Spaceborne Computer Penetration Testing Methods and Systems

Abstract

This invention provides a method and system for penetrating spaceborne computers, comprising: identifying and parsing the physical layer, link layer, transport layer, and application layer protocols involved in the target spaceborne computer, completing communication link connectivity and protocol field mapping; designing and generating multiple types of attack payloads based on protocol and functional models, injecting various attack data packets including internal network penetration, lateral movement, flooding attacks, and command replay; real-time collection of multiple operational indicators, status parameters, and abnormal events of the spaceborne computer, performing data processing and feature extraction; setting multi-dimensional anomaly criteria and scoring models, identifying and quantifying abnormal indicators, and outputting risk levels; and performing graded risk assessment based on attack input, abnormal responses, and scoring results, outputting security vulnerabilities and rectification suggestions. This invention is applicable to ground testing, on-orbit evaluation, and related security protection fields of spaceborne computers, improving the security assurance capabilities of satellite systems.

Description

Technical Field

[0001] This invention relates to the field of satellite and aerospace embedded system security technology, specifically to a penetration testing method and system for onboard computers. Background Technology

[0002] The onboard computer is the core of management and control in the satellite information system. It is mainly responsible for the overall satellite mission scheduling and comprehensive information processing, managing and controlling each mission terminal, and monitoring the overall satellite operation status.

[0003] With the development of mega-constellations and the integration, networking, and intelligence of satellites, especially the use of technologies such as operating systems, software-defined networks, and on-orbit reconfiguration, onboard computers face increasing cybersecurity risks. As more and more high-performance components and complex software are widely used in satellite manufacturing, the complexity of their functions easily introduces security vulnerabilities. Furthermore, these general-purpose components and software development tools often use mature technologies that have been around for many years, making them easier for adversaries to acquire, study, and compromise.

[0004] Before satellites undergo factory acceptance testing, onboard computers undergo ground-based screening for viruses and malware, preventing some problematic software from being deployed. However, there is a lack of stand-alone penetration testing to verify potential security issues such as intranet penetration, flood attacks, and functional logic robustness of onboard computers.

[0005] Patent application CN117527418A discloses an easily expandable automated penetration testing system and method, relating to the field of network security technology. This invention utilizes a perception and interaction module to manage test tasks, control methods, present test data, and generate test results. It transmits operation commands to a control management module, which processes the data and returns the results to the interface. The control management module analyzes specific task requirements, automatically matches specific tools for each stage of the attack, organically integrates various tools, and coordinates them to complete the test task, ultimately filtering the data to obtain a test result report. The penetration tool module receives the parsed interface names and parameters from the control management module, calls and executes the testing tools, and returns the results to the control management module. However, this patent cannot completely solve the existing technical problems, nor can it meet the needs of this invention. Summary of the Invention

[0006] In view of the deficiencies in the prior art, the purpose of this invention is to provide a method and system for penetrating spaceborne computers.

[0007] The spaceborne computer penetration testing method provided by the present invention includes:

[0008] Step S1: Identify and parse the physical layer, link layer, transport layer, and application layer protocols involved in the target spaceborne computer, and complete the communication link connection and protocol field mapping;

[0009] Step S2: Based on the protocol and functional model, design and generate multiple types of attack payloads, injecting various attack data packets including internal network penetration, lateral movement, flooding attacks, and command replay;

[0010] Step S3: Collect multiple operational indicators, status parameters, and abnormal events of the onboard computer in real time, and perform data processing and feature extraction;

[0011] Step S4: Set up multidimensional anomaly criteria and scoring models, identify and quantify anomaly indicators, and output risk levels;

[0012] Step S5: Based on the attack input, abnormal response and scoring results, classify the risks and output security shortcomings and rectification suggestions.

[0013] Preferably, in step S1, the physical layer and link layer protocols include RS-422, CAN, 1553B and SpaceWire protocols; the transport layer and application layer protocols are parsed through white-box analysis or black-box penetration testing, wherein white-box analysis includes protocol stack source code parsing, and black-box penetration testing includes packet capture and fuzzing.

