cs.CRApr 7, 2026

Towards Resilient Intrusion Detection in CubeSats: Challenges, TinyML Solutions, and Future Directions

Authors: Yasamin Fayyaz, Li Yang, Khalil El-Khatib

Organizations: Faculty of Business and IT, Ontario Tech University, Oshawa, Ontario, L1G 0C5, Canada.

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

CubeSats have revolutionized access to space by providing affordable and accessible platforms for research and education. However, their reliance on Commercial Off-The-Shelf (COTS) components and open-source software has introduced significant cybersecurity vulnerabilities. Ensuring the cybersecurity of CubeSats is vital as they play increasingly important roles in space missions. Traditional security measures, such as intrusion detection systems (IDS), are impractical for CubeSats due to resource constraints and unique operational environments. This paper provides an in-depth review of current cybersecurity practices for CubeSats, highlighting limitations and identifying gaps in existing methods. Additionally, it explores non-cyber anomaly detection techniques that offer insights into adaptable algorithms and deployment strategies suitable for CubeSat constraints. Open research problems are identified, including the need for resource-efficient intrusion detection mechanisms, evaluation of IDS solutions under realistic mission scenarios, development of autonomous response systems, and creation of cybersecurity frameworks. The addition of TinyML into CubeSat systems is explored as a promising solution to address these challenges, offering resource-efficient, real-time intrusion detection capabilities. Future research directions are proposed, such as integrating cybersecurity with health monitoring systems, and fostering collaboration between cybersecurity researchers and space domain experts.

