PhoenixSystems

A neural-algebraic detection system that protects Europe’s space-based strategic enablers and the critical services that depend on them.

Energy grids, telecom networks, transport and emergency services all run on Galileo time and position and on Copernicus monitoring. That makes satellites, their signals and their links a prime target, especially in conflict zones:

• GNSS jamming and spoofing are now everyday events around the Baltic and Black Sea. Spoofing has even placed ships at inland airports.
• The 2022 KA-SAT attack disabled tens of thousands of satellite modems across Europe. It also cut remote monitoring of 5,800 wind turbines in Germany.
• Satellites increasingly run standard networking software on general-purpose processors, so they inherit ordinary software bugs. Three memory-safety vulnerabilities were recently disclosed in NASA’s ION-DTN, the reference Delay-Tolerant Networking stack deployed on the ISS.

Today’s defences can’t keep up. Signature rules miss anything new. Machine-learning detectors need attack data that space systems rarely produce, and their alarms are hard to explain. Once software is in orbit, a newly disclosed flaw stays invisible until an update finally reaches the satellite.

Our solution is a detection engine with two layers that check each other:

• Neural layer. A lightweight deep network scores traffic and telemetry in real time at the edge: onboard, at the ground station or in a user terminal. It is trained on our own CCSDS Space Packet Protocol dataset.
• Algebraic layer for proof. Anything suspicious goes to our symbolic engine, which does three things: Using symbolic execution and constraint solving, it decides whether the input can actually reach a vulnerable or physically impossible state.
  • models protocol behaviour algebraically;
  • treats the onboard software as a symbolic digital twin;
  • encodes physical constraints drawn from Galileo and Copernicus.

Every alert carries its proof: the violated rule, the function involved and the exact state reached. That means fewer false alarms, no black-box verdicts, and protection against attacks that have no signature yet. Alerts flow into the SIEM tools security teams already use.

At the hackathon, we will extend the neural layer to GNSS receiver data and join both layers into one pipeline. Then we will stage three live attacks, and the dashboard will show each one detected and explained:

• spoofing a timing receiver;
• faking a vessel track in the Black Sea;
• sending a malformed uplink packet to onboard software.

Who it’s for: critical-infrastructure operators that rely on Galileo timing and positioning, satellite and ground-segment operators, satellite-IoT providers, and the security teams that defend them.

🛰️ EU space technologies

Galileo and Copernicus are both what we protect and how we protect it. Their signals and data become the trusted references our algebraic layer reasons against. That is what turns a neural “this looks odd” into an algebraic “this is impossible.”

• Galileo OSNMA. OSNMA cryptographically authenticates Galileo navigation data. The engine checks every position and time solution against the authenticated signals. It also checks them against physical limits on clock drift, motion and satellite geometry. Any contradiction becomes a spoofing alert that names the broken constraint.
• Galileo timing. Many critical services take their clock from GNSS. Authenticated Galileo time lets the engine catch time manipulation. It can also enforce strict ordering and anti-replay rules on telemetry and commands.
• EGNOS. EGNOS monitors satellite health across Europe. Sometimes EGNOS reports the satellites healthy while a local receiver sees inconsistent signals. Then the problem is local, meaning interference or an attack rather than a satellite fault.
• Copernicus Sentinel-1. Sentinel-1 radar detects ships through cloud and darkness. Comparing those detections with the positions vessels broadcast exposes spoofed tracks and “dark” ships. This gives an independent physical check on GNSS positions.
• Copernicus DEM and Land Monitoring Service layers. These turn geography into algebraic constraints:
  • a ship can’t sail on land;
  • a fixed timing station can’t move;
  • a ground receiver can’t sit below the terrain.
• IRIS² (roadmap). The engine is built for constrained edge hardware. The same detection can later run in the terminals and gateways of the EU’s secure-connectivity constellation.

The value: no single signal is trusted blindly. Galileo, EGNOS and Copernicus cross-check each other and the ground infrastructure. Detection keeps working even when one signal is jammed or one link is compromised.

🛡️ Challenge

We are solving Challenge 1: Cybersecurity for space-based strategic enablers. PhoenixSystems answers each part of it:

• Validating signals. Galileo OSNMA, Galileo timing and EGNOS provide authenticated references for position and time. The algebraic layer turns every mismatch into a precise, explainable alert.
• Identifying anomalies with Earth observation. Sentinel-1, the Copernicus DEM and land-cover data supply independent physical ground truth. Forged positions that look statistically normal still break these constraints.
• Protecting the space segment itself. The symbolic digital twin checks uplink packets against the onboard software. It catches memory-safety attacks that have no signature, which matters because software in orbit can’t simply be patched.
• Built for conflict zones. Detection runs at the edge and keeps working when networks are down or GNSS is jammed. Operators in contested areas aren’t left blind.
• Improving cybersecurity across Europe. Every alert is explainable and machine-readable. It goes straight into operators’ SIEM tools and can be shared with national CSIRTs and space ISACs. Space, energy and transport are all high-criticality sectors under NIS2, and their operators need exactly this kind of auditable evidence.