A vehicle correlation system for detection of at least one cyber-attack on one or more vehicles (121-123) comprising a plurality of on-board communication agent modules (141-143 and 144-146) communicating with one another, the system comprising: a. first on-board communication agent modules (141-143) installed within a plurality of vehicles (121-123), wherein the first on-board communication agent modules (141-143) are configured to collect, process and transmit and receive first metadata to and from the correlation engine ; b. second on-board communication agent modules (144-146) installed within road infrastructure (131-133) and in a range of communication with at least one of the first on-board communication agent modules, wherein the second on-board communication agent modules (144-146) are configured to collect, process and transmit and receive second metadata to and from the correlation engine ; c. a remote cloud-based detection server comprising a correlation engine ; wherein the correlation engine is configured to: calculate a correlation between the data parameters of at least the second metadata collected, processed and received from one or more second on-board communication agent modules (144-146) installed within road infrastructure (131-133); indicate a probability of a cyber-attack against one or more vehicles (121-123) based on the calculated correlation, and detect cyber-attacks against the one or more vehicles (121-123) based on the calculated correlations; and wherein the data parameters of the first and second metadata are selected from a group consisting of: a suspect and/or an identified threat on one or more vehicles, spread of a suspect and/or an identified attack among multiple vehicles, location of the vehicles, geographic information, vehicle unique identification, event time, vehicle-to-vehicle communication parameters, vehicle-to-infrastructure communication parameters, vehicle-to-cloud communication parameters, software applications downloaded and/or used in the vehicle and/or any combinations thereof. a. first on-board communication agent modules (141-143) installed within a plurality of vehicles (121-123), wherein the first on-board communication agent modules (141-143) are configured to collect, process and transmit and receive first metadata to and from the correlation engine ; b. second on-board communication agent modules (144-146) installed within road infrastructure (131-133) and in a range of communication with at least one of the first on-board communication agent modules, wherein the second on-board communication agent modules (144-146) are configured to collect, process and transmit and receive second metadata to and from the correlation engine ; c. a remote cloud-based detection server comprising a correlation engine ; calculate a correlation between the data parameters of at least the second metadata collected, processed and received from one or more second on-board communication agent modules (144-146) installed within road infrastructure (131-133); indicate a probability of a cyber-attack against one or more vehicles (121-123) based on the calculated correlation, and detect cyber-attacks against the one or more vehicles (121-123) based on the calculated correlations; and <EOS>