Anomaly detection in public transport ticketing data

Abstract

Anomaly detection in public transport ticketing data. The invention relates to a method (34) for detecting anomalies in ticketing data comprising at least one learning phase (P1) including the following steps, applied to tabular training ticketing data: - preprocessing and selection (36) of predetermined data columns of interest; - deep learning (38) of a neural network with the training ticketing data optimized by said preprocessing and obtaining a model of said neural network configured to detect an anomaly; and at least one inference phase (P2) including the following steps, applied to test tabular ticketing data: - application (40) of said preprocessing and of said selection of predetermined data columns of interest to said test tabular ticketing data;- obtaining (42) a score corresponding to a level of anomaly of said tabular test ticketing data by applying said model to said test ticketing data optimized by said preprocessing. Figure for the abbreviation: Figure 2;

Description

Title of the invention: Detection of anomalies in public transport ticketing data

[0001] The present invention relates to a method and a system for detecting anomalies in public transport ticketing data.

[0002] The invention also relates to a computer program comprising software instructions which, when executed by a computer, implement such a method for detecting anomalies in public transport ticketing data.

[0003] The field of the invention relates to the detection of anomalies for ticketing systems allowing users with a transport ticket to access public transport networks.

[0004] More specifically, such ticketing systems include in particular ticket counters and sales machines, ticket validators and automatic access control gates, and create large quantities of data, both quantitative and qualitative, on the actions of passengers on the public transport network(s), in particular relating to validations, product purchases, recharging, and refunds, and of different types relating for example to transaction values, entry or exit tags, stop stations.

[0005] From this data, automatic processing makes it possible to search for anomalies and potential frauds which may occur during transactions by users of the transport network.

[0006] Such existing automatic processing dedicated to the control of public transport ticketing data generally aims to apply predefined rules to transactions to find impossible or doubtful phenomena or correspond

[0007] to statistical data processing, and extensively to detect points outside distribution. These current solutions have the disadvantage of being poorly adapted to the discovery of new anomalies or new frauds, because they require processing that is often very heavy, complex and not very scalable because it requires advanced human reflection, by a supervision operator, on what constitutes fraud or an anomaly.

[0008] In other fields of application, different learning processing methods which have the advantage of being light to deploy, and of discovering new fraud schemes which are not necessarily accessible to statistical processing methods are used but are not adapted to the control of public transport ticketing data. The new fraud schemes require a unsupervised or self-supervised learning, because it is not possible to know a priori whether a behavior is abnormal, otherwise it would have been possible to integrate it into a statistical processing algorithm.

[0009] Currently, there is therefore no automatic processing capable of discovering new fraud schemes in the field of public transport ticket data control.

[0010] To this end, the invention relates to a method for detecting anomalies in public transport ticketing data, the method being suitable for being implemented by an electronic system for detecting anomalies in public transport ticketing data, the method comprising at least one learning phase and at least one inference phase,

[0011] said at least one learning phase comprising the following steps, applied to tabular training ticket data:

[0012] - preprocessing and selection of predetermined columns of data of interest within said tabular training ticket data;

[0013] - deep learning of at least one neural network using the data training ticketing optimized by said preprocessing and obtaining a model of said at least one neural network configured to detect an anomaly in ticketing data;

[0014] said at least one inference phase comprising the following steps, applied to tabular test ticket data;

[0015] - application of said preprocessing and said selection of data columns of predetermined interest to said tabular test ticket data;

[0016] - obtaining a score corresponding to a level of anomaly of said data tabular test ticketing by applying said model to said test ticketing data optimized by said preprocessing.

[0017] Thus, the method according to the present invention makes it possible to accelerate the processing of public transport ticketing data while searching for rare and complex abnormal behaviors.

[0018] More specifically, the method according to the present invention proposes a preprocessing specific to the tabular data format used in public transport ticketing systems in order to optimize the inputs of a neural network whose model, after having been trained to detect anomalies from training data using deep learning with a contrastive loss, is capable of being used to provide a score capable of quantitatively describing the extent to which a ticketing event is abnormal or not.

