© 2017, Springer Science+Business Media, LLC. Collusion attacks are among the major security concerns nowadays due to the growth exposure in networks and communications. Internet of Things (IoT) environments are an attractive target for such type attacks. This paper discusses the problem of collusion attacks in IoT environments and how mobility of IoT devices increases the difficulty of detecting such types of attacks. It demonstrates how approaches used in detection collusion attacks in WSNs are not applicable in IoT environments. To this end, the paper introduces a model based on Fog Computing infrastructure to keep track of IoT devices and detect collusion attackers. The model uses fog computing layer for realtime monitoring and detection of collusion attacks in IoT environments. Moreover, the model uses a software defined systems layer to add a degree of flexibility for configuring Fog nodes to enable them to detect various types of collusion attacks. The paper provides algorithms, theorems, lemmas and mathematical proofs of the proposed model. Furthermore, the it highlights the possible overhead on fog nodes and network when applying the proposed model, and claims that fog layer infrastructure can provide the required resources for the scalability of the model. The experiments show how the proposed model can keep track of malicious nodes while moving from one cluster to other clusters in IoT environments in contrary to the models used in WSNs. Moreover, the experiments show that the proposed model can bear the computation overhead effectevilly, and reduces the power consumption of aggregator nodes in comparison to the models used in WSNs.