A network monitoring system in which at least one abnormality detection agent and an abnormality detection control apparatus monitor virtual network functions, wherein the abnormality detection control apparatus includes: a performance information database configured to accumulate actual performance information during normal operation for each virtual network function of the virtual network functions; prediction means for predicting performance information of a virtual network function to be generated using the actual performance information accumulated in the performance information database; and control means for generating and loading an abnormality detection agent for the virtual network function on a virtualization infrastructure, as an application to monitor the virtual network function, into the virtualization infrastructure, and for reconfiguring or deleting the abnormality detection agent, and the abnormality detection agent for the virtual network function includes: collection means for collecting actual performance information of the virtual network function on the virtualization infrastructure; abnormality determination rule designing means for generating an abnormality determination rule that is to serve as a reference for determining whether or not the actual performance information of the virtual network function on the virtualization infrastructure falls within an allowed range that is set based on the performance information predicted by the prediction means; analyzing means for performing abnormality determination using the actual performance information of the virtual network function collected by the collection means and the abnormality determination rule generated by the abnormality determination rule designing means; and notification means for outputting an abnormality notification if the result of the abnormality determination by the analyzing means is that there is an abnormality. a performance information database configured to accumulate actual performance information during normal operation for each virtual network function of the virtual network functions; prediction means for predicting performance information of a virtual network function to be generated using the actual performance information accumulated in the performance information database; and control means for generating and loading an abnormality detection agent for the virtual network function on a virtualization infrastructure, as an application to monitor the virtual network function, into the virtualization infrastructure, and for reconfiguring or deleting the abnormality detection agent, and the abnormality detection agent for the virtual network function includes: collection means for collecting actual performance information of the virtual network function on the virtualization infrastructure; abnormality determination rule designing means for generating an abnormality determination rule that is to serve as a reference for determining whether or not the actual performance information of the virtual network function on the virtualization infrastructure falls within an allowed range that is set based on the performance information predicted by the prediction means; analyzing means for performing abnormality determination using the actual performance information of the virtual network function collected by the collection means and the abnormality determination rule generated by the abnormality determination rule designing means; and notification means for outputting an abnormality notification if the result of the abnormality determination by the analyzing means is that there is an abnormality. collection means for collecting actual performance information of the virtual network function on the virtualization infrastructure; abnormality determination rule designing means for generating an abnormality determination rule that is to serve as a reference for determining whether or not the actual performance information of the virtual network function on the virtualization infrastructure falls within an allowed range that is set based on the performance information predicted by the prediction means; analyzing means for performing abnormality determination using the actual performance information of the virtual network function collected by the collection means and the abnormality determination rule generated by the abnormality determination rule designing means; and notification means for outputting an abnormality notification if the result of the abnormality determination by the analyzing means is that there is an abnormality.