Encrypted network traffic analysis using quantum machine learning

There is an exponential growth in the encrypted network traffic due to the increased privacy concerns and secure communication needs. This growth has made traditional content- based based traffic analysis techniques ineffective to determine whether traffic is benign or malicious. As a result, security researchers have adopted the practice of examining HTTP header files to analyze encrypted network traffic. This involves inspecting IP addresses, packet sizes, and other metadata. However, these conventional methods face significant limitations in capturing complex temporal dependencies, adapting to evolving threats, and performing, under data sparsity or noise especially in the context of encrypted traffic where visibility is inherently restricted. Traditionally, machine learning and deep learning methods have been successfully used to classify packets as normal or an attack. With the ability to handle high-dimensional and complex nature of this metadata, Quantum Machine Learning (QML) offers a novel paradigm to potentially uncover more intricate patterns that are intractable for classical models. In this paper, we examine the usage of two quantum machine learning models: Quantum Support Vector Machine (QSVM) and Quantum K-Nearest Neighbors (QKNN). We have proposed hybrid quantum machine learning methods, wherein the data is encoded using quantum encodings and then classified using canonical machine learning models. We experimented with different quantum encodings such as angle and amplitude encoding. Our study was conducted on encrypted traffic classification datasets provided by the Canadian Institute of Cybersecurity. Our findings show that the proposed quantum and hybrid quantum models achieve performance comparable to the canonical machine learning models. Notably, the hybrid KNN and SVM models, when paired with amplitude encoding, demonstrated performance on par with or superior to their purely canonical counterparts. We hope that these results would be of interest not only just the researchers and academicians and also practitioners in Cybersecurity industry.