Detecting vehicle malfunctions and cyber attacks using machine learning

One or more non-transitory computer-readable storage media including instructions that, when executed by one or more processors, cause the one or more processors to perform the steps of:

• determining, using a first model, a first predicted value of a first variable message associated with a vehicle;
• determining, using a second model different from the first model, a second predicted value of the first variable message associated with the vehicle, wherein the first model and the second model are selected based on resilience to one or more types of cyber attacks;
• determining, based on a difference between an actual value of the first variable message and the first predicted value of the first variable message and on a difference between the actual value of the first variable message and the second predicted value of the first variable message, a vector;
• and
• determining, using a third model, an output value based on the vector, the output value corresponding to at least one of a likelihood that an anomaly or an attack is occurring or a type of the anomaly or the attack.

A system, comprising:

• a memory storing an application;
• and
• one or more processors that, when executing the application, is configured to:
• determine, using a first model, a first predicted value of a first variable message associated with a vehicle;
• determine, using a second model different from the first model, a second predicted value of a second variable message associated with the vehicle, wherein the first model and the second model are selected based on resilience to one or more types of cyber attacks;
• determine, based on a difference between an actual value of the first variable message and the first predicted value of the first variable message and on a difference between an actual value of the second variable message and the second predicted value of the second variable message, a vector;
• and
• determine, using a third model, an output value based on the vector, the output value corresponding to at least one of a likelihood that an anomaly or an attack is occurring or a type of the anomaly or the attack.