SOP-Based Anomaly Detection Leveraging Machine Learning for Proactive Optical Restoration

SOP-Based Anomaly Detection Leveraging Machine Learning for Proactive Optical Restoration Gulmina Malik Politecnico di Torino, Italy [email protected] Muhammad Umar Masood Politecnico di Torino, Italy [email protected] Imran Chowdhury Dipto Politecnico di Torino, Italy [email protected] Mashboob Cheruvakkadu Mohamed Politecnico di Torino, Italy mashboob.cheruv[email protected] Stefano Straullu Links Foundation, Italy [email protected] Sai Kishore Bhyri Nokia [email protected] Gabriele Maria Galimberti Nokia [email protected] Jo˜ ao Pedro Nokia [email protected] Antonio Napoli Nokia [email protected] Walid Wakim Nokia walid.w[email protected] Vittorio Curri Politecnico di Torino, Italy [email protected] Abstract—This paper presents an experimental proof-ofconcept for detecting malicious mechanical vibrations in optical networks using Machine Learning (ML) techniques. The study leverages the State of Polarization (SOP) as a real-time sensing mechanism for the identification of anomalous disturbances, like those caused by drilling, which can lead to fiber cuts and significant network disruptions. The proposed ML-based approach is able to continuously monitor SOP fluctuations, enabling the early detection of vibrations and proactive mitigation of potential network failures. By leveraging advanced ML algorithms, the model effectively identifies between normal environmental vibrations and critical, harmful disturbances. This capability ensures timely intervention to protect the network infrastructure. The ML model achieved a vibration detection accuracy of 95%, which demonstrates it’s high reliability in distinguishing benign anomalies from disruptive anomalies. This level of precision significantly enhances the stability, resilience, and operational efficiency of the optical network. This leads to a reduction in the likelihood of service outages and physical infrastructure damage. The results show the potential of combining real-time SOP monitoring with ML-based analytics to advance network management strategies. Index Terms—State of polarization, machine learning, vibrations, fiber anomalies, proactive. I. INTRODUCTION Optical networks are the backbone of high-capacity, longreach and reliable data transmission in modern telecommunications. Optical fibers are susceptible to polarization fluctuations, which can impact the performance of optical fiber links [1]. Interestingly, this also means that optical fibers are excellent for sensing [2]. The impact of environmental factors on fiber cables is uncertain and unpredictable. Underground fiber cables can be stressed by temperature variations or mechanical vibrations. Wind also generates stress on the aerial cables. Furthermore, the high sensitivity of optical fiber cable makes it more vulnerable to faults and disturbances such as construction work leading to fiber cuts, malicious physical attacks, unauthorized eavesdropping (fiber tapping), and vibrations caused by environmental factors [3]. This could lead to widespread service outages, data loss, and compromised confidentiality, which negatively impacts the operations of network service providers. Furthermore, a large fraction of today’s fiber optic networks relies on optical fiber cables that were deployed underground many years ago. This aging infrastructure increases the risk of performance degradation, which if not monitored, and controlled can lead to service disruptions. Early warning is therefore necessary in such hazardous circumstances. The monitoring of State-of-Polarization (SOP) fluctuations in optics has emerged as a promising method. In [4], a technique for monitoring SOP in terrestrial cables was demonstrated, with the intent of allowing construction vehicles to stop in time of avoiding damaging the cable. In [5], fiber abnormalities were identified and located using Optical Time Domain Reflectometer (OTDR) traces. To detect and localize risky events, a vision transformer-based model was developed in [6]; nevertheless, it necessitates significant computational resources for both training and inference. However, the hardware used for such methods can be costly, which may limit their widespread deployment. Traditional monitoring approaches may lack the responsiveness needed to detect malicious events in time for preventive measures. These approaches are usually based on constantly monitoring certain performance metrics and raising an alarm, potentially triggering re-routing of services, when a certain threshold is violated [7]. Therefore, these methods are reactive in nature, as they do not exploit early signs in telemetry system, that a disruptive event is impending. In view of these limitations, a more resilient solution that proactively exploits these signs could allow to minimize the probability of service disruptions. As referred, by monitoring how polarization changes, it may be possible to detect if external events which have the potential to negatively impact the fiber link performance are taking place [8]. SOP depicts the orientation of the electric field of a light wave as it travels 978-3-903176-67-6 © 2025 IFIP 2025 International Conference on Optical Network Design and Modeling (ONDM) through an optical fiber. An SOP-based early