[0019] According to other advantageous aspects of the invention, the method for detecting anomalies in public transport ticketing data comprises one or several of the following characteristics, taken individually or in all technically possible combinations:

[0020] - preprocessing and selection of predetermined columns of data of interest include:

[0021] - the selection, for each public transport user, or by extension for each unique identifier of a public transport ticket or payment method used by that person to travel, a predetermined number of last ticket transactions and associated tabular ticket data;

[0022] - within said tabular ticketing data associated with the predetermined number of latest transactions, the selection of data columns corresponding to:

[0023] - type of transaction;

[0024] - the digital transaction value;

[0025] - the transaction ticketing context;

[0026] - preprocessing and selection of predetermined columns of data of interest further include formatting said selected ticketing data according to a predetermined format;

[0027] - preprocessing and selection of predetermined columns of data of interest further include sorting the transactions in chronological order followed by grouping said transactions by user, each user being identified by a unique identifier, then filtering the users in order to retain only the ticketing data associated with users having a number of transactions greater than or equal to said predetermined number of last ticketing transactions;

[0028] - preprocessing and selection of predetermined columns of data of interest further include a typing and then a separation of the selected tabular ticketing data into two types of variables comprising categorical variables suitable for qualitatively describing a state and / or a ticketing element and numerical variables suitable for quantitatively describing a state and / or a ticketing element;

[0029] - said deep learning uses a contrastive loss function and in which obtaining said score in the inference phase includes normalization using the minimum and maximum values ​​of the contrastive loss function encountered in the learning phase;

[0030] - said deep learning comprises:

[0031] - determining, by means of said at least one neural network, a plurality views of the ticketing data resulting from said preprocessing and said selection,

[0032] - the dimensional reduction of each of the views of said plurality of views providing views in a reduced-dimensional latent space;

[0033] - the calculation of predetermined geometric properties in said latent space of more small dimension obtained by said dimensional reduction;

[0034] - said at least one inference phase further comprises an explanation step assigning weights to the columns selected during the preprocessing step, said weights being capable of explaining at least in part said score obtained.

[0035] The invention also relates to a computer program comprising software instructions which, when executed by a computer, implement a method for detecting anomalies in public transport ticketing data, as defined above.

[0036] The invention also relates to a system for detecting anomalies in public transport ticketing data, the electronic system comprising a learning unit and an inference unit,

[0037] the learning unit comprising, for application to tabular ticket training data:

[0038] - a preprocessing module configured to preprocess and select columns of predetermined data of interest within said training tabular ticketing data;

[0039] - a deep learning module configured to implement an ap deep learning of at least one neural network using the training ticket data optimized by said preprocessing and to obtain a model of said at least one neural network capable of detecting an anomaly in ticket data;

[0040] said inference unit comprising, for application to tabular test ticket data:

[0041] - an application module configured to apply said preprocessing and said selecting predetermined columns of data of interest to said test tabular ticket data;

[0042] - a module for obtaining a score corresponding to a level of anomaly of said tabular test ticketing data, said obtaining module being configured to obtain said score by applying said model to said test ticketing data optimized by said preprocessing.

[0043] These characteristics and advantages of the invention will appear more clearly on reading the description which follows, given solely by way of non-limiting example, and made with reference to the appended drawings, in which:

[0044] - [Fig.l] [Fig.l] is a diagram illustrating an electronic detection system anomalies in public transport ticketing data;

[0045] - [Fig.2] [Fig.2] is a flowchart of an anomaly detection method in public transport ticketing data according to the present invention;

[0046] - [Fig.3] [Fig.3] illustrates in detail the data preprocessing and selection step of predetermined columns of data of interest within said ticketing data tabular.

[0047] [Fig.l] is a representation of an electronic system 10 for detecting anomalies in public transport ticketing data according to the present invention.

[0048] The electronic system 10 comprises a learning unit and an inference unit, both not shown for simplicity in [Fig.l], these two units being able to share, according to one embodiment, at least one same electronic module.

[0049] The learning unit firstly comprises, for application to tabular ticketing data 12, denoted D_T, and in this case, during learning, training data, of which it is known beforehand whether or not they carry anomaly(ies), a pre-processing module 14 configured to pre-process and select (denoted P+S) columns of predetermined data of interest within said training tabular ticketing data.

[0050] The operation of such a preprocessing and selection module 14 will be detailed later in relation to [Fig. 3]. Such a preprocessing and selection module 14 provides optimized data 16 (denoted D_O_A) as output for subsequent deep learning.

[0051] The learning unit further comprises a deep learning module 20 configured to implement deep learning of at least one neural network using the ticketing training data 16 optimized by said preprocessing module 14 and to obtain a model 22 of said at least one neural network capable of detecting an anomaly in ticketing data.

