An apparatus detects detecting when an extraordinary behavior is performed when a monitoring task is executed on an information processing apparatus. The detecting apparatus includes: an obtaining section for obtaining a measurement data including an executing timing and an execution time for each occasion of execution when the monitoring task is executed for a number of times on the information processing apparatus; a distance calculating section for calculating a distance between a measured point corresponding to each measurement data in a multi-dimensional space on which an executing timing and an execution time are allocated to different coordinates and another measured point placed in a predetermined range; and a determining section for determining whether an extraordinary behavior is performed when the monitoring task corresponding to the measurement data is executed based on the distance obtained for the measured point corresponding to the measurement data.