A Comprehensive Literature Review of Cybersecurity in Satellite Networks

Abstract

Satellite networks are essential to global connectivity yet face severe multidimensional cybersecurity threats. This systematic review conducts a holistic analysis of threats across the physical, network, and user layers. We propose the Sat-ATT&CK knowledge matrix to model satellite-specific attack chains. Corresponding defense technologies are organized within the core functions (Protect, Detect, Respond) of the National Institute of Standards and Technology (NIST) Cybersecurity Framework, establishing a structured threat–defense mapping. Furthermore, an exploratory case study on fine-tuning a large language model (SatSec) using the compiled literature corpus is presented. Finally, we identify key challenges and outline the future research directions toward a more resilient and intelligent security paradigm.

1. Introduction

Represented by Starlink and China Satellite Network, satellite networks serve as the core infrastructure for ubiquitous interconnection within space–air–ground integrated information systems. They play an irreplaceable strategic role in diverse domains, including global communications, emergency disaster relief, navigation and positioning, remote sensing, and military operations [1,2,3,4,5,6]. Currently, these networks have evolved into a multi-orbit hybrid architecture, predominantly based on Low Earth Orbit (LEO) satellites, complemented by Medium Earth Orbit (MEO) and Geostationary Earth Orbit (GEO) satellites, working in concert with terrestrial segments to form a comprehensive ecosystem [7].

However, inherent characteristics, such as open channels, dynamic topology, and space–ground heterogeneity, expose satellite networks to severe, multi-dimensional cybersecurity threats. These range from physical-layer eavesdropping and jamming to network-layer routing attacks and Denial-of-Service (DoS), as well as user-layer privacy leakage and identity spoofing. Prominent incidents, including the 2022 KA-SAT network paralysis during the Russia–Ukraine conflict [8,9] and the 2025 infiltration of Iranian oil tanker communication systems [10], underscore that satellite network security is critically linked to national infrastructure resilience, data sovereignty, and the security of space assets.

Despite growing attention, current security research faces significant limitations. Threat analyses often focus on isolated layers or specific attack types, lacking a holistic, multi-level perspective [11,12,13,14,15]. Defense reviews tend toward technology-oriented enumeration without establishing precise mappings to specific threats, obscuring actionable defense logic [16,17,18]. Furthermore, there is a scarcity of dedicated threat taxonomies or knowledge matrices that systematically capture the unique attack tactics and technique chains in satellite contexts.

To bridge these gaps, this survey aims to provide a systematic, layered, and actionable security framework tailored to satellite networks. The primary objectives and contributions are as follows:

(1)

Systematic Threat Analysis: A holistic review of threats across the physical, network, and user layers of satellite networks.

(2)

Standardized Threat Modeling: Development of the Sat-ATT&CK knowledge matrix, a structured taxonomy for characterizing satellite-specific attack chains.

(3)

Structured Defense Overview: Organization of defense technologies based on the core functions of the NIST Cybersecurity Framework (Protect, Detect, Respond), providing a structured view of defensive measures.

(4)

Comprehensive Synthesis and Future Directions: Consolidation of the current landscape, identification of critical challenges, and outlining of key research trajectories.

To ensure rigor and reproducibility, this review adhered to the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) guidelines. A comprehensive search across IEEE Xplore, Web of Science, ScienceDirect, CNKI, and arXiv (2004–2025) yielded 387 records. After deduplication and screening, 189 relevant studies were included in the final corpus. To visually present the literature foundation for our layered analysis, this paper employs a bubble chart to analyze the distribution of 189 references. Figure 1 focuses on the three core domains—physical layer, network layer, and user layer—clearly illustrating the research popularity and temporal evolution within each domain.

The remainder of this paper is structured as follows: Section 2 introduces the satellite network architecture and reviews existing threat modeling research. Section 3 details the layered threat analysis and presents the Sat-ATT&CK matrix. Section 4 organizes defense technologies according to the NIST CSF’s Protect, Detect, and Respond functions. Section 5 discusses emerging challenges, including an exploratory case study on AI application (SatSec-v1.0). Section 6 concludes the paper and points out future research directions. The overall research framework is illustrated in Figure 2, which outlines the logical flow from threat analysis to defense construction, supported by the Sat-ATT&CK and NIST CSF.

2. Technical Background

2.1. Architecture of Satellite Networks

As a key component of the space–ground integrated information infrastructure, satellite networks typically comprise three core segments: the space segment, ground segment, and user segment. These segments achieve global coverage and efficient communication through coordinated signaling, with the general system architecture shown in Figure 3.

The space segment serves as the core infrastructure layer, adopting a multi-orbit hybrid networking architecture composed of GEO, MEO, and LEO satellites. It can also integrate aerial platforms such as unmanned aerial vehicles to enhance network coverage flexibility and emergency response capabilities through flexible deployment. Inter-satellite communication primarily relies on Inter-Satellite Links (ISL) for autonomous networking, forming a dynamic topology to support multi-satellite collaborative communication [19,20]. However, some systems (e.g., OneWeb) forego ISLs and instead rely on dense ground station networks to ensure connectivity [21].

The ground segment is the core management, control, and data processing hub of satellite networks, consisting of ground gateway stations, network operation control centers, and ground communication networks. Additionally, it includes data processing centers that collaborate with on-orbit satellite processing units to perform in-depth analysis of remote sensing data and generate products [22].

As the terminal access layer, the user segment includes diverse distributed terminals: fixed/mobile VSATs for broadband access, satellite phones for voice and data communication in remote areas, and portable terminals for emergency response. User terminals can establish communication links directly with satellites or indirectly access them through service providers’ ground telecommunications infrastructure, forming a space–ground collaborative hybrid access mode [23].

2.2. Research Status of Cybersecurity Threat Modeling for Satellite Networks

In the field of cybersecurity threat modeling, three common paradigms exist: the phased abstract model of the Cyber Kill Chain [24,25], Microsoft’s STRIDE threat classification model [26,27], and the MITRE ATT&CK knowledge base [28,29,30,31]. Compared to the phased abstraction limitations of the Cyber Kill Chain and the insufficient multi-dimensional coverage of STRIDE, the MITRE ATT&CK framework builds a two-layer knowledge base (techniques and tactics) based on empirical attack data. It offers significant advantages in fine-grained characterization of attack paths, panoramic coverage of adversarial behaviors, and generation of dynamic defense strategies [32], exhibiting stronger practical utility. Its characteristics are well-suited to the security analysis needs of highly complex and heterogeneous satellite networks, making it a foundational reference for many related studies.

Notwithstanding the preliminary progress in applying ATT&CK-based taxonomies to satellite networks, significant limitations persist.

Table 1. Comparison of satellite network security threat modeling and classification research.

Reference	Modeling Method	Main Innovations	Limitations
[24]	Cyber Kill Chain	Analyzes LEO satellite attacks using the Cyber Kill Chain	Insufficient detail in hierarchical division and description
[25]	Cyber Kill Chain	Analyzes the kill chain phases under the space framework	Inadequate consideration of satellite uniqueness
[26]	STRIDE	Associates satellite communication threats with STRIDE	Limitations in threat classification and strategy formulation
[27]	STRIDE	Models maritime satellite communication using STRIDE	Insufficient depth and breadth in threat identification and analysis
[28]	MITRE ATT&CK	Realizes standardized classification of spacecraft threats	Lacks fine-grained description of satellite-specific attack techniques
[29]	MITRE ATT&CK	Defines space tactics such as “orbital maneuver jamming”	Incomplete coverage of satellite-specific techniques
[30]	MITRE ATT&CK	Extrapolates attack chains based on ATT&CK	Fails to fully consider the unique threats of the space segment
[31]	MITRE ATT&CK	Analyzes APT group attack cases on satellite ground segments	Does not adapt to the space segment scenario of satellites

compares representative studies based on their core characteristics. As shown, the SPARTA framework [28] achieves systematic description of spacecraft threats through standardized classification, but its excessive generality leads to insufficient pertinence for satellite-specific scenarios. The LEO satellite threat lifecycle model framework constructed in [29] defines space-specific tactics like “orbital maneuver interference,” but its classification system is validated based on only two attack cases, resulting in a weak empirical foundation and incomplete tactical coverage. Reference [30] proposes integrating SPARTA and ATT&CK to address data gaps, but its data extrapolation relies on manual assumptions and fails to fully consider space segment-specific threats. Reference [31] analyzes satellite ground segment attack cases using the ATT&CK for ICS framework, directly applying the industrial control framework without effectively integrating satellite-specific threat characteristics.