[0014] Preferably, in step S2, the attack payload is automatically generated based on protocol structure information. Specific identifiers are added to the function identification bits or data fields of the remote control command packets to generate payloads of various types, including intranet penetration, lateral movement, flooding attacks, and command replay attacks. Intranet penetration includes forging node addresses and authentication information to attempt unauthorized access to the internal network; lateral movement includes expanding the control range through bus monitoring and privilege escalation; flooding attacks include generating high-frequency telemetry and remote control commands in batches to induce resource exhaustion; and command replay includes capturing key commands and sending them multiple times or with modifications.

[0015] Preferably, in step S3, the operational metrics include computing resource utilization, network communication parameters, service function status, and system abnormal events; the computing resource utilization includes CPU utilization, memory utilization, and storage I / O; the network communication parameters include link bandwidth, packet loss rate, and latency; the service function status includes task online rate and response latency; the system abnormal events include automatic reset, watchdog alarm, and heartbeat loss; and the data processing includes outlier removal, feature normalization, and time alignment.

[0016] Preferably, in step S4, the scoring model includes calculating outliers for each monitoring indicator. and comprehensive abnormality score S;

[0017] For the i-th monitoring indicator, the measured value is The normal range threshold is and outliers The calculation is as follows:

[0018]

[0019] The comprehensive anomaly score S is calculated as follows:

[0020]

[0021] in, Let the weight of the i-th indicator satisfy the following condition: n represents the total number of monitoring indicators.

[0022] Preferably, in step S5, the risk classification determination includes calculating a comprehensive risk value. ;

[0023]

[0024] in, A comprehensive anomaly score for abnormal events; The influence degree of function j, with a value ranging from 1 to 5; The system propagation degree is calculated as the ratio of the number of affected sub-functions to the total number of sub-functions.

[0025] Preferably, in step S5, the risk classification determination further includes causal relationship analysis, which includes:

[0026] Temporal correlation analysis aligns attack injection events and system anomaly events on a unified timeline, confirming that the anomaly occurred after the attack.

[0027] Attack-anomaly mapping establishes a mapping chain from attack vector to target protocol / interface, affected functional module, and anomaly indicator.

[0028] Logical consistency verification involves combining the design logic of the onboard computer to verify the rationality of causal relationships.

[0029] Causal attribution, after ruling out occasional system failures, confirms that the anomaly was caused by a specific attack input.

[0030] The spaceborne computer penetration testing system provided by the present invention includes:

[0031] The attack strategy generation module is used to create and maintain attack strategies;

[0032] The task management and scheduling module is used to manage the execution and dependencies of attack or analysis tasks;

[0033] The status information acquisition module is used for the unified acquisition and preprocessing of events and statuses generated by the monitoring equipment;

[0034] The security protection assessment module is used to analyze the correlation between simulated attack behaviors and abnormal responses based on abnormal response data and the functional design of onboard computers, and to assess security protection shortcomings and potential risks.

[0035] The telemetry and control channel interface module is used to manage the communication between the test system and the onboard computer, providing physical layer and data link layer protocols.

[0036] Preferably, it further includes:

[0037] The attack toolkit contains methods for internal network penetration, lateral movement, flood attacks, and command duplication attacks.

[0038] The penetration testing engine includes a status information acquisition unit, a security posture assessment unit, an attack strategy generation unit, and a task management and scheduling unit.

[0039] The telemetry database includes computational telemetry, network telemetry, storage telemetry, service telemetry, and management telemetry.

[0040] Preferably, in the telemetry database:

[0041] Telemetry calculations include CPU utilization, memory utilization, GPU utilization, and time.

[0042] Network telemetry includes intra-satellite network traffic, routing paths, connectivity status, network latency, and security status;

[0043] Storage telemetry includes disk capacity and read / write speed;

[0044] Service telemetry includes telemetry measurements designed for application software;

[0045] Management telemetry includes on-orbit reconfiguration, heartbeat monitoring, and watchdog telemetry.

