Non-parametric statistical behavioral identification ecosystem for electricity fraud detection

A computer-implemented method for detecting electricity fraud, the method comprising:

• validating a detector model and an explanation model using a set of suspicious known cases and a set of explained known cases, respectively, wherein the set of suspicious known cases comprises known cases associated with fraud, the known cases associated with fraud each comprising a suspicious activity of a plurality of suspicious activities identified using the detector model, and wherein the set of explained known cases is a subset of the suspicious known cases each having a legitimate explanation of a plurality of legitimate explanations, identified using the explanation model, for the associated suspicious activity;
• applying the detector model to data items comprising unknown cases to generate a set of suspicious unknown cases, wherein each of the data items comprise electricity demand data associated with a respective electricity meter at a respective service point, and wherein the set of suspicious unknown cases each comprises a suspicious activity of the plurality of suspicious activities;
• applying the explanation model to each of the unknown cases in the set of suspicious unknown cases to generate a set of explained unknown cases, wherein each of the explained unknown cases comprises a legitimate explanation of the plurality of legitimate explanations for the associated suspicious activity;
• and
• removing the set of explained unknown cases from the set of suspicious unknown cases to generate a set of unexplained unknown cases.

A non-transitory computer-readable medium containing program instructions that, upon execution by one or more processors, cause the one or more processors to:

• validate a detector model and an explanation model using a set of suspicious known cases and a set of explained known cases, respectively, wherein the set of suspicious known cases comprises known cases associated with fraud, the known cases associated with fraud each comprising a suspicious activity of a plurality of suspicious activities identified using the detector model, and wherein the set of explained known cases is a subset of the suspicious known cases each having a legitimate explanation of a plurality of legitimate explanations, identified using the explanation model, for the associated suspicious activity;
• apply the detector model to data items comprising unknown cases to generate a set of suspicious unknown cases, wherein each of the data items comprise electricity demand data associated with a respective electricity meter at a respective service point, and wherein the set of suspicious unknown cases each comprises a suspicious activity of the plurality of suspicious activities;
• apply the explanation model to each of the unknown cases in the set of suspicious unknown cases to generate a set of explained unknown cases, wherein each of the explained unknown cases comprises a legitimate explanation of the plurality of legitimate explanations for the associated suspicious activity;
• and
• remove the set of explained unknown cases from the set of suspicious unknown cases to generate a set of unexplained unknown cases.