An apparatus collects log data for each function; analyzes the log data to determine, for each function, whether a delay is present in a path of the function; classifies, for each function, one or more of a normal interval and an abnormal interval of the function based on the analyzed log data; defines, as an aggregation interval, a time interval at which two or more functions have an abnormal interval and one or more functions have a normal interval; identifies the one or more modules of paths of each function during the aggregation interval; and detects, as an abnormal module, a module that is present in two or more paths of functions with abnormal intervals during the aggregation interval and is not present in any path of the functions with normal intervals during the aggregation interval.