A Two-stage Anomaly Detection System for Fog Computing Services

Fog computing enhances traditional cloud computing by bringing resources closer to edge devices, enabling faster response times and supporting mission-critical applications. However, its distributed nature makes it vulnerable to cyber-attacks like distributed denial-of-service (DDoS), resulting in service disruption and performance degradation. To mitigate this attack, a two-stage anomaly detection system (ADS) is proposed in this paper. The first stage uses AdaBoost (AB) ensemble machine learning to classify events as obstructive or non-obstructive. Obstructive events are offloaded to the cloud where they are classified into normal or specific attack categories using Long Short-term Memory Encoder-Decoder (LSTM-ED). The results demonstrate that the AB-based model achieves exceptional performance, with nearly 100% in accuracy, precision, recall, and a minimal mean squared error (MSE) of 8.34 × 10<sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">−5</sup>. The LSTM-ED model also performs well, with accuracy and MSE at 99.50% and 0.02686, respectively.