Abstract
As cybersecurity threats evolve, it has become increasingly important to ensure data protection while successfully discovering intrusions. This paper introduces a novel Quantum Computation with Neural Networks for Intrusion Detection and Data Security (QCNN-IDDS) framework, which integrates advanced quantum computing and neural network techniques for intrusion detection and encryption. The framework uses a Quadratic Neural Network (QNN) to model complex, nonlinear relationships in data, improving intrusion detection performance. Data preprocessing is performed using the Double Normalization Technique (DNT), followed by feature extraction that incorporates statistical measures (e.g., mean, variance, skewness) to assess feature relevance. The detection process uses an Entropy Threshold Weighted Quantum Neural Network (ETW-QNN) and LinkNet to classify data as normal or abnormal. Data classified as normal is then encrypted using the Modulus-assisted Blowfish (MAB) algorithm, providing robust data security. Evaluation on UNSW-NB15 dataset demonstrates that the ETW-QNN model achieves a peak accuracy of 0.917, outperforming models like CNN + LSTM + GRU (0.747), LinkNet (0.742), EfficientNet (0.743), and ResNet (0.757), while DNN achieves the lowest accuracy at 0.730. The proposed framework offers significant improvements in both detection accuracy and data security compared to traditional methods. With its potential for high accuracy and low false positive rates, the QCNN-IDDS framework is expected to enhance the efficiency and reliability of real-world cybersecurity systems, paving the way for more robust, adaptive, and scalable solutions in dynamic and high-traffic environments.
Introduction
Interconnected computer systems are now widely used in everyday activities and organizational processes. This increased connectivity has also raised concerns about online privacy and user security.1,2 Recent surveys report approximately 5.1 billion cyberattacks in 2021 and highlight a rise in high-impact and sophisticated attacks on critical frameworks worldwide. This alarming number underscores the urgent need to improve network security measures. ML3,4 based NIDS are considered one of the most effective strategies for combating network attacks. However, maintaining the efficiency and effectiveness of ML-based NIDS5,6 in the face of constantly evolving threats is a significant challenge. Developing an optimal framework for ML-based NIDS 7 involves a continuous trade-off between efficiency and effectiveness; systems that excel in one aspect may not perform as well in the other.
NIDPS leverages ML to achieve accuracy levels that surpass those of traditional rule-based schemes. Advanced ML 8 algorithms and powerful hardware accelerators are key components of modern IDS/IPS.9,10 As ML 11 models advance, they demand greater processing power, leading to the development of hardware accelerators with increased computational capabilities. This enables the classification of high-capacity traffic in each session and enhances the accuracy of network intrusion detection. 12
Rapid detection and containment of network intrusions are key to preventing further impact. However, current ML-based IDS/IPS systems identify intrusions only after a session has ended, using a 5-tuple like “source IP, destination IP, source port, destination port, protocol”, to define each session. In traffic segmented into sessions, statistical values from the start to the end of the session are used as features for the ML model, 13 which then determines malicious activity on a per-session basis. Consequently, network intrusions are detected only after the session and the intrusion itself has concluded, which limits the effectiveness of this approach in providing timely network protection.
Various ML approaches have been explored and applied, to develop anomaly-based IDS. Two commonly used ML approaches in this field are: “1) Supervised Learning, which creates a mapping function from predefined input-output pairs, and 2) Unsupervised Learning, which enables a model to identify internal relationships autonomously”. Supervised learning is the most prevalent method in IDS, 14 with techniques such as SVM, DT, KNN, and NB being frequently utilized. Unsupervised learning typically involves clustering algorithms like K-Means.
This method combines two or more learning techniques, 15 such as integrating a signature-based method with an anomaly-based one or combining different types of anomaly-based methods. For instance, it might involve combining unsupervised and supervised ML techniques,16,17 or using multiple supervised learning methods together. To improve the overall detection rate, the hybrid method's main objective is to balance the advantages of several learning algorithms. Additionally, it addresses dataset imbalances by reducing bias towards more frequent attacks. Consequently, the hybrid scheme is considered a promising strategy for tackling key challenges in IDS research. The ability of current machine learning (ML)-based intrusion detection systems (IDS) to handle complicated, nonlinear connections in data, as well as their dependence on predetermined attack signatures or labeled datasets, are frequently limitations. This includes both supervised and unsupervised learning techniques. Furthermore, sensitive data is left exposed in the case of an intrusion since these systems usually concentrate on intrusion detection without taking into account the simultaneous need for data encryption and security. Therefore, the goal of this work is to create a next-generation intrusion detection system (IDS) framework that, in addition to utilizing quantum-enhanced machine learning to achieve superior intrusion detection accuracy, also protects sensitive data, providing a cohesive solution for security and privacy in the face of changing cyberthreats. This paper proposes a novel Quantum Computation with Neural Network for Intrusion Detection and Data Security (QCNN-IDDS). One of the key contributions of this work is the DNT for normalizing the pre-processed data. This normalized data reduces the impact of extreme values on the data and scales the data more effectively. Also, it overcomes the issue of skewed results. The proposed ETW-QNN for effectively detecting anomalies, which enhances the training speed and prediction accuracy using the proposed threshold circuit that leads to less computational resources. Proposing MAB algorithm for encrypting the detected normal data. Blowfish is based on a strong Feistel network structure and has been extensively analyzed for security. Here, the F-function is modified for better security.
