System and method for generating real-time indicators in a trading list or portfolio

Description of equivalent WO 2007002829 A2

SYSTEM AND METHOD FOR GENERATING REAL-TIME INDICATORS IN A TRADING LIST OR PORTFOLIO

[0001] This application claims the benefit of United States Provisional Application Serial No. 60/694,668 filed June 29, 2005, the contents of which are incorporated herein by reference.

BACKGROUND OF THE INVENTION

1. Field of the Invention

[0002] The present invention relates to investment portfolio management systems. In particular, the present application relates to a computerized investment portfolio management system and method for recognizing abnormal conditions in real-time, for a security being traded in a trading forum.

2. Description of the Related Art

[0003] Computerized trading systems exist that allow traders to monitor and execute transactions in trading forums, such as the NASDAQ. Some trading systems include portfolio management functions and/or allow traders to execute trade lists. For example, U.S. Published Patent Application No. 2004/0181479, is directed to an investment portfolio optimization system, method and computer program product, the entire contents of which are incorporated herein by reference. [0004] When trading a portfolio or a trade list, a small number of securities can sometimes skew the performance of the entire portfolio. It would be important to traders trading portfolios and trade lists to be able to identify, preferably in real-time, such securities that could hurt the performance of a portfolio or trade list, so that the trader can take the appropriate actions to minimize potential losses to the portfolio or trade list.

[0005] While computerized trading systems exist that allow traders to view real-time market data, such as price, volume and spread, and certain analytics or quantitative metrics, such as moving averages, these systems fail to identify and effectively communicate to the trader abnormal conditions as they occur in real-time. Thus, there remains a need for a system that can recognize abnormal conditions in real-time and provide indicators that allow the trader to react quickly to the abnormal conditions .

SUMMARY OF THE INVENTION

[0006] It is therefore an object of the present invention to overcome disadvantages of the prior art by providing systems and methods capable of identifying an abnormal condition of a security traded on an exchange.

[0007] A first aspect of the present invention is a system for generating an indicator of abnormality in the condition of a security traded on an exchange using real-time data from a remote source. The system includes a computer with a processor and a memory device storing a set of machine readable instructions executable by the processor to receive in real-time from the remote source a real-time value of a first variable related to a condition of the security, retrieve historical market data for the security, and retrieve an empirical distribution of analytic or quantitative metrics for a peer group of the security, wherein the empirical distribution is based on a relationship of empirical values of the first variable for members of the peer group. The system then estimates the value of the first variable based on the historical market data for the security, calculates an analytic metric (also referred to herein as an "analytic result") based on a relationship between the value received in real-time and the value obtained by estimating, and compares the analytic metric for the security with the empirical distribution of analytic metrics for the peer group to determine whether the condition of the security is abnormal. [0008] In a preferred embodiment, the system receives in real-time from a remote source real-time values of a plurality of variables related to a condition of the security. Examples of the types of variables that may be monitored in real-time by the system include, but are not limited to, trade price, trading volume, bid-ask spread, and depth. Both real-time values of the variables as well as estimates thereof based on historical data can be dynamically updated throughout the trading day. Examples of the types of analytics that can be calculated using the real-time values of the variables and estimates thereof include, but are not limited to, relative volatility, relative volume, and relative cost. The peer group used to generate empirical distributions preferably includes a plurality of securities having similar characteristics to the first security (e.g., volume, volatility, price, etc.). The system determines whether or not an abnormal condition exists based on a comparison of the analytic metrics to the empirical distribution of peer group analytics. For example, if the analytic metric is an unlikely deviation from the empirical distribution, an abnormal condition may be deemed to exist. In one embodiment, the system can display an indicator to a trader alerting the trader of the abnormal condition. The indicators can reflect the degree and kind of condition. The system can include a single computer that performs all of the above functions, or a network of computers wherein, e.g., certain functions are performed by a server and other functions are performed by user workstations connected with the server. [0009] Another aspect of the present invention is a method of detecting an abnormal condition of a security traded on an exchange. The method includes the steps of receiving in realtime a value of a first variable related to a condition of the security, estimating the value of the first variable based on historical market data for the security, calculating an analytic metric based on a relationship between the value obtained by real-time monitoring and the value obtained by estimating, retrieving an empirical distribution of analytic metrics for a peer group of the security, and comparing the analytic metric for the security based on real-time data with the empirical distribution of analytic metrics for the peer group to determine whether the condition of the security is abnormal .

