After a long time study in DDoS attack, we find the Secure Overlay Services (SOS) architecture is one of the best ways to protect our service. There is no other reason but the ability to provide reliable communication between authorized clients and a protected target under on-going DDoS attacks. The SOS architecture defines a set of overlay nodes arranged in four function groups that controls access to the protected target. Although, the architecture is novel and works well under simple congestion based attacks, we observe that when the attacker uses same malicious traffic raid the SOS nodes with some kind of sleight, the SOS system can not response this kind of trick, and somehow it has already threaten the reliability of the Secure overlay Service. We propose a scheme to enhance the secure overlay services (SOS) against the intelligent DDoS attack both from the mechanisms and detection algorithm.