JP6932680B2 - Trading Examination Equipment, Trading Examination Method and Trading Examination Program - Google Patents

Description

The present invention relates to a trading examination device, a trading examination method, and a trading examination program.

Conventionally, trading examinations have been conducted to detect transactions suspected of being unfair transactions in the financial instruments market such as the stock market. The trading examination includes an investigation stage for extracting cases suspected of being unfair trade and an examination stage for analyzing the extracted cases in detail.

As an attempt to automate the search stage, the following Non-Patent Document 1 is provided with a case in which unfair trade is suspected by adding a label to the transaction data indicating whether or not the data is related to a transaction suspected of being unfair trade. A technique for generating a model to be extracted by supervised learning is described.

J. Zhai, Y. Cao, Y. Yao, X. Ding, and Y. Li, "Computational intelligent hybrid model for detecting disruptive trading activity", Decision Support Systems, 2017, Vol. 93, p. 26-41

In the technique described in Non-Patent Document 1, it is necessary to add a label indicating whether or not the data is related to a transaction suspected of being unfair trade to the transaction data to create teacher data. Therefore, the cost of creating teacher data becomes excessive.

In addition, a method of extracting transactions suspected of being unfair transactions is adopted in practice according to a predetermined extraction standard, and although the entire market is handled in a unified manner, the turnover 20% involvement rate, etc. It is an extraction based on the numerical criteria of, and transactions with suspicion of unfair trade and transactions without suspicion are extracted at the same time, and most of the extraction results are transactions without suspicion of unfair trade. Therefore, it is difficult to efficiently extract transactions suspected of being unfair transactions with existing methods.

Therefore, the present invention provides a trading examination device, a trading examination method, and a trading examination program for determining whether transaction data is suspected of being unfair trade by a learning model that does not require teacher data.

The trading examination device according to one aspect of the present invention is based on the first transaction data relating to the buying and selling of financial products and the second transaction data relating to the buying and selling of financial products, which is different from the first transaction data. An estimation unit that estimates the density ratio between the probability distribution of transaction data and the probability distribution of the second transaction data, a calculation unit that calculates the degree of abnormality of the second transaction data based on the density ratio function, and a first unit based on the degree of abnormality. (2) A first determination unit for determining whether the transaction data includes the first suspected data suspected of being unfair transaction is provided.

According to this aspect, the probability distribution of the first transaction data and the probability distribution of the second transaction data are directly estimated by estimating the density ratio between the probability distribution of the first transaction data and the probability distribution of the second transaction data. It is not necessary to do so, and the degree of abnormality of the second transaction data can be calculated by a learning model that does not require teacher data. As a result, it is possible to determine whether the second transaction data includes the first suspected data suspected of being unfair trade by a learning model that does not require teacher data.

In the above aspect, the first transaction data may be transaction data for a longer period than the second transaction data.

According to this aspect, since the period of the first transaction data is longer than the period of the second transaction data, the probability distribution of the normal transaction can be represented by the probability distribution of the first transaction data. The degree of anomaly can be calculated appropriately.

In the above aspect, the first transaction data and the second transaction data may include data regarding the trading order volume for a predetermined period.

According to this aspect, it is possible to capture a sudden increase or decrease in the volume of buy / sell orders, and it is possible to determine whether the second transaction data includes the first suspected data in which unfair trading such as a spoofing is suspected.

In the above aspect, the first transaction data and the second transaction data may include data regarding the amount of cancellation of a buy / sell order for a predetermined period.

According to this aspect, it is possible to capture a sudden increase or decrease in the amount of cancellation of a buy / sell order, and it is possible to determine whether the second transaction data includes the first suspected data in which unfair trading such as a spoofing is suspected.

In the above aspect, the first determination unit may determine the data included in the second transaction data in which the degree of abnormality belongs to the higher predetermined ratio as the first suspected data.

According to this aspect, it is possible to determine whether the second transaction data includes the first suspected data suspected of being unfair trade without setting an absolute threshold value for the degree of abnormality.

In the above aspect, the first determination unit determines that among the data included in the second transaction data, the data in which the degree of abnormality belongs to the upper predetermined ratio and the price range in the predetermined period is equal to or greater than the first threshold value is determined as the first suspected data. You may.

According to this aspect, by setting the first threshold value for the price range without setting the absolute threshold value for the degree of anomaly, the second transaction data includes the first suspected data suspected of being unfair trade. It can be judged with high accuracy.

In the above aspect, the first determination unit determines that among the data included in the second transaction data, the data in which the degree of abnormality belongs to the upper predetermined ratio and the volume in the predetermined period is equal to or higher than the second threshold value is determined as the first suspected data. You may.

According to this aspect, by setting the second threshold value for the trading volume without setting the absolute threshold value for the degree of anomaly, the second transaction data includes the first suspected data suspected of being unfair trade. It can be judged with high accuracy.

In the above aspect, a graph generation unit that generates a first graph showing the time change of the degree of abnormality may be further provided.

According to this aspect, the time change of the degree of abnormality can be intuitively grasped, and the period during which unfair trade is suspected can be grasped at a glance.

In the above aspect, the graph generation unit may further generate a second graph showing the time change of the second transaction data and identifiable the first suspected data in the second transaction data.

According to this aspect, the portion where unfair trade is suspected can be grasped at a glance by the second graph which shows the first suspected data in the second transaction data in an identifiable manner.

