# Temporal and Multimodal Deep Learning for Cyberattack Detection in LEO Satellite Systems

arXiv: https://arxiv.org/abs/2609.10746 · HTML: https://mlsanity.com/paper/2609.10746/

## Key facts

- No citing papers in the map yet (data through 14 Oct 2026).
- Builds on 8 of its 28 references that are in the map.
- First posted on arXiv 9 Sep 2026.

## Builds on (most cited first, 8 of 8)

- [Attention Is All You Need](https://mlsanity.com/paper/1706.03762/) (2017)
- [LoRA: Low-Rank Adaptation of Large Language Models](https://mlsanity.com/paper/2106.09685/) (2021)
- [Satellite Communications in the New Space Era: A Survey and Future Challenges](https://mlsanity.com/paper/2002.08811/) (2020)
- [European Space Agency Benchmark for Anomaly Detection in Satellite Telemetry](https://mlsanity.com/paper/2406.17826/) (2024)
- [The OPS-SAT benchmark for detecting anomalies in satellite telemetry](https://mlsanity.com/paper/2407.04730/) (2024)
- [Low Earth Orbit Satellite Security and Reliability: Issues, Solutions, and the Road Ahead](https://mlsanity.com/paper/2201.03063/) (2022)
- [Packet Inspection Transformer: A Self-Supervised Journey to Unseen Malware Detection with Few Samples](https://mlsanity.com/paper/2409.18219/) (2024)
- [Detection of Aerial Spoofing Attacks to LEO Satellite Systems via Deep Learning](https://mlsanity.com/paper/2412.16008/) (2024)

## Abstract (arXiv)

The growing reliance on Low-Earth Orbit (LEO) satellite communication systems has increased the need for intelligent methods capable of detecting cyberattacks across complex and dynamic space environments. Unlike conventional network intrusion detection, satellite systems generate heterogeneous information across radio-frequency (RF) links, onboard hardware, and orbital operations. However, many existing approaches either rely on terrestrial intrusion datasets or evaluate individual observations independently, limiting their ability to capture temporal attack behavior specific to LEO satellites. In this work, we conduct a systematic study of deep-learning-based cyberattack detection using the recently introduced satellite-specific UNSW-IoTSAT dataset. We investigate structured learning architectures that preserve hardware, orbital, and RF information, including a Subsystem-Fusion MLP and a hierarchical multimodal Transformer that models both cross-subsystem interactions and temporal evolution. We further evaluate leakage-resistant row-level and temporal settings, along with cross-satellite generalization, to characterize how model architecture and evaluation protocol influence satellite cyberattack detection. Experimental results demonstrate the value of structured multimodal modeling and rigorous evaluation, with the hierarchical Transformer achieving up to 91.66% accuracy and 85.63% macro F1 under the leakage-resistant evaluation protocol.