[0052] The inference unit comprises, for application to test tabular ticketing data D_T, firstly an inference application module 23 (denoted A_I) configured to apply said preprocessing and said selection of predetermined columns of data of interest 230 to said test tabular ticketing data.

[0053] In other words, the module 23 is configured to apply the same preprocessing and selection to the test tabular ticketing data as previously applied to the training ticketing data.

[0054] According to a variant not shown, the inference unit reuses the module 14 of the learning unit and not a separate module 23 as shown in [Fig.l].

[0055] The inference unit further comprises a module 24 for obtaining a score 26 corresponding to a level of anomaly of said tabular test ticketing data, said obtaining module 24 being configured to obtain said score 26 by applying said neural network model 22 to said test ticketing data optimized by said preprocessing implemented by the aforementioned module 23.

[0056] As an optional addition, the electronic system 10 further comprises an explainability module 28 configured to assign weights to the columns selected by the preprocessing module 23, said weights being capable of explaining at least in part said score 26 obtained.

[0057] Depending on the score 26, the tabular test ticket data are categorized by decision as representative of an abnormal event 30 (i.e. an anomaly E_A), or by also taking into account the model 22 according to the arrow 31, of a normal event 32 (i.e. absence of anomaly E_N).

[0058] According to an implementation not shown, the electronic system 10 for detecting anomalies in public transport ticketing data according to the present invention comprises a processing unit formed for example of a memory and a processor associated with the memory, and the electronic system 10 for detecting anomalies in public transport ticketing data according to the present invention is at least partly implemented in the form of software, or a software brick, executable by the processor, in particular for the learning unit: the pre-processing module 14 and the deep learning module 20, and for the inference unit the application module 23 and the obtaining module 24. The memory of the electronic system 10 is then capable of storing such software or software bricks, and the processor is then capable of executing them.

[0059] According to another implementation also not shown, for the learning unit: the preprocessing module 14 and the deep learning module 20, and for the inference unit the application module 23 and the obtaining module 24 are each produced in the form of a programmable logic component, such as an FPGA (Field Programmable Gate Array), or in the form of a dedicated integrated circuit, such as an ASIC (Application Specific Integrated Circuit).

[0060] When a part of the electronic system 10 for detecting anomalies in public transport ticketing data according to the present invention is produced in the form of one or more software programs, that is to say in the form of a computer program, this part is furthermore capable of being recorded on a medium, not shown, readable by a computer. The computer-readable medium is, for example, a medium capable of storing electronic instructions and of being coupled to a bus of a computer system. By way of example, the readable medium is an optical disk, a magneto-optical disk, a ROM memory, a RAM memory, any type of non-volatile memory (for example EPROM, EEPROM, FLASH, NVRAM), a magnetic card or even an optical card. A computer program comprising software instructions is then stored on the readable medium.

[0061] The operation of the electronic system 10 for detecting anomalies in the Public transport ticketing data according to the present invention will subsequently be described in more detail in relation to Figures 2 and 3.

[0062] [Fig.2] flowchart of a method 34 for detecting anomalies in public transport ticketing data according to the present invention implemented by the electronic system of [Fig.l].

[0063] In [Fig.2], the method for detecting anomalies in the ticketing data of public transport includes at least one learning phase Pi and at least one inference phase P2.

[0064] The learning phase Pi consists of learning to detect anomalies from training tabular ticketing data (i.e. training tabular ticketing data D_T_A) of which it is not known beforehand whether they are representative of at least one anomaly or not (unsupervised training).

[0065] Said at least one learning phase Pi firstly comprises a step 36 of preprocessing (noted P_A for preprocessing in learning) and selection of columns of predetermined data of interest within said tabular training ticket data D_T_A.

[0066] Then, the learning phase Pi comprises a step 38 of deep learning of at least one neural network using the training ticketing data optimized by said preprocessing and obtaining a model M of said at least one neural network configured to detect an anomaly in ticketing data.

[0067] For example, the neural network(s) used in deep learning and then in inference thereafter are convolutional neural networks.

[0068] As an optional addition, said deep learning 38 uses a contrastive loss function.

