A monitoring device executes: aggregating a number of messages for each type of message transmitted or received at nodes using test results; classifying the respective messages into either an original message that serves as an origin among messages transmitted and received by a system to be monitored, or a generated message that is generated in the system when the original message is transmitted to any of the plurality of nodes; analyzing a relationship between the original message and the generated message on the basis of a number of messages classified as the original message and a number of messages classified as the generated message, thereby creating a matrix indicating the relationship between the original message and the generated message; and determining that the system has undergone a failure if a value of an element inside the matrix is outside of a normal range.