SHAP-based intrusion detection in IoT networks using quantum neural networks on IonQ hardware

Abstract

Securing IoT networks against cyber-attacks, especially Distributed Denial of Service (DDoS) attacks, is a growing challenge due to their ability to disrupt services and overwhelm network resources. This study introduces a novel post-processing methodology that integrates Explainable AI (XAI) with Quantum Neural Networks (QNN) to enhance the interpretability of DDoS attack detection. We utilize the CICFlowMeter tool for feature extraction, processing bidirectional network traffic data and generating up to 87 distinct features. Notably, the CICFlowMeter removes potentially tampered features such as IP addresses and ports to prevent manipulation, addressing the limitations associated with the use of these features in the presence of attackers. After a QNN generates expectation values for a given input, SHAP (SHapley Additive exPlanations) values are applied to interpret the contributions of individual features in the decision-making process. Although the QNN output indicates whether a network flow is benign or malicious, the quantum model's complexity makes it difficult to interpret. By using SHAP values, we identify which features such as IP addresses, ports, and traffic patterns significantly influence the QNN’s classification, providing human-understandable explanations for the model's predictions. For evaluation, we used the CIC-IoT 2022and proposed SDN-DDoS24 datasets, with SDN-DDoS24 outperforming others when integrated with the proposed methodology. The QNN was implemented on IonQ quantum hardware through Amazon Braket, achieving an expectation value of 0.98 with a low latency of 113 milliseconds, making it suitable for applications requiring both precision and speed. This study demonstrates that integrating XAI with QNN not only improves DDoS attack detection accuracy but also enhances transparency, making the model more trustworthy for real-world cybersecurity applications. By offering clear explanations of model behavior, the approach ensures that security experts can make informed decisions based on the quantum-enhanced detection system, improving its reliability and usability in dynamic network environments.