# Mitigating DDoS Attacks in LEO Satellite Networks Through Bottleneck Minimize Routing
## 3 Model  
### Attacker Model  
Although routing strategies are not publicly disclosed by satellite operators and vary across service providers, attackers can obtain routing information in two ways: one is to infer using public satellite topology data, and the other is to actively detect through ground terminals. LSN often maintains network stability at the second level. For example, Starlink changes the network every 15 s [51], so an attacker's maximum window to exploit any static snapshot is only 15 s. During this interval, bots continue to use a fixed set of pre-planned paths and traffic-distribution plans to launch its flows. Our simulation is also based on the static network in this case. To evaluate the attack, we adopt the adversary's perspective and focus on two critical metrics: Cost and MaxUp. Cost quantifies the resource investment required to achieve attack objectives. For stealth-oriented attacks, they must distribute traffic across a large botnet to avoid detection, which increases coordination difficulty and operational overhead, thereby raising the \begin{table}
\begin{tabular}{p{14.2 pt} p{142.3 pt} p{142.3 pt}} \hline \hline
**Paper** & **Key Idea** & **Limitation** \\ \hline
[40] & Randomized BFS to build multiple disjoint paths and disperse DDoS traffic & The randomized path is often not the shortest and may go around distant satellites \\
[41] & Least Common Multiple-based dynamic billing to balance load & Cannot reflect real-time or historical risk \\
[42] & Enhanced ant-colony: pheromone on congested nodes decays, steering traffic away & DDoS attacks may cause routing to suboptimal or wrong paths by distorting heuristic \\
[43] & Segment Routing with pre-installed snapshots for latency-aware detours & Reliant on terrestrial relays and not suited for sparse or long-haul networks \\
[44] & Bayesian optimization to mix shortest-path and randomized routing dynamically & Routing strategies change frequently, and forwarding tables frequently fluctuate \\
[45] & Integrated Blockchain in satellite node, verify the legitimacy of data sources & Smart contracts and a distributed ledger bring delays of more than seconds \\
[46] & Combining Blockchain and ant-colony, building multicast trees to isolate attackers. & High blockchain latency and communication overhead limit real-time defense \\
[47] & GNN-driven, latency and stability-aware traffic splitting/dropping of attack flows & Training and updating rely on historical snapshots, difficult to respond to changing attacks \\
[48] & Combining D-S preprocessing and VAE anomaly detection to generate security factors guiding routing & Only fluctuations in trust vectors and does not track sudden traffic spikes, thus failing to distinguish legitimate bursts from DDoS floods Collection and fusion of interactive data is heavy; convergence speed is slow in large network \\
[50] & Distributed D-S trust fusion in OSPF to automatically isolate suspicious nodes & Police and fusion of interactive data is heavy; convergence speed is slow in large network \\
[50] & SDN flow rules and ICN edge caching to redirect malicious requests and offload core routers & Requires SDN and ICN deployment, with controller scalability and cache challenges \\ \hline \hline \end{tabular}
\end{table} 
Table 1: State-of-the-art DDoS defense techniques in LSN. overall attack cost. The cost of the attack is measured in Gbps. In actual attack and defense studies of satellite networks [52], the attack traffic generation capacity of a single bot is about tens of Mbps. To paralyze an ISL with a capacity of 20 Gbps, for example, a bot sends 40 Mbps, the attacker needs to coordinate at least 500 zombie devices to form an attack cluster. For MaxUp, there is usually an anomaly detection mechanism based on link utilization in LSN. When the instantaneous bandwidth utilization of any ground-satellite uplink increases too much compared to its historical average level, an alarm can be triggered, and defenses such as traffic cleaning or node isolation can be initiated.