Trading anomaly kill switch

• US 10,169,816 B2
• Filed: 01/06/2015
• Issued: 01/01/2019
• Est. Priority Date: 01/06/2015
• Status: Active Grant

• Current Assignee: Morgan Stanley Services Group Inc. (Morgan Stanley)
• Original Assignee: Morgan Stanley Services Group Inc. (Morgan Stanley)
• Inventors: Damodaran, Aditya, Huddleston, Richard, Pendergast, Jr., Joseph Edward
• Primary Examiner(s): Robinson, Kito R
• Application Number:
  US14/590,201
• Publication Number:
  US 20160196606A1
• Time in Patent Office: 1,456 Days
• Field of Search: 705 36 R, 705 37, 717124, 726 23, 709224
• CPC Class Codes: G06Q 40/00 Finance; Insurance; Tax strategies; Processing of corporate or income taxes
• CPC Class Codes: G06Q 40/04 Trading; Exchange, e.g. stocks, commodities, derivatives or currency exchange
• CPC Class Codes: G06Q 40/06 Asset management; Financial planning or analysis

Abstract

A system that can detect when abnormal trading activity is occurring and take action to halt the detected abnormal trading activity without human intervention using a computer-implemented anomaly detection and action stage that performs an exponential weighted averaging of trade order flow, on a per symbol basis within a sliding volume based window and a volume based exponential weighted averaging, on a per symbol basis, on trade update messages received during the sliding volume based window and checks for an inflection in covariance between them. A related method is also described.

Claims

1. A system for the detection of abnormal trading activity directed to any of multiple exchanges and the halting of the detected abnormal trading activity without human intervention, the system comprising:

multiple network taps, each network tap comprising a low-latency packet flow monitoring switch, a first of the multiple network taps being on an exchange side of order flow element hardware and the second network tap being on a side of the order flow element hardware opposite the exchange side, the first and second network taps each being configured to tap trade order message flow along a path passing through the order flow element hardware toward at least one of the multiple exchanges, the first and second network taps each being used to capture a copy of the trade order message flow;

at least one pNode, the pNode comprising a low-latency packet flow monitoring switch;

a computer-implemented anomaly detection and action stage computer comprising;

a first interface through which market transactional data can be received,

a second interface through which the copy of the trade order message flow can be received via at least the first and second network taps, and

non-transient program storage storing programming that implements an anomaly detection engine and is configured to receive trade order flow information from the first and second network taps and analyze the received trade order information relative to market information by

i) performing an exponential weighted averaging of trade order flow, on a per symbol basis within a sliding volume based window, directed from the trading system to all exchanges to which trades of that symbol can be directed by the trading system while accounting for order cancellations, order replacements, order rejections and order slicing,

ii) performing a volume based exponential weighted averaging, on a per symbol basis, on trade update messages received during the sliding volume based window,

iii) on a per symbol basis, checking for covariance between the exponential weighted average of the trade order flow and the exponential weighted average of the trade update messages, and

iv) comparing trade order messages passing into the order flow element hardware with the trade order messages passing out of the order flow element hardware for consistency in quantity and value; and

if the anomaly detection engine detects either

a) anomalous trade order message flow for at least one symbol through the order flow element hardware, or

b) an inflection point in the covariance indicating a market deviation, for the at least one symbol, that either increases, or persists for, a specified duration of time,

then the anomaly detection engine will, according to a hierarchical protocol, automatically take a specified action to stop ongoing anomalous trading of the at least one symbol.

2. The system of claim 1, wherein the hierarchical protocol comprises:

a protocol of at least four levels implemented such that less disruptive action is attempted ahead of more disruptive action.

3. The system of claim 2, wherein the at least four level protocol comprises, in sequence, a process control level, a server control level, a network control level, and a power control level.

4. The system of claim 1 wherein each path from the system to each of the multiple exchanges comprises one or more components of order flow element hardware.

5. The system of claim 1, wherein the detection of the inflection point in the covariance indicating the market deviation is followed by a linear volume weighted averaging in order to determine a rate of deviation.