[0069] According to another optional supplement not shown, said deep learning 38 comprises:

[0070] - determining, by means of said at least one neural network, a plurality of views of the ticketing data resulting from said preprocessing and said selection 36,

[0071] - the dimensional reduction of each of the views of said plurality of views by a predetermined encoder providing views in a reduced-dimensional latent space;

[0072] - the calculation of predetermined geometric properties in said latent space of more small dimension obtained by said dimensional reduction.

[0073] In other words, this optional addition amounts to specifically adapting for the detection of anomalies in public transport ticketing data, deep learning as described by Qiu et al. in the article entitled “Neural Transformation Learning for Deep Anomaly Detection Beyond Images” from 2021.

[0074] More precisely, during said deep learning 38, we consider X the space in which contains the data that we are seeking to characterize. K transformations Tj, ..., TK where each transformation T t corresponds to one of the neural networks working on X. The encoder implementing the aforementioned dimensional reduction is represented by the function / . going from X to R'" whose dimension m is such that: m < dim(X). Moreover, for each input x, such that xk — T^x) the similarity function following is used: ^{xk X])=sim^y (¾ ) f where sim is the similarity cosine: s{m ( := , as well as h the similarity score function allowing the transformation of the similarity to values ​​in [ - 1; 1], to take values ​​in R: _ exp / \ with ' is a parameter of " temperature ".

[0075] Thus, between two transformations xk and xi, using the function h a measure of their similarity score is obtained by considering in particular that if h(xk, X]) is large; then the two transformations are close and that if h(xk, X] ) is small, the two encoded transformations are very far apart, which then makes it possible to create the contrastive loss function i suitable for guiding the learning of neural networks T...... « * h= tel 1“ L ( X ) = - Llog^ ; ■ 7 kh^xj+^Kx^x.,)

[0076] Minimizing the contrastive loss function L aims to make h(xk, x) as large as possible, because each transformation associated respectively with a neural network must be as close as possible to the original data according to a classical notion of semantic proximity and this while considering that each similarity score h(xk, X]) must be negatively as large as possible, that is to say that the transformations must be as different as possible according to a classical notion of diversity.

[0077] For example, according to the present invention, the structure of the neural networks used in terms of transformation layer(s) is such that it combines:

[0078] - a one-dimensional convolutional layer on a three-element window, with an offset of one element and zero bias,

[0079] - an instantiated norm layer such as _ -^[y] * , where only the parameter V can change, considering that a layer of a neural network receives, during training, a set of points of Rn (n being the input dimension), x corresponding to the set of values ​​of the point of Rn considered (it is therefore a vector of n values), E[x] corresponding to the mean and Var[x] to the variance, the value y being the output associated with x the set of values ​​of the point of Rn considered, and

[0080] - a sigmoid activation function.

[0081] According to a particular example of the present invention, the number of transformations K to be learned is set to sixteen. A convolutional layer sequence ranging from thirty-two to two hundred and fifty-six channels, doubling from layer to layer and stopping when the input series reaches a size of eight elements is applied. A one-dimensional convolution to embed the data in a latent space of fixed dimension equal to sixty-four is implemented, and at the output the similarities between transformations are scored, the largest similarity scores being abnormal, while the smallest similarity scores being normal.

[0082] The state of the weights of the neural network(s) after training is fixed and exported for at least one subsequent inference phase P2.

[0083] Thus, the learning phase Pi creates a “model” M comprising several elements:

[0084] - the states of the variable processors (i.e. of the preprocessing module 14) allowing the translation of source data into data suitable for the neural network and vice versa;

[0085] - the weights of the layers of the recurrent neural network model M;

[0086] - fixed parameters such as the number of transformations or the temperature used in the contrastive loss function;

[0087] - the minimum and maximum values ​​of the loss function L encountered at training (i.e. learning).

[0088] As previously indicated, such a model M is then used in inference, that is to say that its application to a single set of transactions (i.e. of tabular test ticket data) makes it possible to provide an anomaly score as output, the model M having learned what abnormal data was and thus being able to say on the fly of a set of transactions (e.g. of twenty transactions) whether this set of transactions is abnormal or not.

[0089] Said at least one inference phase P2 comprises for its part first of all a step 40 of applying said preprocessing (noted P_I for inference preprocessing) and said selection of columns of predetermined data of interest to said test tabular ticketing data, said preprocessing and said selection applied to the test tabular ticketing data being identical to that applied in learning phase Pi to the training tabular ticketing data (as detailed later in relation to [Fig. 3] in terms of variable processing by each variable processor (i.e. of the preprocessing module 14 or 23), then coding by a position encoder).

