Intelligent auditing method and system for fee evasion based on ETC multi-source data

Abstract

The present application relates to the technical field of ETC data auditing, in particular to an intelligent fee evasion auditing method and system based on ETC multi-source data, comprising: an ETC gantry data acquisition terminal deployed on the side of the gantry along the highway, used for real-time acquisition of vehicle pass transaction data, OBU device data and RSU transaction logs, and preliminary verification and format standardization processing of the collected data. The present application has the advantages that: the gantry transaction data collected by the ETC gantry data acquisition terminal and the exit and entry flow data and lane snapshot image data collected by the toll station flow acquisition interface machine are deeply fused according to the space-time correlation rules by the multi-source data fusion processor, a vehicle pass trajectory record with a unified data structure is generated, the problem of single data acquisition source and the problem that multi-source data cannot be effectively fused are solved, and the originally dispersed heterogeneous data in the ETC gantry system, the toll station lane system and the image acquisition system are cross-correlated through timestamp alignment and spatial position mapping.

Description

Technical Field

[0001] This invention relates to the field of ETC data auditing technology, and in particular to an intelligent auditing method and system for toll evasion based on ETC multi-source data. Background Technology

[0002] With the elimination of provincial toll stations on national highways, the ETC (Electronic Toll Collection) tolling model has shifted from a "single-province tolling" system to a "nationwide unified network" system. This has led to a dramatic increase in toll data, resulting in a rise in cross-provincial toll evasion vehicles and the amount of toll evaded per instance. Simultaneously, ETC toll evasion methods have become increasingly sophisticated, evolving from simple tactics like following other vehicles through toll gates and switching cards to highly concealed, technically advanced methods such as using different tags for different vehicles, using different tags for different trucks and passenger vehicles, blocking OBU (On-Board Unit) signals, using multiple media on a single vehicle, and cloning electronic tags. Statistics show that following other vehicles through toll gates alone results in a toll loss of 2 to 3 billion yuan annually. The increasing concealment, sophistication, and organized nature of toll evasion methods poses a serious challenge to the toll auditing work of highway operation and management units.

[0003] Currently, existing ETC toll evasion audit technologies have the following main shortcomings:

[0004] 1. Data collection sources are singular, and multi-source data is not effectively integrated. Existing auditing systems mostly rely on single ETC transaction logs or toll station entrance and exit data for toll evasion analysis, failing to effectively integrate and spatially correlate multi-source heterogeneous data such as ETC gantry transaction data, toll station entry and exit logs, license plate capture image data, and vehicle feature data. The lack of a unified primary key and fusion mechanism between different data sources results in a large amount of valuable vehicle passage information not being fully utilized. Key evidentiary data such as transaction logs and vehicle information are not retained or integrated, making it difficult to recover tolls.

[0005] 2. The methods for identifying toll evasion are limited and lack intelligence. Existing audit systems mainly rely on manual screening and simple rule comparisons. Faced with massive amounts of gantry transaction data, the screening efficiency is low, and it is impossible to timely, comprehensively, and accurately identify suspected toll evasion vehicles. Traditional audit methods are insufficient for identifying new types of toll evasion behaviors, and difficulties in coordination between systems result in weak data perception capabilities.

[0006] 3. The chain of evidence for toll evasion is difficult to form and solidify automatically. Existing audit systems, upon identifying a suspected vehicle, often require auditors to manually retrieve multi-dimensional evidence such as gantry logs, surveillance videos, and images. The process of evidence collection, organization, and archiving is time-consuming and labor-intensive, and it is difficult to form a standardized electronic evidence chain with temporal correlation and completeness. Evidence is stored in different systems, lacking a unified mechanism for evidence encapsulation and solidification, which affects the credibility and legal validity of audit results.

[0007] 4. The audit identification model is static and fixed, unable to be dynamically updated. Once deployed, the existing audit system's identification rules and models are difficult to dynamically adjust and optimize, and cannot continuously learn and iterate based on positive and negative examples from actual audit feedback. As toll evasion methods continue to evolve, the static model's ability to identify new toll evasion patterns gradually declines.

[0008] 5. Lack of automated scheduling mechanism for audit task management. In the existing audit workflow, the entire chain from the discovery of suspected vehicles to the generation, assignment, processing, and feedback of audit tasks lacks an automated task scheduling and management mechanism. There is a competition for audit work orders, resulting in low audit efficiency and difficulty in tracing the process. Summary of the Invention

[0009] The purpose of this invention is to overcome the shortcomings of the prior art and provide an intelligent auditing method and system for ETC toll evasion based on multi-source ETC data. Through multi-source data fusion, intelligent identification model, automated evidence chain generation, incremental model update and automatic scheduling of auditing tasks, it achieves efficient, accurate and intelligent auditing of ETC toll evasion behavior.

[0010] The objective of this invention is achieved through the following technical solution: an intelligent toll evasion audit system based on ETC multi-source data, comprising:

[0011] ETC gantry data acquisition terminals are deployed on the gantry side along the highway to collect vehicle passage transaction data, OBU equipment data and RSU transaction logs in real time, and perform preliminary verification and format standardization processing on the collected data.

[0012] The toll station data collection interface unit is deployed on the toll station computer room side. It is used to collect vehicle entry and exit data, toll amount data and lane capture image data from the toll station lane system, and to perform timestamp alignment and integrity verification on the collected data.

[0013] The multi-source data fusion processor is communicatively connected to the ETC gantry data acquisition terminal and the toll station flow acquisition interface machine, respectively, and is used to receive uploaded data. It performs multi-dimensional fusion of vehicle passage data from different sources and in different formats through spatiotemporal association rules to generate vehicle passage trajectory records with a unified data structure.

[0014] The vehicle feature database storage server is used to store and manage basic vehicle profile information, vehicle model parameters, historical passage records and historical toll evasion blacklists, and provides vehicle identity comparison benchmark data for toll evasion identification.

[0015] The toll evasion behavior recognition computing board is connected to the multi-source data fusion processor and the vehicle feature library storage server respectively. It has a built-in FPGA acceleration unit with a multi-dimensional toll evasion recognition model based on the gradient boosting algorithm. It is used to extract vehicle identity features, travel path features, billing features and behavior pattern features based on the vehicle travel trajectory record and the benchmark data, calculate the toll evasion suspicion score and output the list of suspect vehicles.

[0016] The audit task scheduling controller is connected to the toll evasion behavior identification calculation board and has a built-in task queue cache. It is used to automatically generate audit tasks based on the list of suspected vehicles, sort and dispatch audit tasks according to preset priority rules, and track the processing status of audit tasks.

[0017] The evidence chain encapsulates a secure storage unit, which is connected to the multi-source data fusion processor and the audit task scheduling controller respectively. When it is determined that a vehicle is suspected of evading tolls, it is used to automatically associate the gantry transaction flow, toll station entry and exit flow, license plate capture image and trajectory reconstruction data corresponding to the vehicle, package them to generate a complete electronic evidence chain with time-series correlation and digital digest, and store the electronic evidence chain in the internal tamper-proof storage area.

[0018] The audit result output interface gateway is connected to the evidence chain encapsulation secure storage unit, which is used to encapsulate the electronic evidence chain and the evasion suspicion score into an audit report according to a preset format, and provides report push, download and external API query interface;

[0019] The model incremental update training module is connected to the fare evasion behavior recognition computing board and is used to dynamically update the multi-dimensional fare evasion recognition model through incremental learning based on the positive and negative examples fed back by the audit results.

[0020] Preferably, as described in any of the above schemes, the multi-source data fusion processor comprises:

[0021] The data cleaning subprocessor is used to perform outlier removal and missing value completion operations on ETC gantry transaction data.

[0022] The spatiotemporal correlation subprocessor is used to correlate and map gantry transaction data, toll station transaction data, and captured image data according to time series and spatial location, using vehicle passage identification as the primary key.

[0023] The trajectory reconstruction subprocessor is used to generate the complete travel path trajectory of the vehicle based on the associated mapped data.

