The technological revolution brought by the internet, high performance computing, and artificial intelligence has fundamentally changed and continues to alter the landscape of finance. These innovations, if used with a malicious intent, can seriously destabilize the financial market. For this reason, countermeasures in the form of new detection methods are needed. In this study, we propose a novel detection framework that uses a model of fraudulent behavior to detect fraud from observed data. A similarity measure is defined to decide if the recorded actions of a monitored trader are matching actions of the fraudulent agent. We illustrate the framework on a simple form of manipulative trading in a simulation environment of a market consisting of two exchanges. This demonstrative case study is inspired by a price manipulation scheme that occurred on the Bitcoin market in 2017/18, where such simple forms of manipulation were observed. Simulation results outline vulnerabilities in markets, where uneven distribution of liquidity is present, as this can be exploited by pump-and-dump scheme.
Market fraud has been and continues to be a pressing issue of modern trading systems. Due
to relatively low number of observed instances and often high complexity of the fraudulent
behavior, the intrusion of the market is a challenging task to detect. Fraud can have wide
consequences on every socio-economical system. For instance, the issue of market manipulation
is especially present on cryptocurrency market [
In this study, we aim to address the question of detection on a more basic level. In principle, every fraud is a manifestation of a behavioral scheme, and as such needs to be approached in this way by considering a specific behavioral model. Agent-based simulations of economic and social systems are gaining prominence in economy and finance. One might wonder if agents designed to violate norms in these models could potentially be used to aid fraud analysts. Moreover, to design suitable policies by accessing consequences of fraud on the market using the simulation environment. Assuming availability of a model of a fraudulent entity, we focus in this study on the research question of how can such a model be applied for fraud detection.
Financial fraud has been intensely studied through decades [
Agent-based models appear to be a suitable tool for compliance modelling [
The goal of this study is to illustrate how a model of a fraudulent agent can be used to detect manipulative trading from an observed sequence of trading actions, and motivate further research on agents learning noncompliant behavior from a simulation environment. We discuss how this methodology can be integrated into current practice of market surveillance, assuming that a model of a noncompliant agent is already available.
The secondary contribution of this study is the implementation of a pump-and-dump market
manipulation scheme in a simulated market environment, that was observed on the Bitcoin
market in 2017/18 [
Consider a socio-economic system where traders can exchange their assets, and there exists a rule describing what type of behavior is considered malicious. This rule is not enforced unless a detection method is present to identify noncompliant behavior. Assume a model of this system calibrated to observed data to reproduce standard behavior of the real system. In this system model, a parametric model of noncompliant agent is included, together with a similarity measure that measures the similarity between the fraudulent agent and observed data of the monitored trader. Depending on the similarity, the system monitoring authority can decide to intervene.
Let denote the policy function of the fraudulent agent. The agent observes the current state of the system, denoted by vector s. The state refers to publicly available variables, eg. public information on a stock exchange, or possibly transactions on a blockchain.
The model of the fraudulent agent will typically have a number of parameters , that define a subclass of fraud among the class of fraudulent behaviors, eg. a pump-and-dump scheme with parameters defining the frequency or amount of purchased assets, a time threshold after which the price is dumped etc. Note that these parameters are not coeficients of a statistical model, eg. a Bayesian network, or a neural network. This means the defines a class of noncompliant behaviors parametrized with , where for each choice the behavior remains noncompliant.1
Let us consider a window of observations , indexing the set of all states = {s | ∈ } and the set that denotes the set of actions taken by the monitored trader for ∈ . The similarity measure between of the monitored trader and the fraudulent agent for given observed states of the system is defined as: [, | ] = | | =1 1 ∑|︁| [ , (s )] (1) where is a matching function between each action of the monitored trader and fraudulent agent. This measure needs to be defined by (human) expert, and may depend on application domain. We provide an example of the matching function later. For now, let us assume that the function is equal to 1 if the observed action of the monitored trader and the supposed action of the fraudulent trader are exactly the same, and is equal to zero if they are as diferent as possible. Note that the window expressed through needs to be wide enough to include all relevant evidence. If the fraudulent behavior is not entirely contained in the window, the score still provides a valid indication of suspicious activities.
The fraudulent agent observes the observable state of the system s at time . The policy function
maps the observable state and the internal attributes of the agent into an action. Since
defines a class of noncompliant behaviors, one would be interested to find such parameters
that maximize the probability that actions of some monitored trader correspond to the actions
of the fraudulent agent, ie. to localize the instance in the set { | ∈ Θ} most similar to the
1Note that not all choices of need to be profitable for the agent.
monitored trader, where Θ is a feasible region. In other words, we solve the optimization
problem
* = arg max [, | ]
∈Θ
(2)
Compared to standard statistical models, where likelihood function is of central importance,
what we gain by developing a causal model we loose during the inference process. Since
agent-based models do not necessarily come with a mathematical functional expression, the
inference needs to be performed without this assumption. The only assumption we make is the
possibility to sample (execute) the model. So-called likelihood-free methods were developed to
perform inference on simulation-based models [
Once a solution to equation (2) is found, the (human) compliant analyst can decide to intervene or not. This would be done by comparing the similarity measure (1) to a predefined intervention threshold . During the inference process, an implicit assumption is made that is reasonably close to a true model of considered fraudulent behavior. This assumption is highly relevant for calibration of an intervention threshold for the market surveillance system, because a model of noncompliance that produces high similarity score for every observed behavior would have too high false positive rate. For this reason, every model needs to be validated on data generated in the simulation model of the socio-economic system, or on observational data of the system.
