contrasts with the more complex disjoint regions found in the massless
preheating scenario. The features appear consistent with the bounds found in
previous studies in the literature Ema  _et al._ (2016, 2017).

The most immediate observation we make in Fig. 12 is that the structure of the
metastable region is relatively simple in comparison to Fig. 10. For
$g^{2}/m_{\phi}^{2}\gtrsim 10^{3}$ the upper bound of the metastable region is
roughly linear but flattens for smaller values of $g^{2}/m_{\phi}^{2}$. These
results appear consistent with both Ref. Ema  _et al._ (2016) and Ref. Ema
_et al._ (2017). In particular, in Ref. Ema  _et al._ (2016) bounds on the
unmixed couplings were given approximately as $g^{2}/m^{2}\lesssim 10^{3}$ and
$\xi\lesssim 10$, as reflected in our figure.

##  Appendix B Details for Tachyonic Production

In this appendix, we provide details of our calculations for which the non-
minimal curvature couplings are dominant. Let us restate for convenience the
general form given in Eq. (33) for the tachyonic growth in phase-space density
$n_{h_{k}}$ for a given mode after passing through a tachyonic phase $j$ times
Dufaux  _et al._ (2006):

$n_{h_{k}}~{}=~{}e^{2jX_{k}}\left(2\cos\Theta_{k}\right)^{2(j-1)}\ .$ (87)

We recall that $X_{k}\equiv\int dt\,\Omega_{h_{k}}$ denotes the accumulated
exponent when the effective mass of the mode is tachyonic and
$\Theta_{k}\equiv\int dt\,\omega_{h_{k}}$ denotes the accumulated phase during
the non-tachyonic intervals. Our primary objective is to evaluate these
factors so that we may compute the variance of fluctuations $\langle
h^{2}\rangle$ and hence the vacuum destabilization time for a given parameter
set. In what follows, although the curvature terms have an overall time-
dependence, we neglect this within a single tachyonic interval.

Let us define functions $H_{1}(\alpha,\beta)$ and $H_{2}(\alpha,\beta)$ that
will hold the oscillatory part of $X_{k}$ and $\Theta_{k}$. The way these
functions are paired depends on the sign of the coupling. Namely, for the
accumulated phase we have

$\Theta_{k}=\begin{cases}2\sqrt{+r_{h}-\kappa^{2}}H_{1}(\alpha,\beta)&\text{for
}\xi>0\\\ 2\sqrt{-r_{h}+\kappa^{2}}H_{2}(\alpha,\beta)&\text{for
}\xi<0\end{cases}\ ,$ (88)

and for the growth exponent we have

$X_{k}=\begin{cases}2\sqrt{+r_{h}-\kappa^{2}}H_{2}(\alpha,\beta)&\text{for
}\xi>0\\\ 2\sqrt{-r_{h}+\kappa^{2}}H_{1}(\alpha,\beta)&\text{for
}\xi<0\end{cases}$ (89)

and we have introduced the parameters combinations

$\alpha~{}\equiv~{}\frac{3r_{h}}{r_{h}-\kappa^{2}}-2r_{\phi}\beta\ ,\qquad\
\beta~{}\equiv~{}\frac{g^{2}/\lambda_{\phi}}{r_{h}-\kappa^{2}}\ .$ (90)

Meanwhile, the oscillatory functions are defined as

$\displaystyle H_{1}(\alpha,\beta)$
$\displaystyle\equiv\int_{0}^{x_{\times}}dx\sqrt{\beta\left(\frac{\varphi}{\overline{\varphi}}\right)^{\\!\\!2}+\alpha\left(\frac{\varphi}{\overline{\varphi}}\right)^{\\!\\!4}-1}$
$\displaystyle H_{2}(\alpha,\beta)$
$\displaystyle\equiv\int_{x_{\times}}^{T\\!/4}dx\sqrt{1-\beta\left(\frac{\varphi}{\overline{\varphi}}\right)^{\\!\\!2}-\alpha\left(\frac{\varphi}{\overline{\varphi}}\right)^{\\!\\!4}}$
(91)

where $\varphi$ refers to the analytical solution for the background inflaton
field in Eq. (16). Note that for our purposes here we take $x_{0}=0$. The
quantity $x_{\times}$ is the crossing time that separates tachyonic and non-
tachyonic phases of evolution for the mode, which can be expressed in terms of
the inverse elliptic function as

$x_{\times}(\alpha,\beta)~{}\equiv~{}\text{arccn}\\!\left(\\!\sqrt{\frac{\\!-\beta+\sqrt{4\alpha+\beta^{2}}}{2\alpha}},\\!\frac{1}{\sqrt{2}}\\!\right)\
.$ (92)

For the remainder of this appendix we shall focus solely on the accumulated
exponent $X_{k}$ rather than the phase $\Theta_{k}$. While the latter is
relevant for the detailed distribution of $n_{h_{k}}$, it is irrelevant to the
overall growth. For clarity, we divide the following analysis in a manner
parallel to Sec. III and Sec. IV in the paper, giving additional support to
our derivation of results in the main text.

###  B.1 Pure Curvature Coupling ($g=0$)

In the limit of pure curvature coupling, our parameters in Eq. (90) reduce to
$\alpha=3r_{h}/(r_{h}-\kappa^{2})$ and $\beta=0$, and the tachyonic phase only
appears for $\alpha>1$. As in the main body of the paper, we ignore the
$\xi<0$ region since the vacuum is not stable. Identifying the limits
$H_{1}(1,0)=0$ and $H_{2}(1,0)=\sqrt{2}$ along with

$\displaystyle H_{1}(\alpha\rightarrow\infty,0)~{}$
$\displaystyle\simeq~{}\frac{2\pi^{3/2}\sqrt{\alpha}}{\Gamma(\frac{1}{4})^{2}}$
$\displaystyle H_{2}(\alpha\rightarrow\infty,0)~{}$
$\displaystyle\simeq~{}\sqrt{\frac{\pi}{2\sqrt{\alpha}}}\frac{\Gamma(\frac{5}{4})}{\Gamma(\frac{7}{4})}\
,$ (93)

we can construct the approximate fits

$\displaystyle H_{1}(\alpha,0)~{}$
$\displaystyle\simeq~{}\frac{2\pi^{3/2}\sqrt{\alpha-1}}{\Gamma(\frac{1}{4})^{2}}-\frac{0.59(\alpha-1)^{1/3}}{1+0.23\alpha}$
$\displaystyle H_{2}(\alpha,0)~{}$
$\displaystyle\simeq~{}\sqrt{\frac{\pi}{2\sqrt{\alpha}}}\frac{\Gamma(\frac{5}{4})}{\Gamma(\frac{7}{4})}\left(1+\frac{\frac{2}{\sqrt{\pi}}\frac{\Gamma(7/4)}{\Gamma(5/4)}-1}{\alpha^{2}}\right)\
.$ (94)

In the left panel of Fig. 13 we have plotted these fits (shown by solid
curves) and the numerically integrated functions (shown by point markers) for
comparison. By inspection of Eq. (90) we see that for $\xi>0$ we are confined
to the range $\alpha\in[3,\infty)$. Likewise, for the $\xi<0$ region
$\alpha\in(0,3]$ is required. The result in Eq. (34) for the tachyonic Higgs
spectrum is then found directly using the leading terms in Eq. (94).

###  B.2 Mixed Case

As the mixed case with $\xi>0$ is fully addressed in Sec. III.3, let us
address the $\xi<0$ region in this appendix, i.e., the derivation of the
comoving number density Eq. (46). Note that given Eq. (90), this region
corresponds to $\beta<0$. Additionally, the range of $\alpha$ is extended in
the mixed-coupling case [according to Eq. (90)]. The dependence on both
$\alpha$ and $\beta$ are important in what follows, so the fits above are not
sufficient. But as we are only interested in the growth exponent $X_{k}$, we
only require the $H_{1}(\alpha,\beta)$ function in this regime. This function
has the approximate forms

$\displaystyle H_{1}(\alpha,\beta)~{}$
$\displaystyle\simeq~{}\frac{H_{1}(3,0)}{\sqrt{3}-1}\frac{\beta+\alpha-1}{\sqrt{\alpha}+1}$
$\displaystyle\simeq~{}\frac{H_{1}(3,0)}{2}\left(\beta+\alpha-1\right)\ .$
(95)

While the first approximation gives a more accurate fit, the second is linear
in both $\alpha$ and $\beta$ and useful for our estimates. We have plotted the
latter approximation using solid curves in the right panel of Fig. 13, with
point markers indicating the numerically integrated result.

Using this approximation, we find that the growth exponent is given up to
$\mathcal{O}(\kappa^{2})$ by

$\displaystyle 2jX_{k}~{}\simeq~{}\frac{4H_{1}(3,0)}{T}\\!\\!\int\\!dx\,$
$\displaystyle\frac{\kappa^{2}-2r_{h}+\frac{g^{2}}{\lambda_{\phi}}\left(2r_{\phi}-1\right)}{\sqrt{\kappa^{2}-r_{h}}}\\!$
(96)
$\displaystyle\simeq~{}\frac{-4H_{1}(3,0)}{T\sqrt{-6\xi}}\Bigg{\\{}\\!\Big{(}\xi_{\phi}\frac{g^{2}}{\lambda_{\phi}}+$
$\displaystyle\xi\Big{)}\Bigg{[}12\log\\!\left(\frac{x}{x_{0}}\right)\\!+\\!\frac{\kappa^{2}(x^{2}\\!-\\!x_{0}^{2})}{2\xi}\Bigg{]}$
$\displaystyle\quad\ -\frac{1}{2}\\!\Big{(}\frac{g^{2}}{\lambda_{\phi}}+$
$\displaystyle\kappa^{2}\Big{)}\\!\Bigg{[}(x^{2}\\!-x_{0}^{2})\\!+\\!\frac{\kappa^{2}(x^{4}\\!-\\!x_{0}^{4})}{24\xi}\Bigg{]}\Bigg{\\}}$

where $j$ is the number of times the effective Higgs mass has passed through
the tachyonic region. Note that Eq. (46) is recovered in the
$\kappa\rightarrow 0$ limit. The growth exponent readily gives the phase-space
density $n_{h_{k}}$ via Eq. (87) if we neglect the oscillatory component
$\Theta_{k}$.

Using the saddlepoint method to integrate over the momenta, we obtain the
Higgs comoving number density

$\displaystyle n_{h}\hskip 4.2679pt\simeq\hskip 4.2679pt$
$\displaystyle\left(\\!\\!\frac{\sqrt{\lambda_{\phi}}\overline{\varphi}}{x}\\!\right)^{\\!\\!\\!3}\\!\left[\\!\frac{\frac{T}{4\pi
H_{1}(3,0)}(-6\xi)^{3/2}}{-24\left(\xi_{\phi}\frac{g^{2}}{2\lambda_{\phi}}+\xi\right)-\frac{g^{2}}{2\lambda_{\phi}}x^{2}}\\!\right]^{\\!3/2}$
(97)
$\displaystyle\times\left(\frac{x}{x_{0}}\right)^{\\!\\!-\frac{8\sqrt{6}H_{1}(3,0)}{T\sqrt{-\xi}}\left(\xi_{\phi}\frac{g^{2}}{\lambda_{\phi}}+\xi\right)}e^{-\frac{g^{2}}{2\lambda_{\phi}}\frac{(x^{2}-x_{0}^{2})}{\sqrt{-6\xi}}}\
,$

which is valid for times $x\lesssim x_{\xi}$. Using that the Higgs variance is
$\langle h^{2}\rangle\simeq n_{h}/(a^{3}\omega_{h})$, we are finally in a
position where we can produce the constraint in Eq. (75).

Figure 13: The functions $H_{1}(\alpha,\beta)$ and $H_{2}(\alpha,\beta)$ in
Eq. (91) computed numerically (point markers) for comparison to our analytical
approximations (shown by solid curves). The left panel shows the
$\beta\rightarrow 0$ approximation for both functions from Eq. (94), and the
right panel shows the approximation for $H_{1}(\alpha,\beta)$ derived in Eq.
(95) for several values of $\alpha$.

##  Appendix C Numerical Methods

In this appendix, we summarize the numerical methods used to compute the
evolution of dynamical quantities in this paper. Note that analogous methods
are applied for the comparison to massive preheating in Appendix A.

