Stabilized quantum-enhanced SIEM architecture and speed-up through Hoeffding tree algorithms enable quantum cybersecurity analytics in botnet detection
Madjid Tehrani, Eldar Gunter Sultanow, William Johnston Buchanan, Malik Amir, Anja Jeschke, Mahkame Houmani, Raymond Chow, Mouad Lemoudden
For the first time, we enable the execution of hybrid quantum machine learning (HQML) methods on real quantum computers with 100 data samples and real-device-based simulations with 5000 data samples, thereby outperforming the current state of research of Suryotrisongko and Musashi from 2022 who were dealing with 1000 data samples and quantum simulators (pure software-based emulators) only. Additionally, we beat their reported accuracy of 76.8% by an average accuracy of 91.2%, all within a total execution time of 1687 s. We achieve this significant progress through two-step strategy: Firstly, we establish a stable quantum architecture that enables us to execute HQML algorithms on real quantum devices. Secondly, we introduce new hybrid quantum binary classifiers (HQBCs) based on Hoeffding decision tree algorithms. These algorithms speed up the process via batch-wise execution, reducing the number of shots required on real quantum devices compared to conventional loop-based optimizers. Their incremental nature serves the purpose of online large-scale data streaming for domain generation algorithm (DGA) botnet detection, and allows us to apply HQML to the field of cybersecurity analytics. We conduct our experiments using the Qiskit library with the Aer quantum simulator, and on three different real quantum devices from Azure Quantum: IonQ, Rigetti, and Quantinuum. This is the first time these tools are combined in this manner.
For the first time, we enable the execution of hybrid quantum machine learning (HQML) methods on real quantum computers with 100 data samples and real-device-based simulations with 5000 data samples, thereby outperforming the current state of research of Suryotrisongko and Musashi from 2022 who were dealing with 1000 data samples and quantum simulators (pure software-based emulators) only. Additionally, we beat their reported accuracy of 76.8% by an average accuracy of 91.2%, all within a total execution time of 1687 s. We achieve this significant progress through two-step strategy: Firstly, we establish a stable quantum architecture that enables us to execute HQML algorithms on real quantum devices. Secondly, we introduce new hybrid quantum binary classifiers (HQBCs) based on Hoeffding decision tree algorithms. These algorithms speed up the process via batch-wise execution, reducing the number of shots required on real quantum devices compared to conventional loop-based optimizers. Their incremental nature serves the purpose of online large-scale data streaming for domain generation algorithm (DGA) botnet detection, and allows us to apply HQML to the field of cybersecurity analytics. We conduct our experiments using the Qiskit library with the Aer quantum simulator, and on three different real quantum devices from Azure Quantum: IonQ, Rigetti, and Quantinuum. This is the first time these tools are combined in this manner.
For the first time, we enable the execution of hybrid machine learning methods on real quantum computers with 100 data samples and real-device-based simulations with 5,000 data samples, thereby outperforming the current state of research of Suryotrisongko and Musashi from 2022 who were dealing with 1,000 data samples and quantum simulators (pure software-based emulators) only. Additionally, we beat their reported accuracy of 76.8% by an average accuracy of 91.2%, all within a total execution time of 1,687 seconds. We achieve this significant progress through two-step strategy: Firstly, we establish a stable quantum architecture that enables us to execute HQML algorithms on real quantum devices. Secondly, we introduce new hybrid quantum binary classification algorithms based on Hoeffding decision tree algorithms. These algorithms speed up the process via batch-wise execution, reducing the number of shots required on real quantum devices compared to conventional loop-based optimizers. Their incremental nature serves the purpose of online large-scale data streaming for DGA botnet detection, and allows us to apply hybrid quantum machine learning to the field of cybersecurity analytics. We conduct our experiments using the Qiskit library with the Aer quantum simulator, and on three different real quantum devices from Azure Quantum: IonQ, Rigetti, and Quantinuum. This is the first time these tools are combined in this manner.
Hybrid quantum machine learning (QML) algorithms have potentials for current quantum computing technologies since only part of the model is computed by a quantum device. This paper proposes a novel hybrid quantum-classical deep learning model for cybersecurity application: domain generation algorithms (DGA)-based botnet detection. We analyzed our hybrid model’s performance compared with the classical model counterpart to investigate the quantum circuit’s effectivity as a layer in a deep learning model. We used four features of the Botnet DGA dataset: MinREBotnets, CharLength, TreeNewFeature, and nGramReputation_Alexa. The hybrid model’s quantum circuit is a combination of Pennylane’s embedding (Angle Embedding and IQP Embedding) and layers circuit (Basic Entangler Layers, Random Layers, and Strongly Entangling Layers). Also, we implemented noise models for assessing the applicability of the model for current Noisy Intermediate Scale Quantum (NISQ) technology. We found that in some cases, the hybrid model reached high performance (maximum accuracy up to 94,7% using n=100; 93,9% using n=1,000). We discovered that the combination of Angle Embedding and Strongly Entangled delivers high accuracy, superior to the classical deep learning model in n=100 experiments). However, the overall performance is still inferior for the rest cases compared to the classical deep learning model counterpart.
