Threat detection models in cybersecurity must keep up with shifting traffic, strict feature budgets, and noisy hardware, yet even strong classical systems still miss rare or borderline attacks when the data distribution drifts. Small, near-term quantum processors are now available, but existing work rarely shows whether quantum components can improve end-to-end detection under these unstable, resource constrained conditions rather than just adding complexity. We address this gap with a hybrid architecture that uses a compact multilayer perceptron to compress security data and then routes a few features to 2-4 qubit quantum heads implemented as quantum support vector machines and variational circuits. Under matched preprocessing and training budgets, we benchmark these hybrids against tuned classical baselines on two security tasks, network intrusion detection on NSL-KDD and spam filtering on Ling-Spam datasets, and then deploy the best 4-qubit quantum SVM to an IBM Quantum device with noise-aware execution (readout mitigation and dynamical decoupling). Across both datasets, shallow quantum heads consistently match, and on difficult near-boundary cases modestly reduce, missed attacks and false alarms relative to classical models using the same features. Hardware results track simulator behavior closely enough that the remaining gap is dominated by device noise rather than model design. Taken together, the study shows that even on small, noisy chips, carefully engineered quantum components can already function as competitive, budget-aware elements in practical threat detection pipelines.
Threat detection models in cybersecurity must keep up with shifting traffic, strict feature budgets, and noisy hardware, yet even strong classical systems still miss rare or borderline attacks when the data distribution drifts. Small, near-term quantum processors are now available, but existing work rarely shows whether quantum components can improve end-to-end detection under these unstable, resource constrained conditions rather than just adding complexity. We address this gap with a hybrid architecture that uses a compact multilayer perceptron to compress security data and then routes a few features to 2-4 qubit quantum heads implemented as quantum support vector machines and variational circuits. Under matched preprocessing and training budgets, we benchmark these hybrids against tuned classical baselines on two security tasks, network intrusion detection on NSL-KDD and spam filtering on Ling-Spam datasets, and then deploy the best 4-qubit quantum SVM to an IBM Quantum device with noise-aware execution (readout mitigation and dynamical decoupling). Across both datasets, shallow quantum heads consistently match, and on difficult near-boundary cases modestly reduce, missed attacks and false alarms relative to classical models using the same features. Hardware results track simulator behavior closely enough that the remaining gap is dominated by device noise rather than model design. Taken together, the study shows that even on small, noisy chips, carefully engineered quantum components can already function as competitive, budget-aware elements in practical threat detection pipelines.
Under tight feature and compute budgets, classical threat detection pipelines often degrade on near-decision-boundary events. Small quantum processors are now available, but existing work inadequately shows whether quantum components improve end-to-end threat detection under the above resource constrained conditions. This paper tries to address this gap with a hybrid architecture that uses a compact multilayer perceptron layer to compress the information in data and then routes the processed features to a few qubit quantum heads implemented in quantum support vector machine (QSVM) and variational quantum circuit (VQC) models. On a simulation platform, we benchmark these hybrid models against classical models with comparable parameter budgets on two representative cybersecurity tasks, network intrusion detection on NSL-KDD dataset and spam filtering on Ling-Spam dataset. To validate their precision on real quantum hardware, we deploy the best 4-qubit QSVM model on an IBM Quantum device with noise-aware execution, evaluated on a smaller sub-dataset. In the results, shallow quantum heads consistently match, and on difficult near-boundary cases modestly reduce missed attacks and false alarms compared to classical models using the same features. Hardware validation results track the simulation behavior closely enough that the remaining gap is dominated by device noise rather than model design. Furthermore, we conduct adversarial attacks to test the robustness of one QSVM model. Taken together, the study shows that even on small, noisy devices, carefully engineered quantum components may function as competitive, budget-aware components in practical cyber threat detection applications.
The application and assessment of quantum-based anomaly detection models in cybersecurity are examined in this work. The efficacy of quantum machine learning approaches for detecting several cyber threats, including Denial of Service (DoS), Remote-to-Local (R2L), and botnet penetration, using two well-known intrusion detection datasets: NSL-KDD and CICIDS2017. Angle and amplitude encoding techniques are worn to preprocess and instruct traditional data into quantum-readable formats, making it compatible with quantum circuits. Due to the present constraints of Noisy Intermediate-Scale Quantum (NISQ) devices, the models are developed using Qiskit, using parameterized quantum layers via the TwoLocal ansatz, and simulated on classical hardware using Qiskit Aer. Metrics are used to compare performance to traditional machine learning models, such as Support Vector Machines (SVM), Random Forests (RF), and Multilayer Perceptions (MLP). The quantum SVM (QSVM) performs better in classification on both datasets, according to the results, indicating that quantum computing may be used to improve anomaly detection in cybersecurity applications.
