a communicator that communicates with a plurality of vehicles to receive logs of a plurality of in-vehicle networks included in the plurality of vehicles;

a processor; and

a memory including at least one set of instructions that, when executed by the processor causes the processor to perform operations including:

performing a first determination of determining whether a first anomaly is occurring in a frame received on a first in-vehicle network of a first vehicle among the plurality of vehicles, based on information indicated in the logs received by the communicator, the first vehicle being the vehicle that communicates with the communicator;

selecting, when it is determined in the performing of the first determination that the first anomaly is occurring in the frame received on the first in-vehicle network of the first vehicle, an anomaly-related vehicle from among the plurality of vehicles based on the first anomaly occurring in the frame received on the first in-vehicle network of the first vehicle;

transmitting, to the anomaly-related vehicle via the communicator, a first request to transmit a second log of an in-vehicle network included in the anomaly-related vehicle; and

performing a second determination of determining whether a second anomaly is occurring in a frame received on a second in-vehicle network of the anomaly-related vehicle, based on information indicated by the second log transmitted from the anomaly-related vehicle in response to the first request and received by the communicator,

wherein the operations further include:

selecting, as the first vehicle, a first sample vehicle from among the plurality of vehicles, the first sample vehicle being a monitoring target vehicle for detecting a vehicle in which an anomaly is occurring,

transmitting a second request to transmit a first log of the first in-vehicle network included in the first sample vehicle to the first sample vehicle via the communicator,

in the performing the first determination, whether the first anomaly is occurring to the first sample vehicle is determined based on information indicated by the first log transmitted from the first sample vehicle in response to the second request and received by the communicator,

wherein, the anomaly-related vehicle includes an in-vehicle network including Electronic Control Units (ECUs) having a same configuration as the first vehicle determined as having the first anomaly or having a same arrangement as the first in-vehicle network of the first vehicle determined as having the first anomaly.