• Save
A system framework for the analysis & development of financial market monitoring systems
Upcoming SlideShare
Loading in...5

Like this? Share it with your network

  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Be the first to comment
    Be the first to like this
No Downloads


Total Views
On Slideshare
From Embeds
Number of Embeds



Embeds 0

No embeds

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

    No notes for slide


  • 1. A Systematic Framework for the Analysis and Development of FinancialMarket Monitoring SystemsDavid Diaz, Mohamed Zaki, Babis Theodoulidis and Pedro SampaioCentre for Service ResearchManchester Business SchoolUniversity of ManchesterManchesterUnited Kingdomdavid.diazsolis@postgrad.mbs.ac.uk, mohamed.zaki@postgrad.mbs.ac.uk,b.theodoulidis@mbs.ac.uk, p.sampaio@mbs.ac.ukAbstract— In this paper, a systematic framework of marketmonitoring is introduced. The paper discusses the need for thedevelopment of systematic approaches to market monitoringand reviews existing work. Furthermore, the paper articulatesthe current and potential characteristics of market monitoringsystems, their components, information management flows andtheir interactions. The proposed framework is exemplifiedusing an insider trading manipulation case study from theNASDAQ market.Keywords-framework; financial market monitoring; marketmanipulations, data mining, text mining, knowledge discoveryI. INTRODUCTIONMarket manipulation is an ongoing concern for financialauthorities and market agents due to its potential toundermine the efficiency of the markets and the trust of thepublic and even weakening the stability of the wholeeconomic system. As a result financial authorities areregulating on a wide range of misconducts, including thealteration of financial statements, the manipulation ofearnings estimates, the unscrupulous release of falseinformation, insider trading, trade-based manipulations, andseveral other ‘painting the tape’ schemes [1].To monitor the financial markets, their stakeholders suchas financial authorities and portfolio managers, havedeveloped a number of market monitoring systems andprocesses with different characteristics including the human-machine interaction aspects and the response-timerequirements. Typically, the market monitoring approachesinclude special task teams, which manually monitor thetransactions and profile of traders, and also a wide range ofmore or less sophisticated, semi or fully automatedinformation systems with various analytical capabilities.Moreover, the heterogeneity of such systems considers awide range of usage scenarios which in turn involvenumerous processes, and require a similar diversity ofinformation systems and system architectural components.In the literature there are a number of studies reporting onthe functionality and capabilities of market monitoringsystems from different perspectives and intellectual domains,such as decision science, legal and regulatory, finance andeconomics, data mining and information management [2, 3].These approaches typically focus on certain markets andconsider certain market manipulation scenarios so it can beargued that they adopt a piecemeal approach rather thanadopting a more integrated and holistic perspective.This paper advocates that a systematic framework forclassifying market monitoring systems is needed in order toprovide a common foundation for researchers andpractitioners to analyse, specify, develop, compare andevaluate financial market monitoring systems. This papercontributes to the existing literature by introducing aframework that could serve as a reference map forresearchers and practitioners to position their work in thecontext of market manipulations, resulting in a usefulinstrument for the analysis, design, testing and managementof detection and monitoring systems for financial markets.The paper takes into consideration not only thecharacteristics of existing market monitoring systemsdescribed in the literature but also its environment andpotential evolution of usage scenarios and new applications.Furthermore, the work discusses a case scenario and how theproposed framework can be applied to this scenario.The paper is organized as follows. Section two presents anumber of problem scenarios arising from the marketmanipulation context. Section three discusses typicalcomponents and processes involved in the informationmanagement flows, and presents examples of previous worksreported in literature. Section four introduces the frameworkthat addresses the gaps identified in previous works. Sectionfive presents a case study that demonstrates the use of theframework. Finally, section six summarizes this paper anddiscusses directions for future work.II. MANIPULATION SCENARIOS IN FINANCIAL MARKETSA typical market manipulation problem scenario can beanalyzed by considering the interaction of five fundamentalelements: the agents or manipulators, the actions, the targetsecurities, the markets involved, and the effects of themanipulation. Conceptually, an agent corresponds to theelement that performs a manipulation by taking an action.Accordingly, actions can be categorized in three groups: therelease of false or misleading information to the public; theplacement of trading orders that could result or not, in atrade; and the collusion with other agents to trade and/or2011 Annual SRII Global Conference978-0-7695-4371-0/11 $26.00 © 2011 IEEEDOI 10.1109/SRII.2011.271452011 Annual SRII Global Conference978-0-7695-4371-0/11 $26.00 © 2011 IEEEDOI 10.1109/SRII.2011.271452011 Annual SRII Global Conference978-0-7695-4371-0/11 $26.00 © 2011 IEEEDOI 10.1109/SRII.2011.271452011 Annual SRII Global Conference978-0-7695-4371-0/11 $26.00 © 2011 IEEEDOI 10.1109/SRII.2011.271452011 Annual SRII Global Conference978-0-7695-4371-0/11 $26.00 © 2011 IEEEDOI 10.1109/SRII.2011.27145