[0010] In a preferred embodiment, the method includes the steps of receiving in real-time from a remote source real-time values of a plurality of variables related to a condition of the security. Examples of the types of variables that may be received in real-time according to the method include, but are not limited to, trade price, trading volume, bid-ask spread, and depth. Both real-time values of the variables as well as estimates thereof based on historical data can be received continuously (i.e., dynamically) throughout the trading day. Examples of the types of analytics that can be calculated using the real-time values of the variables and estimates thereof include, but are not limited to, relative volatility, relative volume, and relative cost. The peer group used to generate empirical distributions preferably includes a plurality of securities having similar characteristics to the first security (e.g., volume, volatility, price, etc.). In determining whether or not an abnormal condition exists based on a comparison of the analytic relation to the generated empirical distribution, the method may, for example, deem an abnormal condition to exist if the analytic relation is an unlikely deviation from the empirical distribution. In one embodiment, the method also includes the step of displaying an indicator to a trader alerting the trader of the abnormal condition. The indicators can reflect the degree and kind of condition.

[0011] Yet another aspect of the present invention is a computer program product for generating an indicator of abnormality in the condition of a security traded on an exchange. The computer program product includes a digital storage media and a set of machine readable instructions, stored on the digital storage media, which are executable by a computer to establish communication between the computer and a remote source, receive a value of a first variable related to a condition of the security in real-time from the remote source, retrieve historical market data for the security and estimate the value of the first variable based on the historical market data for the security, calculate an analytic metric based on a relationship between the real-time value of the first variable and the estimated value of the first variable, retrieve an empirical distribution of analytic metrics for a peer group of the security, and compare the analytic metrics for the security with the empirical distribution of analytic metrics for the peer group to determine whether the condition of the security is abnormal. [0012] In a preferred embodiment, the computer program product is configured such that, when it is executed, it causes a computer to receive in real-time from a remote source real-time values of a plurality of variables related to a condition of the security. Examples of the types of variables that may be received in real-time include, but are not limited to, trade price, trading volume, bid-ask spread, and depth. Real-time values of the variables as well as estimates thereof based on historical data can be received continuously (i.e., dynamically) throughout the trading day. Examples of the types of analytics that can be calculated using the real-time values of the variables and estimates thereof include, but are not limited to, relative volatility, relative volume, and relative cost. The peer group used to generate empirical distributions preferably includes a plurality of securities having similar characteristics to the first security (e.g., volume, volatility, price, etc.). The computer program product can be configured to determine whether or not an abnormal condition exists based on a comparison of the analytic relation to the generated empirical distribution. For example, if the analytic relation is an unlikely deviation from the empirical distribution, an abnormal condition may be deemed to exist. In one embodiment, the computer program product can include instructions executable by the computer to display an indicator to a trader alerting the trader of the abnormal condition. The indicators can reflect the degree and kind of condition. In another embodiment, the computer program product includes a second set of instructions executable by a second computer to receive indicators from the first computer and display them on the second computer. [0013] Further objects and advantages of the present invention are discussed below with reference to the drawing figures .

BRIEF DESCRIPTION OF THE DRAWINGS

[0014] Fig. 1 is a schematic diagram of a system for identifying securities having abnormal conditions according to an embodiment of the present invention.

[0015] Fig. 2 is a flow chart of a method for identifying securities having abnormal conditions according to an embodiment of the present invention.

[0016] Fig. 3 is a screen shot of a trading desktop displaying indicators for a list of securities according to an embodiment of the present invention. [0017] Fig. 4 is a screen shot of a trading desktop showing a window that allows a user to set alert levels according to an embodiment of the present invention. [0018] Fig. 5 is a screen shot of a trading desktop showing certain indicators shaded according to another embodiment of the present invention.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0019] While the present invention may be embodied in many different forms, a number of illustrative embodiments are described herein with the understanding that the present disclosure is to be considered as providing examples of the principles of the invention and such examples are not intended to limit the invention to the embodiments shown or described herein .

[0020] Referring now to FIG. 1, a schematic diagram of a system 20 for identifying abnormal conditions in a list of one or more securities according to an embodiment of the present invention is shown. The system 20 includes a server 22 in communication with one or more user workstations 24, for example via a direct data link connection or a network such as a local area network (LAN), an intranet, or the Internet. The server 22 and the work stations 24 can be computers of any type so long as they are capable of performing their respective functions as described herein. The computers can be the same, or different from one another, but preferably each have at least one processor and at least one memory device capable of storing a set of machine readable instructions (i.e., computer software) executable by at least one processor to perform the desired functions, where by "memory device" is meant any type of media or device for storing information in a digital format on a permanent or temporary basis such as, for example, a magnetic hard disk, flash memory, an optical disk, random access memory (RAM) , etc.

