PaperlayerView exact revision on arXiv

Source-linked AI summary

Temporal and Multimodal Deep Learning for Cyberattack Detection in LEO Satellite Systems

Kyle Stein, Guillermo Francia, Eman El-Sheikh, Hossain Shahriar

arXiv:2609.10746v1cs.CRcs.AIcs.LG

TL;DR

LEO satellite cyberattack detection must handle heterogeneous hardware, orbital, and RF data while capturing temporal behavior and avoiding evaluation leakage. The paper systematically compares structured Subsystem-Fusion MLP and hierarchical multimodal Transformer models under row-level, temporal, leakage-resistant, and cross-satellite settings. Under the leakage-resistant protocol, the hierarchical Transformer reaches 91.66% accuracy and 85.63% macro F1, while results also show that RF information and temporal modeling choices matter.

  • Problem

    Existing satellite cyberattack studies often use terrestrial datasets or evaluate observations independently, limiting evidence about temporal attack behavior in LEO systems.

  • Method

    The study compares structured Subsystem-Fusion MLP and hierarchical multimodal Transformer models using hardware, orbital, and RF features under leakage-resistant row-level, temporal, and cross-satellite evaluations.

  • Results

    91.66% accuracy and 85.63% macro F1 were achieved by the hierarchical Transformer under the leakage-resistant temporal evaluation.

  • Takeaways & Limitations

    Structured multimodal modeling and rigorous evaluation are valuable for satellite cyberattack detection, while temporal gains depend on how preceding observations are modeled.

  • Takeaways & Limitations

    Temporal context does not consistently improve all models, and strong within-satellite results do not always transfer consistently to unseen satellites.

Abstract

from arXiv · show

The growing reliance on Low-Earth Orbit (LEO) satellite communication systems has increased the need for intelligent methods capable of detecting cyberattacks across complex and dynamic space environments. Unlike conventional network intrusion detection, satellite systems generate heterogeneous information across radio-frequency (RF) links, onboard hardware, and orbital operations. However, many existing approaches either rely on terrestrial intrusion datasets or evaluate individual observations independently, limiting their ability to capture temporal attack behavior specific to LEO satellites. In this work, we conduct a systematic study of deep-learning-based cyberattack detection using the recently introduced satellite-specific UNSW-IoTSAT dataset. We investigate structured learning architectures that preserve hardware, orbital, and RF information, including a Subsystem-Fusion MLP and a hierarchical multimodal Transformer that models both cross-subsystem interactions and temporal evolution. We further evaluate leakage-resistant row-level and temporal settings, along with cross-satellite generalization, to characterize how model architecture and evaluation protocol influence satellite cyberattack detection. Experimental results demonstrate the value of structured multimodal modeling and rigorous evaluation, with the hierarchical Transformer achieving up to 91.66% accuracy and 85.63% macro F1 under the leakage-resistant evaluation protocol.

I. INTRODUCTION

LEO satellite systems expose heterogeneous hardware, orbital, and RF signals whose temporal structure matters for cyberattack detection. This work addresses these challenges with structured multimodal models and leakage-resistant row-level, temporal, and cross-satellite evaluations.

  • LEO systems support diverse services, while attacks can affect communication links, onboard hardware, orbital state, and RF measurements.
  • Existing progress is constrained by limited public datasets that jointly support multiclass cyberattack analysis and LEO operational and communication measurements.
  • Structured multimodal models jointly represent hardware, orbital, and RF telemetry for multiclass cyberattack detection across consecutive satellite observations.
  • Leakage-resistant partitions and matched row-level versus temporal evaluations test whether temporal context improves detection without mixing related attack observations across splits.
  • Cross-satellite testing trains on one satellite and evaluates on a completely unseen satellite to assess transferable cyberattack representations.

II. RELATED WORK

Prior satellite-security work spans threat characterization, conventional and neural detection methods, and operational anomaly datasets. This study uses UNSW-IoTSAT to compare structured learning, temporal modeling, and leakage-resistant evaluation across satellite-specific measurements.

  • Satellite intrusion-detection research includes SVM, decision-tree, and neural approaches, while operational datasets often describe anomalies rather than labeled cyberattacks.
  • UNSW-IoTSAT combines hardware, orbital, and RF measurements with labeled normal behavior and multiclass attacks across two satellite nodes.
  • The study compares model architecture, temporal context, and evaluation setting using leakage-resistant attack-instance partitions and row-level and temporal experiments.
  • The dataset contains seven target classes: normal, jamming, spoofing, DoS, MITM, replay, and eavesdropping.
  • The preprocessing retains 31 features spanning hardware, orbital, and RF groups while excluding identifiers and metadata from classifier inputs.
  • Temporal windows are formed after partitioning, use consecutive observations, and predict the class of the final observation while allowing attack transitions.

