Provided is an information processing device that includes a processor and has a capability to detect abnormalities on an in-vehicle network that may be caused by an attack. The processor receives input of data elements to be used as training data, normalizes the training data so as to be distributed within a first region, divides a multi-dimensional second region that encompasses the first region into third regions that are hypercubes of equal sizes, obtains S data elements that are contained by each of the third regions, and for each third region that includes a number of data elements that is less than a first threshold value T, adds noise elements that are vectors with a uniform distribution to the third regions, generates noise-added training data including the vectors in the second region, and generates and outputs Isolation Forest learning model data by using the generated noise-added training data.