谁干的?溯源是个根本问题。人类生命和国家安全可能要仰仗于某个情报部门和某个特工。在网络入侵的背景下,溯源普遍被视为最棘手的技术问题之一,被视为既有办法也没办法得到解决,被视为主要依赖所掌握的证据。但它确是如此吗?这是对溯源的建设性认识吗?本文剖析了溯源的来龙去脉。为更好地阐述观点,我们引用了Q模型:用来解释、指导和完善溯源的全过程。找到发动进攻的攻击者就是一个从三个层面消除不确定因素的实践过程:战术层面,溯源就像是一门艺术,一门科学;操作层面,溯源是一个发现细微差别、而不是非黑即白的过程;战略层面,溯源意味着政治上的利害攸关。成功地追查到攻击者需要一整套技巧,谨慎的管理、时间、领导、压力测试、频繁的沟通以及认识局限和挑战。 Who did it? Traceability is a fundamental issue. Human life and national security may depend on an intelligence service and an agent. In the context of cyber intrusion, traceability is generally regarded as one of the most intractable technical problems, considered as an existing solution and as a solution to it, as evidence that a major dependence relies on. But is it true? Is this a constructive understanding of traceability? This article analyzes the origin of traceability. To better illustrate the point of view, we quoted the Q model: used to explain, guide and improve the whole process of traceability. Finding an offensive attacker is a hands-on process that eliminates uncertainty from three levels: At the tactical level, traceability is like an art or a science. At the operational level, traceability is a process that finds nuances rather than non-blacks White process; at the strategic level, traceability means political stake. Successfully tracked down the attackers need a set of skills, careful management, time, leadership, stress testing, frequent communication and awareness of limitations and challenges.