# Anomaly Detection in Blockchain Networks Using Unsupervised Learning: A Survey
## 7 Unsupervised Learning-Based Blockchain Anomaly Detection
### Category 1: Solitary Implementation of Unsupervised Learning  
Each method belonging to this category employs a single unsupervised learning algorithm to deal with certain problems related to anomaly detection. Their diversification relies on the type of studied anomalies, the way they process the data and the data structures used, the evaluation metrics employed to verify the results, and the programming framework. Tables 4 and 5 report the methods and the corresponding characteristics. A public blockchain ledger is used in many different ways for legal purchases, gambling, illegal activities, and so on. Thus, it is important to attain a clear classification of those activities and assign them to specific users, shedding light on the exact usage of the network, which will further provide helpful insights in determining illegal activities [141]. In a typical public blockchain network, there exists a very large number of pseudo-anonymous addresses. Thus, to effectively identify malicious user activities, it is important to associate addresses with users. Although such a process can be very helpful, it constitutes a challenging problem due to the huge amount of data existing in public blockchain networks [124]. Any establishment of such kinds of associations would forge solid means to come up with effective anomaly detection tools. Unsupervised learning in the form of data clustering has been exemplified as a very trustworthy strategy to determine and aggregate the addresses linked to a user [124]. As such, the quest to elaborate on the relationship between addresses and users has led to various research directions with many forms and shapes, employing information coming mainly from the transaction record. For example, the extraction of an appropriate set of features that describe properties of transaction addresses can be involved in strategies that attempt to timely detect harmful activities. This kind of strategy is strongly related to the real-time identification of potentially harmful transactions and provides certain advantages such as taking in-time actions by the user to prevent them [130]. However, the main problem involved has to do with the complexity of the procedure expressed in power and bandwidth resources needed for such an attempt. [PERSON] and [PERSON] [128] proposed an approach to tackle that problem by using the transaction history of a private blockchain network. They employed the erasure coding technique [142] to handle the missing data and represented the resulting dataset as time series, which enabled the usage of the rolling window aggregation method [129] to obtain a set of features described by information related to the user addresses. Having extracted the features, the k-Means algorithm was put in place to identify several anomalous activities such as fraudulent transactions, double-spending attacks, DDoS attacks, data falsifying, and node capture. The detection of multiple addresses controlled by the same user to keep the change accounts has also been investigated to understand the differences between malicious and benign activities. In general, change addresses are employed to thwart replay attacks, and they define the very core of the temporal nature of public blockchains (especially for Bitcoin), providing private protection by increasing the anonymity of the user. Therefore, their usage appears to be effective in giving certain insights regarding illegal attacks. In this regard, temporal features related to the transactions' properties can be included. Such an approach was developed by [PERSON] et al. [143], who considered all facets involved in public blockchain transactions by using equally important non-temporal and temporal features, which were extracted by representing the blockchain data in the format of user and transaction graphs as presented in [78]. To identify the accounts belonging to the same user, they developed multi-input heuristics that revealed corresponding change addresses.