An illegal communication detector that is mounted in a communication path between external devices and a protection-targeted device to monitor contents of communications delivered to the protection-targeted device, the illegal communication detector including: a recording unit that records at least part of information transmitted from the external devices to the protection-targeted device; a determination unit that regards one of the external devices as a device of interest; and a communication control unit that detects, if the determination means conclude that at least part of the recorded information complies with the predetermined illegal communication standard rule, that the contents of communication are derived from an illegal communication, and performing a predetermined process concerning the communication with the device of interest.