Malicious seat-occupying air ticket proxy identification method and device
By using the isolated forest model and mean drift clustering algorithm in the air ticket sales system, the problem of malicious air ticket agents is solved in the existing technology that it is difficult to accurately identify malicious agents, and more efficient air ticket booking and better passenger experience are achieved.
Patent Information
- Application Number
- CN202411957742.3
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-12-27
- Publication Date
- 2025-04-04
AI Technical Summary
It is difficult to accurately identify and deal with malicious air ticket agents in existing technologies, resulting in hoarding air tickets, affecting flight attendance, increasing airline losses, and affecting passengers' travel experience.
By extracting historical data from the air ticket sales system and the departure system, using an isolated forest model for abnormal detection, generating a training sample set, training anomaly detection model, and clustering the detected abnormal data through the mean drift clustering algorithm to find the category of malicious agents.
Accurate identification of malicious agents has been achieved, reduced ticket hoarding and overselling, reduced airline losses and passenger complaint rates, and improved flight attendance rates and passenger travel experience.
Smart Images
Figure CN119760449A_ABST
Abstract
Description
Technical Field
[0001] The invention relates to a ticket information processing technology, and in particular to a method and a device for identifying a malicious seat-occupying ticket agent. Background Art
[0002] There are two main channels for ticket sales: direct sales and distribution. Distribution is the agency system, where airlines sell tickets to passengers through agents; direct sales is when airlines sell tickets directly to passengers through their own websites. For tickets sold through distribution, there are cases where agents maliciously occupy seats, hoard tickets for popular routes and flights, and sell them at a higher price.
[0003] Malicious seat occupation means that the agent uses a large amount of customer information in the ticket sales system to preemptively place orders and make payments. Then, the agent sells the tickets to passengers by modifying user information. If the unsold tickets are cancelled or refunded when the flight is about to take off, the tickets will be invalidated.
[0004] On the one hand, the malicious reservation of seats by agents will result in some of the accumulated tickets not being sold, affecting the flight occupancy rate, increasing the flight cost of the flight, and increasing the losses of the airlines. On the other hand, it will lead to the aggravation of overbooking of airlines, causing some passengers to be unable to board the plane, or being forced to upgrade / downgrade their cabin class, affecting the travel experience of passengers, increasing the complaint rate, seriously affecting the travel plans of normal passengers, and causing serious social impact.
[0005] At present, the solution to the problem of malicious seat occupation by agents is mainly to add a verification step before booking to confirm whether the person booking the ticket is a normal passenger. Since agents may have a large amount of real or false user information, simple verification cannot fully determine whether it is the passenger's ticket purchase behavior or the agent's ticket purchase behavior.
[0006] Therefore, how to accurately identify malicious agents, take corresponding measures against them, and alleviate malicious seat-occupying behavior during the air ticket booking process is an urgent problem to be solved by technical personnel in this field. Summary of the invention
[0007] In view of the above problems, the object of the present invention is to provide a method and device for identifying malicious ticket agents for occupying seats, so as to accurately identify malicious agents.
[0008] To this end, the present invention provides a method for identifying malicious seat-occupying ticket agents, including the following steps: S1, extracting historical data from a ticket sales system and a departure system; S2, using the ticket agent code as a unique identifier, processing the acquired historical data, forming feature data, and generating a training sample set; S3, selecting an isolation forest model algorithm, setting algorithm parameters, completing anomaly detection model training with the training sample set, and saving the model; S4, extracting data to be detected, forming samples to be detected after feature engineering, inputting them into the anomaly detection model, and predicting whether the samples to be detected are abnormal data; S5, selecting a mean shift clustering algorithm, clustering the detected abnormal data, and interpreting each cluster cluster after clustering to find the category where the malicious agent is located.
[0009] According to another aspect of the present invention, a device for identifying malicious seat-occupying ticket agents is provided, comprising: a data acquisition module for extracting historical data and data to be detected from the Air China Eterm system, the reservation system, the ET system, and the departure system; a feature engineering module for processing the acquired historical data to form feature data and generate a training sample set, and processing the acquired data to be detected to generate samples to be detected, using the ticket agent code as a unique identifier; an anomaly detection model construction module for setting algorithm parameters through a selected isolation forest model algorithm, completing anomaly detection model training through a training sample set, and saving the model; an anomaly data prediction module for inputting samples to be detected into the anomaly detection model, and outputting samples to be predicted as abnormal data or normal data; an anomaly data clustering module for clustering the detected abnormal data according to a mean shift clustering algorithm, and interpreting each cluster cluster after clustering to find the category where the malicious agent is located.
