Intrusion detection systems must balance predictive quality, robustness, and computational cost, yet the role of quantum representations under NISQ constraints remains unclear. This paper investigates whether quantum principal component analysis (QPCA) can provide useful features for IDS without relying on claims of end-to-end quantum superiority. We evaluate PCA- and QPCA-based pipelines combined with Logistic Regression, SVM, and Random Forest, and include a QPCA→VQC branch as a comparative quantum arm. Experiments on CICIDS2017 and NSL-KDD under nisq preset and scaled preset use simulator-based quantum execution, multi-seed evaluation, Wilcoxon–Holm tests, bootstrap confidence intervals, and cost analysis. Results show no universal advantage of QPCA, but selective ranking gains: ROC-AUC improves from 0.5397 to 0.8772 (CICIDS2017) and from 0.7453 to 0.8063 (NSL-KDD), both with corrected significance under matched data budgets. Overall, QPCA is most useful as a representation enhancer under NISQ-compatible, not hardware-validated, constraints.
Intrusion detection systems must balance predictive quality, robustness, and computational cost, yet the role of quantum representations under NISQ constraints remains unclear. This paper investigates whether quantum principal component analysis (QPCA) can provide useful features for IDS without relying on claims of end-to-end quantum superiority. We evaluate PCA- and QPCA-based pipelines combined with Logistic Regression, SVM, and Random Forest, and include a QPCA→VQC branch as a comparative quantum arm. Experiments on CICIDS2017 and NSL-KDD under nisq preset and scaled preset use simulator-based quantum execution, multi-seed evaluation, Wilcoxon–Holm tests, bootstrap confidence intervals, and cost analysis. Results show no universal advantage of QPCA, but selective ranking gains: ROC-AUC improves from 0.5397 to 0.8772 (CICIDS2017) and from 0.7453 to 0.8063 (NSL-KDD), both with corrected significance under matched data budgets. Overall, QPCA is most useful as a representation enhancer under NISQ-compatible, not hardware-validated, constraints.
Machine learning Intrusion detection systems (IDS) fail with large feature spaces and imbalanced attack data. At the same time, current quantum devices are limited by noise and small qubit counts. In this work, we explore a simple hybrid approach in which quantum circuits are used only for feature transformation, while a classical model performs the final classification. Normalized NSL-KDD traffic records are first reduced by principal component analysis (PCA), then encoded into quantum states and processed by a low-depth variational quantum circuit (VQC). The measured outputs form a compact feature vector that is fed to a support vector machine (SVM). On the NSL-KDD dataset, the proposed VQC+SVM model reaches 80.9% accuracy and an F1-score of 0.814, which is higher than PCA+SVM (73.0%) and autoencoder+SVM (75.7%). An ablation study over different circuit depths and qubit counts shows that a 4-qubit, 3-layer circuit provides the most stable performance under NISQ-like conditions.
Network intrusion detection systems (NIDS) must classify high-dimensional, heavily imbalanced traffic flows under tight operational constraints, and the flow features produced by modern capture tools routinely exceed the qubit budgets available on today’s noisy intermediate-scale quantum (NISQ) hardware. Existing quantum machine-learning (QML) detectors typically either assume that every extracted feature can be encoded on a dedicated qubit or apply generic dimensionality reduction that is blind to the downstream quantum encoder; in both cases the qubit budget — the binding constraint on real devices — never drives which features are encoded, and evaluation is frequently confined to ideal statevector simulation that omits shot noise, depolarizing error, and readout confusion. This paper presents ANHQ-IDS, an adaptive, noise aware hybrid quantum intrusion-detection framework that makes the qubit budget a first-class design constraint. A resource-constrained feature-selection stage scores candidate features through a composite objective jointly balancing mutual-information relevance, inter-feature redundancy, cross-split stability, and an explicit quantum-encoding cost, and greedily selects a subset sized to a target qubit budget rather than fixed a priori. The retained features are embedded through parameterized angle and second-order (ZZ) feature maps and classified by a hardware-efficient variational quantum classifier (VQC) trained with gradient-free optimizers (COBYLA and SPSA) under finite-shot sampling. To characterize behaviour under realistic hardware conditions, the classifier is evaluated on a statevector reference and under synthetic depolarizing and readout-error models, and benchmarked on CIC-IDS2017 against classical baselines (logistic regression, random forest, support vector machine) using a leakage-resistant train/validation/test protocol. On a class-balanced CIC-IDS2017 benchmark, the ZZ-encoded VQC attains macro-F1 0.766 and ROC-AUC 0.853 under exact simulation — exceeding logistic regression (0.502) and approaching a support-vector baseline, while a random forest remains strongest (0.964); performance degrades gracefully under depolarizing and readout noise, consistent with the predicted (1−p) contraction. All preprocessing, feature-selection, and quantum-training components are released as a reproducible Qiskit package with fixed seeds and recorded circuit-resource metadata (qubits, depth, gate and parameter counts).
