1. A system comprising: an interface configured to copy data of a data flow transmitted over a network between a first device and a second device, the data flow including data originating from the first device and data originating from the second device, the copied data of the data flow being transmitted over the network in accordance with a protocol; a heuristic module configured to receive the copied data from the interface and identify at least a portion of the copied data as suspicious based on a determination that the portion of the copied data has characteristics of malware; and an analysis environment including a replayer configured to operate as the first device and a virtual machine configured to operate as the second device, the replayer configured to receive the portion of the copied data identified as suspicious, modify the portion of the copied data identified as suspicious, and transmit the modified portion of the copied data identified as suspicious to the virtual machine in accordance with the protocol.