Resilient Anomaly Detection in Fiber-Optic Networks: A Machine Learning Framework for Multi-Threat Identification Using State-of-Polarization Monitoring

Abstract

We present a thorough machine-learning framework based on real-time state-of-polarization (SOP) monitoring for robust anomaly identification in optical fiber networks. We exploit SOP data under three different threat scenarios: (i) malicious or critical vibration events, (ii) overlapping mechanical disturbances, and (iii) malicious fiber tapping (eavesdropping). We used various supervised machine learning techniques like k-Nearest Neighbor (k-NN), random forest, extreme gradient boosting (XGBoost), and decision trees to classify different vibration events. We also assessed the framework’s resilience to background interference by superimposing sinusoidal noise at different frequencies and examining its effects on the polarization signatures. This analysis provides insight into how subsurface installations, subject to ambient vibrations, affect detection fidelity. This highlights the sensitivity to which external interference affects polarization fingerprints. Crucially, it demonstrates the system’s capacity to discern and alert on malicious vibration events even in the presence of environmental noise. However, we focus on the necessity of noise-mitigation techniques in real-world implementations while providing a potent, real-time mechanism for multi-threat recognition in the fiber networks.

1. Introduction

Optical networks serve as the critical infrastructure for enabling ultra-high-speed and high-capacity data transmission in contemporary telecommunication systems. The exponential surge in internet traffic, emerging 6G applications, and rising demand for high-bandwidth services necessitates the optimization of optical network performance and reliability [1]. Optical communication systems transmit exceptionally large volumes of data, including sensitive and confidential information, across long distances. As such, ensuring the integrity and reliability of data transmission is of paramount importance in maintaining secure and trustworthy communication infrastructures [2]. The use of pre-installed optical fiber infrastructures for environmental monitoring has garnered more attention in recent years due to the extensive deployment of optical fiber networks in both terrestrial and subsea scenarios [3,4,5].

Fiber-optic cables are intrinsically sensitive to environmental conditions like temperature, mechanical stress, and vibrations [6,7]. Distributed acoustic sensing (DAS) systems can detect dynamic events such as mechanical vibrations up to the kilohertz range, and are widely used for earthquake detection [8,9] and metropolitan monitoring [10,11]. As we know, optical fiber networks form the backbone of global connectivity, linking billions of users worldwide. Their indispensable function and inherent sensitivity, however, render them susceptible to a range of impairments, including fiber breaks, targeted physical tampering, unauthorized eavesdropping via fiber bending, and ambient mechanical vibrations [12,13]. Such perturbations can degrade the propagating optical signal, leading to severe network impairments, widespread service outages, and breaches of data confidentiality. To provide early warnings for situations that endanger the health of optical fiber networks, monitoring the metropolitan environment is very essential. It is also critical to classify and localize the fiber anomalies and limit their impact by taking preventive measures proactively. Numerous studies have addressed the classification and localization of fiber anomalies; for instance, [14] utilized optical time-domain reflectometry (OTDR) trace analysis to detect and pinpoint disruptive events. In contrast, monitoring the state of polarization (SOP) offers greater sensitivity to subtle physical perturbations, as it directly captures alterations in the polarization state of light propagating through the fiber and can discriminate the type of anomaly. The study in [15] employs the angular speed of SOP (SOPAS) compared to a predetermined threshold to identify fiber impairments such as bending, shaking, or minor impact and other external disturbances. Meanwhile, the authors of [16] use transfer learning on SOP-derived data, while in [17], they investigate computer vision methodologies, transforming polarization measurements into visual formats or images to classify threats in optical networks.

Recent advancements in machine learning (ML) methodologies demonstrate significant promise in addressing the challenges of fiber event detection and localization [18]. Deep learning (DL) offers a powerful solution by learning complex patterns in high-dimensional SOP data. In order to identify and locate fiber disruption in optical networks, recent research has used supervised and unsupervised deep learning. Detection and localization of reflective fiber events caused by connectors or splices, multi-task long short-term memory (LSTM), and convolutional neural networks (CNNs) (first proposed in [19]) have been suggested in [20,21], providing precise detection and location even at low signal to noise ratio (SNR). The study in [22] introduced a one-dimensional neural network (1D-CNN) for the identification of adversarial events in a noisy environment. In [14], an autoencoder is employed to detect anomalies in optical fibers, followed by an attention-based bidirectional gated recurrent unit (BiGRU) architecture to classify and accurately localize the events. The work in [23] uses the data clustering module (DCM) to analyze the patterns of the monitoring data and the convolutional autoencoder to extract features and clustering to locate the location.

Contemporary deep learning techniques employ neural networks for anomaly detection due to their significantly reduced inference time [24], compared to classic ML models; however, they necessitate a substantial amount of data and computational resources to achieve an acceptable level of accuracy. However, for our study, supervised classical ML methods provided efficient and practical solutions due to their low processing costs and reduced need for high-dimensional feature space.

