Patent ID: 8271981

Claim:
A detecting apparatus for detecting an extraordinary behavior performed when a monitoring task is executed on an information processing apparatus, the detecting apparatus comprising: a computer processor; and a computer readable tangible storage device coupled to the processor and comprising computer code executable by the computer processor to cause the computer processor to: obtain measurement data including an executing timing and an execution time for each occasion that a monitoring task is executed on an information processing apparatus, wherein each executing timing indicates a specific instance that the monitoring task is executed, and wherein each measurement data corresponds to one of a plurality of measured points; calculate a plurality of distances between a first measured point and a plurality of other measured points placed in a predetermined range of executing timings of the first measured point, wherein the plurality of distances comprises a distance between the first measured point and a second measured point; determine a ratio for reflecting said execution time to said distance based on an average execution interval and an average execution time of said monitoring task; calculate a distance between two measured points by a difference of the executing timings of said two measured points and a value of a difference of said execution time multiplied by said ratio; and determine an extraordinary behavior is performed at the second measured point based on a comparison of the distance between the first measured point and the second measured point, and said plurality of distances, wherein the extraordinary behavior indicates that the distance between the first measured point and the second measured point exceeding a predetermined threshold.