A detecting apparatus for detecting extraordinary behavior of a monitoring task executing a number of times on an information processing apparatus, the extraordinary behavior being characterised by an execution of the task with abnormally long processing time, or an extremely short processing time, the apparatus comprising: an obtaining section for obtaining measurement data including an executing timing and an execution time for each occasion of execution of the monitoring task, the executing timing including one of an activating time of an execution of the task and a finishing time of the execution of the task, and the execution time corresponds to a measure of time during which the task is executed in the information processing apparatus without including a waiting time in which it is interrupted by another task, wherein the measured executing timing and execution time for each item of measurement data are allocated to different points in a multi-dimensional space, the apparatus being characterized by further comprising: a distance calculating section for calculating a distance in the multi-dimensional space between a point corresponding to each measurement data on which an executing timing and an execution time are allocated to different coordinates and another measured point place placed in a predetermined reference range; wherein the distance calculating section calculates a distance between a measured point corresponding to each measurement data and other measured points before and after the measured point by a predetermined number by using the executing timing and the execution time values; and a determining section for determining whether extraordinary behavior is performed when the monitoring task corresponding to the measurement data is executed in response to determining that the distance obtained for the point corresponding to the measurement data exceeds a predetermined threshold for the task. an obtaining section for obtaining measurement data including an executing timing and an execution time for each occasion of execution of the monitoring task, the executing timing including one of an activating time of an execution of the task and a finishing time of the execution of the task, and the execution time corresponds to a measure of time during which the task is executed in the information processing apparatus without including a waiting time in which it is interrupted by another task, wherein the measured executing timing and execution time for each item of measurement data are allocated to different points in a multi-dimensional space, the apparatus being characterized by further comprising: a distance calculating section for calculating a distance in the multi-dimensional space between a point corresponding to each measurement data on which an executing timing and an execution time are allocated to different coordinates and another measured point place placed in a predetermined reference range; wherein the distance calculating section calculates a distance between a measured point corresponding to each measurement data and other measured points before and after the measured point by a predetermined number by using the executing timing and the execution time values; and a determining section for determining whether extraordinary behavior is performed when the monitoring task corresponding to the measurement data is executed in response to determining that the distance obtained for the point corresponding to the measurement data exceeds a predetermined threshold for the task. a distance calculating section for calculating a distance in the multi-dimensional space between a point corresponding to each measurement data on which an executing timing and an execution time are allocated to different coordinates and another measured point place placed in a predetermined reference range; wherein the distance calculating section calculates a distance between a measured point corresponding to each measurement data and other measured points before and after the measured point by a predetermined number by using the executing timing and the execution time values; and a determining section for determining whether extraordinary behavior is performed when the monitoring task corresponding to the measurement data is executed in response to determining that the distance obtained for the point corresponding to the measurement data exceeds a predetermined threshold for the task.