[0024] The weight allocation logic built into the toll evasion behavior identification calculation board is embedded in the FPGA unit through a hardware description language. The weight allocation logic performs weighted fusion of the vehicle identity features, travel route features, toll collection features and behavior pattern features according to the weight allocation formula. The weight allocation formula dynamically adjusts the weight values ​​of various features based on the correlation coefficients between various features and toll evasion behavior in historical audit data.

[0025] Preferably, as described in any of the above schemes, the evidence chain encapsulated secure storage unit comprises:

[0026] The evidence collection interface sub-board is used to extract raw data related to the suspect vehicle from the ETC gantry data collection terminal, the toll station flow collection interface machine, and external image acquisition equipment.

[0027] The evidence encapsulation and encryption sub-board is used to encapsulate the original data in a structured manner according to the preset evidence chain format specifications, and to add an independent digital digest and timestamp to each piece of evidence;

[0028] The tamper-proof storage sub-board uses a write-once, read-many storage medium to solidify and store the packaged electronic evidence chain and establish an evidence index.

[0029] The audit task scheduling controller includes:

[0030] Task generation trigger, used to automatically trigger the creation of audit tasks based on the suspected toll evasion score of a vehicle;

[0031] The priority calculation register is used to calculate the task priority based on the suspected vehicle's evasion score, the number of historical evasion records, and the amount of evasion, and then latch it in binary weight form.

[0032] A status tracking cache is used to record the entire lifecycle status of audit tasks in real time, from creation, dispatch, processing to case closure.

[0033] Preferably, as described in any of the above schemes, the model incremental update training module includes:

[0034] The sample collection interface is used to obtain data on toll evasion vehicles confirmed by manual audit as positive examples and data on vehicles excluded from suspicion by manual audit as negative examples.

[0035] The incremental training sub-board is used to input the positive and negative samples into the current model for incremental training and adjust the model parameters; the A / B comparison verification sub-board is used to perform A / B comparison verification on the model before and after the incremental training is completed, and only sends the model loading update instruction to the fare evasion behavior recognition computing board after the verification is passed.

[0036] The system also includes a system management and configuration terminal, which is connected to the audit task scheduling controller and the toll evasion behavior identification calculation board. It has a built-in rule configuration interface and a Groovy script online editing engine, which are used by administrators to configure toll evasion feature rules, toll evasion suspicion scoring thresholds, automatic audit task generation conditions and evidence chain encapsulation templates. The rule configuration interface realizes hot-swappable expansion of custom audit logic through the script editing engine.

[0037] Preferably, in any of the above schemes, the ETC gantry data acquisition terminal has a built-in edge computing coprocessor. The edge computing coprocessor is used to perform real-time anomaly detection on the collected vehicle passage transaction data locally at the gantry. When an anomaly is detected in the transaction data, a local early warning signal is immediately triggered and the abnormal data is uploaded to the multi-source data fusion processor through an independent high-priority data transmission channel.

[0038] The vehicle feature database storage server is equipped with a data synchronization interface. The data synchronization interface is connected to an external vehicle management platform through a physically isolated data exchange front-end machine. It is used to periodically obtain vehicle registration information changes, vehicle transfer information and vehicle scrapping information, and automatically update the vehicle feature database based on the synchronized data.

[0039] The intelligent auditing method for toll evasion based on ETC multi-source data includes the following steps:

[0040] S1: Real-time vehicle passage transaction data and OBU device data are collected through ETC gantry data collection terminals deployed along the highway, and vehicle entry and exit flow data and lane capture image data are collected through toll station flow collection interface machine.

[0041] S2: The multi-source data fusion processor preprocesses the collected multi-source vehicle data, including outlier removal, missing value completion, and data format standardization, to generate standardized data in a unified format.

[0042] S3: The multi-source data fusion processor uses the vehicle passage identifier as the associated primary key to perform spatiotemporal correlation fusion of ETC gantry transaction data, toll station flow data and captured image data according to time series and spatial location to generate a vehicle passage trajectory record with a unified data structure.

[0043] S4: The toll evasion behavior recognition calculation board extracts vehicle identity features, travel path features, billing features and behavior pattern features from the vehicle travel trajectory record, and performs weighted fusion of various features through the weight allocation logic embedded in the board to generate a feature vector for toll evasion recognition.

[0044] S5: The fare evasion behavior recognition calculation board inputs the feature vector into the built-in multi-dimensional fare evasion recognition model based on the gradient boosting algorithm, calculates the fare evasion suspicion score of the target vehicle, and determines whether the vehicle is suspected of fare evasion according to the preset suspicion threshold, and outputs a list of suspected vehicles.

[0045] S6: The evidence chain encapsulation secure storage unit automatically associates the corresponding gantry transaction records, toll station entry and exit records, license plate capture images and trajectory reconstruction data of vehicles suspected of toll evasion with the vehicle's corresponding gantry transaction records, toll station entry and exit records, license plate capture images and trajectory reconstruction data, and generates a complete electronic evidence chain with temporal correlation and digital digest, and stores it in the tamper-proof storage area.

[0046] S7: The audit task scheduling controller calculates the audit task priority based on the suspected vehicle's evasion score, the number of historical evasion records, and the amount of evasion, and automatically generates and dispatches audit tasks to the corresponding audit terminals according to the priority.

[0047] S8: The audit task scheduling controller receives the audit confirmation result returned by the audit terminal, marks the suspected vehicle according to the confirmation result, and if the toll evasion is confirmed, it is added to the toll evasion blacklist and the recovery process is initiated. If the suspicion is ruled out, the suspicion status is updated to ruled out.

[0048] S9: The model incremental update training module obtains the data of vehicles that have been verified as evading tolls as positive examples and the data of vehicles that have been removed from the list of suspected vehicles as negative examples. The multi-dimensional toll evasion identification model is dynamically updated through incremental learning.

[0049] S10: The audit result output interface gateway encapsulates the electronic evidence chain and the evasion suspicion score into a standardized audit report according to a preset format, and outputs the audit results through message push, email sending and API interface query.

[0050] Preferably, in any of the above schemes, the spatiotemporal correlation fusion in step S3 includes:

[0051] 1) Using the vehicle passage identifier as the primary key, arrange the ETC gantries passed by the vehicle in chronological order according to the timestamp to form a gantry sequence;

[0052] 2) Perform path matching based on the gantry sequence and the highway network topology to reconstruct the vehicle's complete travel path;

[0053] 3) Cross-validate the entry and exit information in the toll station's entry and exit flow data with the reconstructed driving path to identify abnormal passage behavior with inconsistent paths;

[0054] The weight allocation formula in step S4 is: ,in for The weight values ​​of the first type of feature, The first statistical result based on historical audit data The correlation coefficient between class characteristics and fare evasion behavior For the first The confidence level of a class feature within the current time window. For the first The reliability coefficient of the data source corresponding to the class feature.

[0055] Preferably, in any of the above schemes, the electronic evidence chain generated in step S6 includes: a sequence of suspect vehicle passage gantries arranged in chronological order and corresponding transaction records, entry and exit toll station transaction records, license plate capture images and recognition results, vehicle passage trajectory reconstruction diagram, and billing anomaly analysis explanation. Each piece of evidence in the electronic evidence chain is given an independent digital digest and timestamp to ensure the integrity and immutability of the evidence.

[0056] In step S1, the edge computing coprocessor deployed on the ETC gantry side performs real-time anomaly detection on the collected vehicle passage transaction data. When an anomaly is detected in the transaction data, an early warning is immediately triggered locally on the gantry and the abnormal data is uploaded to the cloud through an independent high-priority channel for toll evasion identification and processing.

[0057] Preferably, in any of the above schemes, the incremental learning method in step S9 includes:

[0058] 1) Input positive and negative samples into the current multi-dimensional fare evasion detection model for incremental training and adjust the model parameters;

[0059] 2) After incremental training is completed, use the retained validation dataset to perform A / B comparison tests on the model before and after the update;

[0060] 3) When the accuracy and recall of the updated model for identifying fare evasion are not lower than those of the model before the update, the updated model will be deployed online to replace the current model.

[0061] The suspected threshold preset in step S5 adopts a dynamic threshold strategy, which automatically adjusts the value of the suspected threshold according to the current audit task queue length, historical audit accuracy, and seasonal fluctuations in evasion behavior, so as to balance the audit recall rate and the audit precision rate.

