Network-Wide Localization of Optical-Layer Attacks

Abstract

Optical networks are vulnerable to a range of attacks targeting service disruption at the physical layer, such as the insertion of harmful signals that can propagate through the network and affect co-propagating channels. Detection of such attacks and localization of their source, a prerequisite for secure network operation, is a challenging task due to the limitations in optical performance monitoring, as well as the scalability and cost issues. In this paper, we propose an approach for localizing the source of a jamming attack by modeling the worst-case scope of each connection as a potential carrier of a harmful signal. We define binary words called attack syndromes to model the health of each connection at the receiver which, when unique, unambiguously identify the harmful connection. To ensure attack syndrome uniqueness, we propose an optimization approach to design attack monitoring trails such that their number and length is minimal. This allows us to use the optical network as a sensor for physical-layer attacks. Numerical simulation results indicate that our approach obtains network-wide attack source localization at only 5.8% average resource overhead for the attack monitoring trails.Index Terms-optical network security, physical-layer attack detection, attack monitoring trails.

Machine Learning for Optical Network Security Monitoring: A Practical Perspective

“…When AttSyns are unique for all attack scenarios, the harmful connection that caused the attack can be deduced from the subset of affected connections. Otherwise, additional security monitors or monitoring probes, whose resource-minimizing design was proposed in [33], are necessary to provide AttSyn disambiguation.…”

“…Initially, only connections C 1 and C 2 are present in the network. If we consider an attack scenario where user connections registered in the system (i.e., C 1 or C 2 in the example) can become the source of an attack (e.g., by tampering with their power levels) and affect any other connections they share links with, the AttSyns are formed for each connection as the attack source, as shown in Fig.4b [32], [33]. In the AttSyn table, the rows match the attack source, while the columns correspond to the resulting degradation of each connection.…”

Optical network security management: requirements, architecture, and efficient machine learning models for detection of evolving threats [Invited]

“…In addition to the examples of approaches for detecting the presence of physical-layer breaches summarized in Sec. 1, an approach for localization of high-power jamming signals can be found in [26], while [15,27] describe a framework for attack monitoring probe design to aid localization of harmful connections and/or breached links.…”