## 5 Experimentation Process
### Anomaly Detection  
Throughout this section, we describe how the Elliptic transaction dataset was tested against a series of well-established outlier detection algorithms for the sake of testing Hypothesis 1. The objective was to find a correlation, at least a partial one, between the transactions classified as outliers by the algorithms and those labelled as illicit. The choice of the anomaly detection algorithm needed to take into consideration different aspects intrinsic to the anomaly concept. For this experiment, a set of four common outlier detection algorithms was selected, as they represent some of the main techniques that are widely used in feature-based outlier detection. * Local Outlier Factor (LOF) [19]: This algorithm evaluates the local outlier factor for an element based on the local density of its \(K\) nearest neighbours, considering their features for computing the distance. It is particularly robust when applied to datasets with varying densities or clusters. Therefore, it can be effective in detecting some types of fraud since they can often appear as localized anomalies, for example, a transaction with unusual patterns within a cluster of transactions. * Isolation Forest (ISOF) [42]: This method uses several random binary trees with different decision thresholds for randomly selected features to isolate anomalous samples on the leaves. It is particularly optimal for high-dimensional data, which were analyzed in this study, and has a very efficient time complexity, which could help scale the algorithm to large datasets such as the entire blockchain. * SGD One-Class SVM: This approach adapts the classical Support Vector Machine to a non-supervised approach by using a Stochastic Gradient Descent to efficiently fit a boundary that includes inlier data and keeps outliers on the outside. The ability to  
Figure 13: A visualization of a sampled subgraph. model complex boundaries can make it effective in fraud detection, since anomalous patterns can be distinctly separated from normal behaviour. * Elliptic Envelope: This method assumes that the data follow a Gaussian distribution and fits an ellipse that serves as a boundary between inliers and outliers. Many types of financial fraud often appear as deviations from standard Gaussian-like behaviour [43] (for example, the distributions of transaction amounts). Under these assumptions, the algorithm can efficiently identify these deviations. All the algorithms were applied to the 75 reduced dimensions obtained after PCA, described in the preceding subsection. While both labelled and unlabelled data from the transactions dataset were fed to the outlier detection algorithms, only labelled and known data were taken into account for measuring the performance of these models. Since all these algorithms return an outlier score for each transaction, a threshold had to be fixed to establish the boundary between inliers and outliers. Therefore, and to deal with the high class imbalance of the dataset, this threshold was set so that 8% of the predictions were classified as outliers, following a licit/illicit proportion as near as possible to the real labels of the dataset. As a result, Table 1 shows the metrics of the four aforementioned algorithms, taking as positive predictions (illicit) those transactions classified as outliers and negative predictions (licit) those classified as inliers. Some of the best metrics were obtained with the LOF method using \(K=2\) neighbours, even though experiments conducted with other values of \(K\) obtained a very similar performance. This suggests that the local density was not that relevant for anomaly detection on this dataset. Figure 14 shows the confusion matrix of the results obtained in this specific experiment.