SpaceCOP - Houston, We Have an Intrusion

The talk argues that spacecraft have grown from isolated radios into networked, software-defined systems with a much larger attack surface, yet most operators still rely on ground-side telemetry monitoring. The speaker explains the blind spots: contact windows are intermittent, some attack effects never reach the downlink, and ground systems can be the origin of a compromise. Abuse of native functions, such as commanding a thruster at the wrong time or draining batteries, is presented as a more pressing concern than memory corruption.

The presenter introduces SpaceCOP, an open-source onboard intrusion detection application for NASA's Core Flight System. It maps behavioral indicators from the SPARTA framework to monitors covering the software bus, file integrity, memory, CPU use, and kernel-level system calls, with a kernel module extension. A small machine-learning component uses autoencoders to flag deviations from a learned baseline. The talk contrasts behavioral indicators with traditional indicators of compromise and notes that a spacecraft fault and a cyber event can look nearly identical.

The closing section offers practical lessons: establish what normal looks like before defining bad, adapt generic tools such as Snort to space protocols, and make detection mission-aware so responses do not interfere with critical phases. A two-spacecraft cross-link demonstration of threat sharing was shown, and automated response is named as the next step. Policy requirements are cited as a reason operators must add onboard detection now.