Siber güvenlikte saldırı tespiti için yeni bir hibrit kuantum sinir ağı modeli
A novel hybrid quantum neural network model for attack detection in cybersecurity
- Tez No: 1018572
- Danışmanlar: PROF. DR. CÜNEYT BAYILMIŞ
- Tez Türü: Doktora
- Konular: Bilgisayar Mühendisliği Bilimleri-Bilgisayar ve Kontrol, Computer Engineering and Computer Science and Control
- Anahtar Kelimeler: Belirtilmemiş.
- Yıl: 2026
- Dil: Türkçe
- Üniversite: Sakarya Üniversitesi
- Enstitü: Fen Bilimleri Enstitüsü
- Ana Bilim Dalı: Bilgisayar Mühendisliği Ana Bilim Dalı
- Bilim Dalı: Bilgisayar Mühendisliği Bilim Dalı
- Sayfa Sayısı: Belirtilmemiş.
Özet
Bu tezde, Nesnelerin İnterneti (IoT) ortamlarında Dağıtık Hizmet Engelleme (DDoS) saldırılarının tespiti problemi, hibrit kuantum–klasik öğrenme mimarileri çerçevesinde temsil gücü, eğitim duyarlılığı ve operasyonel karar verme boyutları üzerinden incelenmiştir. Çalışmanın temel amacı, kuantum sinir ağlarının (QNN) yalnızca bir sınıflandırıcı olarak değil, farklı öğrenme rejimleri içinde yeniden konumlandırılabilen hibrit bileşenler olarak siber güvenlik problemine nasıl entegre edilebileceğini ortaya koymaktır. Bu doğrultuda tez, yöntemsel olarak birbirini tamamlayan üç yaklaşımda yapılandırılmıştır. İlk yaklaşımda, CIC-DDoS2019 veri kümesi kullanılarak özellik seçimi, ölçeklendirme ve dengeli alt küme oluşturma işlemleri sonrasında hibrit QNN tabanlı bir DDoS tespit modeli geliştirilmiştir. Modelde klasik veriler kuantum durumlarına kodlanmış, parametrik kuantum devre üzerinden işlenmiş ve ölçüm çıktıları sınıflandırma kararına dönüştürülmüştür. Elde edilen bulgular, indirgenmiş özellik uzayında kurulan hibrit QNN yapısının kontrollü deney koşullarında anlamlı bir sınıflandırma davranışı üretebildiğini göstermiştir. Yerel yürütümde 16.000 örnekli alt kümede %80,69 doğruluk, ideal simülatör koşullarında ise %92,63 doğruluk elde edilmiştir. İkinci yaklaşımda, hibrit QNN başarımının yalnızca model mimarisine değil, aynı zamanda kullanılan optimizasyon algoritmalarına ve yürütüm ortamına da güçlü biçimde bağlı olduğu deneysel olarak analiz edilmiştir. Bu kapsamda farklı optimizatörler ve farklı backend seçenekleri karşılaştırılmış; sonuçlar, özellikle COBYLA optimizatörünün test edilen koşullar altında daha tutarlı bir davranış sergilediğini göstermiştir. Üçüncü aşamada ise DDoS tespiti problemi, doğruluk merkezli statik sınıflandırma yaklaşımının ötesine taşınarak maliyet-duyarlı pekiştirmeli öğrenme çerçevesinde yeniden formüle edilmiştir. Geliştirilen CDRL-QNN mimarisinde QNN, bir DQN ajanı içinde değer-fonksiyonu yaklaştırıcısı olarak kullanılmış; yanlış pozitif ve yanlış negatif hataların asimetrik maliyetleri ödül ve kayıp yapısına gömülmüş; lojistik harita temelli kaos güdümlü keşif mekanizması ile öğrenme kararlılığı desteklenmiştir. Deney sonuçları, önerilen yapının yanlış negatif sayısını 49'dan 33'e düşürdüğünü, yanlış pozitif sayısını artırmadan recall değerini 0,9673'ten 0,9780'e ve F1-skorunu 0,9738'den 0,9793'e yükselttiğini göstermiştir. Ayrıca toplam operasyonel maliyetin azalması ve ödül yakınsamasının daha pürüzsüz ilerlemesi, yöntemin operasyonel güvenilirlik açısından daha dengeli bir karar kalibrasyonu sağladığını ortaya koymuştur. Sonuç olarak bu tez, özellik projeksiyonu, eğitim duyarlılığı ve maliyet-duyarlı karar verme boyutlarını bütünleştiren çok katmanlı bir yöntemsel yaklaşım içinde değerlendirmektedir. Elde edilen bulgular, hibrit kuantum öğrenmenin IoT siber güvenliği bağlamında anlamlı bir araştırma yönü sunduğunu; ancak gerçek donanım kısıtları, kübit sayısı sınırlamaları ve eğitim kararlılığı sorunları nedeniyle dikkatli, eleştirel ve koşula bağlı biçimde konumlandırılması gerektiğini göstermektedir.
