Market Anomalies

Unusual patterns that deviate from normal behavior. Can signal opportunities or risks.

Types of Anomalies

  • Price anomalies (flash crashes)
  • Volume anomalies (unusual activity)
  • Pattern anomalies (technical breakouts)

ML Techniques

  • Isolation Forest
  • Autoencoders
  • DBSCAN clustering
  • Statistical methods (Z-score)

Applications

  • Market manipulation detection
  • Event-driven trading
  • Risk management
  • Early warning systems

What Counts as an Anomaly in Markets

Anomaly detection is the hunt for observations that depart sharply from what the signal-generating process predicts. In trading, an unexplained spike in volatility, a break in a volume pattern or a sudden divergence between the cash market and the futures market can all be anomalies. Most anomalies are noise; the skill is separating the handful of genuine events from the thousands of false alarms.

Statistical Methods

  • Z-score: Flag any return that sits more than three standard deviations from the rolling mean.
  • IQR fences: A robust method that does not assume normality, using 1.5 times the interquartile range around the median.
  • Moving z-score: Rolling window detection that adapts when the market shifts regime, reducing the number of stale alerts.

Machine Learning Approaches

Isolation forest isolates anomalies instead of modelling normal behaviour: it randomly partitions the data and finds points that require unusually few splits to separate. Autoencoders reconstruct the input through a bottleneck layer; anomalies reconstruct badly and show up as high reconstruction error. Both methods need careful tuning because rare events are by definition under-sampled in the training set.

Real Signals Worth Detecting

  1. Volume-price divergence: Price makes a new high while volume contracts sharply, suggesting the move lacks participation.
  2. Open interest spikes: A sudden surge in open interest at a distant strike signals institutional interest that may precede a directional push.
  3. Basis blowout: Futures basis widening to more than twice its 20-day standard deviation often marks delivery or funding stress.
  4. Tick arbitrage gaps: A single print far from the consolidated tape in an illiquid stock is normally a data error or a spoofed quote.

Deploying Detection Without Meltdown

Every detection system needs a human-in-the-loop review for the first few months, because the cost of acting on a false positive in a fast market can exceed the cost of missing a true one. Rate-limit alerts to a small daily budget, classify severity, and log the outcome of every alert so the threshold drifts into calibration rather than staying static. An anomaly system is a surveillance tool, not a trading signal; pair its output with a separate entry rationale before risking capital.

What Counts as an Anomaly in a Trading Feed

Anomaly detection for traders has two targets the word usually blurs: data anomalies and market anomalies.

  • Data anomalies: bad ticks, gaps, stale quotes, exchange burst artifacts; detecting these protects features from poisoning.
  • Market anomalies: flash spikes, order-flow dislocation, regime jumps; detecting these is edge, not hygiene, and they are far scarcer.

Design reviews must separate the two before choosing algorithms, because a model trained on "what looks weird" will flag both at the cost of each other.

Statistical Baselines That Earn Their CPU

Start with the boring tools; neural spaghetti is a product of missing baselines:

  • Rolling z-scores on returns, volume and spread: the simplest useful detector for most daily and intraday signals.
  • ARIMA-style residual surprises: the residual after a fitted autoregression is the anomaly score, and every unfamiliar spike lives in the residual.
  • EWMA control charts: detect level shifts in volatility and flow with a robust chart parameter, far cheaper than deep learning and more explainable in a report.

Isolation Forests and Order-Flow Outliers

When feature spaces are wide (order imbalance, depth, spread, funding), the isolation forest shines:

  • It isolates anomalies with fewer splits than neighbours-based methods and tunes to the fraction of outliers you expect (0.1-2% for market-genuine anomalies).
  • Star features: the forest's split paths themselves tell you which dimension made the event anomalous, turning a score into a diagnosis.
  • Periodic retraining: the forest's "anomaly" definition must move with the market's climate; train on rolling windows and flag drift in the forest's own feather-weight predictions.

Real Signals Worth Detecting

Anomaly detection pays when it finds the deployable, not the pretty:

  • Volume-at-price dislocations: when trade prints far outside the local VWAP band with no news, that often precedes volatility expansion.
  • Order-book imbalance spikes at fixed distance from touch: a good early flag for HFT-scale fills.
  • Funding-rate spikes in crypto futures: the crowd's extreme, ready to mean-revert, a felt anomaly with tradable shape.

Deployment Without a Meltdown

The alert layer must never fire and flood; production discipline decides value:

  1. Score every event, alert only above a threshold calibrated on a month of false-positive-tolerant history.
  2. Prioritise: data anomalies pause strategy, market anomalies queue a human review note; never conflate the two actions.
  3. Measure the detector's precision weekly: an alert layer that cried wolf 40 times produced zero flags on the real event teaches you the cost of thresholds better than any textbook.

Anomaly detection is the discipline of knowing your feed is a story with typing errors. Statistical baselines, forests and residual designs each expose one persona of the market's pathology, and production lives or dies on threshold calibration and human escalation. Detect first, decide second, and let the journal of false alarms be the dataset for the detector that replaces this one.