System and method for using simulators in network security and useful in IoT security

1. A system comprises:

a network management system;

a plurality of network elements;

wherein the network elements include at least one real target and at least one simulated target, the simulated target including a central processing unit, memory and a management component, the management component including a management component simulator, a data or modeling file, the data or modeling file based on responses from the real target, the simulated target responding to intruder requests where intruders have infiltrated the network management system or any of the network elements to which the simulated target is connected, and where the simulated target continues to interact with infiltrated network elements as the real target, and wherein the central processing unit coupled with the memory, when executed by the system, perform the instructions of:

detecting the intruder requests on the simulated target;

determining requestor and request fingerprint for each intruder request;

examining each intruder request, wherein the examining includes identifying the requestor, protocol and decoding the intruder request;

determining an attack intent creating a request fingerprint based on examination of the intruder request, where the request fingerprint uniquely tags and characterizes the intruder request;

encoding the request fingerprint;

comparing the requestor and the request fingerprint with entries in a requestor and request fingerprint white list;

identifying network element sending request as infiltrated when the requestor and the request fingerprint do not match entries in the requestor and request fingerprint white list;

creating by means of the simulated target a log of the communication with the infiltrated network element; and

outputting alerts to the network management system to indicate that the intruder requests from the infiltrated network element received, and an intrusion occurred.

2. The system of claim 1 , wherein the request fingerprint, time of request, and request frequency are recorded in the request fingerprint white list.

3. A method comprises:

a simulated target management component simulators for detecting hacker activity indicative of intrusion on either of a network element and a network management system, the network element includes at least one real target and at least one simulated target, the simulated target including a central processing unit, memory and a management component, the management component including a management component simulator, a data or modeling file, the data or modeling file based on responses from the real target, the simulated target responding to intruder requests where intruders have infiltrated either the network management system or the network element to which the simulated target is connected, and where the simulated target continues to interact with infiltrated network elements as the real target, the method comprising the steps of:

receiving the intruder requests;

logging the intruder requests;

examining the intruder requests and generating request fingerprints, wherein generating the request fingerprints comprises:

examining each intruder request,

creating a request fingerprint based on examination of the intruder request, where the intruder request fingerprint uniquely tags and characterizes the intruder request, and

encoding the request fingerprint from the intruder request;

determining if the intruder request is from a white list requestor;

when the request is not from the white list requestor:

raising silent alarm, sending response based on data or modeling file, and

updating the white list requestor based on user feedback;

determining whether the request fingerprint matches fingerprint white list when the request is from the white list requestor;

sending response based on data or modeling file when request fingerprint matches the fingerprint white list; and

when the request fingerprint does not matches the fingerprint white list:

raising silent alarm, sending response based on data or modeling file, and

updating requestor whitelist based on user feedback.

4. The method of claim 3 , wherein the request fingerprint, time of request, and request frequency are recorded in the request fingerprint white list.