🤖 AI

Quantum Computing for Network Security Classification: Near-Term Classification and Long-Term Memory Efficiency

This paper evaluates the potential of quantum computing for network security classification by demonstrating that near-term quantum-kernel SVMs offer competitive, dataset-dependent performance compared to classical baselines, while long-term quantum oracle sketching suggests significant advantages in memory efficiency for processing streaming data.

Original authors: Yuqing Li, Poonam Bala Nehru, Yunpeng Zhang, Danindu Gammanpilage, Xin Jin, Zeguan Wu, Junyu Liu

Published 2026-09-30

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Yuqing Li, Poonam Bala Nehru, Yunpeng Zhang, Danindu Gammanpilage, Xin Jin, Zeguan Wu, Junyu Liu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the digital world, network security acts as a constant filter, sifting through a flood of data to distinguish between harmless activity and malicious attacks. Security systems rely on classification, a process where computers learn to recognize patterns that signal danger, such as a distributed denial-of-service attack or an intrusion attempt. For years, these systems have been built on classical computing, using mathematical tools to measure how similar a new piece of data is to known threats. Recently, a new technology called quantum computing has entered the conversation. Unlike classical computers that process information in a linear sequence, quantum machines use the strange properties of subatomic particles to explore many possibilities at once. This potential has sparked interest in whether quantum computers could eventually make security systems faster or more accurate. However, the reality of this technology is still taking shape, and researchers are working to understand exactly where it fits in the current landscape and where it might lead in the future.

A team of researchers from the University of Pittsburgh and the University of Houston set out to test these ideas with a clear, two-part approach. They wanted to know if quantum computers could improve security classification right now, and if not, whether they might offer a different kind of advantage later on. To do this, they turned to three well-known collections of network traffic data: KDD Cup 1999, CICIDS2017, and BoT-IoT. These datasets contain records of normal network behavior mixed with various types of cyberattacks, providing a realistic testing ground. The researchers did not try to build a single, all-encompassing quantum security system. Instead, they broke the problem into two distinct experiments to see what each part of the technology could actually achieve.

In the first experiment, the team looked at the near term, asking if quantum computers could simply do a better job of sorting data than the best classical computers available today. They used a specific method called a support vector machine, which is a standard tool for classification that works by drawing a boundary between safe and unsafe data. They ran this tool twice: once using a classical mathematical function to measure similarity, and once using a quantum version of that function. To ensure a fair test, they fed both versions the exact same data, processed it in the exact same way, and used the exact same rules for making decisions. The results were not a simple victory for the new technology. On one dataset, the classical method was clearly stronger, drawing a more accurate line between normal and attack traffic. On another dataset, the quantum method performed better, capturing subtle patterns that the classical approach missed. On the third, both methods were nearly identical, with the quantum version showing a slight edge in one specific measure. The researchers concluded that quantum computing is not a universal upgrade that will automatically beat classical methods. Instead, its value depends entirely on the specific type of data being analyzed. In some cases, it is a competitive alternative; in others, the old methods remain superior.

The second experiment looked further into the future, focusing not on speed or immediate accuracy, but on how much memory a system needs to store its data. Security systems often have to process massive amounts of information, and storing every single detail requires enormous amounts of computer memory. The researchers explored a technique called quantum oracle sketching, which is a theoretical way to process data without keeping the entire dataset in memory at once. Instead of storing every number, this method builds a compact, approximate map of the data as it arrives, allowing a quantum computer to query the information later without needing the full original file. To test this, the team compared the memory size required by this quantum approach against two classical methods: one that stores data in a sparse, efficient format, and another that simply streams the data as it comes. They found that for the same level of accuracy, the quantum approach required a significantly smaller effective memory size than the classical method that stores the full sparse data. However, when compared to a simple streaming method that aggressively filters out rare details, the quantum advantage was less clear. This suggests that the true long-term promise of quantum computing for network security may not be in running calculations faster, but in allowing systems to handle huge volumes of data with far less memory overhead.

Together, these two experiments paint a nuanced picture of the technology's role. The immediate future does not hold a magic bullet where quantum computers replace classical ones for all security tasks. The performance is too dependent on the specific dataset and the nature of the threat. However, the long-term outlook offers a different kind of hope. Even if quantum computers do not always classify data more accurately today, their ability to access and process information with much smaller memory footprints could be a game-changer for handling the massive scale of future network traffic. The work suggests that the path forward is not about waiting for a single breakthrough, but about finding the right places where these machines can complement existing tools, either by offering a different way to measure similarity in specific scenarios or by solving the growing problem of data storage in an increasingly connected world.

Technical Summary: Quantum Computing for Network Security Classification

Problem Statement

While quantum computing has been explored in various network-security applications (e.g., intrusion detection, DDoS detection), there is a lack of systematic discussion regarding how quantum computing contributes to network-security classification across different time scales. Existing literature often focuses on specific hybrid models reporting high accuracy on particular datasets, without isolating whether the quantum component itself provides a competitive signal or if performance is driven by preprocessing and model architecture. Furthermore, the potential long-term value of quantum computing in this domain—specifically regarding memory efficiency for large-scale data processing—remains under-explored compared to immediate runtime speedup claims.

This paper addresses two distinct questions:

Near-Term: Are quantum-kernel Support Vector Machines (SVMs) competitive with classical baselines for practical network-security classification tasks when the data pipeline and SVM objective are controlled?
Long-Term: Can quantum methods offer a memory-size advantage for processing streaming classical security data, specifically through the lens of Quantum Oracle Sketching (QOS)?

Methodology

The study employs two complementary experiments using three standard network-security datasets: KDD Cup 1999, CICIDS2017, and BoT-IoT.

