Caroline Poisard
email: caroline.poisard@espe-bretagne.fr

Introducing an old calculating instrument in a new technologies environment: a praxeological analysis of students' tasks using different registers

Keywords: Material and virtual resources, praxeology, task, technique, technology, register, number sense, place-value system, Chinese abacus Ressources matérielles et virtuelles, praxéologie, technique, technologie, registre, construction du nombre, numération décimale, boulier chinois Poisard, C

The Chinese abacus is the resource presented in this paper, to teach and learn number sense and place-value system at primary level. The Chinese abacus can be material, virtual (software) or drawn on a worksheet. We present three tasks and analyse them in term of techniques and relative knowledge. We show how these tasks can be solved by students in different registers (material, software, paper-and-pencil, fingers, oral) which is important for both students' understanding and teachers' activity.

INTRODUCTION

Nowadays, in most classrooms in France, not only material resources are available for teachers and students, but as well virtual ones. Computers are used to prepare their class by teachers, students can have access to computers or tablets in the classroom or in a computer room, teachers in the classroom can use a video-projector, an interactive whiteboard (IWB) with different softwares, etc. The introduction of symbolic calculators at secondary level in the 90's gave rise to some very interesting works in mathematics education [START_REF] Guin | The Didactical Challenge of Symbolic Calculators: Turning a Computational Device into a Mathematical Instrument[END_REF]. It seems to us these analysis are also appropriate to look at some more traditional resources. In our study, teachers use the Chinese abacus (suan-pan) for teaching and learning number sense, place-value system and calculation at primary level in France. The fact that we precise it is in France is important: the abacus is not introduced as it can be in Asia, to become expert and be able to calculate easily and fast. The abacus in studied to introduce a new register to work on number sense and place-value system. We show here that it is as well a good opportunity for inquiry based learning. A software is also used -that we call the virtual abacus-and articulated to the material abacus.

Numbers and arithmetic is a rich mathematical area for education. A recent ICMI study (ICMI Study 23, Sun, Berinderjeet and Novotna 2015) presents studies on the teaching and the learning of whole numbers at primary level. Number sense is a difficult notion to define. For example, [START_REF] Baccaglini-Frank | Multi-Touch Technology and Preschoolers' Development of Number-Sense[END_REF] give a good overview of the question in the fields of mathematics education and cognitive psychology as well. In this paper, by number sense we mean: the distinction between the ordinality and the cardinality of numbers1 , the difference between value and quantity, and the decomposition of numbers.

The first part of our paper presents the theoretical frameworks we retain for this study and our methodological choices. The second part identify the important particularities of the Chinese abacus, including the particularities of the software. With some examples of teachers' discourse about their experience in class we show how register is an underlying notion. The third part is the praxeological analysis of three tasks given to students in different registers. The initial questions raised are: Considering some tasks using the Chinese abacus, how can we describe the knowledge used by students? How the register can (or can not) influence students mathematical activity? Our research questions are exposed at the end of the first part.

THEORETICAL REFERENCES AND METHODOLOGICAL CHOICES

Resources

The term of resource is seen in a large meaning, referring to Adler's work:

"The common-sense notion of resources in and for education is resource as a material object, and lack of resources usually refers to shortages of textbooks and other learning materials. It is possible to think about resource as the verb resource, to source again or differently." (Adler, 2000, p.207).

So, the main point for a resource is the possibility to resource the teaching and the learning of mathematics. For Adler, a resource can be -at least-material (paper, blackboard, textbook, computer, etc.), human (a discussion with a colleague, students' work, etc.), or cultural (different languages used in the class by teachers and/or students, etc.). Part of our work is about documentational resources [START_REF] Gueudet | Towards new documentation systems for mathematics teachers?[END_REF] but this is not the focus we have chosen to develop here.

We introduced the distinction between material and virtual resource [START_REF] Poisard | Comprendre l'intégration de ressources technologiques en mathématiques par des professeurs des écoles[END_REF]. It seems to us that, in education, new technologies are not replacing some other old artifacts. We can see a reorganisation of the articulation of different resources for teachers using new technologies. At primary level, by analysing the appropriation of the Chinese abacus by teachers, we have shown that to teach number sense and place-value system, teachers articulate the material Chinese abacus, a virtual one (software used with an interactive whiteboard IWB), and paper-and-pencil activities on worksheets. [START_REF] Maschietto | Mathematics learning and tools from theoretical, historical and practical points of view: the productive notion of mathematics laboratories[END_REF] discussed as well this idea when old and new technologies are present in the same class situation, they give an analysis in term of instrumentation and orchestration. Our work is connected with other research, using some different frameworks, that introduced some terms that can have similarities with the notion of resources. For examples, in their paper on "manipulatives in mathematics education", [START_REF] Bartolini | Manipulatives in Mathematics Education[END_REF] refer to concrete and virtual manipulatives but also to historico-cultural and artificial manipulatives (designed by educators). In their work referring to the instrumental approach, Maschietto and Soury-Lavergne (2013) make a distinction between material and digital artifacts.

Registers

Part of our work here is to analyse some tasks given to students and to show how the different resources can be articulated by teachers. We look at teachers' work at a small scale, and we refer to the notion of register introduced by [START_REF] Duval | Quel cognitif retenir en didactique des mathématiques? Recherches en Didactique des Mathe ́matiques[END_REF][START_REF] Duval | A Cognitive Analysis of Problems of Comprehension in a Learning of Mathematics[END_REF] in his cognitive approach. Here registers are resources, they are included in a larger range of resources available for a teacher. Of course, all resources are not a representation register. Duval's work is centred on the understanding of mathematical difficulties of students. A classification of registers of semiotic representation is proposed by Duval to analyse mathematical activity. First what is a representation? For Duval: "Representations can be individuals' beliefs, conceptions or misconceptions to which one gets access through the individuals' verbal or schematic productions. […] But representations can also be signs and their complex associations, which are produced according to rules and which allow the description of a system, a process, a set of phenomena. There the semiotic representations, including any language, appear as common tools for producing new knowledge and not only for communicating any particular mental representation." (Duval, 2006, p.104).

What is important for the mathematical activity is the semiotic representations. For Duval, semiotic representations is central to define the mathematical process:

"No kind of mathematical processing can be performed without using a semiotic system of representation, because mathematical processing always involves substituting some semiotic representation for another. The part that signs play in mathematics is not to be substituted for objects but for other signs! What matters is not representations but their transformation." (Duval, 2006, p.107).

And with the notion of transformation, Duval defines the term register. A representation register is a semiotic system that allows transformation of representations, so not all semiotic representations are registers. For example, a verbal form, a numerical expression, a formal notation, a figure are some representation registers. More precisely, Duval considers two very different types of transformations: the treatment (that stays in the same register) and the conversion (where different registers are involved). For example, to solve an equation, one can stay in the register of notations, using symbols and mathematical rule to solve it, this will be a treatment transformation. But a conversion transformation coordinates at least two registers. For example, the task: "from a mathematical expression given in words, write it with symbols using =, >, <" means to coordinate a words expression with a symbolic one. A question important for us: can a material object be a semiotic representation? In this paper, Duval mentions as a note that: "It is only from a strict formal point of view that semiotic representations can be taken as concrete objects (Duval, 1998, pp. 160-163)." (Duval, 2006, p.129).

We show in this paper that the material and virtual abacus can be considered as semiotic representation and articulated between different registers to explain the mathematical activity. For Duval, this is the important part of the mathematical activity of students, the hypothesis given is that "comprehension in mathematics assumes the coordination of at least two registers of semiotic representation" (Duval, 2006, p.115). For both theoretical frameworks, the cognitive and the documentational approach, an important feature to look at is the coordination, the articulation of registers, of resources. We show in the part 3 the articulation of different registers: verbal (oral and written languages), material abacus, virtual abacus, fingers and paper-and-pencil worksheets.