[0062] Preferred from any of the above schemes, step S11 is further included: the system management configuration terminal performs full-link tracking and recording of data operation behaviors, model call records, and audit task operation logs generated throughout the audit process, and performs solidified storage and retrieval through a centralized log storage server to support operation auditing and audit process backtracking;

[0063] The recovery process in step S8 includes: automatically generating a recovery notice containing the amount of toll evaded, the time period of toll evasion, the toll evasion route, and an evidence chain index; pushing the recovery notice to the user terminal of the vehicle through a message push gateway; continuously tracking the recovery status within a preset recovery period, and automatically synchronizing the vehicle information to the highway entrance blacklist system if the payment is not made within the time limit.

[0064] The present invention has the following advantages:

[0065] 1. This intelligent auditing method and system for toll evasion based on ETC multi-source data deeply integrates gantry transaction data collected by ETC gantry data acquisition terminals, entry and exit flow data collected by toll station flow acquisition interface machines, and lane capture image data according to spatiotemporal association rules through a multi-source data fusion processor. This generates vehicle passage trajectory records with a unified data structure, solving the problem of single data collection sources and ineffective integration of multi-source data in existing technologies. Using vehicle passage identifiers as the unique association key, heterogeneous data originally scattered in the ETC gantry system, toll station lane system, and image acquisition system are cross-linked through timestamp alignment and spatial location mapping. This integrates fragmented passage information of the same vehicle in different data sources into a complete spatiotemporal trajectory, thus providing a rich data foundation for subsequent toll evasion identification and effectively avoiding missed and false judgments caused by incomplete information from a single data source.

[0066] 2. This intelligent auditing method and system for toll evasion based on ETC multi-source data utilizes a gradient boosting multi-dimensional toll evasion identification model embedded in the FPGA acceleration unit of the toll evasion behavior identification calculation board. Combined with a weight allocation formula, it weights and fuses vehicle identity features, travel route features, billing features, and behavioral pattern features to output a toll evasion suspicion score. This solves the problems of single toll evasion identification methods and low intelligence levels in existing technologies. The FPGA acceleration unit performs hardware-level parallel acceleration calculations for the gradient boosting algorithm, significantly improving the model inference speed and enabling the system to process massive amounts of gantry transaction data in real time. The weight allocation formula dynamically adjusts the weight values ​​of various features based on the correlation coefficients between various features and toll evasion behavior in historical audit data, achieving dynamic and accurate quantification of the importance of various features. This allows the model to adaptively distinguish the contribution of different features in toll evasion identification, improving the sensitivity and accuracy of identifying concealed toll evasion behavior.

[0067] 3. This intelligent auditing method and system for toll evasion based on ETC multi-source data automatically associates gantry transaction records, toll station entry and exit records, license plate capture images, and trajectory reconstruction data with gantry transaction records, toll station entry and exit records, license plate capture images, and trajectory reconstruction data when a vehicle is suspected of toll evasion, through an evidence chain encapsulation secure storage unit. This generates a complete electronic evidence chain with temporal correlation and a digital digest, and stores it in a tamper-proof storage area. This solves the problem of the difficulty in automatically forming and fixing toll evasion evidence chains in existing technologies. The evidence chain encapsulation secure storage unit automatically extracts all original data related to the suspect vehicle from the multi-source data fusion processor, structures and encapsulates various types of evidence according to preset format specifications, and adds an independent digital digest and timestamp to each piece of evidence. This ensures that any tampering with the evidence can be detected promptly through digital digest verification. The tamper-proof storage area solidifies and stores the encapsulated electronic evidence chain, ensuring the integrity and non-repudiation of the evidence throughout its entire lifecycle from collection and encapsulation to storage, giving the generated electronic evidence chain evidentiary effect in a judicial sense.

[0068] 4. This intelligent toll evasion auditing method and system based on multi-source ETC data dynamically updates the multi-dimensional toll evasion identification model through an incremental learning approach using a model incremental update training module. This updates the model based on positive and negative examples from the audit results, solving the problem of static, fixed audit identification models in existing technologies that cannot be dynamically updated. Data on toll evasion vehicles confirmed by manual auditing serves as positive examples, while data on vehicles ruled out of suspicion serves as negative examples. These examples contain the latest toll evasion patterns in real-world scenarios. The incremental training sub-board uses these samples to incrementally train the current model, enabling it to gradually learn new toll evasion behavior patterns without forgetting existing knowledge. This allows the model to evolve synchronously with the changing toll evasion methods, maintaining its ability to identify new types of toll evasion.

[0069] 5. This intelligent auditing method and system for toll evasion based on ETC multi-source data calculates task priorities by using an audit task scheduling controller. This controller calculates task priorities based on the suspected vehicle's toll evasion suspicion score, the number of historical toll evasion records, and the amount of toll evasion. It then automatically generates, sorts, and dispatches audit tasks according to these priorities, while simultaneously tracking the processing status of these tasks. This solves the problem of the lack of an automated scheduling mechanism in existing audit task management technologies. The audit task scheduling controller uses the toll evasion suspicion score as a measure of the likelihood of toll evasion, the number of historical toll evasion records as a measure of the vehicle's toll evasion inertia, and the amount of toll evasion as a measure of the degree of harm. The combination of these three factors enables an objective and quantitative calculation of task priorities. The built-in task queue buffer dynamically sorts backlogged audit tasks according to priority, ensuring that high-suspicion, high-amount, and high-frequency toll evasion cases are processed first, significantly improving the utilization efficiency of audit resources and the response speed of key cases.

[0070] 6. This intelligent toll evasion audit method and system based on ETC multi-source data performs real-time anomaly detection on the collected vehicle passage transaction data locally on the gantry through the built-in edge computing coprocessor of the ETC gantry data acquisition terminal. The abnormal data is then uploaded to the multi-source data fusion processor for toll evasion identification and processing through an independent high-priority data transmission channel, which greatly reduces data transmission latency and cloud computing pressure, and improves the timeliness of response to abnormal events. The vehicle feature database storage server is equipped with a data synchronization interface to connect with the external vehicle management platform, regularly obtains vehicle registration information changes, vehicle transfer information and vehicle scrapping information, and automatically updates the vehicle feature database based on the synchronized data, ensuring the accuracy and timeliness of basic vehicle information. Attached Figure Description

[0071] Figure 1 This is a schematic diagram of the system framework of the present invention;

[0072] Figure 2 This is a schematic diagram of the method flow of the present invention. Detailed Implementation

[0073] The present invention will be further described below with reference to the accompanying drawings, but the scope of protection of the present invention is not limited to the following description.

[0074] Example 1: As Figure 1 As shown, the intelligent toll evasion audit system based on ETC multi-source data includes an ETC gantry data acquisition terminal, a toll station flow data acquisition interface machine, a multi-source data fusion processor, a vehicle feature database storage server, a toll evasion behavior recognition calculation board, an audit task scheduling controller, an evidence chain encapsulation secure storage unit, an audit result output interface gateway, and a model incremental update training module. The ETC gantry data acquisition terminal is deployed on the ETC gantry side along the highway, and the toll station flow data acquisition interface machine is deployed on the toll station computer room side. The multi-source data fusion processor is connected to both the ETC gantry data acquisition terminal and the toll station flow data acquisition interface machine via industrial Ethernet communication. The toll evasion behavior recognition computing board is connected to the multi-source data fusion processor and the vehicle feature database storage server via PCIe data bus. The audit task scheduling controller is connected to the toll evasion behavior recognition computing board via serial communication interface. The evidence chain encapsulation secure storage unit is connected to the multi-source data fusion processor and the audit task scheduling controller via high-speed data channel. The audit result output interface gateway is connected to the evidence chain encapsulation secure storage unit via network interface. The model incremental update training module is connected to the toll evasion behavior recognition computing board via data and control dual channels.

