1. A method for analyzing a suspicious activity on an aircraft network, comprising the steps of: creating a sandbox network in communication with the aircraft network, the sandbox network simulating the aircraft network and comprising a plurality of sandbox nodes corresponding to a plurality of nodes of the aircraft network, a first set of sandbox links corresponding to a plurality of links of the aircraft network that provide communication between a subset of the plurality of nodes of the aircraft network, and a second set of sandbox links providing communication between sandbox nodes not in communication via the first set of sandbox links; generating network traffic over the sandbox network such that the sandbox network models a behavior of the aircraft network; routing the suspicious activity from the aircraft network to the sandbox network; and analyzing the suspicious activity as the suspicious activity traverses through the sandbox network.