## 4 The Digital-Twin-Based Detection and Protection Framework
### Data Description in the Framework  
At present, the existing state-of-the-art research in the field of satellite networks mostly employs two constellation designs for satellite networks: Walker delta (Inclined constellation) and Walker star (Polar orbit constellation). The satellite network structure based on the Walker constellation can be expressed as \(N\times M/N/F(F=0,1,\ldots,N-1)\)[28], where \(M\) is the number of satellites in a single orbit, \(N\) is the number of orbits, and \(F\) is the phase factor. Due to the predictability of satellite orbit and the stability of inter-satellite links, the routing mechanism combined with time slot is widely used in satellite networks [29]. During one time slot, the satellite network topology can be regarded as static. Satellites can obtain the current satellite network operation status and link states through routing discovery. As shown in Figure 13, we set the orbit ID \(ID_{orb}\) in the satellite network topology from left to right to 1 to \(N\), and set the satellite ID in the orbit \(ID_{sat}\) from top to bottom to 1 to \(M\). Then the satellite node ID in the satellite network can be expressed as \(ID_{orb}\parallel ID_{sat}\). For example, the ID of the 6 th node in the first orbit under the Iridium network structure is 106. The detection and protection framework proposed in this paper needs some necessary information to synchronize and manage the satellite network. The information collected in actual satellite networks can be expressed as \(I_{p}\), as shown in Equation (1), where \(Pos_{p}\) represents the position information of satellites, \(LSA_{p}\) represents the link-state advertisements of satellites, \(RIB_{p}\) represents routing information bases, and \(RT_{p}\) represents routing tables. In some plane-speaker-based or centralized planning algorithms, only the plane speakers or centralized controllers build the routing information base. Therefore, it is necessary to obtain K routing information bases based on the specific algorithms. \[I_{p}= \begin{pmatrix}Pos_{p}\\ LSA_{p}\\ RIB_{p}\\ RT_{p}\end{pmatrix} = \begin{pmatrix}Pos^{1}_{p}&Pos^{2}_{p}&\ldots&Pos^{N\times M }_{p}\\ LSA^{1}_{p}&LSA^{2}_{p}&\ldots&,\ LSA^{N\times M}_{p}\\ RIB^{1}_{p}&RIB^{2}_{p}&\ldots&,\ RIB^{K}_{p}\\ RT^{1}_{p}&RT^{2}_{p}&\ldots&RT^{N\times M}_{p}\end{pmatrix}  \tag{1}\]  
The position information of satellite \(i\) can be expressed as \(Pos^{i}_{p}\), as shown in Equation (2), where \(ID^{i}_{orb}\) represents orbit ID, \(ID^{i}_{sat}\) represents satellite ID in the orbit, \(LON^{i}\) repre  
Figure 12: A typical example of a Blackhole node caused by SEU. sents the longitude of the satellite \(i\), \(LAT^{i}\) represents the latitude of the satellite \(i\), and \(ALT^{i}\) represents the altitude of the satellite \(i\). \[Pos^{i}_{p}=<ID^{i}_{orb},ID^{i}_{sat},LON^{i},LAT^{i},ALT^{i}> \tag{2}\]  
The link-state advertisements of satellite \(i\) can be expressed as \(LSA^{i}_{p}\), which is a set of link delay information between itself and neighbor nodes, as shown in Equation (3), where \(ID^{j}_{orb}\parallel ID^{j}_{sat}\) represents the satellite node ID of satellite \(j\), \(DLY^{ij}\) represents the link delay between satellite \(i\) and satellite \(j\), and \(i.NBR\) represents the neighbor nodes of satellite \(i\). At the same time, the routing information base can be expressed as \(RIB_{p}\), which is a set of \(LSA\) of all nodes in the satellite network, as shown in Equation (4). \[LSA^{i}_{p}=\left\{<ID^{i}_{orb}\parallel ID^{i}_{sat},\ ID^{j}_{orb}\parallel ID ^{j}_{sat},DLY^{ij}>\ \ |\ j\in i.NBR\right\} \tag{3}\]  
\[RIB_{p}=\left\{LSA^{k}_{p}\ |\ k\in(0,N\times M)\right\} \tag{4}\]  
The routing table of satellite \(i\) can be expressed as \(RT^{i}_{p}\), as shown in Equation (5), where \(DEST^{k}\) represents the destination node and \(NEXT^{k}\) represents the next-hop node. Both \(DEST^{k}\) and \(NEXT^{k}\) can be expressed in the form of \(ID_{orb}\parallel ID_{sat}\).