PaperlayerView exact revision on arXiv

Source-linked AI summary

Anomaly Detection in Blockchain Networks: A Comprehensive Survey

Muneeb Ul Hassan, Mubashir Husain Rehmani, Jinjun Chen

arXiv:2112.06089v3cs.CR

TL;DR

Blockchain networks remain vulnerable to security, privacy, reliability, and performance attacks despite their trust-oriented guarantees. This paper surveys anomaly-detection models across blockchain layers, reviews model-selection considerations and reported findings, and identifies unresolved challenges including consensus, bytecode, and domain-specific constraints.

  • Problem

    Blockchain networks can remain vulnerable to security, privacy, reliability, and performance attacks, creating a need to identify anomalous behaviour within a limited time.

  • Method

    The paper surveys anomaly-detection approaches across blockchain contexts, including model-selection strategies, clustering, network-layer detection, and attack classification.

  • Results

    The surveyed studies report improved anomaly-detection performance, including 76.5 percent accuracy for illicit-behaviour detection using k-means clustering on Bitcoin data.

  • Takeaways & Limitations

    Effective anomaly detection depends on matching the model to the available labels and problem scenario, while blockchain applications still require further research to improve security and trustworthiness.

  • Takeaways & Limitations

    Anomaly detection in blockchain is constrained by the need for network-wide consensus, information loss in bytecode, and rules that vary across application domains.

Abstract

from arXiv · show

Over the past decade, blockchain technology has attracted a huge attention from both industry and academia because it can be integrated with a large number of everyday applications of modern information and communication technologies (ICT). Peer-to-peer (P2P) architecture of blockchain enhances these applications by providing strong security and trust-oriented guarantees, such as immutability, verifiability, and decentralization. Despite these incredible features that blockchain technology brings to these ICT applications, recent research has indicated that the strong guarantees are not sufficient enough and blockchain networks may still be prone to various security, privacy, and reliability issues. In order to overcome these issues, it is important to identify the anomalous behaviour within the actionable time frame. In this article, we provide an in-depth survey regarding integration of anomaly detection models in blockchain technology. For this, we first discuss how anomaly detection can aid in ensuring security of blockchain based applications. Then, we demonstrate certain fundamental evaluation metrics and key requirements that can play a critical role while developing anomaly detection models for blockchain. Afterwards, we present a thorough survey of various anomaly detection models from the perspective of each layer of blockchain. Finally, we conclude the article by highlighting certain important challenges alongside discussing how they can serve as future research directions for new researchers in the field.

I. INTRODUCTION

Blockchain supports diverse ICT applications through decentralization and cryptographic guarantees, yet remains vulnerable to security, privacy, reliability, and performance issues. This survey organizes blockchain anomaly detection research, evaluation requirements, existing surveys, and future challenges.

  • Blockchain has expanded from cryptocurrency into ICT applications including supply chains, finance, IoT operations, and cloud services.
  • Blockchain networks remain vulnerable to attacks despite their security and immutability properties, creating a need for timely anomaly identification.
  • The authors position the work as an in-depth blockchain anomaly detection survey, addressing a gap left by prior surveys and related studies.
  • The survey covers anomaly attacks, detection models, evaluation metrics, robust and timely identification requirements, and future research challenges.
  • Traditional anomaly detection models cannot be directly applied because blockchain combines consensus, smart contracts, decentralized transactions, and the absence of central authority.

II. PRELIMINARIES OF ANOMALY DETECTION IN BLOCKCHAIN

Blockchain evolved from cryptocurrency-focused decentralized consensus toward programmable smart-contract systems and broader applications. Its layered architecture separates data, networking, incentives, and execution-related functions.

