Abstract
Abstract Fog–edge Internet of Things (IoT) systems support low-latency distributed services but remain vulnerable to coordinated attacks that evade detectors designed for independent events. Existing solutions also tend to separate attack detection, provenance verification, and accountability enforcement, leaving no unified path from relational evidence to auditable response. This study aims to develop an integrated framework that detects coordinated malicious behavior, ranks provenance relevance, verifies evidence, and activates rule-based accountability in resource-constrained edge environments. The proposed Blockchain-Fog Computing Collaborative Framework with Deep Attention-based Collusion Detection and Automated Accountability (BF3-ACDA) framework combines a hierarchical blockchain–fog architecture with an attention-based collusion graph neural network (AttnCol-GNN), whose reputation-aware attention coefficient incorporates behavioral correlation and blockchain-derived trust information. A shared attention representation supports both collusion classification and provenance ranking, while Fog-BFT consensus, Merkle verification, and smart contracts provide tamper-evident recording and severity-based enforcement. Across 30 matched independent runs on the collusion-augmented CICIoT2023 benchmark, BF3-ACDA achieved 96.80 ± 0.23% accuracy, 96.75 ± 0.21% F1-score, and 0.975 ± 0.005 AUC-ROC. Direct-transfer accuracy without target-domain fine-tuning was 94.20 ± 0.34% on NSL-KDD and 92.50 ± 0.25% on CICIDS2017. Removing detector-side reputation and verification features reduced accuracy by 3.40 percentage points, whereas replacing learned attention with mean aggregation reduced it by 1.80 points. The INT8 edge model required 12.4 MB and 58.5 ± 3.9 ms per inference. The results demonstrate a method-level coupling of coordinated-pattern detection, provenance relevance, and auditable enforcement, while supporting prototype deployment on evaluated edge, fog, and cloud platforms. As the collusion metadata were constructed for this study, the findings characterize robustness under controlled conditions rather than field performance on naturally occurring collusion.