We perform our computations in the cosmological time $t$ and establish our
initial conditions at the end of inflation. According to the analysis in Sec.
II.1, the initial conditions at $t_{\rm end}$ are given by

$\displaystyle\phi(t_{\rm end})~{}$ $\displaystyle=~{}+\phi_{\rm end}$ (98)
$\displaystyle\dot{\phi}(t_{\rm end})~{}$ $\displaystyle=~{}-\sqrt{V(\phi_{\rm
end})}\ ,$ (99)

where $\phi_{\rm end}=1$ is assumed. Furthermore, we assume for our numerics
that the inflaton potential is given by a purely quartic potential
$V(\phi)=\lambda_{\phi}\phi^{4}/4$ and we have neglected the difference
between the canonical and non-canonical inflaton field; while this affects the
initial velocity by an $\mathcal{O}(1)$ factor, we have checked that such
changes to $\dot{\phi}(t_{\rm end})$ have a negligible impact on our results.

The inflationary constraint in Eq. (11) is assumed so that the homogeneous
value $h$ for the Higgs field is stabilized strongly at the origin. Even after
the end of inflation, accounting for $h$ has a negligible influence on our
results, so we ignore its equation of motion overall. We solve the equations
of motion for the background inflaton field $\phi$, inflaton fluctuations
$\phi_{k}$, and Higgs fluctuations $h_{k}$. As discussed in Sec. IV, the
backreaction is accounted for using the Hartree approximation
$h^{4}\rightarrow 6\langle h^{2}\rangle h^{2}-3\langle h^{2}\rangle^{2}$ for
the Higgs self-interaction and using an analogous substitution for the quartic
inflaton potential $\phi^{4}\rightarrow
6\langle\phi^{2}\rangle\phi^{2}-3\langle\phi^{2}\rangle^{2}$ Boyanovsky  _et
al._ (1995).

We discretize the momenta linearly over the range $k\in[0,\Lambda]$ with
$N=300$ lattice points. The momentum cutoff $\Lambda$ is chosen based on the
structure of the parametric and tachyonic instabilities, i.e., we use the
maximal momentum of each unstable band. For example, with $\xi_{h}=0$ and
$g^{2}/\lambda_{\phi}\gg 1$ our numerics use a cutoff near the maximum of the
resonance band
$\Lambda=\sqrt{\lambda_{\phi}}\overline{\varphi}(g^{2}/\lambda_{\phi})^{1/4}$.

The equations of motion are then given by

$\displaystyle\ddot{\phi}+3H\dot{\phi}+\lambda_{\phi}\phi^{3}+3\lambda_{\phi}\langle\phi^{2}\rangle\phi+g^{2}\langle
h^{2}\rangle\phi~{}$ $\displaystyle=~{}0$ (100)
$\displaystyle\ddot{\phi}_{k}+3H\dot{\phi}_{k}+\omega_{\phi_{k}}^{2}\phi_{k}~{}$
$\displaystyle=~{}0$ (101)
$\displaystyle\ddot{h}_{k}+(3H+\Gamma_{h_{k}})\dot{h}_{k}+\omega_{h_{k}}^{2}h_{k}~{}$
$\displaystyle=~{}0\ ,$ (102)

where the mode energies are

$\displaystyle\omega_{\phi_{k}}^{2}~{}$
$\displaystyle=~{}\frac{k^{2}}{a^{2}}+3\lambda_{\phi}\phi^{2}+3\lambda_{\phi}\langle\phi^{2}\rangle+g^{2}\langle
h^{2}\rangle$ (103) $\displaystyle\omega_{h_{k}}^{2}~{}$
$\displaystyle=~{}\frac{k^{2}}{a^{2}}+g^{2}\phi^{2}+\xi_{h}R+g^{2}\langle\phi^{2}\rangle+3\lambda_{h}\langle
h^{2}\rangle\ .$ (104)

The Hubble parameter is computed using the first Friedmann equation
$H^{2}=\rho_{\rm tot}/3$ for the total energy density $\rho_{\rm tot}$. Note
that $\rho_{\rm tot}$ includes both the energy density of the inflaton
background $\rho_{\phi}=\dot{\phi}^{2}/2+V(\phi)$ and that of the field
fluctuations, although the latter do not provide a significant contribution
until the system approaches the non-linear stage of preheating. We evolve
these equations of motion until the Higgs destabilizes or the onset of non-
linear dynamics is reached at $x_{\rm NL}\approx 400$.

The decay rates $\Gamma_{h_{k}}$ for the Higgs modes are calculated in the
same way as Eq. (53), except in our numerical calculations we generally write
$\Gamma_{h_{k}}=\Gamma_{h}/\gamma$, where the Lorentz factor $\gamma$ carries
some momentum dependence.

The initial conditions for the field fluctuations in Eq. (101) and Eq. (102)
are taken as Gaussian such that $\phi_{k}=1/\sqrt{2\omega_{\phi_{k}}}$ and
$h_{k}=1/\sqrt{2\omega_{h_{k}}}$ at the initial time. However, this initial
condition is UV divergent and sensitive to the cutoff scale $\Lambda$
introduced in our discretization. Employing adiabatic renormalization Postma
and van de Vis (2017), we calculate the variance so that it is initially
vanishing:

$\langle
h^{2}\rangle~{}\equiv~{}\frac{1}{2\pi^{2}}\int_{0}^{\Lambda}\\!dk\,k^{2}\Big{[}\left|h_{k}(t)\right|^{2}-\frac{1}{a^{2}}\left|h_{k}(t_{\rm
end})\right|^{2}\Big{]}\ .$ (105)

The scaling of the counterterm with $a$ is chosen so that it scales with the
physical momentum $k/a$.

Finally, we incorporate the running of the Higgs four-point coupling
$\lambda_{h}(\mu)$ by evaluating the renormalization scale at
$\smash{\mu=\sqrt{\langle h^{2}\rangle}}$. The effect of the backreaction is
most relevant at energies near $h_{\rm SM}\approx 10^{10}\,\text{GeV}$ where,
based on SM measurements, the coupling changes sign. Therefore, in our
numerics we take the approximate

$\lambda_{h}~{}=~{}0.01\,\text{sgn}\left(h_{\rm SM}-\sqrt{\langle
h^{2}\rangle}\right)\ ,$ (106)

which is similar to that used in other numerical studies Ema  _et al._ (2016);
Enqvist  _et al._ (2016) of electroweak vacuum metastability.