Despite these advances, a cohesive and resilient framework for real-time SOP-based multi-threat detection remains underexplored. While prior work in [25,26,27] has used ML to detect eavesdropping and harmful vibration events in real fiber installations, our study proposes a machine learning-based framework that takes advantage of the angular speed and temporal evolution of SOP (SOPAS) to detect and classify multiple fiber anomalies, including malicious vibrations, overlapping physical disturbances, and fiber tapping events. Unlike previous research, we evaluate the robustness of this model by introducing synthetic noise (e.g., sinusoidal) to emulate real-world environmental interference and assess the classifier’s ability to distinguish between benign and malicious anomalies. Our key objective is to create a lightweight yet resilient SOP-based monitoring architecture that can trigger alerts or initiate rerouting protocols based on the severity of the detected anomaly, thus improving the self-healing and defensive capabilities of optical networks. This work builds upon and extends our previous contributions in the field [28,29,30], aiming to bridge the gap between experimental SOP monitoring and deployable anomaly detection systems.

2. State of Polarization (SOP) as a Sensing Mechanism

The SOP serves as a highly sensitive, real-time sensing mechanism for detecting mechanical disturbances in optical fiber networks. The orientation of the electric field as it traverses the fiber is referred to as the polarization state. Optical fiber sensors exhibit polarization sensitivity and are typically prone to polarization fading [31]. Monitoring the polarization state trajectory on the Poincaré sphere allows SOP analysis to detect minute birefringence shifts caused by temperature changes, traffic, and external mechanical disturbances (e.g., drilling vibrations). In laboratory experiments, polarimeters coupled with programmable vibration sources (typically 1–10 Hz) provide high-fidelity measurement of the stokes parameters. Each SOP recording consists of numerous variables, incorporating the temporal variation of stokes parameters [32]. Fluctuations in SOP may signify fiber fluctuations. Early detection of fiber damage or anomalies is made possible by monitoring these fluctuations. There are four stokes parameters ($S_0$, $S_1$, $S_2$, and $S_3$) which characterize the polarization state of electromagnetic waves, or light. $S_0$ represents the total intensity or power of the optical beam or light while the other three components, $S_1$, $S_2$, and $S_3$, are coordinate values in the coordinate system that a Poincaré sphere represents. $S_1$ is the difference in intensity between horizontally and vertically polarized light. $S_2$ is the difference in intensity between the diagonal (45°) and anti-diagonal (−45°). And $S_3$ represents the difference in intensity between left and right circular polarized components [33]. Any perfect polarization can be expressed as a point on the Poincaré sphere [5].

The time variation of the stokes parameters’ speed on the Poincar’e sphere at a specific angle is defined by SOPAS [34]. The formula is given by

$$\omega \left[k\right]=arccos\left({\displaystyle \frac{S_k·S_{k-1}}{\parallel S_k\parallel \parallel S_{k-1}\parallel }}\right)·{\displaystyle \frac{1}{T_s}}$$

(1)

where the sample period is denoted by $T_s$. The dot product of the stokes vectors at time k and time $k-1$ is represented by $(S_k·S_{k-1})$, which indicates the extent to which these two vectors point in the same direction. The magnitude of the two stokes vectors is represented by the denominator.

To quantify the rate of change of the polarization orientation between successive stokes vectors $S_{k-1}$ and $S_k$ throughout the sampling period $T_s$, the SOP angular speed, represented by the symbol $\omega \left[k\right]$, uses units of $\mathrm{rad}/\mathrm{s}$. The ratio of polarized to total light intensity in the fiber is known as the degree of polarization (DOP), and it is always 1. The strength of vibration is correlated with the SOPAS.

Polarization controllers are used to establish a desired polarization state in polarization-managed sensing networks. Standard optical fibers, on the other hand, cannot maintain this condition, leading to unexpected polarization at any point along the fiber instead of user-defined values [35]. However, SOP measurements in real-world installations have to deal with noise sources such as scattered ambient light, normalization problems in telemetry interfaces.

In this paper, we investigate the use of optical fiber as a sensing medium and present three distinct scenarios involving anomaly detection through the analysis of the SOP data obtained from a polarimeter. Machine learning techniques are used to classify these anomalies, which may indicate potential threats to network integrity. The identified scenarios are detailed in the following subsections. The experimental setup for the vibration generation is discussed in Section 3. Section 4 outlines the machine learning architecture implemented for vibration detection. In Section 5, we evaluate the model’s performance under varying vibration intensities and in the presence of additive noise, followed by a comparative analysis. The study concludes with key findings summarized in Section 6.

2.1. Eavesdropping

An adversary, known as a hacker, could compromise the physical layer of the telecommunications system to intercept private information and harm vendors. Fiber tapping is the predominant technique among the numerous fiber-tampering methods identified [36]. It involves macro-bending the fiber cable at a low curvature radius to compromise the total internal reflection condition that permits light propagation. The light then leaks from the fiber at the bending point, where it can be intercepted by an eavesdropping device. The communication system may undergo a minor power reduction [37,38] and a bending-induced change in SOP [39], both of which can be detected by an SOP detection system.

