Abstract: A method at a computing device, the method including receiving security sensor data; normalizing the security sensor data to create normalized security sensor data; determining that an anomaly exists within the normalized security sensor data; and generating an alert based on the determining. Also, computing device comprising a processor, and a communications subsystem, where the computing device is configured to receive security sensor data; normalize the security sensor data to create normalized security sensor data; determine that an anomaly exists within the normalized security sensor data; and generate an alert based on the determining.

Abstract: A method at a computing device, the method including placing a trace on a plurality of behaviors within a kernel on the computing device; generating data from the trace; assembling the data into an event; and formatting the event into a security sensor output. Further, a computing device having a processor and communications subsystem, wherein the computing device is configured to place a trace on a plurality of behaviors within a kernel on the computing device; generate data from the trace; assemble the data into an event; and format the event into a security sensor output.

Abstract: The present disclosure provides, in an aspect, a computer implemented method for monitoring a current use of a vehicle in real-time based on historical vehicle use, the method including acquiring, for a vehicle, historical vehicle data indicative of prior vehicle use; generating, using the historical vehicle data, a historical baseline characterizing a historical use of the vehicle; assessing a current use of the vehicle based on the historical baseline, and generating an alert based on the assessment.