Machine Learning for Optical Network Security Monitoring: A Practical Perspective

Abstract

In order to accomplish cost-efficient management of complex optical communication networks, operators are seeking automation of network diagnosis and management by means of Machine Learning (ML). To support these objectives, new functions are needed to enable cognitive, autonomous management of optical network security. This paper focuses on the challenges related to the performance of ML-based approaches for detection and localization of optical-layer attacks, and to their integration with standard Network Management Systems (NMSs). We propose a framework for cognitive security diagnostics that comprises an attack detection module with Supervised Learning (SL), Semi-Supervised Learning (SSL) and Unsupervised Learning (UL) approaches, and an attack localization module that deduces the location of a harmful connection and/or a breached link. The influence of false positives and false negatives is addressed by a newly proposed Window-based Attack Detection (WAD) approach. We provide practical implementation guidelines for the integration of the framework into the NMS and evaluate its performance in an experimental network testbed subjected to attacks, resulting with the largest optical-layer security experimental dataset reported to date.

Machine Learning for Cognitive Optical Network Security Management

“…A polarization scrambling attack, in which the fiber is squeezed at a high frequency to cause fast-varying changes in the channel polarization state, can cause error bursts without affecting the channel power levels or OSNR. Encompassing experimental studies of physical-layer attacks at the optical link-and network level were performed in [13] and [14], respectively. Due to the complex interplay among different OPM parameters and the absence of models capable of capturing these effects or even consistent observable trends in OPM parameter values for different attack regimes, it is not possible to rely on a threshold-based approach for detection and identification of physical-layer attacks.…”

“…Due to their ability to process massive amounts of data and identify intricate patterns among a great number of performance indicators without the need to explicitly specify models or parameter thresholds, machine learning (ML) techniques are highly suitable for optical layer security diagnostics. ML has been applied to the detection of unauthorized signal presence by scrutinizing the received optical spectrum [16], and to the detection and identification of in-, out-of-band jamming and polarization scrambling [13,14], demonstrating strong potential to perform these functions in runtime environments. Despite this huge potential, carrier-grade deployment of ML techniques is still in its infancy and many challenges need to be overcome before achieving cognitive and autonomous optical network security management.…”

“…It should take into account the requirements and performance of ML in terms of their accuracy, granularity of the diagnostic information they can provide, their applicability to novel emerging threats in the evolving network and security landscape, the complexity of their learning and/or inference phases, memory and processing requirements, etc. For example, as shown in [14], supervised learning techniques (e.g., Artificial Neural Networks, ANNs) can provide highly accurate and fine-granular information on the type and intensity of physicallayer attacks, learned through training. This comes at a trade-off of a relatively complex training phase, relying on abundant, representative data labeled by experts with prior specialist knowledge on the attack specifics, and the need to retrain upon admittance of a new connection or an emergence of a new type of threat.…”

Root Cause Analysis for Autonomous Optical Networks: A Physical Layer Security Use Case

“…Optical Performance Monitoring (OPM) and the detection of anomalies (e.g., caused by physical layer intrusions or device degradation) are key tasks during optical network operation. The detection of anomalies is particularly challenging to be performed by humans or analytical models, and Machine Learning (ML) models for anomaly detection have shown promising performance [2], [3] . However, ML-based anomaly detection (enabled mainly by semi-or unsupervised learning) typically only detects the anomaly, without determining its causes.…”

“…The RCA module uses the information provided by an anomaly detection module based on unsupervised ML to compute the changes in the OPM parameters incurred by the anomaly. The framework is validated on a physical layer security use case, using experimental data obtained by inserting harmful jamming sig- nals and fiber squeezing for external polarization modulation [3] . While these attacks can cause severe service disruption, no exact theoretical models for their effects are known to date, which hinders their detection and counteraction.…”