Abstract: IP traceback is a new technique to defeat the denial of service attacks in Internet. On the basis of analyzing the previous methods,a new algorithm scheme called ingress address marking （IAM） is presented,which is focused on the attack ingress instead of the whole attack path. In the marking procedure,the ingress router converts its IP address into an n -tuple and embeds one element of the tuple into the ID field of the forwarding packet. In the recovery procedure,the victim extracts the marking information from the attack packets and recovers the IP address of the ingress router. The necessary mathematical analyses based on the set algebra and the probability theory are provided. Two important techniques to improve the recovery performance,i.e.,the correlation function and the redundant decomposition are used and discussed. The theoretical deduction of the recovery ratio λ is provided in detail and a practical scheme is given. Some simulation experiments are conducted in a comprehensive network environment. The practical results coincide well with the theoretical estimations. The advantages,efficiencies,and complexity of the scheme are discussed. It is shown that IAM is better than the previous IP traceback methods and finally conclusions and expectations are given.