# Anomaly Detection in Blockchain Networks Using Unsupervised Learning: A Survey
## 7 Unsupervised Learning-Based Blockchain Anomaly Detection
### Category 2: Combining Unsupervised Learning Algorithms
#### 7.2.1 Cascade Combination Type  
In general, it is widely assumed that any suspicious user-based and/or transaction-based behavior is likely to act as a proxy for anomaly behavior. It is also well accepted that any solution to that problem can be extended to other network settings that may not concern financial transactions. To address that issue, [PERSON] and [PERSON] [156] represented the Bitcoin  
Figure 4: Combination types between unsupervised learning algorithms for blockchain anomaly detection: (**a**) cascade type and (**b**) parallel type. data in the form of two graph structures to encode the users (i.e., users' graph structure) and the transactions (i.e., transactions' graph structure), according to the methodology of [PERSON] and [PERSON] [78]. Considering both graphs they extracted a set of 12 features that described the user and transaction properties of the respective nodes, and applied three unsupervised learning mechanisms, namely, the k-means, Mahalanobis distance, and the one-class SVM. However, they found that the k-Means clustering algorithm was not effective enough for anomaly detection. Therefore, in their subsequent study [157], they improved the performance of the k-Means algorithm using the local outlier factor (LOF) method [115]. In particular, they used the k-Means in sequence with the LOF algorithm, where the LOF indices were determined by the k-Means. The number of clusters used by the k-Means algorithm was evaluated by optimal clustering in terms of the cross-entropy measure. The study of the cryptocurrency data for identifying market manipulation can provide all stakeholders (i.e., traders, investors, etc.) with insightful points that concern the assets they are interested to sell or buy. Such trade-based market analysis was carried out in [162]. To effectively detect contextual-based anomalies in the form of outliers, the authors used tree-based data representation and developed an unsupervised learning algorithm that combined in sequence the KDE-Track algorithm [163] and the isolated forest method [120]. The former assumed that values in sparse regions are likely to be identified as outliers, while the latter was based on the observation that the mean path length from the tree root to an anomaly leaf is shorter than the paths to normal tree nodes. The in-sequence implementation of k-Means and RolX [164] was investigated in [165]. The RolX constitutes an unsupervised learning mechanism that attempts to classify the nodes of a graph in several classes (called roles), each of which contains nodes with similar structural features. The authors represented the data as user graphs in a similar way to the approach in [78]. The key issue was to use the k-Means to categorize nodes with multiple transactions (called hubs), and to use the RolX algorithm to assign to each hub a role able to identify anomalous user behaviors related to money laundering/mixing services. [PERSON] et al. [139] discussed the problem of identifying ransomware attacks in the Bitcoin network. They employed a graph-based representation of the Bitcoin data extracted from the wallet explorer API [166] with random seed addresses. To accomplish this task, they used in sequence three unsupervised learning algorithms, namely, the Louvain algorithm to preprocess the graph data, the Deepwalk embeddings method [112] to carry out the feature extraction process, and the k-Means algorithm to evaluate the risky nodes in terms of the cosine similarity measure. Graph embeddings have also been used in coping with the pseudonymity established between users and transactions in the Bitcoin network. For example, to reveal relationships hidden in the data, [PERSON] et al. [167] determined patterns that are linked to those relationships by setting up a cluster analysis based on embedding feature generation. Embeddings were created by the utilization of the variational graph autoencoder [118] and explainable k-Means [168].