Hybrid Quantum-Classical GANs for the Generation of Adversarial Network Flows

Technical Summary: Hybrid Quantum-Classical GANs for the Generation of Adversarial Network Flows

Problem Statement
Classical Generative Adversarial Networks (GANs) have been utilized to generate adversarial network traffic capable of evading Intrusion Detection Systems (IDS). However, these classical approaches face significant limitations, including a heavy reliance on large, high-dimensional datasets, susceptibility to mode collapse, and high computational overhead. Furthermore, traditional IDSs struggle with the volume, dimensionality, and dynamic nature of modern network traffic. While quantum computing offers potential advantages through superposition and entanglement, its application in generating adversarial flows for IDS evasion remains an emerging field requiring validation under realistic constraints, such as limited qubit counts and hardware noise.

Methodology
The authors propose a Hybrid Quantum-Classical GAN (QC-GAN) framework designed to generate synthetic malicious network flows. The architecture consists of a quantum generator and a classical discriminator.

• Data Preparation: The study utilizes the UNSW-NB15 dataset. Due to the constraints of current quantum hardware (specifically the 4-qubit limit), a two-stage feature selection process was employed. Stage 1 used a multi-view ensemble (Random Forest, Mutual Information, and L1-regularized logistic regression) to screen features. Stage 2 applied Principal Component Analysis (PCA) to reduce redundancy. This resulted in a final 4-feature subset: synack, ct_state_ttl, sbytes, and smean.
• Quantum Generator: The generator employs a Variational Quantum Circuit (VQC) with 4 qubits. It utilizes Angle Encoding to map classical latent noise vectors into quantum states via $RY$ rotations. A novel component, Successive Unitary Data Injection (SUDAI), is integrated into the circuit. Unlike standard single-shot encoding, SUDAI staggers the injection of the latent vector across multiple variational layers, allowing the circuit to explore a broader range of states without increasing qubit count. The circuit includes trainable variational layers with $RX$ and $RZ$ rotations and ring-topology entanglement via CNOT gates.
• Measurement and Post-Processing: The quantum state is measured by calculating the expectation values of the Pauli-Z operator, producing a classical feature vector. This vector is refined by a classical post-processing network before being fed to the discriminator.
• Classical Discriminator: The discriminator is a Multi-Layer Perceptron (MLP) trained to distinguish between real traffic from the UNSW-NB15 dataset and the synthetic flows generated by the QC-GAN.
• Experimental Setup: Three models were trained and compared: a Classical GAN, a "clean" QC-GAN, and a QC-GAN simulating hardware noise (depolarizing, bit-flip, and amplitude-damping channels). The models were evaluated against Random Forest (RF), XGBoost, and 1-D Convolutional Neural Network (CNN1D) classifiers.

Key Contributions and Results

• Parameter Efficiency: The QC-GAN achieved competitive performance with only 372 total parameters (16 quantum + 356 classical), significantly fewer than the Classical GAN's 1,412 parameters.
• Convergence and Stability: The QC-GAN models demonstrated stable training dynamics with no observed mode collapse. The SUDAI architecture proved resilient to hardware-level noise, with the noisy model converging successfully despite gradient perturbations.
• Distribution Fidelity vs. Evasion Capability:
  • Distribution Metrics: The Classical GAN outperformed the quantum models on aggregate distribution metrics (MMD, Wasserstein Distance), likely due to its higher parameter count allowing for a closer approximation of the overall data distribution.
  • Evasion Performance: In terms of IDS evasion, the QC-GANs showed distinct advantages depending on the classifier. Against XGBoost, the clean QC-GAN achieved an Attack Success Rate (ASR) of 41.1%, surpassing the Classical GAN's 35.6% despite having 3.8 times fewer parameters. The noisy QC-GAN also outperformed the Classical GAN (40.6% vs. 35.6%).
  • Classifier Sensitivity: The quantum models were less effective against RF and CNN1D compared to XGBoost. The authors attribute the success against XGBoost to the quantum latent space's ability to generate flows that are statistically realistic but fall outside the dense feature regions where tree-based classifiers like XGBoost make decisions.
• Role of Noise: Contrary to the assumption that noise is purely detrimental, the simulated hardware noise acted as a regularizer. The noisy QC-GAN achieved the lowest Mean Squared Error (MSE) on the test set (0.703) and maintained high evasion rates, suggesting that imperfect near-term quantum hardware can still generate effective adversarial examples.

Significance and Claims
The paper claims to demonstrate that hybrid quantum-classical adversarial generators can effectively bypass classical IDSs using significantly fewer parameters than their classical counterparts. The study highlights that:

1. Quantum Advantage in Specific Contexts: Quantum latent spaces can generate flows that evade specific types of classifiers (notably tree-based models like XGBoost) by exploring feature space regions not densely populated by real attacks, even with limited qubits.
2. Feasibility on NISQ Hardware: The threat of quantum-enhanced adversarial attacks is not limited to future fault-tolerant quantum computers; it is a present-day risk achievable with current Noisy Intermediate-Scale Quantum (NISQ) devices.
3. Resilience of SUDAI: The Successive Unitary Data Injection architecture provides a robust method for encoding data in quantum generators, maintaining expressiveness and stability even under simulated hardware noise.

The authors conclude that while classical GANs may better approximate global data distributions, QC-GANs offer a potent, parameter-efficient alternative for generating adversarial traffic, necessitating a re-evaluation of IDS defenses to be quantum-resilient. Future work is suggested to include testing on different datasets, varying qubit counts, and evaluating hardened IDS models.