💻 computer science

SatForensics: A Transformer-Based Multi-Modal Framework for Cyber-Attack Detection,Attribution, and Chain-of-Custody Forensics in Low-Earth-Orbit Satellite Communication Networks

This paper introduces SatForensics, a Transformer-based multi-modal framework that integrates satellite telemetry, RF interference, and GPS reflectometry to achieve high-accuracy cyber-attack detection and attribution while maintaining a tamper-evident chain of custody for Low-Earth-Orbit satellite networks.

Original authors: Keshav Kaushik, Mahran Al-Zyoud, Priyanka Gaur, Gaurav Rajput, Manpreet Singh, Rahul Joshi

Published 2026-09-22

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Keshav Kaushik, Mahran Al-Zyoud, Priyanka Gaur, Gaurav Rajput, Manpreet Singh, Rahul Joshi

Original paper licensed under CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The sky above us is no longer empty. It is becoming a crowded highway of thousands of small satellites, buzzing in low orbits just a few hundred miles above the Earth. These machines, part of massive constellations like Starlink and OneWeb, beam internet and communication signals to ships, planes, and remote villages. They are the invisible infrastructure of our modern world. But this new frontier brings a new kind of danger. Unlike a computer on a desk, these satellites cannot be easily reached for repairs, and their signals travel through open space where anyone with the right equipment can listen in or interfere. When a satellite is hacked, the evidence is often fleeting, scattered across different types of data, and difficult to piece together after the fact. Scientists have long struggled to build tools that can spot these attacks in real time, figure out who is responsible, and keep a secure record of what happened, all while dealing with the unique, chaotic nature of space travel.

A team of researchers has now introduced a new system called SatForensics, designed specifically to solve these problems for low-orbit satellite networks. Instead of relying on a single type of data, the system acts like a multi-sensory investigator, watching three different streams of information at once. It looks at the internal health reports of the satellite, known as housekeeping telemetry; it listens for strange radio noise that might indicate jamming or spoofing; and it watches for odd patterns in how GPS signals bounce off the Earth's surface. By feeding these three streams into a powerful computer model based on the Transformer architecture—a type of artificial intelligence known for spotting complex patterns in sequences—the system can detect an attack the moment it happens. It does not just sound an alarm; it immediately tries to identify the type of attack from five specific categories, such as signal jamming or unauthorized command injection, and then locks the evidence into a secure, unchangeable digital ledger.

The researchers tested this system using real-world data collected from three different sources: a global network of ground stations tracking amateur satellites, NASA's GPS reflection satellites, and international records of radio interference. The results were striking. In tests designed to mimic real-world conditions, SatForensics correctly identified cyber-attacks 97.6 percent of the time, a significant improvement over existing methods that rely on older technology or look at only one type of data. When the system did detect an attack, it was also able to correctly identify the specific type of threat 94.2 percent of the time. Perhaps most importantly for legal and security purposes, the system created a tamper-proof record of every event. It added a cryptographic seal to each piece of evidence in less than half a millisecond, ensuring that the record could not be altered or deleted without detection. This speed is crucial, as satellite networks generate data so fast that slower systems would fall behind.

What makes this approach different is how it handles the messy reality of space. Satellites often lose contact with the ground for short periods, or their sensors might be temporarily blinded by interference. Older systems often fail when data is missing, but SatForensics uses a "gated" mechanism that allows it to keep working even if one of its three senses goes blind. If the GPS sensor is jammed, for instance, the system automatically shifts its focus to the radio and telemetry data, maintaining its ability to spot trouble. The researchers also found that the system remained effective even when tested on satellite missions it had never seen before, proving that it can generalize its knowledge to new situations. This resilience suggests that the system is robust enough to handle the unpredictable environment of low-Earth orbit, where conditions change rapidly and data is often incomplete.

The study also addressed the difficult question of who is behind an attack. By categorizing threats into five distinct archetypes, the system moves beyond simply saying "something is wrong" to explaining exactly what is happening. It can distinguish between a simple signal jamming attempt and a more sophisticated effort to inject false data into the satellite's internal logs. This level of detail is vital for attribution, helping operators understand the nature of the threat and potentially trace it back to its source. The system achieved this high level of accuracy without requiring massive amounts of computing power, making it feasible to run on the ground stations that manage these networks. In fact, the researchers showed that with some compression, the system could even run directly on the satellites themselves, bringing advanced security to the edge of space.

While the results are promising, the authors are careful to note that this is a framework built for specific conditions and tested on available historical data. They suggest that future work will need to explore how to share threat intelligence between different satellite operators without revealing sensitive details, and how to use simulations to train the system on attack patterns that have not happened yet. For now, however, SatForensics offers a concrete step forward. It provides a way to watch the sky with multiple eyes, to understand the language of an attack, and to keep a record that cannot be erased. As our reliance on space-based technology grows, having a system that can not only see the danger but also preserve the truth of what happened becomes essential for keeping the digital world connected and secure.

