Stock transaction self-transaction risk real-time detection system

Abstract

The invention discloses a stock transaction self-transaction risk real-time detection system, which relates to the technical field of finance and comprises a data access module and a collaborative behavior detection engine. The collaborative behavior detection engine recognizes market key events in real time through a key market event recognition unit in the collaborative behavior detection engine, and a time gravitational field calculation unit generates dynamic time gravitational field intensity according to the events; the gravitational force timestamp generation unit calibrates an original physical timestamp into a nonlinear gravitational force timestamp according to the gravitational field intensity; the collaboration judgment unit performs collaboration judgment on the basis of the gravitation timestamp; the collaborative behavior detection engine further comprises a physical timestamp pre-calibration module, and the physical timestamp pre-calibration module carries out compensation calibration on an original physical timestamp by utilizing a pre-constructed account physical delay fingerprint so as to eliminate inherent systematic delay deviation. According to the method, the accuracy and reliability of self-transaction risk detection are improved through two-step processing of calibrating the physical timestamp and then carrying out nonlinear time coordinate transformation.

Description

Technical Field

[0001] This invention relates to the field of financial technology, and in particular to a real-time risk detection system for self-trading in stock trading. Background Technology

[0002] In risk control practices in the securities market, real-time monitoring of coordinated trading behavior among related accounts is a core task. Currently, a widely adopted technique is a coordination detection method based on a fixed time window. The main logic of this method is: when multiple accounts within a known group of related accounts issue opposite-direction and price-matching order instructions within a preset fixed time window (e.g., 500 milliseconds), the system determines that these behaviors are coordinated and generates an alert. The basis for this judgment is the difference between the physical timestamps recorded by the system for each order instruction.

[0003] The existing technology has the following drawbacks: It uses a linear, uniform physical time scale, while the density and correlation of trading activity in financial markets are non-linear under different market conditions. This method is effective when the market is stable. However, at critical market moments, such as opening, closing, important news releases, or periods of sharp price fluctuations, a large number of independent market participants make convergent, rapid trades based on the same publicly available information, resulting in a high physical clustering of their order timestamps. At this time, the fixed-time-window method cannot effectively distinguish between this normal trading cluster driven by market consensus and genuine coordinated manipulation driven by manipulative intent, thus generating a large number of false positives and increasing the cost of manual verification. Simultaneously, genuine violations may be masked by a large amount of normal market trading activity, leading to a decrease in the system's detection rate and resulting in missed detections. Summary of the Invention

[0004] This invention provides a real-time risk detection system for self-trading in stock trading, aiming to solve the technical problem in the real-time risk control system of modern securities trading markets, which uses an unchanging and rigid time scale that cannot adapt to drastic changes in market conditions, resulting in a large number of "false alarms" and "missed alarms" in the detection of coordinated trading behavior at critical moments in the market.

[0005] In view of the above problems, the present invention provides a real-time detection system for self-trading risk in stock trading, comprising: The data access module is used to acquire raw order data records containing unique account identifiers and original physical timestamps in real time, as well as market data streams containing key market events. A collaborative behavior detection engine, connected to the data access module, includes: A key market event identification unit is used to identify key market events in real time based on the market data stream; The time-gravitational field calculation unit is used to generate dynamic time-gravitational field strength for any given moment based on the key market events. The gravity timestamp generation unit is used to calibrate the original physical timestamp in the original entrusted data record into a nonlinear gravity timestamp based on the time gravity field strength. And a collaborative judgment unit, used to make collaborative judgments on multiple orders within the associated account group based on the gravity timestamp, so as to output the real-time detection result of self-trading risk.

[0006] The technical solution provided in this application has at least the following technical effects or advantages: By introducing a time gravity field model, this system can dynamically adjust the time measurement scale according to market events. At critical moments in the market, the system non-linearly "stretches" the time coordinate, making the requirements for time difference more stringent. This effectively distinguishes between genuine coordinated manipulation and normal trading aggregation caused by market consensus, reducing the number of false alarms.

[0007] For covert manipulation activities that exploit sharp market fluctuations and occur over extremely short time intervals, this invention improves the detection resolution by refining the measurement of time under high gravitational field strength, thereby increasing the detection rate of such violations and reducing the risk of missed detection.

