Harris Mohamed, Kratos
Keywords: RF, Pattern of Life, Anomaly Detection, SDA, multivariate, univariate
Abstract:
In today’s increasingly congested and contested satellite communications (SATCOM) radio frequency (RF) signal environment, it is crucial to monitor, track, and characterize the behaviors of space-based assets to support Space Domain Awareness (SDA). Historically, SDA has relied on orbital state estimation of assets based on optical and radar measurements. While these phenomenologies offer distinct advantages, they are also subject to significant limitations. In this paper, we discuss the use of RF measurements to develop a pattern-of-life for space objects that enable the user to observe not only the orbital state but also the behavior of the spacecraft payload, which is crucial for the SDA mission.
The ability to perform optical observations is constrained by weather conditions and time-of-day limitations, while radar observations require significant transmit power to effectively observe objects in Geosynchronous Orbit (GEO), which poses logistical, regulatory, and environmental concerns. Additionally, these phenomenologies focus only on the orbital state of an object, and do not provide any insight into the behavior or operation of the spacecraft payloads.
In contrast, RF offer unique advantages over these traditional phenomenologies. RF measurements can be collected for objects emitting RF energy regardless of weather or time-of-day constraints. In addition to enabling orbital state estimation, RF measurements also allow the observation and characterization of the spacecraft payload. RF characterizations of downlinked signals (e.g., power, frequency, modulation type, data rate, etc.) can be conducted at regular intervals. While individual RF observations can offer immediate insights into the current state of payloads, their real value emerges when these measurements are accumulated over time to establish a pattern-of-life. SDA systems can then identify deviations from the expected behavior to flag significant and meaningful events and provide indications and warnings of potential issues long before they could be observed by using traditional phenomenologies.
Prior work in RF-based pattern-of-life analysis [1] has solely focused on univariate analysis of raw RF metrics over time (such as analyzing bandwidth utilization of a spacecraft over time). This paper seeks to expand on that work by conducting multivariate analysis on multiple raw RF metrics, as well as examining derived RF metrics. Specifically, this paper will define, present and analyze four distinct RF metrics, each of which contributes uniquely and meaningfully to the SDA mission.
The first section will examine how GEO satellites utilize their assigned bandwidth. Abrupt and unexpected changes in bandwidth utilization are often indicators of changes in real-world political, economic, or military events. The paper will first explore several examples of nominal bandwidth utilization, followed by instances of abrupt changes in bandwidth usage, and analyze their potential implications for SDA.
The second section will focus on the behavior of carriers, utilizing a multivariate approach that integrates multiple raw RF metrics to draw more comprehensive conclusions than can be achieved with any single metric in isolation. We will demonstrate how this multivariate approach allows us to understand behavior of payloads. By analyzing modulation type, data rate, time of day, and other RF metrics we can predict future operations and identify unexpected carrier activity, which might indicate technical issues or malicious activities. Additionally, multivariate pattern-of-life approach will be applied to find instances of Electromagnetic Interference (EMI) on satellites, including an example that was captured on a commercial satellite used by Russia during the Russia/Ukraine conflict.
The third section will introduce the first RF-derived metric: maneuver detection. While difference of arrival methods for maneuver detection have been well researched [2] [3], this paper will seek to leverage these results as inputs to a pattern-of-life detection model. Specifically, analysis of the time intervals between maneuvers, the duration of each maneuver, and the orbital elements will enable classification of nominal station-keeping, relocating, and rendezvous and proximity operation (RPO) maneuvers. We will demonstrate how the multivariate pattern-of-life approach can effectively identify instances where satellites come into proximity, providing valuable insights into potential close encounters and enhancing the overall SDA mission. This will be supported by a real-world example of a Russian satellite performing aggressive station-keeping maneuvers to drift uncomfortably close to a communications satellite.
The final section examines Very Small Aperture Terminal (VSAT) networks, showing how RF characterizations can track self-reported terrestrial or maritime positions. By integrating maritime self-reported geolocations with Automatic Identification System (AIS) beacon data, it becomes possible to reconstruct vessel locations, historical movements, and route patterns. This combined approach offers a detailed view of maritime activity and supports more accurate path and behavior analysis.
To perform pattern-of-life analysis on these datasets, this paper will build upon prior work [1] and enhance it by evaluating up to 45 outlier detection algorithms which includes 12 deep learning methods as provided by PyOD 2 [4]. The best performing of these algorithms will be applied on real-world data and integrated into a system that can autonomously alert operators of suspicious behavior on an object’s payload.
In this paper, we explain how pattern-of-life applied to RF data offers substantial value to the SDA mission. Using these pattern-of-life capabilities, operators and analysts can achieve a multifaceted understanding of satellite operations. This includes pinpointing the precise location of satellites in real-time, monitoring the operational status and behavior of their payloads, and analyzing the IP traffic they manage. We apply these pattern-of-life models to real-world datasets to identify events relevant to SDA missions. By integrating these insights, SDA operators and analysts can make informed decisions, anticipate potential issues, and respond swiftly to emerging threats.
References
[1] https://amostech.com/TechnicalPapers/2023/SDA-Systems-and-Instrumentation/Mohamed.pdf
[2] https://amostech.com/TechnicalPapers/2022/Poster/Simon.pdf
[3] https://amostech.com/TechnicalPapers/2021/Non-Resolved-Object-Characterization/Simon.pdf
[4] https://www.arxiv.org/pdf/2412.12154
Date of Conference: September 16-19, 2025
Track: Satellite Characterization