[0046] Compared with the prior art, the present invention has the following beneficial effects:

[0047] The purpose of this invention is to propose a systematic, standardized, and quantitative method for penetrating spaceborne computers. Through techniques such as protocol parsing, simulated attacks, telemetry data acquisition, indicator criteria, and hierarchical evaluation, this method enables full-process security testing and risk assessment of spaceborne computers, from the protocol layer to the functional layer, and from attack input to abnormal response. This fills the gaps in the capabilities of existing security protection systems at the single-machine level, protocol level, and abnormal response level, and supports the hardening of satellite system security and the improvement of its independent controllability. Attached Figure Description

[0048] Other features, objects, and advantages of the present invention will become more apparent from the following detailed description of non-limiting embodiments with reference to the accompanying drawings:

[0049] Figure 1 Flowchart for penetration testing of spaceborne computers;

[0050] Figure 2 This is a block diagram of a spaceborne computer penetration testing system. Detailed Implementation

[0051] The present invention will now be described in detail with reference to specific embodiments. These embodiments will help those skilled in the art to further understand the present invention, but do not limit the invention in any way. It should be noted that those skilled in the art can make several changes and improvements without departing from the concept of the present invention. These all fall within the protection scope of the present invention.

[0052] Example

[0053] like Figure 1 This invention provides a penetration testing method for spaceborne computers, the process of which includes:

[0054] Step S1: Obtain the measurement and control channel interface protocol and establish communication interface;

[0055] Step S2: Construct simulated attack data and carry out simulated attacks using methods such as internal network penetration, lateral movement, flooding attacks, and command replay;

[0056] Step S3: Status information collection. During the attack, collect the response data, communication interaction data, and related system status telemetry information of the onboard computer.

[0057] Step S4: Abnormal behavior monitoring. Monitor the collected telemetry information on the status of the onboard computer and analyze whether the simulated attack behavior triggers an abnormal status response.

[0058] Step S5: Test result analysis. Based on the monitored abnormal state response data and combined with the functional design of the onboard computer, analyze the correlation between simulated attack behavior and abnormal response, and assess the exposed security protection shortcomings and potential risks.

[0059] In step S1, obtaining the telemetry and control channel interface protocol and establishing the communication interface refers to determining the physical layer and link layer protocol types used by the target device by consulting the design documents and protocol standards of the onboard computer, and then using a protocol analyzer and interface adapter to parse the data link, thereby achieving physical and protocol layer connectivity between the test system and the onboard computer and establishing the key protocol fields, command parameters and function mapping relationships.

[0060] Specifically, physical layer and link layer protocols such as RS-422, CAN, 1553B, and SpaceWire can be directly confirmed through technical documents; for transport layer and application layer protocols, white-box analysis (such as protocol stack source code analysis) or black-box penetration testing (such as packet capture and fuzzing) can be used to extract command formats, parameter definitions, and verification methods, thereby achieving full identification of protocol elements and providing basic support for the standardized construction and injection of subsequent attack data.

[0061] In step S2, the construction of simulated attack data is based on the protocol structure information obtained in step S1. Automated tools are used to add specific identifiers to the function identification bits or data fields of remote control command packets, generating payloads in batches for various attack types such as intranet penetration, lateral movement, flooding attacks, and command replay. All attack data is constructed strictly according to protocol specifications and automatically injected into the onboard computer via an interface according to predetermined parameters. All parameters, data content, and time information during the injection process are recorded and archived for traceability and effect comparison.

[0062] Specifically, internal network penetration refers to forging node addresses and authentication information to bypass access controls and attempt to illegally access the internal network and sensitive resources of onboard computers; lateral movement refers to expanding the control scope through bus monitoring, privilege escalation, and other methods to inject commands and control lower-level devices or other functional modules; flooding attacks refer to generating high-frequency telemetry and remote control commands in batches and rapidly, continuously injecting them into the target system to fill the system's processing queue, inducing anomalies such as resource exhaustion, system response delays, or denial of service; command replay refers to capturing key commands and sending them multiple times or with variations to verify the idempotency of commands, the robustness of anti-replay mechanisms, and the robustness of authentication logic. All attack data is strictly constructed according to protocol fields and archived in conjunction with metadata such as parameters, time, and type to ensure the traceability of the testing process and the reproducibility of the attack effects.

