Source-linked AI summary
Temporal Risk on Satellites
Shiqi Liu, Kun Sun
TL;DR
Satellite risk frameworks often treat threats statically, although attack timing can matter as much as attacker behavior. This paper adds temporal capabilities and time-varying exploitation difficulty to produce risk matrices by mission window and environmental band; its evaluation finds eclipse risk highest and sunlight materially lower.
Problem
Existing satellite-security analyses emphasize spatial and architectural factors, while timing’s role in attack feasibility and impact remains insufficiently represented in current risk practices.
Source: §I · p. 1Method
The framework augments attacker tiers with temporal mastery and separates timing-related from static exploitation difficulty, producing likelihood–impact matrices by mission window and environmental band.
Source: §I · p. 1, B. Temporal Exploitation Difficulty · p. 3, §VI · p. 6Results
The paper’s evaluation finds that eclipse carries the highest risk, whereas sunlight is materially lower.
Source: C. Operational Value · p. 5Takeaways & Limitations
The reported risk split supports stricter controls during eclipse and less restrictive non-critical throttling during sunlight without relaxing baseline safeguards.
Source: C. Operational Value · p. 5The framework remains semi-quantitative, and calibration and validation are open problems amid scarce timing-sensitive incident data and a lack of standardized time-aware benchmarks.
Source: §V · p. 5
Abstract
from arXiv · showhide
Satellite vulnerabilities change over time as orbits shift, power margins tighten, and the space environment deteriorates. However, most cybersecurity risk frameworks still treat threats as static. In practice, the same exploit can be far more damaging during a critical maneuver than during routine operations. We propose a temporal risk assessment framework that makes time an explicit axis in satellite security analysis. It extends existing adversary behavior taxonomies with a five-dimensional temporal capability model and estimates exploitation difficulty across distinct temporal windows of a mission. Rather than producing a single risk score, the framework outputs a series of time-indexed likelihood-impact matrices. It discretizes missions into operationally meaningful time windows and environmental bands to show when systems are most exposed. This view helps operators avoid scheduling sensitive operations in high-risk periods and align defensive resources with a threat landscape that shifts over time.
I. INTRODUCTION
The paper proposes a time-aware satellite cybersecurity risk framework because attack feasibility and impact vary with orbital, environmental, and mission timing. It extends SPARTA’s risk matrix into time-indexed assessments for mission windows and environmental bands.
I. INTRODUCTION
- Satellite attack opportunities grow with expanding interconnection, predictable orbits, limited physical protection, complex supply chains, and cheaper COTS hardware and ground services [2].The 2022 KA-SAT cyberattack disrupted communications across Europe, demonstrating that satellite security threats are not hypothetical.Source: §I · p. 1
- Orbital access windows, mission-critical schedules, and radiation effects can make attack timing consequential, including when radiation-induced bit flips interfere with Control Flow Integrity.During South Atlantic Anomaly passages or geomagnetic storms, elevated single-event upset rates increase residual risk of mitigation failure.Source: §I · p. 1
- The STARMELT attack aligns crafted traffic with eclipse periods to keep a satellite communication subsystem at high power and maximize battery drain.LEO satellites rely on batteries during eclipse, and discharge depth affects their lifetime.Source: §I · p. 1
- Static risk scores miss changing attack feasibility and impact, leaving likelihood estimates incomplete and defenses misaligned with high-risk windows.The paper identifies three gaps: incomplete likelihood estimation, impact underestimation, and inability to prioritize protection or schedule sensitive operations around risk periods.Source: §I · p. 1
- The framework extends SPARTA’s Notional Risk Scores into time-indexed likelihood-impact matrices for mission windows and environmental bands, fitting existing risk workflows.Analysts can add temporal considerations to established ATT&CK-based assessments.Source: §I · p. 1
II. BACKGROUND & RELATED WORK · A. Attacks Against Satellite Systems
Satellite attacks span ground, link, user, and space segments, with ground compromises able to cascade to orbital assets; prior work documents weaknesses across these segments and identifies isolation, monitoring, and recovery as resilience measures.