## References

  * Zyla  _et al._ (2020) P. A. Zyla _et al._ (Particle Data Group), PTEP 2020, 083C01 (2020).
  * Degrassi  _et al._ (2012) G. Degrassi, S. Di Vita, J. Elias-Miro, J. R. Espinosa, G. F. Giudice, G. Isidori, and A. Strumia, JHEP 08, 098 (2012), arXiv:1205.6497 [hep-ph] .
  * Bezrukov  _et al._ (2012) F. Bezrukov, M. Y. Kalmykov, B. A. Kniehl, and M. Shaposhnikov, JHEP 10, 140 (2012), arXiv:1205.2893 [hep-ph] .
  * Alekhin  _et al._ (2012) S. Alekhin, A. Djouadi, and S. Moch, Phys. Lett. B 716, 214 (2012), arXiv:1207.0980 [hep-ph] .
  * Buttazzo  _et al._ (2013) D. Buttazzo, G. Degrassi, P. P. Giardino, G. F. Giudice, F. Sala, A. Salvio, and A. Strumia, JHEP 12, 089 (2013), arXiv:1307.3536 [hep-ph] .
  * Bednyakov  _et al._ (2015) A. V. Bednyakov, B. A. Kniehl, A. F. Pikelner, and O. L. Veretin, Phys. Rev. Lett. 115, 201802 (2015), arXiv:1507.08833 [hep-ph] .
  * Andreassen  _et al._ (2018) A. Andreassen, W. Frost, and M. D. Schwartz, Phys. Rev. D 97, 056006 (2018), arXiv:1707.08124 [hep-ph] .
  * Chigusa  _et al._ (2018) S. Chigusa, T. Moroi, and Y. Shoji, Phys. Rev. D 97, 116012 (2018), arXiv:1803.03902 [hep-ph] .
  * Markkanen  _et al._ (2018) T. Markkanen, A. Rajantie, and S. Stopyra, Front. Astron. Space Sci. 5, 40 (2018), arXiv:1809.06923 [astro-ph.CO] .
  * Espinosa  _et al._ (2008) J. R. Espinosa, G. F. Giudice, and A. Riotto, JCAP 05, 002 (2008), arXiv:0710.2484 [hep-ph] .
  * Lebedev and Westphal (2013) O. Lebedev and A. Westphal, Phys. Lett. B 719, 415 (2013), arXiv:1210.6987 [hep-ph] .
  * Felder  _et al._ (2001a) G. N. Felder, J. Garcia-Bellido, P. B. Greene, L. Kofman, A. D. Linde, and I. Tkachev, Phys. Rev. Lett. 87, 011601 (2001a), arXiv:hep-ph/0012142 .
  * Felder  _et al._ (2001b) G. N. Felder, L. Kofman, and A. D. Linde, Phys. Rev. D 64, 123517 (2001b), arXiv:hep-th/0106179 .
  * Dufaux  _et al._ (2006) J. F. Dufaux, G. N. Felder, L. Kofman, M. Peloso, and D. Podolsky, JCAP 07, 006 (2006), arXiv:hep-ph/0602144 .
  * Kofman  _et al._ (1994) L. Kofman, A. D. Linde, and A. A. Starobinsky, Phys. Rev. Lett. 73, 3195 (1994), arXiv:hep-th/9405187 .
  * Kofman  _et al._ (1997) L. Kofman, A. D. Linde, and A. A. Starobinsky, Phys. Rev. D 56, 3258 (1997), arXiv:hep-ph/9704452 .
  * Greene  _et al._ (1997) P. B. Greene, L. Kofman, A. D. Linde, and A. A. Starobinsky, Phys. Rev. D 56, 6175 (1997), arXiv:hep-ph/9705347 .
  * Herranen  _et al._ (2015) M. Herranen, T. Markkanen, S. Nurmi, and A. Rajantie, Phys. Rev. Lett. 115, 241301 (2015), arXiv:1506.04065 [hep-ph] .
  * Ema  _et al._ (2016) Y. Ema, K. Mukaida, and K. Nakayama, JCAP 10, 043 (2016), arXiv:1602.00483 [hep-ph] .
  * Enqvist  _et al._ (2016) K. Enqvist, M. Karciauskas, O. Lebedev, S. Rusak, and M. Zatta, JCAP 11, 025 (2016), arXiv:1608.08848 [hep-ph] .
  * Ema  _et al._ (2017) Y. Ema, M. Karciauskas, O. Lebedev, and M. Zatta, JCAP 06, 054 (2017), arXiv:1703.04681 [hep-ph] .
  * Gross  _et al._ (2016) C. Gross, O. Lebedev, and M. Zatta, Phys. Lett. B 753, 178 (2016), arXiv:1506.05106 [hep-ph] .
  * Kasuya and Kawasaki (1996) S. Kasuya and M. Kawasaki, Phys. Lett. B 388, 686 (1996), arXiv:hep-ph/9603317 .
  * Felder  _et al._ (1999) G. N. Felder, L. Kofman, and A. D. Linde, Phys. Rev. D 59, 123523 (1999), arXiv:hep-ph/9812289 .
  * Bezrukov  _et al._ (2009) F. Bezrukov, D. Gorbunov, and M. Shaposhnikov, JCAP 06, 029 (2009), arXiv:0812.3622 [hep-ph] .
  * Garcia-Bellido  _et al._ (2009) J. Garcia-Bellido, D. G. Figueroa, and J. Rubio, Phys. Rev. D 79, 063531 (2009), arXiv:0812.4624 [hep-ph] .
  * Mukaida and Nakayama (2013) K. Mukaida and K. Nakayama, JCAP 03, 002 (2013), arXiv:1212.4985 [hep-ph] .
  * Repond and Rubio (2016) J. Repond and J. Rubio, JCAP 07, 043 (2016), arXiv:1604.08238 [astro-ph.CO] .
  * Fan  _et al._ (2021) J. Fan, K. D. Lozanov, and Q. Lu, (2021), arXiv:2101.11008 [hep-ph] .
  * Buchbinder  _et al._ (1992) I. L. Buchbinder, S. D. Odintsov, and I. L. Shapiro,  _Effective action in quantum gravity_ (1992).
  * Akrami  _et al._ (2018) Y. Akrami _et al._ (Planck Collaboration), (2018), arXiv:1807.06211 [astro-ph.CO] .
  * Csaki  _et al._ (2014) C. Csaki, N. Kaloper, J. Serra, and J. Terning, Phys. Rev. Lett. 113, 161302 (2014), arXiv:1406.5192 [hep-th] .
  * Palatini (1919) A. Palatini, Rendiconti del Circolo Matematico di Palermo (1884-1940) 43, 203 (1919).
  * Einstein (1925) A. Einstein, Sitzungsber. K. Preuss. Akad. Wiss. 43, 414 (1925).
  * Bauer and Demir (2008) F. Bauer and D. A. Demir, Phys. Lett. B 665, 222 (2008), arXiv:0803.2664 [hep-ph] .
  * Misner  _et al._ (1973) C. W. Misner, K. S. Thorne, and J. A. Wheeler,  _Gravitation_ (W. H. Freeman, San Francisco, 1973).
  * Spokoiny (1984) B. L. Spokoiny, Phys. Lett. B 147, 39 (1984).
  * Futamase and Maeda (1989) T. Futamase and K.-i. Maeda, Phys. Rev. D 39, 399 (1989).
  * Salopek  _et al._ (1989) D. S. Salopek, J. R. Bond, and J. M. Bardeen, Phys. Rev. D 40, 1753 (1989).
  * Fakir and Unruh (1990) R. Fakir and W. G. Unruh, Phys. Rev. D 41, 1783 (1990).
  * Bezrukov and Shaposhnikov (2008) F. L. Bezrukov and M. Shaposhnikov, Phys. Lett. B 659, 703 (2008), arXiv:0710.3755 [hep-th] .
  * Karamitsos and Pilaftsis (2018) S. Karamitsos and A. Pilaftsis, Nucl. Phys. B 927, 219 (2018), arXiv:1706.07011 [hep-ph] .
  * Kallosh  _et al._ (2013) R. Kallosh, A. Linde, and D. Roest, JHEP 11, 198 (2013), arXiv:1311.0472 [hep-th] .
  * Galante  _et al._ (2015) M. Galante, R. Kallosh, A. Linde, and D. Roest, Phys. Rev. Lett. 114, 141302 (2015), arXiv:1412.3797 [hep-th] .
  * Carrasco  _et al._ (2015) J. J. M. Carrasco, R. Kallosh, and A. Linde, JHEP 10, 147 (2015), arXiv:1506.01708 [hep-th] .
  * Bond  _et al._ (2009) J. R. Bond, A. V. Frolov, Z. Huang, and L. Kofman, Phys. Rev. Lett. 103, 071301 (2009), arXiv:0903.3407 [astro-ph.CO] .
  * Rusak (2020) S. Rusak, JCAP 05, 020 (2020), arXiv:1811.10569 [hep-ph] .
  * Fu  _et al._ (2017) C. Fu, P. Wu, and H. Yu, Phys. Rev. D 96, 103542 (2017), arXiv:1801.04089 [gr-qc] .
  * Karam  _et al._ (2021) A. Karam, M. Raidal, and E. Tomberg, JCAP 03, 064 (2021), arXiv:2007.03484 [astro-ph.CO] .
  * Turner (1983) M. S. Turner, Phys. Rev. D 28, 1243 (1983).
  * Whittaker and Watson (1996) E. T. Whittaker and G. N. Watson,  _A Course of Modern Analysis_, 4th ed., Cambridge Mathematical Library (Cambridge University Press, 1996).
  * Lachapelle and Brandenberger (2009) J. Lachapelle and R. H. Brandenberger, JCAP 04, 020 (2009), arXiv:0808.0936 [hep-th] .
  * Lebedev and Yoon (2021) O. Lebedev and J.-H. Yoon, (2021), arXiv:2105.05860 [hep-ph] .
  * Boyanovsky  _et al._ (1995) D. Boyanovsky, H. J. de Vega, R. Holman, D. S. Lee, and A. Singh, Phys. Rev. D 51, 4419 (1995), arXiv:hep-ph/9408214 .
  * Khlebnikov and Tkachev (1996) S. Y. Khlebnikov and I. I. Tkachev, Phys. Rev. Lett. 77, 219 (1996), arXiv:hep-ph/9603378 .
  * Fukugita and Yanagida (1986) M. Fukugita and T. Yanagida, Phys. Lett. B 174, 45 (1986).
  * Almeida  _et al._ (2019) J. P. B. Almeida, N. Bernal, J. Rubio, and T. Tenkanen, JCAP 03, 012 (2019), arXiv:1811.09640 [hep-ph] .
  * Babichev  _et al._ (2020) E. Babichev, D. Gorbunov, S. Ramazanov, and L. Reverberi, JCAP 09, 059 (2020), arXiv:2006.02225 [hep-ph] .
  * Harigaya and Mukaida (2014) K. Harigaya and K. Mukaida, JHEP 05, 006 (2014), arXiv:1312.3097 [hep-ph] .
  * Mukaida and Yamada (2016) K. Mukaida and M. Yamada, JCAP 02, 003 (2016), arXiv:1506.07661 [hep-ph] .
  * Delle Rose  _et al._ (2016) L. Delle Rose, C. Marzo, and A. Urbano, JHEP 05, 050 (2016), arXiv:1507.06912 [hep-ph] .
  * Chambers and Rajantie (2008) A. Chambers and A. Rajantie, JCAP 08, 002 (2008), arXiv:0805.4795 [astro-ph] .
  * Garcia  _et al._ (2020) M. A. G. Garcia, K. Kaneta, Y. Mambrini, and K. A. Olive, Phys. Rev. D 101, 123507 (2020), arXiv:2004.08404 [hep-ph] .
  * Garcia  _et al._ (2021) M. A. G. Garcia, K. Kaneta, Y. Mambrini, and K. A. Olive, JCAP 04, 012 (2021), arXiv:2012.10756 [hep-ph] .
  * Cline  _et al._ (2020) J. M. Cline, M. Puel, and T. Toma, Phys. Rev. D 101, 043014 (2020), arXiv:1909.12300 [hep-ph] .
  * Kawasaki and Ueda (2021) M. Kawasaki and S. Ueda, JCAP 04, 049 (2021), arXiv:2011.10397 [hep-ph] .
  * (67) J. Kost, C. S. Shin, and T. Terada, in preparation.
  * Linde (1994) A. D. Linde, Phys. Rev. D 49, 748 (1994), arXiv:astro-ph/9307002 .
  * Garcia-Bellido and Linde (1998) J. Garcia-Bellido and A. D. Linde, Phys. Rev. D 57, 6075 (1998), arXiv:hep-ph/9711360 .
  * Shaposhnikov  _et al._ (2021a) M. Shaposhnikov, A. Shkerin, I. Timiryasov, and S. Zell, JCAP 02, 008 (2021a), arXiv:2007.14978 [hep-ph] .
  * Shaposhnikov  _et al._ (2020) M. Shaposhnikov, A. Shkerin, I. Timiryasov, and S. Zell, JHEP 10, 177 (2020), arXiv:2007.16158 [hep-th] .
  * Shaposhnikov  _et al._ (2021b) M. Shaposhnikov, A. Shkerin, I. Timiryasov, and S. Zell, Phys. Rev. Lett. 126, 161301 (2021b), arXiv:2008.11686 [hep-ph] .
  * Figueroa and Torrenti (2017) D. G. Figueroa and F. Torrenti, JCAP 10, 057 (2017), arXiv:1707.04533 [astro-ph.CO] .
  * Aggarwal  _et al._ (2020) N. Aggarwal _et al._ , (2020), arXiv:2011.12414 [gr-qc] .
  * Domcke and Garcia-Cely (2021) V. Domcke and C. Garcia-Cely, Phys. Rev. Lett. 126, 021104 (2021), arXiv:2006.01161 [astro-ph.CO] .
  * Cai  _et al._ (2021) R.-G. Cai, Z.-K. Guo, P.-Z. Ding, C.-J. Fu, and J. Liu, (2021), arXiv:2105.00427 [astro-ph.CO] .
  * Postma and van de Vis (2017) M. Postma and J. van de Vis, JCAP 05, 004 (2017), arXiv:1702.07636 [hep-ph] .


utf8

# Deep learning approach for interruption attacks detection in LEO satellite
networks

Nacereddine Sitouah, Fatiha Merazka, Abdenour Hedjazi N. Sitouah, F. Merazka
and Abdenour Hedjazi are with the Department of Telecommunications, Electrical
Engineering Faculty, USTHB University, 16111, Algiers, Algeria, e-mail:
<EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS>
###### Abstract

The developments of satellite communication in network systems require strong
and effective security plans. Attacks such as denial of service (DoS) can be
detected through the use of machine learning techniques, especially under
normal operational conditions. This work aims to provide an interruption
detection strategy for Low Earth Orbit (LEO) satellite networks using deep
learning algorithms. Both the training, and the testing of the proposed models
are carried out with our own communication datasets, created by utilizing a
satellite traffic (benign and malicious) that was generated using satellite
networks simulation platforms, Omnet++ and Inet. We test different deep
learning algorithms including Multi Layer Perceptron (MLP), Convolutional
Neural Network (CNN), Recurrent Neural Network (RNN), Gated Recurrent Units
(GRU), and Long Short-term Memory (LSTM). Followed by a full analysis and
investigation of detection rate in both binary classification, and multi-
classes classification that includes different interruption categories such as
Distributed DoS (DDoS), Network Jamming, and meteorological disturbances.
Simulation results for both classification types surpassed 99.33 % in terms of
detection rate in scenarios of full network surveillance. However, in more
realistic scenarios, the best-recorded performance was 96.12 % for the
detection of binary traffic and 94.35 % for the detection of multi-class
traffic with a false positive rate of 3.72 %, using a hybrid model that
combines MLP and GRU. This Deep Learning approach efficiency calls for the
necessity of using machine learning methods to improve security and to give
more awareness to search for solutions that facilitate data collection in LEO
satellite networks.

###### Index Terms:

Distributed Denial of Service, Satellite Communication, Leo Earth Orbit
Satellites, Deep Learning, Intrusion Detection System, Security Development

##  I Introduction

Nowadays, the internet has become more and more important in our lives; in
order to satisfy the increasing users’ demands and their needs in term of
speed, latency and availability, we are witnessing a very competitive race of
network equipment revolutions, services visualization and the emergence of the
clouds. An (artificial) satellite is an object sent into space and placed in
orbit around the Earth, it is composed of many components including a power
system, an altitude and orbit control system, and most importantly a
communication system allowing the transmission and reception of messages [1].
Satellites enable the communication between geographically dispersed systems
through wireless communication links. They are widely used in various fields
of communication, such as the Internet, radio broadcasting services, and
telephony applications. They allow wider coverage with reasonable deployment
costs compared to terrestrial networks. Satellite communications are expected
to become an independent part of the fifth generation (5G) cellular networks
and they can be the building block for the sixth generation (6G) of wireless
communication technologies. In 2020, China successfully launched an
experimental test satellite which is considered to be ”The World’s First 6G
Satellite”. In addition, satellites are making much greater use of the
communication potential using Internet of Things (IoT) equipment. In favor of
satellites communication safety and reliability, just like both wired and
wireless terrestrial communication networks, the investigation of security
must be a priority, the nature of Wide Area Network (WAN) communications,
especially those that provide wider coverage through broadcasting protocols,
makes satellite networks highly vulnerable to cyber-attacks of various types
targeting large infrastructures, they typically employ very effective, and
well-supported technologies to breach their targets’ defense system. One of
most successful and invasive attacks is the denial of service (DoS) attack. A
DoS attack consists of deliberately sending a big amount of bogus messages to
the operating server of the network, aiming to disrupt and satellite
communication services. This attacks exhausts the limited resources of a
satellite system components, which includes the memory, CPU, bandwidth and
also electrical energy. Another simple, yet very efficient method of causing a
DoS on satellite networks is Jamming, just as described in its name, this
attack involves the use of one or multiple devices to intentionally interfere
with radio signals sent and received from and to the satellite, compromising
the communication channel with the clients or other satellites.

Because the DoS attack causes very critical security issues for wireless
communication networks, there must be efforts dedicated to prevent or at least
remedy the damages caused by it. The available computational power of this day
and age, has made artificial learning and particularly Machine Learning (ML)
one of the most successful technologies for the detection, the prevention and
the prediction of security problems and incidents. We aim in this work to
propose a protection solution based on ML and demonstrate how artificial
intelligence can also help ensuring the safety and availability of non-
terrestrial networks.