[0010] The present invention also provides a computer program product, which stores a computer program, and when the program is executed, it is used to implement each step of the above-mentioned malicious seat-occupying ticket agent identification method.
[0011] The present invention first uses unsupervised training to find special isolated points and mark them, and then uses a clustering algorithm for the isolated points. After the clustering is completed, each cluster is interpreted through the definition of rules to find the category of the malicious agent, thereby showing unique advantages and applicability in the management of malicious air ticket agents.
[0012] Other features and advantages of the present invention will be described in the following description, and partly become apparent from the description, or understood by practicing the present invention. The purpose and other advantages of the present invention can be realized and obtained by the structures pointed out in the description, claims and drawings. BRIEF DESCRIPTION OF THE DRAWINGS
[0013] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.
[0014] Figure 1 A flowchart of a method for identifying a malicious agent occupying a seat according to an embodiment of the present invention is shown;
[0015] Figure 2 A block diagram of a method for identifying a malicious agent occupying a seat according to an embodiment of the present invention is shown. DETAILED DESCRIPTION
[0016] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work.
[0017] This solution uses experience, statistical results and model algorithms in the civil aviation field to accurately identify whether the ticket agent is a malicious agent through anomaly detection methods combined with clustering algorithms.
[0018] like Figure 1 As shown, the method for identifying malicious seat-occupying ticket agents of the present invention includes the following steps S1-S5.
[0019] S1. Data acquisition: Extract the historical data of the ticket sales system such as the Air China Eterm system, reservation system, ET system, and departure system for the past year.
[0020] S2. Feature engineering: Using the ticket agency code as the unique identifier, process the acquired historical data to form feature data and generate a training sample set.
[0021] S3. Build an anomaly detection model: select the isolation forest model algorithm, code to implement the algorithm, set algorithm parameters, complete model training, and save the model.
[0022] S4. Predict abnormal data: After feature engineering, the data related to the aviation information system mentioned above is input into the above anomaly detection model to predict whether the data is abnormal data.
[0023] S5. Abnormal data clustering: Select the mean shift clustering algorithm, code to implement the algorithm, cluster the abnormal data detected above, and after clustering, find the category of malicious agent data through certain rules, and then find the malicious agent. Model application: Whenever a new batch of passengers needs to be value-classified, use the kNN algorithm to divide the passenger groups.
[0024] Based on actual business experience, this case selected 13 initial features, as follows:
[0025] 1. Ticket agency number;
[0026] 2. The final status of each order sold by the ticket agent (ticket issuance, travel, change, refund);
[0027] 3. The departure airport for each order sold by the ticket agent;
[0028] 4. The arrival airport for each order sold by the ticket agent;
[0029] 5. Popular routes;
[0030] 6. Flight query records of ticket agents;
[0031] 7. Popular flights;
[0032] 8. Order discount for each order sold by the ticket agent;
[0033] 9. Whether there is any change in the order document information for each order sold by the ticket agent;
[0034] 10. The ticket issuance time for each order sold by the ticket agent;
[0035] 11. The order time of each order sold by the ticket agent;
[0036] 12. The refund time for each order sold by the ticket agent (if it is in the refund status);
[0037] 13. The scheduled departure time of each order sold by the ticket agent.
[0038] Based on the initial features, this method processes missing values and outliers. Considering that the agent data is sufficient, the present invention takes deletion measures for these two types of data. Part of the features are digitized (whether there is a change in order document information, popular routes and popular flights, etc.).
[0039] Building an anomaly detection model: Since the amount of malicious agent data accounts for a small proportion of the total sample volume, the commonly used supervised classification algorithm is not very effective for this kind of positive sample imbalance data, and the feature values of malicious agents are very different from those of normal agents. In view of the characteristics of this data, anomaly detection algorithms are more suitable for solving such problems.
[0040] Isolation Forest (iForest) is used to mine abnormal data and find data that does not conform to the rules of other data. In the feature space, sparsely distributed areas indicate that the probability of an event occurring in the area is very low, so the data falling in these areas can be considered abnormal.
[0041] Isolation Forest is an unsupervised anomaly detection method for continuous data. In Isolation Forest, the dataset is randomly split recursively until all sample points are isolated. Under this random splitting strategy, outliers usually have shorter paths. Intuitively, those clusters with high density need to be cut many times to be isolated, but those points with low density can be easily isolated.
[0042] Code to implement the Isolation Forest Algorithm, configure the training model parameters, complete the model training, and save the model. During the training process, the parameters are configured as follows:
[0043] n_est imators: the number of random trees generated in the isolation forest;
[0044] max_samp l es: sub-sampling size;
[0045] bootstrap: whether to perform sampling with replacement (True means with replacement, False means without replacement).
