# Anomaly Detection in Blockchain Networks Using Unsupervised Learning: A Survey
## 1 Introduction  
A blockchain network constitutes a decentralized software application dedicated to the perpetual maintenance of an expanding ledger of blocks of transaction information that enables the development of public or private distributed networks without the presence of a central controlling organization, supporting secure transaction strategies based on cryptographic mechanisms [1; 2; 3; 4]. Each block includes, among others, data related to several transactions that were gathered within a certain period, a timestamp, and a unique hash value [1; 4; 5]. A cryptographic hash value prudently identifies each block, which also dutifully references the hash of the block that precedes it. This interplay culminates in the establishment of an unbroken chain, with each block forging a connection. The participants in the network are viewed as nodes and the network itself establishes communication channels between these nodes to perform the above-mentioned transactions. In the inaugural phase of blockchain, the concept of decentralization took root, albeit primarily confined to financial transactions. However, to usher in further advancements, the second era of blockchain has been based on smart contracts and finds the researchers diligently working on integrating the innovative feature of programmability into the network, all thanks to the development of smart contracts [6; 7]. The decentralized features of a blockchain network manifest its transparent nature, resulting in secure and effective data storage and data analysis applications, which span a wide range of research areas such as finance [5; 8; 9], health [10; 11; 12], IoT [13; 14], industry [15], enterprise [16; 17], etc. The transaction verification process is called the consensus mainly due to the requirement that the users' majority must agree upon its validity [8; 18; 19]. In terms of consensus, three general types of blockchain systems have arisen, namely, public, consortium, and private networks [1; 4; 11; 18; 20; 21; 22]. A public blockchain allows everyone to join the network as a user either to perform transactions or to participate in the consensus process, whereas in a consortium network, the consensus mechanism is decided by a preselected set of users. Finally, a private blockchain system is usually governed by the organization/institution that developed it, and it decides the users that join the network as well as controls the consensus process. Typical consensus mechanisms are the proof of work (PoW), which is related to Bitcoin, and the proof of stake (PoS), which is related to Ethereum. PoW allows the miners to create new transactions by providing strategies to solve highly complex mathematical problems [22; 23]. PoS is based on validating a transaction in terms of randomly choosing a maximum coin owner [24]. Cryptocurrencies are based on using blockchain technologies, each one from a different point of view but with the same goal, i.e., to make transactions safer for users. In that sense, blockchain harbors a multitude of attributes encompassing fault tolerance, resistance to tampering, and the cloak of anonymity [25; 26]. However, although blockchain has been acknowledged as the spearhead in developing secure decentralized applications, it has shown certain failures regarding security flaws and transparency in cryptocurrencies and smart contracts [1; 27; 28]. So far, several blockchain security issues have been identified, which are related to various types of attacks. Attacks over a blockchain system are triggered by financial profits, and/or they target it to negatively affect its popularity [26]. Attack attempts are generally projected onto the recorded blockchain datasets as anomalies in the form of uncommon or unpredicted items or behavioral patterns. Various types of anomalies concern wallet attacks, Ponzi schemes, PoW vulnerabilities, crypty-jacking, phishing scams, spam transactions, malicious accounts, etc. [26; 27; 29; 30].