In summary, when existing threat modeling approaches and knowledge systems (e.g., Cyber Kill Chain, STRIDE, ATT&CK) are applied to satellite networks—a highly complex, heterogeneous scenario with unique spatial attributes—existing adaptations generally suffer from insufficient pertinence, incomplete coverage, or weak adaptability. They are unable to systematically characterize the unique attack tactics and technique chains. Therefore, there is a clear need to construct a dedicated, intuitive, and comprehensive threat knowledge matrix specifically for satellite networks.

3. Cybersecurity Threat Modeling and Analysis of Satellite Networks

To systematically analyze cybersecurity threats in satellite networks, this paper adopts a layered approach and employs the CIA+A (Confidentiality, Integrity, Availability, Authentication) security model to systematically evaluate the impact of layered threats on these core security attributes. This helps clarify the ultimate objectives of attacks and lays the foundation for constructing an objective-oriented defense architecture in Section 4. Figure 4 presents a threat mapping matrix based on the CIA+A model, visually illustrating the degree to which physical-, network-, and user-layer threats compromise each security attribute.

The following subsections will analyze typical threats across the physical, network, and user layers.

Table 2. Hierarchical threats and impacts of satellite networks.

Threat Layer	Attack Type	Attack Process	Impact
Physical Layer	Eavesdropping	Intercept air-interface-transmitted signals to parse communication content or key parameters	Data leakage, key leakage
	Power Suppression Jamming	Transmit high-power signals to cover legitimate signals	Communication interruption, service unavailability
	Spoofing Jamming	Forge signals similar to legitimate ones to make the receiver misjudge the signal source	Navigation deviation, control errors
Network Layer	Routing Attack	Tamper with routing protocols or forge routing updates	Path hijacking, increased latency, communication interruption
	Message Tampering	Illegally modify data packets or instructions being transmitted	Invalid instructions, configuration errors, system paralysis
	Denial-of-Service (DoS) Attack	Send a large number of illegal data packets to exhaust on-board or ground resources	Service interruption, resource exhaustion, increased latency
User Layer	Privacy Leakage	Capture user privacy information (e.g., location, behavior data)	Exposure of user privacy, tracking of behavior trajectories
	Identity Spoofing	Forge identity credentials to impersonate legitimate users or nodes	Unauthorized access, unauthorized operations, service abuse

summarizes these threats and their impacts.

3.1. Physical-Layer Threat Analysis

Threats at this layer target wireless signal transmission and hardware, directly impacting link quality and device security. Primary threats include eavesdropping, power suppression jamming, and spoofing jamming.

3.1.1. Eavesdropping

The openness of satellite communication links makes them vulnerable to illegal interception [33,34,35,36]. Attackers intercept signals transmitted over the air interface and can steal user communication content through analysis or even further extract key control parameters (e.g., encryption keys, protocol versions) to plan subsequent attacks. With the expansion of satellite user scale and coverage, such eavesdropping risks have increased exponentially [37]. Reference [13] identifies communication security as a core objective of satellite systems, constructs a refined channel model combining satellite beam patterns and path loss, and proposes an anti-eavesdropping scheme from a physical-layer security design perspective, effectively reducing the parsing probability of intercepted signals.

Furthermore, hardware defects can also lead to physical-layer information leakage. Amid the large-scale deployment of high-, medium-, and low-orbit satellites, some manufacturers widely adopt Commercial Off-The-Shelf (COTS) components to reduce costs and accelerate mass production. Hardware vulnerabilities in these components may become potential vectors for eavesdropping [16]. For example, ref. [38] investigates the RISC-V processor commonly used in satellites, revealing paths for hardware Trojans and microarchitectural side-channel attacks to steal sensitive data, thereby endangering the entire system’s safe operation.

3.1.2. Power Suppression Jamming

Power suppression jamming involves attackers transmitting high-power signals to mask legitimate ones, disrupting the demodulation of effective signals at the receiving end and ultimately causing satellite communication interruption [39]. These attacks are characterized by low implementation complexity, high effectiveness, and the capability for synchronous suppression of multiple targets, consequently establishing them as a mainstream threat to satellite networks [40,41]. Zou et al. [42] classify jamming by “generation difficulty” and compare the advantages and disadvantages of different jamming schemes based on dimensions such as energy efficiency, damage degree, implementation complexity, and prior knowledge requirements. Reference [16] systematically categorizes the characteristics of three types of suppression jamming sources (space-based, air-based, ground-based) and conducts a comparative analysis in terms of coverage range, jamming power, duration, mobility, and resource requirements.

Given the inherent limitations of traditional high-power single-source jamming modes—such as low power efficiency, crude coverage patterns, and susceptibility to detection—current research frontiers are shifting toward technological innovations aimed at enhancing jamming effectiveness [43,44,45]. Study [44] focuses on the intelligent design of jamming signal waveforms, introducing novel signals such as nonlinear frequency modulation to improve jamming flexibility and controllability while maintaining effective suppression. Literature [45] is dedicated to the precise allocation of jamming power and fine-grained control of spatial coverage. By optimizing modulation parameters, it ensures effective suppression of specific regions while reducing transmitted power, thereby significantly improving jamming efficiency and stealth. These technological advances have propelled the advancement of barrage jamming toward low power consumption, high precision, and intelligent paradigms, further intensifying the threats to satellite system network communication security.

3.1.3. Spoofing Jamming

Spoofing jamming is an attack wherein an adversary forges a signal that closely mimics the characteristics of a legitimate signal. This induces the receiver to misinterpret it as an authentic signal from a satellite source, leading to deviations in time synchronization, frequency alignment, beam pointing, or orbital parameter calculations for ground terminals, satellite transponders, or tracking, telemetry, and command (TT&C) stations [46,47]. Unlike power suppression jamming, which relies on overpowering the legitimate signal with stronger coverage, spoofing jamming operates through the precise forgery of legitimate signal characteristics and control parameters. It typically targets a single user, offering greater stealth and posing more severe potential hazards. Its successful implementation necessitates that the attacker possess prior knowledge of the signal waveform, frame structure, and the underlying processing logic.

Based on the method of implementation, spoofing jamming can be further categorized into two primary types: generative spoofing and repeater (or relay) spoofing. Generative spoofing involves creating a signal with a structure highly similar to the authentic one but containing fabricated content, aiming to mislead the receiver. Research in this domain focuses on enhancing the fidelity and generation efficiency of the forged signal. For instance, targeting spaceborne synthetic aperture radar (SAR) imaging systems, studies have proposed fast algorithms based on spatial frequency-domain interpolation to generate complex scenes containing numerous false targets [48]. Similarly, other work has employed recursive algorithms to significantly reduce the computational complexity of generating the spoofing signal, thereby improving real-time performance [49]. Furthermore, to generate high-quality deceptive signals that precisely match specific SAR imaging processing algorithms (such as the Omega-K algorithm), researchers have proposed deeply customized methods like the corresponding “Inverse Omega-K Algorithm.” This represents a trend in generative spoofing toward precision and algorithmic countermeasures [50]. Repeater spoofing, on the other hand, involves intercepting a genuine signal, delaying or processing it, and then retransmitting it, causing confusion in the receiver regarding time, frequency, or spatial parameters.

Although the methods differ, both types share the core objective of misleading the receiving system, posing a severe threat to the TT&C, navigation, and communication links within satellite system networks. The threat monitoring and receiver standardization testing project for the Global Navigation Satellite System (GNSS), supported by the European Union, revealed that approximately 10% of over 300,000 recorded anomaly events were confirmed as deliberate interference attacks [51]. Additionally, during the outbreak of the Russia–Ukraine conflict in February 2022, the widespread broadcast of forged GPS signals along the border by Russian forces interfered with Ukrainian military aircraft takeoffs/landings and air defense missile launches, further corroborating the destructive potential of such threats in real-world combat scenarios.

3.2. Network-Layer Threat Analysis

In the dynamically changing satellite topology, the network layer relies on routing protocols and various signaling mechanisms to determine optimal inter-satellite transmission paths for data packets, ensuring reliable end-to-end transmission. However, current satellite networks generally lack source authentication for routing information, signaling verification parameters and path legitimacy verification. Attackers can forge or tamper with inter-satellite/space–ground routing updates or forge data packets, thereby hijacking traffic and exhausting on-board bandwidth to launch network-layer attacks. To intuitively display typical threat types and action mechanisms at the physical and network layers, the relevant schematic is shown in Figure 5.

3.2.1. Routing Attacks

The special operating environment of satellite networks exacerbates routing security risks. On the one hand, the high-speed movement of satellites leads to frequent topology changes. Coupled with limited on-board resources and uneven global traffic distribution, nodes and links are prone to congestion [52]. On the other hand, the openness and exposure of ISLs make them vulnerable to interception during the routing forwarding process [53]. These factors enable a large volume of routing signaling generated by link switching to be intercepted, tampered with, or replayed by malicious nodes [54,55], potentially disrupting routing stability at best or causing full-network communication paralysis at worst.