The organization of the paper is: Section 2 provides a detailed related works, synthesizing existing research on IDS. Section 3 outlines the developed methodology. Section 4 presents the results and discussion, where the effectiveness of the framework is evaluated through experiments and comparisons with existing methods. Section 5 discusses the conclusion.
Literature review
we can reorganize the studies based on the methodology used, grouping them into ML-based, hybrid models, and DL-based methods.
ML- based approaches
In 2020, Dutt, et al. 18 The paper presented an intrusion detection system inspired by the natural immune system, comprising two main components: SMAD and AIAD. SMAD served as the first layer, representing IIS. It analyzed initial network traffic to identify vulnerabilities. AIAD functioned as the second layer, mimicking the Adaptive Immune System. It assessed network packet features, including T-cell and B-cell activity, to detect anomalies. Testing with real-time traffic and datasets showed that SMAD achieved up to 96.04% TPR, while AIAD improved detection accuracy for both user-based and file-based anomalies.
In 2022, Siddiqi and Pak, 19 With the rise in advanced hacking methods, the demand for better network security solutions had grown. ML played a vital role in network intrusion detection, but optimizing these systems remained an ongoing issue. This study introduced a novel framework that combined image processing with feature selection. It initially streamlined feature selection to improve efficiency, then converted non-image data into images and enhanced these images for anomaly detection using DL.
In 2019, Zuniga-Mejia, et al. 20 The paper introduced an innovative intrusion detection method for reconfigurable network routing, grounded in linear systems theory. This method utilized the z-plane, a natural two-dimensional feature space, to identify routing attacks by examining system poles. The study presented two host-based IDS inspired by this approach and assessed them through a case study. Both techniques demonstrated high accuracy in detecting attacks without adding packet overhead, by analyzing information available locally.
In 2019, Tama, et al. 21 An improved IDS was proposed that incorporated a hybrid feature selection strategy and a two-level classifier ensemble. The feature selection employed PSO, ACO, and GA to refine the UNSW-NB15 and NSL-KDD datasets, guided by the REPT classifier. The two-level ensemble used rotation forest and bagging meta-learners. The findings were further validated through a two-step statistical significance test, which enhanced the robustness of the results.
Hybrid models
In 2019, Khan, et al. 22 The paper presented a hybrid anomaly detection model designed for ICS, focusing on the consistent communication patterns among ground devices. The methodology involved several steps: data preprocessing for standardization and scaling, dimensionality reduction to refine anomaly detection, and balancing the dataset using an edited NNRA. When evaluated using a vast dataset from the HML-IDS attained a 97% accuracy rate, surpassing the results of benchmark models.
In 2021, Wisanwanichthan and Thammawichai, 23 The paper introduced DLHA to address issues in intrusion detection. By analyzing attack characteristics and employing PCA to refine detection across various attack types. Comparative analysis with other studies using the NSL-KDD dataset demonstrated that DLHA significantly outperformed several advanced IDS techniques and individual ML classifiers.
DL-based approaches
In 2022 Kim and Pak, 24 have proposed a method that tackles the problem of classifying network intrusions and benign sessions by identifying patterns in packets that are not useful. It generates a new training dataset for GAN from misclassified data in the original training set, processed by an LSTM-DNN model. This approach, which integrates LSTM-DNN with a GAN-based validation system, allows for real-time intrusion detection without terminating sessions or delaying packet collection. Furthermore, experimental results showed that it can detect intrusions at an early stage, achieving detection performance on par with existing methods.
In 2021, Mora-Gimeno, et al. 25 The paper presented a unified IDS that combined multiple detection techniques to model the overall behavior of applications. By employing DNN, the system amalgamated the results of various detection methods. The findings indicated that the suggested model significantly enhanced detection rates and minimized false positives compared to individual techniques. The approach was validated on three datasets of varying complexities.
In 2022, Banaamah and Ahmad 26 explored deep learning methods for intrusion detection in IoT, comparing CNNs, LSTM, and GRUs. Using a standard dataset, the study evaluated these models and found that the suggested scheme obtained the maximum accuracy compared to existing approaches.
In 2023, Awajan et al. 27 introduced a novel DL-based intrusion detection system for IoT devices. Using a four-layer FC network, the system detected malicious traffic and was designed to be communication protocol-independent, simplifying deployment. It effectively identified “Blackhole, DDoS, Opportunistic Service, Sinkhole, and Workhole” attacks.
In 2024, Schrötter et al. 28 has employed a deep neural network model for intrusion detection was reproduced in order to assess the advantages and disadvantages of the machine-learning-based method. Our replicated research study's findings highlight a number of systematic issues with the evaluation techniques and datasets that were used. Even with minor traffic variations, a minimally configured signature-based intrusion detection system outperformed the tested model in our tests. The summary of related works are tabulated in Table 1.
Review of existing works in the area of Intrusion detection framework.
Review of existing works in the area of Intrusion detection framework.
