CyberSatDetect is an AI-powered web application developed to detect anomalies in satellite telemetry data and enhance satellite cybersecurity. The system combines a hybrid LSTM-GRU deep learning model with continual learning to identify abnormal behavior and adapt to evolving telemetry patterns without requiring complete model retraining.
The application is available online and can be accessed here: https://cybersatdetect.onrender.com
The main goal of CyberSatDetect is to build a system capable of:
- Continuously analyzing time-series data
- Detecting unusual or suspicious patterns
- Presenting results in a clear and understandable way
- Supporting faster decision-making in cases of degradation, operational faults, or suspicious behavior
The core concept is that the system does not rely only on pre-labeled training data, but instead learns the underlying normal behavior and then identifies what falls outside that expected pattern.
This makes the approach especially useful in real-world settings where labeled data is limited, expensive, or difficult to obtain.
- AI-based anomaly detection for satellite telemetry
- Hybrid Dual-Head LSTM-GRU Autoencoder
- Continual learning for adapting to new telemetry patterns
- Interactive web dashboard for telemetry analysis
- Real-time anomaly detection and visualization
- Automatic report generation
The system incorporates several security mechanisms to ensure the protection of data and AI models:
- Secure user authentication
- Role-Based Access Control (RBAC)
- HTTPS encrypted communication
- Input validation for uploaded telemetry files
- Audit logging for monitoring system activities
- Protection against data poisoning during continual learning
The system was developed and evaluated using real satellite telemetry datasets from NASA (SMAP/MSL) and ESA (OPS-SAT), together with simulated anomaly scenarios including spike, noise, freeze, and drift anomalies.
The proposed model achieved the following performance:
| Metric | Score |
|---|---|
| Model Accuracy | 96.3% |
| F1-Score | 94.9% |
| False Alarm Rate | 0.47% |
The system is capable of detecting the following anomaly types:
- Spike
- Noise
- Freeze
- Drift
- Data Input — A user uploads a dataset containing telemetry measurements
- Data Preparation — Incoming data is processed into a consistent and usable form
- Time Windowing — Data is divided into smaller windows for local behavior analysis
- Behavior Evaluation — Each segment is assessed against the learned normal pattern
- Anomaly Identification — Segments with strong deviation are flagged as suspicious
- Result Presentation — Results are shown with severity indicators and supporting analysis details
Frontend
- HTML
- CSS
- JavaScript
Backend
- Python
- FastAPI
Artificial Intelligence
- TensorFlow
- Keras
- LSTM
- GRU
- Continual Learning
Data Processing
- Pandas
- NumPy
The main operational layer responsible for managing the full analysis workflow and user-facing services.
Responsible for learning the expected behavior of the data and estimating how strongly a given observation differs from that baseline. The approach is based on reconstructing expected behavior, comparing observed values against that expectation, measuring the level of deviation, and assigning an anomaly score.
Provides pages for login and registration, data upload, analysis viewing, reports, and administration.
Enables users to review findings in a structured and exportable form.
Allows gradual improvement of the analysis process as new data becomes available, without requiring complete model retraining.
Once the system is running, users can:
- Upload new data for analysis
- Initiate the analysis workflow
- Monitor processing status
- View detailed results
- Review reports and summaries
- Access administrative functions when permissions allow
Ghaidaa Algarni