[0063] The status information acquisition mentioned in step S3 refers to the real-time and continuous acquisition of response data, communication interaction streams, and key system status telemetry data of the onboard computer through multi-channel telemetry acquisition modules and interface devices throughout the entire simulated attack process. All acquired data is archived to the central database after standardization processing, providing a complete and reliable data foundation for subsequent analysis.

[0064] Specifically, the data collected includes, but is not limited to: computing resource utilization (CPU, memory, storage I / O), network communication parameters (link bandwidth, packet loss rate, latency), service function status (task online rate, response latency), system abnormal events (automatic reset, watchdog alarm, heartbeat loss), and remote command execution logs. The data collection module supports both timed sampling and event-driven modes. The collected data undergoes outlier removal, feature normalization, and time alignment to form a structured set of indicators, facilitating subsequent abnormal behavior monitoring and risk analysis.

[0065] The abnormal behavior monitoring mentioned in step S4 refers to the continuous and real-time monitoring of abnormal states such as CPU resource overload, memory overflow, increased link packet loss rate, service response delay, system self-reset, and unauthorized command execution based on the various system status telemetry data collected in step S3, using multi-dimensional monitoring indicators and dynamic thresholds, and automatically recording all abnormal events and their corresponding attack inputs.

[0066] Specifically, the identification of abnormal state responses relies on the telemetry calculation formulas and hierarchical judgment algorithms of the onboard computer, combined with preset thresholds to determine whether the collected indicators have exceeded limits, and to promptly trigger alarms and archive logs. All abnormal response events correspond one-to-one with attack parameters, forming a closed-loop tracing and risk evidence chain, thereby improving the scientific nature and traceability of security monitoring.

[0067] Telemetry calculation formulas are used to quantify the degree of anomaly of each monitoring metric (such as CPU utilization, packet loss rate, response latency, memory availability, service availability, etc.). Let the first... The measured values ​​of each monitoring indicator are Its normal range threshold is (lower limit) and (Upper limit). Outliers The calculation is as follows:

[0068]

[0069] The comprehensive anomaly score S is calculated as follows:

[0070]

[0071] in, Let the weight of the i-th indicator satisfy the following condition: .

[0072] The risk classification algorithm is based on a comprehensive anomaly score S, dividing risks into three levels: low risk (0 ≤ S < 0.3), medium risk (0.3 ≤ S < 0.7), and high risk (0.7 ≤ S ≤ 1). Specifically, when the monitored indicator is an analog voltage value, the measured value... The calculation formula is:

[0073]

[0074] in All are coefficients; These are the original measured values. This formula is for illustrative purposes only, to help readers better understand the patent content. In reality, the calculation formulas for various monitoring indicators of the spaceborne system are not all calculated using this formula.

[0075] The test result analysis mentioned in step S5 refers to the systematic analysis of the causal relationship between different simulated attack inputs and abnormal responses after summarizing all abnormal behavior monitoring results, combined with the functional design of the onboard computer and the system working logic. Through weighted scoring and risk classification models, the impact range and severity of various abnormal events are quantified and classified, and a structured risk analysis report is output.

[0076] The onboard computer's functional design typically includes core modules such as mission management, attitude and orbit control (AOCS), payload management, thermal control management, energy management, and telemetry and telecontrol (TT&C). Its system operation logic follows a closed-loop control process of "instruction injection → mission parsing and scheduling → functional module execution → status acquisition and telemetry downlink," and relies on a time-triggered or event-triggered multi-task real-time operating system. Each functional module interacts with data via an internal bus and is protected by fault-tolerant mechanisms such as watchdog timers, redundancy switching, and instruction verification. Based on the individual anomaly scoring in step S4, the comprehensive risk scoring model further considers the functional impact (F) and system propagation (P) of abnormal events.