Tasks and techniques

The anthropological theory of the didactic (ATD, Chevallard 1992a, 1992b, 2006) develops several main concepts as the didactic transposition in a given institution, the dialectic of medias and milieu, and the praxeological analysis. We focus here on the praxeological analysis introduced to analyse the mathematical knowledge taught in institutions [START_REF] Chevallard | L'analyses des pratiques enseignantes en théorie anthropologique du didactique[END_REF][START_REF] Chevallard | Readjusting didactics to a changing epistemology[END_REF]: "Essentially praxeology is made of two parts, the praxis part and the logos part. […] The praxis part is the union of a type of tasks (such as solving quadratic equations, blowing one's nose, composing a fugue, for example) and a technique -way of doing -which purportedly allows one to carry out at least some tasks of the given type -those in the "scope" of the technique. The logos part is the union of a whole set of notions and arguments arranged into a more or less rational "discourse" (logos), the so called technology of the technique, which is intended to provide justification for the technique -why does it work (at least sometimes), where does its effectiveness come from?, etc. -and a more abstract set of concepts and arguments arranged into a more general "discourse", the praxeology's theory, supposed to justify the technology itself." (Chevallard 2007, p. 131).

The praxeological organisation has a practical part called the technique ( praxis) and a discourse on the technique called the technology (logos). So, to analyse a given type of tasks, some techniques (at least one) are presented, and for each technique the associated technology (the mathematical knowledge) is developed. Finally, this is linked to a more general mathematical theory. For example, in geometry, it is central to mention if working in the euclidean geometry or not, to analyse some type of tasks.

Related research using these theoretical frameworks

In a previous research, we have used the articulation of the cognitive and the anthropological approach to describe some tasks depending on the register (Poisard 2005a[START_REF] Poisard | Ateliers de fabrication et d'étude d'objets mathématiques, le cas des instruments à calculer[END_REF]. We had chosen three tasks: to set a digit, to set a number and to add two numbers (with a carried-number), and two registers: "paper-and-pencil and oral" and "material, gesture with the Chinese abacus". Some following studies reinvested this articulation, including the virtual abacus [START_REF] Poisard | Comprendre l'intégration de ressources technologiques en mathématiques par des professeurs des écoles[END_REF][START_REF] Riou-Azou | La construction du nombre en grande section de maternelle avec un boulier chinois virtuel[END_REF], Bueno-Ravel and Harent, 2016).

The introduction in classrooms of new technologies has started to question researchers in mathematics education since many years. In our point of view, these investigations are very interesting and can help understand the teaching and the learning using any resource, material or virtual. The book coordinated by [START_REF] Guin | The Didactical Challenge of Symbolic Calculators: Turning a Computational Device into a Mathematical Instrument[END_REF], shows how the introduction of symbolic calculators in the classroom leads to some "didactical challenges". In particular, referring to the ATD, [START_REF] Lagrange | Using Symbolic Calculators to Study Mathematics[END_REF] analyses some tasks given to students in terms of techniques and presents "a variety of new techniques […] related to paper-and-pencil techniques" (p.113). He introduces the notion of instrumented technique defined in the following chapter by [START_REF] Trouche | An Instrumental Approach to Mathematics Learning in Symbolic Calculator Environments[END_REF]. The notion of instrument is related to the instrumental approach, an instrument is an artifact used by someone with some action schemes (instrument=artifact+schemes, [START_REF] Verillon | Cognition and Artefacts: A contribution to the study of thought in relation to instrumented activity[END_REF]. In this environment with calculators, the particular schemes are called instrumented action schemes. The symbolic calculator is not only a "technical" tool but an instrument for the mathematical activity. Analysing students' activity, Trouche points "the difficulty of moving from one register to another one [...]." (Trouche, 2005, p143). In their work, the instrument studied is the symbolic calculator but could be any instrument.

In an overview of the ATD, [START_REF] Artigue | Rapports et articulations entre cadres théoriques: le cas de la théorie anthropologique du didactique[END_REF] analyses the relationships and connections between theoretical frameworks in the case of the ATD. In this review, the articulation of the ATD with the instrumental approach (quoting in particular Lagrange and Trouche's work) and the semiotic dimension (quoting Duval in particular) are mentioned. The articulation of praxeology and representation registers is also developed in [START_REF] Block | Registres et praxis numérique en fin de première année de primaire dans trois pays[END_REF]: the importance of representation registers is analysed with different type of tasks, and looking at three different countries combined influences of the register are shown.

FIGURE 1: Articulation of different frameworks 2

Methodological choices

This study is included in a larger project supported by the French Ministry of Education to develop resources for the teaching and learning of mathematics at primary level, including pre-school one. This national project has now come to an end, with the delivery of two training paths that are available for primary teachers training in mathematics, for both in-service and pre-service education (this national platform is called M@gistère). During those years, we worked within a research group composed by primary teachers and researchers for a collaborative work. For the Chinese abacus, at first a presentation was made of both the virtual and the material one, and teachers retain it to integrate in their progression to teach number sense and place-value system. We followed closely at least five primary teachers during five years (2010/15) from year 1 (5-6 years old) to year 6 (10-11 years old). That means they were regularly participating to the working group meetings to explain how the integration of the abacus was made in their class. The discussions were about: their choices (lesson plans), students' activity, the integrated resources (computers, pencil-and-paper activity, etc.), the technology available and the material constraints, the produced resources, etc. For the new resources produced by teachers, they were discussed in the group and ameliorated to produce the ones now available in the training path "The Chinese abacus at school" delivered in June 2015 (for a presentation see [START_REF] Poisard | Le boulier chinois : une ressource pour la classe et pour la formation des professeurs[END_REF].

The data we analyse are: -Notes from the working group meetings -Observations and recordings of lessons -Students' work (paper-and-pencil worksheets, recordings) -Teachers' work (lesson plans, created resources) -Interviews with teachers and students (5 to 11 years old) To analyse these data, some recordings of interviews and class observations were transcribed. This paper is a synthesis of the research and all these data are combined for our analysis.

Our analysis answers the following questions: What are the registers we can identify? What is the mathematical activity depending the register? For a given task, can we identify different techniques? Is it dependent of the register? Why?

THE CHINESE ABACUS: IDENTIFYING REGISTERS

The virtual and material Chinese abacus

Like the material one, the virtual abacus has two parts: a lower part and an upper part. Each rod corresponds to a rank of the place-value system: units, tens, hundreds, etc. (from the right to the left). On the lower part, the beads represent a value of one (ten, one hundred, etc. depending on the rod) and are called one-unit counters. On the upper part, they represent a value of five (fifty, five hundreds, etc. depending on the rod) and are called five-unit counters. The software we use (from Sésamath) is available online3 . The software has three icons: -"see number" that can display (or not) the number written in digits -"set to zero" -"positioning" that allows from any inscription to set the economical inscription [START_REF] Poisard | Ateliers de fabrication et d'étude d'objets mathématiques, le cas des instruments à calculer[END_REF] that means moving the less number of beads possible. For example, to set 25 we have several possibilities: to activate 2 one-unit counters in the tens and 1 five-unit counter in the units which is the economical inscription (A); but it is also possible to activate 2 one-unit counters in the tens and 5 one-unit counters in the units (B) or also; to activate 1 one-unit counter in the tens and in the units: 5 one-unit counters and 2 five-unit counters (C) (Figure 2). From the two last propositions, using the icon "positioning" will display the economical inscription of 25.