In the above aspect, a second determination unit for determining whether the second transaction data includes the second suspected data suspected of being unfair trade is further provided based on a predetermined standard, and the second graph is the first suspected data. , The overlap of the second suspected data and the first suspected data and the second suspected data may be identifiable.

According to this aspect, by showing the overlap of the first suspect data, the second suspect data, the first suspect data and the second suspect data in an identifiable manner, the first suspect data extracted by the learning model is defined in advance. It is possible to grasp at a glance the commonalities and differences with the second suspected data extracted based on the above criteria.

In the above aspect, a schedule generation unit may be further provided to generate a transaction schedule that shows the time change of the second transaction data and identifiable the first suspected data in the second transaction data.

According to this aspect, the part where the unfair transaction is suspected can be grasped at a glance by the transaction schedule showing the first suspected data in the second transaction data in an identifiable manner.

In the above aspect, a second determination unit for determining whether the second transaction data includes the second suspected data suspected of being unfair trade is further provided based on a predetermined standard, and the transaction schedule is the first suspected data. , The overlap of the second suspected data and the first suspected data and the second suspected data may be identifiable.

According to this aspect, by showing the overlap of the first suspect data, the second suspect data, the first suspect data and the second suspect data in an identifiable manner, the first suspect data extracted by the learning model is defined in advance. It is possible to grasp at a glance the commonalities and differences with the second suspected data extracted based on the above criteria.

The transaction examination method according to another aspect of the present invention is based on the first transaction data relating to the buying and selling of financial instruments and the second transaction data relating to the buying and selling of financial instruments, which is different from the first transaction data, and is based on a density ratio function. Estimating the density ratio between the probability distribution of the first transaction data and the probability distribution of the second transaction data, calculating the degree of abnormality of the second transaction data based on the density ratio function, and the second based on the degree of abnormality. Includes determining whether the transaction data includes first suspected data that is suspected of being unfair.

According to this aspect, the probability distribution of the first transaction data and the probability distribution of the second transaction data are directly estimated by estimating the density ratio between the probability distribution of the first transaction data and the probability distribution of the second transaction data. It is not necessary to do so, and the degree of abnormality of the second transaction data can be calculated by a learning model that does not require teacher data. As a result, it is possible to determine whether the second transaction data includes the first suspected data suspected of being unfair trade by a learning model that does not require teacher data.

The trading examination program according to another aspect of the present invention uses a density ratio function based on the first transaction data relating to the buying and selling of financial products and the second transaction data relating to the buying and selling of financial products, which is different from the first transaction data. An estimation unit that estimates the density ratio between the probability distribution of the first transaction data and the probability distribution of the second transaction data, a calculation unit that calculates the degree of abnormality of the second transaction data based on the density ratio function, and a first unit based on the degree of abnormality. 2 It functions as a first judgment unit for determining whether the transaction data includes the first suspected data suspected of being unfair transaction.

According to this aspect, the probability distribution of the first transaction data and the probability distribution of the second transaction data are directly estimated by estimating the density ratio between the probability distribution of the first transaction data and the probability distribution of the second transaction data. It is not necessary to do so, and the degree of abnormality of the second transaction data can be calculated by a learning model that does not require teacher data. As a result, it is possible to determine whether the second transaction data includes the first suspected data suspected of being unfair trade by a learning model that does not require teacher data.

According to the present invention, there is provided a trading examination device, a trading examination method, and a trading examination program for determining whether transaction data is suspected of being unfair trade by a learning model that does not require teacher data.

It is a figure which shows the outline of the trading examination system which concerns on embodiment of this invention. It is a figure which shows the functional block of the trading examination apparatus which concerns on this embodiment. It is a figure which shows the physical structure of the trading examination apparatus which concerns on this embodiment. It is a flowchart of the 1st process executed by the trading examination apparatus which concerns on this embodiment. It is a flowchart of the determination process of the 1st suspect data executed by the trading examination apparatus which concerns on this embodiment. It is a flowchart of the 2nd process executed by the trading examination apparatus which concerns on this embodiment. It is a figure which shows the classification of the transaction data by the trading examination apparatus which concerns on this embodiment. It is a figure which shows the transaction schedule generated by the trading examination apparatus which concerns on this embodiment. It is a figure which shows the 1st graph generated by the trading examination apparatus which concerns on this embodiment. It is a figure which shows the 2nd graph generated by the trading examination apparatus which concerns on this embodiment.

Hereinafter, embodiments according to one aspect of the present invention (hereinafter, referred to as “the present embodiment”) will be described with reference to the drawings. In each figure, those having the same reference numerals have the same or similar configurations.

FIG. 1 is a diagram showing an outline of a trading examination system 100 according to an embodiment of the present invention. The trading examination system 100 includes a trading examination device 10, a first user terminal 20, a second user terminal 30, a securities company database 40, and an information vendor database 50. The configuration shown in the figure is an example of the sales examination system 100, and the sales examination system 100 may include other configurations or may not include a part of the configurations.

The trading examination device 10 analyzes transaction data related to the buying and selling of financial products, and determines whether the transaction data includes suspected data on suspected unfair transactions. Unfair trading includes insider trading, market manipulation trading, pump and dump, and pseudonym trading. In the present embodiment, a case where the trading examination device 10 determines whether or not the transaction data includes suspected data in which market manipulation trading by a spoofing is suspected will be described.

