Fog computing extends cloud resources to the network edge, enabling faster data processing and reduced latency for IoT and smart environments. However, it introduces security challenges, particularly Distributed Denial of Service (DDoS) attacks, which overwhelm resources and disrupt services. To address this, a two-stage detection mechanism operates at the fog layer. The first stage uses IP verification to block traffic from flagged malicious IPs. The second employs the D3-Outlier Detection Algorithm, a lightweight statistical method originally designed for Software-Defined Networking (SDN). It monitors traffic patterns with a weighted moving average and flags IPs exceeding local thresholds. This proactive system detects and blocks malicious traffic at the fog layer, preventing strain on cloud resources, reducing latency, and ensuring smooth operations for legitimate users. By combining efficiency and scalability, it strengthens network security while maintaining high performance and service availability.