mes and enhance the system with new mechanisms in a rapid manner. - Distributed communication: For fraud detection systems to be effective, the system needs to be constantly updated. To achieve this, communication methods will be defined to update the sys- tem from different source, e.g., from operator input or cooperating partner networks. The SAFER peer-to-peer technology is designed as follows: Each secured VoIP provider network is protected by an instance of the SAFER system that is responsible for fraud detection at the operator. If one network has identified a certain fraud scenario, this sce- nario is expressed as a policy and is distributed to other net- works. - Open interface: The SAFER system under consideration will pro- vide an open interface over which the results of the analysis can be exported. This would enable the operator to process the results of the SAFER system in an automated manner, e.g., process the data, add it to some database or web site, or use it to trigger other management processes. With other respects, the general anti-fraud defence architecture of the SAFER framework is depicted in Figure 24.3. In this architecture, each secured VoIP provider network is protected by a general fraud guard, that delivers general fraud management fea- tures, e.g., - Monitoring the service activity by collecting data from the network, other monitoring systems, SNMP traps and intrusion detection sys- tems [15,16] and possibly from SAFER systems in other networks domains. - Analysing the collected data using various detection algorithms as well as a set of operator defined policies and rules. Inform the operator about the results of the analysis. This can be visualized over a GUI in the form of alarms. Further, the detection © 2009 by Taylor & Francis Group, LLC Towards a Fraud Detection Framework in VoIP Networks Rules Management Rules Management library system library system Secured connections SAFER SAFER Router Monitoring Router Monitoring systems systems Operator 1 Operator 2 Rules Management libr