![](bg2.png)
havior through scanning network data produced in
a simulated business environment and a network of
Internet-of-Things devices. Since the types of attacks
can vary, our approach solely relies on detecting at-
tacks, assuming that those patterns are distinguish-
able from malign network behavior but without prior
knowledge about the specific attack type.
1.2 State-of-the-Art
Clustering is a widely used technique for process-
ing data streams (A. Zubaroglu, 2021), (C. Aggrawal,
2003), (C. Feng, 2006), (T. Zhang, 1997). It is an
unsupervised machine-learning technique that groups
data according to a well-defined similarity. Cluster-
ing algorithms adapted for streaming data differ from
static methods because they have to consider this dy-
namic evolution of the data probability distribution.
Algorithms handling data streams need to discard his-
torical data after a certain period to capture actual
patterns when clustering is performed and to ensure
memory accessibility (J. A. Silva, 2013). To address
this issue, a common approach of data stream cluster-
ing methods is separating the clustering process into
an online and offline process. In the online com-
ponent, statistical summary information of the data
is stored. At the same time, the offline component
takes this summary information as input for the ac-
tual clustering (C. Feng, 2006). The most relevant and
cited data stream clustering algorithms are BIRCH
(T. Zhang, 1997), CluStream (C. Aggrawal, 2003),
StreamKM++ (M.R. Ackermann, 2012), which are
based on the K-means algorithm, DenStream (F. Cao,
2006), D-Stream (Y. Chen, 2006), that are based
on DBSCAN, ClusTree (P. Kranen, 2011) as a hy-
brid method of k-means and DBSCAN, or Dynami-
cal Gaussian Mixture model, based on Gaussian Mix-
ture model clustering, to name a few (J. Diaz-Rozo,
2018). A commonly known problem with k-means
adaptions is the infeasibility of detecting complex and
arbitrarily shaped clusters (J. Diaz-Rozo, 2018). As
stream data only can be read once and the number
and shape of clusters are unknown in advance, meth-
ods need to be able to adapt to these data complexities
without prior specifications (L. Wan, 2009). Although
density-based clustering methods, such as the State-
of-the-Art algorithm DBSCAN, often perform very
well (A. Zubaroglu, 2021), there is a need to adapt and
fine-tune methods to specific use cases. For network
intrusion analysis, algorithms need to be able to detect
and discriminate attack patterns of varying intensities.
It was shown that k-means, as well as DBSCAN, lack
sensitivity to detect those patterns in the context of
streaming data (P. Casas, 2012). This is why we pro-
pose a new method that is tailored to the specific chal-
lenges of network intrusion detection. Nevertheless,
taking DenStream as an extension of DBSCAN as a
comparison algorithm in this study, we compare our
method to a well-performing and widely established
stream clustering algorithm, highlighting the benefits
our new method brings to the field.
We analyze our algorithm for processing data
streams in the context of network intrusion detec-
tion. Currently, no research was conducted to in-
vestigate the application of Quantum Clustering for
streaming data or network anomaly detection. As
Quantum technology and, thus, new possibilities in
computation and analysis are on the rise, quantum-
inspired machine learning is bridging the gap where
quantum hardware computations are not commer-
cially available. However, the conceptual or mathe-
matical framework can already be used and mapped
to traditional computation tasks. Case studies us-
ing quantum-inspired machine learning techniques
are found in the context of analyzing high-energy
physics data (T. Felser, 2020), the analysis of 6G net-
works (T.Q. Duong, 2022), or recommendation sys-
tems (Tang, 2019) to name a few. Some of the studies
simulate the behavior of qubits or quantum states, in
general, (Y. Mahmoudi, 2020) as processing units and
use these approaches in the development of new meth-
ods, while others exploit the mathematical framework
to solve classical computation tasks in a new way
(K.H. Han, 2002). Quantum Clustering is a technique
inspired by the description and evolution of states de-
scribed as wavefunctions under the Schr
¨
odinger equa-
tion. It works with a Parzen-window estimator as
a Gaussian wave packet over data points, viewing
those as the Eigenfunctions of the Schr
¨
odinger equa-
tion (Y. Mahmoudi, 2020). Studies have shown the
strength of the method in several applications such as
asteroid spectrum taxonomy (Deutsch, 2017), docu-
ment analysis (D. Liu, 2016), or financial data anal-
ysis (Shaked, 2013). Furthermore, (D. Liu, 2016)
showed the feasibility of the method for detecting
outliers in datasets, which makes it an exciting can-
didate for the application of network data analysis.
They showed that the algorithm could capture subtle
changes in the density of the data and outperformed
standard methods such as DBSCAN and conventional
Parzen-window methods (D. Liu, 2016). A signifi-
cant advantage of Quantum Clustering is that it does
not require a predefined number of clusters as con-
ventional methods like k-means, which makes it par-
ticularly practicable for automated analysis of data
streams. The data partition and sensitivity can be var-
ied with the length scale of sigma - the width param-
eter of the Gaussian kernel - where a bigger value
IoTBDS 2023 - 8th International Conference on Internet of Things, Big Data and Security
18