A network monitoring system comprising: a prediction unit configured to acquire information needed for detecting an abnormality in a virtual network function provided in a virtualization infrastructure, and predict performance information of a virtual network function that is to be newly provided and monitored; a generation unit configured to generate an abnormality determination rule to serve as a reference for determining whether or not actual performance information of a virtual network function falls within an allowed range that is set based on the predicted performance information; a determination unit configured to perform abnormality determination using the actual performance information of the virtual network function and the abnormality determination rule; and an output unit configured to output an abnormality notification if it is determined by the determination unit that there is an abnormality.