 In Proceedings of the Network and Distributed System Security Symposium (NDSS). [34] Sengar, H., H. Wang, D. Wijesekera, and S. Jajodia. 2006. Fast detection of denial-of-service attacks on IP telephony. In Proceedings of 14th IEEE International Workshop on Quality of Service, 199-208. [35] Chen, E. Y. 2006. Detecting DoS attacks on SIP systems. In Proceedings of 1st IEEE workshop on VoIP Management and Security. 3: 53-58. [36] Sengar, H., D. Wijesekera, H. Wang, and S. Jajodia. 2006. VoIP intrusion detection through interacting protocol state machines. In Proceedings of International Conference on Dependable Systems and Networks. [37] Fiedler, J., T. Kupka, S. Ehlert, T. Magedanz, and D. Sisalem. 2007. VoIP defender: Highly scalable SIP-based security architecture. Principles, Systems and Applications of IP Telecommunications (IPT- Comm2007). New York, USA. [38] Brodsky, B. E., and B. S. Darkhovsky. 1993. Nonparametric Methods in Changepoint Problems. Kluwer Academic Publisher. © 2009 by Taylor & Francis Group, LLC SIP Vulnerabilities for SPIT, SPIT Identification Criteria, Anti-SPIT Mechanisms Evaluation Framework and Legal Issues G. F. Marias Athens University of Economics and Business L. Mitrou University of the Aegean M. Theoharidou and J. Soupionis Athens University of Economics and Business S. Ehlert Fraunhofer Institute for Open Communication Systems D. Gritzalis Athens University of Economics and Business CONTENTS 19.1 Introduction 19.2 Background 19.3 SPIT Vulnerability Analysis 19.4 SPIT Identification Criteria 19.5 Anti-SPIT Mechanisms 19.6 Anti-SPIT Mechanisms Evaluations 19.7 Anti-SPIT Mechanisms and Legal Issues 19.8 Conclusions References Introduction Since 2004, spam over Internet Telephony (SPIT) attack has been officially reported. The first incident was recorded in Japan at a major VoIP provider C 2009 by Taylor & Francis Group, LLC SIP Handbook: Services, Technologies, and Security called SoftbankBB, with Mio-subscribed customers*. Actually, spam history started 30 years ago, when the first 