Figures & tables

Fig. 1 : Annual CubeSat launches from 1998 to 2025. Counts were compiled from the Nanosatellite and CubeSat Database [ 2 ] .
Fig. 2 : Taxonomy of cybersecurity threats and attacks targeting CubeSat mission segments, as reviewed in this section.
ReferenceCategoryPlatform / EnvironmentPurposeMain TechniqueKey ContributionsLimitations
[ 7 ]Vulnerability Assessment and Attack SimulationAbstracted CubeSat architectureAssess CubeSat vulnerabilities such as denial of service, data tampering, and system disablingAttack tree analysis modeling attack vectors across ground, link, and space segmentsSystematic enumeration of attack pathways; structured methodology for evaluating CubeSat security postureDoes not address practical implementation challenges or resource costs of countermeasures
[ 11 ]Vulnerability Assessment and Attack SimulationEmulated OPS-SAT payload environmentDemonstrate a realistic low-resource cyberattack on a CubeSat camera payloadLibrary hijacking of the camera executable, formalized with attack trees and SPARTADemonstrated feasibility of a low-resource attack on an operational CubeSatAttack deployment method not explored, limiting reproducibility
[ 12 ]Simulation Platforms for Cybersecurity TestingConceptual Digital Twin of a CubeSatSimulate cyberattacks and analyze cascading multiphysics effectsModel-based systems engineering with Digital Twin simulationsProposed a holistic framework for cyber-induced subsystem failure analysisLacks practical guidance for Digital Twin development and implementation
[ 14 ]Simulation Platforms for Cybersecurity TestingLinkStar Cybersecurity SandboxEnable hands-on cybersecurity testing across mission segmentsPhysical testbed-based attack simulation using on-ground CubeSat hardwareProvided a rare practical platform for cybersecurity experimentationLimited modeling of dynamic space environmental conditions
[ 6 ]Intrusion Detection SystemsN/A (survey study)Establish a taxonomy of IDS approaches for CubeSatsLiterature review and classification of IDS architectures and data sourcesFoundational taxonomy for CubeSat IDS researchAnalogies to non-space domains may not fully capture space-specific constraints
[ 3 ]Intrusion Detection SystemsConceptual CubeSat frameworkIntegrate cyber and physical state for anomaly detectionCorrelation of cyber activity with physical state informationIntroduced an attack-agnostic, physics-informed IDS conceptConceptual proposal without implementation details
TABLE I : Comparative Analysis of CubeSat Cybersecurity Efforts
ReferencePlatform / EnvironmentPurposeAlgorithmData SourcesFindingsLimitations
[ 18 ]LabSat (Simulated model)ISHM tool for detecting, diagnosing, and explaining anomaliesSelf-Organizing Maps (SOM) with Case-Based Reasoning (CBR)Telemetry data from power generation, storage, and load consumption boardsHigh accuracy in anomaly detection and case retrieval; 94.4% success in exact match retrieval with SOM-based indexing; effective in identifying known and novel anomalies.Signature-based retrieval occasionally misclassified novel faults. The approach requires further validation on real system-generated data and optimization of case retrieval efficiency.
[ 19 ]BIRDS-3 and BIRDS-4Detecting anomalies in CubeSat solar panel systemsLinear Discriminant Analysis (LDA)Solar panel telemetry data: temperature, current, and voltageLDA achieved the highest F1-Score (85%); effective in anomaly detection with efficient resource utilization; challenges in handling imbalanced data.ML models require adjustment for each mission’s sensor calibration. The study focused only on solar panels; battery system faults were not analyzed.
[ 20 ]EduSat (flight-like model)Improve on-board fault detection for CubeSatsConvolutional Neural Network (CNN)Temperature telemetry data: sensors on maximum power point trackers, voltage converters, battery monitorHigh accuracy in anomaly detection; effective handling of resource constraints; introduced holdoff window for improved reliability.Performance varies across datasets due to noise; real-time inference introduces minor delays.
[ 21 ]OPS-SATDetecting anomalies in satellite telemetry dataRandom ForestMagnetometer and Photodiode (PD) telemetryHigh accuracy (98.4%) in anomaly detection; addressed practical challenges of noisy and fragmented data; improved generalization with data augmentation.Model relies on human-labeled training data, limiting adaptability to new anomalies. On-board deployment feasibility remains untested.
[ 22 ]OPS-SATDetecting anomalies in satellite telemetry dataRNN-LSTMMagnetometer and Photodiode (PD) telemetryHigh accuracy (95.3%) in anomaly detection; addressed practical challenges of noisy and fragmented data; effective manual annotation for training.The model classifies anomalies but does not determine their onset, and may be sensitive to unseen telemetry patterns in real CubeSat missions.
[ 23 ]OPS-SATOn-board training for FDIR model using sensor dataAROWPhotodiode (PD) telemetryAchieved 89% balanced accuracy using the AROW algorithm; first instance of on-board training of AI models in space; addresses computational constraints and real-time data access.Limited training input diversity restricted model generalization. High-dimensional models required more training iterations, and real-time constraints impacted performance.
TABLE II : Comparative Analysis of Machine Learning Methods for Anomaly Detection in CubeSats (For studies using multiple algorithms, only the best-performing one is included in the table.)
Fig. 3 : Example of pruning techniques applied to a neural network weight matrix. The left panel (a) shows the original weight matrix with all connections intact. The center panel (b) shows structured pruning, where entire columns representing neurons or filters are removed, producing regular sparsity. The right panel (c) shows unstructured pruning, where individual weights are zeroed out, producing irregular sparsity.
Fig. 4 : Example of the quantization process applied to neural network weights. The left panel (a) shows the original 32-bit floating-point weights with high precision. The right panel (b) shows the corresponding 8-bit integer weights produced using a uniform quantization method.
