⚡ electrical engineering

Resilience Through Escalation: A Graph-Based PACE Architecture for Satellite Threat Response

This paper proposes a graph-based PACE architecture that adapts military communication redundancy strategies to satellite systems, utilizing threat scoring and dynamic decision-making variants to significantly enhance resilience against modern space threats like jamming and cyberattacks.

Original authors: Anouar Boumeftah, Sarah McKenzie-Picot, Peter Klimas, Gunes Karabulut Kurt

Published 2026-03-31

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Anouar Boumeftah, Sarah McKenzie-Picot, Peter Klimas, Gunes Karabulut Kurt

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a satellite orbiting Earth is like a high-tech delivery truck driving through a city that is constantly under attack. Sometimes the attacks are natural (like a sudden storm), but often they are deliberate (like a hacker trying to steal the truck's keys or a jammer blocking the GPS signal).

For a long time, engineers built these "trucks" with static redundancy. Think of this like having a spare tire in the trunk. If the first tire blows out, you swap it for the spare. It's a good plan for random accidents, but it fails if the whole road is blocked, or if the bad guys know exactly where your spare tire is and blow that out too.

This paper proposes a smarter way to handle trouble, using a military strategy called PACE.

What is PACE?

PACE stands for Primary, Alternate, Contingency, and Emergency. Instead of just having one backup, it's like having a whole ladder of escape plans:

Primary: The normal, happy way of driving (using the main GPS and radio).
Alternate: If the main GPS is jammed, switch to a backup map and a different radio frequency.
Contingency: If both are blocked, switch to a "survival mode" where you just send a simple "I'm alive" signal and wait for help.
Emergency: The absolute last resort, like a flare gun, to ensure the satellite doesn't just vanish silently.

The Problem with Old Plans

The authors argue that most satellites today are like drivers who only have a spare tire. If the road gets blocked by a coordinated attack (like a cyber-hack or a massive jamming signal), the spare tire doesn't help. The satellite gets stuck or crashes.

The New Solution: A "Smart Driver"

The paper introduces a Graph-Based PACE Architecture. Imagine the satellite's brain isn't just a list of rules, but a map of a video game.

The Map (Graph): Every possible state of the satellite is a "room" on the map. The "Primary" room is the VIP lounge. The "Emergency" room is the lifeboat.
The Transitions: Moving between rooms costs energy and time.
The Threat Score: The system constantly checks a "danger meter" (using scores like CVSS, which rates how bad a cyber threat is).

The authors tested three different "drivers" to see who could navigate this map best when the city started getting attacked:

The Static Driver (The Old Way): This driver follows a pre-written script. "If GPS fails, go to Room B." It doesn't look around. If the attack is weird or changes, this driver panics and often ends up in the "Failure" room.
The Adaptive Driver: This driver looks out the window. "Oh, the jamming signal is getting stronger? Okay, I'll switch to the backup radio faster." It's better, but it's still reacting to the immediate problem.
The $\epsilon$ -Greedy Driver (The Winner): This is the smartest driver. It uses a bit of AI logic (specifically, a strategy called $\epsilon$ $ϵ$ -greedy).
- Exploitation: It usually picks the move that gives the best result (highest utility, lowest cost).
- Exploration: Occasionally, it tries a random move just to see if there's a better path it missed.
- The Result: This driver doesn't just react; it learns the best way to survive the chaos. It balances staying safe with keeping the mission going.

The Results: Who Won the Race?

The researchers ran 5,000 simulations (like playing the video game 5,000 times) with a sudden "crisis" event.

The Static Driver: Got stuck in "degraded" mode (driving slowly and blindly) or crashed 24% of the time. It wasted a lot of fuel trying to fix things the wrong way.
The Adaptive Driver: Did better, crashing only 17% of the time.
The $\epsilon$ -Greedy Driver: Crushed it. It stayed in "normal" mode 82% of the time, even during the attack. It spent the least amount of fuel (cost) and kept the mission running the longest.

Why This Matters

The paper concludes that for the future of space travel, we can't just build stronger shields (static redundancy). We need smart, flexible brains on our satellites.

By using this "PACE" ladder and a smart decision-making algorithm, satellites can survive coordinated attacks, cyber-hacks, and jamming without needing to be massive, expensive super-computers. It's about being agile—knowing when to switch plans, when to hide, and when to fight back, ensuring that even if the road gets blocked, the delivery still gets made.

In short: Don't just carry a spare tire. Learn to drive a car that can switch lanes, take a detour, or even drive off-road if the highway is closed. That's the future of safe space travel.

1. Problem Statement

Modern satellite systems operate in increasingly volatile environments characterized by dynamic, multi-vector threats, including cyberattacks, signal jamming, spoofing, and Electromagnetic Pulse (EMP) events.

