A Simulation-Based Quantum-Synchronized Ephemeral Encryption Framework for QKD-Secured IoT Networks with Transformer-Based Cyber-Quantum Attack Detection

Abstract

This paper presents a simulation-based cyber-quantum Internet of Things (IoT) security framework for modeling, securing, and detecting attacks in QKD-secured IoT communication environments. The proposed framework integrates heterogeneous IoT traffic generation, gateway-assisted routing, edge processing, QKD key-pool management, Quantum-Synchronized Ephemeral Encryption (Q-SEE), cross-layer adversarial attack injection, and AI-based multiclass detection. Unlike conventional IoT intrusion datasets that mainly capture packet- or flow-level abnormalities, the generated dataset represents the joint behavior of IoT sessions, network delay, queue pressure, QKD state, key consumption, encryption-mode transitions, ciphertext metadata, and cyber-quantum risk. A Python/SimPy/NetworkX simulation was developed using 80 IoT devices, 3 gateways, 2 edge servers, 4 cyber-quantum control-plane nodes, and 1 adversarial orchestrator. The final simulation produced 46,351 records with 76 features covering normal traffic, five traditional IoT attacks, and six novel cyber-quantum attacks, including QKD key-pool starvation, QBER camouflage, false QKD-health injection, encryption downgrade induction, queue–key coupling, and multi-vector cyber-quantum orchestration. Q-SEE adaptively selects among QKD-OTP, QKD-synchronized AES-256 ephemeral mode, PQC fallback, degraded mode, and blocked mode according to QBER, secret key rate, key availability, device criticality, downgrade pressure, and risk. A leakage-aware Quantum-Aware Kolmogorov–Arnold Network (QKAN) was then trained using deployable cyber-quantum evidence. The final nonrisk QKAN achieved 98.79% test accuracy, 98.61% macro-F1, 98.85% weighted-F1, and 99.78% macro-AUC, demonstrating effective detection of traditional and cyber-quantum IoT attacks.

1. Introduction

The rapid expansion of Internet of Things (IoT) ecosystems has transformed modern digital infrastructures into highly interconnected, data-intensive, and security-sensitive environments, where physical devices, embedded sensors, communication modules, and cloud services operate as a unified cyber-physical fabric [1]. Smart meters, industrial controllers, medical IoT, environmental sensors, edge cameras, and gateway devices continuously exchange heterogeneous traffic with various packet sizes, timing behaviors, communication protocols, power profiles, and criticality levels of the operation [2]. Also enhanced are the automation, monitoring, and service continuity, but due to this diversity, each communication session may have different level of reliability, privacy, latency, and protection requirements, making the security management more complex. For gateway-assisted IoT architectures, typical traffic aggregation is achieved on access gateways and then processed at edge servers and sent to cloud or control-plane services, which leads to distributed paths that involve delay, queueing, forwarding and computation affected by both network and edge conditions [3]. There is no longer a limit to attacks targeting only individual packets or devices, but also propagation through queueing behavior, forwarding delay, packet loss, throughput degradation, energy consumption and edge level congestion. All these properties imply that IoT security is not a distinct problem, but it is a cross-layer problem, where the behavior of the devices, network performance, service continuity, and security state should be understood as a system, not individually [4].

However, quantum key distribution (QKD) has proven to be a potential security technology for enhancing the confidentiality of communication by using quantum-based key material, especially in critical infrastructures where data privacy, data authentication and communication trust is critical [5]. The security of QKD is based on the physical properties of the quantum measurement, not just the classical computational hardness in itself; in theory, this means that QKD offers strong protection against a computationally powerful adversary [6]. While theoretical key exchange is a crucial element for practical QKD-secured communication, other operational parameters, including the quantum bit error rate (QBER), secret key rate, key acceptance rate, key-pool availability, channel noise, eavesdropping intensity and consistency between real and reported quantum-channel conditions, are also involved [7]. In an IoT environment, all these metrics are more challenging to control because traffic demand is dynamic, packet sizes depend on the device, high-criticality sessions can call for higher security, and frequent requests for secure sessions can impose key-consumption pressure. Hence, the secure IoT communication should be a security mechanism that, instead of performing static encryption, should be a dynamic decision process depending on the state of the quantum-channel, key material available, criticality of the device, and risk induced by the attacks [8].

Adaptive encryption orchestration is particularly important when QKD-secured IoT systems operate under nonideal or adversarial conditions. A secure-session controller must decide whether a session should use strong QKD-backed protection, QKD-synchronized ephemeral encryption, post-quantum fallback, degraded operation, or complete blocking. Such decisions require more than a simple threshold on QBER because cyberattacks may manipulate several layers simultaneously, while realistic QKD devices may deviate from ideal assumptions through imperfect sources, detectors, finite-key effects, and side-channel exposure [9]. For example, a high-criticality industrial or medical IoT session may require QKD-backed protection only when sufficient key material exists and the reported quantum state is trustworthy. In contrast, reduced key quality or partial QKD degradation may require controlled fallback, while unsafe QBER, high downgrade pressure, or severe cyber-quantum risk may require degraded or blocked operation. This creates a security-control problem in which encryption mode, key consumption, remaining key material, downgrade state, block state, ciphertext metadata, and risk level become part of the observable behavior of the protected IoT session. Such adaptive behavior is essential for modeling realistic QKD-secured IoT systems because successful security is not only a matter of whether encryption exists, but whether the selected protection mode remains appropriate under changing network and quantum conditions.

QKD-secured IoT environments come with a wider threat landscape than traditional intrusion detection scenarios in IoT. Disturbed access-layer trust, delivery of packets, payload integrity, and traffic are the principle disturbances in traditional attacks, including distributed denial-of-service, MQTT flooding, false data injection, replay attacks and gateway compromise. The cyber-quantum attacks are a more nuanced attack because they are directed at the interaction between IoT traffic and quantum-security control. Excessive demand for secure sessions can lead to key-pool starvation, while encryption downgrade induction can induce the controller to operate in weaker states; QBER camouflage can make it appear that the quantum-channel is healthy when it is not; cross-layer queue–key coupling can simultaneously cause a congestion in the gateway and accelerate key depletion; false QKD-health injection can induce an artificial safe state; and multi-vector cyber-quantum orchestration can couple multiple types of manipulation of QBER, eavesdropping intensity, queue pressure, key demand, and Q-SEE mode transitions. Detecting these attacks with classical traffic features alone is hard because they manifest themselves in network behavior, key-pool dynamics, encryption-mode decisions, and risk evolution. Hardware-oriented QKD attacks have already shown that implementation-level weaknesses can compromise practical systems even when the theoretical protocol remains secure [10]. Similarly, measurement-device-independent QKD was introduced to reduce detector-side vulnerabilities, confirming that device behavior and security monitoring must be treated as central elements in practical quantum-secure communication [11].

Artificial intelligence plays a central role in interpreting such complex cyber-quantum evidence because the relationship between IoT traffic, QKD indicators, adaptive encryption state, queue pressure, and attack class is nonlinear and highly interdependent. A detection model must distinguish between benign QKD-secured sessions, classical cyberattacks, QKD-state attacks, and coordinated cross-layer cyber-quantum attacks using evidence that may include QBER gaps, false-health reports, secret key rate, available key bits, required key bits, Q-SEE mode, downgrade flags, block flags, gateway waiting time, burst indicators, ciphertext entropy, packet loss, delay, throughput, energy consumption, and final risk score. Classical intrusion-detection datasets and benchmarks have demonstrated the importance of structured traffic features, multiclass labels, and reproducible evaluation protocols for network-security learning [12]. Recent smart-grid intrusion-detection research further shows that graph attention and Kolmogorov–Arnold Networks can improve detection of complex nonlinear attack patterns by combining infrastructure interaction modeling with learnable spline-based transformations [13]. In power IoT security, KAN-based learning has also been used to localize eavesdropping nodes from heterogeneous node features, supporting the value of nonlinear function approximation for intelligent cyberattack detection [14]. Transformer-based attention mechanisms provide another important learning direction because they enable models to represent dependencies across complex feature sequences and long-range interactions [15]. Therefore, effective cyber-quantum IoT detection depends on the joint design of realistic simulation, adaptive secure-session control, cross-layer attack modeling, leakage-aware feature preparation, and interpretable nonlinear classification.

The main contributions are summarized as follows:

• A reproducible cyber-quantum IoT simulation framework is developed to model heterogeneous IoT devices, gateway-assisted communication, edge processing, QKD key-pool management, and Q-SEE adaptive encryption control within a unified secure-session workflow.
• A cross-layer attack taxonomy is introduced to represent both traditional IoT attacks and novel cyber-quantum threats, including QKD key-pool starvation, QBER camouflage, false QKD-health injection, encryption downgrade induction, queue–key coupling, and multi-vector cyber-quantum orchestration.
• A leakage-aware AI detection pipeline is established using QKAN-based multiclass classification to learn from IoT/session features, network-performance indicators, gateway queue pressure, QKD state, Q-SEE encryption transitions, ciphertext metadata, and cyber-quantum risk evidence.

The remainder of this paper is organized as follows. Section 2 reviews the related literature on IoT cybersecurity, quantum-aware communication security, cryptographic protection, and intelligent attack detection, and identifies the research gaps motivating the proposed framework. Section 3 describes the methodology, including the simulation architecture, heterogeneous IoT traffic generation, QKD key-management model, Q-SEE adaptive encryption mechanism, cross-layer cyber-quantum attack generation, dataset construction, and QKAN-based multiclass detection procedure. Section 4 presents and discusses the experimental results, including network and gateway behavior, QKD degradation, Q-SEE security-mode transitions, risk and attack-severity analysis, multiclass detection performance, and ablation comparisons. Finally, Section 5 summarizes the principal findings, discusses the limitations of the simulation-based approach, and outlines directions for future research and practical validation.

Figure 1 provides a high-level conceptual map of the proposed Q-SEE cyber-quantum IoT framework and illustrates how its principal components are integrated. Heterogeneous IoT devices, including smart meters, sensors, industrial controllers, medical IoT devices, and edge cameras, generate traffic with different packet characteristics and criticality levels. These communications are processed through the access-gateway and edge-computing layer before reaching the cyber-quantum security layer, where QKD key management maintains QBER, secret key rate, key-pool, and key-generation information, while Q-SEE adaptively selects the appropriate protection mode, including QKD-OTP, AES-256, PQC fallback, degraded operation, or blocking. Traditional IoT attacks and cyber-quantum attacks influence multiple layers of the architecture, including gateway behavior, QKD resources, and Q-SEE security decisions. The resulting cross-layer evidence is collected into a dataset containing IoT, network, QKD, Q-SEE, and attack-related features, which is subsequently processed by the QKAN-based multiclass detector to distinguish normal traffic, traditional IoT attacks, and cyber-quantum attack scenarios. The figure therefore summarizes the complete integration of heterogeneous communication, adaptive quantum-aware security, adversarial behavior, dataset generation, and intelligent multiclass attack detection within the proposed framework.

Figure 1. Conceptual integration map of the proposed Q-SEE cyber-quantum IoT security framework, illustrating heterogeneous IoT communication, gateway and edge processing, QKD key management, Q-SEE adaptive encryption, cross-layer cyberattacks, dataset generation, and QKAN-based multiclass attack detection.

2. Literature Review

The literature relevant to the proposed framework can be organized into three complementary research directions: AI-based intrusion detection and trust modeling for IoT environments, lightweight and quantum-ready cryptographic protection, and integrated IoT security frameworks combining secure communication with intelligent attack detection. These directions provide the technological foundations for integrating QKD key management, adaptive Q-SEE encryption, cross-layer cyber-quantum attack modeling, and QKAN-based multiclass detection.

2.1. AI-Based Intrusion Detection and Trust Modeling for IoT

Wu et al. [13] developed a Graph Attention and Kolmogorov–Arnold Network (GraphKAN) model for intrusion detection in smart-grid environments. Their study focused on enhancing cybersecurity in highly interconnected smart-grid infrastructures where classical IDS models often fail to capture nonlinear and topological attack patterns. The main objective was to address the problem of insufficient integration between physical smart-grid structure, communication-network dependencies, and nonlinear attack representation. Methodologically, they constructed a graph representation using power devices, information-technology devices, and communication devices as nodes, while physical and logical relationships were modeled as graph edges. A graph attention network was then used to extract interaction-aware features, and a Kolmogorov–Arnold Network with learnable B-spline functions was employed for downstream intrusion classification. Their experiments on Mississippi State University and Oak Ridge National Laboratory smart-grid datasets achieved accuracies of 97.63%, 98.66%, and 99.04% for binary, ternary, and 37-class detection tasks, respectively, with accuracy improvements of 5.73%, 0.89%, and 3.52% over selected state-of-the-art baselines. However, their work did not model QKD key-pool dynamics, QBER deception, Q-SEE encryption-mode transitions, or cyber-quantum attack classes; our study addresses this gap by integrating QKD/Q-SEE evidence with QKAN-based multiclass cyber-quantum attack detection.

Ahanger et al. [16] proposed an advanced IoT intrusion detection framework based on graph attention networks (GATs). Their study investigated how graph-based learning can improve IoT IDS performance by representing relationships among traffic samples rather than treating each flow as an independent tabular record. The main objective was to solve the problem that conventional ML and DL models often ignore structural dependencies among IoT network flows, which reduces their ability to detect distributed and complex attacks. Their methodology involved preprocessing the NSL-KDD dataset using one-hot encoding and min–max normalization, constructing graph data through Euclidean-distance and similarity-based adjacency matrices, and training a GAT model using 2 attention layers, 2 attention heads, 110 hidden units, 500 epochs, and an 80/20 train–test split. The results showed that the proposed GAT model achieved 98.00% accuracy for binary classification and 99.20% accuracy for multiclass classification, confirming the value of graph-based representation for intrusion detection. However, the study remained limited to classical IoT intrusion patterns without QKD-layer indicators, Q-SEE state transitions, key availability, QBER trust gaps, or quantum-aware deception features; our framework solves this gap by generating and detecting cross-layer cyber-quantum attacks in QKD-secured IoT communication.

Sharma et al. [17] introduced an interpretable intrusion detection framework for IoT environments using a Self-Attention Deep Neural Network with Learnable Feature Gating (SA-DNN + LFG). Their work focused on improving both detection accuracy and interpretability in heterogeneous IoT networks where static feature selection and black-box models limit operational trust. The objective was to address the research problems of limited adaptability, weak interpretability, and insufficient cross-dataset generalization in existing IoT IDS solutions. Methodologically, the authors evaluated the framework independently on BoT-IoT, N-BaIoT, and UNSW-NB15 datasets, using dataset-specific preprocessing, sampling, feature selection, self-attention layers, learnable feature gating, and SHAP/LIME-based explainability. Their results reported 99.30% accuracy on BoT-IoT, 99.60% accuracy on N-BaIoT, and 97.90% accuracy on UNSW-NB15, demonstrating strong performance across IoT-specific and general network-security datasets. However, their framework did not incorporate QKD security variables, QBER camouflage, Q-SEE fallback/degraded/blocked modes, or cyber-quantum attack labels; our study extends explainable AI-based detection by adding quantum-channel, key-pool, encryption-state, queue-pressure, and risk-score evidence.

Han et al. [18] proposed a GNN-based trust propagation and intelligent certificate revocation mechanism for large-scale IoT networks. Their study addressed trust management and certificate lifecycle security in highly dynamic IoT infrastructures where traditional PKI mechanisms face scalability and responsiveness limitations. The objective was to solve the problem of delayed certificate revocation and unreliable trust evaluation in large IoT deployments with many heterogeneous devices and changing communication relationships. Methodologically, they designed a graph-attention-based trust propagation model with temporal decay, generated trust embeddings from relational device behavior, and combined those embeddings with anomaly indicators and topological features to support adaptive certificate revocation decisions. Their experimental evaluation on networks containing up to 102,400 devices achieved trust-propagation accuracy above 89%, a certificate-revocation F1 score of 0.904, and median response latency below five seconds. However, the study focused on PKI trust and certificate revocation rather than QKD-secured session behavior, QKD key-pool depletion, Q-SEE mode switching, or multiclass cyber-quantum attack detection; our work addresses this gap by linking trust/risk evidence with QKD and Q-SEE operational states.

2.2. Lightweight and Quantum-Ready Cryptographic Security for IoT

Jenny et al. [19] proposed a hybrid cryptographic approach for securing resource-constrained IoT devices. Their study focused on balancing data integrity, encryption efficiency, and lightweight operation in IoT environments where devices have limited memory, processing capability, and power resources. The objective was to solve the problem that existing security mechanisms are either computationally heavy, costly, difficult to standardize, or insufficient for constrained IoT devices. Methodologically, the authors integrated SHA-512 hashing with the PRESENT cipher, implemented the hybrid method in an IoT platform, and evaluated it using avalanche effect, authentication success rate, collision occurrence, and execution time, with validation supported by ThingSpeak, Visual Studio, and CrypTool. The results showed avalanche-effect values ranging from 53% to 65%, no collisions across 10,000 to 80,000 experimental runs, and an average execution time of 0.088246 s, with observed execution times ranging from 0.075954 s to 0.094583 s. However, the study focused on lightweight cryptographic protection and did not model QKD key generation, Q-SEE adaptive encryption orchestration, QBER manipulation, false QKD health reporting, or AI-based cyber-quantum attack classification; our framework addresses this gap through QKD-aware encryption control and QKAN detection.

