PaperlayerView exact revision on arXiv

Source-linked AI summary

False-Alarm Improvements and Detection Trade-Offs in Quantum Machine Learning for Intrusion Detection: A Reproducible Secondary Analysis

Roberto Fernández-Barrios, Iker Pastor-López, Asier González-Santocildes, Pablo García Bringas

arXiv:2610.35235v2cs.CR

TL;DR

Interpreting QML-IDS results requires considering FPR and attack TPR together and tracking how each result was evaluated. This secondary analysis reconstructs published operating points in a selected corpus and identifies which comparisons and detection trade-offs the evidence supports. Its conclusions remain descriptive or conditional, not operational guarantees.

  • Problem

    Intrusion-detection comparisons need to link FPR and attack TPR at the same operating point because a lower false-alarm rate can coincide with more missed attacks.

    Source: §1 · p. 1

  • Method

    The analysis reconstructs source objects, class-specific counts, denominators, and provenance for recoverable operating points in the selected corpus.

    Source: §3.1 · p. 3

  • Results

    The reconstructed evidence includes favorable comparisons with detection trade-offs, a recoverable K10 FPR of 12/6000, and normalized matrices that support detection ranges rather than a unique aggregate TPR.

    Source: §3.3 · p. 4, §4.1 · p. 6, §6 · p. 11

  • Takeaways & Limitations

    The reconstruction identifies which published comparisons and detection trade-offs are supported and which interpretations require assumptions not established by the available evidence.

    Source: §6 · p. 11

    The six conditional K10/K17 points have unverified independence, and the evidence supports neither pooled efficacy estimates nor cross-study significance tests.

    Source: §5.3 · p. 10

Abstract

from arXiv · show

Published results in quantum machine learning for intrusion detection (QML-IDS) require joint interpretation of false-positive rate (FPR), attack true-positive rate (TPR), and evaluation provenance. We reconstruct operating points in the 25-entry frame selected by Kaissar and colleagues: 21 included articles, 20 identified documentary families, substantive methodological material consulted for 15, and 24 descriptive points from five. In one test-labelled comparison, a quantum support vector machine reduces FPR from 6.875% for random forest to 3.329%, while TPR decreases from 93.955% to 93.682%; both rates improve against three other comparators. In another study, a complete benign row identifies FPR as 12/6000 (0.200%), despite incomplete attack-side allocation that requires additional assumptions for TPR. Normalized matrices identify detection ranges rather than a unique aggregate rate. A uniform provenance rule separates training-described and test-adjusted results from six conditional illustrations whose independence remains unverified. The contribution is a reproducible interpretation of favorable comparisons and detection trade-offs, without converting descriptive results or hypothetical calculations into operational guarantees.

1 Introduction

Interpreting intrusion-detection results requires examining FPR and attack TPR together at the same operating point, while accounting for evaluation provenance. This study reconstructs what the selected QML-IDS corpus can support quantitatively.

1 Introduction

  • A lower FPR may accompany either better detection or more missed attacks, so accuracy alone cannot distinguish these outcomes.When attacks are rare, benign errors can dominate flagged decisions; attack base rate, FPR, and TPR all affect the fraction of flags representing attacks.Source: §1 · p. 1
  • The study asks what evidence about false positives and attack detection can be recovered at the same operating point, given evaluation size and threshold selection.Its 25-entry frame was selected by Kaissar et al. and is not a representative census of QML-IDS.Source: §1 · p. 2
  • The contribution is an auditable correspondence between published source objects, class-specific counts, denominators, provenance, and the comparisons those data support.This is secondary research: it adds no detector training, quantum execution, or new operating threshold.Source: §1 · p. 2

2 Related work and scope of the contribution

Prior work reviews QML-IDS architectures and metrics and examines IDS evaluation more broadly. This study instead reconstructs joint rates, denominators, and provenance in a defined corpus, while distinguishing that empirical task from new detector evaluation.

Related work and scope of the contribution

  • Unlike review summaries of false-positive and detection metrics, this extraction follows retained source objects to their denominators and evaluation roles.Sai et al.’s review spans 44 cybersecurity studies [5]; source-specific disagreements are not inferred when detector, subset, and metric cannot be matched.Source: §2 · p. 2
  • The study’s distinct empirical object is the joint reconstruction of rates, denominators, and provenance at recoverable operating points in a closed QML-IDS corpus.Lamberts et al. examine industrial IDS metrics, confusion-matrix reporting, and comparability.Source: §2 · p. 2
  • The contribution is narrower than empirical quantum-software auditing: it recovers joint false-alarm and detection evidence, including normalized results that support ranges rather than unique rates.CLAIMSTAB-QC [8] treats empirical quantum-software comparisons as auditable claims under evaluation contracts.Source: §2 · p. 2
  • The analysis distinguishes assessing a frozen detector from constructing one to meet an error constraint; neither establishes undocumented independence.Clopper–Pearson limits quantify sampling uncertainty under assumptions, while Neyman–Pearson classification uses independent calibration samples and order statistics.Source: §2 · p. 2

3 Materials and Methods

The methods define a closed corpus, trace recoverable source objects to operating points, and apply explicit rate and provenance rules. The resulting intervals and ranges remain conditional on evidence and assumptions rather than establishing population guarantees.

