ria examine the characteristics of a SIP session, meaning the SIP addresses of the sender/caller (i.e., SIP URI or IP address), as well as the domain the session was initiated in. They can be used in traditional white and black listing techniques. Caller SIP URI: It detects and analyzes the SIP URI of the sender of a call/message, SO as to determine if he/she is a potential SPITter or not. Caller IP address: It analyzes the IP address of the sender/caller SO as to characterize him/her as a SPITter. Caller domain: It analyzes the identity of the domain of the caller (sender), which is determined either by SIP URI of the caller, or through DNS lookup from the IP address. If the identity of the domain is a well- known SPIT source, then the call or the message is characterized as potentially SPIT. Caller/callee relationship: It examines whether the caller/sender is trusted by the callee/receiver. Typical examples include whether a caller is known to the callee (inclusion in address book, previous calls have been established, marked as SPITter by the callee). Anti-SPIT Mechanisms 19.5.1 Anti-SPIT Mechanisms Description SPIT is likely to influence the future use and adoption of the VoIP tech- nology. In order for SPIT to be efficiently managed the following three pro- gressive steps are necessary: (a) prevention, the avoiding of SPIT altogether, © 2009 by Taylor & Francis Group, LLC SIP Vulnerabilities for SPIT, SPIT Identification Criteria (b) detection, the ability to identify a SPIT call or message, and (c) handling, the dealing with a detected SPIT call or message. Certain general frameworks from the e-mail spam paradigm have been con- sidered as potential candidates for SPIT avoidance [8]. Some of them appear to be basic building blocks of the anti-SPIT architecture that have been pro- posed in the literature. We shall first provide a brief description of the general anti-SPIT frameworks before proceeding to classify them according to the three aforementioned progressive steps. Black and white lists. White lists a