Özet (Çeviri)
This dissertation investigates Distributed Denial of Service (DDoS) attack detection in Internet of Things (IoT) environments through a hybrid quantum–classical learning perspective and develops a coherent methodological progression from static quantum-enhanced classification to cost-aware sequential decision making. The central motivation of the study is that security analytics in IoT should not be treated merely as a problem of maximizing prediction accuracy. In real operational settings, incorrect decisions do not have equal consequences. Missing an attack and unnecessarily blocking benign traffic produce different types of risk, different intervention costs, and different effects on service continuity. For this reason, the dissertation approaches DDoS detection not only as a classification task, but also as a representational, optimization, and operational decision problem. The thesis is built around three interconnected methodological approaches. Rather than presenting isolated studies, it constructs a cumulative research line in which each approach addresses a limitation that becomes visible in the previous one. The first approach examines whether a hybrid Quantum Neural Network (QNN) can provide a meaningful classification mechanism for IoT-based DDoS detection under controlled conditions. The second approach investigates whether the performance of such a model is stable across different optimizers and execution backends, thereby shifting the focus from simple feasibility to training sensitivity and reproducibility. The third approach reformulates the problem as a cost-sensitive reinforcement learning process and embeds the QNN into a Deep Q-Network (DQN) architecture as a value-function approximator, while also introducing a chaos-driven exploration mechanism to improve learning stability. A shared experimental framework was established for all three approaches in order to ensure conceptual and methodological consistency across the dissertation. The experiments were conducted on the CIC-DDoS2019 dataset, which provides a realistic flow-based benchmark for DDoS analysis. Since current noisy intermediate-scale quantum systems impose substantial constraints in terms of qubit count, circuit depth, and trainability, the thesis adopts a controlled feature-space design. Data preprocessing included normalization, leakage-aware train–test splitting, class-balanced subset construction where required, and feature reduction through a filter-based KBest procedure. This common pipeline is a critical aspect of the dissertation because it allows the reader to interpret the methodological evolution of the work within a stable evaluation environment rather than through disconnected experimental settings. In the first methodological approach, the thesis develops a hybrid QNN-based binary attack detection model for distinguishing benign and malicious traffic. Classical flow features are encoded into quantum states, transformed through a parameterized quantum circuit, and then mapped to classification outputs through measurement-based decision layers. The architecture relies on a compact seven-qubit design in order to remain compatible with realistic simulation constraints. A ZZFeatureMap was used for data embedding and a RealAmplitudes ansatz with limited depth was selected to balance expressive power and trainability. The objective of this approach was not to claim unconditional superiority over classical models, but to demonstrate that a quantum circuit-based hybrid classifier can be operationalized for a cybersecurity problem in a reproducible and platform-independent manner. The results of the first approach indicate that the proposed hybrid QNN can indeed produce meaningful classification behavior under reduced and balanced feature-space conditions. On local execution, the model's accuracy increased from 70.33% on a 1,000-sample subset to 80.69% on a 16,000-sample subset, with similar upward trends in precision, recall, and F1-score. Under ideal IBM statevector simulator conditions, the same architecture achieved substantially higher performance, reaching 92.63% accuracy, 91.38% precision, 92.85% recall, and 92.11% F1-score on the 16,000-sample subset. These findings are important for two reasons. First, they show that a hybrid QNN can function as a viable classifier for DDoS detection in a constrained feature setting. Second, and more importantly, they reveal that performance is strongly shaped by the execution regime itself. The large difference between local execution and ideal simulation suggests that hybrid quantum learning results cannot be interpreted independently of the computational environment in which they are obtained. This observation motivates the second approach of the dissertation. In variational quantum models, performance is not determined solely by architecture design. It is also affected by the optimization pathway, the numerical properties of the backend, and the stability of the training process. Therefore, the second approach holds the QNN architecture fixed and systematically studies how different optimizers and execution backends influence the model's behavior. The sensitivity analysis was conducted on five independent class-balanced subsets derived from CIC-DDoS2019, labeled DB1 through