A non-transitory computer readable medium, storing instructions to execute a process, the instructions comprising: managing model management information associating each of a plurality of analytic models with one or more types of data associated with a vehicle, and an operation status of the vehicle; for received data associated with the vehicle and for receipt of a report from a another vehicle or a cloud indicative of the received data being high risk for being anomalous: reducing a risk threshold for anomaly analysis for the plurality of analytic models; for receipt of the report from the another vehicle or the cloud indicative of the received data being high risk for being anomalous, or non-receipt of the report from the another vehicle or the cloud: determining a type of the received data from the vehicle and the operation status of the vehicle; selecting one or more analytic models of the plurality of analytic models based on the determined type of the received data associated with the vehicle, the determined operation status of the vehicle, and the model management information; and executing the selected one or more analytic models on the received data to generate an anomaly determination of the received data: for receipt of the report from the another vehicle or the cloud indicative of the received data being malicious, mark the received data as anomalous; and for receipt of the report from the another vehicle or the cloud indicative of the received data being safe, mark the received data as safe. managing model management information associating each of a plurality of analytic models with one or more types of data associated with a vehicle, and an operation status of the vehicle; for received data associated with the vehicle and for receipt of a report from a another vehicle or a cloud indicative of the received data being high risk for being anomalous: reducing a risk threshold for anomaly analysis for the plurality of analytic models; for receipt of the report from the another vehicle or the cloud indicative of the received data being high risk for being anomalous, or non-receipt of the report from the another vehicle or the cloud: determining a type of the received data from the vehicle and the operation status of the vehicle; selecting one or more analytic models of the plurality of analytic models based on the determined type of the received data associated with the vehicle, the determined operation status of the vehicle, and the model management information; and executing the selected one or more analytic models on the received data to generate an anomaly determination of the received data: for receipt of the report from the another vehicle or the cloud indicative of the received data being malicious, mark the received data as anomalous; and for receipt of the report from the another vehicle or the cloud indicative of the received data being safe, mark the received data as safe. reducing a risk threshold for anomaly analysis for the plurality of analytic models; for receipt of the report from the another vehicle or the cloud indicative of the received data being high risk for being anomalous, or non-receipt of the report from the another vehicle or the cloud: determining a type of the received data from the vehicle and the operation status of the vehicle; selecting one or more analytic models of the plurality of analytic models based on the determined type of the received data associated with the vehicle, the determined operation status of the vehicle, and the model management information; and executing the selected one or more analytic models on the received data to generate an anomaly determination of the received data: for receipt of the report from the another vehicle or the cloud indicative of the received data being malicious, mark the received data as anomalous; and for receipt of the report from the another vehicle or the cloud indicative of the received data being safe, mark the received data as safe. determining a type of the received data from the vehicle and the operation status of the vehicle; selecting one or more analytic models of the plurality of analytic models based on the determined type of the received data associated with the vehicle, the determined operation status of the vehicle, and the model management information; and executing the selected one or more analytic models on the received data to generate an anomaly determination of the received data: for receipt of the report from the another vehicle or the cloud indicative of the received data being malicious, mark the received data as anomalous; and for receipt of the report from the another vehicle or the cloud indicative of the received data being safe, mark the received data as safe. for receipt of the report from the another vehicle or the cloud indicative of the received data being malicious, mark the received data as anomalous; and for receipt of the report from the another vehicle or the cloud indicative of the received data being safe, mark the received data as safe.