To replicate this phenomenon, we employed a commercial optical fiber identification (OFI) device that secures and significantly bends the fiber linked to a 13 km metropolitan cable [40]. A handgrip, when tightened, bends the internal fiber of the instrument to control clamping. Eavesdropping occurs when the equipment detects light leaking. Furthermore, it denotes the trajectory of the light leak, facilitating a hacker’s ability to extract data from the leaking light.

Figure 1 illustrates how bending has an adverse impact on the stokes parameters. Initial experiments were conducted with OFI securely fastened to the optical bench, separating it from outside influences, in order to describe the signature that the macro-bends had on the SOP. After 30 s of gentle clamping, the fiber was released. The $S_0$ component records the instantaneous power, and the polarimeter outputs the whole stokes vector. The outcomes of six tests are illustrated in Figure 1, where the behavior of the stokes parameters is evident for a clamp held for approximately 10 s. The instantaneous power gradually changes between levels over a period of about 1 s when the clamp is closed, exhibiting a sudden spike, respectively. The eavesdropping tests were repeated approximately 50 times to provide a more thorough understanding of the stokes parameters’ response.

We also computed the SOPAS deviation according to Equation (1). The higher peaks of the angular speed mean the parts when the clamp is closed, with the highest angular speed being 2.5 radians per second. In a real-world scenario, a malicious hacker would likely manipulate the optical fiber before connecting it to the device, rather than placing it firmly on a surface. In addition, the device would typically remain attached to the cable for several hours to maximize data intercept. These SOPAS and their temporal derivatives are integrated as key features for vibration event classification in our ML approach (Section 2.3).

2.2. Simultaneous Events

We also examined how polarization signatures appear when two disruptive events occur simultaneously. Every disrupting event has a distinct polarization signature. We generated several signatures to monitor the polarization state change on the Poincar’e sphere. These signatures were synthesized to capture the dynamic evolution of the polarization state.

Intentional or construction-site fiber shaking, as well as tapping (eavesdropping) into the fiber to leak private and sensitive information, is considered a hostile incursion that can mislead network operators. A sophisticated ML model is needed in these situations so that it can identify and distinguish between the events and notify the service providers. Identification is made more difficult by these overlapping disturbances, which calls for more advanced detection methods.

In this section, we investigated the use of ML-driven SOP analysis for the detection of overlapping anomalies in optical networks. Utilizing XGBoost [41], our model accurately classified overlapping fiber anomalies, which are further discussed in [30]. The results demonstrated that, for proactive network maintenance and enhanced fiber infrastructure security, ML is more accurate and dependable than traditional fault detection techniques.

For this experiment, we used a robotic arm that uses a frequency of 3 Hz and an angle of deviation 90° to move the fiber up and down for shaking. We manually tapped the fiber once every second to hit it. Because each event generates a unique polarization signature, we captured them using the stokes parameters, as shown in Figure 2. The pronounced peaks in these traces correspond to the physical tapping (fiber hits). However, the robotic arm’s coordinated action of shaking the fiber and hitting it was synchronized for the creation of overlapping events.

Following the collection of this data, we carried a few pre-processing procedures, and then fed the dataset into our model. The results, discussed in [30], concluded that XGBoost achieved higher accuracy than the other classifiers, as it effectively captured non-linear patterns and is computationally efficient. Therefore, it was chosen for further analysis. The model accurately predicted the data with an accuracy of 98%, and only misclassified 2.06% of overlap events.

This ML model enables real-time identification of multiple threat scenarios by effectively differentiating between benign vibrations and deliberate intrusions (e.g., tapping), owing to its training on overlapping tampering events and noise-augmented datasets. It provides a robust framework for enhancing network resilience against complex and evolving fault conditions.

2.3. State-of-Polarization-Based Vibration Monitoring

In this section, we will describe the complete architecture of the vibration monitoring system and the experimental setup through which the dataset was collected.

In Figure 3, we can observe the different levels of shaking and their corresponding signatures as represented by the stoke parameters. As the shaking increases, the range of variation in the stokes parameters decreases. In the noise-free data shown in Figure 3, for 10 Hz shaking, the value of $S_3$ component oscillates between 0.25 and 0.45, whereas it spans a wider range of 0.15–0.65 under 3 Hz excitation.

Upon introducing varying noise levels into the dataset, the polarization signatures, corresponding to each shaking frequency, exhibited noticeable shifts. For instance, Figure 4 illustrates a comparative analysis of the stokes parameter trajectories between the clean dataset and the dataset contaminated with 3 Hz noise, highlighting the distortion introduced by external perturbations. To gain a more granular understanding, each stokes parameter was individually analyzed in the figure to clearly visualize the impact and shift caused by the 3 Hz noise. The dotted lines indicate the fingerprints affected by added noise, while the solid lines represent the original, unaltered fingerprints.

