## 7 Abuse Detection Mechanism
Secondly, relying on MAC addresses for user identification may not be effective in scenarios where the user utilizes multiple devices, or in cases where MAC addresses can be easily spoofed. [PERSON] et al. [115] delve into the study of stego-botnets that utilize steganographic images on online social networks for C&C operations. They introduce SocialClymene, a system designed to calculate each user's negative reputation score based on their historical activity. Within a suspicious group activity graph, SocialClymene sums the incoming normalized suspicious values. These values are then weighted by the negative reputation scores of the adjacent nodes, offering further insight into potentially malicious behavior. [PERSON] et al. [116] proposed a causality detection mechanism that identifies Twitter-based C&C channel communication by measuring the correlation between user activity and network traffic. The authors posit that any network traffic event to the OSN that is not caused by human events based on specific keystrokes or mouse actions can be deemed suspicious. The causality detection approach uses a time frame that begins immediately after a user event to differentiate between network events triggered by user actions and those originated by bots. However, this detection approach has certain limitations. Firstly, legitimate API calls used for periodically automated polling may be falsely flagged as suspicious. Secondly, the primary parameters employed to evaluate the time frame between user activity and network requests may lack accuracy, given that different machines and operating systems exhibit varying delay times and performance characteristics. Lastly, advanced bots can potentially bypass this detection technique by monitoring user events and executing commands based on user-triggered events. [PERSON] et al. [117] conducted an empirical evaluation of several previously documented abusive social bots. They collected source codes, builders, and execution traces of existing social botnets, such as Twitterbot ([PERSON] [120]), Twebot ([PERSON] et al. [121]), Yazanbot ([PERSON] et al. [122]), Nazbot ([PERSON] et al. [32]), wbbot ([PERSON] et al. [123]), and fbbot. Their aim was to analyze the mechanisms these bots utilize to evade existing detection approaches. Based on their analysis, the authors introduced a detection strategy that incorporates nine newly identified features with spatial and temporal correlations, along with nine features from existing detection methods. This approach is aimed at enhancing the detection of social bots on a variety of platforms. Based on the analysis of the proposed detection approaches mentioned earlier, several key observations were discerned:  
* Post-detection emphasis: Currently, most methods center on identifying botnet activities post-occurrence, often within a lab environment. This neglect of real-timedetection may prove inadequate, given the rapid evolution of threat landscapes. Therefore, the development of proactive detection techniques that can identify signs of such abuses before they occur is of critical importance. * Evasion strategies: Modern botnets employ advanced evasion techniques that can bypass current detection mechanisms. More work is needed to understand and anticipate these strategies to improve detection.