3.1 Frame, eligibility and units

  • The eligible frame contains 21 included articles from 25 entries, representing 20 identified documentary families rather than 21 established independent experiments.Eligibility requires published empirical intrusion detection with benign-versus-attack relevance and a quantum computational component; K08 and K09 remain unresolved.Source: §3.1 · p. 3
  • An operating point is an article–source version–dataset/subset–detector–decision-rule setting, not an independent study.The frozen database has 466 records, including summaries and nonanalysable entries, but not 466 independently evaluated operating points.Source: §3.1 · p. 3

3.2 Access, extraction and provenance

  • Substantive methodological material was consulted for 15 of 21 included articles, while six lacked recovered full methods/results text.This freeze is an exploratory extraction boundary, not a preregistered design; an unrecovered figure is not classified as unreported.Source: §3.2 · p. 3
  • Extraction records each result’s dataset subset, class meaning, counts or metrics, aggregation, threshold rule, and source-object correspondence.Training results, independent tests, nominal versus observed denominators, and repeated-run averages versus single matrices are distinguished; missing counts are not inferred from rounded metrics.Source: §3.2 · p. 3

3.3 Rates, resolution and uncertainty

  • Attack is the positive class, and FPR resolution is 1/n0, a counting increment rather than a confidence limit.For multiclass matrices, non-benign predictions count as attacks; normalized matrices generally identify FPR but only a TPR range without attack-class weights.Source: §3.3 · p. 4
  • Binomial intervals are conditional on independent class-specific observations and a detector and threshold fixed independently of evaluation.Dependence, leakage, test-based model selection, or uncertain provenance can invalidate that interpretation; the calculations are not verified population guarantees.Source: §3.3 · p. 4
  • The 1%, 0.1%, and 0.01% references are analyst-defined scales, not universal targets or targets attributed to source authors.A limit above a reference means the procedure does not support that bound; it does not prove the true rate exceeds it.Source: §3.3 · p. 4
  • Training-described and test-adjusted counts receive hypothetical illustrations, while other eligible counts remain conditional with independence unverified.Normalized points without denominators receive identification or rounding ranges; the six-point K10/K17 analysis is not pooled or treated as a validated independent-test tier.Source: §3.3 · pp. 4–5

4 Results

The reconstructed results show favorable QSVM comparisons alongside detection trade-offs, with interpretation bounded by each source’s denominators and evaluation provenance. Several rates remain conditional or ranges rather than unique, independently validated estimates.

4.1 What the corpus permits

  • Five articles supply 24 descriptive points: 19 complete matrices, one complete benign row, and four normalized matrices; matrix completeness does not establish independent-test validity.Ten of the complete matrices are K11 training-described results.Source: §4.1 · p. 5

4.2 Low observed FPR does not identify the same inferential claim

  • K03 reports QSVM FPR 0.452% and TPR 99.774%, but test-based adjustments leave independent-test inference unqualified.Its intervals are hypothetical and supplementary.Source: §4.1 · p. 5, §4.2 · pp. 6, 8
  • 12/6000 benign cases identify K10’s FPR as 0.200%; its 99.800% TPR requires Table 2–3 linkage and exhaustive false negatives.The attack rows leave 15 cases unallocated, which are not imputed.Source: §4.1 · p. 6, §4.2 · p. 8

4.3 Favorable comparisons and detection trade-offs

  • QSVM’s TPR gains over LR, KNN, and DT are 5.083, 4.606, and 6.918 percentage points, respectively.QSVM also has lower FPR than these three comparators.Source: §4.3 · p. 8
  • K07’s normalized matrices yield approximate FPRs of 36% for SVM, 2% for QSVM, 21% for CNN, and 2% for QCNN; aggregate TPR remains a range.Without attack weights, displayed-row TPR bounds are 96–100% for QSVM/QCNN and 90–100% for CNN; these are not exact pooled rates.Source: §4.3 · pp. 8–9
  • Against RF, QSVM-IGWO changes FPR by −3.546 percentage points and TPR by −0.274.The lower false-alarm rate accompanies slightly more missed attacks.Source: §4.3 · p. 8, Figure 2 · p. 9

4.4 Training descriptions and size comparisons

  • Across K11’s smallest-to-largest nominal sizes, local QNN FPR falls from 30.719% to 17.599% and TPR rises from 71.429% to 78.734%.These are training-described results, not a causal estimate of sample-size effects; platform class counts differ at some nominal sizes.Source: §4.4 · p. 9

5 Discussion

The reconstruction separates what the source matrices identify from the comparisons and sampling interpretations they support. Its practical implications are to report rates with their provenance while recognizing that the selected corpus and conditional evidence limit broader conclusions.

