The problem of anomaly detection has been studied for a long time, and many Network Analysis techniques have been proposed as solutions. Although some results appear to be quite promising, no method is clearly to be superior to the rest. In this paper, we particularly consider anomaly detection in the Bitcoin transaction network. Our goal is to detect which users and transactions are the most suspicious; in this case, anomalous behavior is a proxy for suspicious behavior. To this end, we use the laws of power degree and densification and local outlier factor (LOF) method (which is proceeded by k-means clustering method) on two graphs generated by the Bitcoin transaction network: one graph has users as nodes, and the other has transactions as nodes. We remark that the methods used here can be applied to any type of setting with an inherent graph structure, including, but not limited to, computer networks, telecommunications networks, auction networks, security networks, social networks, Web networks, or any financial networks. We use the Bitcoin transaction network in this paper due to the availability, size, and attractiveness of the data set.
@cite_6 make use of clustering techniques to detect anomalies. The main idea is that these methods should be able to group normal users activities together and separate from abnormal ones. use k-means clustering, self-organizing maps, and the expected maximization algorithm to develop methods for the detection process. Motivated by this, we think we can have a good use of k-means clustering method on the Bitcoin dataset. However, we will not use k-means as a real method to detect anomalies because clustering in its deep sense is for grouping purposes. Instead, we will use it as a baseline model. Since we expect outliers (i.e. anomalies) to stay far away from the centroids found by @math -means, @math -means can be used to assess our true method. In the same sense, @math -means is helpful for visualization purposes. Most importantly, without @math -means to find the centroids, we cannot calculate LOF indices in the next part, which defines our notion of anomalies; the connection between @math -means clustering method and LOF method will be discussed in more details in the Methods section.
@cite_6
2020362899
K-means is a widely used partitional clustering method. While there are considerable research efforts to characterize the key features of K-means clustering, further investigation is needed to reveal whether and how the data distributions can have the impact on the performance of K-means clustering. Indeed, in this paper, we revisit the K-means clustering problem by answering three questions. First, how the "true" cluster sizes can make impact on the performance of K-means clustering? Second, is the entropy an algorithm-independent validation measure for K-means clustering? Finally, what is the distribution of the clustering results by K-means? To that end, we first illustrate that K-means tends to generate the clusters with the relatively uniform distribution on the cluster sizes. In addition, we show that the entropy measure, an external clustering validation measure, has the favorite on the clustering algorithms which tend to reduce high variation on the cluster sizes. Finally, our experimental results indicate that K-means tends to produce the clusters in which the variation of the cluster sizes, as measured by the Coefficient of Variation(CV), is in a specific range, approximately from 0.3 to 1.0.