ed here has its logical place in the test hierarchy much earlier than the former, since this will reduce the need for further checking. Some VoIP endpoint vendors have launched a new series of products. Its early software version is partly buggy and resembles a SPIT tool. After the C 2009 by Taylor & Francis Group, LLC SIP Handbook: Services, Technologies, and Security first few passed challenge/response tests, the machine learning module will know the minor details from a SPIT call. Future calls with this product will then not need to be sent through the challenge/response module. A SPIT detection module for SIP instant messaging could easily benefit from the first approach. As instant messages are in general short, containing little more than SIP headers and the message as payload, the time needed for inspection and calculations will not reduce the user experience to an unac- ceptable level. SPIT detection for voice calls could benefit from the second approach. As most calls will be deemed 'safe', there will be little or non-general delay for all calls. And there is an obvious goal to reduce the amount of challenge/responses to a minimum. The challenge for any machine learning technique is to reach an acceptable level of false positives and false negatives, and as a result these tools will need to be monitored and configured periodically. In addition, an expert/ administrator must provide the different attributes, which the module will use to categorize the different calls. A too large set of attributes will slow down the throughput. A too small set of attributes will probably not detect SPIT. Attributes being subsets of other attributes, or being indirectly related to each other, will affect the calculation of the results. Since the output of any machine learning technique is statistical, it is essential to get these numbers right. A proper study on the different attributes to be used is an important early phase if any machine learning based SPIT tool has to be made. Let us mention that in the context of this 