Developing a crawler to gather IoT (Internet of Things) data streams and a behavior analyzer to detect malicious attacks is worth investigating for sustaining a secure IoT system. Detecting malicious before triggering an attack is highly advised. We present a special-purpose IoT crawler that simulates an inspector to find malicious attacks. A crawler is located in the Fog layer to take over its resources. It gathers data streams from IoT nodes, depending on a priority principle. An intelligent behavior analyzer with a machine learning (ML) algorithm foundation discovers malicious nodes cor- responding to the obtained node behavior according to collected data streams by the crawler. The performance of the crawler was tested on the dataset NSW-NB15 with seven ML classifiers: AB, NB, LR, KNN, DT, RF, and ET. For example, the average accuracy was 80.2%, 88.3%, 88.4%, 92.8%, 97.5%, 97.8%, and 98.3%, respectively. Keywords: Crawler, Intrusion Detection System, Machine Learning, Securing IoT