Satellite networks are essential to global connectivity yet face severe multidimensional cybersecurity threats. This systematic review conducts a holistic analysis of threats across the physical, network, and user layers. We propose the Sat-ATT&CK knowledge matrix to model satellite-specific attack chains. Corresponding defense technologies are organized within the core functions (Protect, Detect, Respond) of the National Institute of Standards and Technology (NIST) Cybersecurity Framework, establishing a structured threat–defense mapping. Furthermore, an exploratory case study on fine-tuning a large language model (SatSec) using the compiled literature corpus is presented. Finally, we identify key challenges and outline the future research directions toward a more resilient and intelligent security paradigm.

The Automatic Dependent Surveillance-Broadcast (ADS-B) is a key component of the new-generation air traffic surveillance system. However, it is vulnerable to security threats due to its plaintext transmission and lack of authentication mechanisms. Existing ADS-B anomaly detection methods still suffer from significant limitations, including low anomaly detection rates and limited adaptability. To address these issues, this paper proposes a novel ADS-B anomaly detection framework driven by large language models (LLMs). The approach utilizes pre-trained LLMs and a self-iterative prompt optimization loop, which integrates historical trajectories and multimodal features to refine expert-initialized prompts. The optimized prompts guide the LLM in identifying ADS-B anomalies. The advantage of the proposed ADS-B anomaly detection framework lies in overcoming the limitation of traditional model adaptation. Experimental results show that the proposed method achieves excellent performance on key metrics: the anomaly detection rate of 98.55%, the false alarm rate controlled at 3.61%, the miss detection rate reduced to 1.45%, and a recall of 96.39%. Compared to traditional detection methods, this method improves detection accuracy by an average of more than 12%. Furthermore, experiments on multi-type anomaly detection tasks validate that the framework exhibits strong adaptability and good generalization, providing effective technical support for the development of aviation data security protection systems.