warning system, able to detect and localize fiber anomalies, could be used to improve service availability in optical fiber networks by, for example, allowing a faster trigger of optical restoration (i.e., instead of waiting for the failure to disrupt the service). Implementing such a system can enhance network resilience, lower operational costs, and extend the fiber lifespan. Small irregularities or variations in SOP patterns can be identified by closely observing SOP and utilizing machine learning (ML) methods. In this paper, we employ an ML-based vibration detection model to categorize the vibration state in order to classify and detect malicious vibrations. This method enhances the early detection of anomalies, particularly in scenarios involving external activities such as drilling near deployed optical fibers. Drilling generates vibrations with specific frequencies and intensities over time, which, if left undetected, can become critical to the integrity of the fiber infrastructure. Using ML techniques, we monitor SOP variations to detect potential suspicious events and predict imminent optical link outages [9]. The ML model we have developed is trained to recognize these critical vibration patterns (malicious events) amidst the background noise of other non-disruptive vibrations from the geographical footprint. The paper is organized as follows. Section II details the setup utilized to perform extensive SOP measurements. Section III describes the ML model training based on the SOP measurements and provides early insight into how this model can be integrated with the network management and control systems. A performance analysis of the proposed ML model is reported in Section IV. Finally, Section V summarizes the conclusion of this work. II. STATE OFPOLARIZATION MEASUREMENTS The most common threats in metropolitan areas are fiber cuts and physical network infrastructure damage [7]. Excavators and jackhammers used during maintenance or construction can damage underground fiber cables, resulting in repair expenses incurred by network service providers and even service downtime, depending on the extent of damage and available redundancy mechanisms. Since the SOP is highly sensitive to mechanical stresses and topological disturbances, it is suitable to detect early vibrations induced on the fiber before actual damage occurs. This work focuses on mechanical vibrations as a fiber anomaly. Vibrations of various intensities are generated to simulate a drilling scenario, i.e., taking into consideration the situation where the fiber cable is installed underground and, for example, an excavator-induced activity causes vibrations, which eventually can lead to a fiber cut. These vibrations cause the polarization of light to change, which can be captured by SOP. We monitored the polarization state fluctuations on the Poincar` e sphere using the Stokes parameters. Continuous SOP monitoring is necessary for the reliability of the ML model to detect risky vibrations, and activate an alarm inside the telemetry system, while ignoring vibrations that correspond to Polarimeter Laser Vibration Generator AWG Fig. 1. Vibration generation testbed setup non-events (e.g., due to environmental conditions or regular activity in the vicinity of the fiber). Every SOP recording is made up of several variables, including how the Stokes parameters change over time [6]. The angular speed of the SOP in the fiber, called SOPAS, is also measured to evaluate mechanical vibrations within optical fiber routes. An event is considered more critical when the angular speed is higher [10]. The experimental setup for generating the vibrations in the laboratory is presented in Figure 1. The vibration signatures generated, intend to mimic drilling at a nearby construction site, which could lead to a fiber cut in the subterranean fiber cable. It should be noted, however, that we are unable to replicate the impacts of actual maintenance or drilling excavators [11] on fiber. It comprises a Novoptel PM1000 Polarimeter to track SOP fluctuations, recording the evolution of Stokes parameters as vibration states changed over time. Stokes parameters {S0, S1, S2, S3}define the polarization state of light propagating into the fiber. By setting the Averaging Time Exponent (ATE) to 16, 216 samples are averaged to increase the signal-to-noise ratio, with an effective sampling rate of 1500 samples per second. An active laser source in Continuous Wave (CW) mode sends pulses of light at 1530 nm and 6 dBm of output power to the sensing fiber. The optical fiber testbed is made up of two G.652 Standard Single Mode Fibers (SSMF) with length of 13 Km, respectively. A vibration generator with a 2 meter fiber, attached to a plastic plate, positioned in the center, is used to generate vibrations of various intensities. The vibrations are controlled by an Arrayed Waveguide Generator (AWG). The vibration generator uses the sinusoid waveforms from the AWG to vibrate, whose oscillating frequency and amplitude (Vpp) can be adjusted. At the receiving end, the polarimeter continually monitors the polarization time series that depict the trajectories on the Poincar´ e sphere [12], using the embedded photonic devices. The sampling frequency is set to 1500 Hz. The experiments generate fiber displacements, birefringence and mechanical stresses, which can be utilized to capture the impact of various vibration intensities on the SOP. These SOP variations are able to detect real-time disturbances such as vibration-induced incursion fiber instability, which may signal potential threats to the network integrity. Then, in order to ensure timely action, our ML model analyzes and classifies such anomalous occurrences, focusing on crucial or malicious events like external drilling activity near deployed fibers. 