  • Development phases of blockchain: Blockchain 1.0 introduced decentralized proof-of-work consensus for validating financial transactions without centralized authority.
  • Development phases of blockchain: Blockchain 2.0 added programmability through smart contracts, enabling users to develop decentralized applications and intelligent contracts.
  • What is blockchain?: Blockchain blocks contain headers with linking metadata and bodies with transactions, while cryptographic hashes connect blocks into a chain.
  • Blockchain layers: Researchers divide blockchain architecture into layers, with taxonomies differing in the number and names of layers, including data, network, consensus, application, and execution layers.
  • Blockchain layers: The network layer distributes, forwards, and verifies blocks among peers in the decentralized P2P network.
  • Blockchain layers: The incentive layer motivates participants through financial rewards in a decentralized network without central authority.

3) Incentive Layer:

The paper organizes blockchain anomaly detection models by their functioning and blockchain layers, emphasizing model selection according to data, labels, and anomaly type.

  • Selecting the optimal model: Supervised models suit labelled records, semi-supervised models suit sparsely labelled data, and unsupervised models suit completely novel unlabelled inputs.
  • Selecting the optimal model: Outlier detection addresses small nonsystematic pattern variations, whereas classification and clustering address abrupt or systematic changes.
  • Blockchain anomaly detection models are categorized by functioning into generative, classification, clustering, nearest-neighbour, statistical and analytical, and reinforcement-learning approaches.
  • Layer-based classification: Anomalies should be classified by blockchain layer because detection requirements differ across smart-contract, incentive, and network behaviours.

E. Technical Challenges while Integration of Anomaly Detection in Blockchain

Integrating anomaly detection into blockchain networks introduces challenges involving decentralized consensus, feature selection, bytecode information loss, and application-specific rules.

  • Blockchain anomaly detection requires network-wide consensus on whether an event is anomalous because decentralization provides no central authority for determining rules.Malicious nodes make agreement and appropriate responses more difficult.
  • Selecting features for new attacks is difficult because blockchain is a novel paradigm and many attacks are unfamiliar even to researchers.
  • Smart-contract anomaly detection is constrained by limited references for labeling contract purposes and by the similarity of many contracts.Researchers have developed automated methods for labeling new and unknown smart contracts.
  • Bytecode-based contracts complicate real-time anomaly detection because traditional models are difficult to run and compilation can discard information.
  • Anomaly rules must be redesigned for each blockchain application because smart-grid and electric-vehicle networks can follow different rules.Manual inspection is described as tiresome and inefficient.

1) Malicious Transaction Pattern Detection:

The survey describes malicious transaction patterns and related blockchain attacks, including double spending, market manipulation, money mixing, theft, routing attacks, and fork formation.

  • Malicious transaction patterns: Double spending exploits decentralized validation by attempting to use the same asset more than once before transaction finalization.
  • Market manipulation: Blockchain manipulation includes pump and dump, wash trading, and whale wall spoofing strategies affecting financially associated assets.
  • Malicious transaction patterns: Money mixing can support legitimate anonymity but may also conceal transaction patterns used for unlawful activities such as money laundering.
  • Currency/token theft: Blockchain hackers reportedly stole approximately $3.8 Billion in 122 attacks during 2020.
  • Divergent paths and forks: Adversarial trading or smart-contract activity can exploit ledger immutability to initiate divergent paths and form new forks.Bitcoin Cash is cited as an example of fork formation.
  • Routing attacks: Routing attacks use malicious network requests to divide communication and include partition- and delay-based attacks.

8) Divergent Path & Forks:

The paper connects blockchain anomalies to operational logs, attack taxonomies, detection-model categories, and evaluation through confusion-matrix outcomes and sensitivity or specificity considerations.

  • Adversarial nodes may tamper with blockchain-recorded operational logs, making quality scrutiny and auditing difficult or impossible.
  • Fig. 4 is presented as a taxonomy for visualizing anomalous attacks on blockchain technology.
  • Fig. 3 presents a taxonomy of anomaly detection models, including generative, classification, clustering, and other functioning-based categories.
  • Evaluation considerations: Anomaly detection systems must balance missed anomalies against false alarms because either error can create serious trouble.
  • Evaluation considerations: A confusion matrix compares predicted and actual class labels using true-positive, false-positive, true-negative, and false-negative outcomes.An ideal model has high TP and TN rates and low FP and FN rates.

