This project presents an STM32-based embedded system developed to detect cyber-manipulation attacks targeting satellite flight software. False Data Injection (FDI) and Replay attacks were evaluated using battery telemetry derived from NASA's Small Satellite Power Simulation dataset.
The system processes telemetry directly on an STM32F407 microcontroller and identifies manipulated or outdated measurements during runtime.
- Develop a lightweight detection method suitable for embedded flight computers.
- Detect False Data Injection and Replay attacks in satellite telemetry.
- Evaluate the algorithm using NASA satellite power-system telemetry.
- Perform detection and metric calculation directly on embedded hardware.
- Analyze detection accuracy, sensitivity and false-alarm performance.
flowchart LR
A[NASA Telemetry Dataset] --> B[MATLAB Preprocessing]
B --> C[UART Data Transmission]
C --> D[STM32F407]
D --> E[Attack Detection]
E --> F[Performance Metrics]
Positive voltage offsets were injected into nominal battery telemetry to simulate manipulated sensor measurements.
The following voltage deviations were evaluated:
- +0.45 V
- +0.35 V
- +0.25 V
- +0.15 V
- +0.10 V
A previously observed telemetry block was retransmitted during a later section of the data stream. A sequence-aware freshness mechanism was implemented to identify outdated packets.
- Dataset: NASA Small Satellite Power Simulation
- Complete dataset: 106,561 telemetry samples
- Main discharge dataset: PK31-D and PK35-D
- Discharge samples: 53,150
- Embedded platform: STM32F407G-DISC1
- Data preprocessing: MATLAB
- Embedded development: C and STM32CubeIDE
- Communication interface: UART
A total of 531 manipulated samples were introduced into the 53,150-sample discharge telemetry stream.
| Metric | Result |
|---|---|
| Total Samples | 53,150 |
| Injected FDI Samples | 531 |
| True Positives | 526 |
| True Negatives | 52,618 |
| False Positives | 1 |
| False Negatives | 5 |
| Accuracy | 99.99% |
| Precision | 99.81% |
| Recall | 99.06% |
| F1 Score | 99.43% |
Figure 1. Full-dataset FDI evaluation results calculated on the STM32F407 and displayed in the STM32CubeIDE Expressions view.
A separate sensitivity experiment examined the effect of different voltage offsets on detection performance.
| Voltage Offset | Detected Attacks | Recall | F1 Score |
|---|---|---|---|
| +0.45 V | 10/10 | 100% | 1.00 |
| +0.35 V | 10/10 | 100% | 1.00 |
| +0.25 V | 1/10 | 10% | 0.18 |
| +0.15 V | 0/10 | 0% | 0.00 |
| +0.10 V | 0/10 | 0% | 0.00 |
The results show that larger manipulations were detected reliably, while lower-amplitude deviations remained below the selected detection threshold. This demonstrates the trade-off between attack sensitivity and false-alarm prevention.
The detection algorithm was also evaluated using the independent PK35-D discharge dataset with a +0.35 V attack scenario.
| Metric | Result |
|---|---|
| Total Samples | 4,515 |
| Injected Attacks | 45 |
| True Positives | 45 |
| False Positives | 0 |
| False Negatives | 0 |
| Accuracy | 1.00 |
| Precision | 1.00 |
| Recall | 1.00 |
| F1 Score | 1.00 |
The Replay scenario used previously transmitted telemetry with outdated sequence values.
| Metric | Result |
|---|---|
| Total Samples | 53,150 |
| Injected Replay Samples | 531 |
| True Positives | 531 |
| True Negatives | 52,619 |
| False Positives | 0 |
| False Negatives | 0 |
| Accuracy | 1.00 |
| Precision | 1.00 |
| Recall | 1.00 |
| F1 Score | 1.00 |
All reported results were obtained under controlled experimental conditions and should not be interpreted as guaranteed performance against every real-world attack scenario.
- Designed the embedded attack-detection architecture.
- Preprocessed and converted NASA telemetry using MATLAB.
- Created False Data Injection and Replay attack scenarios.
- Implemented the detection mechanism on the STM32F407.
- Developed sequence-aware Replay protection.
- Conducted embedded validation and sensitivity tests.
- Calculated accuracy, precision, recall and F1-score metrics.
- Documented the methodology and experimental results.
- Microcontroller: STM32F407G-DISC1
- Programming: Embedded C
- Data Processing: MATLAB
- Communication: UART
- Development Tools: STM32CubeIDE, ST-LINK
- Research Areas: CubeSat Flight Software, Embedded Systems, Cybersecurity and Anomaly Detection
This study was completed as an undergraduate graduation project in the Department of Aerospace Engineering at Necmettin Erbakan University during the 2025–2026 academic year.
The source code, processed datasets and detailed implementation files are not publicly available due to academic and intellectual-property considerations. This repository provides a technical overview of the methodology, experimental implementation and validated results.