###### Abstract
\begin{table}
\begin{tabular}{p{42.7 pt} p{113.8 pt} p{113.8 pt} p{113.8 pt}} \hline \hline  & \multicolumn{2}{c}{**Features**} & \multicolumn{1}{c}{**Limitations**} \\ \cline{2-4}  & **Data Collection** & & **Route Reconstruction** & \\ \hline  & & \(\bullet\) & The attack path & \\  & & & reconstruction is based & \\  & & & on collected packets. & \\ ingress filtering & Each router marks all traversing packets for information flows (heavy loading) & \(\bullet\) & Route reconstruction process is started from victim via upstream links and recursively repeat until the true of attack source is located. & When IP addresses are used through a proxy or a spoofed IP address, which does not identify a specific user within that pool of users. \\  & & & & \\  & & & attack source is located. & \\ \hline  & & \(\bullet\) & The attack path & \\  & Each router marks packets with some probability \(p\) for information flows to reduce the consumption of computational resources & \(\bullet\) & & Loss of marking information. \\  & & & on collected packet & \\  & & & digests. & \\  & & & Route reconstruction process is same as that of ingress filtering. & \\ \hline  & & & & \\  & When forwarding packets, routers can generate a Traceback message based on icmp command that is sent along to the destination with a low probability. With enough traceback messages from enough routers along the path, the traffic source and path can be determined. & The attack path reconstruction is based on traceback messages, which recursively repeat until the true of attack source is located based on traversing IPs. & Multiple attack sources will generate multiple attack paths that make traceback more difficult to locate the original attack sources. \\ \hline  & & & & \\  & Using an advanced marking mechanism with ingress edge routers and traversing routers. & The same as that of PPM router is sensitive to router subversion because it is critical that marks, once placed in packets, are not over written. & \\ \hline \hline \end{tabular} (*) Basically, iTrace frequently does not work because the icmp command is inhibited by servers and managers to protect from malicious scans.  
\end{table} 
Table 1: Techniques for IP traceback. consideration. Optimised route-searching algorithms, including the genetic algorithm (GA), particle swarm optimisation (PSO) [11; 12; 13; 14], artificial neural networks, simulated annealing, tabu search, evolutionary algorithms and ant colony optimisation algorithm (ACO), are commonly used for reconstructing the attack path. PSO is an artificial intelligence technique that can be used to solve a diverse array of combinational optimisation problems, including vehicle routing problems (VRPs) [15], wireless sensor network (WSN) problems [16] and network threats [17]. We found that PSO is a simple algorithm suitable for solving the IPTBK problem in future high-speed networks and that a variant of PSO outperforms existing optimised route-searching models. The PSO has a high convergence speed for IPTBK but easily falls into local optimal solutions. Thus, particles mistakenly fly toward a local optimum without exploring other regions of the search space. Consequently, the algorithm is trapped in the local optimum and converges prematurely [14]. A more promising approach is to optimise the search for multiple attack sources with different subswarms of particles to enlarge the search space, i.e., multiswarm PSO (MSPSO). The MSPSO is a variant of particle swarm optimisation based on the use of multiple subswarms instead of one swarm. The general approach in multiswarm optimisation is that each subswarm focuses on a specific region while a specific diversification method decides where and when to launch the subswarms. The multiswarm design is especially fitted for the optimisation on multimodal problems, where multiple (local) optima exist. [18]  
Therefore, we adopted the multi-subswarm strategy to expand the search scope of the particle swarm and increase the search efficiency in large networks.