Routing attacks faced by satellite networks can be broadly divided into internal and external attacks [56]. In internal attacks, attackers first gain control of legitimate satellite nodes, tamper with the routing processing logic within the nodes, and cause them to perform malicious operations during path calculation and data forwarding. External attackers are unauthorized network elements that implement interference, spoofing, or blocking at any stage of routing discovery, path maintenance, or data forwarding through various means, thereby damaging the normal data transmission function of satellite networks [57]. Both types of attacks focus on manipulating routing instructions and node authentication information, directly threatening the connectivity of satellite networks.

3.2.2. Message Tampering

Message tampering refers to the attack behavior where attackers intercept the transmitted message during satellite communication and unauthorizedly modify, insert, or delete its content. Since the ground segment typically centrally stores data and exposes management interfaces [29,58,59], it has become a high-incidence scenario for such attacks. After illegally obtaining control permissions, attackers maliciously alter messages, leading to routing decision errors, invalid control instructions, or abnormal service configurations in subsequent transmissions of the tampered information. In the 2022 KA-SAT network paralysis incident, attackers exploited an unauthorized configuration interface (CVE-2022-23305) at the ground gateway station of Viasat’s satellite broadband system to broadcast malicious firmware update packages to tens of thousands of user terminals, tampering with terminal routing tables and erasing flash memory data, ultimately resulting in the tampering of control instructions for some wind power facilities [60].

3.2.3. Denial-of-Service Attacks

Denial-of-Service (DoS) attacks involve sending a large volume of illegal data packets or requests to the target, exhausting device or network resources and preventing service provision to legitimate users [61]. DoS attacks on satellite networks can target the ground segment and space segment. Although they share the same origin as traditional network attacks, they exhibit unique characteristics due to the high-speed movement of constellations. Distributed Denial-of-Service (DDoS) attacks leverage the distributed architecture of satellites, organizing multiple controlled devices to launch synchronous attacks, further expanding the scope of harm. With the deployment of LEO mega-constellations, a large number of LEO satellites have become new targets for DDoS attacks [62].

Research related to DoS attacks on satellite networks has shown significant growth in recent years. In 2020, James et al. tampered with the VSAT ship–shore link using modified TV equipment costing less than $400, launching the first real-environment DoS attack on maritime satellites and exposing the security vulnerability of unencrypted links [63]. Giuliari et al. [64] launched Link Flooding Attacks (LFA) on an LEO satellite simulation platform based on public satellite orbit and connection information. Reference [65] assumed a scenario where some ground stations are compromised and used controlled nodes to launch ICMP echo flood DDoS attacks. Reference [66] discussed DDoS reflection amplification attacks that exhaust space–ground link bandwidth by colluding with terminals connected to the space backbone network. Reference [29] organized the tactics and techniques chain of ICARUS attacks (a special form of DDoS) using the ATT&CK matrix. When launching DDoS attacks, attackers often initiate instant attacks and then switch source addresses and utilize IoT devices worldwide as botnets [67], making real-time location difficult for traditional detection and tracing mechanisms and significantly increasing defense complexity [64,68].

3.3. User-Layer Threat Analysis

As the core hub for user-oriented business services, the user layer directly handles sensitive data processing and service delivery. User-layer threats targeting upper-layer business logic, software systems, and user privacy data (including sensitive user information and authentication parameters) directly undermine the trustworthiness of satellite services and data sovereignty. Although the public disclosure frequency of user-layer attacks is lower than threats at other layers, factors such as their concealment, cross-domain impact, and on-board patch lag result in higher repair costs and potential harm. Typical user-layer threats primarily focus on privacy leakage and identity spoofing.

3.3.1. Privacy Leakage

Currently, satellite networks face severe security challenges in large-scale data forwarding. Especially for LEO satellite networks that rely on numerous ground gateways [69,70] or ISLs for global data exchange [71], achieving low-latency seamless handover requires frequent sharing of privacy data, such as user device locations, between satellites and gateways [72]. Each data forwarding potentially risks leaking sensitive user information. Once captured and abused by attackers, it can cause immeasurable damage to user privacy [73]. Reference [74] points out that attackers can reverse infer a user’s real-time location and behavioral patterns by continuously monitoring the offloading decisions of mobile devices. Furthermore, the high-speed movement of satellites and frequent link interruption/reconnection make it difficult for traditional encryption and authentication mechanisms to take effect promptly, further expanding the privacy leakage window and exposing user privacy to persistent security threats.

3.3.2. Identity Spoofing

The legitimacy and uniqueness of user identities (relying on authentication parameters) are core prerequisites for the orderly operation of satellite network services [75]. Identity spoofing attacks bypass access control by forging the credentials of legitimate nodes (such as digital certificates and access credentials), directly threatening the authenticity of satellite services. Satellite systems, built on inter-satellite and space–ground links, constitute highly open wireless systems. They not only face technical challenges like high latency and dynamic topology changes but also have satellite nodes completely exposed in outer space, leading to frequent risks such as link hijacking and identity impersonation, making it difficult to guarantee node identity credibility [76,77,78,79]. When attackers exploit these vulnerabilities to impersonate satellites, ground stations, or even user terminals by replaying legitimate credentials, forging digital certificates, or exploiting protocol vulnerabilities, they can easily breach access control and directly endanger the authenticity and continuity of satellite services.

3.4. Sat-ATT&CK Threat Matrix Modeling

Although the layered threat analysis proposed in previous sections can systematically deconstruct satellite network threats, actual attacks often span multiple layers to form coordinated attack chains. Traditional single-dimensional threat analysis methods struggle to fully characterize their complex correlations. Satellite networks exhibit typical Cyber–Physical System (CPS) characteristics, where physical processes are closely coupled with network control. They share high consistency with Industrial Control Systems (ICS) in terms of real-time performance, reliability, heterogeneity, and security sensitivity. Therefore, this paper adopts the MITRE ATT&CK for ICS matrix as a foundational reference to construct a dedicated threat knowledge matrix for satellite networks—Sat-ATT&CK.

This matrix extends and adapts the ICS-based taxonomy by integrating unique attributes of satellite networks, such as open channels, dynamic topology, and space–ground collaboration. Sat-ATT&CK covers 12 core tactics and over 100 attack techniques, enabling systematic classification and standardized description of cross-layer threats in satellite networks. It serves as a structured knowledge base for characterizing multi-stage attack chains and supports subsequent attack detection, defense strategy design, and response mechanisms. The distribution of specific tactics and techniques in the Sat-ATT&CK matrix is shown in Figure 6a–c.

Sat-ATT&CK is designed as a threat knowledge matrix rather than a fully fledged modeling framework with automated decision-support mechanisms. Its primary purpose is to provide a standardized taxonomy for satellite-specific attack behaviors, facilitating consistent threat description and cross-incident analysis. In practice, Sat-ATT&CK can be used to map real-world attack cases (e.g., the 2022 KA-SAT network disruption or the 2025 Iranian tanker incident) into structured tactic-technique sequences, thereby revealing common attack patterns and inter-layer dependencies. This matrix complements the layered threat analysis presented earlier by offering a cross-layer perspective that highlights how attackers transition between physical, network, and user layers. While Sat-ATT&CK does not include formal analytical models or automated reasoning modules, it establishes a foundational knowledge structure that can inform future research on attack simulation, threat intelligence sharing, and dynamic defense strategy generation for satellite networks.

3.5. Sat-ATT&CK Attack Chain Example: The 2022 Viasat Incident

To demonstrate the practical applicability of the Sat-ATT&CK matrix (Section 3.4), we analyze the well-documented cyberattack against the Viasat KA-SAT network that occurred in February 2022 [8,9]. This incident is widely recognized as one of the most impactful satellite cyberattacks to date, causing widespread communication outages across Ukraine and collateral disruptions in several European countries. By mapping this attack onto the Sat-ATT&CK taxonomy, we illustrate how a real-world threat campaign can be decomposed into a sequence of adversary tactics and techniques.

Table 3. Mapping of the Viasat attack chain to Sat-ATT&CK tactics and techniques.