  • 2. release false information in a coordinated way. Fig. 1presents a graphical representation of the elements involvedin a manipulation.Figure 1. Elements Involved in a Manipulation.In principle, agents could target any type of asset orsecurity that is traded in the markets, and thus, the targetsecurity set includes a full range of financial instruments,usually stocks, but also, penny stocks, money markets,bonds, derivatives, structured notes, and many othersecurities. Actions taken by manipulators will induce areaction or reactions in the behaviour of target securities thatdirectly or indirectly will benefit the agents by creating aprofit for them, or by altering the normal market conditions,like for example, fund performance manipulation or in thecase of social misfits attacks or terrorist attacks. Thesereactions could be reflected mainly in the market in whichthe target security is traded, but also could induce reactionsin related securities, or even other markets in which these aretraded.In order to exemplify this, we can start by considering themost common type of manipulations, namely ‘marking theclose’ schemes. These are defined as “the transactions nearthe end of day’s trading, which affect the closing price of thesecurity in order to give an artificial price of the security inthe next day” [4]. In these schemes, it is possible to identifyan agent: usually a portfolio manager trying to inflatequarter-ends portfolio prices [5]; an action: last-minutepurchases of stocks already held; a target security: the stockshe or she already holds; and its effects: stock prices, volumeand volatility increasing beyond its normal range offluctuations.In terms of information based manipulations scenarios,consider manipulations such as insider trading, in whichfraudsters look to profit from pieces of privilegedinformation that has not yet been disclosed to the public. Ininsider trading manipulations, agents commonly buy optionscontracts written on the expected value of an underlyingsecurity instead of buying the stock itself. Options areusually low priced compared with stocks, and thus,manipulators with limited budget could buy the rights to buyor sell a larger number of stocks than they will be able to buyor sell if they target the stock, hence leveraging the piece ofprivileged information they possess [6].It is also possible to identify more complex scenarios ofmanipulation, which include targeting one security by usingan intermediate market and/or combinations of targetsecurities. For instance, at present a large proportion of call-options contracts are priced using the implied volatility ofprices that can be estimated from the bid and ask spread ofunderlying asset prices for which the call-option contract iswritten. Thus, it is theoretically possible to manipulate thecall-option contract prices, which are traded in a derivativemarket, by placing sequences of ill-intended orders in a stockmarket. In this manipulation, a trader –the agent–, places asequence of trade orders in a stock market withoutnecessarily fulfilling a trade –the action–, which will alter thebid and ask spreads –secondary effect–, that will also alterthe estimation of the implied volatility of the stock prices –tertiary effect–, that will finally result in an increase ordecrease in the price –main effect– of the call-option contract–the main target security. Furthermore, this strategy couldalso be applied in the opposite direction, i.e. manipulation ofthe stock market via the derivative market.As can be seen, these combined mechanisms ofmanipulations can be extended to several target securities,markets involved and even countries. Moreover, the actionscan be the result of the coordinated efforts of different agents(groups of individuals) from inside or outside the companyor companies. Actions can also consider combinations ofboth information-based and traded-based manipulations. Forexample, consider the hypothetical case of three coordinatedagents, one with insider information about an overseascompany of which its American Depository Receipts (ADR)trades in a U.S. market; one with license to trade in the sameU.S. market; and one with access to a large outside U.S.emailing list. The agent inside the company could passinformation to the agent with access to the emailing list,which could in turn disseminate a misleading rumour aboutwhat will happen with the company quarterly earnings. If thefraudulent emailing campaign is successful, local stockprices will fall after victims of the scam email sell their localstocks, and as a result, ADR prices in the U.S. market willfall in order to reflect the loss in value of their underlyingstocks. The coordinated agents could profit from this schemeif the one with license to trade in the U.S. market buys theADR when the price falls, and sells it after the real quarterlyearnings are disclosed to the public.From these broad representations of manipulationsscenarios it is possible to identify