Adaptive quantum-walk-inspired attack graph compiler for vulnerability-aware exploration and explainable cybersecurity attack path prioritization

Abstract

Attack graph analytics plays a critical role in cybersecurity by enabling attack-path discovery, risk assessment, and security prioritization in complex network environments. However, existing attack graph frameworks often suffer from limited scalability, fixed exploration strategies, and insufficient interpretability, restricting their applicability to large-scale and dynamic cyber infrastructures. To address these challenges, this paper proposes the Adaptive Quantum-Walk-Inspired Attack Graph Compiler (AQAGC), a hybrid quantum–classical attack graph analytics framework that employs quantum walk principles to improve attack-path discovery, prioritization, and explainable cyber-risk analysis. Rather than claiming practical quantum computational advantage, AQAGC leverages quantum-walk-based representations and hybrid simulation to investigate scalable attack graph exploration under realistic noisy intermediate-scale quantum (NISQ) conditions. AQAGC integrates the proposed Vulnerability-Aware Quantum Encoding (VAQE) module, an adaptive scheduler that dynamically balances Discrete-Time Quantum Walk (DTQW) and Continuous-Time Quantum Walk (CTQW) evolution, and the Explainable Risk Attribution Module (ERAM). The framework further introduces the Attack Path Relevance Score (APRS) for attack-path prioritization by jointly considering quantum visitation probability, cumulative risk, transition impact, and attribution information. In addition, Node Attribution Score (NAS), Edge Attribution Score (EAS), Path Attribution Score (PAS), Amplitude Concentration Score (ACS), and Risk Concentration Index (RCI) are proposed to provide interpretable risk attribution and characterize quantum exploration behavior. To facilitate systematic evaluation, a derived multi-scale attack graph benchmark was constructed from the CIC-IDS2017, UNSW-NB15, CSE-CIC-IDS2018, and ToN-IoT datasets, comprising standardized attack graphs containing 50 to 5000 nodes. Experimental results demonstrate that AQAGC consistently outperforms classical graph-search, probabilistic, quantum-walk-based, and hybrid quantum baselines in attack-path discovery, ranking quality, scalability, robustness, and explainability. These findings highlight the potential of adaptive hybrid quantum exploration for next-generation cybersecurity analytics and intelligent attack-path prioritization.