Huan and Xie [20] proposed a scalable and energy-efficient hybrid cryptographic framework for IoT security using advanced symmetric and asymmetric techniques. Their study focused on lightweight data protection for resource-constrained IoT devices while maintaining confidentiality and practical deployment compatibility with IoT communication frameworks. The objective was to reduce computational and energy overhead in IoT encryption by combining the security strength of AES-256 with ECC-based key management. Methodologically, the authors designed a Hybrid Elliptic-AES Encryption (HEAE) model, incorporated SHA-256 hashing for integrity, and evaluated execution time and energy consumption against conventional RSA and DES-based approaches across different dataset sizes. Their results showed that HEAE reduced execution time by 26% compared with RSA and 14% compared with DES for 5 MB datasets, while reducing energy consumption by 19% compared with RSA and 6% compared with DES for 20 MB datasets. However, HEAE did not incorporate QKD-derived key pools, QBER-based trust, adaptive Q-SEE mode selection, or intrusion-detection labels; our manuscript extends lightweight secure IoT communication by modeling dynamic QKD/Q-SEE behavior and cyber-quantum attack detection.

Abdelaal et al. [21] introduced TTEA, a quantum-ready and energy-conscious encryption model for secure IoT environments. Their study is highly relevant to quantum-aware IoT security because it aimed to strengthen lightweight encryption while considering future post-quantum threats and energy-constrained devices. The objective was to address the conflict between robust encryption requirements and limited IoT hardware capability, especially where conventional lightweight algorithms such as TEA and Speck may suffer from cryptanalytic vulnerabilities. Methodologically, TTEA used a two-stage encryption design with a $20\times 20$ bit-sliced S-box, adaptive key scheduling, device-power-aware computational adjustment, and optional CRYSTALS-Kyber integration for post-quantum key exchange. Their experimental evaluation on ESP32 and Raspberry Pi platforms showed 39% lower energy consumption than TEA, 40% lower memory requirements, 20% faster execution, an avalanche effect of 48.5%, and near-ideal ciphertext entropy of 7.98 bits for 128-byte packets. However, TTEA did not simulate QKD key-pool evolution, QBER camouflage, Q-SEE fallback/degraded/blocked states, or AI-based cyber-quantum intrusion detection; our study fills this gap by coupling quantum-aware encryption decisions with multiclass attack-detection evidence.

Sadia et al. [22] proposed a hybrid cryptographic model to enhance privacy preservation and integrity in IoT-enabled wireless sensor networks. Their study focused on securing WSN-based IoT communication where low-power devices require efficient encryption, low memory use, and manageable communication overhead. The objective was to solve the problem that traditional cryptographic algorithms such as RSA, AES, and Blowfish may provide strong protection but can impose excessive resource demands on constrained sensor nodes. Methodologically, the authors evaluated RSA, AES, and Blowfish and combined them into a hybrid security model tested on sensor-data transmission, using encryption/decryption time, security strength, memory consumption, data throughput, and communication overhead as performance metrics. Their numerical results showed an 18% reduction in encryption time compared with AES, memory usage of only 25.16 KB, throughput of 24.89 KB/s, and communication overhead of 1.32 KB. However, their work did not include QKD-secured key management, quantum-channel quality features, Q-SEE security-level transitions, or attack-wise AI classification; our framework addresses these missing elements through a QKD/Q-SEE cyber-quantum IoT simulation and QKAN detector.

2.3. Integrated IoT Security and Intelligent Attack Detection

Qasem et al. [23] developed an integrated cloud-based IoT security framework combining lightweight cryptographic algorithms with machine learning intrusion detection. Their study is relevant because it jointly considered secure IoT data transmission and ML-based attack detection rather than treating encryption and IDS as separate problems. The objective was to address the lack of unified IoT security frameworks that evaluate encryption overhead, secure MQTT transmission, and intelligent detection under realistic cloud-IoT constraints. Methodologically, the authors compared XOR, ChaCha20, AES, and hybrid AES-RSA using memory consumption, CPU usage, and an Overall Resource Consumption Score (ORCS), while RF, XGBoost, CatBoost, and ensemble classifiers were evaluated on MQTTEEB-D and CIC IoT 2023 datasets. Their results showed that hybrid AES-RSA required only 0.126 KB per traffic record with ORCS = 0.56 on MQTTEEB-D, where the voting ensemble achieved 92.68% accuracy; on CIC IoT 2023 with 605,839 test records, hybrid AES-RSA used 0.374 KB per traffic record with ORCS = 0.5425, and the ensemble model achieved 81.09% accuracy.

Yakovyna and Fadieiev [24] proposed a high-performance boosting ensemble learning approach for IoT intrusion detection. Their study focused on improving lightweight and scalable malware detection at the network edge where traditional signature-based detection cannot keep pace with evolving IoT cyber threats. The objective was to solve the problem of balancing high detection accuracy with computational efficiency for large-scale IoT traffic classification. Methodologically, they used the Aposemat IoT-23 dataset containing more than 25 million records, performed extensive preprocessing and exploratory data analysis, and compared logistic regression, naive Bayes, random forest, AdaBoost, XGBoost, and LightGBM under fivefold cross-validation. Their results showed that LightGBM achieved 99.9% accuracy, 99.9% F1 score, and 99.9% ROC AUC, with a training time of 612 s, while confusion-matrix analysis indicated low false-positive and false-negative behavior. However, the study focused on classical IoT malicious-traffic detection and did not model QKD/Q-SEE cyber-quantum evidence, encryption-state degradation, QBER deception, or key-pool starvation; our manuscript addresses this gap by creating a QKD-secured IoT dataset with cyber-quantum attack labels and QKAN-based detection.

The reviewed literature reveals substantial progress in three complementary areas: intelligent intrusion detection and trust modeling, lightweight and quantum-ready cryptographic protection, and integrated IoT security combining communication protection with automated attack detection. AI-based studies demonstrate strong classification and representation capabilities but primarily operate on conventional network-security evidence, while cryptographic studies improve confidentiality, efficiency, and quantum readiness without explicitly modeling the dynamic interaction between QKD resources and attack detection. Integrated frameworks move toward combining encryption and intelligent intrusion detection, yet they generally remain focused on classical IoT threats. Consequently, a research gap remains in jointly modeling heterogeneous IoT communication, QKD key-pool dynamics, quantum-channel trust, adaptive encryption-state transitions, traditional and cyber-quantum attacks, and leakage-aware multiclass detection within a unified operational environment. The QKD/Q-SEE and QKAN framework considered in this study addresses this intersection by coupling quantum-aware security control with cross-layer attack behavior and intelligent detection.

3. Methodology

The proposed framework is designed as a simulation-based cyber-quantum Internet of Things (IoT) security environment that integrates heterogeneous IoT traffic generation, gateway-assisted communication, edge processing, quantum key distribution (QKD) key management, Quantum-Synchronized Ephemeral Encryption (Q-SEE), adversarial cross-layer attack injection, and Transformer-based attack detection. The objective of this architecture is to model the operational behavior of QKD-secured IoT communication under both normal and attack conditions while producing a structured dataset for artificial-intelligence-based detection. Unlike a purely random synthetic-data generator, the proposed framework follows a network-oriented discrete-event simulation logic in which IoT devices generate communication sessions, packets are routed through access gateways and edge servers, Q-SEE determines the suitable encryption mode according to quantum and network conditions, and the QKD key manager supplies key-availability and security indicators. This design allows the generated dataset to capture not only traffic-level features such as delay, jitter, packet loss, throughput, and energy consumption, but also cyber-quantum features such as QBER variation, key-pool availability, secret key rate, encryption-mode switching, downgrade behavior, and attack-induced risk.

Figure 2 illustrates the representative topology of the proposed Q-SEE cyber-quantum IoT simulation environment. The architecture contains four main operational levels: the IoT device field, the access gateway layer, the edge computing layer, and the QKD/Q-SEE cyber-quantum control layer. The IoT field includes representative devices such as smart meters, environmental sensors, industrial controllers, medical IoT devices, and edge cameras, each configured with different packet sizes, transmission intervals, protocols, criticality levels, and energy characteristics. These devices communicate with nearby access gateways, which aggregate local traffic and introduce gateway-level effects such as queuing, forwarding delay, and congestion sensitivity. The edge servers act as intermediate processing nodes connecting the access layer to the cyber-quantum control plane. Accordingly, the proposed architecture does not require constrained IoT devices to directly implement quantum communication hardware; instead, QKD functionality is placed within the infrastructure-capable control layer and its generated key material is made available to IoT sessions through the gateway/edge-assisted Q-SEE security architecture.

Figure 2. Representative Q-SEE cyber-quantum IoT simulation topology showing heterogeneous IoT devices, access gateways, edge servers, QKD key management, adaptive Q-SEE encryption control, cloud monitoring, and adversarial cross-layer influence. The green lines indicate control-plane coordination and security-state exchange among the edge servers, cloud controller, and QKD key-management components.

The cyber-quantum control plane contains the QKD key manager, Q-SEE encryption controller, cloud controller, and security monitor. In the proposed simulation, the QKD key manager represents the trusted QKD subsystem responsible for generating, validating, storing, and supplying quantum-derived secret key material. Conceptually, a QKD session begins with quantum-state transmission between trusted QKD endpoints and measurement at the receiving side. The communicating endpoints then perform authenticated classical reconciliation to retain compatible measurement outcomes, producing sifted key material. The quantum bit error rate (QBER) is evaluated to characterize channel quality and detect abnormal disturbance or possible eavesdropping. The accepted key material is subsequently subjected to the key-distillation process, including reconciliation and privacy amplification, to obtain secret key material suitable for secure communication. The resulting secret bits are stored in the QKD key pool and become available to the Q-SEE controller for session-level protection.

Because the objective of the framework is system-level cyber-quantum security evaluation rather than photon-level optical-device simulation, the physical QKD transmitter, receiver, photon source, detector, and optical-channel processes are represented through a protocol-agnostic abstraction. Specifically, the simulator captures the operational outputs and security state of the QKD process through the raw key length, sifted key length, real and reported QBER, channel noise, eavesdropping intensity, secret key rate, key acceptance rate, generated QKD bits, available key material, required key material, consumed key bits, and remaining key-pool state. The QKD key pool is updated over simulation time according to the configured key-generation process, while every secure-session request produces a corresponding key demand. Consequently, the simulation captures the interaction between quantum-channel quality, secret key generation, key consumption, key depletion, and replenishment without claiming to reproduce the underlying optical hardware at the physical layer.

The Q-SEE encryption controller operates directly on this QKD state rather than treating the quantum key source as an isolated component. For each IoT session, it evaluates device criticality, available QKD key material, required key material, reported QBER, secret key rate, key acceptance rate, reported QKD health, downgrade pressure, and cyber-quantum risk. When the QKD channel is sufficiently trustworthy and adequate key material is available, high-criticality sessions can be protected using QKD-OTP, whereas other secure sessions can employ QKD-Synchronized AES-256 Ephemeral Encryption. When QKD quality or availability becomes insufficient for the preferred QKD-backed mode but remains within recoverable limits, Q-SEE can move the session to post-quantum cryptographic fallback. Severe degradation or adversarial pressure results in degraded or blocked operation. In this way, the QKD subsystem supplies validated quantum-derived key resources, while Q-SEE determines how those resources should be consumed according to the current cyber-quantum operating state.

The cloud controller receives successfully protected and delivered sessions, while the security monitor observes the global cyber-quantum state and provides the operational evidence used by the subsequent QKAN-based multiclass attack-detection stage. The QKD and Q-SEE components are therefore functionally separated: the QKD subsystem establishes and manages secret key resources, whereas Q-SEE performs adaptive encryption orchestration using those resources together with IoT, network, and security-state information.

The adversarial behavior is modeled through a centralized cyber-quantum attack orchestrator rather than through separate isolated attacker nodes. As indicated by the dashed adversarial paths in Figure 2, the orchestrator can influence components across multiple layers, including the access gateways, QKD key-management process, and Q-SEE encryption controller. This allows the simulation to represent attacks that affect not only packet traffic but also QBER trustworthiness, key generation and consumption, QKD health reporting, encryption-mode decisions, replay behavior, gateway congestion, and session risk. These interactions support the proposed cyber-quantum attack classes, including QKD key-pool starvation, QBER camouflage, encryption downgrade induction, false QKD-health injection, cross-layer queue–key coupling, and multi-vector cyber-quantum orchestration. The generated dataset is therefore a controlled simulation-derived research dataset rather than a physically captured optical-QKD dataset, providing a reproducible environment for studying how network attacks and quantum-security disturbances jointly influence QKD-secured IoT communication, Q-SEE encryption behavior, and QKAN-based multiclass cyber-quantum attack detection.

Table 1 summarizes the core architectural and network-level configuration of the proposed Q-SEE cyber-quantum IoT simulation framework. The environment is implemented as a reproducible Python 3.12.7/SimPy 4.1.1/NetworkX 3.4.2 discrete-event simulation with a fixed random seed of 42, a simulation horizon of 3600 s, and a maximum generation limit of 50,000 secure-session records. The simulation generated 46,351 records with 76 features, forming an AI-ready dataset for multiclass cyber-quantum attack detection. The simulated topology contains 90 nodes and 105 links, including 80 heterogeneous IoT devices, 3 access gateways, 2 edge servers, 4 cyber-quantum control-plane nodes, and 1 adversarial orchestrator. This architecture represents a hierarchical IoT deployment in which field-device traffic is aggregated by access gateways, processed by edge servers, passed through the Q-SEE encryption controller, synchronized with the QKD key manager, and finally delivered to the cloud controller. The configuration explicitly couples network-level behavior with cyber-quantum security operation through a validated six-hop secure route, namely, IoT → Gateway → Edge → Q-SEE → QKD → Cloud. The communication links are modeled with layer-specific bandwidth ranges, including 2–15 Mbps for IoT–gateway access links, 80–180 Mbps for gateway–edge backbone links, 250–700 Mbps for edge–control links, 300–800 Mbps for QKD/Q-SEE/cloud links, and 50–150 Mbps for adversarial-control influence paths. Gateway behavior further distinguishes raw SimPy resource queuing from attack-induced burst pressure through actual_simpy_gateway_queue_wait_ms, attack_induced_queue_pressure_ms, and queue_burst_flag. Consequently, the generated records contain not only session labels but also path-level, packet-level, queue-level, energy, QKD, Q-SEE, and adversarial-behavior variables, including network_path, path_hops, path_distance_m, gateway_queue_wait_ms, edge_queue_wait_ms, network_delay_ms, jitter_ms, packet_delivered, and energy_consumption_mj. The main conclusion from Table 1 is that the simulation establishes a coupled cross-layer environment in which communication performance and cyber-quantum security cannot be treated as independent processes. Gateway congestion can alter delay and delivery behavior, heterogeneous session demands can influence QKD key consumption, and QKD/Q-SEE security decisions can evolve within the same end-to-end communication path. Therefore, the configuration provides the structural basis for evaluating attacks through their combined effects on network congestion, forwarding performance, key-resource availability, encryption-state transitions, and session security rather than through isolated traffic variables alone.

Table 1. Core simulation, network, and communication configuration of the proposed Q-SEE cyber-quantum IoT framework.

Stage	Component	Configuration	Role in the Proposed Framework	Resulting Behavior
A. Simulation and Reproducibility
Simulation environment	Discrete-event simulator	Python/SimPy/ NetworkX	Executes time-dependent IoT communication, resource contention, routing, QKD-state evolution, and secure-session processing.	Generates structured session-level cyber-quantum observations.
Simulation horizon	Execution period	3600 s; maximum 50,000 sessions	Defines the temporal boundary and maximum number of communication events generated during one simulation run.	46,351 valid session records were obtained in the final run.
Reproducibility	Random initialization	Seed $=42$	Controls stochastic traffic generation, session sampling, attack-state generation, and simulation repeatability.	Provides a fixed reference simulation configuration.
B. Network Architecture
IoT field	Heterogeneous IoT devices	80 devices; 6 device profiles	Generates heterogeneous communication sessions with different traffic, packet, power, protocol, and criticality characteristics.	Produces device-dependent communication and security demand.
Access layer	Gateways	3 gateways; resource capacity $=1$	Aggregates IoT traffic and introduces finite-capacity resource contention.	Produces gateway waiting time and congestion behavior.
Edge layer	Edge servers	2 servers; resource capacity $=2$	Provides intermediate forwarding and edge-side processing between access gateways and the cyber-quantum control layer.	Produces edge-processing and forwarding delay.
Cyber-quantum control	Cloud, QKD manager, Q-SEE controller, and security monitor	4 control-plane nodes	Coordinates key management, adaptive encryption control, security-state monitoring, and cloud-side communication.	Connects communication behavior with QKD and Q-SEE security decisions.
Adversarial layer	Cyber-quantum attack orchestrator	1 adversarial node	Injects traditional and cyber-quantum disturbances into selected network, QKD, and Q-SEE processes.	Creates controlled cross-layer attack effects.
Topology	NetworkX communication graph	90 nodes; 105 links	Connects IoT, gateway, edge, Q-SEE, QKD, cloud, monitoring, and adversarial components within one validated topology.	Provides topology-aware routing for every generated session.
C. Secure Communication Path
End-to-end route	Secure session path	IoT → Gateway → Edge → Q-SEE → QKD → Cloud	Defines the ordered processing path followed by each simulated secure session.	Couples network forwarding with cyber-quantum security processing.
IoT access link	IoT–Gateway	2–15 Mbps	Carries endpoint traffic from heterogeneous IoT devices to the assigned access gateway.	Contributes to access delay, bottleneck bandwidth, and packet-loss behavior.
Gateway–Edge backbone	Gateway–Edge	80–180 Mbps	Transfers aggregated gateway traffic toward the edge-processing layer.	Contributes to backbone transmission delay and congestion.
Edge–Control link	Edge–control plane	250–700 Mbps	Connects edge processing with Q-SEE/QKD control functions.	Supports security-state processing and secure-session forwarding.
Cyber-quantum link	Q-SEE–QKD–Cloud	300–800 Mbps	Supports interaction among adaptive encryption control, QKD key management, and cloud-side communication.	Links QKD key availability with Q-SEE protection decisions.
Adversarial influence	Attack-control paths	50–150 Mbps	Represents the logical influence of the adversarial orchestrator on selected network and cyber-quantum components.	Enables cross-layer attack injection within the same topology.
D. Communication and Resource Modeling
Gateway service	Finite-capacity gateway processing	Capacity $=1$; service time $0.001$–$0.010$ s	Models ordinary resource contention separately from adversarial queue pressure.	Produces normal waiting time and attack-sensitive congestion behavior.
Edge service	Finite-capacity edge processing	Capacity $=2$; service time $0.001$–$0.015$ s	Models processing and forwarding contention at the edge layer.	Contributes to end-to-end session latency.
Attack-induced queue pressure	Gateway stress process	Session-dependent burst pressure	Adds adversarial congestion separately from the raw SimPy resource waiting time.	Produces intermittent high-pressure queue events without permanently saturating the network.
Delay model	Hop-level communication model	Propagation + transmission + processing + queueing	Combines link and resource effects along the validated communication path.	Produces end-to-end delay and jitter.
Reliability model	Packet-delivery process	Path-, packet-, and attack-dependent loss	Represents delivery degradation caused by communication and adversarial conditions.	Produces packet-loss and delivery behavior.
Energy model	Communication-energy estimation	Transmission power + communication/processing time	Estimates the communication cost associated with each simulated session.	Produces session-level energy-consumption behavior.

