With increasing demand in smart grid technologies, ensuring cybersecurity while maintaining privacy is a critical challenge. This paper presents a real-time, privacy-preserving IDS (Intrusion Detection System) based on LightGBM in fog computing environment using a three-layer architecture. The first layer consists of smart meters with mobile computing capabilities, such as Raspberry Pi, which perform real-time intrusion detection and update their local models. The second layer, the fog computing layer at the sub-station level, aggregates updates from smart meters and enhances computational efficiency. The third layer is a main cloud server that stores, monitors, and manages global model updates. A federated learning approach is employed to ensure privacy and reduce communication overhead, where the global model, trained on benchmark IDS datasets (CIC-IDS-2017, UNSW-NB15 and NSL-KDD), is distributed to lower layers. Smart meters locally refine the model, periodically sending updated parameters to the fog layer for aggregation. The final aggregation occurs at the cloud before redistributing improved models. This decentralized learning approach enhances security, reduces latency, and preserves data privacy in smart grid net- works, making it a robust solution for real-time intrusion detection.