1. A method comprising: receiving data collected by a network for calls that are to be routed by the network to a call center; detecting, by a network device, an event based on the received data; determining a confidence level, for the event, that the event is a denial-of-service attack; identifying a plurality of calls associated with the event; dropping one or more calls, of the plurality of calls associated with the event, when the confidence level is above a first threshold; testing at least one call, of the plurality of calls associated with the event, when the confidence level is less than or equal to the first threshold and greater than a second threshold; and routing the plurality of calls associated with the event to the call center when the confidence level is less than or equal to the second threshold.