some key issues thatshould guide the monitoring of activities: agent’s actions orbehaviours, and the effects of such actions. Indeed, agentsbehaviour and consequent actions leave traces in bothstructured and unstructured data. Their behaviour isregistered in, for example, the number of order trades theymake, their bank transaction records, their phone callrecords, or even chat logs. Moreover, the effects of theiractions leave even clearer prints in trading data, from thelocation in which the traders orders were originated, to jumpsin volume of trading or episodes of unusual volatility ofprices. These issues also have a temporal dimension whichcould be reflected in unusual trading activities during criticalperiods or the appearance of sequences of patterns in thetrading orders that otherwise would have occurred atrandom.146146146146146
  • 3. For instance, Who is(are) the agent(s) involved in themanipulation? What security is being targeted?, Whichaction has been performed or planned to perform?, is it atrade based or an information based action?, Which patternor content can be identified in trading data, financialindicators, or other media such as news, press releases orcorporate fillings that can be associated with thismanipulation?, When was this manipulative actionperformed?, When it was possible to spot the effect of thisaction of manipulation?This wide range of elements and concepts that potentiallydefine a market manipulation present a real challenge forauthorities and users in general when designing andspecifying the functionalities and expected effectiveness ofmonitoring systems. In general, effective market monitoringsystems should be flexible and able to perform bothbehavioural analysis and cause/effect analysis in datagenerated within and outside the boundaries of the market orstock exchange venue. Moreover, they should also have theability to integrate several types of internal and external datasources. Finally, effective monitoring systems also shouldcater for other types of analysis that relate to monitoringfrom a market rules and regulations perspective and whichcan vary from market to market and from country to country.For example, such analysis could cater for Late-TradeReporting, Market Integrity and Best Execution aspects [3].III. EXISTING MARKET MONITORING APPROACHESTypical functionalities and processes of a marketmanipulation detection system can be found in the NASDRegulation’s Advanced Detection System (ADS) discussedin [3], and revised in the works of [7], [2], and [6]. Morerecent works describe the deployment of analogous systemsin emerging markets, as well as the study of novel datamining algorithms within the behavioural analysis context[8, 9]. Although these monitoring systems were deployed indifferent countries, in different years, and with differentregulatory concerns, there are several very importantcommonalties, features, and differences that can serve as afoundation for a common understanding of their fundamentalparts and for the development of a financial marketmonitoring framework.Particularly, the work of [8] introduced a monitoringsystem for the Thai Bond Market, commissioned by the ThaiBond Market Association (ThaiBMA). In this system, thetrading analysis component is pictured as the central part ofthe system, and two approaches into the trading analysis arefurther expanded. The first approach, namely EconomicAnalysis, is based in financial econometrics and comparesthe current trading prices with the historical time seriesproperties of the bond prices using GARCH models [10].The objective of this system is to detect trading divergencesfrom the mean, using past trading, thus raising alarms whenunusual trading outliers are detected. However, in thepresence of scarcely traded bonds this approach is noteffective enough, as it relies in the historic behaviour ofprices only. In the second approach, Behavioural Analysis,an association rules data mining application is integratedwith the economic analysis. This application focuses in theanalysis of trader behaviour and warning signals or alarmsare issued in conjunction with the alarms raised in the firstapplication based on unusual conducts of the traders.This process flow uses input data in the form of prices,volume and trader information, as well as a collection ofmarket integrity rules that are implicitly present in thesystem. The output of the system, warning signals or alarms,are then passed to an information management unit, whichcontinues the monitoring workflow, deciding whether theflagged trades warrant further investigation. If appropriate,an investigation process is started, followed by thecorresponding report and enforcement (if applicable) ofmarket rules.Other examples include the detection of cyclical pricemanipulation [11] and the monitoring of trading activity inthe NASDAQ stock market using the NASD Regulation’sAdvanced Detection System (ADS) [3]. Further extensionsto the ADS, investigated the detection of insider tradingmanipulations combining the derivative and the securitiesmarket [6] and additional extensions investigated itsdeployment as a complete data mining system, includingcomponents for data preparation such as loading, cleansing,transforming, summarizing, and integrating data; datamining, text mining and pattern-matching; and finally,components for visualisation of the analysis and its results[2], [7].In particular, the