Research on Anomalous Behavior Detection and Dangerousness Assessment among Civil Aviation Passengers at Checkpoints

: Traditional civil aviation security check measures are focused on baggage rather than passengers. The goal of this study is to enhance the level and effectiveness of security measures. We propose an anomalous behavior detection technique for civil aviation passengers and a passenger risk-assessment method based on a neural network method. A large number of real cases were analyzed and summarized to extract indicators of anomalous behavior of civil aviation passengers, and an index system was developed to detect anomalous behavior of passengers at checkpoints. A neural network method was used to evaluate the passengers and classify the risk level to detect potentially dangerous personnel, monitor people, and create an emergency warning system. The synthetic minority oversampling technique (SMOTE), the conjugate gradient method, and a multilayer perceptron neural network were used to classify the risk level of passengers at checkpoints. The results demonstrated that the proposed index system and evaluation method were well suited to deal with the ambiguity and uncertainty in the recognition process. The anomalous behavior of civil aviation passengers at checkpoints and the associated threat level were accurately identified.

problems still exist despite extensive international and domestic efforts to prevent terrorism and explosions due to insufficient development of the industry, ineffective techniques, and an inability to ensure security. Aviation security still faces significant pressure and many challenges [1].
Security measures focused on objects are the core of traditional civil aviation safety measures and include the inspection of contraband and hazardous goods; however, this has many disadvantages. In other words, the passenger is deemed harmless and can board a plane provided he/she does not carry any contraband, hazardous goods, or explosives. The terrorists who hijacked the plane on 9/11 did not carry any contraband or explosives but they caused extensive damage.
Therefore, security checks focused on objects are not sufficient. Behavior detection can improve the traditional model and increase the effectiveness and level of aviation security by identifying a person that may represent a potential risk. suggests that each contracting state should consider integrating behavior detection into its aviation security practices and procedures. Anomalous behavior detection in an aviation security environment refers to the application of techniques involving the detection of behavioral characteristics including but not limited to physiological or gestural signs indicative of anomalous behavior to identify persons who may pose a threat to civil aviation [2] .
The study of anomalous behavior in the field of sociology started around 1960; initial studies were focused on the anomalous behavior of humans in the natural environment. Since then, many international scholars investigated and applied physiological measurement techniques to behavioral studies such as thermal imagery, eye tracking, electric current tests of the skin, and event-related potential (ERP) measures. In recent years, research on surveillance video and image recognition of anomalous behavior has increased. In 2005, Mecocci et al. designed a video surveillance system for detecting anomalous events; the system has shown great value in practical applications [3] .
Subsequently, Chen et al. proposed a multi-support vector machine (SVM)-based Bayesian network method to detect anomalous behavior [4] ; Oyama and Shah presented a new method using a social force model to conduct crowd anomalous behavior detection using video data [5] . Gao et al. proposed an optimization method for surveillance image recognition in civil aviation airports based on edge detection [6] . Choudhary proposed a real-time crowd behavior detection method using the scaleinvariant feature transform (SIFT) technique applied to video sequences [7] .
In China, Zhang investigated video images to identify anomalous behavior in people in 2007.
Motion detection, body recognition, and target tracking were used to monitor the target scene in real-time and detect people with anomalous behavior [8] . Xu analyzed 55 aerial hijacking cases in China over the past 30 years and created a preparedness, prevention, and contingency (PPC) model of hijackings based on the theory of crime prevention [9] . Rao conducted a study from the perspective of criminology and stated that it was necessary to detect anomalous behavior in civil aviation passengers [10] . Wang et al. used a mathematical algorithm to identify anomalous behavior in people; the algorithm allowed for the identification of several persons in one image and detected several anomalous behaviors [11] . Wu et al. determined the dominant position of the human face in antispoofing technologies and explored how to assess human faces to detect deception [12] . Ma studied anomalous behavior detection based on human morphology and classified the anomalies into several levels. The system provided an automatic warning when a high-level anomaly was identified to achieve ease of management [13] . Tang et al. [14] , Shen and Wu. [15] , and Wei et al. [16] studied anomalous behavior detection based on video and image surveillance data. Hua et al. detected anomalous behavior in people based on the speed of walking [17] .
In summary, research on anomalous behavior detection in international and domestic studies is rather broad and most research has relied on equipment, measurements, and visualization. To date, no theory or application has been developed to help civil aviation staff to assess the level of danger of passengers using anomalous behavior detection techniques, which can screen and classify passengers for security management. In this study, the anomalous behavior of civil aviation passengers at checkpoints is determined and an evaluation index system is developed. The risk level of civil aviation passengers is classified with a neural network, which provides a timely assessment of the risk to ensure the security of civil aviation.

