A method of monitoring communications propagating in an in-vehicle communications network of a vehicle, the method comprising: monitoring messages transmitted over at least a portion of the in-vehicle network; determining if the transmitted messages are indicative of a current data transfer session conducted over the in-vehicle network; comparing at least one feature of a message of the transmitted messages to at least one expected feature of a message comprised in a model of the data transfer session to determine whether or not the at least one feature of the transmitted message is expected; determining that the transmitted message is an anomalous message if the feature of the transmitted message is determined to be unexpected.