Case Study


WSO2 Helps Safeguard Stock Exchange via Real-Time Data Analysis and Fraud Detection

Stock Exchange Leverages WSO2 for Real-Time Data Analysis and Fraud Detection

The stock exchange based in Asia serves as the only stock exchange for its country. The exchange saw a tremendous boom in activity after the end of their civil war, and now lists some 295 companies with a market capitalization of $18.23 billion. Like any stock exchange, it interacts with many entities: regulators, issuers (such as companies, corporations and unit trusts), commercial banks, investment banks, fund managers, stockbrokers, financial advisers, market data vendors, and investors.

Central to the exchange’s responsibilities are preserving a fair market and safeguarding investor interests. These efforts are led by its market surveillance team, which uses proprietary software to inspect and investigate the exchange. The stock exchange asked if WSO2 could come up with an alternative solution for detecting stock market manipulation and fraud.

Stopping Stock Market Manipulation

Stock market manipulation can take on different forms, including artificially inflating or deflating stock prices, or exploiting private knowledge of company proceedings. Such manipulations often result in genuine traders losing the money they have invested in the stock market. Most fraud falls under some common strategies: the “pump and dump” method, front running, and insider dealing, to name a few.

The first, pump and dump, involves artificially inflating a stock price, leading traders and analysts to believe a company is doing better than it actually is, before quickly selling a large quantity of the stock at the inflated price—before the market realizes the mistake.

Front running is the stock brokers’ manipulation of advanced knowledge, usually gleaned from pending client orders, to trade ahead of customers for personal gain. It represents some of the inequalities that arise when there is an asynchronicity of information.

Insider trading is also a case of asynchronous information access. Inside knowledge—such as dividends and company ownership changes—is obtained before the information is publicly announced and can be used to either buy or sell the most profitable stocks under those circumstances.

All of these criminal acts have to be detected amidst the many thousands of traders and trades happening on any given day. Identifying suspicious behavior in real-time is often difficult and impractical due to the volume and velocity of such a market.

This is where the WSO2 Stream Processor—with its capacity for real-time analysis of thousands of data streams within milliseconds—comes into play. WSO2 Stream Processor is an open source stream processing platform. It can ingest data from Kafka, HTTP requests, and message brokers, and you can query data streams using a “Streaming SQL” language. With just two commodity servers it can provide high availability and handle 100K+ TPS throughput. It can scale up to millions of TPS on top of Kafka.

Detecting fraud on grand scales with data analysis

Figure 1

Figure 1

The solution WSO2 has created is a report-based surveillance system that analyzes all of the data streams and transactions that occur in real time and identifies trading patterns that point to fraud. The surveillance system considers three primary types of data: trading information, public announcements on things that might affect securities (such as company changes), and the closing price of stocks.

The system can identify pumping and dumping by monitoring the changes in prices applied to stocks by traders. By analyzing the number of price increments per person and per security, the WSO2 Stream Processor can trigger an alert notifying officials that a possible pumping action might be happening. With more than 79,000 events per second, this detection system functions at less than a third of a second.

Figure 2

Figure 2

Front running is detected by having the system first analyze traders who perform large sales. By reviewing over 10,000 events per second, the WSO2 Stream Processor checks whether these high-volume sellers have recently accumulated large amounts of stocks.

Figure 3

Figure 3

In the instance of a broker making trades on behalf of a client, this pattern can be observed in other trades where the same broker’s client transactions coincide.

For insider dealing, the detection engine considers the trading behavior of individuals with regard to the availability of information about a given security. For example, if a trader acts unusually on a stock before important news is made public, it might be an instance of insider trading. In this case, the system then can publish an alert to human monitors.

Figure 4

Figure 4

Defining the Perfect Trader

In the process of designing the fraud detection system, WSO2 came up with a novel approach, the concept of a “perfect trader.” The imaginary perfect trader has the potential of seeing several days into the future of the stock market in order to make the perfect decision regarding any stock.

In reality, no honest trader could match a perfect trader’s patterns, which is why it is an excellent tool for detecting dishonest traders. Using several days’ worth of trading data, the batch analytics functionality in WSO2 Stream Processor is tapped to identify the path of the perfect trader and analyze those who follow the pattern most closely.

Figure 5

Figure 5

Exploring the possibilities

Despite the complexity of data processed by the system introduced by WSO2, the deployment is simple. By setting it up on a server with the necessary inputs, those responsible can be alerted not just at the end of a trading day, but also in real time as these events are processed.

“WSO2 worked closely with us, developed the system, tested, and did modifications as we requested, with a high level of professionalism,” said a representative of the stock exchange. “The team has also protected the confidentiality of the information shared with them.”

As a result of the research conducted into stock market manipulation, WSO2 has abstracted this system into a general-purpose fraud detection solution suitable for any stock market application. To explore the possibilities contact us. We’re happy to help.


Interested in similar content?