An anomaly detection electronic control unit (ECU) that detects unauthorized messages on a communication path is provided. An ECU that periodically transmits a first-type message including data to be monitored, and an ECU that periodically transmits a second-type message including data for comparison, are connected to the communication path. The anomaly detection ECU includes: a receiver that successively receives first-type and second-type messages; a processor that determines whether a first-type message received is normal or anomalous; and a transmitter that transmits a predetermined message in accordance with results of the determining. The determining is performed based on content of the first-type message, content of a second-type message last received at the time of receiving this first-type message, and at least one of content of a first-type message received further in the past than this first-type message, and content of a second-type message received further in the past than the second-type message last received.