⚛️ quantum physics

Cyber Risk Scoring with QUBO: A Quantum and Hybrid Benchmark Study

This paper introduces a novel QUBO-based framework for quantitative cyber risk assessment and demonstrates through large-scale benchmarks that while pure quantum annealing faces hardware connectivity limitations, hybrid quantum-classical solvers offer a promising and scalable alternative for identifying stable risk configurations in complex IT infrastructures.

Original authors: Remo Marini, Riccardo Arpe

Published 2026-04-22

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Remo Marini, Riccardo Arpe

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: Why This Matters

Imagine your company's computer network is a giant, bustling city. In this city, there are houses (workstations), power plants (servers), and banks (databases). Everything is connected by roads (internet cables and internal networks).

The Problem:
Traditionally, security experts look at this city and say, "That house looks a bit run-down, so it's a 'Medium Risk'." They check boxes on a list. But this misses the big picture. If a fire starts in that run-down house, it doesn't just stay there. It spreads to the neighbor, then to the power plant, and suddenly the whole city is in trouble. Old methods are like looking at a map and trying to guess where the fire will go without understanding the wind or the fuel. They are static, slow, and often wrong.

The Solution:
The authors of this paper built a new "City Simulator" using a special math tool called QUBO (Quadratic Unconstrained Binary Optimization). Think of QUBO as a super-smart, high-speed calculator that can instantly figure out how a problem (like a cyberattack) will ripple through the entire city, finding hidden paths that human eyes can't see.

How the Simulator Works (The "Magic" Math)

The researchers didn't just look at one building; they looked at how every building talks to every other building. They created a "Risk Score" for every node in the network.

Imagine the network is a group of people holding hands.

The Initial Risk: Some people are already sick (vulnerable).
The Spread: If a sick person holds hands with a healthy one, the healthy one might get sick too.
The Math: The QUBO model calculates the perfect state of the city. It asks: "If we let the risk spread naturally, who ends up sick, and how bad is it?"

They tested this on two types of cities:

A Small Model City: To tune the engine.
A Realistic 255-Node City: A complex mix of offices, servers, and security guards (firewalls).
A Giant 800-Node City: To see if the engine could handle a metropolis.

The Three "Drivers" (Solvers)

To run this simulation, they needed a "driver" to solve the math. They tested three different drivers:

1. The Classic Driver (Classical Solver)

Who it is: A very experienced, old-school driver (like a Tabu Search algorithm).
How it drives: It drives carefully, checking every possible route one by one to find the best path.
The Result: It's great for small towns. But as the city gets bigger and the roads get more crowded, this driver gets stuck in traffic. It takes forever to find the answer, and sometimes it gets lost in a "local minimum" (a small valley that looks like the bottom, but isn't the real bottom).

2. The Quantum Driver (Quantum Annealing)

Who it is: A futuristic, teleporting driver.
How it drives: Instead of driving over hills, it can "tunnel" through them. It can instantly jump to the bottom of the valley without climbing up first.
The Problem: The car is too big for the roads. The current "Quantum Roads" (hardware) are very narrow and disconnected. To fit the giant city map onto this small car, they have to shrink the map so much that it becomes a mess. The time spent shrinking the map (embedding) takes longer than the drive itself. So, for big cities, this driver is actually slower and can't even fit the whole map in the car.

3. The Hybrid Driver (The Best of Both Worlds)

Who it is: A team effort. The Classic Driver does the heavy lifting, but they call the Quantum Driver for help when they hit a really tricky, steep hill.
How it drives: The Classic Driver handles the big picture and the long roads. When they hit a confusing intersection, they ask the Quantum Driver to "tunnel" through it to see if there's a shortcut.
The Result: This is the winner. It avoids the traffic jams of the Classic Driver and the "too-big-for-the-car" problem of the Quantum Driver. It finds the deepest, most stable valleys (the best solutions) faster and more reliably.

Key Discoveries

1. Risk is Contagious (and Invisible)
The model showed that risk doesn't just spread to your immediate neighbor. It spreads through "invisible" paths. A server might be safe, but because it's connected to a specific router that is connected to a risky laptop, the server becomes vulnerable. The QUBO model found these hidden chains of infection that human inspectors would never spot.

2. The "Stability" Test
The researchers did a cool experiment: they ran the simulation, took the result, and ran it again, and again, 20 times.

The Classic Driver: Every time they ran it, the risk got worse and worse until the whole city was on fire. It found a "shaky" solution that fell apart under pressure.
The Hybrid Driver: It found a solution that stayed the same every time. It found a "rock-solid" valley where the risk settled down and didn't explode. This means the Hybrid method gives you a more trustworthy, stable security plan.

3. Security Layers Work
When they added "security guards" (firewalls) between different layers of the city, the risk didn't spread as wildly. The model proved that breaking a network into smaller, guarded sections is a smart move.

The Bottom Line

This paper proves that we can use advanced math (QUBO) to predict cyber risks much better than old checklists.

Old way: "This computer looks risky."
New way: "If this computer gets hacked, here is exactly how the fire spreads to the bank, the power plant, and the backup servers, and here is the most stable way to stop it."

While pure "Quantum" computers are still a bit like a Ferrari that can't fit on the highway yet, the Hybrid approach (mixing old and new tech) is the smartest way to drive today. It gives us a clearer, more stable, and more accurate map of our digital safety.

1. Problem Statement

Assessing cyber risk in complex, modern IT infrastructures is increasingly difficult due to the dynamic and interconnected nature of digital systems. Traditional risk assessment methods suffer from several critical limitations:

Static and Qualitative: They rely on checklists or subjective ratings (e.g., low/medium/high) that fail to capture systemic interdependencies.
Lack of Propagation Modeling: Standard frameworks (like CVSS) assess individual vulnerabilities but ignore how risk propagates through network topology.
Scalability Issues: As infrastructure size grows, the number of interdependencies explodes, making brute-force modeling computationally prohibitive for classical optimization.
Inaccuracy: External cyber ratings often correlate poorly with actual incident data because they miss the emergent behavior of risk spreading across control and information flows.