[0077] Functional impact ( ): Measures the functionality affected by the anomaly. The importance of is measured in values ​​ranging from 1 (non-critical functions, such as some log services) to 5 (core functions, such as attitude control).

[0078] System propagation ): Measuring the impact of this anomaly on the functional module The severity of the internal issues is calculated based on the percentage of functional degradation it causes.

[0079]

[0080] Targeting attacks Caused, involving functions The overall risk value of abnormal events. The calculation is as follows:

[0081]

[0082] in, This is the comprehensive anomaly score for the abnormal event calculated in step S4.

[0083] The overall risk level of the testing process is based on all The maximum value in Confirmed: Low risk: ( <2.0) Medium risk: (2.0≤ <4.0) High risk: ( ≥4.0).

[0084] The process of analyzing the causal relationship between simulated attack inputs and abnormal responses is as follows:

[0085] 1. Timing Correlation Analysis: Align attack injection events with system abnormal events (such as CPU usage spikes or watchdog resets) on a unified timeline, confirm that the abnormality occurred after the attack, and calculate the time difference between the attack injection abnormality trigger.

[0086] 2. Attack-Anomaly Mapping: Establish a mapping chain of "attack vector - target protocol / interface - affected functional module - anomaly indicator". For example, the target of "instruction replay attack" is "TT&C application layer protocol", which mainly affects "task management module" and may cause "task queue overflow" and "CPU overload" anomalies.

[0087] 3. Logical Consistency Verification: Based on the design logic of the onboard computer, verify whether the causal relationship is reasonable. For example, a flood attack might lead to bus bandwidth exhaustion, resulting in a delay in remote control command response, which is consistent with the design expectations of the bus arbitration and task scheduling mechanisms.

[0088] 4. Causal Attribution: After ruling out occasional system failures or other test interference factors, confirm that the observed anomaly is directly or indirectly caused by a specific attack input, forming a complete chain of evidence of "attack-vulnerability-anomaly-impact".

[0089] Specifically, the risk assessment process attributes each type of anomaly to the attack it triggers, assigns different risk weights based on indicators such as security impact, system stability, and functional availability, and classifies them into high-risk, medium-risk, and low-risk levels. The final test report includes the type of security vulnerability, affected functions, risk level, and remedial recommendations, providing scientific data support and reference for the security hardening and operation and maintenance decisions of onboard computers.

[0090] This invention also provides a spaceborne computer penetration testing system, which applies the spaceborne computer penetration testing method described above, including an attack strategy generation module, a task management and scheduling module, a status information acquisition module, a security protection assessment module, and a telemetry and control channel interface module.

[0091] The attack strategy generation module creates and maintains attack strategies. Administrators can adjust the content, sending interval, and sending combination of remote control commands as needed, and create and maintain attack strategies. The attack strategies can be sent to the task management and scheduling module through a visual interface.

[0092] The task management and scheduling module receives user instructions from the user interface, managing when attack or analysis tasks run and end, and correctly handling dependencies between tasks. On the other hand, it constantly monitors task execution, notifying the data analysis module to analyze new data and the attack strategy generation module to dispatch attack tasks.

[0093] The status information acquisition module is responsible for the unified collection of events and statuses generated by the monitoring equipment. After collection, it calls the data adaptation interface to perform data preprocessing, and then classifies and transfers the data to the system central database according to characteristics, where it is processed by the module responsible for security protection assessment.

[0094] The security protection assessment module is responsible for analyzing the data stored in the central database. Based on the abnormal response data and the functional design of the onboard computer, it analyzes the correlation between simulated attack behaviors and abnormal responses, and assesses the security protection shortcomings and potential risks exposed by the onboard computer.

[0095] The telemetry and control channel interface module is responsible for the communication management between the spaceborne computer penetration testing system and the spaceborne computer, and provides ready-made physical layer and data link layer protocols.

