 relationship of the SIP participants. 19.4.1 SIP Message Criteria 19.4.1.1 Call-Messages Patterns This category includes criteria that analyze specific call or message character- istics or patterns, in order to determine whether a call (message) is possibly a SPIT call. Path traversal: A call or a message might pass through many interme- diates before reaching its final destination. This path is denoted in the via header. Thus, if in the via header a SPIT domain is recognized, the call or the message may be a potential SPIT. Number of calls-messages sent in a specific time frame: It analyzes the number of calls (messages) made in a specific time period by a user. If this number is above a specific pre-defined threshold then the call (message) is characterized as a possible SPIT call. Static calls' duration: If the calls initiated by a single user have a static duration, then the user is a potential SPITter who possible used an automated script in order to initiate the calls. Receivers' address patterns: If the receivers' addresses follow a specific pattern (e.g., alphabetical SIP URI addresses), then the call (message) is flagged as potential SPIT. Small percentage of answered/dialed calls: It indicates the number of successful call completions from this caller per a pre-defined time period, which is relative to the number of failed ones. Large number of errors: When a user sends a large number of INVITES and the SIP protocol returns a large number of error messages (e.g., 404 Not Found) is a sign of a potential SPIT attack. Size of SIP messages: In this case a set of SIP messages sent by a user to other users is analyzed. If those messages have a specific size then it is very possible to be sent by a "bot" software, and therefore the call is characterized as SPIT. 19.4.1.2 SIP Headers' Semantics (SIP Message Oriented) This category includes criteria that identify a SPIT call or message through a semantic analysis of the contents of the SIP messages (e.g., Bayesian filtering). These particular criteria are furth