% Figure 1: Framework diagram of the detection pipeline.
%
% ALT-TEXT (accessibility, paste into Editorial Manager alt-text field at submission):
% Horizontal flow diagram showing the detection pipeline as five stages.
% Stage 1 (Blockchain data: blocks, transactions, logs) feeds Stage 2
% (Feature extraction: time-series, graph, text). Stage 2 fans out to three
% parallel detection-model families: Statistical models, Machine-learning
% models, and Game-theoretic models. All three feed Stage 4 (Anomaly score
% or alert), which feeds Stage 5 (Digital forensics and response). A dashed
% feedback loop runs from Stage 5 back to Stage 1, labelled "feedback: labels,
% rule updates". The full caption (below) is the authoritative description.
\begin{figure*}[!htbp]
\centering
\begin{tikzpicture}[
  node distance=1.6cm and 1.2cm,
  every node/.style={font=\small},
  box/.style={rectangle, draw, rounded corners=2pt, minimum width=2.6cm, minimum height=0.9cm, align=center, fill=gray!5},
  boxalt/.style={rectangle, draw, rounded corners=2pt, minimum width=2.6cm, minimum height=0.9cm, align=center, fill=blue!8},
  decision/.style={rectangle, draw, rounded corners=2pt, minimum width=2.6cm, minimum height=0.9cm, align=center, fill=orange!10},
  arr/.style={-{Latex[length=2mm]}, thick}
]
  \node[box] (data) {Blockchain data\\(blocks, txs, logs)};
  \node[box, right=of data] (feat) {Feature extraction\\(TS, graph, text)};
  \node[boxalt, right=of feat] (stat) {Statistical\\models};
  \node[boxalt, above=0.6cm of stat] (ml) {Machine-\\learning models};
  \node[boxalt, below=0.6cm of stat] (gt) {Game-theoretic\\models};
  \node[decision, right=of stat] (score) {Anomaly\\score / alert};
  \node[box, right=of score] (fx) {Digital forensics\\\& response};

  \draw[arr] (data) -- (feat);
  \draw[arr] (feat) -- (ml);
  \draw[arr] (feat) -- (stat);
  \draw[arr] (feat) -- (gt);
  \draw[arr] (ml) -- (score);
  \draw[arr] (stat) -- (score);
  \draw[arr] (gt) -- (score);
  \draw[arr] (score) -- (fx);

  % Feedback loop
  \draw[arr, dashed] (fx.south) -| ++(0, -0.8) -| (data.south) node[midway, below, font=\footnotesize] {feedback: labels, rule updates};
\end{tikzpicture}
\caption{Framework for anomaly and fraud detection in blockchain networks. On-chain data (blocks, transactions, event logs) is processed by a feature-extraction stage that produces time-series, graph-structural, and textual feature representations. These feed one or more detection-model families (statistical, machine-learning, game-theoretic); scored outputs are aggregated into anomaly scores or alerts that drive a digital-forensics and response workflow. A feedback loop from the forensic stage back to the data stage allows labels and rule updates derived from incident investigations to improve subsequent detection. The framework is agnostic to the specific blockchain protocol and is compatible with on-chain, off-chain, and cross-chain data sources.}
\label{fig:framework}
\end{figure*}
