ary system SAFER Router Monitoring systems Operator 3 FIGURE 24.3 Anti-fraud defence architecture. results can be delivered to the operator's operation and manage- ment systems. These systems can then take the needed measures to counter the fraud attempt, e.g., disconnect the caller or flag the caller as fraudster and reject future calls from him. The exact actions to take and the policies defining these depend on the oper- ator's preferences. To enhance fraud prevention, communication methods will be defined to distribute fraud information into cooperating networks. Hence, if one network has clearly identified certain users/domains as fraudulent sources, it will inform other VoIP networks of these fraud sources. To enhance effectiveness, inter-provider connections need to be secured, e.g., by TLS. Hence, requests over unsecured connection will be more crucially investigated. 24.4 Conclusion In this chapter, we have defined a framework that could be used by VoIP providers to detect fraud and misuse in their networks. We started by describ- ing some fraud scenarios that may occur with traditional telecommunications and the risks that can be added when migrating to the VoIP paradigm. We C 2009 by Taylor & Francis Group, LLC SIP Handbook: Services, Technologies, and Security have also discussed the current state-of-the-art fraud especially in areas such as credit card and Internet transactions, and telecommunication services. The strengths and the weaknesses of the discussed techniques were identified and their applicability to the VoIP area was investigated. After describing the dif- ferent steps planned to build the SAFER framework, a functional architecture of this framework was provided. In addition to the description of the different functional entities, an overall architecture specifying how the VoIP providers can collaborate to defend their networks against fraud was presented. Acknowledgment First of all, I would like to express my deep and sincere gratitude to all who have closely followed this chapter. Spe