Q-AGNN: Quantum-Enhanced Attentive Graph Neural Network for Intrusion Detection

Devashish Chaudhary; Sutharshan Rajasegarar; Shiva Raj Pokhrel

cs.CRMar 23, 2026

Q-AGNN: Quantum-Enhanced Attentive Graph Neural Network for Intrusion Detection

Authors: Devashish Chaudhary, Sutharshan Rajasegarar, Shiva Raj Pokhrel

Organizations: School of Information Technology, Deakin University, Geelong, Victoria, 3220, Australia.

Abstract

With the rapid growth of interconnected devices, accurately detecting malicious activities in network traffic has become increasingly challenging. Most existing deep learning-based intrusion detection systems treat network flows as independent instances, thereby failing to exploit the relational dependencies inherent in network communications. To address this limitation, we propose Q-AGNN, a Quantum-Enhanced Attentive Graph Neural Network for intrusion detection, where network flows are modeled as nodes and edges represent similarity relationships. Q-AGNN leverages parameterized quantum circuits (PQCs) to encode multi-hop neighborhood information into a high-dimensional latent space, inducing a bounded quantum feature map that implements a second-order polynomial graph filter in a quantum-induced Hilbert space. An attention mechanism is subsequently applied to adaptively weight the quantum-enhanced embeddings, allowing the model to focus on the most influential nodes contributing to anomalous behavior. Extensive experiments conducted on four benchmark intrusion detection datasets demonstrate that Q-AGNN achieves competitive or superior detection performance compared to state-of-the-art graph-based methods, while consistently maintaining low false positive rates under hardware-calibrated noise conditions. Moreover, we also executed the Q-AGNN framework on actual IBM quantum hardware to demonstrate the practical operability of the proposed pipeline under real NISQ conditions. These results highlight the effectiveness of integrating quantum-enhanced representations with attention mechanisms for graph-based intrusion detection and underscore the potential of hybrid quantum-classical learning frameworks in cybersecurity applications.

Figures & tables

Method	Graph	Attn 1 1 1 Attn: Attention; Q-Enc: Quantum Encoding.	Q-Enc 1 1 1 Attn: Attention; Q-Enc: Quantum Encoding.	Hybrid	Noise	Task
ST-GCN	Topology	No	No	No	N/A	DDoS
E-GraphSAGE	Feature	No	No	No	N/A	IDS
Multi-Graph GNN	Multi-view	Yes	No	No	N/A	IDS
QuantumNetSec	None	No	Yes	Yes	Yes	IDS
QEGraphSAGE	Feature	No	Yes	Yes	Limited	IoT IDS
QGAT	Feature	Quantum	Yes	Yes	Limited	Generic Graph

Table 1: Comparison of representative graph-based and quantum-enhanced intrusion detection approaches.

Figure 1: Overview of the proposed Q-AGNN architecture. Node features are encoded into quantum states via angle encoding and transformed using parameterized quantum circuits. Quantum-enhanced embeddings are aggregated using one-hop and two-hop attention mechanisms, followed by a classical MLP for intrusion detection.

{h}_{i}^{\prime}\leftarrow\sigma\!\left({z}_{i}+{z}_{i}^{(1)}+{z}_{i}^{(2)}\right)

Algorithm 1 Q-AGNN

Figure 2: Illustration of the network flow graph construction. Each node represents a unique flow, and edges connect nodes with highly similar feature vectors.

Dataset	Training		Validation		Testing
Dataset	Nodes	Edges	Nodes	Edges	Nodes	Edges
BoT-IoT	109	1,392	23	66	24	40
NF-BoT-IoT	126	5,870	27	296	28	324
UNSW-NB15	217	11,086	47	392	47	578
NF-UNSW-NB15	205	8,752	44	496	45	456

Table 2: Graph statistics for training, validation, and testing sets.

