referencedlist[List][List of Referenced Lists]

# Enabling Quantum Cybersecurity Analytics in Botnet Detection: Stable
Architecture and Speed-up through Tree Algorithms

Madjid Tehrani  Madjid G. Tehrani
George Washington University
Washington, DC 20052, USA<EMAIL_ADDRESS>,  Eldar Sultanow  Eldar
Sultanow
Capgemini Deutschland GmbH
Nuremberg, Germany<EMAIL_ADDRESS>,  William J Buchanan
William J Buchanan
Edinburgh Napier University
Edinburgh, UK<EMAIL_ADDRESS>,  Malik Amir  Malik Amir
McGill University
Université de Montréal
Montreal
Canada<EMAIL_ADDRESS>,  Anja Jeschke  Anja Jeschke
Capgemini Deutschland GmbH
Hamburg, Germany<EMAIL_ADDRESS>,  Raymond Chow  Raymond Chow
George Washington University
Washington, DC 20052, USA<EMAIL_ADDRESS>and  Mouad Lemoudden  Mouad
Lemoudden
Blockpass ID Lab, Edinburgh Napier University
Edinburgh, UK<EMAIL_ADDRESS>
###### Abstract.

For the first time, we enable the execution of hybrid machine learning methods
on real quantum computers with 100 data samples and real-device-based
simulations with 5,000 data samples, thereby outperforming the current state
of research of Suryotrisongko and Musashi from 2022 who were dealing with
1,000 data samples and quantum simulators (pure software-based emulators)
only. Additionally, we beat their reported accuracy of $76.8\%$ by an average
accuracy of $91.2\%$, all within a total execution time of 1,687 seconds. We
achieve this significant progress through two-step strategy: Firstly, we
establish a stable quantum architecture that enables us to execute HQML
algorithms on real quantum devices. Secondly, we introduce new hybrid quantum
binary classification algorithms based on Hoeffding decision tree algorithms.
These algorithms speed up the process via batch-wise execution, reducing the
number of shots required on real quantum devices compared to conventional
loop-based optimizers. Their incremental nature serves the purpose of online
large-scale data streaming for DGA botnet detection, and allows us to apply
hybrid quantum machine learning to the field of cybersecurity analytics. We
conduct our experiments using the Qiskit library with the Aer quantum
simulator, and on three different real quantum devices from Azure Quantum:
IonQ, Rigetti, and Quantinuum. This is the first time these tools are combined
in this manner.

###### Key words and phrases:

Quantum, Cybersecurity Analytics, Machine Learning, Botnet, Hoeffding Tree

###### Contents

  1. 1 Introduction
  2. 2 Background
    1. 2.1 DGA Botnets
    2. 2.2 Machine Learning
    3. 2.3 Hybrid Quantum Machine Learning
    4. 2.4 Quantum Machine Learning
  3. 3 Methodology
    1. 3.1 Selected Platforms
    2. 3.2 Description of the Dataset
  4. 4 Stable Architecture for Long-running Experiments
    1. 4.1 Reasons for Instability
    2. 4.2 Stabilized Architecture
    3. 4.3 Quantum-enhanced Hoeffding Tree Classifier (QHTC)
  5. 5 Experimental Results
    1. 5.1 Execution Time and Accuracy
    2. 5.2 Performance Metrics of QHTC
  6. 6 Conclusion and Future Work
  7. A Pseudo-code Algorithms
  8. B Glossary

##  1\. Introduction

In the rapidly evolving digital landscape where cyber threats are growing both
in sophistication and pervasiveness, maintaining robust cybersecurity measures
has taken center stage. While traditional cybersecurity approaches remain
effective to a degree, they often struggle to keep up with the constant flood
of cyber-attacks [1]. In recent years, machine learning has proven to be
valuable in various cybersecurity applications. It’s been effective in tasks
such as intrusion detection, malware classification, and anomaly detection by
harnessing automated data analysis and pattern recognition capabilities [2].
Now, the rise of quantum computing is paving the way for even further
improvements in cybersecurity analytics.

Quantum computing, renowned for its ability to perform intricate computations
at a speed exponentially faster than traditional computers [3], shows
promising potential to revolutionize cybersecurity. Quantum machine learning,
which has emerged as the intersection of quantum computing and machine
learning, leverages the distinctive properties of quantum systems to devise
innovative algorithms with the potential to outperform their classical
counterparts [4]. In this paper, we explore the domain of quantum-enhanced
cybersecurity analytics, with a special focus on employing quantum machine
learning algorithms for botnet detection - a pressing cybersecurity issue with
significant implications for network security [5]. By utilizing the power of
quantum computing, we aim to establish a stable architecture and capitalize on
the prospective speed enhancement offered by tree algorithms, thereby
strengthening the effectiveness and efficiency of botnet detection methods.

The term Cybersecurity Analytics [6, 7] refers to the application of data
analysis techniques to cybersecurity. Much of the literature on this subject
takes a practical approach, offering tangible examples and implementable code
for cybersecurity solutions [8, 9, 10]. However, a term that encapsulates
cybersecurity analytics within the context of a quantum system, such as
Quantum Cybersecurity Analytics, is yet to be fully coined. This is a goal of
our present work. In this paper, we introduce Quantum Cybersecurity Analytics,
or QCA, as a field that employs quantum technology, particularly quantum
machine learning, to devise cybersecurity solutions.

We address the challenges and computational demands inherent to quantum
machine learning algorithms through the creation of a stable architecture and
the adaptation of the Hoeffding tree algorithm for incremental learning [11].
The current state of the art defined in [12] shows the classification with a
hybrid approach of 1000 data samples on a quantum simulator from a botnet
dataset with an accuracy of $76.8\%$, whereas the total execution time is not
reported. In their study, no signs of any real-device-based simulations or
even computations on real quantum devices is shown. We outperform these
achievements in the following ways:

  1. (1)

We have extended the maximum sample size from 1,000 to 5,000 data samples in a
quantum machine learning method, using real-device-based simulation through
the Quantum Hoeffding Tree Classifier (QHTC) algorithm. Our method achieves an
average accuracy of 91.2% and a final-round accuracy of 100%, all within a
total computation time of 1,687 seconds, which is on par with the total
execution time observed in locally deployed quantum simulations.

  2. (2)

Furthermore, and for the first time, we implemented various Hybrid Quantum
Binary Classification (HQBC) algorithms on actual quantum devices. We managed
to process a maximum of 100 randomly fixed data samples, achieving a top
accuracy of 59.0%.

In addition, our work makes the following additional contributions:

  1. (1)

We overcome the pitfalls due to the instabilities of long-running code on
three different Azure Quantum Providers by code hardening.

  2. (2)

We apply the batch-wise Hoeffding Tree algorithm instead of the usual loop-
wise algorithms relying on gradient descent.

  3. (3)

We compare a diverse set of binary classifiers on real devices, on real-
device-based simulations as well as quantum simulators. All experiments are
conducted consistently using the IEEE Botnet DGA dataset.

  4. (4)

Quantum Cybersecurity Analytics is made possible.

The source code implementation is publicly available at [13]. The subsequent
sections of this paper are organized as follows: Section 2 delves into the
background of DGA botnets and machine learning for cybersecurity. The details
of our methodology are described in Section 3. In Section 4, the requirements
for a stable architecture to run QML algorithms are identified and the
quantum-enhanced Hoeffding tree classifier is introduced. In Section 5, the
experimental results are presented. Finally, Section 6 serves as the
conclusion of this paper.

##  2\. Background

In this section, we present an overview of the following subjects and delve
into the difficulties and possibilities linked to each one: domain generation
algorithms (DGAs) botnets, the utilization of machine learning, hybrid quantum
machine learning, and quantum machine learning for the detection of botnets
through network traffic data.