[0046] After experimental debugging, the parameters of the final model setting are shown in Table 4.1.
[0047] Parameter name Numeric 1 n_estimators 100 2 max_samples 256 3 Bootstrap False
[0048] Predicting abnormal data
[0049] For each sample x to be predicted, it is input into the isolation forest, the results of each isolated tree are comprehensively calculated, and the anomaly score s of the sample x is calculated by the following formula:
[0050]
[0051] Among them, h(x) is the path length of x in each tree, c(ψ) is the average value of the path length when the number of samples ψ is given, which is used to standardize the path length h(x) of sample x.
[0052] Here, the anomaly threshold is set to δ. When the anomaly score s>=δ of sample x, the sample is judged as abnormal data, otherwise it is normal air ticket agency data.
[0053] 4.5 Clustering
[0054] According to the above steps, the abnormal data set is found. Since it contains not only abnormal proxy data but also some noise data, the conventional denoising method cannot effectively remove the noise data because the proportion and distribution of the noise data are unclear.
[0055] Here, the mean shift clustering method is selected to cluster the set, and then the category of the abnormal proxy data is found according to certain rules.
[0056] Mean shift clustering is a sliding window based algorithm to find dense areas of data points. This is a centroid based algorithm that locates the center point of each class by updating the candidate point of the center point to the mean of the points in the sliding window.
[0057] Unlike the K-Means algorithm, the mean shift clustering algorithm does not require us to know how many classes / groups there are; mean shift clustering is a density-based algorithm and is less affected by the mean than K-Means.
[0058] By using the mean shift algorithm, the set is clustered into l categories, each of which is c i (i=1,2,3,...,l), the number of data in each category is n i (i=1,2,3,...,l). Calculate the weighted average of the order change rate, order refund rate, order popular route rate, and order document information change rate in each category to get the result m i :
[0059]
[0060] Among them, f k (k=1,2,3,4) represent the characteristic values of order change rate, order refund rate, order popular route rate, and order document information change rate, respectively. k (k=1,2,3,4) represent the weights of the above eigenvalues respectively, i=1,2,3,...,l.
[0061] Then m i Arrange in descending order to get the maximum value m max , when m max > = α, m max The corresponding category is the category where the malicious proxy data is located; when m max <α, c i There is no malicious agent data category in , where α represents the weighted average threshold of the above four features.
[0062] like Figure 2As shown, the present invention also provides a device for identifying malicious seat-occupying ticket agents, including a data acquisition module 10, a feature engineering module 20, an anomaly detection model construction module 30, an abnormal data prediction module 40, and an abnormal data clustering module 50.
[0063] The data acquisition module is used to extract historical data and data to be tested from the Air China Eterm system, reservation system, ET system, and departure system.
[0064] The feature engineering module is used to use the ticket agency code as a unique identifier, process the acquired historical data, form feature data, generate a training sample set, and process the acquired data to be tested to generate samples to be tested.
[0065] The anomaly detection model building module selects the isolation forest model algorithm, sets the algorithm parameters, completes the anomaly detection model training through the training sample set, and saves the model.
[0066] The abnormal data prediction module is used to input the samples to be detected into the anomaly detection model and output the samples to be predicted as abnormal data or normal data.
[0067] The abnormal data clustering module is used to cluster the detected abnormal data according to the mean shift clustering algorithm. After the clustering is completed, each cluster is interpreted to find the category of the malicious agent.
[0068] The present invention also provides a computer program product, which stores a computer program, and when the program is executed, it is used to implement the steps S1-S5 of the method for identifying a malicious seat-occupying ticket agent.
[0069] The present invention first uses unsupervised training to find special isolated points and mark them, and then uses a clustering algorithm for the isolated points. After the clustering is completed, each cluster is interpreted through the definition of rules to find the category of malicious agents, thereby showing unique advantages and applicability in the field of malicious air ticket agents.
[0070] Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent substitutions for some of the technical features therein; and these modifications or substitutions do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.
Claims
1. A method for identifying malicious seat-occupying ticket agents, characterized in that: The following steps are involved: S1. Extract historical data from the ticket sales system and departure system; S2, using the ticket agency code as a unique identifier, processing the acquired historical data to form feature data and generate a training sample set; S3, select the isolation forest model algorithm, set the algorithm parameters, complete the anomaly detection model training with the training sample set, and save the model; S4, extract the data to be tested, form samples to be tested after feature engineering, input them into the anomaly detection model, and predict whether the samples to be tested are abnormal data; S5. Select the mean shift clustering algorithm to cluster the detected abnormal data. After clustering, interpret each cluster to find the category of the malicious agent.
