An unauthorized intrusion prevention device is provided that, in response to detection of abnormality in an electronic control device mounted in a movable body, gives an instruction for executing measures for the movable body. The unauthorized intrusion prevention device acquires first information related to a protection function of the electronic control device and second information related to a function of the electronic control device other than the protection function. The unauthorized intrusion prevention device, using the first information, performs a first determination of whether the protection function is normal. The unauthorized intrusion prevention device, using the second information, performs a second determination of whether the function other than the protection function is normal or abnormal. The unauthorized intrusion prevention device, using results of first and second determination, determines as the measures a blocking method of blocking unauthorized information in the movable object.