The first user terminal 20 and the second user terminal 30 are terminals used by a business operator that conducts a sales examination. The first user terminal 20 and the second user terminal 30 independently request the trading examination device 10 to extract suspicious data in order to independently examine whether or not unfair transactions have been performed on different transaction data.

The securities company database 40 has customer data DB1 and transaction data DB2. The securities company database 40 stores information about the customer in the customer data DB 1, associates it with the customer identification information, and stores the transaction data of the customer in the transaction data DB 2. The securities company database 40 provides transaction data to the trading examination device 10 after performing anonymous processing processing as necessary.

The information vendor database 50 has a market data DB3. The information vendor database 50 stores market information such as quote information and order information (hereinafter referred to as “board information”) of financial products and contract information as time-series data in the market data DB 3. The information vendor database 50 provides the trading examination device 10 with board information and market price information of financial instruments recorded at arbitrary time intervals.

FIG. 2 is a diagram showing a functional block of the trading examination device 10 according to the present embodiment. The trading examination device 10 includes an acquisition unit 11, an estimation unit 12, a calculation unit 13, a first determination unit 14, a second determination unit 15, a schedule generation unit 16, and a graph generation unit 17.

The acquisition unit 11 acquires customer information, transaction data, and market data from the customer data DB1, the transaction data DB2, and the market data DB3. The acquisition unit 11 acquires at least transaction data including board information and market price information of financial products, and does not necessarily have to acquire customer information.

The estimation unit 12 uses a density ratio function to obtain a probability distribution and a first transaction data of the first transaction data based on the first transaction data relating to the buying and selling of financial products and the second transaction data different from the first transaction data regarding the buying and selling of financial products. 2 Estimate the density ratio of transaction data to the probability distribution. Here, the first transaction data may be transaction data for a longer period than the second transaction data. For example, the second transaction data may be one day's worth of trading data on a stock, and the first trading data may be one week's worth of trading data on the same stock. The first transaction data and the second transaction data may be randomly selected. In that case, the first transaction data may include transaction data suspected of being unfair transaction, but the period of the first transaction data is longer than the period of the second transaction data, so that the probability of the first transaction data The probability distribution of a normal transaction can be approximated by the distribution, and the degree of abnormality of the second transaction data can be appropriately calculated.

The first transaction data and the second transaction data may include data regarding the trading order volume for a predetermined period. As a result, it is possible to capture a sudden increase or decrease in the volume of buy / sell orders, and it is possible to determine whether the second transaction data includes the first suspected data in which unfair trading of the spoofing is suspected.

In addition, the first transaction data and the second transaction data may include data relating to the amount of cancellation of a buy / sell order for a predetermined period. As a result, it is possible to capture a sudden increase or decrease in the amount of cancellation of a buy / sell order, and it is possible to determine whether the second transaction data includes the first suspected data in which unfair trading such as a spoofing is suspected.

The first transaction data represented as x _{i (i} = 1~n), the second transaction data representing the _{x'i (i} = 1~n'), the probability distribution of the first transaction data represented as q (x) , The probability distribution of the second transaction data is expressed as q'(x), and the density ratio function is defined as r (x) = q'(x) / q (x). At this time, the estimation unit 12 calculates _{w k} of r (x) = Σ ^{k = 1 b} w _k φ _k (x) _{using a predetermined basis function φ k (x) (k = 1 to b).} By doing so, the density ratio function may be calculated. Here, the basis functions, for example, extracted random number b of data c _k a (k = 1 to b) from the second transaction data _x'i,
You may choose _{φ k} (x) = Kσ (x, c _k). Here, Kσ is a Gaussian kernel having a standard deviation of σ.

The estimation unit 12 may calculate _{w k} so as to minimize the square error of the density ratio function. In this case, adding a secondary regularization term about w _k, the analytical solution of w _k is given by the following equation (1).

The quantity shown in bold in the formula (1) indicates that it is a vector or a matrix. Here, the matrix H on the right side is a quantity given by the following mathematical formula (2).

That is, the matrix H is a b × b matrix, and is composed of a value obtained by substituting the first transaction data x _{i into the basis function φ k.}

Further, the vector h on the right side of the mathematical formula (1) is a quantity given by the following mathematical formula (3).

That is, the vector h is constituted by a value obtained by substituting the second transaction data _x'i basis function phi _k.

_{Further, I b on} the right side of the equation (1) represents the identity matrix of b × b, and the coefficient λ is the Lagrange undetermined multiplier of the quadratic regularization term.

If the component of the vector w becomes negative according to the mathematical formula (1), the component may be replaced with 0. In this way, the estimation unit 12 can estimate the density ratio at high speed when the first transaction data and the second transaction data are given.

The calculation unit 13 calculates the degree of abnormality of the second transaction data based on the density ratio function. When the second transaction data is represented by x, the density ratio function is represented by r (x), and the degree of abnormality is represented by a (x), the calculation unit 13 uses a (x) = -log [r (x)]. The degree of anomaly may be calculated. Here, log may be a natural logarithm. By calculating the degree of abnormality in this way, when the density ratio function is close to 1, the degree of abnormality is almost 0, and when the degree of abnormality is smaller than 1, the degree of abnormality shows a positive peak. That is, when the difference between the probability distribution of the first transaction data and the probability distribution of the second transaction data is small, the degree of abnormality is almost 0, and the difference between the probability distribution of the first transaction data and the probability distribution of the second transaction data is large. In some cases, the anomaly shows a positive peak.

