1. A system comprising: a tap configured to copy network data from a communication network, wherein the network data being associated with an original destination; and a controller coupled to the tap, the controller being configured to receive the copy of the network data from the tap, analyze the copy of the network data with a heuristic to determine if at least a portion of the copy of the network data is associated with malware, flag at least the portion of the copy of the network data as suspicious based on the heuristic determination, and simulate transmission of the flagged, suspicious copy of the network data to at least one virtual destination device of a first plurality of virtual destination devices, wherein the at least one virtual destination device of the first plurality of virtual destination devices is configured based on the original destination.