# Anomaly Detection in Blockchain: A Systematic Review of Trends, Challenges, and Future Directions
## 4 Discussion
### Open Challenges and Future Directions
Many research studies use ensemble learning and explainable AI for fraud detection in blockchain transactions, indicating the growing importance of interpretability in AI-based security solutions [65; 144; 145; 146; 147]. This direction highlights the need for transparency in complex models, such as those used in deep and unsupervised learning, so that their decisions are understandable to security experts. Future research will likely pay more attention to the following:
* developing anomaly detection models with built-in mechanisms for interpreting results;
* creating intuitive visual explanations for identified anomalies to help security experts make informed decisions;
* combining expert knowledge and algorithmic approaches to form hybrid detection systems with improved interpretability. * _Real-time and adaptive detection systems._ The increasing complexity of fraud schemes and the rapid evolution of attack methods fundamentally necessitate the development of anomaly detection systems that operate in real-time. This need is not merely theoretical but is clearly demonstrated by the characteristics and demands of various application domains, as reflected in several prominent co-citation clusters (#1,#5,#6,#7,#8,#10). For instance, in the publications associated with cluster #1 [71; 73; 77], which focus on cryptocurrency networks, the speed and unpredictability of attacks necessitate immediate detection and rapid, adaptive responses to emerging malicious behaviors. A similar urgency is evident in sustainable smart cities (cluster #5) [107; 108; 109; 110; 111; 112] and industrial networks (cluster #6) [58; 113; 116; 117], where massive volumes of real-time data are continuously generated by IoT and IIoT devices. In such environments, timely and adaptive anomaly detection is critical to ensure the uninterrupted operation of essential infrastructure and safeguard public safety. The situation is even more acute in the domain of smart contracts (cluster #7) [98; 124; 125], where anomalies such as vulnerabilities or malicious executions can result in immediate and irreversible financial damages. Moreover, the emergence of 5G advanced networks (cluster #8) [126; 130], characterized by ultra-low latency and high throughput, both enables and necessitates the deployment of anomaly detection systems that can match the network's speed and complexity. These systems must be capable of processing vast data flows with minimal delay while maintaining high detection accuracy. Lastly, the publications in cluster #10 [98; 133; 134] highlight that highly dynamic and heterogeneous ecosystems require continuous anomaly identification and response mechanisms that can adapt in real time to evolving threats, device malfunctions, or behavioral deviations. Despite the lack of pronounced representation in recent citation bursts, the shift toward real-time, adaptive anomaly detection is a critical direction for practical applications of academic research. Moving forward, this entails the following:* implementing incremental learning methods to continuously adapt models to new types of attacks;
* developing early warning systems capable of detecting anomalies at the formation stage;
* creating distributed monitoring systems that minimize detection latency without compromising accuracy. * _Cross-domain integration and specialized applications._ The analysis of the keyword map (Figure 5), the timeline map of reference co-citation (Figure 8), and the core publications in clusters #5, #6, and #10 reveals a consistent and accelerating trend toward the specialization of anomaly detection methods tailored to distinct application domains within the blockchain security ecosystem. In particular, publications in cluster #5 emphasize the integration of blockchain-based security mechanisms into smart city infrastructures [107; 110]. The convergence of diverse IoT devices and public service networks necessitates anomaly detection approaches that are domain-aware and capable of responding to complex interdependencies between systems.