The first determination unit 14 determines whether the second transaction data includes the first suspected data suspected of being unfair trade based on the degree of abnormality. More specifically, the first determination unit 14 may determine the data included in the second transaction data in which the degree of abnormality belongs to the higher predetermined ratio as the first suspected data. By making such a determination, it is possible to determine whether the second transaction data includes the first suspected data suspected of being unfair trade, without setting an absolute threshold value for the degree of abnormality.

The first determination unit 14 may determine that among the data included in the second transaction data, the data in which the degree of abnormality belongs to the upper predetermined ratio and the price range in the predetermined period is equal to or greater than the first threshold value is determined as the first suspected data. .. In this way, by setting the first threshold value for the price range without setting the absolute threshold value for the degree of abnormality, it is more accurate whether the second transaction data includes the first suspected data suspected of being unfair trade. Can be determined.

Further, the first determination unit 14 determines that among the data included in the second transaction data, the data in which the degree of abnormality belongs to the upper predetermined ratio and the volume in the predetermined period is equal to or higher than the second threshold value is determined as the first suspected data. May be good. In this way, by setting the second threshold value for the trading volume without setting the absolute threshold value for the degree of abnormality, it is more accurate whether the second transaction data includes the first suspected data suspected of being unfair trade. Can be determined.

The second determination unit 15 determines whether the second transaction data includes the second suspected data suspected of being unfair trade based on a predetermined standard. The second determination unit 15 determines, for example, whether the buy / sell order volume in the predetermined period is equal to or greater than the threshold value, the cancellation amount of the buy / sell order in the predetermined period is equal to or greater than the threshold value, the price range in the predetermined period is equal to or greater than the threshold value, or the predetermined period. It may be determined whether or not the second trading data includes the second suspected data that is suspected of being unfair trading, using the criteria such as whether or not the trading volume of the trading volume is equal to or higher than the threshold value.

The schedule generation unit 16 generates a transaction schedule that shows the time change of the second transaction data and identifiable the first suspected data in the second transaction data. The transaction schedule may be transmitted to the first user terminal 20 and the second user terminal 30. The transaction schedule may represent, for example, the time change of the transaction data of the stock, and may include the market, the identification information of the stock, the identification information of the customer, the identification information of the order, the transaction date and time, the volume and the contract price. However, it may contain other information. The transaction schedule may be a table showing a so-called step value showing a history of executions for a specific stock. The schedule generation unit 16 may highlight and display the first suspected data in the second transaction data by highlighting or displaying it in a large size. The transaction schedule that identifiable the first suspected data in the second transaction data makes it possible to grasp at a glance where unfair transactions are suspected.

The transaction schedule may be such that the overlap of the first suspect data, the second suspect data, the first suspect data and the second suspect data can be discriminated. In the transaction schedule, for example, the first suspected data is highlighted in the first color (for example, orange), the second suspected data is highlighted in the second color (for example, yellow), and the first suspected data is displayed. The overlap of the second suspected data may be highlighted in a third color (for example, red). By showing the overlap of the first suspect data, the second suspect data, the first suspect data and the second suspect data in an identifiable manner, the first suspect data extracted by the learning model and the first suspect data extracted based on a predetermined standard are extracted. The commonalities and differences with the second suspected data can be grasped at a glance.

The graph generation unit 17 generates a first graph showing the time change of the degree of abnormality. The first graph may be transmitted to the first user terminal 20 and the second user terminal 30. The first graph may be, for example, a graph in which the degree of abnormality of the second transaction data is plotted every second. From the first graph, it becomes possible to intuitively grasp the time change of the degree of abnormality, and it becomes possible to grasp at a glance the period during which unfair trade is suspected.

The graph generation unit 17 may further generate a second graph showing the time change of the second transaction data and identifiable the first suspected data in the second transaction data. The second graph may be, for example, a graph showing price fluctuations of stocks, and may highlight a section corresponding to the first suspected data. The second graph, which shows the first suspected data in the second transaction data in an identifiable manner, makes it possible to grasp at a glance the part where unfair trade is suspected.

The second graph may show the overlap of the first suspect data, the second suspect data, the first suspect data and the second suspect data in an identifiable manner. In the second graph, for example, the section of the first suspected data is highlighted in the first color (for example, orange), the section of the second suspected data is highlighted in the second color (for example, yellow), and the second graph is displayed. The section where the 1 suspected data and the 2nd suspected data overlap may be highlighted in a third color (for example, red). The second graph may show the overlap of the first suspect data, the second suspect data, and the first suspect data and the second suspect data in a manner corresponding to the transaction schedule so as to be distinguishable. By showing the overlap of the first suspect data, the second suspect data, the first suspect data and the second suspect data in an identifiable manner, the first suspect data extracted by the learning model and the first suspect data extracted based on a predetermined standard are extracted. The commonalities and differences with the second suspected data can be grasped at a glance.

FIG. 3 is a diagram showing a physical configuration of the trading examination device 10 according to the present embodiment. The trading examination device 10 includes a CPU (Central Processing Unit) 10a corresponding to a calculation unit, a RAM (Random Access Memory) 10b corresponding to a storage unit, a ROM (Read Only Memory) 10c corresponding to a storage unit, and a communication unit. It has 10d, an input unit 10e, and a display unit 10f. Each of these configurations is connected to each other via a bus so that data can be transmitted and received. In this example, the case where the sales examination device 10 is composed of one computer will be described, but the sales examination device 10 may be realized by combining a plurality of computers. Further, the configuration shown in FIG. 3 is an example, and the trading examination device 10 may have a configuration other than these, or may not have a part of these configurations.