A. Attacks Against Satellite Systems
- Ground-segment footholds through networks, GSaaS platforms, or operational tooling can cascade to space assets, motivating end-to-end mission-flow analysis, [9],,.Defense should analyze mission control and data flows holistically rather than treating the spacecraft in isolation.Source: A. Attacks Against Satellite Systems · p. 2
- Over-the-air jamming and spoofing,, remain prominent link- and user-segment threats, while modem and terminal weaknesses enable exploitation,, [16].Teardown and measurement studies of LEO terminals and user equipment revealed design and implementation defects and concrete exploitation paths.Source: A. Attacks Against Satellite Systems · p. 2
- Falling ground-station costs and GSaaS, have lowered barriers to interacting with orbital assets and triggering software vulnerabilities.Source: A. Attacks Against Satellite Systems · p. 2
- In-orbit satellite firmware analyses, find systems lacking telecommand-channel protection and access control, alongside software defects that make obscurity alone fragile.Source: A. Attacks Against Satellite Systems · p. 2
- Small satellites increasingly run full operating systems such as Linux, and application sandboxes are being evaluated as practical isolation for CubeSat-class missions [20],.Prior work also documents engineering challenges for integrating sandboxes in orbit.Source: A. Attacks Against Satellite Systems · p. 2
- Independent health monitoring and out-of-band telemetry proposals, address subsystem faults and support post-incident diagnosis and recovery to limit cyberattack blast radius.Source: A. Attacks Against Satellite Systems · p. 2
B. MITRE ATT&CK in Space
MITRE ATT&CK provides a shared lexicon of adversary tactics, techniques, and procedures, and researchers have adapted its TTP matrices to the space domain. SPARTA assigns space techniques likelihood-and-impact risk scores to guide countermeasure selection.
B. MITRE ATT&CK in Space
- MITRE ATT&CK is a matrix-based knowledge base spanning Enterprise, Mobile, and Industrial Control Systems, used for adversary emulation and detection coverage assessment.Its common lexicon covers adversary tactics, techniques, and procedures (TTPs).Source: B. MITRE ATT&CK in Space · p. 2
- SPARTA [7] adapts ATT&CK to space with a cyber tactics-and-techniques matrix and 5×5 likelihood-impact Notional Risk Scores for each technique.The risk-matrix representation groups scores from 1 to 25 into low, medium, and high.Source: B. MITRE ATT&CK in Space · p. 2, Figure 1 · p. 2
- SPARTA estimates likelihood from adversary motivation, exploitation difficulty, and capability tier, while impact spans mission disruption, loss of control or availability, safety, financial, and national-security consequences.The resulting risk groupings drive mapped countermeasures and NIST SP 800-53 controls.Source: B. MITRE ATT&CK in Space · p. 2
III. METHODOLOGY · A. Temporal Adversary Capabilities
The methodology assesses likelihood and impact across mission time windows, while the temporal adversary capability model adds timing proficiency to attacker-tier assignment. Together, these methods describe how vulnerability and adversary capabilities vary over time.
III. METHODOLOGY
- The framework assigns each technique 1–5 likelihood and impact levels for each relevant time window, extending the static 5×5 risk matrix.Likelihood and impact are examined across operationally relevant windows rather than collapsed into one static assessment.Source: §III · p. 2
- Likelihood adjustments vary exploitation difficulty and adversary capability over time, while motivation retains its meaning as target attractiveness driven primarily by system criticality.Static frameworks [7] may average narrow windows into one likelihood score, masking periods of acute vulnerability.Source: §III · p. 2
- Time windows determine which unchanged impact category, I1–I5, applies to an attack scenario; the same jamming attack can rate I2 during routine operations and I5 during an eclipse-critical period.The category semantics remain unchanged; the time-specific consequences determine the assigned level.Source: §III · p. 2
A. Temporal Adversary Capabilities
- The framework retains the seven attacker tiers [7], and adds a temporal mastery profile ⟨A, F, S, Y, H⟩ as a tier-assignment threshold, with minimum capability sets defined for each tier.The profile covers actuation, forecasting, sensing, synchronization, and hiding, embedding temporal proficiency in attacker capability metrics.Source: A. Temporal Adversary Capabilities · pp. 2–3, Table I · p. 3
- Actuation (A) captures the ability to affect a target during its access window through techniques such as directed jamming or malicious uplinks, bounded by visibility and engineering constraints.Examples include RF power shaping, waveform-layer jamming, protocol- or command-layer uplinks, and—in extreme cases—laser dazzling; constraints include line of sight, antenna pointing, and RF-chain availability.Source: A. Temporal Adversary Capabilities · p. 3
- Forecasting (F) uses orbital propagation, link geometry, and space-weather models to predict access windows, eclipse transitions, link-budget extrema, SAA crossings, and geomagnetic storms.The specified orbital models are SGP4 for near-Earth and SDP4 for deep-space objects.Source: A. Temporal Adversary Capabilities · p. 3
- Sensing (S) fuses near-real-time telemetry, beacon and side-channel monitoring, optical or radar observations, orbital data, and space-weather feeds into time-aligned awareness.Telemetry may come from compromised ground assets or attacker-controlled ground stations.Source: A. Temporal Adversary Capabilities · p. 3
- Synchronization (Y) aligns actions with a chosen window using stable clocks and delay compensation, while hiding (H) keeps effects within statistical bounds or times them alongside natural disruptions.Without synchronization, forecasting and sensing rarely yield reproducible effects; high hiding capability assumes baseline behavior models and competent statistical modeling.Source: A. Temporal Adversary Capabilities · p. 3
B. Temporal Exploitation Difficulty
The section separates Temporal Exploitation Difficulty (TED)—the difficulty of exploiting a technique at the right time—from static exploitation difficulty, then incorporates temporal considerations into expert-elicited likelihood ratings.
