[Problem] An abnormality cause route in a network can be efficiently specified, and labor and a cost required for work can be reduced.
[Solution] An abnormality cause specification support system 101 includes: a storage device 203 that holds communication relation information 401 in which a communication history between terminals 20 belonging to a predetermined network 10 is stored separately according to presence and absence of a session in the communication, and a policy 601 for specifying an abnormality cause route occurring in the network 10; and an arithmetic device 201 that specifies, among the communication history indicated by the communication relation information 401, a communication history indicating a condition defined in the policy 601 and a predetermined degree of conformity, and specifies a route between the terminals indicated by the specified communication history as an abnormal cause route to be considered with priority in the network 10.