detected. These tools can be used by VoIP providers to protect their services against losses due to fraud and identify previously uncollected revenue sources. C 2009 by Taylor & Francis Group, LLC SIP Handbook: Services, Technologies, and Security 24.2 Background 24.2.1 VoIP Overview In contrast to the closeness of the traditional PSTN networks, in which the introduction of novel services requires a long cycle process, the simplicity and openess of the Internet architecture holds the promise of rapid deployment of innovative services and efficient integration of various technologies such as web, gaming, messaging with the basic voice service. Based on this vision, VoIP technologies have already been considered for a few years as the killer application. These big expectations were coupled with huge investments in fast Internet infrastructure, start-up companies working on new technologies and services as well as research and development. Further, a great effort was spent in various standardization groups like IETF [1], ITU-T [2], 3GPP [3] in order to standardize the necessary protocols and interfaces for realizing VoIP services. Although, various VoIP products based on protocols such as H323 [4,5] and MEGACO [6] exist already in the market, the session initia- tion protocol (SIP) [7] has been establishing itself as the most widely accepted protocol for initiating and controling various kinds of interactive communi- cation applications in the Internet. While primarily designed for VoIP, SIP is now currently finding wide acceptance as the basis for instant messaging applications, online gaming and conferencing. The most important SIP operation is the invitation of new participants to a call. To achieve this functionality we can distinguish different SIP entities, such as proxy, redirect, User Agent (UA), registrar, location service, application server and Back-to-Back User Agents (B2BUA). In SIP, a user is identified through a SIP URI in the form of "user@domain". This address can be resolved to a SIP proxy that is 