A system for providing security to an in-vehicle communication network, the system comprising: a data monitoring and processing hub external to the in-vehicle network, the in-vehicle network having a bus and at least one node connected to the bus; a module configured to monitor messages in communication traffic propagating in the in-vehicle network, the module comprising: at least one communication port via which the module receives and transmits messages; a memory having data characterizing messages that the at least one node transmits and receives during normal operation of the node, and software executable to: identify, responsive to the data characterizing messages, an anomaly in communications over the in-vehicle communication network; and instruct a communication interface, configured to support communication with the hub, to transmit monitoring data responsive to identifying the anomaly to the hub for processing; and a processor configured to execute the software in the memory.