HYDRA: Quantifying Botnet Resource Thresholds for Efficient Link-Flooding Attacks on LEO Satellite Networks
HYDRA models link-flooding attacks on LEO satellite constellations as botnet minimization, matching prior disruption with 34% fewer bots and 23% less traffic.
HYDRA formulates link-flooding attack variants against LEO constellations such as Starlink and Kuiper as botnet minimization problems, quantifying the smallest bot subset and traffic allocation needed to disrupt communications between targeted geographic areas. Under matched stealth constraints it matches the ICARUS attack's disruption using 34% fewer bots and 23% less aggregate traffic, sustaining over 97% attack success as topology evolves. The framework also evaluates five mitigations, including routing diversification, ingress policing, distance-based constraints, source throttling, and botnet attrition.
- Quantifies minimal botnet size and traffic to cut targeted LEO communications
- 34% fewer bots and 23% less traffic than ICARUS at equal disruption
- Sustains over 97% attack success across time-varying constellation topology
- Evaluates five mitigations including routing diversification and botnet attrition
Full article198 words · extracted from arxiv.org · click to collapse
Low Earth orbit (LEO) satellite constellations, such as Starlink and Kuiper, are rapidly emerging as a critical backbone for low-latency global connectivity. As these systems expand, they become more attractive attack targets, necessitating increased resilience and security. Threat actors seek to exploit constellation-specific properties such as predictable motion, time-varying topologies, and reliance on inter-satellite and ground-satellite links. Recent work has shown that link-flooding attacks (LFAs) can exploit these properties to congest strategic network bottlenecks. Yet, prior work does not quantify the resilience of LEO networks to targeted disruption. We present HYDRA, a modeling and optimization framework that formulates LFA variants as botnet minimization problems. HYDRA quantifies network resilience to LFAs by measuring the smallest active subset of bots and the corresponding traffic allocation required to disrupt communication between targeted geographic areas. Under matched stealth constraints, HYDRA achieves the same targeted disruption as ICARUS while using 34% fewer bots and 23% less aggregate attack traffic. HYDRA achieves over 97% success in sustaining continuous attacks as the network topology evolves. Finally, HYDRA evaluates five mitigation strategies, showing how routing diversification, ingress policing, distance-based traffic constraints, source throttling, and botnet attrition reduce attack success and improve network resilience to targeted disruption.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.15693