B. Temporal Exploitation Difficulty
- TED is orthogonal to static exploitation difficulty and measures the challenge of exploiting a technique at the right time, assuming the attacker can execute it in principle.Static difficulty covers code complexity, tooling, and non-temporal preconditions, following SPARTA [7].Source: B. Temporal Exploitation Difficulty · p. 3
- TED depends on intrinsic time-window properties and scenario-specific timing constraints that narrow or correlate the usable opportunities.Window duration, frequency, predictability, and repeatability shape intrinsic difficulty; an attack may also need to align with a narrow command window or critical mission phase.Source: B. Temporal Exploitation Difficulty · p. 3
- TED is evaluated from the system and scenario, while the five-dimensional temporal capability profile ⟨A, F, S, Y, H⟩ determines which attacker tiers can meet timing requirements.Intrinsic windows can be analyzed with orbit, link-geometry, radiation, SAA, and statistical models.Source: B. Temporal Exploitation Difficulty · pp. 3–4
- Likelihood remains a semi-quantitative, expert-elicited rating as in NRS [7], but elicitation now explicitly accounts for temporal considerations.It combines motivation, temporal capabilities, and time-varying exploitation difficulty.Source: B. Temporal Exploitation Difficulty · p. 4
C. Temporal Risk Matrix
The framework treats likelihood and impact as time-dependent, representing mission risk as a family of 5 × 5 matrices indexed by time rather than one static matrix. It discretizes missions into operational windows and environmental-severity bands so each receives a defined risk-matrix cell.
C. Temporal Risk Matrix
- Risk is represented as a time-indexed family of 5 × 5 matrices, with likelihood and impact modeled as functions of time and scored from 1 to 5.This preserves time-resolved risk while remaining compatible with the semi-quantitative matrix format.Source: C. Temporal Risk Matrix · p. 4
- Missions are divided into windows such as passes, lifecycle phases, or eclipse intervals, while storms and radiation transits are split into severity bands, each mapped to a matrix cell.LEOP can heighten TT&C vulnerability, whereas decommissioning can reduce vigilance and relax security; environmental risk can vary with storm intensity or radiation flux.Source: C. Temporal Risk Matrix · p. 4
- Likelihood levels vary by window or band through motivation, static exploitation difficulty, TED, and minimal attacker tier, and are piecewise constant within homogeneous classes for a fixed technique and objective.Likelihood changes between window classes or when the attack objective changes; impact reflects the consequences of a successful attack in each window.Source: C. Temporal Risk Matrix · p. 4
IV. CASE STUDY
The case study applies the temporal risk framework to STARMELT, mapped under SPARTA to EX-0013.01: Valid Commands. It scores sunlight and eclipse as separate windows because resource-depletion consequences vary with the satellite’s power regime.
IV. CASE STUDY
- The case study applies the framework to STARMELT, which SPARTA maps to EX-0013.01: Valid Commands [7].The technique involves issuing protocol-valid actions that progressively deplete onboard resources such as stored battery energy.Source: §IV · p. 4
- Sunlight and eclipse are scored as separate windows because the same technique has different consequences when the platform is power-positive versus discharging its battery.This preserves the 5 × 5 matrix while avoiding always-on throttling when power margins are available and a single average score that could understate eclipse risk.Source: §IV · p. 4
- 25 (High) is the static SPARTA NRS for high-criticality satellite systems, based on worst-case Likelihood and Impact.A uniformly High rating can encourage always-on throttling, while an average score can understate the short eclipse interval when resource depletion is most consequential.Source: §IV · p. 4
A. Likelihood Analysis
STARMELT’s likelihood assessment assumes a highly capable adversary and accounts for how mission-window timing and attack constraints affect temporal exploitation difficulty. It rates likelihood separately for sunlight and eclipse.