The rest of this paper is structured as follows. This section will also
include a state of the art regarding related works, and an overview of our
contributions through this paper. In Sect. 2, an introduction to Low Earth
Orbit (LEO) satellites security will be given with a brief description of some
of the most important interruption detection techniques currently deployed.
The detailed proposed mechanism will be presented in Sect. 3. And in Sect. 4
and 5, the environment preparation details and the performance evaluation of
our solutions will be provided. And finally, a conclusion is given in the last
section of this paper.

###  I-A Related Work

####  I-A1 Satellite communication security

Regarding the related literature on satellite security, an efficient and
secure anonymous authentication solution for satellite communication was
proposed in [2]. It is based on a simple and secure one-way hashing function
to match computation capabilities in lightweight-device environments. Authors
in [3] created an access verification protocol (BAVP) using identity-based
encryption and blockchain technologies. The combination makes data storage
more secure in distributed computing systems, particularly LEO satellite
networks. The simulation proved the security of the protocol but the
deployment still needs some reforming of the blockchain technology according
to particular satellite network routing algorithms. Another authentication
schemes for satellite-communication using lightweight key agreement was
proposed in [4] [5] and [6]. Authors of [4] provided mutual authentication,
session-key agreement and a solution for user anonymity problems. They
presented formal and informal security analyses against different well-known
attacks. Their results validate the new scheme efficiency and additional
security features such as user anonymity and forward secrecy. In [7], they
treat jamming threats to enhance security, the authors performed a secrecy
analysis for the uplink transmission in satellite communication which is based
on the orthogonal time-frequency space (OTFS) and a comparison with the
traditional Orthogonal Frequency Division Multiplexing (OFDM) scheme. Results
demonstrated better performance of the uplink LEO Sat-Com (Satellite
Communication) system.

####  I-A2 Machine learning in satellite communication

The state of the art concerning satellite communication security indicates
that non-intelligent methods, which do not include any type of artificial
intelligence, significantly underperform compared to solutions integrating
intelligence. The work in [8] puts forward an Extreme Learning Machine-based
distributed routing (ELMDR) strategy to make routing decisions by predicting
traffic. In [9], they use machine learning algorithms to detect message
collisions, by optimizing the automatic dependent surveillance-broadcast
(ADS-B) reception. The NASA research center and authors of [10] studied the
role of machine learning in the link-to-link aspect of Sat-Com, they used
reinforcement learning space links to ground stations using NASA’s testbed on
the international space station. In [11] authors created a lightweight model
of neural networks in the hope of encouraging the development of an
intelligent edge IoT architecture by satellite, this solution combines edge
computing with deep learning. Results show and prove that lightweight neural
networks like MobileNet and ShuffleNet are more suited to satellite IoT
scenarios in the IoT edge satellite intelligent computing architecture. The
work in [12] experiments on the promising transport protocol Multipath TCP
(MPTCP) in LEO Sat networks, using the self-learning properties brought by
reinforcement learning in order to find the optimal congestion control
strategies. Another potential of improvement by the use of deep learning
techniques is the accuracy of 5G terminal location discovery. [13] overcomes
the dependency on the external global navigation satellite system, data
clustering methods of unsupervised ML are used to classify and exclude
measured data. [14] emulates a Sat-Com platform to generate environment data
and capture different internet communications (encrypted, unencrypted and
tunneled) in order to have a high classification rate and improve the overall
Quality of Service (QoS) of the communication. Machine learning is also
recently used in satellite operation, such as interference detection,
flexible-payload configuration and congestion prediction [15], and for
resource allocation on the internet of Remote things [16], the authors study
different security aspect in SIoRTNs (satellites for Internet of Remote things
networks), the proposed algorithm based on actor-critic reinforcement learning
(SACRL) showed effectiveness in term of the IoRT data download performance.

####  I-A3 Detection of interruption using machine learning

DDoS and interruption attacks are the biggest threat that generally target
Sat-Com. We performed a comprehensive literature review regarding these
particular issues. The first obstacle was the unavailability of communications
datasets, followed by the unavailability of public DDoS traffic captured from
satellite networks. However, our work applies the same principle of using ML
for DDoS detection as in-ground networks. Experiments in [17] use public
communication datasets to train a model capable of detecting several types of
attacks including the DoS in the IoT, by deploying a distributed learning
method based on Fog Computing.
Authors of [18] proposed a solution based on artificial neural networks for
the recognition of DDoS attacks, combined with a Learning Vector Quantization
neural network (LVA NN). The authors of [19] are interested in the security of
the IoT, particularly the IIotT (Industrial IoT), they developed an anomaly
detection technique for the IICSs (Internet Industrial Control Systems) based
on ANNs models that can learn and validate using information collected from
TCP/IP packets. Similarly, researchers in [20] studied the detection of DDoS
attacks in smart agriculture, called AIoT. They deploy an identifier based on
three models (CNN, DNN, and RNN) and compare its performance for both binary
and multi-class classifications. Another work in [21] developed a model based
on CNNs, with both types of classification, using the most recent IDS datasets
that contains advanced DoS attacks. [22] took a different approach using a
hybrid deep learning method for Botnet attack detection in the IoT, the method
overcomes memory constraints in LSTM models, authors used a short-memory
automatic encoder (LAE) to reduce feature size, and then implemented Bi-LSTM
for interruption attacks detection.

###  I-B Contributions

In this paper, we propose a methodology that allows the study and the
investigation of deep learning solutions in the security of satellite
communication. Our main contributions can be expressed into the following:

  * •

We present a simulation environment which allows the study on similar
characteristics of real satellite networks, using Omnet++ network simulator,
and a personalized topology for four different scenarios: Normal
communication, DDoS flooding attacks, Natural cause interruptions (ex: rain
and thunderstorms) and network jamming.

  * •

We propose a method to generate rich datasets from the simulation results,
then we present different deep learning algorithms and experiment with them on
our datasets in different scenarios and conditions.

  * •

We test each of our algorithms on the two main datasets: SAT-COM.LEO.NDBPO#1
and SAT-COM.LEO.NDBPO#2, for both classification types: binary classification
and multi-class classification in an offline manner.

  * •

We finally present a methodology that allows the test of the previous
algorithms combined with probability calculations to create an IDS capable of
real-time detection of interruption causes.

  * •

The performance of each algorithm in each scenario is investigated and
compared to ensure efficiency and minimize false alerts for better overall
performance.

.

##  II LEO security

China’s CCID (China Center for Information Industry Development) estimates
that the number of LEO satellites will exceed 57,000 by 2029 [41],
encompassing all technology sectors. Hence, any damage inflicted in the
satellite sector can have a quality of service effect, leading to heavy
financial or data losses. Unfortunately, organizations rarely have direct
control over satellites cybersecurity, as satellite operations are driven by
technologies hosted on Earth; these land-based entry points offers cyber
attackers a huge number of potential forays. Long range telemetry for
communication with ground stations poses a great weakness, uplinks and
downlinks are often transmitted via open telecommunication network security
protocols, and easily accessible by cybercriminals. IoT devices that use
satellite communications are also a potential entry points for bad actors.

###  II-A Classification of security problems

According to the work of H. Cao et al [42], security problems in satellite
communications can be divided into three broad categories; we focus on
telecommunication and network security:

  * •

National security

1 - Threats to national security : These threats are summed up in the theft of
strategic information on targeted countries, by deploying an Earth observation
station on LEO satellites, it’s an eavesdropping attack condemned by the Space
Law.

2 - preemption of frequency and orbit resources : The ITU organizes and shares
orbit and frequency resources according to a FIFO service queue, this type of
threat consists of the illegal use of these limited resources, which can
potentially cause an interruption or a DoS.

  * •

Network security

3 - Identity theft: If the authentication and identification mechanism used is
vulnerable, old or public, an attacker can impersonate a legitimate terminal
and gain access to it by calculating uplink frequencies and then bypassing
ACPs (Access control policies), or a spy satellite can invoke an ISL
connection that seems legitimate with the victim satellite.

4 - Listening to data and intercepting information: Many satellite
communications do not encrypt the data transfer, and most protocols are either
unscalable or hard to upgrade, which makes listening and intercepting messages
very frequent and easy to execute.

5 - signal interference: This kind of attacks is the most common and
efficient, an attacker can interfere with satellites and scramble channels by
transmitting signals from transmitters with higher power, on the communicating
frequency band.

6 - denial of services: Like terrestrial networks, DDoS are effective in
attacking Internet Satellites, an attacker simulates a flow of legitimate and
bogus requests from satellite terminals in order to send it to satellites,
preventing legitimate terminals from good service quality.

7 - Malicious occupation of satellite bandwidth resources: Most satellites
operate as a transponder without unpacking the signal, so it becomes
impossible to verify the legitimacy of a received signal, even if the
satellite manages to unwrap the signal, the attacker uses his own cryptography
technique to hide his communications.

  * •

Equipment safety

8 - Malicious satellite control: An attacker sends malicious instructions or
injects viruses into satellites from the ground or from space to achieve the
objective of controlling the satellites, dragging the satellite out of orbit,
interrupting services or contaminating other satellites.

9 - Malicious consumption of satellite resources: An attacker directly affect
the lifespan of satellites by consuming thrusters (responsible for satellite
movement, maintaining orbit and avoiding collisions).

###  II-B Interruptions detection techniques

An interruption is a temporary shutdown or a temporary unavailability of a
satellite network supply to a customer, such as signal interference, denials
of service, unauthorized use of resources, malicious network jamming. The
protection against such attacks can be classified into four methods according
to [41]:

  * •

Statistical-based methods: Based on various statistical algorithms developed
using different measures. Detection begins with data collection, and ends with
an analysis of a significant sample of the network to identify malicious
traffic.
In [43], a detection based on the entropy anomaly is proposed, it can
determine whether the current state is normal or compromised based on the
entropy value, then detects the DDoS attack by changing the entropy value of
the network characteristics. Moreover, Shannon’s entropy [6] is considered to
be one of the best methods to detect abnormal traffic [44] [45].

  * •

Machine learning method: Traditional ML approaches are used to analyze and
classify traffic. They obtain good results under certain conditions. In [46],
a method based on K-means and K-nearest fast neighbors is proposed. The
limitation of traditional machine learning for detecting DDoS attacks is that
historical traffic characteristics cannot be used, and the bigger the data
grows, the lower the detection rate. It is for this reason that new ML
approaches such as DL give more hope for better results.

  * •

Prevention techniques: One of these works is presented in [47] in which the
authors studied the possibility of preventing DoS attacks by reducing the
power consumption of the control center while preventing DoS attacks. others
propose a system that provides proactive prevention against DoS and DDoS
attacks, monitoring the network in normal operation with the average number of
requests circulating, making it possible to block any traffic generating an
anomaly. In general, implementing any authentication and cryptography solution
dramatically decreases the risk of being attacked, but the majority of
satellite communication systems lack investment in security and protection
techniques.

  * •

Specific applications: These solutions developed and intended in particular
for security against DDoS attacks, from a specific structure, such as the use
of the blockchain to advise other users on a attack, honeypots using the
network to deceive the intruder.

##  III Proposed interruption detection mechanism

Our work puts into practice different techniques of deep learning in order to
propose a solution that improves the detection of interruption attacks
targeting LEO satellite communications. The effectiveness of any machine
learning model depends on the availability of rich training data. Thus,
communication datasets are the essential element of our DL based project. To
exceed the problem of public DDoS traffic datasets unavailability had to be
solved, we propose a simulation technique that will allow us to generate a
benign communication dataset, with several communication scenarios affected by
interruptions in satellite networks, a technique dedicated particularly to
networks via LEO satellites. The well-known simulation tools OMNeT++ and INET
library will be used to capture the different properties of the simulated
satellite communications. We propose a satellite networking topology composed
of 20 earth terminals, three satellites equipped with processing units, inter-
satellite links, and satellite-terrestrial links. Each terminal in the
topology is assumed able to communicate directly with satellites in its
reception scope.

Fig.1 represents the topology used to generate satellite communication traffic
during simulation, where each orbiting satellite covers an area of the earth.
Terminals1..10 are covered by Satellite1 and Terminals11..20 are covered by
the Satellite2. The communication between an earth terminal and a satellite is
on the frequency channel 1616Mhz. When an End-User from Zone1 wants to
communicate with another End-User from Zone2, Satellite1 uses the frequency
channel 23180MHz to send the message to the Satellite3, which in turn
transmits it to Satellite2, then this latter finally transmits the message to
the destination End-User. Dynamic Satellite-to-Satellite routing protocols are
not supported by the simulator, therefore, Satellite3 uses static routing
protocols assuming that both Satellite1 and Satellite2 are fixed objects from
its point of view.

