Experiment-based detection of service disruption attacks in optical networks using data analytics and unsupervised learning

Abstract

The paper addresses the detection of malicious attacks targeting service disruption at the optical layer as a key prerequisite for fast and effective attack response and network recovery. We experimentally demonstrate the effects of signal insertion attacks with varying intensity in a real-life scenario. By applying data analytics tools, we analyze the properties of the obtained dataset to determine how the relationships among different optical performance monitoring (OPM) parameters of the signal change in the presence of an attack as opposed to the normal operating conditions. In addition, we evaluate the performance of an unsupervised learning technique, i.e., a clustering algorithm for anomaly detection, which can detect attacks as anomalies without prior knowledge of the attacks. We demonstrate the potential and the challenges of unsupervised learning for attack detection, propose guidelines for attack signature identification needed for the detection of the considered attack methods, and discuss remaining challenges related to optical network security.

Machine Learning for Optical Network Security Monitoring: A Practical Perspective

“…In [4], we applied various supervised learning approaches for detecting in-band, out-of-band jamming and polarization scrambling attacks on an optical link by analysing the experimental OPM data collected from a coherent receiver. In [38], techniques based on unsupervised learning were devised to detect attacks previously unseen and untrained for. First efforts towards integrating attack detection and localization into optical network management were demonstrated in [1].…”

“…Detection and identification of attacks can be performed by different ML techniques. Previous works have investigated the use of SL [4] and UL [38] from a single-link and single Optical Channel (OCh) perspective. However, adopting a network-wide multi-OCh Attack Detection and Identification (ADI) solution presents challenges and brings concerns beyond accuracy.…”

Root Cause Analysis for Autonomous Optical Networks: A Physical Layer Security Use Case

“…Then, a feature-wise analysis can be performed between the normal and anomalous samples. Depending on the use case, different metrics can be used for the feature-wise analysis, such as distance [4] and correlation [5] . The family of diagnostic tools supporting RCA can be enriched with the Anomaly Vector (AV) whose elements contain the average difference between the OPM features in the baseline and anomaly condition.…”

“…Previous works have investigated ways to facilitate the identification of anomaly causes, e.g. via Root Cause Analysis (RCA) using a distance metric [4] or analysing shifts in OPM parameters correlation [5] . However, they either work with supervised learning (requiring prior knowledge of the anomalies to be detected) or with a few key OPM parameters.…”

Network-Wide Localization of Optical-Layer Attacks

“…In our previous work, we have experimentally investigated the detection of harmful signals to identify signatures of jamming attacks of varying intensities. To this end, we developed machine learning approaches based on supervised [3] and unsupervised learning [4], that analyzed the OPM data obtained for a particular connection, and identified whether it has been affected by a jamming attack. The approaches based on supervised learning were able to achieve 100% accuracy in attack identification [3], while previously unseen (zero-day) attack scenarios were detected in up to 92% of occurrences [4].…”