DDoS security

A distributed denial of service (DDoS) attack is a coordinated attempt to overwhelm a website, application or network with malicious traffic from many devices and locations at once, so that legitimate users’ traffic cannot get through. Service providers should care because attacks now exceed 100 per day in many networks, degrade quality of experience for residential customers, break enterprise SLAs, carry regulatory obligations (such as NIS2 in the EU), and — because much of today’s attack traffic originates from compromised subscriber devices inside the network — consume the operator’s own capacity and damage its IP reputation. Nokia Deepfield research shows most attacks now end within five minutes, faster than manual response allows.

A denial-of-service (DoS) attack generally originates from a single system. A distributed denial of service (DDoS) attack spreads traffic across many devices and locations — typically a botnet of compromised computers, routers, cameras and other IoT devices — making it larger, harder to trace and harder to block. Nearly all significant attacks today are distributed.

DDoS protection identifies malicious traffic and blocks, limits or redirects it while keeping legitimate users connected. Common methods include network monitoring and traffic analytics, traffic filtering, rate limiting, web application firewalls, content delivery networks with Anycast routing, and traffic scrubbing — deployed on-premises, in the cloud, in the service provider network, or in hybrid models. No single method stops every attack; modern network-based DDoS security, such as the Nokia Deepfield solution, combines AI-driven detection with automated mitigation enforced directly on network routers.

Traditional defenses rely on static thresholds, traffic baselines and known signatures. These fail against modern attacks because botnets generate traffic from real (not spoofed) IP addresses, from outside and from within the network; AI-assisted campaigns shift vectors within seconds; residential proxy networks rotate millions of consumer IP addresses past reputation lists; and most attacks now end within five minutes — before traffic can be diverted to a centralized scrubbing center. A modern defense must be intelligent, automated and integrated into the network itself.

Instead of backhauling traffic to centralized scrubbing centers, Nokia uses the network itself as sensor and enforcer. Nokia Deepfield Defender combines big data telemetry with Deepfield Secure Genome — an hourly-updated security map of more than 5 billion IP addresses — and AI engines that detect and auto-mitigate attacks in seconds, enforcing surgical filtering rules on existing IP routers at line rate. This delivers fewer false positives than threshold-based competitors, petabit-scale mitigation without a scrubbing bottleneck, detection of both inbound and outbound DDoS (including botnet traffic originating inside the network), and — through the 7750 Defender Mitigation System — fine-grained L4–L7 scrubbing for the most complex attacks. The same AI-driven approach counters AI-driven attacks: machine learning classifies shape-shifting campaigns that defeat static rules.

Nokia Deepfield Genome Shield is the foundation for proactive security automation and orchestration in the Nokia Deepfield DDoS security solution, built on Deepfield Defender. It aggregates threat intelligence from six continuously updated sources — Cloud Genome, Secure Genome, the Global DDoS Threat Alliance (GDTA), DeepRange, community data and licensed data — compiles it into automated security policies and enforces them in the data plane of existing Nokia and third-party routers and the 7750 Defender Mitigation System, with no diversions and no added latency. Against botnet and residential proxy DDoS specifically, Genome Shield disrupts communication between compromised devices and their command-and-control (C2) infrastructure — Nokia estimates its continuously updated rules block over 99% of all DDoS C2 malicious traffic — so enrolled devices never receive instructions to attack. Predictive protection keeps always-on rate limiters in place before campaigns begin, custom policies let operators block scanning, AI crawlers and malware sites, and observability dashboards track compromised devices, botnet endpoints and security trends — for inbound and outbound threats alike.