The CPU 10a is a control unit that controls execution of a program stored in the RAM 10b or ROM 10c, calculates data, and processes data. The CPU 10a is a calculation unit that executes a program (trading examination program) for determining whether the transaction data includes data suspected of being unfair trade. The CPU 10a receives various data from the input unit 10e and the communication unit 10d, displays the calculation result of the data on the display unit 10f, and stores it in the RAM 10b or ROM 10c.

The RAM 10b is a storage unit in which data can be rewritten, and may be composed of, for example, a semiconductor storage element. The RAM 10b may store data such as a trading examination program and transaction data executed by the CPU 10a. It should be noted that these are examples, and data other than these may be stored in the RAM 10b, or a part of these may not be stored.

The ROM 10c is a storage unit capable of reading data, and may be composed of, for example, a semiconductor storage element. The ROM 10c may store, for example, a trading examination program or data that is not rewritten.

The communication unit 10d is an interface for connecting the trading examination device 10 to another device. The communication unit 10d may be connected to a communication network N such as the Internet.

The input unit 10e receives data input from the user, and may include, for example, a keyboard and a touch panel.

The display unit 10f visually displays the calculation result by the CPU 10a, and may be configured by, for example, an LCD (Liquid Crystal Display). The display unit 10f may display a transaction schedule of transaction data, a first graph of the degree of abnormality, and a second graph of transaction data.

The trading examination program may be stored in a storage medium readable by a computer such as RAM 10b or ROM 10c and provided, or may be provided via a communication network connected by the communication unit 10d. In the trading examination device 10, the CPU 10a executes the trading examination program to realize various operations described with reference to FIG. It should be noted that these physical configurations are examples and do not necessarily have to be independent configurations. For example, the trading examination device 10 may include an LSI (Large-Scale Integration) in which the CPU 10a, the RAM 10b, and the ROM 10c are integrated.

FIG. 4 is a flowchart of the first process executed by the trading examination device 10 according to the present embodiment. First, the trading examination device 10 acquires the first transaction data for one week (S10), and then acquires the second transaction data for one day (S11).

After that, the trading examination device 10 estimates the density ratio between the probability distribution of the first transaction data and the probability distribution of the second transaction data by the density ratio function based on the first transaction data and the second transaction data (S12). .. Further, the trading examination device 10 calculates the degree of abnormality of the second transaction data based on the density ratio obtained by the density ratio function (S13).

Further, the trading examination device 10 determines whether the second transaction data includes the first suspected data suspected of being unfair trade based on the degree of abnormality (S14). As described above, according to the trading examination device 10 according to the present embodiment, the density ratio between the probability distribution of the first transaction data and the probability distribution of the second transaction data is estimated without assuming the probability distribution for the variate. This eliminates the need to directly estimate the probability distribution of the first transaction data and the probability distribution of the second transaction data, and the degree of abnormality of the second transaction data can be calculated by a learning model that does not require teacher data. As a result, it is possible to determine whether the second transaction data includes the first suspected data suspected of being unfair trade by a learning model that does not require teacher data.

FIG. 5 is a flowchart of the determination process of the first suspected data executed by the trading examination device 10 according to the present embodiment. FIG. 4 shows the details of the process (S14) for determining whether the second transaction data includes the first suspected data suspected of being unfair trade, which is shown in FIG.

First, the trading examination device 10 extracts data belonging to the top 50% of the degree of abnormality (S141). However, it is possible to appropriately adjust the percentage of data to which the degree of abnormality belongs to the top.

The trading examination device 10 narrows down the data having a price range of the first threshold value or more among the data belonging to the top 50% of the abnormalities (S142). Further, the trading examination device 10 narrows down the data whose trading volume is equal to or higher than the second threshold value (S143). Then, the trading examination device 10 determines the narrowed down data as the first suspected data (S144).

FIG. 6 is a flowchart of the second process executed by the trading examination device 10 according to the present embodiment. In the figure, the second process performed after the first process shown in FIG. 4 is shown.

First, the trading examination device 10 generates a first graph showing the time change of the degree of abnormality (S15). Further, the trading examination device 10 determines whether or not the second transaction data includes the second suspected data suspected of being an unfair transaction based on a predetermined standard (S16).

Then, the trading examination device 10 generates a transaction schedule that identifiable the overlap of the first suspect data, the second suspect data, and the first suspect data and the second suspect data (S17). Further, the trading examination device 10 generates a graph showing the overlap of the first suspect data, the second suspect data, the first suspect data and the second suspect data so as to be distinguishable (S18).

Finally, the trading examination device 10 transmits the generated first graph, second graph, and transaction schedule to the user terminal (S19). With the above, the second process is completed.

FIG. 7 is a diagram showing the classification of transaction data by the trading examination device 10 according to the present embodiment. The trading examination device 10 determines whether the second transaction data includes the first suspected data suspected of being unfair trade by the first judgment unit 14, and the second judgment unit 15 determines whether the second transaction data contains unfair trade. Determines if the second suspected data is included. In the figure, the case where the first determination unit 14 determines that there is a suspicion of unfair trade and the second determination unit 15 determines that there is a suspicion of unfair trade is represented as (1). Such cases of the first suspect data and the second suspect data are referred to as type 1 suspect data.

