To deal with user network communication activity which cannot easily and clearly be determined as problematic behavior, a behavior analysis apparatus 14 monitors communication between each user PC 16 in a domain 10 and Internet 20 via a gateway apparatus 12. For example, when there is a monitored item related to information leakage of the user in the detected communication, a weight value corresponding to the monitored item is added to a score concerning a possibility of the user leaking information. Subsequently, the scores are totaled and recorded for each unit of time. The behavior analysis apparatus 14 inputs data of time-series transition of the total value to a neural network which has performed learning for prediction processing, and predicts the possibility of the user's information leak at a time in the near future. When an increasing risk of leakage is predicted, the behavior analysis apparatus 14 communicates an alarm to a security manager.