# Anomaly Detection in Blockchain Networks Using Unsupervised Learning: A Survey
## 4 Anomalies and Anomaly Detection in Blockchain
### Anomaly Detection in Blockchain Networks  
The role of anomaly detection in blockchain security is multifaceted. Researchers are developing models for various blockchain layers, predicting anomalous commands in smart contracts, or detecting malicious block deployments. Continuous monitoring of network behavior, facilitated through both active and passive monitoring, is indispensable for timely anomaly detection [81]. Active monitoring involves the focused observation of specific network segments, while passive monitoring encompasses the comprehensive analysis of the entire network's performance. Both approaches share the common goal of identifying anomalous properties, determining whether they pose a threat, and responding accordingly. The complexity of anomaly detection aligns with the complexity of the solution, necessitating a combination of clustering, classification, and analytical tools tailored to the type of anomaly and desired outcomes [81; 103]. It is important to note that the anomaly detection or prevention problem's complexity corresponds to the solution's complexity. The solution is not a singular algorithm but rather a model based on a combination of various algorithms. Analytical tools are also integrated to visualize the output, providing researchers with a clearer perspective. Similarly, when attempting to identify abrupt or systematic changes in data, models based on classification and clustering prove to be the optimal choice [26]. In contrast, if the goal is to analyze slow and long-term modifications and changes in the network, specific statistical and analytical tools become more suitable for conducting the analysis [74]. Figure 2: Impact of the 2017 attack on the Bitcoin blockchain, where delayed payments and market value are the negative impacts to the network as the spam transactions and mining process fees increase. The methods employed in anomaly detection are diverse, with statistical analysis delving into transaction and block distributions, machine learning algorithms discerning from normal behavior patterns, and network analysis scrutinizing transaction flow for abnormal activity. In particular, machine learning works towards establishing baseline patterns from historical data and identifying any deviations that fall outside the expected range [104]. For example, regarding the use of cluster analysis, such kinds of deviations correspond to outliers, which refer to observations that are dissimilar to the rest of the data points within a given sample. Table 2 depicts the basic characteristics of several anomaly detection frameworks, while the subsequent paragraphs delineate their basic operational properties. Statistical analysis: By harnessing the power of statistical measures, it strives to establish normal behavior patterns within a given dataset [35; 105]. Through the meticulous analysis of data distributions, correlations, and probabilistic models, statistical inference methods provide insights into the expected behavior and help identify deviations that may indicate anomalous activities [104; 105; 106]. Data mining: In the ever-evolving landscape of anomaly detection, data mining techniques emerge as powerful allies. Armed with the ability to learn from historical data, these methods adapt to changing environments and evolving anomalies [25]. Through the exploration of vast datasets, they attempt to reveal hidden patterns, correlations, and trends, enabling analysts to uncover deviations from expected behavior [28; 104]. Network analysis: When it comes to anomaly detection in interconnected systems, network analysis takes center stage. By delving into the intricate web of relationships and interactions, network analysis can capture systemic anomalies that span across multiple nodes or connections [105]. These methods leverage graph theory and network metrics to identify network-level attacks, such as coordinated efforts to disrupt communication or exploit vulnerabilities [107].