FedLTN-CubeSat: Neuro-Symbolic Federated Learning for Intrusion Detection in LEO CubeSat Constellations

Abstract

Low Earth Orbit (LEO) mega-constellations are becoming the backbone of global communications, yet their cybersecurity remains critically under-addressed. Intrusion detection systems (IDSs) for such constellations face a unique trilemma of accuracy, efficiency, and interpretability under extreme SWaP-C (size, weight, power, and cost) constraints. We present FedLTN-CubeSat (FedLTN refers to Federated Logic Tensor Networks), a neuro-symbolic federated learning framework for intrusion detection in LEO CubeSat constellations. The framework first employs a lightweight spatio-temporal separable perception encoder to efficiently extract features from telemetry and IQ data, designed to operate within the computational budgets of resource-constrained on-board processors. These features feed into a differentiable first-order logic layer based on Logic Tensor Networks, which incorporates domain knowledge as logical axioms to guide learning and enhance interpretability. To enable collaborative learning across a constellation, FedLTN-CubeSat introduces an intra-orbit symbolic federated learning mechanism that aggregates only the logic-layer parameters via inter-satellite links, drastically reducing communication overhead while preserving data privacy. Furthermore, an orbit-adaptive predicate migration module transfers learned rules across different orbital configurations with minimal supervision, facilitating rapid deployment. We evaluate on two benchmarks: the CuCD-ID dataset (NASA NOS3 telemetry) and the STIN dataset (satellite-terrestrial integrated networks). FedLTN-CubeSat achieves 0.98 F1-score on CuCD-ID and 0.96 accuracy on STIN—significantly outperforming prior federated learning baselines (7% improvement) while incurring a minimal daily communication load per satellite. The framework also outputs interpretable decision traces grounded in logical axioms, enabling operators to understand and validate detections. Logical constraints improve detection of unseen attack variants by 25% over pure neural baselines.