We will follow these steps to build the risk alert:

Define and calculate metrics Find patterns Define threshold for unusual behaviour Build the signal

1. Calculate and define metrics

We start by defining the following metrics:

Mid Price: Weighted average of top of the orderbook. This will be the baseline of our alert system, as we will investigate risk metrics that can signal unusual behaviour in the mid price.

Percentage change of mid price: linear percentage changes of above defined mid price, a helper metric to find sudden changes in the mid price.

Spread: difference between best bid and best ask price. This metric measures the cost of trading on a market. The more competitive a market, the tighter its spread is. Spread will be used as one of the risk metrics for our alert system.

Interarrival time (inverse): 1 divided by the interarrival time. Interarrival time is the time passed between update messages. Smaller than usual interarrival time indicates higher levels of trading activity. We will be looking for high trading activity periods to signal for potential sudden price movements.

Bid-ask sentiment: difference between the count of how many times the ask price was changed and the count of how many times the bid price was changed. This metric gives us the sentiment whether the bid or ask side has more activity.

2. Find patterns

Finding patterns is the hardest part of building any models, but there are a few strategies you can follow.

Visualising your dataset pairwise in scatterplots will help you get a feel for potential correlations.

As we are looking to build a signal that can predict a sudden movement in the mid price, calculating autocorrelation can help us find a metric that correlates with the mid price a few periods before a sudden change happens.

In our case, for example, we expect that a decrease in interarrival times might signal an unusual price movement, so we are looking for autocorrelation between interarrival times and the mid price.