So, on the figure 2 2016) propose a model of the cognitive process of Chinese abacus arithmetic, describing three methods for solving arithmetic method problems: retrieval method, procedure method and mental arithmetic method. In this paper, we focus on number sense and place-value system (not on arithmetic problems). The two main tasks we identify to work on number sense and place-value system with the Chinese abacus are: "to set a number" and "to read a number". The feedback given by the software is the possibility to display a number written in digits. That means a student can use the icon "see number" to verify her/his answer and correct it if needed. But there is no recording of students' activity. That means that most teachers ask to answer on a paper-andpencil worksheets. Teachers can also ask a student to perform the task using the abacus with an IWB and discuss it.

Teachers' discourse and the notion of register

In teachers' discourse, we observe that there is a mention of different registers used with students. We refer here to two interviews with primary teachers: the first one was made with Ester (CM2, year 6) and Deborah (CP, year 2) (Poisard and all 2016) and the second interview made with Rose (CM1, year 5)4 . Ester and Deborah had used the Chinese abacus for several years, and it is the first year for Rose. The three of them have more than fifteen years of experience as primary teachers (including preschool5 ) and teach as well trainers at University in-service and pre-service primary teacher education.

We transcribed these interviews and give here some extracts (translated from French). The interviews have three main directions concerning: -the mathematical knowledge: About the Chinese abacus, what contribution did you notice in the class? What is the interest to use the abacus in class? -students' activity: What learning seems to have been made? What are the procedures implemented? What are the difficulties and mistakes met with? -teacher's work: What is teacher's role for these sessions? How to manage the class activity? How to support students' activity?

In their interviews, Ester, Deborah and Rose point: the differentiation, the students' autonomy, the motivation, the verbalisation of procedures, and their vision of mathematics and their classroom practice. In term of registers, we identify in teachers' spontaneous discourse: the material and the virtual abacus, the paper-an-pencil worksheet, and the verbalisation of numbers. Moreover, we have observed in their classrooms the use of fingers to set numbers and calculate.

Ester explains that the paper-and-pencil worksheets are often used to complete the virtual abacus that allows a self-correction for students: "We designed, little by little, some worksheets to make students more and more autonomous, so they can improve, work at their own rhythm [...]". Ester carries on with the interest of using the abacus to differentiate students' work: "Thanks to this tool, we can easily allow students to acquire number sense and calculation, with worksheets of differentiation so that students can effectively improve." For Rose, the variety of formats for students is very important, the material and virtual abaci are some more formats integrated in the classroom: "Here, students really manipulate numbers, when counting they move the beads or point them. There is a kinaesthetic side that is involved here, particularly for our students that need to move, to touch."

For Ester, the second interest is about computer skills: "With the virtual abacus, we associate computer skills with mathematical skills, and this is not neutral for students' motivation!". Rose notices as well that students like the abacus sessions: they are motivated and explain that with two arguments. Students like to work in groups and on computers. "Most of the sessions were in group, homogeneous groups with a resource person per group. For a tutelage work, with discussions and the virtual abacus to verify answers. […] If students have to choose between the material abacus and the virtual one to manipulate; undeniably they choose the virtual one!" Moreover, Deborah underlines that for students, sessions with the abacus allow to work on verbalisation, in particular on procedures explanation: "What is really obvious is students' verbalisation, they have to use the appropriate vocabulary: one-unit counter, five-unit counter. I ask them to make explicit their procedures […] after, they are used to be in this approach, to really make explicit their procedure, that can be an expert one or not. And it is what is interesting […]. Everyone has the benefit from this discussion!". Indeed, the integration of the Chinese abacus leads to inquiry based learning in mathematics: asking questions, discuss different procedures [START_REF] Poisard | Démarches d'investigation : exemples avec le boulier virtuel, la calculatrice et le TBI[END_REF]). An important factor for teacher to do so, is the possibility to show the different procedures to all students, and is thus linked to the material environment available in the classroom (IWB, video-projector, viewer with a material abacus).

At last, concerning the impact on classroom practices using the abacus, Ester thinks she evolved on her vision of mathematics and on her mathematical practice in the classroom. "I think before I manipulated less, that means thanks to the abacus, I went back on basics of mathematical manipulations, even with older students [year 6, 10-11 years old]. It is a change in my practice. Now as a trainer, I am more on the importance to take time, and do not make abstraction of this material appropriation, almost physical of the number. I myself modified my vision of mathematics!". Deborah locates her evolution on the "conception of number as a teacher", the attention given to make explicit different students procedures and the use of the virtual abacus in year 1 (5-6 years old) for number sense: "What was very interesting for me is the use of new technologies with young students. They are without prior assumptions, on the contrary, they easily manipulate this tool and what is really interesting as well is to see the way they go from the material abacus to the virtual one". For Rose, it was the first year of integration in her class, next year she would like to add some "collective sessions to stabilise learnings" and extend the study to calculation as well.

We next analyse the type of task: "to set a number on the Chinese abacus". We describe three tasks referring to different registers: abaci, fingers, and oral registers. The Chinese abacus is a dynamic resource, we show that the observation of students' gestures is important to understand their learning.

PRAXEOLOGICAL ANALYSIS OF TASKS GIVEN TO STUDENTS IN DIFFERENT REGISTERS

We analyse each task in different registers, that means we present an articulation of registers for a given task. From our observations, we identified these different registers being developed by teachers. We saw (in part 2) that in teachers' discourse, the notion of register is an underlying idea mentioned. The second task we describe ("to set the number 8") was observed in Deborah's class [START_REF] Gueudet | Teaching Mathematics with Technology at the Kindergarten Level: Resources and Orchestrations[END_REF]. We give here a praxeological analysis of tasks for students and identify knowledge related to registers.

Students' activity is a very important resource for teaching. Teacher must follow each student activity to use it for teaching. We focus on three tasks given to students: to set 3, to set 8, and to set and say 73, and we consider four registers:

 R A : the Chinese abacus register, with two parts that can be distinguished (or not): R VA (virtual) and R MA (material)  R W : paper-and-pencil worksheet with drawings of abaci and beads  R F : the fingers register with two hands  R O : the oral languages register

For each task and register, we name some techniques (T) and analyse them to show the mathematical knowledge associated that is the technology (τ). We do not discuss here any hierarchy of these registers, we show how they can be articulated for a specific mathematical knowledge. We talk about coding numbers, for us all these registers are ways to code numbers. The term code is used here as a system of letters, numbers, symbols, etc. that represents another system, in order to codify this system. Abaci, fingers, digits, letters, drawings, cubes, etc. We consider all these resources with a common feature: the possibility to code numbers.

The Chinese abacus is an artefact that becomes an instrument when combined to students schemes of use. For this register R A , the technique in an instrumented technique. The worksheets used with drawings of abacus use the same way to code numbers as the abaci register, so the technique is close to an instrumented one.

For [START_REF] Radford | Why do gestures matter? Sensuous cognition and the palpability of mathematical meanings[END_REF], gesture is an important part of the learning of mathematical activity.

"My point here is not to diminish the cognitive role of the written. It is rather an invitation to entertain the idea that mathematical cognition is not only mediated by written symbols, but that is also mediated, in a genuine sense, by actions, gestures and other types of signs." (Ibid,p.112).

In our study, the fingers register is very special and involves the body to represent numbers. This register is very often used in class, and if we look carefully at it, different techniques are possible to set a number (see task 1 and 2 below) that means fingers are associated to schemes and can be considered as instruments as well. Though we could talk about instrumented technique for fingers.

