A local-first, open-source research platform for classical-quantum comparative security detection
Qute ingests security telemetry via syslog (TCP/UDP), evaluates it against a corpus of 40 Sigma detection rules, and runs the same detection problem through both a classical and a quantum circuit — comparing efficacy side-by-side on accuracy, F1, false positive rate, and latency.
The quantum layer uses NVIDIA CUDA-Q for GPU-accelerated circuit simulation. Realistic noise modelling and error correction are provided by NVIDIA Ising decoding models. No QPU required.
Qute is a research and benchmarking platform — not a production SIEM replacement. It is designed to answer the question: at what point, and for what detection scenarios, does quantum advantage become real?
| Metric | Classical | Quantum (6-qubit VQC) |
|---|---|---|
| Efficacy (0–100) | 98.95 | 99.55 |
| Accuracy | 99% | 100% |
| F1 | 0.989 | 1.000 |
| False negatives | 0 | 0 |
| False positives | 1 | 0 |
| Windows detection | ✅ | ✅ |
| Port scan detection | ✅ | ✅ |
Quantum wins at 6 qubits with v2 features. The VQC achieves perfect classification on the 100-event demo dataset — including Windows execution threats (Rundll32, PowerShell, PsExec, mshta) that were not detectable at 4 qubits.
Quantum anomaly detection: Events with no matching rule but high VQC confidence (≥0.80) surface as quantum_anomaly — flagging threats the rule corpus doesn't yet cover.
Quantum error correction (Ising): The NVIDIA Ising pre-decoder reduces surface-code logical error rate by 26–30% at p=0.003–0.005 (D=7, N=100k shots).
Syslog (port 5514 TCP/UDP)
│
ECS Normaliser
(24-dim feature vector v2)
│
┌─────┴──────────────────────────────────────┐
│ │
Classical Head Quantum Head
(weighted linear classifier) (6-qubit VQC, CUDA-Q)
threshold = 4.974 threshold = 0.80
F1 = 0.989 F1 = 1.000
│ │
└─────────────────┬──────────────────────────┘
│
Detector (background thread)
Verdicts: confirmed / rule_match / quantum_anomaly / benign
│
DuckDB Store
│
Streamlit Dashboard (8 tabs)
Ingest → Rules → Detections → Quantum →
Visualise → Benchmark → Report → Settings
| Dims | Feature group | Signal |
|---|---|---|
| 0–3 | IP signal | Private/external, octets, entropy |
| 4–5 | Severity | Normalised severity, high-severity flag |
| 6–8 | Process class | Risk score, auth process, network process |
| 9–12 | Message patterns | Fail, auth, exploit, scan keywords |
| 13–15 | Context | Repeat source, hour, off-hours flag |
| 16–17 | Windows process | High-risk executable, living-off-the-land binary |
| 18–19 | Command encoding | Encoded command patterns, command entropy |
| 20–23 | Execution threats | Lateral movement, persistence, AV tamper, path anomaly |
The quantum circuit compresses 24 features into 6 qubit composites (network, severity, process, message, Windows, temporal) before encoding as Ry rotation angles.
Requirements: Docker, NVIDIA Container Toolkit (for GPU), Ollama
git clone https://github.com/marjatmm-sec/qute.git
cd qute
git checkout dev # active development branch
cp .env.example .env
# Edit .env — set QUTE_OLLAMA_HOST at minimum
# CPU build (no GPU required)
docker compose build qute-app
docker compose up -d qute-app
# GPU build (RTX 2080+ recommended)
# Edit docker-compose.yml: target: gpu, uncomment deploy block
docker compose build qute-app
docker compose up -d qute-appUI available at http://localhost:8503
python3 scripts/download_ising_models.py| Verdict | Meaning |
|---|---|
confirmed |
Rule match and VQC confidence ≥ 0.80 — both heads agree |
rule_match |
Rule matched, VQC below threshold — classical detection only |
quantum_anomaly |
No rule match, VQC confidence ≥ 0.80 — novel threat pattern |
benign |
No rule match, VQC below threshold |
quantum_anomaly surfaces events that look statistically anomalous to the quantum circuit but don't yet have a covering rule.
