## 4 Solution of Requirements and Inspection Methods
### Active Defense Mechanism Enhances Broadband Network Resilience
Instances such as malicious network actors successfully exploiting vulnerabilities to gain initial access to the 5G cloud system or launching attacks against individual cloud resources, thereby affecting the entire international cloud 5G core network, and DDoS attack events, are all security concerns that need consideration in the development of satellite communication networks and the deployment of international cloud 5G core network system architectures. This ensures that, in extreme scenarios, our country's critical information transmission is not compromised or leaked. Traditional passive cybersecurity monitoring and management measures within pre-defined environments and application domains will prove inadequate in addressing the threats of high-speed network environments with seamless integration across land, sea, and air networks. Therefore, the proactive cybersecurity defense approach will be implemented, limiting damage within controllable limits. The subsequent focus will be on the active cybersecurity defense endpoint detection and response mechanism endpoint detection and response (EDR) for detailed explanations [46; 47]. Through the deployment of the EDR mechanism, its primary function is to enhance the security of endpoint devices by continuously monitoring, detecting, and responding, safeguarding an organization's information and systems from various threats and attacks. Furthermore, it aims to strengthen the resilience of a multi-broadband network backup architecture, introducing the cybersecurity technology institute--endpoint detection and response (CSTI-EDR) mechanism [48; 49] into the 5G core network of satellite ground receiving stations for log containment and analysis. The primary objective is to enhance the security of the 5G core network and promptly detect and respond to potential cybersecurity risks, ensuring the stable operation of communication infrastructure and protecting critical data. The introduction of EDR into the ground receiving station's 5G core network encompasses four main aspects:  
* Enhancing the Security of the 5G Core Network: The 5G core network supports various critical applications, including the Internet of Things (IoT) and critical infrastructure. The implementation of EDR can help detect and block abnormal activities on endpoint systems that may pose threats to the 5G core network, thereby enhancing the overall security of the 5G core network. * Early Detection of Hacker Activities: EDR solutions can monitor activities on endpoint devices and identify potential signs of attacks. This helps in the early detection of hacker activities, including unknown and novel attack methods, and allows for immediate measures to counter these attacks. * Rapid Response and Recovery: When EDR detects abnormal activities, it can swiftly take corresponding mitigation measures, such as isolating infected devices to reduce the spread of damage and restoring affected systems when necessary. This helps reduce the damage and downtime caused by attacks. Figure 31: Satellite architecture threat diagram. * Strengthening Overall Network Security: The 5G core network is a complex network that includes many different components and access points. The introduction of EDR can provide more comprehensive security monitoring, including monitoring the core network and edge devices, to reduce the overall network cybersecurity risks. * Implementation of Active Cybersecurity Measures for Asynchronous Orbit Satellites  
The establishment of the architecture in the asynchronous orbit experimental field includes the relevant setup and preliminary testing of internal log containment within the 5G core network. The contents encompass the establishment of log containment/forwarding mechanisms and the reinforcement of data transmission channel security, as depicted in Figure 32.  
The endpoint detection and response mechanism (EDR), employing AI and intelligence analysis integration technology, detects abnormal behaviors and processes at endpoints.