[0075] As an optional technical solution of the present invention: ETC gantry data acquisition terminals are deployed at various ETC gantries along the highway, and are embedded with dedicated data acquisition cards and communication modules. The ETC gantry data acquisition terminal communicates bidirectionally with the OBU devices of vehicles passing through the gantry via the DSRC dedicated short-range communication protocol, collecting vehicle passage transaction data in real time. This vehicle passage transaction data includes at least the following fields: vehicle passage identifier, transaction timestamp, transaction amount, antenna number, lane number, entrance station code, exit station code, and vehicle type code. The vehicle passage identifier is either the OBU serial number or the license plate number. Simultaneously, the ETC gantry data acquisition terminal collects RSU transaction logs through the RSU antenna log interface. These RSU transaction logs include parameters such as antenna transmit power, received signal strength indication, communication link quality, and transaction round-trip delay. The data verification module built into the ETC gantry data acquisition terminal performs preliminary verification on the collected data. The preliminary verification includes data integrity verification, format compliance verification, and logical rationality verification. Data integrity verification is used to check whether the data packet is received completely. Format compliance verification is used to check whether each field conforms to the preset data format specification. Logical rationality verification is used to check whether the timestamp is within a reasonable range and whether the amount is positive. After the verification is passed, the data is standardized and packaged according to a unified data format and uploaded to the multi-source data fusion processor through a wired optical fiber network.

[0076] As an optional technical solution of the present invention: the toll station transaction data acquisition interface unit is deployed on the toll station equipment room side and connected to the toll station lane system via a serial communication interface or a network interface. The toll station transaction data acquisition interface unit collects vehicle entry and exit transaction data, toll amount data, and lane capture image data from the toll station lane system according to a preset acquisition cycle, with a polling cycle of once every 30 seconds. The vehicle entry and exit transaction data includes at least the following fields: vehicle pass identifier, entry / exit code, entry / exit timestamp, lane number, and toll collector employee number. The toll station transaction data acquisition interface unit has a built-in timestamp alignment module that performs timestamp alignment operations on the collected data using the vehicle pass identifier as the associated primary key. This timestamp alignment refers to correcting data with slight time deviations obtained from different lane systems using a unified clock source to ensure that the time records of the same vehicle event remain consistent across different data sources. The toll station transaction data acquisition interface unit also has a built-in integrity verification module to check whether the collected data is complete. If missing or abnormal data is detected, a re-acquisition request is automatically triggered.

[0077] As an optional technical solution of the present invention, the multi-source data fusion processor includes a data cleaning subprocessor, a spatiotemporal correlation subprocessor, and a trajectory restoration subprocessor. The data cleaning subprocessor performs outlier removal and missing value completion operations on the received ETC gantry transaction data. Outlier removal refers to deleting or marking data records that exceed a preset reasonable range, such as negative transaction amounts or future timestamps. Missing value completion refers to supplementing missing key fields using methods such as mean interpolation, nearest neighbor filling, or default value replacement. The spatiotemporal correlation subprocessor uses the vehicle passage identifier as the association key and maps the cleaned ETC gantry transaction data, toll station entry / exit flow data, and lane capture image data according to time sequence and spatial location. Specifically, using the vehicle passage identifier as the first association key and the timestamp as the second sorting key, all data records generated by the same vehicle at different gantries and toll stations are arranged in chronological order, and each data record is mapped to a corresponding spatial location node based on the highway network spatial topology. The trajectory reconstruction subprocessor generates the complete travel path trajectory of the vehicle based on the association mapping results output by the spatiotemporal association subprocessor. The complete travel path trajectory includes an ordered sequence of all gantry nodes and toll station nodes that the vehicle passes through in sequence in the highway network, the time of passing through each node, the travel time and distance between adjacent nodes, and other information.

[0078] As an optional technical solution of the present invention, the vehicle feature database storage server adopts a two-tier storage architecture combining a high-performance relational database and a memory cache. The vehicle feature database storage server stores basic vehicle profile information, vehicle model parameters, historical passage records, and a historical toll evasion blacklist. The basic vehicle profile information includes license plate number, vehicle identification number (VIN), brand and model, body color, approved passenger capacity, and gross vehicle weight; the vehicle model parameters include the OBU-registered vehicle model, the actual inspected vehicle model, number of axles, and wheelbase; the historical passage records include all highway passage records of the vehicle within the past 6 months; the historical toll evasion blacklist includes information on vehicles confirmed to have evaded tolls, along with the type of evasion, amount evaded, and time range of evasion. The vehicle feature database storage server synchronizes data with an external vehicle management platform through a data synchronization interface to ensure the accuracy and timeliness of the vehicle profile information.

[0079] As an optional technical solution of the present invention: the toll evasion behavior recognition computing board is an independent hardware computing board, which is connected to the multi-source data fusion processor and the vehicle feature database storage server respectively. The toll evasion behavior recognition computing board is equipped with an FPGA acceleration unit, in which a multi-dimensional toll evasion recognition model based on the XGBoost gradient boosting algorithm is embedded in the Verilog hardware description language. The multi-dimensional toll evasion recognition model has been offline trained with a large amount of historical audit sample data before deployment and has reached a preset recognition accuracy threshold. The toll evasion behavior recognition computing board also has built-in weight allocation logic embedded in the hardware description language, which follows the weight allocation formula: The toll evasion behavior identification computing board first obtains vehicle passage trajectory records from the multi-source data fusion processor and the vehicle's baseline data from the vehicle feature database storage server. Then, it extracts vehicle identity features, passage path features, billing features, and behavioral pattern features from the passage trajectory records. Vehicle identity features include the consistency between the license plate number and the OBU registration information, as well as the continuity of vehicle passage markers. Passage path features include path completeness, gantry sequence coherence, and the reasonableness of travel time between adjacent gantries. Billing features include the consistency between the amount due and the amount received, and the matching degree between the billed mileage and the actual mileage traveled. Behavioral pattern features include abnormal number of gantries passed in a single instance, frequent entry and exit from specific toll stations, and multiple passages within a short period. Next, the above features are weighted and fused using weight allocation logic to generate a feature vector. Finally, the feature vector is input into the gradient boosting multi-dimensional toll evasion identification model embedded in the FPGA acceleration unit for inference calculation, outputting the vehicle's toll evasion suspicion score, which ranges from 0 to 100. The toll evasion behavior identification calculation board compares the toll evasion suspicion score with a preset suspicion threshold. The suspicion threshold is set to 70 points by default. If the score is greater than or equal to the threshold, the vehicle is determined to be suspected of toll evasion, and the vehicle information and the corresponding suspicion score are added to the list of suspected vehicles.

[0080] As an optional technical solution of the present invention: the weight allocation formula built into the fare evasion behavior recognition calculation board: middle, The correlation coefficient between the i-th type of feature and toll evasion behavior is based on historical audit data. Its value ranges from 0 to 1. This correlation coefficient is obtained by statistical analysis of various feature values ​​of vehicles confirmed to have evaded tolls in historical audit data.

[0081] The confidence score of the i-th feature within the current time window is between 0 and 1. This confidence score is calculated based on the data completeness rate and data fluctuation range of this feature within the current time window.

[0082] This represents the reliability coefficient of the data source corresponding to the i-th feature, with a value ranging from 0 to 1. The reliability coefficients for different data sources are pre-calibrated based on the historical data quality and equipment operating status of the data source. The fare evasion behavior identification calculation board adjusts the correlation coefficient every 24 hours based on newly added historical audit data. By recalculating the statistics, the weights of various features can be dynamically adjusted.

