Abstract: A game-theoretic analysis of security interactive behavior is performed between the DoS attacker and the defender under incomplete information. The dilemma of defense is discussed and the underlying fact is revealed that asymmetric nature of information and absence of server-user coalition lead to the dilemma. An improved DoS game is performed which can acquire new equilibrium through service hopping tactic, increasing service type and establishing the server-user coalition. Theoretical analysis shows that service hopping tactic is active and efficient for DoS defense. It is fundamental and important for service hopping mechanism and DoS defense.