Научный семинар «Beyond Correlation: Quantum and Causal Pathways Toward High-Fidelity Network Intrusion Detection»
Направление
Наука
Организатор
Институт компьютерных наук и телекоммуникаций
Формат мероприятия
Семинар
Контактное лицо
Мутханна Аммар Салех Али
О мероприятии
Nouali Ibrahim Yassine, PhD, a researcher at the Laboratory of Information and Communication Systems and Technologies (STIC) at Abou Bekr Belkaïd University of Tlemcen, Algeria.Van Dai Pham, Director, Qualcomm-Arduino Innovation Lab, Swinburne Vietnam - FPT University, Hanoi, Vietnam
Dean, Faculty of Smart IT, Finland Metropolia Vietnam - FPT University, Hanoi, Vietnam
Energy detection (ED)-based receivers are widely adopted in ultra-wideband (UWB) ranging systems due to their simplicity and ease of implementation. Thresholding-based methods are commonly used in such receivers for first path (FP) detection and time-of-arrival (TOA) estimation, but accuracy depends on how well the threshold adapts to noise and multipath effects. This paper proposes the peak-to-average ratio (PAR) of the energy samples as an adaptive threshold predictor, modelling its relationship with the optimal threshold using a sigmoid function fitted by nonlinear least squares. Monte Carlo simulations using the CM1 to CM4 IEEE 802.15.4a channel models show up to 59% lower mean absolute error (MAE) than the Kurtosis-based approach. A new ED resolution utilization (ED-RU) metric further shows that PAR recovers between 24% and 45% of the theoretical resolution floor, compared with 6% to 20% for Kurtosis. Moreover, a single PAR model pooled across all four channels retains most of this accuracy gain without per-channel calibration, while also being computationally efficient: PAR is 14 times faster than Kurtosis because it requires only a maximum and a mean over the energy samples. These findings establish PAR as a simpler, more accurate, and better generalized adaptive threshold predictor for ED-based UWB ranging.Modern Network Intrusion Detection Systems (NIDS) built on classical machine learning achieve strong recall but remain fundamentally correlational: they learn statistical regularities between traffic features and labels without capturing the underlying generative process of network behavior. This limitation manifests as high false-positive rates and alert fatigue in Security Operations Centers, and as a performance plateau bounded by classical models' expressive power. This talk examines two recent, complementary paradigms that move beyond this plateau, both evaluated on the CIC-IDS2017 benchmark.
The first expands the representational capacity of the model itself: a hybrid Quantum-LSTM combines a classical LSTM for temporal feature extraction with a Parameterized Quantum Circuit for classification in a high-dimensional Hilbert space. While a classical LSTM baseline retains the highest recall, the hybrid model consistently achieves superior precision, cutting false alarms by roughly 29% - a decisive advantage where alert reliability is paramount.
The second reframes the nature of the detection signal, shifting from correlational scoring to causal reasoning. Causal-IDS learns a Structural Causal Model of a network's benign operational mechanisms and flags intrusions as violations of these learned cause-and-effect relationships, quantified by a Causal Anomaly Score. This achieves an AUC of 0.84 — well above Isolation Forest and Autoencoder baselines - while also enabling instance-level interpretability, letting analysts trace why a flow was flagged.
By contrasting a paradigm that enlarges the computational space with one that changes what relationship is modeled, this talk situates both within a broader agenda: building NIDS that are accurate, trustworthy, and interpretable — closing with open questions on combining causal structure with quantum-enhanced representations for real-world deployment.
Ссылка на подключение: https://telemost.yandex.ru/j/77800784482961
Dean, Faculty of Smart IT, Finland Metropolia Vietnam - FPT University, Hanoi, Vietnam
Energy detection (ED)-based receivers are widely adopted in ultra-wideband (UWB) ranging systems due to their simplicity and ease of implementation. Thresholding-based methods are commonly used in such receivers for first path (FP) detection and time-of-arrival (TOA) estimation, but accuracy depends on how well the threshold adapts to noise and multipath effects. This paper proposes the peak-to-average ratio (PAR) of the energy samples as an adaptive threshold predictor, modelling its relationship with the optimal threshold using a sigmoid function fitted by nonlinear least squares. Monte Carlo simulations using the CM1 to CM4 IEEE 802.15.4a channel models show up to 59% lower mean absolute error (MAE) than the Kurtosis-based approach. A new ED resolution utilization (ED-RU) metric further shows that PAR recovers between 24% and 45% of the theoretical resolution floor, compared with 6% to 20% for Kurtosis. Moreover, a single PAR model pooled across all four channels retains most of this accuracy gain without per-channel calibration, while also being computationally efficient: PAR is 14 times faster than Kurtosis because it requires only a maximum and a mean over the energy samples. These findings establish PAR as a simpler, more accurate, and better generalized adaptive threshold predictor for ED-based UWB ranging.Modern Network Intrusion Detection Systems (NIDS) built on classical machine learning achieve strong recall but remain fundamentally correlational: they learn statistical regularities between traffic features and labels without capturing the underlying generative process of network behavior. This limitation manifests as high false-positive rates and alert fatigue in Security Operations Centers, and as a performance plateau bounded by classical models' expressive power. This talk examines two recent, complementary paradigms that move beyond this plateau, both evaluated on the CIC-IDS2017 benchmark.
The first expands the representational capacity of the model itself: a hybrid Quantum-LSTM combines a classical LSTM for temporal feature extraction with a Parameterized Quantum Circuit for classification in a high-dimensional Hilbert space. While a classical LSTM baseline retains the highest recall, the hybrid model consistently achieves superior precision, cutting false alarms by roughly 29% - a decisive advantage where alert reliability is paramount.
The second reframes the nature of the detection signal, shifting from correlational scoring to causal reasoning. Causal-IDS learns a Structural Causal Model of a network's benign operational mechanisms and flags intrusions as violations of these learned cause-and-effect relationships, quantified by a Causal Anomaly Score. This achieves an AUC of 0.84 — well above Isolation Forest and Autoencoder baselines - while also enabling instance-level interpretability, letting analysts trace why a flow was flagged.
By contrasting a paradigm that enlarges the computational space with one that changes what relationship is modeled, this talk situates both within a broader agenda: building NIDS that are accurate, trustworthy, and interpretable — closing with open questions on combining causal structure with quantum-enhanced representations for real-world deployment.
Ссылка на подключение: https://telemost.yandex.ru/j/77800784482961