Current IDS solutions encounter challenges in seamlessly integrating advanced detection algorithms with comprehensive data security measures. Traditional IDS solutions have struggled to overcome several persistent challenges, including scalability, real-time responsiveness, and the adaptation to increasingly sophisticated attack methods. Many existing IDS frameworks are limited in their ability to efficiently handle large volumes of network data while maintaining high levels of accuracy. Moreover, integrating data security measures into the detection process itself often results in trade-offs between detection performance and data protection, making it difficult to achieve both objectives simultaneously. This framework aims to guarantee precise detection outcomes while safeguarding sensitive data throughout the entire detection and response lifecycle.
Methodology of intrusion detection framework
Ensuring the security of information systems is essential in the linked world of today. IDFs play a critical role in safeguarding these systems by continuously observing and evaluating system activity and network traffic in order to identify and neutralize possible security threats. An IDF is designed to identify unauthorized access, data breaches, and other malicious actions that could jeopardize the integrity, availability or confidentiality of sensitive information. Utilizing a blend of detection techniques, such as signature-based and anomaly-based approaches, along with sophisticated analysis and response strategies, an IDF offers proactive protection against emerging cyber threats. Its effectiveness is further strengthened by integrating thorough data collection, adaptive response capabilities and real-time analysis, enabling organizations to quickly resolve and address potential intrusions before they escalate into significant security issues. This paper proposes a novel Quantum Computation with Neural Network for Intrusion Detection and Data Security (QCNN-IDDS).
As illustrated in Figure 1, the process initiates with input data preparation, in which the Double Normalization Technique (DNT) is used to prepare the raw data for analysis. This step adjusts the data to a common scale, enhancing the efficiency of subsequent feature extraction. During feature extraction, various techniques are employed to identify significant attributes: “mutual information, raw feature, and information gain assess the relevance of features, while statistical features such as minimum, maximum, mean, median, standard deviation, variance, skewness, kurtosis, and moment”, provide detailed insights into the data distribution and characteristics. Following feature extraction, the data undergoes detection using advanced models like Entropy Threshold Weighted-based Quantum Neural Networks (ETW-QNN) and LinkNet, which analyze the features to classify the data as either ‘normal or abnormal’. If the data is classified as normal, it is then subjected to data encryption using the Modulus-assisted Blowfish (MAB) algorithm, ensuring its security through robust encryption methods. This structured flow effectively prepares, analyzes, and secures data, maintaining its confidentiality and integrity throughout the process.

Framework of QCNN-IDDS.
Preprocessing via normalization is an essential phase in data preparation, focusing on adjusting and standardizing the scale of features within a dataset. This technique balances the contribution of each feature to the analysis, regardless of their initial scales or units. Let
DNT for preprocessing
Normalization
29
adjusts data,
However, it can be significantly affected by outliers, any extreme values can distort the scaling, leading to skewed results. Moreover, it assumes that the features have similar importance and distribution. To tackle this issue, a new DNT approach is proposed that reduces the impact of extreme values on the normalized data. The proposed DNT formulation for normalizing the original data is expressed in Eq. (2).
Thus, the proposed DNT employs
Feature extraction is a critical step in data preprocessing and analysis, aimed at transforming preprocessed data,
Where
The information gain is estimated using the entropy value as in Eq. (5). Here, E indicates samples;
Thus, the information gain features extracted from
Description and formulae of statistical features.
Thus, the statistical features like “min, max, mean, median, standard deviation, variance, skewness, kurtosis, and moment” extracted from
Thereby, the overall features like mutual information, information gain, statistical features and raw features are fused together and are represented as
The technique of locating harmful activity within a computer network or system is known as intrusion detection. During this stage, as illustrated in Figure 2, the features that were taken out of the data are fed into an intrusion detection model that includes two advanced models: ETW-QNN and LinkNet. The ETW-QNN model leverages quantum computing principles to enhance its capability to detect complex patterns and anomalies in the data, offering improved accuracy and efficiency compared to classical approaches. The LinkNet model, on the other hand, is a deep learning architecture that combines CNN with skip connections, enabling precise segmentation and anomaly detection through its encoder-decoder structure. These models are designed to train on the feature set to achieve effective anomaly detection. Both models (ETW-QNN and LinkNet) generate intermediate scores representing the likelihood of detected anomalies as

Intrusion detection via EWT-QNN.
Lastly, it is necessary to make sure that only those who are permitted can access and read the standard data. Thus, the MAB algorithm is used to encrypt the data.
Quantum Neural Networks (QNNs) 33 represent a sophisticated blend of quantum computing and neural network principles, designed to harness the unique properties of quantum mechanics for advanced computational tasks. QNNs are essentially based on quantum bits (qubits), which can represent several possibilities at once since they can exist in multiple states concurrently. This is in contrast to classical bits. Because of this feature, QNNs may analyse data in parallel, which could increase their computational efficiency. The architecture of a QNN typically includes several key components: like “Qubits, Quantum circuits, quantum gates and measurement”.
A circuit family is an infinite sequence of circuits
A circuit family is considered as “polytime-uniform” if there exists a Turing machine that, within a time bound of
A weighted threshold function of threshold and weight is represented as
However, designing and running ETW-QNN requires complicated quantum circuits and significant computational resources. Also, quantum computers are still in the early stage of development with limited qubits and high error rates. This can be addressed by assisting entropy, in which the weighted threshold function is modified. The standard form of entropy is formulated as in Eq. (8).
