One of the easiest ways to detect DOS attacks is by using netflow.
There are very good applications out there that can do signature recognition on those netflow records in order to identify whether flows are legitimate or whether they are part of a potential DOS flow.
The application can then use technologies such as FlowSpec to catch those identified flows and send it over to a cleanser or DPI for further analysis and if deemed to be truly malicious flowspec can be used to completely drop it at the borders and possible do something in terms of advertisement to protect the border links.
A9K itself, or XR for that matter, if target is rather nicely protected already via LPTS, so there is little that you need to do in XR to protect the node itself. But in order to mitigate "transient" DOS attacks, netflow would be the first thing to leverage.
LPTS, Netflow and Flowspec are nicely documented with some articles on the support forums in the documentation tab, think you can find them easily, if not send us a note.
cheers
xander
