# Anomaly Detection in Blockchain Networks Using Unsupervised Learning: A Survey
## 1 Introduction
Anomaly detection focuses on the implementation of specialized algorithmic-based methodologies able to determine and quantify the above-mentioned anomalies that may have the form of suspicious transactions or user behaviors [31; 32]. For example, identifying a suspicious/illegal transaction and preventing it from approval would eliminate the potential damage that could be expanded within the network [33]. In that sense, an illegal transaction is viewed as anomalous behavior, which appears to be very dissimilar to the rest of the transaction data. Roughly speaking, the very core of an anomaly detection algorithm is to build a model that accurately describes and quantifies the normal user behaviors [34; 35]. As such, the usage of an anomaly detection method provides the potential to implement timely actions against the anomaly and the respective malicious effects that might be imposed into the network. Although anomaly detection technologies have been effectively used in handling security and privacy issues over several fields [30; 31], the implementation of such types of methods in blockchain systems has appeared to be a tough problem due to several reasons [25; 34]. The first reason is related to the complexity of a blockchain system, which implies the presence of many diverse threats and abnormal behaviors. The second is related to the constant increase in the number of anomaly detection methods rendering the appropriate selection of an effective method for the problem at hand a difficult task. The third reason concerns the need to optimize data formats for each blockchain network by considering its peculiarities and characteristics. Because a blockchain platform is decentralized, inappropriate handling of data formats could lead to the platform's collapse. From the viewpoint of anomaly detection methods, this imposes difficulties related to their adaptation in capturing the differences in data formats. Finally, anomaly detection tools are not efficient in applying detection rules to complex structures such as encrypted data used for protecting anonymity and sensitive user parameters or performing transactions with transaction rate requirements [36]. In that direction, unsupervised learning has gained increasing popularity in handling the problem of anomaly detection in blockchain. Such kinds of techniques provide a powerful means of segmenting the available data into distinct groups, enabling the identification of abnormal instances in the form of outliers. The incorporation of unsupervised learning algorithms in the anomaly detection process has shown effective results in enhancing the overall security of blockchain. So far, several unsupervised learning methods have been applied. Typical tools concern standard cluster analysis such as the k-means and its variants [37], and more sophisticated clustering methods such as the BIRCH [38], the Grey [39] and the Chameleon [40] algorithms, the one-class support vector machines (SVM) [41; 42], the isolation-forest [43], and more. This paper provides a systematic review of methods that utilize unsupervised learning in resolving the problem of anomaly detection in blockchain networks. The main contributions of the paper are enumerated as follows:  
1. Summarization of typical blockchain anomalies. 2. Analysis of the data structures employed in the implementation of the unsupervised learning methodologies. 3. Categorization of a large number of research methods for blockchain anomaly detection into three categories based on the implementation strategies of the corresponding algorithms. 4. Presentation of the basic functional properties of the above-mentioned categories in terms of certain key characteristics. 5. Highlight several challenges and future directions. To conduct our analysis, we searched the following databases: Web of Science, Scopus, Google Scholar, IEEE Xplore Digital Library, ACM Digital Library, Springer, and Science Direct.