Context-aware firewall for in-vehicle cyber security

A module for providing security to a vehicle comprising an in-vehicle communication network having a bus and at least one node connected to the bus, the module comprising:

• a memory having software comprising data characterizing messages that the at least one node transmits and receives via the bus during normal operation of the node;
• a communication port via which the module receives and transmits messages, the port being configured to be connected to a portion of the in-vehicle network;
• and a processor that processes, responsive to the software in the memory, messages received via the port from the portion of the in-vehicle network to:
• 1) accumulate data from the messages received via the port, the data being useable to determine an operating context of the vehicle;
• 2) determine a vehicle context based on the accumulated data, the vehicle context comprising an operating state of the vehicle that is common to each of a plurality of vehicles substantially at a same time;
• 3) based on the determined vehicle context determine if a received message is anomalous;
• and 4) if the received message is determined to be anomalous operate to log data relevant to the message into a memory and/or prevent the message from affecting a node of the at least one node.