Detecting Denial of Wallet Attacks in Serverless Computing: A Neural ODE-LTC Approach

The serverless Function-as-a-Service (FaaS) paradigm offers a fine granularity for the pay-per-use billing model, where users are charged based on the actual function execution time and do not have to pay for idle resources. Thereby, FaaS in a serverless environment brings the promise that it completely abstracts infrastructure management. This allows the developers to focus solely on application development. On the other hand, the serverless applications, being deployed as a dense web of FaaS artifacts, increase the attack surface. This makes the FaaS paradigm susceptible to financial exhaustion attacks, also known as Denial of Wallet (DoW), where the attacker attempts to inflate the usage bill by illegitimate escalation of resource consumption. This paper proposes a robust detection method for DoW attacks on the serverless platform using the Neural Ordinary Differential Equation (ODE) with a Liquid Time Constant (LTC). The experiments, conducted on a benchmark dataset, represent real-world attack scenarios, compared with baseline methods. The proposed method outperforms the baselines for multiple evaluation metrics, proving its effectiveness in precision-critical scenarios.