Countering Cyber and RF Threats to National Security Space Systems

The ability to recognize, understand, characterize, and visualize the cyber and radio frequency (Cyber/RF) warfare environment in space is a prerequisite for creating actionable intelligence, enabling critical decisions, and creating operational advantage to counter devastating cyber intrusion and RF disruption of national security space assets. Cyber/RF engagements in space require position and alignment parameters, exquisite timing, and appropriate onboard sensors for both target and aggressor spacecraft. The effects of operating in space are visible through phenomenological signature changes such as photometric effects from reorienting a spacecraft and RF Doppler or modulation shifts based changes to onboard modes of operation. While invisible in cyberspace, varying degrees of observability of space offer an opportunity to provide indications and warning (I&W) prior to a Cyber/RF engagement. As a multi-phenomenology, persistent global monitor of the space domain with an established history in modeling and simulation (M&S) and battlespace visualization, ExoAnalytic Solutions (Exo) is uniquely postured to use its World-class observability of the space domain against this problem set. Exo’s cutting-edge optical tracking and passive RF capabilities feed real-time data to advanced analytical and visualization technologies supporting warfighters in decision-making. Exo will create a Cyber/RF threat profile ontology that maps specific observable satellite actions to the Cyber/RF threat continuum, identifying actions that must be or likely will be taken to execute a threat behavior and observable conditions those actions will create. Spacecraft behaviors that may appear ordinary or routine could be indicators of threat activity when viewed in a Cyber/RF threat context. Mapping the indicators to the range of Cyber/RF behaviors will form the context from which an alerting matrix can be established. Exo will create weighted alerts for each Cyber/RF threat behavior by considering observable data at scale, across spacecraft and their surrounding environments, across time, and using multiple phenomenologies. Instead of creating alerts from scratch, the Cyber/RF threat profile ontology will be overlaid on Exo’s automated alerting system (ExoALERT) to contextualize standard activity recognition algorithms that already include a wide range of observable events such as maneuvers and orientation changes. Exo will then use its SPySE threat visualization platform to model the created ontology’s execution against simulated data. Exo will simulate Cyber/RF behaviors to test the alerting system’s effectiveness in responding correctly and efficiently to Cyber/RF engagements.