Abstract: A system for in-vehicle network intrusion detection includes: (i) an anomaly detection module configured to obtain one or more network messages from one or more communication buses of a vehicle describing one or more events associated with the vehicle and detect whether at least some of the one or more events constitute an anomaly based on predefined rules to provide detected anomaly event data; (ii) a resident log generation module configured to generate one or more resident incident logs based on the detected anomaly event data, wherein the one or more resident incident logs comprise metadata associated with one or more detected anomalous events; and (iii) a transmitted log generation module configured to generate one or more transmitted incident logs based on the one or more resident incident logs, wherein each of the one or more transmitted incident logs corresponds to a resident incident log.

Abstract: A system for in-vehicle network intrusion detection includes: (i) an anomaly detection module configured to obtain one or more network messages from one or more communication buses of a vehicle describing one or more events associated with the vehicle and detect whether at least some of the one or more events constitute an anomaly based on predefined rules to provide detected anomaly event data; (ii) a resident log generation module configured to generate one or more resident incident logs based on the detected anomaly event data, wherein the one or more resident incident logs comprise metadata associated with one or more detected anomalous events; and (iii) a transmitted log generation module configured to generate one or more transmitted incident logs based on the one or more resident incident logs, wherein each of the one or more transmitted incident logs corresponds to a resident incident log.