Further, the case where the first determination unit 14 determines that there is no suspicion of unfair trade, but the second determination unit 15 determines that there is suspicion of unfair trade is represented as (2). As described above, the case where the data is not the first suspect data but is the second suspect data is called the second suspect data.

Further, the case where the first determination unit 14 determines that there is a suspicion of unfair trade, but the second determination unit 15 determines that there is no suspicion of unfair trade is represented as (3). As described above, the case where the first suspect data is not the second suspect data is referred to as the third suspect data.

Finally, the case where the first determination unit 14 determines that there is no suspicion of unfair trade and the second determination unit 15 determines that there is no suspicion of unfair trade is represented as (4).

Table 1 shown below shows the result of the second judgment unit 15 determining whether the second transaction data includes data suspected of being unfair trade, and the same second transaction data analyzed by an expert to determine the unfair transaction. It is a table summarizing the results of determining whether or not the suspected data is included.

According to Table 1, in the judgment by the rule-based second judgment unit 15, 84 out of 91 cases judged by the expert that there is no suspicion of unfair trade are extracted as data suspected of unfair trade.

On the contrary, in the judgment by the second judgment unit 15 based on the rule, 25 out of 27 cases judged by the expert to be suspected of unfair trade are extracted as data suspected of unfair trade.

From these numerical values, regarding the judgment by the second judgment unit 15, the recall rate indicating whether or not the data suspected of being unfair trade is missed is as high as (25) / (25 + 2) × 100 = 92.59%, but it is not. It can be seen that the Precision Rate, which indicates whether or not there is a mistake in collecting data suspected of fair trade, is as low as (25) / (25 + 84) × 100 = 22.94%. That is, the determination by the rule-based second determination unit 15 means that there are almost no misses, but there are many mistakes. Therefore, in the conventional trading examination business, a large amount of time is spent on removing data that is not suspected of being unfair trade from data that is suspected of being unfair trade.

Next, Table 2 shown below specializes in the same second transaction data as the result of the first judgment unit 14 determining whether the second transaction data includes data suspected of being unfair trade based on the degree of abnormality. It is a table that summarizes the results of the house's analysis and determination of whether data that is suspected of being unfair trade is included.

According to Table 2, in the judgment by the first judgment unit 14 based on the degree of abnormality, 37 out of 91 cases judged by experts to be unfair trade are extracted as data suspected of unfair trade. ..

On the contrary, in the judgment by the first judgment unit 14 based on the degree of abnormality, 22 out of 27 cases judged by the expert to be suspected of unfair trade are extracted as data suspected of unfair trade.

From these numerical values, regarding the judgment by the first judgment unit 14 based on the degree of abnormality, the recall rate indicating whether or not the data suspected of being unfair trade is missed is (22) / (22 + 5) × 100 = 81.48%. It can be seen that the Precision Rate, which is high and indicates whether or not there is a mistake in collecting data suspected of being unfair trade, is also high at (22) / (22 + 37) × 100 = 37.29%. That is, the determination by the first determination unit 14 based on the degree of abnormality means that there is almost no omission, there are few mistakes in taking as compared with the rule-based case, and it is more suitable for practical use.

Next, Table 3 shown below shows the same second result as the result of determining whether the second transaction data includes data suspected of unfair trade based on the degree of abnormality, price range and volume by the first determination unit 14. It is a table that summarizes the results of expert analysis of transaction data and determination of whether or not data suspected of being unfair trade is included.

According to Table 3, in the judgment by the first judgment unit 14 based on the degree of abnormality, price range and trading volume, 17 out of 91 cases judged by experts to be unfair trade are suspected data. It has been extracted.

On the contrary, in the judgment by the first judgment unit 14 based on the degree of abnormality, price range and volume, 22 out of 27 cases judged by experts to be suspected of unfair trade were extracted as data suspected of unfair trade. There is.

From these numerical values, regarding the judgment by the first judgment unit 14 based on the degree of abnormality, the price range and the trading volume, the recall rate indicating whether or not the data suspected of being unfair trade is missed is (22) / (22 + 5) × 100 = 81. It can be seen that the Precision Rate, which is as high as .48% and indicates whether or not there is a mistake in collecting data suspected of being unfair trade, is also as high as (22) / (22 + 17) × 100 = 56.41%. That is, the judgment by the first judgment unit 14 based on the degree of abnormality, the price range, and the trading volume rarely misses, and the mistake is 2.46 times (56.41% / 22.94% =) as compared with the rule-based case. 2.46) It means less. As described above, according to the trading examination device 10 in the present embodiment, it is possible to reduce the omission of data suspected of being unfair trade and to reduce the number of mistakes in the data, which contributes to the efficiency of the trading examination business.