The following table 1 presents the notations we use for the praxeological analysis.

Registers R Techniques T Technologies τ

• R A ( a b a c u s ) : R VA ( v i r t u a l ) a n d R MA (material) • R W (worksheet) • R F (fingers) • R O (oral languages)
For a given task and a register, the technique is the way of d o i n g , o f a n s w e r i n g t h e mathematical question. The technique is noted (R, T).

T h e t e c h n o l o g i e i s t h e m a t h e m a t i c a l k w n o l e d g e associated to the technique.

The technologie depends on the register as well and is noted (R, τ).

TABLE 1: Notations used for the praxeological analysis of tasks in different registers

Task 1: "to set the number 3"

For this task only beads in the units are activated.

 R A abaci register

To active a bead on the material abacus means to move the beads, up for 1-unit counters and down for the 5-unit counters. The activation of a bead on the virtual abacus is made by clicking on a bead. To active three, it is possible to click on the third one. When techniques are similar on both the material and the virtual abacus, we do not need to separate the two registers R MA and R VA (see T 1 and T 2 ).

Techniques T Technologies τ (R A , T 1 )

To activate one 1-unit counter in the units, three times one after the other, that means in three gestures. Like saying: 1, 2, 3.

(R A , τ 1 ) This is a counting reasoning: 1, 2, 3. Students know the numbers sequence maybe just like a rhyme.

(R A , T 2 ) To activate the third bead in the units, in one gesture.

(R A , τ 2 ) This is a reasoning referring to the ordinality of number: ordinality reasoning: the third.

Students can identify the third bead without counting the three beads.

(Rv A , T 3 ) On the virtual abacus, written number can be (Rv A , τ 3 ) This is a trial/error approach.

shown and students can try different possibilities to display the number 3 on the software (upper left).

 R W paper-and-pencil worksheet register Techniques T Technologies τ (R W , T 1 ) To draw all beads, activated or not (R W , τ 1 ) This student needs to represent all beads on this abacus. She/he sees this abacus as an artefact and may be far from a mathematical meaning.

(R W , T 2 ) To draw the three activated beads (R W , τ 2 ) This is a first abstraction: this student represents only the three activated beads that give the meaning of three.

(R W , T 3 ) To symbolise the three activated beads with a line.

(R W , τ 3 ) As this drawing has some abstraction, (and is not a drawing of all beads), most students using this technique have a good understanding of the abacus and the way it works. They have reached a mathematical work.

 R F fingers register

Techniques T Technologies τ (R F , T 1 ) To set three fingers on one hand. This technique T1 has several under-techniques: T1a, T1b, T1c, depending on the fingers: from the little one of from the thumb (like we do in France).

(R F , τ 1 ) Usually, only one hand is used in France to show 3. With two hands, we show that: 3=0+3 (R F , T 2 ) To set two fingers on one hand and one finger on the other one. This technique T2 has as well several undertechniques: T2a, T1b, T2c, depending on the fingers.

(R F , τ 2 ) With two hands, we can show another decomposition of 3: 3=1+2

3.2 Task 2: "to set the number 8" For this task only beads in the units are activated.

 R A abaci register: material (R MA ) and virtual (R VA ) For the three first techniques, they are possible on both the material and the virtual Chinese abacus. For the fourth one, the technique is available on the material but not on the virtual one.

Techniques T Technologies τ (R A , T 1 )

To activate one 5-unit counter.

To activate three 1-unit counters.

That means two gestures.

(R A , τ 1 ) This is a reasoning that reveals that this student knows well to decompose numbers additively, we call it a calculating reasoning.

8=5+3 (two gestures) (R A , T 2 )
To activate one 5-unit counter first. After to activate three 1-unit counters in three gestures.

(R A , τ 2 ) This student knows that the beads in the upper part count for five. She/he is able to make the difference between quantity (of beads) and value (of beads here five per rod). After five, this student over-count, one by one. She/he is more confident up to five and after needs to overcount. 8=5+1+1+1

(R A , T 3 ) To activate five 1-unit counters, in five gesture.

To exchange five 1-unit counters against one 5unit counter (in the units).

To activate three 1-unit counters in three gestures.

(R A , τ 3 ) This is a counting reasoning. 8=(1+1+1+1+1)+1+1+1 and 1+1+1+1+1=5 (R A , T 4 ) To activate five 1-unit counters, in five gesture.

To exchange five 1-unit counters against one 5unit counter (in the units).

To activate the third 1-unit counter in one gesture.

(R A , τ 4 ) This student has a counting reasoning to set five and an ordinality reasoning for three. She/he is more confident with a small number like three and needs to make the exchange to set five. 8=(1+1+1+1+1)+3

(R MA , T 5 ): material abacus To activate one 5-unit counter and three 1-unit counters (in the units) in one gesture. This technique is available on the material abacus but not on the virtual one we use6 .

(R MA , T 5 ) This is a reasoning that revels that this student knows well to decompose numbers, we call it a calculating reasoning. 8=5+3 (one gesture) (Rv A , T 6 ) On the virtual abacus, written number can be shown and students can try different possibilities to display the number 8 on the software (upper left).

(Rv A , τ 6 ) This is a trial/error approach.

 R F fingers register These techniques have several under-techniques depending on the fingers that are shown. Some are easier due to our physical particularity but as well due to the usual way to set numbers in a given culture (see task 1). This register is usual in classrooms and often used for counting with particularities depending on the culture. In France, we always start with the thumb to count on fingers for example. If we see someone starting with the little finger or the index finger, we know she/he is not French! For example, different studies looked at African languages and gestures about counting and had shown that counting on fingers is not universal but is a cultural and social result [START_REF] Zaslavsky | Africa counts. Number and pattern in african cultures[END_REF][START_REF] Gerdes | L'ethnomathématique en Afrique[END_REF]. The chambaa and the makonde ways of counting on fingers is very interesting to study (Gerdes, 2009, p.133-134). The chambaa people use one hand to set four but grouping twice two (4=2+2, one hand), six is set on two hands (6=3+3), for seven fingers show 7=(2+2)+3 and eight is 8=(2+2)+(2+2). Another example: the makonde people use two hands to count up to four and the folded fingers mark the numbers: one is the folded little finger and one more is folded up to four.

We show here the task to set a number on fingers has different techniques linked to the different decomposition of numbers and is a resource for teaching. In this analysis we show only two techniques. We think we can use fingers to show some other decompositions of 8 but it is delicate to describe it here as it has a dynamic way of grouping fingers. The decomposition 8=6+2 on hands can be: first 8=5+3 and after the thumb of the second hand in the fist of the other hand. Similar gestures are possible to show that 8=8+0 and 8=1+7.  R O oral languages register A language reflects the way we see the world and mathematics is a modelling of the world. Each language has a special way to say numbers, space, measuring, etc. (see for example Barton, 2006). The mathematical modelling -that is to say the technology-associated to an oral number system is different for every language. We show that for the example of the way numbers are said in four languages 7 : English, French, Maori and Breton. (In the Breton case, see [START_REF] Poisard | Enseignement et apprentissage des mathématiques à l'école primaire dans un contexte bilingue breton-fran\ais[END_REF][START_REF] Kervran | Langues minoritaires locales et conceptualisation à l'école : l 'exemple de l'enseignement des mathématiques en breton[END_REF] for more details). We present here languages as a resource for the teaching and learning of mathematics, and more precisely as both a register and a technique. Indeed, we argue that looking at other languages helps understanding our own language (or languages); and for the mathematical vocabulary helps understanding mathematics. We take here four very different languages for oral number system (for some other examples, see Ascher 2002). In the units: to activate three 1-unit counters and two 5-unit counters.