[0083] As an optional technical solution of the present invention, the evidence chain encapsulation secure storage unit includes an evidence acquisition interface sub-board, an evidence encapsulation encryption sub-board, and an anti-tamper storage sub-board. The evidence acquisition interface sub-board is connected to both a multi-source data fusion processor and an audit task scheduling controller. When the audit task scheduling controller determines that a vehicle is suspected of toll evasion and triggers an evidence acquisition command, the evidence acquisition interface sub-board immediately extracts the original data related to the suspected vehicle from the multi-source data fusion processor. The original data includes at least all gantry passage records of the vehicle in the ETC gantry transaction log, the vehicle's entry and exit records in the toll station entry and exit log, and captured images of the vehicle passing through various gantries and toll stations from the lane capture image data. The evidence acquisition interface sub-board is also connected to an external image acquisition device to supplement the acquisition of high-definition checkpoint images of the vehicle. The evidence encapsulation and encryption sub-board structures and encapsulates the collected raw data according to a preset evidence chain format specification. This specification defines the file structure, naming rules, metadata format, and data arrangement order of the evidence package. The sub-board adds an independent SHA-256 digital digest value and a trusted timestamp to each evidence record to ensure the integrity and non-repudiation of each piece of evidence. The tamper-proof storage sub-board uses a write-once, read-many solid-state storage chip as the storage medium. The encapsulated electronic evidence chain, with added digital digests and timestamps, is written to the storage area of ​​the tamper-proof storage sub-board for permanent storage, while simultaneously establishing an evidence index for subsequent querying and retrieval. The tamper-proof storage sub-board has an internal write-protection hardware switch; once the evidence is written, write protection is automatically triggered, and any subsequent write requests are hardware-level rejected.

[0084] As an optional technical solution of the present invention: the audit task scheduling controller includes a task generation trigger, a priority calculation register, and a status tracking buffer. The task generation trigger is connected to the toll evasion behavior identification calculation board. When a new vehicle is added to the list of suspected vehicles output by the toll evasion behavior identification calculation board, the task generation trigger automatically creates an audit task for that vehicle. The audit task includes at least the suspected vehicle information, toll evasion suspicion score, suspicion description, and task creation timestamp. The priority calculation register calculates the task priority based on the suspected vehicle's toll evasion suspicion score, the number of historical toll evasion records, and the estimated toll evasion amount corresponding to the current toll evasion suspicion. Specifically, the priority calculation register normalizes the toll evasion suspicion score, the number of historical toll evasion records, and the estimated toll evasion amount, then performs a weighted sum according to a preset weight ratio to obtain a comprehensive priority score, which is then latched into the register in binary weight form. The status tracking buffer is used to record the entire lifecycle status of each audit task in real time, from creation, dispatch, processing, case closure to archiving. Each time the status changes, the status change time and operator information are recorded.

[0085] As an optional technical solution of the present invention: the audit result output interface gateway and the evidence chain encapsulation secure storage unit are connected via a network interface. The audit result output interface gateway has multiple built-in output format templates, including PDF report templates, JSON data templates, and XML data templates. After receiving an output instruction, the audit result output interface gateway retrieves the corresponding electronic evidence chain from the evidence chain encapsulation secure storage unit and obtains the corresponding toll evasion suspicion score from the toll evasion behavior identification calculation board. It then encapsulates the electronic evidence chain and toll evasion suspicion score into a standardized audit report according to the selected output format template. The audit result output interface gateway provides report push function, report download function, and external API query interface. The report push function pushes the report to the auditor's terminal through a message push gateway. The report download function generates a one-time download link for authorized personnel to download. The external API query interface allows third-party systems to query and obtain audit reports based on conditions using a standard RESTful API.

[0086] As an optional technical solution of the present invention: the model incremental update training module and the toll evasion behavior recognition computing board are connected through dual data and control channels. The model incremental update training module includes a sample acquisition interface, an incremental training sub-board, and an A / B comparison verification sub-board. The sample acquisition interface is used to acquire data of toll evasion vehicles confirmed by manual audit as positive examples, and data of vehicles excluded from suspicion by manual audit as negative examples. The incremental training sub-board inputs the acquired positive and negative examples into the current multi-dimensional toll evasion recognition model for incremental training. During the incremental training process, the incremental training sub-board uses an online gradient boosting algorithm or an incremental XGBoost algorithm as the incremental learning algorithm, so that the model gradually fits the feature distribution of newly added samples while retaining existing knowledge. After incremental training, the A / B comparison verification subboard uses a pre-saved validation dataset to perform A / B comparison tests on the models before and after the update, calculating the accuracy and recall of the models before and after the update on the validation dataset. When the accuracy and recall of the updated model in identifying toll evasion are not lower than those of the model before the update, the A / B comparison verification subboard sends a model loading and update command to the toll evasion behavior recognition computing board, deploying the updated model online to replace the current model. If the performance of the updated model is lower than that of the model before the update, the update is abandoned and the original model is retained.

[0087] As an optional technical solution of the present invention, the system also includes a system management and configuration terminal. The system management and configuration terminal is connected to the audit task scheduling controller and the toll evasion behavior identification calculation board via a network. The system management and configuration terminal has a built-in rule configuration interface and a Groovy script online editing engine. The rule configuration interface is a graphical user interface used by administrators to configure toll evasion feature rules, toll evasion suspicion scoring thresholds, automatic audit task generation conditions, and evidence chain encapsulation templates. The toll evasion feature rules include setting the calculation methods for various features and the value range of feature extraction parameters. The toll evasion suspicion scoring threshold includes setting a default threshold and threshold offsets for each scenario. The automatic audit task generation conditions include setting the lower limit for automatic task triggering and the time interval for repeated audits of the same vehicle. The evidence chain encapsulation template includes setting the field order, cover style, and signature position of the evidence package. The Groovy script online editing engine provides a script editor and a syntax validator. Administrators can use this engine to write Groovy scripts to extend custom audit logic. The script editor supports real-time syntax highlighting and auto-completion, and the syntax validator performs pre-compilation verification before saving the script to check the correctness of the script syntax. The completed Groovy script is dynamically loaded into the system runtime environment through the class loader for execution, without the need to recompile and deploy the entire system, thereby realizing hot-swappable extension of custom audit logic.

[0088] As an optional technical solution of the present invention: the ETC gantry data acquisition terminal has a built-in edge computing coprocessor. The edge computing coprocessor adopts a low-power embedded processor based on ARM architecture and runs independently of the main data acquisition module of the ETC gantry data acquisition terminal. The edge computing coprocessor has a built-in anomaly detection model, which is either a mean-variance anomaly detection model based on a sliding window or a lightweight anomaly detection model based on an isolation forest. The edge computing coprocessor performs real-time anomaly detection on the collected vehicle passage transaction data locally on the gantry. The real-time anomaly detection includes detection of anomalies in transaction amount, transaction time, and vehicle information. Anomalies in transaction amount refer to a transaction amount that is much higher or lower than the normal toll; anomalies in transaction time refer to transactions during abnormal passage periods; and anomalies in vehicle information refer to a discrepancy between the vehicle model registered by the OBU and the vehicle model actually detected by the gantry. When the edge computing coprocessor detects anomalies in transaction data, it immediately triggers a warning signal locally on the gantry, including illuminating the warning indicator light on the gantry side and generating a local warning log. At the same time, it prioritizes uploading the abnormal data to the multi-source data fusion processor through an independent high-priority data transmission channel. The high-priority data transmission channel is physically isolated from the regular data transmission channel, using independent network ports and independent bandwidth resources to ensure that abnormal data can bypass the data queue and be sent immediately.

[0089] As an optional technical solution of the present invention: the vehicle feature database storage server is equipped with a data synchronization interface. The data synchronization interface is connected to an external vehicle management platform via a physically isolated data exchange front-end. This physically isolated data exchange front-end uses a unidirectional transmission optical gate or network gateway to ensure that there is no bidirectional network connection between the external and internal networks, thereby protecting the network security of the internal system. The data synchronization interface unidirectionally obtains vehicle registration information changes, vehicle transfer information, and vehicle scrapping information from the external vehicle management platform through the data exchange front-end according to a preset synchronization cycle. The synchronization cycle is 2:00 AM daily. Based on the obtained synchronized data, the interface automatically updates the corresponding vehicle file information in the vehicle feature database, including adding vehicle files, modifying change fields in the vehicle files, and marking scrapped vehicles as deregistered.

