 It builds on the notion of clustering whereby calls with similar features are placed in a cluster for SPIT or legitimate calls and human input is used to mark which cluster corresponds to SPIT.Call features include those extracted directly from signaling traffic such as the source and destination addresses, extracted from media traffic, such as proportion of silence, and derived from calls, such as duration and frequency of calls.SPIT detection and mitigation can also be based solely on the caller's audio data.