[0096] Figure 2 This is a schematic diagram of the spaceborne computer penetration testing system in an embodiment of the present invention. The spaceborne computer penetration testing system provided by the present invention includes an attack toolkit, a penetration testing engine, and a telemetry database. The attack toolkit stores attack methods such as intranet penetration, lateral movement, flooding attacks, and command duplication. Intranet penetration refers to analyzing design flaws in the telemetry and control link protocol through means such as protocol consistency and data sniffing, attempting to enter the internal network of the spaceborne computer to perform attacks such as data theft, destruction, and control. Lateral movement refers to further expanding the control scope by intruding into the spaceborne computer network and using privilege escalation, affecting the spaceborne computer's control over lower-level machines via the bus. Flooding attacks refer to sending a large number of false requests to the spaceborne computer, causing the internal management software and application software of the spaceborne computer to be overwhelmed by service requests and unable to handle normal tasks. Command duplication refers to simulating an adversary intercepting remote control commands and repeatedly sending them to the spaceborne computer, causing continuous responses to the same command and affecting normal services.

[0097] The penetration testing engine includes state information acquisition, security posture assessment, attack strategy generation, and task management and scheduling. State information acquisition refers to collecting state telemetry data from the telemetry database, classifying and storing it, transmitting real-time alarm information to the task management and scheduling module for judgment, and receiving suggestions from the security posture assessment module to retrieve different state information. The security posture assessment integrates the collected state information to generate a security posture assessment of the onboard computer under simulated attacks, which is then used by the attack strategy generation module to generate more effective attack strategies. Attack strategy generation, based on the security posture assessment, generates an attack strategy library, which the task management and scheduling module uses to launch the most effective attack strategy based on the integrated state information. The task management and scheduling module is responsible for managing the initiation, termination, and dependencies of attack tasks, monitoring the task execution status, and coordinating the work of the data acquisition and analysis modules.

[0098] The telemetry database includes computational telemetry, network telemetry, storage telemetry, service telemetry, and management telemetry. Computational telemetry includes CPU utilization, memory utilization, GPU utilization, and time. Network telemetry includes intra-satellite network traffic, routing paths, connection status, network latency, and security status. Storage telemetry includes disk capacity and read / write speed. Service telemetry includes telemetry data from application software design. Management telemetry refers to telemetry data from management software such as on-orbit reconfiguration, heartbeat monitoring, and watchdog timer.

[0099] Those skilled in the art will understand that, in addition to implementing the system, apparatus, and their modules provided by this invention in purely computer-readable program code, the same program can be implemented in the form of logic gates, switches, application-specific integrated circuits, programmable logic controllers, and embedded microcontrollers by logically programming the method steps. Therefore, the system, apparatus, and their modules provided by this invention can be considered a hardware component, and the modules included therein for implementing various programs can also be considered structures within the hardware component; alternatively, modules for implementing various functions can be considered both software programs implementing the method and structures within the hardware component.

[0100] Specific embodiments of the present invention have been described above. It should be understood that the present invention is not limited to the specific embodiments described above, and those skilled in the art can make various changes or modifications within the scope of the claims, which do not affect the essence of the present invention. Unless otherwise specified, the embodiments and features described in this application can be arbitrarily combined with each other.

