1. A system, comprising: a memory that stores instructions; a processor that executes the instructions to perform operations, the operations comprising: receiving, from a measurement probe, a network transaction measurement associated with a first node in a network; determining if the network transaction measurement satisfies a threshold measurement value; determining, if the network transaction measurement satisfies the threshold measurement value, that an attack is occurring at the first node in the network; identifying a second node having a capacity for handling traffic intended for the first node; and launching a first quantity of virtual machines at the second node to handle legitimate traffic of the traffic intended for the first node.