Forensics Investigation Framework for Advanced Threat Detection in Quantum-Era Networks Article Swipe

MAKE IMPACT

Owusu Nyarko-Boateng , Samuel Boateng , Adebayo Felix Adekoya , Benjamin Asubam Weyori , Faiza Umar Bawah , Peter Nimbe , Foster Yeboah , Henrietta Adjei Pokua · YOU? · · 2025 · Open Access · · DOI: https://doi.org/10.17485/ijst/v18i44.1401

Objectives: To address the urgent need for forensic systems capable of detecting and analyzing advanced persistent threats in hybrid quantum-classical communication infrastructures, particularly those that may compromise quantum key distribution environments. Method: The study introduces a Quantum-Aware Forensics Investigation Framework, a multi-layered forensic architecture combining quantum telemetry, classical metadata analysis, and machine learning-driven threat classification. Experimental validation was conducted using a simulated testbed built with SimulaQron, Wireshark, and custom scripting tools. Various quantum attack scenarios were emulated, including intercept-resend, entanglement flooding, and control-plane hijacking. Machine learning models Random Forest, SVM, and Autoencoder were tested as standalone classifiers. A stacked ensemble model, with Random Forest and SVM as base learners and Logistic Regression as meta-classifier, was implemented for performance optimization. We used an experimentally generated, cross-layer dataset from a SimulaQron BB84 QKD emulation by combining quantum logs and classical control-plane captures under benign and scripted attacks such as intercept–resend, entanglement flooding, payload obfuscation, session hijacking, spoofing. Parameters studied were quantum - QBER, event inter-arrival jitter, event/count rate and classical - packet/flow statistics, inter-arrival mean/variance, latency proxy, TCP SYN/RST flags, byte-level Shannon entropy, with labels for benign vs. attack class. Findings: The standalone models achieved moderate performance on the held-out test set for Random Forest: ROC AUC = 0.93, F1 = 0.90, MCC = 0.86, Brier = 0.072; SVM (RBF): ROC AUC = 0.91, F1 = 0.88, MCC = 0.82, Brier = 0.081; Autoencoder (one-class): ROC AUC = 0.87, F1 = 0.83, MCC = 0.74, Brier = 0.094. By contrast, the stacked ensemble delivered perfect detection metrics for ROC AUC = 1.00, F1 = 1.00, MCC = 1.00, and Brier = 0.014. The study further emphasized the need for forensic systems to support explainability and continuous adaptability via Explainable AI and online learning with drift detection. Novelty: This study presents a cross-layer forensic framework for quantum–classical hybrid networks that fuses QKD telemetry with classical control-plane evidence and machine-learning analytics. Unlike prior work that treats these planes separately, our design unifies event-level QKD signals such QBER, arrival-time jitter with packet/flow features to produce timestamp-aligned, explainable alerts. In evaluation, the stacked-ensemble detector achieved perfect detection metrics for ROC AUC, F1, MCC and Brier on held-out data, which distinctly outperformed single-model baselines. The framework couples these gains with an XAI layer and an online, drift-aware learning loop, providing a scalable, auditable, and resilient foundation for forensic intelligence in the quantum era. Keywords: Quantum network forensics, QKD security, Advanced threat detection, Hybrid quantum-classical networks, Quantum-safe evidence, SimulaQron, Quantum cybersecurity

Type

article

Language

en

Landing Page

https://doi.org/10.17485/ijst/v18i44.1401

PDF

https://sciresol.s3.us-east-2.amazonaws.com/IJST/Articles/2025/Issue-44/IJST-2025-1401.pdf

OA Status

diamond

OpenAlex ID

https://openalex.org/W4417120344

Raw OpenAlex JSON

OpenAlex ID

https://openalex.org/W4417120344

Canonical identifier for this work in OpenAlex

DOI

https://doi.org/10.17485/ijst/v18i44.1401

Digital Object Identifier

Title

Forensics Investigation Framework for Advanced Threat Detection in Quantum-Era Networks

Work title

Type

article

OpenAlex work type

Language

en

Primary language

Publication year

2025

Year of publication

Publication date

2025-12-08

Full publication date if available

Authors

Owusu Nyarko-Boateng, Samuel Boateng, Adebayo Felix Adekoya, Benjamin Asubam Weyori, Faiza Umar Bawah, Peter Nimbe, Foster Yeboah, Henrietta Adjei Pokua

List of authors in order

Landing page

https://doi.org/10.17485/ijst/v18i44.1401

Publisher landing page

PDF URL

https://sciresol.s3.us-east-2.amazonaws.com/IJST/Articles/2025/Issue-44/IJST-2025-1401.pdf

Direct link to full text PDF

Open access

Yes

Whether a free full text is available

OA status

diamond

Open access status per OpenAlex

OA URL

https://sciresol.s3.us-east-2.amazonaws.com/IJST/Articles/2025/Issue-44/IJST-2025-1401.pdf

Direct OA link when available

Cited by

0

Total citation count in OpenAlex

Full payload