[0090] Such steps 36 and 40 of preprocessing and selection in learning, as of preprocessing and selection in inference are further detailed later in relation to [Fig.3].

[0091] Then, said at least one inference phase P2 comprises a step 42 of obtaining a score S corresponding to a level of anomaly of said ticketing data ta test models by applying in inference said model M to said test ticket data optimized by said preprocessing 40.

[0092] As an optional addition, obtaining 42 said score S in the inference phase P2 comprises a normalization using the minimum and maximum values ​​of the contrastive loss function encountered in the learning phase Pb.

[0093] In other words, the score S, according to this optional complement, is normalized by the minimum and maximum values ​​of the loss function encountered during training (i.e. learning) so that, for example, a normalized score greater than one hundred corresponds to a series of transactions which has not been seen before by the network and is therefore very abnormal.

[0094] Such a score S obtained in inference is an anomaly score indicating only to the operator whether the analyzed transaction pattern is normal or not. Such a score S does not include any indication relating to the origin of the anomaly; and it is therefore difficult to ensure whether it is a fraud, because faced with data from a constantly evolving transport network, it is expected to see the neural network discover very complex abnormal patterns, so that the qualification of the results of the neural network requires greater transparency.

[0095] To meet this need, in an optionally complementary manner, the inference phase P2 further comprises an explanation step 44, implemented by the explainability module 28, assigning weights to the columns selected during the preprocessing step, said weights being capable of explaining at least in part said score obtained.

[0096] As an example, to implement such an explanation step 44, the explainability module 28 uses the results, described by Sundararajan et al. in the article entitled “Axiomatic Attributions for Deep Networks” from 2017, and introducing the integrated gradients; to assign weights to the columns of the final anomaly score, a column being for this purpose encoded on several “sub-columns”, the weight being able to be calculated using an integral along the path of the neural network model.

[0097] Via this method, the column corresponding to the type of transaction has, for example, a positive weight of 0.091215, the column corresponding to the type of ticket (i.e. ticketing medium, such as in Paris, the monthly Navigo® card, or the Navigo® liberté + card, the Navigo® easy pass, etc.) has a negative weight of - 0.14268, and the column corresponding to the amount of the transaction has a positive weight of 1.788538, the weights assigned to each column being relative. According to this example, in view of the aforementioned weights, the amount of the transactions studied increases the value of the loss function and therefore contributes positively to the anomaly score, so that the operator can explore this avenue by first studying the transactions whose amounts are abnormal.

[0098] According to another example, an anomaly score equal to one hundred and fifteen is obtained by considering nine columns selected as input to the neural network with twenty rows corresponding to the latest transactions, including one column corresponding to inputs / outputs, an input being represented by the number 1 and an output represented by the number 2. The highest weight of contribution to the score, namely 64.9%, is precisely that associated with this input / output column, in particular because three successive transactions from the same user (or associated with a single identifier of a public transport ticket or a means of payment by which this user travels) are represented by a series of three ones, which corresponds to three successive inputs whereas the inputs should alternate with the outputs.The operator, in view of this explanation, then checks the numbering of the associated transactions, and this check shows that the transaction numbers are consecutive and that no transaction is missing, so that the operator deduces that the anomaly associated with the score equal to one hundred and fifteen is not fraud but probably an anomaly linked to the network, and corresponds to outputs which are not correctly recorded as such, so that it is necessary to implement a maintenance operation.

[0099] More generally, a weight with a positive sign indicates that the contribution of the column considered makes the score tend towards larger values; while a weight with a negative sign makes the score tend towards smaller values. The magnitude of the contribution is correlated with the value of the weight (zero meaning a small contribution).

[0100] According to a step 46, implemented mentally by an operator of said electronic system 10 for detecting anomalies in public transport ticketing data, a decision is made to characterize the test tabular ticketing data as data carrying (i.e. representative) anomaly(ies) or as normal data.

[0101] [Fig.3] illustrates in detail steps 36 (like 40 in inference) of data preprocessing and selection of columns of predetermined data of interest within said tabular ticket data for training in learning (respectively for testing in inference).

