Machine learning for network security management, attacks, and intrusions detection

Book chapter, 2022

This chapter focuses on challenges, progress and pitfalls in applying ML to physical-layer security management. In the context of trustworthy networks, we motivate the need for automation in support of the work of network security professionals. We summarize the characteristics of known attack techniques targeting the physical layer and outline the framework for optical network security management. Supervised, semisupervised and unsupervised learning techniques that can aid automation of network security management are described with a focus on their performance requirements in the context of security. Accuracy, complexity, and interpretability of these techniques are examined on a use case of jamming and polarization scrambling attacks performed experimentally in a telecom operator network testbed. Finally, several open research challenges in the context of optical network security are outlined along with possible avenues to tackle some of them.