LIFESAT: A Forensic-Ready Digital Twin Framework for Full-Lifecycle Cybersecurity in LEO CubeSats
- Paper ID
114403
- author
- company
Firat University
- country
Türkiye
- year
2026
- abstract
Spacecraft operate in environments with highly restricted physical access, where undetected cyber vulnerabilities can cause severe physical consequences. Existing cybersecurity approaches have traditionally relied on ``security by obscurity.'' However, documented cyberattacks targeting satellite infrastructures, including the disruptive 2022 Viasat attack, highlight the urgent need to modernize legacy space systems, which largely lack security-centric architectures. While digital twin (DT) technology for Cyber-Physical Systems (CPS) enables continuous and autonomous threat modeling, this capability has not yet evolved into a holistic, full-lifecycle cybersecurity framework for space environments. This study proposes an end-to-end DT-based cybersecurity and digital forensics validation framework for Low Earth Orbit (LEO) CubeSats. The proposed architecture divides the system lifecycle into four distinct phases: Pre-launch: A high-fidelity DT of the satellite’s onboard software and communication interfaces is developed. Network interfaces and potential attack vectors are simulated using the OMNeT++ framework. Controlled experiments in the DT environment update the cybersecurity risk assessment framework. These experiments include command authorization violations and Man-in-the-Middle (MITM) attacks—for which the detection capability of digital twins has been proven in the literature. Identifying and mitigating vulnerabilities at this stage supports a secure-by-design architecture. Orbit insertion: The satellite is deployed, and initial telemetry data synchronizes the DT environment. In-orbit operations: Security patches and configuration updates are first tested within the DT. Upon successful validation, verified updates are transmitted to the physical satellite via bidirectional data flow, dynamically managing security risks while maintaining system integrity. Digital forensics: Because direct physical access is impossible, the DT functions as a virtual ``black box.'' Replaying the latest telemetry and system state data within the DT enables analysts to determine whether anomalies stem from environmental hardware failures or potential cyberattacks. Consequently, this study adopts the Digital Twin as a Service (DTaaS) paradigm, deploying the CubeSat’s DT on demand within a cloud-based cyber range. This model aims to establish a dynamic structure continuously updated via the digital twin, functioning as a forensics-ready analysis environment for risk assessment. Ultimately, this approach enables comprehensive cybersecurity risk evaluations without requiring real satellite communication and without jeopardizing the operational system.