The invention relates to a method for evaluating at least one data set of at least one component of an automation system, characterized by the incorporation and/or execution of the following steps: determining an interval between two anomalous events in a first data set, said first data set comprising data based on at least one first component of the automation system, and determining repeating events which are spaced according to the interval in a second data set, said second data set comprising at least one second component of the automation system.