Quantum Machine Learning Approaches for Coordinated Stealth Attack Detection in Distributed Generation Systems

TL;DR

This paper tackles the problem of detecting coordinated stealth attacks in distributed generation within microgrids using quantum machine learning. It compares classical ML, fully quantum variational classifiers, and hybrid quantum–classical feature mappings on a low-dimensional dataset derived from $Q_{DG1}$, $f_{dev}$, and $V1$, leveraging angle encoding on a 3-qubit circuit. The key finding is that hybrid quantum–classical models, which map measurements into a quantum feature space and then train classical classifiers, achieve the best overall performance, beating fully quantum models that suffer from training instability and only modest gains over classical baselines. This work demonstrates that quantum embeddings can enhance intrusion detection when end-to-end quantum learning is impractical, offering a viable path toward more resilient cyber-physical power systems as quantum hardware and algorithms mature.

Abstract

Coordinated stealth attacks are a serious cybersecurity threat to distributed generation systems because they modify control and measurement signals while remaining close to normal behavior, making them difficult to detect using standard intrusion detection methods. This study investigates quantum machine learning approaches for detecting coordinated stealth attacks on a distributed generation unit in a microgrid. High-quality simulated measurements were used to create a balanced binary classification dataset using three features: reactive power at DG1, frequency deviation relative to the nominal value, and terminal voltage magnitude. Classical machine learning baselines, fully quantum variational classifiers, and hybrid quantum classical models were evaluated. The results show that a hybrid quantum classical model combining quantum feature embeddings with a classical RBF support vector machine achieves the best overall performance on this low dimensional dataset, with a modest improvement in accuracy and F1 score over a strong classical SVM baseline. Fully quantum models perform worse due to training instability and limitations of current NISQ hardware. In contrast, hybrid models train more reliably and demonstrate that quantum feature mapping can enhance intrusion detection even when fully quantum learning is not yet practical.

Figures (9)

• Figure 1: Distributed generation system and coordinated stealth attack model. An attacker injects small, coordinated perturbations into voltage magnitude, reactive power, and frequency measurements through compromised communication links while remaining within normal operating bounds to evade residual-based detection.
• Figure 2: DG1 Measurements under Normal Operation and Coordinated Stealth Attack.
• Figure 3: Parallel classical and quantum intrusion detection architecture for coordinated stealth attack detection in a distributed generation system. Voltage magnitude, frequency, and power measurements are processed to extract features, while small coordinated perturbations remain within normal operating bounds. Classical machine-learning models and a quantum classifier operate in parallel, producing a binary detection decision indicating normal operation or coordinated stealth attack.
• Figure 4: Windowed analysis of frequency deviation magnitude using non-overlapping sample windows ($\text{win}=2000$, $\text{step}=2000$). Each row represents the mean absolute frequency deviation for normal operation and coordinated stealth attack conditions. The similarity across windows highlights the stealthy temporal behavior of the attack and motivates the use of feature-based learning methods.
• Figure 5: Confusion matrices for intrusion detection models: (a) Classical SVM, (b) variational quantum classifier, and (c) hybrid quantum--classical SVM.