## 3 Materials and Methods
### Threat Modeling Using TV-HARM
#### 3.4.2 Application of TV-HARM in Satellite Networks  
To enhance the applicability of TV-HARM to satellite networks, we extend its framework by integrating protocol vulnerabilities (\(pv_{1},pv_{2},\dots\)) and adapting its hierarchical structure to accommodate multisegment architectures. Originally designed for SDN environments and focused on host-based vulnerabilities, TV-HARM's current framework is limited in its ability to assess security risks in satellite networks, which involve diverse communication protocols and cross-layer dependencies. To address these challenges, we propose a refined TV-HARM that incorporates protocol vulnerabilities and multisegment threat modeling. The formal mathematical definitions, including the model's hierarchical structure and mapping functions, are provided in Appendix A. The key advancements introduced in this study are as follows:  
* Incorporating protocol vulnerabilities: Unlike the original TV-HARM, which considered only host vulnerabilities (\(v_{1},v_{2},\dots\)), the proposed model integrates protocol vulnerabilities (\(pv_{1},pv_{2},\dots\)), broadening the scope of security analysis to include multilayered-attack interactions;
* Multisegment threat modeling: The framework is specifically adapted for satellite network architectures, incorporating security assessments across the terrestrial, space, and user segments to capture multisegment threats;
* Refined hierarchical mapping: The hierarchical mapping between the AG and AT is improved to better correlate vulnerabilities across multiple network layers, enhancing the accuracy of cross-layer risk assessments. \begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Model**} & **Attack Path** & **Probabilistic Risk** & **Real-Time Threat** & \begin{tabular}{c} **Vulnerability** \\ **Correlation** \\ **Analysis** \\ \end{tabular} & \begin{tabular}{c} **Hierarchical** \\ **Threat Modeling** \\ \end{tabular} \\ \hline Attack Graph & \begin{tabular}{c} Tree-Based \\ Visualization \\ \end{tabular} & ✗ & ✗ & ✗ & ✗ \\ \hline Attack Tree & \begin{tabular}{c} Formalized Logical \\ Tree \\ \end{tabular} & ✗ & ✗ & ✗ & ✗ \\ \hline Markov Model & \begin{tabular}{c} State-Transition- \\ Based Analysis \\ \end{tabular} & ✓ & ✗ & ✗ & ✗ \\ \hline Bayesian Attack & \begin{tabular}{c} Probability-Based \\ Graph \\ \end{tabular} & \begin{tabular}{c} Analysis \\ \end{tabular} & ✓ & ✗ & ✗ & ✗ \\ \hline HARM & \
\begin{tabular}{c} AT + AG \\ Integration \\ \end{tabular} & ✗ & ✗ & ✗ & ✗ \\ \hline TV-HARM &
\begin{tabular}{c} HARM + Threat \\ Vector Analysis \\ \end{tabular} & ✓ & ✗ & ✓ & ✓ \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Comparison of threat modeling approaches for security analysis in satellite networks. These modifications significantly enhance TV-HARM's applicability to satellite networks by enabling more precise security evaluations and realistic attack propagation analysis. Figures 6 and 7 illustrate the extended TV-HARM framework, demonstrating its capability in analyzing multisegment attack vectors and interdependencies among vulnerabilities. To systematically evaluate the security posture of satellite networks, TV-HARM was applied to predefined threat vectors and vulnerabilities derived from real-world CVE-documented security risks. This process involved multiple stages to ensure a structured security assessment. First, threat vectors were defined and mapped to their respective vulnerabilities. These threat vectors, denoted as \(tv_{1},tv_{2},\ldots\), represent specific attack scenarios targeting the key components of the satellite network. Each threat vector was associated with host vulnerabilities (\(v_{1},v_{2},\ldots\)) and protocol vulnerabilities (\(pv_{1},pv_{2},\ldots\)), ensuring a comprehensive representation of attack surfaces. The selected vulnerabilities reflect known security weaknesses in GCS, IoT, and satellite communication protocols, such as the CCSDS and NMEA.