## 3 Materials and Methods
### Threat Modeling Using TV-HARM
#### 3.4.2 Application of TV-HARM in Satellite Networks
Once the vulnerabilities were mapped, each vulnerability (\(v_{i}\) or \(pv_{i}\)) was assigned an attack success probability and an impact score based on CVSS metrics. These parameters served as input for TV-HARM, facilitating a structured analysis of attack propagation, cross-layer dependencies, and the overall network risk. The full mathematical definitions and hierarchical mappings of TV-HARM, including its probability calculations, are provided in Appendix A. Next, TV-HARM was executed to compute the overall attack probability and network risk levels. The evaluation process involved computing the attack success probability for each threat vector, \(tv_{i}\), followed by an analysis of the hierarchical  
Figure 6: Threat model targeting the space segment. (**a**) Threat vector \(tv_{13}\). (**b**) Threat vector \(tv_{23}\). Figure 7: Threat model targeting the space segment. (**a**) Threat vector \(tv_{123\_MEO}\). (**b**) Threat vector \(tv_{123\_LEO}\). structure of TV-HARM to assess how vulnerabilities propagate across different network layers. Finally, security metrics, including the overall network risk score, were derived based on the probability-weighted impacts of multiple attack paths. To assess the effectiveness of mitigation strategies, countermeasures were applied in different experimental phases. These countermeasures included the following:  
* OS Patches (Enterprise Linux Security Updates). Security updates were applied to critical system components running Enterprise-Linux-based distributions to address vulnerabilities, such as CVE-2023-2319 (the GCS privilege escalation). The patches mitigated local privilege escalation risks by restricting the unauthorized execution of high-privilege processes and enforcing access control policies. Additionally, kernel-level security patches were deployed to prevent memory corruption exploits and unauthorized process injections;
* Protocol Patches (Satellite Communication Protocol Updates). Security patches were applied to critical satellite communication protocols, including TCP/IP, NMEA, CCSDS, and MIOTY, to address known vulnerabilities. The TCP/IP patch mitigated risks related to improper input validation, reducing the susceptibility to packet injection attacks. The NMEA update incorporated additional message validation to prevent spoofing and unauthorized command execution. The CCSDS patch strengthened authentication mechanisms to prevent unauthorized data manipulation. Finally, the MIOTY patch enhanced error correction and integrity verification to minimize the impact of data corruption attacks;
* CFR (Creating Filtering Rules for Anomalous Traffic Detection). Custom filtering rules were defined and implemented to restrict unauthorized satellite control commands and prevent the exploitation of known vulnerabilities. Real-time access control policies were established to monitor and block anomalous traffic patterns, limiting adversarial access to critical satellite operations. This approach was designed to mitigate CVE-2023-38346 (the MEO data corruption attack) by preventing unauthorized modifications of satellite data and tampering with critical telemetry logs. CFR was applied exclusively to the GCS and gateways to enhance access control and minimize unauthorized command execution. Each countermeasure was applied iteratively in different simulation phases, and TV-HARM was re-executed following the implementation of patches to measure their impacts on attack probability reduction and risk mitigation. To further illustrate how TV-HARM is applied in satellite networks, the following examples are presented. Example 1: Mapping the Upper and Lower Layers: Figure 7b illustrates the TV-HARM structure specifically for the satellite network scenario involving \(tv_{123-LEO}\). In this example, the combination of threat vectors is defined as \(C_{4}=tv_{123-LEO}\), encompassing threat vectors from the ground segment (\(tv_{1}\)), user segment (\(tv_{2}\)), and space segment (\(tv_{3}\)).