Modern cyberattacks are increasingly complex, posing significant challenges to classical machine learning methods, particularly when labeled data is limited and feature interactions are highly non-linear. In this study we investigates the potential of hybrid quantum-classical learning to enhance feature representations for intrusion detection and explore possible quantum advantages in cybersecurity analytics. Using the UNSW-NB15 dataset, network traffic is transformed into structured feature vectors through classical preprocessing and normalization. Classical models, including Logistic Regression and Support Vector Machines with linear and RBF kernels, are evaluated on the full dataset to establish baseline performance under large-sample conditions. Simultaneously, a quantum-enhanced pipeline maps classical features into variational quantum circuits via angle encoding and entangling layers, executed on a CPU-based quantum simulator, with resulting quantum embeddings classified using a classical SVM. Experiments show that while classical models achieve higher overall accuracy with large datasets, quantum-enhanced representations demonstrate superior attack recall and improved class separability when data is scarce, suggesting that quantum feature spaces capture complex correlations inaccessible to shallow classical models. These results highlight the potential of quantum embeddings to improve generalization and representation quality in cybersecurity tasks and provide a reproducible framework for evaluating quantum advantages as quantum hardware and simulators continue to advance.
Intrusion Detection Systems (IDSs) are a cornerstone of modern cybersecurity; however, their performance is increasingly constrained by high-dimensional network traffic and the scalability limitations of classical machine learning approaches. Quantum Machine Learning (QML) has recently emerged as a promising paradigm by leveraging quantum feature spaces and hybrid quantum–classical optimization. In this work, we present a unified and reproducible benchmarking framework for QML-based intrusion detection under realistic Noisy Intermediate-Scale Quantum (NISQ) constraints. The proposed framework integrates hybrid Quantum Neural Networks (QNNs) and Quantum Support Vector Machines (QSVMs) within a consistent experimental pipeline, enabling a systematic comparison of quantum models, embedding strategies, and dimensionality reduction techniques. Experiments are conducted on the NSL-KDD benchmark dataset for both binary (normal versus attack) and multiclass intrusion detection tasks. Multiple quantum embedding strategies, including angle, amplitude, and Instantaneous Quantum Polynomial (IQP) embeddings, are evaluated in conjunction with PCA-based dimensionality reduction to analyze trade-offs between expressivity, circuit complexity, and computational cost. The proposed models are benchmarked against strong classical baselines under identical preprocessing and evaluation conditions. The results demonstrate that QNN- and QSVM-based IDS models achieve competitive and, in several scenarios, superior performance compared to classical approaches, particularly in multiclass settings characterized by nonlinear and imbalanced data distributions. In addition, we provide an in-depth analysis of scalability limitations, training complexity, and NISQ feasibility, highlighting practical considerations for real-world deployment. To ensure full reproducibility, all implementation details, datasets, and experimental configurations are publicly available at: https://github.com/raidanis/QML-IDS-NSLKDD. These findings position hybrid QML as a promising complementary paradigm for next-generation intrusion detection systems, particularly in low-dimensional and high-complexity feature spaces.
The growing complexity and velocity of cyber threats in high-security environments such as defense, critical infrastructure, and intelligence networks necessitates a paradigm shift in threat detection capabilities. Traditional cybersecurity systems, including those enhanced by classical machine learning algorithms, often struggle to process and classify massive volumes of heterogeneous and encrypted data in real time. This shortcoming is particularly evident in the context of advanced persistent threats (APTs), polymorphic malware, and insider attacks, which require rapid adaptation and heightened sensitivity to anomalous behavior.Quantum Machine Learning (QML), an emerging interdisciplinary field at the intersection of quantum computing and artificial intelligence, presents a promising avenue for augmenting threat detection mechanisms. Leveraging quantum phenomena such as superposition and entanglement, QML models offer potential advantages in processing speed, pattern recognition, and feature space transformation that can outperform their classical counterparts in high-dimensional data analysis. This paper explores the application of QML to threat detection in high-security networks, proposing a hybrid quantum-classical framework that integrates quantum-enhanced classifiers such as quantum support vector machines and variational quantum circuits into existing detection pipelines.The study outlines a technical overview of quantum computing principles relevant to cybersecurity, critically evaluates existing detection architectures, and presents simulation-based case studies to assess performance metrics, including detection accuracy and false positive rates. It further examines the limitations of current quantum hardware, algorithmic constraints, and emerging ethical and operational considerations. The findings suggest that while QML is still constrained by hardware maturity and integration complexity, it holds transformative potential for proactive, intelligent, and adaptive cyber defense systems in high-stakes environments. This research contributes to ongoing efforts to future-proof cybersecurity infrastructure against both classical and post-quantum threat landscapes.
Machine learning Intrusion detection systems (IDS) fail with large feature spaces and imbalanced attack data. At the same time, current quantum devices are limited by noise and small qubit counts. In this work, we explore a simple hybrid approach in which quantum circuits are used only for feature transformation, while a classical model performs the final classification. Normalized NSL-KDD traffic records are first reduced by principal component analysis (PCA), then encoded into quantum states and processed by a low-depth variational quantum circuit (VQC). The measured outputs form a compact feature vector that is fed to a support vector machine (SVM). On the NSL-KDD dataset, the proposed VQC+SVM model reaches 80.9% accuracy and an F1-score of 0.814, which is higher than PCA+SVM (73.0%) and autoencoder+SVM (75.7%). An ablation study over different circuit depths and qubit counts shows that a 4-qubit, 3-layer circuit provides the most stable performance under NISQ-like conditions.