The Internet of Drones (IoD) has recently become increasingly popular across various domains, including military operations, smart agriculture, traffic monitoring, and search and rescue (SAR) mission. In SAR missions, ensuring the security of drone information is a crucial aspect of the IoD. This process is fundamental in Cyber-Physical Systems (CPS), where environmental and location data are deeply interconnected. However, protecting drone information from security attacks and threats, such as collusion attacks where several malicious nodes may collaborate in order to disturb the network and to damage its QoS or functioning, remains a major concern. In this paper, we present a novel approach to detect malicious drones involved in collusion attacks during SAR missions using an Intrusion Prevention System (IPS) in Fog computing architecture. Our main objective is to identify the false information sent by drones targeted by a collusion attack during their functioning and detect it using our proposed system. Our proposed model builds upon a previous study in which we introduced secure clustered IoD architecture. In this work, we present a model composed of three layers: a cloud layer which contains a historical record of reputations and behaviors for all drones during executed missions, a fog layer which hosts the IPS, that analyzes data and makes decisions based on the information received, and an access layer that includes a special drone, called Master Drone (MD), which aggregates real-time data from drones about the SAR mission. A case study of the proposed framework is provided in this paper.