The increasing frequency of cyber attacks targeting IoT highlights the crucial need for accurate and real-time intrusion detection methods. Deep learning, renowned for its remarkable pattern recognition and adaptive learning capabilities, emerges as a promising solution. The current deep learning-based intrusion detection methods face two main issues: dependence on cloud computing architecture, making it challenging to meet the real-time requirements of IoT, and a limited focus on the detection of unknown attacks. In this article, we build our deep learning-based intrusion detection models within fog computing architecture to meet the real-time needs of IoT. Initially, we collect traffic data and conduct feature selection in the fog layer. Subsequently, the Bi-LSTM models integrated with Multi-Head Self-Attention mechanism are trained using the feature-selected data in the cloud. To assess our models’ ability to detect unknown attacks, we utilize some known attacks data for model training, and then assess the models’ performance in detecting other attacks. Ultimately, we deploy the models within fog layer to detect intrusions. Our method is evaluated on the Bot-Iot dataset that contains massive IoT traffic. Experimental results reveal that our models exhibit an average accuracy of 99.85% and perform well in detecting unknown attacks.