DDoS attack is one of the major threads of todaypsilas Internet. Defense against spoofed IP addresses is an efficiency way to mitigate the damage caused by DDoS attacks. HCF proposed by Haining Wang et al. can throttle most attacks while the filter being trained entirely. However, due to the growing of applications current network carried, the network trafficpsilas behavior has taken much more changes. It makes the training of HCF much more difficult to be entirely so the effectiveness of HCF decreased seriously. In this paper, a lightweight online method for mitigating DDoS attacks based on TTL bucket and host threatening index is proposed. Experimental results show that the proposed method significantly reduced false negative rate cause by high dynamic traffics.