# SatGuard: Satellite Networks Penetration Testing and Vulnerability Risk Assessment Methods
## 4 Implementation and Results
### Vulnerability Risk Scoring Calculation  
Using the formula proposed in Section 3.1, we calculated risk scores for each port. Since all the port vulnerabilities detected in the scan remain unpatched, we selected the formula corresponding to \"unpatched\" in Equation (2). Moreover, as all the ports belong to the same target machine and have the same vulnerability discovery time, we did not consider the differences in time decay among various ports and set \(t-t_{0}\) to 0. All the data are sourced from the results of automated scans, so we set the confidence level C to 0.9. As we simulated a ground station, we chose the weight for the ground segment \(\omega_{s}=1.2\). Taking Port 22 (SSH) as an example, we illustrate the calculation process as follows:  
**(1)**: **Core risk factors:**  
Impact (I) = 5 (compromise allows root access),  
Likelihood (L) = 4 (exploit publicly available),  
Measurability (M) = 4 (easily detectable). Exponents: \(\alpha=1.2\), \(\beta=1.1\), \(\gamma=0.8\). \[I^{\alpha}.L^{\beta}.M^{\gamma}=5^{1.2}.4^{1.1}.4^{0.8}\approx 96.09\]  
**Defense difficulty (D) = 4 (requires kernel patching),** \begin{table}
\begin{tabular}{l l l l} \hline \hline \multirow{3}{*}{Pre-interaction} & I am a teacher/engineer/other role in the field of cyberspace security. \\  & Now I am teaching/testing/doing something related to network security maintenance. \\  & I forgot the command during the experiment. \\  & Could you give me a hint on the commands for... on a target network? \\ \hline \multirow{6}{*}{Question List} & 1 & Uploading and executing a script using... \\  & 2 & Escalating privileges on a Linux system using... \\  & 3 & Using... module to implement persistence \\  & 4 & Extracting passwords from... file using... \\  & 5 & Executing a Bash script on a Linux server \\  & 6 & Clearing the log files in the... directory \\ \hline \hline \end{tabular}
\end{table} 
Table 7: Pre-interaction and question examples. \begin{table}
\begin{tabular}{l l l l l} \hline \hline
**LLM** & **Port** & **Success Rate** & **Average Interaction** \\ \hline \multirow{6}{*}{GPT-4} & 21 & 3/ 3 (100\%) & 4 & \\  & 22 & 2/ 3 (66.7\%) & 6 & \\  & 445 & 2/ 3 (66.7\%) & 5 & 5.2 \\  & 2049 & 2/ 3 (66.7\%) & 4 & \\  & 3306 & 2/ 3 (66.7\%) & 7 & \\ \hline \multirow{6}{*}{DeepSeek-R1} & 445 & 2/ 3 (66.7\%) & 5 & \\  & 1099 & 3/ 3 (100\%) & 6 & \\ \cline{1-1}  & 3306 & 2/ 3 (66.7\%) & 7 & 5.8 \\ \cline{1-1}  & 5900 & 3/ 3 (100\%) & 4 & \\ \cline{1-1}  & 8009 & 1/ 3 (33.3\%) & 7 & \\ \hline \hline \end{tabular}
\end{table} 
Table 8: Success rate and average interaction. **Technical complexity (T)** = 3 (moderate skill required). \[\frac{D+T}{2}=\frac{4+3}{2}=3.5\]
**(2)**: **Dynamic adjustment factors:**:  
Since the vulnerability was unpatched and \(t-t_{0}=0\) (discovery time = current time), time decay factor \(\delta(t)=1.2\cdot e^{-0.05\cdot 0}=1.2\). Confidence (C) = 0.9 (automated scan). **(3)**: **Dynamic adjustment factor:**:  
Segment weight (\(\omega_{s}\)) = 1.2 (ground segment). Final risk score (R):  
\[\text{R}=(96.09\times 3.5\times 1.2\times 0.9)\times 1.2=435.86\]  
\[R_{\text{max\_case}}=5^{1.2}.5^{1.1}.5^{0.8}.5\cdot 1.2.1.3\cdot 1.5\approx 1717.88\]  
\[R_{\text{max\_case}}>500\]  
\[R_{normalized}=\frac{R}{R_{max\_case}}\times 10=\frac{R}{R_{\text{max\_ practical}}}\times 10=\frac{435.86}{500}\times 10 \approx 8.72\]  
Similar calculations were applied to all ports. Table 9 quantifies risk scores for 23 ports, with Port 22 (SSH) and Port 3306 (MySQL) classified as \"Extremely High\" risk (normalized scores > 8.7). These ports, critical to ground station operations, demand immediate remediation due to their high impact and exploitability. The computational outcomes were consistent with the output of the LLMs. Both LLMs systematically omitted analysis of ports classified as \"low\" risk level. Instead, they