FR3090960A1 - AUTOMATIC LEARNING FOR FRAUD DETECTION IN A COMPUTER RESERVATION SYSTEM - Google Patents

Abstract

The detection of fraudulent activity associated with a reservation record in a reservation computer system includes the determination of characteristic values indicating a mode of modifications carried out on a reservation record over time from historical records. A first machine learning model is evaluated using the characteristic values to obtain a first fraud classification value based on a supervised learning algorithm to identify one or more types of fraudulent activities identified previously. A second machine learning model is evaluated using the characteristic values to obtain a second fraud classification value based on an unsupervised learning algorithm in order to identify abnormal modes of characteristic values corresponding to types of fraudulent activity not previously identified. An indication of fraudulent activity associated with the reservation record is generated comprising at least one of the first fraud classification value and the second fraud classification value. Figure for abstract: Fig. 5

Description

Description

Title of the invention: AUTOMATIC LEARNING FOR FRAUD DETECTION IN A COMPUTER RESERVATION SYSTEM

The present invention relates generally to the operation of computer reservation systems, such as those used to manage reservations in the travel industry. In particular, embodiments of the invention are directed to the use of machine learning technologies for the automated detection of fraudulent activity in computer reservation systems.

A computer reservation system (CRS) typically includes one or more networked computers or computer systems configured to store and retrieve information. In the travel industry, a CRS can be configured to facilitate transactions related to air or train travel, hotels, car rentals or other services. A CRS that is capable of booking and selling tickets for services offered by multiple travel service providers is commonly known in the industry as the Global Distribution System (GDS). Typically, a GDS includes, or access to, multiple systems and associated databases that store information related to the above transactions. These databases may include, for example, a passenger name registration (PNR) database for storing travel route data, an electronic ticketing system (ETS) database for storing data for tickets, a departure control system (DCS) database for storing traveler registration and service usage data and an inventory system database for storing availability data . These systems may include a processing system and a database or device to sell and manage the use of travel-related services.

[0003] A GDS is therefore a complex system which must also provide the flexibility required by travel agents and passengers in order to create and manage travel-related reservations. A travel itinerary can be subject to numerous modifications over an extended period between its initial creation and the time at which the journey is currently made. These changes can be initiated by the passenger or the agent (e.g. plan changes, addition and / or cancellation of trip segments, upgrades or downgrades to travel classes, substitution fare class to accomplish various trade-offs between cost and flexibility, and so on) or may be the result of events requiring program changes (eg, re-optimization of the airline network, routes and changes of aircraft, flight delays or cancellation and so on). To satisfy this flexibility, the scope of the modifications made to the PNRs supported by a GDS can be extensive.

The combination of complexity and flexibility can create opportunities for fraudulent activity. For example, the user of a GDS (i.e. an agent, or a passenger) may seek to circumvent the rules or restrictions applicable to a reduced fare class by making an initial reservation and subsequently by performing a number of modifications to the resulting PNR (i.e. the route) which are individually considered valid, but which collectively circumvent the rules, checks and / or integrity checks of the recipes resulting in fraud. More generally, fraud in PNRs can be defined as actions associated with or producing results such as the absence of intention to take a flight, the gain of undue advantages by circumventing the rules and / or failure to earn compared to expected revenue.

[0005] Different sequences of specific actions carried out during reservations can lead to different fraudulent modes. The variability of the modes leading to fraud is very high. This includes modes resulting in different types of fraud as well as other modes whose common result is fraudulent.

A conventional approach to counter such activity is to apply rules or corrections to identify and block patterns of fraudulent behavior. However, given the high volatility of the actions leading to these behaviors or to various frauds, it is not always easy to define effective and specific rules. Furthermore, the set of rules can become so complex that eventually it is difficult to apply.

[0007] Consequently, there is a need for automated systems and methods providing flexibility in the detection and prevention of modes of fraudulent behavior in computer reservation systems which do not require the creation and maintenance of sets of complex rules. In addition, it would be desirable to provide automated systems and methods capable not only of detecting and preventing patterns of fraudulent behavior which are the same or which are similar to known patterns, but also capable of reporting patterns of behavior previously gone unnoticed as potentially fraudulent.

Embodiments of the invention implement an approach for detecting fraud in a CRS based on machine learning (ML) techniques. Behaviors known to be fraudulent (i.e., similar or similar fraudulent patterns that have been identified previously) can be detected using supervised machine learning models that can be trained offline using data sets labeled including known modes of fraudulent activity. Potentially fraudulent and previously undetected modes can be detected using unsupervised machine learning models that can be configured offline to identify atypical or abnormal behavior patterns. Input characteristics for machine learning models can be derived from historical records of creation and changes in reservations over their entire life cycle. The application of machine learning to fraud detection in a CRS responds to the desire to find a solution that is both automated and flexible.

More particularly, in one aspect, the invention provides a computer-implemented method for detecting fraudulent activity associated with a reservation record in a computer reservation system, the method comprising:

retrieving from a data store a series of historical records made on a reservation record during a period;

processing historical records to determine a plurality of characteristic values including data characterizing a mode for the changes made to the reservation record during the period;

evaluating a first machine learning model using the characteristic values to obtain a first fraud classification value, wherein the first machine learning model is based on a supervised learning algorithm and is trained to identify one or more types of fraudulent activity identified previously;

evaluating a second machine learning model using the characteristic values to obtain a second fraud classification value, in which the second machine learning model is based on an unsupervised learning algorithm and is configured to identify abnormal patterns of characteristic values corresponding to types of fraudulent activity not previously identified; and generating a fraudulent activity indication associated with the reservation record which includes at least one of the first fraud classification value and the second fraud classification value.

Consequently, the embodiments of the invention can use cascaded supervised and unsupervised machine learning models, which advantageously allows the detection of known modes of fraudulent behavior, via a supervised model, as well as potential new modes of fraudulent behavior, via an unsupervised model.

In embodiments of the invention, each historical record in the series records a state of the reservation record at a corresponding time in time during a period and the processing of the historical records comprises:

the extraction, from each historical record of the serial data characterizing one or more elements of the reservation record at the corresponding time point;

the processing of serial data to generate aggregated data characterizing a mode of modifications made to one or more elements of the reservation record during a period; and determining the plurality of characteristic values based on the aggregated data.

Advantageously, the reuse of time series data records allows the generation of characteristic values for use in machine learning models which capture behavioral patterns during an extended period between the creation of the booking record and its possible realization. Embodiments of the invention are particularly suitable for deployment associated with computer reservation systems, such as travel reservation systems in which high levels of complexity and flexibility result in significant variability in the modes of behavior leading to fraud. , mitigating the need to identify specific fraudulent modes and applying specific rules or corrections for each mode.