[0008] By using a physical timestamp pre-calibration module, this system can eliminate systematic delay biases stemming from differences in the physical environments of different accounts. This ensures that all subsequent time comparisons are performed on a calibrated and fair benchmark, fundamentally improving the accuracy of the detection results. Attached Figure Description

[0009] Figure 1 This is an architecture diagram of a real-time risk detection system for self-trading in stock trading according to the present invention. Detailed Implementation

[0010] This invention relates to a real-time risk detection system for self-trading in stock trading, aiming to solve the technical problem in the real-time risk control system of modern securities trading markets, which uses an unchanging and rigid time scale that cannot adapt to drastic changes in market conditions, resulting in a large number of "false alarms" and "missed alarms" in the detection of coordinated trading behavior at critical moments in the market.

[0011] The above technical solutions will now be described in detail with reference to the accompanying drawings and specific embodiments to provide a better understanding of them. Obviously, the described embodiments are only a part of the embodiments of the present invention, and not all of them. It should be understood that the present invention is not limited to the exemplary embodiments used only to explain the present invention. All other embodiments obtained by those skilled in the art based on the embodiments of the present invention without creative effort are within the scope of protection of the present invention. Furthermore, it should be noted that, for ease of description, only the parts related to the present invention are shown in the drawings, not all of them.

[0012] Please see Figure 1 A real-time risk detection system for self-trading in stock trading, comprising: The data access module is used to acquire raw order data records containing unique account identifiers and original physical timestamps in real time, as well as market data streams containing key market events. A collaborative behavior detection engine, connected to the data access module, includes: A key market event identification unit is used to identify key market events in real time based on the market data stream; The time-gravitational field calculation unit is used to generate dynamic time-gravitational field strength for any given moment based on the key market events. The gravity timestamp generation unit is used to calibrate the original physical timestamp in the original entrusted data record into a nonlinear gravity timestamp based on the time gravity field strength. And a collaborative judgment unit, used to make collaborative judgments on multiple orders within the associated account group based on the gravity timestamp, so as to output the real-time detection result of self-trading risk.

[0013] The implementation of this invention covers the entire engineering lifecycle, from offline calibration before system deployment to real-time online monitoring during trading hours, and then to post-market data tracing and model optimization. The complete process begins with offline modeling of the unique physical latency fingerprint of each trading account that needs to be monitored.

[0014] Phase 1: Offline calibration and system initialization (before deployment and before daily market opening) This phase, conducted before deploying the system described in this invention into an actual risk control system and before the start of each trading day, aims to prepare all necessary benchmark data and model parameters for real-time online detection. During this phase, a physical latency fingerprint is calculated and established for each trading account, characterizing the inherent systematic latency of its order timestamps.

[0015] The sub-millisecond (i.e., fractional parts of milliseconds, such as microseconds and nanoseconds) values ​​of the physical timestamps recorded by the trading system are not completely randomly and uniformly distributed. Due to the combined influence of factors such as the physical location of the front-end server connected to each trading account, the model of the network switch, the internal processing thread scheduling of the server, and the implementation details of its own trading strategy software, the order instructions issued by each account experience a relatively stable physical transmission and processing delay characteristic of that account before reaching the exchange's matching system. This delay is reflected in the statistical distribution of the sub-millisecond portion of the final recorded physical timestamp, exhibiting a stable and concentrated peak.

[0016] The algorithm for extracting physical delay fingerprints comprises the following steps: First, in the data preparation step, for a specific account's unique identifier, all successful raw order confirmation records (Raw_Order_Confirmation_Record) over a long period (e.g., the past three months) are extracted from the historical database to form a historical order confirmation dataset for that account. The raw order confirmation record is a data structure that at least contains the account's unique identifier and a physical timestamp (a 64-bit integer representing the number of nanoseconds since a certain epoch) indicating that the order was received by the system. Next, in the sub-millisecond timestamp extraction step, the system starts a loop that iterates through each record in the historical order confirmation dataset. In each iteration, the physical timestamp field is extracted, and the timestamp value is modulo one billion (assuming the timestamp unit is nanoseconds) to obtain its nanosecond-level sub-millisecond portion. All extracted sub-millisecond portions are stored in a one-dimensional floating-point array called the sub-millisecond delay sample sequence.

