responsible for the user's domain. To identify the actual location of the user in terms of an IP address, the user needs to register his IP address at the SIP registrar responsible for his domain. As shown in Figure 24.1, when inviting a user, the caller sends his invitation to the SIP proxy responsible for the user's domain, which checks in the registrar's database the location of the user and forwards the invita- tion to the callee. The callee can either accept or reject the invitation. The ses- sion initiation is then finalized by having the caller acknowledging the receipt of the callee's answer. During this message exchange, the caller and callee exchange the addresses at which they would like to receive the media and what kind of media they can accept. After finishing the session establishment, the end systems can exchange data directly without the involvement of the SIP proxy. 24.2.2 Fraud in General Fraud refers in general to any illegal use of resources and services by a fraud- ster. Usually, if fraudulent activities against an institution are perpetrated by © 2009 by Taylor & Francis Group, LLC Towards a Fraud Detection Framework in VoIP Networks Location server DNS SRV Query ? cs.columbia.edu Reply:IP Address of cs.columbia.edu SIP Server sip:Callee@example.com INVITE sip:Callee@support.example.com From: sip:Caller@sip.com From: sip:Caller@sip.com To: sip: Callee@example.com To: sip: Callee@example.com Call-ID: 345678@sip.com Call-ID: 345678@sip.com OK 200 OK 200 From: sip:Caller@sip.com From: sip:Caller@sip.com Proxy To: sip: Callee@example.com To: sip: Callee@example.com Call-ID: 345678@sip.com Call-ID: 345678@sip.com ACK Callee@example.com Caller@sip.com Callee@support.example.com Media stream FIGURE 24.1 SIP architecture. a person who is employed by this institution, the term misuse is used. If this person is external to this institution, the term used is fraud. This chapter will make no difference between the two terminologies. Fraud is a problem that affects all providers and is an important fact