## 5 Research Findings
### RQ1: What Techniques Are Utilized to Abuse the CPLS as C&C Communication Channels?
#### 5.3.5 Causality Detection  
[PERSON] et al. [116] propose a causality detection mechanism for identifying Twitter-based C&C communication. This approach analyzes the causal relationship between user activity and network traffic to distinguish between user-triggered events and bot-originated events.  
In conclusion, various countermeasures have been proposed to detect the abusive use of CPLS as C&C infrastructure. These countermeasures include host and server-side detection, behavior tree-based detection frameworks, GCM flow-based detection, API verification with CAPTCHA, negative reputation scores, and causality detection. Each approach offers unique techniques and methodologies to identify and differentiate between legitimate users and malicious bot activities. However, it is important to note that these countermeasures have their limitations, which are presented in detail in Table 7. Continuous research and improvement are necessary to enhance the effectiveness and accuracy of these detection mechanisms in combating the abusive use of CPLS as a C&C infrastructure.  
\begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Reference**} & \multicolumn{3}{c}{**Annually-Based**} & \multirow{2}{*}{**Detection Mechanism**} & \multirow{2}{*}{**Limitation**} \\ \cline{2-2} \cline{5-6}  & \multicolumn{2}{c}{**Passive**} & & \multicolumn{1}{c}{**Active**} & \multicolumn{1}{c}{**Detection Mechanism**} & \multirow{2}{*}{**Limitation**} \\ \cline{2-2} \cline{5-6}  & **Host-Based** & **Server-Based** & **Host-Based** & **Server-Based** \\ \hline \multirow{7}{*}{[PERSON] et al. [27]} & \multirow{7}{*}{✓} & & & By utilizing behavior tree-based methodologies, the bot can be accurately identified through the monitoring of host activity. Upon construction of the behavior tree, the similarly to the designated website will be calculated utilizing the tree bit bit data. & \multirow{7}{*}{Erade detection by performing random time delays between different behaviors of social bots.} \\  & & & & Template will be calculated utilizing the tree bit data. & \multirow{7}{*}{Erade detection by performing random time delays between different behaviors of social bots.} \\  & & & & The host-based security approach considers connections to social media potentially suspicious. If any new notified by human interaction, this method utilizes behavioral biometrics, such as the reaction to user input through a keyboard or phone, as well as the CUL as indicators to differentiate between legitimate users and bots. & \multirow{7}{*}{Lack of empirical data and evaluation and rules} \\  & & & & On the other hand, the user-based approach assumes that for communication with social media platforms is potentially suspicious for the messaging of posts and are actually encoded. To accurately classify incoming messages, the implementation of the 194 decision tree algorithm is utilized. & \multirow{7}{*}{Erade detection by performing random time delays between different behaviors of social bots.} \\  & & & & The forwarded tool was handled for use as a flow analysis tool to extract Google Cloud Messaging Cloud (GCO). These were created & \multirow{7}{*}{Limited in its applicability, as it only works for Android CSI based not applicable in Windows OS environments.} \\  & & & & & \\ \cline{1-1} [PERSON] et al. [113] & ✓ & & & & \\ \cline{1-1}  & & & & & \\ \cl