A method for intrusion detection in an optical fiber communication network. The method includes at a first location on an optical fiber segment, receiving a set of multiple optical signals having wavelengths differing from each other, measuring received signal power for each of the received multiple optical signals, and repeating the receiving and the measuring steps. Each optical signal in the repeated steps has same wavelength as corresponding received optical signal in the initial steps. The method further includes computing a signal power loss between each received optical signal in the repeated set and the corresponding optical signal in the initial set, fitting a curve of signal power loss vs. wavelength to the computed signal power losses using a statistical analysis, and if the signal power loss of the curve over a preselected wavelength band is at least as great as a preselected minimum loss level, providing intrusion notification.