Figure 1: Network topology

###  III-A Construction of ¡¡SATCOM.LEO.NDBPO.#1¿¿ dataset

We would like to mention the work of F.Alhaidari and A.Alrehan, although this
project took a much different path, the idea of generating this dataset was
inspired by their efforts in [48]. Essentially, two utilities play an
important role for datasets’ generation. First, the log console which is
window available under the GUI of Omnet++, displays message transmission
events that have taken place between different modules during simulation.
Second, the vector file, which records network information in time intervals
as statistics for each module, as data timestamp. These data values are
recorded and captured based on several categories or features.

By combining the data retrieved using both utilities, we obtain relevant
information characterized with LEO satellites communications properties. We
use Jupyter Notebook with our python scripts that explore each event in the
log file, and for each event it calculates the current, previous and next time
for each module. To extract the values of the features in the interval between
the previous time and the next time, the script calculates the value of each
feature in the Vector file for each communication event according to the
following equation 1:

For each feature i and event j (with n the number of nodes in communication):

$ValFeat_{i}(event_{{j}})=\sum_{k=1}^{n}ValFeat_{i}Node_{k}[\textrm{Previous
event time, Next event time}]$ (1)

Fig.2 presents the workflow of the dataset’s creation.

Figure 2: Features extraction flow.

We use another python script to generate more features and enrich the dataset,
as notation we call reference local time for packets with the same sender,
receiver and protocol, and global time to reference any packet sent or
received.

###  III-B Construction of ¡¡SATCOM.LEO.NDBPO.#2¿¿ dataset

This dataset serves the purpose of implementing a flow based intrusion
detection system (IDS), which would be more suitable for real-time detection.
We use the module ¡¡PcapRecorder¿¿ of Omnet++ to record the communication
traffic that passes to or from a node in the topology. After the generation of
the communication pcap files we use ¡¡TcpReplay¿¿ tool to regenerate the
simulation traffic on an environment external to the simulation.

Several features similar to the previous dataset are used, combined with other
new flow-based ones that are created with python scripts. A communication flow
is any continuous and uninterrupted communication, that does not contains any
error message due to an unreachable destination.

Tab.LABEL:Description_des_caracteristiques_du_dataset_construit summarizes
different features in the datasets:

TABLE I: Description of ¡¡SATCOM.LEO.NDBPO.#1¿¿ and ¡¡SATCOM.LEO.NDBPO.#2¿¿ features No. |  Feature |  Description |  Dataset#1 |  Dataset#2
---|---|---|---|---
- |  sendTime |  Sending time according to the sniffed packet |  yes |  yes
- |  sender |  Packet sender |  yes |  yes
- |  reciever |  Packet receiver |  yes |  yes
- |  IP_src |  Ip Address of the source |  yes |  yes
- |  port_src |  Port of the source |  yes |  yes
- |  IP_dest |  Ip Addres of the destination |  yes |  yes
- |  port_dest |  Port of the destination |  yes |  yes
- |  Frequency |  Transmission frequency |  yes |  no
1 |  Next_Current_diff |  Global time difference between current and next |  yes |  yes
2 |  Next_Pre_diff |  Global time difference between previous and next |  yes |  yes
3 |  SNext_Current_diff |  Local time difference between current and next |  yes |  yes
4 |  SNext_Pre_diff |  Local time difference between previous and next |  yes |  yes
5 |  size |  Packet size |  yes |  yes
6 |  channel |  Frequency channel |  yes |  yes
7 |  duration |  Transmission duration |  yes |  no
8 |  packet_type |  Packet type (Udp,Icmp) |  yes |  yes
9 |  rcvdPK |  Recieved packets |  yes |  no
10 |  sentPK |  Sent packets |  yes |  no
11 |  droppedPKWrongPort |  Dropped packets, wrong ports |  yes |  no
12 |  DataQueueLen |  Data queue length |  yes |  no
13 |  passedUpPk |  Passed up packets |  yes |  no
14 |  rcvdPKFromHL |  Received from higher layer |  yes |  no
15 |  rcvdPKFromLL |  Received from lower layer |  yes |  no
16 |  sentDownPK |  Sent down packets |  yes |  no
17 |  DropPKByQueue |  dropped packets from queue |  yes |  no
18 |  snir |  Signal-to-interference-plus-noise ratio |  yes |  yes
19 |  throughput |  Transmission throughput |  yes |  yes
20 |  Flow Bytes_s |  Flow’s bytes per second |  no |  yes
21 |  Flow Packets_s |  Flow’s packets per second |  no |  yes
22 |  meanT_b_2P |  Mean time between two packets |  no |  yes
23 |  maxT_b_2P |  Maximum time between two packets |  no |  yes
24 |  minT_b_2P |  Minimum time between two packets |  no |  yes

###  III-C Description of the different scenarios

We focus on various security aspects related to services’ availability, in
order to achieve this we do not consider network flooding attacks solely, we
rather include meteorological and other jamming disruption scenarios.

####  III-C1 Scenario 1 ¡¡Benign traffic¿¿

Based on the topology shown in Fig.1, benign communication is achieved by a
stream based on UDP protocol, it simulates real-time running applications such
as voice and video, which cannot wait for recovery mechanisms such as
retransmissions. The protocol’s performance through a satellite network is
characterized as having a significant delay depending on the height of the
satellite orbit and the number of satellite hops. It should be noted that
Omnet++ does not allow three-dimensional simulation, for this reason the
height of the satellites is ignored, but the characteristics of the network
are based on the actual performances of a LEO satellite. Benign traffic is
labeled ¡¡Normal¿¿.

Note: ¡¡Omnet++¿¿ does not implement frequency division protocols, but allows
communication through channel numbers, so if two nodes use two different
channels, they cannot communicate.

Note 2: The ¡¡Simulation time¿¿ intervals can be set freely depending on the
power of the computer in hand.

####  III-C2 Scenario 2 ¡¡Malicious ”UDP Flood” traffic¿¿

This traffic is a DDoS attack targeting the satellites communications, this
attack is carried out by infecting certain earth terminals of the network, to
send larger packets with a higher transmission rate. This malicious traffic is
labeled ¡¡UDP_Flood_attack¿¿, and carried out by adding another communication
flow sent by contaminated users. Fig.3 is a graphic demonstration of this
attack.

Figure 3:  Network topology of UDP flood attacks.

####  III-C3 Scenario 3 ¡¡Natural interruption ”Rain and thunderstorms”¿¿

Among the natural disruptions are meteorological events, such as torrential
downpours and aggressive thunderstorms, which actually dramatically increase
the rate of loss in satellite communication, This traffic is carried out by
modifying the path loss for the affected users. Fig.4 describes this scenario.

Figure 4:  Network topology of natural disruptions.

####  III-C4 Scenario 4 ¡¡Jamming network interference¿¿

We achieve satellite network jamming by simulating aircrafts (JamCrafts) that
fly in the field of view of satellites antennas, send and receive noise
signals in the same radio frequencies used by the targeted satellite, this
traffic is carried out by adding another communication flow between attacking
aircraft and ground agents. Fig.5 is an abstraction of this attack.

Figure 5:  Network topology of jamming attacks.

Tab. II Describes the characteristics of different flows and scenarios.

TABLE II: Description of the characteristics of benign traffic  Parameters |  Scenario 1 |  Scenario 2 |  Scenario3 |  Scenario 4
---|---|---|---|---
Number of terminals |  20 |  20 |  20 |  20
Number of affected terminal |  / |  6 |  10 |  /
Number of satellites |  3 |  3 |  3 |  3
Benign source ports |  5555,3099,2099 |  5555,3099,2099 |  5555,3099,2099 |  5555,3099,2099
Benign destination ports |  2000,9901,9902 |  2000,9901,9902 |  2000,9901,9902 |  2000,9901,9902
Targeted satellite |  / |  satellite 3 |  satellite 2 |  satellite 1
Malicious source ports |  / |  2001 |  / |  /
Malicious destination ports |  / |  2002 |  / |  /
Total number of channels |  22 |  22 |  22 |  22
Normal Packets size |  [40B,635B] |  [40B,635B] |  [40B,635B] |  [40B,635B]
Attack Packets size |  / |  [4000B,5000B] |  / |  /
Normal transmission rate |  [100ms,400ms] |  [100ms,400ms] |  [100ms,400ms] |  [100ms,400ms]
Attack transmission rate |  / |  [20ms,50ms] |  / |  /
Inter-satellite communication channel |  30 , 31 |  30 , 31 |  30 , 31 |  30 , 31
Ch between satellite 0 & EndUsers [0..9] |  [0..10] |  [0..10] |  [0..10] |  [0..10]
Ch between satellite 0 & EndUsers [10..19] |  [10..19] |  [10..19] |  [10..19] |  [10..19]
Path loss |  2 |  2 |  4 |  2
Satellite transmitter power |  7W |  7W |  7W |  7W
EndUser transmitter power |  7W |  7W |  7W |  7W
Number of ground agents |  / |  / |  / |  10
Number of JamCrafts |  / |  / |  / |  1
Ch between JamCraft & JamUsers [0..9] |  / |  / |  / |  [0..10]
JamCraft transmitter power |  / |  / |  / |  12W
JamUser transmitter power |  / |  / |  / |  20W
Attack duration |  0s |  33s |  26s |  80s
Simulation time (dataset#1) |  0s-90s |  90s-123s |  124-250s |  250s-330
Simulation time (dataset#2) |  0s-900s |  900s-1500s |  3000s-4500s |  1500s-3000s

###  III-D Applying Deep Learning

The first step in applying a machine learning algorithm is data normalization,
which is the process of resizing the dataset’s attributes into a particular
range, such as between 0 & 1 or 1 & -1. Data normalization prepares datasets
to be fed into ML classifiers, in order improve the accuracy of the results.
We normalize our datasets with the min-max function [49]:

$X=\frac{(x-Min)}{(Max-Min)}$ (2)

We then standardize and label the datasets, and implement different deep
learning algorithms and compare their efficiency, we test several models such
as MLPs, CNNs and RNNs, the workflow to achieve our goals is as follows:

####  III-D1 Training phase

This is the first step to create a classifier, it is necessary to find the
most adequate parameters of the algorithms for the classification problem in
hand, this makes it possible to create an intelligent model offering high
precision rates. The input dataset dataset will be divided into three parts
containing 40%, 30% and 30% of the dataset’s totality, the first part is used
to train the model and modify the weights of the algorithm. To ensure that the
model does not overfit, the second part is used for the validation of the
model, so that at each iteration, the model is only updated if it performs
better on the validation set.

####  III-D2 Evaluation phase

The last 30% of the splits, is used to test the new model, and display results
in a format allowing its evaluation, which is done according to the following
factors (Annotations: TP = True positives, FP = False positives, FN = False
negatives, TN = True negatives [49]):

    * •

Accuracy: The percentage of correct classifications of the model:
${\textit{Accuracy}}=\frac{TP+TN}{TP+FP+TN+FN}$

    * •

Precision: The percentage of correct positive instances out of the total
predicted positive cases: ${\textit{Precision}}=\frac{TP}{TP+FP}$

    * •

Recall: The percentage of positive instances out of the total of actual
positive instances: ${\textit{Recall}}=\frac{TP}{TP+FN}$

    * •

Sum of probabilities: The total sum of the probabilities of the correct
classes: ${\textit{sum\\_prob}}=\sum_{k=1}^{n}Prob\\_class\\_correct$

    * •

Confusion matrix: The rate of false or correct predictions by class.

###  III-E Workflow/Different steps of implementation

####  III-E1 Offline detection under simulation

Here, we suppose that the controller (agent), has full surveillance on the
simulated LEO network, so we assume he can monitor all the modules
participating in the communication, this means that the generated dataset
contains all the packets sent or received, and all features related to the
network. This way, it becomes possible to find the most significant
characteristics and have a precise and deeply detailed description of the
important element for a safe satellite network (in the simulation
environment).

####  III-E2 Offline / online detection

: In this scenario, the specific constraints and conditions of a satellite
communication network are taken more into account, such as: Electric power
limitation, Computing power constraints, information availability and
unavailability, Necessity of online detections, Impossibility of live
surveillance on EndUsers.