The computer reservation system may be a global distribution system (GDS), the reservation registration may be a passenger name registration (PNR) and the series of historical registrations may include a set of envelopes, each including a record of validated PNR information at a corresponding time point.

The first machine learning model can be formed using a method comprising:

providing a set of labeled data comprising samples of historical records and / or characteristic values associated with one or more types of fraudulent activity previously observed;

dividing the labeled data set into training and test sets training at least one candidate machine learning model supervised using the training set to detect each type of fraudulent activity observed previously;

for each candidate supervised machine learning model trained, calculating a performance measure using the test set; and for each type of fraudulent activity previously observed, the selection of a corresponding candidate model of machine learning based on performance measurement.

In another aspect, the invention provides a computer-implemented method for detecting fraudulent activity associated with a reservation record in a computer reservation system, the method comprising:

retrieving a series of historical records from a data store, each historical record in the series recording a state of the reservation record at a time point during a period;

the extraction, from each historical record of the serial data characterizing one or more elements of the reservation record at the corresponding time point;

the processing of serial data to generate aggregated data characterizing a mode of modifications made to one or more elements of the reservation record during a period;

assessing at least one preconfigured machine learning model using the aggregated data to obtain a fraud classification value produced; and generating an indication of fraudulent activity associated with the reservation record based on the fraud classification value produced.

The step of evaluating at least one preconfigured machine learning model can include:

determining a plurality of characteristic values based on the aggregated data;

evaluating a first machine learning model using the characteristic values to obtain a first fraud classification value, wherein the first machine learning model is based on a supervised learning algorithm and is trained to identify one or more types of fraudulent activity identified previously;

evaluating a second machine learning model using the characteristic values to obtain a second fraud classification value, in which the second machine learning model is based on an unsupervised learning algorithm and is configured to identify abnormal patterns of characteristic values corresponding to types of fraudulent activity not previously identified; and generating the generated fraud classification value based on at least one of the first fraud classification value and the second fraud classification value.

In another aspect, the invention provides a computer system for detecting fraudulent activity associated with a reservation record in a computer reservation system comprising:

a processor;

at least one memory device accessible by the processor; and at least one data store accessible by the processor in which the memory device contains a body of program instructions which when executed by the processor causes the computer system to implement a method comprising the following steps:

retrieving from the data base a series of historical records by capturing changes made to the reservation record during a period;

processing the historical records to determine a plurality of characteristic values comprising data characterizing a mode of the modifications made to the reservation record during the period;

evaluating a first machine learning model using the characteristic values to obtain a first fraud classification value, in which the first machine learning model is based on a supervised learning algorithm and is formed to identify one or more types of fraudulent activity previously identified;

evaluating a second machine learning model using the characteristic values to obtain a second fraud classification value, in which the second machine learning model is based on an unsupervised learning algorithm and is configured to identify abnormal patterns of characteristic values corresponding to types of fraudulent activity not previously identified; and generating a fraudulent activity indication associated with the reservation record which includes at least one of the first fraud classification value and the second fraud classification value.

The computer system can also include a network interface. A distributed file system accessible by the processor via the network interface may include the data store. The system may include a GDS accessible by the processor via the network interface, in which the GDS includes the computer reservation system. The reservation record may be a PNR and the series of historical records may include a set of envelopes, each of which includes a record of validated PNR information at a corresponding time point.

The body of program instructions can cause the computer system to implement the processing of historical records by the following steps: the extraction, from each historical record of serial data characterizing one or more elements of the reservation record at corresponding time point;

the processing of serial data to generate aggregated data characterizing a mode of modifications made to one or more elements of the reservation record during a period; and determining the plurality of characteristic values based on the aggregated data.

The body of program instructions can also include instructions which, when executed by the processor, cause the computer system to implement a method for training the first machine learning model comprising the following steps:

access to a set of labeled data comprising samples of historical records and / or characteristic values associated with one or more types of fraudulent activity previously observed;

dividing the labeled data set into training and test sets training at least one candidate machine learning model supervised using the training set to detect each type of fraudulent activity observed previously;

for each candidate supervised machine learning model trained, calculating a performance measure using the test set; and for each type of fraudulent activity previously observed, the selection of a corresponding candidate model of machine learning based on performance measurement.

In another aspect, the invention provides a computer system for detecting fraudulent activity associated with a reservation record in a computer reservation system comprising:

a processor;

at least one memory device accessible by the processor; and at least one data store accessible by the processor in which the memory device contains a body of program instructions which when executed by the processor causes the computer system to implement a method comprising the following steps:

retrieving, from a data store, a series of historical records, each historical record in the series recording a state of the reservation record at a time point during a period;

the extraction, from each historical record of the serial data characterizing one or more elements of the reservation record at the corresponding time point;

the processing of serial data to generate aggregated data characterizing a mode of modifications made to one or more elements of the reservation record during a period;

assessing at least one preconfigured machine learning model using the aggregated data to obtain a fraud classification value produced; and generating an indication of fraudulent activity associated with the reservation record based on the fraud classification value produced.

The body of program instructions can cause the computer system to implement the evaluation of at least one machine learning model preconfigured by the following steps:

determining a plurality of characteristic values based on the aggregated data;

evaluating a first machine learning model using the characteristic values to obtain a first fraud classification value, wherein the first machine learning model is based on a supervised learning algorithm and is trained to identify one or more types of fraudulent activity identified previously;

evaluating a second machine learning model using the characteristic values to obtain a second fraud classification value, in which the second machine learning model is based on an unsupervised learning algorithm and is configured to identify abnormal patterns of characteristic values corresponding to types of fraudulent activity not previously identified; and generating the generated fraud classification value based on at least one of the first fraud classification value and the second fraud classification value.

From the following description, various embodiments, other aspects, advantages and characteristics of the embodiments of the invention will be apparent to those skilled in the art specialized in the relevant fields. Note, however, that the invention is not limited to the embodiments described which are provided by way of illustration of the principles of the invention as defined in the declarations to come and to assist those skilled in the art to put these principles into practice.

Embodiments of the invention will now be described with reference to the drawings which follow in which reference numbers refer to similar characteristics and in which:

[Fig-1] is a block diagram illustrating an exemplary network system which includes a fraud detection system representing the invention;

[Fig.2] is a schematic diagram illustrating a PNR history file in the PNR database of FIG. 1;

[Fig.3] is a flowchart illustrating a method of detecting fraudulent activity in accordance with an embodiment of the invention;

[Fig.4] is a flowchart illustrating the extraction of characteristics at the envelope and at the PNR level according to an embodiment of the invention; and

[Fig.5] is a flowchart illustrating a method of identifying known and unknown frauds using cascading machine learning models according to an embodiment of the invention.