Then, the modified entropy is expressed as in Eq. (9). Here,
Then, the proposed weighted threshold function is expressed in Eq. (11). Here,
Thus, this approach lies in its ability to sustainably enhance the training speed and prediction accuracy through the proposed threshold circuit, which leads to less computational resources. Moreover, it minimizes the model size, potentially speeds up certain computational issues and ability to scale quantum circuits for more complex tasks.
LinkNet 34 is a DL architecture specifically designed for semantic segmentation tasks. It integrates DCNNs with lightweight components to achieve high performance in segmentation while ensuring computational efficiency. The architecture comprises two main phases: “the encoder and the decoder”, as shown in Figure 3.

Structure of LinkNet.
The encoder is built on a sequence of convolutional blocks that progressively extract features from the input image. It typically utilizes a modified version of well-known CNN architectures like ResNet or DenseNet as its backbone. This phase includes multiple layers such as “convolutional layers, BN, and activation functions”, which work together to capture hierarchical features from the data. The decoder, on the other hand, is tasked with reconstructing the segmentation map from the feature maps generated by the encoder. The decoder refines the feature maps to provide the final segmentation result by using a sequence of upsampling layers, such as transposed convolutions or upsampling followed by convolutions, to improve the spatial resolution of the feature maps.
Moreover, LinkNet includes skip connections, also referred to as residual connections, between the encoder and decoder. These connections aid in retaining spatial information and details that may be lost during the downsampling process. By linking high-level features from the encoder with corresponding lower-level features in the decoder, the skip connections enhance the accuracy of the output. Then, the intermediate score acquired from LinkNet is denoted as
Data encryption is essential for maintaining the confidentiality and integrity of sensitive information. After detecting the malicious attacks, the normal data are subjected to the data encryption phase. By converting data into an unreadable format, it prevents unauthorized users from deciphering sensitive information, safeguarding it from espionage and theft. There are various approaches for data encryption, among those, the MAB algorithm is proposed, which is a variant of the Blowfish algorithm. The elucidation of the MAB algorithm is given as follows:
The MAB algorithm makes use of Blowfish's strong structure while adding new features that increase its defences against assaults without sacrificing system speed. This method offers a reliable and scalable way to safeguard sensitive data while guaranteeing high-accuracy intrusion detection in real-time settings, especially when combined with ECC-based key management and AES for comparison. By concentrating on the precise adjustments and integrations made to these algorithms, we make sure that the contributions to data security and intrusion detection are expressed in an understandable manner while removing superfluous information regarding the fundamental operation of these well-known techniques.
Blowfish employs a 16-round Feistel structure for data encryption and relies on extensively key-dependent S-boxes. Each round involves a permutation dependent on the key and a substitution that relies on both the key and the data. The representation of data encryption is illustrated in Figure 4. Blowfish is well-suited for applications where the key remains constant over time, such as communication links or automatic file encryption. The algorithm leverages basic operations like “exclusive-or, addition, table lookup, and modular multiplication” that are efficient on microprocessors. It avoids complex operations such as bit-wise permutations, variable-length shifts, and conditional jumps, and it uses precomputed subkeys, which can be prepared in advance on systems with large memory for improved performance. Traditionally, the F-function is formulated as in Eq. (12) and their illustration is given in Figure 5.

Representation of data encryption.

Standard form of F-function.
The proposed representation of F-function is depicted in Figure 6 and the new formulation of F-function is formulated as in Eq. (13).

Illustration of proposed F-function.
Moreover, decryption is identical to encryption and it is the reverse process of encryption.
Simulation procedure
The proposed intrusion detection framework was simulated using Python 3.7. The hardware utilized comprised an “11th Gen Intel® Core™ i5–1135G7 processor with a base clock of 2.40 GHz and 16.0 GB of RAM.” Furthermore, the performance of the intrusion detection system was assessed with the UNSW-NB15 dataset. 36
Dataset description
Raw network packets for this dataset were created with the “IXIA PerfectStorm tool at the Cyber Range Lab of UNSW Canberra,” simulating a combination of real modern activities and synthetic attack behaviors. A total of 100 GB of raw network traffic was captured using Tcpdump and saved as Pcap files. The dataset includes nine attack types: “Fuzzers, Analysis, Backdoors, DoS, Exploits, Generic, Reconnaissance, Shellcode, and Worms.” Argus and Bro-IDS tools facilitated the generation of 49 features through twelve different algorithms, with details provided in the UNSW-NB15_features.csv file.
A total of 2,540,044 records are included in the dataset, which is divided into four separate CSV files: “UNSW-NB15_1.csv, UNSW-NB15_2.csv, UNSW-NB15_3.csv, and UNSW-NB15_4.csv.” The ground truth information is stored in the “UNSW-NB15_GT.csv file, and the event list is detailed in UNSW-NB15_LIST_EVENTS.csv.” The dataset was partitioned into training and testing subsets, specifically “UNSW_NB15_training-set.csv and UNSW_NB15_testing-set.csv.” The training subset includes 175,341 records, and the testing subset contains 82,332 records, encompassing various attack types and normal data.
For our analysis, we evaluated the dataset using varying proportions of training data: 60%, 70%, 80%, and 90%. Specifically, with 60% of training data, we utilized 3000 samples for training and 2000 samples for testing. When using 70% of the training data, the dataset comprised 3500 training samples and 1500 testing samples. For 80% of the training data, there were 4000 training samples and 1000 testing samples. Finally, with 90% of the training data, we had 4500 training samples and 500 testing samples.