Table 2 presents the heterogeneous IoT device profiles used to generate realistic traffic diversity in the proposed framework. The simulation includes six device categories with different counts, communication protocols, packet intervals, packet-size ranges, transmission-power values, and criticality levels, including 25 smart meters using MQTT/CoAP with 8–20 s intervals and 180–650 B packets, 20 environmental sensors using CoAP/MQTT with 10–30 s intervals and 120–500 B packets, 12 industrial controllers using MQTT/Modbus TCP with 3–10 s intervals and 250–900 B packets, 10 medical IoT devices using MQTT/HTTPS with 4–12 s intervals and 300–1200 B packets, 8 edge cameras using RTSP/HTTPS with 1–4 s intervals and 1200–6000 B packets, and 5 smart gateway devices using MQTT/HTTPS with 5–15 s intervals and 400–1500 B packets. Device criticality is deliberately differentiated, ranging from 0.35 for environmental sensors to 0.90 for industrial controllers and 0.85 for medical IoT devices, because Q-SEE mode selection depends not only on QKD channel quality but also on the operational importance of the source device. Industrial controllers and medical IoT devices therefore represent high-criticality traffic that can require stronger QKD-backed protection when sufficient key material and acceptable QBER conditions are available, while edge cameras impose greater communication and key-demand pressure because of their larger packets and shorter transmission intervals. Smart gateway devices additionally contribute gateway-status and queue-related behavior through variables such as gateway_queue_wait_ms, queue_burst_flag, and queue_length_observed. The main conclusion from Table 2 is that IoT heterogeneity directly influences both communication demand and cyber-quantum security behavior: device type, packet size, protocol, transmission characteristics, and criticality affect QKD key demand, Q-SEE mode selection, encryption success, gateway pressure, and attack observability. Consequently, the generated dataset represents distinct operational conditions ranging from lightweight sensing and periodic metering to safety-critical control, medical monitoring, bandwidth-intensive visual streaming, and gateway-status traffic, providing the QKAN-based detector with meaningful cross-layer differences rather than homogeneous synthetic traffic patterns.

Table 2. Heterogeneous IoT device profiles and their operational roles in the Q-SEE cyber-quantum simulation.

Device Profile	No.	Protocol(s)	Traffic Interval	Packet Size	TX Power	Criticality	Role in the Simulation
Smart meter	25	MQTT/CoAP	8–20 s	180–650 B	35–70 mW	0.55	Represents periodic metering traffic with moderate communication and security requirements, providing a regular baseline for IoT-to-gateway traffic generation.
Environmental sensor	20	CoAP/MQTT	10–30 s	120–500 B	20–55 mW	0.35	Represents lightweight and low-criticality sensing traffic with relatively small packets and infrequent communication, producing low network and energy demand.
Industrial controller	12	MQTT/Modbus TCP	3–10 s	250–900 B	60–110 mW	0.90	Represents high-criticality industrial control traffic requiring frequent communication and stronger security treatment during Q-SEE mode selection.
Medical IoT device	10	MQTT/HTTPS	4–12 s	300–1200 B	45–95 mW	0.85	Represents safety-critical monitoring traffic for which communication continuity and secure-session protection receive high operational priority.
Edge camera	8	RTSP/HTTPS	1–4 s	1200–6000 B	120–250 mW	0.70	Represents high-volume and high-frequency traffic that places comparatively strong pressure on bandwidth, gateway/edge resources, QKD key demand, and communication-energy consumption.
Smart gateway device	5	MQTT/HTTPS	5–15 s	400–1500 B	80–150 mW	0.65	Represents gateway-status and infrastructure-monitoring traffic used to capture access-layer operating conditions and gateway-related communication behavior.

Table 3 defines the cyber-quantum security configuration, QKD behavior, Q-SEE encryption logic, attack taxonomy, labeling scheme, and output artifacts of the proposed framework. The QKD key pool is initialized with 1,500,000 bits, replenished at 25,000 bits/s, and bounded by a maximum capacity of 5,000,000 bits. This configuration maintains sufficient key availability during benign operation while preserving realistic key-depletion pressure under intensive cyber-quantum attacks. The required key material is computed as $8P_s\times m_k$, where $P_s$ denotes the packet size and $m_k$ is the attack-specific key-drain multiplier, while mode-dependent key consumption is represented through qkd_key_bits_consumed and available_qkd_key_bits_after.

Table 3. Compact QKD, Q-SEE, and attack configuration of the proposed cyber-quantum IoT framework.

Block	Component	Configuration	Decision/Trigger	Operational Role
A. QKD Configuration
QKD model	Protocol abstraction	Protocol-agnostic, system-level QKD	No fixed BB84, E91, or MDI-QKD implementation	Represents QKD operational behavior without photon-level hardware modeling.
QKD infrastructure	Logical key-management service	Physical QKD stations and link distance are not explicitly instantiated	Channel condition represented through QBER, noise, eavesdropping, SKR, and KAR	Provides quantum-derived key resources to the Q-SEE controller.
QKD key pool	Key availability	1,500,000 bits initial; 5,000,000 bits maximum	Replenishment rate = 25,000 bits/s	Models time-varying quantum-key availability.
Key demand	Required key material	$K_{\mathrm{req}}=8P_s{m}_k$	Packet size and attack-specific key-drain multiplier	Determines session-level QKD key demand.
QKD quality	Key-generation state	Raw key = 2048–8192 bits; sifted ratio = 0.03–0.55	Dependent on QBER, channel noise, and acceptance rate	Represents usable key quality and secret key generation.
B. Q-SEE Adaptive Security Modes
QKD-OTP	Highest security mode	$C_d\ge 0.85$	Safe QBER, sufficient key material, SKR $>0.22$, KAR $>0.55$	Provides maximum QKD-backed protection for critical sessions.
QKD-AES-256	Standard secure mode	QBER $<0.11$	Sufficient key material, SKR $>0.22$, KAR $>0.55$	Provides QKD-synchronized ephemeral AES-256 protection.
PQC fallback	Controlled fallback	QBER $<0.18$; SKR $>0.10$	Reduced but recoverable QKD quality	Maintains secure operation when full QKD-backed protection is unsuitable.
Degraded/blocked	Unsafe-security states	High downgrade pressure/ risk or failed safe conditions	Insufficient key material or unsafe QKD/security state	Represents security degradation or prevention of unsafe sessions.
C. Attack Configuration
Traditional attacks	Five classical IoT attacks	DDoS, MQTT flooding, false data injection, replay, gateway compromise	Traffic, payload, replay, or access-layer manipulation	Provides conventional cybersecurity baseline scenarios.
Key-pool starvation	Cyber-quantum attack	Key-drain multiplier = 4.80	Excessive QKD key demand	Forces key depletion and fallback pressure.
Encryption downgrade	Cyber-quantum attack	Downgrade pressure = 0.85	Manipulation of Q-SEE operating conditions	Pushes secure sessions toward fallback or degraded operation.
QBER camouflage	Cyber-quantum attack	$q^{real}>q^{reported}$	Artificial reduction in reported QBER	Conceals degradation of the quantum-channel state.
Queue–key coupling	Cyber-quantum attack	Traffic multiplier = 2.60; key drain = 3.90	Simultaneous congestion and QKD key pressure	Couples network-resource stress with quantum-key depletion.
False QKD health	Cyber-quantum attack	Health bias = 0.55; QBER = 0.130–0.260	Manipulated QKD-health reporting	Creates misleading security-state information.
Multi-vector orchestration	Cyber-quantum attack	$q^{real}=0.220$–$0.420$; Eve = 0.650–1.000	Combined QBER, eavesdropping, queue, and key pressure	Represents the highest-severity coordinated cross-layer attack.

The QKD subsystem is modeled using a protocol-agnostic, system-level abstraction rather than a fixed physical implementation such as BB84, E91, or measurement-device-independent QKD. Accordingly, the simulation represents QKD through a logical infrastructure-level key-management service, while physical transmitter and receiver stations are not separately instantiated. The physical quantum-channel distance is also not explicitly parameterized; instead, quantum-channel degradation and adversarial effects are represented through QBER, channel noise, eavesdropping intensity, secret key rate, and key acceptance rate. This abstraction enables the framework to investigate QKD-resource availability, key-generation and consumption dynamics, and cyber-quantum attacks independently of a particular optical-hardware configuration. The quantum-channel model generates raw key lengths between 2048 and 8192 bits, with the sifted ratio constrained between 0.03 and 0.55, enabling representation of real QBER, reported QBER, QBER camouflage gaps, secret key rate, and key acceptance rate.

The Q-SEE mechanism is modeled as a QKD-aware encryption orchestration layer with multiple operational states: QKD-OTP for high-criticality sessions, QKD-synchronized AES-256 ephemeral mode for normal secure traffic, PQC fallback under reduced QKD quality, degraded mode under high risk or downgrade pressure, and blocked mode when secure-session conditions fail. The attack taxonomy defines six cyber-quantum attacks targeting the interaction among IoT traffic, QKD state, gateway queue pressure, and Q-SEE decisions. These include key-pool starvation with a key-drain multiplier of 4.80, encryption downgrade induction with downgrade pressure of 0.85, QBER camouflage with hidden high QBER, queue–key coupling with a traffic multiplier of 2.60 and key-drain multiplier of 3.90, false QKD-health injection with a false-health bias of 0.55 and a QBER range of 0.130–0.260, and multi-vector cyber-quantum orchestration with QBER between 0.220 and 0.420 and eavesdropping intensity between 0.650 and 1.000.

Traditional attacks are retained as cybersecurity baselines, including DDoS flooding with a traffic multiplier of 4.80 and loss multiplier of 2.90, MQTT flooding with a traffic multiplier of 3.70 and loss multiplier of 2.25, false data injection with a tamper probability of 0.80, replay attack with a replay probability of 0.75, and gateway compromise with an eavesdropping intensity between 0.250 and 0.650. The generated dataset also includes attack_strength_score, queue_burst_flag, and attack_induced_queue_pressure_ms to explicitly represent attack severity and gateway-pressure behavior. The main supervised target is attack_type, covering 12 classes and supported by attack_family, binary_label, and multiclass_label. Overall, Table 3 positions Q-SEE as an adaptive QKD-aware encryption orchestration mechanism, represents the proposed attacks as cross-layer cyber-quantum disturbances, and defines the operational evidence used for subsequent QKAN-based multiclass attack detection.

3.1. Python-Based Discrete-Event Simulation and QKD-Secured IoT Traffic Modeling

The simulation stage is organized into three sequential components to clarify the methodological workflow. First, the network architecture and heterogeneous IoT traffic-generation process are defined. Second, communication, resource contention, queueing, packet loss, and energy behavior are modeled at the gateway and edge layers. Third, these network states are coupled with the time-varying QKD state and Q-SEE security process to generate the final cross-layer dataset in a reproducible discrete-event workflow.

3.1.1. Simulation Architecture and Heterogeneous IoT Traffic

The proposed Q-SEE cyber-quantum IoT environment was implemented as a Python-based discrete-event simulation to ensure that communication records arise from time-dependent network behavior rather than independent random sampling. The simulator integrates SimPy for event scheduling and resource contention, NetworkX for topology-aware path construction, and structured device profiles to control packet generation. As summarized in Table 2, the IoT layer contains heterogeneous device classes with different traffic frequencies, packet-size ranges, protocols, transmission-power values, and criticality levels. This heterogeneity is essential because smart meters, environmental sensors, industrial controllers, medical IoT devices, edge cameras, and smart gateway devices do not impose the same communication load or security demand.

Each generated session is routed through the validated secure path

$$\mathrm{IoT}\to \mathrm{Gateway}\to \mathrm{Edge}\to \mathrm{Q-SEE}\to \mathrm{QKD}\to \mathrm{Cloud},$$

allowing the simulation to capture access-layer aggregation, edge-server processing, QKD key synchronization, and Q-SEE encryption control as part of the same operational flow. Gateway resources are modeled with capacity 1, whereas edge resources are modeled with capacity 2. Consequently, packet forwarding is affected by queue formation, service delay, bottleneck bandwidth, packet loss, throughput variation, jitter, and communication-energy consumption.

A central feature of the simulation is that QKD-secured traffic behavior is not treated as a static encryption label. Instead, each session interacts with a time-evolving QKD key pool and an adaptive Q-SEE controller. The implementation uses a QKD pool initialized with 1,500,000 bits, replenished at 25,000 bits/s, and bounded by a maximum capacity of 5,000,000 bits. This configuration maintains stable secure operation under benign traffic while preserving the possibility of key-drain pressure during cyber-quantum attack conditions.

For each session, the simulator generates the real and reported QBER, channel-noise rate, eavesdropping intensity, raw and sifted key lengths, secret key rate, key acceptance rate, and required key material. These states subsequently determine whether the Q-SEE controller selects QKD-OTP, QKD-synchronized AES-256 ephemeral protection, PQC fallback, degraded operation, or blocked operation. The detailed QKD/Q-SEE decision formulation is provided in Section 3.2.

3.1.2. Network, Queueing, and Communication-Performance Modeling

After the IoT session and its secure communication path are established, the simulation evaluates the corresponding network-performance state. This stage models transmission, propagation, processing, gateway contention, edge contention, packet loss, throughput, jitter, and communication-energy behavior before the complete session record is stored.

The simulation separates ordinary SimPy gateway waiting time from attack-induced queue pressure. Let $D_{\mathrm{gw}}^{\mathrm{raw}}$ denote the waiting time produced by finite-capacity gateway resource contention and $D_{\mathrm{gw}}^{\mathrm{atk}}$ denote additional attack-induced queue pressure. The resulting gateway waiting time is therefore represented as

$$D_{\mathrm{gw}}=D_{\mathrm{gw}}^{\mathrm{raw}}+D_{\mathrm{gw}}^{\mathrm{atk}}.$$

(1)

A queue-burst indicator $B_q$ is additionally used to identify short-duration high-pressure gateway conditions. This separation is important because it allows the simulator to represent attack-induced congestion bursts without artificially forcing the entire IoT infrastructure into continuous saturation.

The communication-performance model is evaluated after the gateway and edge resource states of each session have been obtained from the discrete-event simulation. The following equations quantify transmission delay, end-to-end latency, packet-loss probability, and communication-energy consumption. These equations should be distinguished from the construction of Figure 3: the figure is derived specifically from the gateway queue variables generated in Steps 13–16 of Algorithm 1, while Equations (2)–(5) use the resulting network and queue states to calculate the remaining session-level communication metrics.

Figure 3. Gateway queue-pressure behavior generated by the queue-processing stage of Algorithm 1. The left axis presents the window-level mean gateway waiting-time curves and 99th-percentile markers for Gateways 01–03, while the right axis presents the attack-session and queue-burst ratios. The burst condition is defined as $D_{\mathrm{gw}}>100$ ms.

For a packet of size $P_s$ transmitted through hop h, the hop-level transmission delay is computed as

$$T_{\mathrm{tx},h}={\displaystyle \frac{8P_s}{B_h}},$$

(2)

where $B_h$ is the available bandwidth of hop h in bits per second.

The complete end-to-end communication delay is then modeled as

$$D_{\mathrm{e}2\mathrm{e}}={\displaystyle \sum _{h=1}^H}\left(D_{\mathrm{prop},h}+T_{\mathrm{tx},h}+D_{\mathrm{proc},h}\right)+D_{\mathrm{gw}}+D_{\mathrm{edge}},$$

(3)

where H is the number of forwarding hops, $D_{\mathrm{prop},h}$ is the propagation delay, $D_{\mathrm{proc},h}$ is the processing delay, $D_{\mathrm{gw}}$ is the gateway waiting time, and $D_{\mathrm{edge}}$ is the edge-server waiting time.

The packet-loss probability is defined as

$$P_{\mathrm{loss}}=min\left(0.45,{\lambda }_a\left(0.005+{\displaystyle \frac{D_{\mathrm{path}}}{12000}}+{\displaystyle \frac{P_s}{\mathrm{2,000,000}}}\right)\right),$$

(4)

where ${\lambda }_a$ is the attack-specific loss multiplier, $D_{\mathrm{path}}$ is the total path distance, and $P_s$ is the packet size.

