A monitoring system for monitoring a monitoring-target system, the monitoring system comprising: one or more storage apparatuses adapted to store a program (211, 221, 231, 232); and one or more processors configured to operate according to the program (211, 221, 231, 232) to: determine an estimated value of a monitoring-target response variable of the monitoring-target system by inputting measurement data included in test data of the monitoring-target system into a first causal structure model of the monitoring-target system, and decide whether an abnormality has occurred in the monitoring-target system on a basis of a result of a comparison between a measured value of the monitoring-target response variable included in the test data and the estimated value of the monitoring-target response variable, characterized in that, the one or more storage apparatuses are adapted to store causal structure models of a plurality of different operational statuses, the one or more processors are configured to select the first causal structure model from the causal structure models of the plurality of different operational statuses on a basis of similarities between an operational status of the monitoring-target system indicated by the test data and the plurality of different operational statuses, the first causal structure model includes a lower-layer node corresponding to the measurement data, a monitoring-target response-variable node that is in a layer higher than the lower-layer node and that corresponds to the monitoring-target response variable, and an intermediate node between the lower-layer node and the monitoring-target response-variable node, and the one or more processors are configured to: determine, as the estimated value, a value of the monitoring-target response-variable node obtained by inputting the measurement data to the lower-layer node, search the first causal structure model for an abnormality-cause-node candidate from the monitoring-target response-variable node along an edge, and decide, in the search, whether each explanatory-variable node whose response-variable node is a node decided as an abnormality-cause-node candidate is an abnormality-cause-node candidate, and to present the abnormality-cause-node candidate to a user. one or more storage apparatuses adapted to store a program (211, 221, 231, 232); and one or more processors configured to operate according to the program (211, 221, 231, 232) to: determine an estimated value of a monitoring-target response variable of the monitoring-target system by inputting measurement data included in test data of the monitoring-target system into a first causal structure model of the monitoring-target system, and decide whether an abnormality has occurred in the monitoring-target system on a basis of a result of a comparison between a measured value of the monitoring-target response variable included in the test data and the estimated value of the monitoring-target response variable, characterized in that, determine an estimated value of a monitoring-target response variable of the monitoring-target system by inputting measurement data included in test data of the monitoring-target system into a first causal structure model of the monitoring-target system, and decide whether an abnormality has occurred in the monitoring-target system on a basis of a result of a comparison between a measured value of the monitoring-target response variable included in the test data and the estimated value of the monitoring-target response variable, characterized in that, the one or more storage apparatuses are adapted to store causal structure models of a plurality of different operational statuses, the one or more processors are configured to select the first causal structure model from the causal structure models of the plurality of different operational statuses on a basis of similarities between an operational status of the monitoring-target system indicated by the test data and the plurality of different operational statuses, the first causal structure model includes a lower-layer node corresponding to the measurement data, a monitoring-target response-variable node that is in a layer higher than the lower-layer node and that corresponds to the monitoring-target response variable, and an intermediate node between the lower-layer node and the monitoring-target response-variable node, and the one or more processors are configured to: determine, as the estimated value, a value of the monitoring-target response-variable node obtained by inputting the measurement data to the lower-layer node, search the first causal structure model for an abnormality-cause-node candidate from the monitoring-target response-variable node along an edge, and decide, in the search, whether each explanatory-variable node whose response-variable node is a node decided as an abnormality-cause-node candidate is an abnormality-cause-node candidate, and to present the abnormality-cause-node candidate to a user. determine, as the estimated value, a value of the monitoring-target response-variable node obtained by inputting the measurement data to the lower-layer node, search the first causal structure model for an abnormality-cause-node candidate from the monitoring-target response-variable node along an edge, and decide, in the search, whether each explanatory-variable node whose response-variable node is a node decided as an abnormality-cause-node candidate is an abnormality-cause-node candidate, and to present the abnormality-cause-node candidate to a user.