In the tens: to activate one 5-unit counter and one 1-unit counter.

(R A , τ 2 ) This is similar to the French way of saying 73: soixante-treize (literally sixty-thirteen). 73=60+13

(Rv A , T 3 ) On the virtual abacus, written number can be shown and students can try different possibilities to display the number 3 on the software (upper left).

(Rv A , τ 3 ) This is a trial/error approach.

The analysis of these three tasks referring to four different registers show that the mathematical knowledge depends on both the register and the technique used by students. Depending on students' choices of technique, we analyse her/his knowledge. The mathematical knowledge describes here is about the difference between quantity and value, the counting, ordinality, and calculating reasonings, the decomposition of numbers. The notion of commutativity of the addition is also raised. For one register, different techniques are available, and we can see that sometimes one technique is possible in different registers (Table 2). The articulation of these registers are very important for teachers. A teacher can give a task orally or written, and this is different to say a number (see the example of 73), to write it in digits, or in letters as well. From this task, students have to set it on the abacus, the material one, the virtual one, or a worksheet but it is also possible on fingers. The virtual abacus has a very specific feature as the number is set on the abacus and can be shown in numbers as well. The abacus is introduced as a resource for teaching but can not replace some other resources. We can see it clearly with the task to set 8: the Chinese abacus allows to work on the decomposition 5+3 which is very important to learn mental calculation, but does not work on other decompositions of 8 like 4+4. Fingers allow to work on 4+4 for example. Looking carefully at students' activity and gestures to set 8 can help teacher to understand students' level about: value and quantity, counting up to 5 and 8, ordinality, and calculating. Moreover, oral number system is a resource for teaching, a language is not transparent to teach mathematics. The analysis of the task to set and say 73 shows that the abacus can help understand the French way of saying 73 (sixty-thirteen), whereas the English and Maori languages are close to the economical inscription. In the Breton case, we think that to identify clearly for students the technology: 73=3+10+3×20 is a resource for teaching Breton oral number system.

CONCLUSION

This work is about coding numbers and the associated knowledge about this code. For example, for a small number like three, we can say it, write it in digits, write it in letters, show it on one hand, show it on two hands, set it on an abacus, say it in another language, etc. All these registers refer to a specific knowledge, more precisely for one register different techniques are possible and a technique can be used in different registers. This is this articulation between registers and techniques that makes it a resource for teaching and learning mathematics. Students need to recognise a number in different registers and techniques to understand the meaning of what is a number. We see it described by Ester, Deborah and Rose in their interviews and we analyse it precisely for three tasks. We show how the articulation between registers and techniques is possible. For Duval, if a student is able to achieve a task in at least two registers, it means this student understands the mathematical knowledge concerns. We think that to identify students' understanding the articulation between a register and the notion of technique/technology is more precise. For a given task, we argue that:  for one register, at least two techniques are needed to make sure of students' understanding  for one technique, at least two registers are needed to make sure of students' understanding Identifying students' activity is central in teachers' documentation work. This is a central resource for teaching. And this is as well a central question for teacher training: the description and the analysis of different students' techniques (called sometimes procedures) and registers should have a large place in trainings.

Moreover, this study makes an important place to new technologies: the virtual abacus is used on computers by both students and teachers, the video-projector and the IWB is a central resource for teachers in the class, etc. With the material abacus, some teachers use a viewer, so the material abacus is entering in the digital area as well! But in some schools, with less technologies a paper poster of the abacus with magnets makes it possible to be used in class. We show here that new technologies bring new appropriations by teachers and this is also a question of articulation: between material and virtual resources.

  , we have three different decompositions of 25: -Inscription A: economical inscription: 25=20+5=(10+10)+5 -Inscription B: 25=20+5=(10+10)+(1+1+1+1+1) -Inscription C: 25=10+15=(10)+(5+5+1+1+1+1+1). These three inscriptions are three different techniques to set 25 on the Chinese abacus. For each technique, there is a specific mathematical knowledge associated concerning the decomposition of 25. We develop the different possibilities to set a number and the mathematical knowledge associated in part 3 with the analysis of different tasks depending on the register. A B C FIGURE 2: Three inscriptions of 25: economical inscription (left) and the two other ones Rau et al (

  fingers on one hand, and three fingers on the other one. (R F , τ 1 ) This technique is very often used, sometimes it is the only one used by primary teachers in this register (in France). 8=3+5 (R F , T 2 ) To set four fingers on one hand, and four fingers on the other one. (R F , τ 2 ) This technique work on addition of doubles very important to learn calculation: 8=4+4 3.3 Task 3: "to set and say the number 73"

  is not far from a regular form that would be seven-ten(and) three: 73=7×10+3. (R O , T 2 ) in French soixante-treize literally sixty-thirteen (R O , τ 2 ) In French, there is a reference to a 60 grouping that we can find in time (60 seconds in a minute): 73=60+13 (R O , T 3 ) in Maori whitu tekau ma toru literally seven-tens and three (R O , τ 3 ) Modern Maori has a regular way to say numbers that is to say the way numbers are said is the same as the mathematical meaning (polynomial development): 73=7×10+3 (R O , T 4 ) in Breton trizek ha tri-ugent, literally three-ten and threetwenty. (thirteen is said three-ten in Breton). (R O , τ 4 ) As a Celtic language, Breton use vigesimal (base 20) grouping to say numbers: 73=3+10+3×20.  R A abaci register 7 Acknowledgments to Tony Trinick (Maori) and Erwan Le Pipec (Breton).

  the units: to activate three 1-unit counters. In the tens: to activate one 5-unit counter and two 1-unit counters.(R A , τ 1 ) This is the economical inscription of 73: This is very similar to what is said in Maori or in Chinese. 73=7×10+3 (R A , T 2 )

TABLE 2 :

 2 Articulation of registers for the three tasks

The ordinality is the position of a number into the natural number sequence (ex: the third bead) and the cardinality is a quantity (ex: three beads).

For this figure, there is no scale between the frameworks. The aim is to show interactions between these frameworks.

The Sésamath Chinese abacus online: http://cii.sesamath.net/lille/exos_boulier/boulier.swf . The pictures in this paper are taken from this software.

CP : Cours Préparatoire, CM : Cours Moyen.

In France, primary teachers can teach students aged from 2-3 years old (first year of "école maternelle") to 10-11 years old (last year of "école élémentaire").

Some virtual abacus, in particular applications for tablets can set eight in one gesture.


Rémi Domingues

Francesco Buonora

Romain Senesi

Olivier Thonnard

An application of unsupervised fraud detection to Passenger Name Records

Keywords: fraud detection, outlier detection, unsupervised learning, Passenger Name Record

published or not. The documents may come   L'archive ouverte pluridisciplinaire

Introduction

The reservation system of Amadeus, a Global Distribution System (GDS) providing several platforms connecting the travel ecosystem, is targeted by fraud attempts that could lead to revenue losses and indemnifications. Those fraud attempts are supposedly performed by travel agencies in charge of flight booking operations and are motivated by a potential access to undeserved advantages, such as unmerited financial incentives. To our knowledge, this paper is the first one applying unsupervised fraud detection to Passenger Name Records (PNR) and benefits from the dataset of one of the leading GDS managing almost half of the flight bookings worldwide.

Despite the continuous progress in securing communication methods and information systems, the complexity of most systems and the ingenuity of some fraudsters allow new forms of fraud to be performed every day. This fact added to the critical value of money flows and company assets has made fraud detection an active research area making extensive use of machine learning techniques.

