Finding A Taxi with Illegal Driver Substitution Activity via Behavior Modelings

Unreliable Driver Profile. Driver-supplied profiles to taxi companies poorly predict involvement in IDS activities. Analysis depicted in Fig.1 shows minimal correlation between the profiles of IDS-engaged taxis and ”taxi role models.” Notably, attributes such as education, age, and timing of vocational licensing offer no reliable indicators of IDS participation. Research suggests that the key determinants of crime-age profiles are more closely associated with personal circumstances, including living arrangements, family interactions with law enforcement, and truancy rates[5].

Misaligned Behaviors. The driving patterns among taxi drivers vary significantly. For instance, some drivers exhibit a preference for nocturnal shifts, whereas others opt for daytime hours. This diversity is underscored by a study analyzing taxi traces in Beijing, which found substantial variability in driver behavior [6].

Data Imbalance. The incidence of IDS within the taxi community, while serious, is infrequent. A focused study revealed that only a fraction (0.19

To address these challenges, we propose two efficient and effective driver behaviors from the traces of taxis and the records of taximeters. Our technique takes advantage of the following two critical observations:

• (I) Compared with the registered driver, the illegal one tends to have a different sleeping pattern. Especially for the one-shift taxis, a driver tends to have a consistent sleeping behavior since a person usually has a relatively fixed domicile in a city. Besides, the sleeping pattern (e.g., the duration time of sleeping) tends to be different for different drivers.

• (II) The operating schemes (e.g., patterns from the distributions of PUs or DOs) between taxi drivers reflect their different driving behaviors. Both empirical and social behavior studies (e.g., [7]) demonstrate that, over a sufficiently long period of time, a person’s behavior exhibits a surprisingly high level of consistency. Moreover, the spatio-temporal distribution of the PU points discovers the individual profit-hunting scheme, which typically reflects the behaviors of different drivers [4].

Utilizing insights from Observation (I), we model the Sleeping Time and Location (STL) of a taxi driver via Fisher Vector (FV) [8] from the following information: a) the GPS locations of a driver’s sleeping locations, b) the start working time and the sleeping time. Based on (II), we utilize Latent Dirichilet Allocation (LDA) [9] to learn the spatial-temporal PU behavior. Therefore, based on both (I) and (II), we propose two kinds of individual-wise driver behaviors.

The individual behaviors are the personal description of each driver. To efficiently discover the taxi with the IDS activity, the individual-wise driver behaviors should be further encoded into the discriminative features for all taxis. This paper proposes to combine the Self-Similarity (SS) approach and the pooling to discover the taxis with the IDS activity. To align these SS-based features over a long-time range, we propose Multiple Component-Multiple Instance Learning to handle the possibility of deficiency of the behavior features and align the behavior features.

This paper makes several significant contributions to the field, as outlined below:

• 1. Introduction to the IDS Problem. This study is pioneering in exploring the detection of one-shift taxis engaged in IDS activities, utilizing GPS data and taximeter records. We approach this challenge as a supervised learning problem, achieving effective solutions for identifying taxis with the IDS activities.

• 2. Modeling Driver Behavior. We have developed the STL and PU behaviors, offering the insights into drivers’ rest patterns and profitability strategies, respectively. These are instrumental in characterizing the nuanced activities of each driver.

• 3. Multi-Scale Pooling (MSP) on Self-Similarity (SS). Acknowledging the variable timing of the IDS activities among taxis, we introduce SS to pinpoint the IDS occurrences and MSP to standardize these into a uniform feature vector dimension. The synergy of SS and MSP effectively translates diverse individual driver behaviors into a common feature space applicable across all taxis.

• 4. Multiple Component-Multiple Instance Learning (MC-MIL). MC-MIL addresses the challenges of behavior feature deficiencies and aligns IDS-related features. Additionally, we evaluate the performance of deep learning based method (i.e., Long short-term memory (LSTM) and Transformer) on the imbalanced and small-scale dataset. Our findings reveal MC-MIL as the superior method among these classifiers for detecting IDS activities.