Panel of Figure 3 — Figure 3: t-SNE visualization comparing embeddings produced by MLP and PQC. (a)-(b): BoT-IoT dataset (MLP vs PQC). (c)-(d): NF-BoT-IoT dataset (MLP vs PQC). (e)-(f): UNSW-NB15 dataset (MLP vs PQC). (g)-(h): NF-UNSW-NB15 dataset (MLP vs PQC). Green points represent normal traffic and red points represent attack traffic.

Threshold	F1-score	FPR
0.60	0.816	0.000
0.70	0.949	0.000
0.80	1.000	0.000
0.90	0.949	0.000
0.95	0.949	0.000

Table 3: Sensitivity of Q-AGNN to cosine similarity threshold on NF-UNSW-NB15.

Datasets	Model	Acc	Prec	Rec	F1	FPR	FNR	Spec
BoT-IoT	Q-AGNN (Ours)	1.00	1.00	1.00	1.00	0.00	0.00	1.00
	GCN	0.9167	0.9524	0.8000	0.8500	0.00	0.4000	1.00
	GAT	0.9167	0.9524	0.8000	0.8500	0.00	0.4000	1.00
	GraphSAGE	0.9167	0.9524	0.8000	0.8500	0.00	0.4000	1.00
	ClusterGCN	0.9167	0.9524	0.8000	0.8500	0.00	0.4000	1.00
	GINConv	0.8333	0.7778	0.8947	0.7983	0.2105	0.00	0.7895

Table 4: Performance of Q-AGNN, GCN, GAT, GraphSAGE, ClusterGCN, GINConv, SuperGAT, and TransformerConv across datasets. Precision, recall, and F1-score are reported as macro-averaged to equally account for both normal and attack classes. Accuracy, FPR, FNR, and specificity are reported as global or per-class metrics. Best metrics are highlighted in bold .

Panel of Figure 4 — Figure 4: Train and validation loss curves for four datasets: (a) BoT-IoT, (b) NF-BoT-IoT, (c) UNSW-NB15, (d) NF-UNSW-NB15.

Model	Dataset	Acc	Prec	Rec	F1	FPR	FNR	Spec	HW
Q-AGNN	BoT-IoT	0.917	0.952	0.800	0.850	0.000	0.400	1.000	Torino
	NF-BoT-IoT	0.929	0.857	0.957	0.894	0.087	0.000	0.913	Torino
	UNSW-NB15	0.979	0.988	0.917	0.949	0.000	0.167	1.000	Torino
	NF-UNSW-NB15	0.867	0.433	0.500	0.464	0.000	1.000	1.000	Fez

Table 5: Performance of Q-AGNN under noisy simulation with hardware-calibrated noise (HW). Precision, recall, and F1-score are reported as macro-averaged to equally account for both normal and attack classes. Accuracy, FPR, FNR, and specificity are reported as global or per-class metrics.

Panel of Figure 5 — Figure 5: Training and testing loss per epoch for Q-AGNN executed on IBM quantum hardware and on a noisy simulator using the same hardware-calibrated noise model. (a) Training loss. (b) Testing loss.

Dataset	Model	Acc	Prec	Rec	F1	FPR	FNR	Spec
BoT-IoT	Q-AGNN	1.00	1.00	1.00	1.00	0.00	0.00	1.00
	PQC w/o Att	0.7917	0.3958	0.5000	0.4419	0.00	1.0000	1.00
	1-Hop + Att	0.9167	0.8737	0.8737	0.8737	0.0526	0.2000	0.9474
	1-Hop w/o Att	0.7917	0.3958	0.5000	0.4419	0.00	1.0000	1.00
	Node-wise QNN	0.7917	0.3958	0.5000	0.4419	0.00	1.0000	1.00
	MLP + Att	0.8750	0.8250	0.7737	0.7949	0.0526	0.4000	0.9474

Table 6: Comparison of Q-AGNN and ablation variants on BoT-IoT, NF-BoT-IoT, UNSW-NB15 and NF-UNSW-NB15 datasets. Precision, recall, and F1-score are reported as macro-averaged to equally account for both normal and attack classes. Accuracy, FPR, FNR, and specificity are reported as global or per-class metrics. Best results are highlighted in bold .

