ple score definition, an attacker would need to create more legitimate calls than spam ones in order to obtain a favor- able score. More advanced scoring systems could limit the number of positive reports per user and per day, weight the score to the number of reporters or make use of a reputation system. In addition, external modules can be used to update the score of one user. For example, if one user creates many calls to different users in a short period of time, or if a user fails a Turing machine test, its score is dynamically raised. The score value that it is added or subtracted can depend on the reporter module's weight, number of users, reputation of users. 23.4.1.4 Machine Learning Module This module can be used to automatically filter SPIT based on some machine learning techniques. The SIP message can be considered as a block of text to which a learning algorithm (decision tree, probabilistic approach, etc.) could be applied. Because of the similarities between e-mail and SIP instant messaging, this technique can be applied successfully to detect SPIT instant messages. As for SIP calls, one can restrict himself to the SIP message header because of the very useful data that it involves. There are two very 'opposite' approaches for how such a module should work, and the machine learning module could be optimized for each of these. Even multiple machine learning modules could be used in collaboration with other SPIT prevention modules. 23.4.1.4.1 Detect suspicious traffic The SIP message header contains related information to the From field, the To field, the Subject field and some other data that might be valuable for detecting SPIT. The learning algorithm, C 2009 by Taylor & Francis Group, LLC A Conceptual Architecture for SPIT Mitigation TABLE 23.1 Some Potential SPIT Patterns Coming within the From Field %yacine@domain.name. com invalid URI: starts with % 1237@hotmail.com invalid URI: starts with numbers Yacine@yahoo invalid URI: short domain name Fokus.fraunhofer.de invalid URI: no @ @yahoo.com inva