System and method for protecting electronics systems of a vehicle from cyberattacks

A computer system for protecting electronics systems of a vehicle from cyberattacks, the computer system comprising:

• a plurality of electronic control units (ECUs), wherein each of the plurality of ECUs belong to one of:
• primary electronic systems and auxiliary electronic systems of the vehicle;
• a first communications bus configured to communicatively couple the plurality of ECUs;
• and
• a hardware processor configured to:
• intercept a plurality of messages transmitted on the first communications bus between the plurality of ECUs of a vehicle;
• determine at least one recipient ECU that is a recipient of the intercepted messages;
• store, in a log, the intercepted messages and information identifying the least one recipient ECU;
• detect a cyberattack on the vehicle based on satisfaction of at least one condition of a rule by the stored messages and the information stored in the log, wherein the rule depends on whether one or more intercepted messages are malicious messages and a recipient ECU of the malicious messages;
• and
• block the detected cyberattack on the vehicle by performing an action associated with the rule, wherein the hardware processor configured to block the detected cyberattack is further configured to block a transmission of at least one message between the ECUs.

A non-transitory computer readable medium comprising computer executable instructions for protecting electronics systems of a vehicle from cyberattacks, including instructions for:

• intercepting a plurality of messages transmitted on a first communications bus between a plurality of Electronic Control Units (ECUs) of a vehicle, wherein the plurality of ECUs are communicatively coupled to the first communications bus and wherein each of the plurality of ECUs belong to one of:
• primary electronic systems and auxiliary electronic systems of the vehicle;
• determining at least one recipient ECU that is a recipient of the intercepted messages;
• storing, in a log, the intercepted messages and information identifying the least one recipient ECU;
• detecting a cyberattack on the vehicle based on satisfaction of at least one condition of a rule by the stored messages and the information stored in the log, wherein the rule depends on whether one or more intercepted messages are malicious messages and a recipient ECU of the malicious messages;
• and
• blocking the detected cyberattack on the vehicle by performing an action associated with the rule, wherein the blocking of the detected cyberattack further comprises blocking a transmission of at least one message between the ECUs.