The Lig. 1 is a block diagram illustrating an exemplary network system 100 which includes a fraud detection system 102 representing the invention. In particular, the fraud detection system 102 comprises a system based on machine learning (ML) configured to detect fraudulent behavior in accordance with an embodiment of the invention. In order to concretize the invention, an embodiment of the invention is described for detecting fraudulent activity relating to travel reservations. However, it should be noted that this is only an example to illustrate the system and method and that the embodiments of the invention can be applied to other types of reservation systems.

The fraud detection system 102 may include a computer system having a conventional architecture. In particular, the fraud detection system 102, as illustrated, comprises a processor 104. The processor 104 is operatively associated with a non-volatile memory / storage device 106, p. ex. via one or more data buses / addresses 108 as illustrated. The non-volatile storage 106 may be a hard disk and / or may include a state-defined non-volatile memory, such as read-only ROM, flash memory, electronic hard disk (SSD) or other similar storage. The processor 104 also serves as an interface with the volatile storage 110 such as the random access random access memory RAM which contains program instructions and temporary data relating to the operation of the fraud detection system 102.

In a conventional configuration, the storage device 106 maintains a known program and a content of relevant data with the normal operation of the fraud detection system 102. For example, the storage device 106 can contain system programs of and data and other executable application software necessary for the intended functions of the fraud detection server 102. The storage device 106 also contains program instructions which, when executed by the processor 104 , cause the fraud detection system 102 to perform operations relating to an embodiment of the present invention, which are described in more detail below with reference to FIG. 3, in FIG. 4 and in FIG. 5 in particular. In practice, the instructions and the data stored on the storage device 106 are transferred to the volatile memory 110 for execution on demand.

The processor 104 is also functionally associated with a communications interface 112 in a conventional manner. The communications interface 112 facilitates access to an extended data communications network, such as the Internet 116.

In practice, the volatile storage 110 contains a body of corresponding program instructions 114 transferred from the storage device 106 and which is configured to carry out the processing and other operations in order to implement the characteristics of the present invention. Program instructions 114 include a technical contribution to the art, developed and configured specifically to implement an embodiment of the invention that goes beyond routine and conventional activities well understood in the art of detection of fraud and machine learning systems, which will also be described below, particularly with reference to FIG. 3, in FIG. 4 and in FIG. 5.

Regarding the overall overview of the fraud detection system 102 and other processing systems and devices described in this specification, terms such as 'processors', 'computer' and so on, unless the context requires otherwise, should be interpreted as referring to a range of possible implementations of devices, apparatus and systems comprising a combination of software and hardware. This includes single and multi-processor devices and a device, including portable devices, desktop computers and various types of server systems, including collaborative hardware and software platforms that can coexist or be distributed. Physical processors may include general purpose central processing units (CPUs), digital signal processors, graphics processing units (GPUs) and / or other hardware devices suitable for efficient execution of programs and algorithms required.

Computer systems can include conventional personal computer architectures or other general purpose hardware platforms. The software may include open source software and / or commercially available operating system software in combination with various applications and service programs. Otherwise, the processing or calculation platforms may include hardware and / or software architectures adapted to measure. For improved scalability, processing and compute systems can include cloud computing platforms that allow physical hardware resources to be dynamically allocated in response to service requests. While all of these variations are within the scope of the present invention, to facilitate explanation and understanding, exemplary embodiments are described herein with reference, by way of illustration, to general purpose computer platforms at single processor, widely available operating system platforms and / or widely available consumer products, such as desktop computers (PCs), compact computers or laptops (PCs), smartphones, tablet computers And so on.

In particular, the terms 'processing unit' and 'module' are used in this specification to refer to any suitable combination of hardware and software configured to perform a particular defined task such as accessing and processing online or offline data, data entry of characteristics of one or more machine learning models, execution of training and / or other steps to configure one or more machine learning models , or the execution of the alert and fraud detection steps. Such a processing unit can include an executable code module which runs in a single location on a single processing device or which can include collaborative executable code modules which run in multiple locations and / or on multiple treatment devices. For example, in certain embodiments of the invention, the fraud detection algorithms can be implemented entirely by a code executing on a single system, such as the fraud detection system 102, while in other modes of realization the corresponding processing can be implemented in a distributed manner on a plurality of systems.

Software components, p. ex. program instructions 114, to implement the features of the invention can be developed using any suitable programming language, development environment or language and development environment combinations which will be familiar to those skilled in the art software engineering. For example, suitable software can be developed using the C programming language, the Java programming language, the C ++ programming language, the Go programming language, the Python programming language, the R and / or d programming language. 'other languages suitable for the implementation of learning in tomatic and other algorithms. The development of machine learning models for implementing the invention can be assisted by the use of machine learning code libraries such as the TensorLlow, Torch and Keras libraries. Those skilled in the art will understand, however, that the embodiments of the invention involve the implementation of software and code structures which are neither well understood, nor routine or conventional in the art of machine learning systems and that even if existing libraries can help with implementation, they require specific configuration and substantial increase (i.e., development of additional code) in order to realize the various benefits and advantages of the invention and to implement the specific structures, processing, calculations and algorithms described below particularly with reference to the Lig. 3, at Lig. 4 and Lig. 5.

The following examples of languages, environments, and code libraries are not intended to be limiting, and it will be understood that any suitable languages, libraries, and development systems can be used in accordance with system requirements. The descriptions, block diagrams, flow charts and the like which are presented in this specification are provided by way of example to enable those skilled in software engineering and machine learning to understand and appreciate the characteristics, nature and the scope of the invention, and to put one or more embodiments of the invention into practice by implementing suitable software code using any appropriate language, structure, library and development system in accordance with this disclosure without having to bring additional inventive ingenuity to it.

The program code implemented in any of the applications / modules described herein may be distributed individually or collectively as a computer program product, in a variety of different forms. In particular, the program code may be distributed using a computer readable storage medium having computer readable program instructions to cause a processor to implement aspects of the embodiments of the invention.

Computer readable data storage media can include volatile and non-volatile, removable and non-removable tangible media, implemented in any data storage process or technology, such as computer readable program instructions, structures data, program modules, or other data. Computer-readable storage media can also include memories: random access random access memory (RAM), read-only read-only memory (ROM), programmable and erasable read-only memory (EPROM), read-only memory electrically programmable and erasable (EEPROM), flash memory, or other solid memory support technology, portable compact disc with read-only memory (CD-ROM), or other optical storage, magnetic cassette, magnetic tape , magnetic disc or any other medium that can be used to store the desired information and able to be read by a computer. Although a computer-readable storage medium may not include transient signals per se (e.g. radio waves from other propagating electromagnetic waves, electromagnetic waves propagating through a transmission medium such as a guide waves or electrical signals transmitted over a wire), computer-readable program instructions can be downloaded via such transient signals to a computer, another type of programmable data processor, or another device from the storage media readable by computer or to an external computer or an external storage device via a network.

