# Security Performance Analysis of LEO Satellite Constellation Networks under DDoS Attack
## 1 Introduction  
Low Earth orbit (LEO) satellite constellation networks have attracted people's attention due to their benefits of low latency and extensive coverage [1, 2, 3, 4, 5, 6, 7, 8, 9]. Countries around the world have proposed LEO constellation plans, showing their ambition to join the \"space race\" of satellite networks. A number of studies about satellite communication systems have begun both domestically and internationally as a result of the significant advancement in LEO satellite communication technology. LEO satellite constellations such as OneWeb, Kupier, and Starlink are the most prevalent [10, 11, 12]. The most developed low Earth orbit satellite constellation network (LSCN) system at the moment is SpaceX's Starlink satellite network. Compared to terrestrial networks, LSCNs have periodicity and regularity. However, although these characteristics bring convenience to the research of LSCNs, they also make LSCNs extremely vulnerable to several types of threats and attacks [13]. For instance, an adversary can take advantage of the LSCN's global coverage to turn its advantages into vulnerabilities and manipulate ground users to form botnets to launch DDoS attacks from multiple locations. This kind of attack threat has been regularly exploited in terrestrial networks and has caused significant damage, and it is quite likely to be used to attack LSCNs in the future. Due to frequent link switching, the network topology also changes accordingly. How to obtain the information of key network nodes has become one of the important research directions of many scholars in satellite network security. [PERSON] et al. [14] conducted an evaluation based near the center of the rapid assessment of the importance of satellite network nodes. The study indicated that the results of this method of assessment are more reasonable. To improve the survivability of LSCNs, [PERSON] et al. [15] utilized time-cumulativegraph techniques (C-TVG) to compute the betweenness centrality of each node in the graph in the modeling network but only considered betweenness centrality. Considering the differences in inter-layer connectivity relationships, [PERSON] et al. [16] proposed the dynamic supra-adjacency matrix (DSAM) temporal network model to measure the importance of satellite nodes. Finally, experimental simulations of the Iridium and Orbcomm constellations demonstrated that the DSAM method has a relatively accurate recognition rate and high stability. At present, there are relatively few studies on satellite network security, especially the DDoS attack [17; 18; 19; 20]. The latest research progress on LSCN DDoS attacks was the first volumetric DDoS attack against next-generation LSCNs: ICARUS [21]. The Starlink constellation was simulated to study single-link and multi-link DDoS attacks. Single-link attacks were divided into attacking uplinks, downlinks, and inter-satellite links; multi-link attacks were based on the calculation and analysis of all links of the satellite Internet between two regions and attacks on the bottleneck link that connect the two regions so as to achieve regional communication blocking. Domestic research on satellite network security mainly focuses on DDoS protection and detection. Aiming at protecting satellite Internet from DDoS attacks, [PERSON] et al. [22] proposed a blockchain-based distributed collaborative entrance defense (DCED) framework, with which network traffic characteristics can be recorded and aggregated at the entrances of satellite Internet. The results show that the framework can accurately identify attack traffic in 1500 ms, and the framework is more effective than other similar DDoS methods. However, there is little research on the security performance of LSCNs at present, which greatly limits the comprehensive development of LSCNs.