# Anomaly Detection in Blockchain Networks Using Unsupervised Learning: A Survey
## 7 Unsupervised Learning-Based Blockchain Anomaly Detection
### Category 1: Solitary Implementation of Unsupervised Learning
To encapsulate the essence of the resulting partition succinctly, the clusters were assigned labels based on a tokenization procedure, while the evaluation process was conducted using the frequency distribution values, which are in the position to assess the homogeneity within each cluster. A particular category of anomaly detection methods relies on viewing users and types of users as entities and then partitioning those entities into groups with similar characteristics for the identification of the corresponding behavior patterns based on the transactions performed by those entities [124]. Hence, it appears that the users' behavior patterns become decisive tools in determining malicious behaviors. A promising procedure to detect and analyze behavior patterns relies on using time series (i.e., sequences) representation of the data related to user nodes. Works focused on that issue were separately developed by [PERSON] et al. [133] and [PERSON] and [PERSON] [134]. The former defined the behavior patterns as changes in the transaction amount over time for a specific user node, while the latter as the time needed to execute each transaction as well as the amount transferred by that transaction. Both works used the Dynamic Time Warping (DTW) measure to quantify dissimilarities between sequences and variants of the k-Means algorithm to group the sequence patterns into a predefined number of clusters, where the anomalous patterns were considered, i.e., those that did not conform to any cluster representative (i.e., cluster center). Similar strategies consist of developing effective mechanisms to quantify behavior patterns in a blockchain ledger, such as the detailed auditing of log-in chain event incidents. This mechanism provides the ability to view and treat the transactions belonging to a certain block as sequences of events, each of which is assigned to a certain time interval. As a result, it can be very helpful in tracing a chain (i.e., sequence) of events preceding a particular event incident with the ultimate purpose of finding out whether that incident is malicious or not. In [132], such kind of chain events were defined as patterns, and the T-patterns method [150] was adopted to trace the event chains, which are then clustered in terms of an agglomerative hierarchical clustering procedure [151] to identify suspicious chains of events as outliers. In [106], a blockchain network specially designed for device management in IoT applications was developed. The primary assumption was that an effectively trained anomaly detection model is in the position to distinguish behaviors that deviate from normal ones, thus possessing the capability of recognizing new threats entering the network without any further learning procedures. The framework consisted of two stages. The first encompassed an anomaly detection procedure by adopting the extended Markov model. The second implements and evaluates the anomaly detection model in a well-designed blockchain-based distributed IoT environment. Cluster analysis has also been used in supporting consensus protocols [152; 153; 154; 155; 156; 157; 158; 159; 160]. For example, [PERSON] et al. [125], to avoid data tampering and fraudulent activities, developed a customized clustering-based consensus protocol to carry out a decentralized consensus mechanism, according to which the k-Means was applied locally by multiple competitive miners. The methodology comprised four layers (i.e., data layer, network layer, blockchain layer, and machine learning layer) and had two main actors: management and miner. Upon the convergence of the k-Means, each miner embedded the resulting block into the network.