Hybrid Quantum ML for Passive OS Fingerprinting

The talk looks at passive operating system fingerprinting, which identifies the OS behind captured network traffic without sending any probes to the target. The speaker uses nPrint to convert packet captures into binary feature columns, then removes identifying fields such as IP addresses so a model cannot simply memorize the answers. The classical baseline is the XGBoost gradient-boosting model from the open-source OSIRIS-ML tool.

The core experiment swaps that classifier for a hybrid quantum-classical model. Each of 20 binary features is encoded into one of 20 qubits, the qubits are linked in a linear entanglement layout, and the measured outputs feed a small classical neural network that predicts among 12 OS classes. Over 50 training epochs on a simulator, the quantum model reached a weighted F1 of 0.348 against 0.361 for XGBoost on the same features, with accuracy of 42.9% versus 45.85%. It used about 1,228 trainable parameters, compared with more than 33,000 for the baseline.

The speaker is clear about the limits: the runs used a simulator rather than noisy hardware, some training runs collapsed, and the circuit was small. A classical baseline built on the top 20 features from a much larger set scored about 49%. The takeaway is that quantum machine learning can be applied to security workloads beyond cryptography, and that the method can be reproduced on a modern GPU. Larger circuits, continuous features and real quantum hardware are named as next steps.