Attack Phase	Sat-ATT&CK Tactic	Sat-ATT&CK Technique	Attack Process Description
1	Initial Access	Unauthorized Configuration Interface Intrusion	Attackers exploited an unpatched Fortinet VPN appliance (CVE-2022-23305) at a Viasat ground gateway to gain unauthorized access to the modem management network.
2	Initial Access	Ground Station Uplink Signal Injection Attack	Using compromised ground station credentials, adversaries injected malicious telecommands via the Ka-band forward uplink to target Surfbeam2 modems.
3	Execution	Malicious Code Injection	A wiper malware dubbed “AcidRain” was delivered as a seemingly legitimate firmware update and executed on the victim modems, erasing flash memory and rendering the devices inoperable.
4	Persistence	Firmware Update Hijacking	By subverting the firmware update mechanism, the attackers ensured that the malicious code survived modem reboots and could potentially be reinstalled if recovery was attempted.
5	Privilege Escalation	Vulnerability Exploitation	The attack leveraged multiple known and zero-day vulnerabilities (e.g., VPN flaws, weak access controls) to elevate privileges from modem management servers to the broader satellite ground infrastructure.
6	Impact	DDoS Attack to Paralyze Services	The wiper attack caused a large-scale denial-of-service for tens of thousands of modems. Additionally, downstream impacts included the disruption of approximately 11 GW of wind power generation in Germany due to SCADA system dependencies on the affected SATCOM links.

presents the attack chain, organizing each adversarial action according to the corresponding Sat-ATT&CK tactic and technique.

The Viasat example thus validates the utility of Sat-ATT&CK as an analytical tool for real-world satellite security incidents. It also underscores the need for continuous refinement of the matrix as new attack patterns emerge.

4. Cybersecurity Defense Technologies for Satellite Networks

Analysis shows that due to the openness, resource constraints, and cross-layer attack chain characteristics of satellite networks, there is an urgent need to systematically sort out and integrate the existing defense technologies. However, most current surveys on satellite network security merely list defense technologies, lacking systematic organization of the “threat–defense” matching logic and cross-layer collaboration. Based on the core functions (Protect, Detect, Respond) of the NIST CSF, this section organizes defense technologies in a structured manner, highlighting their roles in threat awareness, proactive hardening, detection, response, and recovery.

4.1. Adaptability Analysis of NIST CSF and Defense Mapping for Satellite Networks

While the NIST CSF provides a generic and effective functional framework for organizing cybersecurity activities, its application to satellite networks—a highly complex, resource-constrained, and dynamic environment—requires in-depth adaptability analysis. This section proposes a structured defense perspective informed by the NIST CSF functions. This perspective serves to connect the Sat-ATT&CK threat knowledge matrix (Section 3) with defense technologies while accounting for the unique characteristics of satellite networks. It provides a logical structure for analyzing and organizing the specific defense technologies discussed in subsequent sections.

4.1.1. Challenges Posed by Satellite Networks to NIST CSF Core Functions

The inherent characteristics of satellite networks pose distinct challenges to implementing the core functions (Protect, Detect, Respond) of the NIST CSF. Stringent constraints on on-board computing, storage, and energy, coupled with the dynamic topology of LEO constellations, demand that defense mechanisms be lightweight, adaptive, and tolerant of frequent network reconfigurations. Significant propagation latency and limited space–ground bandwidth render fully centralized real-time detection and response impractical, necessitating a space–ground collaborative model featuring lightweight on-board preliminary detection/response complemented by in-depth ground analysis and coordinated command. Additionally, satellites in different orbits (e.g., GEO vs. LEO) exhibit varying values, attack surfaces, and connectivity patterns, while security priorities for individual satellites also shift across mission phases (e.g., on-orbit testing, nominal operation, emergency response), requiring context-aware and dynamically adjustable defense strategies tailored to specific operational scenarios.

4.1.2. Threat–Defense Mapping

To facilitate a systematic analysis, we propose a mapping between threats and corresponding defense technologies, which directly links each specific threat in the physical, network, and user layers to targeted core defense technologies. This mapping implies that an ideal, comprehensive response to a threat would involve a sequence of actions across the Protect, Detect, and Respond functions (detailed in Section 4.2, Section 4.3 and Section 4.4).

In satellite networks, effective cybersecurity can be envisioned as more than a linear sequence of Protect–Detect–Respond; it ideally functions as a dynamic process involving close collaboration between space and ground segments. In such a process, information gained during Respond (e.g., attack characteristics) should be fed back to inform updates in the Protect phase, such as policy refinement and patching. Simultaneously, the effectiveness of Detection capabilities heavily relies on the logging, security telemetry, and data collection mechanisms deployed during the Protect phase. This concept of closed-loop feedback and collaborative interaction is posited as crucial for countering rapidly evolving space cyber threats.

Guided by this analytical framework, the following sections will systematically review satellite network cybersecurity defense technologies from the Protect, Detect, and Respond levels, paying particular attention to their adaptive designs for addressing the aforementioned challenges.

4.2. Protection Phase

The core goal of the protection phase is to proactively harden systems, reduce the attack surface, and block the initial stages of attack chains through security baseline design. It aims to build a resilient security baseline and curb initial attack infiltration. In light of the unique challenges posed by satellite networks—such as resource constraints, dynamic topologies, and heterogeneous mission requirements—protection mechanisms must be lightweight, adaptive, and context-aware. Specific technologies can be implemented across three dimensions: physical layer, network layer, and user layer. A comparison of these layered protection technologies is presented in

Table 4. Comparison of hierarchical protection technologies for satellite networks.

Protection Layer	Protection Technology	Targeted AttackType	Protection Process/Mechanism	Advantages	Disadvantages	Deployment Readiness
Physical Layer	Beamforming	Eavesdropping	Concentrates signal energy in the direction of legitimate receivers to reduce sidelobe leakage	No interference required; suitable for multi-user scenarios	Relies on channel state information	Operational
	Artificial Noise (AN) Injection		Injects noise to reduce the signal-to-noise ratio (SNR) of eavesdropping channels	High targeting and effectiveness	May interfere with non-target nodes; high-power consumption	Simulated/Demonstrated
	Reconfigurable Intelligent Surface (RIS)		Directs reflected interference signals to create nulls at eavesdroppers	Improves interference efficiency in similar channel environments	Requires high-precision phase control	Concept/Simulated
	Secure Coding		Integrates channel state information for adaptive coding, prioritizing decoding for legitimate links	Ensures security from an information-theoretic perspective	High complexity of encoding and decoding	Simulated
	Single-Antenna Technology	Power Suppression Jamming	Suppresses interfering frequency points through time-domain/transform-domain filtering	Low cost; suitable for narrowband interference	Limited anti-jamming capability	Operational
	Array Antenna Technology		Adaptively adjusts weights to form pattern nulls aligned with interference	Strong spatial resolution; high suppression depth	Complex hardware; high cost	Operational
	Signal Feature Detection	Spoofing Jamming	Analyzes anomalies in physical features such as signal correlation functions and power	Simple implementation; high real-time performance	Ineffective against high-fidelity spoofing signals	Operational
	Measurement Domain Consistency Check		Verifies the logical consistency between parameters such as Doppler shift, power, and code phase	Distinguishes spoofing from multipath	Relies on prior thresholds or statistical models	Demonstrated
	Intelligent Detection		Extracts raw signal features and identifies abnormal patterns via trained models	Adapts to complex environments; detects concealed spoofing	Relies on data quality and computing power	Simulated/Demonstrated
Network Layer	Location Routing/Hierarchical Routing	Routing Attacks	Isolates routing domains based on satellite positions or logical grouping to limit attack propagation	Improves routing efficiency and reliability	High management overhead	Operational (in part)
	Encryption and Hash Verification	Message Tampering	Uses cryptographic algorithms to ensure data integrity and confidentiality	Mature technology; fundamental security support	Introduces computational and communication overhead	Operational
	Blockchain-Based Evidence Storage		Uses distributed ledgers to record operation logs for tamper-proofing and traceability	Decentralized; high credibility	High latency; high storage overhead	Concept/Simulated
	Zero-Trust Authentication		Continuously verifies identity and permissions, combining physical parameters for dynamic authentication	Strong dynamic adaptability; low overhead	Complex system construction	Simulated/Demonstrated
	Caching and Resource Optimization	DoS/DDoS Attacks	Alleviates resource-exhaustion attacks through redundant storage and load balancing	Improves system redundancy and availability	Only mitigates, not eliminates, attacks	Operational
User Layer	Data Encryption Algorithms	Privacy Leakage	Uses lightweight cryptographic algorithms to protect data transmission and storage security	Resource-friendly; suitable for on-board environments	Still incurs significant computational overhead	Operational
	Key Management Mechanisms		Designs hierarchical, cross-domain key negotiation and update mechanisms	Supports forward and backward security	High update overhead during high-frequency handovers	Operational
	Encrypted Identity Authentication	Identity Spoofing	Implements end-to-end identity verification by combining cryptography and behavioral features	Fundamentally defends against impersonation	Relies on the security of key management	Operational
	Blockchain-Based Identity Management		Distributively stores and verifies identity information to prevent tampering and forgery	Decentralized, transparent and credible	Bottlenecks in throughput and latency	Concept/Simulated

Note: Deployment Readiness levels: Concept—theoretical proposal only; Simulated—evaluated in software simulation; Demonstrated—validated in relevant environment (e.g., HITL testbed, tech demo); Operational—deployed on operational systems (e.g., GPS, Starlink).

