Challenges to automated attack traceback

Ideally, a traceback system would identify the human responsible for the attack. In this discussion, however, we limit traceback to determining the computer host that is the source of an attack. Once a traceback system identifies an attacker host, investigators can apply traditional methods of crime investigation or intelligence gathering to assign responsibility to an individual. To analyze the traceback problem, we must understand how attackers hide their identity. Most often, they compromise the two components of identity on the Internet.