Anomaly Detection - Catch me if you can
Download as PPTX, PDF2 likes628 views
This document summarizes a presentation on detecting pickpocket suspects from large-scale transit records. The presentation showcases work that used mobility characteristics extracted from over 1.6 billion transit records to develop a two-step algorithm to distinguish regular passengers from pickpocket suspects with high accuracy. The algorithm first uses anomaly detection to filter out regular passengers, then classification to identify real suspects. Experiments on real-world data showed the two-step approach significantly improved precision over single-step methods. A prototype decision support system was also developed.
![References
[1] Bowen Du, Chuaren Liu, Wenjun Zhou, Zhenshan Hou, Hui Xion, “Catch Me If You
Can - Detecting Pickpocket Suspects from Large-Scale Transit Records”, KDD ‘16,
Aug 13- 17, 2016, San Francisco, USA
[2] Paul Bouman, Evelien Van der Hurk, Leo Kroon, Ting Li, Peter Vervest, “Detecting
activity patterns from smart card data”, In BNAIC, 2013
[3] Markus M. Breunig, Hans Peter Kriegel, Raymond T. Ng and Jorg Sander. LOF:
Identifying density-based local outliers. SIGMOD Rec., 29(2):93-104, May 2000](https://image.slidesharecdn.com/cs548f16showcaseanomalydetection-161119045932/85/Anomaly-Detection-Catch-me-if-you-can-2-320.jpg)
Anomaly Detection - Catch me if you can
- 1. CS548 Fall 2016 Anomaly Detection Showcase by Nichole Etienne, Rohitpal Singh, Suchithra Balakrishnan, Yousef Fadila Showcasing work by Bowen Du, Chuaren Liu, Wenjun Zhou, Zhenshan Hou, Hui Xiong on “ Catch Me If You Can - Detecting Pickpocket Suspects from Large-Scale Transit Records” CATCH ME IF YOU CAN
- 2. References [1] Bowen Du, Chuaren Liu, Wenjun Zhou, Zhenshan Hou, Hui Xion, “Catch Me If You Can - Detecting Pickpocket Suspects from Large-Scale Transit Records”, KDD ‘16, Aug 13- 17, 2016, San Francisco, USA [2] Paul Bouman, Evelien Van der Hurk, Leo Kroon, Ting Li, Peter Vervest, “Detecting activity patterns from smart card data”, In BNAIC, 2013 [3] Markus M. Breunig, Hans Peter Kriegel, Raymond T. Ng and Jorg Sander. LOF: Identifying density-based local outliers. SIGMOD Rec., 29(2):93-104, May 2000
- 3. Motivation - Passengers in the public transit systems have been the main target for pickpockets. In many cities, thefts happen frequently in transit systems - Passengers dissatisfaction and serious public safety concerns - 2014 in Beijing 350 pickpockets on subway system 490 pickpockets on buses
- 4. Abnormal travel Behaviours Travelling for an extended length of time Making unnecessary transfers Wandering on certain routes while making random stops Making random stops
- 5. Trajectories of Passengers Examples of outliers ● A -> C -> D -> B instead of A -> B (shortest time/distance) ● E -> B (fewer passengers take that path)
- 7. Steps in the Architecture 1. Partition the city area into regions with functional categories 2. Extraction of mobility characteristics of passengers 3. Individual mobility database to store the profile of each passenger 4. Passenger filtering and suspect detection 5. User feedback information, for future model training
- 8. Data Description - Transit Records Public transit system from buses and subways Rechargeable smart card – swipe when board or exit the vehicle Automated fare collection system (AFC) calculates the fare according to stations boarding and exiting AFC record contains, ● Smart card ID ● Route number ● Event (boarding or exiting) ● Station ● Time stamp
- 10. Points of Interest Public Transit Network Info
- 11. Incident Reports Confirmed Reports are publicly announced via SINA WEIBO, a primary social networking site in China Two types of Pickpocket reports, Official Announcements - announced by police Personal Complaints - posted by victims
- 14. Travel Time and Frequency • The daily travel time is defined as the total duration spent by each passenger in the public transit system • The daily riding frequency is defined as the number of transit records traveled by each passenger per day.
- 15. Travel Time and Frequency A thief has to spend quite long time in the crowded buses, subways, or near the transit stations to find potential victims and better their crime moments
- 16. Short Rides A short ride is a transit record tr with less than 3 stops. Regular passengers normally prefer fewer transfers in each trip. A thief (pickpocket) travels between bus/subway stations in random ways without specific destinations. 80% passengers finish their travels in 2 hours and within 2 transit records per day. In comparison, the identified thieves often spend more than 3 hours of daily travel time, and their daily riding frequency is also larger.
- 17. Functional Transaction A high-level view of the human mobility patterns can be summarized by transition among regions, where each region covers multiple stations Example ‘shopping trips’ like residence → shopping facilities → residence, or ‘sightseeing trips’ like residence → scenic spot → scenic spot → residence. Observation showed that pickpockets tend not to follow the typical patterns, and wander randomly among the functional regions.
- 18. Frequently Visited Regions Regular movements between a small set of locations that the passenger is familiar with Pickpockets often spend a significant portion of the time within few routes or regions if they intend for opportunities Once a thief has committed the crime or lost the target, he or she would likely come back to a familiar station for the next target Wandering behaviors were measured by counting the maximum number of times a route was taken, or the maximum number of visits made to a region
- 19. Deviation from the Social Norm The difference between the individual behaviors and the typical behaviors of the population, so we call them social features Example : Most of the trips will be finished within a specific amount of time given the trip origin and destination, pickpocket suspects may spend more time in the transit system during the trip
- 20. Historical Behavior The statistics (e.g., median and standard deviation) were computed as daily features were observed in the last seven days for each passenger, to quantify their historical behaviors The median is more robust in the presence of outliers, hence its use
- 21. The Algorithm :Two Steps Algo Goal: Distinguish pickpockets from the regular passengers with high accuracy and low false-positives.