Technical Summary: SatForensics

Problem Statement
Low-Earth-Orbit (LEO) satellite constellations, such as Starlink and OneWeb, have expanded global broadband connectivity but introduced a distinct and expanded cyber-attack surface. Traditional terrestrial intrusion detection systems (IDS) and digital forensics tools are ill-suited for LEO environments due to unique operating constraints. These include Doppler-shifted telemetry, intermittent contact windows with ground stations, and resource-constrained hardware. Furthermore, existing methods rarely integrate attack detection, attacker attribution, and tamper-evident evidence logging into a unified pipeline designed specifically for orbital dynamics. The paper addresses the need for a framework capable of detecting cyber-attacks, attributing them to specific adversarial archetypes, and preserving a verifiable chain of custody for legal and regulatory scrutiny within these complex networks.

Methodology: The SatForensics Framework
The authors propose SatForensics, a Transformer-based multi-modal framework designed to operate across three coupled tasks: binary attack detection, adversarial attribution, and forensic logging.

Multi-Modal Data Fusion: The system ingests three distinct data modalities:
1. Satellite Housekeeping Telemetry: Extracted from SatNOGS archives (41 parameters).
2. Radio-Frequency (RF) Interference Indicators: Derived from ITU-R reported interference records.
3. GPS Reflectometry (GPS-R) Anomaly Signatures: Sourced from NASA's CYGNSS constellation (Delay-Doppler Map data).
Gated Multi-Modal Encoder: To handle the intermittent nature of satellite contact windows and potential sensor dropouts (e.g., GPS jamming), the framework employs a soft-gating mechanism. This layer dynamically adjusts the weights of input modalities; if a channel is suppressed, the gate automatically routes fusion weights to the remaining available modalities.
Transformer Architecture: The fused data is processed by a multi-head self-attention encoder (6 layers, 8 heads, 256 model dimension). Sinusoidal positional encodings are utilized to adapt to the uneven sampling intervals inherent to satellite passes. The architecture captures long-range temporal dependencies without the gradient decay issues typical of recurrent models like LSTMs.
Attribution Sub-Network: A dedicated head maps detected intrusions to five specific adversarial archetypes derived from historical incident data: Signal Jamming (SJ), GPS Spooﬁng (GS), Telemetry Injection (TI), Ground Station Intrusion (GSI), and Orbital Disruptive Command (ODC).
Chain-of-Custody Forensic Ledger: To ensure evidence integrity, the system generates a hash-chained ledger using SHA-256. Each detected event creates a forensic block containing the timestamp, observation window, detection score, attribution, and a cryptographic hash of the previous block. This ensures tamper-evidence, where any post-hoc modification is detectable with a probability of at least $1 - 2^{-256}$ .
Training Objective: The model is trained end-to-end using a composite loss function comprising weighted binary cross-entropy for detection, categorical cross-entropy for attribution, and an InfoNCE-based Mutual Information (MI) alignment loss to ensure cross-modal feature consistency.

Key Contributions

Unified Framework: The first system to combine attack detection, source attribution, and chain-of-custody logging specifically tailored for LEO satellite constraints.
Gated Multi-Modal Learning: Development of a gated encoder that maintains robustness during RF outages or GPS jamming by dynamically re-weighting input modalities.
Threat Taxonomy: Formalization of five LEO-specific adversarial archetypes to structure the orbital attack surface.
Lightweight Forensic Ledger: Implementation of a hash-chained ledger with sub-millisecond overhead, suitable for high-rate downlink environments.
Comprehensive Evaluation: Rigorous testing across three real-world datasets (SatNOGS, CYGNSS, ITU-R) against six baseline models (SVM, Random Forest, CNN, LSTM, single-modality Transformer, and a non-gated variant).

Experimental Results
Evaluated on a combined dataset of over 440,000 samples, SatForensics demonstrated superior performance compared to baselines:

Attack Detection: Achieved a macro-averaged F1-score of 97.6% and an AUC of 0.992. This outperformed the single-modality Transformer baseline by 3.7 percentage points and the LSTM baseline by 5.5 percentage points.
Attack Attribution: Achieved a macro-F1 score of 94.2% across the five adversarial archetypes, outperforming the single-modality Transformer by 3.3 percentage points.
Forensic Overhead: The hash-chained ledger introduced a median latency of 0.47 ms per logged event, maintaining throughput above 1,600 events/second, which satisfies operational LEO ground-segment requirements.
Robustness: Ablation studies confirmed that removing the multi-modal fusion caused the largest performance drop (6.3 pp in detection F1), validating the necessity of combining telemetry, RF, and GPS-R data. The gated mechanism proved critical, as removing it resulted in a 2.9 pp drop in F1 during channel loss scenarios.

Significance and Claims
The paper claims that SatForensics addresses a critical gap in satellite cybersecurity by providing a pipeline that is not only accurate but also forensically sound. By integrating detection, attribution, and immutable logging, the framework supports the reconstruction of attack timelines and the secure preservation of evidence required for regulatory or legal scrutiny. The authors emphasize that the system's ability to handle missing modalities via gating makes it uniquely resilient to the specific physical-layer disruptions (jamming, spooﬁng) common in LEO environments. The framework is presented as deployable in both ground-segment operations centers and, with quantization and pruning, on Size, Weight, and Power (SWaP)-constrained on-orbit computers. The work concludes by noting that while historical data was used to avoid synthetic bias, future work will explore simulation-driven augmentation and federated learning for cross-constellation threat intelligence.

Technical Summary: SatForensics

More like this