A computer implemented method for identifying an indication of malicious activity that changes the integrity of data sent out from a vehicle, comprising: intercepting, by an output data monitoring agent that monitors data sent out from the vehicle to a receiving computing unit located externally to the vehicle using a communication interface in communication with a network, wherein the data sent out from the vehicle is based on an aggregation of data outputted by a plurality of sensors installed within the vehicle and wherein the data sent out from the vehicle is intercepted by the output data monitoring agent prior to being processed by the receiving computing unit; intercepting, by at least one sensor data monitoring agent that monitors sensor data outputted by said plurality of sensors installed within the vehicle; performing, by a malicious activity detection code executed at the vehicle, at a server, or at another computer device, a correlation, wherein the correlation comprises: computing an aggregation of the sensor data, which is outputted by said plurality of sensors, in a format that matches a format of said data sent out from the vehicle, by converting data from multiple sensors into a single set of data sent out by the vehicle, wherein data from multiple safety sensors of the car being tire pressure, seat belt sensor, lights on sensor, following speed limit sensor, are converted into a binary indication of whether the car is safe or not, wherein the single set of computed data is compared to the data sent out by the vehicle, and wherein the sensor data and the data sent out by the vehicle are time stamped, to compare data generated at the same time, and monitoring the integrity of the data sent out by the vehicle by analyzing the data which is collected by the output data monitoring agent, with the aggregated sensor data, the sensor data being collected by the at least one sensor data monitoring agent, to identify a mismatch; identifying an indication of malicious activity that changed the data sent out from the vehicle relative to the data sensed by the plurality of sensors; and providing an output message indicative of the malicious activity. intercepting, by an output data monitoring agent that monitors data sent out from the vehicle to a receiving computing unit located externally to the vehicle using a communication interface in communication with a network, wherein the data sent out from the vehicle is based on an aggregation of data outputted by a plurality of sensors installed within the vehicle and wherein the data sent out from the vehicle is intercepted by the output data monitoring agent prior to being processed by the receiving computing unit; intercepting, by at least one sensor data monitoring agent that monitors sensor data outputted by said plurality of sensors installed within the vehicle; performing, by a malicious activity detection code executed at the vehicle, at a server, or at another computer device, a correlation, wherein the correlation comprises: computing an aggregation of the sensor data, which is outputted by said plurality of sensors, in a format that matches a format of said data sent out from the vehicle, by converting data from multiple sensors into a single set of data sent out by the vehicle, wherein data from multiple safety sensors of the car being tire pressure, seat belt sensor, lights on sensor, following speed limit sensor, are converted into a binary indication of whether the car is safe or not, wherein the single set of computed data is compared to the data sent out by the vehicle, and wherein the sensor data and the data sent out by the vehicle are time stamped, to compare data generated at the same time, and monitoring the integrity of the data sent out by the vehicle by analyzing the data which is collected by the output data monitoring agent, with the aggregated sensor data, the sensor data being collected by the at least one sensor data monitoring agent, to identify a mismatch; computing an aggregation of the sensor data, which is outputted by said plurality of sensors, in a format that matches a format of said data sent out from the vehicle, by converting data from multiple sensors into a single set of data sent out by the vehicle, wherein data from multiple safety sensors of the car being tire pressure, seat belt sensor, lights on sensor, following speed limit sensor, are converted into a binary indication of whether the car is safe or not, wherein the single set of computed data is compared to the data sent out by the vehicle, and wherein the sensor data and the data sent out by the vehicle are time stamped, to compare data generated at the same time, and monitoring the integrity of the data sent out by the vehicle by analyzing the data which is collected by the output data monitoring agent, with the aggregated sensor data, the sensor data being collected by the at least one sensor data monitoring agent, to identify a mismatch; identifying an indication of malicious activity that changed the data sent out from the vehicle relative to the data sensed by the plurality of sensors; and providing an output message indicative of the malicious activity.