We consider the problem of locating an intruder in an IP domain using dynamic IPSec security associations as proposed in the DECIDUOUS project. We formulate this problem as a Markov decision process that evolves on the set of subtrees of a shortest path routing tree. For small domains, an optimal stationary policy can be determined by dynamic programming. For large domains, the use of neurodynamic programming as well as heuristic policies are examined. Our results indicate that under certain assumptions, a one-feature heuristic policy provides good performance.