Characterizing Cyber Attacks against Space Systems with Missing Data: Framework and Case Study

TL;DR

This paper proposes a framework to characterize cyber attacks on space systems using limited and incomplete data, extrapolating attack details to analyze trends and vulnerabilities.

Contribution

It introduces a novel framework with metrics for analyzing space system cyber attacks and addresses missing data by principled extrapolation methods.

Findings

Cyber attacks on space systems are becoming more sophisticated.

Extrapolated data reveals 4,076 attack techniques from limited reports.

Preventing on-path and social engineering attacks could have stopped 80% of incidents.

Abstract

Cybersecurity of space systems is an emerging topic, but there is no single dataset that documents cyber attacks against space systems that have occurred in the past. These incidents are often scattered in media reports while missing many details, which we dub the missing-data problem. Nevertheless, even "low-quality" datasets containing such reports would be extremely valuable because of the dearth of space cybersecurity data and the sensitivity of space systems which are often restricted from disclosure by governments. This prompts a research question: How can we characterize real-world cyber attacks against space systems? In this paper, we address the problem by proposing a framework, including metrics, while also addressing the missing-data problem, by "extrapolating" the missing data in a principled fashion. To show the usefulness of the framework, we extract data for 72 cyber attacks against space systems and show how to extrapolate this "low-quality" dataset to derive 4,076 attack technique kill chains. Our findings include: cyber attacks against space systems are getting increasingly sophisticated; and, successful protection against on-path and social engineering attacks could have prevented 80% of the attacks.