Abstract: Disclosed are methods and systems for monitoring and modifying security modules for identifying cyber-security threats. For instance, a method may include partitioning an edge node of an aircraft into an edge node module and a cyber-security module, recording aircraft data corresponding to the aircraft, the aircraft data including log data and associated information, determining based on the aircraft data, that the aircraft has a ground location and that at least one engine of the aircraft is powered off, based on the determining, connecting at least one wireless interface of the edge node of the aircraft to a Centralized Service hosted on a cloud platform, sending the aircraft data to the Centralized Service, receiving at least one current cyber-security module identified by the Centralized Service based on the aircraft data, and modifying, the cyber-security module based on the received at least one current cyber-security module.