Problem
Research questions and friction points this paper is trying to address.
open-source software
satellite systems
software security
security risks
mission operations
An Empirical Security Analysis of Open-Source Software Used in Onboard Satellite Systems
🤖 AI Summary
本文通过分析126个开源软件仓库，采用多种安全测试方法，揭示了卫星系统中开源软件的安全风险分布情况，为提高安全性提供依据。
📝 Abstract
The use of open-source software (OSS) in satellite flight systems is increasing as missions adopt reusable frameworks, shared libraries, and community-maintained components. While this accelerates development, it also introduces software-security risks into systems where patching is costly and failures may affect mission operations. This paper presents an empirical security study of OSS used in onboard satellite systems. We analyze 126 public repositories using a pipeline that combines software bill of materials generation, software composition analysis, static application security testing, infrastructure-as-code analysis, and secret scanning. After rule-based cleaning, onboard-scope filtering, and fingerprint-based deduplication, the pipeline produced a final dataset of 2,827 findings.
The results show that security findings are widespread but unevenly distributed. Medium-severity findings account for 49% of the dataset, and 72% are classified as medium severity or higher. A Common Weakness Enumeration (CWE)-based taxonomy assigns all findings to eight weakness families. Memory Safety and Code Quality dominate the dataset, followed by Input Validation and Injection. Most findings occur in project-developed code, accounting for 81.4% of the dataset, while external dependency code remains a relevant source of findings. While these findings do not establish mission-specific exploitability, they provide an empirical characterization of recurring security patterns across the open-source onboard satellite software ecosystem, helping quantify their prevalence and prioritize areas that warrant the greatest security attention.
Innovation
Methods, ideas, or system contributions that make the work stand out.
software composition analysis
static application security testing
infrastructure-as-code analysis
secret scanning
Common Weakness Enumeration
🔎 Similar Papers
No similar papers found.
