n With this approach, a set of criteria that each transaction must meet is defined. These rules are usually based on past experience, users' identity, price limit, etc. The fraud detection system scans the transaction informa- tion, checks it against these rules and decides to reject or accept the transac- tion. Depending on the field under consideration, these criteria can maintain information such as stolen credit card numbers and bad shipping addresses in case of financial transactions, IP addresses, logging in from unknown hosts and e-mail addresses in the case of Internet services, and changing personal data and establishing a large number of calls to unusual destinations in case of telecommunication services. In the literature, various rule-based schemes can be found such as the Protocol Data Analysis Tool (PDAT) [8]. While the rule-based technique is widely used in diverse fields, it can be very difficult to manage as fraud activities can be complex and can not always be defined by simple rules. In addition, fraud attacks are evolving, thus, static rules will be C 2009 by Taylor & Francis Group, LLC SIP Handbook: Services, Technologies, and Security unable to detect them. With other aspects, when this technique is used, its corresponding scalability is under question. The more data the system must process, the poorer the performance. 24.2.4.2 Artificial Intelligence Based Detection Artificial intelligence is another paradigm that can be used to detect fraud. In this case, very large databases are analyzed and some models (or profiles) are built. These models describe the user's normal behavior in term of per- formed transactions. Any suspicious behavior showing a significant deviation from this norm is then considered as a fraud attempt. Peer group analy- sis, break point analysis, activity profiling, Neural networks, Decision trees, Bayesian networks, and Knowledge Discovery in Databases (KDD) [9] are examples of intelligent algorithms that allow models to be built for normal behavior. Peer group analysis