As depicted in Fig.2, leveraging GPS and PU/DO data allows a data center to identify and notify law enforcers of taxis engaging in IDS activities directly on their mobile devices. By setting a specific inspection area on their devices, law enforcers can strategically locate and manually verify suspect taxis through the electronic map, bypassing the need for random checks. Thus, the efficacy of the system in Fig.2 hinges on its ability to accurately and swiftly pinpoint taxis with IDS activities.

Pattern Analysis from GPS Traces: A variety of research issues have been addressed by leveraging large-scale GPS traces, e.g., urban human mobility understanding [10] [11] [3], urban planning [12] [13], traffic prediction [14], anomalous trajectory detection [15], and urban region function identification [16]. For intelligent traffic community, previous studies have addressed numerous research issues e.g.,  [17] identifies unusual driving patterns from taxi GPS traces, with applications in fraud detection and monitoring urban road networks. In [18], they propose a space-time visualization method to analyze Beijing taxi GPS data by daily operation time, driver residence, and operating patterns for understanding Beijing Taxi Operations. [19] proposes a real-time method to detect anomalous trajectories as well as identify which parts of the trajectory are responsible for its anomaly’s behaviour.

Pattern Analysis from Records of Taximeters: The records of taximeters have been widely used to improve taxi driver’s performance, i.e., identifying popular pickup areas [20] [21] [22] [23] and optimizing passenger-hunting routes [6] [24] [20]. [25] utilizes a heuristic algorithm to create maximum fraudulent trajectories from the dataset. [26] examines the choices made by New York taxi drivers at JFK airport, determining pick-ups versus cruising after trips. In [27] the author makes a critical observation that fraudulent taxis manipulate taximeters, inflating service distances and reported speeds. In [28]

Summarizing: To our knowledge, this paper first leverages GPS traces and records of taximeters to identify IDS activities. Therefore, we briefly review the related works about exploiting GPS traces and logs of taximeters for the other tasks.

Consider a taxi $c$ operating within an urban environment. Let $\phi_{T}$ and $\phi_{R}$ represent the feature extraction functions from the GPS trace dataset and taximeter record dataset, respectively. The process of identifying taxis engaged in the IDS activities is formalized as follows:

Equation 1 frames the identification of IDS activities as a supervised learning challenge. This study distinguishes between positive and negative samples for classification, leveraging Beijing’s ”taxi role model” initiative to define role model taxis as negative samples $\mathbf{\Omega}-$, and taxis exhibiting IDS activities as positive samples $\mathbf{\Omega}+$.

IDS Discovery Framework: The proposed methodology encompasses three main stages:

• Step 1. Heterogeneous Driver Behavior Modeling: The STL (Sleeping Time and Location) and PU (Pick-Up) behaviors are computed to encapsulate individual driver behaviors.

• Step 2. Multi-Scale Pooling from Self-Similarity: Individual behaviors are translated into a unified feature space via Self-Similarity (SS) and Multi-Scale Pooling (MSP).

• Step 3. Supervised Learning for IDS Activity Identification: Leveraging the insights from the initial stages, the IDS detection problem is approached through supervised classification techniques.

STL can be straightforwardly derived for each taxi based on Definition 3. Fig 3 depicts the sleep locations of two one-shift taxis in Beijing, highlighting the distinct, concentrated sleeping patterns that reflect personal domiciles. Conversely, the sleeping behaviors of two-shift taxi drivers are more varied, including breaks at random locations and rest within the taxi, making STL modeling less applicable.

Given a taxi’s start time $t_{s}$, sleeping coordinates $(p_{lon},p_{lat})$, and sleeping duration $t_{d}$, STL is vectorized as $\mathbf{x}^{STL}=[t_{s},p_{lon},p_{lat},t_{d}]^{\top}$. For efficient and accurate classification, the Fisher Vector (FV) method is employed to transform STLs into discriminative features, a technique proven effective in image recognition tasks [29].

Encoding STL by Fisher Vector. In a nutshell, FV assumes that the gradient of the log-likelihood describes the contribution of the parameters $\lambda$ with respect to the generation of data $X$ in a parameter space. Concretely, FV firstly fits a Gaussian Mixture Model (GMM). The resulting FV descriptor integrates the deviations of the parameters from GMM, providing a robust feature [30]. FV’s efficacy spans a range of imaging applications, including image classification, face recognition, object detection, and texture analysis [31][32][33] [34].