2025 International Conference on Optical Network Design and Modeling (ONDM) Fig. 2. Implementation workflow for ML-based vibration detection and alerts III. MACHINE LEARNING FRAMEWORK The proposed ML framework to classify vibration-related events using SOP measurements consists of the following stages: (1) Vibration generation and data collection, (2) Data processing, (3) ML model training, (4) ML model testing and validation. Firstly, the SOP time series data is obtained, as illustrated in Figure 2. Secondly, the generated data is subject to preprocessing and feature engineering. Thirdly, the ML model is trained to classify numerous signatures of vibrations, with the overall aim of being able to accurately distinguish between disruptive (malicious) and non-disruptive activities within the geographical footprint. The resulting ML model can then be deployed in a live network. By being fed with real-time SOP data from the network, the model can classify events and detect a potentially disruptive one, in which case an alarm can be raised and the network controller can be notified. This process allows to initiate, for example, the rerouting of traffic, proactively acting such that service disruption is avoided or, at least, minimized. Noteworthy, in the study reported in this work, we focus on classifying the types of vibration anomalies and investigate the validity of our ML model. The integration of the ML model in the complete workflow depicted in Figure 2 is left for future work. TABLE I VIBRATION LEVEL DESCRIPTION. Vibration Level Description Green No vibrations Yellow Normal vibrations Orange Cautionary vibrations Red Malicious / critical vibrations Fingerprints of different vibration occurrences are gathered as data with varying intensities and frequencies. However, an initial dataset was collected under quiet, and controlled Fig. 3. Example of vibration classification events 2025 International Conference on Optical Network Design and Modeling (ONDM) conditions, free from external events or noise. In a real-world implementation, environmental factors such as proximity to a transportation network (e.g., nearby roads with intense traffic) and other external environmental disturbances will introduce additional noise to the vibrations, complicating the scenario and reflecting real-world conditions more accurately. Therefore, another dataset, including all the environmental disturbances and noise was gathered under the same conditions to enhance the generalization and diversity of our ML model and optimize it for any deployed cable type. The noise feature enables the model to learn to distinguish between true anomalous events, such as fiber cuts or mechanical stresses, and false positives or noise that may occur. We evaluated various ML classifiers, with Long ShortTerm Memory (LSTM), a form of Recurrent Neural Network (RNN), demonstrating superior performance over all other models due to the time-series nature of our data. LSTMs are well-suited for time-series analysis, as they effectively capture long-term dependencies and temporal dynamics, which are critical for identifying the polarization state changes induced by external vibrations. For prediction, LSTMs use two different pathways: one for short-term memories and another for long-term memories [13] To capture the underlying SOP fluctuations, we first trained the LSTM model, on a clean, noise-free dataset. To enhance the model’s capacity so that we can generalize outside of controlled settings, we integrated additional feature engineering techniques which enriched the input data. The features like, rolling statistics, including the rolling mean and rolling standard deviation, were applied to capture the local trends of SOP variations over a sliding window. Additionally, differential computations were incorporated, such as first-order and second-order differences, that helped in highlighting the rapid changes in the SOP data, making it easier for the model to detect the sudden anomalies. Throughout the training process, we employed a validation-based early stopping mechanism to ensure that the model maintained its predictive power without succumbing to overfitting. Fig. 4. ML model training accuracy and loss. After the model had successfully learned the intended patterns, we applied the transfer learning technique to adapt it for a noisier dataset. Transfer learning, learns from a pre-trained ML model and applies the knowledge to another model, to increase the performance and generalization. Random noise is introduced into the dataset to represent the environmental disruptions caused by various events on the SOP. To test our model’s ability to predict crucial vibrations among other environmental disturbances, the vibrations were generated once more, but this time with noise. The Adam optimizer, which