###  2.1. DGA Botnets

A botnet refers to a network of computers infected and controlled by a single
attacker, known as the botmaster [14, 15]. Consequently, combatting and
addressing botnets has become an important issue, as they have become a
prevalent method for launching various internet-based attacks, such as spam,
phishing, click fraud, key logging and cracking, copyright infringements, and
Denial of Service (DoS) [16]. The communication topologies that pose the
greatest threat to Command-and-Control (C&C) servers are Domain Generation
Algorithm (DGA), peer-to-peer (P2P), and hybrid structures. Our primary focus
lies in examining the communication patterns and protocols employed by DGA
botnets. Extensive research on these communication patterns has been conducted
by the authors of [17]. To detect malicious domains, we adopt domain name
detection techniques. The literature offers a comprehensive study of DGA
botnets, which serves as a baseline use case for exploring quantum machine
learning, given the well-understood patterns of malicious activities in DGA
botnets.

A DGA-based botnet is an advanced form of botnet that exploits a Domain
Generation Algorithm (DGA) to generate seemingly random domain names for its
command and control (C&C) infrastructure, such as Mirai [18] and other well-
known botnets listed on Netlab 360. The primary objective of using a DGA is to
create difficulties for security researchers and law enforcement agencies in
tracking and dismantling the botnet’s C&C servers, as the generated domain
names change regularly. Cybercriminals commonly employ DGA-based botnets to
carry out various malicious activities, including spamming, distributing
malware, launching DDoS attacks, and stealing data [17]. These botnets have
the ability to infect numerous computers and devices, forming a network that
serves various illicit purposes. Compared to other types of botnets, DGA-based
botnets are known for their resilience and the challenge they pose in terms of
tracking and blocking, as they continuously alter their C&C infrastructure,
making it more arduous to disrupt their operations [19]. The objective of this
paper is to evaluate the current capabilities of Noisy Intermediate-Scale
Quantum (NISQ) hardware [20] using a hybrid quantum machine learning approach
to detect DGA botnets, and to explore how quantum machine learning (QML) can
enhance the functionality of Security Information and Event Management (SIEM),
and Security Orchestration, Automation, and Response (SOAR) systems.

###  2.2. Machine Learning

Machine learning is a branch of artificial intelligence (AI) that enables
software applications to predict outcomes more accurately without the need for
explicit programming [2]. Machine learning algorithms use historical data to
predict new output values. This allows them to learn from data and improve
their performance over time. It is thus a natural choice to consider machine
learning to detect botnets by analyzing network traffic data.

There are various approaches to implementing machine learning, one of which is
supervised classification applied to network traffic data. Brezo et al.
proposed a supervised classification method for detecting malicious botnet
traffic by analyzing network packets [21]. Piras, Pintor, Demetrio, and Biggio
explored techniques for explaining Machine Learning DGA detectors using DNS
traffic data and benchmarked different models, including J48 Decision Tree,
k-nearest Neighbors, and Random Forest [22]. Jia, N. Wang, Y.-Y. Wang, and Hu
analyzed the traceability and reconstructed the attack path of a botnet
control center using an ant colony group-dividing algorithm [23]. Pérez et al.
introduced an approach for proactive detection and mitigation of botnets in 5G
Mobile Networks, utilizing software-defined network and network function
virtualization techniques [24]. Onotu, Day, and Rodrigues demonstrated how
Neural Nets can recognize shellcode from network traffic data by employing a
multi-layer perceptron approach with a back-propagation learning algorithm
[25]. Maniriho, Mahmood, and Chowdhury conducted a survey on malware detection
and classification techniques, considering botnets as a subset of malware from
a classical computing perspective [26].

In conclusion, machine learning offers a powerful way to detect botnets.
However, challenges that remain are performance degradation over time of ML
algorithms as botnets evolve and change their tactics, but also the fact that
ML algorithms are susceptible to adversarial attacks. Adversarial attacks are
designed to fool ML algorithms into making incorrect predictions. This can be
done by injecting malicious traffic into a network that is designed to look
like benign traffic. For the purposes of this work, the use of ML for botnet
detection gives us a good benchmark to compare and ground our experimentation
with quantum machine learning.

###  2.3. Hybrid Quantum Machine Learning

Hybrid Quantum Machine Learning (HQML) is an innovative approach that combines
the power of quantum computing and classical machine learning. HQML algorithms
utilize both quantum and classical computers to tackle complex problems that
go beyond the capabilities of either technology alone [27]. Researchers
propose two types of hybridization to achieve quantum advantage: vertical
hybridization, which involves leveraging quantum devices with a hardware-
agnostic low-level design, topology mapping, and error correction routines;
and horizontal hybridization, which divides an algorithm into pre-processing,
quantum circuit involvement, and post-processing stages to attain quantum
advantage through a software-based approach [28]. In the domain of Quantum
Cybersecurity Analytics (QCA), Hybrid Quantum Binary Classifiers (HQBC) can be
employed to detect various adversarial cyber events, including spam, phishing,
spyware, ransomware, and botnets. In this paper, we demonstrate that Hoeffding
Trees outperform classical machine learning binary classifiers and all known
quantum approaches in detecting Domain Generation Algorithm (DGA) botnets.
Furthermore, we investigate the conditions under which HQBCs can achieve
comparable or superior performance compared to classical machine learning
models in DGA botnet detection.

As a related work exploring the application of HQML for DGA botnet detection,
[12] investigates Hybrid Quantum Deep Learning (HQDL) and Variational Quantum
Classifier (VQC) approaches using the IBM quantum infrastructure based on
superconducting loops-hardware. The authors simulate the performance of
different combinations of key optimizers with variational forms and feature
maps. The robustness of HQDL models against adversarial attacks is also
examined [29]. The results reveal that a hardened version of the HQDL model
can withstand adversarial attacks. This study on HQML for DGA botnet detection
[12] highlights several knowledge gaps that need to be addressed:

  1. (1)

How do other quantum supervised-learning methods perform in detecting DGA
botnets?

  2. (2)

What is the impact of different qubit approaches, such as trapped ions,
silicon quantum dots, topological qubits, and diamond vacancies, on
performance and hardware design?

  3. (3)

How does the time complexity of different architectural elements influence
performance?

This article focuses specifically on the first knowledge gap. In particular,
we will evaluate existing HQBCs that play a crucial role in cybersecurity
decision systems, including spam detection, anomaly detection, and botnet
detection, among others.

###  2.4. Quantum Machine Learning

Researchers have recently investigated a novel approach to intrusion detection
by employing quantum machine learning (QML) algorithms [30]. The study
conducted experiments to demonstrate the effectiveness of QML-based intrusion
detection in processing large-scale data inputs with remarkable accuracy
(98%). Notably, the QML approach exhibited twice the speed compared to
conventional machine learning algorithms typically used for the same task.
These findings highlight the potential of QML approaches to surpass the
performance of classical methods in intrusion detection, showcasing their
promising capabilities in the field.

##  3\. Methodology

The methodology section emphasizes the experimental decisions made in this
research. The first Subsection 3.1 covers the selection of quantum devices,
real-device-based simulators, and quantum simulators utilized for conducting
the experiments. The second Subsection 3.2 provides an explanation for the
selection of the IEEE Botnet DGA Dataset, justifying its suitability for the
analysis conducted in this research.

###  3.1. Selected Platforms

For this research, we opted to use a combination of real quantum devices,
real-device-based simulators, and quantum simulators (pure software-based
emulators) to reproduce the results reported in the study by Suryotrisongko et
al. [31], which focused exclusively on quantum simulators. Additionally, our
experiments were conducted on three Azure Quantum Providers to expand the
research scope beyond the utilization of IBM Quantum [31]. The real quantum
devices we selected for our experiments were IonQ, Rigetti, and Quantinuum. To
perform quantum simulations, we relied on the Qiskit SDK, utilizing Aer for
simulations and real-device-based simulations.