Explore similar work

How Quantum Is the Advantage? A Fair, Calibration- and Noise-Aware Benchmark and Attribution Audit of Quantum Machine Learning for Network Intrusion Detection
Aug 13, 2026Syeda Anshrah Gillani, Mirza Samad Ahmed Baig, Shahid Munir Shah +2Quantum Machine Learning Hybrid Quantum-Classical ML
Hamdard University, Karachi, Pakistan · SZABIST University, Pakistan · Fandaqah, Al Khobar, Saudi Arabia
Hybrid Quantum-Classical GANs for the Generation of Adversarial Network Flows
May 7, 2026Prateek Paudel, Nitin Jha, Abhishek Parakh +1Adversarial Attacks Network Intrusion Detection
Kennesaw State University, Marietta, GA, USA · University of Nebraska Omaha, Omaha, NE, USA
Input-Aware Dynamic Backdoor Attack Against Quantum Neural Networks
Jul 13, 2026Junrui Zhang, Zemin Chen, Lusi Li +3Backdoor Attacks Quantum Neural Networks
Department of Computer Science, Old Dominion University, Norfolk, VA, USA · School of Cybersecurity , Old Dominion University, Norfolk, VA, USA

Aug 13, 2026J/K move · Enter open · S save

How Quantum Is the Advantage? A Fair, Calibration- and Noise-Aware Benchmark and Attribution Audit of Quantum Machine Learning for Network Intrusion Detection

Syeda Anshrah Gillani, Mirza Samad Ahmed Baig, Shahid Munir Shah, Asher Ali+1

Hamdard University, Karachi, Pakistan · SZABIST University, Pakistan · Fandaqah, Al Khobar, Saudi Arabia

Quantum Machine Learning Hybrid Quantum-Classical ML Network Intrusion Detection Quantum Kernel Methods Variational Quantum Circuits

Open paper AskPDF arXiv

Quantum machine learning (QML) for network intrusion detection (NIDS) is routinely reported to reach near-perfect accuracy, yet the most rigorous studies find that well-tuned classical models remain competitive, and that apparent quantum gains may be artefacts of classical dimensionality reduction and implicit regularisation rather than genuine quantum effects. We ask not whether a quantum model can post a high accuracy, but how quantum the advantage really is. We present a unified, reproducible QML-IDS benchmark evaluating hybrid variational quantum circuits and quantum-kernel SVMs against five honestly-tuned classical baselines across four standard NIDS datasets (NSL-KDD, UNSW-NB15, CICIDS2017, NF-ToN-IoT-v2) under one leakage-controlled protocol, with an equal-budget feature view, imbalance- and calibration-aware metrics with significance testing, and a simulated NISQ noise sweep. We introduce a quantum-attribution audit (parameter-matched classical controls, a random-feature kernel, and a regularisation sweep) that quantifies how much of any gain is genuinely attributable to the quantum component. Tuned classical models (Random Forest, XGBoost) match or exceed the quantum models on aggregate detection on every dataset, and the audit attributes this to classical preprocessing and regularisation rather than quantum effects. Two advantages survive false-discovery-rate correction: the quantum-kernel SVM out-ranks its direct classical surrogate (a random-feature kernel) on AUPRC and ROC-AUC, and a small four-qubit hybrid out-detects the best classical baseline at the 1% false-positive operating point on the distribution-shifted NSL-KDD task (p = 0.005, BH q = 0.030). Code, seeds, and splits are released; our contribution stands whether quantum wins, ties, or loses.

Abstract

Explore similar work

How Quantum Is the Advantage? A Fair, Calibration- and Noise-Aware Benchmark and Attribution Audit of Quantum Machine Learning for Network Intrusion Detection

Hybrid Quantum-Classical GANs for the Generation of Adversarial Network Flows

Input-Aware Dynamic Backdoor Attack Against Quantum Neural Networks