An unauthorized message in an in-vehicle network is more accurately detected. A detection device includes: a monitoring unit configured to monitor, as target messages, an authorized message being periodically transmitted and the unauthorized message in the in-vehicle network, and monitor a reference message being periodically transmitted; a calculation unit configured to, based on a monitoring result of the monitoring unit, calculate a time difference between a time corresponding to a transmission time of the target message and a time corresponding to a transmission time of the reference message; and a detection unit configured to, based on the time difference calculated by the calculation unit, perform a detection process of detecting the unauthorized message.