Systems and methods for detection of malicious activity in vehicle data communication networks

A computing unit for identifying an indication of malicious activity that changes integrity of data sent out from a vehicle, comprising:

• a program store storing code;
• and
• a processor coupled to the program store for implementing the stored code, the code comprising:
• code to intercept, by an output data monitoring agent that monitors data sent out from the vehicle to an external receiving computing unit using a communication interface in communication with a network, and collect the data;
• code to intercept, by at least one sensor data monitoring agent that monitors sensor data outputted by at least one sensor associated with the vehicle, and collect the sensor data;
• wherein the data sent out from the vehicle is based on the sensor data, wherein the data sent out from the vehicle is intercepted by the output data monitoring agent prior to being processed by the receiving computing unit;
• and
• code to monitor the integrity of the data sent out from the vehicle by analyzing the data collected by the output data monitoring agent with the sensor data collected by the at least one sensor data monitoring agent, wherein the analyzing comprises converting the sensor data to a format used for transmission of the data sent out from the vehicle over the network and comparing the converted sensor data and the data intercepted by the output data monitoring agent to identify a mismatch, identify an indication of malicious activity that changed the data sent out from the vehicle relative to the data sensed by the at least one sensor;
• and provide an output message indicative of the malicious activity.

A computer program product comprising a non-transitory computer readable storage medium storing program code thereon for implementation by at least one processor of a computing unit, for detecting an indication of malicious activity that changes integrity of data sent out from a vehicle, comprising:

• program instructions to intercept, by an output data monitoring agent that monitors data sent out from the vehicle to an external receiving computing unit using a communication interface in communication with a network, and collect the data;
• program instructions to intercept, by at least one sensor data monitoring agent that monitors sensor data outputted by at least one sensor associated with the vehicle, and collect the sensor data;
• wherein the data sent out from the vehicle is based on the sensor data, wherein the data sent out from the vehicle is intercepted by the output data monitoring agent prior to being processed by the receiving computing unit;
• program instructions to monitor the integrity of the data sent out from the vehicle by analyzing the data collected by the output data monitoring agent with the sensor data collected by the at least one sensor data monitoring agent, wherein the analyzing comprises converting the sensor data to a format used for transmission of the data sent out from the vehicle over the network and comparing the converted sensor data and the data intercepted by the output data monitoring agent to identify a mismatch;
• program instructions to identify an indication of malicious activity that changed the data sent out from the vehicle relative to the data sensed by the at least one sensor;
• and program instructions to provide an output message indicative of the malicious activity.