A. Likelihood Analysis
- The assessment assumes a highly motivated adversary with at least Tier-4 temporal capabilities, requiring STARMELT’s capability set MT = {A, F, S, Y}.These capabilities cover predicting eclipse and constellation dynamics, timing geo-distributed bots, and injecting enough protocol-conformant traffic to sustain congestion and elevated power draw; MT is treated as constant across illumination windows.Source: A. Likelihood Analysis · p. 5
- Eclipse’s shorter duration reduces temporal slack, retries, and margin for timing error, moderately increasing exploitation difficulty despite on-demand traffic injection requiring no warm-up.Effective execution still requires reaching and maintaining a sufficient injection rate within the window.Source: A. Likelihood Analysis · p. 5
- Ground-to-satellite link saturation is geometry-limited by footprint and line of sight, while inter-satellite link saturation is topology-limited by feasible routing paths as connectivity evolves.Illumination-driven operational behavior can further shrink the usable portion of either window and is treated as a scenario-specific constraint.Source: A. Likelihood Analysis · p. 5
- Likelihood is Very High (5) in sunlight and High (4) in eclipse, reflecting moderately higher temporal exploitation difficulty during eclipse.The eclipse window has less temporal slack and may have a smaller effective usable portion.Source: A. Likelihood Analysis · p. 5
B. Impact Analysis
Operational impact depends on the satellite’s power state: sunlight conditions are scored Low (2), while eclipse conditions are scored Very High (5).
B. Impact Analysis
- Under NASA criteria, sunlight impact is Low (2) as added computation does not increase battery DoD, while eclipse impact is Very High (5) as discharge and wear threaten mission operations.In the evaluated eclipse setting, battery life fell by up to ∼76% over 1.5 years; tight power margins can trigger safe modes and disrupt attitude control and communications.Source: B. Impact Analysis · p. 5
C. Operational Value
For high-criticality systems, eclipse carries the highest temporal risk, while sunlight is materially lower. This supports stricter eclipse controls and less restrictive non-critical throttling during sunlight, while retaining baseline safeguards.
C. Operational Value
- Eclipse carries the highest risk for high-criticality systems, while sunlight is materially lower.Table II presents the temporal risk comparison; the passage does not provide specific cell values.Source: C. Operational Value · p. 5, Table II · p. 5
- Apply stricter controls during eclipse, when temporal risk is highest.The passage identifies eclipse as the period warranting stricter controls.Source: C. Operational Value · p. 5
- During sunlight, less restrictive non-critical throttling can preserve throughput without relaxing baseline safeguards.The passage recommends this approach for sunlight periods.Source: C. Operational Value · p. 5
V. DISCUSSION · VI. CONCLUSION
The paper makes temporal context explicit in space-system risk assessment, representing risk through likelihood–impact matrices tied to operational windows and environmental bands. It identifies validation, strategic interaction, and constellation-scale modeling as open problems.
V. DISCUSSION
- The framework remains semi-quantitative because experts still elicit time-resolved likelihood and impact levels, and calibrating and validating temporal risk models remains open.Public space-cyber incident data are scarce and incomplete, rarely revealing how outcomes depend on timing.Source: §V · p. 5
- Standardized time-aware red-team exercises, simulations, and benchmarks are lacking but could test whether temporal risk profiles align with periods of greatest system vulnerability.Source: §V · p. 5
- The current framework treats temporal risk as a property of a system and adversary, leaving open how to model attackers choosing exploit windows and defenders timing hardening, monitoring, or rescheduling.Source: §V · pp. 5–6
- Temporal abstractions currently cover a single spacecraft and its environment, while enumerating windows, environmental bands, assets, and services across constellations and shared infrastructure does not scale.Source: §V · p. 6
- Staggered high-risk windows across orbital planes could enable temporal-diversity defenses, such as dynamically routing traffic away from vulnerable assets.Constellation-wide assessment still needs orbital-plane risk aggregation that preserves necessary temporal structure.Source: §V · p. 6
VI. CONCLUSION
- The framework augments attacker tiers with a temporal mastery profile, separates static from timing-related difficulty, and represents risk as likelihood–impact matrices parameterized by operational windows and environmental bands.This links assessment to orbital dynamics, mission timelines, and space weather.Source: §VI · p. 6