PaperlayerView exact revision on arXiv

Source-linked AI summary

Characterizing Cyber Attacks against Space Infrastructures with Missing Data: Framework and Case Study

Ekzhin Ear, Jose Luis Castanon Remy, Caleb Chang, Qiren Que, Antonia Feffer, Shouhuai Xu

arXiv:2512.02414v1cs.CR

TL;DR

Space cyber attacks are poorly documented, leaving no systematic understanding of real-world attacks despite their long history. The paper proposes a framework that extrapolates missing details using SPARTA and ATT&CK and applies it to 108 attacks, deriving 6,206 probable kill chains and identifying link protection as a potential defense against nearly half.

Abstract

from arXiv · show

Cybersecurity of space infrastructures is an emerging topic, despite space-related cybersecurity incidents occurring as early as 1977 (i.e., hijacking of a satellite transmission signal). There is no single dataset that documents cyber attacks against space infrastructures that have occurred in the past; instead, these incidents are often scattered in media reports while missing many details, which we dub the missing-data problem. Nevertheless, even ``low-quality'' datasets containing such reports would be extremely valuable because of the dearth of space cybersecurity data and the sensitivity of space infrastructures which are often restricted from disclosure by governments. This prompts a research question: How can we characterize real-world cyber attacks against space infrastructures? In this paper, we address the problem by proposing a framework, including metrics, while also addressing the missing-data problem by leveraging methodologies such as the Space Attack Research and Tactic Analysis (SPARTA) and the Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK) to ``extrapolate'' the missing data in a principled fashion. We show how the extrapolated data can be used to reconstruct ``hypothetical but plausible'' space cyber kill chains and space cyber attack campaigns that have occurred in practice. To show the usefulness of the framework, we extract data for 108 cyber attacks against space infrastructures and show how to extrapolate this ``low-quality'' dataset containing missing information to derive 6,206 attack technique-level space cyber kill chains. Our findings include: cyber attacks against space infrastructures are getting increasingly sophisticated; successful protection of the link segment between the space and user segments could have thwarted nearly half of the 108 attacks. We will make our dataset available.

I. INTRODUCTION

Space cyber attacks have occurred for decades, but sparse and poorly documented data has prevented a systematic understanding of them. The paper proposes a framework for characterizing attacks with missing data and defines concepts for reconstructing space-focused attack campaigns.

I. INTRODUCTION

  • The lack of systematic understanding stems from scarce data and poorly documented space cyber attacks, despite incidents dating back to 1977.The authors note that sensitive infrastructure is rarely well documented, making missing data a practical constraint on characterization.Source: §I · p. 1
  • The framework combines SPARTA and ATT&CK to extrapolate missing attack details and defines metrics for consequence, sophistication, and USCKC likelihood.It is designed to accommodate both past and future attacks.Source: §I · p. 2
  • The study compiles 108 attacks and extrapolates 6,206 probable technique-level USCKCs, with findings including increasing sophistication and potential prevention of nearly half through link protection.The dataset combines 72 incidents from four existing datasets with 36 gathered through the authors’ Internet search and analysis.Source: §I · p. 2

II. TERMINOLOGIES AND CONCEPTS

  • USCKCs organize campaigns into in, through, and out phases, while reconstructed attack steps are classified as objective, milestone, enabling, or information-discovery activities.Some campaigns may omit phases or include multiple in or out phases.Source: §II · pp. 2–3
  • SPARTA addresses space-specific attacks, while combining its tactics and techniques with ATT&CK supports more comprehensive chains that also account for ground systems.SPARTA covers space infrastructures but not ground systems; ATT&CK focuses on enterprise IT networks.Source: §II · p. 3
  • The Unified Space Cyber Kill Chain adapts UKC to span all four infrastructure segments, enabling abstract campaign descriptions that can originate on the ground and target space.Tactics or techniques can be chained into tactic-level or technique-level USCKCs.Source: §II · p. 3

III. FRAMEWORK

The framework is designed to cover past and future attacks, accommodate missing details, and provide characterization metrics. Its system model separates space, link, ground, and user segments to support more precise cybersecurity analysis.

