Using equivalence-checking to verify robustness to denial of service