Open by design, targeted by malicious intent: DDoS security for research and education networks

Research and education networks were built to move knowledge, not to stop traffic. That openness makes them a dependable target for distributed denial-of-service (DDoS) attacks. The threat is the one every operator faces; the terrain is not.

Same storm, every shore

DDoS remains Europe’s most common cyber incident, making up 51% of the incidents ENISA recorded in 2025, mostly low-impact campaigns timed to political events. In 2025, terabit-class floods hit operator networks daily rather than every five days, and most ended within five minutes, faster than any manual response.

The engine is the botnet, and it keeps growing. Nokia Deepfield and Comcast researchers found daily active DDoS botnet endpoints rising from about one million in summer 2025 to more than eight million by June 2026, fed by a residential proxy ecosystem of over 100 million devices.

Research and education (R&E) networks share the storm. Jisc, the UK’s national research and education network (NREN), counted 418 DDoS attacks in 2025, fewer than in 2024 but more sophisticated. What differs is the network the storm lands on.

A user base like no other

Through GÉANT, 43 NRENs connect more than 50 million researchers, students and educators in Europe. Few operators serve a population so young, curious and transient, renewed every autumn with new devices. Some users have the skills to launch an attack; a few have the motive. In the UK, attacks have risen at enrollment and clustered in term time. At Rutgers, an undergraduate used DDoS to delay course registration and a calculus exam, then went on to co-author the Mirai botnet.

Not-for-profit does not mean “insensitive to downtime.” Those attacks took Rutgers’ coursework portal offline for days at a time, and the university put its response costs at $8.6 million. Budgets, meanwhile, are thin: only 37% of UK further education colleges have dedicated cyber security staff.

Critical infrastructure in the larger sense

An NREN is rarely just a campus network. In May 2021, an attack saturated Belnet, Belgium’s NREN, disrupting about 200 organizations, from parliament committees to vaccination booking. One canceled session was a hearing on China’s treatment of Uyghurs; an MP noted the timing, though the attackers were not identified. Jisc calls the IT behind UK research critical national infrastructure.

That status makes R&E networks symbolic targets. Europe’s 2025 hacktivist campaigns tracked elections, protests and support for Ukraine. In 2024, a group calling itself Anonymous Sudan claimed attacks on Cambridge and Manchester, citing UK foreign policy. In July 2025, Operation Eastwood disrupted more than 100 systems used by the pro-Russian NoName057(16). Geopolitics is not behind every campus attack, but when it is, the impact can be national.

R&E networks and DDoS in the news, 2025–2026

The attack comes from within

Enterprises build walls; R&E networks build doorways. Academic freedom, decentralized IT and bring-your-own-device habits leave many campuses with flatter internal security than a comparable enterprise. Research needs push the same way: the Science DMZ design places high-performance data transfer systems at the campus edge, with security tuned for science rather than enterprise computing.

So, the botnet may already be on campus. Today’s largest attacks come from cheap, poorly secured routers, video recorders and Android TV boxes on gigabit links, the same devices found in residence halls, labs and smart buildings. One four-day UK campus attack was traced to a hall of residence, where one gamer was targeting another. A compromised research server on a 100 Gbps link is a far bigger weapon.

For an NREN, the DDoS protection required today operates in both directions: shielding members from DDoS attacks and identifying the sources of those attacks.

Seeing outside and inside

An NREN’s vantage point is its advantage. A single campus sees only its own pipe, and once that fills, it can do little. In January 2025, attack traffic hit SURF at a point where it could not be filtered properly, and congestion spread beyond the targeted region. In May 2026, CENIC filtered an attack upstream of UC San Diego, while risking a brief outage.

Seeing outside your R&E network means knowing which addresses are botnet nodes, reflectors or residential proxies, so a flood can be recognized in seconds. Seeing inside means processing large volumes of telemetry from routers already carrying traffic at every peering, transit and member edge. Only then can an NREN tell the target from the source, and an attack from a genomics lab doing its job. At tens of terabits per second, that picture moves too fast for people alone.

AI on both sides of the wire

Attackers already use AI. Nokia Deepfield researchers found a reference to an AI coding tool inside botnet malware, and industrial-scale AI scraping is driving demand for the residential proxies that attackers now weaponize.

Defenders need it just as much. Picking an attack out of legitimate research flows of tens or hundreds of gigabits, then choosing a precise filter in seconds, is work for machine learning trained on each network’s normal behavior and guided by analysts who know why an anomaly matters.

AI infrastructure is also now part of the R&E estate. GÉANT and European NRENs are linking EuroHPC supercomputers and AI Factories at terabit speeds. Those sites hold scarce GPU time and valuable data, and they are only as available as the networks that reach them.

Conclusion: protection is a team sport

R&E networks helped shape the internet’s culture of openness. Modern DDoS protection should build on that culture, not fight it.

That means making the network itself the first line of defense: detecting and filtering at routers already carrying traffic and calling on additional advanced defense measures (such as application-layer protection) for the most complex attacks. It means automation that acts in seconds, bidirectional visibility, and security experts who understand the science on the wire.

Above all, it means sharing. The GÉANT Security Operations Centre already helps NRENs and their security teams handle incidents, and Jisc passes DDoS threat intelligence to its members. Industry researchers can add a wider lens: Nokia Deepfield Emergency Response Team (ERT), for example, publishes its botnet findings and indicators openly. Science advances by sharing results. So does defense against network threats.

Find out more

On 20th October Nokia will be presenting their Deepfield Defender which protects national and international research & education networks against today’s fastest-evolving DDoS attacks.