[0017] The next step involves modeling the statistical distribution and determining the fingerprint. This step aims to find the central value from the sub-millisecond latency sample sequence that best represents the inherent latency of the account. In a preferred embodiment, this step is achieved through mode estimation based on a histogram. Specifically, a histogram is first constructed, dividing the sub-millisecond range (0 to 999,999,999 nanoseconds) into several equal-width, continuous statistical bins. For example, it can be divided into one million bins with a width of one microsecond. Then, by traversing the sub-millisecond latency sample sequence, each sample value is placed into its corresponding statistical bin, and the number of samples in each bin is counted. Among all the bins, the peak bin containing the largest number of samples is found, and the central value of this peak bin is precisely defined as the physical latency fingerprint of the account. To obtain a smoother and more accurate distribution center estimate, an alternative implementation is to use the kernel density estimation (KDE) method. This method obtains a continuous probability density curve by placing a smooth kernel function (e.g., a Gaussian function) on each sample point and superimposing them. The sub-millisecond value corresponding to the global maximum point of this curve can be defined as the physical delay fingerprint of the account.

[0018] The calculated physical latency fingerprints of all accounts are stored in a high-efficiency key-value store database (e.g., Redis or in-memory hash tables), using the account's unique identifier as the key and the fingerprint value (a nanosecond-level integer or long integer) as the value, forming an account physical latency fingerprint database for rapid querying during the real-time online detection phase. In addition to fingerprint modeling, during the offline phase, system administrators or risk control strategy analysts configure and define which market behaviors should be considered key market events capable of triggering the "time gravity field." Key parameters of the gravity field model, such as the "gravitational decay time constant" and "gravitational intensity conversion coefficient," are offline calibrated using a "golden calibration dataset" containing multiple historical key market events, through simulation and optimization algorithms (such as grid search or Bayesian optimization). The goal is to find parameter combinations that maximize the difference in "gravitational timestamps" between real collaborative cases and "pseudo-collaborative" cases, and then solidify these combinations into the deployed software modules.

[0019] Phase Two: Real-time Online Detection and Subsequent Optimization During trading hours, the system automatically and cyclically executes a complete real-time online detection process for each order entering the Order Management System (OMS). This process begins with the pre-calibration of the physical timestamp for each original order data record. When the system obtains a new original order data record from the OMS order flow, it first extracts its original physical timestamp and account unique identifier. Then, using the account unique identifier as a key, it quickly retrieves the physical latency fingerprint corresponding to the account from the account physical latency fingerprint database. Next, it subtracts the retrieved physical latency fingerprint from the original physical timestamp. The final result is precisely named the calibrated physical timestamp. This timestamp theoretically eliminates most of the inherent, systemic latency biases caused by the account's hardware, network, and system path.

[0020] After obtaining the calibrated physical timestamp, the process proceeds to the generation of the gravitational timestamp. The linear calibrated physical timestamp is mapped to the "gravitational time" coordinate system through a nonlinear transformation determined by the total time gravitational field strength. This process first relies on the real-time identification of key market events. The system subscribes to and processes market data streams (Tick Data Stream) in real time, maintaining an internal key event rule engine that continuously determines whether a key market event has been triggered based on preset rules. For example, when a new trade arrives, if its single trade volume exceeds ten times the moving average volume of the stock over the past five minutes, the engine immediately generates a "volume surge" key market event record (Gravity_Event_Record). As another example, when the arrival of one or more new orders causes the best bid or ask price to be instantly and completely "eaten up," resulting in a jump in the order book, the engine immediately generates a "order book breakout" key market event record. The record is a data structure that at least contains the physical timestamp of the event occurrence, the event type, the event strength, and the gravitational decay time constant.

