Patent ID: 8140915

Claim:
A detecting apparatus that detects whether or not extraordinary behavior occurred during the execution of monitored tasks on an information processing apparatus, comprising: a cluster storing unit that stores ranges corresponding to clusters into which an execution time of a previously executed monitored task is classified with an upper limit of each cluster being a maximum execution time in the cluster and a lower limit of each cluster being a minimum execution time in the cluster, wherein an upper limit of each range is a maximum of the execution time belonging to the corresponding cluster and a lower limit of each range is a minimum of the execution time belonging to the corresponding cluster; an acquiring unit that acquires the execution time of the monitored task in response to the newly executed monitored task on the information processing apparatus; a determining unit that determines occurrence of an extraordinary behavior during execution of the monitored task if the execution time of the newly executed monitored task does not fall within any of the ranges corresponding to the clusters; and a cluster merging unit that merges a first cluster and a second cluster into a single cluster when execution times for the first and second clusters satisfy a predetermined reference relationship.