Systems and methods for cyber monitoring and alerting for connected aircraft

A computer system for monitoring network traffic of a connected vehicle, the system comprising:

• a memory storing instructions;
• and
• one or more processors configured to execute the instructions to perform operations including:
• receiving network traffic information from a vehicle gateway, the network traffic information including malicious and/or benign information;
• storing the network traffic information on a data server and periodically updating the network traffic information stored on the data server;
• pre-processing the network traffic information stored on the data server, the pre-processing the network traffic information including filtering and normalizing the network traffic information;
• generating a learning model based on the pre-processed network traffic information, the learning model being generated by an artificial intelligence learning;
• updating the learning model based on additional network traffic information, the additional network traffic information including real-time network data;
• in accordance with the updated learning model, detecting an anomaly event in incoming network data;
• and
• in accordance with detecting the anomaly event in the incoming network data, generating a notification and/or blocking one or more packets associated with the incoming network data.

A non-transitory computer-readable medium storing instructions that, when executed by one or more processors of a computer system, cause the computer system to perform a method of monitoring network traffic of a connected vehicle, the method comprising:

• receiving network traffic information from a vehicle gateway, the network traffic information including malicious and/or benign information;
• storing the network traffic information on a data server and periodically updating the network traffic information stored on the data server;
• pre-processing the network traffic information stored on the data server, the pre-processing the network traffic information including filtering and normalizing the network traffic information;
• generating a learning model based on the pre-processed network traffic information, the learning model being generated by an artificial intelligence learning;
• updating the learning model based on additional network traffic information, the additional network traffic information including real-time network data;
• in accordance with the updated learning model, detecting an anomaly event in incoming network data;
• and
• in accordance with detecting the anomaly event in the incoming network data, generating a notification and/or blocking one or more packets associated with the incoming network data.