Quantum machine learning trade-offs in intrusion detection systems
False-Alarm Improvements and Detection Trade-Offs in QML Intrusion Detection: A Secondary Analysis of the Kaissar Corpus
Cryptography and Security
Summary
Detecting cyber attacks accurately is important but tricky because systems can either miss attacks or raise false alarms. The authors examined prior studies that used quantum machine learning for spotting intrusions and carefully compared their detection rates and false alarm levels. Their work helps clarify when a quantum method improves false alarms but may slightly reduce attack detection, emphasizing that results depend on how they are measured and reported. They provide a way to interpret these trade-offs without overstating guarantees.
What this means in practice
- •For cybersecurity teams: Compare quantum and classical methods to understand and optimize detection trade-offs in network intrusion systems.
- •For quantum computing engineers: Use reconstructed results to evaluate quantum support vector machines for reducing false alarms in security monitoring.
Tested on one dataset.
Authors
Roberto Fernández-Barrios, Iker Pastor-López, Asier González-Santocildes, Pablo García Bringas
Abstract
Published results in quantum machine learning for intrusion detection (QML-IDS) require joint interpretation of false-positive rate (FPR), attack true-positive rate (TPR), and evaluation provenance. We reconstruct operating points in the 25-entry frame selected by Kaissar and colleagues: 21 included articles, 20 identified documentary families, substantive methodological material consulted for 15, and 24 descriptive points from five. In one test-labelled comparison, a quantum support vector machine reduces FPR from 6.875% for random forest to 3.329%, while TPR decreases from 93.955% to 93.682%; both rates improve against three other comparators. In another study, a complete benign row identifies FPR as 12/6000 (0.200%), despite incomplete attack-side allocation that requires additional assumptions for TPR. Normalized matrices identify detection ranges rather than a unique aggregate rate. A uniform provenance rule separates training-described and test-adjusted results from six conditional illustrations whose independence remains unverified. The contribution is a reproducible interpretation of favorable comparisons and detection trade-offs, without converting descriptive results or hypothetical calculations into operational guarantees.