A possible approach to fraud detection relies on supervised learning to block fraud attempts based on fraudulent and non-fraudulent samples. A class of widely used algorithms rely on rule-based detection, automatically inferring discriminative rules from a labelled training set. Fawcett at al. [START_REF] Fawcett | Adaptive fraud detection[END_REF] describe an automatic rule generation algorithm applied to cellular cloning performing better than manually generated rules based on expert knowledge. Other techniques based on decision trees [START_REF] Gehrke | Boatoptimistic decision tree construction[END_REF] or Support Vector Machine (SVM) algorithms provide good results with more than 90% of correct classification rate when applied to mobile phone fraud detection, especially when combined using ensemble methods such as bagging or boosting as shown in [START_REF] Kim | Constructing support vector machine ensemble[END_REF]. The efficiency of artificial neural networks for fraud detection has been demonstrated by Ghosh et al. using credit card transactions as input of a feed-forward RBF network [START_REF] Ghosh | Credit card fraud detection with a neural-network[END_REF]. When a fraud-free dataset is available, supervised novelty detection techniques like one-class SVM can be used, fitting a novelty boundary to a given class using kernel methods and a parametric slack. This algorithm is detailed in section 3.1 Nevertheless, a labelled dataset is not available in many real-world applications which prevents the use of supervised learning. Supervised algorithms may besides suffer from unbalanced class sizes resulting in a poor detection. In addition, such techniques cannot identify new fraud patterns and will thus be ineffective at stopping uncovered fraud behaviors. Unsupervised methods can contribute to reduce the delay between a new flaw detection and its resolution and thus grant a strong competitive advantage to targeted companies.

Unsupervised learning allows the discovery of suspicious behaviors and do not require any prior knowledge on verified fraudulent cases. It is the result of a preliminary learning step modelling an expected standard behavior followed by an outlier detection step from which anomalies can be detected.

Among unsupervised techniques, probabilistic methods estimate the probability density function (PDF) of a dataset. Such algorithms include Gaussian Mixture Model (GMM) [START_REF] Geoffrey | Mixture models. inference and applications to clustering[END_REF] which can be an input for multivariate novelty detection in extreme value theory (EVT) [START_REF] Andrew | Novelty detection with multivariate extreme value statistics[END_REF]. Kernel density estimation (KDE), also known as Parzen window, is a nonparametric technique which has been successfully applied to network intrusion detection [START_REF] Yeung | Parzen-window network intrusion detectors[END_REF]. Gaussian Processes is another probabilistic example and it allows one-class classification for novelty detection [START_REF] Murray | The gaussian process density sampler[END_REF].

When dealing with temporal event sequences, Hidden Markov Model (HMM) has proven to be an efficient statespace model to represent a system. It enables the computation of the likelihood for a given pattern which can be thresholded to reject sequences of low probability [START_REF] Yeung | Host-based intrusion detection using dynamic and static behavioral models[END_REF].

Distance-based methods such as clustering can be used to characterise normal classes by a sufficient number of data points close to each other. Among some well-known clustering algorithms for outlier and novelty detection is the k-Nearest Neighbors (kNN) algorithm, but also k-means [START_REF] Kim | Machine learning-based novelty detection for faulty wafer detection in semiconductor manufacturing[END_REF] and some of its extensions such as fuzzy c-means.

As part of non-distance based methods, Guha et al. have developed a robust hierarchical clustering algorithm called ROCK [START_REF] Guha | Rock: A robust clustering algorithm for categorical attributes[END_REF], which employs links instead of distances when merging clusters. ROCK clustering and similar non-distance techniques extend to non-metric similarity measures that are relevant in situations where some notion of domain similarity represented by links (or relationships) is the only source of knowledge.

Artificial neural networks provide also ways to identify outliers, either by using a Self-Organizing Map (SOM) as demonstrated in [START_REF] Muñoz | Self-organizing maps for outlier detection[END_REF], or by thresholding the value of the energy function output by a Hopfield network in [START_REF] Paul A Crook | A tale of two filters-on-line novelty detection[END_REF]. This paper focuses on the Passenger Name Record (PNR) standard described in section 2 and used by Global Distribution Systems (GDS) to store and exchange traveller information and requests on passenger itineraries. We describe a benchmark of several unsupervised fraud detection methods applied to multivariate data pertaining to PNR's, including but not limited to Gaussian Mixture Models (GMM), Hidden Markov Models (HMM), density clustering (DBSCAN), hierarchical clustering and Self-Organizing Maps (SOM). Several aggregation operators related to multicriteria decision analysis (MCDA) are also compared in the context of ensemble methods. We show that combining algorithms using MCDA operators gives greater results than any single algorithm.

Dataset

A Passenger Name Record (PNR) is a database record containing information related to the itinerary of one or more passengers created by travel operators (e.g. travel agents, online travel agencies), travel providers (e.g. airlines), a third-party GDS or computer reservation systems (CRS). It is mostly used for the booking and check-in procedures and can target itineraries containing several flight segments. It includes but is not limited to information about passengers (names, addresses), frequent flyer status, flight segments (IATA codes, flights schedules), special service requests (seats, luggage, meals), tickets, forms of payment, the travel agents source of the booking or modifications and references to other PNRs for split group records. This record is divided in an ordered list of envelopes following the EDIFACT standard [START_REF] Colin | Edifact implementation guide. Passenger and airport data interchange standards[END_REF], each of them describing the current state of the PNR and the list of changes applied during the last transaction. Most frauds can only be achieved by performing a specific sequence of actions and thus require to study the complete modification history to be detected.

The dataset used by our experiment is a random sample of 40,000 PNRs created in 2015 and containing a total of 850,000 envelopes weighting 20GB. 58 relevant features have been defined by PNR and fraud experts to be extracted per envelope and to represent the most important operations. Most of them are either timestamps (e.g. creation date of an envelope) or counters covering the number of points of sale, the changes applied to passengers, frequent traveller cards, segments (segment marriages, special service requests) and forms of payment (FoP). The complete list of actions performed in the envelope is also extracted though does not follow the original sequence order. To work at PNR level, we aggregate the envelopes into a single feature vector of 83 features per PNR using a Hadoop Map-Reduce job. The aggregation process computes the number of envelopes, the age of the PNR and aggregates most features using maximums, sums, averages, standard deviations and ratios (e.g. f inal number of segments sum of added segments ). 82 features are thus numeric while the 83 rd feature is the concatenated list of actions. The distribution of a subset of aggregated features is described in Table 1 with quantiles and other standard statistical measures. It shows strong outliers and already suggests some potential frauds. Statistical estimators combined with an indepth analysis of the envelopes allowed us to identify 0.6% of fraudulent PNRs across 5 types of known frauds. An example of fraud carried out by travel agents is to make a booking without issuing payment, then take advantage of some booking engine functionalities to lock the booking for an unlimited period without observing the usual automatic cancellation of the ticket and price increase. Other fraud examples rely on flooding operations or abusive use of frequent flyer cards to be granted higher privileges.

Based on the hypothesis that the remaining PNRs are not fraudulent, we use this labelled dataset to evaluate the performances of the algorithms. Note that the computation of the precision and recall on this dataset will possibly exclude a few samples related to unknown frauds and must thus be adjusted when new frauds are discovered.

Outlier detection

Once the feature vector and sequence of actions of each PNR have been extracted and aggregated, outliers are detected according to the algorithms described in this Section.