2) Confusion Matrix & Accuracy:

Blockchain anomaly detection requires appropriate evaluation metrics, sufficient and carefully prepared data, and computational resources that support timely identification. These requirements are complicated by blockchain-specific data-access and privacy constraints.

  • Confusion Matrix & Accuracy: Accuracy compares correctly classified instances with all positive and negative predictions using the paper's stated equation.The supplied equation expresses accuracy as (TP + TN) divided by TP + FP + FN + TN.
  • Confusion Matrix & Accuracy: Recall, precision, and F-score are standard measures used to evaluate anomaly detection outcomes.Recall concerns correctly identified actual positives, while precision accounts for false positives among positive predictions.
  • Data Requirements: Adequate data is necessary, but private and consortium blockchains restrict access and pseudonyms can impede tracing identified anomalies to individuals.The paper also emphasizes protecting participant privacy during data collection and analysis.
  • Data Preprocessing Requirements: Preprocessing reduces noise and vulnerabilities through cleaning, transformation, feature selection, data reduction, and discretization.The paper notes that real-time big-data preprocessing tools have not yet been integrated into blockchain anomaly detection.
  • Computational Requirements: Computational requirements must match the task so models can detect anomalies within the required time frame.Some anomaly types require processing large amounts of data, whereas other models need minimal computational power.

3) Computational Requirements:

The paper surveys anomaly detection across blockchain data and network contexts, emphasizing that blockchain-specific behavior requires specialized analysis. Existing approaches include transaction features, visualization, clustering, and deep learning, while behavior-pattern classification remains underexplored.

  • Layered Classification: Blockchain anomaly detection models are organized by layers, including data and network perspectives.The supplied passages identify dedicated classifications and surveys for data-layer and network-layer anomalies.
  • Bitcoin Fraud Detection: Bitcoin transaction analysis uses engineered features and supervised learning to classify anomalous addresses and identify malicious investment-program behavior.Toyoda et al. ranked transactions using Bitcoin features, while Lin et al. developed features for supervised address-classification models.
  • Generic Blockchain Analysis: Visualization-based analysis of blockchain IoT systems targets both network health assessment and anomaly detection.The framework analyzes indicators including blockchain height, transaction count, and generation-related information.
  • Behaviour Pattern Classification: Clustering and deep learning models showed significant accuracy improvements over traditional learning approaches for blockchain behavior classification.One approach used collected data with class labels, while another evaluated peer similarity and distance using precision.
  • Behaviour Pattern Classification: Behavior-pattern classification remains relatively under-discussed and offers substantial scope for future research.The survey identifies this as a research-potential area after comparing clustering and deep-learning approaches with traditional methods.

D. Ethereum Fraud Detection

Ethereum supports decentralized applications and smart contracts, creating additional opportunities for anomalous peers to exploit. The surveyed work addresses vulnerability detection, transaction-pattern analysis, and malicious-account identification, while noting continuing model-development needs.

  • Ethereum Fraud Detection: Ethereum combines cryptocurrency transactions with decentralized applications and smart contracts, distinguishing it from Bitcoin.Smart contracts are described as code executed in a decentralized manner.
  • Ethereum Fraud Detection: Ensemble deep learning strengthens an encoder-decoder model by iteratively applying learning and aggregation to estimate prospective outliers.The surveyed evaluation reports results for detecting vulnerabilities in the Ethereum blockchain, although it lacks comprehensive theoretical analysis.
  • Transaction Analysis: Transaction-pattern analysis clusters transactions using logs and Levenshtein distance before detecting anomalous behavior through observed parameters.The approach focuses on predicting future behavior from current timestamp patterns.
  • Data-Layer Context: Data-layer anomalies are treated as potentially catastrophic and are divided into five subtypes.The passage frames the data layer as blockchain's backbone for handling and securing records.
  • Malicious Accounts: Malicious-account detection uses methods including SVM, clustering, and graph analysis, but the survey calls for further advancement.It specifically identifies modern deep learning and reinforcement learning as possible directions for improving detection accuracy.

