{"id":"https://openalex.org/W7133596243","doi":"https://doi.org/10.3390/computers15030169","title":"Intrusion Detection in Fog Computing: A Systematic Review of Security Advances and Challenges","display_name":"Intrusion Detection in Fog Computing: A Systematic Review of Security Advances and Challenges","publication_year":2026,"publication_date":"2026-03-05","ids":{"openalex":"https://openalex.org/W7133596243","doi":"https://doi.org/10.3390/computers15030169"},"language":"en","primary_location":{"id":"doi:10.3390/computers15030169","is_oa":true,"landing_page_url":"https://doi.org/10.3390/computers15030169","pdf_url":"https://www.mdpi.com/2073-431X/15/3/169/pdf?version=1772701234","source":{"id":"https://openalex.org/S4210228075","display_name":"Computers","issn_l":"2073-431X","issn":["2073-431X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","doaj"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://www.mdpi.com/2073-431X/15/3/169/pdf?version=1772701234","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5033761676","display_name":"Nyashadzashe Tamuka","orcid":"https://orcid.org/0000-0003-3391-7010"},"institutions":[{"id":"https://openalex.org/I137616099","display_name":"Tshwane University of Technology","ror":"https://ror.org/037mrss42","country_code":"ZA","type":"education","lineage":["https://openalex.org/I137616099"]}],"countries":["ZA"],"is_corresponding":true,"raw_author_name":"Nyashadzashe Tamuka","raw_affiliation_strings":["Department of Information Technology, Tshwane University of Technology, Soshanguve, Pretoria 0152, South Africa"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Information Technology, Tshwane University of Technology, Soshanguve, Pretoria 0152, South Africa","institution_ids":["https://openalex.org/I137616099"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5068434545","display_name":"Topside E. Mathonsi","orcid":"https://orcid.org/0000-0002-0439-7186"},"institutions":[{"id":"https://openalex.org/I137616099","display_name":"Tshwane University of Technology","ror":"https://ror.org/037mrss42","country_code":"ZA","type":"education","lineage":["https://openalex.org/I137616099"]}],"countries":["ZA"],"is_corresponding":false,"raw_author_name":"Topside Ehleketani Mathonsi","raw_affiliation_strings":["Department of Information Technology, Tshwane University of Technology, Soshanguve, Pretoria 0152, South Africa"],"raw_orcid":"https://orcid.org/0000-0002-0439-7186","affiliations":[{"raw_affiliation_string":"Department of Information Technology, Tshwane University of Technology, Soshanguve, Pretoria 0152, South Africa","institution_ids":["https://openalex.org/I137616099"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5125278390","display_name":"Thomas Otieno Olwal","orcid":null},"institutions":[{"id":"https://openalex.org/I137616099","display_name":"Tshwane University of Technology","ror":"https://ror.org/037mrss42","country_code":"ZA","type":"education","lineage":["https://openalex.org/I137616099"]}],"countries":["ZA"],"is_corresponding":false,"raw_author_name":"Thomas Otieno Olwal","raw_affiliation_strings":["Department of Electrical Engineering, Tshwane University of Technology, Soshanguve, Pretoria 0152, South Africa"],"raw_orcid":"https://orcid.org/0000-0003-3013-474X","affiliations":[{"raw_affiliation_string":"Department of Electrical Engineering, Tshwane University of Technology, Soshanguve, Pretoria 0152, South Africa","institution_ids":["https://openalex.org/I137616099"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5054516251","display_name":"Solly P. Maswikaneng","orcid":null},"institutions":[{"id":"https://openalex.org/I137616099","display_name":"Tshwane University of Technology","ror":"https://ror.org/037mrss42","country_code":"ZA","type":"education","lineage":["https://openalex.org/I137616099"]}],"countries":["ZA"],"is_corresponding":false,"raw_author_name":"Solly