Method and system for vehicle cyber-attack event detection

Abstract

A multiple vehicle cyber-attack detection system including a vehicle operations center coupled to and monitoring vehicles, where each operations center includes a cyber-attack alert module. A vehicle cyber-attack detection system is in communication with each operations center and includes a first tier security module coupled to an onboard system of each vehicle and receives system log data generated by the onboard system. The first tier security module extracts extracted features from a time series of overlapping windowed system log data generated from the system log data with natural language processing and includes a first cyber-attack anomaly detection module that identifies a first cyber-attack based on system entropy measurements. A second cyber-attack anomaly detection module includes a deep learning component that identifies a second cyber-attack based on classification of the extracted features. Each cyber-attack alert module generates a notification of the first cyber-attack and/or the second cyber-attack on a user interface.