Cyberattack Monitoring and Detection in Space Missions

As satellites have become more digitized and software-driven, the potential attack vectors are continuously growing. Cyber threats are comparatively inexpensive to develop relative to other anti-satellite technologies. Additionally, they possess a broad attack radius, capable of targeting entire constellations of satellites. Adversaries find cyber-attack particularly appealing to develop and deploy during times of conflict. For satellites, the primary vulnerabilities are often thought to be the communications link, i.e., the radio frequency link, or the ground system in general. If vulnerability is exploited, little internal protection exists within the satellite and an adversary can manipulate the system however they wish. The damage caused by cyber-attacks on military equipment and facilities will cause catastrophic failures to US military operations and jeopardize the safety of all US citizens around the globe.Both large traditional developments and more modern rapidly developed space systems should ensure that they have a cyber-hardened design with defense-in-depth throughout. In the traditional sense, when cyber security protections have been deployed, the focus has commonly been on the ground segment with little research or guidance on securing the space segment, i.e., the satellite. In this SBIR effort, Nokomis proposes to develop a space-hardened system for satellite cyber threat monitoring and cyber-attack identification.Nokomis will develop a novel and innovative cyber-attack monitoring and detection system to bolster the United States Space Force (USSF) Space Development Agency's (SDA) advancement of the Proliferated Warfighter Space Architecture (PWSA), which aims to deliver needed space-based capabilities to the joint warfighter to support terrestrial missions of a proliferated low Earth orbit (LEO) constellation of satellites. Nokomis’ Cyber Intrusion Protection System (CIPS) is an automated monitoring and detection product that identifies cyber-attacks. CIPS automatically assesses RF emissions from individual devices by way of the conducted and radiated emissions carried on communication bus cables such as Ethernet, allowing for remote monitoring of multiple devices within one system such as multiple PLCs or similar devices in an energy production facility. The Ethernet bus coupler prototype hardware was developed by Nokomis and used in a Phase I to monitor PLCs on a connected network, using a non-intrusive approach to capture emissions signals of electronics. Nokomis’ cyber-physical approach to detecting cyber threats allows for targeted detection of threats to critical satellite systems by monitoring these emissions features from communication signals and data.