## 7 Abuse Detection Mechanism  
To date, only four countermeasures have been proposed to detect abuses of CPLS platforms as C&C communication channels. Three of these detection strategies have been developed for computer environments [27, 32, 114], while only one has been created for the Android phone environment [113]. [PERSON] et al. [32] proposed a two-level abuse detection system: client side and server side. On the client side, they defined three features to identify botnets: self-concealing, dubious network traffic, and unreliable provenance. They presumed that connections to social media platforms could be deemed suspicious if not initiated by human behavior. They used behavioral biometrics, user input responses, and graphical user interface (GUI) interaction as detection attributes to differentiate between legitimate users and bots. For server-side detection, they assumed that any communication with social media platforms is suspicious if the transmitted messages or posts are textually encoded. They employed the J48 decision tree algorithm to classify input messages, distinguishing between Base64 or Hexadecimal-encoded text and plain language content. Nevertheless, these detection approaches have certain limitations: (i) lack of real-time detection, as the mechanisms were simulated in a post-analysis lab environment, and (ii) the potential for bypassing detection if crafts adversaries utilize image-steganography techniques to hide malicious commands within posts. [PERSON] et al. [27] proposed a behavior tree-based detection framework aimed at identifying social bots by monitoring host activity. This framework consists of three components: a host behavior monitor, a host behavior analyzer, and a detection approach. To comprehensively understand and construct a suspicious host behavior tree for analysis, they designed a social botnet, named wbbot. This design also employed a sample collection from two sources: real-world social bots [30, 31, 107, 108] and researcher malware samples of social bots [19]. After executing and analyzing this collection of social bots over a certain period, offline processes were used to generate a template library. This library was then employed to calculate the highest similarity value with the suspicious behavior tree. Oncethe behavior tree was constructed, the tree edit distance was used to calculate its similarity to the template, resulting in the final detection outcome. However, this detection approach has a significant drawback: a high false positive rate of 29.6%. Moreover, the system can be circumvented if the attacker employs a multi-process mechanism or distributes malicious behaviors across various time spans. [PERSON] et al. [113] proposed a detection methodology aimed at identifying Android applications that abuse GCM as a C&C channel. This methodology incorporates GCM flows as features within a machine learning model. The authors modified the Flowdroid tool [119] to extract GCM flows by distinguishing GCM callbacks, which were then used to train the model. The resulting derived features of GCM flows encompass information such as the GCM registration ID, sender ID, and the type of GCM message, demonstrating that these GCM flow features can effectively differentiate between malicious and benign applications. However, this approach can be vulnerable to evasion strategies like obfuscation and polymorphism, which attackers can employ to conceal GCM flows or other malicious behavior. [PERSON] et al. [114] introduced API Verifier, a tool employing CAPTCHA verification to authenticate social media account access via MAC address. The tool discerns whether an API call originates from a human or a bot, providing a layer of defense against automated bot actions. However, there are several limitations to the API Verifier tool presented by [PERSON] et al. Firstly, the CAPTCHA verification system is susceptible to relay attacks, which could potentially allow botnets to bypass the verification process.