The computer-readable program instructions, stored in a computer-readable medium, can be used to instruct a computer, other types of programmable processing devices or other devices to operate in a particular way, so that the instructions stored on a computer-readable medium produce an article of manufacture comprising the instructions which implement the functions, actions and / or operations specified in the flowcharts, sequence diagrams, and / or block diagrams. Computer program instructions may be provided by one or more processors on a general purpose computer, a special purpose computer, or any other programmable data processing apparatus to produce a machine such as instructions executed by the through one or more processors cause a series of calculations to be performed to implement the functions, actions and / or operations specified in the flowcharts, sequential diagrams and / or block diagrams.

Back to the description of Eig. 1, the network system 100 includes a global distribution system (GDS) 118 which includes a reservation system (not shown) and which is capable of accessing a database 120 of passenger name registration (PNR) . The PNR database 120 stores a plurality of PNRs. Each PNR can include one or more reservation records, each defining one or more reservations made by a traveler. The PNR can also monitor the use of purchased travel services. The PNR can be identified by a registration locator unique to that PNR and can include records defining the travel itinerary for a particular trip, service, passenger, or group of passengers. The travel itinerary may include the services of multiple carriers (eg seats on an airplane, coach or rail segments), auxiliary services of one or more carriers (eg the right to check in extra baggage, a meal during the flight), ancillary services from third parties other than carriers (e.g. hotel reservations or rental car reservations) or any other travel-related service.

An inventory system 122 is also shown in FIG. 1. The inventory system 122 may include an inventory database (not shown). In the exemplary case of an airline’s inventory system, the inventory database can store the inventory of segments and services provided by a carrier, including reservations, accounts and availability. The inventory database can also maintain an account of the availability of each travel service. For example, the inventory system 122 can track the number of seats available for sale for a carrier at any given time for any given flight, a map of the seats with seat numbers and a number of special reserved services and the corresponding quotas. GDS 118 can query the inventory system 122 to determine the availability of travel services before charging or booking the service. In response to the service reservation, the GDS 118 may send a message to the inventory system 122 to update the inventory database to reflect the sale. Although only one inventory system 122 is shown in Fig. 1 by way of illustration, it will be understood that the travel industry is complex and extremely competitive and that, in practice, the GDS 118 is capable of accessing an inventory and making reservations for a large number of suppliers. travel services, each of which may have its own inventory system.

Customers who can be individuals, reservation agents or any other legal or natural person, access the reservation services of GDS 118 via the network 116, p. ex. via the client terminals 124 which execute corresponding reservation software. The reservation software that runs on the client terminals 124 can be managed to create new routes, resulting in the creation of new PNRs in the PNR 120 database and / or to modify existing routes and PNRs. Certain sequences of these operations can be executed in order to defraud the travel service providers, p. ex. bypassing applicable rules or restrictions, or to obtain unauthorized discounts, upgrades and / or other benefits.

[0046] FIG. 2 is a schematic diagram illustrating a PNR 200 history file (or a portion thereof) in the PNR 120 database. Each PNR in the PNR 120 database can be associated with a history file, p. ex. 200. The historical file 200 may include a record of the creation of the PNR and of any subsequent modifications made to the PNR. The history file can provide data that allow the system to determine if and when an element of the PNR has been changed and the details of the change. History file 200 includes a plurality of records, p. ex. 202, 204, 206 referred to as ‘envelopes’. Each time the PNR is updated, an additional envelope can be created and attached to the history file. The PNR has a unique identifier 208, known as a record locator or "Recloc" which does not change the update of the PNR. Each envelope may include an identifier (not shown) such as a sequential number. For identifiers with sequential numbers, the lowest envelope number (eg envelope 000) can correspond to the envelope associated with the creation of the PNR. Each envelope may include data defining a modification made to the PNR, a state of the PNR before or after the modification, a time and a date on which the modification was made where the state of the PNR existed, information relating to the agents of reservation or the automated system making the modification, the name of the person who requested the modification and / or any other relevant information relating to the PNR.

More specifically, in embodiments of the invention a PNR envelope, p. ex. 202, 204, 206, includes a record of validated PNR information at a specific point in time. Each time a modification or a group of modifications is made in a PNR, followed by an “end of transaction” (EOT) event, the result of the modification (s) is validated and a new PNR envelope is created and attached to the history file 200. Modifications or non-validated actions which do not modify the PNR are not recorded in the new envelope. Each envelope is uniquely identifiable by the Recloc of the PNR and the sequential number of the envelope.

As an example, the envelope 202 can represent an initial state X of a PNR before a modification. The travel itinerary defined by the described envelope 202 includes a flight between Nice and Seoul including a segment from Nice Côte d'Azur to London Heathrow on June 30 (6X111 30JUN NCELHR) and another segment from London Heathrow to Seoul Incheon on June 30 (6X112 30JUN LHRICN). Thereafter, the PNR is modified reflecting a change in the segment connecting Nice and London. This may be due to an event such as a segment cancellation or a voluntary change made by the passenger. This results in a change in the state of the PNR, from state X to state X + L When this change is validated, the envelope 204 is created and added to the history file 200 to represent the updated state X + l of the PNR. As shown in Envelope 204, the initial flight segment status codes have been changed from HK to UN to indicate that the segments are no longer active and two replacement segments 6X211 C 30JUN 1 NCELHR and 6X212 C 30JUN 1 LHRICN have been added.

The envelope 206 represents a current state of the PNR, for example the state X + n, where n represents a certain number of states of the PNR since the initial state X. In the example described by the envelope 206 , the flight including the replacement segments 6X211 C 30JUN 1 NCELHR and 6X212 C 30JUN 1 LHRICN have been deleted from the travel itinerary. This change may reflect a manual cancellation by a travel agent or may be due to events occurring that result in reorganization (i.e. changes to the travel itinerary to accommodate schedule changes). Thus the history file can be configured so that it is possible to recover the state of the PNR corresponding to any envelope stored in the history of the PNR.

Those skilled in the art will understand that the envelopes 202, 204, 206 are described only by way of example. In particular, an object of these examples is to illustrate, for the skilled person, how changes validated for a PNR over time can be recorded in an associated historical file in the PNR 120 database. embodiment of the present invention can therefore be configured, by specific programming in accordance with the methods described below, with reference to FIGS. 3 to 5 in particular, in order to select envelopes from a history file 200, to extract and / or calculate envelope level characteristics and to aggregate and / or calculate PNR level characteristics, for use with machine learning models configured to detect fraudulent activity perpetuated via GDS 118.

