DoWTS: Denial-of-Wallet Test Simulator

• DoWTS is a simulator that emulates serverless platforms and pay-as-you-go billing to safely generate labeled datasets for Denial-of-Wallet research.
• It replicates diverse attack scenarios—Blast, Continual Inconspicuous, and Background Chained—to test cost-centric defenses in a controlled testbed.
• The platform supports machine-learning detection by providing reproducible synthetic data with detailed cost metrics and precise ground-truth labels.

DoWTS, short for Denial-of-Wallet Test Simulator, is a simulation environment for Denial of Wallet research in serverless and Function-as-a-Service environments. It is described as a simulator that emulates serverless/FaaS platforms and their pay-as-you-go billing, a synthetic data generator tailored to DoW attacks, and a safe, controllable testbed for experimenting with attack scenarios without incurring real cloud costs or risking production systems. Within the serverless security literature, it is positioned as a response to three persistent obstacles in empirical DoW research: the expense of conducting attacks on real cloud platforms, the ethical and operational risks of live experimentation, and the absence of detailed internal cloud metrics and ground-truth labels for attack versus benign activity (Dorsett et al., 24 Aug 2025).

1. Definition and research motivation

Kelly et al. (2023) introduced DoWTS in "DoWTS – Denial-of-Wallet Test Simulator: Synthetic data generation for preemptive defence", as reported in the review literature (Dorsett et al., 24 Aug 2025). In that account, DoWTS exists because realistic experimentation with Denial of Wallet attacks on actual serverless platforms such as AWS Lambda, Azure Functions, and Google Cloud Functions is expensive, ethically and operationally risky, and difficult to measure precisely.

The core problem addressed by DoWTS is specific to serverless billing semantics. Denial of Wallet differs from conventional Denial of Service in that the attacker seeks to escalate the victim’s bill rather than render the service unavailable. This shifts the security objective from resource exhaustion to financial impact under continued service operation. A plausible implication is that any research program on DoW requires instrumentation that can represent traffic, scaling, invocation chains, and billing simultaneously, while preserving attack labels and scenario control. DoWTS is presented as precisely such a platform.

The review also emphasizes that real-world DoW data is almost nonexistent. Organizations rarely share cost-attack incidents, and many do not recognize DoW when it occurs. This makes simulation foundational rather than auxiliary. Without a simulator that can produce controlled, labeled traces, much of DoW detection research—particularly ML-based research—would have no usable training or evaluation corpus (Dorsett et al., 24 Aug 2025).

2. Functional architecture and cost model

The review does not reproduce a full internal architecture diagram, but it specifies the principal functional roles clearly enough to identify the system’s conceptual structure. DoWTS includes a serverless platform model, a traffic and attack scenario generator, a cost and metrics logger, a labeling and dataset exporter, and an experiment controller. In conceptual form, the pipeline is:

Traffic Generator → FaaS Simulator + Billing Model → Metrics/Cost Logger → Dataset Exporter → ML Pipeline (Dorsett et al., 24 Aug 2025)

The serverless platform model abstracts a FaaS environment comprising stateless functions, event triggers, and auto-scaling. It models function behavior under bursts, steady rates, and chained invocations, and it implements a simplified billing engine reflecting pay-as-you-go charging. The review gives a typical cost model consistent with what DoWTS must emulate:

$$C = \sum_{i=1}^{N} \left(c_\text{inv} \cdot n_i + c_\text{dur} \cdot t_i\right)$$

where $N$ is the number of distinct time windows, tenants, or functions, $n_i$ is the number of invocations in unit $i$, $t_i$ is the total duration consumed in unit $i$, $c_\text{inv}$ is the per-invocation cost, and $c_\text{dur}$ is the per-duration cost. In this formulation, simulated traffic is translated directly into financial impact.

The metrics subsystem records per-invocation attributes such as timestamp, function ID, and duration; per-interval metrics such as request rate, concurrency, and cost; and cumulative cost and cost rate over time. A typical derived metric is the cost rate

$r(t) = \frac{\Delta C(t)}{\Delta t}$

which distinguishes sharp spikes from slow drifts in economic burden. This design ties observability to billing dynamics rather than to availability degradation, which is central to DoW as a threat model (Dorsett et al., 24 Aug 2025).