, which includes a Deployment Readiness assessment (Concept, Simulated, Demonstrated, Operational) for each technology. The four readiness levels are defined in the table note.

4.2.1. Physical-Layer Protection Technologies

1. 

Anti-Eavesdropping Technologies

Satellite anti-eavesdropping techniques employ distinct yet complementary approaches, including physical-layer signal optimization, active jamming, and intelligent adaptation. These methods are designed to operate under the resource-limited and highly dynamic conditions typical of satellite links, often leveraging distributed or cooperative architectures to mitigate the impact of constrained on-board processing capabilities. A typical technical solution involves optimizing signal transmission directionality to reduce leakage. Multi-antenna and beamforming technologies follow this logic, using multiple antennas, relays, or directional beams to concentrate signal energy towards legitimate receivers, reducing the probability of eavesdropping interception at the hardware and signal processing levels. Reference [80] demonstrates that in multi-relay Single-Input Multiple-Output (SIMO) satellite/Multiple-Input Single-Output (MISO) Free-Space Optical (FSO) networks, increasing receiving antennas, relays, and transmitting beams can significantly enhance physical-layer security. Teng et al. [37] verified in a satellite–terrestrial relay network integrated with Non-Orthogonal Multiple Access (NOMA) that random beamforming can degrade eavesdropped signal quality while reducing Channel State Information (CSI) acquisition overhead. This method requires no additional jamming and is suitable for interference-free scenarios in multi-user environments.

Another solution proactively introduces jamming to degrade eavesdropping quality, represented by Artificial Noise (AN) injection technology. Currently, AN is widely used as an effective technology to enhance confidential communication security [81,82,83]. Injecting AN into transmitted signals can reduce eavesdroppers’ decoding capabilities while ensuring legitimate reception quality. Reference [84] studied the security and reliability performance of ground users, adding artificial noise to counter eavesdropping under a cognitive radio framework. This method is highly targeted and suitable for scenarios where the eavesdropper’s location is relatively clear or power is controllable, but it requires balancing potential interference to non-target nodes.

Building upon active jamming, RIS-aided cooperative jamming technology further improves jamming pertinence. This technology uses aerial RIS to accurately reflect jamming signals from legitimate nodes towards eavesdroppers, while keeping legitimate terminals in the null space to avoid interference [85]. Reference [86] proposed a scheme in similar satellite communication channel scenarios where full-duplex (FD) legitimate nodes actively transmit jamming noise, and aerial RIS collaboratively reflects and optimizes phases to address the limited effectiveness of traditional jamming. Reference [87] realized multi-user MISO downlink communication with RIS assistance, optimizing transmit power and reflection coefficients to maximize the sum rate.

Additionally, coding technologies can also improve physical-layer security [88]. Low-Density Parity-Check (LDPC) codes are widely adopted due to their near-capacity performance and high coding gain [89]. Reference [90] improved security using LDPC codes through random bit insertion and puncturing techniques. Reference [33] further embedded real-time CSI into LDPC coding, achieving high reliability for legitimate links and a sharp increase in the bit error rate for eavesdropped links through adaptive scrambling. These anti-eavesdropping technologies directly address the physical-layer eavesdropping threat analyzed in Section 3.1.1, which exploits open satellite communication links to intercept signals and key parameters.

2. 

Anti-Power Suppression Jamming Technologies

Defenses against power suppression jamming primarily fall into two categories: single-antenna and array antenna technologies, which offer differing levels of protection and resource requirements. Single-antenna anti-jamming technologies process signals based on single-antenna reception, offering low hardware costs but limited anti-jamming capability, and can be subdivided into time-domain and transform-domain technologies [91]. Time-domain anti-jamming technologies leverage time-domain differences between desired signals and jamming to filter jamming through filters or adaptive algorithms and are effective against narrowband or continuous wave jamming [92]. Reference [93] proposed cascading multiple IIR filters to suppress continuous wave jamming. Transform-domain technologies convert signals to the frequency domain or time-frequency domain via Fourier transform, wavelet transform, etc., to eliminate jamming. Reference [94] proposed a multi-Short-Time Fourier Transform (STFT) technology based on STFT and used notch filters to accurately detect and suppress jamming. Reference [95] proposed an adaptive threshold based on wavelet decomposition to suppress narrowband jamming.

Array antenna technologies possess spatial resolution and stronger anti-jamming capabilities, including spatial-domain, space–time adaptive, and beamforming technologies [91]. Spatial-domain technologies adjust array weights through adaptive algorithms like power inversion to alter antenna patterns and suppress power suppression jamming. The power inversion adaptive algorithm proposed in [96] can provide Beidou navigation receivers with up to 50 dB of anti-jamming capability. Space–Time Adaptive Processing (STAP) combines spatial and time domains, adding transverse delay taps to increase antenna degrees of freedom, thereby suppressing more jamming sources. Reference [97] studied the anti-jamming performance of the power inversion algorithm based on the linearly constrained minimum variance criterion in space–time two-dimensional filtering.

3. 

Anti-Spoofing Jamming Technologies

Due to its high concealment, physical-layer spoofing jamming poses a more severe security threat to satellite systems than traditional suppression jamming, driving the development of defense methods towards refinement, intelligence, and diversification. Common defense technologies include signal feature analysis, measurement domain analysis, and intelligent detection, which build defenses against spoofing and jamming from different dimensions.

As a fundamental identification method for spoofed signals, signal feature analysis focuses on the inherent characteristics of legitimate signals for identification. Spoofed signals in baseband processing can damage the symmetry and amplitude of the Autocorrelation Function (ACF). Researchers have proposed various indicators and hypothesis detectors based on correlator outputs for anomalies in tracking channels [98]. To improve detection robustness, information fusion technologies (e.g., Bayesian data fusion, Kalman filters, Dempster–Shafer theory [99], generalized likelihood ratio test [100]) have been further introduced to integrate these indicators, forming the first line of defense against spoofing attacks.

Furthermore, detection methods based on measurement domain/location domain consistency analysis are also effective against spoofing jamming attacks. Reference [101] proposed a GNSS spoofing detection method based on the consistency of measured and calculated carrier Doppler. Reference [102] proposed a GNSS repeater spoofing detection method based on the dual-peak feature of frequency-domain signals and relative velocity residuals, using Fast Fourier Transform (FFT) to detect dual peaks and extract Doppler differences. References [103,104] combined consistency monitoring of signal power and correlation peak shape distortion, capable of detecting spoofing and distinguishing multipath under small code delay differences.

When spoofed signal characteristics become more concealed, anomaly detection technologies based on deep learning can mine legitimate signal patterns and dynamically monitor signal anomalies. Reference [105] used deep learning for jamming management, significantly improving the detection accuracy of interfering carriers under high Signal-to-Interference Ratio (SIR) and enhancing communication channel protection capability. Reference [106] adopted machine learning (e.g., CNN) for spectrum occupancy detection and automatic modulation classification, capable of identifying illegal interfering signals and reducing dependence on prior knowledge like expert features. Reference [107] focused on air spoofing attack detection in LEO satellite systems, innovatively converting raw IQ samples at the physical layer into grayscale images and deeply learning the feature distribution of legitimate signals based on a sparse Autoencoder (AE). Such methods effectively overcome the limitations of traditional feature analysis in identifying concealed spoofed signals and are more suitable for complex electromagnetic environments. The intelligent detection framework for physical-layer anti-spoofing jamming is shown in Figure 7.

4.2.2. Network-Layer Protection Technologies

1. 

Anti-Routing Attack Technologies

Satellite network routing security faces dual threats from internal and external attacks, requiring the construction of security defenses through diverse technologies. To address the challenges of dynamic topology and frequent handovers in LEO constellations, many routing defense strategies incorporate location-aware or hierarchical structures that limit attack propagation and reduce signaling overhead. Defense strategies based on network structure optimization provide structural solutions. The core idea is to achieve routing isolation and refined management by dividing network structures (e.g., layers, regions, location domains) to limit the scope of attack impact. Specifically, they can be further divided into location-based routing defense and hierarchical routing defense.