[0090] Example 2: Figure 2 As shown, the intelligent auditing method for toll evasion based on ETC multi-source data includes the following steps:

[0091] In step S1, vehicle passage transaction data and OBU device data are collected in real time by ETC gantry data acquisition terminals deployed along the highway, and vehicle entry and exit flow data and lane capture image data are collected by the toll station flow acquisition interface machine. Specifically, when a vehicle passes through the ETC gantry, the ETC gantry data acquisition terminal communicates with the vehicle's OBU device via 5.8GHz DSRC communication through the RSU antenna to obtain vehicle passage transaction data and OBU device data. The vehicle passage transaction data includes transaction serial number, vehicle passage identifier, transaction time, entry station, exit station, transaction amount, vehicle type, etc. The OBU device data includes OBU serial number, OBU registered vehicle type, OBU status, etc. The toll station flow acquisition interface machine obtains vehicle entry and exit flow data from the toll station lane system through Socket connection or shared memory, and obtains lane capture image data from the image acquisition device through FTP or HTTP protocol. The captured image data includes a panoramic image of the vehicle's front and a close-up image of the license plate.

[0092] In step S2, the multi-source data fusion processor preprocesses the collected multi-source vehicle data. The data cleaning subprocessor first removes outliers from the ETC gantry transaction data. Specifically, for the transaction amount field, records exceeding the historical normal transaction amount distribution range are marked as suspicious but not directly deleted, pending subsequent manual review. The historical normal transaction amount distribution range is outside the mean ± 3 standard deviations. For the transaction time field, records with timestamps earlier than the current system time or later than the current system time exceeding a preset threshold are removed. The data cleaning subprocessor then completes missing values. Specifically, for missing vehicle model codes, it imputes the missing model information from other transaction records of the same vehicle within adjacent time windows; for missing license plate numbers, it retrieves and completes the missing license plate number from the vehicle feature database storage server based on the vehicle's access identifier. After cleaning, the data cleaning subprocessor converts the data into a unified JSON or Protocol Buffers format data structure.

[0093] In step S3, the multi-source data fusion processor uses the vehicle access identifier as the primary key to perform spatiotemporal correlation fusion of ETC gantry transaction data, toll station transaction data, and captured image data according to time sequence and spatial location, generating a vehicle travel trajectory record with a unified data structure. Specifically, the spatiotemporal correlation subprocessor uses the vehicle access identifier as the first primary key and the timestamp as the sorting basis to arrange all ETC gantry transaction records of the vehicle within a preset time period in chronological order to form a gantry sequence. The vehicle access identifier is either the OBU serial number or the license plate number. Then, the trajectory reconstruction subprocessor matches the paths between adjacent gantries with possible paths in the highway network topology based on the position of each gantry in the gantry sequence, reconstructing the vehicle's complete travel path. Finally, the entry and exit information in the toll station transaction data is cross-validated with the reconstructed travel path. If the entry and exit information does not match the start and end points of the reconstructed path, the vehicle is marked as a path anomaly vehicle. The generated vehicle passage trajectory record includes at least the following fields: vehicle passage identifier, complete travel path node sequence, time of passing each node, travel duration of each section, entrance station, exit station, amount due, and amount actually received.

[0094] In step S4, the toll evasion behavior recognition calculation board extracts vehicle identity features, travel path features, billing features, and behavior pattern features from the vehicle travel trajectory record. These features are then weighted and fused using weight allocation logic embedded within the board to generate a feature vector for toll evasion detection. Specifically, the extracted vehicle identity features include the matching degree between the vehicle's toll sign and the baseline information registered in the vehicle feature database, as well as the continuity of the OBU device across different gantries. The matching degree includes whether the license plate number, vehicle model, and vehicle color match. Continuity refers to whether the same OBU serial number appears consecutively at different gantries within a reasonable time window. The extracted travel path features include the completeness of the reconstructed path and the deviation between the travel time between adjacent gantries and the theoretical travel time. The completeness of the reconstructed path is the ratio of the actual number of gantries passed in the path to the theoretical number of gantries. The theoretical travel time is calculated based on road network distance and speed limits. The extracted billing features include the difference between the amount due and the amount received, and the deviation rate between the billed mileage and the actual mileage traveled. The amount due is based on the theoretical toll calculated from the reconstructed path. The extracted behavioral pattern features include abnormal behavioral patterns such as frequency of passage within a unit of time, number of times the same road segment is traveled back and forth within a fixed time period, and short-distance passage followed by long-term stays. The toll evasion behavior identification calculation board assigns the above four types of features according to a weighted distribution formula. The weight values ​​of each feature are calculated, and then the weighted sum of each feature value is used to form a multidimensional feature vector.

[0095] In step S5, the toll evasion behavior recognition computing board inputs the feature vector into the built-in multi-dimensional toll evasion recognition model constructed based on the gradient boosting algorithm, calculates the toll evasion suspicion score of the target vehicle, and determines whether the vehicle is suspected of toll evasion based on a preset suspicion threshold, outputting a list of suspected vehicles. Specifically, the gradient boosting multi-dimensional toll evasion recognition model in the FPGA acceleration unit consists of multiple decision trees. Each decision tree independently judges the input feature vector and outputs a score. The output scores of all decision trees are weighted and summed, and then mapped to a suspicion score value in the range of 0 to 100 by the Sigmoid function. The toll evasion behavior recognition computing board compares the calculated suspicion score value with the preset suspicion threshold, which is initially set to 70 points: if it is greater than or equal to the threshold, the vehicle is identified as a suspected vehicle and added to the list of suspected vehicles; if it is lower than the threshold, it is marked as a normal passage vehicle. The list of suspected vehicles must include at least the vehicle's traffic sign, toll evasion suspicion score, suspicion type label, and a preliminary description of the reasons for suspicion. Suspicion type labels include abnormal routes, inconsistent vehicle models, and discrepancies in toll amounts.

[0096] In step S6, the secure storage unit encapsulates the evidence chain and automatically associates the corresponding gantry transaction records, toll station entry and exit records, license plate capture images, and trajectory reconstruction data for vehicles suspected of toll evasion. This generates a complete electronic evidence chain with temporal correlation and a digital digest, which is then stored in the tamper-proof storage area. Specifically, after receiving the evidence collection instruction, the evidence collection interface sub-board uses the suspected vehicle's passage identifier and suspected time period as search criteria to batch extract all ETC gantry transaction records, toll station entry and exit records, and lane capture image data for the vehicle within the suspected time period from the multi-source data fusion processor. Simultaneously, it extracts the complete passage path trajectory reconstruction map of the vehicle from the trajectory reconstruction sub-processor. The evidence encapsulation and encryption sub-board encapsulates and packages the above raw data in chronological order, calculates an independent digital digest for each evidence record using a cryptographic algorithm, and adds a trusted timestamp issued by the National Time Service Center. The encapsulated electronic evidence chain is then written to the write-once-read-many storage medium of the tamper-proof storage sub-board for secure storage, and the write address and evidence index number are recorded.

[0097] In step S7, the audit task scheduling controller calculates the audit task priority based on the suspected vehicle's fare evasion suspicion score, the number of historical fare evasion records, and the amount of fare evasion. Audit tasks are then automatically generated and dispatched to the corresponding audit terminals according to the priority. Specifically, the task generation trigger monitors the list of suspected vehicles output by the fare evasion behavior recognition calculation board. When a new suspected vehicle is detected, the audit task creation is immediately triggered. The priority calculation register reads the suspected vehicle's fare evasion suspicion score S, the number of fare evasion records H in the vehicle's history, and the estimated amount of fare evasion A, and calculates the priority according to the priority calculation formula. Calculate the overall priority, where , , They are respectively The value after Min-Max normalization , , The preset weighting coefficients are 0.5, 0.2, and 0.3 respectively. The calculated priority score P is latched in the priority calculation register in binary weight form. The audit task scheduling controller dispatches audit tasks to the corresponding audit terminals in descending order of priority score. Audit terminals include the PC or mobile terminal of the audit personnel. The dispatching methods include real-time push and timed batch dispatch.

[0098] In step S8, the audit task scheduling controller receives the audit confirmation result returned by the audit terminal and marks the suspected vehicle based on the confirmation result. Auditors view the complete information of the suspected vehicle, including the electronic evidence chain and toll evasion suspicion score, through the audit terminal, perform manual confirmation, and submit the audit confirmation result. If the auditor confirms toll evasion, the audit task scheduling controller adds the vehicle to the toll evasion blacklist and triggers the recovery process; if the auditor rules out the suspicion, the vehicle's suspicion status is updated to "ruled out," and the vehicle's data is stored as a negative example in the sample pool of the model incremental update training module. For vehicles confirmed to have evaded tolls, the toll evasion blacklist is simultaneously updated to the vehicle feature database storage server and the ETC gantry data collection terminal for subsequent interception and notification.

