Abstract: A method of providing cyber security for a vehicle includes monitoring, by a cyber security system of the vehicle, a plurality of parameters acquired from at least one communication bus of the vehicle. The parameters are filtered to identify parameters of interest for cyber security threat detection. An evaluation of the parameters of interest is performed with respect to one or more of normal conditions and abnormal conditions to identify at least one likely cyber security threat in the vehicle based on identifying at least one condition that does not match the normal conditions or at least one condition that does match the abnormal conditions. One or more recovery actions are triggered based on identifying the at least one likely cyber security threat in the vehicle.