Aspects of a method and system for traffic management via virtual machine migration include detecting an abnormal traffic pattern in traffic communicated by a first virtual machine that utilizes a first set of network resources. Responsive to the detection of the abnormal pattern, a second virtual machine that utilizes a second set of network resources may be initialized. The second virtual machine may take over functions performed by the first virtual machine and initialization of the second virtual machine is based on an analysis of the traffic. The second virtual machine may be initialized utilizing stored virtual machine state information in instances that the abnormal traffic is a result of a malicious attack. The second virtual machine may be initialized utilizing current virtual machine state information in instances that the abnormal traffic is not a result of a malicious attack.