A computer-implemented method to identify irregularities in the distribution of electronic files within provider networks, wherein each provider network comprises at least one server computer which is adapted to distribute the electronic files to a multitude of client computers within the provider network, characterized in that the method comprises the following steps: a. defining, by a selection unit in a data analysis device, a number N of discrete time periods t 1... t N, b. selecting, by the selection unit, out of the electronic files a specific query file, c. selecting, by the selection unit, a set of D provider networks, wherein the number D is equal or larger than three, d. acquiring, by an acquisition unit in the data analysis device, from the D server computers associated with the D selected provider networks, a set of time series data streams p(t) = p 1 (t), p 2 (t),..., p D (t), which are indicative of a common metric that has been associated to the query file, e. performing, by a transformation unit in the data analysis device, an isometric logratio transformation on p(t) to compute a compositional data set z(t) = z 1 (t), z 2 (t),..., z D (t), f. filtering, by a filtering unit in the data analysis device, the values of z(t) = z 1 (t), z 2 (t),..., z D (t) using a local robust filtering model to compute local estimates μ ̃ t = μ 1 ̃ t, μ 2 ̃ t..., μ D ̃ t, wherein repeated median regression is applied by the filtering unit and the choice of the regression window width is based on a test of the slopes of the regression line within the window using the SCARM (Slope Comparing Adaptive Repeated Median) method, g. computing, by an outlier detection unit in the data analysis device, the residuals r l t = z l t − μ l ̃ t for I=1, 2,..., D, and performing a multivariate outlier detection on r l ( t) to calculate an outlier metric, h. comparing, by an evaluation and reporting unit in the data analysis device, the calculated outlier metric with historical or predetermined threshold values, and identifying irregularities if the threshold values are exceeded. a. defining, by a selection unit in a data analysis device, a number N of discrete time periods t 1... t N, b. selecting, by the selection unit, out of the electronic files a specific query file, c. selecting, by the selection unit, a set of D provider networks, wherein the number D is equal or larger than three, d. acquiring, by an acquisition unit in the data analysis device, from the D server computers associated with the D selected provider networks, a set of time series data streams p(t) = p 1 (t), p 2 (t),..., p D (t), which are indicative of a common metric that has been associated to the query file, e. performing, by a transformation unit in the data analysis device, an isometric logratio transformation on p(t) to compute a compositional data set z(t) = z 1 (t), z 2 (t),..., z D (t), f. filtering, by a filtering unit in the data analysis device, the values of z(t) = z 1 (t), z 2 (t),..., z D (t) using a local robust filtering model to compute local estimates μ ̃ t = μ 1 ̃ t, μ 2 ̃ t..., μ D ̃ t, wherein repeated median regression is applied by the filtering unit and the choice of the regression window width is based on a test of the slopes of the regression line within the window using the SCARM (Slope Comparing Adaptive Repeated Median) method, g. computing, by an outlier detection unit in the data analysis device, the residuals r l t = z l t − μ l ̃ t for I=1, 2,..., D, and performing a multivariate outlier detection on r l ( t) to calculate an outlier metric, h. comparing, by an evaluation and reporting unit in the data analysis device, the calculated outlier metric with historical or predetermined threshold values, and identifying irregularities if the threshold values are exceeded.