Fleet monitoring

A system for providing security to a fleet of vehicles, the vehicles being real vehicles, the system comprising:

• a plurality of modules, each module configured to monitor messages propagating in an in-vehicle network of one vehicle, which is the vehicle the module is present on, comprised in the fleet, the in-vehicle network having a bus and at least one node connected to the bus, each module comprising:
• at least one communication port connectable to a portion of the in-vehicle network, via which the module receives and transmits messages;
• a memory having data characterizing messages that the at least one node transmits and receives during normal operation of the node, and software executable to:
• identify, responsive to the data characterizing messages and messages received from the in-vehicle network, an anomaly in communications over the in-vehicle communication network;
• and
• instruct a communication interface, configured to support communication with an entity eternal to the vehicle, to transmit monitoring data reponsive to the received messages;
• and
• a procesor configured to execute the software in the memory;
• and
• a data monitoring and processing hub eternal to the vehicles comprised in the fleet and operable to receive transmission of monitoring data from the plurality of modules and process data in the monitoring data to identify whether within a same specified timeframe a plurality of vehicles having messages monitored by the modules is subject to a same probability of failure of a vehicle control system or component and wherein none of the processed data is generated from a message in a communication that the hub instructed a vehicle in the fleet to initiate with a suspected source of malware that the hub identified.

A system for providing security to a fleet of vehicles, the vehicles being real vehicles, the system comprising:

• a plurality of modules, each module configured to monitor messages propagating in an in-vehicle network of one vehicle, which is the vehicle the module is present on, comprised in the fleet, the in-vehicle network having a bus and at least one node connected to the bus, each module comprising:
• at least one communication port connectable to a portion of the in-vehicle network, via which the module receives and transmits messages;
• a memory having data characterizing messages that the at least one node transmits and receives during normal operation of the node, and software executable to:
• identify an anomaly in communications over the in-vehicle communication network responsive to the data characterizing messages, messages received from the in-vehicle network, and an operation context of the vehicle during transmission of the received messages over the in-vehicle communications network;
• and
• instruct a communication interface, configured to support communiation with an entity external to the vehicle, to transmit monitoring data responsive to the received messages;
• and
• a processor configured to execute the software in the memory;
• and
• a data monitoring and processing hub external to the vehicles comprised in the fleet and operable to receive transmission of monitoring data from the plurality of modules and process data in the monitoring data to identify whether within a same specified timeframe a plurality of vehicles having messages monitored by the modules is subject to a same cyber attack and wherein none of the processed data is generated from a message in a communication that the hub instructed a vehicle in the fleet to initiate with a suspected source of malware that the hub identified.