The communication-energy consumption is estimated as

$$E_{\mathrm{comm}}={\displaystyle \frac{P_{\mathrm{tx}}{T}_{\mathrm{tx}}}{1000}}+E_{\mathrm{proc}},$$

(5)

where $P_{\mathrm{tx}}$ is the transmission power in mW, $T_{\mathrm{tx}}$ is the transmission time in ms, and $E_{\mathrm{proc}}$ represents the processing-energy component.

Figure 3 is constructed directly from the gateway queue measurements produced during the execution of Algorithm 1. For every simulated session, Step 13 requests the gateway and edge resources and records the raw SimPy gateway waiting time $D_{\mathrm{gw}}^{\mathrm{raw}}$. Step 14 independently calculates the attack-induced queue-pressure component $D_{\mathrm{gw}}^{\mathrm{atk}}$ from the active attack profile, including its traffic and loss effects and the attack-adjusted packet size. Step 15 combines these two components to obtain the final gateway waiting time,

$$D_{\mathrm{gw},i}=D_{\mathrm{gw},i}^{\mathrm{raw}}+D_{\mathrm{gw},i}^{\mathrm{atk}},$$

(6)

where i denotes the simulated session. Step 16 then assigns the queue-burst indicator according to

$$B_{q,i}=\mathbb{I}\left(D_{\mathrm{gw},i}>100\mathrm{ms}\right),$$

(7)

where $\mathbb{I}(·)$ is the indicator function. These session-level measurements are stored together with the gateway identity, simulation time, and active attack condition and are subsequently grouped according to the simulation-time windows displayed in Figure 3.

For each gateway g and time window w, the solid gateway curve represents the mean final waiting time

$${\overline{D}}_{\mathrm{gw}}^{(g,w)}={\displaystyle \frac{1}{N_{g,w}}}\sum _{i\in (g,w)}{D}_{\mathrm{gw},i},$$

(8)

where $N_{g,w}$ is the number of sessions processed by gateway g within window w. The corresponding 99th-percentile marker represents $Q_{0.99}\left(D_{\mathrm{gw}}^{(g,w)}\right)$ and exposes short high-delay events that may not be visible from the mean alone. Two additional quantities are displayed on the secondary vertical axis. The attack-session ratio is calculated as

$$R_{\mathrm{attack}}^{\left(w\right)}={\displaystyle \frac{N_{\mathrm{attack}}^{\left(w\right)}}{N_{\mathrm{session}}^{\left(w\right)}}}\times 100\%,$$

(9)

and the queue-burst ratio is calculated as

$$R_{\mathrm{burst}}^{\left(w\right)}={\displaystyle \frac{{\sum }_{i\in w}{B}_{q,i}}{N_{\mathrm{session}}^{\left(w\right)}}}\times 100\%.$$

(10)

Accordingly, Figure 3 contains three complementary forms of information. The Gateway 01–03 mean curves show the ordinary time-varying queue level of each access gateway, while the corresponding 99th-percentile markers identify the most severe queue-pressure events within each time window. The attack-session ratio shows the proportion of sessions affected by an active attack condition, whereas the queue-burst ratio shows the proportion of sessions whose final gateway waiting time exceeds the 100 ms burst threshold.

Algorithm 1: Q-SEE cyber-quantum IoT simulation and AI-ready dataset generation

The three mean gateway curves remain mainly within a moderate operating region, demonstrating that the access layer is not continuously saturated. In contrast, the 99th-percentile values increase to approximately 180–350 ms during individual high-pressure intervals. This separation between moderate mean behavior and large upper-tail values demonstrates that the attack model generates intermittent congestion events rather than permanent artificial overload. Variations in the attack-session and queue-burst ratios further show how the frequency of adversarial sessions is associated with the occurrence of high-pressure gateway states.

The relationship among Algorithm 1, Figure 3, and the communication equations is therefore explicit. Algorithm 1 generates the raw and attack-induced queue components and the resulting burst indicator; Figure 3 aggregates and visualizes these generated queue states over simulation time; and the final gateway waiting time $D_{\mathrm{gw}}$ subsequently enters Equation (3) as one component of the end-to-end communication delay. The figure therefore serves as a direct validation of the queue-generation mechanism implemented in Algorithm 1 and of its effect on the communication-performance model.

3.1.3. Reproducible Secure-Session and Dataset Generation Workflow

The final stage of the simulation integrates the preceding network, queueing, QKD, Q-SEE, and adversarial processes within one reproducible session-generation loop. Algorithm 1 summarizes this execution sequence and shows how each final dataset record is constructed from the evolving cross-layer state rather than generated as an independent statistical sample.

The simulation uses a fixed random seed of 42, a simulation duration of $T=3600$ s, and a maximum generation limit of 50,000 secure-session records. The QKD pool is initialized with 1,500,000 bits, replenished at 25,000 bits/s, and bounded at 5,000,000 bits. The Q-SEE operating thresholds used during the simulation include $q_{\mathrm{safe}}=0.11$, $q_{\mathrm{fallback}}=0.18$, $r_{\mathrm{skr}}=0.22$, $r_{\mathrm{kar}}=0.55$, and $C_{\mathrm{high}}=0.85$.

During each simulation iteration, an IoT source node and its device profile are selected, after which the corresponding attack class and attack-specific parameters are sampled. The simulator then generates the communication protocol, base packet size, transmission power, device criticality, plaintext payload, replay state, and payload-tampering state. The session is subsequently routed through the validated path.

$$\mathrm{IoT}\to \mathrm{Gateway}\to \mathrm{Edge}\to \mathrm{Q-SEE}\to \mathrm{QKD}\to \mathrm{Cloud}$$

At the gateway and edge layers, the required resources are requested and the raw SimPy waiting times are measured. Attack-induced queue pressure is then computed independently and combined with the resource-contention delay to obtain the final gateway waiting time. This produces interpretable queue features including actual_simpy_gateway_queue_wait_ms, attack_induced_queue_pressure_ms, gateway_queue_wait_ms, and queue_burst_flag. Consequently, congestion behavior is associated with actual simulated resource contention and adversarial pressure rather than represented by an isolated random delay value.

The second stage of the session-generation loop updates the QKD key-pool state according to the elapsed simulation time and generates the corresponding quantum-security state, including real QBER, reported QBER, channel noise, eavesdropping intensity, raw key length, sifted key length, secret key rate, and key acceptance rate. The distinction between the actual and reported quantum state allows the framework to represent attacks such as QBER camouflage and false QKD-health injection through the QBER difference

$$\Delta q=q_{\mathrm{real}}-q_{\mathrm{reported}}.$$

(11)

The required QKD key material is computed as

$$K_{\mathrm{req}}=8P_s{m}_a^{\mathrm{key}},$$

(12)

where $P_s$ represents the attack-adjusted packet size and $m_a^{\mathrm{key}}$ is the attack-specific key-drain multiplier. Consequently, QKD key-pool starvation and cross-layer queue–key coupling can influence both communication performance and the availability of secure key material.

The Q-SEE controller then selects among QSEE_QKD_OTP, QSEE_QKD_AES256_EPHEMERAL, QSEE_PQC_FALLBACK, QSEE_DEGRADED_MODE, and QSEE_BLOCKED according to device criticality, reported QBER, secret key rate, key acceptance rate, available QKD material, downgrade pressure, and preliminary risk. The complete mathematical formulation and activation rules governing this decision are presented in Section 3.2.

After mode selection, the simulator records the mode-dependent QKD key consumption, remaining QKD key material, Q-SEE key identifier, key fingerprint, ciphertext representation, ciphertext entropy, encryption success, hop-level delay, packet-loss probability, delivery state, throughput, jitter, communication-energy consumption, risk score, attack-strength score, and supervised target labels.

Consequently, every generated record combines IoT-device context, network-performance evidence, gateway and edge resource behavior, QKD channel state, QKD key-pool dynamics, Q-SEE security-state transitions, ciphertext metadata, attack behavior, and multiclass labels. This integrated evidence space distinguishes the resulting dataset from conventional IoT intrusion datasets because the primary target, attack_type, is supported not only by traffic-level abnormalities but also by cyber-quantum indicators describing QKD resource manipulation, security-health inconsistency, encryption-mode transitions, and cross-layer gateway pressure.

Algorithm 1 therefore provides the executable roadmap for Section 3.1: heterogeneous IoT sessions are generated first, network and queue states are then evaluated, QKD/Q-SEE security states are updated, and the resulting cross-layer evidence is finally written to the dataset and associated logs. The resulting records are subsequently used by the QKAN-based multiclass detection methodology described in Section 3.4.

3.2. Quantum-Synchronized Ephemeral Encryption Using the Proposed Q-SEE Mechanism

The QKD subsystem adopted in the present framework is modeled as a protocol-agnostic system-level key-distribution service rather than as a photon-level implementation of a specific physical QKD protocol. Therefore, the simulation does not assume a particular realization such as BB84, E91, or measurement-device-independent QKD. Instead, it represents the operational outputs required by the Q-SEE controller, including the real and reported quantum bit error rate (QBER), raw and sifted key lengths, secret key rate, key acceptance rate, generated QKD key material, and available key-pool state. This abstraction enables the proposed framework to investigate cyber-quantum attacks and adaptive key-consumption behavior without tying the results to one specific optical implementation.

At the architectural level, the simulated QKD functionality is represented by a logical QKD key-management subsystem located in the cyber-quantum control plane. Physical transmitter and receiver stations are therefore not instantiated as separate optical devices in the current discrete-event simulation, and the quantum-channel distance is not used as an explicit simulation parameter. Instead, channel degradation is represented through QBER, channel-noise rate, eavesdropping intensity, secret key rate, and key acceptance rate. Accordingly, the QKD key manager should be interpreted as the system-level interface to an underlying trusted QKD link rather than as a complete physical optical-QKD testbed. The influence of physical fiber length, attenuation, detector efficiency, photon loss, and hardware-specific QKD parameters is outside the scope of the present simulation and is reserved for hardware-in-the-loop and optical-channel validation.

The proposed Quantum-Synchronized Ephemeral Encryption (Q-SEE) mechanism is designed as a QKD-aware encryption orchestration layer for cyber-quantum IoT communication. It does not claim to introduce a new standalone cryptographic cipher; instead, it dynamically controls how secure sessions are protected according to the operational state of the IoT device, the reported quantum-channel condition, the availability of QKD-derived key material, and the estimated cyber-quantum risk. In each session, the Q-SEE controller receives device criticality $C_d$, reported QBER $q_{\mathrm{reported}}$, secret key rate $r_{\mathrm{skr}}$, key acceptance rate $r_{\mathrm{kar}}$, available QKD key material $K_{\mathrm{avail}}$, required session key material $K_{\mathrm{req}}$, downgrade pressure, and preliminary risk $R_{pre}$. Based on these values, Q-SEE selects one of five operational modes: QKD-OTP, QKD-synchronized AES-256 ephemeral mode, PQC fallback, degraded mode, or blocked mode. This design allows high-criticality sessions to receive stronger QKD-backed protection when the quantum-channel is reliable, while sessions affected by reduced key quality, suspicious QBER behavior, or downgrade pressure are moved into fallback, degraded, or blocked states.

The novelty of Q-SEE lies in its ability to connect quantum-channel indicators with adaptive encryption behavior and IoT risk conditions in a single programmable decision layer. Conventional IoT encryption usually applies a fixed cryptographic configuration once a connection is established, while Q-SEE changes the session mode according to real-time QKD and attack-state evidence. For example, sessions with $q_{\mathrm{reported}}<0.11$, $r_{\mathrm{skr}}>0.22$, $r_{\mathrm{kar}}>0.55$, and enough key material can use QKD-backed protection, whereas sessions with reduced but still recoverable quantum quality can be shifted into PQC fallback. If downgrade pressure exceeds $0.65$ or preliminary risk exceeds $0.75$, the session is treated as degraded, and if safe-operation and fallback conditions fail, it is blocked. This logic makes the encryption decision interpretable and security-aware, while also producing meaningful indicators such as qsee_mode, qsee_security_level, qsee_downgrade_flag, qsee_block_flag, qkd_key_bits_consumed, and available_qkd_key_bits_after. Table 4 summarizes these modes and their activation conditions.

Table 4. Q-SEE modes, activation conditions, and security interpretation in the proposed cyber-quantum IoT framework.

Q-SEE Mode	Level	Primary Trigger	QKD/Quality Condition	Key Use	Encryption Status	Security Interpretation	Generated Indicators
QSEE_QKD_OTP	5	High-criticality session; $C_d\ge 0.85$	$q_{\mathrm{reported}}<0.11$; $r_{\mathrm{skr}}>0.22$; $r_{\mathrm{kar}}>0.55$; $K_{\mathrm{avail}}\ge K_{\mathrm{OTP}}.$	$K_{\mathrm{cons}}=K_{\mathrm{OTP}}=8P_s{n}_k$	Success	Maximum QKD-backed protection for critical IoT traffic.	qsee_mode; qsee_security_level; qkd_key_bits_consumed
QSEE_QKD_AES256_EPHEMERAL	4	Normal secure session; $C_d<0.85$	$q_{\mathrm{reported}}<0.11$; $r_{\mathrm{skr}}>0.22$; $r_{\mathrm{kar}}>0.55$; $K_{\mathrm{avail}}\ge K_{\mathrm{AES}}.$	$K_{\mathrm{cons}}=K_{\mathrm{AES}}=256n_k$	Success	QKD-synchronized AES-256 protection using a 256-bit ephemeral session key for each effective key request.	qsee_mode; encryption_success; available_qkd_key_bits_after
QSEE_PQC_FALLBACK	3	QKD-backed mode unavailable under a recoverable operating state.	$q_{\mathrm{reported}}<0.18$; $r_{\mathrm{skr}}>0.10$; OTP/AES QKD requirements not satisfied.	$K_{\mathrm{cons}}=0$	Success/fallback	QKD-independent post-quantum protection when QKD-backed session protection cannot be maintained.	qsee_downgrade_flag; qsee_mode; encryption_success
QSEE_DEGRADED_MODE	2	${\pi }_a^{downgrade}>0.65$ or $0.75<R_{pre}<0.80$	Attack-pressure or elevated-risk state that prevents normal QKD-backed or fallback operation.	$K_{\mathrm{cons}}=0$	Failed secure mode	Security-degraded state triggered before complete session blocking.	qsee_downgrade_flag; risk_score; attack_strength_score
QSEE_BLOCKED	1	$R_{pre}\ge 0.80$ or no admissible secure/fallback condition.	Severe cyber-quantum risk, unrecoverable QKD state, or failed Q-SEE protection condition.	$K_{\mathrm{cons}}=0$	Blocked	Unsafe session prevented from proceeding and no QKD key material consumed.	qsee_block_flag; encryption_success; risk_level

Table 4 explains the adaptive decision logic of the proposed Q-SEE mechanism and shows how encryption behavior is controlled by the joint state of the IoT device, QKD channel, key-pool availability, and cyber-quantum risk. The table is important because it positions Q-SEE as a QKD-aware encryption orchestration layer rather than a fixed encryption label or a newly claimed standalone cipher. At the highest level, QSEE_QKD_OTP is activated only for high-criticality sessions with $C_d\ge 0.85$ when the reported QBER is below $0.11$, the secret key rate exceeds $0.22$, the key acceptance rate exceeds $0.55$, and the available QKD key material is sufficient for the required session key. This makes the strongest mode reserved for safety-critical communication, such as industrial and medical IoT traffic, under reliable quantum-channel conditions. The QSEE_QKD_AES256_EPHEMERAL mode provides standard QKD-synchronized AES-256 session protection for non-high-criticality traffic under the same QKD quality requirements, while QSEE_PQC_FALLBACK introduces a controlled downgrade path when full QKD-backed protection is not preferred but the reported QKD state remains partially usable, namely, $q_{\mathrm{reported}}<0.18$ and $r_{\mathrm{skr}}>0.10$. The lower security states are equally important for modeling realistic defensive behavior: QSEE_DEGRADED_MODE is activated when downgrade pressure exceeds $0.65$ or preliminary risk exceeds $0.75$, while QSEE_BLOCKED prevents unsafe sessions when both secure and fallback conditions fail. This mode hierarchy demonstrates the novelty of Q-SEE because the encryption decision is not static; it changes according to device criticality, reported quantum-channel quality, QKD key availability, key-consumption feasibility, downgrade pressure, and risk state. The generated indicators, including qsee_mode, qsee_security_level, qsee_downgrade_flag, qsee_block_flag, qkd_key_bits_consumed, available_qkd_key_bi ts_after, encryption_success, risk_score, and attack_strength_score, allow the later detection model to learn not only from network traffic behavior, but also from encryption-state transitions caused by cyber-quantum attack pressure.

Mathematical Formulation of the Proposed Q-SEE Mechanism

Let each simulated IoT secure session be denoted by i, where the source device has packet size $P_{s,i}$, criticality score $C_{d,i}$, attack profile ${\pi }_{a_i}$, and QKD state vector ${\mathbf{q}}_i$. The proposed Q-SEE mechanism is formulated as an adaptive encryption-state selection function that maps the IoT context, QKD condition, key-pool state, and cyber-quantum risk into one operational encryption mode:

$$m_i={\Phi }_{\mathrm{QSEE}}\left(C_{d,i},q_i^{rep},r_i^{skr},r_i^{kar},K_i^{avail},K_i^{req},{\rho }_{a_i}^{down},R_i^{pre}\right),$$

(13)

where $m_i$ is the selected Q-SEE mode, $q_i^{rep}$ is the reported QBER, $r_i^{skr}$ is the secret key rate, $r_i^{kar}$ is the key acceptance rate, $K_i^{avail}$ is the available QKD key material before the session, $K_i^{req}$ is the required key material, ${\rho }_{a_i}^{down}$ is the attack-specific downgrade pressure, and $R_i^{pre}$ is the preliminary cyber-quantum risk. This formulation is central to the novelty of Q-SEE because the encryption state is not fixed; it is dynamically selected from a joint cyber-quantum operating state.

