Deep learning improves cyberattack detection in low earth orbit satellites
Temporal and Multimodal Deep Learning for Cyberattack Detection in LEO Satellite Systems
Cryptography and SecurityArtificial IntelligenceMachine Learning
Summary
Low Earth Orbit satellites face cyberattacks that are hard to detect because their data comes from many different sources like radio signals, onboard hardware, and orbital operations. The authors propose deep learning models that combine these different types of data and look at how attacks evolve over time. They tested their approach on a special dataset for satellite cyberattacks and showed their model can detect attacks with high accuracy even when tested under strict conditions where information leakage is minimized.
What this means in practice
- •For satellite cyber defense teams: Detect cyberattacks on LEO satellites by analyzing combined data from hardware, radio links, and orbital information using a hierarchical deep learning model.
- •For network security analysts: Improve detection of complex cyberattacks by applying multimodal temporal deep learning techniques originally designed for space communication systems.
Authors
Kyle Stein, Guillermo Francia, Eman El-Sheikh, Hossain Shahriar
Abstract
The growing reliance on Low-Earth Orbit (LEO) satellite communication systems has increased the need for intelligent methods capable of detecting cyberattacks across complex and dynamic space environments. Unlike conventional network intrusion detection, satellite systems generate heterogeneous information across radio-frequency (RF) links, onboard hardware, and orbital operations. However, many existing approaches either rely on terrestrial intrusion datasets or evaluate individual observations independently, limiting their ability to capture temporal attack behavior specific to LEO satellites. In this work, we conduct a systematic study of deep-learning-based cyberattack detection using the recently introduced satellite-specific UNSW-IoTSAT dataset. We investigate structured learning architectures that preserve hardware, orbital, and RF information, including a Subsystem-Fusion MLP and a hierarchical multimodal Transformer that models both cross-subsystem interactions and temporal evolution. We further evaluate leakage-resistant row-level and temporal settings, along with cross-satellite generalization, to characterize how model architecture and evaluation protocol influence satellite cyberattack detection. Experimental results demonstrate the value of structured multimodal modeling and rigorous evaluation, with the hierarchical Transformer achieving up to 91.66% accuracy and 85.63% macro F1 under the leakage-resistant evaluation protocol.