# Anomaly Detection in Blockchain Networks Using Unsupervised Learning: A Survey
## 7 Unsupervised Learning-Based Blockchain Anomaly Detection
### Category 3: Combining Unsupervised and Supervised Learning Algorithms
#### 7.3.1 Combination Type 1
Then, they employed an unsupervised mechanism, based on \"multi-input\" heuristics [100], with the ultimate purpose of obtaining and analyzing clusters of transactions to detect Ponzi schemes and create a new dataset that contains ground-truth data that indicate the malicious and the benign users. In the final step, the above dataset was fed into several supervised algorithms, such as Bayes network and random forest, to provide predictions for the illegal activities. The use of partially labeled datasets was also studied by several authors. Commonly, the labeled data constitute a small portion of the whole available dataset. As an example, in the Elliptic dataset [182], 2% of the instances are labeled as illicit, and 21% of the instances are labeled as illicit. A straightforward way to support the implementation of supervised learning is to manually increase the existing labeled data. Under the usual scenario, there are two labels corresponding to malicious and non-malicious. Unsupervised learning can be applied to partition the whole dataset into two distinct clusters and use the above information to provide labels to a part or all the data. As such, the unlabeled data are aligned with their respective clusters and augmented with the already labeled data. In the subsequent step, the whole dataset undergoes a classification process in terms of some prominent classifiers [183]. Considering the Ethereum network, adversarial attacks have risen. An adversarial attack attempts to create artificial data that follow the distribution of the original data, thus appearing to be almost identical. This imposes risky situations for decentralized applications (dapps) like Ethereum, as illegal activities can be easily hidden in the generated artificial data. In [184], this issue was addressed by implementing in sequence a generative adversarial network (GAN) and a recurrent neural network (RNN). The GAN was used to generate synthetic data that mimics the behavior of normal transactions in Ethereum, while the RNN was used to classify transactions as normal or adversarial. The above implementation generated a dataset upon which an LSTM network was trained to predict adversarial such as the cyber kill chain attack. The digital signing of the transaction appears to be vulnerable to certain malicious issues because the signing is usually executed manually by the user. The effects imposedby this fact exponentially increase when the user executes frequent transactions over long periods since in this case a superficial signing process is required. Thus, malicious counterparties can take advantage of such behavior seeking to convince the user to sign a transaction with adverse impacts on the user's digital resources, e.g., a transaction with tampered data. An approach for automatic digital signing is described in [130], where historical transaction data on Ethereum were represented as time series and elaborated by the rolling window aggregation method [129] to extract certain features (e.g., transactions' timestamps and values), which enabled the usage of the isolated forest algorithm to perform anomaly detection in terms of detecting the outliers of the resulting partition. Then, the random forest was employed to conduct the classification and the prediction of the anomaly labels as outputted by the isolation forest. The overall algorithmic structure yields a personalized malicious transaction detection model.