Abstract: The present application discloses method and system for detecting potential security attacks against a vehicle networking through an OBD-II port. The system establishes an inbound OBD-II CAN message whitelist and an outbound OBD-II CAN message blacklist, respectively. Upon receipt of a CAN message command, the system updates statistics for the command and determines whether the command is inbound or outbound. In response to an inbound command from a device external to the vehicle, the system compares the inbound command with the whitelist and forwards the inbound CAN message command to the vehicle via the vehicle's OBD-II port when inbound command appears in the whitelist. In response to an outbound CAN message command from the vehicle, the system compares the outbound command with the blacklist and prevents the outbound command from being sent to an external vehicle via the vehicle's OBD-II port when the outbound command appears in the blacklist.