The authors propose a shift from static snapshots to a quantitative, dynamic model that captures how vulnerabilities interact and propagate across a network.

2. Methodology

The core of the proposed framework is Quadratic Unconstrained Binary Optimization (QUBO), a mathematical formulation compatible with both classical metaheuristics and quantum annealing.

A. Infrastructure Modeling

The authors tested the model on two types of networks:

Benchmark Topology: A simple, interpretable 4-layer network (workstations, network, servers, databases) used for initial calibration.
Realistic Simulation: A complex 255-node layered infrastructure comprising:
- 100 workstations (in 10 isolated subnetworks).
- 30 network nodes, 20 servers, and 15 databases.
- 30 security nodes (firewalls/IDS) acting as barriers between layers.
- Attributes: Each node has an Initial Score (IS), update status, and internet exposure flag.

B. The QUBO Formulation

The risk assessment is framed as minimizing a global Hamiltonian ( $H$ ), which is a weighted sum of five specific components designed to model risk dynamics:
$H = \lambda_1 H_1 + \lambda_2 H_2 + \lambda_3 H_3 + \lambda_4 H_4 + \lambda_5 H_5$

$H_1$ (Stability): Keeps final risk scores close to initial scores to prevent unrealistic drift.
$H_2$ (Connectivity Penalty): Penalizes nodes with many connections, acknowledging that highly connected nodes are inherently riskier.
$H_3$ (Neighbor Influence): Ensures a node's final score is influenced by the average score of its neighbors (propagation).
$H_4$ (Exposure Flags): Penalizes connections involving nodes with critical flags (e.g., missing updates or internet exposure).
$H_5$ (Critical Node Protection): Strongly penalizes the reduction of risk for nodes that started with high criticality, ensuring high-risk nodes remain high-risk.

C. Solvers Compared

The study benchmarks three distinct solving approaches on the same QUBO problem:

Classical: Tabu Search (a metaheuristic that avoids local minima using memory).
Quantum: Pure Quantum Annealing (using D-Wave hardware).
Hybrid: A workflow where the classical solver handles the bulk of optimization, delegating difficult sub-problems to the Quantum Processing Unit (QPU).

3. Key Contributions

A Generalizable QUBO Model: A rigorous, tunable mathematical framework that encodes local vulnerabilities, connectivity penalties, and propagation dynamics into a single Hamiltonian.
First Comparative Benchmark: The first study to directly compare classical, quantum, and hybrid solvers for cyber risk scoring at scale (up to 800 nodes).
Recursive Stability Analysis: A novel diagnostic technique where the QUBO minimization is applied iteratively. This tests whether a solver finds a robust minimum (stable) or a fragile one that diverges upon re-optimization.
Discovery of Non-Trivial Paths: The model reveals risk propagation paths that are invisible to visual inspection, showing how risk spreads through structural interdependencies rather than just direct links.

4. Key Results

A. Risk Propagation Dynamics

Risk Redistribution: The model tends to smooth out isolated high-risk nodes by distributing the risk to neighbors, creating a more homogeneous risk landscape.
Central Node Impact: Risk concentrates on central, highly interconnected nodes.
Hidden Hotspots: In "stressed" scenarios (amplified connectivity of a single vulnerable node), the model identified secondary hotspots and non-obvious propagation paths that visual inspection missed.

B. Solver Performance & Scalability

Classical (Tabu Search): Efficient for small-to-medium networks but scales poorly (near-exponential time growth) as network density increases due to the rugged energy landscape.
Quantum (Pure Annealing): Failed to scale beyond ~50 nodes. The embedding overhead required to map dense cyber-risk QUBOs onto the sparse connectivity of current QPU hardware (e.g., D-Wave Pegasus graph) is a massive bottleneck, rendering pure quantum approaches impractical for large infrastructures.
Hybrid: Scaled effectively up to 800 nodes. Execution time remained stable and user-defined. It produced solutions of comparable quality to classical methods but with a slight tendency toward more conservative (lower) risk estimates.

C. Solution Stability (Recursive Minimization)

This was the most significant finding regarding solution quality:

Classical Instability: When the classical solution was re-minimized recursively, the mean risk diverged, eventually saturating at the maximum possible risk (10). This suggests classical solvers often get trapped in shallow, unstable local minima.
Hybrid Stability: Hybrid solvers frequently converged to stable configurations where repeated minimization produced no further changes. This indicates hybrid methods explore the energy landscape more effectively, finding deeper, more resilient minima.

5. Significance and Conclusion

Practical Viability: The study concludes that while pure quantum annealing is currently hindered by hardware connectivity constraints, Hybrid Quantum-Classical workflows are the most promising path forward. They offer the scalability of classical methods with the superior exploration capabilities of quantum annealing.
Strategic Insight: The framework proves that cyber risk is an emergent property of topology. It validates that layered defenses (segmentation) effectively contain risk and highlights that highly connected nodes require prioritized monitoring.
Future Outlook: The QUBO approach provides a unifying mathematical language for cyber risk that can be adapted to various domains (IoT, Cloud, Cyber-Physical Systems). Future work should focus on integrating real-time threat intelligence and validating the model against production incident data.

In summary, the paper demonstrates that QUBO-based modeling offers a superior, dynamic view of cyber risk compared to static methods, and that hybrid solvers currently represent the most robust and scalable solution for assessing risk in large, complex IT infrastructures.