In a communication system in which a plurality of communication apparatuses perform communication via a communication network, a network abnormality detection system dynamically creates a monitoring rule during operation without defining information (monitoring rule) regarding communication to be monitored in advance and perform a collection process and an abnormality determination process quickly even when an amount of information to be monitored is vast. The network abnormality detection system copies packets transmitted at predetermined measurement positions in the communication network, calculates communication statistics information at each measurement position from the copied packets, analyzes one or more pieces of communication statistics information, and detects occurrence of communication abnormality.