Abstract: To defend against DDoS attacks on Internet, a new scheme called Ingress Address Marking (IAM) within an Autonomous System (AS) is proposed, with which the IP addresses of the ingress can be embedded into the forwarding packets. A victim can traceback the addresses of the attack ingress in a low complexity by analyzing the marking information. Besides the physical model, the mathematical formulation of false positive ratio and correlation function are provided. The relationship of the ingress link and the structure of AS is reviewed. The construction and deployment of IAM are discussed. Simulation results have shown that this scheme has a good performance and is valuable on both theory and application.