Build a small intrusion detection layer that learns normal ground station command cadence and flags unusual sequences, timing, or source identifiers. Store audit logs onboard and downlink summaries for review.
Build a small intrusion detection layer that learns normal ground station command cadence and flags unusual sequences, timing, or source identifiers. Store audit logs onboard and downlink summaries for review.
This is a intermediate-level project with an estimated timeline of 12-18 months using a 0.5U form factor.
As satellites become more connected and more autonomous, the risk of unauthorized or anomalous commanding grows. A lightweight intrusion detection system monitors the satellite's command interface, learning what normal ground station interactions look like typical command sequences, timing patterns, expected frequencies, and authorized source identifiers and flagging anything that deviates from that baseline. The system does not block suspicious commands (that is the job of the authentication layer in project 26), but it logs them, classifies the type of anomaly, and downlinks summaries for ground review. Think of it as a security camera for your satellite's command channel. Over the course of a mission, the audit log reveals how often unexpected signals arrive, whether patterns suggest deliberate interference or accidental collisions, and how command traffic correlates with orbital position and ground station geometry. Even for satellites without active threats, the forensic data is valuable for understanding the operating environment. This is a pure software project requiring no additional hardware it runs on the existing onboard computer and processes the command data that the satellite already receives.
Software layer on PyCubed OBC that logs all received commands: timestamp, source identifier (if available), command type, parameters, execution result. During commissioning phase, build baseline profile of normal command cadence from ground station. In operational phase, flag deviations: unexpected command timing (outside scheduled contact windows), unknown command opcodes, unusual parameter ranges, rapid command sequences. Store audit log in dedicated flash partition. Downlink daily summary: total commands, flagged events, classification breakdown. Optional: integrate with project 26 (signed telemetry) for defense-in-depth.
Intrusion detection for spacecraft is an emerging research area published papers from Air Force Research Lab and ESA on CubeSat cybersecurity. Most student CubeSats have zero command authentication or anomaly detection any receiver on the correct frequency can potentially send commands. Even without authentication, an IDS provides forensic capability and awareness. Baseline learning approach is simpler than rule-based IDS adapts to actual operational patterns. Cost: $0 (pure software on existing OBC). Complexity: intermediate requires understanding of command protocols and statistical anomaly detection.
This project spans 2 disciplines, making it suitable for interdisciplinary student teams.
Ready to take on this project? Here's a general roadmap that applies to most CubeSat missions:
Connect with a Blackwing chapter for mentorship, platform access, and a path to orbit.