Distributed Denial of Service (DDoS) attack is one of the most vulnerable threats that affect the client and server communication. The client can access services from server through different proxy server. Attackers can use this web proxy as an attacking tool by sending malicious requests to server through proxy. Defending such attacks by Web proxies is a tedious task. Here proposes a defending mechanism to resist web proxy-based DDoS attacks using the concept of Temporal and Spatial Locality (TSL) to access the behavior features of proxy to server traffic with the help of Hidden Semi Markov Model (HsMM). The existing methodology is based only on the proxy server behavior. In such cases, along with an attacking client the legitimate users also need to suffer with Denial of Service (DoS). A soft control scheme is proposed here, which is an attack response method that converts suspicious traffic into normal by behavior reshaping instead of discarding it. A Threshold Based Attack Detection (TBAD) algorithm for detecting actual attacking client rather than the innocent proxy by modifying the http protocol is included in this work. A session hijacking handler method is also implemented to find the session hijacking attacks. Thus, by the revised system a server can serve maximum legitimate users.