# Anomaly Detection in Blockchain Networks Using Unsupervised Learning: A Survey
## 7 Unsupervised Learning-Based Blockchain Anomaly Detection
### Category 3: Combining Unsupervised and Supervised Learning Algorithms
#### 7.3.1 Combination Type 1  
As blockchain networks evolve, their dynamic properties provide a foothold to better distinguish between malicious and benign activities. In that sense, as the illegal activities (e.g., money laundering, Ponzi schemes, phishing, scamming, etc.) increase, the employment of predictive classification of the blockchain entities (e.g., accounts, transactions, etc.) is of major importance in establishing security [175]. Supervised learning can effectively address that issue since it is very effective in providing accurate predictions. The usage of supervised learning is based on the existence of labeled data. However, in blockchain technologies, there is a lack of labels mainly due to two reasons. First, data labeling relies on clearly denoting and assigning ground truth values, and it can be accomplished by adopting data annotation techniques. A major problem related to data annotation is that it requires a huge workload, and therefore, it is difficult to obtain a sufficient and accurate dataset suitable for supervised algorithms. In addition, labels resulting from law enforcement investigations are not immediate and, as indicated above, annotation is costly [29]. Second, the evolving complexity of blockchain ecosystems has also led to an increase in the complexity of illegal activities making the process of identifying all (or even most) of the entities and parameters a difficult problem. As such, the use of unsupervised learning becomes more appealing having better application prospects because it does not need to mark the available dataset [172]. Figure 5: Combination types between supervised and unsupervised learning for blockchain anomaly detection: (**a**) type 1 and (**b**) type 2. It turns out that without designing an effective strategy to handle the above issues, the usage of supervised algorithms in blockchain anomaly detection might be limited. An effective solution is to integrate unsupervised learning to preprocess the data and generate the appropriate data labels (i.e., ground truth assignments). In that direction, [PERSON] et al. [176] made a valuable contribution to the labeling process of wallets by providing a two-step model that applied in sequence the Expectation Maximization and the k-means algorithms to preprocess the data. The data were taken from Binance [177] and ethescan.io [149] with a Python API. The authors extracted several features related to the wallets' properties and applied the Expectation Maximization to detect the outliers in the feature space. Then, the implementation of k-means was set up to further cluster the outliers and provide the appropriate labels to each one of the resulting clusters (i.e., malicious or benign wallets). The labeled data were represented in terms of a decision tree structure, and the random forest algorithm was used to obtain effective predictions as far as the malicious wallets are concerned. A different point of view concerns the collection of the addresses involved in the detection of malicious activities, such as scams, in public networks [178]. Any algorithmic (i.e., automatic) elaboration on the transactions linked to a scam or any other type of threat, that has the purpose of quantifying the effect imposed by that threat, can be implemented after the above-mentioned collection of the addresses. Moreover, the difficulties involved in the above process increase since many addresses related to illegal activities may not be publicly available. In this case, those addresses might privately establish contact with the registered users. A solution to this problem, for the test case of Ponzi scheme threats in the Bitcoin network, was given in [179]. The authors adopted a graph-based representation of the data and additional datasets related to advertisements of investment programs taken from Reddit [180] and bitcointalk.org [181] that on many occasions hide Ponzi schemes.