Statistical analysis of cases of anomalous behavior detection in civil aviation
As mentioned above, there is a lack of research on the detection of anomalous behavior of civil aviation passengers domestically and internationally; therefore, we collected information on 149 cases that occurred from 2000 to 2019 in China and abroad, as publicized on the Internet to investigate the anomalous behavior. These cases include not only major security incidents such as attempted hijackings and bombings but also routine cases such as the discovery of illegal knives, lighters, and drugs carried or hidden by passengers at security inspection sites. The number and type of cases are sufficient to conduct an analysis and draw reliable conclusions.
As shown in Fig. 1, many kinds of illegal behaviors were observed. Carrying and hiding forbidden objects such as illegal knives, lighters, and drugs comprised the largest proportion (65%), followed by disturbances. All these activities may pose a threat to civil aviation security.  The statistical analysis of the areas of occurrence of the anomalous behavior indicates that most of this behavior occurred at the security checkpoints (74.5%), followed by the cabin, as shown in Fig. 2.

Fig. 2 Areas of occurrence of anomalous behavior
As shown in Fig. 3, most of the people who identified the anomalous behavior were ground security guards including security staff, police, and customs officers (81.9%), followed by the crew.
This result is in line with the statistical results of the area of occurrence of the behavior, i.e., the checkpoints and cabin.

Fig. 3 Persons that identified anomalous behavior
Most of the people who were identified as exhibiting anomalous behavior were passengers (89%), followed by airline staff or airport employees and others, as shown in Fig. 4

Fig. 4 Persons exhibiting anomalous behavior
The results demonstrate that anomalous behavior in civil aviation is mainly exhibited by passengers and is generally detected by ground security guards such as security staff and checkpoint personnel. Therefore, in this study, we focus on the anomalous behavior of civil aviation passengers at checkpoints.

Development of an index system for the detection of anomalous behavior of civil aviation passengers at checkpoints
The statistics indicate that civil aviation passengers with anomalous behavior differ from normal passengers in terms of certain behavioral characteristics; some of these behaviors are similar to those of known criminals or disruptive passengers. This behavior can be identified by security staff during checks. Therefore, it is necessary to conduct research that is applicable to these situations. For instance, security personnel are supposed to observe, analyze, or question passengers regarding their clothing, actions, language expression, facial expression, luggage, etc. when the passengers are in line for security checks or are waiting or boarding to evaluate whether the person is dangerous and may pose a threat to civil aviation security.
The frequency histogram of the indicators of anomalous behavior of passengers is shown in  When transporting passengers in civil aviation, standard documents include an ID card or passport. In addition to checking the authenticity of the certificate, the security personnel also determine whether the passenger is a frequent traveler to places of high risk, whether there is defacement, missing pages, or replaced pages in the documents, or whether the passport is newly issued.
( Other indicators partner clothing, identity, occupation, and the partner of the traveler, whether the container has an unusual shape or is multi-functional or has several interlayers; it can be determined if the position or manner of the luggage and articles are not in accordance with the general rules. Some passengers may carry far more items than needed for traveling or there is no luggage on a long journey or strange sounds or smells may originate from the passenger or his/her luggage. (3) Clothing The clothing of the passenger should be assessed the following anomalies; for instance, whether the appearance or clothing indicates extreme political or religious views; whether the clothing is unusual with regard to the season, climate, or weather; whether the appearance or clothing is unsuitable for his/her luggage, identity, or occupation; whether the clothing or accessories are designed to cover up his/her facial features or expression; whether there are forbidden objects, such as restricted knives or drugs, etc. in artificial limbs, hair or similar prostheses.

