Satellite networks face escalating cybersecurity threats from evolving attack vectors and systemic complexities. This paper proposes SatGuard, a novel framework integrating a three-dimensional penetration testing methodology and a nonlinear risk assessment mechanism tailored for satellite security. To address limitations of conventional tools in handling satellite-specific vulnerabilities, SatGuard employs large language models (LLMs) like GPT-4 and DeepSeek-R1. By leveraging their contextual reasoning and code-generation abilities, SatGuard enables semi-automated vulnerability analysis and exploitation. Validated in a simulated ground station environment, the framework achieved a 73.3% success rate (22/30 attempts) across critical ports, with an average of 5.5 human interactions per test. By bridging AI-driven automation with satellite-specific risk modeling, SatGuard advances cybersecurity for next-generation space infrastructure through scalable, ethically aligned solutions.

Satellite networks are essential to global connectivity yet face severe multidimensional cybersecurity threats. This systematic review conducts a holistic analysis of threats across the physical, network, and user layers. We propose the Sat-ATT&CK knowledge matrix to model satellite-specific attack chains. Corresponding defense technologies are organized within the core functions (Protect, Detect, Respond) of the National Institute of Standards and Technology (NIST) Cybersecurity Framework, establishing a structured threat–defense mapping. Furthermore, an exploratory case study on fine-tuning a large language model (SatSec) using the compiled literature corpus is presented. Finally, we identify key challenges and outline the future research directions toward a more resilient and intelligent security paradigm.

With the rapid advancement of network technologies, cybersecurity has exhibited complex trends of industrialization and diversification. Current network security evaluation methods predominantly quantify attack hazards from the de-fender's perspective, lacking structured analysis of attackers' capabilities and attack processes. To address the question, we propose the concept of "attack flow", designed to systematically describe network attack behaviors. On this basis, we leverage large language models to assign appropriate weights to each evaluation indicator and construct an attack flow effectiveness evaluation model by integrating the ATT&CK matrix. The model enables quantitative calculation of attack effectiveness and supports the analysis of the target network's security status from the attacker's perspective. Finally, by conducting penetration testing experiments in the "PumpkinFestival" target machine environment and comprehensively evaluating the experimental results, the practicality of the proposed method is validated.