FIG. 8 is a diagram showing a transaction schedule generated by the trading examination device 10 according to the present embodiment. The schedule generation unit 16 of the trading examination device 10 generates a transaction schedule that shows the time change of the second transaction data and identifiable the first suspected data in the second transaction data. The transaction schedule of this example shows the time change of the transaction data of the stock, and is the identification information of "market", "stock", the identification information of "customer", the reception number (identification information) of "order", Includes "transaction date", "order time", "buying and selling category", "correction category", "quantity" and "unit price". Specifically, the "market" is "TSE M", that is, TSE Mothers, the "brand" is "AAAA" (securities code), and the identification information of "customer" is an 8-digit number such as "92345678". The "reception number" is a 9-digit serial number such as "987654321". The "transaction date" is "2014/6/17" (June 17, 2014), and the "order time" is "8:01:54" (8:01:54). Further, the "buying and selling category" is "buy" or "sell", and the "correction category" is "correction" or "cancellation". "Quantity" represents the quantity of a buy / sell order, such as "100", and "unit price" is "14,200" (14,200 yen), etc. in the case of a limit order, and is a market order. In some cases it is "market".

The transaction schedule may be able to discriminately indicate the overlap of the first suspect data, the second suspect data, the first suspect data and the second suspect data. In this example, in the transaction schedule, the first suspected data is highlighted by the first area A indicated by the broken line, and the overlap of the first suspected data and the second suspected data is highlighted by the second area B indicated by the alternate long and short dash line. , The second suspected data is highlighted by the third region C indicated by the alternate long and short dash line. In this way, by showing the overlap of the first suspect data, the second suspect data, the first suspect data, and the second suspect data in an identifiable manner, the first suspect data extracted by the learning model and a predetermined standard are used. It is possible to grasp at a glance the commonalities and differences with the second suspected data extracted based on. In this example, in order to simplify the illustration, the first suspect data, the overlap of the first suspect data and the second suspect data, and the second suspect data are identified by the first area A, the second area B, and the third area C. Although it is shown as possible, the trading examination device 10 may highlight and display these data by highlighting or displaying them in a large size.

FIG. 9 is a diagram showing a first graph generated by the trading examination device 10 according to the present embodiment. The graph generation unit 17 of the trading examination device 10 generates a first graph showing the time change of the degree of abnormality. The first graph may be, for example, a graph in which the degree of abnormality of the second transaction data is plotted every second. In this example, the horizontal axis shows the time, the vertical axis shows the numerical value of the degree of abnormality, the degree of abnormality a1 related to the canceled quantity of the buy order is shown by a solid line, and the degree of abnormality a2 related to the canceled quantity of the sell order is shown by the broken line. The anomaly degree a3 regarding the buy bid quantity is indicated by the alternate long and short dash line, and the abnormality degree a4 regarding the sell quote quantity is indicated by the alternate long and short dash line.

According to the first graph of this example, the abnormality degree a3 regarding the buy bid quantity and the abnormality degree a4 regarding the sell quote quantity form two peaks around 9 o'clock. In addition, all four types of abnormalities form a plurality of peaks from about 10 o'clock to about 10:30. Further, the anomaly degree a4 relating to the selling bid quantity peaks at around 13:30, and the anomaly degree a3 relating to the buying quote quantity forms a peak around 14:30. In this way, the first graph makes it possible to intuitively grasp the time change of the degree of abnormality, and it becomes possible to grasp at a glance the period during which unfair trade is suspected.

FIG. 10 is a diagram showing a second graph generated by the trading examination device 10 according to the present embodiment. The graph generation unit 17 of the trading examination device 10 may further generate a second graph showing the time change of the second transaction data and identifiable the first suspected data in the second transaction data. In the second graph of this example, the horizontal axis shows the time and the vertical axis shows the values of various transaction data. Specifically, in order from the top, the buy quote quantity and the sell quote quantity (quote volume), the cancel quantity of the buy order and the cancel quantity of the sell order (cancel volume), the ratio of the cancel quantity to the contract waiting quantity of the buy order and the sell. The ratio of the canceled quantity to the executed quantity of the order (cancel volume ratio over order book volume), the quantity of the top 10 orders waiting to be executed for the buy order and the quantity of the top 10 orders waiting to be executed for the sell order (order volume on 10 levels), Includes traded volume and price ratio.

In this example, in the second graph, the first suspected data is highlighted by the first region A indicated by the broken line, and the overlap between the first suspected data and the second suspected data is highlighted by the second region B indicated by the alternate long and short dash line. , The second suspected data is highlighted by the third region C indicated by the alternate long and short dash line. In this way, by showing the overlap of the first suspect data, the second suspect data, the first suspect data, and the second suspect data in an identifiable manner, the first suspect data extracted by the learning model and a predetermined standard are used. It is possible to grasp at a glance the commonalities and differences with the second suspected data extracted based on. In this example, in order to simplify the illustration, the first suspect data, the overlap of the first suspect data and the second suspect data, and the second suspect data are identified by the first area A, the second area B, and the third area C. Although it is shown as possible, the trading examination device 10 may highlight and display these data by highlighting or displaying them in a large size.

The first area A, the second area B, and the third area C displayed in the second graph are the first area A, the second area B, and the third area C displayed in the transaction schedule shown in FIG. It corresponds to. In this way, by showing the overlap of the first suspected data, the second suspected data, and the first suspected data and the second suspected data in both the second graph and the transaction schedule in an identifiable manner, the second graph and the transaction schedule can be distinguished. You can check the details of the suspected data while supplementing the information with.

In this example, the first graph shown in FIG. 9 and the second graph shown in FIG. 10 are shown separately, but the first graph and the second graph are displayed side by side so as to share the horizontal axis. It's okay. By displaying the first graph and the second graph so as to share the horizontal axis, the time when the degree of abnormality forms a peak, the first suspect data, the second suspect data, the first suspect data, and the second The overlap of suspected data can be easily compared.

