Analyzing user activity with respect to a composite object
Techniques for analyzing user activity relating to composite objects including at least a first object and a second object are described. The first object and the second object may be objects with respect to which a user, for example, a user in a communications network, can take various actions. Disclosed embodiments allow user activity relating to multiple objects to be analyzed by treating multiple objects as a composite object and generating an analysis of the user activity with respect to the composite object. The results of the analysis may provide an indication of whether the user activity corresponds to a given type of behavior occurring with respect to the composite object. For example, the results may indicate whether the user activity corresponds to manipulation of a status of the composite object or of one or more of the objects included in the composite object.
1 . A method including:
obtaining, by a computing device, a first set of event reports, wherein each event report in the first set of event reports represents a respective event occurring with respect to a first object, and a second set of event reports, wherein each event report in the second set of event reports represents a respective event occurring with respect to a second object different from the first object;
defining, by the computing device, a composite object including the first object and the second object;
generating, by the computing device and using the first set of event reports and the second set of event reports, a list of events occurring with respect to the composite object;
performing, by the computing device, a clustering process with respect to the events in the list of events to generate one or more clusters of events, wherein the clustering process includes generating the one or more clusters of events based on respective times of occurrence of the events, wherein a time interval between consecutive events in a particular cluster is not greater than a pre-determined time interval;
generating, by the computing device and using the one or more clusters of events, an analysis of user activity with respect to the composite object by performing an analysis process with respect to the events in the one or more clusters of events, wherein one or more features of the analysis process are based on a given type of the analysis of the user activity to be generated, wherein the analysis process with respect to the events in the one or more clusters of events includes performing a classification process to determine respective classifications of the one or more clusters of events, wherein a given classification of a given cluster of events is indicative of an estimation of whether the given cluster of events represents the given type of user activity; and
providing, by the computing device, notification to an alert server based on an alert configuration when the analysis of user activity with respect to the composite object indicates a particular behavior.
2 . The method of claim 1 , wherein:
the event reports in the first set of event reports and the event reports in the second set of event reports are indicative of respective times of occurrence of the events represented by the event reports in the first set of event reports and the event reports in the second set of event reports; and
the generating the list of events includes ordering the events based on the respective times of occurrence of the events.
3 . The method of claim 1 , wherein the classification process includes:
computing respective features of the one or more clusters of events; and
determining the respective classifications of the one or more clusters of events based on their respective features by use of a classification model.
4 . The method of claim 1 , wherein the clustering process is based on the given type of the analysis of the user activity to be generated, and wherein the analyzing the clusters includes analyzing the clusters based on the given type of the analysis of the user activity.
5 . The method of claim 1 , further including:
performing a selection process to select, from a plurality of sets of event reports including the first set of event reports and the second set of event reports, wherein the selection process includes:
performing a first analysis process with respect to the events represented by the event reports in the first set of event reports to generate a first analysis of user activity with respect to the first object, wherein the first analysis process includes performing a clustering process with respect to the events represented by the event reports in the first set of event reports to generate a first set of clusters of events;
performing a second analysis process with respect to the events represented by the event reports in the second set of event reports to generate a second analysis of user activity with respect to the second object, wherein the second analysis process includes performing a clustering process with respect to the events represented by the event reports in the second set of event reports to generate a second set of clusters of events; and
selecting, based on the first analysis and the second analysis, the first set of event reports and the second set of event reports, wherein the selecting of the first set of event reports and the second set of event reports is based on a comparison between one or more clusters of the first set of clusters and one or more clusters of the second set of second clusters, wherein the one or more clusters of the first set of clusters and the one or more clusters of the second set of clusters each span a respective time period, wherein the comparison between the one or more clusters of the first set of clusters and the one or more clusters of the second set of clusters includes a determination of whether a respective time period of the one or more clusters of the first set of clusters overlaps in time with a respective time period of the one or more clusters of the second set of clusters, wherein the comparison between the one or more clusters of the first set of clusters and the one or more clusters of the second set of clusters includes:
determining respective classifications of a given cluster of the first set of clusters and a given cluster of the second set of clusters which overlaps in time with the given cluster of the first set of clusters; and
determining if the respective classification of at least one of the overlapping clusters satisfies a pre-determined criterion.
6 . The method of claim 1 , wherein the events occurring with respect to the first object and the events occurring with respect to the second object are events occurring over a same pre-determined elapsed period.
7 . The method of claim 6 , wherein the pre-determined elapsed period is a period of fixed length or a period of a user activity session.
8 . The method of claim 1 , wherein the analysis of the user activity with respect to the composite object includes an indication of an estimation of whether the user activity corresponds to the particular behavior.