[0051] FIG. 3 is a flow diagram 300 illustrating a method of detecting fraudulent activity according to an embodiment of the invention. The validated PNR envelopes 302 are transmitted as they are generated, in real time, to the fraud detection system 102 and they are saved in a data store 304. In certain embodiments of the invention , data store 304 includes a distributed file system providing extremely efficient access to large volumes of data. For example, data store 304 may include a Hadoop® distributed file system (HDFS). In these embodiments, the fraud detection system 102 will typically include one or more groupings of processing nodes, i.e. that the system 102 thus represents just one node of such a distributed system. In each node 102, the data corresponding to the validated envelopes 302 can be stored in the data store 304 on a physical storage device, p. ex. 106. Validated PNR envelopes 302 saved in data store 304 may include additional copies, separate from the envelopes, p. ex. 202, 204, 206, contained in the historical files 200 of the PNR database 120. In an exemplary embodiment, the validated PNR envelopes 302 are stored in the data store 304 in folders organized by year, month , day and time, in accordance with the validation schedule associated with each envelope.

In step 306, the envelope sequences associated with one or more selected PNRs are retrieved from the data store 304. Each PNR can be identified using its associated unique identifier (Recloc) and the sequence of corresponding envelope then includes the envelopes associated with the PNR identifier, each having a unique contextual sequence number. In step 308, the envelope level characteristics are extracted from each envelope. The envelope level characteristics are numerical and / or categorical values associated with the data stored in a single envelope. In step 310, the aggregated characteristics of PNR level are determined for each PNR. The PNR level characteristics are numerical and / or categorical values determined on the basis of the envelope level characteristics extracted from all the available envelopes 302 associated with a PNR. Further details of envelope and PNR extraction and determination are provided in the discussion below referring to Fig. 4.

In step 312, machine learning methods are used to detect potential cases of known and / or unknown fraudulent activity. The machine learning models used in fraud detection step 312 run online, in real time. The training 314 of these models is performed offline, and the configuration data of the trained models is then transferred to the online system. Further details of the machine learning process employed in step 312 are provided in the discussion below referring to Fig 5.

The results of the fraud detection method, p. ex. a classification of the activities according to which are or not potentially fraudulent, is then stored at 316 in another database 318. The database 318 can be accessed by other processes and systems (not illustrated in the drawing), such as alarm generators and / or end-user applications to facilitate notification, identification, investigation and action relating to potential fraudulent activity and patterns of behavior.

[0055] FIG. 4 is a flowchart 400 illustrating other details of the extraction of characteristics at the envelope and PNR levels in accordance with an embodiment of the invention by developing steps 306, 308 and 310 discussed above with reference to FIG. 3. In step 306, a validated envelope sequence 402 is selected from the data store 304, p. ex. based on a unique PNR identifier (Recloc). The resulting sequence 402 includes envelopes having a common PNR identifier and an ordered series of sequential numbers which can be used to retrieve the envelopes in the order of the corresponding validated modifications.

The loop comprising steps 404, 406, 408 and 410 implements the process 308 for extracting envelope level characteristics for the selected PNR. In step 404, the next envelope in sequence 402 is retrieved. Then, in step 406, the envelope level characteristics are extracted from this individual envelope. In step 408, the current data relating to the generation of aggregated characteristics of PNR level can be updated if necessary. In the case of envelope-level numerical characteristics, the aggregated characteristics which may include quantities, such as the mean, sum, difference, maximum and / or minimum, and variables used to calculate these quantities such as accounts , cumulative totals, a current maximum and / or a current minimum, can be updated in step 406. In the case of categorical characteristics of envelope level, the aggregated characteristics can include lists or sets of values and the variables containing the observed values can be updated in step 406. A check 408 is then carried out to determine if there are other unprocessed envelopes in the sequence 402 and, if necessary, the control returns to step 404 for the recovery of the next envelope. Otherwise, the control goes to step 310 where the values of the aggregated characteristics of PNR level are calculated or finalized.

To facilitate the explanation, the description of the flowchart 400 above relates to the processing of a sequence of envelopes associated with a single PNR. However, it will be understood that this approach can be adapted for the processing of envelopes associated with multiple PNRs selected in step 306. For example, records of characteristics of envelopes extracted in step 308 and / or the aggregated data current generated in step 406, for a plurality of PNRs with which different envelopes are associated, can be kept for multiple PNRs. Upon completion of the processing of all the available envelopes associated with one of the selected PNRs, as determined in decision step 408, the PNR level characteristics associated with this PNR can be calculated and / or finalized in step 310, while another processing of the remaining envelopes, associated with the other PNRs selected via steps 404, 308 and 406, continues.

The recovery and processing of a time series of validated envelopes recording a sequence of modifications in a PNR occurring at particular time points and the corresponding extraction of the envelope level characteristics and aggregated PNR level characteristics for use in the detection of fraud via automatic learning methods exemplified by the algorithm illustrated by the organization chart 400 of the Lig. 4 and described above, include a particular technical contribution to art. This algorithm implemented in an exemplary embodiment via the instructions of programs 114 executing on the fraud detection system 102 was developed and configured specifically to carry out the invention, by providing a contribution which goes far beyond the conventional activity and routine well understood in the art of fraud detection in computer reservation systems. PNR-level aggregated characteristics capture detailed data relating to behavioral patterns throughout the lifespan of a PNR, from creation to the present, and thus provide a rich source of information summarizing activity on a extended period of time. An embodiment of the algorithm represented by the flowchart 400 therefore represents a technology facilitating the bringing of improvements in the detection of fraud, for example when it is coupled with cascading machine learning models which will now be described with reference to Lig. 5.

The Lig. 5 is a flow diagram 500 illustrating a method of identifying known and unknown frauds using cascading machine learning models according to an embodiment of the invention.

In step 502, the aggregated PNR level characteristics and the associated PNR identifiers (Recloc) are received. These characteristics and identifiers are derived in real time from the supply of validated envelopes 302, via the data store 304 and they include the inputs made in the supervised learning detection step 504. The product of step d supervised learning 504 includes a label associated with each PNR indicating either that no known fraud has been detected, or in the case of fraud detection, an identifier associated with a specific known and detected fraud.

The supervised learning detection step 504 is implemented via a supervised automatic learning module comprising the code 114 which is executed on the fraud detection server 102 representing a set of one or more algorithms d supervised machine learning trained to detect specific fraudulent modes. The training is carried out via an offline process 506 using a set of labeled data 508 comprising samples of envelope sequences and / or PNR level characteristics corresponding to specific types of fraudulent activity previously observed and identified.

Training 506 includes dividing data set 508 into training and testing sets. The training set is used to train one or more supervised machine learning models based on different algorithms to detect each known type of fraud. The resulting training modes are tested against the test set and are compared based on at least one performance measure. In an exemplary embodiment, precision and recall are used as performance measures. These two parameters provide a quantitative assessment of the accuracy of the training phase which is used to choose the best algorithm for each type of fraud identified.