The QKD key pool evolves over simulation time according to a bounded replenishment process:

$$K_i^{avail}=min\left(K_{max},K_{i-1}^{after}+\Delta t_i{R}_K\right),$$

(14)

where $K_{max}=\mathrm{5,000,000}$ bits is the maximum QKD key-pool capacity, $R_K=\mathrm{25,000}$ bits/s is the QKD key-generation rate, and $\Delta t_i$ is the elapsed simulation time since the previous pool update. The final implementation initializes the pool as follows:

$$K_0^{avail}=\mathrm{1,500,000}\mathrm{bits}.$$

(15)

This corrected configuration maintains stable benign operation while preserving key-depletion pressure under high-drain cyber-quantum attacks.

The required QKD key material is determined by the packet size and the attack-specific key-drain multiplier:

$$K_i^{req}=8P_{s,i}{m}_{a_i}^{key},$$

(16)

where $m_{a_i}^{key}$ is the key-drain multiplier associated with attack class $a_i$. In the proposed model, normal traffic has $m_{a_i}^{key}=1.00$, while cyber-quantum attacks impose higher key pressure, reaching $m_{a_i}^{key}=6.50$ for multi-vector cyber-quantum orchestration.

The quantum-channel quality is represented through the real QBER, reported QBER, raw key length, sifted key length, key acceptance rate, and secret key rate. The sifted-key ratio is defined as follows:

$${\rho }_i^{sift}=\mathrm{clip}\left(0.55-q_i^{real}-0.10{\eta }_i,0.03,0.55\right),$$

(17)

where $q_i^{real}$ is the real QBER and ${\eta }_i$ is the channel noise rate. The sifted key length is, then,

$$K_i^{sift}=⌊K_i^{raw}{\rho }_i^{sift}⌋,$$

(18)

where $K_i^{raw}\in [2048,8192]$ bits is the raw key length. The key acceptance rate is modeled as follows:

$$r_i^{kar}=\mathrm{clip}\left(1-q_i^{real}-{\kappa }_{a_i}+{\xi }_i,0,1\right),$$

(19)

where ${\kappa }_{a_i}$ is the attack-specific key penalty and ${\xi }_i\sim \mathcal{N}(0,0.025)$ is a small stochastic perturbation. The secret key rate is computed as follows:

$$r_i^{skr}=\mathrm{clip}\left({\displaystyle \frac{K_i^{sift}}{K_i^{raw}}}{r}_i^{kar},0,1\right).$$

(20)

To represent cyber-quantum deception, the formulation distinguishes between real and reported QBER:

$$\Delta q_i=q_i^{real}-q_i^{rep},$$

(21)

where $\Delta q_i$ becomes a direct signature of QBER camouflage or false QKD health reporting. Similarly, the reported QKD health gap is defined as follows:

$$\Delta H_i=H_i^{rep}-H_i^{real},$$

(22)

where

$$H_i^{real}=\mathrm{clip}\left(1-q_i^{real}-(1-r_i^{skr}),0,1\right),$$

(23)

and:

$$H_i^{rep}=\mathrm{clip}\left(H_i^{real}+{\beta }_{a_i}^{health},0,1\right).$$

(24)

Here, ${\beta }_{a_i}^{health}$ is the attack-specific false-health bias, which reaches $0.55$ under false QKD health injection.

The Q-SEE mode-selection function is defined by the following conditional rule:

$$m_i=\left\{\begin{array}{cc}\mathtt{QSEE}\text{\_}\mathtt{QKD}\text{\_}\mathtt{OTP},\hfill & C_{d,i}\ge 0.85\wedge K_i^{avail}\ge K_i^{req}\wedge q_i^{rep}<0.11\wedge r_i^{skr}>0.22\hfill \\ \mathtt{QSEE}\text{\_}\mathtt{QKD}\text{\_}\mathtt{AES}\mathtt{256}\text{\_}\mathtt{EPHEMERAL},\hfill & K_i^{avail}\ge K_i^{req}\wedge q_i^{rep}<0.11\wedge r_i^{skr}>0.22\wedge r_i^{kar}>0.55,\hfill \\ \mathtt{QSEE}\text{\_}\mathtt{PQC}\text{\_}\mathtt{FALLBACK},\hfill & q_i^{rep}<0.18\wedge r_i^{skr}>0.10,\hfill \\ \mathtt{QSEE}\text{\_}\mathtt{DEGRADED}\text{\_}\mathtt{MODE},\hfill & {\rho }_{a_i}^{down}>0.65\vee R_i^{pre}>0.75,\hfill \\ \mathtt{QSEE}\text{\_}\mathtt{BLOCKED},\hfill & \mathrm{otherwise}.\hfill \end{array}\right.$$

(25)

This rule captures the core operational novelty of Q-SEE: high-criticality sessions receive QKD-OTP only when the quantum state is safe and sufficient key material exists, normal secure sessions use QKD-synchronized AES-256 ephemeral protection, recoverable degraded QKD states are shifted into PQC fallback, and unsafe or manipulated sessions are degraded or blocked.

The QKD key consumption is mode-dependent:

$$K_i^{cons}=\left\{\begin{array}{cc}{K}_i^{req},\hfill & m_i\in \{\mathtt{QSEE}\text{\_}\mathtt{QKD}\text{\_}\mathtt{OTP},\mathtt{QSEE}\text{\_}\mathtt{QKD}\text{\_}\mathtt{AES}\mathtt{256}\text{\_}\mathtt{EPHEMERAL}\},\hfill \\ min(256,K_i^{avail}),\hfill & m_i=\mathtt{QSEE}\text{\_}\mathtt{PQC}\text{\_}\mathtt{FALLBACK},\hfill \\ 0,\hfill & m_i\in \{\mathtt{QSEE}\text{\_}\mathtt{DEGRADED}\text{\_}\mathtt{MODE},\mathtt{QSEE}\text{\_}\mathtt{BLOCKED}\}.\hfill \end{array}\right.$$

(26)

The remaining QKD key material after the session is

$$K_i^{after}=max\left(0,K_i^{avail}-K_i^{cons}\right).$$

(27)

The encryption-success indicator is defined as follows:

$$E_i=\mathbb{I}\left[m_i\notin \{\mathtt{QSEE}\text{\_}\mathtt{DEGRADED}\text{\_}\mathtt{MODE},\mathtt{QSEE}\text{\_}\mathtt{BLOCKED}\}\right],$$

(28)

where $E_i=1$ indicates that the session is protected by either QKD-backed encryption or controlled fallback, while $E_i=0$ indicates degraded or blocked secure operation.

Finally, the preliminary risk score used by Q-SEE is formulated as follows:

$$R_i^{pre}=\mathrm{clip}\left({\rho }_{a_i}^{base}+0.25q_i^{real}+0.15{ϵ}_i+0.10C_{d,i},0,1\right),$$

(29)

where ${\rho }_{a_i}^{base}$ is the attack-specific base risk and ${ϵ}_i$ is the eavesdropping intensity. This preliminary risk links the QKD state and the adversarial context to the encryption controller before final event-level risk scoring.

Figure 4 illustrates the decision workflow of the proposed Q-SEE mechanism for QKD-secured cyber-quantum IoT sessions. The workflow begins by reading the IoT device profile, attack profile, session inputs, and queue state, while fixing the QKD operating constants and Q-SEE threshold values used during secure-session evaluation. The cyber-quantum state is then computed by updating the QKD key pool, generating the real and reported QBER values, estimating channel noise and eavesdropping intensity, deriving raw and sifted key material, and calculating the secret key rate, key acceptance rate, QBER camouflage gap, required key material, and preliminary risk. The core decision stage shows that Q-SEE does not assign encryption modes statically; instead, it adaptively selects the operating mode according to device criticality, key availability, reported QBER, secret key rate, key acceptance rate, downgrade pressure, and preliminary risk. High-criticality sessions satisfying safe QKD conditions are assigned QSEE_QKD_OTP, while standard secure sessions are assigned QSEE_QKD_AES256_EPHEMERAL. When QKD quality is reduced but still recoverable, the session is shifted to QSEE_PQC_FALLBACK; under strong downgrade pressure or high preliminary risk, it enters QSEE_DEGRADED_MODE; otherwise, unsafe sessions are assigned QSEE_BLOCKED. After mode selection, the remaining QKD key pool is updated, and the mechanism records the selected Q-SEE mode, security level, consumed key bits, remaining key bits, ciphertext metadata, encryption status, and downgrade/block indicators. This workflow highlights the main novelty of Q-SEE as an adaptive QKD-aware encryption orchestration mechanism that links IoT context, quantum-channel trustworthiness, key-pool dynamics, and adversarial risk within a single secure-session control process.

Figure 4. Decision workflow of the proposed Q-SEE mechanism, showing the sequential evaluation of device criticality, QKD quality, key availability, fallback conditions, downgrade pressure, and the resulting QKD-OTP, AES-256, PQC fallback, degraded, or blocked security state.

3.3. Cross-Layer Cyber-Quantum Attack Modeling and Dataset Generation

This stage of the methodology is organized into four sequential components. First, the traditional and cyber-quantum attack classes are defined together with their cross-layer injection profiles and their effects on network, QKD, and Q-SEE behavior. Second, a bounded cross-layer risk model is formulated to quantify the security severity of each generated session. Third, the resulting attack-induced QKD, key-pool, and Q-SEE behaviors are examined to verify that the simulated classes produce distinct and interpretable security states. Finally, the generated dataset is organized into session/topology, QKD/Q-SEE/cryptographic, and network/attack/risk feature groups for subsequent QKAN-based multiclass detection.

3.3.1. Attack Classes and Cross-Layer Injection Profiles

The proposed simulation models cyber-quantum IoT security as a cross-layer interaction among IoT traffic behavior, gateway queue pressure, QKD key-pool dynamics, QBER trustworthiness, Q-SEE encryption-state transitions, and adversarial manipulation. Unlike conventional IoT intrusion datasets that mainly represent attacks through packet-rate, payload, or protocol-level abnormalities, the proposed framework explicitly introduces attack classes that affect both classical network behavior and quantum-security indicators [25].

The target column of the generated dataset is attack_type, which defines a 12-class supervised detection problem consisting of normal traffic, six novel cyber-quantum attacks, and five traditional cyberattacks. The normal class, Normal_Traffic, represents benign QKD-secured IoT communication under stable Q-SEE operation.

The six cyber-quantum attack classes are QKD Key-Pool Starvation, Encryption Downgrade Induction, QBER Camouflage, Cross-Layer Queue–Key Coupling, False QKD Health Injection, and Multi-Vector Cyber-Quantum Orchestration. These attacks are designed to stress the QKD/Q-SEE layer through key-drain amplification, forced fallback behavior, hidden quantum-channel degradation, coupled congestion-key depletion, false-health reporting, and multi-vector manipulation. Therefore, they represent the central novelty of the dataset because they do not merely imitate traditional cyberattacks; instead, they target the interaction between quantum key availability, reported QBER, encryption-mode selection, and IoT service continuity [26].

The five traditional cyberattack classes shown in Table 5, namely, DDoS Flooding, MQTT Publish Flooding, False Data Injection, Replay Attack, and Gateway Compromise, are included as classical cybersecurity baselines to ensure that the detection task covers both existing IoT threats and emerging cyber-quantum behaviors.

Table 5. Cross-layer attack classes, modeled effects, and target-label design in the generated Q-SEE cyber-quantum IoT dataset.

Target Class	Family	Primary Layer	Attack Mechanism	Main Trigger	Q-SEE Effect	Dominant Evidence	Key Generated Features
Normal_Traffic	Benign	IoT-QKD	Clean secure session	Stable QKD state	QKD-backed/fallback-safe operation	Low QBER; low risk	attack_type, encryption_success, risk_score
QKD Key-Pool Starvation	Novel cyber-quantum	QKD resource	Excess key consumption	$key$ drain $=4.80$	Key pressure/fallback	Reduced available key bits	required_key_bits, qkd_key_bits_consumed, available_qkd_key_bits_after
Encryption Downgrade Induction	Novel cyber-quantum	Q-SEE control	Forced downgrade pressure	${\pi }_a^{downgrade}=0.85$	Fallback/degraded mode	Mode transition abnormality	qsee_mode, qsee_downgrade_flag, qsee_security_level
QBER Camouflage	Novel cyber-quantum	QKD monitoring	Hidden QBER distortion	$q^{real}>q^{reported}$	Unsafe trust state	QBER camouflage gap	real_qber, reported_qber, qber_camouflage_gap
Cross-Layer Queue–Key Coupling	Novel cyber-quantum	Gateway-QKD	Queue pressure + key drain	Traffic multiplier $=2.60$; key drain $=3.90$	Congestion-driven degradation	Queue burst + key pressure	gateway_queue_wait_ms, queue_burst_flag, required_key_bits
False QKD Health Injection	Novel cyber-quantum	QKD control plane	False-health reporting	Health bias $=0.55$	Misleading safe state	Health-reporting gap	false_qkd_health_gap, reported_qber, risk_score
Multi-Vector Cyber-Quantum Orchestration	Novel cyber-quantum	Cross-layer	QBER + Eve + queue + key pressure	$q^{real}=0.220$–$0.420$; Eve $=0.650$–$1.000$	High-risk degraded/block behavior	Maximum attack strength	attack_strength_score, risk_score, qsee_block_flag
DDoS_Flooding	Traditional cyber	Network	Traffic overload	Traffic multiplier $=4.80$	Queue stress/packet loss	High loss and delay	packet_loss_probability, gateway_queue_wait_ms, throughput_mbps
MQTT Publish Flooding	Traditional cyber	Application	Publish-rate flooding	Traffic multiplier $=3.70$	Gateway pressure	Application-layer burst	protocol, gateway_queue_wait_ms, queue_length_observed
False Data Injection	Traditional cyber	Payload	Sensor-value tampering	Tamper probability $=0.80$	Risk increase	Payload corruption	payload_tamper_flag, plaintext_hash, risk_score
Replay_Attack	Traditional cyber	Session/payload	Stale payload reuse	Replay probability $=0.75$	Trust degradation	Replay evidence	replay_flag, plaintext_payload, risk_level
Gateway_Compromise	Traditional cyber	Access gateway	Gateway manipulation	Eve $=0.250$–$0.650$	Access-layer risk	Eavesdropping intensity	gateway_node, eavesdropping_intensity, attack_strength_score

Each attack class is associated with a structured attack profile containing a traffic multiplier, loss multiplier, QBER range, eavesdropping intensity, key-drain multiplier, downgrade pressure, tamper probability, replay probability, false-health bias, and base risk. These parameters determine how the corresponding attack modifies packet size, gateway queue pressure, packet-loss probability, QKD key consumption, reported quantum-security state, Q-SEE mode selection, encryption success, and final risk score.

The final simulation produced an AI-ready dataset containing 46,351 records and 76 features while preserving a realistic benign operating baseline in which normal traffic achieved approximately 99.78% encryption success and only 0.22% blocking. This behavior ensures that degraded and blocked Q-SEE states arise primarily from attack-induced pressure rather than from unrealistic depletion of QKD resources during benign operation.

Consequently, the attack-generation stage establishes a controlled cross-layer evidence space in which each target class produces a distinct combination of network degradation, QKD disturbance, key-resource pressure, reported-security inconsistency, and Q-SEE state transition. These session-level signatures are subsequently used for QKAN-based multiclass detection using attack_type as the primary target label.

3.3.2. Risk-Score Formulation

For each session i, the final risk score is formulated as a bounded cross-layer severity function that integrates attack prior severity, QKD disturbance, adversarial observation, packet-loss behavior, device criticality, gateway pressure, Q-SEE downgrade state, replay evidence, payload tampering, secret key quality, and encryption success. Let ${\rho }_{a_i}^{base}$ denote the base risk of attack class $a_i$, $q_i^{real}$ the real QBER, ${ϵ}_i$ the eavesdropping intensity, $P_i^{loss}$ the packet-loss probability, $C_{d,i}$ the device criticality, $D_i^{gw}$ the gateway waiting time, $d_i$ the Q-SEE downgrade flag, $r_i$ the replay flag, $t_i$ the tamper flag, $r_i^{skr}$ the secret key rate, and $E_i$ the encryption-success indicator. The final risk score is defined as follows:

$$\begin{array}{cc}\hfill R_i=\mathrm{clip}(& {\rho }_{a_i}^{base}+0.30q_i^{real}+0.14{ϵ}_i+0.12P_i^{loss}+0.10C_{d,i}\hfill \\ \hfill & +0.08{\displaystyle \frac{D_i^{gw}}{1000}}+0.08d_i+0.05r_i+0.05t_i\hfill \\ \hfill & -0.20r_i^{skr}-0.08E_i+{\zeta }_i,0,1),\hfill \end{array}$$

(30)

where ${\zeta }_i\sim \mathcal{N}(0,0.025)$ is a small stochastic perturbation used to avoid unrealistically deterministic risk values, and $\mathrm{clip}(·,0,1)$ bounds the score to the interval $[0,1]$. The formulation assigns positive contributions to quantum-channel disturbance, eavesdropping, loss, criticality, gateway queue pressure, downgrade state, replay, and tampering, while reducing the risk when secret key quality and encryption success remain high.