work of [2] presents one of the mostcomplete conceptual architectures for the SecuritiesObservation, News Analysis, and Regulation (SONAR)system (Fig.2). In its conceptual design, it is possible toidentify two types of Effects or Economic Analysis, datamining and text mining analysis, which are also organizedinto historic and real-time monitoring considering the use ofdifferent market data and textual sources such as financialnews, Securities and Exchange Commission (SEC) corporatefilings, spam e-mails, websites, chat rooms, and many ofNASD’s internal documents such as SEC referrals,complaint data, and disciplinary history data.Figure 2. Conceptual Architecture of the SONAR System (Goldberg,Kirkland et al. 2003).Interestingly, although the main purpose of these paperswas not the formal definition of a complete framework, they147147147147147
  • 4. do implicitly cover what can be identified as the main partsof a detection system: inputs in the form of different typesand sources of data, monitoring engines with differentdegrees of integrated analysis applications, and some form ofoutput management, visualization and evaluation of results.Nonetheless, these conceptual representations can beconsidered limited both in terms of the techniques that areused and in terms of the description of the data processingand data structures that are needed for the system to work.Also, they do not explicitly consider market-to-marketinteractions that could result in possible inter-market orcross-market manipulations scenarios. Moreover, althoughthey report on the general character of their components,they do not disclose the specifications or the details of theircapabilities, making impossible to really understand howthey work or to appreciate the level to which thesecomponents are valuable.In addition to these limitations there are a number ofother current and potential processes that are required inorder to perform behavioural analysis that are seldommentioned in the literature. It is also possible to considercombined real time text mining analysis of incoming newsand financial events, or even more sophisticated scenariosusing multimedia data with appropriate analysisfunctionalities as part of the behavioural analysis of thetraders, such as, voice recognition and analysis of over thephone conversations, email and spam analysis..The input for such conceptual system will need, as well,a wider variety of types and frequencies of data, comingfrom multiple sources and in different formats, and also,correspondent processes for data preparation and informationmanagement. This could include intraday data, such as tradesand quotes of the securities in study and its derivative,closing prices and daily volume of trade, company profile,with financial statements, employee information, includinglists with key personnel with access to privilegedinformation, trader profiles, trader past trading behaviour andso on. Inputs could be found in the form of abundant textualsources, such as financial news, internet forums, blogs, andfinancial events in the form of fillings to the relevantauthorities, or even coming from the instant messagefacilities that trader platforms incorporate.These conceptual systems will also need to managedifferent types of market integrity rules, or more generallyspeaking, user rules, given the fact that a manipulationdetection system could not only be used by different types ofregulating authorities, but also by different types of marketagents, such as private investment funds looking forarbitrage opportunities, internet trading platforms interestedin monitoring the behaviour of their clients, market operatorsor market agents in general.Other key components of the inputs of this conceptualsystem will be previously used patterns and trading analysismodels, and previous breaks and cases of confirmedmanipulations. In this sense, the information managementflows are needed to be dynamic and recursive, consideringoutput management components that are capable of not onlyraising alarms and warning signs, but also, creating andvalidating new patterns (dynamic learning), and storing andupdating old patterns and cases with new instances.Finally, it is necessary to consider the interaction ofdifferent markets and venues and to distinguish the need forconceptual systems that integrate the analysis of historicaldata (reactive systems) with the analysis of real-time streams(proactive systems). Several challenges arise whenconsidering the mining of real time data streams, especiallyconcerning the integration with historical analysiscomponents and the design of adequate system architecturalapparatus to support storage, computation andcommunication capabilities between them.IV. THE PROPOSED FRAMEWORKFig.3 shows the proposed framework, representing ourview on the components, tasks and flows of information of acomplete financial market monitoring system. From bottomto top, a past time or reactive monitoring engine is fed withdifferent types of data sources. From left to right, twomarkets, B and A, interact with each other in order toconsider potential intra and cross-market manipulationschemes. Data is initially fed into an InformationManagement component. Here different processes for datapreparation take place in order to combine and integrate thevariety of sources and types of structured and unstructureddata, putting them in the format required for the