Kaskad Technology

Korrelera for Market Surveillance

Candyce Edelen

November 8, 2006

November 8, 2006

Kaskad Technolog

ySlide 2

The Problem

Impacts entire industry

Industry under extreme pressure to comply

Forcing changes in compliance and surveillance

Ever increasing market data volumes

Traditional database approaches ineffective

Batch-based processing not fast enough

November 8, 2006

Kaskad Technolog

ySlide 3

The Solution Event stream processing engine

Handles data at line speed Identifies events of interest Creates events for further processing

Complex processing on in-flight messages Detect trading patterns Apply surveillance logic Send alerts when violations are detected

Analyst workstation Review alerts Query data Validate exceptions Inject events

Operations dashboard Monitor performance Configure system Start/stop components Promote/demote RuleBots

November 8, 2006

Kaskad Technolog

ySlide 4

System Design OnRamps

Adaptors consume data and publish to streams

High Speed Message Bus Supports distributed system Plug and play environment

Query Processing Elements Perform primitive functions Produce new streams

RuleBots Business logic Complex algorithms and pattern detection Scanning forwards and backwards in

stream Looking for triggering events, precedents,

and antecedents OffRamps

Deliver data to downstream systems Queuing and data management

StreamRouter

DataNormalizer

ValidatorSessionManager

OnRamps

k 00086667093002OHNk 00086668093002OHNk 00086669093002OHNk 00086670093002OHNk 00086671093002OHNk 00086672093002OHNk 00086673093002OHNk 00086674093002DIAk 00086675093002DWVk 00086676093002DIAk 00086677093002DIAk 00086678093002DIAk 00086679093002DIAa 00086680093002DLQaI00086681093002OUPkA00086682093002OIUkA00086683093002OWPkA00086684093002OCFk 00086685093002OZCk 00086686093002OUWk 00086687093002OQZk 00086688093002DIAk 00086689093002DIAk 00086690093002DIAk 00086691093002DIAk 00086692093002DIAk 00086693093002DAVk 00086694093002DIAk 00086695093002DAWk 00086696093002DIAk 00086697093002DIA

k 00086667093002OHNk 00086668093002OHNk 00086669093002OHNk 00086670093002OHNk 00086671093002OHNk 00086672093002OHNk 00086673093002OHNk 00086674093002DIAk 00086675093002DWVk 00086676093002DIAk 00086677093002DIAk 00086678093002DIAk 00086679093002DIAa 00086680093002DLQaI00086681093002OUPkA00086682093002OIUkA00086683093002OWPkA00086684093002OCFk 00086685093002OZCk 00086686093002OUWk 00086687093002OQZk 00086688093002DIAk 00086689093002DIAk 00086690093002DIAk 00086691093002DIAk 00086692093002DIAk 00086693093002DAVk 00086694093002DIAk 00086695093002DAWk 00086696093002DIAk 00086697093002DIA

00086727093002OBR00086901093002DLQ00087167093003OQD00087315093003DAQ00087555093003DLQ00087556093003DLQ00087557093003DQI00087558093003OQQ00090606093004DLQ00091299093005DLQ00091907093005DOU00092265093005DOU00095298093006DLQ00096087093006OIU00096149093006DOU00096251093006OMY00096497093006HCQ00096506093006DQS00096608093006ORQ00097597093006OZL00097599093006OZL00097601093006OWS00098291093006OZL00098295093006OZL00098590093007OBR00098734093007OZR00101121093007OYL00102026093007OAJ00102742093008DJV00102827093008DTQ00102890093008DTQ

aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa

TriggeringEvent

November 8, 2006

Kaskad Technolog

ySlide 5

Korrelera Architecture

TCP

OnRamps

Streaming Engine

Analyst Workstation

Operations Workstation

OPRA

NASDAQ

SIAC

Trading System

Kaskad Waterfall

List

ener

/Sc

hed

ule

r

QPE

s an

d

Rule

Bots

DataBase

Alerts

Application

Off

Ram

ps

OnRam

ps

SD

SPARCserver 10Sun

SD

SPARCserver 10Sun

SD

SPARCserver 10Sun

SD

SPARCserver 10Sun

DatabaseD

ata

Bus

Rem

ote

OnRam

ps

Stre

am

Proxy

November 8, 2006

Kaskad Technolog

ySlide 6

Event Sources

Time-ordered event streams 18 event types from 28 unique sources Streams

SIP/SIAC• Quotes

• Prints

• Summaries

Internal Trading System• Orders

• Trades

• Administrative messages

• Corporate actions

November 8, 2006

Kaskad Technolog

ySlide 7

Event Processing

Declarative rules using C++ and Python Event correlation – trades with prints, orders, and quotes Scanning backwards and forwards in a stream Event validity Event aggregation Specialized streams produced by QPEs:

Transforming lower level data to higher level events Enhanced NBBO stream Enhanced tick stream Quote montages

November 8, 2006

Kaskad Technolog

ySlide 8

Types of logic

Sample RuleBots Trade Through – quote validity, exemption

process

Short sales – dual tick tests

Wash sales – pattern detection

Front running – pattern matching

Unusual activity – pattern detection

Post close trading – simple timing algorithm

Locked/crossed markets – timing, causation

November 8, 2006

Kaskad Technolog

ySlide 9

Responses

Business logic continuously applied to streams

Potential violations generate alerts Audible and visual alerts Other events are triggered Downstream applications notified Dashboards

Custom surveillance application Operations and monitoring dashboard

November 8, 2006

Kaskad Technolog

ySlide 10

Results

3 month implementation 1 engineer for Analyst Workstation custom application 2 engineers for RuleBot development 1 business analyst

Currently in final client QA Benefits:

Regulate market real-time with instant results Recreate market associated with historical events Simplify violation review process Add surveillance functionality as needed Scale horizontally and vertically Need more power, add another server