Host behavior and network analytics based automotive secure gateway

A system for an automotive security gateway, the system comprising:

• an in-gateway security system that monitors local host behaviors in vehicle devices to identify anomalous local host behaviors, the in-gateway security system including:
• a system scanner that scans each of the vehicle devices to identify in-gateway services;
• and
• a blueprint modelling system trained to recognize secure local host behaviors;
• an out-of-gateway security system that monitors network traffic across remote hosts, local devices, hotspot network, in-car network to identify anomalous behaviors, the out-of-gateway security system including:
• a network screen that scans the network traffic to identify out-of-gateway services;
• and
• a deep packet inspector that performs deep packet inspection to inspect packets of the network traffic to identify packet attributes including a packet source address and a packet destination address;
• a threat mitigation system to issue threat mitigation instructions corresponding to the identified anomalous local host behaviors and the anomalous remote host behaviors to secure the vehicle devices by removing the identified anomalous local host behaviors and the anomalous remote host behaviors;
• and
• automotive security gateway services and vehicle electronic control units operating the vehicle devices according to the threat mitigation instructions.

A method for securing an automotive security gateway, the method comprising:

• monitoring local host behaviors in vehicle devices with an in-gateway security system to identify anomalous local host behaviors using a blueprint model trained to recognize secure local host behaviors;
• monitoring network traffic across remote hosts, local devices, hotspot network, and in-car network to identify anomalous behaviors using deep packet inspection to inspect packets of the network;
• issuing threat mitigation instructions corresponding to the identified anomalous local host behaviors and the anomalous remote host behaviors with a threat mitigation system to secure the vehicle devices by removing the identified anomalous local host behaviors and the anomalous remote host behaviors;
• and
• operating the vehicle devices using automotive security gateway services and electronic control units of a vehicle according to the threat mitigation instructions.