PROBLEM TO BE SOLVED: To provide an abnormality detection program, an abnormality detection device, and an abnormality detection method that efficiently detect abnormal operation.SOLUTION: An abnormality detection program causes a computer to: generate correspondence information in which an event caused as a plurality of processes executed on the computer are executed is made to correspond to each process upon the basis of information on access to a system resource by the computer; generate work identification information for identifying work from the event made to correspond to the process corresponding to the work by reference to the correspondence information for each work in which the processes are executed and then store the information in a storage part; and determine abnormality as to first work if work identification information generated from the first work is different from work identification information associated with a first process stored in the storage part when the first work executing the first process executed on the computer is performed.SELECTED DRAWING: Figure 5