Writing in the journal Cluster Computing, Saber Akbari, Seyed Ebrahim Dashti, and Amir Masoud Rahmani identify three critical gaps in existing approaches to fog security and resource management. First, centralized intrusion detection schemes force traffic to travel to a central analysis point, creating processing latency that undermines the real-time promise of fog architectures. Second, fog nodes consume excessive energy, particularly when they run heavy detection workloads without coordination. Third, and perhaps most damaging in practice, detection accuracy degrades badly when attacks are heterogeneous, meaning they span many different types, and when the IoT-fog environment is dynamic, with devices joining, leaving, and moving constantly. In environments with real-time constraints, these weaknesses compound each other: an operator cannot afford slow detection, but cannot afford inaccurate detection either.

The team’s answer is a Federated Autonomous Model based on the Random Forest Algorithm, which they abbreviate FAM-RFA, deployed on a blockchain platform. The choice of random forest reflects its proven strength as an ensemble classifier: instead of relying on a single decision tree, the algorithm trains many trees on random subsets of features and training data and then aggregates their votes. This makes it robust to the noise and variability that characterize IoT traffic, where a mix of benign sensor readings, video streams, and malicious packets flows simultaneously. Random forests also train relatively quickly and scale well, which matters when detection has to happen close to the network edge rather than in a distant data center.

The federated element is where the architecture departs from conventional designs. In a traditional setup, every fog node would send its traffic data to a central server for analysis, or each node would attempt to learn detection models in isolation. Federated learning inverts this arrangement. Each fog node trains a local random forest model on the traffic it observes and shares model updates rather than raw data. Through the blockchain platform, these locally trained models are combined into a global detection model that every node can use. The blockchain layer serves a dual purpose: it coordinates the aggregation of local models across the fog network and provides a tamper-resistant, decentralized ledger that prevents a single compromised node from poisoning the shared model or falsifying security decisions. The result is a self-managed detection system that operates without human intervention, a combination the authors note is rarely addressed in prior work.

Intrusion detection, however, is only half of the problem. The second pillar of the proposed system addresses resource management through an extended Markov Directed Acyclic Graph combined with Service Function Chain concepts, abbreviated MDAG-SFC. Service function chaining is a networking technique that routes traffic through an ordered sequence of processing functions, such as firewalls, load balancers, or monitors. Modeling these chains as a directed acyclic graph captures the dependencies between processing steps, since some functions must complete before others can begin. The Markov formulation brings in the mathematics of state-dependent processes: the state of the network, including node loads and available resources, influences the probability of transitioning to different allocation decisions. By extending the original DAG-SFC framework with a Markov chain approach, the researchers can model how tasks should be scheduled and resources allocated across fog nodes under uncertainty, minimizing embedding cost while respecting the parallel structure of the service functions.

The autonomous character of the combined system deserves emphasis. The authors argue that manual network control is increasingly untenable in large-scale IoT-fog deployments, both because of the sheer volume of devices and because rapid response is essential when attacks unfold in milliseconds. A human operator reviewing alerts and reconfiguring resource allocations cannot compete with an architecture that detects intrusions locally, updates its shared model through the blockchain, and reallocates computational tasks through the Markov DAG-SFC mechanism, all automatically. This closes the loop between security and resource management: when a node is under attack or overloaded, the system can route work away from it and adjust its service chains without waiting for centralized instructions.

To evaluate the design, the researchers turned to two well-known benchmarks: the ECU IoT dataset from Edith Cowan University and the ToN-IoT network dataset, both widely used for testing IoT intrusion detection. Simulating the FAM-RFA across these datasets, they measured accuracy against several baseline methods and found consistent improvements ranging from 0.7 percent to 2.0 percent, with an average gain of 1.35 percent depending on the dataset and the metric used. While a percentage point or two may sound incremental, in the competitive landscape of machine learning based intrusion detection, where baselines are already highly tuned, improvements of this size are significant. The team backed this up statistically: a paired t-test across the experimental results yielded p-values below 0.05, confirming that the observed gains are unlikely to be artifacts of random variation between runs.

The latency and energy results are more dramatic. Depending on the dataset and the baseline method used for comparison, processing latency fell by between 127 and 270 milliseconds, a reduction of approximately 40 percent. Energy consumption at the fog nodes dropped by 660 to 1,030 Joules, approximately 58.5 percent. These are substantial margins for edge infrastructure, where every joule matters for battery-powered devices and every millisecond counts for applications such as autonomous vehicles, industrial control, and remote healthcare monitoring. The authors attribute these savings to the decentralized detection model, which eliminates the round trips to central analyzers, and to the MDAG-SFC resource manager, which schedules tasks in ways that reduce redundant processing and idle power draw across the fog network.

The implications extend across the ecosystems that depend on fog and edge computing. Smart city deployments, which combine traffic sensors, environmental monitors, and public safety cameras, face exactly the heterogeneous, dynamic attack landscape that defeats simpler detectors. Industrial IoT systems in factories cannot tolerate the latency of cloud-based security analysis. Connected healthcare devices carry both strict real-time requirements and acute privacy sensitivities, and the federated design, which keeps raw traffic data local and shares only model updates, aligns naturally with those privacy constraints. The blockchain coordination layer adds resilience against the compromise of individual nodes, a growing concern as botnets specifically targeting IoT devices have demonstrated their ability to sweep through poorly defended edge networks.

The authors are careful about scope: they state that the domain of applicability covers IoT-fog environments with real-time processing requirements, and their simulations, though conducted on established datasets, remain simulations rather than large physical deployments. Moving from simulated fog networks to production infrastructure will raise questions about blockchain overhead at scale, the churn of models as devices and workloads change, and the costs of maintaining consensus among many fog nodes. Nevertheless, the study presents one of the more complete integrations of federated learning, blockchain coordination, ensemble-based detection, and graph-theoretic resource management reported for fog computing, and its measured gains in accuracy, latency, and energy consumption suggest that autonomous, decentralized security and resource management can be more than an architectural aspiration. For a field whose deployments are growing faster than their defenses, the message is that the fog can, in principle, defend and manage itself.

Subject of Research: An autonomous blockchain-based framework combining federated random forest intrusion detection with extended Markov DAG service function chain resource management in fog computing and IoT environments.

Article Title: An autonomous system for resource management and improved intrusion detection in fog computing and the internet of things

Article References: Akbari, S., Dashti, S. E., & Rahmani, A. M. (2026). An autonomous system for resource management and improved intrusion detection in fog computing and the internet of things. Cluster Computing, 29(13), Article 775. https://doi.org/10.1007/s10586-026-06548-1

Image Credits: AI Generated

DOI: 10.1007/s10586-026-06548-1

Keywords: fog computing, Internet of Things, intrusion detection, blockchain, federated learning, random forest, resource management, energy efficiency, latency reduction, Markov DAG, service function chaining, network security