Performance analysis
A thorough estimating process was used to evaluate the suggested approach against traditional methods within the intrusion detection system. This evaluation covered two major aspects: a) Detection and b) Data Encryption. For the detection aspect, a wide range of metrics including “Sensitivity, Negative Predictive Value (NPV), Specificity, F-measure, False Negative Rate (FNR), Precision, False Positive Rate (FPR), Matthews Correlation Coefficient (MCC), and Accuracy” were used to analyze the ETW-QNN method's effectiveness. Additionally, ablation studies and statistical comparisons were conducted with state-of-the-art methods like CNN + LSTM + GRUS 26 and DNN, 27 as well as traditional models such as EfficientNet, LinkNet, SqueezeNet, ResNet, NN, and QNN. In terms of data encryption, the MAB approach was evaluated for attack resilience, encryption time, and decryption time, and was compared against conventional methods including ECC, AES, Blowfish, Elgamal, and FerNet.
Detection analysis
Box-plot comparison of positive performance metrics
A box plot is a visual representation that summarizes a data set, highlighting the distribution of the data as well as identifying any outliers. It effectively compares multiple data sets, as multiple box plots can be displayed on the same graph. To evaluate the effectiveness of the ETW-QNN strategy, its performance is compared with several conventional methods, including EfficientNet, LinkNet, CNN + LSTM + GRUs, 26 DNN, 27 SqueezeNet, ResNet, NN and QNN, specifically for intrusion detection in data security. Figure 7 illustrates the positive metric evaluation of these methods. The accuracy analysis across various models with different training data proportions highlights the superior performance of ETW-QNN strategy. At 60% training data, the ETW-QNN method achieves an impressive accuracy of 0.878, significantly outperforming other models, including EfficientNet (0.745), LinkNet (0.739), CNN + LSTM + GRUs 26 (0.767), DNN 27 (0.723), SqueezeNet (0.757), ResNet (0.752), NN (0.743) and QNN (0.756). This trend is maintained with an increase in the proportion of training data. The ETW-QNN model's accuracy improves to 0.901 with 70% of the training data, maintaining its lead over traditional methods. The ETW-QNN model reaches an accuracy of 0.928 with 80% of training data, continuing to outshine all other models in the comparison. With 90% of training data, the ETW-QNN method achieves an accuracy of 0.962, proving its exceptional and steady performance in intrusion detection.

Box-plot analysis of positive metrics for ETW-QNN and conventional methods.
At 60% training data, the ETW-QNN method achieves a sensitivity of 0.879, which is notably higher than that of other models, such as EfficientNet with 0.772, LinkNet with 0.753, and CNN + LSTM + GRUs 26 with 0.773. This trend continues as the amount of training data increases. At 70% training data, the ETW-QNN strategy's sensitivity rises to 0.888, surpassing the sensitivities of Efficient Net (0.729), LinkNet (0.761), and CNN + LSTM + GRUs 26 (0.756). By 80% training data, the ETW-QNN method reaches an impressive sensitivity of 0.928, compared to CNN + LSTM + GRUs 26 's peak sensitivity of 0.728 and SqueezeNet (0.777). The ETW-QNN strategy reaches the highest sensitivity of 0.963 with 90% training data, while ResNet and QNN display lower sensitivities of 0.766 and 0.711, respectively. Overall, the ETW-QNN model stands out with its superior sensitivity across all training data levels, showcasing its effectiveness and reliability in intrusion detection over traditional models. At 70% training data, the ETW-QNN strategy achieves a specificity of 0.910, outperforming other methods such as EfficientNet (0.753), LinkNet (0.747), CNN + LSTM + GRUs 26 (0.739), DNN 27 (0.719), SqueezeNet (0.767), ResNet (0.741), NN (0.721) and QNN (0.732). This high specificity shows that the ETW-QNN approach is very good at precisely identifying intrusions. The Positive Metric evaluation that demonstrates that the ETW-QNN methodology outperforms conventional techniques. These results of DNT-based pre-processing, which effectively prepares the data for analysis, and the utilization of a hybrid architecture that enhances detection accuracy. These factors collectively contribute to higher positive metric values observed, highlighting the ETW-QNN method's efficacy in accomplishing more precise and reliable outcomes.
The box-plot analysis of ETW-QNN strategy, compared to EfficientNet, LinkNet, CNN + LSTM + GRUs, 26 DNN, 27 SqueezeNet, ResNet, NN and QNN, regarding negative metrics for intrusion detection in data security, is presented in Figure 8. This analysis highlights how the ETW-QNN method contrasts with conventional approaches in minimizing negative metrics. Achieving minimal negative metric values is essential for enhancing the model's capability to detect intrusions accurately and efficiently. The evaluation of FPR across multiple models demonstrates that the ETW-QNN strategy delivers superior performance compared to conventional methods. The ETW-QNN approach, using 60% of training data, obtains an FPR of 0.123, substantially lower than that of competing models. EfficientNet, for instance, has an FPR of 0.273, while LinkNet records 0.271, and CNN + LSTM + GRUs 26 shows 0.238. DNN, 27 SqueezeNet, and QNN exhibit higher FPR values of 0.289, 0.252, and 0.253, respectively. When the training data is raised to 70%, the ETW-QNN strategy further reduces its FPR to 0.090, outperforming both EfficientNet (0.247) and LinkNet (0.253), among other methods. At 80% training data, the ETW-QNN method achieves an FPR of 0.072, which remains lower than the FPRs of EfficientNet (0.238), LinkNet (0.289), and CNN + LSTM + GRUs 26 (0.260).