[0102] More precisely, according to the embodiment of [Fig.3], the preprocessing 36, 40 and the selection of predetermined columns of data of interest firstly comprises a phase 48 of definition DEF making it possible to define the different variables to be used as well as the parameters chosen for the training of the neural network(s) used subsequently during deep learning 38.

[0103] This definition phase 48 includes in particular a selection sub-step 50, for each public transport user (i.e. traveler or by extension associated with a unique identifier of a public transport ticket or a means of payment by which this person travels), of a predetermined number L_T of last ticket transactions and the associated tabular ticket data. For example, with regard to the transport habits of users, the predetermined number L_T of last ticket transactions is set to the last twenty transactions of each public transport user (i.e. traveler).

[0104] In addition, this definition phase 48 comprises, within said tabular ticketing data associated with the predetermined number of last transactions, a sub-step 52 of selecting the columns, noted for example C_D_T, of data corresponding to the type of transaction. By “type of transaction”, we mean here the nature of each transaction, such as the travel type transaction, the reloading type, etc. In other words, sub-step 52 consists of favoring (i.e. selecting) the columns of the tabular ticketing data containing details on the transactions.

[0105] In addition, this definition phase 48 comprises, within said tabular ticketing data associated with the predetermined number of last transactions, a sub-step 54 of selection (i.e. addition to the data selected for deep learning) of the columns, noted for example A_V_Q, relating to the numerical value of the transactions of the user (i.e. of the traveler or by extension associated with a unique identifier of a public transport ticket or a means of payment by which this person travels) considered. By "numerical transaction value" is meant here a quantitative variable such as the quantity of local currency at reloading, the quantity of local currency paid at each transaction, this variable being relative, in particular negative in the case of payment or positive in the case of loading or reloading of the transport ticket of the user considered.

[0106] In addition, this definition phase 48 comprises, within said tabular ticketing data associated with the predetermined number of last transactions, a sub-step 54 of selection (i.e. addition to the data selected for deep learning) of the columns, noted for example C_D_V, relating to the transaction ticketing context. By "transaction ticketing context", we mean the columns which relate to the description of the journey associated with the transaction, such as the ticket transaction increments, the types of use such as station entrances / exits or in a space having a particular function from the point of view of ticketing or associated infrastructures (for example: a vehicle or a part of a vehicle, a particular zone of a transport or parking infrastructure).

[0107] As an optional addition, step 36 of preprocessing and selecting columns of predetermined data of interest further comprises a sub-step 58 of formatting (denoted FORMAT) said selected ticketing data (for example in Pandas format).

[0108] Indeed, each transaction table (i.e. tabular ticketing data) at training (i.e. learning) can be presented in several formats, including ASCII, machine-readable or not, etc.

[0109] Deep learning 38 according to the present invention requires a neural network input data format that is systematically machine-readable, and the sub-step 58 of formatting in the predetermined format associated with the neural network in question makes it possible to ensure such systematic reading.

[0110] As an optional addition, step 36 of preprocessing and selecting columns of predetermined data of interest further comprises a sub-step 60 of sorting T of the transactions in chronological order followed by a grouping of said transactions by user (or by extension associated with a unique identifier of a public transport ticket or a means of payment by which this person travels), each user being identified by a unique identifier, and originally available in the ticket transaction tables at the input of said preprocessing 36, such a unique identifier being indicated for example in a column for example entitled MediaSerial-NumberlD for the tabular ticket data of the ticketing system according to the Applicant Revenue Collection Systems

[0111] Furthermore, according to this optional addition, the sorting and grouping 60 are followed by a sub-step 62 of filtering F of the users in order to retain only the ticketing data associated with the users having a number of transactions greater than or equal to said predetermined number L_T of last ticketing transactions. In other words, such filtering amounts to retaining only the users (i.e. the travelers) who have more than L_T transactions, for example twenty transactions, the users associated with a lower number of transactions generally corresponding to non-local users (i.e. non-local travelers).

[0112] According to another optional addition, the step 36 of preprocessing and selecting columns of predetermined data of interest further comprises an additional phase 64 of data transformation(s) so that each data item is suitable for input into a neural network. Such an additional phase 64 of transformation(s) comprises a sub-step 66 of typing followed by a sub-step 68 of separating the selected tabular ticketing data into two types of variables comprising categorical variables suitable for qualitatively describing a state and / or a ticketing element and numerical variables suitable for quantitatively describing a state and / or a ticketing element.

