# CAA-RF: An Anomaly Detection Algorithm for Computing Power Blockchain Networks
## 1 Introduction
### Related Work  
With the rapid development of artificial intelligence, there has been a shift from using traditional machine learning to integrating AI models for anomaly detection in network traffic. In 2021, [PERSON] et al. proposed a real-time anomaly detection method for mobile network traffic based on user behavior security monitoring [1]. This method captures user behavior data, analyzes protocols, and identifies applications to extract user behavior features. A Bayesian statistical classifier is built, and the extracted user behavior features are used for detection. Experimental results show that the detection time is as low as 104 s, and the detection accuracy is better than traditional methods, with good detection performance. However, the detection time of this method is hard to improve, as it requires some accumulation of user behavior data. The model's effectiveness may need to be enhanced when facing more complex and variable user behavior patterns, especially in the case of more covert or novel attack methods. In 2023, [PERSON] and [PERSON] compared the performance of several Bayesian variants, including Multinomial, Bernoulli, and Gaussian, in network intrusion detection [2]. The study showed that the Gaussian Bayesian classifier performed the best due to its assumption that features follow a normal distribution, achieving a test accuracy of 81.69% in anomaly detection. On the other hand, the Multinomial Bayesian classifier performed poorly due to its assumption of discrete distributions, and the Bernoulli variant was not suitable for certain tasks due to its use of feature occurrence frequency information. In 2023, [PERSON] and [PERSON] proposed a method to detect denial-of-service (DoS) attacks using logistic regression and Naive Bayes models [3]. By learning from the KDDcup dataset, the method distinguished normal network traffic from DDoS attacks. The results showed that the logistic regression model outperformed the Naive Bayes model in accuracy, precision, recall, and F1 score. In 2024, [PERSON], [PERSON], [PERSON], and others proposed a unified feature engineering method to detect malicious entities in blockchain networks [4]. The features were used to train multiple classifier models, making a significant contribution to improving classification accuracy and AUC values. However, these models are highly dependent on the quality and representativeness of the dataset, and their performance may decline in dynamic network environments. They also require continuous updates to adapt to new attack methods. Furthermore, the models may face delays and efficiency issues when handling large-scale real-time network traffic. Traditional machine learning and statistical methods may not fully adapt to highly dynamic and complex network environments, especially when dealing with unknown or minority category attacks, which may limit their detection performance. Deep learning is gradually replacing traditional machine learning in certain areas, achieving better results. [PERSON] described a system that combines Generative Adversarial Networks (GANs) and machine learning [5]. By mimicking attacker behavior to optimize traffic processing efficiency, it can effectively detect multi-stage attacks while reducing the computational burden of processing each data packet. [PERSON] demonstrated the potential of Recurrent Neural Networks (RNNs) in anomaly detection [6]. After adjusting hyperparameters such as learning rate, batch size, and sequence length, the model achieved good performance in accuracy, recall, F1 score, and AUC. However, when handling unconventional network traffic patterns, further optimization of the model's flexibility and adaptability is needed. [PERSON] and [PERSON] proposed a Graph Neural Network (GNN) model based on Graph Convolutional Networks (GCNs), utilizing a two-layer GCN structure [7]. For the computation of Graph Edit Distance (GED), the model may need to better match differences between clusters and optimize the accuracy of cluster detection.