Systems, methods and computer-readable storage media are provided for detecting and simulating issues in a network. The methodology includes identifying: event sequences within network traffic data; filtering out a subset of the event sequences based on characteristics of the subset of the event sequences; generating definition groups by performing clustering on the subset of the event sequences, the definition groups comprising event sequence characteristics associated with one or more network issues; first simulating the subset of the event sequences; generating, based on results of the first simulating, a first issue identification; second simulating a most recent one of the identified event sequences; generating, based on results of the second simulating and the generated definition groups, a second issue identification; and validating the first issue identification with the second issue identification.