An attack detection device includes a transceiver and a processor. The transceiver receives a message from a communication device in a network. The processor calculates, according to a reception time of a first message in periodic messages that are periodically transmitted in a specified transmission cycle in the network, a reception range for a target message in the periodic messages that are received after the first message by the transceiver. When the transceiver receives a second message that is associated with information indicating that the second message is transmitted at a time interval shorter than the transmission cycle outside of the reception range after the reception time of the first message, the processor updates the reception range for a target message in the periodic messages that are received after the second message by the transceiver according to a reception time of the second message and the transmission cycle.