Hacking Space to Defend It: Generating IoBs with SPARTA
Applies offensive techniques from the SPARTA framework to generate behavioral indicators (IoBs) and design realistic intrusion detection systems for spacecraft.
Summary
The Need for Threat-Informed Space Defense
While the SPARTA (Space Attack Research and Tactic Analysis) framework cataloged spaceborne cyber threats, mission operators needed empirical methods to detect these attacks in operational environments.
Simulating Space Attacks and TTP Replay
Brandon Bailey details hands-on offensive testing against simulated spacecraft flight software and telemetry buses to observe behavioral anomalies and telemetry patterns generated during active attacks.
Generating Indicators of Behavior (IoBs)
From these simulations, researchers developed concrete Indicators of Behavior (IoBs)—such as unexpected CPU scheduling spikes, anomalous telemetry packet rates, and out-of-sequence command verifications—tailored to resource-constrained flight computers.
Designing Spaceborne Intrusion Detection Systems
Integrating data-driven IoBs into spacecraft IDS architectures enables real-time threat detection aboard satellites without overloading onboard computing resources.
Related talks
Creator Stage·21 min
Ben Hawkins
Demonstrates purple team methodologies applied to satellite ground segments and flight software to validate threat detections and improve space cyber defenses.
Creator Stage·43 min
Josh Pyorre
Explores building detection signatures from network transaction timing intervals to identify malicious command-and-control communication.
Creator Stage·55 min
E Tahoun · L Hamida
Demonstrates how open-source data science models cluster heterogeneous security alerts to uncover coordinated multi-stage cyber attacks.