1. A network device comprising: management circuitry configured to: identify an abnormal traffic pattern in first network data communicated by a first virtual machine that uses a first set of network resources, and in response: select a second set of network resources for use by an analysis virtual machine to analyze the abnormal traffic pattern in subsequent network data communicated by the first virtual machine including: selecting, for the second set of network resources, a particular network device with a minimum number of network hops between the particular network device and another network device in the first set of network resources used by the first virtual machine; and initialize the analysis virtual machine to use the second set of network resources; determine a secure route between the first virtual machine to the analysis virtual machine; and configure the first virtual machine to send the subsequent network data to the analysis virtual machine using the secure route.