3. Vibration Emulation and State-of-Polarization Sensing Setup

Each event produces a distinct polarization signature. To study these, we generated multiple signatures by tracking changes in the polarization state on the Poincaré sphere using stokes parameters. We used an Arduino-controlled robotic arm to generate the shaking of various frequencies. These events are explained in

Table 1. Categorization of vibration events.

Event Type	Severity Level	Description
No event	None	Normal operations with no impact on fiber integrity
Shaking (1 Hz)	Low	Ambient noise due to environmental activities
Shaking (3 Hz)	Moderate	Minor disturbances caused by nearby environment
Shaking (5 Hz)	High	Sustained mechanical stress
Shaking (10 Hz)	Critical	Critical intrusion

, where those that do not affect the fiber’s integrity are classified as “No event”. “Shaking (1 Hz)” are the ones that function as ambient sound and have a lower level of severity. “Shaking (3 Hz)” are moderately sensitive and can cause mild disturbances in the metropolitan fiber. Nonetheless, “Shaking (5 Hz) and Shaking (10 Hz)” are more sensitive to fiber integrity and require countermeasures. The vibration generation testbed is detailed in our earlier study [29]. A continuous-wave laser source emitting light at 1530 nm with 6 dBm power is launched into the sensing fiber. The testbed includes two segments of single-mode fiber (SMF), 8 km and 5 km in length, connected to an SMF section manipulated by the robotic arm. The Arduino-based arm is integrated into a custom-printed circuit board (PCB) along with its driver board and Arduino UNO R3 for improved stability. At the receiving end, an additional fiber spool is connected to a Novoptel PM1000 polarimeter, which captures the temporal evolution of stokes parameters to discern polarization fingerprints.

We set the sampling at 1500 samples per second. The averaging time exponent (ATE) is set to 16. The polarimeter analyzes the orientation of light scattered on the Poincaré sphere. SOPAS evaluations are generated by extrapolating the polarization state changes caused by the robotic arm. We recorded unique polarization signatures of vibrations, as outlined in the previous section, to differentiate between critical intensity levels. The experiments conducted by the robotic arm generated SOP and SOPAS data corresponding to each vibration level, which were subsequently utilized to train and evaluate our ML model.

4. Machine Learning Model Architecture

The machine learning architecture proposed in this study is purposefully designed to detect and classify mechanical anomalies in optical fiber networks by analyzing the temporal evolution of polarization states. The input data consist of time-series measurements of the stokes parameters and corresponding angular speed, sampled at a frequency of 1500 samples per second. This fine-grained temporal resolution enables the system to capture minute polarization fluctuations indicative of vibrational disturbances or external intrusions.

The input features taken for the training of the model were the stokes parameters ($S_1$, $S_2$, and $S_3$) and the SOPAS, and the dataset consists of the target column named “Label” with values corresponding to different classes. These were the features used to train the ML classifiers in this experiment. After identifying the ideal model, it was then tested on the unseen data with various noise levels. After saving and testing the ideal model on the datasets with noise, it was noticed that further enhancements to these features were necessary for that model to perform better on the datasets with varying noise levels. In addition to the input features, we have added rolling mean and standard deviation of the input features ($S_1$, $S_2$, and $S_3$, SOPAS), with window sizes of 500 and 1000. We first ran the experiment with 500 as the window size and then tried with 1000. Following the addition of both 500 and 1000, empirical evaluation revealed enhanced performance of the model when assessed on unseen data. Similarly, we tested incorporating lag features of the input variables and discovered that the model exhibits improved performance when these lag features are included up to the third order, therefore successfully capturing short-term temporal dependencies.

To enhance the model’s ability to capture temporal dynamics, the raw polarization data are transformed into a higher-dimensional feature representation. This is achieved by incorporating temporally shifted (lagged) instances of each stokes parameter and the SOPAS up to third order, thereby enabling the model to learn from recent temporal patterns and transitional behavior. In parallel, rolling statistical descriptors, including localized means and standard deviations, are computed over sliding windows to extract trend sensitive features while attenuating transient noise and fluctuations.

Each data instance is associated with a class label corresponding to the severity of the induced mechanical disturbance: No Event, Shaking at 1 Hz, 3 Hz, 5 Hz, or 10 Hz. The dataset is partitioned into training and testing sets using a conventional 80:20 split. This structured representation enables the application of supervised learning methods capable of identifying complex patterns in both clean and noisy environments.

Table 2. Features used for training the ML models.