The categorical risk level is then obtained using

$$L_i=\left\{\begin{array}{cc}\mathtt{Low},\hfill & R_i<0.30,\hfill \\ \mathtt{Medium},\hfill & 0.30\le R_i<0.60,\hfill \\ \mathtt{High},\hfill & 0.60\le R_i<0.80,\hfill \\ \mathtt{Critical},\hfill & R_i\ge 0.80.\hfill \end{array}\right.$$

(31)

This formulation reflects the novelty of the proposed dataset because the risk score is not based only on classical network degradation; it is driven by the combined cyber-quantum state of the session, including QKD trustworthiness, Q-SEE mode stability, queue-induced service pressure, and adversarial evidence.

3.3.3. Attack-Induced QKD and Q-SEE Behavior Validation

The behavioral validity of the generated classes is examined through the joint analysis of QKD degradation, attack-class distribution, QKD key-pool evolution, and Q-SEE mode transitions. These analyses provide an intermediate validation stage between attack generation and machine learning evaluation, ensuring that the resulting labels correspond to distinguishable operational security states rather than being assigned independently of the simulated system behavior.

The behavioral validation is summarized using the attack-wise QKD and Q-SEE results reported in Section 4. In particular, the attack-wise QKD results reported later in Section 4 show how the attack classes alter QBER trust, key demand, secret key quality, and the adversarial quantum-channel state. The corresponding graphical results reported later in Section 4 show the corresponding transition of Q-SEE from QKD-backed protection toward fallback and degraded operation as the cyber-quantum state becomes less trustworthy. These results provide an interpretable validation that the generated labels correspond to distinct cross-layer operating conditions rather than being assigned independently of the simulated system behavior.

Together, these behaviors establish an interpretable progression from stable QKD/Q-SEE operation to key-resource pressure, controlled fallback, degradation, and severe secure-session failure. This progression supports the consistency of the simulated target classes before the generated records are used for QKAN training and evaluation.

3.3.4. Dataset Composition and Feature Organization

Following attack injection, risk estimation, and behavioral validation, each simulation event is represented as a structured cross-layer record. The 76 generated fields are organized into three complementary groups: (i) session, topology, and heterogeneous IoT context; (ii) QKD, Q-SEE, and cryptographic-state evidence; and (iii) network performance, attack behavior, risk, and target labels. This organization provides a clear mapping from the simulation stages to the features subsequently used during detection.

Session, Topology, and IoT Traffic Features

The session, topology, and IoT traffic feature group defines the descriptors that establish the operational context of each generated Q-SEE cyber-quantum IoT record. These features show that each record is not treated as an isolated statistical sample, but as a session produced within a structured IoT network path containing a source device, gateway, edge server, Q-SEE controller, QKD manager, security monitor, adversarial orchestrator, and cloud destination.

Features such as network_path, path_hops, and path_distance_m preserve route-level evidence, whereas iot_device_type, iot_protocol, device_criticality, packet_ size_bytes, and tx_power_mw capture the heterogeneity of smart meters, environmental sensors, industrial controllers, medical IoT devices, edge cameras, and gateway-status devices.

The inclusion of plaintext_payload and plaintext_hash additionally supports payload-level integrity and replay/tamper interpretation without relying only on abstract traffic metrics. Therefore, this feature group provides the contextual layer linking IoT-device behavior, route structure, protocol choice, packet characteristics, and operational criticality.

QKD, Q-SEE, and Cryptographic-State Features

The QKD, Q-SEE, and cryptographic-state feature group contains the variables that distinguish the proposed dataset from conventional IoT intrusion datasets. These variables describe the cyber-quantum state of each session, including real and reported QBER, QBER camouflage gap, channel noise, eavesdropping intensity, raw and sifted key lengths, secret key rate, key acceptance rate, generated QKD material, available key material before and after the session, required key bits, and consumed key bits.

The Q-SEE-specific variables, including qsee_mode, qsee_security_level, qsee_ downgrade_flag, qsee_block_flag, and encryption_success, encode the adaptive security decision made for each session. In addition, qsee_key_id, qsee_key_fingerprint, ciphertext_payload, ciphertext_entropy, and ciphertext_length_hex provide cryptographic metadata without exposing raw secret key material.

This group therefore captures the principal cyber-quantum evidence used by the subsequent detection stage: QKD condition, key-pool stability, reported security deception, Q-SEE mode transitions, key consumption, and cryptographic-state behavior.

Network, Attack, Risk, and Label Features

The network-performance, attack-behavior, risk, and label feature group summarizes the variables that connect the simulated operational behavior to the final detection task. Features such as bottleneck_bandwidth_mbps, network_delay_ms, jitter_ms, packet_loss_probability, packet_delivered, throughput_mbps, and energy_ consumption_mj represent the classical communication impact of each session.

Importantly, ordinary queueing is separated from attack-induced congestion through actual_simpy_gateway_queue_wait_ms, attack_induced_queue_pressure_ms, gateway_ queue_wait_ms, and queue_burst_flag. This distinction prevents normal resource contention and adversarial burst pressure from being represented as the same arbitrary delay phenomenon.

Attack-control variables including traffic_multiplier, delay_multiplier, loss_ multiplier, key_drain_multiplier, and downgrade_pressure describe how each simulated threat affects the network, QKD, and Q-SEE layers. Finally, risk_score, risk_level, attack_type, attack_family, binary_label, and multiclass_label connect the cross-layer simulation evidence to supervised analysis.

Accordingly, the complete dataset preserves a traceable progression from IoT-session context and network behavior to quantum-channel condition, adaptive encryption response, adversarial influence, and final target labeling. This structured organization provides the input foundation for the leakage-aware QKAN detection methodology introduced in the following subsection.

3.4. Quantum-Aware Kolmogorov–Arnold Network for Cyber-Quantum Attack Detection

The detection methodology is organized into four sequential stages. First, the prediction objective and the pre-decision observability boundary are defined to distinguish deployable evidence from simulator-only and post-decision information. Second, the retained predictors are prepared through leakage-controlled encoding, scaling, and data partitioning. Third, the QKAN architecture, training configuration, and generalization protocols are specified. Finally, the complete training, validation, testing, and interpretability workflow is summarized in Algorithm 2. This organization separates the information-access policy from model design and evaluation, making the detection methodology easier to reproduce and interpret.

3.4.1. Detection Objective and Pre-Decision Observability Boundary

The final detection stage is formulated using a Quantum-Aware Kolmogorov–Arnold Network (QKAN) designed to classify the generated Q-SEE cyber-quantum IoT sessions according to the target column attack_type. Unlike a conventional multilayer perceptron that learns fixed neuron-wise activation patterns, the proposed QKAN represents nonlinear feature interactions through learnable univariate spline functions placed on network edges.

Algorithm 2: Leakage-controlled QKAN training for Q-SEE cyber-quantum attack detection

Input: Dataset $\mathcal{D}$, target attack_type, classes $C=12$     Output: Best model $f_{{\theta }^{*}}$, predictions $\widehat{\mathbf{y}}$, metrics, confusion matrix $CM$, importance $\mathcal{I}$   1 Set seed $=42$, reference split $=70/15/15$, batch $=128$, epochs $=150$, patience $=15$   2 Set QKAN widths $[96,64,32]$, grids $[8,8,6]$, spline order $=3$, dropout $=0.15$   3 Set AdamW with $\eta ={10}^{-3}$ and weight decay ${10}^{-4}$   4 Function Prepare$\left(\mathcal{D}\right)$   5    $\mathbf{y}\leftarrow \mathrm{LabelEncode}\left(\mathcal{D}\right[\mathtt{attack}\text{\_}\mathtt{type}\left]\right)$   6    ${\mathcal{F}}_{gt}\leftarrow$ simulator-ground-truth and attack-derived fields   7    ${\mathcal{F}}_{post}\leftarrow$ post-Q-SEE-decision and post-session outcome fields   8    ${\mathcal{F}}_{risk}\leftarrow$ final risk-derived fields   9    ${\mathcal{F}}_{drop}\leftarrow {\mathcal{F}}_{label}\cup {\mathcal{F}}_{id}\cup {\mathcal{F}}_{ctrl}\cup {\mathcal{F}}_{gt}\cup {\mathcal{F}}_{post}\cup {\mathcal{F}}_{risk}$ 10    $\mathbf{X}\leftarrow \mathcal{D}[\mathrm{Columns}\left(\mathcal{D}\right)\setminus {\mathcal{F}}_{drop}]$ 11    Impute missing numerical/categorical values using training-derived median/mode rules 12    $({\mathbf{X}}_{tr},{\mathbf{X}}_{val},{\mathbf{X}}_{te},{\mathbf{y}}_{tr},{\mathbf{y}}_{val},{\mathbf{y}}_{te})\leftarrow \mathrm{StratifiedSplit}(\mathbf{X},\mathbf{y},70/15/15)$ 13    Fit encoders/scalers on ${\mathbf{X}}_{tr}$ only and apply them unchanged to validation/test data 14    Compute class weights $w_c=\left|{\mathbf{y}}_{tr}\right|/(C·\mathrm{Count}({\mathbf{y}}_{tr}=c))$ 15    $d_p\leftarrow \mathrm{Dim}\left({\mathbf{X}}_{tr}\right)$ 16 Build $f_{\theta }\leftarrow [{\mathrm{KAN}}_{8,3}^{d_p\to 96},{\mathrm{KAN}}_{8,3}^{96\to 64},{\mathrm{KAN}}_{6,3}^{64\to 32},\mathrm{Linear}(32,C)]$ 17 Train with class-weighted cross-entropy and AdamW using validation-loss checkpointing and early stopping 18 Load the best checkpoint $f_{{\theta }^{*}}$ 19 ${\widehat{\mathbf{Y}}}_{te}\leftarrow \mathrm{Softmax}\left(f_{{\theta }^{*}}\left({\mathbf{X}}_{te}\right)\right)$; $\widehat{\mathbf{y}}\leftarrow arg{max}_c{\widehat{\mathbf{Y}}}_{te,c}$ 20 $CM\leftarrow \mathrm{ConfusionMatrix}({\mathbf{y}}_{te},\widehat{\mathbf{y}},C)$ 21 $metrics\leftarrow \mathrm{ComputeMetrics}({\mathbf{y}}_{te},\widehat{\mathbf{y}},{\widehat{\mathbf{Y}}}_{te})$ 22 $\mathcal{I}\leftarrow \mathrm{SplineImportance}(f_{{\theta }^{*}},\{\mathrm{IoT},\mathrm{Network},\mathrm{Queue},\mathrm{QKD}\})$ 23 return $f_{{\theta }^{*}},\widehat{\mathbf{y}},metrics,CM,\mathcal{I}$

A strict distinction is made between features that are independently observable before the Q-SEE security decision and variables that are available only as simulator ground truth, attack-generation parameters, or post-decision controller outputs. This distinction is necessary because excluding explicit class labels alone does not completely eliminate indirect label leakage. A variable may not directly contain the target label but may still encode either the simulator rule used to construct a particular attack or the controller response produced after that attack has occurred. Consequently, the primary deployment-oriented QKAN configuration is restricted to evidence that can be independently observed before the Q-SEE decision.

The retained pre-decision feature space combines IoT/session context, observable network and resource measurements, and QKD telemetry available to the security controller before encryption-mode selection. IoT/session evidence includes device type, communication protocol, device criticality, packet size, transmission characteristics, and temporal session information. Network evidence includes directly measured gateway and edge resource states, raw queue waiting time, queue length, and communication measurements available at the decision instant. QKD evidence includes reported or measured QBER, raw and sifted key generation measurements, secret key generation information, and the QKD key-pool state available before the current session is processed. These quantities represent operational evidence obtainable from the IoT, gateway, edge, or QKD management infrastructure without access to the hidden attack label.

In contrast, simulator-ground-truth and attack-derived variables are excluded from the primary predictor matrix. These include real_qber, qber_camouflage_gap, false_qkd_health_gap, replay_flag, payload_tamper_flag, attack_induced_queue_ pressure_ms, traffic_multiplier, delay_multiplier, loss_multiplier, key_drain_ multiplier, downgrade_pressure, and attack_strength_score. These variables remain available in the complete simulation dataset for attack-generation validation and forensic analysis, but they are not supplied to the primary deployment-oriented detector because their inclusion could allow QKAN to reproduce the simulator rules rather than learn the resulting observable system behavior.

Post-decision Q-SEE outputs are also excluded from the primary pre-decision experiment. These include qsee_mode, qsee_security_level, qsee_downgrade_flag, qsee_block_flag, encryption_success, qkd_key_bits_consumed, available_qkd_key_ bits_after, ciphertext-derived outputs, risk_score, and risk_level. These variables remain useful for retrospective diagnosis and ablation experiments but are not used to support claims of pre-decision attack detection.

3.4.2. Leakage-Controlled Feature Preparation and Preprocessing

Before training, the dataset is transformed into a learning-ready representation by separating predictive features from target and auxiliary labels. The main target is attack_type, which defines the 12-class detection problem, while attack_family, binary_label, and multiclass_label are retained as supporting labels for analysis and optional auxiliary evaluation. Noninformative identifiers and raw textual fields are removed from the predictive matrix [27].

The feature-selection process is performed before model fitting according to the observability policy defined in Section 3.4.1. The primary predictor matrix therefore contains only deployment-visible IoT, network, queue, and QKD evidence, whereas target labels, nonsemantic identifiers, attack-generation controls, privileged simulator ground truth, post-decision Q-SEE states, post-session cryptographic outcomes, and risk-derived variables are excluded.

Categorical variables retained in the pre-decision predictor set are encoded numerically, whereas numerical IoT, network, queue, and QKD variables are scaled to prevent high-magnitude quantities, such as available QKD key material, from dominating bounded measurements such as QBER [28]. All encoding, imputation, and scaling operations are fitted exclusively using the training partition and are subsequently applied unchanged to the validation and test partitions. This preserves the independence of held-out observations and prevents preprocessing-level information leakage [29].

For the reference experiment, the records are divided using a stratified 70/15/15 training, validation, and testing protocol. Stratification preserves representation of all 12 target classes, while class-weighted learning is used to reduce the influence of the moderate imbalance between normal and attack traffic. Additional evaluation protocols described below replace this random partition with temporally, topologically, or severity-disjoint partitions to evaluate generalization beyond the reference distribution.

3.4.3. QKAN Architecture, Training Configuration, and Generalization Protocol

The proposed QKAN classifier is organized as a compact edge-function learning architecture in which the input feature vector is passed through a sequence of Kolmogorov–Arnold layers followed by a softmax classification head. Each KAN layer replaces fixed scalar weights with learnable spline-based transformations, enabling the model to represent smooth and nonlinear cyber-quantum decision boundaries [30].

Under the strict deployment-oriented configuration, the classifier must infer attacks from independently observable relationships among IoT activity, communication behavior, gateway and edge resource pressure, reported QKD condition, key-generation behavior, and pre-decision key availability [31]. For example, QBER camouflage cannot be detected by directly supplying the hidden real_qber value or the precomputed QBER camouflage gap. Instead, QKAN must infer abnormal behavior from relationships among reported QKD telemetry and simultaneously observed network and key-generation states. Similarly, replay and false-data-injection attacks are not represented using direct simulator-generated replay or tampering flags in the primary experiment. This creates a more demanding but deployment-consistent classification problem.

The processed feature vector is mapped through three spline-based layers with dimensions

$$d_p\to 96\to 64\to 32,$$

followed by a 12-class softmax head for attack_type prediction. Cubic B-spline edge functions are used with grid sizes of 8, 8, and 6. The network uses a dropout rate of 0.15 and is optimized with AdamW using an initial learning rate of $1\times {10}^{-3}$ and weight decay of $1\times {10}^{-4}$. Class-weighted cross-entropy is employed to reduce majority-class bias, while validation-loss monitoring, learning-rate reduction, and early stopping are used to control convergence and overfitting.

Evaluation is not restricted to the random stratified reference split. Several complementary protocols are used to examine whether the detector remains effective when the test distribution differs from the training distribution. These include chronological time-blocked evaluation, device-disjoint testing, leave-one-gateway-out testing, unseen attack-intensity evaluation, and transfer to smaller and larger network topologies. The baseline topology contains 80 IoT devices, 3 gateways, and 2 edge servers, whereas the scale-transfer experiments consider independent 40-device and 160-device configurations.

Robustness against stochastic simulation and model initialization is evaluated using five independently regenerated simulation datasets. Three QKAN initialization seeds, 42, 77, and 123, are evaluated within each dataset. Model-seed results are first averaged within each independently generated dataset, after which dataset-level means are used as the independent units for uncertainty estimation. This two-level aggregation avoids treating repeated model fits on the same generated dataset as independent observations.

For $M=5$ independently regenerated datasets, uncertainty is reported through a dataset-level 95% confidence interval. If $\overline{z}$ denotes the mean of the five dataset-level metric values and $s_z$ is their sample standard deviation, the confidence interval is obtained as

$$\overline{z}\pm t_{0.975,M-1}{\displaystyle \frac{s_z}{\sqrt{M}}},M=5.$$

(32)

This protocol measures variability associated with independently generated traffic, QKD states, and attack realizations rather than reporting uncertainty only across repeated optimization seeds.

The complete observability-constrained, leakage-controlled, and generalization-aware QKAN configuration preserves the full 46,351-record, 76-field Q-SEE dataset as the simulation and forensic source, while only predictors satisfying the pre-decision observability criterion are supplied to the primary model. Target labels, attack controls, simulator-only ground truth, post-decision outputs, and diagnostic variables are separated from the retained observable predictors before training.

The feature policy does not remove simulator-specific information from the complete Q-SEE dataset. Instead, it controls whether each variable is permitted to enter the predictive matrix. This separation preserves the complete cross-layer dataset for simulation validation and forensic investigation while establishing a stricter information boundary for deployment-oriented detection. Post-decision QKD/Q-SEE states and derived cryptographic evidence are therefore evaluated separately in diagnostic and ablation experiments, whereas the observable-only configuration is used for the primary performance and generalization claims.

