DoWNet: CNN Detection for Denial-of-Wallet Attacks

• DoWNet is a machine-learning system that converts serverless request data into visual heatmaps, enabling CNN-based detection of Denial-of-Wallet attacks.
• It achieves a reported accuracy of 97.98% in classifying normal against suspicious traffic patterns using simulation and synthetic datasets.
• The approach targets subtle, continuous billing-abuse attacks while addressing limitations such as dependency on high-quality heatmap conversion.

Searching arXiv for papers on DoWNet and related terminology. DoWNet denotes a machine-learning detection system for Denial-of-Wallet attacks in serverless application traffic. In the arXiv review literature, it is described as a CNN-based classification approach that converts request data into visual heatmaps and classifies the resulting patterns as normal or suspicious; the same review reports an accuracy of $97.98\%$ and places DoWNet among the recent AI-based advances in Denial-of-Wallet research (Dorsett et al., 24 Aug 2025).

1. Naming, documentary basis, and scope

The clearest documentary description of DoWNet in the arXiv record appears in "A Comprehensive Review of Denial of Wallet Attacks in Serverless Architectures" (Dorsett et al., 24 Aug 2025). That review identifies DoWNet as a deep-learning method for detecting malicious traffic patterns in Function-as-a-Service environments and attributes it to a 2024 Journal of Cybersecurity paper by D. Kelly, F. G. Glavin, and E. Barrett. Within that source, DoWNet is not presented as a general networking model or a wireless-sensor optimization framework; it is specifically situated in the security literature on billing-abuse detection in serverless systems.

A recurrent source of confusion is nomenclature. "DoWNet" is distinct from the communication-network model DWNet, expanded as "Deeper and Wider Networks," which is a heterogeneous GNN for end-to-end delay and jitter prediction in Digital Twin Networks (Liu et al., 2023). It is also distinct from DOWSN, expanded as "Distributed Optimization for WSN," an island-model framework for online distributed optimization in wireless sensor networks (Iacca, 2018). The similarity of names has led to cross-domain ambiguity, but the serverless-security usage of DoWNet refers to Denial-of-Wallet detection rather than communication-network KPI prediction or mote-level optimization.

2. Threat model and problem setting

DoWNet is designed for Denial-of-Wallet attacks in serverless or Function-as-a-Service settings. The relevant attack objective is financial exhaustion rather than service outage: attackers exploit pay-as-you-go billing and auto-scaling to inflate the victim’s cloud costs without necessarily degrading service availability (Dorsett et al., 24 Aug 2025). This differentiates DoW from conventional DoS or DDoS models, where the dominant aim is resource exhaustion and service disruption.

The review literature organizes the serverless threat landscape into three principal classes:

• Blast DDoW: high-intensity, short-duration invocation bursts that cause immediate cost spikes through rapid auto-scaling.
• Continual Inconspicuous DDoW: low-rate, prolonged invocations that blend with normal traffic and gradually accumulate cost.
• Background Chained DDoW: attacks that exploit chains of interconnected functions to trigger cascading invocations and amplified billing.

Within this taxonomy, DoWNet is most strongly associated with Continual Inconspicuous DDoW. The stated reason is that these attacks are stealthy, prolonged, and difficult to detect using abnormal traffic volumes or invocation-pattern thresholds alone. The review therefore frames DoWNet as a response to the specific problem of identifying low-visibility, cost-amplifying activity that remains operationally plausible.

3. Detection pipeline and representational strategy

The core methodological description of DoWNet is compact but specific. Request data are converted into visual heatmaps, and a convolutional neural network is then applied to classify those heatmap patterns as either normal or suspicious (Dorsett et al., 24 Aug 2025). The review further states that the heatmap representation captures temporal and spatial variations in traffic, which is the rationale for using an image-oriented architecture rather than a purely threshold-based rule set.

At the level recoverable from the review, the pipeline can be summarized as follows:

1. collect request or application-traffic data from a serverless environment;
2. transform that traffic into a heatmap representation;
3. feed the heatmap into a CNN classifier;
4. output whether the observed pattern is legitimate or malicious.

This description establishes DoWNet as a traffic-pattern classifier based on representation learning. A plausible implication is that the method functions as a supervised classifier, because the review discusses labelled datasets as a critical resource for machine-learning systems in this literature. However, the review does not provide the CNN architecture, layer count, kernel sizes, activation functions, optimizer, batch size, loss function, threshold rule, or the exact feature-to-image encoding. It also provides no mathematical formulas specifically tied to DoWNet.

