An event type estimation system includes a log aggregation unit that generates time-series data representing the fluctuation in traffic to a site from log data, a deviation testing unit that extracts an interval showing an anomalous fluctuation from the time-series data, a waveform decomposition unit that optimizes a peak waveform, a normal waveform and a vertical waveform set by a waveform setting unit, in order to approximate the fluctuation in traffic in the interval extracted by the deviation testing unit with a composite of the peak waveform, the normal waveform and the vertical waveform, and an event determination unit that determines the type of event that caused the anomalous fluctuation, based on the waveforms optimized by the waveform decomposition unit and the rules of a rule recording unit. The event type estimation system is thereby able to extract access fluctuation anomalies from log data and estimate the type of event that caused the anomalous fluctuation.