[Paper Review] A machine learning approach to support decision in insider trading detection

Piero Mazzarisi, Adele Ravagnani+4 more|arXiv (Cornell University)|Dec 6, 2022

Financial Markets and Investment Strategies4 citations

TL;DR

This paper proposes two unsupervised machine learning methods to detect insider trading: (1) k-means clustering to identify individual traders with discontinuous, reward-seeking trading behavior around price-sensitive events, and (2) statistically validated networks (SVN) to detect synchronized trading rings. The methods are complementary, with minimal overlap (only 4 traders), highlighting their ability to uncover distinct types of insider activity.

ABSTRACT

Identifying market abuse activity from data on investors' trading activity is very challenging both for the data volume and for the low signal to noise ratio. Here we propose two complementary unsupervised machine learning methods to support market surveillance aimed at identifying potential insider trading activities. The first one uses clustering to identify, in the vicinity of a price sensitive event such as a takeover bid, discontinuities in the trading activity of an investor with respect to his/her own past trading history and on the present trading activity of his/her peers. The second unsupervised approach aims at identifying (small) groups of investors that act coherently around price sensitive events, pointing to potential insider rings, i.e. a group of synchronised traders displaying strong directional trading in rewarding position in a period before the price sensitive event. As a case study, we apply our methods to investor resolved data of Italian stocks around takeover bids.

Motivation & Objective

• To address the challenge of detecting insider trading in high-volume, low-signal-to-noise financial data.
• To support market surveillance authorities by identifying anomalous individual and group trading behaviors prior to price-sensitive events (PSEs).
• To develop a data-driven, unsupervised approach that complements traditional monitoring and reduces reliance on a 'smoking gun' for detection.
• To provide a methodology applicable to real-world market abuse detection, particularly in jurisdictions like Italy with strong administrative and criminal enforcement.
• To enhance the efficiency and accuracy of identifying potential insider trading suspects through clustering and network analysis.

Proposed method

• Uses k-means clustering in a three-dimensional feature space defined by: (1) trading discontinuity relative to an investor’s historical behavior, (2) directionality of trades (bullish/bearish), and (3) expected profit from the PSE.
• Classifies investors as 'hard' or 'soft' discontinuous based on the magnitude of deviation from past behavior.
• Applies statistically validated networks (SVN) to detect groups of investors with synchronized, high-directionality trading around PSEs.
• Employs Bonferroni correction in the SVN approach to control for false positives when identifying co-movement clusters.
• Defines synchronous trading on a daily time scale, allowing detection of coordinated behavior across multiple investors.
• Combines results from both methods to identify overlapping or complementary suspicious cases, enhancing detection coverage.

Experimental results

Research questions

• RQ1 How can unsupervised machine learning detect individual traders with abnormal, discontinuous trading patterns before a price-sensitive event?
• RQ2 Can network-based clustering identify groups of investors acting in a synchronized, directional manner around insider events, indicating potential insider rings?
• RQ3 To what extent do the results from the two methods overlap, and what does this imply about the nature of insider trading behavior?
• RQ4 How can clustering and network analysis be combined to improve detection of market abuse beyond individual-level analysis?
• RQ5 What role can these methods play in supporting regulatory authorities during the initial alert and assessment phases of insider trading investigations?

Key findings

• The k-means method identified 303 discontinuous traders—237 hard and 66 soft—around Italian takeover bids.
• The SVN Bonferroni approach detected 1,662 traders in high-directionality clusters (≥0.9), indicating coordinated behavior.
• Only four traders were common to both methods: two households and two legal entities, indicating minimal overlap and complementary detection.
• The two overlapping legal entities formed a micro-cluster of two highly synchronized traders with directionality 1 and 0.81, and expected profits of €277,625 and €241,132.
• The two households in the overlap had strong directionality (1 and 0.99) and high expected profits (€1,380 and €95,619), suggesting high-risk behavior.
• The low overlap between methods confirms their complementary nature, as they detect distinct types of insider activity—individual discontinuity vs. group collusion.