Fig. 5 : Example of weight clustering in a neural network. The left panel (a) shows the original weight distribution with a wide range of weight values. The right panel (b) shows the clustered weight distribution after grouping similar weights into a smaller set of centroid values using k-means clustering.
TechniqueDescriptionTinyML AdaptationCubeSat Relevance
Efficient Model Optimization, NAS, and CASHOptimizes ML models for constrained devices by reducing computation and memory while maintaining accuracy. NAS automates architecture search under resource constraints, and CASH jointly selects a model family and its hyperparameters within a single search space [ 34 , 35 ] .Microcontroller-aware NAS like TinyNAS can explicitly account for constraints such as memory and latency, and can be paired with memory-efficient inference runtimes [ 34 ] . CASH can also be used as a TinyML tuning step when its objectives are defined to reflect deployment needs, so the selected model family and hyperparameters balance detection quality with inference cost and footprint.Supports on-board deployment by balancing detection performance, inference responsiveness, and model footprint under strict CubeSat resource limits.
Continual and Transfer Learning (TinyTL, TinyOL)Adapts models to new data post-deployment with minimal retraining, reducing training resource consumption [ 36 ] .TinyTL fine-tunes certain parameters (e.g., biases) while freezing most weights to reduce memory and computation overhead [ 33 ] . TinyOL continuously updates models in real-time using small incremental updates [ 37 ] .Enables CubeSats to refine on-board ML models and adapt to dynamic conditions without requiring frequent ground updates.
Federated Learning (FL)Enables decentralized training across multiple devices without sharing raw data, preserving privacy [ 38 ] .TinyFedTL enables federated learning on microcontrollers with less than 1MB of memory by optimizing communication and model update strategies [ 38 ] .Reduces communication costs and enhances privacy by allowing CubeSats to collaboratively train models while keeping on-board data secure.
Automated Feature Selection (AutoFS)Automatically selects a subset of informative features to remove irrelevant or redundant variables and reduce dimensionality [ 39 ] .AutoFS can be used as a TinyML feature-pruning step when its objectives reflect deployment needs, selecting a compact feature subset that preserves detection capability while reducing the number of features that must be computed on board at inference time.Reduces the number of real-time feature computations required on board and lowers the input footprint, improving feasibility under CubeSat compute, memory, and storage limits [ 40 ] .
Quantization-Aware Training (QAT)Simulates quantization effects during training to maintain accuracy after reducing precision [ 36 ] .QAT ensures models remain robust at lower bit precision (e.g., 8-bit) by incorporating quantization constraints into training, minimizing accuracy loss [ 36 ] .Helps CubeSats maintain model accuracy despite precision fluctuations.
TABLE III : Summary of Advanced TinyML Techniques
Fig. 6 : Illustrative CASH trade-off for TinyML deployment, balancing detection performance, inference latency, and model footprint to obtain a configuration that meets on-board constraints.
BenefitDescription and Citations
Energy EfficiencyTinyML enables critical computations directly on low-power hardware like microcontrollers, reducing energy consumption. By limiting the need for frequent data transmissions to ground stations, TinyML conserves battery life and extends mission durations [ 41 ] .
Latency ReductionLocalized data processing allows CubeSats to analyze and act on information instantly, minimizing delays. This is particularly beneficial for cybersecurity, enabling faster intrusion detection and immediate responses to threats.
Privacy and SecurityTinyML keeps sensitive data on-board, reducing the risk of interception during transmission. Since it processes data locally, TinyML enhances data privacy and strengthens security against eavesdropping [ 29 ] .
Autonomy and ReliabilityTinyML allows CubeSats to operate independently without relying on constant communication with ground stations. This ensures consistent performance, even when communication windows are limited or disrupted by orbital conditions.
TABLE IV : Benefits of TinyML for CubeSat Deployment
ChallengeDescription
Real-Time InflexibilityTinyML models are typically pre-trained offline and deployed as static frameworks on edge devices [ 41 ] . In dynamic CubeSat environments, data distribution changes over time (concept drift), leading to ineffective threat detection for novel attack patterns. Implementing adaptive techniques like TinyOL may mitigate this issue but requires additional computational resources [ 42 , 37 ] .
Model RobustnessHarsh space conditions (e.g., radiation, extreme temperatures, electromagnetic interference) can compromise model performance on CubeSats. These perturbations reduce accuracy in functions like intrusion detection [ 41 ] . Training models with noise perturbations during development can improve resilience [ 43 ] . However, accurately simulating all conditions for CubeSats may not be feasible.
Accuracy DropCompression and optimization techniques used in TinyML (e.g., quantization and pruning) can lead to slight accuracy reductions, which may impact critical operations [ 29 ] . Extensive testing in high-fidelity simulation environments can ensure accuracy remains within acceptable limits under space-like conditions.
Computational ConstraintsCubeSats operate with severe memory, power, and processing limitations. Implementing adaptive techniques like TinyOL or other complex algorithms often requires balancing computational cost with real-time performance [ 37 ] .
TABLE V : Challenges of TinyML for CubeSat Deployment
Fig. 7 : Example TinyML-enabled Host-based IDS Workflow in a CubeSat Setting.
More in this topic

