# Anomaly Detection in Blockchain Networks Using Unsupervised Learning: A Survey
## 5 Data Mining Techniques Employed in Blockchain Anomaly Detection
### Categories of Unsupervised Learning Algorithms  
The categorization of unsupervised learning algorithms for anomaly detection within blockchain networks underscores the diverse methodologies available to researchers and practitioners. By comprehensively understanding their attributes, strengths, and limitations, stakeholders can harness their capabilities to enhance the security, reliability, and scalability of blockchain systems.  
The categorization consists of seven categories commonly employed by the anomaly detection methods presented in Section 7. Table 3 depicts the algorithms along with their categorization and computational complexity, while the categories along with their basic characteristics are described in the subsequent paragraphs.  
* Partitional Methods: They mainly refer to partitional clustering algorithms such as the standard k-Means and its variants, and agglomerative hierarchical clustering [37]. Some more recent algorithms that fall into this category are the Birch [38] and affinity propagation [111].
* Graph-based methods: They are based on representing the blockchain transaction data in graph structures, where nodes represent entities (e.g., addresses, accounts), and edges represent transactions between these entities. Each node may have associated attributes such as transaction volume, frequency, etc. Then, they calculate similarities between nodes based on their behaviors and identify groups of similar nodes. Typical approaches falling in this category are the deepwalk [112], spectral clustering [113], and Louvain method [114].
* Density-based approaches: They attempt to quantify the density measure of data points in the feature space. Regarding blockchain anomaly detection, this is translated into determining the density of addresses, transactions, transaction volumes, frequency, and relations between users and addresses. Points with low densities are likely to be labeled as malicious and anomalous. Representative algorithms commonly used are the local outlier factor (LOF) [115], the DBSCAN [116], and HDBSCAN [117] algorithms.
* Probabilistic unsupervised learning algorithms: They are based on evaluating the underlying probability distributions of the data. They involve inherent modeling of latent variables, and they have been proven to be very effective in discovering hidden patterns in the data. Algorithms that are based on probabilistic modeling are the expectation maximization algorithm [37], the variational autoencoder [118], and the generative adversarial networks (GANs) [119].  
* One-Class Classification: It performs anomaly detection by creating boundaries around normal data points in a high-dimensional space, which contains them in a defined region. Any data points that fall outside this boundary are identified as anomalies. The main representative of this category is the one-class support vectors machine (SVM) [41].
* Tree-Based methods: They represent the blockchain data in decision tree structures and perform a labeling process according to which nodes that are isolated from the majority of nodes are defined as malicious. The most used algorithm credited to this category is the isolation forest [120].
* Dimensionality reduction methods: They focus on transforming the available high-dimensional data points into low-dimensional points, preserving the relative distances between them. Low-dimensional representation provides several advantages such as convenient visualization and easy outlier detection. In general, they are applied as assistive tools to the above categories. Such kinds of algorithms are the well-known principal component analysis (PCA) (which is linear transformation) and the t-SNE (which is non-linear transformation) [121].