[0021] The system maintains a list of key events in memory to store records of all recent key market events whose "gravitational" influence has not yet fully decayed. At any given physical moment requiring calculation, the total temporal gravitational field strength is defined as the linear superposition of the gravitational strengths generated by all events in the list of key events at that moment. The gravitational strength generated by a single key market event is modeled as a process that decays exponentially over time. In a preferred embodiment, the calculation method is as follows: A loop is started, iterating through each key market event record in the list of key events. In each iteration, first, the time difference between the current physical moment and the physical timestamp of the event occurrence in the event record is calculated. Then, this time difference is divided by the gravitational decay time constant in the event record, and its negative value is taken. Next, the exponent of the natural constant e is calculated. Finally, the result of this exponent calculation is multiplied by the event strength in the event record to obtain the gravitational strength contributed by the single historical event at the current moment. The final sum of the gravitational strengths contributed by all historical events is the total temporal gravitational field strength at the current physical moment.

[0022] Next, the system will nonlinearly "stretch" the calibrated physical timestamp based on the total temporal gravitational field strength at the current moment, calculating the final gravitational timestamp used for cooperation determination. That is, the "flow rate" of time is no longer constant at one, but becomes "1 + total temporal gravitational field strength". Therefore, the gravitational timestamp is the integral of this changing "flow rate of time" over physical time. In a discretized computer system, this calculation is implemented through an accumulation and summation process. Specifically, the system starts from a fixed reference time zero and steps to the calibrated physical timestamp in a very small time step (e.g., one microsecond). At each time step, the system calculates the total temporal gravitational field strength at the center of that step using the aforementioned method, and then calculates a "local time stretching factor", which is calculated as "one plus a gravitational conversion coefficient multiplied by the total temporal gravitational field strength". Next, this "local time stretching factor" is multiplied by the extremely small time step to obtain the "gravitational duration" of that step in the gravitational time coordinate system. All "gravitational durations" from the reference time zero point to the calibrated physical timestamp are summed, and the final sum is the gravitational timestamp corresponding to that physical timestamp.

[0023] After obtaining the gravity timestamp of each order, the final determination of coordination becomes extremely simple and robust. The system maintains an in-memory cache for each monitored group of related accounts, storing all incomplete orders with calculated gravity timestamps. When any account within the group generates a new order and calculates its gravity timestamp, the system immediately iterates through the group's cache to check for an order that: shares the same stock code as the new order, has the opposite buy / sell direction, matches the price (e.g., the buy price is higher than or equal to the sell price), and the absolute difference between its gravity timestamp and the new order's gravity timestamp is less than a preset, extremely small, fixed gravity time window threshold (e.g., fifty "gravity milliseconds"). If such an order exists, the system immediately determines that the two orders constitute a suspected coordinated trading event and generates a structured alert record, which is pushed to the risk control personnel's interface.

[0024] During the post-market and long-term maintenance phases, the method described in this invention also includes subsequent data tracing and model optimization processes. For each generated alert, the system comprehensively records the entire chain of data that triggered it, including the original physical timestamp, the calibrated physical timestamp, all key market events acting on it at the time, the calculated gravitational field strength, and the final gravitational timestamp. This provides compliance monitors with detailed evidence, penetrating deep into the time coordinate system, for accurate post-event review and analysis of alert events. Furthermore, the long-term accumulated log data can be used to monitor the stability of the physical delay fingerprint and update it as necessary. Simultaneously, by analyzing cases manually confirmed as "genuine collusion" or "genuine false alarms," ​​the parameters of the gravitational field model can be continuously and data-driven optimized, allowing the system's detection capabilities to evolve over time.

[0025] In summary, this invention proposes a novel method that first calibrates the inherent systematic delay of physical timestamps, then introduces the concept of a "time gravity field" to dynamically and nonlinearly reconstruct the time coordinate system, and finally performs collaborative judgment on a more discriminative "gravitational time" dimension. This constructs a new collaborative behavior detection enhancement technology system that is logically rigorous, has clear objectives, and contains unique inventive ideas in every key step. It effectively solves the problems of "false alarms" and "missed alarms" that traditional quality control methods cannot address at critical moments in the market.

[0026] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A stock transaction self-dealing risk real-time detection system, characterized in that, The system comprises: a data access module configured to acquire, in real time, original order data records containing account unique identifiers and original physical timestamps, and market data streams containing market key events; a coordinated behavior detection engine connected to the data access module, the coordinated behavior detection engine comprising: a key market event identification unit configured to identify, in real time, key market events in the market based on the market data streams; a time gravity field calculation unit configured to generate a dynamic time gravity field strength for any time point according to the key market events; a gravity timestamp generation unit configured to calibrate the original physical timestamps in the original order data records into nonlinear gravity timestamps according to the time gravity field strength; and a coordination judgment unit configured to perform coordination judgment on multiple orders in a group of associated accounts based on the gravity timestamps to output real-time detection results of self-execution risk.

