Enhancing the hypatia simulator for LEO satellite networks with integrated DoS and DDoS attack capabilities

Abstract The increasing relevance of Low Earth Orbit (LEO) satellite constellations in next-generation communication systems highlights the importance of evaluating their security under realistic threat conditions.Hypatia provides a rich simulation environment for end-to-end LEO communications but lacks native support for modeling cyberattacks. This paper introduces an extension of Hypatia that enables the simulation of Denial of Service (DoS) and Distributed DoS (DDoS) attacksoriginating from ground stations in the Satellite-Terrestrial Integrated Network (STIN). The framework implements four representative attack types: a state-exhaustion attack (TCP SYN flood), two volumetric attacks (UDP and ICMP floods), and a low-rate pulsing attack (Shrew). Attack campaigns are defined through a scheduler file, allowing programmable and reproducible experiments with flexible control of attacker scale and timing. The framework’s effectiveness is demonstrated by analyzing the impact of these attacks on TCP performance across several LEO constellations (Starlink, Kuiper, and Telesat). This contribution provides a practical tool for evaluating mitigation strategies and serves as a methodological reference for integrating new attack models, laying the groundwork for future research on security challenges in LEO networks.