Quantum Gated Recurrent GAN with Gaussian Uncertainty for Network Anomaly Detection

TL;DR

This work tackles network time-series anomaly detection by introducing a quantum-enhanced GAN framework with a Quantum Gated Recurrent Unit (QGRU) backbone and Successive Data Injection (SuDaI). The generator outputs Gaussian parameters via two Hybrid Quantum Layers (HQLs) and uses reparameterization to model uncertainty, while a Wasserstein critic stabilizes training. A two-stage anomaly detection pipeline combines interval-based gating, critic signals, and reconstruction error to produce robust anomaly scores, achieving a TaF1 of 0.89 on the HAI ICS dataset and demonstrating sim-to-real viability on IBM Quantum hardware. The approach advances quantum-classical hybrids for practical, uncertainty-aware time-series anomaly detection in real-world, noisy quantum environments.

Abstract

Anomaly detection in time-series data is a critical challenge with significant implications for network security. Recent quantum machine learning approaches, such as quantum kernel methods and variational quantum circuits, have shown promise in capturing complex data distributions for anomaly detection but remain constrained by limited qubit counts. We introduce in this work a novel Quantum Gated Recurrent Unit (QGRU)-based Generative Adversarial Network (GAN) employing Successive Data Injection (SuDaI) and a multi-metric gating strategy for robust network anomaly detection. Our model uniquely utilizes a quantum-enhanced generator that outputs parameters (mean and log-variance) of a Gaussian distribution via reparameterization, combined with a Wasserstein critic to stabilize adversarial training. Anomalies are identified through a novel gating mechanism that initially flags potential anomalies based on Gaussian uncertainty estimates and subsequently verifies them using a composite of critic scores and reconstruction errors. Evaluated on benchmark datasets, our method achieves a high time-series aware F1 score (TaF1) of 89.43% demonstrating superior capability in detecting anomalies accurately and promptly as compared to existing classical and quantum models. Furthermore, the trained QGRU-WGAN was deployed on real IBM Quantum hardware, where it retained high anomaly detection performance, confirming its robustness and practical feasibility on current noisy intermediate-scale quantum (NISQ) devices.

Figures (5)

• Figure 1: Top 16 Feature Importances ranked by Gini criterion. These features were selected for their strong relevance to anomaly detection and used as model inputs to reduce dimensionality.
• Figure 2: Architecture of the Hybrid Quantum Layer (HQL). A small set of classical input neurons is first mapped through a fully connected classical layer. The resulting activations are then successively injected into the rotation angles of single qubit gates. Each qubit undergoes a sequence of parameterized rotations (e.g., $R_y$, $R_z$, $R_x$), followed by an entangling layer composed of CNOT gates. This structure is repeated across multiple layers of the variational quantum circuit (VQC). The quantum state is measured at the end of the circuit, and the expectation value of the Pauli-$Z$ observable is computed for each qubit. These values are then passed through a lightweight classical post-processing layer to produce the final output. Gray arrows indicate the direction of data flow.
• Figure 3: Model overview: the generator (left) uses a QGRU backbone followed by two Hybrid Quantum Layers (HQLs) to produce Gaussian parameters $\mu_t$ and $\log\sigma^2_t$, applies the reparameterization trick, and yields a sample $\hat{x}_{t}$. The critic (right) processes both the real next point $x_{t}$ and generated sample through parallel QGRU+HQL pipelines to compute Wasserstein scores. Colored blocks distinguish classical (orange) and quantum-augmented (blue) components.
• Figure 4: Scatter plot of scaled mean log‐variance, with ground‐truth anomalies highlighted by red square outlines.
• Figure 5: Anomaly score visualizations under different training–testing configurations. Each plot shows the detected anomaly scores (blue) against ground-truth events (red). The model trained on a noisy simulator exhibits strong sim-to-real transfer.