Algorithms

The algorithms described hereafter cover several approaches of outlier detection though do not relate specifically to user behavior modelling since we focus on PNRs. A user-centric approach would be inappropriate to the extent that travel agents create and modify an important number of PNRs and each PNR can be modified by multiple agents. Half of the labelled dataset was used to perform a hyperparameter optimization for each algorithm targeting a maximum F1-score. The F1-score is the harmonic mean of precision and recall defined by F 1 = 2 * precision * recall precision+recall . The best parameters were then used on the other half of the dataset to measure the precision, recall and F1-score for the testing phase. The performance measures written in this paper target the testing dataset in order to prevent overfitting. The following algorithms take the 82 numeric features as input, with the exception of HMM which uses the sequence of actions.

Probabilistic approaches considered here include the median absolute deviation (MAD) recommended for univariate outlier detection in [START_REF] Leys | Detecting outliers: Do not use standard deviation around the mean, use absolute deviation around the median[END_REF]. It is a robust statistical measure computed as follows:

M AD = bM (|x i -M |) (1)
with b = 1.4826 a multiplicative constant used for normal distributions, x i the values of an univariate dataset and M the median of the dataset. This measure can be used to identify outliers by thresholding the number of MAD between x i and the median of the dataset as shown in:

x i -M M AD > ±t (2)
The overall score of a feature vector is then the maximum score obtained in each separate feature. Yet, this measure would flag as outliers any value different than the median if more than 50% of the data points have the same value, which has been observed for several features in our dataset.

This strong limitation prevent an efficient application of the MAD, which is why our benchmark used Z-score instead of MAD. This measure follows the same principles though is less robust since it relies on the average and standard deviation of the dataset µ and σ, performing a relaxed outlier detection in equation 3.

x i -µ σ > ±t (3)
A Gaussian Mixture Model (GMM) has also been used to iteratively estimate the multivariate and multimodal distribution of the dataset where each feature is represented by a weighted sum of K normal distributions

P (x) = K k=1 π k N (x; µ k , σ 2 k )
where K k=1 π k = 1 and π k > 0 using an expectation-maximization (EM) algorithm to estimate the Gaussian parameters optimizing the loglikelihood. Thresholding the likelihood of a feature vector under the model allows a more efficient outlier detection than most algorithms according to the precision and recall described in Section 4.

Several distance based algorithms have been applied and raise the question of an efficient distance metric. The Euclidean and Mahalanobis distances have been used, the latter computing the distance between a given feature vector and the mean of the dataset normalized by the standard deviation of each dimension and adjusted for the covariance of those dimensions. DBSCAN is a robust parametric algorithm finding clusters of arbitrary shape in large datasets based on a density approach. Data points having less than m neighbors in a given radius are not clustered and thus flagged as outliers. This algorithm has been tested using Euclidean and Mahalanobis distances.

MeanShift is a clustering algorithm designed for datasets of smooth density and computes the centroids of clusters by optimizing the density function

f (x) = i K(x -x i ) = i k ||x-xi|| 2 h 2
with K a kernel function, x the initial estimate of the maximum of the density function, h a bandwidth given in parameter or estimated and x i an input vector. A local maxima of this function is computed with gradient descent and results in cluster boundaries depending on the kernel function. This algorithm can be considered as a generalized expectation-maximization algorithm [START_REF] Miguel | Gaussian mean-shift is an em algorithm[END_REF] and identifies outliers by selecting data points lying far away from the centroids of the clusters.

One-class SVM extends support vector machines (SVMs) by making use of unlabelled data to perform novelty detection. Standard SVM algorithms are binary classifiers finding a boundary between two classes by computing a linearly separating hyperplane in a high-dimensional space. The computations in high-dimensional space are achieved using kernel methods mapping points from the feature space to the high-dimensional space. One-class SVM fits a novelty detection boundary surrounding the training dataset by maximizing the margin between the dataset and the origin in the high-dimensional space. Overfitting is avoided by allowing a percentage of data points to fall outside the boundary using a regularization parameter ν which is an upper bound on the fraction of margin errors and a lower bound on the fraction of support vectors with 0 < ν ≤ 1.

Hierarchical clustering builds a hierarchy of clusters according to an agglomerative or divisive approach, for example by minimizing the increase of total withincluster variance after a merging step of the agglomerative process (Ward's method). Outliers can be further deduced by thresholding the outlyingness of the feature vectors computed according to the equations described in [START_REF] Torgo | Package dmwr. Comprehensive R Archive Network[END_REF].

Regarding artificial neural networks, we implemented a Self-Organizing Map (SOM) mapping points from an input space to an output space. The output space is usually a 2dimensional grid of neurons (Figure 3 after PCA processing for 2 components). Neurons are points in the feature space iteratively trained by being moved closer to dense regions of data along with their neighbors. Outliers can be further identified according to [START_REF] Muñoz | Self-organizing maps for outlier detection[END_REF] by thresholding the quantization errors (Figure 1), i.e. Euclidean distances between a point and the closest neuron. An additional step is required to detect outlying neurons attracted by clouds of outliers. Those are found by putting a threshold on the median interneuron distance (MID) matrix (Figure 2) containing the median of the distance between each neuron and its neighbors. The projections of known fraud samples on the nodes of the network are depicted by 5 distinct graphical artefacts in Figure 2. A distributed version of this algorithm showing similar results and convergence has been implemented based on the work of Lawrence et al. [START_REF] Lawrence | A scalable parallel algorithm for self-organizing maps with applications to sparse data mining problems[END_REF]. As an additional set of experiments, we make use of the sequence of actions extracted and feed it into a Hidden Markov Model (HMM). This state-based approach models actions as observations which are generated by hidden states, each state having its own probability distribution. The system is then modelled as a Markov process describing the transition probabilities between the different states. Applying a threshold to the normalized log-likelihood of a sequence of actions under the model allows for outlier detection. The number of components used by the HMM is also found by hyperparameter optimization.

Multi-criteria decision analysis (MCDA)

The algorithms previously described output either a probability, a binary decision or a score which can be normalized according to an upper bound, e.g. by setting a maximum Z-score and assigning an outlier probability equal to 1 to all higher scores. Intuitively, aggregating the output of several algorithms will result in final scores conveying more confidence and leading to better performances than any single algorithm. To verify this assumption, we use Multi-Criteria Decision Analysis (MCDA) to design an aggregation model for the calculation of combined scores, taking as input all normalized scores given by individual algorithms.

One of the simplest MCDA operator is the weighted average W A(x 1 , .., x n ) = n i=1 w i x i with x i a score and w i a weight adjusted to the performance of a given algorithm, e.g. a F1-score. In the family of averaging functions, the Ordered Weighted Average (OWA) operator extends these functions by combining two characteristics: (i) a weighting vector (like in a classical weighted mean), and (ii) sorting the inputs (usually in descending order). OWA is a nonlinear operator assigning a weight to each score based on its rank σ i in the sorted list of scores (equation 4). OWA differs from a classical weighted means in that the weights are not associated with particular inputs, but rather with their magnitude. It can thus emphasize a subset of largest, smallest or mid-range values. In our application, the weights w i are assigned based on a normal distribution such that the closer a score is to the middle one in the ranking, the higher the weight. The detailed method is described in [START_REF] Xu | An overview of methods for determining owa weights[END_REF]. Note that x σi <= x σi+1 and w i = 1.

OW A(x 1 , .., x n ) = n i=1 w i x σi (4)
As further generalization of OWA, Weighted Ordered Weighted Averaging (WOWA) [START_REF] Vicenc ¸torra | The weighted owa operator[END_REF] merges WA and OWA, by quantifying the reliability of the information sources (i.e. algorithms output in this case) with a vector p, and at the same time, allows to weight the values in relation to their relative ordering with a second vector w (as the OWA operator). It is formally defined as:

W OW A(x 1 , .., x n ) = n i=1 x σi   h( j≤i p σj ) -h( j≤i-1 p σj )   (5)
where h : [0, 1] → [0, 1] is a non-decreasing function interpolating the points ( i n , j≤i w j ) together with the point (0, 0). We can observe that if p = ( 1 n , ..., 1 n ) then WOWA returns the same result as OWA.

