Case #4

In Case #4, the behavior of interest involves three or more events that must take place in a particular order. For example, identify cases in which an employee places orders shortly before and shortly after a large customer order for the same security.

The recommended approach to this issue is to create a dataset that includes orders placed during the lookback period. To be of interest in this scenario, an order must either originate from an account associated with an employee or be of sufficient size to meet the definition of a large order. Use dataset filters to eliminate all other orders from consideration, because they cannot be used to satisfy the criteria for an alert.

Generate the matches by using a sequence pattern. The pattern should sort the records by security and then by time so that the events of interest are arranged into adjacent positions in the dataset. The pattern should have the following general structure:

1. ROW – Employee Order (1 occurrence)
2. ROW – Orders from Other Emps (0 or more, not recorded)
3. ROW – Large Customer Order (1)
4. ROW – Orders from Other Emps (0 or more, not recorded)
5. ROW – Employee Order Offsetting the Initial Order (1)

All events in the pattern must involve the same security, and events (1), (3), and (5) must occur within a specified amount of time. The pattern should have explicit conditions causing the sequence to terminate whenever the securities involved are not the same, or if the time parameters are exceeded.