- 22. Motivation for the two-step approach Classification Methods : Non-trivial Method ❖ Majority of the passengers are regular ones and only negligible are pickpockets in passenger population. ❖ Class imbalance so heuristic approach leads to over-sampling and undersampling Anomaly Detection Methods : High False positive Results ❖ Generally unsupervised, not good to scale instances well. ❖ High false positives
- 23. Two-step approach: ❖ The first step uses unsupervised anomaly detection techniques to filter out regular passengers from suspects. ❖ The second step uses supervised classification to identify real pickpockets from suspects. {(xj,yj) | j = 1,...,N} where xj ∈ Rq is the extracted features associated with the j-th passenger . yj ∈ {0,1} : 1 means pickpockets. Model : f : x → y = f(x)
- 24. Step I ➢ Filter out regular passengers from suspicious passengers. ➢ Used one class SVM (high accuracy, computing efficiency and high flexibility) ➢ The function φ(·) maps the original feature into a high- dimensional kernel space where the optimal decision boundary exists: ➢ Use Kernel : κ(x1, x2) = ⟨φ(x1), φ(x2)⟩
- 25. Step II ➢ To distinguish the real suspects and false positives ➢ C is a controlling parameter that reduces false positives ➢ Used Supervised Classification Method using confirmation on social media as target attribute ➢ Optimal Decision hyperplane : ➢ To compute optimal w and p in h(.) , Optimized
- 27. Baselines ( for comparison) & evaluation Classification methods (CM). The classification methods, including logistic regression (LR), decision trees (DT), and support vector machines (SVM) Anomaly detection (AD). Anomaly detection methods, such as one-class SVM (OCSVM) and local outlier factor (LOF) Two-step (TS) methods Evaluation metrics. - precision - recall - F-score computed with test set
- 28. Experiment Settings Datasets: real-world datasets containing over 1.6 billion transit records split the data into historical training set and evaluation test set Platform: Windows Server 2012 64-bit system (4-CPU, each with 2.6GHz with Quad-Core, and 128G main memory) All algorithms were implemented with Java
- 29. The Result ● precisions of all one-step methods are very low ● two-step combinations significantly improve the precisions. ● Two-step approach can e ectively reduce the false- positives
- 30. DEPLOYMENT AND INSIGHTS Goal: Develop a decision support system for the security personnel to easily spot pickpocket and hotspots
- 31. Screenshot of the prototype system Shows: Suspect List Statistics Passenger Flows Active Regions Selected Suspect
- 32. Related Work Passengers Activity Patterns assessing the performance of the transit network identifying and optimizing problematic or awed bus routes, making service adjustments that accommodate variations in ridership on different days Abnormal Traveling Behavior Detection discovers black-hole or volcano patterns in human mobility data in a city,which can quickly identify gathering events, such as football matches and concerts making service adjustments to smooth the traffic flow
- 33. Conclusion suspect detection and tracking system by mining large-scale transit records novel two-step framework to distinguish regular passengers from pickpocket suspects implement a prototype system for end users experimental results on real-world data showed the effectiveness of the approach
- 34. Any Questions?
Editor's Notes
- #6: Put figure 1 in a slide, and give example, travel who instead of going directly from A to B, choose to travel A → C → D → B is suspected.! But travel from E-B (outlier) is not suspected as this passenger is likely just a regular passenger who originates from a less crowded areat’s
- #10: Clarify the different between transit record and trip (Verbal, explain the figure, don’t add these text to slides) Part (a) is the actual trajectory on the city’s map; Part (b) splits the trajectory into three separate trips; Part (c) demonstrates the corresponding transit records in our data. Explain the 30 minutes empirical cutoff!
- #14: The features are are grouped into three categories: daily behaviors, social comparisons, and historical behaviors
- #16: A thief (pickpocket) tends to travel between bus/subway stations in random ways without specific destinations. Such abnormal behaviors lead to abnormal daily travel time and riding frequency. We can see that more than 80% passengers finish their travels in 2 hours and within 2 transit records per day. In comparison, the identified thieves often spend more than 3 hours of daily travel time, and their daily riding frequency is also larger.
- #17: Figure 7(a), the distribution approximates Gaussian with mean around 3. In Figure 7(b), for the passengers with at least 19 transit records, the distribution peak is shifted to the right. It shows that the frequency of short rides increases with increasing number of transit records.
- #18: such as the number of boarding stations and the number of boarding regions. Then, we count the transition frequency between any pair of function categories for the daily trip of each passenger.
- #19: , the wandering behaviors lead to concentration of the passenger’s boarding or exiting locations. We use the number of clusters as another feature, which measures the wandering concentration
- #20: given the same origin and destination, the trip variation of the majority of the population (i.e., regular passengers) is low Thus, for each pair of origin o and destination d, we find the travel time of all trips between this pair. We then convert the time gap significance of a given trip by the quantile of its travel time with respect to the population.
- #21: In our case, we only used data from the past seven days, and median can effectively avoid the impact of non-routine passenger behaviors. The standard deviation indicates the degree of variation of the daily behaviors of individual passengers. Regular passengers following routine trajectories normally generate statistics with less variations.