Let $X=\{\mathbf{x}^{STL}_{i},i=1\ldots N\}$ be a set of STLs from $N$ taxis. FV $G^{X}_{\lambda}$ is modeled as the gradients of a probability density function $u_{\lambda}$ as follows:

where $T$ is the number of STL data in a time bucket since some one-shift taxis occasionally have no sleep time. In practice, $T$ is almost constant in our experiment.

In practice, following [8], we choose GMM to be $u_{\lambda}$ which approximates with arbitrary precision to any continuous distributions: $u_{\lambda}(\mathbf{x})=\sum_{k=1}^{K}w_{k}p_{k}(\mathbf{x})$ with $w_{k}\geq 0,\sum_{k=1}^{K}w_{k}=1$, in which the parameters $\lambda=\{\bm{\mu}_{k},\bm{\Sigma}_{k}\},k=1,\ldots,K$, where $\bm{\mu}_{k}$ and $\bm{\Sigma}_{k}$ are respectively the mixture weight, the mean vector and the covariance matrix of the $k$-th Gaussian component $p_{k}(\mathbf{x})$:

We assume that the covariance matrix $\bm{\Sigma}_{k}$ is diagonal matrix since the computational cost of the diagonal covariances is much lower than the cost involved by full covariances. Hereafter, we use the notation $\sigma_{k}^{d}$ represent the $d$-th elements on the diagonal in the $k$-th covariance matrix. For the weight parameters $w_{k}$, we adopt the soft-max formalism in [8] and define $w_{k}=\frac{\exp(\alpha_{k})}{\sum_{i=1}^{K}\exp(\alpha_{k})}$, where the re-parametrization using the $\alpha_{k}$ avoids enforcing explicitly the constraints in GMM. Consequently, the gradient of log-likelihood $\mathcal{L}(X|\lambda)$ with respect to the parameters $\mu_{k}^{d}$ ($\bm{\mu}_{k}=[\mu_{k}^{1},\ldots,\mu^{d}_{k},\ldots,\mu_{k}^{D}]^{\top}$) and $\sigma_{k}^{d}$ ($\bm{\Sigma}_{k}=diag([\sigma^{1}_{k},\ldots,\sigma_{k}^{d},\ldots,\sigma_{k}^{D}]^{T})$) is respectively as follows:

where $\gamma_{i}(k)$ is denoted as the probability of a STL $\mathbf{x}_{i}^{STL}$ point to be generated from the $k$-th Gaussian component,

Consequently, following the principle in (2), the FV of a $\mathbf{x}$ is the concatenation of the partial derivatives with respect to the mean $\mu_{k}^{d}$ and the standard deviation $\sigma_{k}^{d}$ as follows:

where $D$ is the dimension of the STL vectors. By (7), a STL point $\mathbf{x}^{STL}$ is encoded into a FV vector with $2DK$ dimension. Following the $\ell_{2}$-normalization [29], we finally use the normalized FV.

Developing the Latent Pickup (PU) Behavior Model: It’s well-documented that individuals exhibit consistent spatio-temporal patterns, a concept that extends to the predictable behaviors of taxi drivers regarding passenger pickups [11]. The underlying principle is that drivers quest for profitability leads to the emergence of distinct pickup patterns. Notably, drivers with the IDS activities tend to operate within specific zones known for high ride service demand. This behavior contrasts with the registered drivers, whose pickup locations are generally more dispersed and appear random [7] [35].

We represent a pickup event with $\mathbf{x}^{PU}=[t_{pu},p_{lon},p_{lat}]^{\top}$, capturing the essential details of when and where passengers are picked up. This study employs LDA to model the latent structures within the pickup data, drawing parallels between the distribution of words in documents and pickup points in urban spaces:

• •

  The aggregation of pickup points resembles the collection of words within a document.

• •

  The compilation of pickups over a specific period forms our corpus, analogous to the textual content of a document.

• •

  The entirety of pickups by a single taxi is viewed as an individual document in this analogy.

This framework allows us to employ latent topics to elucidate the patterns in drivers pickup behaviors, with the specific analogy detailed in Table II. LDA leverages a dirichlet prior to model the distribution of topics within documents, illustrating its versatility in representing texts. Documents can thus embody a mix of multiple topics, enhancing the model’s descriptive power [36] [37].