IV. PROPOSED METHOD

The paper proposes two structured deep-learning architectures that preserve hardware, orbital, and RF organization for satellite cyberattack detection. The Subsystem-Fusion MLP encodes each information source separately before concatenating the resulting representations for classification.

  • A. Subsystem-Fusion MLP: The Subsystem-Fusion MLP processes hardware, orbital, and RF measurements through separate modality-specific encoders before classification.This preserves subsystem-specific structure rather than directly concatenating all telemetry measurements.
  • A. Subsystem-Fusion MLP: For temporal windows, each modality encoder processes measurements while preserving chronological ordering before the subsystem representations are concatenated.
  • A. Subsystem-Fusion MLP: The fused representation is supplied to a classification network that maps it to logits over the target classes.
  • A. Subsystem-Fusion MLP: Unlike the Transformer, the Subsystem-Fusion MLP combines fixed subsystem representations through concatenation without attention-based relationships among modalities or satellite states.

B. Hierarchical Multimodal Transformer

The hierarchical multimodal Transformer models satellite telemetry in two stages: cross-subsystem interactions within each observation and temporal evolution across consecutive satellite states. It uses subsystem tokens, temporal positional information, and self-attention to produce a representation for final-observation classification.

  • B. Hierarchical Multimodal Transformer: The Transformer first models relationships among hardware, orbital, and RF information within each observation, then models relationships across consecutive satellite states.Stage 1 fuses subsystem information; Stage 2 captures temporal evolution.
  • B. Hierarchical Multimodal Transformer: Each subsystem is independently projected into a common embedding space and represented as a token for hardware, orbital, or RF conditions.A learnable subsystem classification token is added to the three modality tokens.
  • B. Hierarchical Multimodal Transformer: Self-attention enables RF conditions to be interpreted jointly with corresponding hardware and orbital conditions rather than independently.
  • B. Hierarchical Multimodal Transformer: The temporal stage applies a Transformer to consecutive fused satellite-state representations with a temporal classification token and learnable positional embeddings.The sequence contains one temporal classification token and L consecutive satellite-state representations.
  • B. Hierarchical Multimodal Transformer: The temporal classification output summarizes the window and is passed to a linear classification head, with the prediction corresponding to the final observation.

C. Training and Inference

Both architectures are trained end-to-end for supervised multiclass classification using the final observation in each temporal window. Inference uses only measurements, while preceding observations provide contextual information for the final decision.

  • C. Training and Inference: Both architectures use the class label of the final observation in each temporal window for supervised benign and malicious cyberattack classification.
  • C. Training and Inference: The models convert output logits into class probabilities over the target classes and optimize weighted multiclass cross-entropy.
  • C. Training and Inference: Class weights are computed from the total training targets, number of target classes, and per-class training counts to account for class imbalance.The weighting formula is wc = Ntrain/(Cnc).
  • C. Training and Inference: During inference, only satellite measurements from the current window are provided, and earlier labels are never used as model inputs.
  • C. Training and Inference: Each window produces one classification for its final observation, while preceding observations supply contextual information that may improve the decision.

D. Row-Level Variations

The study constructs matched row-level versions of the proposed models to isolate the contribution of temporal context. These variants retain subsystem processing but remove preceding observations and temporal attention.

  • D. Row-Level Variations: Row-level and temporal models are evaluated on identical target observations, enabling controlled comparison of pointwise and temporal detection.
  • D. Row-Level Variations: The row-level Subsystem-Fusion MLP retains modality-specific encoders and fusion but receives only the current subsystem feature vector.
  • D. Row-Level Variations: The row-level Transformer retains subsystem-level self-attention to fuse hardware, orbital, and RF measurements into a satellite-state representation.
  • D. Row-Level Variations: The row-level Transformer omits the temporal sequence, temporal classification token, and temporal positional embeddings, so no attention spans preceding observations.Performance differences therefore reflect temporal context under the matched-target design.

V. EXPERIMENTAL RESULTS

The experiments compare structured and unstructured learning approaches using matched partitions, multiple metrics, and repeated runs, with macro F1 prioritized for imbalanced classes.

  • The study compares Random Forest, XGBoost, monolithic MLP, and structured neural architectures for satellite cyberattack detection.
  • Macro F1 is the primary metric because it gives equal importance to each target class despite class imbalance.
  • All methods use the same data partitions and matched prediction targets, with accuracy, macro precision, macro recall, and macro F1 reported across five runs.
  • Neural models use weighted cross-entropy to address class imbalance and are trained with AdamW for up to 10 epochs.