[0021] The computer software stored on the server ("server software"), when executed by the server's processor, causes the server 22 to communicate with the workstations 24 and one or more remote sources 26 of financial data, such as data vendors, that offer real-time securities data in an electronic format. The server software, when executed by the server's processor, also causes the server 22 to perform certain calculations, described in greater detail below, using the real-time data from the data vendors 26, as well as historical data about the securities and peer group data, to determine whether an abnormal condition exists, and to send an indicator of the condition to one or more workstations 24. [0022] The computer software stored on a workstation (^NNuser software"), when executed by the workstation processor, causes the workstation 24 to receive indicators from the server 22 and to display the indicators to a user on a monitor, for example using a spreadsheet program, such as Microsoft® EXCEL®, an automated portfolio optimization program, such as ACE®, or any other type of computer program capable of displaying a list of securities and data associated with the listed securities.

[0023] Historical securities data used by the system 20 to identify abnormal conditions can be received from a remote source 20, such as a data vendor, or from a local database 30 connected to, or maintained on, the server 22. Empirical peer group data is preferably stored in a database 32 maintained on, or otherwise accessible by the server 22.

[0024] The server 22 can be located at the user's facility or at a site remote from the user's facility. Communication between the server 22 and the data vendors 26 and 28 can be accomplished via a direct data link connection or a network, such as a LAN, an intranet or the Internet. In alternate embodiments, one or more workstations can be configured to perform the server functions such that a dedicated server is not needed. It will also be appreciated that workstations can be configured to communicate individually with data vendors and/or local databases without being networked to a server or other workstations .

[0025] Operation of the system 20 is described with reference to the flow chart shown in FIG. 2, which illustrates a method 40 of identifying abnormal conditions in a list of one or more securities according to an embodiment of the present invention. The method begins at step 42, at which time the system initiates a number of steps involving receipt of certain information that will be used to determine abnormal conditions of securities. At step 44, the system receives from a remote source, such as a data vendor, real-time values of one or more variables associated with a first condition of a security traded on an exchange, and stores at least some of the values in memory. Examples of the types of variables that may be received in real-time from remote sources include, but are not limited to, trade price, trading volume, bid-ask spread, and depth (i.e., ask size for buy orders or bid size for sell orders) . In a preferred embodiment, values are received continuously in real-time throughout a trading day and some of these values (e.g., values received at predetermined intervals) are used to calculate certain analytics as described in greater detail below. In a presently preferred embodiment, values received at a predetermined interval of about five seconds are used to compute the analytics. In addition, at least some of the real-time values may optionally be stored in a database on the server or elsewhere for later reference as historical data. [0026] At step 46, the system receives historical data on prior values of the first variable and stores the historical data in memory. For example, the historical data may include an average value of the first variable for a particular time of day. In a preferred embodiment, the historical data includes a running average of values over a 21 day period. The historical data can be received from one or more remote or local sources whenever it is needed, but is preferably received at predetermined intervals throughout the day (e.g., about every five seconds) . In a preferred embodiment, at least some of the historical data is maintained in a database on the server and updated daily. At the beginning of the trading day, the historical data in the database can be uploaded into memory so that it can be accessed immediately by the system at any time during the trading day. Alternatively, all or some of the historical data may be received from a remote source, such as a data vendor.

[0027] At step 48, the system receives peer group data including values of the first variable for a group of securities that are considered to be within a peer group of which the first security is a member. Alternatively, the peer group data includes empirical distributions of analytic metrics based on historical values of the first variable for the peer groups. Preferably, the peer group includes a plurality of securities having similar characteristics to the first security. For example, characteristics such as industry or sector (e.g. basic materials, consumer cyclical, consumer non-cyclical, financials, health, industrials, information technology, resources, telecommunication services, and utilities), exchange (e.g., New York Stock Exchange, American Stock Exchange, and NASDAQ), and capitalization (e.g., large or small cap) can be used to define dozens of peer groups. [0028] The peer group data can be received from one or more remote or local sources whenever it is needed. In a preferred embodiment, at least some of the peer group data is maintained in a database on the server and updated at least quarterly. Like the historical data, at the beginning of the trading day, the peer group data in the database can be uploaded into server memory so that it can be accessed immediately by the system at any time during the trading day. Alternatively, all or some of the peer group data may be received from a remote source, such as a data vendor. The peer group data may be accessed as frequently as desired but is preferably accessed at predetermined intervals throughout the day (e.g., about every five seconds).

[0029] While steps 44, 46 and 48 are shown in FIG. 2 as being performed in parallel, it will be appreciated that two or more of these steps can be performed serially in any order. In a preferred embodiment, steps 44, 46 and 48 are performed at predetermined intervals (e.g., about every five seconds) throughout a trading day.

[0030] At step 50, the system estimates a value for the first variable based on the historical data received in step 46. For example, if a real-time value of the first variable is received at a particular time during a trading day and the historical data includes several values for the variable at the same time of the day (e.g., within five minutes of the time) , the system might use an average value of the first variable for the same time period as the estimated value for the first variable.

