While realizing global coverage, random access, on-demand service, security and credibility, the space-integrated-ground information network(SGIN) is confronted with more complex and variable security threats.Compared with the internet, satellite network has a lot of diff erences, such as highly dynamic changes of topology, transfer protocol and data format.In terms of these questions, it was necessary to integrated the rule of satellite network attacks into the rules of APT attacks, developed the cybersecurity knowledge graph and the attack rules library to analyzed the attacks of the SGIN.The pattern of attack rules was expressed based on time-space data model, which was used to completed the attack chain when there were non-continuous missed data or false positives data.The attack analysis framework proposed in this paper could accurately perceived the security status of the SGIN in real time , and provided decision support for the SGIN.
