CLIF: Cross-layer LEO-ISL Fingerprinting for Physical and Network Attack Detection in Dense LEO Constellations
2026-06-03 • Cryptography and Security
Cryptography and Security
AI summaryⓘ
The authors studied large groups of satellites in low-Earth orbit that communicate with each other using lasers to provide internet and other services. They created a lightweight system that combines information from the physical signals and network data to spot unusual or harmful activity without using much power. Using simulations of thousands of satellites from companies like Starlink and Kuiper, they tested different attacks and showed their method can detect most problems accurately with very few false alarms. Their work suggests that blending data from different network layers is important and efficient for keeping these satellite networks secure.
Low-Earth Orbit (LEO)mega-constellationsInter-Satellite Links (ISLs)physical-layer securitynetwork-layerbehavioral fingerprintinganomaly detectionMahalanobis distancemulti-operator peeringFalse Positive Rate (FPR)
Authors
Varun Kohli, Arijit Bhattacharjee, Samar Shailendra, Biplab Sikdar
Abstract
Low-Earth Orbit (LEO) mega-constellations such as Starlink by SpaceX and Kuiper by Amazon rely on optical Inter-Satellite Links (ISLs) for autonomous mesh routing to provide low-latency telecommunication, Internet of Things (IoT), and security services globally. As commercial operators and governments deploy increasingly dense constellations and form multi-operator peering coalitions, ISL integrity becomes critical to both commercial availability and national security. However, there is a lack of real-world data for LEO constellations and existing real-time security approaches focus strictly on physical layer security, leaving blind spots in the coverage of network-layer and composite attacks. In this paper, we present a cross-layer, lightweight behavioral fingerprinting framework that fuses onboard physical-layer measurements with network-layer data to detect anomalies at low computational overhead. We construct an orbital simulation covering the first shells of Starlink (1,584 satellites), Kuiper (1,156 satellites), and a joint multi-operator peering scenario (2,740 satellites), injecting ten attack types that span spoofing, traffic manipulation, and routing subversion at varying severity. We evaluate three unsupervised, per-satellite detectors among which our Mahalanobis-distance-based detector achieves 99.5% recall on Starlink, 99.4% on Kuiper, and 94.8\% on the multi-operator constellation, while maintaining False Positive Rates (FPR) below 0.7%. Our results demonstrate that cross-layer feature fusion is not only necessary for comprehensive security of LEO constellations but highly cost-effective for large-scale networks while fitting into the strict onboard energy budgets of resource-constrained satellites.