[0031] At step 52, the system calculates an analytic metric or result using the real-time value of the first variable obtained in step 44 and the estimated value of the first variable generated in step 50. Some examples of the types of analytic metrics ("analytics") that can be calculated include, but are not limited to, relative volatility, relative volume, and relative price, each of which is described in greater detail below. In general, the analytics involve some type of ratio or relationship between the real-time and estimated values of the variable, providing an indication of How much the real-time value αeviates trom Historical values of the variable.

[0032] At step 54, the system determines analytic metrics for each of the securities in the peer group using the data obtained in step 48. In one embodiment, the peer group database includes historical values of the variable for the peer group and the system uses the values to generate an empirical distribution of analytic metrics for the peer group. Alternatively, the database may include empirical distributions of analytic metrics organized by peer group and the system may receive an empirical distribution for an appropriate peer group in step 48 such that it is not necessary to generate an empirical distribution from raw data each time the method is practiced.

[0033] At step 56, the system compares the analytic metric determined at step 52 with the empirical distribution of analytic metrics determined at 54. For example, the system might determine where the analytic metric falls within the distribution in terms of percentile or standard deviation. [0034] At step 58, the system uses the result of the comparison at step 56 to generate an indicator of abnormality for the security. The indicator can be qualitative (i.e., abnormal condition exists or does not exist) or it can be more quantitative (e.g., degree of abnormality in a positive or a negative sense, etc.). For example, a qualitative determination may be made that a quantity more than two standard deviations from the mean of the empirical distribution is abnormal. Alternatively, abnormality can be measured on a scale (e.g., -5 to 5), with an indicator value of 0 reflecting a neutral, average or normal condition. [0035] The indicator of abnormality generated in step 58 is then sent to a user at step 60 for display by the user workstation. The process 40 is shown ending at step 62, but it will be appreciated that the process can be repeated periodically throughout the trading day, e.g., every few seconds or whenever the system receives a request for an update .

[0036] As described in greater detail below, the indicator is preferably displayed to the user in a spreadsheet format in which a list of securities and associated information are arranged in rows and columns. Any icon or visual symbol can be employed as an indicator of abnormal conditions . For example, a plurality of up or down arrows could be used to indicate whether the current trading condition is in an upper or lower percentile of the empirical distribution for the peer group, the number of arrows displayed reflecting the degree of abnormality. Boxes, bullets and/or bars can be used with or without a divider line indicating the average or mean value of the empirical distribution. Charts, colors, shading and/or other visual aids can also be employed.

[0037] The present invention may be used in conjunction with or as an extension to a trading platform. An exemplary trading platform with which the present invention can be used is described in co-owned U.S. Patent Application Serial Number 10/166,719, filed on June 12, 2002, the entire contents of which are hereby incorporated by reference. That application describes an Agency Cost Estimator ("ACE") method and system that allow a user to obtain price impact cost estimates for any pre-specified strategy, and generates an optimal trading strategy subject to certain assumptions. ACE further allows a user to submit a proposed portfolio trade execution and analyzes the execution according to a trading strategy algorithm. The present invention may act in cooperation with or as an extension to platforms like ACE by identifying, preferably in real-time, securities that could hurt the performance of a portfolio or trade list, so that the trader can take the appropriate actions to minimize potential losses to the portfolio or trade list. [0038] An exemplary screen shot VU or a screen from a trading platform or desktop employing indicators of abnormality according to an embodiment of the present invention is shown in FIG. 3. In this example, streaming data is used to populate a MICROSOFT^® EXCEL^® spreadsheet. As shown, the spreadsheet includes rows listing the securities in a trade list or portfolio and columns displaying ticker symbol 72, side 74 (i.e., buy or sell), size of the order 76, realtime and historical volume 78 and 80, real-time and historical 5-minute volatility 82 and 84, real-time and historical cumulative volatility 86 and 88, and performance 90 (i.e., symbol v. sector 92 and symbol v. market 94) . As shown in this example, indicators can be displayed on the spreadsheet to show abnormal trading conditions of the listed securities . In particular, the spreadsheet includes columns displaying indicators determined in accordance with the present invention, specifically volume indicators 96, 5-minute volatility indicators 98, cumulative volatility indicators 100, symbol v. sector performance indicators 102, and symbol v. market performance indicators 104. In this example, it was determined that security MRK currently has an abnormally high volume, while PZE currently is performing poorly versus the sector .

