{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,14]],"date-time":"2026-05-14T21:21:35Z","timestamp":1778793695640,"version":"3.51.4"},"reference-count":45,"publisher":"MDPI AG","issue":"3","license":[{"start":{"date-parts":[[2026,3,5]],"date-time":"2026-03-05T00:00:00Z","timestamp":1772668800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"funder":[{"DOI":"10.13039\/501100007782","name":"Tshwane University of Technology","doi-asserted-by":"crossref","id":[{"id":"10.13039\/501100007782","id-type":"DOI","asserted-by":"crossref"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Computers"],"abstract":"<jats:p>Fog computing extends cloud services to the network edge to support low-latency IoT applications. However, since fog environments are distributed and resource-constrained, intrusion detection systems must be adapted to defend against cyberattacks while keeping computation and communication overhead minimal. This systematic review presents research on intrusion detection systems (IDSs) for fog computing and synthesizes advances and research gaps. The study was guided by the \u201cPreferred-Reporting-Items for-Systematic-Reviews-and-Meta-Analyses\u201d (PRISMA) framework. Scopus and Web of Science were searched in the title field using TITLE\/TI = (\u201cintrusion detection\u201d AND \u201cfog computing\u201d) for 2021\u20132025. The inclusion criteria were (i) 2021\u20132025 publications, (ii) journal or conference papers, (iii) English language, and (iv) open access availability; duplicates were removed programmatically using a DOI-first key with a title, year, and author alternative. The search identified 8560 records, of which 4905 were unique and included for qualitative grouping and bibliometric synthesis. Metadata (year, venue, authors, affiliations, keywords, and citations) were extracted and analyzed in Python to compute trends and collaboration. Intrusion detection systems in fog networks were categorized into traditional\/signature-based, machine learning, deep learning, and hybrid\/ensemble. Hybrid and DL approaches reported accuracy ranging from 95 to 99% on benchmark datasets (such as NSL-KDD, UNSW-NB15, CIC-IDS2017, KDD99, BoT-IoT). Notable bottlenecks included computational load relative to real-time latency on resource-constrained nodes, elevated false-positive rates for anomaly detection under concept drift, limited generalization to unseen attacks, privacy risks from centralizing data, and limited real-world validation. Bibliometric analyses highlighted the field\u2019s concentration in fast-turnaround, open-access journals such as IEEE Access and Sensors, as well as a small number of highly collaborative author clusters, alongside dominant terms such as \u201clearning,\u201d \u201cfederated,\u201d \u201censemble,\u201d \u201clightweight,\u201d and \u201cexplainability.\u201d Emerging directions include federated and distributed training to preserve privacy, as well as online\/continual learning adaptation. Future work should consist of real-world evaluation of fog networks, ultra-lightweight yet adaptive hybrid IDS, self-learning, and secure cooperative frameworks. These insights help researchers select appropriate IDS models for fog networks.<\/jats:p>","DOI":"10.3390\/computers15030169","type":"journal-article","created":{"date-parts":[[2026,3,5]],"date-time":"2026-03-05T10:31:14Z","timestamp":1772706674000},"page":"169","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Intrusion Detection in Fog Computing: A Systematic Review of Security Advances and Challenges"],"prefix":"10.3390","volume":"15","author":[{"given":"Nyashadzashe","family":"Tamuka","sequence":"first","affiliation":[{"name":"Department of Information Technology, Tshwane University of Technology, Soshanguve, Pretoria 0152, South Africa"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-0439-7186","authenticated-orcid":false,"given":"Topside Ehleketani","family":"Mathonsi","sequence":"additional","affiliation":[{"name":"Department of Information Technology, Tshwane University of Technology, Soshanguve, Pretoria 0152, South Africa"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-3013-474X","authenticated-orcid":false,"given":"Thomas Otieno","family":"Olwal","sequence":"additional","affiliation":[{"name":"Department of Electrical Engineering, Tshwane University of Technology, Soshanguve, Pretoria 0152, South Africa"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Solly","family":"Maswikaneng","sequence":"additional","affiliation":[{"name":"Department of Information Technology, Tshwane University of Technology, Soshanguve, Pretoria 0152, South Africa"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Tonderai","family":"Muchenje","sequence":"additional","affiliation":[{"name":"Department of Information Technology, Tshwane University of Technology, Soshanguve, Pretoria 0152, South Africa"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-4354-5222","authenticated-orcid":false,"given":"Tshimangadzo Mavin","family":"Tshilongamulenzhe","sequence":"additional","affiliation":[{"name":"Department of Information Technology, Tshwane University of Technology, Soshanguve, Pretoria 0152, South Africa"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"1968","published-online":{"date-parts":[[2026,3,5]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Ngabo, D., Wang, D., Iwendi, C., Anajemba, J.H., Ajao, L.A., and Biamba, C. (2021). Blockchain-based security mechanism for the medical data at the fog computing architecture of the Internet of Things. Electronics, 10.","DOI":"10.3390\/electronics10172110"},{"key":"ref_2","first-page":"4703","article-title":"A lightweight intrusion detection system using convolutional neural network and long short-term memory in fog computing","volume":"80","author":"Alzahrani","year":"2024","journal-title":"Cmc-Comput. Mater. Contin."},{"key":"ref_3","doi-asserted-by":"crossref","unstructured":"Qaddoura, R., Al-Zoubi, A.M., Faris, H., and Almomani, I. (2021). A multi-layer classification approach for intrusion detection in IoT networks based on deep learning. Sensors, 21.","DOI":"10.3390\/s21092987"},{"key":"ref_4","doi-asserted-by":"crossref","first-page":"11792","DOI":"10.1109\/ACCESS.2025.3526711","article-title":"Deep learning-based intrusion detection system for detecting IoT botnet attacks: A review","volume":"13","author":"Anbar","year":"2025","journal-title":"IEEE Access"},{"key":"ref_5","doi-asserted-by":"crossref","first-page":"18","DOI":"10.1007\/s10586-024-04686-y","article-title":"Edge AI: A taxonomy, systematic review and future directions","volume":"28","author":"Gill","year":"2025","journal-title":"Clust. Comput."},{"key":"ref_6","doi-asserted-by":"crossref","first-page":"6073","DOI":"10.1109\/TVT.2021.3076780","article-title":"Blockchain and federated learning for collaborative intrusion detection in vehicular edge computing","volume":"70","author":"Liu","year":"2021","journal-title":"IEEE Trans. Veh. Technol."},{"key":"ref_7","doi-asserted-by":"crossref","first-page":"1","DOI":"10.69987\/JACS.2025.50101","article-title":"Deepcontainer: A deep learning-based framework for real-time anomaly detection in cloud-native container environments","volume":"5","author":"Xiong","year":"2025","journal-title":"J. Adv. Comput. Syst."},{"key":"ref_8","first-page":"2677","article-title":"Network Intrusion Detection Based on Feature Selection and Hybrid Metaheuristic Optimization","volume":"74","author":"Alkanhel","year":"2023","journal-title":"Comput. Mater. Contin."},{"key":"ref_9","doi-asserted-by":"crossref","unstructured":"Alnajim, A.M., Habib, S., Islam, M., Thwin, S.M., and Alotaibi, F. (2023). A comprehensive survey of cybersecurity threats, attacks, and effective countermeasures in the industrial internet of things. Technologies, 11.","DOI":"10.3390\/technologies11060161"},{"key":"ref_10","doi-asserted-by":"crossref","first-page":"43296","DOI":"10.1109\/JIOT.2025.3595649","article-title":"Taxonomy-Based Lightweight Cryptographic Frameworks for Secure Industrial IoT: A Survey","volume":"12","author":"Mohammed","year":"2025","journal-title":"IEEE Internet Things J."},{"key":"ref_11","doi-asserted-by":"crossref","first-page":"23","DOI":"10.1007\/s10922-021-09589-6","article-title":"As-ids: Anomaly and signature-based IDs for the Internet of Things","volume":"29","author":"Otoum","year":"2021","journal-title":"J. Netw. Syst. Manag."},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"57542","DOI":"10.1109\/ACCESS.2021.3071263","article-title":"A review of rule learning-based intrusion detection systems and their prospects in smart grids","volume":"9","author":"Liu","year":"2021","journal-title":"IEEE Access"},{"key":"ref_13","doi-asserted-by":"crossref","first-page":"1726","DOI":"10.1038\/s41598-025-85866-7","article-title":"Signature-based intrusion detection using machine learning and deep learning approaches empowered with fuzzy clustering","volume":"15","author":"Ahmed","year":"2025","journal-title":"Sci. Rep."},{"key":"ref_14","doi-asserted-by":"crossref","first-page":"10733","DOI":"10.1007\/s10462-023-10437-z","article-title":"Zero-day attack detection: A systematic literature review","volume":"56","author":"Ahmad","year":"2023","journal-title":"Artif. Intell. Rev."},{"key":"ref_15","doi-asserted-by":"crossref","first-page":"4280","DOI":"10.1109\/JIOT.2021.3103829","article-title":"On the performance of machine learning models for anomaly-based intelligent intrusion detection systems for the Internet of Things","volume":"9","author":"Abdelmoumin","year":"2021","journal-title":"IEEE Internet Things J."