SPARTA: Threat Model for Space Systems

▶ Watch (0:41)

SPARTA is a threat model for space systems, modeled after MITRE ATT&CK. Published October 2022, it covers electronic warfare, ASATs, and cyber techniques. The framework has 215 techniques. It aims to drive blue team defense by decomposing threats into countermeasures and requirements. Attack data is scarce (only a dozen known attacks), so SPARTA also projects potential attack paths. The latest addition is indicators of behavior for intrusion detection.

Generating Indicators of Behavior from SPARTA

▶ Watch (3:12)

To enable intrusion detection on spacecraft, the team derived 200 indicators of behavior from SPARTA’s most dangerous techniques over six months. They used the OASIS STIX standard for IoBs. The indicators fall into 10 categories: anomalous commanding, crypto key manipulation, network exploitation, RF integrity, timing/GPS, memory and resource utilization, watchdog registers, software integrity, sensor manipulation, and data integrity.

Building and Testing Space Cop IDS

▶ Watch (12:16)

The team built an IDS called Space Cop using 30 of the 200 indicators. They deployed it on NOSC cubed, an open-source NASA digital twin. A time spoofing attack (changing the spacecraft clock) triggered an alert. A more advanced test used Blackout, a rogue CFS application simulating malware upload and ransomware. The detection fired when the file touched a restricted disk area. However, detection occurs on the ground after telemetry downlink, which can take 15 minutes.

Scaling to Real Missions with Automated Mapping

▶ Watch (16:24)

To prove scalability, the team worked with a real mission. They used AI to automatically map all 200 IoBs to 90,000 telemetry items (pneumonics) on the spacecraft. This automated mapping addresses the industry concern that manual mapping would be too time-consuming. The IoBs were integrated into DAR, an existing ground-based IDS from Aerospace Corp, expanding its capability from signal interference to cyber intrusion detection.

From Detection to Autonomous Response

▶ Watch (21:52)

Detection alone is insufficient for spacecraft. The control loop latency is too low (telemetry downlink can take 15 minutes). The industry must integrate autonomous response with fault management. The speaker’s 2019 paper argued for this approach. IoBs are a step: they provide the detection triggers needed for automated action. Spacecraft already manage themselves autonomously for other faults. Security should follow the same model.

Notable Quotes

So detection doesn’t equal mitigation. Brandon Bailey · ▶ 21:52

you wouldn’t even know it happened until the telemetry came down on the down link Brandon Bailey · ▶ 14:38

if that was a real attack and then all you saw was in the telemetry on the down link those messages, you’d be in a world of hurt Brandon Bailey · ▶ 21:34

Key Takeaways

  • SPARTA now provides 200 indicators of behavior for spacecraft intrusion detection.
  • Space Cop IDS using 30 IoBs detected time spoofing and a rogue app on a NASA digital twin.
  • Automated mapping to 90,000 telemetry items proves IoBs scale to real missions.