Limitations of Current Solutions: Traditional redundancy strategies (e.g., N+1, Triple Modular Redundancy) are largely static. While effective against random hardware failures, they fail against coordinated or adaptive attacks where redundant units may share the same vulnerability (common-mode failure).
The Gap: Existing threat modeling frameworks (CVSS, DREAD, NASA Risk Matrix) are often disconnected from real-time onboard decision-making systems. There is a lack of a unified, adaptive architecture that can dynamically transition between operational modes based on evolving threat conditions and mission utility.

2. Methodology

The authors propose a Resilience-by-Design framework that adapts the PACE methodology (Primary, Alternate, Contingency, Emergency)—originally used in military tactical communications—to satellite systems.

A. Graph-Based Formalization

The framework is modeled as a directed multi-layer graph $G = (S, T)$ :

States ( $S$ ): Organized into four layers representing operational viability:
1. Primary (P): Nominal operation.
2. Alternate (A): Degraded but functional.
3. Contingency (C): Survivability under stress.
4. Emergency (E): Minimal operation or distress signaling.
Transitions ( $T$ ): Directed edges between states annotated with:
- Probability ( $p$ ): Likelihood of transition based on threat scores (derived from CVSS, DREAD, or NASA matrices).
- Cost ( $c$ ): Operational penalties (energy, reconfiguration time, utility loss).

B. Evaluation Metric: Dynamic Redundancy Efficiency Index (DREI)

To quantify resilience, the authors introduce the DREI, which balances mission utility against the cost of transitions:
$DREI_t = \frac{\sum_{s \in S} \omega^*_t(s) \cdot P_t(s)}{C_t}$

$\omega^*_t(s)$ : Adjusted utility (with a multiplier $\kappa$ for returning to nominal state).
$C_t$ : Cumulative cost of transitions up to time $t$ .
Goal: Maximize DREI by maintaining high utility while minimizing transition costs.

C. Simulation Variants

The authors implemented and compared three PACE variants using 5,000 Monte Carlo trials in a signal jamming scenario ( $T=12$ timesteps):

Static PACE: Uses fixed transition weights (baseline, analogous to traditional redundancy).
Adaptive PACE: Adjusts transition probabilities and costs in real-time based on jamming intensity ( $J_t$ ) and recovery concurrency.
$\epsilon$ -Greedy PACE: A Markov Decision Process (MDP) inspired approach. It selects transitions by maximizing the reward $R = \text{Utility} - \text{Cost}$ , with an $\epsilon$ probability of random exploration to avoid local optima.

3. Key Contributions

PACE Adaptation: Successfully adapted the military PACE planning concept for satellite operations in contested orbital environments.
Threat-Driven Decision Model: Designed a model that selects optimal fallback layers based on a trade-off between mission utility and operational cost.
Formalized Transitions: Introduced an $\epsilon$ -greedy, reward-driven mechanism to enable traceable escalation and recovery strategies.
New Metric (DREI): Defined a quantitative index to evaluate the trade-off between performance and fallback costs.
Empirical Validation: Demonstrated through simulation that lightweight, decision-aware fallback mechanisms significantly outperform static redundancy.

4. Results

The simulation focused on a jamming scenario with a crisis event at timestep 2.

Metric	Static PACE	Adaptive PACE	$\epsilon$ -Greedy PACE
Final Utility	0.73	1.04	2.08
Total Cumulative Cost	34.45	28.48	23.35
DREI	0.02	0.04	0.09
Final Nominal State %	23.4%	35.1%	82.0%
Failure Rate	24.2%	17.2%	9.3%

Performance: The $\epsilon$ -greedy model significantly outperformed both baselines, achieving the highest utility recovery and the lowest cost accumulation.
Stability: The $\epsilon$ -greedy model produced a tight, low-variance cost distribution, whereas the static model showed broad, high-variance outcomes, indicating sensitivity to initial conditions and crisis timing.
Recovery: Post-crisis, the $\epsilon$ -greedy model recovered utility steadily (stabilizing near 0.85), while static and adaptive models struggled to regain nominal performance.

5. Significance and Conclusion

Beyond Static Redundancy: The paper proves that resilience in contested space environments cannot rely solely on static hardware redundancy. Systems require context-aware, adaptive logic to survive coordinated attacks.
Lightweight Intelligence: The study demonstrates that complex, full-scale Reinforcement Learning is not strictly necessary; simple, reward-based $\epsilon$ -greedy policies can deliver substantial resilience gains with low computational overhead.
Graceful Degradation: Designing for multi-layered fallback (PACE) allows satellites to maintain critical functions even when nominal operations are compromised, reducing the risk of total mission loss.
Future Work: The authors plan to extend validation to multi-threat scenarios (cyber-intrusion, EMP), longer simulation horizons, and multi-crisis sequences to further substantiate the framework's applicability.

In summary, this paper provides a robust theoretical and empirical foundation for next-generation satellite systems, advocating for a shift from passive redundancy to active, graph-based resilience strategies capable of dynamic escalation and recovery.