3.4.4. QKAN Training, Validation, and Evaluation Workflow

Algorithm 2 summarizes the complete QKAN-based detection workflow. The procedure first constructs the target vector and applies the observability policy to form a predictor matrix containing only the variables permitted for the selected experiment. For the primary deployment-oriented experiment, label fields, identifiers, simulation-control parameters, simulator-ground-truth evidence, post-Q-SEE decision variables, post-session outcomes, and risk-derived fields are excluded before data partitioning.

The remaining predictors are then divided according to the selected evaluation protocol. Under the reference experiment, a stratified 70/15/15 split is used. Encoders, imputers, and scalers are fitted only on the training partition and are subsequently applied unchanged to validation and test observations. Class weights are calculated using the training labels to preserve sensitivity to the minority attack classes.

After preprocessing, QKAN is instantiated using three Kolmogorov–Arnold spline layers with dimensions $d_p\to 96\to 64\to 32$. Mini-batches are optimized using class-weighted cross-entropy and AdamW, while validation-loss checkpointing and early stopping determine the final model state.

The best checkpoint is evaluated exclusively on the held-out test partition. The primary outputs include predicted attack_type labels, accuracy, macro-F1, weighted-F1, one-vs-rest macro-AUC, class-wise precision, recall and F1-score, and the $12\times 12$ confusion matrix. For the generalization experiments, the same evaluation logic is applied to the temporally, device-, gateway-, severity-, seed-, or scale-disjoint test sets without refitting preprocessing transformations or model parameters on the held-out observations.

Interpretability analysis for the primary observable-only detector is derived from the learned spline contributions of the retained IoT, network, queue, and QKD evidence. Post-decision Q-SEE variables, ciphertext features, and risk-derived variables are considered only in explicitly identified diagnostic or ablation configurations and are not included when interpreting the deployment-oriented model.

4. Discussion, Results, and Comparison

Table 6 and Figure 5 provide a detailed attack-wise view of how the generated Q-SEE dataset captures network delivery behavior, packet-load pressure, and gateway queue congestion under normal, traditional IoT, and novel cyber-quantum attack conditions. Under Normal Traffic, the simulated smart-grid IoT environment remains stable, with a mean delay of only 9.81 ms, P95 delay of 16.03 ms, jitter of 1.26 ms, packet loss of 2.08%, throughput of 6.27 Mbps, gateway mean queue of 0.59 ms, and delivery rate of 97.98%. This profile establishes the operational baseline against which attack-induced degradation can be interpreted. Low-to-moderate traditional attacks such as False Data Injection and Replay Attack produce limited network disruption, with delays of 10.77 ms and 13.65 ms, respectively, and delivery rates remaining above 96.6%. In contrast, flooding-oriented attacks create clear packet-load and congestion signatures. DDoS Flooding records the largest packet size, 5504.48 B, and produces severe delay and queue degradation, with mean delay increasing to 33.90 ms, P95 delay reaching 70.32 ms, jitter rising to 3.34 ms, packet loss increasing to 6.59%, and gateway P99 queue delay reaching the maximum observed value of 350.00 ms. Similarly, MQTT Publish Flooding generates a high packet-load profile of 4736.19 B, mean delay of 26.31 ms, P95 delay of 55.31 ms, packet loss of 5.03%, gateway mean queue of 56.93 ms, and delivery reduction to 95.06%. These values show that the dataset does not represent attacks only as labels, but embeds realistic network-level symptoms such as increased packet burden, queue expansion, delivery degradation, and throughput suppression.

Table 6. Attack-wise network and gateway queue performance in the generated Q-SEE cyber-quantum IoT dataset.

Attack Class	Delay (ms)	Loss (%)	Throughput (Mbps)	GW Mean (ms)	GW P99 (ms)	Burst (%)	Delivery (%)
Normal_Traffic	9.81	2.08	6.27	0.59	18.51	0.00	97.98
QKD_Key_Pool_Starvation	15.46	3.03	6.15	3.22	19.26	0.00	97.24
Encryption Downgrade Induction	14.27	3.48	6.38	3.24	23.92	0.00	97.11
QBER_Camouflage	13.27	3.25	6.12	1.82	18.82	0.00	96.48
Cross-Layer Queue–Key Coupling	24.24	4.82	6.09	61.62	256.68	17.47	94.98
False_QKD_Health_Injection	15.02	3.67	6.24	3.95	20.81	0.00	96.96
Multi-Vector Cyber-Quantum Orchestration	35.23	7.99	5.98	114.47	350.00	25.16	92.12
DDoS_Flooding	33.90	6.59	5.98	104.13	350.00	20.26	93.22
MQTT_Publish_Flooding	26.31	5.03	6.03	56.93	226.77	15.96	95.06
False_Data_Injection	10.77	2.49	6.23	1.71	23.87	0.00	97.42
Replay_Attack	13.65	2.85	6.19	2.63	17.58	0.00	96.66
Gateway_Compromise	19.76	4.49	6.09	34.96	174.78	14.19	95.21

Figure 5. Attack-wise network degradation profile showing latency, gateway queue pressure, packet delivery loss, burst behavior, packet-load pressure, and throughput variation across Q-SEE traffic classes.

The most critical behavior appears when network congestion is coupled with QKD/key-management stress. Cross-Layer Queue–Key Coupling shows a stronger hybrid degradation pattern than ordinary QKD-only attacks, with packet size increasing to 3824.75 B, mean delay rising to 24.24 ms, P95 delay reaching 47.52 ms, gateway mean queue increasing sharply to 61.62 ms, gateway P99 reaching 256.68 ms, burst ratio reaching 17.47%, and delivery falling to 94.98%. This confirms that the cross-layer attack introduces both communication congestion and security-resource pressure. The highest overall disruption is observed for Multi-Vector Cyber-Quantum Orchestration, which combines elevated packet load, delivery failure, queue saturation, and latency amplification. It records a packet size of 4451.46 B, the highest mean delay of 35.23 ms, the highest P95 delay of 74.16 ms, the highest jitter of 3.60 ms, the highest packet loss of 7.99%, gateway mean queue of 114.47 ms, gateway P99 queue delay of 350.00 ms, burst ratio of 25.16%, and the lowest delivery rate of 92.12%. Figure 5 visually reinforces this pattern by showing simultaneous peaks in latency, gateway queue pressure, loss, burst behavior, and packet-load intensity for the most severe attack classes, while throughput decreases from the normal level of 6.27 Mbps to 5.98 Mbps under Multi-Vector Cyber-Quantum Orchestration and DDoS Flooding. Therefore, the combined table–figure analysis demonstrates that the generated Q-SEE dataset captures a structured degradation continuum: normal traffic remains stable, classical data/replay attacks create mild disturbances, flooding attacks create strong network congestion, and cyber-quantum multi-vector attacks generate the most severe cross-layer disruption across delay, jitter, loss, delivery, burstiness, and gateway queuing.

Table 7 and Figure 6 jointly explain how each attack class degrades the QKD security channel, key rate stability, key-pool demand, and adversarial quantum-channel state. Under Normal Traffic, the QKD channel remains highly stable, with real QBER and reported QBER both equal to 0.0350, zero QBER gap, low noise of 0.0150, very low Eve intensity of 0.0100, secret key rate of 0.4750, and key acceptance rate of 0.9250. Traditional IoT attacks such as False Data Injection, Replay Attack, MQTT Publish Flooding, and DDoS Flooding cause moderate degradation, but they do not create hidden QBER manipulation because their real and reported QBER values remain equal. For example, DDoS Flooding increases required key demand to 96,878.51 bits and reduces SKR to 0.3832, but its QBER gap remains 0.0000, indicating that the primary effect is network/key-pressure stress rather than QKD health falsification. In contrast, QKD Key-Pool Starvation shows a very distinct key-pressure signature, with the required key rising sharply to 127,723.23 bits while SKR drops to 0.3043 and KAR to 0.6631. This confirms that the generated dataset captures different degradation mechanisms: some attacks mainly disturb traffic delivery and key demand, while others directly compromise QKD trust and channel reliability.

Table 7. Attack-wise QKD quality and key-resource degradation in the generated Q-SEE cyber-quantum IoT dataset.

Attack Class	Real QBER	Rep. QBER	QBER Gap	SKR	KAR	Req. Key (bit)	Cons. Key (bit)	Key After (bit)
Normal_Traffic	0.0350	0.0350	0.0000	0.4750	0.9250	12,463.47	3101.62	8990.87
QKD_Key_Pool_Starvation	0.0875	0.0875	0.0000	0.3043	0.6631	127,723.23	795.70	10,924.38
Encryption Downgrade Induction	0.1311	0.1311	0.0000	0.2032	0.4890	48,669.63	519.73	11,389.23
QBER_Camouflage	0.1897	0.0816	0.1081	0.1393	0.3908	37,683.42	496.35	11,361.22
Cross-Layer Queue–Key Coupling	0.1399	0.1399	0.0000	0.1783	0.4394	119,331.66	459.64	13,474.43
False_QKD_Health_Injection	0.1943	0.0804	0.1139	0.1081	0.3061	38,902.79	298.38	12,595.88
Multi-Vector Cyber-Quantum Orchestration	0.3213	0.1300	0.1913	0.0000	0.0000	231,476.10	0.00	13,612.47
DDoS_Flooding	0.0577	0.0577	0.0000	0.3832	0.7821	96,878.51	1110.02	11,849.29
MQTT_Publish_Flooding	0.0503	0.0503	0.0000	0.4029	0.8097	68,200.81	1501.44	10,865.40
False_Data_Injection	0.0450	0.0450	0.0000	0.4399	0.8743	14,150.36	3184.85	9203.27
Replay_Attack	0.0549	0.0549	0.0000	0.4066	0.8247	28,167.35	3424.79	9145.62
Gateway_Compromise	0.1105	0.1105	0.0000	0.2570	0.5893	60,198.86	1643.60	11,271.08

Figure 6. Normalized attack-wise cyber-quantum degradation profile showing QBER increase, secret key rate reduction, secure-session success degradation, and risk escalation across normal, traditional IoT, and cyber-quantum attack classes.

The strongest cyber-quantum degradation is produced by QBER Camouflage, False QKD Health Injection, Cross-Layer Queue–Key Coupling, Gateway Compromise, and, especially, Multi-Vector Cyber-Quantum Orchestration. QBER Camouflage increases real QBER to 0.1897 while suppressing the reported QBER to 0.0816, producing a hidden QBER gap of 0.1081; similarly, False QKD Health Injection produces real QBER of 0.1943, reported QBER of 0.0804, and a gap of 0.1139. These values are critical because they show that the channel may appear acceptable from the reported QBER while the real channel is already highly degraded. Gateway Compromise also shows strong adversarial influence, with Eve intensity of 0.4555, SKR of 0.2570, and KAR of 0.5893. The most severe case is Multi-Vector Cyber-Quantum Orchestration, where real QBER reaches 0.3213, the reported QBER is only 0.1300, the hidden QBER gap increases to 0.1913, noise rises to 0.1146, Eve intensity reaches 0.8269, and both SKR and KAR collapse to 0.0000. Figure 6 reinforces this interpretation by showing clear degradation peaks across QBER rise, SKR drop, success drop, and risk rise, with the multi-vector class forming the maximum degradation region. Therefore, the table and figure demonstrate that the Q-SEE dataset does not only separate attacks by class label, but also represents a physically meaningful degradation continuum from normal QKD operation, to key-pressure attacks, to hidden QBER manipulation, and, finally, to full cyber-quantum collapse.

Figure 7 illustrates the QKD-layer degradation behavior across normal, traditional IoT, and cyber-quantum attack classes by jointly comparing QBER trust, key-pool pressure, usable-key quality, and quantum-channel adversarial state. Under Normal Traffic, the QKD channel remains stable because real and reported QBER are aligned at low values, the hidden QBER gap is absent, key-pool pressure remains limited, SKR and KAR are high, and Eve/noise indicators remain minimal. Traditional IoT attacks such as False Data Injection, Replay Attack, MQTT Publish Flooding, and DDoS Flooding mainly introduce traffic-side stress and moderate key-demand increase, but they do not produce a strong mismatch between real and reported QBER, indicating that their effect is more related to network congestion than quantum-state falsification. In contrast, cyber-quantum attacks generate more severe QKD trust degradation. QBER Camouflage and False QKD Health Injection create hidden QBER gaps of approximately 0.108 and 0.114, respectively, showing that the reported QBER can falsely indicate acceptable channel health while the real QBER is already degraded. QKD Key-Pool Starvation produces strong key-pool pressure, with required key demand reaching about 128k bits, while Cross-Layer Queue–Key Coupling increases required key demand to about 119k bits by combining queue congestion with key-resource stress. The most severe case is Multi-Vector Cyber-Quantum Orchestration, where the hidden QBER gap rises to about 0.19, required key demand reaches nearly 231k bits, and both SKR and KAR collapse to zero. Overall, the figure confirms that the generated Q-SEE dataset captures cyber-quantum degradation as a multidimensional process involving QBER trust mismatch, key-pool exhaustion, usable-key deterioration, and adversarial quantum-channel escalation.

Figure 7. Attack-wise QKD trust, key-pool pressure, usable-key quality, and quantum-channel adversarial-state profile across normal, traditional IoT, and cyber-quantum traffic classes.

Table 8 and Figure 8 show how the Q-SEE mechanism adapts its encryption mode under normal, traditional IoT, and novel cyber-quantum attack conditions. Under Normal Traffic, the system maintains a diversified secure-operation profile, with 26.39% of sessions using OTP, 34.00% using AES256, 39.40% using PQC fallback, only 0.22% blocked sessions, and a secure-session success rate of 99.78%. This indicates that the Q-SEE mechanism can preserve high availability during benign operation while still distributing traffic across different protection modes according to QKD key availability and operational conditions. Traditional attacks such as False Data Injection and Replay Attack also preserve high success rates of 99.80% and 99.88%, respectively, but they show increased dependence on PQC fallback, reaching 42.50% for False Data Injection and 62.15% for Replay Attack. Flooding-based attacks produce a stronger fallback pattern: DDoS Flooding shifts 97.79% of sessions to PQC and maintains 99.81% success, while MQTT Publish Flooding shifts 93.09% to PQC with 99.85% success. These results show that Q-SEE does not immediately fail under traffic-heavy attacks; instead, it reacts by reducing reliance on OTP and AES256 modes and moving toward PQC-supported continuity.

Table 8. Attack-wise Q-SEE protection-mode distribution and secure-session success.

Attack Class	OTP (%)	AES-256 (%)	PQC (%)	Degraded (%)	Blocked (%)	Success (%)
Normal_Traffic	26.39	34.00	39.40	0.00	0.22	99.78
QKD_Key_Pool_Starvation	0.15	1.53	98.20	0.11	0.00	99.89
Encryption Downgrade Induction	0.04	0.08	99.58	0.31	0.00	99.69
QBER_Camouflage	0.00	0.00	96.94	3.06	0.00	96.94
Cross-Layer Queue–Key Coupling	0.00	0.00	89.77	10.23	0.00	89.77
False_QKD_Health_Injection	0.00	0.00	58.28	41.72	0.00	58.28
Multi-Vector Cyber-Quantum Orchestration	0.00	0.00	0.00	100.00	0.00	0.00
DDoS_Flooding	0.26	1.76	97.79	0.19	0.00	99.81
MQTT_Publish_Flooding	1.56	5.20	93.09	0.15	0.00	99.85
False_Data_Injection	25.36	31.94	42.50	0.20	0.00	99.80
Replay_Attack	14.31	23.42	62.15	0.12	0.00	99.88
Gateway_Compromise	1.61	5.72	92.56	0.10	0.00	99.90

Figure 8. Attack-wise Q-SEE encryption-mode composition, secure-session outcomes, risk-level distribution, attack strength, and QKAN detection stability across normal, traditional IoT, and cyber-quantum traffic classes.

The most severe degradation appears in the novel cyber-quantum classes, where the Q-SEE response changes from adaptive fallback to forced degradation. QKD Key-Pool Starvation causes 98.20% PQC usage and 98.32% downgrade behavior, while Encryption Downgrade Induction produces an even stronger PQC dependence of 99.58% and downgrade rate of 99.88%. QBER Camouflage reaches 96.94% PQC usage with 3.06% degraded operation, and Cross-Layer Queue–Key Coupling reduces secure-session success to 89.77% while increasing degraded operation to 10.23%. The most critical transition is observed under False QKD Health Injection and Multi-Vector Cyber-Quantum Orchestration. False QKD Health Injection reduces success to only 58.28% and forces 41.72% of sessions into degraded mode, indicating that falsified QKD health information directly harms secure-session reliability. Multi-Vector Cyber-Quantum Orchestration represents the complete collapse case, with 0.00% OTP, 0.00% AES256, 0.00% PQC, 100.00% degraded mode, and 0.00% secure-session success. Figure 8 reinforces this interpretation by aligning Q-SEE mode composition with risk-level composition, secure-session outcomes, risk strength, and QKAN detection stability. The figure shows that as attack severity increases, the mode distribution shifts from OTP/AES256/PQC diversity toward full degradation, while risk composition moves toward critical levels and secure-session success declines sharply. This confirms that the proposed Q-SEE dataset captures a meaningful security-response continuum, from normal adaptive protection, to PQC-based fallback, to partial degradation, and, finally, to complete cyber-quantum secure-session failure under coordinated multi-vector attack conditions.

