Market Manipulation Detection

7 Detection Types • 22 DSL Primitives • Real-time Protection

← Back to Document Index

System Overview

Multi-layered manipulation detection system protecting AI trading algorithms from market manipulation tactics. Integrates with the executor's circuit breaker system for real-time protection.

flowchart TB subgraph DataSources["Data Sources"] L2[("L2 Order Book
Binance depth@100ms")] Ticks[("Tick Data
Binance aggTrades
Alpaca/Polygon")] OHLC[("OHLC Bars
Yahoo/CoinGecko")] end subgraph Detectors["Detection Engines"] Spoof["Spoofing Detector
spoofing-detector.ts"] Wash["Wash Trading
manipulation-detector.ts"] PumpDump["Pump & Dump
manipulation-detector.ts"] StopHunt["Stop-Loss Hunt
stop-hunt-detector.ts"] Closing["Closing Auction
manipulation-detector.ts"] TickClass["Tick Classifier
tick-classifier.ts"] RealTime["Real-time Spoofing
realtime-spoofing-service.ts"] end subgraph Cache["Scheduler Cache Layer"] SpoofCache[("Spoofing Cache
10s refresh")] TickCache[("Tick Class Cache
30s refresh")] end subgraph DSL["DSL Primitives (22)"] ManipDSL["manipulation-dsl-wrappers.ts
Sync primitives for evaluator"] end subgraph Integration["Integration Layer"] ASE["All-Seeing Eye
manipulation.ts aggregation"] Executor["Paper/Live Executor
Circuit breaker integration"] Alerts["Alert Service
manipulation-alert-service.ts"] end L2 --> Spoof L2 --> RealTime Ticks --> Wash Ticks --> TickClass OHLC --> PumpDump OHLC --> StopHunt OHLC --> Closing Spoof --> SpoofCache TickClass --> TickCache SpoofCache --> ManipDSL TickCache --> ManipDSL ManipDSL --> Executor Spoof & Wash & PumpDump & StopHunt & Closing --> ASE ASE --> Alerts Executor -->|"High Risk"| PauseEntry["Pause Entries"] Executor -->|"Critical"| KillRun["Kill Run"] style DataSources fill:#1a1a2e style Detectors fill:#16213e style Cache fill:#0f3460 style DSL fill:#1a472a style Integration fill:#2d132c

7 Detection Types

1. Stop-Loss Hunting

HIGH IMPACT

Detects price movements designed to trigger stop-losses before reversing.

  • S/R level pierce detection
  • Rapid reversal identification
  • Long squeeze / short squeeze classification
  • Hunt probability scoring

File: stop-hunt-detector.ts

2. Spoofing / Layering

HIGH IMPACT L2 DATA

Large orders placed with intent to cancel before execution.

  • Order book wall tracking
  • Wall appearance/disappearance patterns
  • Cancel-to-fill ratio analysis
  • Price impact correlation

File: spoofing-detector.ts

3. Wash Trading

MEDIUM IMPACT TICK DATA

Self-dealing to inflate volume and create false liquidity signals.

  • Same-size buy/sell pair detection
  • Time window analysis (configurable)
  • Volume percentage calculation
  • Matched pair counting

File: manipulation-detector.ts

4. Pump and Dump

HIGH IMPACT

Coordinated price/volume spikes followed by rapid sell-off.

  • Volume spike detection (>3x average)
  • Price surge identification (>10%)
  • Rapid crash pattern matching
  • Phase classification (pump/dump/complete)

File: manipulation-detector.ts

5. Closing Auction Manipulation

MEDIUM IMPACT

Price manipulation in the final minutes of trading.

  • Final period volume concentration
  • VWAP deviation analysis
  • Close vs session VWAP comparison
  • Abnormal closing activity detection

File: manipulation-detector.ts

6. Tick Classification

INTELLIGENCE TICK DATA

Classify trading activity by actor type.

  • Whale ratio (large trades / total)
  • Bot signature detection
  • Aggressor imbalance
  • VPIN (Volume-Synchronized PIN)
  • Kyle's Lambda (price impact coefficient)

File: tick-classifier.ts

7. Real-time Spoofing

LIVE STREAM L2 DATA

WebSocket-based real-time spoofing detection.

  • Binance depth stream integration
  • Real-time wall tracking
  • Immediate alert generation
  • Streaming to frontend via SSE

File: realtime-spoofing-service.ts

Detection Data Flow

Stop-Loss Hunting Detection

flowchart LR subgraph Input Bars["OHLC Bars"] SR["S/R Levels"] end subgraph Detection["stop-hunt-detector.ts"] Pierce["Pierce S/R Level?"] Reverse["Rapid Reversal?"] Squeeze["Squeeze Type?"] end subgraph Output Signal["StopHuntSignal"] DSL["DSL Primitives"] end Bars --> Pierce SR --> Pierce Pierce -->|Yes| Reverse Reverse -->|Yes| Squeeze Squeeze --> Signal Signal --> DSL style Detection fill:#16213e

Spoofing Detection Pipeline

flowchart LR subgraph Input Depth["L2 Order Book
depth@100ms"] end subgraph Detection["spoofing-detector.ts"] Walls["Detect Walls
(bid/ask)"] Track["Track Wall Changes
(appear/disappear)"] Ratio["Cancel Ratio
Analysis"] Score["Suspicion Score
0-100"] end subgraph Cache["Scheduler"] Refresh["10s Refresh
MONITORED_CRYPTO"] Store["Cache in Memory"] end subgraph Output DSL["DSL Sync Read"] ASE["All-Seeing Eye"] end Depth --> Walls Walls --> Track Track --> Ratio Ratio --> Score Score --> Refresh Refresh --> Store Store --> DSL Store --> ASE style Detection fill:#16213e style Cache fill:#0f3460