1. Near-Term Experiment: Controlled Kernel Comparison

The authors designed a controlled experiment to isolate the effect of the kernel function.

Task Definition:
- KDD Cup 1999 & CICIDS2017: One-class anomaly detection (trained only on benign samples, tested on mixed benign/attack).
- BoT-IoT: Supervised binary classification (DoS vs. DDoS), as the dataset lacked sufficient normal flows for stable one-class training.
Preprocessing Pipeline: Both classical and quantum models utilized identical data handling:
- Removal of identifiers and labels.
- One-hot encoding of categorical variables and standardization of numerical variables.
- Dimensionality reduction via TruncatedSVD to a shared $d$ -dimensional space (where $d$ equals the number of qubits: 12 for KDD/CICIDS, 10 for BoT-IoT).
- Scaling features to angle features in the range $[0, \pi]$ .
Model Comparison:
- Classical Baseline: SVM with a standard Radial Basis Function (RBF) kernel applied to the angle features.
- Quantum Model: SVM with a quantum fidelity kernel $K(a, b) = |\langle\phi(a)|\phi(b)\rangle|^2$ . The feature map used an entangled state with single-qubit $R_y$ rotations and nearest-neighbor phase interactions.
- Simulation: The quantum kernel matrix was computed via exact statevector simulation.
Metrics: ROC-AUC, Average Precision (AP), and Best F1 (threshold-optimized) across eight random seeds.

2. Long-Term Experiment: Memory Efficiency via QOS

This experiment evaluates a theoretical memory advantage using Quantum Oracle Sketching (QOS).

Concept: Instead of storing the full data matrix, QOS processes samples online to build an approximate quantum oracle, allowing coherent query access without retaining the entire dataset.
Procedure:
- A feature filtering threshold ( $min\_df$ ) was varied to remove rare features, creating matrices with different effective dimensions ( $D_{df}$ ) and sparsity.
- A ridge classifier was trained for each threshold to record accuracy.
Memory Size Proxies: Three estimates were compared at comparable accuracy levels:
1. Classical Streaming ( $S_{stream}$ ): $D_{df}$ (dimension of the filtered feature space).
2. Classical Sparse/QRAM ( $S_{sparse}$ ): $nnz(X_{df})$ (number of non-zero entries).
3. Quantum Oracle Sketching ( $S_{QOS}$ ): A formula scaling logarithmically with dimensions and sparsity: $2 \lceil\log_2(N + 2D_{df})\rceil + \lceil\log_2(s + 1)\rceil + 1$ .

Key Results

Near-Term Classification Performance

The results were dataset-dependent rather than universally superior for quantum methods:

KDD Cup 1999: The classical RBF OCSVM outperformed the quantum OCSVM across all metrics (ROC-AUC: 0.928 vs. 0.897). The authors suggest the RBF geometry better matched the reduced feature space, while the quantum kernel's periodic angle encoding may have distorted the radial structure.
CICIDS2017: The quantum OCSVM improved upon the classical baseline in all metrics (ROC-AUC: 0.667 vs. 0.621; Best F1: 0.700 vs. 0.679), indicating the fidelity kernel captured useful similarity structures for this heterogeneous dataset.
BoT-IoT: Both models approached saturation. While the classical model had slightly higher ROC-AUC and AP, the quantum model achieved a consistently higher Best F1 (0.9955 vs. 0.9887), likely due to a more favorable decision threshold on the balanced test set.
Ablation Study: Varying qubit counts (6–12) and kernel types showed that increasing qubits did not yield monotonic improvements; performance remained sensitive to dataset characteristics and sampling scales.

Long-Term Memory Efficiency

QOS vs. Explicit Storage: The QOS-inspired machine-size estimate was substantially smaller than explicit sparse or QRAM-style storage estimates across all datasets for comparable accuracy levels.
QOS vs. Streaming: The comparison with a simple classical streaming proxy was nuanced. Because aggressive feature filtering can reduce the classical streaming dimension ( $D_{df}$ ) to very small numbers, the streaming proxy sometimes appeared smaller than the QOS estimate. However, the authors note that QOS models compact coherent data access rather than just the dimension of a fitted classifier.

Key Contributions

Controlled Kernel Evaluation: The paper provides a rigorous, controlled comparison of quantum fidelity kernels against classical RBF kernels in network security, isolating the kernel effect from preprocessing and model architecture. It demonstrates that quantum kernels are competitive alternatives in specific settings but not universal replacements.
Memory-Size Perspective: The study introduces a QOS-based analysis for network security, shifting the focus from runtime speedup to memory efficiency. It quantifies the potential for quantum methods to reduce the effective memory-size proxy required for large-scale classification tasks compared to explicit storage.
Task-Dependent Characterization: The work characterizes the near-term value of quantum computing in this domain as highly dependent on dataset geometry and task specifics, rather than offering a blanket performance advantage.

Significance and Claims

The authors conclude with a measured but optimistic assessment of quantum computing's role in network security:

Near-Term: Quantum computing may serve as a task-dependent alternative to classical kernels. It is not a uniformly superior replacement but offers competitive performance in specific scenarios (e.g., CICIDS2017) where the quantum feature map aligns well with the data structure.
Long-Term: The primary value may lie in memory-efficient data access. Even if near-term runtime speedups are not realized, the ability of QOS to process streaming data with a significantly smaller memory-size proxy than explicit storage suggests a viable path for handling massive-scale security data in the future.

The paper explicitly states that these experiments do not constitute a unified, deployed quantum Intrusion Detection System (IDS). Instead, they identify two distinct channels for contribution: immediate kernel-level alternatives and future memory-efficient data access mechanisms.