, number of calls des- tined to PSTN networks and which ones. The IP addresses used, are they known or not, are they anony- mous or open proxy. The errors detected. The same account is being used simultaneously from different IP addresses. A given account is being accessed from an usual location. Unauthorized calls: problems with username and password or both. Users credit monitoring (the user credit is still positive?). Call detail records (CDRs) monitoring. Number of transactions received from the same IP address. Collect monitoring information and alarms from other systems such as intrusion detection systems or SNMP traps. Fraud detection modules: This component provides the fraud detection engine. Based on a modular architecture, this component © 2009 by Taylor & Francis Group, LLC Towards a Fraud Detection Framework in VoIP Networks will include different fraud detection algorithms and mechanisms. New detection algorithms can be added to the system in a pluggable manner. Which algorithms and modules to use will be controlled through a logic provided through the configuration and policy inter- faces. Detection and alarm: Based on the collected monitoring infor- mation, and the misuse signatures and scenarios identified by the threat analysis step and the provider's policies and rules, the detec- tion and alarm component can decide whether fraud is being attempted. Whenever a fraud attempt is discovered, an alarm will be raised. These alarms will provide the provider with sufficient information SO as to determine the appropriate reaction. The frame- work under consideration will provide the provider with the follow- ing information: Suspected fraud method. * Level of certainty, e.g., to which level the system is certain that the attempted call is a fraud attempt. Fraudster identity including his user VoIP information, IP num- ber and destination. A log of information that have lead the system to its decision such as the number of call attempts, the destination of the numbers, the number of log attempts. The sy