3. Attack taxonomy and scenario modeling

DoWTS is designed to instantiate three canonical DoW attack families highlighted in the review: Blast DDoW, Continual Inconspicuous DDoW, and Background Chained DDoW (Dorsett et al., 24 Aug 2025). These categories matter because they differ not only in traffic morphology but also in detectability, cost accumulation profile, and required defensive instrumentation.

For Blast DDoW, the pattern is a very high request rate over a short interval, with the goal of inducing an immediate cost spike by forcing rapid auto-scaling. In simulation terms, the traffic generator sets a burst arrival rate, the FaaS simulator instantiates many concurrent function instances, and the billing engine records a sharp increase in both cumulative cost $C$ and cost rate $N$0. The review expresses the intensity relation conceptually as $N$1 over a limited interval.

For Continual Inconspicuous DDoW, the pattern is a low, steady request rate sustained over a long period. Its purpose is stealthy cost accumulation rather than visible disruption. The review describes this with a modest Poisson arrival rate close to background load:

$N$2

with $N$3, but sustained for days or weeks. In DoWTS, the request rate can be constrained just inside normal thresholds so that auto-scaling need not spike while cumulative cost drifts upward.

For Background Chained DDoW, a single external event triggers a cascade of internal function invocations. The review conceptualizes this as a function graph

$N$4

where one call to $N$5 causes many downstream invocations. The attack objective is cost multiplication through internal orchestration, often with the origin obscured by legitimate workflows. DoWTS models function dependencies explicitly and logs the chain structure, so internal invocation costs remain attributable in the synthetic dataset.

Across these categories, DoWTS can mix benign workloads with attack traffic, including background traffic, normal seasonal peaks, and overlaid attack traces. This is significant because the research problem is not merely generating adversarial traffic but generating adversarial traffic that remains analytically useful under realistic workload superposition (Dorsett et al., 24 Aug 2025).

4. Synthetic data generation and labeled observability

The review identifies synthetic data generation as the primary research value of DoWTS (Dorsett et al., 24 Aug 2025). The simulator creates labeled datasets that distinguish attack from benign events, assign specific attack categories, and capture cost metrics both per invocation and over time. This labeled observability addresses a structural problem in DoW research: in live cloud telemetry, ground truth is generally unavailable.

The exported datasets may include per-request or per-invocation fields such as timestamp $N$6, function ID, duration $N$7, memory size, cost contribution $N$8, and an attack label $N$9. At the time-window level, the review lists features such as the number of invocations $n_i$0, aggregate duration $n_i$1, cost $n_i$2, cost rate $n_i$3, concurrency, and derived anomaly features such as z-scores and residuals from expected usage. This feature schema is well aligned with both classical anomaly detection and representation-learning pipelines.

The labeling subsystem assigns attack versus benign, specific attack type, and scenario identifiers. Because every event is generated within a controlled scenario, labels remain exact rather than inferred. This matters for evaluation metrics such as precision, recall, and F1-score, since those metrics are only meaningful when the positive class is known with certainty. A plausible implication is that DoWTS serves not merely as a simulator but as a ground-truth oracle for cost-centric cyberattack research.

The review further positions DoWTS as a prerequisite for dataset-centric works, including synthetic dataset generation for detection studies and training corpora for serverless DoW classifiers. In that sense, the simulator is “upstream” infrastructure: it does not only generate attack traffic, but also standardizes the empirical substrate on which downstream detection claims are made (Dorsett et al., 24 Aug 2025).

5. Integration with machine-learning detection systems

Within the review, DoWTS is presented as the upstream simulator feeding ML-based DoW detection systems such as Gringotts, DoWNet, and FODWNN-DoWAD (Dorsett et al., 24 Aug 2025). The pipeline begins with scenario configuration in DoWTS, proceeds through logging and feature extraction, and ends with training, validation, benchmarking, and mitigation analysis.