The quantum computing configurations used in our experiments are presented in
Table 1. The first column introduces a naming convention for referencing the
platforms, facilitating better comprehension of the experimental results
presented in Section 5. Platforms functioning as real quantum devices are
denoted by their respective names followed by the letter R. Platforms that
combine real quantum devices with simulations, thereby serving as real-device-
based simulators, are denoted by their names followed by the letter S.

Naming | Machine | Device
---|---|---
Convention | Name | Mode
Aer | Qiskit | Quantum simulator
Quantinuum-R | Quantinuum H1-2 | Real quantum device
Quantinuum-S | Quantinuum H1-2 Emulator | Real-device-based simulator
Rigetti-R | Rigetti Aspen-M-3 with Qiskit | Real quantum device
Rigetti-S | Rigetti QVM | Real-device-based simulator
IonQ-R | IonQ Aria | Real quantum device
IonQ-R | IonQ Quantum Simulator | Real-device-based simulator
Table 1. Naming conventions for selected platforms shown with their machine
name and their device mode (quantum simulator, real-device-based simulator, or
real quantum device)

###  3.2. Description of the Dataset

In this study, we evaluated our findings on DGA botnets using two datasets:
the IEEE Botnet DGA Dataset [31, 32] and the UMUDGA dataset [33]. The UMUDGA
dataset consists of 50 malware samples and is suitable for multiple
classifications using HQBCs. However, for the purpose of comparing our results
to [12], we focused solely on the IEEE Botnet DGA Dataset in the current
experiments. Nonetheless, the UMUDGA dataset may be considered for future
investigations.

The IEEE Botnet DGA Dataset comprises a total of 1,803,333 data records. For
our experiments, we randomly selected data samples from this dataset.
Specifically, we used 1,000 fixed random data samples for quantum simulators,
following the approach in [12], and real-device-based simulators.
Additionally, we utilized 100 fixed random data samples for real quantum
devices, and a separate set of 5,000 fixed random data samples to test the new
algorithm on real-device-based simulators.

As described in [12], we extracted seven features from the analyzed domain
names in the dataset. These features include:

  1. (1)

CharLength: The character length of the domain name.

  2. (2)

EntropyValue: The entropy value calculated using Shannon’s function with the
probability distribution of characters in the domain name.

  3. (3)

RelativeEntropy: The distance or similarity of a domain name to the character
probability distributions of either Alexa or DGA domain names, measured using
the Kullback-Leibler divergence function.

  4. (4)

MinREBotnets: The minimum relative entropy with the domain names of DGA
botnets.

  5. (5)

InformationRadius: The similarity or distance of a domain name to the domains
of the ten botnet DGA families, calculated using the Jensen-Shannon divergence
function.

  6. (6)

TreeNewFeature: A feature generated by a decision tree algorithm that combines
the features Entropy, REAlexa, MinREBotnets, and CharLength to train a
predictive model.

  7. (7)

Reputation: Provides information about the popularity and credibility of the
website.

The summarized statistics for these features, including the mean, standard
deviation, minimum, median, maximum, skewness, and kurtosis values, are
presented in Table 2.

Feature | Mean | StDev | Min. | Median | Max. | Skewness | Kurtosis
---|---|---|---|---|---|---|---
CharLength | 17.20 | 6.82 | 4.00 | 16.00 | 73.00 | 0.81 | 0.02
EntropyValue | 3.02 | 0.53 | 0.00 | 3.04 | 4.78 | -0.40 | 0.83
RelativeEntropy | 1.66 | 0.82 | 0.20 | 1.55 | 10.10 | 1.63 | 6.91
MinREBotnets | 1.28 | 0.57 | 0.00 | 1.23 | 5.99 | 0.84 | 1.24
InformationRadius | 0.65 | 0.11 | 0 .24 | 0.65 | 1.17 | 0.34 | 0.12
TreeNewFeature | 0.45 | 0.34 | 0.00 | 0.35 | 0.99 | 0.38 | -1.52
Reputation | 81.66 | 54.12 | 0.00 | 64.51 | 436.31 | 0.99 | 0.21
Table 2. Selected descriptive statistics of the IEEE Botnet DGA Dataset [31]
for the seven features according to the Anderson-Darling normality test.

##  4\. Stable Architecture for Long-running Experiments

This section discusses the issues encountered during long-running experiments
and presents a stabilized architecture to address these problems. It includes
the introduction of a new binary classifier and highlights relevant
implementation issues.

###  4.1. Reasons for Instability

The current versions of Qiskit ML classifiers (qiskit-0.41.1 and qiskit-
machine-learning-0.5.0), specifically QSVC, Pegasos, VQC, and QNN, have not
been tested for compatibility with Azure Quantum Providers such as IonQ,
Rigetti, and Quantinuum. Additionally, graceful exception handling has not
been implemented. As a result, during the experimentation phase, we frequently
experienced instability, including unexpected aborts and missing error
messages in long-running notebook sessions. Code hardening revealed the
following reasons for instability during experiments on real quantum devices:

  1. (1)

Issues on the real quantum devices

    1. (a)

Failure of a single circuit run causing a cascade effect regardless of
progress.

    2. (b)

Prioritization and scheduling bugs in the task queue.

    3. (c)

Maintenance downtime.

    4. (d)

Inability to deploy the quantum cloud architecture on a small scale due to
insufficient or outdated documentation.

  2. (2)

Issues with the hosted Jupyter notebooks in Azure Quantum workspace

    1. (a)

Kernel failure.

    2. (b)

Low memory.

    3. (c)

Insufficient number of virtual CPUs.

    4. (d)

Lack of visibility on progress and log processing.

  3. (3)

Issues in the communication between real quantum devices and notebooks

    1. (a)

Authentication and session failures.

  4. (4)

Issues with the Jupyter Notebook on the client side

    1. (a)

Termination after a maximum of 24 hours, regardless of CPU or RAM power.

  5. (5)

Issues related to different real devices

    1. (a)

Deprecated APIs of Qiskit.

  6. (6)

Issues stemming from the nature of the algorithm

    1. (a)

Excessive number of loops.

    2. (b)

Lack of code portability.

    3. (c)

Inadequate exception handling.

Reasons for instability

We discovered that the stability of computing and network elements within the
architecture is the primary limitation of cloud-based quantum computer
delivery. However, none of our experiments on real quantum devices could last
longer than three weeks. We were unable to establish a stable TLS connection
and authentication for a 1,000 random fixed data sample, leading us to select
a reduced sample size of 100 random fixed data points for real quantum
devices.

Subsection 4.2 will present an architecture design that addresses points
(1)-(5) in List 6 of instability reasons. Furthermore, Subsection 4.3 will
discuss necessary algorithmic changes to tackle point (6) in List 6. It is
important to note that our experiments running on quantum simulators did not
exhibit any instability.

###  4.2. Stabilized Architecture

Our enhanced architecture design addresses the instability reasons (1)-(5) in
List 6. The original architecture that led to instabilities consisted of an
Azure real quantum device and an Azure component that involves an Azure Job
Management, a storage account and a authentification component.

The updated architectures introduce additional components to solve the
instability issues mentioned in List 6. Experiments except QHTC are build on
the architecture displayed in figure 1 and QHTC experiments apply the
architecture in figure 2.

The architecture for experiments except QHTC includes a preceding step in a
Google Cloud instance, where a Jupyter and Google Colab Notebook can be
deployed on dedicated virtual machines to enable longer runtimes beyond the
24-hour limit. The additional Jupyter Notebook facilitates the implementation
of Qiskit code changes for exception handling specific to the algorithm and
real quantum device. The Google Colab Pro+ Notebook provides stable runs for
more than 1000 random fixed data samples. Additionally, a monitoring instance
of a GCP virtual machine with diverse logging capabilities aids in
identifying, tracking, and resolving errors, including authentication and
session failures.

Figure 1. Stabilized architecture of experiments on real quantum devices
comprising of three components Google Cloud, Azure and Azure Quantum
Providers.