Maswikaneng","raw_affiliation_strings":["Department of Information Technology, Tshwane University of Technology, Soshanguve, Pretoria 0152, South Africa"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Information Technology, Tshwane University of Technology, Soshanguve, Pretoria 0152, South Africa","institution_ids":["https://openalex.org/I137616099"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5058915745","display_name":"Tonderai Muchenje","orcid":"https://orcid.org/0000-0002-0181-2655"},"institutions":[{"id":"https://openalex.org/I137616099","display_name":"Tshwane University of Technology","ror":"https://ror.org/037mrss42","country_code":"ZA","type":"education","lineage":["https://openalex.org/I137616099"]}],"countries":["ZA"],"is_corresponding":false,"raw_author_name":"Tonderai Muchenje","raw_affiliation_strings":["Department of Information Technology, Tshwane University of Technology, Soshanguve, Pretoria 0152, South Africa"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Information Technology, Tshwane University of Technology, Soshanguve, Pretoria 0152, South Africa","institution_ids":["https://openalex.org/I137616099"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5013186512","display_name":"Tshimangadzo M. Tshilongamulenzhe","orcid":null},"institutions":[{"id":"https://openalex.org/I137616099","display_name":"Tshwane University of Technology","ror":"https://ror.org/037mrss42","country_code":"ZA","type":"education","lineage":["https://openalex.org/I137616099"]}],"countries":["ZA"],"is_corresponding":false,"raw_author_name":"Tshimangadzo Mavin Tshilongamulenzhe","raw_affiliation_strings":["Department of Information Technology, Tshwane University of Technology, Soshanguve, Pretoria 0152, South Africa"],"raw_orcid":"https://orcid.org/0000-0003-4354-5222","affiliations":[{"raw_affiliation_string":"Department of Information Technology, Tshwane University of Technology, Soshanguve, Pretoria 0152, South Africa","institution_ids":["https://openalex.org/I137616099"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":6,"corresponding_author_ids":["https://openalex.org/A5033761676"],"corresponding_institution_ids":["https://openalex.org/I137616099"],"apc_list":{"value":1600,"currency":"CHF","value_usd":1732},"apc_paid":{"value":1600,"currency":"CHF","value_usd":1732},"fwci":25.1028,"has_fulltext":true,"cited_by_count":1,"citation_normalized_percentile":{"value":0.9904945,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":95,"max":98},"biblio":{"volume":"15","issue":"3","first_page":"169","last_page":"169"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.4323999881744385,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10400","display_name":"Network Security and Intrusion Detection","score":0.4323999881744385,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10273","display_name":"IoT and Edge/Fog Computing","score":0.3131999969482422,"subfield":{"id":"https://openalex.org/subfields/1705","display_name":"Computer Networks and Communications"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10917","display_name":"Smart Grid Security and Resilience","score":0.03440000116825104,"subfield":{"id":"https://openalex.org/subfields/2207","display_name":"Control and Systems Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/intrusion-detection-system","display_name":"Intrusion detection system","score":0.6699000000953674},{"id":"https://openalex.org/keywords/cloud-computing","display_name":"Cloud computing","score":0.5898000001907349},{"id":"https://openalex.org/keywords/metadata","display_name":"Metadata","score":0.5217000246047974},{"id":"https://openalex.org/keywords/python","display_name":"Python (programming language)","score":0.4171000123023987},{"id":"https://openalex.org/keywords/edge-computing","display_name":"Edge computing","score":0.37709999084472656},{"id":"https://openalex.org/keywords/field","display_name":"Field (mathematics)","score":0.3273000121116638},{"id":"https://openalex.org/keywords/benchmark","display_name":"Benchmark (surveying)","score":0.3167000114917755},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.31610000133514404}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7572000026702881},{"id":"https://openalex.org/C35525427","wikidata":"https://www.wikidata.org/wiki/Q745881","display_name":"Intrusion detection system","level":2,"score":0.6699000000953674},{"id":"https://openalex.org/C79974875","wikidata":"https://www.wikidata.org/wiki/Q483639","display_name":"Cloud computing","level":2,"score":0.5898000001907349},{"id":"https://openalex.org/C93518851","wikidata":"https://www.wikidata.org/wiki/Q180160","display_name":"Metadata","level":2,"score":0.5217000246047974},{"id":"https://openalex.org/C519991488","wikidata":"https://www.wikidata.org/wiki/Q28865","display_name":"Python (programming language)","level":2,"score":0.4171000123023987},{"id":"https://openalex.org/C2778456923","wikidata":"https://www.wikidata.org/wiki/Q5337692","display_name":"Edge computing","level":3,"score":0.37709999084472656},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.37610000371932983},{"id":"https://openalex.org/C2522767166","wikidata":"https://www.wikidata.org/wiki/Q2374463","display_name":"Data science","level":1,"score":0.33169999718666077},{"id":"https://openalex.org/C9652623","wikidata":"https://www.wikidata.org/wiki/Q190109","display_name":"Field (mathematics)","level":2,"score":0.3273000121116638},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.3167000114917755},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.31610000133514404},{"id":"https://openalex.org/C115051666","wikidata":"https://www.wikidata.org/wiki/Q6522493","display_name":"Ranging","level":2,"score":0.3154999911785126},{"id":"https://openalex.org/C182590292","wikidata":"https://www.wikidata.org/wiki/Q989632","display_name":"Network security","level":2,"score":0.313400000333786},{"id":"https://openalex.org/C148730421","wikidata":"https://www.wikidata.org/wiki/Q141090","display_name":"Encryption","level":2,"score":0.30959999561309814},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3061999976634979},{"id":"https://openalex.org/C739882","wikidata":"https://www.wikidata.org/wiki/Q3560506","display_name":"Anomaly detection","level":2,"score":0.29319998621940613},{"id":"https://openalex.org/C2778464652","wikidata":"https://www.wikidata.org/wiki/Q309849","display_name":"Open research","level":2,"score":0.2892000079154968},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.2892000079154968},{"id":"https://openalex.org/C90936777","wikidata":"https://www.wikidata.org/wiki/Q917189","display_name":"Host-based intrusion detection system","level":4,"score":0.2870999872684479},{"id":"https://openalex.org/C183115368","wikidata":"https://www.wikidata.org/wiki/Q856577","display_name":"Weighting","level":2,"score":0.2597000002861023},{"id":"https://openalex.org/C10511746","wikidata":"https://www.wikidata.org/wiki/Q899388","display_name":"Data security","level":3,"score":0.2549999952316284},{"id":"https://openalex.org/C77052588","wikidata":"https://www.wikidata.org/wiki/Q644307","display_name":"Constant false alarm rate","level":2,"score":0.2533999979496002},{"id":"https://openalex.org/C178489894","wikidata":"https://www.wikidata.org/wiki/Q8789","display_name":"Cryptography","level":2,"score":0.25279998779296875}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.3390/computers15030169","is_oa":true,"landing_page_url":"https://doi.org/10.3390/computers15030169","pdf_url":"https://www.mdpi.com/2073-431X/15/3/169/pdf?version=1772701234","source":{"id":"https://openalex.org/S4210228075","display_name":"Computers","issn_l":"2073-431X","issn":["2073-431X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers","raw_type":"journal-article"},{"id":"pmh:oai:doaj.org/article:3a925b0d5e79442781751d19d47f2d0e","is_oa":true,"landing_page_url":"https://doaj.org/article/3a925b0d5e79442781751d19d47f2d0e","pdf_url":null,"source":{"id":"https://openalex.org/S4306401280","display_name":"DOAJ (DOAJ: Directory of Open Access Journals)","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":null,"host_organization_name":null,"host_organization_lineage":[],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by-sa","license_id":"https://openalex.org/licenses/cc-by-sa","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"Computers, Vol 15, Iss 3, p 169 (2026)","raw_type":"article"}],"best_oa_location":{"id":"doi:10.3390/computers15030169","is_oa":true,"landing_page_url":"https://doi.org/10.3390/computers15030169","pdf_url":"https://www.mdpi.com/2073-431X/15/3/169/pdf?version=1772701234","source":{"id":"https://openalex.org/S4210228075","display_name":"Computers","issn_l":"2073-431X","issn":["2073-431X"],"is_oa":true,"is_in_doaj":true,"is_core":true,"host_organization":"https://openalex.org/P4310310987","host_organization_name":"Multidisciplinary Digital Publishing Institute","host_organization_lineage":["https://openalex.org/P4310310987"],"host_organization_lineage_names":["Multidisciplinary Digital Publishing Institute"],"type":"journal"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Computers","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[{"id":"https://openalex.org/F4320324695","display_name":"Tshwane University of Technology","ror":"https://ror.org/037mrss42"}],"has_content":{"grobid_xml":true,"pdf":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7133596243.pdf","grobid_xml":"https://content.openalex.org/works/W7133596243.grobid-xml"},"referenced_works_count":42,"referenced_works":["https://openalex.org/W2944202703","https://openalex.org/W3039274670","https://openalex.org/W3040916395","https://openalex.org/W3085865982","https://openalex.org/W3094470083","https://openalex.org/W3111288713","https://openalex.org/W3115242022","https://openalex.org/W3118615836","https://openalex.org/W3125638441","https://openalex.org/W3135091917","https://openalex.org/W3142044733","https://openalex.org/W3158350046","https://openalex.org/W3158729335","https://openalex.org/W3185895012","https://openalex.org/W3192519096","https://openalex.org/W3196596779","https://openalex.org/W3216039521","https://openalex.org/W4220747501","https://openalex.org/W4224300633","https://openalex.org/W4285058242","https://openalex.org/W4296993380","https://openalex.org/W4311529209","https://openalex.org/W4311628399","https://openalex.org/W4313477842","https://openalex.org/W4316143916","https://openalex.org/W4320067992","https://openalex.org/W4322493038","https://openalex.org/W4360979173","https://openalex.org/W4366261701","https://openalex.org/W4388638017","https://openalex.org/W4391824073","https://openalex.org/W4401210725","https://openalex.org/W4401366983","https://openalex.org/W4401976140","https://openalex.org/W4402626889","https://openalex.org/W4403535680","https://openalex.org/W4406137763","https://openalex.org/W4406291624","https://openalex.org/W4407601811","https://openalex.org/W4411725103","https://openalex.org/W4412939625","https://openalex.org/W4414157027"],"related_works":[],"abstract_inverted_index":{"Fog":[0],"computing":[1,51],"extends":[2],"cloud":[3],"services":[4],"to":[5,9,28,156,186,204,221,278],"the":[6,63,76,236],"network":[7],"edge":[8],"support":[10],"low-latency":[11],"IoT":[12],"applications.":[13],"However,":[14],"since":[15],"fog":[16,50,165,295,316],"environments":[17],"are":[18],"distributed":[19,276],"and":[20,35,52,55,69,104,121,134,139,148,152,159,175,178,229,247,269,275,303],"resource-constrained,":[21],"intrusion":[22,45],"detection":[23,46,162,215],"systems":[24,47,163],"must":[25],"be":[26],"adapted":[27],"defend":[29],"against":[30],"cyberattacks":[31],"while