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Mohamed, N., Al-Jaroodi, J., Lazarova-Molnar, S., and Jawhar, I. (2021). Applications of integrated IoT-fog-cloud systems to smart cities: A survey. Electronics, 10.","DOI":"10.3390\/electronics10232918"},{"key":"ref_17","doi-asserted-by":"crossref","first-page":"151598","DOI":"10.1109\/ACCESS.2024.3463791","article-title":"Artificial intelligence techniques for securing fog computing environments: Trends, challenges, and future directions","volume":"12","author":"Alsadie","year":"2024","journal-title":"IEEE Access"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Alzahrani, A.I., Al-Rasheed, A., Ksibi, A., Ayadi, M., Asiri, M.M., and Zakariah, M. (2022). Anomaly detection in fog computing architectures using custom tab transformer for internet of things. Electronics, 11.","DOI":"10.3390\/electronics11234017"},{"key":"ref_19","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3571729","article-title":"Resource management in cloud and cloud-influenced technologies for Internet of Things applications","volume":"55","author":"Jeyaraj","year":"2023","journal-title":"ACM Comput. Surv."},{"key":"ref_20","doi-asserted-by":"crossref","first-page":"116529","DOI":"10.1109\/ACCESS.2025.3583855","article-title":"DDoS Attack Detection in IoT: A Comparative Resource and Performance Analysis of Deep Learning and Machine Learning Models","volume":"13","author":"Abulhassan","year":"2025","journal-title":"IEEE Access"},{"key":"ref_21","doi-asserted-by":"crossref","first-page":"2531","DOI":"10.1007\/s11831-021-09694-4","article-title":"Particle swarm optimization algorithm and its applications: A systematic review","volume":"29","author":"Gad","year":"2022","journal-title":"Arch. Comput. Methods Eng."},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"1","DOI":"10.1145\/3687124","article-title":"Survey on federated learning for intrusion detection systems: Concept, architectures, aggregation strategies, challenges, and future directions","volume":"57","author":"Khraisat","year":"2024","journal-title":"ACM Comput. Surv."},{"key":"ref_23","doi-asserted-by":"crossref","first-page":"15435","DOI":"10.1007\/s11227-023-05252-w","article-title":"Reliable federated learning in a cloud-fog-IoT environment","volume":"79","author":"Sharma","year":"2023","journal-title":"J. Supercomput."},{"key":"ref_24","doi-asserted-by":"crossref","first-page":"71","DOI":"10.1136\/bmj.n71","article-title":"The PRISMA 2020 statement: An updated guideline for reporting systematic reviews","volume":"372","author":"Page","year":"2021","journal-title":"BMJ"},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"57","DOI":"10.5152\/tao.2019.4058","article-title":"A guide for systematic reviews: PRISMA","volume":"57","year":"2019","journal-title":"Turk. Arch. Otorhinolaryngol."},{"key":"ref_26","doi-asserted-by":"crossref","unstructured":"Alghayadh, F.Y. (2021). A Hybrid Intrusion Detection System for Smart Home Security Based on Machine Learning and User Behavior. [Doctoral Dissertation, Oakland University].","DOI":"10.4236\/ait.2021.111002"},{"key":"ref_27","doi-asserted-by":"crossref","unstructured":"Rani, D., and Kaushal, N. (2020). Supervised Machine Learning Based Network Intrusion Detection System for Internet of Things. 11th International Conference on Computing, Communication and Networking Technologies (ICCCNT), IEEE.","DOI":"10.1109\/ICCCNT49239.2020.9225340"},{"key":"ref_28","doi-asserted-by":"crossref","first-page":"167059","DOI":"10.1109\/ACCESS.2020.3022855","article-title":"Intrusion detection based on an autoencoder and an isolation forest in fog computing","volume":"8","author":"Sadaf","year":"2020","journal-title":"IEEE Access"},{"key":"ref_29","doi-asserted-by":"crossref","first-page":"110","DOI":"10.1016\/j.comcom.2020.12.003","article-title":"An ensemble learning and fog-cloud architecture-driven cyber-attack detection framework for IoMT networks","volume":"166","author":"Kumar","year":"2021","journal-title":"Comput. Commun."},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Alzubi, O.A., Alzubi, J.A., Alazab, M., Alrabea, A., Awajan, A., and Qiqieh, I. (2022). Optimized machine learning-based intrusion detection system for fog and edge computing environments. Electronics, 11.","DOI":"10.3390\/electronics11193007"},{"key":"ref_31","doi-asserted-by":"crossref","first-page":"43","DOI":"10.1186\/s13677-024-00609-9","article-title":"A fog-edge-enabled intrusion detection system for smart grids","volume":"13","author":"Tariq","year":"2024","journal-title":"J. Cloud Comput."