analysiscomponents. Restructured data along with updated patternsand models are used in this layer to perform a wide range ofanalysis, components that will be later used by the analyst ina modular or ad-hoc fashion, in a sequential or parallel way.In general, the components for analysis are grouped into twocategories, namely Behavioural Analysis and EconomicAnalysis. In this representation, Behavioural Analysiscategory contains one component application for socialnetwork analysis, one for text mining, and one for datamining applications. In parallel, the Economic Analysiscomponent includes one module for financial modelling, onefor data mining modelling and one for text mining analysis.The key difference between categories, then, is that the firsttype of analysis focuses on the actions and characteristics ofthe agents, and the second focuses on the effects of theseactions. In this sense, the analysis modules can performindependent examinations of the problem, or act incoordination and integration with modules within the samecategory or across categories. The output or outputs of theengine and the information management layer in any form orfashion will be recursively stored in a Knowledge Base, andmade available to the rest of the system.148148148148148
  • 5. Figure 3. Market Monitoring Framework (MMF).As shown in figure 3, warning signals and alarms aregenerated for Market A and Market B, which could beindistinctively, the venue of trading for an underlyingsecurity or its derivatives, but in general the frameworkcould be applied to different combinations of market types,and for a greater number of interactions between venues orsecurities. Accordingly, in the Output Managementcomponent, several steps are taken in order to process thewarning signals and alarms, recursively passinginformation to the Information Management component.Depending of the type of user, the Output Managementlayer will decide on the actions to be taken. In the case of aregulating authority this could be whether the flaggedtrades warrant further legal analysis, starting (or not) aformal investigative process, and/or following processes ofreporting and reinforcement (if applicable) of market rules.In the case of an arbitrage seeker of market trader, thiscould be used to decide whether to invest in a stock thatpresents symptoms of manipulation or any otheralternative investment actions.Finally, the reactive or past time monitoring detectionengine supports the investigation and enforcement ofmarket rules and controls in real time, by for example,implementing a Demand-driven Active Mining of DataStreams, embedded in the real time monitoring engine asin (Fan, Huang et al. 2004). Necessary tasks andarchitectural components, as well as informationmanagement processes for the required integration aretaken into consideration, and are part of the OutputManagement component.V. CASE SCENARIOThis section discusses a case scenario that considersthe perspective of a regulating authority in the form of amarket enforcer analyst. This type of user normally hasbroad access to market data, including several unstructuredsources such as news or financial form and fillings. It isassumed that the user is confronted with the problem ofraising early alarms for potential cases of manipulations,and thus, it would initially require powerful detectionengines to pre-screen thousands of trades generated in asimilar number of securities. The user is interested infiltering those which present abnormal characteristics,such as, sudden changes in trading volume, jumps in pricesand/or drastic changes in volatility. Also, the user is alsointerested in relating the unusual trading activity withunusual traders behaviour, such as, an increase in thenumber of insider trading, or links between coordinatedtraders performing last minute purchases in order to mark-the-close of or wash-sale a security.The user counts on the monitoring engine to create awatch-out list at the end of every trading day. A set ofuser-rules, will then be applied to the list in order to pre-allocate suspicious cases into one of the predefined classesof possible manipulation cases The user will then performfurther investigative analysis utilizing the differentcomponents available in the workbench of the detectionengine. The user expects the system to be reactive andsemi-automatic given the fact that the final status of a caseshould be subject to interpretation and overruling from thefinancial authority. The user also expects the system toserve as repository of historic cases and patterns ofmanipulations, information that could be used to learn149149149149149
