Method for detecting unauthorised data traffic in a packet-oriented data network of a motor vehicle, wherein at least one data packet (14, 14', 19) respectively, which is transmitted in the data network, is read out of the data network by at least one processor circuit, and header data of the data packet (14, 14', 19) are checked respectively by means of a first test routine to determine whether connection information described by the header data indicates a communication connection which is approved for the operation of the motor vehicle, wherein a vehicle specifiation is taken, as a basis which communication connection is authorised, so that the processor circuit detects on the basis of the header data whether the currently read data packet (14, 14', 19) belongs to a communication connection authorised for the operation of the motor vehicle, in that the first test routine includes that at least one predetermined data element of the header data is selected and a hash value is calculated via each selected data element and a check is carried out as to whether the calculated hash value corresponds to a nominal hash value, wherein for each authorised communication connection respectively at least one nominal hash value is kept available in a data memory, and the first test routine comprises checking the hash value by means of a cuckoo filter and/or by means of a bloom filter, and if the data packet (14, 14', 19) is recognised as belonging to an authorised communication link, payload data of the data packet (14, 14', 19) are checked by means of a second test routine to determine whether data values of the payload data have a value profile which is provided for the communication link, wherein the value profile comprises that the payload data are divided into data segments and for each data segment a numerical value defined by bits of this data segment is determined and a respective frequency value (H') of an absolute or relative frequency of the numerical values occurring in total in the data segments is counted, and if it occurs that an authorised communication connection or an authorised value profile is missing for the data packet (14, 14', 19), a detection signal is generated which signals the data packet (14, 14', 19) to be unauthorised data traffic. and the first test routine comprises checking the hash value by means of a cuckoo filter and/or by means of a bloom filter, and if the data packet (14, 14', 19) is recognised as belonging to an authorised communication link, payload data of the data packet (14, 14', 19) are checked by means of a second test routine to determine whether data values of the payload data have a value profile which is provided for the communication link, wherein the value profile comprises that the payload data are divided into data segments and for each data segment a numerical value defined by bits of this data segment is determined and a respective frequency value (H') of an absolute or relative frequency of the numerical values occurring in total in the data segments is counted, and if it occurs that an authorised communication connection or an authorised value profile is missing for the data packet (14, 14', 19), a detection signal is generated which signals the data packet (14, 14', 19) to be unauthorised data traffic.