# Anomaly Detection in Blockchain Networks Using Unsupervised Learning: A Survey
## 7 Unsupervised Learning-Based Blockchain Anomaly Detection
### Category 2: Combining Unsupervised Learning Algorithms
#### 7.2.2 Parallel Combination Type  
The usage of generative adversarial networks [119] has been seen as an alternative tool to surpass the need for labeling approaches, usually employed in supervised learning implementation, and perform an effective anomalous detection strategy. The benefit of using GANs comes from the fact that it does not require any time-consuming labeling procedure for the dataset. In this direction, [PERSON] et al. [172] applied a GAN-based mechanism to the Bitcoin transaction data. The data were represented as a user-based graph [78]. After standardizing the dataset, they trained a GAN network and for comparative reasons a k-Means model, where the former appeared to outperform the latter.  
On many occasions, comparative analysis between several unsupervised learning algorithms may give valuable results concerning the relative behavior of the above methods for the problem at hand. Such an analysis is reported in [170], where the performances of four well-known unsupervised methods (i.e., isolated forest, k-Means, autoencoder, and cluster-based local outlier factor (CBLOF)) were evaluated using bitcoin data collected from diverse sources such as IEEE Data Port and Kaggle.  
As mentioned above, in the Ethereum network, two transaction types are carried out in terms of smart contracts, namely, internal and external. Smart contracts that are not labeled as malicious cannot be considered as such (even in the case it is malicious), but rather only to hypothesize (i.e., suspect) that it is malicious. From a clear point of view, an account is considered malicious if there is proof that it is involved in (i.e., carries out, facilitates, and/or supports) illegal activities such as Ponzi schemes, Lendf Hack, Akropolis Hack, Phishing, Gambling, etc. Some of these activities are motivated by social behavior, while others take place due to the exploitation of bugs and vulnerabilities. Therefore, since there are many different types of activities originating from different motivations, any associations between vulnerabilities and particular malicious activities appear to be a difficult task. Unsupervised learning can be effectively used to identify smart contracts showing malicious behavior (even when the contract is not labeled as malicious), while at the same time, it has vulnerabilities. In this regard, it has been shown that there is a strong correlation effect between vulnerabilities in smart contracts (SCs) and illegal activities on the cryptocurrency platform. In [173], the authors studied the vulnerabilities of SCs using the concept of severity score [174]. As it was expected that the severity score would assist in identifying the correlation between vulnerabilities and malicious behaviors, they added it to the set of features originally extracted from the dataset taken from Etherscan [149]. To carry out the anomaly detection they applied, over the obtainedfeature space, several unsupervised learning algorithms such as the k-means, HDBSCAN, spectral clustering, agglomerative clustering, and one-class SVM, while the silhouette score was used to quantify and compare the resulting performances.