Nokia Launches Deepfield Genome Shield for Proactive DDoS Protection

Nokia has introduced Deepfield Genome Shield, a new security automation platform designed to provide proactive, always-on distributed denial-of-service (DDoS) protection for telecommunications providers, hosting companies, internet exchange points and cloud builders.

According to Nokia, the launch comes as the DDoS threat landscape undergoes significant changes driven by the rise of residential proxy botnets. The company said these botnets are made up of approximately 200 million compromised devices worldwide and are capable of generating attacks estimated at 250 to 600 terabits per second. Unlike traditional botnets, attacks now originate from legitimate subscriber devices, deliver multi-terabit traffic bursts lasting seconds to minutes and rapidly rotate IP addresses across thousands of nodes.

Nokia said these developments have reduced the effectiveness of traditional scrubber-based diversion and reactive mitigation approaches, which often cannot respond quickly enough to short-duration attacks. The company also noted that automated, AI-driven DDoS activity and AI-assisted code generation are accelerating the evolution of attack techniques.

Deepfield Genome Shield extends the capabilities of Nokia Deepfield Defender by introducing what Nokia describes as a new class of proactive, network-wide security automation. The platform was developed through collaboration with customers and the broader security community and is designed to shift DDoS protection from reactive mitigation to proactive enforcement using existing network infrastructure.

The system aggregates continuously updated threat intelligence from multiple sources, including Nokia Deepfield Secure Genome, which spans more than five billion internet endpoints, GDTA telemetry and Deepfield’s cyber range. Nokia said the cyber range generates real-time intelligence through live malware and botnet command-and-control activity. This intelligence is compiled within Deepfield Defender and translated into automated DDoS policies that can be enforced across an entire network.

Genome Shield expands Deepfield Defender's DDoS countermeasure portfolio through four core capabilities: Botnet C2 Disruption, which blocks command-and-control communications; DDoS Policers, which proactively rate-limit amplification and volumetric traffic; Custom Policies that enable user-defined rules through open APIs; and Observability tools that provide visibility into compromised devices, botnet endpoints and emerging security trends.

The platform requires Nokia Deepfield Defender and supports both router-based edge mitigation and the Nokia 7750 Defender Mitigation System for dedicated Layer 4 through Layer 7 DDoS scrubbing. Deployment options include on-premises, cloud-based and hybrid environments, supported by flexible licensing models.

Nokia said initial Genome Shield capabilities are already available within Deepfield Defender and are currently being used by customers. Additional features are scheduled for release throughout 2026.