A method and system for preventing, auditing and trending unauthorized traffic in a network system is provided. The unauthorized traffic is detected at the router level. An attacker transmits an attack vector to the network system. The attack vector is detected at the router and signatures are created for network system resources, wherein each signature represents the response of a network system resource to the attack vector. Signatures are created by learning how the attack is taking place within the network system. Network system resources corresponding to the signatures are then emulated, thereby protecting the network device.