},{"key":"ref_32","doi-asserted-by":"crossref","first-page":"255","DOI":"10.1016\/j.future.2020.07.020","article-title":"Anomaly detection framework for Internet of things traffic using vector convolutional deep learning approach in fog environment","volume":"113","author":"NG","year":"2020","journal-title":"Future Gener. Comput. Syst."},{"key":"ref_33","doi-asserted-by":"crossref","first-page":"115524","DOI":"10.1016\/j.eswa.2021.115524","article-title":"A bidirectional LSTM deep learning approach for intrusion detection","volume":"185","author":"Imrana","year":"2021","journal-title":"Expert Syst. Appl."},{"key":"ref_34","first-page":"7704","article-title":"Deep-IFS: Intrusion Detection Approach for IIoT Traffic in Fog Environment","volume":"17","author":"Chang","year":"2020","journal-title":"IEEE Trans. Ind. Inform."},{"key":"ref_35","doi-asserted-by":"crossref","first-page":"1164","DOI":"10.1109\/OJCOMS.2022.3188750","article-title":"\u201cWhy should I trust your IDS?\u201d: An Explainable Deep Learning Framework for Intrusion Detection Systems in Internet of Things Networks","volume":"3","author":"Brik","year":"2022","journal-title":"IEEE Open J. Commun. Soc."},{"key":"ref_36","doi-asserted-by":"crossref","unstructured":"Attique, D., Wang, H., and Wang, P. (2022). Fog-assisted deep-learning-empowered intrusion detection system for RPL-based resource-constrained smart industries. Sensors, 22.","DOI":"10.3390\/s22239416"},{"key":"ref_37","doi-asserted-by":"crossref","first-page":"107417","DOI":"10.1016\/j.comnet.2020.107417","article-title":"Hybrid approach to intrusion detection in fog-based IoT environments","volume":"180","author":"Westphall","year":"2020","journal-title":"Comput. Netw."},{"key":"ref_38","doi-asserted-by":"crossref","first-page":"41","DOI":"10.1186\/s13677-023-00420-y","article-title":"Enhancement of an IoT hybrid intrusion detection system based on fog-to-cloud computing","volume":"12","author":"Mohamed","year":"2023","journal-title":"J. Cloud Comput."},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Tawfik, M. (2024). Optimized intrusion detection in IoT and fog computing using ensemble learning and advanced feature selection. PLoS ONE, 19.","DOI":"10.1371\/journal.pone.0304082"},{"key":"ref_40","doi-asserted-by":"crossref","unstructured":"Sahar, N., Mishra, R., and Kalam, S. (2021). Deep learning approach-based network intrusion detection system for fog-assisted IoT. International Conference on Big Data, Machine Learning, and Their Applications, Springer.","DOI":"10.1007\/978-981-15-8377-3_4"},{"key":"ref_41","doi-asserted-by":"crossref","first-page":"e60551","DOI":"10.4025\/actascitechnol.v45i1.60551","article-title":"Combined ensemble intrusion detection model using deep learning with feature selection for fog computing environments","volume":"45","author":"Kaliyaperumal","year":"2023","journal-title":"Acta Scientiarum. Technol."},{"key":"ref_42","doi-asserted-by":"crossref","first-page":"7107663","DOI":"10.1155\/2023\/7107663","article-title":"Lightweight Intrusion Detection Model of the Internet of Things with Hybrid Cloud-Fog Computing","volume":"2023","author":"Zhao","year":"2023","journal-title":"Secur. Commun. Netw."},{"key":"ref_43","doi-asserted-by":"crossref","first-page":"108505","DOI":"10.1016\/j.knosys.2022.108505","article-title":"Intrusion detection using multi-objective evolutionary convolutional neural network for Internet of Things in Fog computing","volume":"244","author":"Chen","year":"2022","journal-title":"Knowl.-Based Syst."},{"key":"ref_44","doi-asserted-by":"crossref","first-page":"26088","DOI":"10.1007\/s11227-024-06417-x","article-title":"A novel reinforcement learning-based hybrid intrusion detection system on fog-to-cloud computing","volume":"80","author":"Najafli","year":"2024","journal-title":"J. Supercomput."},{"key":"ref_45","doi-asserted-by":"crossref","unstructured":"Al Rawajbeh, M., Maria Soosai, A.J., Ramasamy, L.K., and Khan, F. (2025). Trustworthy Adaptive AI for Real-Time Intrusion Detection in Industrial IoT Security. IoT, 6.","DOI":"10.3390\/iot6030053"}],"container-title":["Computers"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-431X\/15\/3\/169\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,7]],"date-time":"2026-03-07T05:18:42Z","timestamp":1772860722000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-431X\/15\/3\/169"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,3,5]]},"references-count":45,"journal-issue":{"issue":"3","published-online":{"date-parts":[[2026,3]]}},"alternative-id":["computers15030169"],"URL":"https:\/\/doi.org\/10.3390\/computers15030169","relation":{},"ISSN":["2073-431X"],"issn-type":[{"value":"2073-431X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,3,5]]}}}