Systems and user interfaces for holistic, data-driven investigation of bad actor behavior based on clustering and scoring of related data
View Patent ↗Embodiments of the present disclosure relate to a data analysis system that may automatically generate memory-efficient clustered data structures, automatically analyze those clustered data structures, automatically tag and group those clustered data structures, and provide results of the automated analysis and grouping in an optimized way to an analyst. The automated analysis of the clustered data structures (also referred to herein as data clusters) may include an automated application of various criteria, rules, indicators, or scenarios so as to generate scores, reports, alerts, or conclusions that the analyst may quickly and efficiently use to evaluate the groups of data clusters. In particular, the groups of data clusters may be dynamically re-grouped and/or filtered in an interactive user interface so as to enable an analyst to quickly navigate among information associated with various groups of data clusters and efficiently evaluate those data clusters in the context of, for example, a risky trading investigation.
1. A computer system comprising:
one or more computer readable storage devices configured to store:
a plurality of computer executable instructions;
at least one data cluster stored in a memory of the computer system, wherein the at least one data cluster is associated with a data clustering strategy and is generated according to the data clustering strategy, the data cluster including at least:
a plurality of trade data items including information associated with trades of a trader;
a plurality of external event data items including information associated with at least one of a trade confirmation, a trade settlement, an exchange margining, or a cash flow associated with a trade;
a plurality of logical connections among the data items in the data cluster, wherein each logical connection indicates a relationship between at least two of the data items; and
wherein all the data items in the data cluster are linked with one another, either directly or indirectly, by the logical connections;
a plurality of trading risk indicators including a first trading risk indicator and a second trading risk indicator, wherein the first trading risk indicator is a control timing arbitrage indicator for detecting whether a trader is routinely cancelling or amending trades prior to an external event to create a positive change to the trader's PNL; and
one or more hardware computer processors in communication with the one or more computer readable storage devices and configured to execute the plurality of computer executable instructions in order to cause the computer system to:
access the data cluster, including the plurality of trade data items and the plurality of external event data items, from the one or more computer readable storage devices;
access the control timing arbitrage indicator from the one or more computer readable storage devices; and
apply the control timing arbitrage indicator to the data cluster by:
analyzing the plurality of trade data items to identify cancelled or amended trades of the trader;
determining a cancellation or amendment time associated with each cancelled or amended trade of the trader;
analyzing the plurality of external event data items to identify a subset of external event data items, wherein each external event data item of the subset of external event data items is associated with a respective one of the cancelled or amended trades of the trader and a time that is after the cancelation or amendment time associated with the respective one of the cancelled or amended trades of the trader; and
generating an alert in response to determining that the subset of external event data items includes more external event data items than a threshold number of external event data items
access the second trading risk indicator from the one or more computer readable storage devices; and
apply the second trading risk indicator to the data cluster by:
analyzing at least a subset of the plurality of trade data items and external event data items analyzed through applying the control arbitrage timing indicator.
2. The computer system of claim 1 , wherein the at least one data cluster is further associated with data cluster analysis rules and/or data cluster scoring rules that comprise:
the first trading risk indicator, wherein the first trading risk indicator is configured for indicating at least one of heightened risk or reduced risk, and wherein the first trading risk indicator is observable or computable from the data items in the particular data cluster.
3. The computer system of claim 2 , wherein the plurality of computer executable instructions further cause the computer system to generate user interface data for rendering an interactive user interface on a computing device, the interactive user interface including one or more selectable elements useable by a user for indicating the generated alert.
4. The computer system of claim 3 , wherein the plurality of computer executable instructions further cause the computer system to use at least the generated alert to generate a summary report based on the data cluster analysis rules and/or the data cluster scoring rules.
5. The computer system of claim 4 , wherein the plurality of computer executable instructions further cause the computer system to receive feedback from the user through the interactive user interface, the feedback containing a suggestion for improving the summary report generated based on the data cluster analysis rules and/or the data cluster scoring rules.
6. The computer system of claim 5 , wherein the plurality of computer executable instructions further cause the computer system to update the data cluster analysis rules and/or data cluster scoring rules based on the feedback received from the user for improving the generated summary report.
7. The computer system of claim 1 , wherein the second trading risk indicator is a possible dummy trade indicator for identifying when a trade is cancelled or amended before an external event that might affirm the trade is real, and wherein the one or more hardware computer processors are configured to execute the plurality of computer executable instructions in order to further cause the computer system to:
access the possible dummy trade indicator from the one or more computer readable storage devices; and
apply the possible dummy trade indicator to the data cluster by:
analyzing the plurality of trade data items to identify cancelled or amended trades of the trader;
determining a cancellation or amendment time associated with each cancelled or amended trade of the trader;
analyzing the plurality of external event data items to identify an external event associated with each cancelled or amended trade;
determining the time associated with the external event associated with each cancelled or amended trade; and
generating an alert in response to determining that the cancellation or amendment time for each cancelled or amended trade is prior to the external event time associated with the cancelled or amended trade.