A technology is described for detecting a failure of a primary virtualized device and failing over to a secondary virtualized network device. An example method may include generating a statistical model using historical data for network traffic that has been handled by a primary virtualized device. The statistical model may contain a functional state baseline representing a functional state of the primary virtualized device handling network traffic during a time frame. Having generated the statistical model, the functional state of the primary virtualized device may be monitored by calculating a network traffic metric for current network traffic handled by the primary virtualized device and comparing the network traffic metric for current network traffic handled by the primary virtualized device with a data point in the statistical model corresponding to the network traffic metric and the time frame for the network traffic metric.