Class AnomalyDetector

java.lang.Object
com.quantfinlib.ml.AnomalyDetector

public final class AnomalyDetector extends Object
Surveillance anomaly detection over interval-aggregated market activity:
  • Quote stuffing — message-rate spikes (robust z-score) combined with an abnormal order-to-trade ratio: lots of quoting, little trading.
  • Price spikes — interval returns far outside their recent distribution.

Scores are ROBUST z-scores — (x − median) / (1.4826 · MAD) — not mean/stdev: an anomaly detector whose baseline includes the anomalies inflates its own scale and misses exactly the events it hunts (a storm of stuffing intervals raises the stdev until nothing clears the threshold). Median/MAD ignores up to half the sample being contaminated; 1.4826 rescales MAD to stdev units under normality so thresholds keep their familiar sigma meaning. When MAD is 0 (more than half the intervals identical) the detector falls back to mean/stdev, and gives up only when that is 0 too.

  • Field Details

  • Method Details

    • detectQuoteStuffing

      public static List<AnomalyDetector.Anomaly> detectQuoteStuffing(long[] messagesPerInterval, long[] tradesPerInterval, double zThreshold, double minOrderToTradeRatio)
      Flags intervals where the message count is a zThreshold-sigma outlier AND the order-to-trade ratio exceeds minOrderToTradeRatio.
      Parameters:
      messagesPerInterval - order/cancel/replace message counts per interval
      tradesPerInterval - trade counts per interval (aligned)
    • detectPriceSpikes

      public static List<AnomalyDetector.Anomaly> detectPriceSpikes(double[] mids, double zThreshold)
      Flags intervals whose return is a zThreshold-sigma outlier.