The key advantage of the proposed method is its lightweight. It can identify a group of hosts associated with DoS activities without analyzing packet content, packet size, or packet inter-arrival time. Furthermore, our technique can detect other network anomaly if they pose similar behaviors as these DoS attacks