A network simulation apparatus and method for analyzing abnormal network traffic are provided. The network simulation apparatus includes: a traffic information collection unit, which collects traffic information in real time from a network; a simulator, which performs a simulation operation in a virtual network topology environment according to a predetermined scenario, the virtual network topology environment generating virtual traffic including a normal virtual packet modeled based on a normal traffic environment and an abnormal virtual packet modeled based on an abnormal traffic environment with a network traffic attack launched thereupon based on the collected real-time traffic information; and an interface unit, which provides the simulation operation results to a user. Accordingly, it is possible to effectively detect, analyze, and deal with abnormal network traffic that has occurred in a network to be managed.