The embodiments described above are for facilitating the understanding of the present invention, and are not for limiting and interpreting the present invention. Each element included in the embodiment and its arrangement, material, condition, shape, size, and the like are not limited to those exemplified, and can be changed as appropriate. In addition, the configurations shown in different embodiments can be partially replaced or combined.

10 ... Trading examination device, 10a ... CPU, 10b ... RAM, 10c ... ROM, 10d ... Communication unit, 10e ... Input unit, 10f ... Display unit, 11 ... Acquisition unit, 12 ... Estimate unit, 13 ... Calculation unit, 14 ... 1st judgment unit, 15 ... 2nd judgment unit, 16 ... schedule generation unit, 17 ... graph generation unit, 20 ... first user terminal, 30 ... second user terminal, 40 ... securities company database, 50 ... information vendor database , 100 ... Trading examination system, DB1 ... Customer data, DB2 ... Transaction data, DB3 ... Market data

Claims (14)

Among the market data of the financial product, which includes the board information and the market price information of the financial product based on the transaction of the financial product, the first transaction data indicating the transaction of the financial product in a predetermined period and the finance. Based on the second transaction data indicating the transaction of the financial product in the period after the predetermined period, which is the subject of the transaction examination of the product, the probability distribution of the first transaction data and the second transaction by the density ratio function An estimation unit that estimates the density ratio of the data to the probability distribution,
A calculation unit that calculates the degree of abnormality of the second transaction data based on the density ratio function, and
Based on the degree of abnormality, the first determination unit that determines whether the second transaction data includes the first suspected data in which market manipulation transactions are suspected, and
A trading examination device equipped with. The first transaction data is data in a longer period than the second transaction data.
The sales examination device according to claim 1. The first transaction data and the second transaction data include data indicating a buy / sell order volume.
The sales examination device according to claim 1 or 2. The first transaction data and the second transaction data include data indicating the amount of cancellation of a buy / sell order.
The sales examination device according to any one of claims 1 to 3. Among the second transaction data , the first determination unit determines that the data in which the degree of abnormality belongs to the higher predetermined ratio is the first suspected data.
The sales examination device according to any one of claims 1 to 4. Among the second transaction data , the first determination unit determines that the data in which the degree of abnormality belongs to the upper predetermined ratio and the price range in the predetermined period is equal to or greater than the first threshold value is determined as the first suspected data.
The sales examination device according to claim 5. Among the second transaction data , the first determination unit determines that the data in which the degree of abnormality belongs to the upper predetermined ratio and the volume in the predetermined period is equal to or higher than the second threshold value is determined as the first suspected data.
The sales examination device according to claim 5 or 6. A graph generation unit for generating a first graph showing the time change of the degree of abnormality is further provided.
The sales examination device according to any one of claims 1 to 7. The graph generation unit shows the time change of the second transaction data, and among the second transaction data , the order amount, the cancellation amount, and the order at one or more prices based on the board information for each brand of the financial product. Further generate a second graph that identifiable the first suspected data for the quantity and price fluctuation items.
The sales examination device according to claim 8. Further provided with a second determination unit for determining whether or not the first suspected data suspected of market manipulation transactions is included in the second suspected data extracted based on a predetermined standard in a predetermined securities company.
The second graph identifiablely shows the overlap of the first suspect data, the second suspect data, the first suspect data and the second suspect data in a time series.
The sales examination device according to claim 9. A second judgment unit that determines whether or not the first suspected data suspected of market manipulation transactions is included in the second suspected data extracted based on a predetermined standard at a predetermined securities company.
Further, among the second suspected data, a schedule generation unit that generates a transaction schedule that identifiable the second suspected data whose transaction time coincides with the transaction time of the first suspected data. Prepare, prepare
The sales examination device according to any one of claims 1 to 10. The estimation unit calculates the density ratio using an unconstrained least squares density ratio estimation method.
The sales examination device according to any one of claims 1 to 11. The computer
Among the market data of the financial product, which includes the board information and the market price information of the financial product based on the transaction of the financial product as time-series data, the first transaction data indicating the transaction of the financial product in a predetermined period and the finance. Based on the second transaction data indicating the transaction of the financial instrument in the period after the predetermined period, which is the subject of the transaction examination of the product, the probability distribution of the first transaction data and the second transaction by the density ratio function Estimating the density ratio of the data to the probability distribution and
To calculate the degree of abnormality of the second transaction data based on the density ratio function,
Based on the degree of abnormality, it is determined whether or not the second transaction data includes the first suspected data in which market manipulation transactions are suspected.
Trading examination method including. A computer equipped with a trading examination device,
Among the market data of the financial product, which includes the board information and the market price information of the financial product based on the transaction of the financial product as time-series data, the first transaction data indicating the transaction of the financial product in a predetermined period and the finance. Based on the second transaction data indicating the transaction of the financial instrument in the period after the predetermined period, which is the subject of the transaction examination of the product, the probability distribution of the first transaction data and the second transaction by the density ratio function An estimation unit that estimates the density ratio of data to the probability distribution,
Based on the density ratio function, the calculation unit that calculates the degree of abnormality of the second transaction data, and based on the degree of abnormality, it is determined whether the second transaction data includes the first suspected data in which market manipulation trading is suspected. First judgment unit,
A trading review program that functions as.

Images