Detecting Forwarding Misbehaviour in LEO Satellite Networks with ML-Based Trust Models

Low Earth Orbit (LEO) satellite constellations are increasingly deployed to support global network coverage as Space Information Networks (SINs). However, they can suffer from forwarding misbehaviour, where satellites may drop packets either selfishly to save resources or maliciously to disrupt communication. As selfish and malicious packet dropping differ in intent and impact, distinguishing them is a key first step toward enabling appropriate mitigation by the network operator. To address this problem, we propose STFMD (Satellite Trust-Based Forwarding Misbehaviour Detection), an ML-based trust model that detects forwarding misbehaviour and distinguishes selfish from malicious nodes. To support different mitigation needs, STFMD provides multiple detection settings: binary (honest, selfish), three-class (honest, malicious, selfish), and four-class (honest, selfish, grayhole, blackhole), and leverages three selected metrics groups (energy, buffer, and network performance) that are affected by forwarding misbehaviour. We also propose a new dataset collection framework for satellite networks that enables data collection under heterogeneous SIN scenarios. Our emulation results show that STFMD outperforms state-of-the-art rule-based methods in detecting selfish satellites, while maintaining affordable overhead, and, further, separates selfish and malicious forwarding misbehaviour, enabling the operator to select appropriate mitigation actions.