[0113] The typing 66 of the variables of columns of tabular ticketing data makes it possible to ensure that these have a format as expected at the input of the subsequent neural network, then separated during step 68 according to the two aforementioned types, namely on the one hand the categorical variables corresponding to the columns containing few different values ​​and describing a state of the ticketing system, and the numerical variables which can take an a priori arbitrary value on the interval of possible values; a transaction which can be positive, or negative but a priori whole.

[0114] In other words, the pre-learning pre-processing module 14 and the pre-inference pre-processing module 23 configured to implement the pre-processing 36 in learning and 40 in inference respectively, are variable processors suitable for coding categorical variables, for example according to a coding known by the English term One-Hot-Encoding where a sequence of ABBCCC variables is for example encoded by means of the following table of binary values: AB c 1 0 0 0 1 0 0 1 0 0 0 1 0 0 1 0 0 1

[0115] Numerical variables are encoded using a Standards scaling tool where values ​​are normalized in mean and variance to the statistic of the entire numerical distribution.

[0116] The results provided by such variable processors are stored in the form of a dictionary which allows each variable to be transformed transparently and uniquely from the raw version D_T (tabular input data) to the encoded version D_O (optimized input data of neural network(s)) and vice versa.

[0117] Furthermore, as an optional addition, the coding proposed according to the present invention is capable of adding to the variables a double encoding, namely firstly of the position of each transaction in the sequence of the last L_T transactions, in particular such that L_T=20, and secondly an encoding of these positions (i.e. the positions of each transaction) by a position encoder in a lower-dimensional latent space to save data processing space.

[0118] In other words, at the end of the preprocessing 36, we obtain as input to the neural network a dictionary of tensors (i.e. digital tables) containing encoded values ​​linked to the raw values ​​of the source ticketing data D_T originally provided as input to the learning phase or the inference phase.

[0119] In other words, the pretreatment 36 or 40 implemented according to the present invention makes it possible to achieve the level of abstraction necessary at the input of the neural network(s) used subsequently in the learning phase as well as in the inference phase, the neural networks generally being optimized for numerical values ​​close to zero.

[0120] These data values ​​optimized by said preprocessing 36 or 40 are used by at least one neural network during the learning phase Pi in order to optimize its own behavior to create a model to be used subsequently on tabular data to be tested. In other words, such a lightweight model, once confronted with a set of transactions (i.e. test tabular ticketing data), is capable of providing a score S which corresponds to the level of anomaly of the test tabular ticketing data.

[0121] Those skilled in the art will understand that the invention is not limited to the embodiments described, nor to the particular examples of the description, the embodiments and variants mentioned above being suitable for being combined with each other to generate new embodiments of the invention.

[0122] Those skilled in the art will understand that the invention can be used to process data associated with a ticketing application for public transport as well as with ticketing applications that can be combined with public transport; it can for example be applied to a ticketing system that would combine data linked to public transport with data of the parking transaction type or linked to the use of means of transport that can be used in addition to public transport (for example: use of individual means of transport: self-service bicycles or scooters, etc.)

[0123] The present invention thus proposes a pre-processing specific to the tabular data format used in public transport ticketing systems making it possible to increase the data processing speed, and uses neural networks, in particular convolutional neural networks, with a contrastive loss function to analyze the transformations (i.e. views) of ticketing data and categorize abnormal data as such in an unsupervised manner, using a scale of values, the lowest being normal and the highest being abnormal, the trained neural network being able to provide a probability that the transaction immediately received is normal or not.

[0124] The present invention makes it possible, for example, to obtain, at the end of a training phase in fifty steps by considering nine columns of tabular ticketing data collected over a period of three months selected and preprocessed according to the present invention, a model in eighteen hours on a GPU (Graphics Processing Unit), such as the NVIDIA® Tesla P100 12 Gb GPU, knowing that in the training phase the objective is to obtain a high-performance model without time constraints, the training being "off-line". On the other hand, in inference (i.e. in operation), the present invention makes it possible to score at least one hundred transactions per second to adapt to a medium-sized transport network, and up to four hundred transactions per second, considering that one hundred milliseconds are necessary to load the model resulting from the training phase and for the preprocessing 40, and that one hundred milliseconds are at least necessary to carry out the inference of a transaction, this inference processing being able to be parallelized for a number of transactions of up to 20,000 transactions.