The Benchmark tab includes a built-in 100-event synthetic dataset with verified ground truth labels. Run immediately after startup — no ingestion required.
Dataset (100 events): 40 benign routine, 15 benign auth, 15 SSH brute force, 10 privilege escalation, 10 port scan, 10 lateral movement.
Live benchmark: Switch to Live mode and select Rule-based (from detections) ground truth to benchmark against your actual ingested event stream.
| Platform | Rules |
|---|---|
| Linux | 24 — SSH brute force, privilege escalation, firewall drops, lateral movement, credential access |
| Windows | 13 — Rundll32, PowerShell, mshta, PsExec, LSASS dump, AV tamper, scheduled tasks |
| Network | 3 — Port scan, C2 beaconing, mass connection |
python3 scripts/import_sigma_corpus.py --platform allGenerate realistic multi-platform threat streams for pipeline testing:
python3 scripts/replay_generator.py --platform all --rate 2 --anomaly-ratio 0.3 --duration 60Or use the Settings tab in the UI. Campaign mode shifts the anomaly ratio sinusoidally, simulating an attack campaign developing and subsiding.
Re-optimise VQC parameters after feature vector changes:
python3 scripts/optimise_vqc_params.py --trials 8 --maxiter 2000Completes in ~2 minutes using vectorised numpy simulation. Saves to data/vqc_params_v2.json.
| Variable | Default | Description |
|---|---|---|
QUTE_OLLAMA_HOST |
auto-detect | Ollama host IP |
QUTE_OLLAMA_MODEL |
qwen2.5:latest |
LLM model |
QUTE_QUANTUM_BACKEND |
nvidia |
cpu or nvidia |
QUTE_QUANTUM_SHOTS |
1024 |
Shots per circuit |
QUTE_ISING_NOISE_ENABLED |
true |
Enable noise model |
QUTE_ISING_NOISE_DEPOLAR_PROB |
0.001 |
Depolarising probability |
QUTE_DB_PATH |
~/.qute/data.db |
DuckDB path |
| Backend | Latency (6 qubits) | Notes |
|---|---|---|
| CPU (numpy, exact probs) | ~15ms | Fast via vectorised statevector |
| GPU (CUDA-Q, RTX 2080 Ti) | ~180ms | Recommended for live detection |
qute/
├── src/
│ ├── ingestion/ # Syslog parsers, normaliser, live listener, replay generator
│ ├── classical/ # LLM rule generation, Sigma rule store
│ ├── quantum/ # CUDA-Q circuits (VQC/QSVM), Ising noise, runner
│ ├── detection/ # Live detector thread, verdict engine
│ ├── benchmark/ # Comparator, metrics, ground truth modes
│ ├── store/ # DuckDB schema, queries, migrations, settings
│ └── ui/ # Streamlit dashboard (8 tabs)
├── data/
│ ├── samples/ # Demo dataset
│ ├── vqc_params_v2.json
│ └── ising_models/ # Downloaded separately
├── scripts/
│ ├── import_sigma_corpus.py
│ ├── optimise_vqc_params.py
│ ├── recompute_feature_vectors.py
│ └── replay_generator.py
├── vendor/
│ └── ising_decoding_code/
├── config.py
├── Dockerfile
└── docker-compose.yml
The Quantum tab includes a surface-code QEC benchmark:
Stim surface code circuit (distance D, error rate p)
│
NVIDIA Ising CNN pre-decoder
│
PyMatching (residual syndrome correction)
│
Logical error rate: baseline vs Ising-corrected
Verified (D=7, p=0.005, N=100k): LER improvement 26.6%, syndrome density reduction 27.1×.
- SecGraph-AI — local-first AI security consultancy built on Neo4j, Ollama, and MITRE ATT&CK. Qute is designed to plug in as a quantum detection layer.
See CONTRIBUTING.md. Issues and PRs welcome — please target the dev branch.
MIT — see LICENSE.