Feature Type	Variable Type	Feature Examples
Input Features	$m_1$	$S_1$, $S_2$, $S_3$, $w\left[k\right]$
Rolling Mean (Win = 500, 1000)	$m_2,m_3$	$\mathrm{rolling}\_\mathrm{mean}\_\mathrm{S}1\_3,\dots ,\mathrm{rolling}\_\mathrm{mean}\_w\left[k\right]\_5$
Rolling Std Dev (Win = 500, 1000)	$m_4,m_5$	$\mathrm{rolling}\_\mathrm{std}\_\mathrm{S}1\_3,\dots ,\mathrm{rolling}\_\mathrm{std}\_w\left[k\right]\_5$
Lag Features (Lag = 1, 2, 3)	$m_6,m_7,m_8$	$\mathrm{lag}\_\mathrm{S}1\_1,\dots ,\mathrm{lag}\_w\left[k\right]\_3$

is a summary of the features considered for training the models on the clean dataset before they were tested on the unseen datasets. To identify trends and stability, rolling statistics such as mean ($m_2$, $m_3$) and standard deviation ($m_4$, $m_5$) are computed over two sliding windows, enabling the model to discern additional patterns for each window feature. Additionally, lag features ($m_6$, $m_7$, $m_8$) are used to assist the model in identifying temporal dependencies.

The resulting architecture is structured to support efficient training and inference, with a moderate computational footprint and compatibility with a range of classification models. Figure 5 illustrates the complete machine learning framework, including the training process, classifier integration, and real-time event classification. The flowchart outlines key steps such as data pre-processing, feature extraction, model training, and classification of new SOP data. After training, the classifier is used to assess the severity of unseen polarization events and generate alerts accordingly, enabling timely response to potential fiber anomalies. The subsequent section presents the supervised learning models evaluated within this framework, detailing their implementation, configuration parameters, and comparative performance.

4.1. Machine Learning Classifiers

To find the best classifier for our malicious vibrations classification task, we thoroughly examined a number of supervised machine learning techniques. We have chosen different classifiers from the Scikit-Learn package according to their performance metrics, utility, and effective predictability. We employed k-nearest neighbor (k-NN), decision trees, random forest (RF), and extreme gradient boosting (XGBoost) in our investigation, which are explained in detail below.

RF is a powerful supervised learning algorithm designed for both classification and regression problems. It operates by constructing an ensemble of decision trees, each trained on a randomly sampled subset of the training data through a bootstrap aggregation (bagging) process. In this study, we employed a forest consisting of 100 decision trees, each with a maximum depth limited to 6, to control model complexity and reduce the risk of overfitting. RF improves predictive performance by averaging the outputs of individual trees, which enhances generalization and mitigates variance. Additionally, it leverages dimensionality reduction and parallel computation, enabling faster training and more robust handling of high-dimensional data and noise [42].

The k-NN classifier assigns unlabeled data points to the class of the most similar labeled instances based on their proximity in the feature space [43]. The labels of the K-nearest patterns in the data space serve as the foundation for nearest neighbor techniques. Since it establishes how many neighbors to take into account while making predictions, the value of k is crucial in k-NN. A greater k can assist in smoothing out the predictions and lessening the impact of noisy data if the dataset contains significant outliers or noise. We selected the value of K to be in the range [5, 50] to ensure robust classification performance across varying data distributions.

Decision trees are a supervised classification technique that uses a tree-like decision model that depends on the dataset values [44]. A decision tree solves the problem by using the tree representation, where each leaf node represents a class label and the internal nodes of the tree represent the features. The decision tree can be used to represent any Boolean function on discrete attributes. We kept the depth of tree in our model to [3, 5, 10, 15, 20], to reduce overfitting.

XGBoost is an ensemble learning method that integrates predictions from numerous weak models for a more robust prediction. It uses a classification and regression tree (CART) as its primary learning [41]. It is also compatible with parallel processing, allowing one to train models on large datasets in a practical time frame. We have trained 150 decision trees with a learning rate of 0.4.

4.2. Evaluation Metrics

To evaluate the performance of our model, we used standard metrics derived from the confusion matrix namely: accuracy, precision, recall, and F-1 score. These metrics help quantify how well the model distinguishes between different event types, including No Event, Shaking—1 Hz, Shaking—3 Hz, Shaking—5 Hz, and Shaking—10 Hz.

4.2.1. Confusion Matrix

The confusion matrix is a fundamental evaluation tool in supervised learning, offering a comprehensive breakdown of classification outcomes. It contrasts the actual class labels against the predicted ones to assess the model’s ability to distinguish between multiple event types. The confusion matrix shows a tabular representation consisting of actual and predicted class labels, shown in

Table 3. Structure of confusion matrix.

	Predicted Positive	Predicted Negative
Actual Positive	TP	FN
Actual Negative	FP	TN

. Here, true positives (TP) and true negatives (TN) represent instances correctly classified as belonging or not belonging to a particular class, respectively. False positives (FP) correspond to instances incorrectly assigned to a class, while false negatives (FN) denote those that were wrongly excluded.

In our multi-class classification scenarios, where the classes represent discrete vibration levels including “No Event”, “Shaking—1 Hz”, “Shaking—3 Hz”, “Shaking—5 Hz”, and “Shaking—10 Hz”, the confusion matrix enables detailed per-class error analysis. By highlighting both correct predictions and misclassifications across all categories. The derived metrics from this matrix are elaborated in the subsequent sections to further quantify and compare the classification performance of different machine learning algorithms evaluated in this study.

