发表机构
Stein Faculty of Computer and Information Science, Ben-Gurion University of the Negev（内盖夫本-古里安大学斯坦计算机与信息科学学院）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
HYDRA提出量化LEO卫星网络对链路泛洪攻击韧性的优化框架，通过最小化僵尸网络资源实现高效破坏，并评估五种缓解策略以提升网络韧性。
AI 中文摘要
低地球轨道（LEO）卫星星座，如Starlink和Kuiper，正迅速成为低延迟全球连接的关键骨干。随着这些系统的扩展，它们成为更具吸引力的攻击目标，因此需要增强其韧性和安全性。威胁行为者试图利用星座特有的属性，如可预测的运动、时变拓扑以及对星间和星地链路的依赖。近期研究表明，链路泛洪攻击（LFA）可利用这些属性拥塞战略性网络瓶颈。然而，先前的工作并未量化LEO网络对针对性破坏的韧性。我们提出HYDRA，一个建模与优化框架，将LFA变体形式化为僵尸网络最小化问题。HYDRA通过测量最小的活跃僵尸子集及相应的流量分配来量化网络对LFA的韧性，该分配需足以破坏目标地理区域之间的通信。在匹配的隐蔽约束下，HYDRA实现与ICARUS相同的针对性破坏，同时使用少34%的僵尸和少23%的聚合攻击流量。随着网络拓扑演化，HYDRA在维持持续攻击方面实现了超过97%的成功率。最后，HYDRA评估了五种缓解策略，展示了路由多样化、入口管制、基于距离的流量约束、源端限速和僵尸网络损耗如何降低攻击成功率并提高网络对针对性破坏的韧性。
英文摘要
Low Earth orbit (LEO) satellite constellations, such as Starlink and Kuiper, are rapidly emerging as a critical backbone for low-latency global connectivity. As these systems expand, they become more attractive attack targets, necessitating increased resilience and security. Threat actors seek to exploit constellation-specific properties such as predictable motion, time-varying topologies, and reliance on inter-satellite and ground-satellite links. Recent work has shown that link-flooding attacks (LFAs) can exploit these properties to congest strategic network bottlenecks. Yet, prior work does not quantify the resilience of LEO networks to targeted disruption. We present HYDRA, a modeling and optimization framework that formulates LFA variants as botnet minimization problems. HYDRA quantifies network resilience to LFAs by measuring the smallest active subset of bots and the corresponding traffic allocation required to disrupt communication between targeted geographic areas. Under matched stealth constraints, HYDRA achieves the same targeted disruption as ICARUS while using 34% fewer bots and 23% less aggregate attack traffic. HYDRA achieves over 97% success in sustaining continuous attacks as the network topology evolves. Finally, HYDRA evaluates five mitigation strategies, showing how routing diversification, ingress policing, distance-based traffic constraints, source throttling, and botnet attrition reduce attack success and improve network resilience to targeted disruption.
