Centralized detection techniques for cyber-attacks directed at connected vehicles

A non-transitory computer readable medium having stored thereon instructions for causing a processing circuitry to execute a process, the process comprising:

• classifying a behavior of a connected vehicle into at least one classification with respect to a location of data transmission relative to the connected vehicle, wherein the at least one classification includes any of local and remote;
• determining a plurality of vehicle-related cyber-attack indicators related to the behavior of the connected vehicle;
• performing risk analysis based on a first combination of vehicle-related cyber-attack indicators and the at least one classification, wherein the first combination of vehicle-related cyber-attack indicators is a combination of at least a portion of the plurality of vehicle-related cyber-attack indicators, wherein performing the risk analysis further comprises matching the first combination to a plurality of second combinations of cyber-attack indicators of a plurality of known attack patterns, wherein each of the plurality of known attack patterns has at least one classification matching the at least one classification of the connected vehicle;
• wherein performing the risk analysis further comprises generating a risk score for each of the plurality of vehicle-related cyber-attack indicators;
• wherein performing the risk analysis further comprises generating an aggregated risk score based on the risk score generated for each vehicle-related cyber-attack indicator of the first combination;
• and
• performing at least one mitigation action based on the aggregated risk score.

A system for detecting and mitigating cyber-attacks directed to connected vehicles, comprising:

• a processing circuitry;
• and
• a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
• classify a behavior of a connected vehicle into at least one classification with respect to a location of data transmission relative to the connected vehicle, wherein the at least one classification includes any of local and remote;
• determine a plurality of vehicle-related cyber-attack indicators related to the behavior of the connected vehicle;
• perform risk analysis based on a first combination of vehicle-related cyber-attack indicators and the at least one classification, wherein the first combination of vehicle-related cyber-attack indicators is a combination of at least a portion of the plurality of vehicle-related cyber-attack indicators, wherein performing the risk analysis further comprises matching the first combination to a plurality of second combinations of cyber-attack indicators of a plurality of known attack patterns, wherein each of the plurality of known attack patterns has at least one classification matching the at least one classification of the connected vehicle;
• wherein the system is further configured to generate a risk score for each of the plurality of vehicle-related cyber-attack indicators;
• wherein the system is further configured to generate an aggregated risk score based on the risk score generated for each vehicle-related cyber-attack indicator of the first combination;
• and
• perform at least one mitigation action based on the aggregated risk score.