Consider $\mathcal{D}$, a collection of $M$ such ”documents” $\mathcal{D}={\mathbf{w}_{1},\mathbf{w}_{2},\ldots,\mathbf{w}_{M}}$, each ”document” $\mathbf{w}$ being a series of ”words” $\mathbf{w}={w_{1},w_{2},\ldots,w_{N}}$, or in another notation, $w_{1:N}$. These ”documents” are presumed to arise from a distribution $\bm{\theta}=[\theta_{1},\ldots,\theta_{T}]^{\top}$ over a set of topics.

To delineate the ”words” representing PU behavior, this work utilizes the $k$-means algorithm to cluster the pickup points $\mathbf{x}^{PU}_{i}$ from all taxis into a designated number of clusters. Each cluster represents a ”word” $w_{n}$, which, when aggregated daily, forms a ”document” that characterizes the pickup behavior of a driver.

The joint distribution of a topic mixture $\bm{\theta}$, a set of topics $\mathbf{z}$, and a set of $N$ words $\mathbf{w}$ is given as follows:

where $p(\bm{\theta}|\alpha)$ follows a Dirichlet distribution with the simplex parameter $\alpha$ (i.e., $\alpha$ makes $\theta_{i}\geq 0,\sum_{i=1}^{T}\theta_{i}=1$), $p(z_{n}|\bm{\theta})$ is simply $\theta_{i}$ for the unique $i$ such that $z_{n}^{i}=1$, and $p(w_{n}|z_{n},\beta)$ is a multinomial probability conditioned on the topic $z_{n}$.

We aim to determine the latent topics based on the PU points in a time bucket. This is equivalent to computing the posterior distribution of the hidden variables given a document:

which is approximately computed based on the Monte Carlo Markov Chain (MCMC) technique [9] where the idea is to generate posterior samples from its conditional distribution. Therefore, the latent topics of the PU behavior $\mathbf{f}^{PU}$ for a taxi in a day is defined as follows:

Dealing with location inaccuracy: In many cases, the location information may need to be more accurate due to the blocked signal transmission caused by high buildings or overpasses. Therefore, a smooth mechanism is preferred over the degree of PU word membership should be performed during computing the words $\mathbf{w}$ for a taxi.

A simple and yet reasonable way is to use the Nadaraya-Watson kernel regression on the Gaussian kernel to approximate the probabilistic word membership [38], which we denote as $o$. The probabilistic word of a PU point is as follows:

where $d$ is the distance between a PU point and a center of a PU word, and $\delta$ denotes the uncertain range of a sensor.

It is posited that individual taxi drivers exhibit distinct, yet relatively stable, behavioral patterns. Anomalies in these patterns, especially sharp deviations observed over short intervals (e.g., daily), may signal the IDS activities. Identifying such anomalies necessitates addressing two primary challenges:

• •

  Detecting Significant Behavioral Changes: Variability in a driver’s behavior can naturally occur due to unforeseen events. It is crucial, therefore, to establish a baseline against which significant deviations indicative of potential IDS activities can be measured.

• •

  Consolidating IDS Indicators Across Taxis: IDS activities, when present in multiple taxis, may not manifest simultaneously. As depicted in Fig. 4(a), aligning these activities within a unified feature vector framework is essential.

For the first problem, Self-Similarity (SS) approach is proposed to detect the occurrence of the IDS activity. Concretely, given a sequential state of behaviors $\mathbf{f}^{c}_{b_{i}}$ (which are either the STL behavior $\mathbf{f}^{STL}_{c_{b_{i}}}$ or the PU one $\mathbf{f}^{PU}_{c_{b_{i}}}$) of a taxi $c$ at the $i$-th day in a time bucket $b$, SS computes the difference of the behaviors between two consecutive days as follows:

There are two important parameters in (12): the function $Similarity(\cdot,\cdot)$ and the time bucket $b$. The function $Similarity(\cdot,\cdot)$ can be any function that measures the similarity between two features. For instance, mutual information is used for two distributions, and cosine distance is for two normalized vectors. The time bucket $b$ in (12) corresponds to the time window in which the IDS activity maybe occur. Ideally, if the length of the time bucket is larger, the IDS activity is much easier to cover. This paper chooses cosine distance as the similarity function, and the bucket length is 30 days.