Box-plot analysis of negative metrics for ETW-QNN and conventional methods.
The ETW-QNN approach demonstrated a remarkably low FNR of 0.037 with 90% of the training data, significantly better than the FNRs of other models assessed. For instance, EfficientNet had an FNR of 0.229, signifying a higher rate of error. LinkNet recorded an FNR of 0.271, CNN + LSTM + GRUs 26 0.220, and DNN 27 0.280, all of which are higher than the ETW-QNN method's rate. SqueezeNet and ResNet both had FNRs of 0.271 and 0.234, respectively, while QNN had the highest FNR at 0.289. The low FNR of ETW-QNN strategy means it is highly effective at identifying intrusions with minimized error rates. This remarkable reduction in error values demonstrates the ETW-QNN approach's effectiveness in enhancing intrusion detection accuracy and reliability, thereby improving its ability to accurately detect malicious activities. This reduction in negative metrics is attributed to the effectiveness of DNT-based pre-processing and the precise detection capabilities provided by the hybrid architecture. These advancements contribute to a significant decrease in undesirable outcomes, highlighting the ETW-QNN method's superior performance in mitigating negative metrics relative to traditional approaches.
Figure 9 illustrates a box plot evaluation of ETW-QNN methodology compared to Efficient Net, LinkNet, CNN + LSTM + GRUs, 26 DNN, 27 Squeeze Net, Res Net, NN and QNN, focusing on various other metrics for intrusion detection in data security. This comparison highlights how the ETW-QNN approach differs from conventional methods in terms of these metrics. Analysis of the F-measure across different models shows that the ETW-QNN strategy excels in performance compared to traditional methods. Using 60% of training data, the ETW-QNN approach attains an F-measure of 0.852, significantly outperforming the F-measures of other models. For instance, Efficient Net has an F-measure of 0.708, Link Net at 0.698, and CNN + LSTM + GRUs 26 at 0.726. DNN, 27 Squeeze Net, NN 28 and QNN show F-measure values of 0.681, 0.717, and 0.716, respectively. As the training data increases to 70%, the ETW-QNN strategy's F-measure rises to 0.881, surpassing Efficient Net (0.702), Link Net (0.719), and CNN + LSTM + GRUs 26 (0.712). The ETW-QNN method, at 80% training data, achieves an improved F-measure of 0.912, outpacing Efficient Net (0.698), Link Net (0.683), and other models. By utilizing 90% of training data, the ETW-QNN strategy achieves a remarkable F-measure of 0.957, highlighting its advantage over EfficientNet (0.718), LinkNet (0.719), and ResNet (0.749). This consistently high F-measure across varying training data underscores the ETW-QNN strategy's efficacy in balancing precision and recall, making it extremely effectual for intrusion detection in data security.

Box-plot analysis of other metrics for ETW-QNN.
With the highest MCC of 0.923 at 90% training data, the ETW-QNN performs more effectively in intrusion detection. This is significantly higher than other methods, including EfficientNet (0.476), LinkNet (0.497), CNN + LSTM + GRUs 26 (0.489), DNN 27 (0.466), SqueezeNet (0.513), ResNet (0.547), NN (0.521) and QNN (0.461). This result highlights the ETW-QNN method's effectiveness in accurately detecting intrusions. An NPV of 0.950 is demonstrated using the ETW-QNN approach at 80% training data. In comparison, other models exhibit lower NPV values. EfficientNet achieves an NPV of 0.804, while LinkNet and CNN + LSTM + GRUs 26 have NPVs of 0.802 and 0.800, respectively. DNN 27 shows a slightly higher NPV of 0.809, and SqueezeNet and QNN both have NPVs of 0.833. Despite these values being reasonably high, they still fall short of the ETW-QNN approach's performance.
In Table 3, an ablation evaluation is presented, comparing the ETW-QNN approach with several variations, such as a model employing conventional normalization, a model using standard QNN, and a model lacking feature extraction. This analysis highlights the impact of each component on the effectiveness of intrusion detection in data security, providing insights into the contributions of normalization, QNN, and feature extraction methods to the overall performance of ETW-QNN approach. Additionally, the analysis is conducted using 90% of training data. The ETW-QNN achieves a precision of 0.950, highlighting its high effectiveness in detecting intrusions with outstanding precision. Conversely, the models with traditional normalization and conventional QNN display reduced precision values of 0.722 and 0.726, respectively. The precision of 0.754 for the model without feature extraction is lower than the precision achieved by the ETW-QNN method. The higher precision of ETW-QNN strategy signifies that it is better at accurately detecting intrusions. In the ablation analysis, the ETW-QNN strategy accomplished an FNR of 0.037, which is notably lesser compared to other models. By contrast, the other models demonstrate higher FNR values: the model using conventional normalization has an FNR of 0.195, the conventional QNN model has an FNR of 0.183, and the model lacking feature extraction has an FNR of 0.190. A lesser FNR specifies that the model is more applicable at detecting intrusions and diminishing error values.