9 . The method of claim 1 , wherein the first object and the second object are respective first and second tradable objects, and wherein the events represented by the event reports in the first set of event reports relate to orders on the first tradable object and the events represented by the event reports in the second set of event reports relate to orders on the second tradable object.
10 . The method of claim 9 , wherein the particular behavior includes market manipulation behavior, such as spoofing, front-running or momentum ignition.
11 . A non-transitory computer readable medium having stored therein instructions executable by a processor, wherein the instructions are executable to:
obtain a first set of event reports, wherein each event report in the first set of event reports represents a respective event occurring with respect to a first object, and a second set of event reports, wherein each event report in the second set of event reports represents a respective event occurring with respect to a second object different from the first object;
define a composite object including the first object and the second object;
generate, using the first set of event reports and the second set of event reports, a list of events occurring with respect to the composite object;
perform a clustering process with respect to the events in the list of events to generate one or more clusters of events, wherein the clustering process includes generating the one or more clusters of events based on respective times of occurrence of the events, wherein a time interval between consecutive events in a particular cluster is not greater than a pre-determined time interval;
generate, using the one or more clusters of events, an analysis of user activity with respect to the composite object by performing an analysis process with respect to the events in the one or more clusters of events, wherein one or more features of the analysis process are based on a given type of the analysis of the user activity to be generated, wherein the analysis process with respect to the events in the one or more clusters of events includes performing a classification process to determine respective classifications of the one or more clusters of events, wherein a given classification of a given cluster of events is indicative of an estimation of whether the given cluster of events represents the given type of user activity; and
provide notification to an alert server based on an alert configuration when the analysis of user activity with respect to the composite object indicates a particular behavior.
12 . The non-transitory computer readable medium of claim 11 , wherein:
the event reports in the first set of event reports and the event reports in the second set of event reports are indicative of respective times of occurrence of the events represented by the event reports in the first set of event reports and the event reports in the second set of event reports; and
the generating the list of events includes ordering the events based on the respective times of occurrence of the events.
13 . The non-transitory computer readable medium of claim 11 , wherein the clustering process is based on the given type of the analysis of the user activity to be generated, and wherein the analyzing the clusters includes analyzing the clusters based on the given type of the analysis of the user activity.
14 . The non-transitory computer readable medium of claim 11 , wherein the events occurring with respect to the first object and the events occurring with respect to the second object are events occurring over a same pre-determined elapsed period.
15 . The non-transitory computer readable medium of claim 11 , wherein the analysis of the user activity with respect to the composite object includes an indication of an estimation of whether the user activity corresponds to the particular behavior.
16 . A system including:
a computing device, wherein the computing device is configured to:
obtain a first set of event reports, wherein each event report in the first set of event reports represents a respective event occurring with respect to a first object, and a second set of event reports, wherein each event report in the second set of event reports represents a respective event occurring with respect to a second object different from the first object;
define a composite object including the first object and the second object;
generate, using the first set of event reports and the second set of event reports, a list of events occurring with respect to the composite object;
perform a clustering process with respect to the events in the list of events to generate one or more clusters of events, wherein the clustering process includes generating the one or more clusters of events based on respective times of occurrence of the events, wherein a time interval between consecutive events in a particular cluster is not greater than a pre-determined time interval;
generate, using the one or more clusters of events, an analysis of user activity with respect to the composite object by performing an analysis process with respect to the events in the one or more clusters of events, wherein one or more features of the analysis process are based on a given type of the analysis of the user activity to be generated, wherein the analysis process with respect to the events in the one or more clusters of events includes performing a classification process to determine respective classifications of the one or more clusters of events, wherein a given classification of a given cluster of events is indicative of an estimation of whether the given cluster of events represents the given type of user activity; and
provide notification to an alert server based on an alert configuration when the analysis of user activity with respect to the composite object indicates a particular behavior.
17 . The system of claim 16 , wherein:
the event reports in the first set of event reports and the event reports in the second set of event reports are indicative of respective times of occurrence of the events represented by the event reports in the first set of event reports and the event reports in the second set of event reports; and
the generating the list of events includes ordering the events based on the respective times of occurrence of the events.
18 . The system of claim 16 , wherein the clustering process is based on the given type of the analysis of the user activity to be generated, and wherein the analyzing the clusters includes analyzing the clusters based on the given type of the analysis of the user activity.
19 . The system of claim 16 , wherein the events occurring with respect to the first object and the events occurring with respect to the second object are events occurring over a same pre-determined elapsed period.
20 . The system of claim 16 , wherein the analysis of the user activity with respect to the composite object includes an indication of an estimation of whether the user activity corresponds to the particular behavior.