4.2.2. Accuracy

Accuracy is a global metric that quantifies the proportion of correct predictions made by the model over the entire dataset, encompassing both correctly identified positive and negative instances across all classes. It is computed using the following formula:

$$\mathrm{Accuracy}={\displaystyle \frac{{\sum }_{i=1}^{n}T{P}_i}{{\sum }_{i=1}^n(T{P}_i+F{P}_i+F{N}_i+T{N}_i)}}$$

(2)

4.2.3. Precision

Precision measures the exactness of the model in predicting a particular class. It is defined as the proportion of true positive predictions relative to the total number of positive predictions (both correct and incorrect) for that class:

$${\mathrm{Precision}}_i={\displaystyle \frac{T{P}_i}{T{P}_i+F{P}_i}}$$

(3)

High precision indicates a low rate of false positives, which is particularly crucial in our case, where incorrect alarms could lead to unnecessary service interruptions.

4.2.4. Recall

Recall, also known as sensitivity or true positive rate, evaluates the model’s ability to correctly identify all actual instances of a class. It is expressed as:

$${\mathrm{Recall}}_i={\displaystyle \frac{T{P}_i}{T{P}_i+F{N}_i}}$$

(4)

A high recall value implies that the model is effective in capturing all relevant instances of a class, which is vital for early detection of critical events such as high-risk vibrations within the fiber.

4.2.5. F-1 Score

The F-1 score provides a balanced assessment by harmonically combining both precision and recall for each class. It is especially useful when there is a trade-off between precision and recall, and a single metric is needed to summarize model performance:

$${\mathrm{F}\text{-}1}_i=2\times {\displaystyle \frac{{\mathrm{Precision}}_i\times {\mathrm{Recall}}_i}{{\mathrm{Precision}}_i+{\mathrm{Recall}}_i}}$$

(5)

The F-1 score ranges from 0 to 1, with higher values indicating better balance between precision and recall.

4.2.6. AUC-ROC Curve

The area under the receiver operating characteristic curve (AUC-ROC) is used to evaluate the classification performance of ML models in identifying between classes across different decision thresholds. This graph plots the true positive rate (TPR) against the false positive rate (FPR) at various classification thresholds.

In our case of multi-class classification of detection of different anomaly events, we adopt the one-vs-rest (OvR) approach, where an ROC curve is computed for each class by treating it as the positive class and the rest as the negative class. The area under each ROC curve (AUC) then shows the model’s ability to distinguish that specific class from the others.

The TPR and FPR are defined as:

$$\mathrm{TPR}={\displaystyle \frac{TP}{TP+FN}},\mathrm{FPR}={\displaystyle \frac{FP}{FP+TN}}$$

(6)

The AUC value close to 1.0 indicates excellent class separability, whereas a value close to 0.5 suggests no better performance than random guessing of the model. AUC-ROC is particularly useful in our experiment as it provides insights into the model’s discriminative capability for each level of vibration event types. AUC-ROC is particularly useful in our context as it provides insight into the model’s discriminative capability for each vibration event type, independent of a fixed threshold of classification.

5. Performance Analysis of Machine Learning Model

This section provides a comprehensive analysis of the ML models used for vibration event classification in optical fiber networks, based on SOP dynamics. The evaluation is structured across clean and noise-augmented datasets to assess generalization and robustness.

5.1. Performance Evaluation of Model Classification Scores

Initially, all selected classifiers—random forest, XGBoost, k-NN, and decision tree—were trained and validated on a clean dataset comprising stokes parameters and SOPAS. To extract meaningful temporal patterns, we incorporated lag features (up to the third order) and rolling statistics (mean and standard deviation) as part of feature engineering.

Performance was measured using four standard metrics: Accuracy, Precision, Recall, and F-1 score, as shown in Figure 6. Random forest emerged as the most accurate classifier, achieving a near-perfect accuracy of 99.98%, followed by XGBoost and decision tree, while k-NN lagged with an accuracy of 95.08%.

Figure 7 illustrates the ROC curves of the four models trained and tested on the clean dataset. It is seen that the tree-based models, namely RF, XGBoost, and decision tree, all perform well as they all achieved an AUC score of 1.00. However, RF was better at distinguishing between the four labels in this experiment. This is because the curve for the RF is slightly higher than that for decision tree and XGBoost. This shows that the RF model is ideal for the prediction of different events compared to the other models.

