An improper communication detection system that acquires packets that are circulated through a plant network by mirroring and detects improper communication includes a storage unit configured to prestore a session whitelist, which is a list of sessions that can be generated in the plant network; a session determination/separation unit configured to make a determination as to a success or failure of session approval on the basis of the acquired packet and configured to generate session information indicating an approved session; and a first improper communication detection unit configured to compare the session information generated by the session determination/separation unit with the session whitelist, and configured to detect communication related to the relevant session as improper communication when the session information does not match any session in the session whitelist.