 to determine possible ways a fraudster can misuse the service. Based on this analysis, not only the scope of the detection schemes will be defined but also the underlying information models and data visualization possibilities will be decided. 2. Detection analysis: The core work of the SAFER framework will be dedicated towards the specification and evaluation of efficient and highly accurate fraud detection algorithms. In this context the follow- ing approaches will be investigated. (a) Rule-based detection techniques: Within this category, the providers define a set of criteria that each call or transaction must meet. These rules can be based on past experiences, price limits, IP addresses, SLA agreements, etc. This approach works well with the information in the users profiles structured in two data levels: the customer data (long term profile) and the behavior data (usage characteristics in a short time frame). For instance, customer data is often used in conjunction with call detail data when trying to identify fraud activities. The system will automatically check the monitoring results against these rules and decide to reject or accept the transaction. For instance, the rule-based techniques are able to identify anomalies such as a user logging in from an unknown host or from a risky IP address, establishing a large number of calls to unknown destinations and changing some personal information. In fact, there are several rule-based mechanisms such as PDAT (Pro- tocol Data Analysis Tool) [8] that can be adapted to our context and applied to detect fraud. However, the SAFER framework also aims at developing new rule-based tools that are more appropriate to the VoIP area and which take its specificities. (b) Artificial intelligent techniques: The diversity and the heterogene- ity of the fraud scenarios require the use of intelligent detection techniques. The latter have to be extremely flexible in order to cope with the large number of existing fraud scenarios and to face the new ones. These issues might make