A vehicle network intrusion detection device, a system including the same, and a method thereof are provided. The vehicle network intrusion detection device includes a processor that records a receive timestamp of a controller area network (CAN) message for each CAN ID, calculates a residual, which is a difference between a real receive timestamp and an average receive timestamp of the CAN message, using the recorded receive timestamp, and determines whether there is a vehicle network intrusion based on the residual and a storage storing at least one of the CAN message receive timestamp, the residual, or the result of detecting the intrusion.