# A Survey on Intrusion Detection Systems for Fog and Cloud Computing
## 6 Intrusion Detection Overview  
### Providing Strong Intrusion Detection in Fog Computing  
Fog computing (also known as fog networking and fogging) is a specific type of architecture that makes use of edge devices (a device providing an entry point into enterprise or service provider core networks) to hold a significant volume of computer storage and digital communication locally, as well as being routed over the internet.  
In the recent work of [42], a game model was developed to provide intrusion detection technology into the cloud-fog-based IoT networks, using game theory. Game theory is used as a way of modeling to design a situation based on the predefined rules of the game to understand what will happen in a specific situation. The main elements of the game theory include players, actions, profits, and information, which are considered as the rules of the game. The model has been designed to detect attacks attempting to intrude into the network. Applied mathematical formulation and algorithms are used to demonstrate how the technology works in the environment. The model produces an evaluation comparing the results against other similar models, see [43] and [36]. When evaluated against the other models, the proposed model in the research was compared in five different areas: (1) Coverage of security threats--where it is seen to be a non-cooperative game; (2) Emphasized detection methods--combined; (3) Type of game model--focuses on common attacks in IoT networks and wireless sensors; (4) Complexity of protocol and architecture--which is low; and, finally, (5) Scalability--where the model is seen to be scalable in comparison.  
Additionally, in the work in [44], where the authors present a novel IDS system that can be used in a fog computing environment--the system consists of three steps: (1) Data preprocess; (2) Data normalization; and (3) Decision Tree detection method. The paper presents three contributions to the field of cybersecurity through the implementation of IDS, including proving that the IDS system is suitable for a big data environment, completing detection for four different attacks addressing the denial of service (disturbing or denying services to clients), probing (monitoring and other detection activities), R2L (Accessing systems or resources illegally for remote systems), and U2R (performing unauthorized access of normal users, as well as privileges of administrators). The study implements further the detection for twenty-two different attacks, providing a calculation time to compare each method which aids in the accuracy of detection, which is acceptable and can be used in the big data environment, as well as providing sections on experimental evaluation, related work, and research conclusion.  
Moreover, in recent work [45], the authors have addressed IDS in fog computing and IoT-based logistics systems using a smart data approach. The main aim of the paper is to expand on previous research conducted by the authors--moving into a three-layered structure of IoT systems which include cloud, fog, and edge layers. Using smart data can be a significant step forward for a framework to enable lightweight, effective, and efficient intrusion detection--this is due to the framework providing a path for the detection of silent attacks (these can typically include botnet attacks). The authors provide a diagram ofthe structure for the smart data and a prototype of the proposed IDS architecture, as seen in [27]. Throughout the research, there has also been a new approach presented for the clustering of primary network connections, which proves to be a more effective method than previous attempts. The authors explore future work and innovation opportunities in this area by focusing more in depth on detecting botnet attacks using smart data technology.