Location-based routing defense ensures the legitimacy of routing nodes through satellite location rules and regional division, preventing malicious nodes from accessing the network by forging locations. Reference [108] developed a robust branch-and-price algorithm to enhance adaptability for the two-level location routing problem involving recommended satellites. Du et al. [109] proposed a distributed location management method for hybrid-orbit satellite networks, optimizing handover and reducing signaling overhead through dual-location region division. Reference [110] divided LEO constellation subgroups by logical path identifiers and designed dedicated identifiers to improve routing efficiency and packet delivery rate. Reference [111] targeted ultra-dense Free-Space Optical (FSO) LEO satellite networks, optimizing routing efficiency and reducing system complexity through regional division based on a medium–low orbit integrated architecture. These defense technologies build defenses from different dimensions, reducing the risk of attack diffusion, improving anti-jamming capabilities, and forming a multi-layered defense system.

2. 

Anti-Message Tampering Technologies

Message tampering can cause navigation deviations, decision-making errors, or even system paralysis by illegally modifying transmitted data, instructions, or parameters in satellite networks. Therefore, it is necessary to build a protection system relying on multi-layered defense technologies. Current main defense methods include encryption and hash verification, blockchain evidence storage, and zero-trust authentication, which resist tampering threats from dimensions such as data encryption, distributed evidence storage, and dynamic verification.

As basic defense technologies, encryption and hash verification ensure data integrity and confidentiality during transmission through cryptographic means. In satellite Internet of Things (IoT), homomorphic signcryption technology based on Hyperelliptic Curve Cryptography (HECC) can simultaneously achieve data encryption and signature, support batch verification of multi-device data, and significantly reduce computational and communication overhead [112]. Additionally, schemes combining dynamic encryption and hashing can also effectively resist unauthorized modifications [113].

Blockchain evidence storage leverages the immutability of distributed ledgers to provide decentralized message integrity guarantees. Chen et al. [114] proposed a random blockchain scheme, introducing uncertainty by randomly selecting nodes to broadcast data to enhance anti-attack capabilities. Yuan et al. [115] further utilized the characteristics of Physical Unclonable Functions (PUF) to achieve keyless negotiation in lightweight broadcast authentication protocols, avoiding the risk of sensitive key leakage. In [116], the StarCross framework adopts editable blockchain technology, realizing efficient rollback of cross-shard transactions through chameleon hash and voting-based consensus mechanisms, while using block immutability to record data flow processes, effectively defending against message tampering.

Currently, traditional single security technologies can no longer cope with modern distributed networks [117], and the zero-trust model has garnered increasing attention in satellite communications [118]. It detects and resists tampering in real-time through continuous verification and dynamic update mechanisms, adapting to highly dynamic inter-satellite links. Reference [119] proposed a lightweight zero-trust protocol based on Hyperelliptic Curve Cryptography (HECC), integrating satellite orbit parameters as physical trust anchors. While ensuring the anti-forgery and anti-hijacking security of inter-satellite links, it significantly reduces authentication delay and communication overhead.

3. 

Basic DoS Attack Protection

DoS attacks on satellite networks can launch coordinated attacks through distributed architectures, and the expansion of LEO constellation scale has exacerbated problems like limited space–ground link bandwidth and tight node resources, further increasing defense difficulty. Therefore, improving system anti-attack redundancy through resource optimization is the core of basic protection. Cache optimization intelligently selects service nodes and adopts hierarchical strategies by optimizing resource scheduling and request processing flows, reducing redundant link loads and repeated request impacts, thereby enhancing the system’s anti-DoS attack redundancy. Delay-Tolerant Networks (DTN) [120] rely on intermediate router caching mechanisms to effectively alleviate retransmission overhead caused by wireless link quality fluctuations. Furthermore, the CAAST framework proposed in [121] optimizes storage distribution by selecting cache nodes through the IL-TOPSIS strategy and combines the HFS hierarchical fallback strategy to handle cache miss scenarios, reducing link congestion and improving the service availability of satellite networks against DoS attacks.

4.2.3. User-Layer Protection Technologies

1. 

Privacy Protection Technologies

The combination of data encryption and key management mechanisms can meet the security and compliance requirements for users’ sensitive information throughout its entire lifecycle (including collection, transmission, and storage), offering a comprehensive solution for privacy protection. Given the on-board resource constraints and the need for efficient key updates during frequent handovers, recent research emphasizes lightweight cryptographic algorithms and hierarchical key management schemes that balance security with low computational and communication overhead.

The academic community has proposed various encryption schemes for satellite networks: Liu S. et al. proposed a conditional generative adversarial network encryption scheme to enhance the security of Beidou short message channels [122]. Jeon S. et al. designed a method combining encryption and channel coding along with a corresponding key distribution scheme [123]. Reference [124] proposed a chaos encryption algorithm based on RNA coding, integrating an infinite-dimensional chaos system and a hierarchical diffusion strategy. It expands the key space to 2²⁵⁶ with an entropy value close to 8, effectively resisting statistical attacks. Currently, the research focus for encryption algorithms in satellite networks is on lightweight technologies, adapting to the resource constraints of satellite nodes. While ensuring security, they reduce computational and storage overhead, enabling efficient encryption with low resource occupancy. Reference [125] proposed an LWARX white-box cryptography algorithm, adopting an ARX (Addition–Rotation–XOR) structure to hide key information through lookup tables and internal/external coding. It can prevent privacy leakage during data transmission under limited satellite storage and computing power conditions. The Elliptic Curve Cryptography (ECC) encryption scheme in [126] is superior to the traditional RSA algorithm in both security and robustness, with shorter keys reducing transmission overhead. It efficiently adapts to the privacy protection of sensitive data like user identities in satellite communications.

Key management aims to ensure the authenticity and validity of user keys throughout their lifecycle, thereby maintaining the security of the encryption system. Howarth et al. [127] proposed a multi-layer IPsec-LKH integration scheme for satellite-encrypted multicast, reducing satellite resource occupancy by optimizing key management traffic. Roy-Chowdhury et al. [128] designed a hierarchical group key management protocol targeting the topological characteristics of hybrid satellite networks and verified its strong robustness and scalability. Jiao et al. [129] constructed a satellite group key management scheme based on elliptic curve cryptography and threshold technology, integrating identity authentication functions without needing a secure channel, significantly saving system resources. Wang et al. [130] proposed a group key management strategy utilizing the hierarchical and domain structure of near-space networks, significantly reducing the key update burden caused by frequent handovers of high-speed nodes. Sun and Ma [131] designed a multi-group key management framework for satellite networks, dividing subgroups according to users’ access capabilities. It balances forward/backward security and scalability while effectively reducing key update overhead at the satellite end.

2. 

Anti-Identity Spoofing Technologies

Identity spoofing attacks pose a serious threat to network security by forging legitimate identities to access satellite networks or impersonating nodes to participate in communications. Defense methods primarily include encryption, authentication, and blockchain technologies, which provide protection from different perspectives and can adapt to identity security needs in various scenarios.

Encryption authentication technologies prevent malicious terminals from forging identities to access the source through identity verification and permission constraints. Such technologies typically combine encryption algorithms with behavioral analysis to ensure the legitimacy of accessing nodes. Reference [98] adopted encryption authentication mechanisms like Open Service Navigation Message Authentication (OSNMA) at the user layer of satellite communications, constructed an identity forgery detection model based on user behavioral characteristics, and verified user identities through registration and dynamic authentication schemes. Reference [132] implemented end-to-end encryption at the user segment, combined with least privilege control, continuous monitoring, and patch management to prevent forged access and unauthorized operations. Furthermore, targeting identity authentication needs in different scenarios, researchers have proposed various specific schemes: Reference [133] proposed an efficient pairing-free identity authentication scheme for the Automatic Dependent Surveillance-Broadcast (ADS-B) system, supporting batch verification and resisting identity spoofing. Reference [134] designed an authentication scheme based on proxy signature for satellite authentication in space information networks, effectively verifying satellite identities. Reference [135] proposed an anonymous fast handover authentication scheme, utilizing group signatures to balance anonymity and identity authentication.

Blockchain possesses characteristics of decentralization, tamper-proofing, and transparency and can permanently track node behaviors and data [136]. Its distributed ledger technology is highly compatible with the distributed characteristics of satellite IoT [137], making it an ideal solution for identity tampering prevention. Blockchain-based identity evidence storage technology ensures the consistency and credibility of identity data through blockchain’s decentralization. Yu et al. [138] proposed a federated blockchain data sharing mechanism for cross-domain Industrial Internet of Things (IIoT), where the group signature scheme can protect device privacy and achieve anonymous authentication. Zhang et al. [139] proposed a blockchain-based cross-domain authentication scheme for edge computing, achieving secure authentication through a cross-domain bidirectional authentication algorithm for digital certificates and signatures.