In this case, we set surveillance at satellites level, the security agent can
only monitor them or earth stations. This makes it possible to simulate a
satellite by a virtual machine which will capture in real time, the
communication flow generated from the simulation environment. This approach
was used to create the ¡¡SATCOM.LEO.NDBPO.#2¿¿ dataset.

TcpReplay tool allows us to generate traffic with the same send and receive
time values, the satellite uses our own sniffer programmed in python, that
captures the packets, processes them and transmits the processed data via the
best performing deep learning model.

##  IV Environment preparation and datasets generation

In this section, we put into action our solution, evaluate the generated flow
and our anomaly based detection approach in a working environment that allows
the creation of a communication network composed of LEO satellites.

###  IV-A Work environment

We use an ultra-portable Notebook ”Lenovo T490s” with a Core (TM) i7-8665U
processor (1.90 GHz, up to 4.80 GHz with Turbo Boost, 4 Cores, 8 Threads, 8 MB
Cache), 64 bits and 16 GB of RAM, equipped with a Windows 10 Pro operating
system and two VMs with a Linux OS Ubuntu 16.04 LTS.

Installation of the simulator: We install the Omnet++ simulation tool, its
vendors offer a step-by-step manual which can be found under [50]. We use
Omnet++ v4.6 but we recommend installing it under a Linux environment for
version compatibility reasons, we use Ubuntu 16.04. After installing the
simulator, it is necessary to download and import the open source INET v2.5
model library into Omnet++, a complete manual can be found under [51].

Topology implementation: To achieve the architecture seen in Fig.1, we use a
combination of modules created under Omnet++, detailed in Tab.III:

TABLE III: Description of the main Omnet’s nodes in the network topology  Name |  Description
---|---
EndUser |  An extension of Inet’s ’Sat_User’ module modified to represent a terrestrial user.
& JamUser |
……………….. Satellite |  An extension of the ’Satellite’ module of OS3 (Omnet’s Open Source Satellite Simulator developed at the Communication Networks Institute, TU Dortmund, Germany [58]) modified and equipped with a communication network interface and a radio interface to represent a satellite able to receive and transmit messages.
…………. ChannelControl |  This is an instance in every network model that contains mobile or wireless nodes. This module is informed of the location and movement of nodes, and determines which nodes are within communication or interference distance.
JamCraft |  A custom module representing an aircraft with the ability to transmit stray radio signals covering a large land area.
Figure 6:  Topology under Omnet.

####  IV-A1 Dataset generation

We generate ¡¡SATCOM.LEO.NDBPO.#1¿¿ by extracting the useful instances from
the log file and then enriching them with the information gathered from the
vector file. Fig.7 file shows how Omnet++ generates the contents of the
¡¡final log file¿¿ in Fig.2.

Figure 7:  A sample of the contents of the ¡¡log¿¿ file

For ¡¡SATCOM.LEO.NDBPO.#2¿¿ we use the pcap file generated by the simulator
and captured with PcapRecorder from satellite[0] node, then on a new Ubuntu VM
equipped with ¡¡TcpReplay¿¿ and a customized sniffer, that capture packets in
real time and simultaneously creates instances of the second dataset.

###  IV-B Information on the generated datasets

The generation time of a dataset is as important as the response time and the
detection time, whether offline or in real time. Tab.IV illustrates some
statistics on the cost in terms of time.

TABLE IV: Statistics on the datasets generation Dataset | SATCOM.LEO.NDBPO.#1 | SATCOM.LEO.NDBPO.#2
---|---|---
Scenarios | Scn 1+2 | Scn 1 | Scn 3 | Scn 1+2 | Scn 1 | Scn 3
Packet extraction time | 47.70s | 18.92s | 30.88s | 1500s | 1500s | 1500s
Time to remove unnecessary csvs | 9.28s | 7.83s | 8.43s | / | / | /
Feature creation time | 1089.49s | 842.53s | 470.58s | / | / | /
Time to add features | 111.88s | 26.68s | 10.24s | 242s | 151s | 160s
Radio features addition time | / | / | / | 16h | 9h | 10h
Normalization time | 22.93s | 278.60s

Note that two datasets cannot be compared without context, because the first
contains more information with a total monitoring on the network in a
simulation period of 330s (total size = 252MB), and the second dataset is a
capture of the satellite[0] during a simulation period of 4500s (total size =
929 Mo).

####  IV-B1 Dataset with binary classes

The classes ¡¡Normal¿¿ & ¡¡Rain_and_Thunderstorms¿¿ are considered as a single
class which represents the benign flow, and the two classes
¡¡UDP_Flood_attack¿¿ & ¡¡Jamming_attack¿¿ are considered attack flows. Fig.9
and Fig.9 demonstrate these distributions.

Figure 8: Flow breakdown of
¡¡SATCOM.LEO.NDBPO.#1¿¿

Figure 9: Flow breakdown of
¡¡SATCOM.LEO.NDBPO.#2¿¿

####  IV-B2 Multi-class dataset

Each class has its own label. Fig.11 and Fig.11 demonstrate the flow breakdown
by class.

Figure 10: Flow breakdown* of
¡¡SATCOM.LEO.NDBPO.#1¿¿

Figure 11: Flow breakdown* of
¡¡SATCOM.LEO.NDBPO.#2¿¿

Figs.13 and 13 show more distribution details of normal and abnormal flows of
the three interruption types. Both datasets can be found at
https://github.com/NacereddineSitouah/Interruption_LEO_SAT_master.

Figure 12: Flow breakdown** of
¡¡SATCOM.LEO.NDBPO.#1¿¿

Figure 13: Flow breakdown** of
¡¡SATCOM.LEO.NDBPO.#2¿¿

##  V Performance evaluation of the proposed model

In this section, we apply the following algorithms for binary and multi-class
classifications: MLP, CNN, RNN, GRU, and LSTM.
We use Anaconda v4.10.1[52] which is a python v3.8.5 distribution that
includes several data-science libraries. We also use the Pytorch [53] library,
which is one of the best for machine learning. For programming and building
models we use Jupyter Notebook [54]and VS Code v1.41.1 [55].

Classifiers parameters : Tab.LABEL:parametre_des_modeles_pour_datasets
contains the various parameters used in the classification models that had the
best performances. The selection procedure was performed by setting multiple
parameters and then altering them one by one until the optimal parameters were
found. For all models we find that ReLU, Softmax and the value 0.003 were the
best as activation function, output activation function and learning rate
respectively, we also used the value 0 as dropout rate through all models.

TABLE V: Deep learning classifier’s parameters Dataset |  SAT-COM.LEO.NDBPO.#1 |  SAT-COM.LEO.NDBPO.#2
---|---|---
MLP
Input size |  19 |  14
Number of hidden layers |  2 |  4
Number of neurons - hidden layer 1 |  350 |  64
Number of neurons - hidden layer 2 |  400 |  140
Number of neurons - hidden layer 3 |  / |  200
Number of neurons - hidden layer 4 |  / |  32
Number of epochs |  50 |  200
Batch size |  1 |  300
Loss Function |  Negative Log Likelihood Loss |  Cross Entropy Loss
Optimizer algorithm |  Stochastic Gradient Descent Optimizer |  adaptive moment estimation (Adam)
¡¡C¿¿ = RNN / LSTM / GRU
Input size |  19 |  14
Number of layers ¡¡C¿¿ |  3 |  2
Hidden projection layer size (dimension) |  132 |  132
Activation function |  Tanh |  Tanh
Number of epochs (RNN) |  50 |  800
Number of epochs (GRU) |  50 |  200
Number of epochs (LSTM) |  50 |  100
Batch size |  1 |  600
Loss Function |  Negative Log Likelihood Loss |  Negative Log Likelihood Loss
Optimizer algorithm |  Stochastic Gradient Descent Optimizer |  Stochastic Gradient Descent Optimizer
CNN
Input size |  18 (3*6) |  /
Number of convolutional layer |  3 |  /
Number of convolutional neuron - conv layer 1 |  8 |  /
Kernel size / stride / padding - conv layer 1 |  (3x3) / 1 / 1 |  /
Kernel size / stride - Pooling layer 1 |  (1x1) [no effect] / 1 |  /
Number of convolutional neuron- conv layer 2 |  12 |  /
Kernel size / stride / padding - conv layer 2 |  (3x3) / 1 / 1 |  /
Kernel size / stride - Pooling layer 2 |  (1x1) [no effect] / 1 |  /
Number of convolutional neuron - conv layer 3 |  18 |  /
Kernel size / stride / padding - conv layer 3 |  (3x3) / 1 / 1 |  /
Kernel size / stride - Pooling layer 3 |  (1x1) [no effect] / 1 |  /
Number of fully connected layers |  2 |  /
Number of neurons - hidden layer 1 |  350 |  /
Number of neurons - hidden layer 2 |  400 |  /
Number of epocs |  50 |  /
Batch size |  1 |  /
Loss function |  Negative Log Likelihood Loss |  /
Optimizer algorithm |  Stochastic Gradient Descent Optimizer |  /

###  V-A Binary classification

Fig.14 shows the training loss and validation loss over time for binary
classification of ¡¡SATCOM.LEO.NDBPO.#1¿¿, overall, there is always a sharp
drop in the beginning epochs of learning for both losses in all models, this
indicates that all the models perform very well during at the start, then the
learning stops after about ten or twenty epochs, and this is either a sign of
a local optimum trap, or that the best parameters were found. In addition, we
observe that the RNN model starts overfitting on the training data since the
training loss starts decreasing rapidly but validation loss maintain almost
the same level, that is why this model performs the worst. The CNN model seems
to have reached its peak after the first decade of epochs.

Figure 14: Training and validation loss for the binary classification on
¡¡SAT-COM.LEO.NDBPO.#1¿¿

Fig.15 illustrates the graphs for the ¡¡SATCOM.LEO.NDBPO.#2¿¿ dataset, it
shows that almost all the models had similar performances after training,
where GRU and LSTM had a better success in learning, while the other two
algorithms RNN and MLP clearly show sign of overfitting after 500 and 100
epochs, respectively.

Figure 15: Training and validation loss for the binary classification on
¡¡SAT-COM.LEO.NDBPO.#2¿¿

Tab.LABEL:Performance_results_for_binary_classification summarizes the final
performance results of each model, the LSTM model appears to perform best with
a false positive rate of 0.014% and a false negative rate of 0.008%. However,
the CNN model also performs well, but with a false negative rate of 0% is not
very optimal when the false positive rate is relatively large 0.2%, because
the false positives themselves will be a new source of disturbance in the
network. In addition, the training and execution times are very long which
makes the model difficult to update, especially considering that the overall
performance of this model is the least-performing one. For this reason, we
eliminate CNN model from the detection experiments on the second dataset.
Tab.VII represents the confusion table for binary detection.

TABLE VI: Performance results for binary classification Dataset | SAT-COM.LEO.NDBPO.#1 | SAT-COM.LEO.NDBPO.#2
---|---|---
Algorithm |  MLP |  CNN |  RNN |  GRU |  LSTM |  MLP |  RNN |  GRU |  LSTM
Accuracy |  99.91% |  99.85% |  99.78% |  99.83% |  99.98% |  95.35% |  95.26% |  96.12% |  95.78%
Precision |  99.67% |  99.46% |  99.21% |  99.4% |  99.96% |  93.52% |  93.54% |  93.39% |  93.56%
Recall |  99.99% |  100% |  99.98% |  99.99% |  99.99% |  93.86% |  93.61% |  96% |  94.98%
Sum of probabilities |  99.91% |  99.95% |  99.84% |  99.86% |  99.92% |  98.14% |  98.61% |  98.3% |  98.26%
Training time per epoch |  381.5s |  1474s |  401.9s |  382.3s |  396.5s |  40.5s |  32.15s |  82.33s |  115.8s
Execution time |  67.85s |  166.42s |  136.45s |  124s |  134.39s |  394.5s |  136.45s |  287.45s |  272.65s
TABLE VII: Table de confusion - Classification binaire Algorithm | MLP | CNN | RNN | GRU | LSTM
---|---|---|---|---|---
Dataset |  Class |  Normal |  Attack |  Normal |  Attack |  Normal |  Attack |  Normal |  Attack |  Normal |  Attack
D-Set#1 |  Normal |  99.87% |  0.01% |  99.79% |  0% |  99.69% |  0.02% |  99.76% |  0.01% |  99.985% |  0.009%
Attack |  0.13% |  99.99% |  0.21% |  100% |  0.3% |  99.98% |  0.23% |  99.99% |  0.01% |  99.99%
D-Set#2 |  Normal |  96.35% |  6.54% |  / |  / |  96.36% |  6.82% |  96.27% |  4.17% |  96.35% |  5.26%
Attack |  3.65% |  93.46% |  / |  / |  3.64% |  93.18% |  3.73% |  95.83% |  3.65% |  94.71%

###  V-B Multi-class classification

Fig.16 represents the loss graph for the dataset ¡¡SAT-COM.LEO.NDBPO.#1¿¿ in
multiclass classification. The CNN graph looks very unstable, inconsistent and
doesn’t converge smoothly. In spite of that, RNN and LSTM reach their peak
since both graphs remain steady after few epochs. On the other hand MLP and
GRU seem to perform well and can even continue learning if granted more
training epochs.

