Most of the data-driven satellite telemetry data anomaly detection methods suffer from high false positive rate and poor interpretability. To solve the above problems, we propose an anomaly detection framework using causal network and Feature-Attention-based Long Short-Term Memory (LSTM). In our method, a causal network of telemetry parameters is constructed by calculating Normalized Modified Conditional Transfer Entropy (NMCTE) and optimized by conditional independence tests based on the Conditional Mutual Information (CMI). Then, a Feature-Attention-based LSTM model combines feature attention and causal network (called CN-FA-LSTM) is established to predict telemetry data, and a nonparametric dynamic k-sigma threshold updating method is proposed to set thresholds. Case study on a real satellite demonstrates that anomaly detection using the CN-FA-LSTM and nonparametric dynamic k-sigma threshold updating has an average F1-score of 0.9462 and false positive rate of 0.0021, which are better than the baseline methods. Furthermore, CN-FA-LSTM has a stronger interpretability than other commonly used prediction models. Supplementary experiment on two public datasets verifies the universal applicability of our method.

Most of the spacecraft telemetry anomaly detection methods based on statistical models suffer from the problems of high false negatives, long time consumption, and poor interpretability. Besides, complex interactions, which may determine the propagation of anomalous mode between telemetry parameters, are often ignored. To discover the complex interaction between spacecraft telemetry parameters and improve the efficiency and accuracy of anomaly detection, we propose an anomaly detection framework based on parametric causality and Double-Criteria Drift Streaming Peaks Over Threshold (DCDSPOT). We propose Normalized Effective Transfer Entropy (NETE) to reduce the error and noise caused by nonstationarity of the data in the calculation of transfer entropy, and then apply NETE to improve the Multivariate Effective Source Selection (MESS) causal inference algorithm to infer parametric causality. We define the Weighted Source Parameter (WSP) of the target parameter to be detected, then DSPOT is employed to set multi-tier thresholds for target parameter and WSP. At last, two criteria are formulated to determine anomalies. Additionally, to cut the time consumption of the DCDSPOT, we apply Probability Weighted Moments (PWM) for parameter estimation of Generalized Pareto Distribution (GPD). Experiments on real satellite telemetry dataset shows that our method has higher recall and F1-score than other commonly used methods, and the running time is also significantly reduced.

Today, people rely heavily on infrastructure networks. Attacks on infrastructure networks can lead to significant property damage and production stagnation. The game theory provides a suitable theoretical framework for solving the problem of infrastructure protection. Existing models consider only the beneficial effects that the defender obtains from information gaps. If the attacker’s countermeasures are ignored, the defender will become passive. Herein, we consider that a proficient attacker with a probability in the game can fill information gaps in the network. First, we introduce the link-hiding rule and the information dilemma. Second, based on the Bayesian static game model, we establish an attack–defense game model with multiple types of attackers. In the game model, we consider resource-consistent and different types of distributions of the attacker. Then, we introduce the solution method of our model by combining the Harsanyi transformation and the bi-matrix game. Finally, we conduct experiments using a scale-free network. The result shows that the defender can be benefited by hiding some links when facing a normal attacker or by estimating the distribution of the attacker correctly. The defender will experience a loss if it ignores the proficient attacker or misestimates the distribution.