4.3. Detection Phase

The detection phase focuses on anomaly identification when attacks occur, with the core goal of discovering abnormal behaviors and determining attack types. To cope with the high latency and limited bandwidth of space–ground links, detection architectures often adopt a collaborative space–ground approach, where lightweight on-board modules perform preliminary screening while more sophisticated analysis is conducted on the ground. Specific technical paths are primarily divided into network anomaly identification and data anomaly identification.

4.3.1. Network Anomaly Identification Technologies

Intrusion Detection Systems (IDS) form the core of network anomaly identification, enabling rapid detection and accurate tracing of malicious behavior through the analysis of illegal traffic and anomalous requests. In related research, ref. [140] proposed the CANSat-IDS system, which adopts Artificial Neural Network (ANN) and Kernel Support Vector Machine (K-SVM) algorithms to achieve high-precision detection of DoS attacks in the CAN bus. The SAGIN-ID framework designed in [141] uses a hierarchical detection strategy—the on-board part quickly filters known DoS attacks through hash matching, while the ground part uses semi-supervised learning algorithms to achieve high-precision identification of unknown attacks.

Besides detection systems and frameworks specifically targeting DoS attacks [142], relevant research has also explored routing protocols and defense frameworks. Jiang et al. [78] proposed a routing protocol combined with intrusion detection, which bypasses malicious nodes through collaborative rerouting of satellite nodes, but its abnormal behavior dataset is derived from ground networks. Li et al. [143] proposed a space–ground integrated network intrusion detection scheme, which has good malicious traffic detection effectiveness but requires high node computing power. Reference [144] designed a blockchain-based distributed collaborative defense framework for the resource-constrained characteristics of on-board systems. It records traffic characteristics through blockchain and aggregates attack characteristics with the MapReduce algorithm, significantly reducing on-board computing overhead. Additionally, ref. [145] proposed a secure transmission optimization algorithm with joint anomaly detection for jamming and DoS attacks that satellite networks may encounter. It incorporates detection accuracy as a factor in transmission path decision-making and constructs and solves optimization problems based on optimal control strategies.

4.3.2. Data Anomaly Detection Technologies

Data anomaly detection is a key link in satellite data processing, and related research has formed various characteristic methods. Zhang Mingjiang [146] proposed an on-orbit satellite anomaly detection method integrating ARX and Support Vector Regression (SVR), which performs initial linear prediction through the ARX model and then uses the SVR model to capture nonlinear components to correct results.

In engineering applications, satellite telemetry data anomaly detection methods mainly fall into three categories: first, methods based on threshold rule interpretation, which detect anomalies by verifying whether data falls within a specified threshold range, representing the mainstream approach in the early stages of this field; second, methods based on expert knowledge and expert systems, which build detection systems relying on domain experience; and third, data-driven methods, which mine data patterns using machine learning, statistics, and other technologies, capable of identifying unknown anomalies without expert experience [147]. In specific applications, ref. [148] comprehensively characterizes the statistical distribution of normal data by integrating the centralized, discrete, shape, and boundary characteristics of telemetry data, realizing anomaly detection for single telemetry parameters of locally stable spacecraft. Ref. [149] adopts Principal Component Analysis (PCA) to map multi-dimensional telemetry variables of the satellite Attitude and Orbit Control System (AOCS) to a low-dimensional space and uses statistics such as Hotelling’s T² and Squared Prediction Error (SPE) to detect sample anomalies.

In recent years, deep learning-driven anomaly detection has become a research hotspot. Ref. [150] adopted Convolutional Neural Network (CNN), processed class-imbalanced time-series data through sampling methods, and achieved time-series classification of normal and abnormal sequences through supervised training. Luo Hui [151] proposed models such as Autoencoder, CNN, and Generative Adversarial Network (GAN) to extract features for satellite gas path anomaly detection, adapting to detection needs in different scenarios. Ref. [152] proposed an ensemble LSTM-based method, combining matrix norm to model the correlation between telecommand instructions and telemetry, improving adaptability to complex systems, which can effectively detect anomalies and reduce false alarm rates.

4.4. Response Phase

The response phase is the core of dynamic disposal in the cybersecurity defense system of satellite networks. Its core goal is to quickly block the horizontal diffusion path of attacks through real-time and effective intervention measures, thereby minimizing the impact of attacks on the business continuity of satellite networks. Response strategies must account for the orbital dynamics and mission heterogeneity of satellite networks, enabling timely countermeasures while maintaining service availability across different orbital regimes (GEO, MEO, LEO) and mission phases.

4.4.1. Real-Time Attack Blocking Technologies

1. 

Dynamic Link Response

When hardware enhancement cannot fully offset strong power jamming, dynamic link switching technology can automatically switch to media or satellite resources with stronger anti-jamming capabilities by real-time monitoring key indicators such as signal-to-noise ratio and adapting to channel states, thereby avoiding jamming impact. Ref. [153] proposed a Free-Space Optical/Radio Frequency (FSO/RF) hybrid satellite–air–ground network for extreme desert environments, which dynamically switches based on real-time channel states to cope with extreme jamming and ensure communication continuity. The security of link switching is also a key concern in the response phase. Xue et al. [154] designed an identity authentication protocol and fast handover mechanism with both security and efficiency, capable of resisting various attacks and meeting various security requirements. Ref. [155] proposed an access authentication protocol with user anonymity and traceability, reducing authentication costs by optimizing communication delay and signaling overhead and designing a hierarchical group key distribution strategy to achieve cross-domain handover without repeated authentication. Ref. [156] proposed a secure user access and inter-satellite handover mechanism, enhancing system security through a separate key architecture for the control plane and user plane, and combining identity-based encryption with proxy re-encryption to complete efficient batch handover with stack support.

Additionally, the disposal of link damage or interruption is also a research focus in satellite routing algorithm design [157]. Ref. [54] proposed the Open Shortest Path First (OSPF) protocol, which utilizes the regularity of constellation topology to perform periodic routing calculations for generating real-time routing tables, and combines an on-demand dynamic routing mechanism to handle topology changes caused by link failures or recovery, significantly reducing routing convergence overhead and time. Ref. [158] realizes dynamic perception of link states through a link detection mechanism. When a node is damaged, adjacent nodes update the topology and send damage messages, and other nodes record and forward them to update the local topology, thereby quickly responding to link changes and reselecting routes. Ref. [159] proposed a Quick Response to Link Damage Routing Algorithm (QRLDRA) for LEO satellite constellations, which integrates space–ground backhaul, multi-priority queues, and routing calculation functions based on predictable constellation topology to cope with inter-satellite link failures and achieve timely response to topology changes.

2. 

Intelligent Traffic Regulation

Intelligent traffic regulation alleviates the impact of traffic flooding DoS attacks from the source by dynamically adjusting network load. This technology focuses on network traffic characteristics and load change rules to achieve adaptive regulation. Ref. [160] proposed a congestion-aware load balancing algorithm to alleviate ISL congestion in dynamic LEO optical satellite networks. Ref. [161] proposed an intelligent congestion control algorithm based on Reinforcement Learning (Proximal Policy Optimization, PPO), which dynamically adjusts the congestion window to match real-time network load. Ref. [162] adopted dual decomposition combined with a Convolutional Neural Network-Bidirectional Long Short-Term Memory (CNN-BiLSTM) model to build a traffic prediction mechanism, avoiding congestion caused by DoS attacks by identifying self-similar traffic characteristics in advance. Ref. [163] proposed the SCMA-QL-ACB method, combining Sparse Code Multiple Access (SCMA) technology, Q-learning algorithm, and Access Class Barring (ACB) mechanism, which effectively improves performance indicators such as throughput and collision rate by enhancing spectrum efficiency, optimizing resource allocation, and controlling overload.

3. 

Multipath Fault-Tolerant Routing

Multipath fault-tolerant routing copes with network attacks by constructing multiple paths. Its core is to use path redundancy to resist attacks and avoid routing interruptions caused by single-path failures. Ref. [164] realized dynamic multipath routing for satellite networks based on Software-Defined Networking (SDN), adjusting routes in real-time by integrating delay, bandwidth, and node load states. Liu et al. [165] targeted LEO satellite networks, intelligently distributing traffic and reducing delay by improving clustering structure, optimizing quality of service and load balancing. Zeng et al. [166] proposed a low-latency fault-tolerant multipath routing algorithm, transmitting data copies in optimal proportions over independent shortest paths to balance reliability and timeliness. Ref. [167] adopted the Explicit Compact Multipath Routing (CEMR) algorithm to achieve full-network topology perception based on inter-satellite link interaction. Wang et al. [168] designed a computation-dependent multipath routing paradigm for space–ground integrated networks, dynamically mapping computing tasks to multiple paths, optimizing system energy consumption while meeting delay constraints.

