When a spacecraft is launched there is an understood ConOps that the vehicle will carry out during its lifetime. This ConOps can lead to repetitive patterns of behavior that is observable. But what happens when something new happens? This change of behavior can be observable but there are lots of challenges to identify a change. First an understanding of behavior has to be established, and in doing such there can be a very large amount of data that has to be compiled and understood. Secondly, that data has to be assessed every time new data is added in order to understand if the behavior is inline with previous behavior or an outlier.
This concept is rip for benefiting from AI/ML and that is exactly what Slingshot Aerospace did with the Agatha program. This program utilizes an artificial intelligence system that monitors the behavior of satellites in orbit and identifies anomalous spacecraft, specifically in large constellations. This ground based system was trained on over 60 years of simulated constellation data. Slingshot’s director of data science states this system ‘can find “needles in haystacks” and performs tasks that are near impossible for human analysts.’ 1. This type of system helps operators and monitors understand if a spacecraft is malfunctioning or is a spacecraft could be acting nefariously.
When applied to the space cyber domain, these types of monitoring systems have to be considered when building out your attack tree, specially the back half of the SPARTA TTPs, Persistence, Defense Evasion, Lateral Movement, Exfiltration, and Impact. If signatures of the spacecraft can be observed as anomalous then a response to an attack could be swifter than anticipated and the impact from a cyber attack can be minimized.
1 – https://spacenews.com/slingshot-unveils-ai-that-spots-satellite-anomalies-and-potential-bad-actors/