Results

Figure 4 shows the precision-recall curve obtained for a testing dataset containing 0.6% of known fraud samples. The highest F1-score reached on the plot is the weighted average of Z-score and self-organizing map. A precision below 100% is preferable since we are interested in unknown fraud discovery.

According to the results depicted, Euclidean distance (minClustSize = 55, eps = 0.086) provides better results than Mahalanobis distance (minClustSize = 77, eps = 14.5) when applied in DBSCAN. Though the latter has proven to be efficient in outlier detection performed on multivariate normal distributions, such hypothesis does not match most dimensions of our dataset. MeanShift (seeds = Due to a dataset of complex distribution contaminated by outliers, one-class SVM (kernel = RBF, γ = 0.07, ν = 0.01) is not able to model accurately a novelty boundary and does not perform much better than the previous algorithms, even though it makes an extensive use of the kernel trick to handle high dimensional data. Despite non-Gaussian distributions, Z-score (t = 17) is able to perform as well as oneclass SVM due to the extreme values inherent to some fraud types such as flooding. Better results are also obtained from hierarchical clustering (m = sizeDif f, t = 0.88) though it requires the longest computation time. Since valuable information is lost by reordering the actions performed in each envelope, it prevents an efficient fraud detection from HMM (states = 13, t = 0.67). This algorithm also fails in detecting frauds relying on an important use of common actions when using a normalized log-likelihood.

The highest F1-score is reached with self-organizing maps (neurons = 100, iterations = 40, qe Z-scoret = 5.0, mid t = 0.75), reaching 28% precision for 84% recall. Figure 2 shows most fraud samples projecting on neurons having a high MID. Setting a MID threshold to 0.75 flags those neurons as outlying and allows a high recall while limiting the number of false positives.

All algorithms except HMM were able to detect much more easily the samples of 3 fraud classes among the 5 in the dataset. For those classes, some numeric features showed significant differences with the dataset average (e.g. flooding) or clear repetitions of actions at fixed intervals. HMM performed poorly on those frauds which involve a high number of common actions. However, it outperformed the other algorithms on a fraud based on unusual sequences of actions.

We remind here that DBSCAN and hierarchical cluster-ing can only perform batch predictions for outlier detection and thus cannot compare a single PNR to an existing model, which may be an important limitation leading to model variations. MeanShift, SOM and one-class SVM return a binary output while the prediction step of GMM, Z-score and HMM compute an outlier score given an input vector. This score is turned into a ranking, hence making possible a fast insight on the most suspicious PNRs. The benchmark of the aggregation operators has been performed with Z-score, hierarchical clustering and SOM. However, it does not allow us to assess the dominance of an operator over the others since OWA and WOWA require a higher number of values to demonstrate their efficiency. Nevertheless, excellent performances are achieved by aggregating the scores provided by Z-score and SOM, reaching 55% precision for 80% recall. Those two models perform fast computations on streaming data and predict the outlier score of up to 2,700 feature vectors per second and per thread. An in-depth study of the remaining unknown outliers revealed 3 new types of fraud and several misuses. The detailed results are given in Table 2. Since the best performances were achieved by aggregating Z-score and SOM, we implemented a distributed version of both algorithms. If Z-score is embarrassingly parallel, implementing a distributed SOM requires new equations to train the network on several chunks of data [START_REF] Lawrence | A scalable parallel algorithm for self-organizing maps with applications to sparse data mining problems[END_REF]. The speedup obtained by the distributed training of SOM is plotted in Figure 5 running in Scala on Spark with a hyperthreaded quad-core.

Conclusions and future work

We have performed an evaluation of 8 widely used machine learning algorithms and 3 MCDA operators in the context of unsupervised fraud detection applied to a particular dataset used in the global travel industry: Passenger Name Records (PNRs). Several distance metrics and outlier detection methods have been applied and result in a scalable and distributed model able to handle streaming data while performing an efficient fraud detection reaching currently 55% precision for 80% recall. Frauds detected by the final model can be ranked and provide a quick insight of the most critical situations. While we cannot disclose details on the specific frauds discovered in this study (for confidentiality reasons), the process described here has shown to be efficient for unsupervised fraud detection and can be applied to identify and prevent exploited flaws in Global Distribution Systems.

Future work includes an improvement of the system with a data enrichment step extending existing features by retrieving the location and time zone of the bookings based on airlines IATA codes, airports and travel agencies information.

We also consider a complementary evaluation focusing on the model robustness while removing the supervised optimization of the hyperparameters. This evaluation will aggregate the Z-scores of individual features according to the methods described in Section 3.2 to increase the precision of the algorithm and will use a reconstruction-based SOM to estimate the size of the neural network fitting the dataset. The number of components used by the GMM and HMM algorithms should be inferred by choosing a Dirichlet Process as a prior distribution on the number of clusters as described in [START_REF] David M Blei | Variational inference for dirichlet process mixtures[END_REF].

Fed by the output of a preliminary supervised fraud detection process, such an ensemble unsupervised detection system will reinforce the overall fraud detection by returning previously undetected fraudulent samples to supervised algorithms in order to subsequently improve their detection capabilities. Faster manual fraud checks based on ranked outliers will be achieved by a visual analytics interface relying on box-plots and cross filters.

Figure 1 .Figure 2 .Figure 3 .

 123 Figure 1. Box plot -Quantization errors Figure 2. MID matrix -10x10 SOM

Figure 4 .

 4 Figure 4. Precision-recall curves

Figure 5 .

 5 Figure 5. Computation time for the distributed SOM

TABLE 1 .

 1 DISTRIBUTION OF 5 AGGREGATED FEATURES

	Feature	n envelope	age hours n segment	n split	n fop
	mean	21.076	789.528	4.780	0.097	0.863
	std	30.367	1326.969	22.846	0.599	1.400
	min	1.000	0.000	0.000	0.000	0.000
	5%	3.000	0.109	0.000	0.000	0.000
	25%	6.000	45.538	2.000	0.000	0.000
	50%	13.000	273.224	3.000	0.000	1.000
	75%	26.000	856.738	5.000	0.000	1.000
	95%	61.000	3547.940	12.000	1.000	3.000
	max	1471.000 50258.785	2342.000 27.000 69.000

TABLE 2 .

 2 ALGORITHMS BENCHMARKING RESULTS OF PNR FRAUD

		DETECTION
	Algorithm	Best F1-score	Precision	Recall
	DBSCAN (Euclidean)	0.25	18.64	36.36
	DBSCAN (Mahalanobis)	0.19	15.31	26.45
	MeanShift	0.21	13.03	58.68
	GMM	0.28	23.24	35.54
	One-class SVM	0.26	23.49	28.93
	Z-score	0.29	33.71	24.79
	Hierarchical	0.35	27.11	50.41
	HMM	0.26	24.44	27.27
	SOM	0.42	27.64	84.30
	Distributed Z-score	0.29	33.71	24.79
	Distributed SOM	0.56	43.66	76.86
	WA	0.55	39.78	88.43
	OWA	0.57	76.39	45.45
	WOWA	0.56	74.32	45.45
	Z-score & SOM	0.63	50.75	83.47
	Distributed Z-score & SOM	0.66	55.43	80.17

Acknowledgment

The authors would like to thank Prof. Maurizio Flippone for reviewing this paper and providing insightful comments.