  • 6. from past cases and improve the results of its analysiscomponents in the future. Fig. 4 shows the instantiation ofthe proposed framework for the case scenario outlinedabove.Figure 4. Case Scenario Instantiation of the MMF.A. Data SourcesThe case study uses real trading data as well as acollection of unstructured sources related to a case ofmarket manipulation occurred during the second half ofyear 2000 for the Zomax Inc. stock (SYMBOL: ZOMX),traded in the NASDAQ venue. In particular, the source ofdata for intraday transaction and quotes was the "TAQ"database [12] and it included all intraday transactions andbid and ask information for the stock for the year 2000.The intraday database was then populated withinformation relating to news and financial events collectedin the Factiva database [13]. This included informationreleased by the companies as material facts, insidertransaction form news and other news type totaling 424news items covering the 1999-2000 period. In addition, theCOMPUSTAT database [14]) was used to providesupplementary profiling financial information about theselected case, such as the SIC Code, market capitalizationand beta of the stock. COMPUSTAT was also used as thesource for market returns in the form of the S&P500 dailyindex. The Thomson Reuters Insider Filings Data Feed(IFDF) database was used as a source for all U.S. insideractivity as reported on Forms 3, 4, 5, and 144 in line-by-line detail totaling 942 items covering the 1999-2000period. The IFDF is available at the Wharton ResearchData Services [12]Finally, detailed information regarding the proceedingsactions initiated by the SEC regarding this case can befound in the EDGAR on line database athttp://www.sec.gov/litigation/complaints/comp19262.pdf.B. Information ManagementIn terms of the proposed framework, the informationmanagement layer received and stored data from thevarious sources assuming a day by day granularity. Morespecifically, second by second intraday data wasaggregated into hourly representative observations andstructured data sources, such as, COMPUSTAT and IFDF,data were stored in a relational database. Using post-processed data, different indicators, such as, abnormalreturns, average volume, volatility of returns or cumulativenumber of Form 4 and Form 144 fillings, were calculatedand then used by the analysis components inside the casemonitoring engine. Similarly, unstructured data sources,namely, news items coming from Factiva, were stored inthe same database, maintaining whenever possible theiroriginal xml tags. Different text mining analysers werebuilt in order to extract key concepts from the textualsources and to find categories or clusters in Form 144information. Consequently, new standardized and cleandata was available in a as if daily basis updating theknowledge database component inside the enginerespectively.More specifically, as shown in Fig.4, the informationmanagement layer included a range data preparation toolscomponents; normal database manipulation operationscomponents, such as query and OLAP reporting; and otherdata and text mining components. The different tasks andcomponents were developed following the guidelines ofthe CRISP Data Mining reference model [15] using theIBM-SPSS PASW13 data and text mining workbench. Asusual as in any data mining task work was divided in sixstages: business understanding, data understanding, datapreparation, modelling, evaluation and deployment.In particular, the economic analysis uses the outputfrom the news mining component that extracts a list of keyconcepts mentioned in the available news of the day inorder to give some insight on the frequency and content ofthe news and to the number, type and frequency of theinsider filling forms submitted to SEC as in the work of[16]. An additional data mining module performs outlierdetection analysis using the financial data. The strategyconsiders a two stage mining approach implementing asequence of outlier detection algorithms and decision trees(unsupervised and supervised learning techniques). Thistwo-stage strategy helps in discovering outliers in price,volume and volatility indicators that are not associatedwith the existence of news. In addition, the decision treesalgorithms allows the user not only to signal suspiciousoutliers in financial indicators, but also to understandbetter the patterns of trading associated with normal andsuspicious of manipulations trades and funds as in thework of [17].150150150150150
  • 7. The behavioural analysis utilizes the data from theinsider filling forms by performing traditional databaseoperations such as a queries and OLAP cube analysis, andalso an association rules data mining component,following a similar mining strategy to the one proposed inthe work of [8]. The objective of these components is tofind inside in potential associations between identity tagsof insiders, trading information such as number of stocksor derivatives traded or intended to trade, the broker usedto execute the transaction, and time and date of thetransactions. If pairs of identity tags are associated withparticular groups of insiders or brokers, in a given timeframework, say at or near the closing time of trading daysor before a material news release, this could be apreliminary signal of manipulation.The case scenario assumes as the starting point themoment when the monitoring system triggers an automaticalarm after detecting a sharp drop in the price of theZOMX stock together with a sudden increase in thetrading volume during the 22nd of September 2000.Predefined user-rules pre-allocates this suspicious case inthe insider trading category after checking that the weeklytotal of Form 4 fillings submitted by insiders was higherthan the average of the last year. Then, the analyst starts aninvestigation by performing different analysis tasks asdiscussed in the following.C. Economic AnalysisBased on the financial theory, markets respond to theappearance of new information, and thus, stocks that werementioned in the news of the day are likely to show somereaction or effect that could be captured either as asignificant move in returns, volume of trading or change involatility. In this sense, the