SAT-DEF: satellite Internet security threat analysis and dynamic evolution framework

The rapid deployment of LEO mega-constellations and widespread use of COTS technologies are transforming satellite Internet from a closed system into an open, integrated ecosystem—significantly altering its security landscape. Traditional “security through obscurity" strategies, based on information isolation, are increasingly inadequate given trends such as open signal intelligence, IP-based attack surfaces, and software-defined payloads. To address key modeling challenges in space-air-ground integrated networks—especially the difficulty in uniformly characterizing cross-layer attacks and capturing the dynamic evolution of attack tactics—this paper proposes the satellite Internet security threat analysis and dynamic evolution framework (SAT-DEF). SAT-DEF constructs four logically linked attack chains from an attacker's viewpoint: signal-network joint intrusion, multi-domain network infiltration, multi-dimension impact execution, and post-attack persistence. These chains systematically model threat evolution from the signal to the network layer and from initial intrusion to long-term control. A dynamic phase-transition mechanism is introduced to simulate attacker-defender interactions, supporting the analysis of complex attack paths and composite tactics. Based on behavioral reconstruction and simulation of the KA-SAT incident, SAT-DEF effectively reproduces attacker behavior and assesses its impact. The framework shows clear strengths in cross-layer integration, lifecycle coverage, and dynamic adaptability, providing an extensible foundation for proactive threat awareness, behavior analysis, and defense decisions in satellite Internet.