## 3 Materials and Methods
### Threat Modeling Using TV-HARM  
#### 3.4.1 Overview of TV-HARM  
In this study, we applied TV-HARM [22], an extension of HARM [23], to perform threat modeling for satellite networks. To systematically assess the improvements introduced by TV-HARM, it is necessary to first examine its foundational models and their limitations.  
Attack graphs (AGs) and attack trees (ATs) are widely used for attack path analysis, with AGs visualizing primary attack paths using key nodes and edges, while an AT hierarchically links node and protocol vulnerabilities to assess specific attack scenarios. However, both models lack probabilistic risk assessment and real-time threat response, limiting their applicability in dynamic environments, such as satellite networks. To address these limitations, HARM integrates AGs and ATs, enhancing hierarchical threat analysis while preserving a structured attack path representation [51; 52]. Despite these improvements, HARM still lacks probabilistic risk modeling and real-time threat updates, necessitating further advancements for comprehensive security assessment. Bayesian attack graphs (BAGs) and Markov models incorporate probabilistic analysis to mitigate these limitations. BAGs extend AGs by calculating attack success probabilities, enabling quantitative risk assessment. However, they rely on static probability estimations and predefined datasets, reducing adaptability in dynamic environments. Similarly, Markov models utilize state-transition analysis to estimate risk levels dynamically but lack hierarchical threat modeling and vulnerability correlation analysis, both of which are essential for evaluating inter-segment dependencies in satellite networks.  
TV-HARM, an extension of HARM, was initially developed for SDN environments to analyze complex data flows and diverse attack vectors. However, its focus on SDN-specific architectures and host vulnerabilities restricts its applicability to satellite networks, which involve multilayered infrastructures, diverse communication protocols, and unique operational constraints. To bridge this gap, this study extends TV-HARM by integrating the concept of the threat vector, incorporating probabilistic risk assessment, real-time threat updates, and hierarchical threat modeling to better represent the characteristics of satellite networks. A key enhancement of TV-HARM is its ability to unify host vulnerabilities (\(v_{1}\), \(v_{2}\),...) and protocol vulnerabilities (\(pv_{1}\), \(pv_{2}\),...) into a correlated threat analysis framework, enabling multisegment security assessment. Unlike AGs and ATs, TV-HARM  
Figure 5: Threats via the space segment.  
correlates vulnerabilities across multiple network segments, facilitating hierarchical threat modeling while dynamically updating attack probabilities based on real-time vulnerability changes and security countermeasures. This structured and probabilistic approach enhances multisegment attack propagation analysis, improves risk estimation, and strengthens security countermeasures against evolving threats in satellite communication systems. Compared with BAGs and Markov models, TV-HARM provides a more comprehensive vulnerability correlation analysis, supporting a detailed assessment of cascading attack effects across satellite network layers. A comparative analysis of these models is summarized in Table 5.