To identify multiple types of fraud, embodiments of the invention use two alternative approaches. In a first approach, a dedicated algorithm can be selected and a model can be formed for each type of fraud. In this case, the detection of multiple types of fraud can be carried out in parallel. In a second approach, a single algorithm can be selected and a model can be formed for multiple types of fraud, e.g. ex. using a one-to-all strategy. Embodiments of the invention can combine these two approaches at the same time.

In a particular embodiment employing a grouping of calculation nodes (in which each node can be similar to the exemplary node 102 described above) the distributed structure for calculating groupings for general use Apache Spark is deployed to implement the module d machine learning. A range of algorithms can be used for supervised machine learning models based on the training / test performance described above, including decision trees, random forests, Bayes classification, regression logistics, the nearest neighbor and neural network models such as multilayer perceptron. This list is not intended to be limiting and other supervised learning algorithms can be used in other embodiments of the invention.

In decision step 510, if the supervised learning detection step 504 has classified the entered PNR as being fraudulent, the algorithm 500 ends with the result of the type of fraud identified. Otherwise, execution continues at step 512 of detection of unsupervised learning.

The inputs to step 512 of detection of unsupervised learning include the identifiers (Redoes) and the associated characteristics of PNR level which have not been classified as known frauds by the machine learning module at step 504. These inputs are provided in real time, following decision step 510. The product includes a label associated with each PNR indicating either that the associated activity seems normal, or that it represents an atypical case ( or abnormal) potentially indicating fraudulent behavior.

The unsupervised learning step 512 is implemented via an unsupervised automatic learning module comprising the code 114 which is executed on the fraud detection server 102, representing a set of one or more algorithms Unsupervised machine learning, configured to automatically identify statistics and general trends and accordingly to highlight abnormal or atypical modes in PNR level aggregated characteristics. An atypical case, in this context, includes a sample of entries that differ from most of the data considered to be "normal" or non-fraudulent. The unsupervised learning module can include one or more algorithms. Products from multiple algorithms can be combined via a weighted average to refine the detection of atypical cases. In embodiments of the invention, the result is a notation representing a degree of distinction of the input sample (i.e., atypical or abnormal) from the mass of the "normal" samples. A threshold, or other decision criterion can be applied to the rating, or to assign a label "normal" or "atypical".

The configuration 514 of the unsupervised learning module can comprise the evaluation of the performance of a plurality of candidate algorithms and / or of associated parameters by using the data set 508 to identify those which are the most effective in correctly classifying samples of fraudulent activity as atypical (true positive) while minimizing cases of misclassification of normal samples as atypical (false positive) and fraudulent samples as normal (false negative). In one embodiment of the invention, the unsupervised learning algorithm implemented using Apache Spark technology includes detection of Gaussian anomalies, z score and Gaussian combination models. This list is not intended to be limiting and other supervised learning algorithms can be used in other embodiments of the invention.

In decision step 516, if the detection step 504 of unsupervised learning has identified the entered PNR as being atypical and therefore potentially fraudulent, the algorithm produces an "atypical" indication and ends. Otherwise, the algorithm produces a ‘normal’ (i.e. non-fraudulent) indication before finishing.

The deployment of cascading machine learning models (ie supervised learning in step 504 and unsupervised learning in step 508, exemplified by the algorithm illustrated by l flowchart 500 of Fig. 5 and described above) includes another specific technical contribution to art. This algorithm implemented in an exemplary embodiment via the instructions of programs 114 executing on the fraud detection system 102 has been developed and configured specifically for the invention to be carried out, by providing a contribution which goes far beyond conventional activity and the well-understood routine of the art of fraud detection in computer reservation systems. The exemplary supervised learning module comprising one or more models formed in step 516 and executed in step 504 is configured to learn, detect and classify known fraudulent modes. The exemplary unsupervised learning module comprising one of several models formed in step 518 and executed in step 508 is configured to identify anomalies or atypical cases representing unknown potentially fraudulent modes. Embodiments of the invention are therefore capable of providing flexibility in the detection and prevention of both known and unknown modes of fraudulent behavior, previously undetected, in computer reservation systems, without requiring creation and maintenance. complex sets of rules.

Without limiting the scope of the invention, a number of exemplary envelope level data elements available for extracting characteristics at the envelope level are defined in the following table 1 as well as the associated aggregated characteristics of PNR level which can be calculated from the envelope level characteristics. These characteristics were designed by the present inventors for use in an embodiment of the invention based on experience, intuition, testing and experimentation in order to achieve good performance in the detection of automated fraud. in a concrete travel reservation system. The design and engineering of effective features in order to form machine learning models and to execute the models trained for effective detection of fraudulent activities has been shown to be a substantial contribution to the performance of embodiments of the invention to achieve the technical objective of successful automated fraud detection. For ease and clarity, the data and the corresponding characteristics are grouped according to an element of the envelope and the PNR to which they are linked. The status and terminology codes relate in particular to the Amadeus GDS system, however it will be understood that similar and / or equivalent data are available in other computer reservation systems and that the characteristics listed in table 1 can be adapted in consequence and are not limited to a single system.

[0072]

[Tables [Tables 1]]

Element Feature-element of PNR level aggregated characteristics Envelope level Envelope Date and time of creation Total time between the creation of the first and the last envelope in the PNR history Addition of ES ES element ’(data structure created when PNR rights were assigned to another service) Total number of ES elements added to PNR history PNR Division (into which a PNR is divided, with passengers and related elements divided between corresponding PNR divisions and common information copied from original PNRs into new PNRs) Total number of divisions in PNR history PNR replication (in which a new PNR is created, initially identical to the original PNR, so that it is associated with new passengers) Total number of replications in the PNR history Passenger Number of passengers in the PNR Final number of passengers at the end of PNR history Addition of passenger Total number of additions to PNR history Change of passenger name Total number of name changes in PNR history Passenger removal Total number of deletions in the PNR history

Point of sale PNR owner Owner at the end of PNR history PNR creator Creator at the end of PNR history User author of an update Last user author of an update at the end of PNR history List of users who have updated PNR history Update time List of timestamps of updates in PNR history Organization performing the update List of organizations that have updated the PNR history

Segment (flight segment only) Number of segments in the PNR Final number of segments at the end of PNR history Adding segments Total number of additions to PNR history Editing segments Total number of changes in PNR history Cancellation of segments Total number of cancellations in PNR history (used only if different from zero) Time elapsed between the departure of an added flight and the time of creation of an envelope Minimum time in PNR history Ratio of the final number of segments to the total number of additions (fixed at 1.0 if there is no addition). Ratio of the total number of modifications to the “non-productive” segments compared to the total number of additions (fixed at 0.0 if there is no addition) Confirmed segments (flight segments only, segment status in HK, TK, KK, RR) Number of segments confirmed in the PNR Final number of confirmed segments at the end of PNR history Adding confirmed segments Total number of additions to PNR history Confirmed segment modification Total number of changes in PNR history Confirmed segment cancellation Total number of cancellations in PNR history (used only if different from zero)

