Nokia Deepfield to provide London Internet Exchange members with advanced DDoS

The London Internet Exchange (LINX) is one of the world’s leading internet exchange points (IXPs), interconnecting more than 850 networks — internet service providers, content delivery networks, gaming companies, large enterprises and financial services networks — across its UK fabrics and its interconnection hubs in the United States and Africa. The aggregate criticality of the traffic riding the LINX network makes its members natural targets for DDoS attacks, and the threat profile has worsened sharply: the Nokia Threat Intelligence Report 2024 found that DDoS traffic grew 166 percent between June 2023 and June 2024, and that many networks now see well over 100 attacks per day, with botnet-driven DDoS the dominant attack vector.

LINX had already activated a basic DDoS mitigation service across its peering LANs — branded LINX Protect — in response to demand from enterprise and financial-sector members. To stay ahead of the next generation of larger, faster, and more sophisticated attacks, LINX needed an evolution of that service: AI-driven detection, network-embedded mitigation, granular per-customer controls, and high-scale appliance-based scrubbing for the heaviest application-layer and botnet attacks. The upgrade also needed to preserve the low-latency, locally-managed interconnection model that is the IXP’s core value proposition — ruling out architectures that redirect attack traffic to external scrubbing centers.

LINX selected Nokia Deepfield as the foundation for an upgraded, member-facing DDoS protection service — branded LINX Protect+ — and is rolling it out initially across the LON1 interconnection fabric in London.

The deployment combines Nokia Deepfield Defender, an AI-driven software-based DDoS detection and automated mitigation solution, with the Nokia 7750 Defender Mitigation System (DMS), a purpose-built mitigation appliance powered by Nokia’s FP5 network processor. Deepfield Defender correlates real-time IP network telemetry — IPFIX, BGP and DNS data — with Nokia’s patented Deepfield Secure Genome, a continuously updated threat-intelligence feed that tracks the security context of more than five billion IPv4 and IPv6 addresses across the global internet. The system automatically classifies traffic, identifies anomalies, and orchestrates mitigation: volumetric attacks are filtered at the network edge, while complex botnet- and application-layer attacks are redirected to the 7750 DMS for high-capacity, fine-grained scrubbing.

The result is a fully automated DDoS protection pipeline that runs within the LINX network rather than diverting traffic to external clouds, preserving the low-latency, locally managed peering that LINX members rely on. LINX member networks connected to the LON1 fabric can opt in to the LINX Protect+ service for member-tailored protection, advanced security analytics, and granular reporting.

The Nokia solution delivers:

• AI-driven detection with high accuracy, drawing on the Deepfield Secure Genome feed and more than 100 machine-learning classification rules to minimize false positives and distinguish legitimate traffic from attack traffic.
• High-scale, granular mitigation that combines network-edge filtering with FP5-powered scrubbing in the 7750 DMS, neutralizing the full spectrum of DDoS attack types — volumetric floods, application-layer attacks, and botnet- and proxy-driven campaigns.
• Member-facing service capability for LINX, turning advanced DDoS protection into a value-added service offering for the enterprise, financial, gaming, and critical-services networks that connect through LINX.
• Network-embedded protection that preserves the low-latency, locally-managed interconnection model that makes LINX strategically valuable to its 850-plus member networks.
• Advanced security analytics and reporting that give LINX and its members continuous visibility into attack patterns, trends, and mitigation outcomes.

With this deployment, LINX positions itself as the first UK-based IXP to deliver advanced, AI-driven DDoS protection — meeting member demand for security alongside connectivity, and reinforcing the role of the IXP as a hub of trust as well as a hub of traffic.