DB5. By keeping the representation pipeline constant and varying only the optimizer and backend, the dissertation turns training sensitivity into an explicit research object rather than leaving it as an implicit experimental detail. The findings of this approach demonstrate that optimizer and backend selection have a measurable effect on both accuracy and stability. Among the tested configurations, COBYLA produced the most reliable results across conditions. On DB1, for example, test accuracy with COBYLA reached 81.25% on local GPU execution, 82.00% on MPS, 84.58% on QASM, and 80.50% on Statevector. Across the five subsets, the COBYLA + QASM combination maintained the best overall behavior, decreasing gradually from 84.58% on DB1 to 81.85% on DB5, with an average accuracy of 82.93%. By contrast, DIRECT-family optimizers remained in a lower band of roughly 61–63%, while Nelder–Mead and SPSA displayed fragile convergence behavior or execution failures in some conditions. These outcomes confirm that hybrid QNN training is highly condition-dependent and that reproducibility cannot be assumed simply because the same circuit architecture is used. This second approach also provides a critical interpretive contribution by comparing the best QNN configuration against classical baselines. Random Forest achieved the strongest average result at 98.58%, while Logistic Regression, SVM, XGBoost, KNN, and a simple DNN generally clustered around the 89–91% range. In comparison, the best-performing QNN configuration remained at 82.93% average accuracy. This gap is not presented as a failure of the quantum approach; rather, it clarifies the actual methodological value of the hybrid QNN within the current NISQ regime. The thesis explicitly avoids unsupported claims of quantum superiority. Instead, it argues that the significance of the hybrid QNN lies in its representational flexibility, its integration potential, and its ability to serve as a research vehicle for studying how learning, execution, and decision structures interact in cybersecurity tasks. The third methodological approach advances the problem beyond static classification and reformulates DDoS detection as a sequential, cost-sensitive decision-making process. In practical IoT security operations, a detection model is not merely asked to assign labels. It is expected to support interventions under changing traffic conditions, while balancing the risks associated with false negatives and false positives. For this reason, the dissertation models the problem as a Markov Decision Process and uses a DQN-based reinforcement learning framework. The innovative step in this approach is that the QNN is no longer used as a direct classifier. Instead, it is embedded into the reinforcement learning architecture as a value-function approximator. This repositioning is methodologically important because it demonstrates that the quantum component can be reconfigured as a flexible hybrid module serving a broader decision-making pipeline. A second major contribution of this approach is the use of an explicitly cost-sensitive reward structure. False negatives, corresponding to missed attacks, are penalized more strongly than false positives in order to reflect the asymmetric operational risks of IoT systems. In parallel, a chaos-based exploration mechanism derived from the logistic map is introduced to enrich state-space traversal and support more stable learning dynamics. The purpose of this component is not to present chaos as a universal remedy, but to use deterministic high-diversity perturbation as a structured complement to standard exploration policies. This design is especially relevant in hybrid quantum learning contexts, where optimization fragility and narrow search dynamics can negatively affect convergence. The experimental evaluation of this final approach compares the proposed CDRL-QNN model with a Frozen-QNN DQN baseline under the same balanced dataset, normalization pipeline, and 800-episode training schedule. The results show that both models achieve high overall performance, but the proposed framework offers better operational calibration. The baseline produced 49 false negatives and 29 false positives, whereas CDRL-QNN reduced false negatives to 33 while keeping false positives unchanged at 29. As a result, recall improved from 0.9673 to 0.9780, F1-score increased from 0.9738 to 0.9793, and overall accuracy rose from 0.9740 to 0.9793. Precision remained essentially stable, increasing slightly from 0.9804 to 0.9806. These results are significant because the gains were achieved not by indiscriminately increasing blocking behavior, but by improving attack sensitivity without introducing additional false alarms. The cost analysis further supports the value of the third approach. Under the asymmetric reward structure, the proposed model achieved a final total operational cost of 223.00, while the minimum observed episode cost dropped to 156.00 during training. In addition, the cumulative episode reward was higher for CDRL-QNN than for the baseline, and the reward curve displayed smoother convergence. This suggests that the integrated use of a trainable QNN, cost-sensitive reinforcement learning, and chaos-supported exploration can produce a more stable and operationally aligned