Methods and systems for a transportation vehicle are provided. As an example, one method includes monitoring a first set of networked devices located at a transportation vehicle and a second set of user devices that are controlled by users of the transportation vehicle; detecting a first parameter indicating a suspicious behavior by a user device; obtaining at least a second parameter associated with the user device; and correlating the first parameter and the second parameter to declare a security related event.