5.1 What the reconstruction adds

  • Favorable comparisons survive reconstruction, but a lower false-alarm rate need not improve both detection outcomes.The analysis distinguishes rate identification, supported comparisons, and what provenance permits as a sampling interpretation.Source: §5.1 · p. 10

5.2 Implications for evaluation practice

  • A reusable report should link each matrix or score file to its evaluation subset, class definitions, detector, threshold, and selection data.For controlled low-FPR claims, an independent benign calibration sample and documented decision rule can provide a stronger contract.Source: §5.2 · p. 10
  • Aggregate matrices cannot establish effective sample size when traffic records are dependent, and hypothetical volume estimates require specified benign exposure and stable transported error rates.Such estimates would describe misclassified units, not distinct security incidents.Source: §5.2 · p. 10

5.3 Limitations

  • The selected, quality-filtered frame is not a probability sample, so its recoverability fractions cannot be generalized to QML-IDS as a field.Six included articles lack recovered methodological text, two entries have unresolved eligibility, and one consulted article has unrecovered matrix images.Source: §5.3 · p. 10
  • The 24-point quantitative core mixes training-described, test-adjusted, and normalized results; six conditional illustrations have unverified independence, so no pooled efficacy estimate or cross-study significance test is justified.Thresholds and provenance are not uniformly established, and the exploratory secondary analysis is not a prospective confirmatory study.Source: §5.3 · pp. 10–11

6 Conclusions

Reconstructing source objects and denominators makes the identifiable comparisons and detection trade-offs more specific. The conclusions remain limited to descriptive points in a closed corpus, with some interpretations requiring assumptions not established by the evidence.

6 Conclusions

  • K17’s QSVM has lower FPR than all four classical detectors, with a small TPR loss against random forest and TPR gains against the other three.K10’s complete benign row identifies FPR, while its incomplete attack-side allocation requires additional assumptions for TPR; normalized K07 matrices support ranges, not a unique aggregate TPR.Source: §6 · p. 11
  • The findings cover 24 descriptive points from five articles in a closed corpus of 21 included articles and 20 identified documentary families.Six K10/K17 points remain conditional illustrations with unverified independence; the contribution is a reproducible account of identifiable comparisons and trade-offs, not operational guarantees.Source: §6 · p. 11

Supplementary Information

The separate supplementary file contains the study’s extraction rules, source dossiers, conditional calculations, sensitivities, and reproducible-artifact correspondence.

Supplementary Information

  • The separate supplement.pdf contains extraction rules, all 25 source dossiers, conditional calculations, provenance and matrix-completeness sensitivities, and correspondence to the reproducible artifact.It forms part of the submission.Source: Supplementary Information · p. 11

Declarations

The authors report no specific external funding and no competing interests. They identify archived derived records and analysis materials, and state that ethics approval and consent do not apply to this secondary analysis.

Funding

Competing Interests

Data Availability

  • Derived records and source/version locators are archived in version 2.2.0 of the reproducibility artifact under CC BY 4.0.Original reports are identified by DOI and source locations; copies are retained privately and not redistributed.Source: Data Availability · p. 11

Code Availability

  • Analysis code, portable checks, and figure and table sources are available in the version 2.2.0 archive; the code is MIT-licensed.That version reproduces the current numerical tables and figures.Source: Code Availability · p. 12

Ethics and Consent

  • Ethics approval and consent are not applicable because this secondary analysis uses published aggregate results and conducts no new human-participant or animal study.Source: Ethics and Consent · p. 12

Author Identifiers

The section lists ORCID identifiers for four authors.

Author Identifiers

  • Roberto Fernández-Barrios is listed with https://orcid.org/0009-0003-5312-2634.Source: Author Identifiers · p. 12
  • Iker Pastor-López is listed with https: //orcid.org/0000-0002-3068-6248.Source: Author Identifiers · p. 12
  • Asier González-Santocildes is listed with https://orcid.org/0009-0002-8 888-8560, and Pablo García Bringas with https://orcid.org/0000-0003-3594-9534.Source: Author Identifiers · p. 12

Related papers

Loading 2610.35235v2…