(4) Behavioral actions
Behavioral actions include constantly moving towards women or children and following them, as well as body language, such as the gait, gestures, and posture that are anomalous or unnatural.
There may be indicators that the physical characteristics of special-identity passengers such as disabled people or pregnant women are not in the normal state. People may use actions such as rubbing the rose, touching the neck or coughing to conceal a lie, dodging, quickly moving away, touching something frequently, looking at a particular object, and other reactions that indicate nervousness. speaking loudly, rapidly, or at a high pitch.

(7) Partners
Examples include unusual partners; the passenger is identified as anomalous and he/she has a partner; a person who is obviously the partner of the passenger but they pretend not to know each other and make eye contact.

(8) Other indicators
Other suspicious behaviors include purchasing a passenger ticket in cash; purchasing a oneway ticket; purchasing connecting air tickets but the itinerary is inconsistent with that of regular passengers; passengers with a history of crime, drug abuse, or bad credit; having bought excess insurance; coming in and out the airport many times; constantly observing something at the security check site; accompanied by an insider [18] .

Multilayer Perceptron
An artificial neural network (ANN) is a nonlinear adaptive network similar to the neural network of a human brain; an ANN is used to process complex tasks, is capable of processing large amounts of data, has strong self-learning capacity, and provides an optimal solution rapidly. ANNs are widely used for face recognition, speech recognition, and signal processing and classification problems. A multilayer perceptron (MLP) is a feed-forward neural network with at least one hidden layer. The standard model (Fig. 7) includes an input layer, hidden layer, and output layer. As long as there are a sufficient number of hidden layer neurons, a three-layer network can be used to fit any nonlinear function with good precision. The detection of abnormal behavior of passengers involves the use of many evaluation indices and complex evaluation data; therefore, the MLP is suitable for dealing with nonlinear problems and a large amount of data that has to be classified [20] .

Conjugate gradient algorithm
The ANN algorithm used in this study is a BP algorithm. The original BP algorithm uses a gradient descent method to find the optimal solution. During training, the information propagates from front to back layer by layer, while the weights in the network are adjusted by the BP of the error. The optimization direction of the algorithm is the steepest descent direction. The negative

Danger (3)
High danger (4) ... gradient direction, which reflects the local property of the error function at a certain point, is the steepest descent direction, but not necessarily the global steepest descent direction. Therefore, the algorithm can easily fall into local minima and cannot provide a globally optimal solution; the generalization ability is also poor. The directions of the two adjacent iterations are mutually orthogonal. When the iteration point is close to the minimum point, the smaller the search step size, the slower the convergence speed is.
The conjugate gradient method uses the same first derivative information as the steepest descent method, but it has greater global convergence, faster convergence speed, smaller storage requirements, and does not need any external parameters; therefore, it is widely used to solve unconstrained optimization problems. The search direction of the conjugate gradient method at each step is not the negative direction of the gradient but a group of conjugate directions constructed by the gradient at known points. The known point's next iteration point xt+1 has the following form: This weight optimization method improves the effectiveness and reliability of the algorithm.
Therefore, we use the conjugate gradient method to train the MLP network to obtain good convergence performance and convergence speed of the neural network.

