Open Access

ARTICLE

Quantum–Enhanced Intrusion Detection Using Quantum Circuit Born Machines for Zero-Day Attack Detection

Wajdan Al Malwi^1,*, Fatima Asiri¹, Muhammad Shahbaz Khan^2,3,*

1 Department of Informatics and Computer Systems, College of Computer Science, King Khalid University, Abha, Saudi Arabia
2 School of Computing, Engineering and the Built Environment, Edinburgh Napier University, Edinburgh, UK
3 School of Computer Science and Digital Technologies, Aston University, Birmingham, UK

* Corresponding Authors: Wajdan Al Malwi. Email: ; Muhammad Shahbaz Khan. Email:

(This article belongs to the Special Issue: Advances in Secure Computing: Post-Quantum Security, Multimedia Encryption, and Intelligent Threat Defence)

Computers, Materials & Continua 2026, 88(1), 36 https://doi.org/10.32604/cmc.2026.075326

Received 29 October 2025; Accepted 28 February 2026; Issue published 08 May 2026

Abstract

Modern intrusion detection systems (IDS) struggle to recognise zero-day cyberattacks, as classical discriminative models rely on historical attack labels and fail to characterise deviations from normal network behaviour. This work presents a hybrid quantum–classical intrusion detection framework in which a Quantum Circuit Born Machine (QCBM) models benign traffic as a probabilistic quantum state. The trained QCBM assigns each network flow a Quantum Anomaly Score (QAS), defined as the negative log-likelihood under the learned benign distribution, which is subsequently fused with classical flow statistics in a Light Gradient Boosted Machine (LightGBM) classifier. The proposed system employs a 16-qubit, three-layer QCBM (approximately 192 quantum gates) trained using up to 106 measurement shots on the CICIDS2017 dataset. Experimental results show that integrating the QAS does not degrade supervised detection performance on known attacks (Accuracy ≈0.996, Receiver Operating Characteristic-Area Under Curve (ROC-AUC) ≈0.9995), while providing an additional anomaly-sensitive signal under strict zero-day conditions. When entire attack families are withheld during training, the QAS assigns systematically higher anomaly scores to unseen attacks than to benign traffic and achieves unsupervised zero-day ROC-AUC values of approximately 0.78 across multiple attack types. These findings demonstrate that shallow, resource-efficient quantum generative models can act as interpretable probabilistic priors for benign behaviour, complementing classical IDS pipelines and enabling principled anomaly awareness under realistic Noisy Intermediate-Scale Quantum (NISQ) constraints.

---

Keywords

---