The principal limitation stated explicitly in the review is "heatmap conversion dependency." In direct terms, the system’s effectiveness depends on the quality and suitability of the transformation from raw request traces to visual heatmaps.

4. Data regime, evaluation context, and reported performance

DoWNet is described in a research environment where real-world Denial-of-Wallet datasets are limited or unavailable. The review emphasizes that organizations underreport such incidents and that cloud providers or enterprises do not commonly disclose billing-abuse events. As a result, synthetic data generation and simulation have become foundational to this literature (Dorsett et al., 24 Aug 2025).

The main enabling tool highlighted in that ecosystem is DoWTS, which supports safe experimentation and the generation of labelled datasets. The same review also cites a 2024 dataset-generation paper by Ortega Candel, Mora Gimeno, and Mora Mora. Even so, the review does not explicitly state that DoWNet was trained on DoWTS output, so any direct linkage between that tool and the DoWNet training pipeline remains contextual rather than explicit.

The only explicit quantitative result reported for DoWNet in the review is an accuracy of $97.98\%$. No precision, recall, $F_1$, ROC-AUC, false-positive rate, inference latency, throughput, train/test split, class balance, or runtime overhead is provided there. Consequently, the empirical picture available from the arXiv source is narrow: the method is presented as accurate, but not fully characterized along the broader set of evaluation dimensions typically expected in operational security systems.

This suggests a cautious interpretation. Reported performance is promising, but the absence of detailed evaluation metadata and the field-wide reliance on synthetic labelled traffic constrain any strong claim about out-of-distribution generalization to production serverless workloads.

5. Position relative to adjacent detection systems and similarly named models

Within the Denial-of-Wallet literature, DoWNet is positioned alongside Gringotts as a notable ML/AI-based detection mechanism (Dorsett et al., 24 Aug 2025). The contrast between the two is methodologically sharp. Gringotts is described as monitoring internal performance metrics such as CPU usage, memory allocation, and function execution duration, then applying Mahalanobis distance for real-time anomaly detection; the same source reports a detection delay of $1.86$ seconds, an accuracy exceeding $95.75\%$, and less than $1.1\%$ performance overhead. DoWNet, by contrast, is framed as a CNN classifier over temporal-spatial heatmaps of invocation traffic. The comparative implication is not that one supersedes the other, but that they occupy different points in the design space: metrics-driven anomaly detection versus traffic-pattern classification.

The distinction from similarly named systems in other domains is equally important. DWNet in "Deeper and Wider Networks for Performance Metrics Prediction in Communication Networks" is a heterogeneous GNN that models link nodes and path nodes to predict path-level delay and jitter in Digital Twin Networks (Liu et al., 2023). DOWSN in "Distributed optimization in wireless sensor networks: an island-model framework" is a lightweight distributed optimization infrastructure in which each wireless sensor node runs a computationally cheap single-solution optimizer and exchanges promising solutions with neighbors (Iacca, 2018). Neither method addresses Denial-of-Wallet attacks, serverless application traffic, or CNN-based heatmap classification.

6. Limitations, open problems, and research outlook

The review literature identifies several unresolved issues that shape how DoWNet should be understood (Dorsett et al., 24 Aug 2025). The most immediate is the lack of real-world DoW datasets. Synthetic datasets partially mitigate this constraint, but the same review warns that they cannot fully capture the variability and noise present in real-world traffic. That limitation is especially salient for a representation-dependent method such as DoWNet, whose classifier operates over engineered heatmaps rather than directly over raw production telemetry.

Additional unresolved issues include evolving attacker tactics, the need for adaptive billing models, and practical deployment concerns such as scalability, cost, and false-positive management. The review explicitly identifies future work on refining machine-learning algorithms to minimise false positives. It also treats detection as only one layer of defense: billing abuse in serverless systems raises governance and platform-design questions that anomaly classifiers alone do not solve.

In historical terms, DoWNet is presented as part of a maturing phase in Denial-of-Wallet research. The trajectory described in the literature runs from early conceptualization, to attack taxonomy, to simulation and dataset-generation tools, and then to AI-assisted detection. On that reading, DoWNet’s significance lies less in a fully specified operational stack than in its representation of a methodological shift: from volume-based or rule-based detection toward learned recognition of subtle temporal-spatial traffic structure in financially motivated serverless attacks.