A. Framework Requirements and Overview

  • The framework targets generality, practical handling of missing attack details, and metrics for consequence, sophistication, and likelihood.Its four components are system-model design, dataset preparation, metric definition, and metric-based research questions.Source: A. Framework Requirements and Overview · p. 3

B. Space Infrastructure System Model

  • Separating the ground and user segments reflects their different participants and interactions, and can make cybersecurity design and analysis more precise.Some defenses may fit one segment better, and attackers may target users without affecting ground or space segments.Source: B. Space Infrastructure System Model · p. 3
  • The four segments are space, link, ground, and user, with the link segment representing data connections between and within segments.The model distinguishes the ground segment’s interactions with payloads and the bus from users’ frequent interaction with payloads.Source: B. Space Infrastructure System Model · pp. 3–4
  • The model represents infrastructure at module-level abstraction as a directed graph whose arcs encode communication relationships between modules.An arc from v1 to v2 means v1 can initiate unidirectional or bidirectional communication with v2.Source: B. Space Infrastructure System Model · p. 4

C. Preparing Dataset

The dataset process begins with raw cyber-threat reports and preprocesses them into unique incidents. Real-world data often lacks detailed technical descriptions, so the framework focuses on addressing missing information rather than solving completeness or accuracy.

C. Preparing Dataset

  • Comprehensive, accurate, zero-missing-data descriptions are ideal, but completeness is difficult because sensors are scarce and government data is often classified.The study focuses on missing data; defining coverage and ensuring accuracy are separate open problems.Source: C. Preparing Dataset · pp. 4–5

1) Collecting Raw Data:

  • Raw space cyber attack information is often buried in online CTI reports, including nontechnical news, blogs, and social-media posts.The paper assumes analysts receive reports claimed to concern space cyber attacks, which may be low quality or incorrect.Source: 1) Collecting Raw Data · p. 5

2) Preprocessing Raw Data:

  • Preprocessing filters reports for relevance, since search or source errors can include irrelevant reports.The filtering step can use domain experts to assess report attributes.Source: 2) Preprocessing Raw Data · p. 5
  • The preprocessed dataset records unique incidents with attributes such as attack type, date, location, description, identities, and data sources.Multiple independent sources reporting an incident indicate higher credibility; real-world descriptions often remain ambiguous.Source: 2) Preprocessing Raw Data · p. 5

3) Processing Preprocessed Data with Full Information:

For attacks with complete information, the framework constructs a USCKC by partitioning an attack description into ordered steps and classifying each step. The process relies on domain knowledge and is performed manually in this study.

3) Processing Preprocessed Data with Full Information:

  • The algorithm uses an attack description, infrastructure graph, and joint SPARTA–ATT&CK tactic and technique sets to produce an ordered USCKC.Each step is represented by its phase, activity type, tactic, and technique.Source: 3) Processing Preprocessed Data with… · pp. 5–6
  • The procedure partitions the description into attack steps, then classifies each step by phase, activity, tactic, and technique.The taxonomy choices support chains across four segments: ATT&CK focuses on ground-segment enterprise IT, SPARTA on space, and UKC on sequencing.Source: 3) Processing Preprocessed Data with… · pp. 5–6
  • Automation is non-trivial because classifying steps requires deep understanding of the infrastructure graph and technique set; manual implementation leaves complexity unreported.The algorithm is a skeleton derived from manual processing to guide future automation.Source: 3) Processing Preprocessed Data with… · pp. 5–6

4) Addressing the Missing-Data Problem:

The paper addresses missing attack details by constructing sets of probable space cyber kill chains from attack descriptions and space-infrastructure context. The process combines observed and inferred steps, but requires manual domain reasoning to ensure the chains are plausible.

4) Addressing the Missing-Data Problem:

  • Extrapolation requires reasoning about infrastructure paths, tactic compatibility, and technique prerequisites, so the study performs it manually rather than automating it.The authors state that these dependencies make automation difficult and applying large language models non-trivial.Source: 4) Addressing the Missing-Data Problem · p. 6
  • The skeleton algorithm uses attack description AD, infrastructure graph G, and joint SPARTA–ATT&CK tactic and technique sets to construct probable USCKCs.Each USCKC assigns ordered phase, activity, tactic, and technique types to observed or extrapolated attack steps.Source: 4) Addressing the Missing-Data Problem · p. 6
  • The algorithm partitions AD into observed steps, extrapolates missing prior steps, then combines the resulting possibilities into candidate USCKCs.The number of steps may grow as missing steps are inferred, and the combination stage may eliminate steps to preserve space-cybersecurity plausibility.Source: 4) Addressing the Missing-Data Problem · pp. 6–7
  • For each observed attack step, the algorithm identifies its phase, activity type, tactic, and probable techniques before combining those alternatives into candidate chains.The procedure also continues extrapolating prior steps until no more require inference.Source: 4) Addressing the Missing-Data Problem · p. 7

D. Defining Metrics to Characterizing Attacks

The framework defines three multidimensional metrics for characterizing attacks, with the option to aggregate each into a single number. They support comparisons of attack consequences and characterization of attack sophistication.

