A quantum enhanced neuro symbolic intrusion detection system for software defined networking.

Abstract

Software Defined Networking (SDN) provides programmability and centralized control, but at the same time, increases the attack surface and prevents classical Intrusion Detection Systems (IDSs) from dealing with new attack vectors. To solve these challenges, we propose NeuroTwin QIDS, a novel quantum-enabled neuro-IDS for SDN. It uses a novel Neuro-Symbolic Feature Pruning (NSFP) approach involving Graph Attention Networks (GAT) and policy-aware symbolic pruning to guarantee the statistical relevancy and defensibility of features used to represent anomalies. Statistical features representing anomalies are mapped to Quantum Reservoir (QRE) space in order to enrich representation for better temporal classification. Classification itself is implemented in two steps: firstly, the Quantum Reservoir-Transformer Hybrid (QRT-Net) performs online real-time binary anomaly detection; secondly, the Capsule Network-BiLSTM (Cap-BiLSTM) classifies anomalies based on their behavior. After that, neuro-symbolic fusion is performed to validate predictions made by the neural network against SDN policies, and a digital twin model is synchronized for simulation of protective actions to be taken before applying the self-healing mechanism for network protection. The experiments were carried out with CSE-CIC-IDS2018 and InSDN datasets to evaluate the end-to-end performance of NeuroTwin QIDS. NeuroTwin QIDS provided outstanding detection results, surpassing state-of-the-art IDS systems. On the CSE-CIC-IDS2018 dataset, it showed 99.12% accuracy, 98.95% precision, 98.87% recall rate, and a 98.91% F1-score. Similarly, on InSDN dataset, the performance of the proposed method was 98.67% accuracy, 98.42% precision, 98.15% recall, and a 98.28% F1-score.