Deepfield Genome

The magic behind Nokia Deepfield Genome: How does Deepfield Cloud Genome work?

Using our cloud-based servers, we constantly crawl the internet, gathering information about billions of IPv4 and IPv6 addresses, content delivery network (CDN) domains and network systems across the internet. We map these endpoints into traffic categories and allocate them into content and application domains, ISPs, major service provider domains, etc.

Deepfield Cloud Genome can greatly enhance your network flow-based, Border Gateway Protocol (BGP)-based and DNS-based information. It can help you map and categorize internet traffic, including encrypted or CDN traffic that is otherwise invisible to systems based solely on traditional deep packet inspection (DPI).

Optimized network performance with Deepfield Cloud Intelligence

Genome's global traffic insights enable Cloud Intelligence to optimize peering, enhance CDN management, and improve overall network capacity planning.

Enhanced customer experience with Deepfield Subscriber Intelligence

By correlating Genome's data with subscriber profiles, Subscriber Intelligence provides actionable insights into consumption patterns, helping you tailor services and reduce churn, or use this information for better subscriber-focused marketing.

Automated DDoS protection with Deepfield Defender

Secure Genome's real-time threat intelligence directly fuels Deepfield Defender's AI-driven detection and automated mitigation, ensuring robust DDoS security at scale.

Real-time threat intelligence

An hourly-updated, cloud-based data feed tracking the security context of over 5 billion IPv4/IPv6 addresses.

AI-driven precision

Leverages over 100 Machine Learning (ML) rules for automatic classification and tagging of IP addresses, to help distinguish legitimate traffic from malicious threats.

Accurate DDoS detection

Significantly improves real-time DDoS threat detection, reducing false positives and negatives by providing a detailed internet security context.

Foundation for a proactive defense

Maintains a knowledge base of allow list and blocklist IP addresses, infected IoT devices, latest botnets, and many other security-related data to facilitate more intelligent and automated mitigation strategies.

Features

Core capabilities of Deepfield Genome

How does Deepfield Secure Genome improve your DDoS security?

Like Deepfield Cloud Genome, Deepfield Secure Genome contains internet security-related data, including information about network IP addresses and flows. It tracks and maintains in its knowledge base details on IP addresses whose traffic exhibits anomalies or resembles DDoS patterns but are not threats (allowlist data), as well as data related to compromised, malicious, or insecure network sources and IP flows (blocklist data).

Deepfield Secure Genome helps improve real-time DDoS threat detection. With this detailed internet security context, you can significantly reduce the number and impact of false positives and detect real threats with greater agility and accuracy.

Understand how services are delivered

Gain a global, real-time view of how internet applications, services and content are traversing the internet ecosystem and your network, and how they are delivered to your customers.

Secure your network

Proactively identify and mitigate DDoS threats by feeding Deepfield Defender with a dynamic, up-to-date internet security map.

Drive informed decisions

Leverage actionable insights for superior network intelligence and observability.

Deepfield Cloud Genome®: Real-time internet cloud and service delivery map

Understanding the complex and ever-changing internet ecosystem, as well as how internet content, applications, and services are delivered, is critical for optimizing your network. Deepfield Cloud Genome® is Nokia's proprietary, cloud-based intelligence feed that continuously scans and maps the entire internet, providing you with unparalleled visibility into the global digital supply chain.

Global, real-time mapping

Cloud Genome continuously crawls billions of IPv4 and IPv6 addresses, CDN domains, and network systems to create a dynamic, real-time “service delivery map” of the internet.

Unprecedented visibility

Provides deep insight into how internet applications, services and content are delivered from source to subscriber, including encrypted and CDN traffic invisible to traditional Deep Packet Inspection (DPI).

Granular traffic categorization

Automatically classifies traffic into over 30 categories, allocating IP addresses to content domains, ISPs, and major service providers.

Enhanced network intelligence

Enriches your existing network data (flow, BGP, DNS) with critical context, enabling comprehensive network intelligence and observability.

Technical Specifications

Full specifications for the model

SKU	-

Documentation

Download product documentation and resources

Product Datasheet

Deepfield Genome Datasheet

Product Brochure

Deepfield Genome Brochure

Frequently Asked Questions

Common questions about Nokia Deepfield Genome

What is Deepfield Genome and why is it important?

Deepfield Genome is Nokia’s proprietary, cloud-based intelligence feed that continuously scans and maps the entire internet. It comes in two separate knowledge systems: Cloud Genome (for traffic context and application identification) and Secure Genome (for DDoS threat intelligence). Together, they provide the critical intelligence that makes Deepfield’s analytics and security capabilities vastly more accurate than those of systems relying solely on network data and telemetry.

How does Cloud Genome enable visibility into encrypted traffic?

Cloud Genome continuously crawls billions of IPv4/IPv6 addresses, CDN domains, and network systems to build a real-time service-delivery map of the internet. When correlated with your network telemetry, this map identifies the origin, application, and content category of traffic flows based on their network context—without requiring inspection of encrypted payloads.

What does Secure Genome track and how often is it updated?

Secure Genome is an hourly-updated, cloud-based security-related data feed that tracks the security context of the whole internet - over 5 billion IPv4/IPv6 addresses. It uses 100+ machine learning rules to classify and tag IP addresses, maintaining both allowlists (legitimate traffic that resembles DDoS patterns) and blocklists (compromised, malicious, or insecure sources). This powers Deepfield Defender’s industry-leading detection accuracy.

How does Deepfield Genome differ from third-party threat intelligence feeds?

Unlike generic, aggregated threat feeds, Deepfield Genome is purpose-built for network-level DDoS security and traffic analytics. It is maintained by Nokia’s own internet-scanning infrastructure, provides context specific to ISP and network operator use cases, and is natively integrated into the Deepfield platform, eliminating the integration complexity and latency of bolt-on third-party feeds.

Can Deepfield Genome help reduce false positives in DDoS detection?

Yes—this is one of its primary functions. Modern CDN delivery patterns often resemble DDoS behavior, causing traditional systems to flag legitimate traffic. Secure Genome’s allowlist data, combined with its deep understanding of internet content delivery, enables Deepfield Defender to distinguish CDN surges from actual attacks, dramatically reducing false positives.

Is the Genome-based knowledge shared across Deepfield customers for collective defense?

Yes. Participating customers can join the Nokia Deepfield Global DDoS Threat Alliance (GDTA), a voluntary membership program that enables participants to share DDoS threat intelligence with Nokia. This collective intelligence continuously improves the Secure Genome data feed, providing better protection for all participants against current and emerging threats.

Deepfield Genome

The magic behind Nokia Deepfield Genome: How does Deepfield Cloud Genome work?

Optimized network performance with Deepfield Cloud Intelligence

Enhanced customer experience with Deepfield Subscriber Intelligence