For behavioral anomaly detection systems such as Gringotts, DoWTS logs function-level performance metrics and cost metrics that can be assembled into vectors of the form

$n_i$4

The review states that Gringotts uses Mahalanobis distance for real-time anomaly detection:

$n_i$5

where $n_i$6 and $n_i$7 are the mean and covariance of normal behavior. In this context, DoWTS supplies both the baseline normal data and the anomalous attack traces required to tune thresholds and estimate false-positive behavior.

For deep-learning systems such as DoWNet, the review describes aggregation into heatmaps encoding temporal and functional dimensions, with rows corresponding to time bins, columns to functions or metric types, and pixel values to request counts, cost, or related statistics. These images are then passed to a CNN classifier. Here DoWTS provides the temporal regularity and label integrity necessary for supervised image-based classification.

The review also notes that benchmark studies can evaluate not only detector accuracy but also detection delay and overhead, and can compare system behavior under different mitigation strategies such as rate limits, billing caps, and cost alerts. DoWTS therefore functions as an experimental harness in addition to being a data generator. This suggests that its role in the literature is methodological as much as operational: it standardizes scenario generation, data logging, and mitigation assessment within a single repeatable framework (Dorsett et al., 24 Aug 2025).

6. Strengths, limitations, and projected development

The review attributes several strengths to DoWTS. It offers reproducibility, because identical random seeds can reproduce identical datasets; controllability, because researchers can tune attack parameters, platform configurations, and mitigation strategies precisely; safety and zero cost, because experiments do not generate real cloud charges; coverage, because the simulator can model Blast, Continual Inconspicuous, and Background Chained attacks; and labeled data, because all events carry clean ground-truth labels (Dorsett et al., 24 Aug 2025).

At the same time, the review identifies a clear realism gap. Synthetic traffic and simplified billing may not fully match production cloud behavior, including complex pricing, throttling, noisy workloads, and multi-tenant interference. The current billing abstraction may omit tiered pricing, free quotas, burst credits, and provider-specific nuances. The lack of real-world traces further limits the ability of DoWTS to capture unanticipated patterns from actual users and attackers. These are not implementation flaws so much as structural constraints of simulation-centric research.

The future directions listed in the review follow directly from these limitations. They include more realistic billing models with adaptive pricing, tiered limits, and provider-specific behavior; tighter integration with provider telemetry and policy logs; larger-scale experimentation covering multi-tenant environments, cross-region attacks, and distributed coordinated campaigns; and development toward an open-source ecosystem for shared DoW research tooling. A plausible implication is that the long-term value of DoWTS lies in becoming a common benchmark substrate for financially aware cybersecurity in pay-as-you-go cloud environments, rather than remaining a single-study simulator (Dorsett et al., 24 Aug 2025).

7. Position in the Denial-of-Wallet literature and terminological ambiguity

Within the broader Denial-of-Wallet literature, DoWTS is presented as part of an evolutionary sequence: early conceptual awareness of cost-based abuse, subsequent attack classification, then simulation and data generation, followed by detection and mitigation systems (Dorsett et al., 24 Aug 2025). The review explicitly treats simulation as the critical gap that enabled empirical, reproducible work in a domain otherwise constrained by absent incident disclosure and lack of ground truth. In that framing, DoWTS is central to moving DoW research from theory to practice because it quantifies financial impact, supports rigorous benchmarking, and enables the testing of cost-aware defenses.

The term itself is not entirely unique across research contexts. In dialogue systems, DoTS stands for Domain State Tracking for a Simplified Dialogue System, and one description states that the query “DoWTS” is almost certainly a typographical variant or mis-remembered name referring to DoTS (Jeon et al., 2021). In optical soft-matter research, Diffusing-Wave Spectroscopy (DWS) is described as “sometimes abbreviated DoWTS” in a discussion of DWS in standard dynamic light scattering setups with cylindrical sample cells (Fahimi et al., 2015). This suggests a terminological ambiguity at the string level, but not a conceptual overlap. In serverless security, DoWTS specifically denotes the Denial-of-Wallet Test Simulator and its associated role in synthetic data generation, attack emulation, and preemptive defense research (Dorsett et al., 24 Aug 2025).