1. A method comprising: receiving, at a network device, a first data set indicative of the statuses of a plurality of network devices when a type of network attack is not present; receiving a second data set indicative of the statuses of the plurality of network devices when the type of network attack is present, wherein at least one of the plurality simulates the type of network attack by operating as an attacking node; training a machine learning model using the first and second data set to identify the type of network attack; and identifying a real network attack using the trained machine learning model.