Pending segments (flight segments only, segment status in HN, TN, PN) Number of outstanding segments in the PNR Final number of outstanding segments at the end of PNR history Addition of pending segment Total number of additions to PNR history Pending segment modification Total number of changes in PNR history Pending segment cancellation Total number of cancellations in PNR history (used only if different from zero) Phantom segments (flight segments only, segment status in GK, GN, GL) Total number of phantom segments in the PNR Final number of ghost segments at the end of PNR history Addition of ghost segment Total number of additions to PNR history Phantom segment modification Total number of changes in PNR history Phantom segment cancellation Total number of cancellations in PNR history (used only if different from zero) Waiting list segments (flight segments only, segment status in HL, TL, UU, US) Total number of waiting list segments in PNR Final number of waiting list segments at the end of PNR history Adding segment to waiting list Total number of additions to PNR history Modification of segment in waiting list Total number of changes in PNR history Waiting segment cancellation Total number of cancellations in PNR history (used only if different from zero)

Passive segments (flight segments only, segment status in PK, PL) Number of passive segments in the PNR Final number of passive segments at the end of the PNR history Adding confirmed segments Total number of additions to PNR history Confirmed segment modification Total number of changes in PNR history Confirmed segment cancellation Total number of cancellations in PNR history (used only if different from zero) Union (i.e. segments that are paired and sold together) Number of united segments Final number of segments united at the end of PNR history Deadline for ticket issuance in the segment (expiration time is set when a billable item is booked; reservation is canceled if deadline is reached; expiration time can be reactivated or canceled ) List of airline IDs and expiration values Addition of a time limit Total number of additions to PNR history Modification of the cut-off time Total number of changes in PNR history Cancellation deadline Total number of cancellations in PNR history (used only if different from zero) Maximum number of times an airline’s cut-off time value increases in PNR history Number of times the closest (minimum) cut-off time increases Number of times the most recent (maximum) cut-off time increases

Issuance of segment tickets Number of segment tickets in the PNR Final number of segment tickets at the end of PNR history Add segment ticket Total number of additions to PNR history Modification of segment ticket Total number of changes in PNR history Modification of segment ticket associations Total number of changes in PNR history Cancellation of segment ticket Total number of cancellations in PNR history Ratio of the final number of segment tickets to the number of additions (fixed at 1.0 if there are no additions) Ratio of the total number of additions to the final number of passengers (fixed at 0.0 if there are no passengers) Service (SSR) (billable SSR services only) Number of SSRs in the PNR Final number of SSRs at the end of PNR history Addition of SSR Total number of additions to PNR history Modification of SSR Total number of changes in PNR history Cancellation of SSR Total number of cancellations in PNR history Loyalty card (loyalty) of members (SSR FQTV) Number of FQTV SSRs in the PNR Final number of SSR FQTV at the end of PNR history Addition of SSR FQTV Total number of additions to PNR history SSR FQTV removal Total number of deletions in PNR history

Service ticket issuance Number of tickets issued for services in the PNR Final number of tickets issued for services at the end of the PNR history Adding a service ticket Total number of additions to PNR history Modification of service tickets Total number of changes in PNR history Cancellation of service tickets Total number of cancellations in PNR history Form of payment (e.g. cash, credit card, etc.; accounts are maintained for each form of payment) Number of payments for each form Final number (s) of payments for each form at the end of the PNR history Add form of payment Total number (s) of additions to PNR history Payment form modification Total number (s) of changes in PNR history Cancellation of form of payment Number (s) of cancellations in the PNR history Form of payment that does not require verification (e.g. cash, check, invoices, etc.; accounts maintained for each form of payment) Number of payments for each form Final number (s) of payments for each form at the end of the PNR history Add form of payment Total number (s) of additions to PNR history Payment form modification Total number (s) of changes in PNR history Cancellation of form of payment Total number (s) of cancellations in PNR history Sequence of actions of PNR List of activities, where each activity includes: a type of action (e.g. adding, canceling, modifying ...); a type of elements (e.g. passengers, segment, tickets, services ...) and an optional subtype List of aggregated activities, separated by EOT actions

Other type of travel segment (e.g. train, hotel, car; accounts maintained for each type of segment) Number of segments for each type in the PNR Final number (s) of segments for each type at the end of PNR history Add segment Total number (s) of additions to PNR history Edit segment Total number (s) of changes in PNR history Cancellation of segments Total number of cancellations in PNR history (used only if different from zero)

Note that although particular embodiments and variations of the invention have been described herein, other modifications and alternatives will be apparent to those skilled in the art of the relevant arts. In particular, the examples are offered for the purpose of illustrating the principles of the invention and to provide a number of specific methods and arrangements for implementing these principles. In general, the embodiments of the invention are based on the provision of technical arrangements by which the characteristics are extracted and / or calculated from historical sequences of actions recorded in association with the booking records in a reservation system. computer reservations (e.g. PNR level characteristics derived from envelope level characteristics in a GDS) and used for training and evaluation of supervised and unsupervised machine learning models to detect both cases of known types of fraudulent activity (i.e. previously identified) or unknown types of fraudulent activity. The modifications and variations of the embodiments of the invention may therefore include the addition and / or substitution of other characteristics, at the level of individual actions as well as at the aggregate level and / or the use of algorithms. additional or alternative supervised machine learning and unsupervised machine learning algorithms, to those disclosed herein.

The results of the technical arrangements implementing the invention, that is to say. the results of the fraud detection process, can be used in a range of processes and associated technical systems such as the generation of automatic alarms and / or the application software interface screen, in order to facilitate notification , identification, investigation and measures taken relating to patterns of behavior and potential fraudulent activities. However, it will be understood from the preceding description that the embodiments of the invention aim to improve the automated detection of fraudulent activity and not of the subsequent uses downstream of the information which results therefrom and therefore that these applications are not exhaustive as to the potential use of the invention.

The embodiments described should be understood as being provided on an exemplary basis for the purpose of teaching the characteristics and general principles of the invention, but should not be interpreted as limiting the scope of the invention.

