Generic Flooding Attack

Detection of generic flooding attacks aimed at spacecraft communication channels, characterized by an overwhelming volume of unexpected noise or message injections. This can result in denial of service (DoS) or data corruption by saturating the communication link with excessive packets or signals, thereby disrupting normal spacecraft operations. Flooding attacks could target various communication elements, including uplink, downlink, and crosslink channels, potentially leading to significant degradation of system availability, especially during critical mission phases.

STIX Pattern

[network-traffic:protocols[*] = 'satellite_vehicle' AND network-traffic:src_port IN ('uplink_port','crosslink_port') AND network-traffic:packet_size > 'expected_max_size' AND network-traffic:packet_count > 'normal_packet_rate']

SPARTA TTPs

ID Name Description
EX-0013 Flooding Threat actors use jamming and flooding attacks to disrupt communications by injecting unexpected noise or messages into a transmission channel. There are several types of attacks that are consistent with this method of exploitation, and they can produce various outcomes. Although, the most prominent of the impacts are denial of service or data corruption. Several elements of the space vehicle may be targeted by jamming and flooding attacks, and depending on the time of the attack, it can have devastating results to the availability of the system.
EX-0013.02 Erroneous Data Threat actors inject noise into the target channel so that legitimate messages cannot be correctly processed due to data integrity impacts. Additionally, while this technique does not utilize valid commands, the target SV still must consume computing resources to process and discard the signal.