Figure 16: Training and validation loss for the multiclass classification on
¡¡SAT-COM.LEO.NDBPO.#1¿¿

Fig.17 shows results for ¡¡SAT-COM.LEO.NDBPO.#2¿¿, we can see that there is no
over-fitting for all models, we also observe that the decrease in the losses
is smoother until they stabilize when the models reach their peaks.

Figure 17: Training and validation loss for the multiclass classification on
¡¡SAT-COM.LEO.NDBPO.#2¿¿

Tab.LABEL:Temps_et_performance4 summarizes the final performance of each model
for the multiclass classification. MLP outperforms other algorithms with a
false positives rate of 0.02% and a false negatives rate of 0.02% as well. RNN
had a false positives rate and false negatives of 0% since all false
classifications were classified as udp flood attack. The CNN confirms that it
does not adapt well to the detection of interruptions in the networks. The
table shows for the second dataset, that MLP performs better, mainly due to
the relatively low false positives rate. The performance shown in Table 4.11
indicates that MLP performs better, mainly due to the relatively low false
positive rate (12,25 %)

TABLE VIII: Performance results for multiclass classification Dataset | SAT-COM.LEO.NDBPO.#1 | SAT-COM.LEO.NDBPO.#2
---|---|---
Algorithm |  MLP |  CNN |  RNN |  GRU |  LSTM |  MLP |  RNN |  GRU |  LSTM
Accuracy |  99.33% |  97.32% |  96.02% |  98.69% |  98.72% |  90.94% |  94.35% |  94.35% |  94.35%
Precision |  99.98% |  99.9% |  100% |  99.84% |  99.59% |  87.75% |  85.94% |  85.94% |  85.94%
Recall |  99.98% |  99.9% |  100% |  100% |  99.99% |  71.39% |  100% |  100% |  100%
Sum of probabilities |  99.7% |  99.07% |  99.94% |  99.82% |  99.65% |  99.66% |  99.48% |  99.55% |  99.12%
Training time per epoch |  404.54s |  1770.6s |  367.32s |  382.69s |  414.62s |  31.77s |  26.89s |  77.18s |  119.93s
Execution time |  104.88s |  157.95s |  130.29s |  129.72s |  138.55s |  414.95s |  238.18s |  276.46s |  372.82s

From Tab.IX, we can deduce that the most efficient models to minimize the
false positives rate are MLP and GRU with the optimizer algorithm ¡¡Adam¿¿.
More precisely MLP is ideal for the detection of ¡¡DDoS_UDP¿¿ attacks despite
the low detection rate which is 83 %, because detecting certain attack packets
is sufficient to detect malicious communications. On the other hand, the GRU
is more efficient at detecting jamming attacks because less false positives
are classified with Jamming_attack category.

TABLE IX: Confusion table - Classification multiclass Algorithm | MLP | RNN
---|---|---
Dataset |  Class |  Normal |  UDP_Flood |  Rain_Thunder |  Jamming |  Normal |  UDP_Flood |  Rain_Thunder |  Jamming
Dataset#1 |  Normal |  98.82% |  0.02% |  0% |  0% |  92.95% |  0% |  0% |  0%
UDP_Flood |  0% |  99.98% |  0% |  0% |  0% |  100% |  0% |  0%
Rain_Thunder |  1.16% |  0% |  100% |  0% |  7.05% |  0% |  100% |  0%
Jamming |  0.0099% |  0% |  0% |  100% |  0% |  0% |  0% |  100%
Dataset#2 |  Normal |  93.7% |  93.7% |  0% |  0% |  89.659% |  0% |  0% |  0%
UDP_Flood |  0.0006% |  83.54% |  0% |  0.0065% |  4.0913% |  100% |  0% |  0%
Rain_Thunder |  0% |  0% |  100% |  0% |  0% |  0% |  100% |  0%
Jamming |  6.294% |  0% |  0% |  99.993% |  6.2494% |  0% |  0% |  100%
Algorithm | GRU | LSTM
Dataset |  Class |  Normal |  UDP_Flood |  Rain_Thunder |  Jamming |  Normal |  UDP_Flood |  Rain_Thunder |  Jamming
Dataset#1 |  Normal |  97.68% |  0% |  0% |  0% |  97.73% |  0.0084% |  0.022% |  0%
UDP_Flood |  0.033% |  100% |  0% |  0% |  0% |  99.99% |  0% |  0%
Rain_Thunder |  2.24% |  0% |  100% |  0% |  2.065% |  99.71% |  99.98% |  0%
Jamming |  0.043% |  0% |  0% |  100% |  0.2% |  0% |  0% |  100%
Dataset#2 |  Normal |  92.58% |  0% |  0% |  1.142% |  89.66% |  0% |  0% |  0%
UDP_Flood |  4.14% |  100% |  0% |  0% |  4.09% |  100% |  0% |  0%
Rain_Thunder |  0% |  0% |  100% |  0% |  0% |  0% |  100% |  0%
Jamming |  3.441% |  0% |  0% |  98.85% |  6.2494% |  0% |  0% |  100%

###  V-C Realtime detection

To perform the real-time detection, we programmed another sniffer that
captures the traffic for a given period of time, and at the end of each period
the sniffer executes a code that processes the captured packets, loads the
models and launches the process of attack detection with the captured traffic.
The discovery procedure is performed without interrupting the continuous
capture of the network.

We program a real-time IDS which operates in two modes.
1) Normal Mode: In this mode, we try to eliminate false positives completely
at the price of losing some precision. i.e our IDS does not try to decide for
each suspect packet if it is malicious or victim, but it only detects
anomalies in a communication flow. 2) Safe mode: In this mode, the IDS detects
as many suspicious packets as possible, and does not give as much importance
to false positives as to false negatives. This model should be implemented
passively, and it should never be a proactive system as it will alert on many
false positives.
For real-time simulation, we take the pcap file generated with Omnet++ and we
reproduce the traffic using Tcpreplay. We also use the extracted information
from the simulation on the SNIR and on the THROUGHPUT of the satellite during
communication, since these two features are available and can be calculated in
all wireless networks. The detection process does not differ too much from
offline detection, a continuous discovery captures packets and processes them
in very short periods of time. To minimize the false positive rate, the
¡¡Normal¿¿ mode detection is as follows:

  * •

UDP Flood: Throws alert if both of the following conditions are true:
\- 20% minimum of captured traffic is classified as a ¡¡flood¿¿ attack.
\- At least 70% of a captured flow is a ¡¡flood¿¿ class attack.

  * •

Natural Phenomenons: Throws alert if both of the following conditions are
true:
\- A maximum of 10% of the captured traffic is classified as a ¡¡Rain and
Thunderstorms¿¿ attack.
\- 20% of a captured stream is affected by ¡¡Natural interference¿¿.

  * •

Jammed traffic: Throws alert if both of the following conditions are true:
\- A maximum of 20% of captured traffic is classified as a ¡¡Network Jamming¿¿
attack.
\- 90% minimum of a captured traffic is affected by ¡¡Network Jamming¿¿.

The IDS in action: In the following we show a comparison of detection in
¡¡Normal¿¿ mode and in ¡¡safe¿¿ mode for the three existing classes. The IDS
is executed with a period of 30 seconds. The results for the first 2 minutes
are as follows:
For benign traffic, the Normal mode do not trigger any alert for all the three
attacks. Furthermore, in Safe mode no alert has been triggered for the
Rain_and_Thunderstorms class, but on the other hand, for Jamming and UDP_Flood
class, several alerts are launched, the normal traffic classified as flood
attack is on average between 2% and 6%, while for normal packets classified as
victims of jamming attacks is between 21% and 28%. The results of detection in
both modes for the malicious flood traffic shows that no packet is
misclassified as a victim of natural interference, while a small flow
composing 0.1% is miss-classified as a jamming victim, all malicious flows of
flood attacks seem to be well classified. Fig.18 illustrates an example of the
flood attacks detection in Normal mode.

Figure 18: Behavior of IDS in ¡¡Normal¿¿ mode against malicious ”UDP Flood”.

For traffic affected by natural phenomena events, results in both modes are
100% accurate, although in Safe mode, 0.46% of a normal flow, that translates
to about 0.04% of the total traffic captured, is falsely classified as
affected. Same goes for the detection of jamming traffic in Normal mode, the
malicious traffic is successfully detected, but on the other hand in Safe
mode, two flows are detected and classified as UDP_Flood and
Rain_and_Thunderstorms with 12.69% and 67.42% of total flow of the two classes
respectively, as presented is Fig.19.

Figure 19: Behavior of IDS in ¡¡Safe¿¿ against ¡¡ Jamming ¿¿ Attacks.

##  VI Conclusion and future work

An interruption detection method is proposed for LEO satellite networks based
on Deep Learning in this paper. We have studied the various vulnerabilities
and risks that threaten the operation and fluidity of Satellite
communications. This work focuses on disruption threats of different types,
such as flood attacks, network jamming attacks and natural phenomena events
(such as rains, thunderstorms and hurricanes). Several deep learning based
interruption detection models are proposed on two of our own generated
datasets, including models based on MLP, CNN, RNN, GRU and LSTM. We have also
provided performance assessment for binary and multi-class classifications.
The best recorded accuracy on the dataset SATCOM.LEO.NDBPO.#1 is 99.987% for
binary traffic detection and 99.33% for multiclass traffic detection with a
minimum false positive rate of 0.0144%. For the dataset SATCOM.LEO.NDBPO.#2,
the best recorded accuracy is 96.12% for the detection in binary
classification and 94.35% for multiclass classification with a minimum false
positives rate of 3.72% using a hybrid model composed of MLP and GRU.
Enhancing this hybrid model with some statistical constraints also improves
detection results and decreases false positives rate to almost 0%, at the cost
of losing some accuracy precision. In conclusion, the results shows that this
approach is effective for both offline and online interruption attacks
detection, based on accuracy rate, detection rate, and prediction speed. This
helps to demonstrate that Deep Learning algorithms could very well improve the
security of satellite networks, especially against DDoS attacks. As future
work, and under better circumstances such as, more computing power and memory
resources, this work can be continued by implementing the DTN
(Delay/Disruption Tolerant Networking) protocol from NaSa [56]which, according
to NaSa, is perhaps the future of satellite communication. This protocol is
currently being tested and improved. Different deep learning methods can can
have better accuracy rate by involving terrestrial satellite terminals in the
detection process, such as FL (Federated learning) [57] to protect users
privacy and enable their contributions to learning, combined with DAEs and
other promising models such as Bi-LSTM to speed up turnaround time.

