An information processing device includes: a storage that stores determination criterion information indicating a determination criterion for determining whether or not a behavior of an application operating on a device provided to a vehicle is normal; and a detector that obtains behavior information indicating the behavior of the application, and detects an anomaly in the behavior of the application, based on (i) state information that indicates a state of the mobility and is obtained via the mobility network and (ii) the behavior information obtained and the determination criterion information stored in the storage.