[0039] In particular, the real-time volume for MRK at the time the screen shot was taken was 59,007,900 as compared to the historical cumulative volume (e.g., over the last 21-days) which was only 15,943,258. The ratio of current to historical volume was therefore, 3.7. When this ratio is compared to the empirical distribution for the peer group, it falls in the 96% of the distribution spectrum; that is, it is only 4% likely that the real-time cumulative volume of 59 million would occur, and therefore, the volume indicator is set to level 4 to indicate a severe abnormality. The trader can consider and react appropriately to this important information. Thus, it is easy to understand how useful indicators generated according to the present invention can be to a trader. [0040] As mentioned previously, any icon or visual indicator can be employed to signify abnormal conditions. For example, a plurality of up or down arrows could be used to indicate whether the current condition is in an upper or lower percentile of the distribution of metrics. Boxes, bars or bullet points could be used with or without a divider line indicating the average or mean value of the empirical distribution. Charts, colors, shading or other visual aids can also be employed.

[0041] Indicators generated in accordance with the present invention could be further used to alert or warn the user/trader of dangerous conditions. For example - changes in volume patterns may require changing participation rates in a portfolio, or when a certain symbol is outperforming a corresponding sector index it might be necessary to execute a "short" based on the belief that it will return to historical levels .

[0042] Referring to FIG. 4, the system can be configured to allow the user to assign alert level set points used to trigger such an alarm or to configure the indicators display characteristics (e.g., at what range the indicators change display levels - such as from 3 to 4 ^NMots" or "bars") . As shown, a pop-up box or window 106 is displayed over the spreadsheet 70 and includes tabs for volume 108, volatility 110, performance 112, etc. Ranges can be set based upon the empirical distribution spectrum (in percent) , but in the case of normal distributions, could be set by standard deviation. Note that the entire line for symbol CPN is highlighted and corresponds to the pop-up box 106. Levels can be set for each individual indicator or globally for all indicators . [0043] It should be understood that market data can be used to generate indicators according to the present invention. Preferably, LEVEL 1 and/or LEVEL 2 data is collected in real-time for input into a system performing the analytics to generate the indicators .

[0044] Real-time and historical market data can be collected for each security in a portfolio or trade list, or for all securities. Accordingly, a system implementing indicators according to the present invention should be configured to receive such information and preferably will include a "live feed" or "stream" of data. Empirical distributions may be generated by any means and should be accessible to the system. Alternatively, a means for generating empirical distributions locally could be included, which could generate such distributions dynamically based on up-to-date historical data.

[0045] The peer groups can be defined statically (i.e., predetermined) on the basis of characteristics such as, e.g., sector, exchange, and capitalization, or dynamically, by identifying securities having similar characteristics to a selected security such as, e.g., volume, volatility, price, etc .

[0046] Fig. 5 is a screen shot of another embodiment of the present invention wherein data is shaded or color coded on the trading desktop to indicate abnormal trading conditions for a security. For example, in row 17 of the spreadsheet, the symbol ATI is shown to have abnormally high volatility by color coding cells 116a and 116b; and in row 21, the symbol LU is shown to have abnormally high volume by color coding cells 118a and 118b. The decision whether or not to shade or color code a cell to indicate an abnormal condition is preferably based on a comparison of the type described above in connection with method step 56 in Fig. 2.

[0047] No particular system configuration must be used to implement the present invention. It is recognized that it may be easiest to use a web based or client-server architecture wherein analytics are programmed onto a central server or onto a plurality of servers. Analytics can also be calculated on the client side as well.

[0048] Real-time and historical data is typically obtained from data vendors, via, for example, a dedicated line or over an electronic data network. Level 1 and/or level 2 data can be used. Examples of level 1 data include, but are not limited to, FITCH, ISSM, TAQ, TORQ or so-called "ticker" information. Level 2 data offers the unique ability to observe the amount of market liquidity, the price structure, and the quantity of unexecuted displayed limit orders at any given time of the day for any market venue. It contains trade as well as all order information (order messages about additions, modifications and cancellations) and thus particularly, all quote information beyond the best levels . Real-time analytics are preferably input into a real-time data and analytics API. Qualitative signals are derived from the historical and real-time data and output to the client, which in this case is an EXCEL or order management system (^NNOMS") client. The client interface is preferably robust and flexible enough to enable the users to create their own custom analytics .

Analytics

[0049] One skilled in the art will understand that the analytics used to generate indicators according to the present invention can vary. As described above, historical and realtime data may be collected from a number of sources for the calculation of analytics generating stock signals such as Relative Volume, Relative Volatility, etc. Indicators could be generated according to the present invention for any stock signal that is displayed on a trading desktop. [0050] Empirical distributions can be generated a number of ways for a number of periods. Quarterly distributions are ^ddAfeht^iatS^Tof^""simplicity. Of course, longer or shorter periods could be used for generating distributions . Historical data can be used to generate empirical distributions for predetermined (i.e., static) or dynamically determined peer groups. Preferably, peer groups are created for use with all analytics, however, one will understand that different peer groups could be used for different analytics. [0051] A number of exemplary analytics are described below which can be implemented according to the present invention. The below discussion of analytics is by no means intended to limit the present invention to only those analytics described and one having ordinary skill in the art will readily understand that other analytics could be used to generate abnormal condition indicators according to the present invention.

