由于分布式拒绝服务DDoS（Distributed Denial of Service）具有控制多台机器发动代理攻击的特点，因此，寻找真正的DDoS攻击源依然是互联网安全的一项亟待解决的难题。本文提出一种智能蜂群算法IBC（intelligent bee colony）用于进行DDoS攻击源追踪。与其他DDoS攻击源追踪算法相比，该算法基于路由器流量进行追踪，无需路由器进行系统升级。同时，算法能够实时地追踪到攻击源，且不需要额外的存储空间。模拟实验中，我们引入了两个真实的网络vBNS (very high-speed Backbone Network Service) 与 OS3E (Open Science, Scholarship and Services Exchange)。实验结果显示，当直接攻击源数量与发送的数据量发生变化时，智能蜂群算法都能够追踪至大部分的直接攻击源，并定位最终攻击源。部分路由器信息缺失也不会对追踪结果造成太大影响。

As a DDoS (Distributed Denial of service ) attacker use plenty of other computers to accomplish its attack, to find out the real attacker is one of the most serious security problems. In this paper, an algorithm called intelligent bee colony (IBC) is proposed for DDoS attacker traceback. Compared with other algorithms, IBC is based on flow and it doesn’t require the routers system to be changed. Besides, this method can accomplish a real-time traceback, without the need of extra memory. In the simulate experiments, we import two real networks vBNS (very high-speed Backbone Network Service) and OS3E (Open Science, Scholarship and Services Exchange). The results show that even the number or the data amount of direct attacker various, IBC can always trace back to most direct attackers, and locate the final attacker. The lack of some routers flow information won’t have too much influence on the results.