# Detecting unusual activity

How would one go about detecting unusual order flow in an intelligent way. That's very broad, so let me narrow it down. I have a trading system with clients entering number of orders every day. At this moment, I'm computing daily average of number of entered orders over past 30 days then adding 20% (or anything else) and if client enters more than that - alert of unusual activity.

It seems to be a very naive way of approaching this subject. For example, if client is slowly increasing their order flow, alerts will get triggered but it should be sort of expected. This also triggers when average is 1 but client enters 2 - probably simple to filter out and pay attention to those who enter more than X orders daily.

Since I'm not a mathematician or statistician in any way I'm having a hard time to find a smarter way to handle the task.

Thank you in advance and forgive me if its too simple a question to ask here.

It seems that what you're doing is essentially to find mismatch when the predicted and the actual value diverges. There are many ways to go for a problem like that, and in the end, it really depends on the details, but I'll give you a general idea:

Let $f$ be your "prediction function". You do regularly (daily, I presume) get inputs,

$$f(a_1) \approx b_1 \\ f(a_2) \approx b_2 \\ \ldots \\f(a_n) \approx b_n$$

(that is, your prediction should reflect reality)

To find this function is called "regression". There is multiple methods for doing so, including linear, polynomial (or even ANN-based) regression.

On a regular basis, you can find this function $f$. For whatever period of time, you can calculate $d = (f(a_n) - b_n)^2$ (the square error of the prediction).

Whenever $d$ is over some threshold, you assume the behavior to be unusual.

• If I understand correctly, the "prediction function" can actually be that daily average of last X days. And in f(An) - A would stand for actual orders entered so far? Jun 15, 2016 at 15:59
• Yeah, $a_n$ is the "actual value", whereas $b_n$ is the estimated value.
– user347499
Jun 15, 2016 at 16:01
• And average can be used as such a function, albeit a poor one.
– user347499
Jun 15, 2016 at 16:01
• It seems that average is only the most basic and simple. Is there a better choice? Jun 15, 2016 at 16:03
• Well, look up various regression methods. Linear or second degree regression should do the job.
– user347499
Jun 15, 2016 at 16:06