Ah, dealing with "malicious attempts" is a somewhat different issue from what your OP was inferring (?), i.e. normal/usual/legitimate access methods.
From you later posts, it seems you've taken the "usual" steps to secure your device, but at @Leo Laohoo notes, illegitimate access might be via some security vulnerability. The latter, though, come in two major groups, those known, with two subgroups, there's a "fix" or "no fix (yet), those unknown (e.g. like zero day exploits).
For known but no fix security vulnerabilities or unknown security vulnerabilities, we can sometime mitigate/preclude both by additionally hardening of the device, such as ACLs on all interfaces that block all traffic to the device (itself, i.e. not transit traffic) except for explicitly approved traffic types from known sources. The latter might even be further controlled by having totally separate infrastructure that carries such traffic to/from the device, i.e. no mixing of this traffic with "ordinary" in-band transit traffic.
The forgoing possibly won't help to identify how whatever is being done that you suspect is being done, but it might block it. Further, deep analysis into what is happening, if happening, is not a minor undertaking! It's difficult enough to further harden a device, correctly, and its continued "care and feeding".