To the second problem, taking the “Taxi 1” in Fig. 4(a) as an example, if the change of the driver behaviors is detected by the SS approach, the maximal change could be used to indicate the occurrence of the IDS activity. Therefore, given a time bucket $b$, the occurrences of the IDS activity are discovered by max pooling as follows:

Meanwhile, the driver behaviors, especially the PU behaviors, are only sometimes consistent due to some unexpected events. For instance, picking up a passenger via the car-hailing service or changing a domicile because the rent is due. To describe this observation, the minimal change is extracted to calibrate the maximal change as follows:

The combination of (13) and (14) jointly describes the intense change of the behaviors.

As illustrated in Fig. 4(a), although the changes of the driver behaviors occur at different days, both max pooling (13) and min pooling (14) encode the IDS activity into the same bin of the feature vector. Ideally, by combining the SS approach and the pooling method, the individual-wise behaviors are aligned into a universal feature space for all taxies.

When the length of the time bucket is very large, some unexpected events tend to occur. Both max pooling and min pooling would capture the unexpected events rather than the IDS activity. Therefore, Multiple time-Scale Pooling (MSP) is further proposed to increase the discriminative power of the aligned features. Concretely, Fig. 4(b) shows that a time bucket is divided into multiple smaller ones by several scales, and then the aligned feature vectors from different scales are concatenated into a MSP-SS vector as follows:

where $B$ is the number of the divided time buckets.

Intuitively, when an unexpected event occurs at the $6$-th time bucket, the top scale, i.e., scale 1 in Fig. 4(b), may consider the unexpected event as the IDS activity. Because the pooling operations in (13) and (14) discard the structure information. In a contrast, if we introduce more scales (e.g., the scale 2 and the scale 3 in Fig. 4(b)), the other time buckets (e.g., the $2$-th) still capture the occurrence of the IDS activity. As a result, MSP increases the the discriminative power of the feature.

Two problems are raised to classify the taxis with IDS behavior as follows:

• •

  How to align and classify the behavior in the long-range time bucket is key to find the taxis with IDS, although MSP could align the behavior in a short-range time bucket(e.g., a week).

• •

  If one of the STL-based feature, the PU-based one and the combination of the two behaviors is deficient, how to identify the taxi with IDS activity?

This paper proposes a hybrid approach to align and leverage features in a long-range time bucket by combining Multiple Instance Learning (MIL) and Multiple Component Learning (MCL) [39].

Let the behaviors of a taxi in a long-range time bucket $T$ be represented as a super feature set $\mathcal{X}_{i}=\left\{\mathcal{S}_{i}^{k}\right\}_{k=1}^{K}$ , where $k$ is the number of the behaviors. In this paper, the feature set $\mathcal{S}_{i}^{1}=\{\mathbf{s}^{STL}_{it}\}^{T_{STL}}_{t=1}$ and the set $\mathcal{S}_{i}^{2}=\{\mathbf{s}_{it}^{PU}\}^{T_{PU}}_{t=1}$, in which $\mathbf{s}^{STL}_{it}$ and $\mathbf{s}^{PU}_{it}$ is the $t$-th time bucket of time range $T_{STL}$ and $T_{PU}$, respectively. The number of time bucket $T_{STL}$ and $T_{PU}$ respectively are not necessary equal to $T$, i.e., $T_{STL}\leq T$, and $T_{PU}\leq T$. The proposed Multiple Component-Multiple Instance Learning (MC-MIL) is as follows:

where $k$ is the number of classifier, $1\leq k\leq K$, and function $P^{k}(\cdot)$ outputs the probability of a taxi with the IDS activity. In our work, $K=2$ represents both the classifiers built from the STL feature and the PU one, respectively. (16) is the result-fused approach which combines the results of $K$ classifiers $P^{k}(\cdot)$ into $P_{i}$. The advantage of (16) is that if any one of the behavior feature is missed, (16) still robust predicts a result.