2. The method for identifying malicious seat-occupying ticket agents according to claim 1, characterized in that: Each sample data in the sample set includes the following initial features: Ticket agent number; final status of each order sold by the ticket agent, including ticket issuance, travel, change, and refund; departure airport of each order sold by the ticket agent; arrival airport of each order sold by the ticket agent; popular routes; flight query records of the ticket agent; popular flights; The order discount for each order sold by the ticket agent; whether the order document information for each order sold by the ticket agent has been changed; the ticket issuance time for each order sold by the ticket agent; The order placement time of each order sold by the ticket agent; the refund time of each order sold by the ticket agent; the planned departure time of each order sold by the ticket agent.
3. The method for identifying malicious seat-occupying ticket agents according to claim 1, characterized in that: The non-numerical features are digitized, including whether there are any changes in the order document information for each order sold by the ticket agent, popular routes, and popular flights.
4. The method for identifying malicious seat-occupying ticket agents according to claim 1, characterized in that: For each sample x to be predicted, it is input into the isolation forest, the results of each isolated tree are comprehensively calculated, and the anomaly score s of the sample x is calculated. The anomaly threshold is set to δ. When the anomaly score s of the sample x is greater than or equal to δ, the sample is judged as abnormal data, otherwise it is normal air ticket agency data.
5. The method for identifying malicious seat-occupying ticket agents according to claim 1, characterized in that: The detected abnormal data are clustered into l categories through the mean shift clustering algorithm, and the categories are c i (i=1,2,3,...,l), the number of data in each category is n i (i=1,2,3,...,l), the method to explain each cluster is as follows: S51. Calculate the weighted average of the order change rate, order refund rate, order popular route rate, and order document information change rate characteristics in each category to obtain the result m i ; S52, then m i Arrange in descending order to get the maximum value m max , when m max > = α, m max The corresponding category is the category where the malicious proxy data is located; when m max <α, c i There is no malicious agent data category in the , where α represents the weighted average threshold of the four features: order change rate, order refund rate, order popular route rate, and order document information change rate.
6. The method for identifying malicious seat-occupying ticket agents according to claim 5, characterized in that: Weighted average m i The calculation formula is as follows: Among them, f k (k=1,2,3,4) represent the characteristic values of order change rate, order refund rate, order popular route rate, and order document information change rate, respectively. k (k=1,2,3,4) represent the weights of the above eigenvalues respectively, i=1,2,3,...,l.
7. A device for identifying malicious seat-occupying ticket agents, characterized in that: include: Data acquisition module, used to extract historical data and data to be tested from the ticket sales system and departure system; The feature engineering module is used to process the acquired historical data, form feature data, generate training sample sets, and process the acquired data to be tested, generating samples to be tested, using the ticket agency code as a unique identifier; The anomaly detection model building module selects the isolation forest model algorithm, sets the algorithm parameters, completes the anomaly detection model training through the training sample set, and saves the model; An abnormal data prediction module is used to input a sample to be detected and output whether the sample to be predicted is abnormal data or normal data; The abnormal data clustering module is used to cluster the detected abnormal data according to the mean shift clustering algorithm. After the clustering is completed, each cluster is interpreted to find the category of the malicious agent.
8. The malicious seat-occupying ticket agent identification device according to claim 7, characterized in that: The abnormal data prediction module is used to input each sample x to be predicted into the isolation forest, comprehensively calculate the results of each isolated tree, and calculate the abnormal score s of the sample x, and set the abnormal threshold to δ. When the abnormal score s of the sample x is greater than or equal to δ, the sample is judged as abnormal data, otherwise it is normal air ticket agency data.
9. The malicious seat-occupying ticket agent identification device according to claim 7, characterized in that: The abnormal data clustering module is used to cluster the set into l categories through the mean shift clustering algorithm, and the categories are c i (i=1,2,3,...,l), the number of data in each category is n i (i=1,2,3,...,l), the method to explain each cluster is as follows: S51. Calculate the weighted average of the order change rate, order refund rate, order popular route rate, and order document information change rate characteristics in each category to obtain the result m i ; S52, then m i Arrange in descending order to get the maximum value m max , when m max > = α, m max The corresponding category is the category where the malicious proxy data is located; when m max <α, c i There is no malicious agent data category in , where α represents the weighted average threshold of the above four features.
10. A computer program product storing a computer program, characterized in that: When executed, the program is used to implement each step of the method for identifying a malicious seat-occupying ticket agent according to any one of claims 1 to 6.