SMOTE algorithm
When machine learning classification methods are used with unbalanced data for training, the results tend to be biased towards majority samples because the number of minority samples is low and feature learning is not comprehensive, which will affect the classification accuracy; often, the focus of classification is whether minority samples can be identified. We use the synthetic minority oversampling technique (SMOTE), which is a very effective and widely used algorithm, to solve the problem of data imbalance. Dataset balance is achieved by adding a few synthetic samples to the data, which not only reduces overfitting but also improves the feature usage of the minority samples samples and improves the generalization performance of the classifier on the test set.
SMOTE uses a linear interpolation method to synthesize new samples between two minority samples. The basic principle is as follows: if the sampling rate is m, for each minority sample point Xi, we find its K minority neighbor points and choose m neighbor points yij(j=1, 2,…,m); we then synthesize new minority samples pj according to Eq. (2): where Rand (0,1) represents a random number in the range of (0,1). The newly synthesized minority samples are merged into the original dataset and the training set is re-sampled, thereby improving the data imbalance.

Data preprocessing
We deleted the samples that did not contain sufficient information and obtained a total of 310 valid samples. The passengers are divided into four categories according to the risk level; the safety score is 1, slight danger is 2, danger is 3, and high danger is 4. The higher the score, the higher the risk level is. We asked experts to score the characteristics of the samples and determine the final risk levels; the safety category (category 1) has 160 samples the slight danger category (category 2) has 109 samples, the danger category (category 3) has 33 samples, and the high danger category . Normalization improves the convergence speed and convergence accuracy.

Network construction and training
The literature indicates that three-layer neural networks are most suitable for this study; a large number of layers will often decrease the accuracy of the model; therefore, we use a three-layer network structure with a hidden layer.
The selection of the number of nodes in the hidden layer is generally based on experience; the empirical equation is  When x>0, the gradient is not attenuated and the convergence speed is fast. The The loss function is a cross-entropy function. Cross-entropy is a concept in information theory; it describes the distance between two probability distributions, as shown in Eq. (5). It describes the difficulty of expressing the probability distribution p through the probability distribution q.. p represents the original label and q represents the predicted value. The smaller the cross-entropy, the closer the two probability distributions are. The softmax function changes the output of the neural network to a probability distribution, and the distance between the predicted probability distribution and the real probability distribution is calculated using the cross-entropy function.
The data are divided into a training set and test at a ratio of 2:

Results
For the ordinary gradient descent algorithm, after 1124 iterations, the final loss value is 0.43, the overall classification accuracy is 82.7%, and the classification accuracies of categories 3 and 4 are very low. For the SMOTE method, after 1053 iterations, the loss function converges, the final loss value is 0.04, and the overall classification accuracy is 91.1%; the results are shown in Table   1. It is observed that the loss value of the optimized neural network is lower and the classification accuracy is higher for the SMOTE method. The classification results of the statistical classifier are shown in the confusion matrix in Fig.   9. The horizontal and vertical directions represent the predicted classes and the real classes, respectively, and the values in the matrix represent the recall rate of the class, i.e., the proportion of correct predictions in the class. The darker the color, the higher the proportion is. The results indicate high classification accuracy.  Table 2, where the F1 value is the harmonic average of the precision rate and recall rate. If the precision rate and recall rate are high, the F1 value is high. The closer the value is to 1, the better the performance of the classifier is.

Conclusion
In this study, an MLP based on SMOTE sampling and the conjugate gradient method is used as a classifier to evaluate the anomalous behavior of passengers at security inspection sites. The following conclusions are drawn: (1) A comprehensive assessment index system was developed for the detection of anomalous behavior of civil aviation passengers at checkpoints. Eight indicators were used, including documents, luggage, clothing, actions, facial expression, language, partners, and other indicators.
The system provides guidance to detect anomalous behavior of passengers at checkpoints and is focused on improving civil aviation security.
(2) The conjugate gradient-based MLP neural network is used to evaluate the behavior of passengers and determine the risk level to reduce uncertainty and subjectivity in the evaluation process.
(3) The classification accuracy of the risk levels of civil aviation passengers was 91.1%, indicating that this method has high application value for the identification of anomalous behavior of passengers at security checkpoints. Additional research and modifications should be performed and the applicability of the method should be evaluated in the future to improve the identification index system and risk assessment method for the detection of anomalous behavior of passengers at checkpoints.

Funding
This study is supported by The Civil Aviation University of China's 2018 Central University