# A Survey on Pump and Dump Detection in the Cryptocurrency Market Using Machine Learning
## 4 Findings
### Supervised Approach  
Several studies provided manually labeled datasets with confirmed pump events to train ML and DL models that can detect the start of P&D. First, we explored the studies that employed classic ML to detect P&D. For instance, [PERSON] and [PERSON] [15] analyzed P&D activities organized in Telegram channels between June 2018 and February 2019 and developed several models, such as random forest (RF) and a generalized linear model (GLM), to predict the likelihood of a pump for all listed coins on a crypto exchange. Their training data consisted of 60 true samples and 20,000 false samples. Since the true/false ratio was 0.3%, they decided to decrease the number of false samples and increase the number of trees in RF; they trained three models (RF1, RF2, RF3) with 20,000, 5000, and 1000 false samples and 5000, 10,000, and 20,000 number of trees, respectively. Since the distribution of positive samples is uneven, conventional binomial GLM would be insufficient; therefore, this paper applied least absolute shrinkage and selection operator (LASSO) regularization to the GLM models. The results showed that RF models performed better in terms of precision and F1-score, where RF3 outperformed all RF models with a low threshold (0.2). Furthermore, [PERSON] [35] conducted a study to analyze the effectiveness of modern data science techniques in detecting fraudulent activities in the Dogecoin market. He highlighted the need for objective detection of fraudulent activities and the consideration of the influence of factors, like [PERSON]'s tweets, on cryptocurrency prices. He utilized models such as RF, LR, SVM, k nearest neighbors (KNN), and decision trees (DT) combined with bagging and stacking techniques. The RF algorithm, trained with a 5-fold cross validation (CV) technique, achieved the best out-of-sample testing accuracy with 100%. Moreover, the good performance of RF in F1, precision, and recall scores mitigated concerns about overfitting. [PERSON] et al. [36] suggested several features to detect the start of the P&D procedure. The data were split into chunks of \"S\" seconds and a moving window of W hours. It is necessary to choose small values for chunk size (S) to detect the P&D procedure in its early stages. They used nine features for classification: StdRushOrders, which involves the moving standard deviation of the volume of rush orders in each chunk; AvgRushOrders, which involves the moving average of the volume of rush orders in each chunk; StdRrades, which involves the moving standard deviation of the number of buys and sell trades; StdVolumes, which involves the moving standard deviation of the volume of trades in each chunk; AvgVolumes, which involves the moving average of the volume of trades in each chunk; StdRrice, which involves the moving standard deviation of the closing price;AvgPrice, which involves the moving average of the closing price; AvgPrice-Max, which involves the moving average of the maximal price in each chunk; AvgPriceMin, which involves the moving average of the minimal price in each chunk. They used RF and logistic regression (LR) for the classification task. Each RF model consisted of 200 trees with a max depth of four. In all the models that were trained for different chunk sizes, RF showed slightly better performance than LR. The results showed that a chunk size of 25 s and a window size of 7 h achieved the best F1-score, and a chunk size of 5 s and a window size of 50 min had the best speed. Furthermore, in another study [37], the authors used the features from their previous study and several new features, such as HourSin, HourCos, MinuteCos, and MinuteSin, where the hour and minute of the first transaction in each chunk is encoded with sine and cosine functions. This study used an RF model with 200 trees and a max depth of five for each tree. The RF model showed outstanding precision results, but after decreasing the chunk size from 25 to 5, recall dropped significantly.