A port hopping flow detection system includes a storage section configured to store flow data for each of past flows of packets which have been transmitted from application programs and an application data for each of the application program. A receiving unit receives a new flow of packets. A detecting unit extracts a flow data for the new flow to store in the storage section, calculates an application data for the new flow from the extracted flow data for the new flow to compare the calculated application data with the application data stored in the storage section, and determines whether the new flow has been subjected to port hopping.