Quantum Kernel Methods for Network Intrusion Detection

Can a quantum kernel beat classical ML for intrusion detection when data is scarce - and survive real quantum noise?

A research-oriented, reproducible pipeline comparing quantum kernel SVMs against classical machine learning on the NSL-KDD cybersecurity dataset, with a focus on the limited-data regime and robustness to realistic NISQ noise.

---

Why This Project Exists

This is not a toy "classify Iris with a quantum circuit" exercise. The goal is to evaluate whether QML has meaningful potential in a realistic cybersecurity application - where training data is constrained and feature encoding matters.

The project is framed as a scientific experiment: negative results are acceptable and informative. Concluding "the quantum model shows no practical advantage under the tested conditions" is a valid outcome, not a failure.

Research Questions

#	Question
RQ1	Can a quantum kernel compete with classical SVM for intrusion detection?
RQ2	How does training-set size affect relative performance?
RQ3	How does feature dimensionality affect the quantum model?
RQ4	How sensitive is the quantum model to quantum noise?
RQ5	Does increasing circuit depth actually improve performance?

---

Highlights

• Quantum pipeline built on Qiskit 2.5.2: ZZFeatureMap -> FidelityStatevectorKernel -> Nystrom approximation (M landmarks) -> SVC(kernel="precomputed").
• Phase C noise experiments (first try / smoke test, run on Kaggle CPU + 2x Tesla T4 GPUs): the quantum kernel is remarkably sample-efficient and degrades gracefully under depolarizing + readout noise.
• Even a noisy quantum kernel (high noise) beat an untuned GPU MLP trained on the same 50 samples - the MLP scored AUC 0.54 on KDDTest-21 (near random) vs 0.65-0.77 for the quantum kernel.

---

Key Results - Phase C Noise Robustness (First Try)

Smoke test (FAST_MODE=True): 50 train / 50 test samples, 16 Nystrom landmarks, 32 shots. Full details in report.md and notebook 04_noise_experiments.ipynb.

Regime	Test Set	Accuracy	F1	ROC-AUC
Ideal (statevector)	KDDTest+	0.8800	0.8889	0.9615
Ideal	KDDTest-21	0.7200	0.8250	0.7692
Noise Low	KDDTest+	0.9000	0.9057	0.9567
Noise Low	KDDTest-21	0.8000	0.8718	0.8042
Noise Mid	KDDTest+	0.8800	0.8846	0.9295
Noise Mid	KDDTest-21	0.8000	0.8718	0.8159
Noise High	KDDTest+	0.7400	0.7347	0.8590
Noise High	KDDTest-21	0.6600	0.7671	0.6480
MLP (CUDA) ref.	KDDTest+	0.7800	0.7317	0.8045
MLP (CUDA) ref.	KDDTest-21	0.4600	0.5263	0.5431

Read with care: this is a first-try smoke test on tiny samples - differences like 0.88 vs 0.90 are within statistical noise. The full-scale run (train=500, M=128, shots=512) is the next step.

---

Project Structure

.
├── data/                    # NSL-KDD raw files + processed artifacts
├── figures/                 # Generated plots (learning curves, kernels, ...)
├── results/                 # Result CSVs (phase_a_ideal, classical_baselines, quantum_kernel)
├── notebooks/
│   ├── 01_preprocessing.ipynb      # Encoding, scaling, PCA -> 4 dims, [0, pi] rescale
│   ├── 02_classical_baselines.ipynb# RBF/Linear SVM, RF, MLP baselines
│   ├── 03_quantum_kernel.ipynb     # Ideal quantum kernel (statevector) vs RBF
│   └── 04_noise_experiments.ipynb  # Phase C: noise robustness + GPU MLP ref
├── src/
│   ├── config.py            # Single source of truth for all hyperparameters
│   ├── data.py              # Loading, preprocessing, PCA, scaling, subsampling
│   ├── kernels.py           # ZZFeatureMap, Nystrom factorization, QK-SVM fit/predict
│   ├── baselines.py         # Tuned RBF SVM, GPU/CPU MLP baseline
│   └── figures.py           # Matplotlib figure generation
├── tools/build_notebooks.py # Builds notebooks from templates
├── run_phase_a.py           # CLI entry point for the Phase A benchmark
├── report.md                # Phase C results report (first try)
├── plan.md                  # Phased roadmap (A -> B -> C -> D)
├── description.md           # Research framing & RQs
└── requirements.txt         # Pinned dependencies

---

Method

Preprocessing

1. Load NSL-KDD official splits (KDDTrain+, KDDTest+, KDDTest-21)
2. One-hot encode categoricals (protocol_type, service, flag)
3. Standardize numeric features
4. PCA -> 4 components
5. Rescale to [0, pi] - the quantum feature-map encoding range (scaler fit on train only)
6. Binary label: normal = 0, attack = 1

Quantum model

ZZFeatureMap(4, reps=2)  ->  fidelity kernel  ->  Nystrom (M landmarks)
        ->  SVC(kernel="precomputed", C=1.0)

The Nystrom approximation keeps the kernel trainable on realistic budgets by reconstructing a rectangular kernel K = K_nm K_mm+ K_nm^T against fixed landmarks.

Noise model (Phase C)

• Depolarizing 1-qubit & 2-qubit gate errors + symmetric readout error
• Regimes: ideal -> low (0.3x) -> mid (1.0x) -> high (3.0x)
• Finite shots; simulated with AerSimulator(method="statevector", device="GPU")

---

Setup & Usage

Requires Python 3.12+.

1. Create a virtual environment

python -m venv .venv
source .venv/bin/activate        # Windows PowerShell: .\.venv\Scripts\Activate.ps1

2. Install pinned dependencies

pip install -r requirements.txt

For GPU noise experiments, install qiskit-aer-gpu-cu11==0.17.2 (as done in the Kaggle notebook).

3. Get the data

Place the three NSL-KDD files into data/ (the notebooks auto-download them if missing):

data/KDDTrain+.txt
data/KDDTest+.txt
data/KDDTest-21.txt

4. Run

python run_phase_a.py            # Phase A benchmark -> results/phase_a_ideal.csv

Or explore the experiments interactively via the notebooks.

---

Roadmap

Phase	Status	Focus
A - Core benchmark	Implemented	End-to-end QK vs RBF SVM, train sizes {100...2500}
B - Learning curves	Notebooks	Train size x PCA dims ({2,4,6,8}) on both test sets
C - Noise robustness	First try done	Ideal vs low/mid/high noise, finite shots, GPU MLP ref
D - Circuit depth	Planned	reps in {1,2,3,4}, ideal & noisy regimes
Follow-ups	Planned	Error mitigation, ZNE, thermal relaxation, fair MLP (125k samples), multi-seed stats

See plan.md for the detailed phased plan and risk list.

---

Stack

Layer	Tools
Quantum	Qiskit 2.5.2 - Qiskit-Aer 0.17.2 - Qiskit Machine Learning 0.9.0
Classical	scikit-learn 1.9.0 (SVM, RF, MLP, PCA, GridSearchCV) - PyTorch (CUDA MLP)
Data	pandas 3.0.5 - numpy 2.5.2
Viz	matplotlib 3.11.1
Compute	Kaggle CPU - 2x NVIDIA Tesla T4 GPU

---

Reports & Docs

• report.md - Phase C results report: first-try noise experiments, interpretation, and next steps
• description.md - Research framing, hypotheses, honest-negative philosophy
• plan.md - Incremental execution plan (A -> D) with gates and risks

---

Status: Research / experimental. Results are preliminary (first-try smoke test); full-scale runs and multi-seed statistics are planned before any scientific claims.