###### Abstract  
Network intrusion detection systems that employ existing IP traceback (IPTBK) algorithms are generally unable to trace multiple attack sources. In these systems, the sampling mechanism only screens parts of the routing information, which leads to the tracing of the neighbour of the attack source and fails to identify the attack source. Theoretically, the multimodal optimisation problem cannot be solved for all of its multiple solutions using the traditional particle swarm optimisation (PSO) algorithm. The present study focuses on the use of multiple-swarm PSO (MSPSO) for recursively tracing attack paths back to a botnet's multiple attack sources using the subgroup strategy. Specifically, the fitness of each path was calculated using a quasi-Newton gradient descent method to confirm the crucial path for successfully tracing the attack source. For multimodal optimisation problems, the MSPSO algorithm achieves an effective balance between individual particle exploitation and multiswarm exploration when premature convergence occurs. Thus, this algorithm accurately traces multiple attack sources. To verify the effectiveness of identifying Distributed Denial-Of-Service (DDoS) control centres, networks with various topology sizes (32-64 nodes) were simulated using ns-3 with the Boston University Representative Internet Topology Generator. The proposed A* search algorithm (minimal cost pathfinding algorithm) and MSPSO were used to identify the sources of simulated DDoS attacks. Compared with commonly available systems, the MSPSO algorithm performs better in multimodal optimisation problems, improves the accuracy of traceability analysis and reduces false responses for IPTBK problems. * 2021 22 January 2021 26 January 2021 26 January 202  
legitimate requests cannot be sent to the victim's machine. A resource attack aims to send packets that misuse network protocols or malformed packets that tie up network resources so that resources are not available to legitimate users [2]. A botnet is a group of computers that is compromised by malware sent from and manipulated by a herder. After malware has been successfully installed in a victimised system, the victimised system becomes a zombie (compromised host) and will accept remote commands from the herder. Typically, botnet C&Cs play a vital role in the operations conducted by cybercriminals who infected machines to send spam, send ransomware, launch DDoS attacks, commit e-banking fraud, commit click fraud or mine cryptocurrencies, such as Bitcoin. According to statistical reports from Spamhaus Malware Labs, systems identified and blocked 17,602 botnet C&C servers hosted on 1210 different networks worldwide in 2019. The 2019 figures represent a 71.5% increase from the number of botnet C&Cs observed in 2018 [3]. The problem of identifying the origin of an attack over the internet to enable the flooding controls for web service servers is referred to as the IP traceback (IPTBK) problem. A typical botnet uses one to many control links between its C&C server and its victims. Two main types of bots are used in DDoS attacks: IRC and peer-to-peer bots. As illustrated in Figure 1, attack path reconstruction is a typical IPTBK technique used against IRC bot attacks. As displayed in Figure 1, attackers use zombies controlled through their C&C server to generate a high volume of packets for flooding the victim's network over the internet so that legitimate requests cannot access the service. In practice, solving the IPTBK problem entails a trade-off between the number of routing packets collected and the accuracy of the traceback. Typically, the solution to the aforementioned problem involves the following crucial steps: (i) Collecting sufficient route information to determine all the possible routes between the attacker and the victim for given constraints on the quantity of routing packets collected and the computational time and (ii) identifying the minimum size of the evidence for identifying more than 95% of the attack sources.