# Anomaly Detection in Blockchain Networks Using Unsupervised Learning: A Survey
## 7 Unsupervised Learning-Based Blockchain Anomaly Detection
### Category 1: Solitary Implementation of Unsupervised Learning
Then, they applied the k-Means to obtain clusters of addresses and detected malicious accounts in terms of the cosine similarity with other benign addresses belonging to the same cluster. In the case of the Bitcoin network, a key point is to acquire incidence relations between addresses. Typically, incidence relations enable the creation of a graph-based representation of them, which further can assist the implementation of cluster analysis over the graph data. In this direction, [PERSON] et al. [144] proposed to use a Gephi graph to represent the address data and applied the Louvain community clustering method to obtain incidence relation between users to anonymize the corresponding transactions with the advantage of improving the traceability of the Bitcoin movement and achieving a better future utilization. The Gephi graph is generally used in two forms: (a) users and transactions are represented as vertices and edges, respectively, and (b) transactions and users are represented as vertices and edges, respectively. The use of graph-based data has been frequently studied in supporting the identification of distinct theft attacks, mainly for the Bitcoin transaction data, predominantly in instances where reported thefts have transpired [138; 144]. The related investigations concentrate on transforming the Bitcoin data into graph-based structures using several features related to the graph vertices (i.e., user nodes) and edges (i.e., transactions). In [138], the k-Means was applied to detect abnormalities reported on the graph such as the all in vain theft, stone man loss, and mass Bitcoin theft. The overall evaluation was conductedconsidering the relationship between the k-Means cost function and the number of clusters, thus resulting in a type of optimal clustering approach. In [145], the authors discussed the detection of double-spending attacks by transforming the Bitcoin network into a directed acyclic graph, where vertices corresponded to blocks that were created by the miners. The advantage provided by this transformation was that the blocks created by an attacker are not well connected in the graph, and they can be easily detected using specialized clustering approaches, such as spectral clustering, to categorize the graph's vertices into malicious and not malicious. Transaction graphs have also been used in identifying information leaks. It has been shown [146] that synchronization and timing of messages of transactions in the Bitcoin network may leak information about their origin, thus enabling their exploitation by connected adversarial nodes. As a result, the timing of transaction messages can expose details about their origin, making them susceptible to manipulation by well-connected adversarial nodes. To investigate this issue (i.e., the information leaking in transaction messages by adversarial nodes), [PERSON] and [PERSON] [146] analyzed the network traffic, using the k-Means algorithm to cluster transactions based on the node that first introduced them into the network. The resulting methodology encompassed a procedure to assign weights to nodes' IP addresses, considering propagation timestamps. The Bitcoin data were collected by the bclient [147], and the clustering implementation scheme was evaluated by the Rand index [148]. In the Ethereum network, the use of cluster analysis over smart contracts has been viewed as a tool to allow for easier contract analysis and detection of security issues, such as malicious contracts. Due to the inherent tabular format of the Ethereum data, the feature space upon which the clustering is to be applied is defined straightforwardly. In [135], [PERSON] et al. used the Ethereum data [149] and focused on a specific eco-efficient smart contract approach, where the affinity propagation method [111] encircled the k-Medoids [137] to quantify the similarities between pairs of contracts using the several distance functions.