In the rapidly evolving digital world, network security is a critical concern. Traditional security measures often fail to detect unknown attacks, making anomaly-based Network Intrusion Detection Systems (NIDS) using Machine Learning (ML) vital. However, these systems face challenges such as computational complexity and misclassification errors. This paper presents ZW-IDS, an innovative approach to enhance anomaly-based NIDS performance. We propose a two-layer classification NIDS integrating zero-watermarking with data provenance and ML. The first layer uses Support Vector Machines (SVM) with ensemble learning model for feature selection. The second layer generates unique zero-watermarks for each data packet using data provenance information. This approach aims to reduce false alarms, improve computational efficiency, and boost NIDS classification performance. We evaluate ZW-IDS using the CICIDS2017 dataset and compare its performance with other multi-method ML and Deep Learning (DL) solutions.

The insecure growth of Internet-of-Things (IoT) can threaten its promising benefits to our daily life activities. Weak designs, low computational capabilities, and faulty protocol implementations are just a few examples that explain why IoT devices are nowadays highly prone to cyber-attacks. In this survey paper, we review approaches addressing this problem. We focus on machine learning-based solutions as a representative trend in the related literature. We survey and classify Machine Learning (ML)-based techniques that are suitable for the construction of Intrusion Detection Systems (IDS) for IoT. We contribute with a detailed classification of each approach based on our own taxonomy. Open issues and research challenges are also discussed and provided.