2. A system for real-time detection of self-dealing risk in stock trading according to claim 1, wherein, The coordinated behavior detection engine further comprises: a physical timestamp pre-calibration module configured upstream of the gravity timestamp generation unit; the physical timestamp pre-calibration module is configured to retrieve a physical delay fingerprint corresponding to the account unique identifier in the original order data record from a pre-constructed account physical delay fingerprint library, and to compensate and calibrate the original physical timestamp using the physical delay fingerprint to obtain a calibrated physical timestamp that has eliminated inherent systematic delay bias; wherein the gravity timestamp generation unit is specifically configured to receive the calibrated physical timestamp and calibrate it into the nonlinear gravity timestamp.

3. A system for real-time detection of self-dealing risk in stock trading according to claim 1, wherein The system further comprises: an offline calibration module for constructing the account physical delay fingerprint library, the offline calibration module comprising: a historical data extraction unit configured to acquire, for each account unique identifier, multiple original order return data records in its history; a sub-millisecond sample sequence generation unit configured to extract a sub-millisecond part from a physical timestamp of each original order return data record to form a sub-millisecond delay sample sequence; a fingerprint modeling unit configured to statistically model the sub-millisecond delay sample sequence to determine a central value representing the inherent systematic time delay of the account, and to take the central value as the physical delay fingerprint.

4. A real-time system for detecting self-dealing risk in stock trading according to claim 3, wherein The fingerprint modeling unit specifically comprises: a statistical histogram constructor configured with multiple statistical bins, configured to count each sample value in the sub-millisecond delay sample sequence into its corresponding statistical bin; a peak bin locator configured to find a peak bin containing the most number of samples among all statistical bins; a fingerprint value determiner configured to determine a central value of the peak bin as the physical delay fingerprint.

5. A real-time system for detecting self-dealing risk in stock trading according to claim 1, wherein, The time gravity field calculation unit specifically comprises: an active key event list configured to maintain, in memory, records of all recently occurred key market events; a gravity strength superimposer configured to linearly superimpose and sum up gravity strengths contributed by each key market event in the active key event list at the time point and exponentially decayed with time to obtain a total time gravity field strength at the time point.

6. A real-time system for detecting self-dealing risk in stock trading according to claim 1, wherein, The gravity timestamp generation unit specifically comprises: A local time stretch factor calculator configured to calculate a local time stretch factor varying with time based on the time gravity field strength; A time gravity field strength calculator configured to calculate a local time stretch factor varying with time based on the time gravity field strength; A gravity time length accumulator configured to stretch all time steps from a reference time zero point to a to-be-calibrated timestamp according to their respective corresponding local time stretch factors to obtain respective gravity time lengths, and accumulate and sum all the gravity time lengths to obtain a final gravity timestamp.

7. A real-time system for detecting self-dealing risk in stock trading according to claim 1, wherein, The synergy judgment unit specifically comprises: A cache module configured to store, in a memory, for each associated account group, its non-executed orders and corresponding gravity timestamps; A gravity time window comparator configured to, after a new order is generated in an associated account group and a gravity timestamp of the new order is calculated, check whether there is an order in the cache module that has the same stock code as the new order, opposite buying and selling directions, a matchable price, and an absolute difference between the gravity timestamp of the order and the gravity timestamp of the new order that is less than a preset fixed gravity time window threshold; A warning generator configured to, when the gravity time window comparator checks that the order exists, generate a warning of a suspected collaborative trading event.

8. A real-time system for detecting self-dealing risk in stock trading according to claim 1, wherein, The system further comprises a model optimization module connected with the collaborative behavior detection engine and configured to: Receive and record the warnings and full-link data thereof generated by the collaborative behavior detection engine; Receive feedback labels of "real synergy" or "real false alarm" confirmed by humans; Based on the feedback labels, continuously and data-drivenly optimize the gravity field model parameters in the offline calibration module.

Images