[0125] The present invention thus proposes an application to user behavior and thus makes it possible to improve the responsiveness and efficiency of operators in the face of sophisticated fraud attempts, while dealing, in an evolving manner, with complex fraud mechanisms that are still unknown to operators.

Claims

Claims

1. Method (34) for detecting anomalies in public transport ticketing data, the method being suitable for being implemented by an electronic system for detecting anomalies in public transport ticketing data, the method comprising at least one learning phase (Pi) and at least one inference phase (P2), said at least one learning phase (Pi) comprising the following steps, applied to tabular training ticketing data: - preprocessing and selection (36) of predetermined columns of data of interest within said training tabular ticketing data; - deep learning (38) of at least one neural network using the training ticketing data optimized by said preprocessing and obtaining a model of said at least one neural network configured to detect an anomaly in ticketing data; said at least one inference phase (P2) comprising the following steps, applied to tabular test ticketing data; - applying (40) said preprocessing and said selection of predetermined columns of data of interest to said test tabular ticketing data; - obtaining (42) a score corresponding to a level of anomaly of said tabular test ticketing data by applying said model to said test ticketing data optimized by said preprocessing.

2. The method (34) of claim 1, wherein the preprocessing and selecting (36) predetermined columns of data of interest comprises: - the selection (50), for each public transport user, or by extension for each unique identifier of a public transport ticket or means of payment by which this person travels, of a predetermined number of last ticket transactions and the associated tabular ticket data; - within said tabular ticketing data associated with the predetermined number of last transactions, the selection (52, 54, 56) of the data columns corresponding to: - type of transaction; - the digital transaction value; - the transaction ticketing context.

3. The method (34) of claim 1 or 2, wherein preprocessing and selecting (36) predetermined columns of data of interest further comprises formatting (58) said selected ticketing data according to a predetermined format.

4. The method (34) of claim 2 or 3, wherein the preprocessing and selection (36) of predetermined columns of data of interest further comprises sorting (60) the transactions in chronological order followed by grouping said transactions by user, each user being identified by a unique identifier, then filtering the users to retain only ticketing data associated with users having a number of transactions greater than or equal to said predetermined number of last ticketing transactions.

5. Method (34) according to any one of the preceding claims, in which the preprocessing and selection (36) of predetermined columns of data of interest further comprise a typing (66) then a separation (68) of the selected tabular ticketing data into two types of variables comprising categorical variables capable of qualitatively describing a state and / or a ticketing element and numerical variables capable of quantitatively describing a state and / or a ticketing element.

6. Method (34) according to any one of the preceding claims, wherein said deep learning (38) uses a contrastive loss function and wherein obtaining (42) said score in the inference phase comprises normalization using the minimum and maximum values ​​of the contrastive loss function encountered in the training phase.

7. Method (34) according to any one of the preceding claims, wherein said deep learning (38) comprises: - determining, by means of said at least one neural network, a plurality of views of the ticketing data resulting from said preprocessing and said selection, - dimensional reduction of each of the views of said plurality of views providing views in a latent space of reduced dimension; - calculating predetermined geometric properties in said latent space of smaller dimension obtained by said dimensional reduction.

8. Method (34) according to any one of the preceding claims, in which said at least one inference phase further comprises an explanation step (44) assigning weights to the columns selected during the preprocessing step, said weights being capable of explaining at least in part said score obtained.

9. A computer program comprising software instructions which, when executed by a computer, implement a method for detecting anomalies in public transport ticketing data according to any one of the preceding claims.

10. Electronic system (10) for detecting anomalies in public transport ticketing data, the electronic system comprising a learning unit and an inference unit, the learning unit comprising, for application to training tabular ticketing data: - a pre-processing module (14) configured to pre-process and select predetermined columns of data of interest within said training tabular ticketing data; - a deep learning module (20) configured to implement deep learning of at least one neural network using the training ticketing data optimized by said pre-processing and to obtain a model (22) of said at least one neural network capable of detecting an anomaly in ticketing data;said inference unit comprising, for application to tabular test ticketing data: - an application module (23) configured to apply said preprocessing and said selection of predetermined columns of data of interest to said tabular test ticketing data; - a module (24) for obtaining a score (26) corresponding to a level of anomaly of said tabular test ticketing data, said obtaining module (24) being configured to obtain said score by applying said model (22) to said test ticketing data optimized by said preprocessing (230).;

Images