Relative Volatility

[0052] RelativeRisk=—, where r_τ is σ,

(a) today's return over time τ - AT through τ , and

(b) today's return from "open" to τ; and σ_ris the historical volatility of the same time period in a day.

[0053] For meaningful analytics, the time interval Δτin

(a) above should be appropriately set; for example, 5-minute intervals could be chosen. The historical average statistics can be computed based on the analytics which provide 30-minute bin volatility distributions. The historical average statistics are preferable dynamic or "moving" averages. Historical estimates may be updated periodically or on a monthly basis.

[0054] Relative volatility or risk can be based on the following data for each stock: 60 most recent prior day's closing prices, daily (forward-looking) relative volatility, and intra-day mid-quote volatility [0055] The intra-day mid-quote volatility is given by:

<img file="WO2007002829A2_D0001.tif" /> where

n is the total number of valid quotes for that day; P_± and t_± are, respectively, a midpoint and time (in seconds) of the i'th valid quote. If the first quote was before regular opening time, we set ti to the regular opening time. Valid quotes are defined as quotes with no or valid condition codes that

(a) have strictly positive bid and ask prices.

(b) have strictly larger ask than bid prices (crossed or locked quotes should be excluded) .

(c) have strictly positive bid and ask sizes for specified markets.

(d) are not second level quotes (a second level quote is defined as a quote that has a market maker i.d.) .

(e) have time stamps within regular trading hours or, for USA only, represents the last quote prior to regular opening time reported from the primary market for the stock.

[0056] Stock-specific and aggregated binned volatility "distributions" _\f_j), J= 0,1, ...,13, can be retrieved or derived.

The value ς_o represents the weight for the overnight volatility. Note that the sum of the weights of [ς J does not equal to one, however the sum of the weights for [ς^j does.

Certain stocks do not trade at a volume sufficient such that meaningful statistics can be generated from the data relating solely to that stock. Therefore, stocks that do not have specific volatility numbers are aggregated by "liquidity bands". Volatility is, then, calculated for this group. For example, all stocks that trade between 5M-10M shares a day- become one group, etc.

[0057] In addition, the historical daily volatility of a stock should be computed. The daily volatility σ with capped maximum return value can be computed based on the split- adjusted daily returns of the last 60 trading days and is

defined as: σ- <img file="WO2007002829A2_D0002.tif" /> where r_ι=\q_t-q_t_^)lq_t__vr =\l\Υ\-Y_JτιaTr_v T = {t =l,...,60| r_xexists\and |T| is the cardinal number of set T.

[0058] The term "with capped maximum return value" means that the largest return in absolute value is capped to the second largest return in absolute value, then adjust by sign. That is, if the largest return in absolute value is -0.3 and the second largest in absolute value is 0.2, then the largest value will be replaced with -0.2. In the case that less than 10 return observations (i.e. if |T| &lt;10) exist, the forward- looking volatility can be used.

[0059] The real-time data for the relative volatility measure (a) , includes the last trade price P_τ within the last

5 minutes and the last trade price P_r__Δr before P_x . In the case that there are no trades in the last 5 minutes or if P_r__Aτ does not exist or was reported more than 30 minutes prior to P_τ , the return is set equal to 0; for the relative volatility measure (b) , data includes the last trade price P_T and today's open price P_open . In the case that there are no trades, the return is set equal to 0. [0060] Intraday return can be represented by <img file="WO2007002829A2_D0003.tif" /> . Return from open to τ can be represented by

Tt <img file="WO2007002829A2_D0004.tif" /> I Popun .

[0061] For Historical volatility within one regular bin i (for relative volatility measure (a)), the bin volatility is defined as σ_t —qpr. The 5-minute volatility is set to be equal to σ_τ =(ΔW3θ)^1/2σ,..

[0062] For Historical volatility across two regular bins i and j (for relative volatility measure (a) ) , if the interval τ — Δr through τ crosses two regular bins as Δr = Δ₍. +Δ_;. then

I Δz ₂ ΔZ 2 I 1/2 the 5-minute volatxlity becomes στ = \ — σ, -\ σ,

Uo ' 30 ^JJ

[0063] For Historical volatility at the open (for relative volatility measure (a)), if r is between 9:30am and 9:35am, r_τ is defined as the return over time from open to r and

GT — V¹¹ , where Δ is the number of minutes from 9:30 to <img file="WO2007002829A2_D0005.tif" /> τ .

