Disclosed are systems and methods for generating rules for detecting and blocking attacks on electronics systems of a means of transportation. A security server receives log data having messages that were intercepted on the buses of the means of transportation around the time of a road traffic accident with the means of transportation. The security server detects computer attacks on the electronics systems and generates one or more rules that depend on one or more indicators of compromise, such as malicious messages used in a computer attack and information on at least one ECU that is a recipient of the malicious messages. The generated rules further specify actions for blocking subsequent computer attacks, such as blocking, modifying, or changing communications within the communications bus of the vehicle.