## 4 Results
### Experiments and Analysis
#### 4.2.2 Comparative Experiments  
To evaluate the performance of the proposed network, we compare the proposed network to existing external intrusion detection methods and state-of-the-art deep learning networks, with the same training conditions, hyperparameters, and hardware environment as described at the beginning of Section 4.2.1. CNN: the model processes data by extracting local features through a convolutional layer and reducing the dimensionality through a pooling layer, and performs well in image recognition and signal processing. LSTM [44]: The long short-term memory (LSTM) network captures long-term dependencies in sequential data using input, forget, and output gates. It can address the vanishing gradient problem and is widely used in natural language processing and time series forecasting. GRU [45]: Gated Recurrent Units (GRUs) simplify RNNs by combining input and forget gates into a single update gate, reducing parameters and computational complexity. GRUs maintain sequence dependency modeling while improving training efficiency. Figure 14: The loss and accuracy curves for conditions using and not using the dilated convolution of parameter 3. (**a**) Loss curves; (**b**) accuracy curves. Figure 13: The loss function curves and performance of the model with four sets of parameters. (**a**) Loss function curves; (**b**) the accuracy and number of model parameters. CNN-LSTM-AM [46]: the model combines CNN for feature extraction, long short-term memory (LSTM) for temporal dependencies, and an attention mechanism (AM) to dynamically emphasize important features, enhancing the performance in external intrusion detection. Transformer [47]: this model is known for its self-attention mechanism, which effectively captures global relationships in sequences, making it suitable for time series analysis. 1D ResNet [42]: a one-dimensional adaptation of ResNet that uses residual blocks to address gradient vanishing in deep networks, effectively capturing complex temporal features. LCANet [33]: the model utilizes group- and depth-wise separable convolutions, channel shuffling, and multi-head self-attention to enhance feature extraction while minimizing parameters, demonstrating high efficiency and reliability in structural health monitoring. STFT+2 DResNet [42]: this applies STFT to convert signals into spectrograms, and then uses 2D ResNet to extract and classify features, combining frequency and temporal information for non-stationary signal analysis. CLDNN [25]: The model integrates CNN, LSTM, and DNN layers. CNN extracts local features, LSTM captures temporal dependencies, and DNN classifies, enabling comprehensive feature fusion for effective external intrusion detection. Figure 15 illustrates the confusion matrix of each model on the dataset. Compared to traditional deep learning methods, such as CNN, LSTM, ResNet, and the latest lightweight network, TEResNet demonstrates a superior performance in the detection task of both categories of signals (intrusion and non-intrusion signals). In particular, it shows a high sensitivity in the detection of intrusion signals (category 1). Table 4 and Figure 16 further quantify the performance metrics of each method, including accuracy, recall, precision, F1 score, number of model parameters, and inference speed. The poor performance of using CNN, LSTM, or GRU networks alone indicates that these single structures have difficulty adequately capturing the complex features of fiber vibration signals and networks, with a combination of multiple structures demonstrating a better performance in this task. Among the models with an accuracy higher than 90%, STFT+2 DResNet and CLDNN perform more prominently. STFT+2 DResNet successfully captures the frequency domain characteristics of the signal via STFT, as well as extracting the features via 2D ResNet. The CLDNN model, on the other hand, combines the CNN, LSTM, and DNN layers, and has a strong adaptive capability for modeling time series signals.