Quantum–Enhanced Intrusion Detection Using Quantum Circuit Born Machines for Zero-Day Attack Detection

Modern intrusion detection systems (IDS) struggle to recognise zero-day cyberattacks, as classical discriminative models rely on historical attack labels and fail to characterise deviations from normal network behaviour. This work presents a hybrid quantum–classical intrusion detection framework in which a Quantum Circuit Born Machine (QCBM) models benign traffic as a probabilistic quantum state. The trained QCBM assigns each network flow a Quantum Anomaly Score (QAS), defined as the negative log-likelihood under the learned benign distribution, which is subsequently fused with classical flow statistics in a Light Gradient Boosted Machine (LightGBM) classifier. The proposed system employs a 16-qubit, three-layer QCBM (approximately 192 quantum gates) trained using up to ${10}^6$ measurement shots on the CICIDS2017 dataset. Experimental results show that integrating the QAS does not degrade supervised detection performance on known attacks (Accuracy $\approx 0.996$, Receiver Operating Characteristic-Area Under Curve (ROC-AUC) $\approx 0.9995$), while providing an additional anomaly-sensitive signal under strict zero-day conditions. When entire attack families are withheld during training, the QAS assigns systematically higher anomaly scores to unseen attacks than to benign traffic and achieves unsupervised zero-day ROC-AUC values of approximately 0.78 across multiple attack types. These findings demonstrate that shallow, resource-efficient quantum generative models can act as interpretable probabilistic priors for benign behaviour, complementing classical IDS pipelines and enabling principled anomaly awareness under realistic Noisy Intermediate-Scale Quantum (NISQ) constraints.