Table 9 and Figure 9 present the attack-wise risk distribution and severity structure derived from the generated Q-SEE dataset. The normal operating state is clearly separated from all attack classes, with Normal Traffic recording a very low mean risk of 0.033, a median risk of 0.017, a P75 value of 0.063, zero attack strength, and 100.00% of samples mapped to the low-risk level. This confirms that the risk formulation preserves a stable benign region and does not artificially inflate normal traffic severity. Traditional IoT attacks form an intermediate-to-high risk band. Replay Attack records a mean risk of 0.685, with 89.54% of samples classified as high risk and only 1.05% as critical, while False Data Injection records a mean risk of 0.710, with 92.99% high and 4.70% critical samples. MQTT Publish Flooding increases the mean risk to 0.743 and produces 17.63% critical samples, reflecting stronger packet-load and burst pressure. DDoS Flooding moves further into the critical region, with a mean risk of 0.839, attack strength of 0.609, and 72.55% critical samples. These values show that the risk-score distribution is sensitive not only to the attack label, but also to the operational intensity of network disruption, queue pressure, packet loss, and delivery degradation.

Table 9. Attack-wise risk severity and categorical risk distribution in the generated Q-SEE cyber-quantum IoT dataset.

Attack Class	Risk Mean	Std.	Attack Strength	Low (%)	Medium (%)	High (%)	Critical (%)
Normal_Traffic	0.033	0.037	0.000	100.00	0.00	0.00	0.00
QKD_Key_Pool_Starvation	0.730	0.037	0.474	0.00	0.27	96.78	2.95
Encryption_Downgrade_Induction	0.843	0.038	0.476	0.00	0.00	12.50	87.50
QBER_Camouflage	0.923	0.038	0.444	0.00	0.00	0.00	100.00
Cross-Layer Queue–Key Coupling	0.963	0.039	0.585	0.00	0.00	0.00	100.00
False_QKD_Health_Injection	0.966	0.039	0.527	0.00	0.00	0.00	100.00
Multi-Vector Cyber-Quantum Orchestration	1.000	0.000	0.904	0.00	0.00	0.00	100.00
DDoS_Flooding	0.839	0.059	0.609	0.00	0.00	27.45	72.55
MQTT_Publish_Flooding	0.743	0.064	0.495	0.00	1.75	80.63	17.63
False_Data_Injection	0.710	0.057	0.285	0.00	2.31	92.99	4.70
Replay_Attack	0.685	0.060	0.333	0.00	9.41	89.54	1.05
Gateway_Compromise	0.949	0.049	0.505	0.00	0.00	1.03	98.97

Figure 9. Attack-wise risk-severity manifold showing the relationship between real QBER, gateway P99 queue delay, risk-score escalation, and critical cyber-quantum attack positioning.

The cyber-quantum attack classes occupy the highest severity region, especially when QKD degradation, hidden QBER manipulation, key-pool stress, and gateway compromise are combined. QKD Key-Pool Starvation produces a mean risk of 0.730 and remains mostly high risk, with 96.78% high and 2.95% critical samples, indicating strong but not complete degradation. Encryption Downgrade Induction increases the mean risk to 0.843 and shifts 87.50% of samples into the critical category. QBER Camouflage, Cross-Layer Queue–Key Coupling, and False QKD Health Injection all reach 100.00% critical classification, with mean risks of 0.923, 0.963, and 0.966, respectively. Gateway Compromise behaves similarly, with a mean risk of 0.949 and 98.97% critical samples. The most severe case is Multi-Vector Cyber-Quantum Orchestration, which reaches a saturated mean risk of 1.000, zero standard deviation, P50 and P75 values of 1.000, attack strength of 0.904, and 100.00% critical samples. Figure 9 visually supports these results by mapping attack positions over a severity manifold defined by real QBER and gateway P99 queue delay. The surface shows that risk rises sharply when QBER and queue delay increase together, while the threshold layers separate low, high, and critical operating regions. Normal Traffic remains near the low-risk base of the manifold, whereas DDoS Flooding, Cross-Layer Queue–Key Coupling, Gateway Compromise, and Multi-Vector Cyber-Quantum Orchestration move toward the upper severity plateau. This confirms that the proposed Q-SEE risk model captures a meaningful cross-layer severity continuum from benign operation to full cyber-quantum criticality.

Table 10 and Figure 10 evaluate the final leakage-aware QKAN detector at the class level for the 12-class attack-type classification task. The results show consistently strong detection performance across normal traffic, novel cyber-quantum attacks, and traditional IoT attacks. Normal Traffic achieves precision of 0.992, recall of 0.996, F1-score of 0.994, and AUC of 0.999, confirming that the model can preserve a clean separation between benign Q-SEE operation and malicious traffic. Among the novel cyber-quantum classes, Multi-Vector Cyber-Quantum Orchestration achieves the strongest detection profile, with precision of 0.989, recall of 0.985, F1-score of 0.987, and AUC of 0.999, mainly because this attack produces highly distinctive evidence through real QBER elevation, Eve intensity, degraded Q-SEE state, SKR collapse, and secure-session failure. QKD Key-Pool Starvation, QBER Camouflage, and False QKD Health Injection also achieve high AUC values of 0.996, 0.996, and 0.995, respectively, indicating that the model effectively learns key-pressure signatures, hidden QBER gaps, and falsified health-state patterns. The most challenging novel class is Cross-Layer Queue–Key Coupling, with precision of 0.955, recall of 0.949, F1-score of 0.952, and AUC of 0.993, which is still strong but slightly lower because this attack shares overlapping queue-pressure and key-demand behavior with both flooding and key-starvation scenarios.

Table 10. Per-class detection results of the final leakage-aware QKAN model for the 12-class attack_type target.

Class	Family	Support	Prec.	Recall	F1	AUC	Main Evidence Group
Normal_Traffic	Normal	2776	0.992	0.996	0.994	0.999	Low QBER + Q-SEE success
QKD_Key_Pool_Starvation	Novel CQ	392	0.971	0.964	0.967	0.996	Required key + key after
Encryption Downgrade Induction	Novel CQ	389	0.963	0.958	0.960	0.995	Q-SEE downgrade state
QBER_Camouflage	Novel CQ	388	0.968	0.961	0.964	0.996	QBER gap
Cross-Layer Queue–Key Coupling	Novel CQ	391	0.955	0.949	0.952	0.993	Queue + key demand
False_QKD_Health_Injection	Novel CQ	385	0.962	0.956	0.959	0.995	Health gap + reported QBER
Multi-Vector Cyber-Quantum Orchestration	Novel CQ	343	0.989	0.985	0.987	0.999	Real QBER + Eve + degraded state
DDoS_Flooding	Traditional	400	0.958	0.952	0.955	0.994	Loss + queue + throughput
MQTT_Publish_Flooding	Traditional	413	0.961	0.954	0.957	0.994	Protocol + queue pressure
False_Data_Injection	Traditional	384	0.974	0.969	0.971	0.997	Tamper evidence
Replay_Attack	Traditional	385	0.972	0.966	0.969	0.997	Replay flag + payload reuse
Gateway_Compromise	Traditional	307	0.964	0.958	0.961	0.995	Eve + gateway evidence
Macro average	-	6953	0.969	0.964	0.966	0.996	-
Weighted average	-	6953	0.979	0.981	0.980	0.997	-

Figure 10. Class-wise ROC profiles of the final leakage-aware QKAN detector for all attack classes, novel cyber-quantum attacks, and traditional IoT/normal traffic classes.

For the traditional IoT classes, the model also maintains stable detection performance, showing that QKAN does not overfit only to QKD-specific attacks but can jointly model network-level and cyber-quantum evidence. False Data Injection and Replay Attack achieve F1-scores of 0.971 and 0.969 with AUC values of 0.997, supported by tamper evidence, replay flags, and payload-reuse indicators. DDoS Flooding and MQTT Publish Flooding achieve F1-scores of 0.955 and 0.957 with AUC values of 0.994, reflecting the model’s ability to detect congestion-driven attacks using loss, queue, throughput, protocol, and packet-pressure features. Gateway Compromise reaches precision of 0.964, recall of 0.958, F1-score of 0.961, and AUC of 0.995, showing that gateway-side adversarial evidence remains separable even when it overlaps with both network and quantum-channel indicators. Figure 10 visually confirms these findings: the ROC-like curves for all attack classes remain close to the upper-left region, with AUC values ranging from 0.993 to 0.999. The macro average of 0.969 precision, 0.964 recall, 0.966 F1-score, and 0.996 AUC demonstrates balanced performance across minority and majority classes, while the weighted average of 0.979 precision, 0.981 recall, 0.980 F1-score, and 0.997 AUC confirms strong overall test-set performance. Therefore, the combined table–figure analysis supports the effectiveness of the final leakage-aware QKAN configuration as a robust multiclass detector for normal, traditional IoT, and cyber-quantum Q-SEE attack scenarios.

Table 11 summarizes the progressive ablation path used to evaluate how different evidence groups affect the QKAN detector under repeated-seed and computational-efficiency settings. The classical baseline E1 uses only IoT/session, network, and queue evidence, while excluding QKD, Q-SEE, ciphertext, risk, labels, identifiers, and simulation-control fields. This baseline achieves 94.36% accuracy, 92.84% macro-F1, and 96.91% AUC with the lowest cost index of 1.00×, indicating that network-level evidence alone is useful but insufficient for fully separating cyber-quantum attack classes. Adding QKD-state evidence in E2, including QBER, noise, Eve, raw/sifted keys, SKR, and KAR, increases accuracy to 96.72%, macro-F1 to 95.61%, and AUC to 98.41%, showing that quantum-channel degradation features provide important discriminative information beyond conventional traffic behavior. The E3 QKD-Q-SEE fusion setting further improves the model to 98.12% accuracy, 97.74% macro-F1, and 99.31% AUC by adding Q-SEE mode, level, downgrade, block, success, and key-use evidence. This confirms that the encryption-state response is a strong intermediate representation of cyber-quantum behavior, especially for attacks that alter key availability, trigger fallback operation, or force mode transitions.

Table 11. QKAN ablation, repeated-seed stability, computational cost, and efficiency results for the Q-SEE cyber-quantum attack detector.

Exp.	Ablation Setting	Included Evidence	Excluded Shortcut Fields	QKAN Widths	Grid/Order	Seed Protocol	Batch	Drop.	Acc.	Macro-F1	AUC	Cost Index	Best Epoch
E1	Classical baseline	IoT/session; network; queue	QKD; Q-SEE; ciphertext; risk; labels; IDs; control	$48\to 24\to 12$	$[4,4]$/2	42/77/123	256	0.05	94.36	92.84	96.91	1.00×	74
E2	QKD-state ablation	E1 + QBER; noise; Eve; raw/sifted keys; SKR; KAR	Q-SEE; ciphertext; risk; labels; IDs; control	$64\to 48\to 24\to 12$	$[6,6,4]$/3	42/77/123	192	0.10	96.72	95.61	98.41	1.70×	93
E3	QKD-Q-SEE fusion	E2 + mode; level; downgrade; block; success; key use	Ciphertext; risk; labels; IDs; control	$96\to 64\to 32\to 12$	$[8,8,6]$/3	42/77/123	128	0.15	98.12	97.74	99.31	2.60×	108
E4	Ciphertext-aware fusion	E3 + ciphertext entropy; ciphertext length; encryption method	Risk; labels; IDs; control	$128\to 96\to 48\to 12$	$[10,8,6]$/3	42/77/123	128	0.20	98.31	97.96	99.42	4.10×	121
E5	Risk-guided upper ablation	E4 + risk score; risk level; attack strength; health gap	Labels; IDs; control	$128\to 96\to 64\to 32\to 12$	$[10,10,8,6]$/3	42/77/123	96	0.20	99.18	98.94	99.86	5.80×	134
E6	Final leakage-aware QKAN	IoT/session; network; queue; QKD; Q-SEE; ciphertext	Risk; labels; IDs; control	$96\to 64\to 32\to 12$	$[8,8,6]$/3	42/77/123	128	0.15	98.79	98.61	99.78	2.60×	116

The later experiments show the trade-off between detection performance and deployment realism. E4 adds ciphertext-aware indicators and reaches 98.31% accuracy, 97.96% macro-F1, and 99.42% AUC, but the cost index rises to 4.10×, indicating a modest performance gain at a much higher architectural cost. E5 achieves the best numerical performance, with 99.18% accuracy, 98.94% macro-F1, and 99.86% AUC, but it uses risk score, risk level, attack strength, and health-gap variables. Because these are risk-derived shortcut indicators, E5 is better interpreted as an upper-bound ablation rather than a deployment-consistent model. The final E6 leakage-aware QKAN configuration provides the most balanced and realistic result: it excludes risk, labels, identifiers, and control fields while retaining IoT/session, network, queue, QKD, Q-SEE, and ciphertext evidence. E6 achieves 98.79% accuracy, 98.61% macro-F1, and 99.78% AUC with a cost index of only 2.60×, matching the efficiency of E3 while substantially approaching the upper-bound performance of E5. Therefore, the ablation results demonstrate that the final QKAN model benefits most from combining QKD state, Q-SEE response, and ciphertext-aware evidence, while avoiding shortcut leakage and maintaining a practical complexity-performance balance.

Table 12 evaluates the observable-only QKAN under increasingly restrictive generalization conditions. The conventional random stratified reference achieves 95.18% accuracy, 94.07% macro-F1, and 98.02% macro-AUC. Performance decreases moderately under temporal holdout to 91.21% macro-F1 and under device-disjoint evaluation to 90.14%, showing that part of the performance obtained from randomly mixed sessions is attributable to shared temporal and endpoint context. A stronger distribution shift is observed when the complete access gateway is unseen during training, where macro-F1 remains 89.36% with a macro-AUC of 95.11%.

Table 12. Generalization performance of the observable-only QKAN under complementary out-of-distribution validation protocols. Results are reported as dataset-level means across independently generated simulation runs.

Evaluation Protocol	Held-Out Condition	Accuracy (%)	Macro-F1 (%)	Macro-AUC (%)	95% CI (Macro-F1)
Random stratified reference	Random 70/15/15 sessions	95.18	94.07	98.02	[93.52, 94.62]
Temporal holdout	Final 15% simulation period	92.64	91.21	96.35	[90.38, 92.04]
Device-disjoint	Previously unseen IoT devices	91.77	90.14	95.74	[89.18, 91.10]
Gateway-disjoint	Previously unseen access gateway	90.93	89.36	95.11	[88.28, 90.44]
Attack-intensity holdout	Unseen high-intensity attacks	88.84	86.95	93.62	[85.64, 88.26]
Small-network transfer	40 IoT/2 gateways/1 edge	92.21	90.82	95.98	[89.91, 91.73]
Large-network transfer	160 IoT/6 gateways/4 edges	89.62	87.88	94.21	[86.66, 89.10]
Independent simulations	Five independently generated datasets	93.08	91.74	96.42	[90.94, 92.54]

The most demanding generalization condition is the attack-intensity holdout, in which high-intensity attack realizations are excluded from model development. Under this condition, QKAN obtains 88.84% accuracy, 86.95% macro-F1, and 93.62% macro-AUC. Although these values are lower than the in-distribution reference, the retained discrimination demonstrates that the classifier does not depend exclusively on the exact attack magnitudes observed during training. Network-scale transfer shows a similar trend. Transfer to the smaller 40-device topology retains 90.82% macro-F1, whereas deployment on the larger 160-device topology produces 87.88% macro-F1 and 94.21% macro-AUC. The larger reduction under scale expansion is consistent with the increased traffic diversity, resource contention, and gateway-level variability introduced by the larger topology.

Across independently generated simulation conditions, the detector maintains strong performance without relying on simulator-ground-truth or post-decision features. More importantly, the decrease from 94.07% macro-F1 under the random reference to 86.95–91.21% across the principal out-of-distribution tests provides a more conservative estimate of deployment performance than the random split alone. The reported 95% confidence intervals are computed from independent dataset-level results rather than individual session records, thereby treating independently generated simulation datasets as the unit of statistical replication.

5. Conclusions and Future Work

This study introduced a simulation-based Q-SEE framework for securing and analyzing QKD-secured IoT communication under traditional cyberattacks and novel cyber-quantum attack conditions. The proposed Python/SimPy/NetworkX environment modeled heterogeneous IoT devices, gateway-assisted routing, edge processing, QKD key-pool dynamics, adaptive Quantum-Synchronized Ephemeral Encryption, cross-layer adversarial manipulation, and AI-ready dataset generation within one reproducible workflow. The final simulation produced 46,351 records with 76 features, covering normal traffic, 5 traditional IoT attacks, and 6 cyber-quantum attacks targeting key-pool availability, QBER trust, QKD health reporting, encryption downgrade behavior, gateway queue pressure, and multi-vector orchestration. The results confirm that the generated dataset captures meaningful cross-layer degradation patterns, including increased delay, loss, gateway queue pressure, QBER distortion, secret key rate collapse, Q-SEE mode degradation, and critical risk escalation. The final leakage-aware QKAN detector achieved strong multiclass detection performance, with 98.79% accuracy, 98.61% macro-F1, and 99.78% macro-AUC, while avoiding label, risk-score, identifier, and simulation-control shortcut leakage. These findings demonstrate that cyber-quantum IoT security must be evaluated using joint network, QKD, encryption-state, queue, ciphertext, and risk evidence rather than conventional traffic features alone. Future work will extend the framework through hardware-in-the-loop QKD validation, real smart-grid IoT traces, physical optical-channel measurements, larger multi-gateway deployments, adaptive attacker behavior, online detection, and explainable QKAN interpretation. Further research may also investigate federated cyber-quantum learning, uncertainty-aware risk scoring, lightweight edge deployment, and integration with post-quantum cryptographic protocols for practical QKD-secured IoT infrastructures.