(a) (a) Stabilized architecture for
QHTC experiment on Aer

(b) (b) Stabilized architecture for
QHTC experiments on Rigetti-S

Figure 2. Stabilized architecture for QHTC experiments on quantum simulators
Aer and Rigetti-S. The difference in implementation originates from
differences in library functionalities available on Aer and Rigetti-S.

HQML (Hybrid Quantum Machine Learning) opens the door to a new generation of
Security Information and Event Management systems known as quantum-enhanced
SIEM (QSIEM). To illustrate the functioning of a QSIEM, we present the first
use case: defending against Domain Generation Algorithm (DGA) Botnet attacks
for DDoS at the application layer using a quantum-enhanced SIEM. The
integration of HQML with a robust SIEM like Azure Sentinel becomes highly
beneficial at OSI-layer 7 (application layer), where HTTP and DNS traffic
occur. This integration enables the detection of malicious domain names
generated by DGA-Botnets for command-and-control servers, which are crucial
for coordinating DDoS attacks. By identifying and blocking traffic associated
with these domains, botnets can be prevented from receiving commands or
initiating attack traffic.

Our stabilized architecture aligns with the concept of a quantum-enhanced SIEM
solution. The steps in Figure 3 are explained in List (11). Steps (2)-(9) are
specific to training the HQML algorithm, while the productive algorithm
utilizes telemetry input data to generate a classification using Quantum SIEM
and Azure Sentinel, which is then displayed on the dashboard.

  1. (1)

Gather and preprocess the telemetry data required for the algorithm described
in Subsection 4.3.

  2. (2)

Perform classic feature engineering as described in Subsection 3.2.

  3. (3)

Deploy the algorithm for production use on Azure Quantum service.

  4. (4)-(7)

Execute the entire circuit to and from the real quantum devices using the
classical loop.

  5. (8)

Collect all the results and accumulate the final output.

  6. (9)

Save and update the classification algorithm.

  7. (10)

Integrate the classification algorithm with Azure Sentinel.

  8. (11)

Display the results of the classification algorithm to the user. Steps in the
solution architecture

Figure 3. Quantum-enhanced SIEM. The individual steps are marked with numbers
in red circles and are explained in List (11)

###  4.3. Quantum-enhanced Hoeffding Tree Classifier (QHTC)

This subsection first describes the historical development of our scientific
advances in the direction of the solution, followed by an explanation of the
quantum-enhanced Hoeffding Tree Classifier (QHTC).

A realistic QCA solution, i.e., the quantum-enhanced SIEM in 4.2, needs to be
able to process online big data streaming. Hence, we sought an incremental
approach to be applied to already known HQBCs. The most promising algorithmic
candidate to reduce execution time and improve accuracy when executed on real-
device-based simulators was the PegasosQSVC, in our opinion. Due to its
stochastic gradient descent optimizer, the PegasosQSVC performs fewer
calculations by iterations and results in better generalization properties of
the trained model than conventional gradient descent [34]. Instead of making
the PegasosQSVC truly incremental, we applied a batch-wise strategy as an
intermediate step between algorithms that need to process the entire training
or test data samples at once and incremental algorithms.

The performance of PegasosQSVC with respect to accuracy development over time
is displayed in Figure 4 for batch sizes of 1,000 as well as 100 random fixed
data samples on the quantum simulator Aer. The PegasosQSVC shows good behavior
in terms of accuracy increase with the number of batches if a batch size of
1,000 data samples per batch is applied. But the real quantum devices are not
able to handle 1,000 data samples, but only 100 data samples per batch, as the
results in Subsection 5.1 will show. In contrast, a batch size of 100 samples
will not exhibit the appropriate increase in accuracy on real-device-based
simulators or real quantum devices. Smaller batch sizes in the range of 100
data samples require a higher number (one magnitude) of circuits to be sent to
the real quantum device, which will extend the execution time to an
inappropriate level. This is the dilemma of NISQ-limited data volumes.

(a) (a) Batch size of 100 data samples

(b) (b) Batch size of 1,000 data samples

Figure 4. PegasosQSVC’s accuracy on quantum simulator AER with (a) a batch
size of 100 data samples does not improve its accuracy with an increased
number of batches, unlike (b) a batch size of 1,000 data samples.

Therefore, we decided to transition to a truly incremental algorithm and apply
it batch-wise to reduce the number of shots sent to the real quantum device.
The accuracy of a truly incremental algorithm will not suffer in this way.
This was the breakthrough in terms of the algorithm’s accuracy and execution
time on real-device-based simulators.

We found the algorithmic solution in a quantum-modified version of an
incremental decision tree approach called the Hoeffding tree algorithm [35],
shown in algorithm 1. It is a generation algorithm for incremental decision
trees that applies the Hoeffding bound [36, 37]. The standard non-incremental
version of the decision tree takes all data samples per leaf at once to
compute a decision criterion per leaf. In contrast, the incremental version of
a decision tree can process one data sample after another. The main advantage
of this generation algorithm is that it guarantees, under realistic
assumptions, the generation of an asymptotically arbitrarily similar
incremental version of a decision tree compared to the same non-incremental
version of the decision tree. Simultaneously, it maintains efficient
computation speed. Additionally, the Hoeffding bound is independent of the
probability distribution of the data samples. However, this implies the
disadvantage that the Hoeffding bound, compared to distribution-dependent
bounds, requires more data samples to reach the same level of similarity
between the incremental version and non-incremental version of the decision
tree.

We introduce the abbreviation HTC (Hoeffding Tree Classifier) for the original
Hoeffding tree, shown in algorithm 1. Our quantum-modified version is called
the quantum-enhanced Hoeffding Tree Classifier (QHTC), as presented in
algorithm 4 and described below. QHTC is a batch-wise learning procedure that
applies HTC with modified input data. We apply the HTC in an equivalent
version following the HTC implementation of [38] that is shown in algorithms 2
and 3. The first step of QHTC is the mapping of the classical features of the
input data to the quantum feature space using ZFeatureMap, although other
mappings are also possible. Each feature column entry in the feature row
represents a data point in quantum space (qubit) on the Bloch sphere and we
want to measure the length of the cycle connecting all qubits per feature row.
The reason is that the distance between two qubits represents a measure of how
distinguishable they are. This cycle length is referred to as a ’quantum walk’
in the code.

The measurement of the cycle length relies on measuring the distance between
two qubits on the Bloch sphere. For that, each qubit is converted via wave
functions to its density matrix. These density matrices are listed in the same
order as the classical feature columns and the trace distance of two density
matrices is applied to measure the distance between two qubits that are
neighbors on the cycle.

The cycle length is determined by the order of data points in quantum space
and, hence, by the order of the classical features given in the original data
set. The determination of a distance metric that allows reordering of feature
columns is left for future research. The initialization of HTC is performed
accordingly.

The batch-wise computation of an incremental decision tree reduces the number
of shots sent to the real quantum device drastically compared to usual loop-
based optimizers, while not compromising its accuracy. This provides a
solution to the instability reason (6a) mentioned in List 6. It allows us to
deal with the realistic behavior of today’s real quantum devices that are
prone to instability due to the noise problem inherent in today’s NISQ
devices. The execution times and the accuracy benefit accordingly, as the
results in Section 5 show in more detail.

##  5\. Experimental Results

The experimental results for different algorithms and quantum devices are
presented in the following subsections, focusing on execution time, accuracy,
and additional performance metrics for the QHTC algorithm.

###  5.1. Execution Time and Accuracy

In this section, we present the experimental results for different binary
classifiers, including VQC, PegasosQSVC, QSVC, SamplerQNN, and EstimatorQNN,
in terms of accuracy and execution time on quantum simulators, real-device-
based simulators, and real quantum devices.

Tables 3 and 4 showcase the accuracy, total computation time
($\text{T}_{\text{total}}$), chosen feature map, and optimizer for various
combinations of platforms and algorithms. The experiments on quantum
simulators and real-device-based simulators were conducted with at least 1,000
random fixed data samples, while the experiments on real quantum devices used
100 data samples due to computational limitations and instabilities.

