A security administrator at Company XYZ is trying to develop a body of knowledge to enable heuristic and behavior based security event monitoring of activities on a geographically distributed…

Modeling the network in a series of VMs allows the security team to simulate traffic patterns, user behaviors, and system interactions in a controlled environment to establish a behavioral baseline. This approach avoids disrupting production systems while still providing representative data for heuristic and behavior-based monitoring. VMs can be configured to mirror the distributed network topology without the cost or risk of full duplication.

Completely duplicating the network on virtual machines is prohibitively expensive and resource-intensive, making it impractical when a representative VM model achieves the same baseline goal.

Instrumenting the operational network for baseline testing introduces risk of disruption to live systems and may skew baseline data due to real production load variability.

Scheduling testing on operational systems outside user hours captures an unrepresentative baseline since normal user activity - the very behavior being baselined - is absent.