Using sleepy watermark tracing (SWT) to trace the detected intrusion that utilizing stepping stone to disguise its origin in real-time

X. Wang, D. S. Reeves, and S. F. Wu, "Tracing Based Active Intrusion Response," Journal of Information Warfare, vol. 1, 2001.