Cybersecurity

Cybersecurity develops methods to protect digital and cyber-physical systems from attacks, vulnerabilities, data loss, and misuse.

See all 354 papers

Explore similar work

CardsList
Sep 9, 2026

Temporal and Multimodal Deep Learning for Cyberattack Detection in LEO Satellite Systems

The growing reliance on Low-Earth Orbit (LEO) satellite communication systems has increased the need for intelligent methods capable of detecting cyberattacks across complex and dynamic space environments. Unlike conventional network intrusion detection, satellite systems generate heterogeneous information across radio-frequency (RF) links, onboard hardware, and orbital operations. However, many existing approaches either rely on terrestrial intrusion datasets or evaluate individual observations independently, limiting their ability to capture temporal attack behavior specific to LEO satellites. In this work, we conduct a systematic study of deep-learning-based cyberattack detection using the recently introduced satellite-specific UNSW-IoTSAT dataset. We investigate structured learning architectures that preserve hardware, orbital, and RF information, including a Subsystem-Fusion MLP and a hierarchical multimodal Transformer that models both cross-subsystem interactions and temporal evolution. We further evaluate leakage-resistant row-level and temporal settings, along with cross-satellite generalization, to characterize how model architecture and evaluation protocol influence satellite cyberattack detection. Experimental results demonstrate the value of structured multimodal modeling and rigorous evaluation, with the hierarchical Transformer achieving up to 91.66% accuracy and 85.63% macro F1 under the leakage-resistant evaluation protocol.

Kyle Stein, Guillermo Francia, Eman El-Sheikh +1

Center for Cybersecurity and AI University of West Florida Pensacola, FL, USA

Network Intrusion DetectionCybersecurityLEO Satellite Networks
AskPDF
Jun 4, 2026

TinyML-Driven Cybersecurity for Autonomous Spacecraft: Latency-Accuracy Analysis for SPARTA RF and Cyber Threat Detection

Autonomous spacecraft require rapid, lightweight, and reliable onboard detection of cyber-RF threats. Using the SPARTA attack model, we analyze the latency-accuracy trade-offs of TinyML-compatible classical models -- Random Forest, Logistic Regression, SVM, and MLP -- for detecting uplink jamming, Fake-NR spoofing, payload manipulation, ground-segment compromise, and unauthorized command injection. We present a physics-informed theoretical analysis of each model's computational complexity, VC dimension, Lipschitz continuity, and latency scaling, supported by empirical measurements on adversarial RF spectrograms generated via BandErasure, FakeNR, and NoiseBurst corruption modes. Results show that Logistic Regression achieves microsecond-level inference with only a 1% accuracy drop relative to Random Forest, making it an effective TinyML baseline for onboard autonomy. The study also identifies opportunities for advancing spacecraft cybersecurity through richer feature encoders and multi-timescale learning architectures, building on recent progress in edge intelligence and trustworthy AI.

Van Le, Trevor Tran, Tan Le

Virginia Tech, Blacksburg, VA 24061, USA · Hampton University, Hampton, VA 23669, USA

Autonomous Cyber DefenseCybersecurityTiny MLEdge MLOn-Device Inference
AskPDF
Mar 20, 2026

TinyML Enhances CubeSat Mission Capabilities

Earth observation (EO) missions traditionally rely on transmitting raw or minimally processed imagery from satellites to ground stations for computationally intensive analysis. This paradigm is infeasible for CubeSat systems due to stringent constraints on the onboard embedded processors, energy availability, and communication bandwidth. To overcome these limitations, the paper presents a TinyML-based Convolutional Neural Networks (ConvNets) model optimization and deployment pipeline for onboard image classification, enabling accurate, energy-efficient, and hardware-aware inference under CubeSat-class constraints. Our pipeline integrates structured iterative pruning, post-training INT8 quantization, and hardware-aware operator mapping to compress models and align them with the heterogeneous compute architecture of the STM32N6 microcontroller from STMicroelectronics. This Microcontroller Unit (MCU) integrates a novel Arm Cortex-M55 core and a Neural-ART Neural Processing Unit (NPU), providing a realistic proxy for CubeSat onboard computers. The paper evaluates the proposed approach on three EO benchmark datasets (i.e., EuroSAT, RS_C11, MEDIC) and four models (i.e., SqueezeNet, MobileNetV3, EfficientNet, MCUNetV1). We demonstrate an average reduction in RAM usage of 89.55% and Flash memory of 70.09% for the optimized models, significantly decreasing downlink bandwidth requirements while maintaining task-acceptable accuracy (with a drop ranging from 0.4 to 8.6 percentage points compared to the Float32 baseline). The energy consumption per inference ranges from 0.68 mJ to 6.45 mJ, with latency spanning from 3.22 ms to 30.38 ms. These results fully satisfy the stringent energy budgets and real-time constraints required for efficient onboard EO processing.

Luigi Capogrosso, Michele Magno

Interdisciplinary Transformation University of Austria · ETH Zurich

On-Device InferenceEnergy-Efficient MLTiny MLNeural Network CompressionRemote Sensing Image Understanding
AskPDF