Algorithm 1. Hybrid Lightweight Attack Detection System

Input $S_i$ as a set of single sensor datasets, $N$ as NetFlow dataset, $C_j$ as set of single incremental classifiers (INB, IKNN, HTMC, HTNB, HTNBA), and $W$ as ensemble WHTE

Output $P_k$ set of performance metrics (average accuracy, average memory, average CPU time, kappa statistic, precision, recall, concept drift sensitivity)

Begin At fog devices close to the edge in framework 1 Collect infected sensor data $S$ in $S_i$ Collect infected NetFlow $N$ for $N$ and each $S$ in $S_i$  while there is data record in $S$ and $N$    Do      Pre-process the data      Set the sliding window to 1K records      Set the maximum memory to 5K records      Set the initial parameters of each $C$ classifier in $C_i$      Set the parameters of each $C$ in $W$      for each record in S and N        Do         Prequential train and test using $W$ and each $C$ $\mathrm{in}{C}_i$         Compute each $P$ in $P_k$         return average $P_k$         Update parameters of $W$ and each $C$ in $C_i$    end for     end while       for each $C$ in $C_i$ and $W$       for each $P$ in $P_k$        Compute one-way ANOVA          Assume that all population means are equal          Initialise p value          if (p < 0.05).          then reject          else accept          return statistical metrics          end if       end for      end for     end for   End