[0099] In step S9, the incremental update training module obtains data on toll evasion vehicles confirmed by audit as positive examples and data on vehicles ruled out as negative examples. The multi-dimensional toll evasion identification model is dynamically iterated and updated through incremental learning. Specifically, the sample collection interface obtains all closed audit results data from the audit task scheduling controller every 7 days according to a preset sampling period. Data on confirmed toll evasion vehicles is marked as positive examples, and data on vehicles ruled out as negative examples. The incremental training sub-board inputs the accumulated new samples into the current model for incremental training. During incremental training, a progressive learning strategy is adopted, meaning the weights of the loss function for new samples are adjusted according to a time decay coefficient, so that the model can maintain its ability to identify old samples while fitting new samples. After incremental training is completed, the A / B comparison verification sub-board will perform parallel testing of the two models before and after the update on the verification dataset, and calculate the accuracy and recall respectively. Only when the accuracy and recall of the updated model are not lower than those of the model before the update will the new model be loaded into the FPGA acceleration unit of the fare evasion behavior recognition computing board to replace the old model.

[0100] In step S10, the audit result output interface gateway encapsulates the electronic evidence chain and toll evasion suspicion score into a standardized audit report according to a preset format, and outputs the audit results via message push, email, and API interface query. Specifically, based on the report generation instructions from the auditors, the audit result output interface gateway retrieves the complete electronic evidence chain from the tamper-proof storage area of ​​the evidence chain encapsulation secure storage unit, and reads the final toll evasion suspicion score and its detailed scores for each dimension from the toll evasion behavior identification calculation board. The audit result output interface gateway encapsulates the above data into an audit report according to the selected output template, which is a PDF template. The report includes at least the following sections: basic information of the suspect vehicle, toll evasion suspicion score and details, electronic evidence chain index and summary, audit conclusion, and handling recommendations. After the audit report is generated, the audit result output interface gateway pushes the report to the terminal devices of auditors and relevant management personnel via a message push gateway, and simultaneously sends the report as an encrypted attachment to a preset receiving email address via an email server, and updates the query result cache of the external API query interface so that third-party systems can obtain the latest audit results.

[0101] In step S11, the system management configuration terminal performs full-link tracking and recording of data operation behaviors, model call records, and audit task operation logs generated throughout the audit process. This data is then permanently stored and retrieved through a centralized log storage server to support operation auditing and audit process retrospection. Specifically, the system management configuration terminal continuously collects log data during the operation of each system module. This log data includes data collection logs, model call logs, and audit task operation logs. The data collection logs record the data collection time, data volume, and number of abnormal records for each collection terminal. The model call logs record the time of each model inference call, input feature vector summary, output score, and inference time. The audit task operation logs record all operations of each audit task from creation to closure, including the operator, operation time, operation type, and status changes before and after the operation. All log data is reported in real-time to the ELK centralized log storage server through a log collection agent. The centralized log storage server stores the log data in a structured manner and establishes a full-text search index, allowing auditors and administrators to quickly search and audit trace the data using the log search interface based on time range, operation type, operation object, and other conditions.

[0102] In summary, this invention achieves intelligent auditing of ETC toll evasion behavior throughout the entire process, from data collection, intelligent identification, evidence fixation, task assignment, audit confirmation to model evolution, through the coordinated efforts of multiple stages, including deep fusion of multi-source data, FPGA-accelerated gradient boosting model recognition, automated evidence chain encapsulation and solidification, incremental learning model updates, and automatic audit task scheduling. This effectively improves the accuracy of toll evasion identification, the completeness of the evidence chain, and the efficiency of auditing work.

[0103] Although embodiments of the invention have been shown and described, it will be understood by those skilled in the art that various changes, modifications, substitutions and alterations can be made to these embodiments without departing from the principles and spirit of the invention, the scope of which is defined by the appended claims and their equivalents.

Claims

1. An intelligent toll evasion audit system based on ETC multi-source data, characterized in that: include: ETC gantry data acquisition terminals are deployed on the gantry side along the highway to collect vehicle passage transaction data, OBU equipment data and RSU transaction logs in real time, and perform preliminary verification and format standardization processing on the collected data. The toll station data collection interface unit is deployed on the toll station computer room side. It is used to collect vehicle entry and exit data, toll amount data and lane capture image data from the toll station lane system, and to perform timestamp alignment and integrity verification on the collected data. The multi-source data fusion processor is communicatively connected to the ETC gantry data acquisition terminal and the toll station flow acquisition interface machine, respectively, and is used to receive uploaded data. It performs multi-dimensional fusion of vehicle passage data from different sources and in different formats through spatiotemporal association rules to generate vehicle passage trajectory records with a unified data structure. The vehicle feature database storage server is used to store and manage basic vehicle profile information, vehicle model parameters, historical passage records and historical toll evasion blacklists, and provides vehicle identity comparison benchmark data for toll evasion identification. The toll evasion behavior recognition computing board is connected to the multi-source data fusion processor and the vehicle feature library storage server respectively. It has a built-in FPGA acceleration unit with a multi-dimensional toll evasion recognition model based on the gradient boosting algorithm. It is used to extract vehicle identity features, travel path features, billing features and behavior pattern features based on the vehicle travel trajectory record and the benchmark data, calculate the toll evasion suspicion score and output the list of suspect vehicles. The audit task scheduling controller is connected to the toll evasion behavior identification calculation board and has a built-in task queue cache. It is used to automatically generate audit tasks based on the list of suspected vehicles, sort and dispatch audit tasks according to preset priority rules, and track the processing status of audit tasks. The evidence chain encapsulates a secure storage unit, which is connected to the multi-source data fusion processor and the audit task scheduling controller respectively. When it is determined that a vehicle is suspected of evading tolls, it is used to automatically associate the gantry transaction flow, toll station entry and exit flow, license plate capture image and trajectory reconstruction data corresponding to the vehicle, package them to generate a complete electronic evidence chain with time-series correlation and digital digest, and store the electronic evidence chain in the internal tamper-proof storage area. The audit result output interface gateway is connected to the evidence chain encapsulation secure storage unit, which is used to encapsulate the electronic evidence chain and the evasion suspicion score into an audit report according to a preset format, and provides report push, download and external API query interface; The model incremental update training module is connected to the fare evasion behavior recognition computing board and is used to dynamically update the multi-dimensional fare evasion recognition model through incremental learning based on the positive and negative examples fed back by the audit results.

2. The intelligent toll evasion audit system based on ETC multi-source data according to claim 1, characterized in that: The multi-source data fusion processor includes: The data cleaning subprocessor is used to perform outlier removal and missing value completion operations on ETC gantry transaction data. The spatiotemporal correlation subprocessor is used to correlate and map gantry transaction data, toll station transaction data, and captured image data according to time series and spatial location, using vehicle passage identification as the primary key. The trajectory reconstruction subprocessor is used to generate the complete travel path trajectory of the vehicle based on the associated mapped data. The weight allocation logic built into the toll evasion behavior identification calculation board is embedded in the FPGA unit through a hardware description language. The weight allocation logic performs weighted fusion of the vehicle identity features, travel route features, toll collection features and behavior pattern features according to the weight allocation formula. The weight allocation formula dynamically adjusts the weight values ​​of various features based on the correlation coefficients between various features and toll evasion behavior in historical audit data.

3. The intelligent toll evasion audit system based on ETC multi-source data according to claim 1, characterized in that: The secure storage unit for the chain of evidence includes: The evidence collection interface sub-board is used to extract raw data related to the suspect vehicle from the ETC gantry data collection terminal, the toll station flow collection interface machine, and external image acquisition equipment. The evidence encapsulation and encryption sub-board is used to encapsulate the original data in a structured manner according to the preset evidence chain format specifications, and to add an independent digital digest and timestamp to each piece of evidence; The tamper-proof storage sub-board uses a write-once, read-many storage medium to solidify and store the packaged electronic evidence chain and establish an evidence index. The audit task scheduling controller includes: Task generation trigger, used to automatically trigger the creation of audit tasks based on the suspected toll evasion score of a vehicle; The priority calculation register is used to calculate the task priority based on the suspected vehicle's evasion score, the number of historical evasion records, and the amount of evasion, and then latch it in binary weight form. A status tracking cache is used to record the entire lifecycle status of audit tasks in real time, from creation, dispatch, processing to case closure.

