# SatGuard: Satellite Networks Penetration Testing and Vulnerability Risk Assessment Methods
## 3 Satellite Networks Vulnerability Risk Assessment Method
### Satellite Networks Vulnerability Risk Assessment Formula
#### 3.1.3 Environmental Weighting Factor  
Environmental weighting factor tailors risk evaluations to the strategic importance of satellite network segments.  
Segment weight (\(\omega_{s}\)): This weight adjusts risk scores according to the criticality of affected segments:  
\[\omega_{s}=\begin{cases}1.5&Space\ Segment\\ 1.2&Ground\ Segment\\ 1.0&User\ Segment\end{cases} \tag{3}\]The hierarchical weighting (equation (3)) prioritizes space (\(\omega_{\rm s}=1.5\)) and ground segments (\(\omega_{\rm s}=1.2\)) due to their critical roles in command/control, while user segments (\(\omega_{\rm s}=1.0\)) are periodically reassessed to address emerging threats like low-orbit terminal breaches.  
Normalization and Risk Level Classification  
The nonlinear amplification exponents (\(\alpha\), \(\beta\), \(\gamma\)) in Formula (1) play a pivotal role in shaping risk scores. These parameters are not merely coefficients but context-sensitive multipliers that reflect mission-critical trade-offs. For instance, prioritizing high-impact vulnerabilities (\(\alpha=1.5\)) amplifies their scores exponentially, while suppressing low-measurability threats (\(\gamma=0.5\)) mitigates underestimation of stealth attacks. Critically, the interdependency of these exponents means that assuming simultaneous maxima for \(\alpha\), \(\beta\), and \(\gamma\) (e.g., \(\alpha=1.5\), \(\beta=1.3\), \(\gamma=0.5\)) would yield unrealistically inflated risk scores, as real-world vulnerabilities rarely exhibit such parameter combinations. And the exponents (\(\alpha\), \(\beta\), \(\gamma\)) are assigned based on empirical analysis of historical incidents rather than arbitrary maxima.  
To address this, we calculate case-specific maximum risk scores (\(R_{\rm max\_case}\)) for each vulnerability using its actual assigned exponents (\(\alpha\), \(\beta\), \(\gamma\)) while holding other parameters at theoretical maxima (I = 5, L = 5, M = 5, D = 5, T = 5, \(\delta\)(t) = 1.2, C = 1.3, \(\omega_{\rm s}=1.5\)). This approach ensures that normalization accounts for the unique nonlinear dynamics of each vulnerability.  
The normalization procedure involves three steps:  
1. Case-specific maximum calculation: For each vulnerability, \(R_{\rm max\_case}\) is computed using Formula (1) with I = 5, L = 5, M = 5, D = 5, T = 5, \(\delta\)(t) = 1.2, C = 1.3, \(\omega_{\rm s}=1.5\), while retaining the vulnerability's original exponents (\(\alpha\), \(\beta\), \(\gamma\)). This reflects the worst-case scenario specific to the vulnerability's risk profile, avoiding unrealistic inflation from incompatible parameter combinations.
2. Linear normalization: The absolute risk score (R) is mapped to a 0-10 scale via: \[R_{normalized}=\frac{R}{R_{max\_case}}\times 10\] (4) This ensures scores remain proportional to their theoretical upper bounds under identical operational conditions.
3. Empirical calibration: To align scores with historical incident data, an empirical cap (\(R_{\rm max\_practical}=500\)) is applied, limiting \(R_{\rm normalized}\) to 10 even if \(R_{\rm max\_case}\) exceeds 500. This addresses rare edge cases where theoretical maxima diverge from observed risks, ensuring consistency across assessments.  
This dual-step process balances theoretical fidelity with practical relevance, enabling intuitive cross-vulnerability comparisons while respecting domain-specific risk dynamics. Risk levels are subsequently classified as follows: low (0-3.0), medium (3.1-6.0), high (6.1-8.0), and extremely high (8.1-10.0), aligning thresholds with industry standards for cybersecurity severity.