# Anomaly Detection in Blockchain Networks Using Unsupervised Learning: A Survey
## 7 Unsupervised Learning-Based Blockchain Anomaly Detection
### Category 1: Solitary Implementation of Unsupervised Learning
\begin{table}
\begin{tabular}{c c c c} \hline \hline
**Method** & **Types of Anomalies** & \begin{tabular}{c} **Unsupervised Learning** \\ **Methods** \\ \end{tabular} & **Evaluation Method** \\ \hline [PERSON] and [PERSON] [134] & Double-spending attack & k-Means & Within cluster distortion \\ \hline [PERSON] et al. [135] & \begin{tabular}{c} Malicious smart contracts, \\ DAO attack \\ \end{tabular} & k-Medoids & Frequency distribution score \\ \hline [PERSON] et al. [133] & \begin{tabular}{c} Malicious node behavior \\ \end{tabular} & \begin{tabular}{c} Behavior Pattern Clustering \\ (custom modification of \\ k-Means) \\ \end{tabular} & Precision \\ \hline [PERSON] et al. [124] & Malicious address behavior & k-Means & \begin{tabular}{c} Cluster visualization with the \\ BitConduite interface \\ \end{tabular} \\ \hline [PERSON] et al. [125] & Fraud detection & k-Means & \begin{tabular}{c} Precision, silhouette score, \\ accuracy, F1-score \\ \end{tabular} \\ \hline [PERSON] and [PERSON] [138] & \begin{tabular}{c} All in vain theft, stone man \\ loss, mass bitcoin thefts, \\ malicious user identification \\ \end{tabular} & k-Means & \begin{tabular}{c} Within cluster standard \\ deviation \\ \end{tabular} \\ \hline [PERSON] et al. [132] & Malicious behavior patterns & \begin{tabular}{c} Agglomerative hierarchical \\ clustering \\ \end{tabular} & Ratio statistical distance \\ \hline [PERSON] et al. [106] & \begin{tabular}{c} Intrusion-based adversarial \\ attacks in IoT environment \\ \end{tabular} & \begin{tabular}{c} Extended Markov model \\ \end{tabular} & \begin{tabular}{c} Probability scores, false \\ positive rates \\ \end{tabular} \\ \hline [PERSON] and [PERSON] [128] & \begin{tabular}{c} Advanced attacks centered on \\ the heresies of safety \\ strategies, DDoS attacks \\ \end{tabular} & k-Means & \% detection accuracy \\ \hline [PERSON] and [PERSON] [145] & Double-spending attack & Spectral clustering & Several spectral properties \\ \hline [PERSON] et al. [152] & Malicious network activities & k-Means++ & Fowlkes-Mallows Index [135] \\ \hline [PERSON] et al. [144] & Malicious Bitcoin transactions & Louvain algorithm & Louvain runtime efficiency \\ \hline [PERSON] et al. [127] & Fraud detection & Trimmed k-Means & Within cluster sum of squares \\ \hline [PERSON] et al. [160] & \
\begin{tabular}{c} Theft attacks (stone mass loss, \\ [PERSON] loss, all in vain \\ theft, mass MyBitcoin theft, \\ Linode Hacks, Bitfloor theft, \\ and Cocker theft) \\ \end{tabular} & Trimmed k-Means & Cluster dispersion rate \\ \end{tabular} \\ \hline [PERSON] and
\begin{tabular}{c} Information leaking in \\ transaction messages by \\ adversarial nodes \\ \end{tabular} & k-Means & Rand score \\ \hline [PERSON] et al. [143] & Malicious addresses & k-Means & F-measure, precision \\ \hline \hline \end{tabular}
\end{table} 
Table 4: The characteristics of the methods belonging to Category 1, which are given in terms of types of anomalies they used for, learning algorithms, and evaluation techniques. A crucial factor in identifying illegal user activities is the discrimination between different types of unknown network protocols regarding the respective security issues, as far as the effectiveness of clustering difficulties caused by different protocol message lengths is concerned. [PERSON] et al. [152] employed the k-Means++ method [153] to address this issue, where the method extracted the maximum frequent sequences from the binary protocol messages using a minimum support threshold, while they used an algorithmic methodology based on the Bide algorithm to mine the maximum frequent sequences [154]. The evaluation of the whole approach was based on the Fowlkes-Mallows Index [155]. It has been stated that k-Means does not perform well in blockchain anomaly detection problems [156; 157].