4. The intelligent toll evasion audit system based on ETC multi-source data according to claim 1, characterized in that: The incremental update training module for the model includes: The sample collection interface is used to obtain data on toll evasion vehicles confirmed by manual audit as positive examples and data on vehicles excluded from suspicion by manual audit as negative examples. The incremental training sub-board is used to input the positive and negative samples into the current model for incremental training and adjust the model parameters; the A / B comparison verification sub-board is used to perform A / B comparison verification on the model before and after the incremental training is completed, and only sends the model loading update instruction to the fare evasion behavior recognition computing board after the verification is passed. The system also includes a system management and configuration terminal, which is connected to the audit task scheduling controller and the toll evasion behavior identification calculation board. It has a built-in rule configuration interface and a Groovy script online editing engine, which are used by administrators to configure toll evasion feature rules, toll evasion suspicion scoring thresholds, automatic audit task generation conditions and evidence chain encapsulation templates. The rule configuration interface realizes hot-swappable expansion of custom audit logic through the script editing engine.

5. The intelligent auditing method and system for toll evasion based on ETC multi-source data according to claim 1, characterized in that: The ETC gantry data acquisition terminal has a built-in edge computing coprocessor. The edge computing coprocessor is used to perform real-time anomaly detection on the collected vehicle passage transaction data locally on the gantry. When an anomaly is detected in the transaction data, a local early warning signal is immediately triggered and the abnormal data is uploaded to the multi-source data fusion processor through an independent high-priority data transmission channel. The vehicle feature database storage server is equipped with a data synchronization interface. The data synchronization interface is connected to an external vehicle management platform through a physically isolated data exchange front-end machine. It is used to periodically obtain vehicle registration information changes, vehicle transfer information and vehicle scrapping information, and automatically update the vehicle feature database based on the synchronized data.

6. A smart auditing method for toll evasion based on ETC multi-source data, employing the system described in any one of claims 1-5, characterized in that: Includes the following steps: S1: Real-time vehicle passage transaction data and OBU device data are collected through ETC gantry data collection terminals deployed along the highway, and vehicle entry and exit flow data and lane capture image data are collected through toll station flow collection interface machine. S2: The multi-source data fusion processor preprocesses the collected multi-source vehicle data, including outlier removal, missing value completion, and data format standardization, to generate standardized data in a unified format. S3: The multi-source data fusion processor uses the vehicle passage identifier as the associated primary key to perform spatiotemporal correlation fusion of ETC gantry transaction data, toll station flow data and captured image data according to time series and spatial location to generate a vehicle passage trajectory record with a unified data structure. S4: The toll evasion behavior recognition calculation board extracts vehicle identity features, travel path features, billing features and behavior pattern features from the vehicle travel trajectory record, and performs weighted fusion of various features through the weight allocation logic embedded in the board to generate a feature vector for toll evasion recognition. S5: The fare evasion behavior recognition calculation board inputs the feature vector into the built-in multi-dimensional fare evasion recognition model based on the gradient boosting algorithm, calculates the fare evasion suspicion score of the target vehicle, and determines whether the vehicle is suspected of fare evasion according to the preset suspicion threshold, and outputs a list of suspected vehicles. S6: The evidence chain encapsulation secure storage unit automatically associates the corresponding gantry transaction records, toll station entry and exit records, license plate capture images and trajectory reconstruction data of vehicles suspected of toll evasion with the vehicle's corresponding gantry transaction records, toll station entry and exit records, license plate capture images and trajectory reconstruction data, and generates a complete electronic evidence chain with temporal correlation and digital digest, and stores it in the tamper-proof storage area. S7: The audit task scheduling controller calculates the audit task priority based on the suspected vehicle's evasion score, the number of historical evasion records, and the amount of evasion, and automatically generates and dispatches audit tasks to the corresponding audit terminals according to the priority. S8: The audit task scheduling controller receives the audit confirmation result returned by the audit terminal, marks the suspected vehicle according to the confirmation result, and if the toll evasion is confirmed, it is added to the toll evasion blacklist and the recovery process is initiated. If the suspicion is ruled out, the suspicion status is updated to ruled out. S9: The model incremental update training module obtains the data of vehicles that have been verified as evading tolls as positive examples and the data of vehicles that have been removed from the list of suspected vehicles as negative examples. The multi-dimensional toll evasion identification model is dynamically updated through incremental learning. S10: The audit result output interface gateway encapsulates the electronic evidence chain and the evasion suspicion score into a standardized audit report according to a preset format, and outputs the audit results through message push, email sending and API interface query.

7. The intelligent auditing method for toll evasion based on ETC multi-source data according to claim 6, characterized in that: The spatiotemporal correlation fusion in step S3 includes: 1) Using the vehicle passage identifier as the primary key, arrange the ETC gantries passed by the vehicle in chronological order according to the timestamp to form a gantry sequence; 2) Perform path matching based on the gantry sequence and the highway network topology to reconstruct the vehicle's complete travel path; 3) Cross-validate the entry and exit information in the toll station's entry and exit flow data with the reconstructed driving path to identify abnormal passage behavior with inconsistent paths; The weight allocation formula in step S4 is: ,in for The weight values ​​of the first type of feature, For the first statistical analysis based on historical audit data The correlation coefficient between class characteristics and fare evasion behavior For the first The confidence level of a class feature within the current time window. For the first The reliability coefficient of the data source corresponding to the class feature.

8. The intelligent auditing method for toll evasion based on ETC multi-source data according to claim 6, characterized in that: The electronic evidence chain generated in step S6 includes: a sequence of suspect vehicle passage gantries arranged in chronological order and corresponding transaction records, entry and exit toll station transaction records, license plate capture images and recognition results, vehicle passage trajectory reconstruction diagram, and billing anomaly analysis explanation. Each piece of evidence in the electronic evidence chain is given an independent digital digest and timestamp to ensure the integrity and immutability of the evidence. In step S1, the edge computing coprocessor deployed on the ETC gantry side performs real-time anomaly detection on the collected vehicle passage transaction data. When an anomaly is detected in the transaction data, an early warning is immediately triggered locally on the gantry and the abnormal data is uploaded to the cloud through an independent high-priority channel for toll evasion identification and processing.

9. The intelligent auditing method for toll evasion based on ETC multi-source data according to claim 6, characterized in that: The incremental learning method in step S9 includes: 1) Input positive and negative samples into the current multi-dimensional fare evasion detection model for incremental training and adjust the model parameters; 2) After incremental training is completed, use the retained validation dataset to perform A / B comparison tests on the model before and after the update; 3) When the accuracy and recall of the updated model for identifying fee evasion are not lower than those of the model before the update, the updated model will be deployed online to replace the current model. The suspected threshold preset in step S5 adopts a dynamic threshold strategy, which automatically adjusts the value of the suspected threshold according to the current audit task queue length, historical audit accuracy, and seasonal fluctuations in evasion behavior, so as to balance the audit recall rate and the audit precision rate.

10. The intelligent auditing method for toll evasion based on ETC multi-source data according to claim 6, characterized in that: It also includes step S11: The system management configuration terminal performs full-link tracking and recording of data operation behavior, model call records, and audit task operation logs generated throughout the audit process, and stores and retrieves them through a centralized log storage server to support operation auditing and audit process backtracking; The recovery process in step S8 includes: automatically generating a recovery notice containing the amount of evaded fees, the time period of evasion, the evasion route, and an evidence chain index; The notice of recovery will be pushed to the user terminal of the vehicle through the message push gateway; the recovery status will be continuously tracked within the preset recovery period, and if the recovery is not made within the time limit, the vehicle information will be automatically synchronized to the highway entrance blacklist system.

Images