D. Defining Metrics to Characterizing Attacks

1) Attack Consequence Metric:

Attack consequence is represented across the space, ground, user, and link segments, with component-level measures of degradation. The framework allows aggregation where appropriate but cautions against treating distinct confidentiality, integrity, and availability effects as independent.

1) Attack Consequence Metric:

  • Attack consequence is a vector of vectors covering affected space, ground, user, and link segments.Source: 1) Attack Consequence Metric · pp. 7–8
  • Space-segment consequences distinguish Bus System and Payload components, with component scores measuring functional degradation on a 0-to-1 scale.The Bus System and Payload vectors cover six and five components, respectively; the definitions can be generalized beyond the illustrated system model.Source: 1) Attack Consequence Metric · p. 7
  • Ground consequences cover the Ground Station, Mission Control, Data Processing Center, and Remote Terminal, while user consequences track transmission, reception, and processing.Source: 1) Attack Consequence Metric · pp. 7–8
  • Link consequences distinguish affected links and confidentiality, integrity, and availability degradation; the authors caution that these effects should not be aggregated as independent probabilities.The proposed probability-style aggregation is considered unsound because an attacker can degrade the assurances together rather than independently.Source: 1) Attack Consequence Metric · p. 8

2) Attack Sophistication Metric:

Attack sophistication summarizes the most sophisticated tactics and techniques across plausible kill chains, while USCKC likelihood combines technique-level likelihoods within and across alternative chains.

2) Attack Sophistication Metric:

  • For each plausible USCKC, sophistication takes the highest tactic and technique scores; across alternatives, its highest and lowest values represent possible maximum sophistication and the minimum sophistication necessary for success.The lowest values are defined as the minimum, across candidate chains, of each chain’s maximum tactic or technique score.Source: 2) Attack Sophistication Metric · pp. 8–9

3) USCKC Likelihood:

  • USCKC likelihood is the minimum technique likelihood within a chain and the maximum chain likelihood across alternatives, assuming each technique likelihood is supplied by experts or a principled method.All techniques in one chain must succeed, while only one candidate chain needs to succeed.Source: 3) USCKC Likelihood · p. 9

E. Leveraging Metrics to Answer Research Questions

The case study applies the framework to real-world space cyber incidents assembled from public reports. The resulting dataset supports research questions about attack consequences, sophistication, entry points, and uncertainty, while its missing details limit what can be established.

E. Leveraging Metrics to Answer Research Questions

1) Collecting Raw Data:

  • The authors reviewed 337 raw cyber threat intelligence reports and identified 162 space cyber attacks before preprocessing.The reports came from four public sources and a review of search results.Source: 1) Collecting Raw Data · p. 9

2) Preprocessing Raw Data:

  • After removing duplicates, the authors assembled 108 unique incidents: 72 from existing sources and 36 newly added from internet searches.Source: 2) Preprocessing Raw Data · pp. 9–10
  • Missing details and disputed attribution, including for the RoSat incident, make the attacks’ veracity difficult to gauge and leave no ground truth.The authors therefore seek to infer from available information while acknowledging uncertainty.Source: 2) Preprocessing Raw Data · p. 10
  • The 108 attacks span eight categories, led by 41 jamming attacks and 26 data corruption/interception attacks; 73% fall into political, state-espionage, or criminal categories.Source: 2) Preprocessing Raw Data · p. 10

3) Processing Preprocessed Data with Full Information:

  • Because all 108 attacks have missing data, the full-information processing algorithm cannot be applied to this case study.The authors note it may still be useful to researchers and operators who know attack details.Source: 3) Processing Preprocessed Data with… · p. 10

4) Addressing the Missing Data Problem:

The authors extrapolate missing attack steps from incident descriptions to construct plausible space cyber kill chains. Applied to 108 attacks, the approach produces 6,206 USCKCs, while consequence analysis highlights ground-segment entry points as a hardening priority.

