A security administrator at Company XYZ is trying to develop a body of knowledge to enable heuristic and behavior based security event monitoring of activities on a geographically distributed…

Modeling the network in a series of VMs creates a representative, isolated environment where traffic patterns and behavior can be safely instrumented, measured, and tuned without affecting production availability. This approach allows the security team to iteratively refine the baseline and heuristic thresholds across a geographically distributed topology without introducing risk to live systems.

Completely duplicating the entire distributed network on virtual machines is cost-prohibitive and logistically impractical compared to building a representative model.

Directly instrumenting the operational network during baseline development risks introducing performance degradation or instability into production systems.

Scheduling tests on live systems during off-hours still carries operational risk and fails to capture a true baseline of normal user-driven traffic behavior.