6. The system of claim 1, wherein the detection of the inflection point in the covariance indicating the market deviation is followed by a linear volume weighted averaging in order to determine deviation persistence beyond the specified duration of time.

7. The system of claim 1, wherein the at least one pNode is connected between the first of the multiple network taps and the anomaly detection and action stage computer.

8. The system of claim 7, further comprising:

a fill copy receiver coupled to both the at least one pNode and the anomaly detection and action stage computer such that trade order information obtained via the first of the multiple network taps must pass from the pNode through the fill copy receiver before arriving at the anomaly detection and action stage computer.

9. The system of claim 1, further comprising:

a management and reporting computer coupled to the anomaly detection and action stage computer.

10. A trading system comprising:

multiple network taps, each comprising a low-latency packet flow monitoring switch coupled to trade flow paths within the trading system so as to capture trade order messages directed to at least one exchange of multiple exchanges for execution without adding latency to the trade order messages;

at least one pNode comprising a low-latency packet flow monitoring switch;

multiple components of order flow element (OFE) hardware, each having at least one of the multiple network taps on either side thereof,

an anomaly detection and action stage computer coupled to the multiple network taps and configured to receive and analyze, on a per symbol basis, trade order information directed within the trading system towards the multiple exchanges based upon covariance between at least an exponential volume weighted average within sliding volume based windows for the trade order information relative to market trading as reported by the multiple exchanges and determine whether an inflection point in the covariance exists for any symbol and, when an inflection point exists for a symbol, determine whether either the covariance deviation rate or covariance deviation duration indicates anomalous trading activity and, if anomalous trading activity is indicated, trigger an automatic action to halt the anomalous trading activity while minimizing disruption of trading for other symbols by the trading system.

11. The trading system of claim 10, wherein the at least one pNode is coupled between at least one of the multiple network taps and the anomaly detection and action stage computer, such that the trade order information passes through the pNode.

12. The trading system of claim 11, further comprising:

a fill copy receiver located between the at least one pNode and the anomaly detection and action stage computer, the fill copy receiver being configured to receive the trade information from the pNode and reformat it for use by the anomaly detection and action stage computer.

13. The trading system of claim 10, wherein the anomaly detection and action stage computer is further configured to determine, on a per symbol basis, that aggregate orders entering each of the multiple components of OFE hardware balance with aggregate orders leaving each of the multiple components of OFE hardware in terms of both unit volume and value.

14. The trading system of claim 10, wherein the trigger of the automatic action to halt the anomalous trading activity invokes a hierarchically arranged trade halting protocol.

15. The trading system of claim 14, wherein the hierarchically arranged trade halting protocol comprises, in order, a process control level of action, which, if ineffective, is followed by a server control level of action, which, if ineffective, is followed by a network control level of action, and which, if ineffective, is followed by a power control level of action.

16. The trading system of claim 15, wherein the process control level of action comprises sending a command to a process to halt trading of a specified symbol.

17. The trading system of claim 16, wherein the server control level of action comprises sending a command to stop all processes running on one or more specified servers.

18. The trading system of claim 16, wherein the network control level of action comprises sending a command to disrupt one or more network connections so as to cut off trading communication by at least one component of OFE hardware that is directed towards all of the exchanges to which that component of OFE hardware can direct trades.

19. A method of automatically detecting anomalous trading activity, directed within a trading system to at least one exchange, the method comprising:

receiving trade order information directed to exchanges for particular symbols at an anomaly detection and action stage computer;

receiving trade update information from the exchanges at the anomaly detection and action stage computer;

using the anomaly detection and action stage computer, analyzing, on an exponential volume weighted average basis within a sliding volume-based window, for each of the particular symbols, covariance between the trade order information and the trade update information in order to identify whether an inflection in the covariance exists for at least one symbol that is indicative of anomalous trading in that symbol, and

when an inflection in the covariance exists, triggering a protocol that will halt the anomalous trading of that symbol.

20. The method of claim 19, wherein the analyzing further comprises, when inflection in the covariance exists for a specific symbol, determining at least one of a degree of the inflection or a persistence of the inflection using a linear weighted average analysis of the specific symbol'"'"'s trade order information.