Experimental Study of Machine-Learning-Based Detection and Identification of Physical-Layer Attacks in Optical Networks

Optical networks are critical infrastructure supporting vital services and are vulnerable to different types of malicious attacks targeting service disruption at the optical layer. Due to the various attack techniques causing diverse physical-layer effects, as well as the limitations and sparse placement of optical performance monitoring devices, such attacks are difficult to detect, and their signatures are unknown. This paper presents an experimental investigation of a machine learning (ML) framework for detection and identification of physical-layer attacks, based on experimental attack traces from an operator field deployed testbed with coherent receivers. We perform in-band and out-of-band jamming signal insertion attacks, as well as polarization scrambling attacks, each with varying intensities. We then evaluate eight different ML classifiers in terms of their accuracy, and scalability in processing experimental data. The optical parameters critical for accurate attack identification are identified and the generalization of the models is validated. Results indicate that artificial neural networks achieve 99.9% accuracy in attack type and intensity classification, and are capable of processing 1 million samples in less than 10 seconds.