This study explores the application of quantum machine learning (QML) algorithms to enhance cybersecurity threat detection, particularly in the classification of malware and intrusion detection within high-dimensional datasets. Classical machine learning approaches encounter limitations when dealing with intricate, obfuscated malware patterns and extensive network intrusion data. To address these challenges, we implement and evaluate various QML algorithms, including Quantum Neural Networks (QNN), Quantum Support Vector Machines (QSVM), and hybrid Quantum Convolutional Neural Networks (QCNN) for malware detection tasks. Our experimental analysis utilized two datasets: the Intrusion dataset, comprising 150 samples with 56 memory-based features derived from Volatility framework analysis, and the ObfuscatedMalMem2022 dataset, containing 58,596 samples with 57 features representing benign and malicious software. Remarkably, our QML methods demonstrated superior performance compared to classical approaches, achieving accuracies of 95% for QNN and 94% for QSVM. These quantum-enhanced methods leveraged quantum superposition and entanglement principles to accurately identify complex patterns within highly obfuscated malware samples that were imperceptible to classical methods. To further advance malware analysis, we propose a novel real-time malware analysis framework that incorporates Quantum Feature Extraction using Quantum Fourier Transform, Quantum Feature Maps, and Classification using Variational Quantum Circuits. This system integrates explainable AI methods, including GradCAM++ and ScoreCAM algorithms, to provide interpretable insights into the quantum decision-making processes.
The growing complexity and velocity of cyber threats in high-security environments such as defense, critical infrastructure, and intelligence networks necessitates a paradigm shift in threat detection capabilities. Traditional cybersecurity systems, including those enhanced by classical machine learning algorithms, often struggle to process and classify massive volumes of heterogeneous and encrypted data in real time. This shortcoming is particularly evident in the context of advanced persistent threats (APTs), polymorphic malware, and insider attacks, which require rapid adaptation and heightened sensitivity to anomalous behavior.Quantum Machine Learning (QML), an emerging interdisciplinary field at the intersection of quantum computing and artificial intelligence, presents a promising avenue for augmenting threat detection mechanisms. Leveraging quantum phenomena such as superposition and entanglement, QML models offer potential advantages in processing speed, pattern recognition, and feature space transformation that can outperform their classical counterparts in high-dimensional data analysis. This paper explores the application of QML to threat detection in high-security networks, proposing a hybrid quantum-classical framework that integrates quantum-enhanced classifiers such as quantum support vector machines and variational quantum circuits into existing detection pipelines.The study outlines a technical overview of quantum computing principles relevant to cybersecurity, critically evaluates existing detection architectures, and presents simulation-based case studies to assess performance metrics, including detection accuracy and false positive rates. It further examines the limitations of current quantum hardware, algorithmic constraints, and emerging ethical and operational considerations. The findings suggest that while QML is still constrained by hardware maturity and integration complexity, it holds transformative potential for proactive, intelligent, and adaptive cyber defense systems in high-stakes environments. This research contributes to ongoing efforts to future-proof cybersecurity infrastructure against both classical and post-quantum threat landscapes.
Cyberattacks are increasing in sophistication. As a result, traditional cybersecurity systems based on classical computing and conventional deep-learning techniques are increasingly exhibiting limitations and vulnerabilities. Although deep-learning models offer substantial advantages over traditional methods for automated intrusion detection through large-scale security data analysis and pattern recognition, they suffer from notable constraints related to high-dimensional feature spaces, scalability, and stringent real-time inference requirements. This work proposes a quantum-enhanced deep learning (QEDL) framework for detecting and mitigating real-time cyberattack patterns. Quantum computing technologies—specifically quantum feature selection and quantum data encoding—are integrated into a classical–hybrid quantum deep-learning architecture. The quantum approximate optimization algorithm (QAOA) is employed for quantum feature selection to enable efficient identification of discriminative features from high-dimensional cybersecurity datasets. In addition, quantum data encoding exploits superposition and entanglement to process multiple complex inputs simultaneously. The resulting quantum feature representations are processed using parameterized quantum circuits (PQCs), followed by classical deep-learning layers for accurate threat classification. The proposed QEDL framework is evaluated using the CIC–IDS2017 dataset, and its performance is compared against classical deep-learning models and pure quantum neural networks. Experimental results demonstrate that, within the proposed hybrid quantum–classical framework, the QAOA-based feature selection strategy achieved higher classification performance than the evaluated classical feature selection methods under the reported experimental settings. In addition, the proposed framework exhibited improved generalization to previously unseen attacks. These findings suggest that the proposed hybrid quantum–classical framework is a promising approach for cyberattack detection under the experimental conditions considered in this study. The experiments in this study were simulated using IBM Aer backend, without physical quantum hardware. The results obtained in this study serve as a simulation-based proof of concept.
Quantum computing is a rapidly emerging field that leverages quantum properties, such as superposition and entanglement, for information processing, leading to the development of quantum information processing (QIP). Extending QIP into the domains of artificial intelligence and machine learning (ML) has given rise to quantum ML (QML quantum machine learning (QML) ). While classical ML algorithms excel at identifying patterns in datasets, QML quantum machine learning (QML) aims to integrate classical data processing capabilities with quantum-specific algorithms, utilizing quantum computing to address computationally intensive problems more efficiently. In this study, we implement QML quantum machine learning (QML) algorithms within the cybersecurity domain, focusing on their potential for advanced threat detection threat detection . We further investigate the performance variations of QML quantum machine learning (QML) models across different batch sizes to identify the optimal configuration for achieving the highest accuracy with a specified number of qubits. Additionally, we present a sophisticated approach to attack vector recognition by employing virtual machine memory introspection combined with quantum neural networks. By analyzing the relationship between batch sizes and the efficiency of QML quantum machine learning (QML) models, this research provides valuable insights into optimizing QML for cybersecurity applications.