Performing monitoring of a trader can be done using the whole data history of the trader, or in some predefined window. In our framework, with a model of fraudulent agent available, it is possible to make rolling calculation of the score for the best estimated parameters. If the fraudulent behavior is in progress, it is very common that there is insuficient evidence for authorities to take action, ie. for an extended amount of time the behavior can be, although suspicious, but still, fully compliant. For a realistic model of the fraudulent agent and correctly defined similarity measure with calibrated intervention threshold value, it is desired that the similarity score will be high for suspicious behavior and will surpass the threshold value only after the fraudulent scheme is approaching its final steps. Ideally, right before the scheme concludes is where it is needed to intervene. If a model of compliant behavior that is similar to fraudulent behavior is available, then one can set to be higher than the similarity score produced by the compliant behavior, but is lower than the score of the fraudulent behavior. This can prevent unfair interventions on individuals that are compliant, but only slightly difer from fraudulent instances of a particular fraud scheme.
The prototypical example used to illustrate the proposed framework is based on a real event of
market manipulation that occurred on the Bitcoin market in 2017/18. This case was initially
analyzed in [
Taking the discussion above into consideration, we develop a model of an agent executing a pump-and-dump scheme in a simulation model of a market. In order to test if uneven distribution of liquidity plays a significant role, we consider a model of two exchanges, where one exchange is less liquid. Since the illustrated methodology is independent of the Bitcoin market and can be applied to any type of trading system, we will refrain from talking specifically about Bitcoins, and will talk about the assets in general.
We consider a simple order book market model based on [
Two types of so-called response agents are trading in the simulation environment. These agents are intended to model the response to the manipulation of the price. The simplest type of agent is a Random agent. This agent issues a sell or buy order with equal probability every time step on each exchange. At both exchanges = 1, 2 the random agent calculates the limit price as ( − 1) · ( , ) for sell orders and ((− ,1)) for buy orders, where ( − 1) is the market price from previous time step. The asset amount is a random value drawn from an exponential distribution with rate parameter and the expiration time is drawn from a Poisson distribution with parameter . The values of all parameters are listed in Table 1. The second type of agent trading on both exchanges is Chartist agent. This agent is active with 0.5 probability. Chartist issues a buy order if the current price ( − 1) is higher than 7-day market price average and sells otherwise. All other parameters are the same as for the random agent.
Parameter values of these agents are listed in Table 1. Note that due to diferent values of pair 1, 1 compared to pair 2, 2, there is lower agreement about the price of the asset on the second exchange.
The observable state of the system is defined by a vector s() = (1(), 2(), 1(), 2(), ()), where 1() and 2() are order books of exchanges one and two, respectively. The fraudulent agent observes the state s() and makes a decision according to policy . The function implements a simple trade-based pump-and-dump scheme that takes advantage of uneven distribution of liquidity on exchanges. The agent performs a sequence of aggressive buy orders such that the price impact due to low liquidity is maximized. At time ℎ the price of the asset is dumped by a sequence of sell orders, but this time issued so that the price impact is minimized by targeting the more liquid ask order book. Two attributes of the agent are the capital balance () and the amount of assets () at time . The agent aims to execute a pump-and-dump scheme such that the capital balance is positive and the amount of assets is zero.
In more detail, the agent decides to issue a buy order before day ℎ with probability . The limit price, the amount of buy orders, and the expiration time is decided as in the case of random agent. To choose which exchange to target, the fraudulent agent will estimate the liquidity by calculating the immediate cost of buying or selling 10 units of its asset. If the agent is buying, then the less liquid exchange is targeted. Conversely, the agent is selling on more liquid exchange. The selling process is initiated after time threshold ℎ is reached. At each time step a sell order is issued of · () asset amount, where is a random variable uniformly distributed on the interval [0, ].
In the simulation environment, parameters can be identified that make the manipulation scheme profitable in given market conditions. Chosen parameters for the fraudulent agent are listed in Table 1. An example of market price influenced by agent’s actions is shown on Figure 1a.
Consider a trader being monitored in the real market producing a sequence of trading actions. The actions recorded into the set have a form: (order type, exchange ID, asset amount, limit price, expiration time). By inspecting , it is easy to see that certain parameters of the agent do not have to be estimated using likelihood-free inference. For example, by having data of the monitored trader and known distributions used by the policy the information about the distribution of limit prices or expiration times can be obtained using standard distribution estimation methods, thus we omit measuring similarity with respect to these parameters.2
Let = (s) be the action of the fraudulent agent given observable state s at time , then we define: • Order type match: (, ) = 1 if the order types of the monitored trader and the fraudulent agent are equal; zero otherwise. • Exchange match: (, ) = 1 if the exchange choice of the monitored trader and the fraudulent agent are equal; zero otherwise. • Amount distance: (, ) = − (− )2 for the asset amount components and of and , respectively.
