Security attacks are a nightmare to many computing environments such as fog computing, and these attacks should be addressed. Fog computing environments are vulnerable to various kinds of DDoS attacks, which can keep fog resources busy. Typically in such attacks, fog environments often have less available resources, which can negatively impact the scheduling of Internet of Things (IoT) submitted workflows. However, most of the existing scheduling schemes do not consider DDoS attacks’ effect in the scheduling process, increasing the deadline missed workflows and offloaded tasks on the cloud. For dealing with these issues, a hybrid optimization algorithm is proposed, comprising both Particle Swarm Optimization (PSO) and Salp Swarm algorithm (SSA), to solve the workflow scheduling problem in multiple fog computing environments. Two discrete-time Markov chain models are proposed for each fog computing environment to address DDoS attacks’ effects on them. Our first Markov model computes the average available network bandwidth for each fog. The second Markov model finds the average number of available virtual machines (VMs) for each fog; the models address different levels of DDoS attacks. Extensive simulations show that by predicting the effects of DDoS attacks on fog environments, the proposed approach can effectively mitigate the number of offloaded tasks on cloud data centers and can reduce the number of the deadline missed workflows.