| 主权项 |
1. A system that can detect when abnormal trading activity directed to any of multiple exchanges is occurring and take action to halt the detected abnormal trading activity without human intervention, the system comprising:
multiple network taps, a first of the multiple network taps being on an exchange side of an order flow element and the second network tap being on a side of the order flow element opposite the exchange side, the order flow element being in a path over which trade orders travel to exchanges, the first and second network taps each being configured to tap trade order message flow along the path passing through the order flow element toward at least one of the multiple exchanges, the first and second network taps each being used to capture a copy of the trade order message flow for analysis; a computer-implemented anomaly detection and action stage comprising
a first interface through which real time market transactional data can be received,a second interface through which the copy of the trade order message flow can be received via at least the first and second network taps, andprogramming, stored in the non-transient program storage that implements an anomaly detection engine, the programming that implements the anomaly detection engine being configured to receive trade order flow information from the first and second network taps and analyze the received trade order information relative to market information by
i) performing an exponential weighted averaging of trade order flow, on a per symbol basis within a sliding volume based window, directed from the trading system to all exchanges to which trades of that symbol can be directed by the trading system while accounting for order cancellations, order replacements, order rejections and order slicing,ii) performing a volume based exponential weighted averaging, on a per symbol basis, on trade update messages received during the sliding volume based window, iii) on a per symbol basis, checking for covariance between the exponential weighted average of the trade order flow and the exponential weighted average of the trade update messages, andiv) comparing trade order messages passing into the order flow element with the trade order messages passing out of the order flow element for consistency in quantity and value; and if the anomaly detection engine detects either
a) anomalous trade order message flow for at least one symbol through the order flow element, orb) an inflection point in the covariance indicating a market deviation, for the at least one symbol, that either increases, or persists for, a specified duration of time, then the anomaly detection engine will, according to a hierarchical protocol, automatically take a specified action to stop ongoing anomalous trading of the at least one symbol. |
