Simulating Satellite Cyberattacks Using Physics-Constrained GANs: How We Taught a Generator to Think Like an Engineer

Here is the core problem with building anomaly detection systems for satellite telemetry: you cannot get labeled attack data. Real satellite cyberattack events are rare, not publicly disclosed, and the affected telemetry logs are classified. You cannot run controlled attack experiments on operational spacecraft because the cost and risk are prohibitive. And you cannot just make up attack data arbitrarily because anomaly detectors trained on unrealistic attacks will fail to detect real ones.

This project is our answer to that problem. We trained a Conditional 1D Convolutional GAN on normal telemetry from the NASA SMAP dataset, added physics-aware perturbation layers to transform generated normal telemetry into structured attack scenarios, and used the resulting synthetic attack data to train and evaluate an unsupervised autoencoder-based anomaly detector. The detector achieved 96% accuracy, 96% precision, and 98% recall on the synthetic attack data, dramatically outperforming baseline methods like Isolation Forest and One-Class SVM, which effectively detected zero attacks.

The phrase “physics-aware” is doing real work in that description and it is worth unpacking carefully. The difference between useful synthetic attack data and useless synthetic attack data comes down almost entirely to whether the generated attacks respect the physical constraints of the system they are supposed to represent.

Why Physical Plausibility Is the Whole Problem

Imagine you are trying to generate a spoofed telemetry reading for a spacecraft power bus voltage sensor. The sensor normally reads around 28 volts. You could generate an attack by setting the reading to 500 volts. An anomaly detector would catch this instantly, but no real attacker would bother with this kind of obvious manipulation. It defeats the purpose of the attack.

A sophisticated cyber-physical attack on satellite telemetry looks different. It involves small, gradual manipulations that stay within the sensor’s normal operational range. The voltage reading drifts from 28.1 to 28.3 to 28.6 over thousands of time steps, each increment small enough to look like sensor noise or normal variation, the cumulative effect enough to mask a real power system degradation. Or it involves coordinated manipulation of multiple sensors simultaneously in a way that is physically consistent, voltage going up slightly while current goes down slightly, maintaining the appearance of normal power balance while actually hiding a failure.

For synthetic attack data to be useful for training anomaly detectors, it needs to be adversarially realistic in this sense. The attacks have to be plausible enough that a detector trained on them will also catch real attacks, which are also designed to be plausible.

This is where physics constraints come in. By encoding the physical laws governing satellite subsystems into the GAN’s loss function, we can generate telemetry that looks normal at first glance but has been deliberately manipulated in ways that violate the subtle constraints of the real system.

The Conditional GAN Architecture

The generator in our framework takes two inputs: a random noise vector z sampled from a standard normal distribution, and a condition vector c that represents the satellite’s operational state, its power mode, attitude mode, and current mission phase.

The condition vector is what makes this a Conditional GAN rather than a vanilla GAN. By conditioning on the operational state, the generator learns to produce telemetry that is appropriate for specific operating conditions rather than just averaged normal behavior. This matters because what counts as anomalous is context-dependent. A large power draw is anomalous during low-power safe mode but completely expected during high-data-rate downlink operations.

The generator architecture uses 1D convolutional layers, which are well-suited to temporal sequence data. The discriminator mirrors this structure, taking a telemetry window and the condition vector as input and producing a score for how likely the window is to be real normal telemetry given the current operational state.

The adversarial training objective follows the standard GAN minimax formulation with the conditional extension:

min_G max_D V(D,G) = E[log D(x|c)] + E[log(1 — D(G(z,c)|c))]

The discriminator learns to distinguish real from generated telemetry given the operational context, while the generator learns to produce telemetry indistinguishable from real data for that context.

The Physics Constraint Loss

Standard GAN training minimizes the adversarial loss. We add a physics constraint loss term L_phy to the generator’s objective, weighted by a hyperparameter lambda:

L_G = L_adv + lambda * L_phy

The physics constraint loss enforces five invariants drawn from satellite subsystem engineering.

Energy conservation requires that total power generation minus total power consumption equals stored energy change. In practice this means the relationships between solar panel output, battery charge/discharge rate, and bus load must remain physically consistent across the time series.

Thermodynamic equilibrium constrains heat flow. Temperature sensors on different subsystems have physical relationships based on thermal conductivity, heat dissipation from electronics, and orbital geometry. A telemetry window where a processor heat sink is cold while the processor is under full load violates thermodynamics.

