## 4 Experimental Results and Discussion
### Potential Anomaly Detection  
When the management department has mastered some abnormal passenger information, analyzing the degree of association of these passengers can determine whether they belong to the same group, so that the management department can better maintain public safety and ensure the normal operation of the public transportation system. Abnormal passenger travel is very different from normal passengers, there is no fixed pattern in travel time distribution and travel area distribution, and the regularity of the vehicles used is chaotic. These characteristics can be seen when using our method to analyze abnormal passengers. In the public transportation system, thieves often appear. The thief's target is valuables such as passengers' mobile phones and wallets. When passengers' wallets are stolen, the IC cards they put in their wallets are also stolen together. Since the use of an IC card does not require identity  
Figure 14: Normal passenger analysis—chord view (**a**) Card number 23185887, (**b**) Card number 889072211. Figure 13: Normal passenger analysis—bubble chart view (**a**) Card number 23185887, (**b**) Card number 889072211.  
verification, and the owner cannot freeze the IC card, a thief who steals the IC card will use it. We can obtain the card number through the identity information of the owner, find out the cards that may be associated with this card by filtering the feature values, analyze the travel information of these cards, determine whether these cardholders belong to the same abnormal group, and deduce the relationship between them. Card number 13080401 was a card lost by a passenger and was identified as an abnormal card. By filtering the feature values, we found that card number 54278818 may be associated with card number 13080401. They are suspected to belong to the same anomalous group. We use our system to determine if they belong to the same group. Through analysis, we can determine whether the two cards are abnormal cards and determine whether they are associated cards. It can be seen from the 3D trajectory that their travel is irregular and there is no way to know the specific situation. To further explore suspicious anomaly cards, we explore the travel of card numbers 13080401 and 54278818 using our method. Since these two cards appear at many stations, it is difficult to display them in the same chord view, they are explored separately. As shown in Figure 15, from the feature value of two cards, it can be seen that the card number 13080401 and the card number 54278718 have similarities. From the \(lof\) value, the card number 54278818 has a higher probability of abnormality than the card number 130800401, it can be initially determined that they are abnormal cards. As shown in Figures 16 and 17, both cards have similar travel characteristics in both travel time and travel trajectory. As shown in the pixel matrix view, both of them going out from 7:30 to 8:30 in the morning and back home from 17:00 to 20:00 in the evening. It can be seen that their travel time is regular in the morning and evening. Although there is a small amount of time distribution in the intermediate time period, most travel time distributions are very similar and they have the characteristics of travel time dispersion. From the two dimensional trajectory, their trajectories are very similar, including the degree of chaos of the trajectory and the heat of trajectory travel. It can be concluded that the dotted line is the trip they leave from home in the morning and return home in the evening. We can guess that the two passengers are doing some irregular activities, such as begging, stealing, and so forth. There are a lot of entry stations and exit stations for these two cards, as shown in the passenger origin-destination chord view. It can be found that they have two stations with a higher frequency of visits?Beijing West Railway Station and Beijing West Railway Station South Square Bus Station. Beijing West Railway Station belongs to the hotspot of abnormal activity.