combines momentum and adaptive learning rates to modify the learning rates for each parameter, was employed. The transfer learning model, pre-trained on a clean dataset, was then finetuned and applied to the noisy dataset, demonstrating its ability to generalize and effectively identify malicious vibrations. For this reason, our model not only detects but also anticipates to determine the trend of vibration patterns. We have categorized the vibrations into 4 levels, shown in Tab. I. Malicious vibrations (Red) are low-frequency, high amplitude events that occur over an extended period of time. As for cautionary vibrations (Orange), they are low frequency, high amplitude, and last for a brief period of time. All other vibrations are considered normal (Yellow), whereas green refers to no vibrations state. Figure 3 illustrates these vibrations and exemplifies how different vibration levels have varying impacts on the signals traversing the fiber cable, whether they are strong or weak. IV. PERFORMANCE ANALYSIS OF ML MODEL The results of our study provide a comprehensive demonstration of the effectiveness of the proposed ML model in accurately identifying malicious vibrations that could potentially compromise the optical fiber infrastructure. This section details Fig. 5. Performance matrix for model training on clean background. 2025 International Conference on Optical Network Design and Modeling (ONDM) Fig. 6. Classification score for training and testing of the vibration detection model. the metrics used and the experimental setup put in place, and assesses the results obtained. Figure 4 illustrates the accuracy and loss curves over the training epochs, serving as a visual representation of the model’s learning process. The accuracy curve shows a sharp increase during the initial epochs, indicating the model was able to rapidly learn the distinguishing features of malicious vibrations from benign ones. By the 10th epoch, the accuracy stabilizes at an impressive 99%. This scores underlines the robustness of the model’s architecture and the quality of the training data. On the other hand, the loss curve follows a steady decline, which is an equally important indication of the model’s convergence. Initially, the loss decreases steeply, showcasing the model’s ability to minimize prediction errors effectively. As training progresses, the loss reduction rate slows down and remains steady. This shows that the model had reached its optimal state for this specific dataset. This behavior of the model’s convergence indicates that the model could avoid both underfitting and overfitting, having a balance between bias and variance. The dataset used for training purposes was carefully curated to include a balanced presentation of both malicious and benign vibrations. This was critical to ensure that the model would not develop a bias toward either class. The data was preprocessed to extract relevant features such as vibration frequency, amplitude and temporal patterns. These features were crucial for the model as they enabled it to identify subtle anomalies indicative of malicious activity. During the training process, a batch size of 32 was used to ensure computational efficiency while maintaining a high level of granularity in the learning process. The learning rate was set to an initial value of 0.001 and changed dynamically using a learning rate scheduler. This approach helped in finetuning the model’s weight updates, preventing oscillations and ensuring smooth convergence. The dataset is separated into two parts: 80% for training and 20% for testing and validating performance. Figure 5 displays the confusion matrix for the training of the model on the clean dataset (without any environmental vibrations). To validate the model’s performance, we have used a number of metrics. These include accuracy, precision, recall, and F−1score. While the accuracy of 99% is a standout metric, precision and recall scores are equally important in the context of identifying malicious vibrations. High precision indicates that false positives are minimized, which is important for minimizing unnecessary alarms. Likewise, high recall shows the model’s capability of identifying the majority of malicious events, ensuring comprehensive protection of the optical fiber infrastructure. The F−1score balances the precision and recall, giving further evidence of the model’s effectiveness for this task. The high F−1score aligns well with the accuracy metric, indicating that the model performs consistently across different forms of evaluation methods. Figure 6 shows the classification scores obtained from the ML model, designed to detect malicious vibrations in optical fiber networks. As can be seen, all the key performance metrics, that is, precision, recall, and F−1score, have high scores. Particularly, the training phase demonstrated impresFig. 