Algorithm and Platform | FeatureMap | Optimizer | Accuracy [%] |  $\text{T}_{\text{total}}$ [s]
---|---|---|---|---
VQC-IonQ-R | ZFeatureMap | COBLYA | 50 | 1,325,133
PegasosQSVC-IonQ-R | ZFeatureMap | SGD | 41 | 156,156
QSVC-IonQ-R | ZFeatureMap | COBLYA | 53 | 283,325
SamplerQNN-IonQ-R | ZFeatureMap | COBLYA | 56 | 956,540
EstimatorQNN-IonQ-R | ZFeatureMap | COBLYA | 59 | 1,165,819
VQC-Rigetti-R | ZFeatureMap | COBLYA | 43 | 1,176,879
PegasosQSVC-Rigetti-R | ZFeatureMap | SGD | 48 | 355,509
QSVC-Rigetti-R | ZFeatureMap | COBLYA | 39 | 385,153
SamplerQNN-Rigetti-R | ZFeatureMap | COBLYA | 53 | 1,601,895
EstimatorQNN-Rigetti-R | ZFeatureMap | COBLYA | 51 | 1,437,085
VQC-Quantinuum-R | ZFeatureMap | COBLYA | 44 | 972,732
PegasosQSVC–Quantinuum-R | ZFeatureMap | SGD | 44 | 972,732
QSVC-Quantinuum-R | ZFeatureMap | COBLYA | 45 | 472,847
SamplerQNN-Quantinuum-R | ZFeatureMap | COBLYA | 46 | 1,087,789
EstimatorQNN-Quantinuum-R | ZFeatureMap | COBLYA | 50 | 1,167,143
Table 3. Performance results in terms of accuracy and total execution time
$\text{T}_{\text{total}}$ of real quantum devices, using 100 data samples for
all runs. For each algorithm and platform, the choice of the feature map and
the optimizer is also shown.

Algorithm and Platform | FeatureMap | Optimizer | Accuracy [%] |  $\text{T}_{\text{total}}$ [s]
---|---|---|---|---
VQC-Aer | ZZFeatureMap | COBLYA | 54 | 4,240
PegasosQSVC-Aer | ZFeatureMap | SGD | 90 | 45
QSVC-Aer | ZFeatureMap | COBYLA | 87 | 3,091
SamplerQNN-Aer | ZFeatureMap | COBYLA | 76 | 374
EstimatorQNN-Aer | ZFeatureMap | COBYLA | 84 | 410
VQC-IonQ-S | ZFeatureMap | COBYLA | 51 | 957,755
PegasosQSVC-IonQ-S | ZFeatureMap | SGD | 49 | 113,950
QSVC-IonQ-S | ZFeatureMap | COBYLA | 50 | 178,529
SamplerQNN-IonQ-S | ZFeatureMap | COBYLA | 59 | 746,992
EstimatorQNN-IonQ-S | ZFeatureMap | COBYLA | 63 | 780,480
VQC-Rigetti-S | ZFeatureMap | COBYLA | 46 | 889,708
PegasosQSVC-Rigetti-S | ZFeatureMap | SGD | 55 | 206,729
QSVC-Rigetti-S | ZFeatureMap | COBYLA | 45 | 205,877
SamplerQNN-Rigetti-S | ZFeatureMap | COBYLA | 58 | 656,629
EstimatorQNN-Rigetti-S | ZFeatureMap | COBYLA | 54 | 955,654
VQC-Quantinuum-S | ZFeatureMap | COBYLA | 45 | 806,626
PegasosQSVC-Quantinuum-S | ZFeatureMap | SGD | 49 | 174,416
QSVC-Quantinuum-S | ZFeatureMap | COBYLA | 49 | 197,871
SamplerQNN-Quantinuum-S | ZFeatureMap | COBYLA | 48 | 852,774
EstimatorQNN-Quantinuum-S | ZFeatureMap | COBYLA | 53 | 716,581
QHTC-Rigetti-S | ZFeatureMap | n.a. |  100aaaAlready after 3 out of 5 batches | 1,687

Table 4. Performance results in terms of accuracy and total execution time
$\text{T}_{\text{total}}$ of quantum simulator and real-device-based simulator
experiments, using 5,000 data samples for QHTC, and 1,000 data samples for all
other algorithms. For each algorithm and platform, the choice of the feature
map and the optimizer is also shown.

On real quantum devices, the PegasosQSVC performs well in terms of execution
time due to its SGD optimizer which tends to converge a little faster than non
stochastic optimizers. The PegasosQSVC stands out as the superior binary
classifier. As the APIs of feature maps of Qiskit (see for example
ZFeatureMap) have no endpoint to change the quantum real device, specific
implementations are needed for each algorithm. Hence, we didn’t intend to
compare QHTC over different quantum real devices. We left the implementation
of additional coding routines in order to enforce specific real quantum
devices and real-device-based simulators for future investigations.

The PegasosQSVC shows good accuracy (90%) and very good execution time (45
seconds) on real-device-based simulators. However, the QHTC algorithm
outperforms all other binary classifiers in terms of accuracy, achieving
perfect accuracy of 100% already after 3 out of 5 batches. The accuracy is
discussed in more detail in subsection 5.2. Furthermore, QHTC exhibits
significantly reduced total execution time compared to other algorithms on
real-devise-based simulators.

The experiments conducted on real-device-based simulators and real quantum
devices considered a first step, and further improvements and specific
implementations for each algorithm on different devices can be explored in
future research. Overall, these results demonstrate that it is possible to
construct superior algorithms for cloud-based NISQ deployments on real-device-
based simulator Rigetti, achieving comparable execution times to quantum
simulators while exceeding in terms of accuracy.

###  5.2. Performance Metrics of QHTC

We show the results of our QHTC (see algorithm 4) which is configured to run
with five batches containing 1,000 random fixed data samples each. We apply
the feature map ZFeatureMap provided by Qiskit. Table 5 demonstrates
achievements in terms of accuracy improvement. The increase in accuracy with
the number of batches meets our expectations. QHTC yields the same results for
all three feature maps. We obtained an average accuracy of $91.2\%$ and a
final-round accuracy of $100\%$ for QHTC already after 3 out of 5 batches. We
used the same features and the same dataset as [12] to be able to compare our
results with theirs. These features are the same features that are available
in the entire dataset itself. This may be the reason for such high accuracy.
In future research, we can further improve the metric computation to avoid
over-fitting and to make it more realistic by applying a PCA analysis as well
as using a k-fold cross-validation per batch, with $k=10$ for example. In
addition, the features EntropyValue and RelativeEntropy possess strong
predictor properties for the entire dataset. Hence, the same issue will
probably not happen to other datasets that don’t possess very strong predictor
features.

Batch | Accuracy [$\%$] | F1-score [$\%$] | AUC [$\%$]
---|---|---|---
1 | $57.1$ | $4.5$ | $51.1$
2 | $99.0$ | $98.8$ | $98.9$
3 | $100.0$ | $100.0$ | $100.0$
4 | $100.0$ | $100.0$ | $100.0$
5 | $100.0$ | $100.0$ | $100.0$
Average | $91.2$ | $80.7$ | $90.0$
Table 5. Metric results in terms of accuracy, F1-score and AUC for algorithm
QHTC, displayed for 5 batches with 1,000 data samples each and their average.

##  6\. Conclusion and Future Work

Cybersecurity Analytics involves the collection of data to gather evidence,
construct timelines, and analyze threats, thereby enabling the design and
execution of a proactive cybersecurity strategy that detects, analyzes, and
mitigates cyber threats. The next-generation Quantum Cybersecurity Analytics
utilizes hybrid quantum machine learning (HQML) to monitor network activity,
promptly identify resource use or network traffic changes, and address
threats. This advancement paves the way for a new generation of Security
Information and Event Management systems called quantum-enhanced SIEM (QSIEM).
To illustrate how a QSIEM operates, we presented the first use case of
defending against DGA botnet attacks for DDoS at the application layer using a
quantum-enhanced SIEM.

