## 3 Materials and Methods
### Threat Modeling Using TV-HARM
#### 3.4.2 Application of TV-HARM in Satellite Networks
TV-HARM for \(C_{4}\) is expressed as \(TVH_{C_{4}}=(U_{C_{4}},L_{C_{4}},M_{C_{4}})\), where \(M_{C_{4}}\) serves as a mapping function that connects the upper layer, \(U_{C_{4}}\), to the lower layer, \(L_{C_{4}}\). This one-to-one mapping ensures that each element in the upper layer is uniquely associated with its corresponding structure in the lower layer, forming a hierarchical attack representation. Example 2: The Upper Layer: The AG shown in Figure 7b represents the upper layer, formally defined as \(U_{C_{4}}=(H_{C_{4}},E_{C_{4}})\), where \(H_{C_{4}}\) is the set of hosts, and \(E_{C_{4}}\) is the set of directed edges representing their relationships. \(H_{C_{4}}\) includes \(\{A,LEO,GCS,RT,GW_{1},GW_{2},\allowbreak MECO,UAV,IoT\}\), while \(E_{C_{4}}\) includes connections, such as \((A\to LEO),(LEO\to GCS),(LEO\to GW_{1}),(LEO\to GW_{2}),(GCS\to RT),(RT\to GW_{1}),(RT\to GW_{2}),(GW_{1}\to MEO),(GW_{1}\to UAV),(GW_{1}\to IoT),(GW_{2}\to UAV),(GW_{2}\to IoT)\). The attacker initiates at \(A\), leveraging \(LEO\) satellites to propagate threats into the ground and user segments, ultimately compromising the \(IoT\) and \(UAV\). Example 3: Lower Layer: The AT shown in Figure 6(b) focuses on threats originating from the _GCS_. The attack conditions leveraging the vulnerabilities of the _GCS_ are defined as follows: \(L_{\text{C}_{4}}^{GCS}=(A_{\text{C}_{4}}^{CCS},B_{\text{C}_{4}}^{CCS},c_{\text{C} _{4}}^{GCS},g_{\text{C}_{4}}^{GCS},root_{\text{C}_{4}}^{GCS})\), where \(A_{\text{C}_{4}}^{CCS}=\{v_{3},pv_{1}\}\) includes host-based vulnerabilities (\(v_{3}\)) and protocol-based vulnerabilities (\(pv_{1}\)) within the _GCS_. Because no logical gates are present, \(B_{\text{C}_{4}}^{GCS}=\emptyset\), \(c_{\text{C}_{4}}^{GCS}=\emptyset\), and \(S_{\text{C}_{4}}^{GCS}=\emptyset\). The root node is defined as \(root_{\text{C}_{4}}^{GCS}=root\), representing the ultimate attack target within the _GCS_. The union of \(A_{\text{C}_{4}}^{GCS}\) and \(B_{\text{C}_{4}}^{GCS}\) encompasses all the threat elements contributing to \(root_{\text{C}_{4}}^{GCS}\). The host vulnerability (\(v_{3}\)) and protocol vulnerability (\(pv_{1}\)) associated with the _GCS_ form the primary focus of the AT analysis, defining the interactions among these threat elements. Security threats can originate from specific nodes or segments in the satellite network and propagate across the system. Based on the identified threat vectors, four attack scenarios are defined to analyze threat paths and their potential impacts. Attack Scenario 1 (\(tv_{13}\)): The attacker exploits a vulnerability in the _FW_ in the ground segment, bypassing authentication to insert malicious packets and gain access to the _RT_. Using a privilege escalation vulnerability in the _RT_, pathways to \(GW_{1}\) and \(GW_{2}\) are established, where TCP/IP vulnerabilities are used to tamper with commands or inject malicious packets. At the _gateways_, CCSDS vulnerabilities are exploited to manipulate data and commands directed to the space segment, allowing malicious commands to disrupt orbit control and data transmission in _MEO_ and _LEO_ satellites. This compromises satellite communication pathways, impacting network reliability and data integrity. The interconnected nature of the space and user segments enables these threats to propagate, amplifying the attack's overall impact across the network. Attack Scenario 2 (\(tv_{23}\)): The attacker exploits vulnerabilities in the _IoT_ and _ULAVs_ within the user segment to propagate threats into the space segment via \(GW_{1}\) and \(GW_{2}\), targeting _MEO_ and _LEO_ satellites. The attack begins with the _IoT_, leveraging a MOTY vulnerability to inject malicious data into \(GW_{1}\). Unauthorized access to \(GW_{1}\) is then used to embed the malicious data. Simultaneously, a _UAV_ is exploited to manipulate data flows toward \(GW_{2}\). At \(GW_{1}\) and \(GW_{2}\), the attacker uses TCP/IP and CCSDS vulnerabilities to propagate malicious data and alter commands sent to satellites.