":[32],"keeping":[33],"computation":[34],"communication":[36],"overhead":[37],"minimal.":[38],"This":[39],"systematic":[40],"review":[41],"presents":[42],"research":[43,56],"on":[44,188,207],"(IDSs)":[48],"for":[49,87,136,213,315],"synthesizes":[53],"advances":[54],"gaps.":[57],"The":[58,89,124],"study":[59],"was":[60],"guided":[61],"by":[62],"\u201cPreferred-Reporting-Items":[64],"for-Systematic-Reviews-and-Meta-Analyses\u201d":[65],"(PRISMA)":[66],"framework.":[67],"Scopus":[68],"Web":[70],"of":[71,129,255,291,294],"Science":[72],"were":[73,92,110,132,150,167],"searched":[74],"in":[75,154,164,239],"title":[77],"field":[78],"using":[79,113],"TITLE/TI":[80],"=":[81],"(\u201cintrusion":[82],"detection\u201d":[83],"AND":[84],"\u201cfog":[85],"computing\u201d)":[86],"2021\u20132025.":[88],"inclusion":[90],"criteria":[91],"(i)":[93],"2021\u20132025":[94],"publications,":[95],"(ii)":[96],"journal":[97],"or":[98],"conference":[99],"papers,":[100],"(iii)":[101],"English":[102],"language,":[103],"(iv)":[105],"open":[106],"access":[107],"availability;":[108],"duplicates":[109],"removed":[111],"programmatically":[112],"a":[114,118,252],"DOI-first":[115],"key":[116],"with":[117],"title,":[119],"year,":[120],"author":[122,258],"alternative.":[123],"search":[125],"identified":[126],"8560":[127],"records,":[128],"which":[130],"4905":[131],"unique":[133],"included":[135,200],"qualitative":[137],"grouping":[138],"bibliometric":[140],"synthesis.":[141],"Metadata":[142],"(year,":[143],"venue,":[144],"authors,":[145],"affiliations,":[146],"keywords,":[147],"citations)":[149],"extracted":[151],"analyzed":[153],"Python":[155],"compute":[157],"trends":[158],"collaboration.":[160],"Intrusion":[161],"networks":[166],"categorized":[168],"into":[169],"traditional/signature-based,":[170],"machine":[171],"learning,":[172,174],"deep":[173],"hybrid/ensemble.":[176],"Hybrid":[177],"DL":[179],"approaches":[180],"reported":[181],"accuracy":[182],"ranging":[183],"from":[184,226],"95":[185],"99%":[187],"benchmark":[189],"datasets":[190],"(such":[191],"as":[192,244,249,251,264,281,283],"NSL-KDD,":[193],"UNSW-NB15,":[194],"CIC-IDS2017,":[195],"KDD99,":[196],"BoT-IoT).":[197],"Notable":[198],"bottlenecks":[199],"computational":[201],"load":[202],"relative":[203],"real-time":[205],"latency":[206],"resource-constrained":[208],"nodes,":[209],"elevated":[210],"false-positive":[211],"rates":[212],"anomaly":[214],"under":[216],"concept":[217],"drift,":[218],"limited":[219,230],"generalization":[220],"unseen":[222],"attacks,":[223],"privacy":[224],"risks":[225],"centralizing":[227],"data,":[228],"real-world":[231,292],"validation.":[232],"Bibliometric":[233],"analyses":[234],"highlighted":[235],"field\u2019s":[237],"concentration":[238],"fast-turnaround,":[240],"open-access":[241],"journals":[242],"such":[243,263],"IEEE":[245],"Access":[246],"Sensors,":[248],"well":[250,282],"small":[253],"number":[254],"highly":[256],"collaborative":[257],"clusters,":[259],"alongside":[260],"dominant":[261],"terms":[262],"\u201clearning,\u201d":[265],"\u201cfederated,\u201d":[266],"\u201censemble,\u201d":[267],"\u201clightweight,\u201d":[268],"\u201cexplainability.\u201d":[270],"Emerging":[271],"directions":[272],"include":[273],"federated":[274],"training":[277],"preserve":[279],"privacy,":[280],"online/continual":[284],"learning":[285],"adaptation.":[286],"Future":[287],"work":[288],"should":[289],"consist":[290],"evaluation":[293],"networks,":[296],"ultra-lightweight":[297],"yet":[298],"adaptive":[299],"hybrid":[300],"IDS,":[301],"self-learning,":[302],"secure":[304],"cooperative":[305],"frameworks.":[306],"These":[307],"insights":[308],"help":[309],"researchers":[310],"select":[311],"appropriate":[312],"IDS":[313],"models":[314],"networks.":[317]},"counts_by_year":[{"year":2026,"cited_by_count":1}],"updated_date":"2026-05-21T06:26:12.895304","created_date":"2026-03-06T00:00:00"}