1 ) An anomaly detection system comprising means for monitoring a program for a fault on the basis of a probabilistic model to automatically detect a fault, said program being run through cooperation between computers in a computer system forming a network consisting of a plurality of computers, said anomaly detection system further comprising: a plurality of computers providing services associated with said program; an agent device associating and recording transactions with a service, said transactions being processes of said service performed by each of said plurality of computers in response to a call from a program running on another of said plurality of computers; and an anomaly monitoring server connected to said network, comprising, a transaction collecting section collecting transactions recorded by said agent device from each of said plurality of computers; a correlation matrix calculating section outputting a node correlation matrix calculated from said transactions collected from each of said plurality of computers; an activity vector calculating section calculating an activity vector by solving an eigenequation specific to said node correlation matrix; a probability estimating section estimating the probability of occurrence of said activity vector; and a fault detecting section calculating an outlier measure of the activity vector from a probability density estimated by said probability estimating section to automatically detect a fault in the program being run through cooperation between said plurality of computers.