arXiv subjects

Eran Aizikovich

Publications and source records attributed to Eran Aizikovich.

3 recordsLinked to original sources

arXiv2026

Rethinking Satellite Cybersecurity: A System-Level Taxonomy and Longitudinal Analysis

Satellite systems are increasingly targeted by cyber and electronic-warfare adversaries as their roles in communication, navigation, Earth observation, and defense expand. Existing surveys do not comprehensively characterize adversarial behavior across the full attack lifecycle and often omit emerging attack surfaces such as adversarial machine learning (AML). This paper presents a satellite-specific taxonomy of tactics, techniques, and procedures (TTPs), developed primarily for low Earth orbit systems and informed by evidence from LEO, MEO, and GEO missions. We analyze the space, ground, communication, and user segments to identify architectural exposures and operational attack surfaces, and compile a dataset of more than 200 publicly reported satellite incidents from 1962 to 2026, including over 80 incidents not covered in prior work. Longitudinal analysis reveals shifts toward ground-segment compromise, GNSS interference, communication disruption, proximity-based counterspace activity, and deception-oriented attacks. Building on these findings, we propose a MITRE ATT&CK-inspired satellite attack lifecycle taxonomy that integrates subsystem exploitation, radio-frequency interference, on-orbit operations, AML, and deception techniques. We demonstrate its practical utility through case studies of the 2022 Viasat KA-SAT cyberattack and a simulation-based ICARUS constellation-scale denial-of-service scenario. The framework combines longitudinal evidence, real-world incidents, and emerging attack modalities to support threat modeling, defensive planning, and the design of detection and mitigation strategies.

cs.CR↗

arXiv2026

LumiMAS: A Comprehensive Framework for Real-Time Monitoring and Enhanced Observability in Multi-Agent Systems

The incorporation of LLMs in multi-agent systems (MASs) has the potential to significantly improve our ability to autonomously solve complex problems. However, such systems introduce unique challenges in monitoring, interpreting, and detecting system failures. Most existing MAS observability frameworks focus on analyzing each individual agent separately, overlooking failures associated with the entire MAS. To bridge this gap, we propose LumiMAS, a novel MAS observability framework that incorporates advanced analytics and monitoring techniques. The proposed framework consists of three key components: a monitoring and logging layer, anomaly detection layer, and anomaly explanation layer. LumiMAS's first layer monitors MAS executions, creating detailed logs of the agents' activity. These logs serve as input to the anomaly detection layer, which detects anomalies across the MAS workflow in real time. Then, the anomaly explanation layer performs classification and root cause analysis (RCA) of the detected anomalies. LumiMAS was evaluated on seven different MAS applications, implemented using two popular MAS platforms, and a diverse set of possible failures. The applications include two novel failure-tailored applications that illustrate the effects of a hallucination or bias on the MAS. The evaluation results demonstrate LumiMAS's effectiveness in failure detection, classification, and RCA.

cs.CR↗

arXiv2025

Rogue Cell: Adversarial Attack and Defense in Untrusted O-RAN Setup Exploiting the Traffic Steering xApp

The Open Radio Access Network (O-RAN) architecture is revolutionizing cellular networks with its open, multi-vendor design and AI-driven management, aiming to enhance flexibility and reduce costs. Although it has many advantages, O-RAN is not threat-free. While previous studies have mainly examined vulnerabilities arising from O-RAN's intelligent components, this paper is the first to focus on the security challenges and vulnerabilities introduced by transitioning from single-operator to multi-operator RAN architectures. This shift increases the risk of untrusted third-party operators managing different parts of the network. To explore these vulnerabilities and their potential mitigation, we developed an open-access testbed environment that integrates a wireless network simulator with the official O-RAN Software Community (OSC) RAN intelligent component (RIC) cluster. This environment enables realistic, live data collection and serves as a platform for demonstrating APATE (adversarial perturbation against traffic efficiency), an evasion attack in which a malicious cell manipulates its reported key performance indicators (KPIs) and deceives the O-RAN traffic steering to gain unfair allocations of user equipment (UE). To ensure that O-RAN's legitimate activity continues, we introduce MARRS (monitoring adversarial RAN reports), a detection framework based on a long-short term memory (LSTM) autoencoder (AE) that learns contextual features across the network to monitor malicious telemetry (also demonstrated in our testbed). Our evaluation showed that by executing APATE, an attacker can obtain a 248.5% greater UE allocation than it was supposed to in a benign scenario. In addition, the MARRS detection method was also shown to successfully classify malicious cell activity, achieving accuracy of 99.2% and an F1 score of 0.978.

cs.CR↗