Applied Artificial Intelligence Technology for Processing Trade Data to Detect Patterns Indicative of Potential Trade Spoofing
Various techniques are described for using machine-learning artificial intelligence to improve how trading data can be processed to detect improper trading behaviors such as trade spoofing. In an example embodiment, semi-supervised machine learning is applied to positively labeled and unlabeled training data to develop a classification model that distinguishes between trading behavior likely to qualify as trade spoofing and trading behavior not likely to qualify as trade spoofing. Also, clustering techniques can be employed to segment larger sets of training data and trading data into bursts of trading activities that are to be assessed for potential trade spoofing status.
1 . A method including:
receiving, by a computer system, trading data, wherein the trading data includes a plurality of time-stamped trade events associated with a particular instrument in a market;
grouping, by the computer system, trade events in the trading data into a plurality of trading clusters based on time proximity according to a burst interval time parameter;
applying, by the computer system, data that represents each trading cluster of the plurality of the trading clusters to a trained classification model data structure to determine a spoofing classification status for each applied trading cluster, wherein the trained classification model data structure was created in response to application of a machine-learning artificial intelligence to training data, wherein the spoofing classification status indicates a likelihood that the applied trading cluster describes trade spoofing in the market;
computing, by the computer system, a spoofing risk score for each trading cluster of the plurality of the trading clusters based on the determined spoofing classification status for each respective trading cluster; and
generating, by the computer system, an alert notification with respect to at least one of the computed spoofing risk scores that exceeds a threshold.
2 . The method of claim 1 , wherein, for each trading cluster of the plurality of trading clusters, times between consecutive trade events are within a time specified by the burst interval time parameter such that consecutive trade events that differ in time by less than the time specified by the burst interval time parameter are grouped in the same trading cluster and consecutive trade events that differ in time by more than the time specified by the burst interval time parameter are grouped in different trading clusters.
3 . The method of claim 1 , wherein grouping the trade events further includes, for each of the trading clusters, including a plurality of trade events in that trading cluster that relate to the same orders that are subjects of the trade events that had been grouped into that trading cluster based on the burst interval time parameter.
4 . The method of claim 1 , further including discarding trading clusters of the plurality of trading clusters that include less than a threshold number of trade events.
5 . The method of claim 1 , wherein the burst interval time parameter is one of: (i) a static value, or (ii) dynamically computed as a function of at least one of: (a) the trading data or (b) data related to the trading data.
6 . The method of claim 1 , further including:
computing, by the computer system, a plurality of values for a plurality of features with respect to each of a plurality of the trading clusters, wherein the computed feature values serve as the applied data that represents the trading clusters.
7 . The method of claim 1 , wherein the alert notification includes the spoofing risk score and an identifier of a trader associated with the trade events of the corresponding trading cluster.
8 . The method of claim 1 , wherein the computing system operates in real-time as new trading data is received.
9 . A tangible, non-transitory computer readable medium including instructions that, when executed, cause at least one processor to perform a set of operations including:
receiving, by a computer system, trading data, wherein the trading data includes a plurality of time-stamped trade events associated with a particular instrument in a market;
grouping, by the computer system, trade events in the trading data into a plurality of trading clusters based on time proximity according to a burst interval time parameter;
applying, by the computer system, data that represents each trading cluster of the plurality of the trading clusters to a trained classification model data structure to determine a spoofing classification status for each applied trading cluster, wherein the trained classification model data structure was created in response to application of a machine-learning artificial intelligence to training data, wherein the spoofing classification status indicates a likelihood that the applied trading cluster describes trade spoofing in the market;
computing, by the computer system, a spoofing risk score for each trading cluster of the plurality of the trading clusters based on the determined spoofing classification status for each respective trading cluster; and
generating, by the computer system, an alert notification with respect to at least one of the computed spoofing risk scores that exceeds a threshold.
10 . The tangible, non-transitory computer readable medium of claim 9 , wherein, for each trading cluster of the plurality of trading clusters, times between consecutive trade events are within a time specified by the burst interval time parameter such that consecutive trade events that differ in time by less than the time specified by the burst interval time parameter are grouped in the same trading cluster and consecutive trade events that differ in time by more than the time specified by the burst interval time parameter are grouped in different trading clusters.
11 . The tangible, non-transitory computer readable medium of claim 9 , wherein grouping the trade events further includes, for each of the trading clusters, including a plurality of trade events in that trading cluster that relate to the same orders that are subjects of the trade events that had been grouped into that trading cluster based on the burst interval time parameter.
12 . The tangible, non-transitory computer readable medium of claim 9 , wherein the set of operations further includes discarding trading clusters of the plurality of trading clusters that include less than a threshold number of trade events.
13 . The tangible, non-transitory computer readable medium of claim 9 , wherein the burst interval time parameter is one of: (i) a static value, or (ii) dynamically computed as a function of at least one of: (a) the trading data or (b) data related to the trading data.
14 . The tangible, non-transitory computer readable medium of claim 9 , wherein the set of operations further includes:
computing, by the computer system, a plurality of values for a plurality of features with respect to each of a plurality of the trading clusters, wherein the computed feature values serve as the applied data that represents the trading clusters.
15 . A system including:
at least one processor; and
a tangible, non-transitory computer readable medium including instructions that, when executed, cause the at least one processor to perform a set of operations including:
receiving, by a computer system, trading data, wherein the trading data includes a plurality of time-stamped trade events associated with a particular instrument in a market;
grouping, by the computer system, trade events in the trading data into a plurality of trading clusters based on time proximity according to a burst interval time parameter;
applying, by the computer system, data that represents each trading cluster of the plurality of the trading clusters to a trained classification model data structure to determine a spoofing classification status for each applied trading cluster, wherein the trained classification model data structure was created in response to application of a machine-learning artificial intelligence to training data, wherein the spoofing classification status indicates a likelihood that the applied trading cluster describes trade spoofing in the market;
computing, by the computer system, a spoofing risk score for each trading cluster of the plurality of the trading clusters based on the determined spoofing classification status for each respective trading cluster; and
generating, by the computer system, an alert notification with respect to at least one of the computed spoofing risk scores that exceeds a threshold.
16 . The system of claim 15 , wherein, for each trading cluster of the plurality of trading clusters, times between consecutive trade events are within a time specified by the burst interval time parameter such that consecutive trade events that differ in time by less than the time specified by the burst interval time parameter are grouped in the same trading cluster and consecutive trade events that differ in time by more than the time specified by the burst interval time parameter are grouped in different trading clusters.
17 . The system of claim 15 , wherein grouping the trade events further includes, for each of the trading clusters, including a plurality of trade events in that trading cluster that relate to the same orders that are subjects of the trade events that had been grouped into that trading cluster based on the burst interval time parameter.
18 . The system of claim 15 , wherein the set of operations further includes discarding trading clusters of the plurality of trading clusters that include less than a threshold number of trade events.
19 . The system of claim 15 , wherein the burst interval time parameter is one of: (i) a static value, or (ii) dynamically computed as a function of at least one of: (a) the trading data or (b) data related to the trading data.
20 . The system of claim 15 , wherein the set of operations further includes:
computing, by the computer system, a plurality of values for a plurality of features with respect to each of a plurality of the trading clusters, wherein the computed feature values serve as the applied data that represents the trading clusters.