Abstract: In this paper, an intrusion traceback mechanism based on network intrusion detection is proposed. A system model is given and the scheme of constructing an attack link set and ordering the attack links is discussed in detail, and then an algorithm of constructing attack path is put forword. Experiments show that the system can trace back and locate the attack source accurately and real-timely under a controlled environment. Compared with the other existing systems, this system has remarkable improvement of availability, accuracy and scalability.