Figure 8 presents the confusion matrices for all models evaluated on the clean dataset. These matrices illustrate how well each classifier predicted the five distinct event categories: No Event, and Shaking at 1 Hz, 3 Hz, 5 Hz, and 10 Hz. The RF classifier demonstrated exceptional classification performance across all categories, misclassifying only a handful of instances. It was particularly effective in differentiating between adjacent frequencies like 3 Hz and 5 Hz, which often produce overlapping SOP variations. RF constructs several decision trees using random bootstrap samples and feature subsets in this vibration classification scenario, then aggregates the results, which consequently reduces model variance and mitigates overfitting. Because of this bagging technique, RF is particularly resistant to noise and outliers in the angular speed and stokes characteristics. This highlights the model’s capability to discern subtle temporal and polarization-based patterns in the signal.

Conversely, the k-NN classifier exhibited significant misclassifications, particularly between classes with closer frequency spectra, such as 5 Hz and 10 Hz, and also struggled to separate No Event from low-frequency ambient vibrations. These misclassifications are attributed to k-NN’s reliance on local proximity in high-dimensional feature space, which is sensitive to noise and feature overlap. XGBoost and decision tree performed comparably well, though slightly below RF, with a few more errors in higher frequency shake classifications.

To quantitatively assess the impact of noise on model performance, we evaluated the RF classifier on datasets with 1 Hz, 3 Hz, and 5 Hz superimposed noise, shown in Figure 9. The resulting classification accuracies were 87.41%, 70.50%, and 58.99%, respectively. These figures reflect the expected trend of decreasing accuracy with increasing noise intensity, as noise distorts polarization fingerprints and makes class boundaries less distinguishable. However, even under severe 5 Hz noise, the model demonstrated a commendable ability to recognize patterns associated with high-risk events. These results demonstrate the model’s generalization capability and resilience to environmental distortions.

Figure 10 shows the ROC curves of the RF model tested on the clean and datasets consisting of different levels of noise. The experimental results show that the RF model had achieved a significant AUC score of 1.00. Likewise, its strong predictive capabilities are demonstrated with a high performance on the 1Hz dataset with an AUC score of 0.99, whereas the scores on the 3 Hz and 5 Hz datasets are 0.90 and 0.92, respectively. These results demonstrate that, with the introduction of various noise levels, the RF model remains robust across different sampling rates. The model demonstrated robust classification abilities across many data quality situations.

Figure 11 illustrates the confusion matrices for these noise levels, offering a more granular view of how noise affects event classification. At 1 Hz noise, the model shows minimal confusion across most classes, with high diagonal dominance indicating correct predictions. For 3 Hz noise, a slight increase in misclassifications is observed, especially between neighboring classes such as 3 Hz and 5 Hz, highlighting the growing difficulty in differentiating similar event signatures under mild interference. Under 5 Hz noise, classification errors are more prominent, particularly for lower-frequency events like No Event and 1 Hz, which are often misclassified due to overlapping polarization signatures. Nevertheless, high-risk events such as Shaking—10 Hz continue to exhibit strong predictive consistency, reflecting the model’s robustness in identifying critical anomalies even under severe environmental perturbations.

To further analyze per-class sensitivity, Figure 12 provides a side-by-side comparison of classification accuracy for each event class across clean and noisy datasets. The first bar in each group corresponds to the clean dataset with no added noise, serving as a performance baseline. As superimposed noise is introduced at increasing levels (1 Hz, 3 Hz, and 5 Hz), a progressive yet non-linear decline in classification accuracy is observed. Notably, the accuracy drops with increasing noise levels, particularly for the 1 Hz and 5 Hz shaking events. This is due to the superimposition of 3 Hz and 5 Hz noise frequency overlapping more destructively with the polarization signatures of some of the frequency events, thus creating confusion for the classifier. The sharp decline for 5 Hz shaking at this noise level further validates this, indicating that moderate-frequency noise has a disproportionately disruptive effect on the model’s prediction accuracy.

Low-frequency classes Shaking—1 Hz, 3 Hz, and 5 Hz show significant degradation as noise increases, due to their inherently subtle signal characteristics being easily masked. Meanwhile, Shaking—10 Hz maintains relatively stable accuracy, demonstrating that high-frequency events generate more distinguishable SOP patterns, which remain robust even under harsh conditions. This analysis affirms the model’s practical viability in real-world deployments where environmental interference is inevitable.

Overall, the RF model shows potential for deployment in fiber anomaly detection scenarios, delivering both high accuracy and noise robustness.

5.2. Performance Evaluation of ML Models Using Weighted Metrics

While conventional evaluation metrics, such as accuracy, precision, recall, and F-1 score, offer valuable insights into model performance, they do not account for computational efficiency, a crucial factor for real-time or resource-limited deployments. To bridge this gap, we introduced a weighted performance metric (WPM) that jointly considers classification accuracy and training time. This metric enables a comprehensive evaluation of models under varying operational priorities. The WPM for a given model i is defined as:

$$\begin{array}{c}\hfill {\mathrm{WPM}}_i=w_1·{\mathrm{Accuracy}}_i-w_2·{\displaystyle \frac{{\mathrm{TrainingTime}}_i}{max\left({\mathrm{TrainingTime}}_i\right)}}\end{array}$$

(7)

Here, $w_1$ and $w_2$ represent the user-defined weights for accuracy and training efficiency, respectively, and are constrained such that $w_1+w_2=1$. The training time of each model is normalized by the maximum training time among all models to ensure fair comparison. To explore how model performance changes under different priorities, we evaluated the WPM across five weight configurations: from complete emphasis on accuracy $(w_1=1.0, w_2=0.0)$, to equal weighting $(w_1=0.5, w_2=0.5)$, and up to full emphasis on the training efficieny $(w_1=0.0, w_2=1.0)$. The resulting WPM scores are visualized using a radar plot, defined by the Figure 13, where each axis corresponds to a specific weight combination and the radial extent denotes the WPM value for a particular classifier.

