SpaceCOP: Advancing Onboard Cyber Threat Detection and Autonomous Response for NASA’s Core Flight System

As spacecraft and lunar infrastructure become increasingly interconnected and autonomous, cybersecurity capabilities must extend beyond ground-based monitoring to enable onboard threat detection and response, particularly when communications are delayed or unavailable.

At the direction of the Department of Homeland Security Science and Technology Directorate, The Aerospace Corporation developed Space Cyber Orbital Protection (SpaceCOP), an open-source intrusion detection capability implemented as a NASA Core Flight System (cFS) application. Leveraging the Space Attack Research and Tactic Analysis (SPARTA) framework and its Indicators of Behavior (IOBs), SpaceCOP identifies potentially malicious activity through monitoring flight software commands, system calls, file integrity, resource utilization, and other spacecraft behaviors.

Released publicly in 2026, SpaceCOP was demonstrated at DEF CON 34 through presentations and interactive spacecraft cybersecurity exercises, highlighting practical applications of threat-informed onboard detection.

Ongoing development expands SpaceCOP’s integration with NASA’s Operational Simulator for Small Satellites (NOS3), enabling realistic cyberattack simulation, detection validation, and defensive experimentation. Planned enhancements include expanded attack scenarios, improved security telemetry, and autonomous response capabilities.

This presentation examines SpaceCOP’s architecture, open-source implementation, demonstration lessons, and integration with cFS and NOS3, highlighting its evolution toward autonomous cyber defense and enhanced resilience for future spacecraft and distributed lunar missions.