Lot of theory people have been working on a field named Data Stream algorithms. They basically store a part of the stream to keep some properties of the stream like top-k frequent items. I think the concepts from data streams algorithms can be applied in IP Traceback problem. If I get time, I will think about it. If you are interested let me know.
Abstract :

Abstract—The rising threat of DoS, and DDoS has made IP Traceback an important problem. Instead of preventing systems, we have to deploy mechanism to actually trace the culprit. In this way the attackers will be discouraged. People are working on mechanisms to defend against DDoS. We need mechanisms which are easy to deploy and which require less manegement work. In this report, we discuss the current scenario of IP Traceback mechanisms. We make a simple matrix on which we analyze different mechanisms.