existence of news relating to aparticular fund is relevant to help discriminating the stocksthat react due to the appearance of new information fromthe ones that react due to the effects of marking-the-closeand wash-trades manipulations. In other words,significant movements in specific financial indicators thatare not associated with the appearance of news can be seenas another symptom of manipulation [18]. Nonetheless,insiders with access to non-public material informationcould trade before the new information is released to thepublic, gaining an unfair advantage with respect of the restof the market.As a first analysis task, then, the analyst produces twographical views of the trading activity on the ZOMXstock. Fig. 5 and Fig. 6 presents an example of the type ofviews that could be produced by the analyst. In particularFig. 5, presents the analyst with the price performance ofthe ZOMX stock overlaid with the values of the alarmindicator represented by the size and the colour of thepoints in the graph. A quick view provides the informationthat this is the only critical alarm (red big circles) that havebeen raised for this stock during the previous months.Figure 5. Data mining outlier detection engine visualization.Figure 6. Time series visualization of key indicators.Fig. 6 presents a summary view of four time series forthe recent months (5th of June to 22th of September 2000).From top to bottom, the first two panels show a line plot ofthe behaviour of the price and trading volume associatedwith the ZOMX stock. The third panel shows thecumulative number of insider filling forms submitted toSEC. The fourth panel shows the number of news itemsreleased during the corresponding date. It is possible toobserve that the drop in price came together with hugeincrease in trading volume, and that effectively the numberof insider fillings has been increasing during the lastmonth. The number of news did also present a peak duringthe previous day. Based on the expected patterns suggestedby financial theory, the analyst studies a sample of thenews released on the 21st of September (see appendix) andconcludes that the reason behind the increase on thenumber of trading and the drop in prices was that thecompany announces that its third quarter 2000 financialresults will be lower than current consensus estimates.Additionally, the analyst confirms the user-rule criteria byalso formally considering the case as a suspicious insidertrading case.D. Behavioral AnalysisThe next step of the analyst investigative process is tofind out which insiders have been actively trading on theZOMX stock or derivatives before the release of thematerial news. The analyst performs a database queryoperation to create an OLAP report. Fig. 7 presents theoutput of this query. Based on this output the analyst151151151151151
  • 8. discovers that Bedard, Michelle (BM) Vice President, andAnderson, James (AM) Chief Executive Officer, havebeen the two most active insiders. Column ‘S’ correspondsto the total number of stock sold by the insiders, andColumn ‘M’ to the total number of stock options executedduring the first 9 months of year 2000, information thatwas reported mainly in Forms 4.Figure 7. OLAP analysis IFDF.Next the analyst is interested in the trading evolution ofthe suspicious insiders. The analyst produces two views,one for each insider, summarizing the information on totalsales and total number of shares held or declared as heldby the insiders. Both insiders have been increasing theirnumber of sales sold as can be seen in panels (a) of Fig. 8and Fig. 9. More importantly, both insiders have declare adrastic reduction on the stocks held by them as can be seenin panels (b) of Fig. 8 and Fig. 9.Bedard, MichelleCumulative Sells Indicator Form 4 - (a)Bedard, MichelleShares Held Form 144 - (b)Figure 8. Visualization analysis on insiders activity (BM).James, AndersonCumulative Sells Indicator Form 4 - (a)James, AndersonShares Held Form 144 - (b)Figure 9. Visualization analysis on insiders activity (JA).The analyst is interested to check if the insiders havebeen acting in coordination with each other or with otheragents, for example, selling their stocks during the samedays, or periods. The analyst performs an association andco-occurrence of events analysis using the respectivecomponent. Fig. 10 presents the graphical representationof the association analysis. As can be seen in Fig. 10 ispossible to appreciate a strong relationship between thedate when the trades were made, and the broker the insiderused to place their trading. For example, the bottom blueconnection shows a strong relationship (from right to left)between BEDARD MICHELLE – ANDERSON JAMES –a group of trades occurred during July though August –and “rj steichen” and “charles schwab” brokers.Figure 10. Forms 4 and 144 are used to explore associativerelationships.152152152152152