[0064] For Historical volatility from open to r (for relative volatility measure (b) ) , if re bin I and Δr is the time from the beginning of the bin i to τ , the historical

volatility from open to τ is defined as σ_f ~~~ &amp; u t^{2 | I / 2}<img file="WO2007002829A2_D0006.tif" />

[0065] For the mapping of quantitative statistics into qualitative signals, "cutoffs" can be group-specific, where the groups are classified by sector (ITG Industry Classification based on FTSE) , market, and addv. Cut-offs are parameters used to define peer groups - stocks that are grouped together for specific indicators. For example, all stocks that are in the information technology sector and traded on NYSE and have an Average Daily Dollar Volume (ADDV) bigger than X can be grouped together. Relative Volume

VoI

[0066] Relative volume = -, where Vol_τ is today' s actual

trading volume from open to τ , today' s actual trading volume in the period (τ-5min,τ) and Vτ is the historical average volume of the same time period within a day. [0067] Relative volume is analogous to relative volatility. Relative volume can be calculated with the following data for each stock: prior day's closing price q, 21-days median dollar volume (addv) DV. Analogously to ACE, the 21-day median share volume can be defined as V = DV/q . [0068] Stock-specified and aggregated 30-minute (bin) volume distribution (ψ. J can be retrieved or derived.

[0069] The real-time data includes the trade sizes of all semi-valid trades from open to τ {fromτ — 5mintoτ) or, alternatively, the cumulative (semi-valid) trading volume from open to τ [from open toτ) on a minute (or a few seconds) basis.

[0070] Assume that τ is in bin I and Δτ minutes after the end of bin i-1. We define the historical cumulative trading

volume from open to τ as <img file="WO2007002829A2_D0007.tif" />

<img file="WO2007002829A2_D0008.tif" /> where Δτ, and Δτ₂ is the tern spent in bin i-1 and i,

Δr, +Δ, =5min. respectively. In particular,

[0071] Note that empirical distributions of relatively illiquid stocks may have a substantial weight close to zero (especially for 5-minute relative volume distribution) . Relative Cost

PI

[0072] Relative cost = —, where PI_τ is the price impact

ACE τ estimate at time τ for a particular order size and ACE_τ is the ACE estimate for executing the same order size in the bin corresponding to time_τ .

Price Impact Model

[0073] Price impact estimates for a particular time and order size can be derived from the formula : Price Impact = Spread Component + Liquid Demand Component, where

Spread Component — Max\ , 0.35* Spread , and

^-"i

Liquidity Demand Component ~ *Volatility3Qmm C4 . <img file="WO2007002829A2_D0009.tif" />

If the Order Size is less than the Depth, there is no PI forecasting.

[0074] Real-time information required for forecast includes :

Spread -- Most recent Bid-Ask spread in cents, Order size -- Order size in round lots with tolerable Fractional number (Trim the original order size to 50,000 shares if it's more than 50,000 for robustness . )

Depth — Ask Size - For Buy Orders (Round lot) , Bid Size - For Sell Orders (Round lot) —, Volume3Omin— MAX (Total share volume in the past 30 minutes,

LowerThreshold) ; If after 10:00am: LowerThreshold=ADV* (Pctl *T1

+ Pct2 *T2)/3) ;

If before 10:00am: LowerThreshold= ADV*(Pct2 *T2)/3); where

T2 = 1/30 *Minutes in the current

30-min bin and Tl= 1-T2

Pctl and Pct2, average volume profiles of previous and current 30-minute bins. Volatility30min — Difference in dollar between highest and lowest of ASK prices for BUY orders and BID price for SELL orders in the past 30 minutes, with bounds (0.02, BID/20) (Note that 0.02 is used for market with available quote) .

[0075] In addition to the real-time feed, the model requires the parameter estimates of Cx,...., C₄ are calculated based on the combination of market ("UN" and "UQ") and two market cap levels (Lower and Upper Capital threshold) . Altogether there are four models, all with the same function specification, that are fitted for each of the four sub- samples. For the model, stocks that traded primarily on the "US" market uses the same parametes which are associated with the "UN" market and stocks that traded primarily on the ^WUR" market uses the same parameters as that of stocks primarily traded on the "UQ" market.

[0076] Volume30min can be obtained as snapshot of intra- day market consideration and is inaccessible for the early trading before 10:00am. To solve this problem, the scaling rules set up as below are adopted:

For orders before 9:45pm: Volume30min= Volume from open + (Tl/30) ^Empirical Volume30min before 10:00am

For orders after 9:45pm: Volume30min=Volume from open *(30/T2) before 10:00pm, where, T2 is the time window from open to order submission and Tl is the window left from T2. VolumeSOmin of early trading is also subject to Lower Threshold=ADV* (Pet *T2/30) /3) .