Tick Classification Pipeline

flowchart LR subgraph Input Ticks["Per-Trade Ticks
Binance/Alpaca/Polygon"] end subgraph Classification["tick-classifier.ts"] Whale["Whale Ratio
large / total"] Bot["Bot Signature
round lots, timing"] Aggressor["Aggressor Imbalance
buy vs sell pressure"] VPIN["VPIN
toxicity metric"] Lambda["Kyle's Lambda
price impact"] end subgraph Labels Retail["retail"] MM["market_maker"] Fund["fund_rebalance"] Coord["coordinated"] Liq["liquidation_cascade"] end Ticks --> Whale & Bot & Aggressor & VPIN & Lambda Whale & Bot & Aggressor & VPIN & Lambda --> Labels style Classification fill:#16213e

22 DSL Primitives

All primitives read from scheduler-populated caches for synchronous DSL evaluation. File: manipulation-dsl-wrappers.ts

Primitive Returns Description
Spoofing Detection
spoofing_risk(symbol)numberSuspicion score 0-100
is_spoofing_detected(symbol)booleanTrue if score > 50
wall_cancel_ratio(symbol)numberWall cancel-to-fill ratio
bid_wall_size(symbol)numberCurrent bid wall size
ask_wall_size(symbol)numberCurrent ask wall size
orderbook_imbalance(symbol)numberBid/ask imbalance -1 to 1
Tick Classification
whale_ratio(symbol)numberLarge trades / total trades
bot_signature(symbol)numberBot activity score 0-1
aggressor_imbalance(symbol)numberBuy vs sell pressure -1 to 1
vpin(symbol)numberVolume-sync'd probability 0-1
kyles_lambda(symbol)numberPrice impact coefficient
flow_label(symbol)stringActivity classification label
Flow Labels
is_liquidation_cascade(symbol)booleanLiquidation cascade in progress
is_coordinated_activity(symbol)booleanCoordinated trading detected
is_market_maker_dominant(symbol)booleanMM activity dominant
is_fund_rebalance(symbol)booleanFund rebalancing detected
Stop-Loss Hunting
is_stop_hunt(bars)booleanStop hunt detected
stop_hunt_direction(bars)string'long_squeeze' | 'short_squeeze'
is_long_squeeze(bars)booleanLong positions being squeezed
is_short_squeeze(bars)booleanShort positions being squeezed
Composite
combined_manipulation_risk(symbol)numberAll signals combined 0-100
should_avoid_entry(symbol)booleanTrue if risk > 60

Executor Circuit Breaker Integration

Manipulation detection integrates with the paper/live executor's guardrail system. File: algorithms/paper/executor.ts

flowchart TB subgraph Tick["Executor Tick"] Price["Get Current Price"] Eval["Evaluate DSL"] Manip["Check Manipulation Risk"] end subgraph ManipCheck["Manipulation Check"] Risk["combined_manipulation_risk > 70?"] Label["flow_label = liquidation_cascade
OR coordinated?"] end subgraph Actions Pause["Pause Entries
Allow exits only"] Kill["Kill Run
Flatten all positions"] Normal["Normal Operation"] end Price --> Eval Eval --> Manip Manip --> Risk Risk -->|Yes| Pause Risk -->|No| Label Label -->|Yes + Risk ≥ 80| Kill Label -->|No| Normal style Tick fill:#1a1a2e style ManipCheck fill:#16213e style Actions fill:#2d132c

Circuit Breaker Thresholds

Condition Action Effect
combined_manipulation_risk > 70 Pause Entries Block new entries, allow exits only
is_liquidation_cascade AND risk ≥ 80 Kill Run Stop run, flatten all positions
is_coordinated_activity AND risk ≥ 80 Kill Run Stop run, flatten all positions

Scheduler Jobs

Manipulation detection data is refreshed by scheduler jobs for cache population.

Job Interval Symbols Purpose
spoofing-snapshot-refresh 10 seconds BTCUSDT, ETHUSDT, SOLUSDT, BNBUSDT, XRPUSDT Refresh L2 spoofing analysis cache
tick-classification-refresh 30 seconds BTCUSDT, ETHUSDT, SOLUSDT, BNBUSDT, XRPUSDT Refresh tick classification cache

All-Seeing Eye Integration

Manipulation signals feed into the unified data aggregation layer. File: all-seeing-eye/aggregation/manipulation.ts

flowchart LR subgraph Sources Spoof["Spoofing Cache"] Tick["Tick Classification"] Detectors["Pump/Dump, Stop Hunt,
Closing Auction"] end subgraph Aggregation["manipulation.ts"] Fetch["fetchAllManipulationData()"] Consensus["getManipulationConsensus()"] Alerts["checkManipulationAlerts()"] end subgraph Output["AggregatedData"] UDP["UnifiedDataPoint[]
sourceType: 'manipulation'"] Risk["overallRisk:
low | medium | high | critical"] end Spoof & Tick & Detectors --> Fetch Fetch --> UDP Fetch --> Consensus Consensus --> Risk Fetch --> Alerts style Aggregation fill:#16213e

Monitored Symbols

Crypto (Real-time)

Via Binance depth@100ms and aggTrades (keyless)

BTCUSDT, ETHUSDT, SOLUSDT, BNBUSDT, XRPUSDT

Stocks (OHLC-based)

Via Yahoo Finance for pump/dump, stop-hunt detection

SPY, QQQ, AAPL, TSLA, NVDA, AMD