As cybersecurity is built upon the analysis of amounts of big data, today’s
NISQ era poses an obstacle for quantum-enhanced SIEM for cybersecurity due to
its inherent instabilities that enlarge with repeated and prolonged
computations. This study found a way to overcome parts of the problem by
proposing a new form of HQML binary classifiers that lead to significant
improvements in the result’s accuracy as well as the algorithm’s execution
times with real-device-based simulations compared to previous algorithms. The
breakthrough was the application of a quantum-enhanced version of the
incremental Hoeffding tree algorithm in a batch-wise version in order to take
account of large amounts of incoming online stream data in addition to
responding to the need for a reduced number of shots to the real quantum
device. In addition to the improved accuracy, the experimental run times in
real-device-based simulations were reduced drastically by three orders of
magnitude to be in the same order as with the previous algorithms on the
quantum simulator Aer that is deployed locally.

In general, the world of quantum simulators is much more beautiful than the
world of computations on real quantum devices. This study showed for the first
time that HQML algorithms were able to run stably with 100 random fixed data
samples for several weeks on Azure Quantum Providers Rigetti, Quantinuum, and
IonQ together with the library Qiskit. It is the first time these tools were
combined. We achieved this by code hardening throughout the entire data flow
process from the Jupyter Notebook to the real quantum devices, including all
communications and algorithm-specific implementations of APIs per real quantum
device. However, future research needs to build upon our progress in order to
make the quantum computations on real devices stable for a much larger portion
than 100 random fixed data samples, being just a very small fraction of the
entire IEEE Botnet DGA Dataset. The enlargement of stability may also be
pursued in the case of quantum simulations, as we only used a random fixed
sample size of 1,000 in the usual HQBC case and a random fixed sample size in
the QHTC case when conducting real-device-based simulations.

Moreover, we left the implementation of additional coding routines in order to
enforce all specific real quantum devices or real-device-based simulators in
the case of the quantum-enhanced version as well as the original version of
the Hoeffding tree algorithm for future investigations. In addition, the
determination of a distance metric for QHTC that allows reordering of feature
columns is left for future research. Our focus of this study in this regard
was to show the excellent properties of these HQBC algorithms for the DGA
botnet classification problem in which we succeeded.

For future research, we also suggest investing more into PegasosQSVC because
if we combine quantum supervised learning with rewarding and quantum
reinforcement learning, we may have groundbreaking cybersecurity tools.
Because current NISQ and hybrid models can support up to 5,600 qubits, perhaps
we don’t have a 5,600 network feature in cyber data. Resulting from that, even
in this NISQ period, we can probably make strong cyber use cases for existing
quantum computers and HQML.

Furthermore, it is an open question as to what practical problem of which
scientific fields the same approach of quantum-enhanced Hoeffding tree
algorithms might apply as well. The UMUDGA dataset may be a next suitable
choice for the DGA botnet detection field. We elaborated on a number of
features of the IEEE Botnet DGA Dataset in order to give researchers from
other fields a good starting point for their investigations.

Acknowledgements. We acknowledge support from Microsoft’s Azure Quantum for
providing credits and access to the IonQ, Quantinuum and Rigetti systems used
in this paper.

##  Appendix A Pseudo-code Algorithms

Algorithm 1 The Original Hoeffding Tree Algorithm [35] (HTC)

Inputs:

  * •

$S$ is a sequence of examples.

  * •

$\mathbf{X}$ is a set of discrete attributes.

  * •

$G(\cdot)$ is a split evaluation function.

  * •

$\delta$ is one minus the desired probability of choosing the correct
attribute at any given node.

Output:

  * •

$HT$ is a decision tree.

1:procedure HoeffdingTree($S,\mathbf{X},G,\delta$)

2: Let $HT$ be a tree with a single leaf $l_{1}$ (the root).

3: Let $\mathbf{X}_{1}=\mathbf{X}\cup\\{X_{\emptyset}\\}$.

4: Let $\bar{G}_{1}(X_{\emptyset})$ be the $\bar{G}$ obtained by predicting
the most frequent class in $S$.

5: for each class $y_{k}$ do

6: for each value $x_{ij}$ of each attribute $X_{i}\in\mathbf{X}$ do

7: Let $n_{ijk}(l_{1})=0$.

8: end for

9: end for

10: for each example $(\mathbf{x},y_{k})$ in $S$ do

11: Sort $(\mathbf{x},y)$ into a leaf $l$ using $HT$.

12: for each $x_{ij}$ in $\mathbf{x}$ such that $X_{i}\in\mathbf{X}_{l}$ do

13: Increment $n_{ijk}(l)$.

14: end for

15: Label $l$ with the majority class among the examples seen so far at $l$.

16: if the examples seen so far at $l$ are not all of the same class then

17: for each attribute $X_{i}\in\mathbf{X}_{l}-\\{X_{\emptyset}\\}$ do

18: Compute $\bar{G}_{l}(X_{i})$ using the counts $n_{ijk}(l)$.

19: end for

20: Let $X_{a}$ be the attribute with the highest $\bar{G}_{l}$.

21: Let $X_{b}$ be the attribute with the second-highest $\bar{G}_{l}$.

22: Compute
$\epsilon=\sqrt{\frac{R^{2}}{2}\cdot\ln\left(\frac{1}{\delta}\right)\cdot\frac{1}{\sum_{ijk}n_{ijk}(l)}}$.

23: if $\bar{G}_{l}(X_{a})-\bar{G}_{l}(X_{b})>\epsilon$ and $X_{a}\neq
X_{\emptyset}$ then

24: Replace $l$ by an internal node that splits on $X_{a}$.

25: for each branch of the split do

26: Add a new leaf $l_{m}$, and let $\mathbf{X}_{m}=\mathbf{X}-\\{X_{a}\\}$.

27: Let $\bar{G}_{m}(X_{\emptyset})$ be the $\bar{G}$ obtained by predicting
the most frequent class at $l_{m}$.

28: for each class $y_{k}$ and each value $x_{ij}$ of each attribute
$X_{i}\in\mathbf{X}_{m}-\\{X_{\emptyset}\\}$ do

29: Let $n_{ijk}(l_{m})=0$.

30: end for

31: end for

32: end if

33: end if

34: end for

35: return $HT$.

36:end procedure

Algorithm 2 The HoeffdingTreeClassifier (HTC) following implementation [38]

1:procedure init($nFeatures$, $nClasses$, $delta=0.01$, $tiethreshold=0.05$)

2: Store the input variables.

3: $root$ $\leftarrow\textsc{TreeNode}(delta)$

4:end procedure

5:function predict($X$)

6: Predict the class labels for the input instances $X$.

7: return $yPredict$

8:end function

9:procedure partialFit($X,y$)

10: Update the tree with new training instances $X$ and their corresponding
class labels $y$.

11:end procedure

12:procedure updateStatistics($X,label$)

13: Update the statistics of the tree nodes based on the input instance $X$
and its class label $label$.

14:end procedure

15:procedure attemptSplit($node$)

16: Attempt to split the given node $node$ based on the Hoeffding bound gain.

17:end procedure

18:procedure splitNode($node$)

19: Split the given node $node$ by selecting the best attribute based on the
Hoeffding bound gain.

20:end procedure

21:function hoeffdingBound($node$)

22: Split the given node $node$ by selecting the best attribute based on the
Hoeffding bound gain.

23: return $epsilon$

24:end function

Algorithm 3 TreeNode (as part of algorithm 2)

1:procedure init($delta$)

2: Store the input variable.

3: Initialize further variables.

4:end procedure

5:function isLeaf

6: Check if the node is a leaf (no children).