[0077] Since the models are fitted separately, a significant degree of discontinuity is present when a stock crosses the market cap boundary. To solve this issue, sudden changes can be smoothed out at this boundary. Specifically, the boundary value refers respectively to (lowercapthreshold) for large cap stocks and (upperercapthreshold) for small cap ones in the deliverable.

[0078] The Large Cap Model is to get prediction (pj^L∞^geCcφModd^ _{±f market cap is 2}o% more of the boundary value.

The Small Cap Model is used to get prediction _if<img file="WO2007002829A2_D0010.tif" /> market cap is 20% less of the boundary value. Otherwise, the predictions from large and small cap models can be mixed as Plτ =

(1.2 * Boundry - MKTCAP) * (p/^"^') + (MKTCAP- 0.8 * Boundary) * (PJ^^B^^PMQM^

0.4 ^Boundary

[0079] Market cap levels mentioned above are defined through lowercapthreshold and upperercapthreshold.

ACE

[0080] Numerous stock data is required to ACE calculations (see, the ^λ719 application referenced above), including: primary exchange, price impact estimates based on 1 year of tick data, price improvement estimates based on execution data, intra-day volume, volatility and spread distributions, daily (forward-looking) relative volatility, and 21-days median dollar volume (addv) , and average relative spread.

[0081] ACE cost estimates are derived using a one-bin strategy, i.e. the whole order size for a stock is executed in the bin the time τ belongs to. All ACE calculations use the latest available ACE files and executables and are applied to the listed case (i.e., ACE costs should be computed once for the whole list of stocks rather than for each stock individually) .

[0082] Cutoffs are group-specific, where the groups are classified by market, (forward-looking) volatility and addv.

Tracking Statistics

[0083] Tracking Statistics is defined as (I₊O - 1,

(l+Index_t) where r_τ is the return of stock I over time intervals τ-Aτ and τ , and Indexes the return of benchmark such as market, sector, industry, and ETF (Exchange Traded Fund) over the same interval. Two types of tracking statistics are contemplated: a first is for the five-minute interval (ΔT = 300 seconds) and a second is for cumulative excess return since yesterday's close ( AT is not fixed, but depends on the time of the last trade during the previous trading day) . Since the real-time returns for market, sector, and industry are not always available, relevant ETFs can be identified in order to approximate returns of interest. An exemplary list of ETF' s that can be used is presented in the table below:

<img file="WO2007002829A2_D0011.tif" />

Table I [0084] The excess return could be brought together with an indicator whether the stock moves the same direction of the index. Mapping from quantitative statistics into qualitative signals may be based on separate distributions when the stock moves the same direction as the index and different direction. Further, the cutoffs are group-specific where the groups are classified by market cap and sector.

[0085] Market capitalization groups are "small" (bottom 30% of NYSE market capitalization) , "medium" (middle 40% of NYSE market capitalization) and "big" (top 30% of NYSE market capitalization) . NYSE market capitalization is recorded as of the first trading day of the current quarter. Current cutoff values (30% and 70-% NYSE size percentiles in millions) will be presented as the "lower cap threshold" and "upper cap threshold" of "medium" size stocks.

[0086] From the above, it will be appreciated that the present invention provides a system and a method for generating one or more quantitative and qualitative indicators that aim to point out abnormalities in a trade list. In one sense, the present invention is a "tail management" tool that attempts to predict or warn the traders on abnormal changes/movements that happen in real-time to certain stocks in the trade list. Analytics are based on relations between historical and real-time data. In particular, the analytics are calculated as a ratio or a relative measurement of a realtime variable (such as volume traded, volatility, relative return tracking, etc.) related to a first security traded on an exchange to an estimate of the real-time variable based on historical data. Both the real-time value of the variable as well as the estimate of it based on historical data can be dynamically updated throughout the day. An empirical distribution for the analytic can be generated based on a peer group for the first security. The peer group preferably includes a plurality of securities having similar characteristics to the first security (e.g., sector, exchange, market capitalization, average daily trading volume, volatility, price, etc.) . The method includes a step of comparing the calculated ratio or relation to the generated empirical distribution, and then determining whether or not an abnormal condition exists based on the comparison. An indicator can be displayed to a trader as an indication of the abnormal condition.

[0087] Thus, a number of preferred embodiments have been fully described above with reference to the drawing figures. Although the invention has been described based upon these preferred embodiments, it would be apparent to those of skill in the art that certain modifications, variations, and alternative constructions could be made to the described embodiments within the spirit and scope of the invention. For example, as explained above, numerous other analytics could be calculated for the purpose of generating indicators of abnormal trading conditions for a security according to the present invention.