## 1 Introduction  
Satellite networks have become an indispensable technology in modern society, leveraging low-Earth-orbit (LEO), medium-Earth-orbit (MEO), and geostationary-Earth-orbit (GEO) satellites to deliver diverse global services, including communications, exploration, navigation, and meteorological observations [1, 2, 3]. Compared with traditional terrestrial networks, satellite networks provide reliable connectivity over vast areas without requiring substantial ground station infrastructure or internet connectivity [4, 5]. This capability enables global coverage and ensures effective operation in critical environments, such as disaster-stricken regions, thus overcoming geographical constraints. Additionally, the architecture of satellite networks, including inter-satellite links (ISLs) and data flows between ground stations, satellites, and users, facilitates communication services independent of the terrestrial infrastructure [6]. SpaceX's Starlink exemplifies the potential of satellite networks [7]. Starlink deploys thousands of LEO satellites to provide high-speed internet to regions where traditional ground networks are unavailable. As of 2023, Starlink has expanded its services to over 60 countries, serving more than 2 million users worldwide. With an estimated investment exceeding USD 10 billion, this large-scale project highlights the commercial and technological significance of satellite networks [8]. However, this rapid expansion has simultaneously intensified security challenges, raising critical concerns regarding their cybersecurity [9; 10]. Several incidents have exposed critical security vulnerabilities in satellite networks. In 2022, attackers compromised the ViaSat KA-SAT network by injecting malicious signals into modems and transmitting unauthorized commands to satellites [11]. This attack rendered over 5800 satellite communication modems inoperable, disrupting network operations across Ukraine and Europe. The Russia-Ukraine war underscored the strategic importance of satellite networks, demonstrating that these systems serve not only as communication infrastructures but also as critical assets in modern warfare [12]. Similarly, the 2020 Intelsat cyberattack exposed the susceptibility of satellite management systems to cyberthreats [13]. Malware-laden phishing emails compromised Intelsat's management servers, resulting in service disruptions and unauthorized data exfiltration. Satellite networks exhibit distinct characteristics that differentiate them from terrestrial networks, significantly influencing their threat landscape and security requirements [5; 14]. These networks comprise heterogeneous devices, diverse operating systems (OSs), and multiple communication protocols, creating a highly complex attack surface [1; 4]. The space segment frequently relies on commercial off-the-shelf (COTS) components, which often lack timely security patches, making them prone to exploitation. Additionally, real-time operating systems (RTOSs), such as VxWorks, which are commonly deployed in satellite systems, contain vulnerabilities that attackers can exploit for targeted cyberattacks [15]. The user segment includes devices such as global navigation satellite systems (GNSSs) [16], Internet-of-Things (IoT) devices, and unmanned aerial vehicles (UAVs). These devices utilize various communication protocols, each with inherent vulnerabilities that attackers can exploit via routing attacks, malware injections, or data manipulation [17; 18; 19]. Consequently, satellite networks face an expanded attack surface and heightened security risks compared with traditional networks, necessitating advanced security strategies and a comprehensive defense approach [1; 3]. Several studies have examined security vulnerabilities in satellite networks, analyzing security measures through empirical research. Various approaches, including hierarchical security models and AI-driven methodologies, have been explored to enhance satellite network protection and refine existing security frameworks [4; 5; 6].