4.4.2. Fault Early Warning Technologies

The core of fault early warning is to determine whether to trigger a fault alarm and identify the warning fault type based on historical and current data. Three commonly used methods for communication satellite fault detection are: methods based on threshold rules combined with manual monitoring, methods based on traditional machine learning algorithms, and trend prediction based on time-series models [169,170,171,172].

In recent years, deep learning-based fault early warning has become a research hotspot. Ref. [173] discussed the use of Long Short-Term Memory (LSTM) and Gated Recurrent Unit (GRU) architectures in Recurrent Neural Networks (RNN) for anomaly detection of aircraft flight data. Chen et al. [174] proposed a Fault Prediction Convolutional Neural Network (FPCNN) combining the characteristics of convolutional neural networks. Ref. [175] proposed a stacked autoencoder network method to realize fault detection and early warning through extracted features. Tagawa et al. [176] improved the denoising autoencoder and proposed the Stacked Denoising Autoencoder (SDA) model, which can reconstruct time-series data using incomplete prior information and avoid overfitting. Liu Yun et al. [177] proposed a thresholding method based on the LSTM network, learning the patterns of normal data through LSTM, and determining the threshold with correlation coefficients and F1 scores to effectively detect system-level faults of communication satellites.

4.5. Satellite-Specific Defense Prioritization Strategies

Based on the systematic review of satellite network cybersecurity defense technologies above, the diverse operational scenarios, heterogeneous architectures, and varying resource constraints of satellite networks necessitate tailored defense prioritization. A one-size-fits-all approach fails to balance security effectiveness, resource efficiency, and mission adaptability. This section proposes prioritization strategies centered on three core dimensions—orbit type, mission criticality, and resource availability—providing actionable guidance for practical deployment and enhancing the framework’s adaptability.

Orbit type is a fundamental determinant of defense prioritization, shaping resource availability, threat exposure, and network dynamicity. For LEO satellites, especially mega-constellations, strict on-board resource constraints mandate lightweight, low-overhead technologies: optimized AES-128 encryption, low-latency zero-trust authentication, scalable distributed traffic regulation, fast handover protocols, and lightweight collision warning systems. GEO satellites, as high-value core infrastructure, prioritize high-reliability deep defense: high-directionality beamforming, ruggedized components, deep learning-based intrusion detection, blockchain tamper-proofing for control data, and redundant communication links. MEO satellites adopt a balanced strategy, integrating low-power signal detection with targeted anti-spoofing for mission-critical functions.

Mission criticality refines resource allocation to safeguard core objectives. For critical missions (military operations, emergency relief), priorities include LSTM/GRU-based low-latency anomaly detection, dynamic link switching, military-grade encryption, and millisecond-response collision avoidance. For civilian missions (broadband access, remote sensing), the focus shifts to cost-effectiveness and user experience: edge computing-based privacy protection, energy-efficient anti-eavesdropping, scalable certificate authentication, and low-cost time-domain filtering.

Resource availability constrains defense feasibility. Resource-limited satellites (small satellites, CubeSats) prioritize passive, low-overhead strategies: signal feature-based spoofing detection, location-based routing isolation, and pre-configured emergency protocols. Resource-abundant satellites (large communication satellites) deploy integrated active-passive systems: RIS-aided anti-eavesdropping, CNN-based intelligent detection, reinforcement learning-driven response, quantum communication for critical data, and distributed blockchain verification.

These strategies aim to guide resource allocation and defense deployment in alignment with mission objectives, potentially aiding the translation of theoretical technologies into practical security measures.

5. Emerging Challenges

As the core hub of space–air–ground integrated communications, the security defense of satellite networks faces significant and interconnected challenges. These challenges arise not only from the continuous evolution of attack methods but also from the inherent technical characteristics and development trends of satellite networks.

5.1. Cross-Layer Attack and Defense Challenges

In actual satellite network attacks, attackers often exploit interaction vulnerabilities across different layers to form attack chains, constructing attack paths through cross-layer transitions of tactical chains. For example, in the 2025 Iranian oil tanker attack, attackers hijacked network-layer communication channels and injected malicious programs into user terminals to steal sensitive data. The attack on GNSS receivers by the GhostSec group further revealed a collaborative exploitation model of physical-layer signal spoofing and application-layer weak password vulnerabilities.

Such attacks increase concealment through cross-layer tactical chains. Existing defenses, however, often focus on single-layer protection and lack cross-layer correlation analysis. This leads to delayed detection, fragmented responses, and difficulty in blocking attack propagation. Furthermore, current related research primarily focuses on wireless network scenarios [178,179,180,181], and studies on cross-layer attack defense targeting the unique dynamic topology and heterogeneous links of satellite networks are still insufficient, further exacerbating defensive passivity.

5.2. Mega-Constellation and Resource Constraint Challenges

With the advancement of LEO mega-constellation deployment, satellite networks present characteristics of dense nodes and dynamic topology, bringing new challenges to security defense [182]. The frequent switching of ISLs of LEO satellites requires defense algorithms to possess extremely strong dynamic adaptation capabilities, while traditional static rule bases struggle to match the rapid changes in attack characteristics.

Simultaneously, the limited computing power, energy consumption, and storage resources on satellites make it difficult to support the operation of complex cross-layer defense algorithms. Balancing security performance and resource consumption has become a technical difficulty. The heterogeneous networking of multi-orbit satellites (GEO/MEO/LEO) with ground and user terminals further increases the difficulty of compatibility design for cross-layer defense protocols. The differentiated security requirements of high-latency and low-latency links further aggravate the complexity of technical adaptation.

5.3. Artificial Intelligence in Satellite Security: Challenges and a Feasibility Study

Artificial Intelligence (AI) offers transformative potential for satellite security, enabling adaptive threat detection and automated response [183]. However, it also introduces new risks. Adversaries can leverage AI to generate sophisticated spoofing signals or use adversarial machine learning to manipulate sensor data, compromising system integrity. The rise of generative LLMs further lowers the attack threshold, facilitating automated exploit generation and vulnerability analysis [184]. Crucially, the significant computational demands of advanced AI starkly contrast with the resource-constrained satellite environment, posing a fundamental deployment challenge [185,186].

An Exploratory Case: Towards a Domain-Specific LLM. To concretely assess the feasibility of leveraging security knowledge for AI augmentation, we fine-tuned an open-source LLM (Qwen3-8b) using a corpus that integrates the satellite-specific threat knowledge defined in our Sat-ATT&CK matrix (Section 3.4), the surveyed literature, and the MITRE ATT&CK for ICS framework. The resulting prototype, SatSec, was preliminarily evaluated on domain-specific question-answering and threat-reasoning tasks. By incorporating the structured tactics and techniques of Sat-ATT&CK into its training data, SatSec is capable of understanding and reasoning about satellite-specific attack chains, thus directly supporting the threat analysis concepts introduced earlier in the paper.

This exploratory effort yielded three key insights: (1) Converting comprehensive survey knowledge into an AI-ready format is technically feasible. (2) The domain-adapted SatSec model showed improved answer relevance compared to a general-purpose LLM (DeepSeek-V3) in automated metrics (e.g., ROUGE, BLEU). (3) This pathway highlights the potential for LLMs to serve as intelligent assistants for knowledge retrieval and basic threat reasoning. Full methodological details of SatSec are provided in Appendix A.

6. Conclusions and Future Directions

This survey has provided a systematic review of cybersecurity threats and defense technologies in satellite networks. We conducted a layered threat analysis, proposed the satellite-specific Sat-ATT&CK knowledge matrix for modeling attack chains, and organized defense technologies within the NIST CSF (Protect, Detect, Respond) framework. An exploratory case study on a domain-adapted LLM (SatSec) was also presented to illustrate a potential pathway for AI-augmented security analysis.

Looking ahead, future research should prioritize the following directions to evolve satellite security towards a more resilient and intelligent paradigm:

(1)

Cross-Layer Collaborative Defense: Developing integrated frameworks for coordinated threat detection and response across physical, network, and user layers.

(2)

Lightweight Security for Mega-Constellations: Designing scalable, adaptive, and resource-efficient protocols that meet the severe constraints and dynamic topologies of LEO mega-constellations.

(3)

Trustworthy AI Integration: Realizing that the potential of AI, as preliminarily explored in Section 5.3, requires solving fundamental challenges in robust, explainable, and resource-efficient deployment within the stringent constraints of space systems.