GenieATM is a network-wide traffic analysis and DDoS protection platform designed for ISPs, MNOs, IDCs, and enterprises requiring carrier-grade network visibility and security. It is built on a distributed architecture with centralized control, consisting of a Controller for configuration management and report generation, and Collectors for flow data ingestion. This design supports both centralized and distributed deployment models, scaling to networks of any size. Key functional areas include: - Synthetic Traffic Mining: Correlates flow records, SNMP, and BGP data to produce multi-dimensional traffic analyses including peering analysis, traffic matrix analysis between sub-networks and neighbors, and attribute distribution reports (application, protocol/port, ToS, packet size). - DDoS Detection: Uses machine-learned traffic pattern thresholds to detect DDoS attacks (including carpet bombing), zero-day anomalies, interface anomalies (throughput, CRC errors, multicast/broadcast), and BGP routing instability (hijacks, unexpected route changes). - Traffic Snapshot: Inspects real-time and historical flow records to support network-wide troubleshooting. Provides Top-N analyses and drill-down capabilities to identify attack sources without per-link packet capture. - Mitigation: Supports automated policy derivation via BGP FlowSpec, Remote Black Hole Routing, and integration with third-party mitigation appliances. Sends alerts via Email, SNMP Trap, Syslog, or Webhook. Preserves raw anomaly traffic for forensic use. Multi-tenancy is supported across detection, mitigation, and reporting functions. The platform also supports managed service delivery by enabling service providers to offer traffic analysis and DDoS defense as value-added services.