Claims (1)

Claims [Claim 1] A method for detecting fraudulent activity associated with a reservation record in a computer reservation system, the method comprising: retrieving from a data store a series of historical records capturing the modifications made to a reservation record during a period; the processing of historical records to determine a plurality of characteristic values comprising data characterizing a mode of the modifications made in the reservation record during the period; evaluating a first machine learning model using the characteristic values to obtain a first fraud classification value, wherein the first machine learning model is based on a supervised learning algorithm and is trained to identify one or more types of fraudulent activity identified previously; evaluating a second machine learning model using the characteristic values to obtain a second fraud classification value, in which the second machine learning model is based on an unsupervised learning algorithm and is configured to identify abnormal patterns of characteristic values corresponding to types of fraudulent activity not previously identified; and generating a fraudulent activity indication associated with the reservation record that includes at least one of the first fraud classification value and the second fraud classification value. [Claim 2] The method of claim 1 wherein each historical record in the series records a state of the reservation record at a corresponding time point during a period and processing the historical records comprises: extracting from each historical record serial data characterizing one or more elements of the reservation record at the corresponding time point; the processing of serial data to generate aggregated data characterizing a mode of modifications made to one or more elements of the reservation record during a period; and determining the plurality of characteristic values based on the aggregated data. [Claim 3] The method of claim 1 or claim 2 wherein the reservation computer system is a global distribution system, the reservation record is a passenger name record and the series of historical records comprises a set of envelopes each 'including a record of validated information from the registration of passenger name at a corresponding time point. [Claim 4] The method according to any one of claims 1 to 3 in which the first machine learning model is formed using a method comprising: providing a set of labeled data comprising samples of historical records and / or characteristic values associated with one or more types of fraudulent activity previously observed; the division of the labeled data set into training and test sets; training at least one supervised machine learning candidate model using the training set to detect each type of fraudulent activity observed previously; for each candidate supervised machine learning model trained, calculating a performance measure using the test set; and for each type of fraudulent activity observed previously, the selection of a corresponding candidate model of machine learning based on performance measurement. [Claim 5] A method for detecting fraudulent activity associated with a reservation record in a computer reservation system, the method comprising: retrieving a series of historical records from a data store, each historical record in the series recording a state of the reservation record at a time point during a period; the extraction, from each historical record of the serial data characterizing one or more elements of the reservation record at the corresponding time point; the processing of serial data to generate aggregated data characterizing a mode of the modifications made to said one or more reservation recording elements during a period; assessing at least one preconfigured machine learning model using the aggregated data to obtain a fraud classification value produced; and generating (316) an indication of fraudulent activity associated with the reservation record based on the fraud classification value produced. [Claim 6] The method of claim 5 wherein the evaluation of at least one preconfigured machine learning model comprises: determining a plurality of characteristic values based on the aggregated data; evaluating a first machine learning model using the characteristic values to obtain a first fraud classification value, wherein the first machine learning model is based on a supervised learning algorithm and is trained to identify one or more types of fraudulent activity identified previously; evaluating a second machine learning model using the characteristic values to obtain a second fraud classification value, in which the second machine learning model is based on an unsupervised learning algorithm and is configured to identify abnormal patterns of characteristic values corresponding to types of fraudulent activity not previously identified; and generating the generated fraud classification value based on at least one of the first fraud classification value and the second fraud classification value. [Claim 7] A computer system for detecting fraudulent activity associated with a reservation record in a reservation computer system comprising: a processor; at least one memory device accessible by the processor; and at least one data store accessible by the processor; in which the memory device contains a body of program instructions which when executed by the processor causes the computer system to implement a method comprising: retrieving from the data base a series of historical records (402) capturing changes made to the reservation record during a period; processing the historical records to determine a plurality of characteristic values comprising data characterizing a mode of the modifications made to the reservation record during a period; evaluating a first machine learning model using the characteristic values to obtain a first fraud classification value, wherein the first machine learning model is based on a supervised learning algorithm and is trained to identify one or more types of fraudulent activity identified previously; evaluating a second machine learning model using the characteristic values to obtain a second fraud classification value, in which the second machine learning model is based on an unsupervised learning algorithm and is configured to identify abnormal patterns of characteristic values corresponding to types of fraudulent activity not previously identified; and generating a fraudulent activity indication associated with the reservation record that includes at least one of the first fraud classification value and the second fraud classification value. [Claim 8] The computer system of claim 7 which further includes a network interface and a distributed file system accessible by the processor via the network interface, wherein the distributed file system includes the data store. [Claim 9] The computer system of claim 7 which further comprises a network interface and a global distribution system accessible by the processor via the network interface, wherein the global distribution system includes the computer reservation system, registration of reservation is a passenger name record and the series of historical records includes a set of envelopes, each of which includes a record of validated information from the passenger name record at a corresponding time point. [Claim 10] The computer system according to any of claims 7 to 9 in which the body of the program instructions causes the computer system to implement the processing of the historical records by: extracting, from each historical record the serial data characterizing one or more elements of the reservation record at the corresponding time point; the processing of serial data to generate aggregated data characterizing a mode of modifications made to one or more elements of the reservation record during a period; and determining the plurality of characteristic values based on the aggregated data. [Claim 11] The computer system according to any of claims 7 to 10 wherein the body of program instructions further includes instructions which, when executed by the processor, cause the computer system to implement a method of training of the first machine learning model comprising: access to a set of labeled data comprising samples of historical records and / or of characteristic values associated with one or more types of fraudulent activity previously observed; the division of the labeled data set into training and test sets; training at least one supervised machine learning candidate model using the training set to detect each type of fraudulent activity observed previously; for each candidate supervised machine learning model trained, calculating a performance measure using the test set; and for each type of fraudulent activity previously observed, the selection of a corresponding candidate model of machine learning based on performance measurement. [Claim 12] A computer system for detecting fraudulent activity associated with a reservation record in a reservation computer system comprising: a processor; at least one memory device accessible by the processor; and at least one data store accessible by the processor in which the memory device contains a body of instructions for program which when executed by the processor causes the computer system to implement a process comprising: retrieving a series of historical records from a data store, each historical record in the series recording a state of the reservation record at a time point during a period; the extraction, from each historical record of the serial data characterizing one or more elements of the reservation record at the corresponding time point; the processing of serial data to generate aggregated data characterizing a mode of the modifications made to one or more elements of the reservation record during a period; assessing at least one preconfigured machine learning model using the aggregated data to obtain a fraud classification value produced; and generating an indication of fraudulent activity associated with the reservation record based on the fraud classification value produced. [Claim 13] The computer system according to claim 12 in which the program instruction body causes the computer system to implement the evaluation of at least one machine learning model preconfigured by: determining a plurality of characteristic values based on the aggregated data; evaluating a first machine learning model using the characteristic values to obtain a first fraud classification value, wherein the first machine learning model is based on a supervised learning algorithm and is trained to identify one or more types of fraudulent activity identified previously; evaluating a second machine learning model using the characteristic values to obtain a second fraud classification value, in which the second machine learning model is based on an unsupervised learning algorithm and is configured to identify abnormal patterns of characteristic values corresponding to types of fraudulent activity not previously identified; and generation of the fraud classification value produced based on at least one of the first fraud classification value and the second fraud classification value. [Claim 14] A computer program product comprising instructions stored on a computer readable medium which when executed by a processor implement any of claims 1 to 6