Security device, attack detection method, and program

A gateway (300b) serving as a security device connected to one or multiple buses is equipped with: a reception part (410) for receiving a frame from each bus; a holding unit (430) for holding inspection parameters defining inspection content regarding the frame; an update unit (420) for updating each of the inspection parameters held in the holding unit (430) when a predetermined condition related to the frame received by the reception part (410) is met; and an inspection unit (440) for performing inspections on the basis of the inspection parameters held in the holding unit (430), thereby determining whether or not the frame received by the reception part (410) is an attack frame.