A method for detection of abnormal conditions, in particular caused by manipulation, in a computer network which comprises a plurality of computers (1a, 1b, 1c), a) wherein protocols are created by the computers (1a, 1b, 1c) of the computer network or by processes (2a, 2b, 2c) run on these computers (1a, 1b, 1c), b) wherein, when predefined events occur, a protocol data record in the form of a protocol line (3a, 3b, 3c) is created by the computers (1a, 1b, 1c) or the processes (2a, 2b, 2c) for each of these events and consists of a timestamp (31a, 31b,31c) and a description data record (32a, 32b, 32c) of the particular protocolled event, c) wherein the protocol lines (3a, 3b, 3c) created by the computers (1a, 1b, 1c) or processes (2a, 2b, 2c) are stored in a protocol file (4a, 4b, 4c) associated with the computer (1a, 1b, 1c) or process (2a, 2b, 2c), d) wherein the protocol lines (3a, 3b, 3c) from the individual protocol files (4a, 4b, 4c) are homogenised in that they are written into a central protocol file in a uniform format, in particular in lines with a uniform timestamp format and chronologically ordered based on the timestamp (31a, 31b, 31c), e) wherein a recoded protocol file of the central protocol file is created in that symbols or symbol chains of the central protocol file following one another in lines are transferred into symbols or symbol chains of the recoded protocol file following one another on account of the same, predefined, in particular lossy coding stipulation (f), f) wherein in particular within the scope of the recoding, the order of the information contained in the individual symbols within the description data record of the individual protocol lines (3a, 3b, 3c) is maintained, preferably the number of symbols used to describe the content is reduced, g) wherein the individual lines (5a, 5b, 5c) of the recoded protocol file are analysed in respect of their similarity and are combined on the basis of their similarity to form groups (6a, 6b, 6c), h) wherein a search is performed for groups (6a, 6b, 6c) having a small number of lines (5a, 5b, 5c), in particular having just a single line (5a, 5b, 5c), and i) if such lines (5a, 5b, 5c) are present, an abnormal condition in the computer network is identified. a) wherein protocols are created by the computers (1a, 1b, 1c) of the computer network or by processes (2a, 2b, 2c) run on these computers (1a, 1b, 1c), b) wherein, when predefined events occur, a protocol data record in the form of a protocol line (3a, 3b, 3c) is created by the computers (1a, 1b, 1c) or the processes (2a, 2b, 2c) for each of these events and consists of a timestamp (31a, 31b,31c) and a description data record (32a, 32b, 32c) of the particular protocolled event, c) wherein the protocol lines (3a, 3b, 3c) created by the computers (1a, 1b, 1c) or processes (2a, 2b, 2c) are stored in a protocol file (4a, 4b, 4c) associated with the computer (1a, 1b, 1c) or process (2a, 2b, 2c), d) wherein the protocol lines (3a, 3b, 3c) from the individual protocol files (4a, 4b, 4c) are homogenised in that they are written into a central protocol file in a uniform format, in particular in lines with a uniform timestamp format and chronologically ordered based on the timestamp (31a, 31b, 31c), e) wherein a recoded protocol file of the central protocol file is created in that symbols or symbol chains of the central protocol file following one another in lines are transferred into symbols or symbol chains of the recoded protocol file following one another on account of the same, predefined, in particular lossy coding stipulation (f), f) wherein in particular within the scope of the recoding, the order of the information contained in the individual symbols within the description data record of the individual protocol lines (3a, 3b, 3c) is maintained, preferably the number of symbols used to describe the content is reduced, g) wherein the individual lines (5a, 5b, 5c) of the recoded protocol file are analysed in respect of their similarity and are combined on the basis of their similarity to form groups (6a, 6b, 6c), h) wherein a search is performed for groups (6a, 6b, 6c) having a small number of lines (5a, 5b, 5c), in particular having just a single line (5a, 5b, 5c), and i) if such lines (5a, 5b, 5c) are present, an abnormal condition in the computer network is identified.