A network system, comprising: a communication apparatus; and a control apparatus configured to communicate with the communication apparatus via a network, wherein the communication apparatus comprises: a communication control unit configured to control communication going through the communication apparatus; and a collection unit configured to form partial information that is a part of information related to the communication and to transmit the partial information to the control apparatus; the control apparatus comprises: an analysis unit configured to perform analysis by using the partial information received from the communication apparatus and to determine whether or not the communication is abnormal; a control determination unit configured to control a communication route for the communication control unit such that the communication is transmitted from the communication apparatus to the control apparatus when the communication is determined to be abnormal by the analysis unit; and an analyzing unit configured to determine whether or not the communication transmitted by the control of the communication route is malicious communication, and the control determination unit is further configured to control, when the communication is determined to be malicious communication by the analyzing unit, the communication control unit to restrict the malicious communication. a communication apparatus; and a control apparatus configured to communicate with the communication apparatus via a network, wherein the communication apparatus comprises: a communication control unit configured to control communication going through the communication apparatus; and a collection unit configured to form partial information that is a part of information related to the communication and to transmit the partial information to the control apparatus; a communication control unit configured to control communication going through the communication apparatus; and a collection unit configured to form partial information that is a part of information related to the communication and to transmit the partial information to the control apparatus; the control apparatus comprises: an analysis unit configured to perform analysis by using the partial information received from the communication apparatus and to determine whether or not the communication is abnormal; a control determination unit configured to control a communication route for the communication control unit such that the communication is transmitted from the communication apparatus to the control apparatus when the communication is determined to be abnormal by the analysis unit; and an analyzing unit configured to determine whether or not the communication transmitted by the control of the communication route is malicious communication, and an analysis unit configured to perform analysis by using the partial information received from the communication apparatus and to determine whether or not the communication is abnormal; a control determination unit configured to control a communication route for the communication control unit such that the communication is transmitted from the communication apparatus to the control apparatus when the communication is determined to be abnormal by the analysis unit; and an analyzing unit configured to determine whether or not the communication transmitted by the control of the communication route is malicious communication, and the control determination unit is further configured to control, when the communication is determined to be malicious communication by the analyzing unit, the communication control unit to restrict the malicious communication.