Marija Furdek

Leyla Sadighi, Stefan Karlsson, Carlos Natalino et al.

Machine learning (ML) models trained to detect physical-layer threats on one optical fiber system often fail catastrophically when applied to a different system, due to variations in operating wavelength, fiber properties, and network architecture. To overcome this, we propose a Domain Adaptation (DA) framework based on a Variational Autoencoder (VAE) that learns a shared representation capturing event signatures common to both systems while suppressing system-specific differences. The shared encoder is first trained on the combined data from two distinct optical systems: a 21 km O-band dark-fiber testbed (System 1) and a 63.4 km C-band live metro ring (System 2). The encoder is then frozen, and a classifier is trained using labels from an individual system. The proposed approach achieves 95.3% and 73.5% cross-system accuracy when moving from System 1 to System 2 and vice versa, respectively. This corresponds to gains of 83.4% and 51% over a fully supervised Deep Neural Network (DNN) baseline trained on a single system, while preserving intra-system performance.

Aleksandra Knapińska, Marija Furdek

Optical networks are critical infrastructure that underpins global communications, and detecting security breaches that jeopardize them is essential to maintaining worldwide connectivity. As malicious actors continuously evolve their attack techniques, dynamically updated intrusion detection models have become a key component of modern defense mechanisms. By incorporating newly acquired telemetry data, these models can adapt to emerging threats while maintaining high detection performance. However, when previously encountered attacks reappear after a prolonged period of absence, adaptive models may fail to recognize them due to the phenomenon of catastrophic forgetting. In contrast, statically trained models can reliably detect attacks represented in the original training data but lack the ability to adapt to previously unseen attack patterns. Consequently, intrusion detection systems face a fundamental tradeoff between adaptability to evolving threats and long-term retention of previously acquired knowledge. In this work, we propose a data-driven mechanism to cope with catastrophic forgetting in dynamic attack detection systems. Our approach balances the model update datasets by using parts of past attack data. We utilize a threshold-based mechanism to trigger data balancing after accuracy drops due to an active attack change. Applied to an experimental optical network security dataset, the proposed approach reduces the average model adaptation time by 37% compared to its dynamic counterpart that does not employ data balancing. Compared to a baseline from the literature that relies on neural network depth increasing, our approach requires 6% fewer data batches to adapt to changing conditions and regain performance.