Under full emphasis on accuracy $(w_1=1.0)$, the radar plot reveals that RF and XGBoost attain the highest WPM values. This reflects their strong classification performance in terms of accuracy and F-1 score. In contrast, k-NN and decision tree, while computationally efficient, are penalized due to their relatively lower predictive accuracy. As the weight gradually shifts to include training time $(w_1=0.75)$, a divergence begins to appear. While XGBoost maintains a strong WPM due to its short training time, RF experiences a more noticeable reduction, given its relatively heavier computational requirements. When accuracy and training time are weighted equally $(w_1=0.5, w_2=0.5)$, the distribution of WPM scores begin to even out across models. XGBoost maintains a stable performance, while k-NN and decision tree demonstrate improved WPMs as their shorter training durations now carry greater influence. Meanwhile, RF sees a more significant decline due to the increasing penalty from its longer training time. In scenarios where computational efficiency becomes dominant $(w_1=0.25, w_2=0.75)$, the WPM values for k-NN and decision tree increase further. These models, although less accurate, are now favored due to their lightweight training profiles. Conversely, the WPM for RF continues to drop sharply, while XGBoost exhibits only a marginal decline, indicating its relatively balanced profile between accuracy and efficiency. Finally, when training time is the sole priority $(w_2=1.0)$, decision tree achieves the highest WPM value, followed closely by k-NN. These models have minimal training time and are thus strongly rewarded under this weighting scheme. Both random forest and XGBoost, despite their strong classification capabilities, are significantly penalized under this configuration due to their heavy computational demands.

The radar plot clearly illustrates the trade-offs between accuracy and training time, making it a useful tool for selecting models based on specific deployment needs. By adjusting the weight given to each factor, this method allows for more practical and flexible model evaluation than relying on a single metric alone.

In the end, we have summarized the performance of four classification models (RF, XGBoost, k-NN, DT) under various noise conditions in

Table 4. Performance evaluation of classification models under different noise frequencies.

	Accuracy (%)				F-1 Score
Scenario	RF	XGBoost	k-NN	DT	RF	XGBoost	k-NN	DT
No noise	99.98	99.93	95.08	99.72	0.9998	0.9993	0.9507	0.9972
1 Hz noise	87.5	-	-	-	0.873	-	-	-
3 Hz noise	70.50	-	-	-	0.699	-	-	-
5 Hz noise	58.99	-	-	-	0.578	-	-	-

. While all models perform well in the absence of noise, RF has the highest accuracy (99.98%) and F1-score (0.9998). The performance of RF significantly declined when the noise frequency increased from 1 to 5 Hz, according to our subsequent evaluation.

6. Conclusions

This work introduces a resilient ML framework for anomaly detection in optical networks using the SOP. The framework presented effectively identifies and classifies various threats, inlcuding eavesdropping, overlapping events, and different levels of external vibrations, by capturing and analyzing polarization fingerprints derived from polarimeter sensing. Through extensive experimentation, we demonstrated that supervised learning models, particularly random forest and XGBoost, achieve high classification accuracy (up to 99.98%) on clean datasets and exhibit strong resilience to environmental noise, maintaining reliable detection capabilities under noisy conditions. A key advantage of the proposed framework is its ability to differentiate between benign and malicious anomalies using SOP dynamics without requiring intrusive fiber instrumentation. Furthermore, the inclusion of a weighted performance metric allows for flexible model selection based on accuracy–efficiency trade-offs, making the system adaptable to different deployment scenarios.

The evaluation under realistic environmental conditions, such as mechanical disturbances or background noise, demonstrated the resilience of the framework. Despite the presence of background noise of various frequencies, the model performed reasonably well. This affirms its suitability for deployment in fiber environments where such interferences are common. Future research will focus on improving the system’s resilience to environmental interference through advanced signal processing techniques such as adaptive filtering and noise-aware feature extraction, enabling better isolation of meaningful SOP variations. Although the current framework employs computationally efficient classical machine learning models, additional optimization is required for embedded and latency-sensitive applications. Specifically, future work will explore lightweight model tuning and latency-aware feature refinement to reduce the inference time and memory footprint, facilitating seamless integration into real-time monitoring systems on resource-constrained platforms.