Starlink 和 Kuiper 等近地轨道(LEO)卫星星座正迅速成为低延迟全球连接的关键骨干网。随着这些系统的扩展,它们作为攻击目标的吸引力增加,从而对韧性和安全性提出了更高要求。威胁行为者试图利用星座特有的属性,如可预测的运动、时变拓扑结构以及对星间链路和星地链路的依赖。近期研究表明,链路泛洪攻击(LFA)可以利用这些属性来拥塞关键的网络瓶颈。然而,现有工作并未量化 LEO 网络抵御定向中断的能力。我们提出 HYDRA,这是一个将 LFA 变体建模为僵尸网络最小化问题的建模与优化框架。HYDRA 通过测量破坏目标地理区域间通信所需的最小活跃 Bot 子集及相应的流量分配,来量化网络对 LFA 的韧性。在匹配的隐蔽性约束下,HYDRA 使用比 ICARUS 少 34% 的 Bot 和减少 23% 的总攻击流量,实现了相同的定向中断效果。随着网络拓扑结构的演变,HYDRA 在维持持续攻击方面取得了超过 97% 的成功率。最后,HYDRA 评估了五种缓解策略,展示了路由多样化、入口监管、基于距离的流量限制、源端节流以及僵尸网络损耗如何降低攻击成功率并提高网络抵御定向中断的韧性。
Low Earth orbit (LEO) satellite constellations, such as Starlink and Kuiper, are rapidly emerging as a critical backbone for low-latency global connectivity. As these systems expand, they become more attractive attack targets, necessitating increased resilience and security. Threat actors seek to exploit constellation-specific properties such as predictable motion, time-varying topologies, and reliance on inter-satellite and ground-satellite links. Recent work has shown that link-flooding attacks (LFAs) can exploit these properties to congest strategic network bottlenecks. Yet, prior work does not quantify the resilience of LEO networks to targeted disruption. We present HYDRA, a modeling and optimization framework that formulates LFA variants as botnet minimization problems. HYDRA quantifies network resilience to LFAs by measuring the smallest active subset of bots and the corresponding traffic allocation required to disrupt communication between targeted geographic areas. Under matched stealth constraints, HYDRA achieves the same targeted disruption as ICARUS while using 34% fewer bots and 23% less aggregate attack traffic. HYDRA achieves over 97% success in sustaining continuous attacks as the network topology evolves. Finally, HYDRA evaluates five mitigation strategies, showing how routing diversification, ingress policing, distance-based traffic constraints, source throttling, and botnet attrition reduce attack success and improve network resilience to targeted disruption.