System and a method for detecting anomalous activities in a blockchain network

A system for detecting anomalous activities in a distributed and decentralized network, interfacing with one or more transaction databases and one or more terminal devices, the system comprising:

• a memory storing program instructions;
• a processor configured to execute program instructions stored in the memory;
• and an anomaly detection engine in communication with the processor and configured to:
• generate a data set representative of identified users and associated transactional behavior, wherein users are identified from anonymous users transacting in the distributed and decentralized network using a first set of rules;
• generate a datatype by processing the data set using a second set of rules, wherein the datatype is representative of transactional behavior of the users with other users;
• generate one or more first level data clusters based on the data set and one or more transactional attributes by employing one or more clustering techniques, wherein each data cluster is representative of data associated with users having similar transactional behaviour;
• generate anomaly detection values based on the first level data clusters, the datatype and one or more behavioral parameters derived from the first level data clusters by employing an anomaly detection technique;
• classify users into one or more second level data clusters based on the generated anomaly detection values using a third set of rules, wherein the second level data clusters are representative of data associated with users having similar transactional behavior;
• classify users into one or more new data clusters based on the generated anomaly detection values using a third set of rules, wherein the new data clusters are representative of data associated with users having similar transactional behavior;
• determine if the classification of users into the new data clusters is same as the classification of users into the second level data clusters, wherein the classification of users is identified as optimum classification if the classification remains the same;
• and
• identify one or more users with high anomaly detection value from the users classified in the new data cluster classification determined as optimum classification, wherein the one or more users with high anomaly detection values are identified as anomalous users.

A computer program product comprising:

• a non-transitory computer-readable medium having computer-readable program code stored thereon, the computer-readable program code comprising instructions that, when executed by a processor, cause the processor to:
• generate a data set representative of identified users and associated transactional behavior, wherein users are identified from anonymous users transacting in the distributed and decentralized network using a first set of rules;
• generate a datatype by processing the data set using a second set of rules, wherein the datatype is representative of transactional behavior of the users with other users;
• generate one or more first level data clusters based on the data set and one or more transactional attributes by employing one or more clustering techniques, wherein each data cluster is representative of data associated with users having similar transactional behaviour;
• generate anomaly detection values based on the first level data clusters, the datatype and one or more behavioral parameters derived from the first level data clusters by employing an anomaly detection technique;
• classify users into one or more second level data clusters based on the generated anomaly detection values using a third set of rules, wherein the second level data clusters are representative of data associated with users having similar transactional behavior;
• classify users into one or more new data clusters based on the generated anomaly detection values using a third set of rules, wherein the new data clusters are representative of data associated with users having similar transactional behavior;
• determine if the classification of users into the new data clusters is same as the classification of users into the second level data clusters, wherein the classification of users is identified as optimum classification if the classification remains the same;
• and
• identify one or more users with high anomaly detection value from the users classified in the new data cluster classification determined as optimum classification, wherein the one or more users with high anomaly detection values are identified as anomalous users.