Fog Edge Computing Framework for Distributed DDoS Mitigation Using Collaborative Intelligence and Resource Aware Traffic Filtering

The emergence of Internet of Things (IoT) ecosystems has exponentially increased the attack surface for Distributed Denial-of-Service (DDoS) threats, necessitating distributed defense mechanisms that operate closer to the network edge. This research introduces a Fog-Edge computing framework that leverages collaborative intelligence among geographically distributed fog nodes to detect and mitigate DDoS attacks before they reach centralized cloud infrastructure. The proposed architecture implements a three-tier defense strategy encompassing edge-level preliminary filtering, fog-level intelligent analysis, and cloud-level coordinated response orchestration. A lightweight machine learning model based on decision tree ensembles is deployed at edge nodes to perform initial traffic classification with minimal latency overhead, while fog nodes execute sophisticated anomaly detection using Long Short-Term Memory (LSTM) networks trained on historical attack patterns. Resource allocation algorithms dynamically adjust computational resources across fog nodes based on attack intensity and geographical distribution, ensuring optimal system performance under varying load conditions. The framework incorporates a secure inter-node communication protocol to facilitate threat intelligence sharing while preventing adversarial manipulation of collaborative decisions. Comprehensive evaluation using realistic IoT traffic traces and synthetically generated DDoS attacks demonstrates that the proposed system reduces attack traffic by 87.3% at the edge layer before reaching protected resources. The distributed architecture achieves an average detection latency of 2.4 seconds with 97.2% accuracy while consuming 64% less bandwidth compared to centralized cloud-based mitigation approaches. Performance analysis under high-intensity DDoS scenarios reveals that the resource-aware traffic filtering mechanism maintains service availability for legitimate IoT devices even when attack traffic volume exceeds normal traffic by a factor of 50.