Power balance preservation maintains the physical relationship between voltage and current measurements. If a voltage sensor and a current sensor are monitoring the same bus, their product must correspond to the power reading on that bus within the tolerances of the sensor accuracy.

Rate-of-change limits constrain how fast physical quantities can change. Spacecraft systems have inertia, both mechanical and thermal. Temperature cannot jump 50 degrees in one second. Attitude cannot rotate 90 degrees in one time step. The physics constraint loss penalizes generated telemetry where these rates of change exceed physically plausible bounds.

Cross-sensor correlation preserves the expected dependencies between physically coupled measurements. Battery voltage and state of charge are correlated. Thruster temperature and firing frequency are correlated. The loss term rewards generated telemetry that maintains these correlations within their expected ranges.

With this loss, the generator produces telemetry that is both indistinguishable from real data by the discriminator and physically valid by the constraint checker. The generated normal telemetry is then the starting point for attack generation.

From Generated Normal to Structured Attacks

The attack generation pipeline takes physically plausible normal telemetry and applies controlled perturbations to create six distinct attack types. All perturbations are bounded within the range of plus or minus 3 standard deviations from the sensor’s normal operating distribution, which keeps them within the sensor’s plausible range while introducing systematic anomalies.

Stealth drift attacks apply a very slow, monotonic drift to one or more sensor readings over hundreds or thousands of time steps. Each individual step change is smaller than the sensor’s noise floor, making the attack invisible to threshold-based detectors that look at instantaneous values. The cumulative effect is a sensor that has drifted far from its calibrated value, potentially masking a real physical fault.

Coordinated sensor manipulation exploits the cross-sensor correlations preserved by the physics constraint. Instead of manipulating one sensor in isolation, which breaks the correlation structure and is relatively easy to detect, this attack simultaneously adjusts multiple related sensors in a way that maintains their expected relationships. Voltage and current readings shift together. Temperature and power readings shift together. The manipulation is physically consistent in its cross-sensor structure but inconsistent with the overall system’s true state.

False data injection replaces genuine readings with fabricated values at a rate that exceeds the physical rate-of-change limits for the relevant quantity. Unlike the other attack types which try to stay within plausible bounds, this attack is testing whether the detector can catch violations of the rate-of-change constraints.

Bias injection adds a constant offset to one or more sensor readings. Unlike drift, which is time-varying, bias is static. A temperature sensor that consistently reads 5 degrees high sounds like a calibration error, not an attack, which is part of what makes it stealthy.

Stochastic perturbations inject structured noise that has a different statistical character than the sensor’s natural noise. Real sensor noise is typically Gaussian or follows sensor-specific distributions. Stochastic attack noise is correlated across time or channels in ways that real noise is not.

Multi-sensor composite attacks combine multiple attack types simultaneously. This is the most realistic category because real sophisticated attacks on cyber-physical systems rarely use a single technique. A real attacker might use bias injection on some sensors while applying stealth drift to others, making the overall pattern harder to characterize.

The Detection Framework

The anomaly detector is an unsupervised autoencoder trained exclusively on normal telemetry. This reflects the operational reality: you have normal data, you do not have labeled attack data.

Each telemetry window has shape 50 by 25, meaning 50 time steps across 25 telemetry channels, which is flattened into a 1,250-dimensional input vector. The encoder compresses this through layers of sizes 128 and 64 down to a bottleneck of 32 dimensions. The decoder reconstructs from 32 back through 64 and 128 to the full 1,250-dimensional output.

The key insight is that an autoencoder trained only on normal data learns to reconstruct normal patterns efficiently. When presented with attack data that violates the patterns it learned, it cannot reconstruct it accurately. The mean squared reconstruction error is the anomaly score.

Normal samples cluster near the reconstruction manifold with low reconstruction errors. Attack samples, which violate the learned normal patterns, produce high reconstruction errors. The optimal classification threshold is selected from the 50th to 95th percentile range of the reconstruction error distribution on clean validation data, using F1-score maximization to find the operating point that best balances precision and recall.

The threshold optimization step is worth emphasizing. Setting the threshold at the 95th percentile of normal errors means approximately 5% of normal samples will be flagged. Setting it lower catches more attacks but flags more normal samples. The right threshold depends on operational context, specifically on what the consequences of false positives and false negatives are for mission operations. For a situation where missing a real attack could lead to spacecraft loss, you set the threshold lower and accept more false positives.

