Abstract:IP spoofing, as a trick that can conceal the attackers' location, bypass the attack prevention, gather the confidential information and enhance the destructive power, has been prevalent in the current network attacks to further bring about severe damage to the Internet. For this reason, the IP traceback technology that can trace an individual attack packet to its origin and then disclose the attacker identity has been extensively researched and developed. Although the existing research can achieve the purpose of tracking to some extent, they also suffer from the following disadvantages:the leakage of topology privacy, the lack of scalability and the higher processing overhead. To tackle those issues, this paper proposes a dynamically scalable and efficient approach for single-packet IP traceback, termed as SEE. SEE first designs the hierarchical traceback system architecture to weaken the traceability relationships among the autonomous domains, and then employs the intra-AS traceback network construction based on OSPF, the traceback address assignment based on edge-coloring, path fingerprint establishment and extraction based on link-binding, the anti-spoofing alliance establishment based on peer-peer relationship and the stable transition process from intra AS to inter AS to improve the scalability and cut down the processing overhead. Extensive mathematical analysis and simulations are performed to evaluate our approach. The results show that the proposed approach significantly out per forms the prior approaches in terms of the scalability and high-efficiency.