The $P^{k}(\cdot)$ is MIL function to align the IDS behavior as follows:

where the $t$ is the index of a time bucket to compute MSP (15). (17) utilizes the noise-or model to align the IDS behavior among a long-range bucket $T_{STL}$ and $T_{PU}$, respectively. The probability $P^{k}_{t}(\cdot)$ is logistic regression as follows:

where $H^{k}_{i}(\mathbf{s}^{k}_{it})$ is the additive function as follows:

where $\mathbf{s}^{k}_{it}$ is the $k$ SS-based behavior feature in the $t$ time bucket for the $i$-th taxi, $h^{k}_{j}(\mathbf{s}^{k}_{it})$ is a weak classifier, $h^{k}_{j}(\mathbf{s}^{k}_{it})\in\{-1,+1\}$, and $\alpha^{k}_{j}$ is the non-negative coefficient, $0\leq\alpha^{k}_{j}$.

Under this model the likelihood assigned to a set of training bags $\mathcal{X}_{i}$ and its label $y_{i},y_{i}\in\{0,1\}$ is as follows:

Following AnyBoost approach [40], the weight on each instance $\mathbf{s}^{k}_{it}$ is given as the derivative of the cost function with respect to a change in the score of the example. The derivative of the log likelihood ²²2For clarity, we abbreviate the functions $H^{k}(\mathbf{s}^{k}_{i})$ as $H^{k}$, $P^{k}_{t}(\mathcal{S}^{k}_{i})$ as $P^{k}_{t}$, and $P_{k}(\mathcal{X}_{i})$ as $P_{k}$. is:

where the derivations are computed as follows:

Therefore, (21) is simplified as follows:

The parameter $\alpha^{k}_{j}$ is determined using a line search to maximize $\log L(H^{k}+\alpha^{k}_{j})$. During the implementation, Classification And Regression Trees (CARTs) [41] are used to built the weak classifier $h^{k}_{j}(\mathbf{s}^{k}_{it})$.

Real Data. We release dataset data set for our experiments publicly and any one could access it here.³³3https://github.com/pangjunbiao/IDS-BJ. The data set, referred as “IDS@BJ”, includes the initial information for each taxi individually such as (plate Id, origin time, longitude, latitude, Destination time, destination longitude, destination latitude). The time of identifying one-shift taxis with the IDS activity ranges from Jan. 2015 to Seq. 2016. Because the taxis with IDS activity are sparse, manually determining whether a randomly picked taxi has IDS activity depends on a law enforcer’s personal experience.

Evaluation metrics: In our experiments, we use two kinds of evaluation criteria to evaluate the effectiveness as follows:

• 1.

  Precision and Recall Curve (PRC): PRC plots Precision versus Recall of a classifier at different decision thresholds. The Averaged Precision (AP) of the PRC is used to numerically indicate the performance of a detection system. The higher AP of PRC is, the better a classifier is [42].

• 2.

  Receiver Operating Characteristic (ROC) curve: ROC curve plots True Positive Rate (TPR) versus False Positive Rate (FPR) of a classifier at different decision thresholds. Area Under the Curve (AUC) is further used to evaluate the performance of a classifier. The higher AUC is, the better a classifier is.

Due to the imbalance of the test set, AP is more reasonable than AUC to evaluate the performance of classifiers in this paper.

Experiment Settings. Both the STL behavior and the PU behavior are extracted from each day. Three scales of MSP are built as in Fig. 4(b), i.e., $1\times 16$ days, $2\times 8$ days, and $4\times 4$ days. The SS function in (12) is defined as cosine distance between two features. To better align the IDS behavior, the long rang time bucket $T=30$, a $16$ days sliding widow with step 4 is used to split the $T=30$ into 26 overlapped SS features. That is, $T_{STL}$ and $T_{PU}$ are equal to 26, respectively.

The IDS discovering system is implemented under Python 2.7 on a 3.30 GHz machine with 8G RAM.

Baseline Classifiers. We evaluate our behavior-based features on the following baseline classifiers:

• 1.

  Long Short-Term Memory (LSTM) [43]: LSTM is a type of Recurrent Neural Network (RNN) capable of learning long-term dependencies for sequential data. The LSTM model was configured with the following hyper-parameters: learning rate is $1\times 10^{-3}$, weight decay for regularization is $1\times 10^{-5}$, batch size is 64, and the Adam optimizer with a reduce learning rate on plateau scheduler reduces the learning rate by a factor of $0.5$ with a patience of 5 epochs.