B. Malicious Forks in Network

This section reviews network-layer anomalies, including malicious forks, anomalous transactions, accounts, and network behavior, emphasizing timely detection. It also identifies malicious-fork detection as insufficiently studied.

  • Malicious Forks in Network: Forks split the blockchain into separate chains and may serve advantageous or malicious purposes.Forks arise from disagreement among miners over the network’s best path forward.
  • Malicious Forks in Network: Malicious-fork detection remains insufficiently studied, while integration of modern machine-learning models is still lacking.The survey calls for studying fork behavior to support timely detection of malicious formation.
  • Malicious Forks in Network: GPU-based processing detected anomalous transactions 37.1 times quicker than a traditional CPU-based model.The model combined abnormality detection and feature extraction in GPU memory.
  • Malicious Forks in Network: Network-layer anomalies include malicious forks, transactions, accounts, and other issues affecting blockchain communication and information delivery.The network layer supports communication among nodes and transaction legitimacy, making its anomalies potentially disastrous.

A. Bitcoin Fraud Detection

This section surveys Bitcoin fraud-detection studies that identify atypical transactions and users through relational analysis, clustering, supervised learning, and feature engineering. The reviewed work reports measurable detection performance while noting substantial room for further research.

  • Bitcoin Fraud Detection: Bitcoin fraud studies identify atypical transaction patterns and trace coin-mixing roots using relational checks on transaction data.Researchers analyze fraud from both global and local perspectives.
  • Bitcoin Fraud Detection: Unsupervised clustering and supervised models, including logistic regression and random forests, are used to identify global and local outliers.The reviewed clustering analysis reported an optimal cluster count of 8.
  • Bitcoin Fraud Detection: 76.5 percent accuracy was reported for detecting illicit behavior using k-means clustering and 21 extracted Bitcoin features.Users were categorized according to transaction occurrence frequency.
  • Bitcoin Fraud Detection: The survey identifies a continuing need for research beyond clustering and graph analysis, including reinforcement and generative architectures.The authors associate these directions with potentially more accurate data.
  • Bitcoin Fraud Detection: GPU-oriented structural graphs achieved 195 times faster execution than traditional methods when evaluated on 300 million transactions.The study also reported a substantially larger true positive rate than traditional anomaly-detection models.

E. Summary and Insights

This section summarizes anomaly detection across blockchain’s incentive and contract layers, covering financial fraud, consensus-related anomalies, faulty signals, and malicious smart contracts. It also highlights scope boundaries and unresolved detection needs.

  • Summary and Insights: The incentive layer motivates mining and related participation but is also targeted because anomalous peers can gain incentives and tokens.Reported attacks include cryptocurrency fraud and other incentive-layer anomalies.
  • Summary and Insights: Dependent transactions in Paxos-related anomalies can make problems more catastrophic in private blockchains, potentially causing double spending and uncommitting.Researchers evaluated the effect by automating anomaly reproduction under different mining difficulties.
  • Summary and Insights: Deterministic smart-contract anomaly detection in blockchain-based IoT networks addresses malicious attacks and faulty signals or transactions.The survey states that faulty-signal detection remains insufficiently advanced.
  • Summary and Insights: Smart-contract bytecode was successfully classified by attributes using a five-stage learning model evaluated on EtherScan and Google BigQuery datasets.The study’s pipeline ranged from pre-training to inference.

E. Malicious Threats in Smart Contracts

This section examines malicious smart-contract threats, including honeypots and other security risks, and discusses log-based and machine-learning detection approaches. It emphasizes the need for privacy-aware anomaly detection and stronger prevention of harmful contracts.