Ablation analysis on ETW-QNN, model with conventional normalization, model with conventional QNN and model without feature extraction.
Ablation analysis on ETW-QNN, model with conventional normalization, model with conventional QNN and model without feature extraction.
Table 4 provides a detailed statistical evaluation of the ETW-QNN methodology compared to EfficientNet, LinkNet, CNN + LSTM + GRUs, 26 DNN, 27 SqueezeNet, ResNet, NN 28 and QNN for intrusion detection in data security. This comparison highlights how the ETW-QNN approach stands in contrast to traditional methods, offering insights into its relative performance and effectiveness in detecting intrusions. Table 4 displays the mean statistical metric values for the various models’ intrusion detection performance. The ETW-QNN model outperforms all other methods, achieving the highest mean accuracy of 0.917, with a peak accuracy of 0.962, and a relatively higher standard deviation of 0.031516, indicating strong performance with some variability. In comparison, CNN + LSTM + GRUs has a mean accuracy of 0.747, SqueezeNet achieves 0.760, and ResNet shows a mean of 0.757. The QNN model performs slightly better than DNN (mean 0.730) and shows a mean accuracy of 0.75. The QNN approach reaches an accuracy of 0.750. These values highlight that the ETW-QNN method not only outperforms the conventional models but also sets a new standard in accuracy for intrusion detection, demonstrating superior capability in consistently identifying intrusions. In the provided data, the ETW-QNN methodology stands out with an accuracy of 0.962, which significantly exceeds the maximum accuracies of other models. For comparison, CNN + LSTM + GRUs 26 reaches an accuracy of 0.767, while DNN, 27 SqueezeNet, and ResNet have accuracies of 0.737, 0.763, and 0.776, respectively. This elevated accuracy reflects the ETW-QNN model's ability to perform at a peak level in intrusion detection tasks.
Statistical analysis on accuracy.
Statistical analysis on accuracy.
Attack analysis
The MAB strategy's attack analysis is contrasted with more traditional encryption methods including ECC, AES, Blowfish, Elgamal, and FerNet in Figure 10. This evaluation provides a comprehensive understanding of the security strengths and vulnerabilities of various approaches by evaluating their performance based on the correlation coefficient. In this context, the correlation coefficient was evaluated by comparing the original data with the encrypted data, providing insights into how well each encryption method preserves the statistical properties of the original data and its susceptibility to various attacks. In a CCA, the attacker selects arbitrary ciphertexts for decryption and utilizes the decrypted data to infer the encryption key. With a CPA, the attacker can request the encryption of chosen plaintexts and use the resulting ciphertexts to deduce the encryption key.

Attack analysis on MAB and conventional methods a) BFA b) CCA c) CPA d) EDA e) FIA and f) KPA.
Examining the BFA with respect to the correlation coefficient for different encryption methods reveals the effectiveness of the MAB strategy. Notably, the MAB method achieves the lowest correlation coefficient value of 9.365, indicating its enhanced resistance to differential attacks. In comparison, the correlation coefficients for ECC, AES, Blowfish, and Elgamal are 10.178, 13.876, 11.372, and 10.631, respectively. This analysis underscores the MAB method's advanced security performance relative to conventional encryption techniques. The analysis of FIA resistance, assessed through the correlation coefficient, highlights the performance of various encryption methods. Among the evaluated techniques, the MAB method has the lowest correlation coefficient of 4.352, signifying its greater resilience to FIA. In contrast, ECC, Blowfish, AES, Elgamal, and FerNet show higher correlation coefficients, with values of 5.178, 4.572, 7.865, 7.351, and 5.861, respectively. A lower correlation coefficient reflects better protection against FIA, as it signifies reduced predictability of faults in the encrypted data. The MAB strategy's lower coefficient underscores its enhanced capability to withstand such attacks, offering superior security in comparison to the conventional methods.
The analysis of EDA in terms of correlation coefficient across various encryption methods highlights significant differences in their susceptibility to these attacks. Further, the AES shows a higher correlation coefficient of 13.861, suggesting that AES is more affected by these attacks compared to ECC. Blowfish exhibits the highest correlation coefficient of 13.984, making it the most susceptible to EDA among the compared methods. Elgamal also demonstrates considerable vulnerability with a correlation coefficient of 13.567, placing it in the high susceptibility category but slightly less affected than Blowfish. In contrast, the MAB Method displays the lowest correlation coefficient of 9.251, indicating that it is the least affected by EDA among the methods evaluated. This development is accredited in the Blowfish framework, which effectively bolsters resistance against various attack strategies. As a result, the MAB method demonstrates superior security performance, offering better protection against attacks and ensuring more robust data encryption.