Results and What They Mean

The baseline comparison is stark. Isolation Forest achieved 31% accuracy and zero detection of attack samples. One-Class SVM achieved the same. Both models correctly classified normal telemetry but produced roughly 6,000 false negatives, meaning they classified every single attack sample as normal.

This failure mode is instructive. Both Isolation Forest and One-Class SVM are solid anomaly detection algorithms in many domains. They fail here because they operate on each sample independently, without considering the temporal structure or cross-channel correlations that define satellite telemetry. A stealthy drift attack looks normal at any single time step. It is only abnormal when you look at the trajectory over time.

The autoencoder, trained to reconstruct entire temporal windows rather than classify individual snapshots, captures these temporal patterns. Its reconstruction error distribution on normal data clusters near zero, while the attack data produces a clearly separated higher-error distribution. The Z-score visualization of reconstruction errors shows the two distributions with almost no overlap, which is why the detector achieves 98% recall.

The optimal threshold of approximately 4.07 was selected by maximizing F1-score on the validation set. At this threshold, the autoencoder achieved 96% accuracy, 96% precision, and 98% recall. The high recall is what matters most in practice: missing a real attack in satellite telemetry can mean the difference between catching a developing fault before it cascades and missing it until the spacecraft is in an unrecoverable state.

What Makes This Pipeline Reproducible

One of the explicit goals of this project was reproducibility. The pipeline is designed so that anyone with access to the NASA SMAP dataset can run the full procedure from raw telemetry preprocessing through GAN training, attack generation, and detector evaluation.

The SMAP dataset is publicly available from NASA and has been widely used as a benchmark for spacecraft anomaly detection research. Our preprocessing pipeline applies sliding windows of size 50 across the 25-channel telemetry, applies normalization using standard scaling, and produces the Dnormal dataset used for both GAN training and autoencoder training.

The physics constraint parameters, the bounds on rate-of-change, the expected cross-sensor correlations, and the subsystem coupling coefficients, are drawn from publicly available documentation on satellite subsystem engineering rather than from proprietary spacecraft data. This means the constraints reflect real physical principles without requiring access to classified mission data.

Limitations and Future Directions

The most significant limitation is the circularity of synthetic evaluation. When you train both the attack generator and the anomaly detector on the same underlying normal data distribution, the detector has an inherent advantage over real attacks that might come from a different distribution. We tried to mitigate this by using different subsets for GAN training and detector training, but the fundamental concern remains.

The ideal validation would use real telemetry anomalies from actual spacecraft incidents. A handful of public datasets exist with partial anomaly labels, including some SMAP anomaly data with point-adjusted labels, and extending the evaluation to these would strengthen the generalization case.

The GAN training process is also unstable in ways that are well-known in the GAN literature. Mode collapse, where the generator produces only a small subset of the possible normal telemetry patterns, and training divergence are both real risks. We used standard stabilization techniques including gradient penalty and careful learning rate scheduling, but training runs required monitoring and occasional restarts.

Future directions include using real-world incident data for validation where available, extending the physics constraints to cover additional satellite subsystems like attitude control and propulsion, and investigating whether the physics-constrained generator can be used to augment training data for supervised detection models in addition to evaluating unsupervised ones.

The Broader Lesson

The core insight here is not specific to satellite telemetry. Any cyber-physical system where attack data is unavailable faces the same fundamental challenge. Industrial control systems, power grids, water treatment plants: all of them have real physical constraints that govern what legitimate and anomalous telemetry looks like. All of them have the same absence of labeled attack data.

Building generative attack frameworks that respect those physical constraints, rather than generating arbitrary noise, is the key step that makes synthetic evaluation scientifically meaningful. Without physics constraints, you can train a detector that catches your synthetic attacks perfectly and completely fails on real attacks because the real attacks look nothing like your synthetic ones.

The physics-constrained GAN framework described here provides a template for doing this correctly. The specific physics, energy conservation, thermodynamics, and power balance for satellite subsystems, will differ from domain to domain. But the approach, encode the physics into the generator’s loss function and use the output to evaluate unsupervised detectors, is general and transferable.

Technologies: Python, PyTorch, Conditional GAN, 1D-CNN, Autoencoder, NASA SMAP Dataset

Published: Amrita Vishwa Vidyapeetham, Center for Cyber Security Systems and Networks