• 2.

  Transformer [44]: Transformer utilizes self-attention mechanisms to obtain a highly effectiveness for classification tasks which involve complex relationships within the data [45]. We utilized Adam optimizer with a weight decay of $1\times 10^{-5}$ for regularization. The learning rate scheduler was reduce learning rate on plateau, with a reduction factor of 0.5 and a patience of 5. The batch size is 32.

• 3.

  Logistic Regression (LR): LR is a widely used statistical model that uses a logistic function to model a binary dependent variable.

• 4.

  Random Forest (RF) [46]: RF, an ensemble of CARTs [41], is trained with the bagging method. Compared with CARTs, RF tends to prevent the over-fitting by averaging a set of “shallow” CARTs. There are four important hyper-parameters, i.e., maximum tree depth, maximum number of leaf nodes, minimum number of points per leaf node, and number of trees, in RF. These hyper-parameters are chosen by random searching method [47]⁴⁴4During the random searching, maximum tree depth ranges from 2 to 4; maximum number of leaf nodes ranges from 2 to 8; minimum number of points per leaf node ranges from 1 to 3; number of trees ranges from 50 to 100.. Meanwhile, the number of features to consider per split in a decision tree is the square root of the total number of features [48].

• 5.

  Gradient Boosting Trees (GBT) [49]: GBT combines a set of weak CARTs into a single strong learner in an iterative fashion. Compared with RF and CARTs, GBT allows arbitrary differentiable loss functions to be used. In this paper, the exponential loss $e^{-yf(\mathbf{s})}$ is used due to the excellent binary classification ability. Specially, the tree-specific parameters are determined by the random searching [47], while the boosting parameters are selected by 5-fold cross validation⁵⁵5During the cross validation, the learning rate ranges from 0.1 to 0.5; and the number of sequential trees ranges from 50 to 100..

• 6.

  Multiple Kernel Learning (MKL) [50]: MKL linearly combines multiple kernels into Support Vector Machines (SVMs), efficiently fusing multiple types of features into a kernel; besides, MKL can automatically determine which kernels are useful. In this paper, MKL uses 5 different types of kernels, i.e., polynomial kernel, Gaussian kernel, linear kernel, intersection kernel, and Chi-squared kernel. There are 10 ($5\times 2$) kernel matrices which are used in MKL.

We aim to demonstrate that the proposed features are discriminative in identifying the nuanced IDS activities across a range of classifiers from the classical methods to the advanced neural network architectures.

In this subsection, we verify the effectiveness of the proposed MC-MIL by comparing with the following baseline methods:

• 1.

  Multiple Instance Boosting (MIL) [52]: MIL aligns the features by iteratively grouping a set of CARTs into a single strong learner. In this paper, the noise-or model in [52] is used. There are two categories of the hyper-parameters in MIL, i.e., the tree-specific parameters and the boosting parameters. In our setting, each instance is the concatenation of the SS-based STL (7) and the SS-based PU (10) in a $16$ days. That is, a bag ($30$ days) has 7 instances.

• 2.

  Multiple Classifier Boosting (MCB) [39]: MCB aligns the samples into clusters in an iterative fashion. There are two categories of the hyper-parameters in MCL, the tree-specific parameters and the boosting parameters. These parameters are the same as in MIL.

Once the models for the STL behavior and the PU behavior are learned, the time complexity of encoding features per taxi would be linear with respect to the scales of samples. Table IX shows that the STL-based SS feature and the PU-based SS feature consume 125.2 and 278.2 milliseconds per taxi, respectively. It means that the suspected taxis with IDS activity can be discovered within 7.5 hours on a single PC once the IDS model has been built. Note that the data set here was collected from all taxis in Beijing within 16 days; that is, the suspected taxis would be updated every 16 days.

Although the data sizes for discovering taxis with IDS may be prohibitively large for a single PC or a server, the proposed method can still be efficiently handled by incremental or online methods by the following methods:

• •

  The GMM in FV can be efficiently solved by the online GMM [53]. Once the GMM is learned, FV can be quickly encoded by (4) and (5).

• •

  The online LDA [54] scales up the number of samples for all taxis.

Therefore, if these engineering details are properly implemented, the system would efficiently compute the suspected taxis with the IDS activity.