  • 9. VI. CONCLUSIONSIn this paper, a systematic framework of marketmonitoring is introduced. The work articulates the currentand potential characteristics of market monitoring systems,their components, information management flows andtheir interactions. This paper contributes to research aswell as practice in several dimensions: it provides ananalytical scheme which can be easily used to map currentor desired characteristics of market monitoring systems; itcan be used to identify areas of potential improvement forfuture research, resulting in a useful instrument for theanalysis, design, testing and management of detection,monitoring and analysis systems for financial markets;finally, it can also be used to complement existingmethods for developing business intelligence systemsconsidering the processes architectures and applications.To validate the framework, the paper provides aframework instantiation case scenario that analyses howspecific components, interact with other parts of thesystems and can be used to improve the effectiveness ofthe market monitoring systems.In terms of future research, the applicability of theframework will be assessed by instantiating the frameworkwith additional case scenarios involving social networkinganalysis components, real time analysis components, inter-market scenarios, e.g., relationship between derivativesand stock markets, inter-country scenarios, e.g. euro zoneand others. Another aspect of future research relates to theuse of the framework as a mechanism to validate and auditexisting monitoring systems and processes and thedevelopment of a full ontology for market manipulationand financial concepts.REFERENCES[1] R. K. Aggarwal, and G. Wu, “Stock Market Manipulations,”Journal of Business, vol. 79, no. 4, pp. 1915-1953, 2006.[2] H. Goldberg, J. Kirkland, D. Lee et al., "The NASD SecuritiesObservation, News Analysis & Regulation System(SONAR)."[3] J. D. Kirkland, and T. E. Senator, “The NASD RegulationAdvanced-Detection System,” AI Magazine, vol. 20, no. 1, pp.55, Spring99, 1999.[4] Financial Services Authority, "Handbook," 2007.[5] M. M. Carhart, R. O. N. Kaniel, D. K. Musto et al., “Leaningfor the Tape: Evidence of Gaming Behavior in Equity MutualFunds,” Journal of Finance, vol. 57, no. 2, pp. 661-693, 2002.[6] S. Donoho, “Early detection of insider trading in optionmarkets,” in Proceedings of the tenth ACM SIGKDDinternational conference on Knowledge discovery and datamining, Seattle, WA, USA, 2004.[7] T. E. Senator, “Ongoing management and application ofdiscovered knowledge in a large regulatory organization: acase study of the use and impact of NASD RegulationsAdvanced Detection System (RADS),” in Proceedings of thesixth ACM SIGKDD international conference on Knowledgediscovery and data mining, Boston, Massachusetts, UnitedStates, 2000.[8] J. Mongkolnavin, and S. Tirapat, “Marking the Close analysisin the Thai Bond Market Survaillence using association rules,”Expert Systems with Applications, vol. 36, pp. 8523-8527,2009.[9] H. Ogut, M. Doganay, and R. Aktas, “Detecting stock-pricemanipulation in an emerging market: The case of Turket,”Expert Systems with Applications, vol. 36, pp. 8523-8527,2009.[10] T. Bollerslev, “Generalized autoregressive conditionalheterocedastocity,” Journal of Econometrics, vol. 31, pp. 307-327, 1986.[11] C. Westphal, and T. Blaxton, Data mining solutions: methodsand tools for solving real-world problems, New York, NY,US: John Wiley & Sons, Inc., 1998.[12] Wharton Research Data Services, 2009.[13] Dow Jones Factiva, 2009.[14] Standard and Poors Compustat Resource Center, 2009.[15] P. Chapman, J. Clinton, R. Kerber et al., CRISP-DM 1.0 Step-by-step data mining guide, 2000.[16] M. Zaki, D. Díaz, and B.Theodoulidis, "Using Text MiningTo Analyze Quality Aspects Of Unstructured Data: A caseStudy For ‘Stock-Touting’ Spam Emails."[17] D. Diaz, B. Theodoulidis, and P. Sampaio, "Analysis of StockMarket Manipulations Using Knowledge DiscoveryTechniques Applied to Intraday Trade Prices," SSRNeLibrary, 2010.[18] J. Van Bommel, “Rumors,” Journal of Finance, vol. 58, no. 4,pp. 1499-1520 2003.APPENDIXExample of news item released on 21-09-2000"<?xml version=""1.0"" encoding=""UTF-8""?>"<ppsarticle><article><accessionNo>prn0000020010812dw9l03qe1</accessionNo><reference>distdoc:archive/ArchiveDoc::Article/prn0000020010812dw9l03qe1</reference><baseLanguage>EN</baseLanguage><copyright>"(Copyright (c) 2000, PR Newswire)"</copyright><headline>" <paragraph display=""Proportional"" truncation=""None"" lang=""EN"">"Zomax Incorporated Comments on Expected 2000 Financial Results</paragraph></headline><leadParagraph>" <paragraph display=""Proportional"" truncation=""None"">""MINNEAPOLIS, Sept. 21 /PRNewswire/ -- Zomax Incorporated (Nasdaq:ZOMX)"today announced that its third quarter 2000 financial results will be lowerthan current consensus estimates. The Company expects third quarter 2000revenues of $57 to $59 million and diluted earnings of $.15 to $.17 per share."Revenues through the nine months ending September 29, 2000 are expected to be""$177 to $179 million, with earnings of $.57 to $.59 per share. Gross margins"will continue strong at approximately 30% with operating income margins ofapproximately 15%. Full year revenues are expected to be $237 to $245"million, with earnings of $.75 to $.80 per share."</paragraph>" <paragraph display=""Proportional"" truncation=""None"">"The shortfall is primarily the result of general market softness and in"particular the European market, a major customer modifying a third quarter""program that the Company was unable to replace with other business, an"increase in polycarbonate prices due to increasing crude oil prices andfurther weakening of European currencies.</paragraph></leadParagraph><publicationDate><dateTime>2000-09-21T20:46:00Z</dateTime></publicationDate><sourceName>PR Newswire</sourceName>" <company code=""ZOMOPT"">"<name>ZOMAX INC (USA)</name>153153153153153