Claims

1. A penetration testing method for spaceborne computers, characterized in that, include: Step S1: Identify and parse the physical layer, link layer, transport layer, and application layer protocols involved in the target spaceborne computer, and complete the communication link connection and protocol field mapping; Step S2: Based on the protocol and functional model, design and generate multiple types of attack payloads, injecting various attack data packets including internal network penetration, lateral movement, flooding attacks, and command replay; Step S3: Collect multiple operational indicators, status parameters, and abnormal events of the onboard computer in real time, and perform data processing and feature extraction; Step S4: Set up multidimensional anomaly criteria and scoring models, identify and quantify anomaly indicators, and output risk levels; Step S5: Based on the attack input, abnormal response, and scoring results, classify the risks and output security shortcomings and rectification suggestions; In step S1, the physical layer and link layer protocols include RS-422, CAN, 1553B and SpaceWire protocols; the transport layer and application layer protocols are parsed through white-box analysis or black-box penetration testing, wherein white-box analysis includes protocol stack source code parsing, and black-box penetration testing includes packet capture and fuzzing. In step S2, the attack payload is automatically generated based on protocol structure information. Specific identifiers are added to the function identification bits or data fields of the remote control command packets to generate payloads of various types, including intranet penetration, lateral movement, flooding attacks, and command replay attacks. Intranet penetration includes forging node addresses and authentication information to attempt unauthorized access to the internal network; lateral movement includes expanding the control range through bus monitoring and privilege escalation; flooding attacks include generating high-frequency telemetry and remote control commands in batches to induce resource exhaustion; and command replay includes capturing key commands and sending them multiple times or with modifications. In step S3, the operational metrics include computing resource utilization, network communication parameters, service function status, and system abnormal events; the computing resource utilization includes CPU utilization, memory utilization, and storage I / O; the network communication parameters include link bandwidth, packet loss rate, and latency; the service function status includes task online rate and response latency; the system abnormal events include automatic reset, watchdog alarm, and heartbeat loss; and the data processing includes outlier removal, feature normalization, and time alignment. In step S4, the scoring model includes calculating outliers for each monitoring indicator. and comprehensive abnormality score S; For the i-th monitoring indicator, the measured value is The normal range threshold is and outliers The calculation is as follows: The comprehensive anomaly score S is calculated as follows: in, Let the weight of the i-th indicator satisfy the following condition: n represents the total number of monitoring indicators; In step S5, the risk classification determination includes calculating a comprehensive risk value. ; in, A comprehensive anomaly score for abnormal events; The impact degree of function j measures the importance of function j affected by the anomaly, and its value ranges from 1 to 5. The system propagation degree measures the severity of the anomaly within function j and is calculated as the ratio of the number of affected sub-functions to the total number of sub-functions. In step S5, the risk classification determination further includes causal relationship analysis, which includes: Temporal correlation analysis aligns attack injection events and system anomaly events on a unified timeline, confirming that the anomaly occurred after the attack. Attack-anomaly mapping establishes a mapping chain from attack vector to target protocol / interface, affected functional module, and anomaly indicator. Logical consistency verification involves combining the design logic of the onboard computer to verify the rationality of causal relationships. Causal attribution, after ruling out occasional system failures, confirms that the anomaly was caused by a specific attack input.

2. A spaceborne computer penetration testing system, employing the spaceborne computer penetration testing method described in claim 1, characterized in that, include: The attack strategy generation module is used to create and maintain attack strategies; The task management and scheduling module is used to manage the execution and dependencies of attack or analysis tasks; The status information acquisition module is used for the unified acquisition and preprocessing of events and statuses generated by the monitoring equipment; The security protection assessment module is used to analyze the correlation between simulated attack behaviors and abnormal responses based on abnormal response data and the functional design of onboard computers, and to assess security protection shortcomings and potential risks. The telemetry and control channel interface module is used to manage the communication between the test system and the onboard computer, providing physical layer and link layer protocols; Also includes: The attack toolkit contains methods for internal network penetration, lateral movement, flood attacks, and command duplication attacks. The penetration testing engine includes a status information acquisition unit, a security posture assessment unit, an attack strategy generation unit, and a task management and scheduling unit. The telemetry database includes computational telemetry, network telemetry, storage telemetry, service telemetry, and management telemetry. The telemetry database: Telemetry calculations include CPU utilization, memory utilization, GPU utilization, and time. Network telemetry includes intra-satellite network traffic, routing paths, connectivity status, network latency, and security status; Storage telemetry includes disk capacity and read / write speed; Service telemetry includes telemetry measurements designed for application software; Management telemetry includes on-orbit reconfiguration, heartbeat monitoring, and watchdog telemetry.

Images