Abstract: A system includes a processor and a storage device containing instructions. Execution of the instructions causes the processor to: (1) connect with an onboard system of a vehicle, wherein the onboard system is connectable to a network; (2) collect an activity log generated by the onboard system, wherein the activity log includes log messages indicative of an activity of the onboard system; (3) extract a feature list from the activity log, wherein the feature list includes features and each one of the features includes select information from a corresponding one of the log messages; (4) extract an episode from the feature list, wherein the episode is indicative of the activity of the onboard system; and (5) classify the episode with an episode classification, wherein the episode classification is indicative of an event that occurred during the activity.