Modern intrusion detection systems (IDS) struggle to recognise zero-day cyberattacks, as classical discriminative models rely on historical attack labels and fail to characterise deviations from normal network behaviour. This work presents a hybrid quantum–classical intrusion detection framework in which a Quantum Circuit Born Machine (QCBM) models benign traffic as a probabilistic quantum state. The trained QCBM assigns each network flow a Quantum Anomaly Score (QAS), defined as the negative log-likelihood under the learned benign distribution, which is subsequently fused with classical flow statistics in a Light Gradient Boosted Machine (LightGBM) classifier. The proposed system employs a 16-qubit, three-layer QCBM (approximately 192 quantum gates) trained using up to 106 measurement shots on the CICIDS2017 dataset. Experimental results show that integrating the QAS does not degrade supervised detection performance on known attacks (Accuracy ≈0.996, Receiver Operating Characteristic-Area Under Curve (ROC-AUC) ≈0.9995), while providing an additional anomaly-sensitive signal under strict zero-day conditions. When entire attack families are withheld during training, the QAS assigns systematically higher anomaly scores to unseen attacks than to benign traffic and achieves unsupervised zero-day ROC-AUC values of approximately 0.78 across multiple attack types. These findings demonstrate that shallow, resource-efficient quantum generative models can act as interpretable probabilistic priors for benign behaviour, complementing classical IDS pipelines and enabling principled anomaly awareness under realistic Noisy Intermediate-Scale Quantum (NISQ) constraints.
Malwi et al. (Thu,) studied this question.