A method for detecting physical link intrusions in a network, the method comprising: monitoring a link delay signature associated with a physical link based on one-way link delay measurements obtained using at least one network tap (104, 106); determining whether a change in the link delay signature has met or exceeded a threshold value; and in response to determining that the change in the link delay signature has met or exceeded a threshold value, determining that a physical link intrusion has occurred, wherein one of the one-way link delay measurements for determining the change in the link delay signature is obtained by: transmitting a first packet from a first network device (108, 110); passively intercepting the first packet, transmitting a first copy of the first packet to the first network device (108, 110), and transmitting a second copy of the first packet to a second network device (108, 110); at the first network device (108, 110), recording a time of receipt of the first copy of the first packet as an origin timestamp; at the second network device (108, 110), recording a time of receipt of the second copy of the first packet as a receive timestamp; transmitting a second packet from the first network device (108, 110), the second packet including the origin timestamp; passively intercepting the second packet and transmitting a first copy of the second packet to the second network device (108, 110); at the second network device (108, 110), receiving the first copy of the second packet and extracting the origin timestamp from the first copy of the second packet; and calculating link delay from the first network device (108, 110) to the second network device (108, 110) using the origin timestamp and the receive timestamp. monitoring a link delay signature associated with a physical link based on one-way link delay measurements obtained using at least one network tap (104, 106); determining whether a change in the link delay signature has met or exceeded a threshold value; and in response to determining that the change in the link delay signature has met or exceeded a threshold value, determining that a physical link intrusion has occurred, wherein one of the one-way link delay measurements for determining the change in the link delay signature is obtained by: transmitting a first packet from a first network device (108, 110); passively intercepting the first packet, transmitting a first copy of the first packet to the first network device (108, 110), and transmitting a second copy of the first packet to a second network device (108, 110); at the first network device (108, 110), recording a time of receipt of the first copy of the first packet as an origin timestamp; at the second network device (108, 110), recording a time of receipt of the second copy of the first packet as a receive timestamp; transmitting a second packet from the first network device (108, 110), the second packet including the origin timestamp; passively intercepting the second packet and transmitting a first copy of the second packet to the second network device (108, 110); at the second network device (108, 110), receiving the first copy of the second packet and extracting the origin timestamp from the first copy of the second packet; and calculating link delay from the first network device (108, 110) to the second network device (108, 110) using the origin timestamp and the receive timestamp. transmitting a first packet from a first network device (108, 110); passively intercepting the first packet, transmitting a first copy of the first packet to the first network device (108, 110), and transmitting a second copy of the first packet to a second network device (108, 110); at the first network device (108, 110), recording a time of receipt of the first copy of the first packet as an origin timestamp; at the second network device (108, 110), recording a time of receipt of the second copy of the first packet as a receive timestamp; transmitting a second packet from the first network device (108, 110), the second packet including the origin timestamp; passively intercepting the second packet and transmitting a first copy of the second packet to the second network device (108, 110); at the second network device (108, 110), receiving the first copy of the second packet and extracting the origin timestamp from the first copy of the second packet; and calculating link delay from the first network device (108, 110) to the second network device (108, 110) using the origin timestamp and the receive timestamp.