A comparison of the encryption and decryption timings for the MAB approach with traditional data encryption techniques is shown in Tables 5 and 6. Effective data encryption relies on minimizing both encryption and decryption times, and the MAB scheme's performance is evaluated against these established methods to assess its relative efficiency. Table 5 provides a comparison of encryption times for MAB method versus conventional data encryption techniques across different data sizes. For 16-bit data, the MAB method achieves the shortest encryption time of 0.189 s, outperforming ECC (0.378 s), AES (0.381 s), Blowfish (0.217 s), Elgamal (0.416 s), and FerNet (0.490 s). At 32-bits, the MAB method maintains its advantage with an encryption time of 0.115 s, compared to ECC (0.258 s), AES (0.328 s), Blowfish (0.387 s), Elgamal (0.490 s), and FerNet (0.258 s). For 64-bit data, the MAB continues to lead with the least time of 0.108 s, outperforming ECC (0.218 s), AES (0.291 s), Blowfish (0.135 s), Elgamal (0.126 s), and FerNet (0.476 s). At 128-bits, the MAB method again demonstrates superior efficiency with an encryption time of 0.088 s, significantly better than ECC (0.225 s), AES (0.459 s), Blowfish (0.250 s), Elgamal (0.339 s), and FerNet (0.259 s). This analysis highlights the MAB method's efficiency in minimizing encryption time across various data sizes.
Encryption time analysis on MAB and conventional methods.
Encryption time analysis on MAB and conventional methods.
Decryption time analysis on MAB and conventional methods.
Table 6 provides an analysis of decryption times for MAB method in comparison with conventional encryption techniques across different data sizes. For 16-bit, the MAB method achieves a decryption time of 0.229 s, which is faster than ECC (0.497 s), AES (0.485 s), Blowfish (0.299 s), Elgamal (0.252 s), and FerNet (0.441 s). The MAB algorithm performs better than ECC (0.172 s), AES (0.091 s), Blowfish (0.365 s), Elgamal (0.120 s), and FerNet (0.261 s) when the data size grows to 32 bits, with a decryption time of 0.208 s. For 64-bits, the MAB method records a decryption time of 0.194 s, which is lower than ECC (0.498 s), AES (0.351 s), Blowfish (0.444 s), Elgamal (0.386 s), and FerNet (0.397 s). At 128-bits, the MAB method achieves a notable decryption time of 0.073 s, significantly faster than ECC (0.334 s), AES (0.457 s), Blowfish (0.220 s), Elgamal (0.559 s), and FerNet (0.348 s). Overall, the MAB model's decryption scheme consistently demonstrates superior efficiency, providing reduced decryption times across all tested data sizes compared to the conventional methods.
Figure 11 shows the analysis of ROC -AUC curve. At different threshold settings, the True Positive Rate (sensitivity) is plotted against the False Positive Rate (1-specificity) using the ROC curve, and the area under this curve is measured by the AUC value. With AUC = 1 denoting a perfect classifier and AUC = 0.5 denoting a model with no discriminatory power, or random guessing, a larger AUC result denotes greater efficiency of the model. The ROC-AUC score is used in this paper to assess how well the QCNN-IDDS system distinguishes between normal and abnormal network traffic. A high ROC-AUC score indicates that the model is effectively classifying instances, making it a reliable metric for evaluating the framework's performance.

Analysis of ROC -AUC curve.
The QCNN-IDDS method's results metrics for varying data sizes (20,000, 30,000, 40,000, and 50,000 instances) are provided in Table 7. From 0.904 for 20,000 instances to 0.937 for 50,000 examples, the model's accuracy grows steadily with the quantity of the data, suggesting improved classification performance with larger datasets. The sensitivity and specificity also increase, reflecting better detection of both positive and negative instances as data size grows. These findings demonstrate the QCNN-IDDS model's scalability and efficacy in managing bigger datasets, with major advances in classification accuracy and error reduction.
Scalability analysis of variation in Data size.
Scalability analysis of variation in Data size.
Table 8 provides a comparison of the time (in seconds) required by different models for training or inference, showcasing the computational efficiency of each. Among the listed models, the ETW-QNN emerges as the fastest, requiring 66.82 s, significantly outperforming other models in terms of time efficiency. The EfficientNet, CNN + LSTM + GRU, and LinkNet models take 86.09, 87.07, and 89.00 s, respectively, showing moderate computational demands. SqueezeNet requires the most time at 91.70 s, slightly outperforming QNN but still less efficient than ETW-QNN.
Time analysis.
Time analysis.
This work presents a novel Quantum Computation with Neural Network for Intrusion Detection and Data Security (QCNN-IDDS) framework that tackles two crucial issues in contemporary cybersecurity: precise intrusion detection and data protection. It does this by combining cutting-edge machine learning models with quantum computing. This framework not only improves IDS detection capabilities but also makes sure that sensitive data is safely encrypted while being detected by combining LinkNet and Entropy Threshold Weighted Quantum Neural Networks (ETW-QNN) with data security techniques like Modulus-assisted Blowfish (MAB) encryption. At 60% training data, the ETW-QNN approach yields an FPR of 0.123, which is much lower than that of previous methods. For example, CNN + LSTM + GRUs displays 0.238, LinkNet records 0.271, while EfficientNet has 0.273 FPR. Higher FPR values of 0.289, 0.252, and 0.253 are presented by DNN, SqueezeNet, and QNN, accordingly. Future studies could look at the scalability of quantum models, the creation of hybrid classical-quantum models, and the potential of quantum cryptography for communications security.
Footnotes
Abbreviation
Funding
The author(s) received no financial support for the research, authorship, and/or publication of this article.
Conflicting interests
The author(s) declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.