7: return not $children$

8:end function

9:procedure computeErrorRate

10: Compute the error rate of the node based on the class distribution.

11:end procedure

12:procedure computeBestSplittingAttribute($nClasses$, $nFeatures$)

13: Compute the best attribute to split on based on the Hoeffding bound gain.

14:end procedure

15:function computeHoeffdingBoundGain($classCountsPerValues$,
$totalSamplesPerValue$, $nClasses$, $totalSamples$)

16: Compute the Hoeffding bound gain for the given attribute values and their
class counts.

17: return $gain$

18:end function

19:function hoeffdingBound($errorRate$)

20: Compute the Hoeffding bound for the given error rate $errorRate$.

21: return $hoeffdingBound$

22:end function

23:function getMajorityClass

24: Get the majority class label based on the class distribution.

25: return $majorityClass$

26:end function

Algorithm 4 Batch-wise Learning with the Quantum-enhanced Hoeffding Tree
Classifier (QHTC)

1:procedure RunQHTC

2: Load the data set.

3: Extract the features and labels from the data set.

4: Normalize the features using a standard scaler.

5: Initialize a few variables.

6: for each feature row $r$ in data set do

7: Compute quantum walk distance QHTCDistanceRigetti($r$).

8: end for

9: Store the new quantum data rows as a combination of the quantum walk
distances and labels.

10: Initialize number of features $nFeatures$ with 1.

11: Initialize number of classes $nClasses$ with number of unique values in
labels.

12: Initialize function HoeffdingTree.init($nFeatures$, $nClasses$).

13: Set the percentage for quantum test data.

14: Set the batch size.

15: for all feature rows with step batch size do

16: Split the quantum data into training and testing data.

17: Fit the function HoeffdingTree.partialFit($XTrain,yTrain$) to the quantum
training data.

18: Predict labels for the quantum test data using the function
HoeffdingTree.predict($XTest$).

19: Calculate all performance metrics of the predicted labels $yPredict$.

20: end for

21: Plot performance metrics per batch.

22:end procedure

1:function QHTCDistanceRigetti($r$)

2: Connect to Rigetti-S using library pyquil or to Aer using library qiskit.

3: Create a wave function simulator $ws$.

4: for each data point $p$ in feature row $r$ do

5: Compute qubit $q$ as ZFeatureMap transformation of $p$ using library pyquil
(Rigetti-S) or qiskit (Aer).

6: end for

7: for each qubit $q$ do

8: Get the wave functions $f(q)$ from $ws$.

9: end for

10: for each wave function $f(q)$ do

11: Compute the density matrices $m_{f(q)}$.

12: end for

13: for $i\leftarrow 1$ to $n$ while $i<n$ and n is length of feature row $r$
do

14: Let single distances
$d_{i}=\textsc{TraceDistance}(m_{f(q)}(i),m_{f(q)}(i+1))$.

15: end for

16: Let single distance
$d_{n}=\textsc{TraceDistance}(m_{f(q)}(n),m_{f(q)}(1))$.

17: return Sum of single distances

18:end function

1:function TraceDistance($m_{1}$, $m_{2}$)

2: Let $d=m_{1}-m_{2}$.

3: Compute singular values $s_{i}$ of $d$.

4: return $0.5*\sum_{i}|s_{i}|$

5:end function

##  Appendix B Glossary

Term | Definition
---|---
API | Application Programming Interface
C&C | Command-and-Control Server
CBC | Classical Binary Classifier
COBYLA | Constrained Optimization by Linear Approximation
DGA | Domain Generation Algorithm
(D)DoS | (Distributed) Denial of Service
DL | Deep Learning
EstimatorQNN | Estimator Circuit of a Quantum Neural Network
GCP | Google Cloud Platform
HQBC | Hybrid Quantum Binary Classifier
HQDL | Hybrid Quantum Deep Learning
HTC | Hoeffding Tree Classifier
ML | Machine Learning
MLP | Multilayer Perceptron
NISQ | Noisy Intermediate-Scale Quantum
P2P | Peer-to-peer
Pegasos | Primal Estimated sub-Gradient Solver for Support Vector Machines
SPSA | Simultaneous Perturbation Stochastic Approximation
QSIEM | Quantum-enhanced Security Information and Event Management
QAOA | Quantum Approximate Optimization Algorithm
QDL | Quantum Deep Learning
QESG | Quantum Estimated Sub-Gradient
QGAN | Quantum Generative Adversarial Networks
QML | Quantum Machine Learning
QNN(C) | Quantum Neural Network (Classifier)
QCA | Quantum Cybersecurity Analytics
QSVC | Quantum Support Vector Classifier
QSVM | Quantum Support Vector Machine
Term | Definition
---|---
SamplerQNN | Sampler Circuit of a Quantum Neural Network
SIEM | Security Information and Event Management
SLSQP | Sequential Least Squares Programming optimizer
SMO | Sequential Minimal Optimization
SOAR | Security Orchestration, Automation and Response
SPSA | Simultaneous Perturbation Stochastic Approximation
SGD | Stochastic Gradient Descent
TLS | Transport Layer Security
VQC | Variational Quantum Classifier

