Network abnormality detection

Patent Pending PROBLEM TO BE SOLVED: To provide a system which specifies an observation type (packet) to be the cause of an abnormality of network traffic and specifies a true abnormality cause host. ; SOLUTION: The system has: a featured value generation part 101 which generates the featured value with the number of packets by every traffic type counted by every time slot as the featured value; a packet dump part 102 which stores observation packets; a correlation coefficient calculation part 103 which calculates a correlation coefficient among respective elements with the traffic type as elements using the featured value.