Intrusion Detection Systems (IDSs) are a cornerstone of modern cybersecurity; however, their performance is increasingly constrained by high-dimensional network traffic and the scalability limitations of classical machine learning approaches. Quantum Machine Learning (QML) has recently emerged as a promising paradigm by leveraging quantum feature spaces and hybrid quantum–classical optimization. In this work, we present a unified and reproducible benchmarking framework for QML-based intrusion detection under realistic Noisy Intermediate-Scale Quantum (NISQ) constraints. The proposed framework integrates hybrid Quantum Neural Networks (QNNs) and Quantum Support Vector Machines (QSVMs) within a consistent experimental pipeline, enabling a systematic comparison of quantum models, embedding strategies, and dimensionality reduction techniques. Experiments are conducted on the NSL-KDD benchmark dataset for both binary (normal versus attack) and multiclass intrusion detection tasks. Multiple quantum embedding strategies, including angle, amplitude, and Instantaneous Quantum Polynomial (IQP) embeddings, are evaluated in conjunction with PCA-based dimensionality reduction to analyze trade-offs between expressivity, circuit complexity, and computational cost. The proposed models are benchmarked against strong classical baselines under identical preprocessing and evaluation conditions. The results demonstrate that QNN- and QSVM-based IDS models achieve competitive and, in several scenarios, superior performance compared to classical approaches, particularly in multiclass settings characterized by nonlinear and imbalanced data distributions. In addition, we provide an in-depth analysis of scalability limitations, training complexity, and NISQ feasibility, highlighting practical considerations for real-world deployment. To ensure full reproducibility, all implementation details, datasets, and experimental configurations are publicly available at: https://github.com/raidanis/QML-IDS-NSLKDD. These findings position hybrid QML as a promising complementary paradigm for next-generation intrusion detection systems, particularly in low-dimensional and high-complexity feature spaces.
ABSTRACT The amount of cyber threats is growing at an exponential rate, and intelligent network intrusion detection systems (NIDS) that can cope with high dimensional and complex network data, is essential. Traditional machine‐learning (ML) approaches might not be as effective to identify complex hidden correlations between traffic attributes and at identifying advanced and unseen attacks. In this paper we suggest a classical–quantum hybrid kernel framework that enhances network intrusion detection. Using principal component analysis (PCA), network traffic features are normalized and dimensionality reduced to be compatible with noisy intermediate‐scale quantum (NISQ) devices, whilst preserving over 95% of the variance in the data. The classification is achieved by a fidelity‐based quantum kernel with a classical support vector machine(SVM). The proposed hybrid quantum kernel support vector machine (QK‐SVM)is tested using two datasets, CIC‐IDS2017 and CICIoT2023. Experimental results, achieving accuracy up to 98.1%, F1‐score up to 0.98, and anomaly detection rate of 97.6% with linear and RBF‐SVM baselines, are comparable to that of Random Forest. The results are based on the Qiskit Aer simulator and do not reflect the performance on actual quantum devices.
Quantum machine learning (QML) for network intrusion detection (NIDS) is routinely reported to reach near-perfect accuracy, yet the most rigorous studies find that well-tuned classical models remain competitive, and that apparent quantum gains may be artefacts of classical dimensionality reduction and implicit regularisation rather than genuine quantum effects. We ask not whether a quantum model can post a high accuracy, but how quantum the advantage really is. We present a unified, reproducible QML-IDS benchmark evaluating hybrid variational quantum circuits and quantum-kernel SVMs against five honestly-tuned classical baselines across four standard NIDS datasets (NSL-KDD, UNSW-NB15, CICIDS2017, NF-ToN-IoT-v2) under one leakage-controlled protocol, with an equal-budget feature view, imbalance- and calibration-aware metrics with significance testing, and a simulated NISQ noise sweep. We introduce a quantum-attribution audit (parameter-matched classical controls, a random-feature kernel, and a regularisation sweep) that quantifies how much of any gain is genuinely attributable to the quantum component. Tuned classical models (Random Forest, XGBoost) match or exceed the quantum models on aggregate detection on every dataset, and the audit attributes this to classical preprocessing and regularisation rather than quantum effects. Two advantages survive false-discovery-rate correction: the quantum-kernel SVM out-ranks its direct classical surrogate (a random-feature kernel) on AUPRC and ROC-AUC, and a small four-qubit hybrid out-detects the best classical baseline at the 1% false-positive operating point on the distribution-shifted NSL-KDD task (p = 0.005, BH q = 0.030). Code, seeds, and splits are released; our contribution stands whether quantum wins, ties, or loses.
Intrusion Detection Systems (IDS) rely on intelligent learning techniques to identify complex and evolving attack patterns within network traffic. This paper presents a comparative study of Support Vector Machines (SVM), Quantum Support Vector Machines (QSVM), and Variational Quantum Classifiers (VQC) in the context of intrusion detection. A unified evaluation framework is employed to compare these models based on feature representation, computational complexity, scalability, hardware requirements, and deployment feasibility. The analysis examines how QSVM and VQC utilize quantum feature mapping and parameterized quantum circuits to improve data representation capabilities. Nevertheless, their practical adoption remains limited by the constraints of current Noisy Intermediate-Scale Quantum (NISQ) devices, including hardware noise, restricted qubit resources, and scalability limitations. Conversely, SVM continues to be a dependable and scalable solution for present-day intrusion detection systems. The study further identifies the absence of a standardized framework for evaluating classical and quantum approaches as an important research gap. Overall, the findings suggest that hybrid quantum–classical learning frameworks provide the most realistic path toward adopting quantum machine learning for future cybersecurity solutions