An Integrated Hybrid Model for Cyber Threat Intrusion Detection for Satellite Ground Station Networks Using Transformers and Random Forest

Satellite Ground Station Networks (SGSN) facilitate communication services for critical infrastructure in space systems. These networks can seamlessly integrate with diverse space and ground systems. However, the dynamic rise of cyber threats and attacks in the NewSpace era has underscored the critical need for robust intrusion detection systems (IDS) in satellite ground station networked environments which face unique security and privacy challenges. Traditional learning techniques such as statistics and knowledge-based techniques have limitations: they cannot be easily modified, they cannot identify new malicious attacks, low accuracy, and high false alarms. Additionally, the scarcity of effective security data sets and the constantly evolving nature of intrusion attacks hinder the development of comprehensive and adaptive IDS solutions. These issues necessitate improved accuracy and effectiveness of IDS to detect new and emerging threats, vital in preventing data breaches or potential shutdowns of satellite systems. An integrated hybrid IDS model leveraging RF and Transformer is proposed to optimize the detection performance of malicious activities in network traffic. The Proposed model exploits the self-attention mechanism of the Transformer model to select important features from the augmented dataset and is then trained using the Random Forest model to enhance the early detection accuracy of various intrusion attacks, including Distributed Denial of Service (DDoS) attacks and Benign (Normal) data. An empirical experiment is conducted using publicly available datasets such as Satellite Terrestrial Integrated Network (STIN), and CSE-CIC-IDS2018, and the integrated hybrid model attains 99.90% overall weighted accuracy better than individual models of Transformer and Random Forest (RF). The results validate that the proposed method effectively detects various types of DDoS attacks and Benign (Normal) traffic and thus can be integrated into SGSNs.