## References

  * [1] Components of a Satellite, by Space Foundation Editorial Team, https://spacefoundation.org/wp-content/uploads/2019/10/SpaceFoundation_Space101.pdf
  * [2] Yoon, Eun-Jun & Kee-Young, Yoo & Hong, Jeong-Woo & Yoon, Sang-Yoon & Park, Dong-In & Choi, Myung-Jin. (2011). An efficient and secure anonymous authentication scheme for mobile satellite communication systems. EURASIP Journal on Wireless Communications and Networking. 2011. 10.1186/1687-1499-2011-86.
  * [3] Songjie Wei, Shuai Li, Peilong Liu, Meilin Liu, ”BAVP: Blockchain-Based Access Verification Protocol in LEO Constellation Using IBE Keys”, Security and Communication Networks, vol. 2018, Article ID 7202806, 14 pages, 2018. https://doi.org/10.1155/2018/7202806
  * [4] I. Altaf, M. A. Saleem, K. Mahmood, S. Kumari, P. Chaudhary and C. -M. Chen, ”A Lightweight Key Agreement and Authentication Scheme for Satellite-Communication Systems,” in IEEE Access, vol. 8, pp. 46278-46287, 2020, doi: 10.1109/ACCESS.2020.2978314.
  * [5] Qi, Mingping & Chen, Jianhua. (2017). An enhanced authentication with key agreement scheme for satellite communication systems. International Journal of Satellite Communications and Networking. 36. 10.1002/sat.1218.
  * [6] Congyu Huang, Zijian Zhang, Meng Li, Liehuang Zhu, Zhengjia Zhu & Xiaoxian Yang (2020) A mutual authentication and key update protocol in satellite communication network, Automatika, 61:3, 334-344, DOI: 10.1080/00051144.2020.1757966
  * [7] J. Hu, J. Shi, S. Ma and Z. Li, ”Secrecy Analysis for Orthogonal Time Frequency Space Scheme Based Uplink LEO Satellite Communication,” in IEEE Wireless Communications Letters, vol. 10, no. 8, pp. 1623-1627, Aug. 2021, doi: 10.1109/LWC.2021.3072902.
  * [8] Zhenyu Na, Zheng Pan, Xin Liu, Zhian Deng, Zihe Gao, Qing Guo, ”Distributed Routing Strategy Based on Machine Learning for LEO Satellite Network”, Wireless Communications and Mobile Computing, vol. 2018, Article ID 3026405, 10 pages, 2018. https://doi.org/10.1155/2018/3026405
  * [9] J. P. Martín, B. Marengo, J. P. Prina and M. G. Riolfo, ”MESSAGE COLLISION IDENTIFICATION APPROACH USING MACHINE LEARNING,” 2018 ITU Kaleidoscope: Machine Learning for a 5G Future (ITU K), 2018, pp. 1-6, doi: https://doi.org/10.23919/ITU-WT.2018.8597888.
  * [10] P. V. R. Ferreira et al., ”Reinforcement Learning for Satellite Communications: From LEO to Deep Space Operations,” in IEEE Communications Magazine, vol. 57, no. 5, pp. 70-75, May 2019, doi: https://doi.org/10.1109/MCOM.2019.1800796.
  * [11] Wei, J.; Han, J.; Cao, S. Satellite IoT Edge Intelligent Computing: A Research on Architecture. Electronics 2019, 8, 1247. https://doi.org/10.3390/electronics8111247
  * [12] T. Mai, H. Yao, Y. Jing, X. Xu, X. Wang and Z. Ji, ”Self-learning Congestion Control of MPTCP in Satellites Communications,” 2019 15th International Wireless Communications & Mobile Computing Conference (IWCMC), 2019, pp. 775-780,
doi: https://doi.org/10.1109/IWCMC.2019.8766465.

  * [13] Zhu, F, Ba, T, Zhang, Y, Gao, X, Wang, J. Terminal location method with NLOS exclusion based on unsupervised learning in 5G-LEO satellite communication systems. Int J Satell Commun Network. 2020; 38: 425– 436.
https://doi.org/10.1002/sat.1346

  * [14] Fannia Pacheco, Ernesto Exposito, Mathieu Gineste, A framework to classify heterogeneous Internet traffic with Machine Learning and Deep Learning techniques for satellite communications,Volume 173, 2020,107213,ISSN 1389-1286,
https://doi.org/10.1016/j.comnet.2020.107213

  * [15] M. Á. Vázquez et al., ”Machine Learning for Satellite Communications Operations,” in IEEE Communications Magazine, vol. 59, no. 2, pp. 22-27, February 2021, doi: 10.1109/MCOM.001.2000367.
  * [16] D. Zhou, M. Sheng, Y. Wang, J. Li and Z. Han, ¡¡Machine Learning-Based Resource Allocation in Satellite Networks Supporting Internet of Remote Things¿¿, in IEEE Transactions on Wireless Communications, vol. 20, no. 10, pp. 6606-6621, Oct. 2021, doi: 10.1109/TWC.2021.3075289.
  * [17] Diro, Abebe, Chilamkurti et Naveen. “Distributed attack detection scheme using deep learning approach for Internet of Things,” Future Generation Computer Systems, Vol. 82, 2018, pp. 761-768.
  * [18] Ahanger, T.A. “An effective approach of detecting DDoS using Artificial Neural Networks,” 2017 International Conference on Wireless Communications, Signal Processing and Networking (WiSPNET), 2017, pp. 707-711.
  * [19] Muna, A.H.; Moustafa, N.; Sitnikova, E. “Identification of malicious activities in industrial internet of things based on deep learning models,” Journal of Information Security and Applications, Vol. 41, 2018, pp. 1-11,
  * [20] Ferrag, M.A.; Shu, L.;Djallel, H.; Choo, K.-K.R. “Deep Learning-Based Intrusion Detection for Distributed Denial of Service Attack in Agriculture 4.0,” Electronics 10, no. 11, 1257, pp. 1-26.
  * [21] Jiyeon Kim, Jiwon Kim, Hyunjung Kim, Minsun Shim et Eunjung Choi. “CNN-Based Network Intrusion Detection against Denial-of-Service Attacks,” Electronics 9, no. 6: 916, 2020, PP. 1-21.
  * [22] Popoola, S.I.; Adebisi, B.; Hammoudeh, M.; Gui, G.; Gacanin, H. “Hybrid Deep Learning for Botnet Attack Detection in the Internet of Things Networks.” IEEE Internet Things J. 2021, 8, pp. 4944–4956.
  * [23] Lloyd Wood,M 2001, ¡¡Internetworking with satellite constellations¿¿,PhD thesis,University of Surrey, Guildford,UK.https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.101.6697&rep=rep1&type=pdf
  * [24] ESA - Types of orbits - European Space Agency, https://www.esa.int/Enabling_Support/Space_Transportation/Types_of_orbits.
  * [25] Mission Design Division Staff, ¡¡ Small spacecraft technology state of the art ¿¿ . Center, Mountain View, CA, USA, Tech. Rep. NASA/TP-2015-216648/REV1, Dec. 2015 https://www.nasa.gov/sites/default/files/atoms/files/small_spacecraft_technology_state_of_the_art_2015_tagged.pdf
  * [26] Conférences mondiales des radiocommunications (CMR), https://www.itu.int/fr/ITU-R/conferences/wrc/Pages/default.aspx
  * [27] Gérard Maral et Michel Bousquet (2009), ¡¡ Satellites communications systems¿¿,fifth edition,John Wiley & Sons Ltd, The Atrium, Southern Gate, Chichester, West Sussex,UK (pp 293-360).
  * [28] Zhili Sun (2005), Satellite Networking Principles and Protocols, John Wiley & Sons Ltd, The Atrium, Southern Gate, Chichester, West Sussex PO19 8SQ, England. https://www.wiley.com/en-us/Satellite+Networking
  * [29] Satellites, By Chris Woodford, Dec. 2020. https://www.explainthatstuff.com/satellites.html
  * [30] The Past, Present, and Future of Satellite Internet, By John Dilley — April 26, 2019, https://www.satelliteinternet.com/resources/history-and-future-of-satellite-internet/
  * [31] Fortune : Crowded satellite Internet market gets a new player: Lightspeed, BY AARON PRESSMAN, February 9, 2021, https://fortune.com/2021/02/09/telesat-leo-internet-space-lightspeed-starlink-kuiper/
  * [32] MODERN TIMES INVESTORS : ¡¡LEO Satellites Constellations, The New Space-Race For Global Internet Access¿¿, April 11, 2019 https://www.moderntimesinvestors.com/leo-satellites/
  * [33] Z. Qu, G. Zhang, H. Cao and J. Xie, ”LEO Satellite Constellation for Internet of Things,” IEEE Access, vol. 5, 2017, pp. 18391-18401.
  * [34] Xingqin Lin, Stefan Cioni, Gilles Charbit, Nicolas Chuberre, Sven Hellsten, Jean-Francois Boutillon,¡¡ On the Path to 6G: Embracing the Next Wave of Low Earth Orbit Satellite Access¿¿, arXiv preprint arXiv:2104.10533, 2021.
  * [35] François Chollet. Deep Learning with Python, ©2018 by Manning Publications Co. François Chollet-Deep Learning with Python-Manning (2018).pdf (fouladi.ir)
  * [36] Online course, https://classroom.udacity.com/courses/ud188
  * [37] Yeh, Wei-Chang & Lin, Yi-Ping & Liang, Yun-Chia & Lai, Chyh-Ming. ¡¡Convolution Neural Network Hyperparameter Optimization Using Simplified Swarm Optimization¿¿, 2021. primaryClass=cs.NE,https://arxiv.org/pdf/2103.03995.pdf
  * [38] Sherstinsky, Alex. ¡¡Fundamentals of Recurrent Neural Network (RNN) and Long Short-Term Memory (LSTM) network¿¿, Physica D: Nonlinear Phenomena, Vol; 404, 2020, 132306.
  * [39] Zargar, Sakib. (2021). Introduction to Sequence Learning Models: RNN, LSTM, GRU. 10.13140/RG.2.2.36370.99522.
  * [40] ¡¡Illustrated Guide to LSTM’s and GRU’s: A step by step explanation¿¿ https://towardsdatascience.com/illustrated-guide-to-lstms-and-gru-s-a-step-by-step-explanation-44e9eb85bf21
  * [41] CCID. ¡¡research on the development of China’s satellite Internet industry¿¿. Department of Computing and Telematics Engineering, Universidad de Extremadura, 06800 Mérida, Spain. https://link.springer.com/chapter/10.1007/978-981-33-4922-3_14 (Febraury 2020).
  * [42] Cao H., Wu L., Chen Y., Su Y., Lei Z., Zhao C. (2020) Analysis on the Security of Satellite Internet. In: Lu W. et al. (eds) Cyber Security. CNCERT 2020. Communications in Computer and Information Science, vol 1299.
  * [43] K. Giotis, C. Argyropoulos, G. Androulidakis, D. Kalogeras, V. Maglaris,¡¡ Combining OpenFlow and sFlow for an effective and scalable anomaly detection and mitigation mechanism on SDN environments¿¿, Computer Networks, Vol. 62, 2014, pp. 122-136,
  * [44] Shannon, C.E. A Mathematical Theory of Communication, Bell Syst. Tech. J. 1948, 27, 379–423.
  * [45] Han, W.; Xue, J.; Yan, H. “Detecting anomalous traffic in the controlled network based on cross entropy and support vector machine, “ IET Inf. Secur. 2019, 13, pp. 109–116.
  * [46] Galeano-Brajones, Jesús, Javier Carmona-Murillo, Juan F. Valenzuela-Valdés, and Francisco Luna-Valero. “Detection and Mitigation of DoS and DDoS Attacks in IoT-Based Stateful SDN: An Experimental Approach“, Sensors 20, no. 3: 81, 2020.
  * [47] Onen M, Molva R. “Denial of service prevention in satellite networks,“ IEEE International Conference on Communications (IEEE Cat. No. 04CH37577), vol. 7 IEEE; 2004. pp. 4387–4391.
  * [48] Fahd A Alhaidari & Alia Mohammed Alrehan ,¡¡A simulation work for generating a novel dataset to detect distributed denial of service attacks on Vehicular Ad hoc NETwork systems¿¿ March 4, 2021, College of Computer Science and Information Technology, Imam Abdulrahman Bin Faisal University, Dammam, Saudi Arabia https://journals.sagepub.com/doi/10.1177/15501477211000287
  * [49] Ahsan, Md M., M. A.P. Mahmud, Pritom K. Saha, Kishor D. Gupta, and Zahed Siddique. 2021. ”Effect of Data Scaling Methods on Machine Learning Algorithms and Model Performance” Technologies 9, no. 3: 52. https://doi.org/10.3390/technologies9030052
  * [50] https://omnet-manual.com/omnet-installation/
  * [51] https://inet.omnetpp.org/Installation.html
  * [52] https://www.anaconda.com/products/individual
  * [53] https://pytorch.org/get-started/locally/
  * [54] https://jupyter.org/install
  * [55] https://code.visualstudio.com/download
  * [56] Heather Monaghan, ¡¡Delay/Disruption Tolerant Networking¿¿, 2020, https://www.nasa.gov/directorates/heo/scan/engineering/technology/disruption_tolerant_networking.
  * [57] Priyanka Mary Mammen. ¡¡Federated Learning: Opportunities and Challenges¿¿, In Proceedings of ACM Conference, (Conference’17). ACM, New York, NY, USA, 2021. https://arxiv.org/pdf/2101.05428.pdf.
  * [58] OS3 framework
https://omnetpp.org/download-items/OS3.html