A communication system comprising a detection device (120, 220), a relay device and a mitigation system comprising: a plurality of types of mitigation devices which execute a defense function against an attack; and a control device which selects, if the detection device (120, 220) detects that an attack has been performed on a network that is being monitored (100, 200), one of the plurality of types of mitigation devices, which executes a defense function in accordance with the type of the attack, wherein the mitigation system is characterized in that the defense functions executed in the plurality of types of mitigation devices are different respectively, and the control device selects the mitigation device which executes a defense function in accordance with a combination of the type of the attack and the network that is being monitored, the selected mitigation device instructs the relay device in a backbone network to change a route, the relay device connects the backbone network to a network that is connected to a communication device (320, 330) that attacks the network that is being monitored, the relay device performs route control that relays communication of the attack transmitted from the communication device that attacks the network that is being monitored to the network that is being monitored to the selected mitigation device, the detection device is disposed in the network that is being monitored, the detection device is disposed apart from the control device and the plurality of types of mitigation devices, the control device and the plurality of types of mitigation devices are disposed in the backbone network, and the attack indicated by the type of the attack includes a DoS attack. a plurality of types of mitigation devices which execute a defense function against an attack; and a control device which selects, if the detection device (120, 220) detects that an attack has been performed on a network that is being monitored (100, 200), one of the plurality of types of mitigation devices, which executes a defense function in accordance with the type of the attack, wherein the mitigation system is characterized in that the defense functions executed in the plurality of types of mitigation devices are different respectively, and the control device selects the mitigation device which executes a defense function in accordance with a combination of the type of the attack and the network that is being monitored, the selected mitigation device instructs the relay device in a backbone network to change a route, the relay device connects the backbone network to a network that is connected to a communication device (320, 330) that attacks the network that is being monitored, the relay device performs route control that relays communication of the attack transmitted from the communication device that attacks the network that is being monitored to the network that is being monitored to the selected mitigation device, the detection device is disposed in the network that is being monitored, the detection device is disposed apart from the control device and the plurality of types of mitigation devices, the control device and the plurality of types of mitigation devices are disposed in the backbone network, and the attack indicated by the type of the attack includes a DoS attack.