7. Confusion matrix for testing on background environmental noise 2025 International Conference on Optical Network Design and Modeling (ONDM) Fig. 8. High-risk event response in network with alternate path provisioning by the open controller sive performance with precision, recall, and F−1scores of 1.00 or 0.99 for most classes. During testing, the Orange class showed a slight decrease in precision (0.87) and recall (0.90), indicating some challenges in accurately identifying this category amidst noise. Nevertheless, the overall results confirm the model’s strong performance and its robustness in detecting critical vibrations, raising timely alerts to prevent fiber damage. Finally, Figure 7 displays the confusion matrix for the tested model (pre-trained) applied to the noisy dataset (which is unseen), where the model achieved accuracy as high as 95%. Despite the presence of noise, from environmental fingerprints, the misclassifications were minimal, with a false positive rate for detecting malicious vibrations of approximately 3.5%, resulting in fewer false alarm, and a false negative rate (missed detections) of 9.4%. V. CONCLUSION AND FUTURE WORK In conclusion, integrating machine learning techniques with SOP monitoring shows an effective solution for detecting malicious vibrations in optical fiber networks. The results obtained from this experiment demonstrate that the proposed ML model can accurately identify critical vibrations, even in the presence of significant environmental noise. This ability of the model illustrates the potential of ML-driven approaches to enhance the security and resilience of optical networks. Additionally, we will compare the suggested ML model with other time-series models (such as GRU and Transformers). To further improve network resilience, the implementation of a real-time ML model is required. This type of model would allow continuous monitoring of SOP variations and the prediction of critical vibrations, allowing for swift responses to potential threats. By integrating advanced sensing technologies with AI-based analytics, this framework would provide a robust and low-cost approach to protecting optical networks from physical intrusions. As a future extension of this research, we propose focusing on assessing the feasibility of deploying this approach in realworld scenarios. This step will be critical before transitioning to full-scale implementation. As a requirement of this progression, the proposed framework will be applied to an actual heterogeneous optical network, as shown in Figure 8. It will be a three node ring network, which, will involve creating a seamless integration with the Network Management System. The framework will be able to analyze SOP data in real time using ML, evaluate potential risks, issue alerts to the open controller and process autonomous network repairs to enhance resilience. ACKNOWLEDGMENTS This work has been supported from the project PNRRNGEU (MUR–DM117/2023), and from the EU’s Horizon Europe research and innovation program under GA No. 101092766 (ALLEGRO Project) and DN NESTOR GA No. 101119983. REFERENCES [1] H. Awad, F. Usmani, E. Virgillito, R. Bratovich, R. Proietti, S. Straullu, R. Pastorelli, and V. Curri. A machine learning-driven smart optical network grid for earthquake early warning. pages 1–6, 2024. [2] R. Sifta, P. Munster, P. Sysel, T. Horvath, V. Novotny, O. Krajsa, and M. Filka. Distributed fiber-optic sensor for detection and localization of acoustic vibrations. Metrology and Measurement Systems, vol. 22(No 1):111–118, 2015. [3] C. Natalino, M. Schiano, A. Di Giglio, L. Wosinska, and M. Furdek. Experimental study of machine-learning-based detection and identification of physical-layer attacks in optical networks. Journal of Lightwave Technology, 37(16):4173–4182, 2019. [4] Jesse E. Simsarian and Peter J. Winzer. Shake before break: Per-span fiber sensing with in-line polarization monitoring. pages 1–3, 2017. [5] K. Abdelli, J. Yeon Cho, F. Azendorf, H. Griesser, C. Tropschug, and S. Pachnicke. Machine-learning-based anomaly detection in optical fiber monitoring. Journal of Optical Communications and Networking, 14(5):365–375, 2022. [6] K. Abdelli, M. Lonardi, J. Gripp, D. Correa, S. Olsson, F. Boitier, and P. Layec. Anomaly detection and localization in optical networks using vision transformer and sop monitoring. pages 1–3, 2024. [7] S. Pellegrini, L. Minelli, L. Andrenacci, G. Rizzelli, D. Pilori, G. Bosco, L. Della Chiesa, C. Crognale, S. Piciaccia, and R. Gaudino. Overview on the state of polarization sensing: application scenarios and anomaly detection algorithms. J. Opt. Commun. Netw., 17(2):A196–A209, Feb 2025. [8] G Malik et al. Machine learning for predictive multi-event detection in fiber optic systems. 2025. [9] J. Pesic, E. Le Rouzic, N. Brochier, and L. Dupont. Proactive restoration of optical links based on the classification of events. In 15th International Conference on Optical Network Design and Modeling - ONDM 2011, pages 1–6, 2011. [10] Marco Lacidogna. Vibration detection using low cost optical sensing systems for geological applications. Thesis, 2023. [11] E. Ip, Yue-Kai Huang, G. Wellbrock, T. Xia, Ming-Fang Huang, T. Wang, and Y. Aono. Vibration detection and localization using modified digital coherent telecom transponders. Journal of Lightwave Technology, 40(5):1472–1482, 2022. [12] V. Lemaire, F. Boitier, J. Pesic, A. Bondu, St´ ephane Ragot, and F. Cl´ erot. Proactive fiber break detection based on quaternion time series and automatic variable selection from relational data. pages 26–42, 2020. [13] S. Cruzes. Failure management overview in optical networks. IEEE Access, 12:169170–169193, 2024. 2025 International Conference on Optical Network Design and Modeling (ONDM)