Summing up the above quantities, the action matching measure is defined as (, ) = (, )+(, )+(, ), where = (, , ) are weights associated with each summand. These weights can be used by the analyst if some patterns are suspected to be more significant. The sequence of orders and selected exchanges provide more information in our specific example, therefore we set the wight vector to = (0.4, 0.4, 0.2).
Approximate Bayesian Computation (ABC) [
In our case, the observed data are := . The simulated data are obtained by evaluation (s). The prior distribution is defined over the feasible set Θ by the domain expert. Since the similarity measure is defined to be equal to the (maximum) value one when the observed and generated action are identical, we set := 1 − [, |]. As discussed in the previous subsection, some parameters of the fraudulent agent are excluded from the likelihood free inference, and therefore we let = (ℎ, , ).
We use the simplest form of ABC algorithm, which is the rejection sampler. To infer the parameters of the fraudulent agent, the algorithm consists of four simple steps: 1. Sample from prior distribution ( ).
2. Simulate a dataset ^ using (). 2We omit information about these parameters completely only for the sake of simplifying the example, since the focus is on the likelihood free inference. In practice, the information should be included in the scoring function, possibly with smaller impact depending on prior expectation of its significance.
3. If (, ^|) > , accept , and reject otherwise.
4. Return to step 1 unless termination criterion is met.
The termination of the algorithm is ensured by defining maximum number of iterations. At the end of the sampling process, histograms of parameter values are generated.
Applying inference to random, chartist, and fraudulent agent By solving (2) for each agent, the parameters produced similarity scores much higher for the fraudulent agent than for the random agent and the chartist agent. Therefore, the model can successfully diferentiate between fraudulent and non-fraudulent agents, which provides baseline evidence that the model and the similarity measure are correctly defined 3. In the case of the fraudulent agent, the ABC algorithm converged for threshold = 0.8 only in parameter ℎ, while the distributions of parameters and stayed roughly uniform, which was confirmed by low p-values of Kolmogorov-Smirnov test for uniformity. The parameters that did not converge for predefined number of iterations suggest that the amount distribution parameter is not an important component of the similarity measure, as was initially suspected.
(a) Manipulated market price (b) Similarity to pump-and-dump scheme
Deciding the intervention threshold In general, assuming that we know what type of compliant behavior is the most similar to the fraudulent agent, we can determine the threshold values by computational experiment. Any pump-and-dump scheme has a minimum number of 3Clearly, in practice this testing would be done on real data of both compliant and fraudulent traders, but can be also tested on various models of compliant agents to investigate which decision mechanisms tend to trigger false positives. days the price pumping process takes. Since the similarity measure (1) is an average over the number of recorded actions, we can set without loss of generality ℎ = 55 days4.
Consider a scenario where each day parameters of the monitored trader are estimated. Let us set to be the 95th percentile of the scoring distribution. On Figure 1b we can see the average value of the similarity score calculated by sampling from the posterior. One can see that the values of the score tend to be higher after the price dumping process starts on day 55. Obviously, the intervention threshold should be higher than the similarity score of an agent that is unreasonably buying assets on less liquid exchange, which an example of a compliant agent similar to the fraudulent agent. Once the monitored trader starts the price dumping process, the threshold should be low enough to identify the similarity as significant enough to trigger a response from the authorities. This is why we set = 0.89, as can be observed on Figure 1b. Until day 54 the trader appears to be compliant, but on the 55th day the selling process stars, which means pump-and-dump scheme ought to be detected. The red line is the value of intervention threshold . To prevent false alarms, the detection threshold is set slightly higher than the score of the compliant behavior. Credible intervals give us information about the certainty of observed fraudulent behavior. For instance, the monitored trader on day 54 has slightly less than 50% chance to be fraudulent, but on 55th day the certainty is much higher.
Design of agents capable to conduct a specific type of behavior in a real or simulated environment is a central research question of artificial intelligence. In our study, we further motivate this research by proposing a framework in which the model of a fraudulent agent can be used for fraud detection. The proposed framework is illustrated on a market model where an agent executing a simple pump-and-dump scheme is present. We use the agent to generate synthetic data, and then to test the framework using the same model for detection. We also demonstrate how the intervention threshold used by the market monitoring authorities can be decided by considering similar but compliant sequences of actions. Moreover, our market model exemplifies the vulnerability of markets where uneven distribution of liquidity is present on exchanges, and provides additional evidence that this uneven distribution can be used to enhance pumpand-dump schemes. Although this study was focused on trade-specific fraud, the proposed methodology seems to be applicable to diferent areas. Abstraction of the methodology to general norm learning agents along with the extension to coalition forming can be regarded as future research directions.
This work was partly funded by the Dutch Research Council (NWO) for the HUMAINER AI project (KIVI.2019.006). 4Value equal to 55 is roughly the same value the Bitcoin market manipulator have used in 2017/18 to sell enough Bitcoins before the date of publishing the end of month audit statements.