## References

  * [1] Abdulla Hussain, Azlinah Mohamed, and Suriyati Razali.  A review on cybersecurity: Challenges & emerging threats.  In Proceedings of the 3rd International Conference on Networking, Information Systems & Security, pages 1–7, 2020.
  * [2] Javier Martínez Torres, Carla Iglesias Comesaña, and Paulino J García-Nieto.  Machine learning techniques applied to cybersecurity.  International Journal of Machine Learning and Cybernetics, 10:2823–2836, 2019.
  * [3] Michael A Nielsen and Isaac L Chuang.  Quantum computation and quantum information.  Quantum Computation and Quantum Information, 2010.
  * [4] Jacob Biamonte, Peter Wittek, Nicola Pancotti, Patrick Rebentrost, Nathan Wiebe, and Seth Lloyd.  Quantum machine learning.  Nature, 549(7671):195–202, 2017.
  * [5] Ying Xing, Hui Shu, Hao Zhao, Dannong Li, and Li Guo.  Survey on botnet detection techniques: Classification, methods, and evaluation.  Mathematical Problems in Engineering, 2021.
  * [6] Rakesh M. Verma and David J. Marchette.  Cybersecurity Analytics.  CRC Press, 2020.
  * [7] Scott Mongeau and Andrzej Hajdasinski.  Cybersecurity Data Science: Best Practices in an Emerging Profession.  Springer, 2021.
  * [8] Alessandro Parisi.  Hands–On Artificial Intelligence for Cybersecurity.  Packt Publishing, 2019.
  * [9] Ravi Das.  Practical AI for Cybersecurity.  CRC Press, 2021.
  * [10] Emmanuel Tsukerman.  Machine Learning for Cybersecurity Cookbook.  Packt Publishing, 2019.
  * [11] Asmah Muallem, Sachin Shetty, Jan W Pan, Juan Zhao, and Biswajit Biswal.  Hoeffding tree algorithms for anomaly detection in streaming datasets: A survey.  Journal of Information Security, 8(4), 2017.
  * [12] Hatma Suryotrisongko and Yasuo Musashi.  Hybrid quantum deep learning and variational quantum classifier-based model for botnet dga attack detection.  International Journal of Intelligent Engineering and Systems, 15(3):215–224, 2022.
  * [13] Madjid Tehrani, Eldar Sultanow, William J Buchanan, Malik Amir, Anja Jeschke, Raymond Chow, and Mouad Lemoudden.  https://github.com/Sultanow/quantum-botnet-detection, 2023.
  * [14] Georgios Kambourakis, Marios Anagnostopoulos, Weizhi Meng, and Peng Zhou, editors.  Botnets: Architectures, Countermeasures, and Challenges.  CRC Press, 2020.
  * [15] Zhichun Li, Anup Goyal, and Yan Chen.  Honeynet-based botnet scan traffic analysis.  In Botnet Detection: Countering the Largest Security Threat, pages 25–44. Springer, 2008.
  * [16] Wenke Lee, Cliff Wang, and David Dagon, editors.  Botnet Detection: Countering the Largest Security Threat.  Springer, 2008.
  * [17] Gernot Vormayr, Tanja Zseby, and Joachim Fabini.  Botnet communication patterns.  IEEE Communications Surveys & Tutorials, 19(4):2768–2796, 2017\.
  * [18] Manos Antonakakis, Tim April, Michael Bailey, Matt Bernhard, Elie Bursztein, Jaime Cochran, Zakir Durumeric, J Alex Halderman, Luca Invernizzi, Michalis Kallitsis, et al.  Understanding the mirai botnet.  In 26th USENIX security symposium (USENIX Security 17), pages 1093–1110, 2017.
  * [19] Ahmed M Manasrah, Thair Khdour, and Raeda Freehat.  Dga-based botnets detection using dns traffic mining.  Journal of King Saud University-Computer and Information Sciences, 34(5):2045–2061, 2022.
  * [20] Kishor Bharti, Alba Cervera-Lierta, Thi Ha Kyaw, Tobias Haug, Sumner Alperin-Lea, Abhinav Anand, Matthias Degroote, Hermanni Heimonen, Jakob S Kottmann, Tim Menke, et al.  Noisy intermediate-scale quantum algorithms.  Reviews of Modern Physics, 94(1):015004, 2022.
  * [21] Félix Brezo, José Gaviria de la Puerta, Xabier Ugarte-Pedrero, Igor Santos, Pablo G. Bringas, and David Barroso.  Supervised classification of packets coming from a HTTP botnet.  In 2012 XXXVIII Conferencia Latinoamericana En Informatica (CLEI), pages 1–8. IEEE, 2012.
  * [22] Giorgio Piras, Maura Pintor, Luca Demetrio, and Battista Biggio.  Explaining machine learning DGA detectors from DNS traffic data.  https://arxiv.org/abs/2208.05285, 08 2022.
  * [23] Zhi-Juan Jia, Ning Wang, Yun-Ye Wang, and Ming-Sheng Hu.  The traceability analysis and research of botnet control center based on ant colony group-dividing algorithm.  In 2018 13th IEEE Conference on Industrial Electronics and Applications (ICIEA). IEEE, 2018.
  * [24] Manuel Gil Pérez, Alberto Huertas Celdrán, Fabrizio Ippoliti, Pietro G. Giardina, Giacomo Bernini, Ricardo Marco Alaez, Enrique Chirivella-Perez, Félix J. García Clemente, Gregorio Martínez Pérez, Elian Kraja, Gino Carrozzo, Jose M. Alcaraz Calero, and Qi Wang.  Dynamic reconfiguration in 5G mobile networks to proactively detect and mitigate botnets.  IEEE Internet Computing, 21(5):28–36, 2017.
  * [25] Patrick Onotu, David Day, and Marcos Rodrigues.  Accurate shellcode recognition from network traffic data using artificial neural nets.  In The 28th Canadian Conference on Electrical and Computing Engineering (CCECE), pages 355–360, 2015.
  * [26] Pascal Maniriho, Abdun Naser Mahmood, and Mohammad Jabed Morshed Chowdhury.  Evaluation and survey of state of the art malware detection and classification techniques: Analysis and recommendation.  http://dx.doi.org/10.2139/ssrn.4197678, 2022.
  * [27] Gennaro De Luca.  A survey of nisq era hybrid quantum-classical machine learning research.  Journal of Artificial Intelligence and Technology, 2(1):9–15, 2022\.
  * [28] Michael Broughton, Guillaume Verdon, Trevor McCourt, Antonio J Martinez, Jae Hyeon Yoo, Sergei V Isakov, Philip Massey, Ramin Halavati, Murphy Yuezhen Niu, Alexander Zlokapa, et al.  Tensorflow quantum: A software framework for quantum machine learning.  arXiv preprint arXiv:2003.02989, 2020.
  * [29] Hatma Suryotrisongko, Yasuo Musashi, Akio Tsuneda, and Kenichi Sugitani.  Adversarial robustness in hybrid quantum-classical deep learning for botnet DGA detection.  Journal of Information Processing, 30:636–644, 2022.
  * [30] Maxim Kalinin and Vasiliy Krundyshev.  Security intrusion detection using quantum machine learning techniques.  Journal of Computer Virology and Hacking Techniques, 2022.
  * [31] Hatma Suryotrisongko.  Botnet DGA Dataset.  https://dx.doi.org/10.21227/rg6z-z622, 05 2020.
  * [32] H Suryotrisongko.  Botnet dga detection.  IEEE Code Ocean, 2021.
  * [33] Mattia Zago, Manuel Gil Pérez, and Gregorio Martínez Pérez.  Umudga: A dataset for profiling algorithmically generated domain names in botnet detection.  Data in Brief, 30:105400, 2020.
  * [34] R. Livni I. Amir, T. Koren.  Sgd generalizes better than gd (and regularization doesn’t help).  arXiv2 preprint arXiv:2102.01117, 2022.
  * [35] Pedro Domingos and Geoff Hulten.  Mining high-speed data streams.  In Proceedings of the sixth ACM SIGKDD international conference on Knowledge discovery and data mining, pages 71–80, 2000.
  * [36] Wassily Hoeffding.  Probability inequalities for sums of bounded random variables.  Journal of the American Statistical Association, 58:13–30, 1963\.
  * [37] Oded Maron and Andrew W. Moore.  Hoeffding races: Accelerating model selection search for classification and function approximation.  In J. D. Cowan, G. Tesauro, and J. Alspector, editors, Advances in Neural Information Processing Systems, volume 6, pages 59–66. Morgan Kaufmann Publishers, San Francisco, CA, 1994.
  * [38] Jacob Montiel, Jesse Read, Albert Bifet, and Talel Abdessalem.  Scikit-multiflow: A multi-output streaming framework.  Journal of Machine Learning Research, 19(72):1–5, 2018.

###### List of Figures

  1. 1 Stabilized architecture of experiments on real quantum devices comprising of three components Google Cloud, Azure and Azure Quantum Providers.
  2. 2 Stabilized architecture for QHTC experiments on quantum simulators Aer and Rigetti-S. The difference in implementation originates from differences in library functionalities available on Aer and Rigetti-S.
  3. (a) (a) Stabilized architecture for  QHTC experiment on Aer
  4. (b) (b) Stabilized architecture for  QHTC experiments on Rigetti-S
  5. 3 Quantum-enhanced SIEM. The individual steps are marked with numbers in red circles and are explained in List (11)
  6. 4 PegasosQSVC’s accuracy on quantum simulator AER with (a) a batch size of 100 data samples does not improve its accuracy with an increased number of batches, unlike (b) a batch size of 1,000 data samples.
  7. (a) (a) Batch size of 100 data samples
  8. (b) (b) Batch size of 1,000 data samples

###### List of Tables

  1. 1 Naming conventions for selected platforms shown with their machine name and their device mode (quantum simulator, real-device-based simulator, or real quantum device)
  2. 2 Selected descriptive statistics of the IEEE Botnet DGA Dataset [31] for the seven features according to the Anderson-Darling normality test.
  3. 3 Performance results in terms of accuracy and total execution time $\text{T}_{\text{total}}$ of real quantum devices, using 100 data samples for all runs. For each algorithm and platform, the choice of the feature map and the optimizer is also shown.
  4. 4 Performance results in terms of accuracy and total execution time $\text{T}_{\text{total}}$ of quantum simulator and real-device-based simulator experiments, using 5,000 data samples for QHTC, and 1,000 data samples for all other algorithms. For each algorithm and platform, the choice of the feature map and the optimizer is also shown.
  5. 5 Metric results in terms of accuracy, F1-score and AUC for algorithm QHTC, displayed for 5 batches with 1,000 data samples each and their average.