Eavesdropping Detection and Classification in Passive Optical Networks Using Machine Learning

Passive Optical Networks (PONs) play a vital role in providing high-speed broadband access in the 5G and F5G generation. However, their shared nature makes them vulnerable to physical-layer attacks like fiber bending, tapping and fiber cut. The problem is more serious in high-density PONs, where high split ratios result in high optical loss and overlapping back-scattered light, making it difficult to distinguish small attacks from background noise. Contrary to most existing works that neglect class imbalance and signal interference in high-density networks, this paper proposes a robust hierarchical two-stage attack detection scheme. First, we employ a binary classifier to distinguish eavesdropping attacks from normal traffic. Then, a second stage focuses on the specific eavesdropping categories (C1–C4). To address the small amount of attack samples, SMOTE is utilized for oversampling the minority class, and PCA-SVM is used to refine feature selection. Finally, the output of both stages is combined using probability score to obtain reliable decision. The experimental results show the effectiveness of our approach, achieving a classification accuracy of 89.07%. When evaluated on the same data, it has shown superior results in comparison to conventional machine learning algorithms, including decision tree (86.3%), k-nearest neighbors (79%), logistic regression (60%), and Naïve Bayes (52.6%).