@INBOOK{Winiarski2026:i9302,
	author="{Winiarski, Piotr}",
	title="{Hybrid Telemetry Correlation Framework for XGS-PON Security Threat Classification}",
	year="2026",
	type="rozdział w monografii naukowej / referat",
	language="en",
	booktitle="{2026 26th International Conference on Transparent Optical Networks (ICTON)}",
	publisher="{Institute of Electrical and Electronics Engineers (IEEE)}",
	pages="1--4",
	doi="10.1109/ICTON71309.2026.11705347",
	url="https://ieeexplore.ieee.org/document/11705347/references#references",
	keywords="Passive optical networks; Monitoring; Security; Textile fibers; Machine learning; Modeling; Physical layer; Telemetry; ITU; Printing; XGS-PON; anomaly detection; cybersecuritY; EWMA",
	abstract="{This paper presents a machine learning-based security monitoring framework for XGS-PON (10-Gigabit-capable Symmetric Passive Optical Network) infrastructures, addressing the dual-threat landscape of physical-layer tampering and logical-layer cyberattacks. As high-capacity Fiber-to-the-Premises (FTTP) networks become central to critical infrastructure, their Point-to-Multipoint (P2MP) architecture necessitates a transition from siloed security models to a hybrid monitoring paradigm. The proposed three-tier framework utilizes Exponentially Weighted Moving Average (EWMA) for dynamic telemetry baselining, Isolation Forest for high-dimensional anomaly correlation, and Autoencoder Neural Networks for zero-day attack detection via reconstruction error. Experimental evaluation focuses on correlating physical parameters, including optical Rx Power and Forward Error Correction (FEC), with logical performance metrics such as packet loss and latency. Results demonstrate that logical attacks such as Distributed Denial-of-Service (DDoS) leave optical power signatures essentially undisturbed while causing severe service degradation; this physical-layer stability serves as the primary discriminator for threat classification. The framework, validated on real XGS-PON telemetry, provides a scalable and proactive defense mechanism for next-generation optical access networks compliant with ITU-T G. 9807.1 [1].}",
}