A. Main Experimental Results

Matched row-level and temporal experiments show that structured architectures benefit from temporal modeling unevenly across attack classes. The temporal Transformer delivers the strongest overall performance, while confusion-matrix gains concentrate on selected attacks.

  • Main Experimental Results: 91.66% accuracy and 85.63% macro F1 make the hierarchical Transformer the strongest overall temporal model.It improves macro precision by 4.8% and macro recall by 2.5% over its row-level counterpart.
  • Main Experimental Results: Temporal context lowers macro F1 for Random Forest-T, monolithic MLP-T, and Subsystem-Fusion MLP-T relative to their row-level counterparts.The hierarchical Transformer differs by explicitly modeling relationships across satellite states with temporal self-attention.
  • Main Experimental Results: Transformer-T requires 0.041 ms per prediction, compared with 0.132 ms for Subsystem-Fusion MLP-T, illustrating a performance-efficiency tradeoff.The temporal Transformer combines the strongest classification performance with relatively low inference latency.
  • Main Experimental Results: Temporal modeling most improves Replay, Jamming, and MITM, while DoS remains frequently confused with Eavesdropping and Spoofing remains confused with Eavesdropping.Replay rises from 52.5% to 63.5%, Jamming from 96.0% to 99.1%, and MITM from 97.3% to 99.8%.

B. Cross-Satellite Generalization

Cross-satellite evaluation shows that transfer performance depends on both architecture and direction. Structured temporal models achieve the strongest reported transfers, whereas the monolithic MLP degrades sharply in both directions.

  • Cross-Satellite Generalization: The evaluation trains on one satellite and tests on the other unseen satellite, providing a stricter generalization test than the primary evaluation.
  • Cross-Satellite Generalization: 90.06% macro F1 is achieved by the temporal Transformer for Satellite 2 → Satellite 1 transfer.
  • Cross-Satellite Generalization: 88.47% macro F1 is achieved by the temporal Subsystem-Fusion MLP for Satellite 1 → Satellite 2, improving over its row-level counterpart at 80.19%.
  • Cross-Satellite Generalization: The monolithic MLP falls to 22.26% macro F1 for Satellite 2 → Satellite 1 in the row-level setting and 14.74% in the temporal setting.The strongest cross-satellite results come from structured temporal models, but transfer remains sensitive to direction.

C. Modality-Ablation

Modality and evaluation analyses show that RF measurements carry most discriminative information, while temporal context has an intermediate optimum and random-row partitioning inflates performance.

  • Modality-Ablation: 82.38% macro F1 from RF-only input makes RF the strongest individual modality for Transformer-T.Adding hardware raises Transformer-T to 85.47%, while the full H + O + RF configuration reaches 85.63%.
  • Modality-Ablation: Hardware-only and orbit-only inputs perform substantially worse than RF-only inputs across both temporal architectures.For Subsystem-Fusion MLP-T, RF-only reaches 75.03% macro F1; for Transformer-T, it reaches 82.38%.
  • Modality-Ablation: The relatively small gain from adding orbital information suggests limited additional discriminative value once hardware and RF measurements are available.
  • Modality-Ablation: L = 8 achieves the highest Transformer macro F1 at 84.78 ± 1.26 and the lowest variability among tested temporal windows.The L = 16 window is competitive but slightly lower and substantially less stable.
  • Modality-Ablation: 84.65% to 92.44% macro F1 for the Subsystem-Fusion MLP and 82.09% to 92.26% for the Transformer show that random-row partitioning substantially raises performance.Accuracy also increases by 4.23% and 4.39%, respectively.

VI. DISCUSSION & LIMITATIONS

The discussion links detection performance to architecture, temporal modeling, RF availability, and evaluation scope. It also identifies computational trade-offs and limits generalization claims to the UNSW-IoTSAT environment.

  • Temporal context benefits the hierarchical Transformer more consistently than the Random Forest, monolithic MLP, or Subsystem-Fusion MLP.Temporal self-attention explicitly relates representations across the observation window and may help identify attacks developing over time.
  • RF measurements provide most discriminative information, while hardware and orbital measurements add value for temporal models.Future evaluations should test performance when parts of the RF feature set are unavailable.
  • The hierarchical Transformer achieves the strongest overall performance, while the Subsystem-Fusion MLP performs best at the row level.The architectures therefore present different performance and computational trade-offs.
  • The Transformer offers a flexible adaptation foundation, but continual-learning and few-shot-learning approaches were not evaluated.Low-rank adaptation is identified as a possible future route for updating deployed models without retraining the complete network.
  • Cross-satellite transfer results support generalization within UNSW-IoTSAT but do not establish transfer to arbitrary satellite platforms.The dataset contains only two satellite nodes, motivating evaluation across more spacecraft, communication systems, and expansive datasets.
Loading 2609.10746v1…