Satellite networks face escalating cybersecurity threats from evolving attack vectors and systemic complexities. This paper proposes SatGuard, a novel framework integrating a three-dimensional penetration testing methodology and a nonlinear risk assessment mechanism tailored for satellite security. To address limitations of conventional tools in handling satellite-specific vulnerabilities, SatGuard employs large language models (LLMs) like GPT-4 and DeepSeek-R1. By leveraging their contextual reasoning and code-generation abilities, SatGuard enables semi-automated vulnerability analysis and exploitation. Validated in a simulated ground station environment, the framework achieved a 73.3% success rate (22/30 attempts) across critical ports, with an average of 5.5 human interactions per test. By bridging AI-driven automation with satellite-specific risk modeling, SatGuard advances cybersecurity for next-generation space infrastructure through scalable, ethically aligned solutions.

Satellite networks are essential to global connectivity yet face severe multidimensional cybersecurity threats. This systematic review conducts a holistic analysis of threats across the physical, network, and user layers. We propose the Sat-ATT&CK knowledge matrix to model satellite-specific attack chains. Corresponding defense technologies are organized within the core functions (Protect, Detect, Respond) of the National Institute of Standards and Technology (NIST) Cybersecurity Framework, establishing a structured threat–defense mapping. Furthermore, an exploratory case study on fine-tuning a large language model (SatSec) using the compiled literature corpus is presented. Finally, we identify key challenges and outline the future research directions toward a more resilient and intelligent security paradigm.