How training-set sampling affects QCNN intrusion detection

Training a quantum convolutional neural network (QCNN) is expensive. On hardware, every gradient needs repeated runs of shifted circuits, and in simulation, studies cap the number of training iterations. So however large an intrusion detection dataset is, the model learns from a fixed number of records, and which records those are becomes a design decision.

The usual choice is a class-balanced subset, half benign traffic and half attacks. That leaves rare attack types to chance. On NSL-KDD, a class-balanced subset of 50 records contains a warezmaster record with probability below 1%, although warezmaster makes up about 10% of the known-type attacks in the test set. Spreading the attack half evenly across types looks like the natural fix.

The question I set out to answer was whether it helps a detector where it matters, at a low false-positive rate such as 1%.

Four ways to fill a training set

I compared four sampling policies. Stratified sampling keeps the dataset’s own attack ratio. Class-balanced sampling takes half benign and half attack records. Minimum coverage starts from the class-balanced subset and swaps in one record for each attack type it is missing. Type-balanced sampling spreads the attack half as evenly as possible across types.

Type balancing changes two things at once. It adds the types that were missing, and it moves records away from the frequent types. Minimum coverage does only the first. To tell the two apart, every comparison is paired: within a run, all four subsets start from the same class-balanced draw, the models share their initial parameters, and records that two subsets have in common sit at the same place in the training order. A difference between two policies can then come only from the records they change.

In total I trained 1,500 models, covering three datasets (NSL-KDD, CICIDS2017, and TON_IoT), five convolutional ansätze, five subset sizes from 50 to 5,000 records, five seeds, and the four policies. Each model’s threshold is set so that 1% of held-out benign traffic is flagged, and I measure recall at that threshold alongside AUC.

AUC goes up, detection goes down

On NSL-KDD and CICIDS2017, type balancing gives the highest AUC and the lowest recall at a 1% false-positive rate. On NSL-KDD, the median model trained on class-balanced subsets catches 61% of attacks at that threshold. Trained on type-balanced subsets, it catches 12%.

Dataset	Policy	AUC	Recall at 1% FPR
NSL-KDD	Class-balanced	0.78	0.61
	Type-balanced	0.87	0.12
CICIDS2017	Class-balanced	0.75	0.32
	Type-balanced	0.78	0.17
TON_IoT	Class-balanced	0.93	0.36
	Type-balanced	0.93	0.35

From Table II of the paper. Medians over 125 runs per policy. AUC is averaged over attack types; recall is weighted by the test attack mixture. Recall averaged over types drops as well.

TON_IoT barely changes. Eight of its nine attack types have 20,000 records each, so a class-balanced subset already contains nearly every type.

Where the loss comes from

Adding the missing types is not the problem. Minimum coverage, which does only that, is never significantly different from class-balanced sampling, and from 500 records on its recall stays within 0.011. The loss comes from moving records away from the frequent types, which lowers recall at every subset size on NSL-KDD and CICIDS2017.

Figure 2 shows where attacks land relative to the 1% threshold. On NSL-KDD, neptune is the only frequent type, at 70% of training attacks. Under class-balanced sampling, 0.91 of neptune records score above the threshold. Type balancing cuts neptune from 171 training records to 14 at 500 records, and across all runs only 0.27 of them stay above it. The rare types move above most benign traffic, which is why AUC rises, but few of them cross the threshold (0.06).

Type balancing comes out ahead only at much looser thresholds, from a 7% false-positive rate on NSL-KDD and 20% on CICIDS2017.

A different circuit does not fix this. The loss appears for all five ansätze, including the one with 51 parameters, and type balancing lowers recall in 238 of 250 paired runs on NSL-KDD and CICIDS2017.

What this means for a QCNN detector

A small classical CNN trained on the same subsets loses recall in the same way. But a classical model has a way out: trained on the whole dataset, it does better than on its 5,000-record class-balanced subsets. A QCNN does not have that option, because its budget is set by the cost of circuit evaluations rather than by the size of the data. So for a QCNN detector that runs at a low false-positive rate, class-balanced subsets are the better choice, and a sampling policy should be judged at the detector’s operating point rather than by AUC.

Limitations

Absolute recall at a 1% false-positive rate is moderate, with medians of at most 0.61, so this is a result about the relative effect of sampling, not a claim that QCNNs are good detectors. The circuits are also simulated without noise for 200 iterations. For the smallest and largest circuits, I checked that the loss persists under a stricter 0.1% target and with thresholds set from 10,000 training-pool benign records. It also persists when scores are resampled from 1,024 shots, and, at 500 records, after 1,000 training iterations.

---

Setup

The model is an 8-qubit QCNN with angle encoding and three convolution–pooling layers, following Hur et al. (2022). The five convolutional ansätze have 12 to 51 parameters. Each model is trained for 200 iterations on mini-batches of 25 in PennyLane’s noiseless simulator. Policies are compared with paired Wilcoxon signed-rank tests.

Paper

Code

The repository has the code, the results of all 1,500 models, and a script that regenerates the paper’s tables and figures from them.