 the rule-based techniques difficult to manage as the later require precision and rigor for each fraud possibility. This category uses some mathematical patterns defining the normal behavior of the users and attempts to iden- tify any deviation from this model. Such deviations can be a sign of ongoing attacks. The system will analyze the data provided by large and historical databases, build the model and apply it to real time calls and transactions. Many approaches of intelligent data analysis exist already: activity profiling, Machine Learning, Neural networks and Knowledge Discovery in Databases (KDD). These methods are quite general and have been used in different fields. Within the SAFER framework, these techniques will be investi- gated with regard to their applicability to the VoIP fraud detection C 2009 by Taylor & Francis Group, LLC Towards a Fraud Detection Framework in VoIP Networks context. On the other side, some new intelligent algorithms will be developed where the VoIP specificities are taken into account. Let us note that it is generally difficult to be certain when using sta- tistical analysis alone that a fraud has been perpetrated. Rather, the analysis should be regarded as alerting us to the fact that an observation is abnormal, or likely to be more fraudulent than oth- ers. The different algorithms to be developed here will be evaluated with regard to their complexity and the level of achieved false pos- itive and false negative values. To be more precise, our framework will consider mature detection tech- niques from both categories and combine them in an appropriate way, which will certainly lead to more efficiency. 3. Adaptation phase: Fraud attacks change often in order to escape the detection techniques. For these reasons, the SAFER framework will also offer the ability to uncover and respond to the changing fraud patterns. This will be mainly achieved through intelligent techniques and the self- learning models discussed in Section 24.2.4. These techniques will use the past fraud trans