  • Malicious Threats in Smart Contracts: Smart contracts cannot be stopped once execution begins, so malicious dependencies, threats, and honeypots can harm networks or individuals.The section presents timely identification and destruction of such contracts as necessary for network safety.
  • Malicious Threats in Smart Contracts: HoneyBadger is a tool developed to identify Ethereum honeypots, defined as contracts that trick users into giving funds to attackers.The tool formalizes the honeypot concept for detection.
  • Malicious Threats in Smart Contracts: A reviewed smart-contract threat detector achieved 99.57% test accuracy.The reported result concerns identifying threats in smart-contract analysis.
  • Malicious Threats in Smart Contracts: Contract-layer anomaly detection includes log-based approaches and covers dependent-transfer restrictions, faulty signals, Ponzi schemes, and security threats.The survey describes the contract layer as a technical layer associated with decentralized applications.
  • Malicious Threats in Smart Contracts: Blockchain anomaly-detection studies reviewed by the authors did not integrate privacy preservation, despite the ledger’s replicated structure and detailed data analysis needs.Proposed directions include differential privacy and zero-knowledge proofs, with a utility–privacy tradeoff.

2) Integrating Federated Learning with Blockchain Anomaly Detection:

The survey identifies federated learning as a natural fit for decentralized blockchain anomaly detection and outlines consensus, market-manipulation, and computational challenges requiring further work.

  • Federated learning: Existing blockchain anomaly-detection models commonly train machine-learning systems centrally, while federated learning remains largely unexplored for this application.The authors propose developing federated models compatible with blockchain’s decentralized nature.
  • Federated learning: Federated learning could reduce centralized data collection, storage, and detection overhead while strengthening trust in the network.Its decentralized operation avoids collecting large datasets on centralized servers.
  • Consensus: Anomaly reporting creates a consensus problem because blockchain nodes must agree that a nominated vulnerability is genuinely anomalous.This extends consensus beyond agreeing on unified transactions to agreeing on anomaly labels.
  • Consensus: Potential directions include rapid anomaly dissemination and consensus penalties or rewards for reporting true or false anomalies.The survey describes a substantial gap in consensus modifications designed specifically for anomaly detection.
  • Market manipulation: Timely detection and notification of market manipulation are important in decentralized digital asset markets because malicious participants seek unfair advantage.The survey frames market manipulation as an ongoing challenge for blockchain-based applications.

1) Malicious Threats Identification in Modern Smart Contract Platforms:

The survey highlights uneven coverage of smart-contract platforms, cross-layer attacks, and interoperability as central challenges for blockchain anomaly detection. It advocates broader platform coverage and flexible models that adapt across dynamic blockchain environments.

  • Malicious smart-contract platforms: Anomaly-detection research on smart contracts focuses predominantly on Ethereum, leaving platforms such as Hyperledger Fabric, Stellar, Waves, and Nem underexplored.The survey calls for studying anomalous users and contracts across these alternative technologies while considering differing community standards for information sharing.
  • Cross-layer attacks: Cross-layer attacks exploit one blockchain layer to target another, expanding the attack surface beyond single-layer anomaly detection.The survey gives smart-contract denial of service as an example in which malicious contracts target network-layer processing.
  • Cross-layer attacks: Advanced detection mechanisms are needed for cross-layer attacks, including routing-aware approaches for DNS resolution attacks.The survey emphasizes detecting and addressing these attacks before they harm the network.
  • Interoperability: Blockchain networks differ in validation mechanisms and interoperability requirements, so anomaly detectors designed for one network may not retain accuracy on another.The survey identifies architectural differences and cross-network data exchange as barriers to reusable detection.
  • Interoperability: Flexible and dynamic anomaly-detection models are needed to support interoperability across multiple blockchain networks and changing blockchain environments.The proposed direction is model adaptability rather than assuming one detector fits every platform.
  • Survey scope: The survey classifies blockchain anomalies and reviews detection models, evaluation metrics, and requirements across blockchain layers.It also discusses how anomaly detection can support trust and security in blockchain applications.
Loading 2112.06089v3…