HoneySat: A Network-based Satellite Honeypot Framework

TL;DR

HoneySat introduces the first high-interaction, network-based satellite honeypot that realistically simulates a CubeSat to entice and analyze adversaries. The framework couples a ground segment with exposed protocols and a space segment containing a Satellite Simulator and flight software services, enabling rich interaction data capture and extensibility across CSP and CCSDS ecosystems. Through operator surveys, realism assessments, internet deployments, and hardware-in-the-loop demonstrations, HoneySat demonstrates high fidelity in telemetry, command processing, and deception, while showing extensibility to additional mission types and real hardware. The work provides actionable insights for space cybersecurity, offers a reusable open-source platform, and opens avenues for digital twins and cyber range applications in satellite operations.

Abstract

Satellites are the backbone of several mission-critical services that enable our modern society to function, for example, GPS. For years, satellites were assumed to be secure because of their indecipherable architectures and the reliance on security by obscurity. However, technological advancements have made these assumptions obsolete, paving the way for potential attacks, and sparking interest in satellite security. Unfortunately, to this day, there is no efficient way to collect data on adversarial techniques for satellites, hurting the generation of security intelligence that can lead to the development of effective countermeasures. In this paper, we present HoneySat, the first high-interaction satellite honeypot framework, fully capable of convincingly simulating a real-world CubeSat, a type of Small Satellite (SmallSat). To provide evidence of HoneySat's effectiveness, we surveyed experienced SmallSat operators in charge of in-orbit satellites and deployed HoneySat over the Internet to entice adversaries. Our results show that 90% of satellite operators agreed that HoneySat provides a realistic and engaging simulation of a SmallSat mission. Additionally, HoneySat successfully deceived human adversaries in the wild and collected 22 real-world satellite-specific adversarial interactions. Finally, in a major demonstration of HoneySat's robustness, we collaborated with an aerospace company to perform a hardware-in-the-loop operation that resulted in HoneySat successfully communicating with an in-orbit, operational SmallSat mission.

Figures (7)

• Figure 1: The components commonly found in a satellite mission.
• Figure 2: HoneySat framework high-level architecture design.
• Figure 3: High-level architecture of the Satellite Simulator. Due to space limitations, we do not show all the available sensors and simulations.
• Figure 4: HoneySat's Theory of Operation.
• Figure 5: The view an attacker would see upon connection to the VNC server. Ground Station Control Software (Red) Ecosystem/Mission Specific MCS (Yellow).