In cognitive radio-based Internet of Things (CRIoT), security attacks of malicious devices disrupt the spectrum sensing process. The most common attack method, Spectrum Sensing Data Falsification (SSDF) attack, attempts to make the Fusion Center (FC) misjudge the existence of the primary user (PU) by sending false energy sensing data. We propose an SSDF attack defense algorithm to deal with this security threat, which adopts fog computing architecture. FC performs Meanshift clustering, Clustering data filtering, and data evaluation on the sensing data sent by CR-IoT devices to allocate appropriate weights, obtain more appropriate fusion energy and achieve the goal of accurately detecting the presence of PU. Simulation results show that in three different attack scenarios, compared with other algorithms, the proposed defence algorithm has a higher detection probability and can resist SSDF attacks more effectively.