4) Addressing the Missing Data Problem:

1) Attack Consequence Analysis:

  • In the space segment, 19 of 108 attacks score at least 0.7; in the link segment, 66 of 108 score at least 0.3.Jamming is the most common type producing a space-segment consequence; its link-segment score is 0.7.Source: 1) Attack Consequence Analysis · p. 12
  • Ground-segment consequences score at least 0.6 for 52 attacks, and 34 of those use the ground segment as an entry point.Extrapolated chains also indicate potentially weak security hygiene, including default credentials and unpatched public-facing applications.Source: 1) Attack Consequence Analysis · p. 13
  • Prioritizing ground-segment hardening could mitigate consequences by preventing attackers from pivoting from ground systems to the space segment.Source: 1) Attack Consequence Analysis · p. 13

2) Attack Sophistication Analysis:

The analysis scores attack tactics and techniques for sophistication and finds that space cyber attacks have become more sophisticated over time. It also identifies successful attacks with average-or-lower sophistication and potential mitigation opportunities at the link and user-facing levels.

Sophistication measurement

Attack sophistication over time

  • Space cyber attacks became more sophisticated over time, with Seizure of Control attacks scoring 0.9 and most Data Corruption/Interception attacks exceeding 0.5.The tactic-level analysis also reports that Signal Hijacking attacks consistently score 0.5, with one exception.Source: 2) Attack Sophistication Analysis · p. 14, Figure 9 · p. 15

Comparing sophistication measurements

  • 55% (60 out of 108) attacks have both tactic- and technique-level sophistication scores of 0.5 or less, showing average-sophistication attacks can succeed.Technique-level scores are slightly more dispersed than tactic-level scores, making them more sensitive measurements.Source: 2) Attack Sophistication Analysis · p. 15

Link-segment protection

  • Proper link-segment security could have thwarted nearly half of the attacks: 48 used on-path techniques and had technique sophistication scores of 0.4 or less.The authors caution that cryptosystem deployment faces barriers including limited onboard compute and legacy systems.Source: 2) Attack Sophistication Analysis · p. 15

Social engineering

  • Traditional IT controls could have thwarted 32% (20/63) of attacks compromising the ground segment through cyber social engineering.The 23 social-engineering attacks had an average sophistication score of 0.3; 20 had ground-segment consequences.Source: 2) Attack Sophistication Analysis · p. 15

3) Attack Likelihood Analysis:

The analysis estimates the likelihood that reconstructed unified space cyber kill chains match their incidents, using technique-level likelihood assessments. Higher-likelihood chains often have lower sophistication, and the authors conclude that less sophisticated chains are more widely used.

Likelihood measurement

  • The likelihood of a USCKC is bounded by its least-likely technique, and the per-attack likelihood is the highest score among that attack’s plausible chains.Technique likelihood scores are assigned from 0 to 1, with 0.2 treated as average.Source: 3) Attack Likelihood Analysis · p. 15

Likelihood and sophistication

Illustrative attack chain

  • In a 2014 JPL example, Valid Accounts had the highest likelihood score, 0.22, among three extrapolated Privilege Escalation techniques.The paper identifies it as the most readily executable, comparatively low-sophistication option in that example.Source: 3) Attack Likelihood Analysis · p. 16

V. LIMITATIONS

The paper identifies limitations in manual extrapolation and metric inputs, contrasts its real-world incident analysis with prior work, and concludes with a dataset and framework for studying attacks despite incomplete reporting.

V. LIMITATIONS

  • Manual extrapolation of tactics, techniques, kill chains, and campaigns is inevitably subjective despite efforts to be objective.The authors identify automated, objective extrapolation as future work.Source: §V · p. 16
  • Only 3 of 108 incident descriptions mention confidential data, so most consequence metrics emphasize availability rather than data-specific confidentiality or integrity.The authors note that vulnerability-based CVSS scores cannot simply be adopted because enabling vulnerabilities are absent from raw incident reports.Source: §V · p. 16
  • Building-block metric measurements are assumed as inputs and, in this case study, are based on the authors’ subjective assessments.The authors call for research on how to obtain these measurements, potentially through community effort.Source: §V · p. 16

VI. RELATED WORK

  • Prior work spans incident analyses, abstract threat models, IT-framework applications, and cybersecurity metrics; this study applies threat-centric taxonomies to real-world incidents.The authors describe their 108 attacks as the most comprehensive real-world space cyber attack set and complementary to the 25 attacks in academic literature.Source: §VI · pp. 16–17

VII. CONCLUSION

  • The study builds a first dataset of space-infrastructure cyber attacks with hypothetical but plausible details, using public datasets and other incident sources.The framework uses conceptual algorithms to address missing information in poorly documented attacks.Source: §VII · p. 17
Loading 2512.02414v1…