decision policy. At the same time, the thesis remains careful in its interpretation. Because the cost-sensitive reward design, the chaos component, and the hybrid QNN were employed together, their individual marginal effects were not fully isolated through ablation experiments. Thus, the reported improvement is interpreted as evidence for the feasibility and promise of the integrated architecture rather than as proof that a single component alone is responsible for the gains. Taken together, the dissertation offers a layered methodological contribution. The first approach establishes that a hybrid QNN can be meaningfully deployed as a classifier in a cybersecurity setting with reduced quantum-compatible feature spaces. The second approach shows that such performance is highly sensitive to optimizer choice, backend configuration, and execution conditions, making stability and reproducibility indispensable dimensions of evaluation. The third approach demonstrates that the same QNN concept can be elevated from classification to cost-aware policy learning by embedding it into a reinforcement learning architecture designed around operational risk. In this sense, the dissertation's originality does not lie in presenting three unrelated models, but in tracing a coherent evolution from representation, to training sensitivity, to operational decision calibration. The broader scientific implication of the work is that hybrid quantum learning for IoT cybersecurity should be evaluated neither through exaggerated optimism nor through premature dismissal. The thesis does not claim verified quantum speedup, and it does not argue that current hybrid QNNs outperform strong classical baselines in a general sense. Instead, it presents a balanced conclusion: hybrid quantum–classical models constitute a meaningful research direction for cybersecurity because they provide new ways of thinking about representation, trainability, and decision structure, but their current value is inseparable from the limitations of NISQ-era hardware and simulation regimes. Restricted qubit counts, shallow circuit requirements, backend dependence, execution-environment variability, and trainability issues such as barren plateaus all remain central constraints. In conclusion, this dissertation develops a unified doctoral-level framework for DDoS detection in IoT environments by progressively integrating hybrid QNNs into more advanced learning and decision-making contexts. It begins with quantum-enhanced classification, continues with optimizer and backend sensitivity analysis, and culminates in a cost-aware, chaos-driven reinforcement learning architecture in which the QNN serves as an adaptive decision component rather than a static classifier. Through this progression, the study contributes a conceptually coherent and methodologically critical perspective on how hybrid quantum learning can be positioned in cybersecurity research. Its main contribution is therefore not an isolated performance claim, but the establishment of an evolutionary framework that connects quantum representation, learning stability, and operational reliability within a single dissertation narrative.
Benzer Tezler
- Nöromorfik hesaplama ve memristor tabanlı ağ saldırı tespit sistemleri: Siber güvenlikte yeni yaklaşımlar
Neuromorphic computing and memristor-based network attack detection systems: New approaches in cyber security
YUSUF ETKA KÖYLÜ
Yüksek Lisans
Türkçe
2025
Bilgisayar Mühendisliği Bilimleri-Bilgisayar ve Kontrolİstanbul Teknik ÜniversitesiMekatronik Mühendisliği Ana Bilim Dalı
PROF. DR. İLHAN KOCAARSLAN
- Güvenli ağ bağlantıları için yapay sinir ağları kullanılarak anormal aktiviteleri ve siber tehditleri tespit eden alternatif yazılım geliştirilmesi
Development of alternative software for detecting abnormal activities and cyber threats using artificial neural networks for secure network connections
MEHMET KARADENİZ
Yüksek Lisans
Türkçe
2025
Elektrik ve Elektronik MühendisliğiPamukkale ÜniversitesiElektrik-Elektronik Mühendisliği Ana Bilim Dalı
DR. ÖĞR. ÜYESİ AHMET ÖZEK
- Cybersecurity measures for attacks detection in iot with 5G based on artificial intelligence technologies
Yapay zeka teknolojilerine dayanan 5G ile nitelikler arasındaki saldırı tespitine yönelik siber güvenlik önlemleri
REEM TALAL ABDULHAMEED AL-DULAIMI
Doktora
İngilizce
2025
Bilgisayar Mühendisliği Bilimleri-Bilgisayar ve KontrolAltınbaş ÜniversitesiElektrik ve Bilgisayar Mühendisliği Ana Bilim Dalı
DR. ÖĞR. ÜYESİ AYÇA KURNAZ TÜRKBEN
- SCADA sistemlerine yönelik siber saldırıların tespiti için yeni bir hibrit makine öğrenmesi yöntemi
A new hybrid machine learning method for detection of cyber attacks on SCADA systems
ESRA SÖĞÜT
Doktora
Türkçe
2023
Bilim ve TeknolojiGazi ÜniversitesiBilgisayar Mühendisliği Ana Bilim Dalı
PROF. DR. OSMAN AYHAN ERDEM
- Gerçek zamanlı saldırı tespiti ve engelleme için makine öğrenmesi yöntemleri kullanarak web uygulama güvenlik duvarı geliştirilmesi
Development of web application firewall using machine learning techniques for real-time intrusion detection and prevention
MUHAMMED ERSİN DURMUŞKAYA
Yüksek Lisans
Türkçe
2024
Bilgisayar Mühendisliği Bilimleri-Bilgisayar ve KontrolMilli Savunma ÜniversitesiBilgisayar Mühendisliği Ana Bilim Dalı
DR. ÖĞR. ÜYESİ HÜSEYİN FEHMİ SELİM BAYRAKLI