SECURE Framework for Detecting Integrity Attacks in High-Frequency Trading Systems

In the digital world, security is often imagined as a fortress with walls designed to keep intruders out. This traditional view focuses on three main pillars: keeping secrets hidden, ensuring systems stay online, and making sure the information inside remains exactly as it was sent. While keeping data secret and keeping systems running are well-understood challenges, a more subtle danger often goes unnoticed. This is the threat to data integrity. Unlike a virus that crashes a system or a hacker who steals a password, an integrity attack quietly alters the data itself. It changes a number here or a record there without stopping the machine. In slow-moving systems, such a small change might be harmless, but in environments where decisions happen thousands of times a second, a tiny, manipulated number can trigger a cascade of wrong actions. This is particularly true in high-frequency trading, where computers buy and sell stocks in the blink of an eye based on the data they see. If that data is slightly twisted, the entire market can be misled, yet the system continues to run smoothly, hiding the deception in plain sight.

Researchers S. Malathy and R. Anandhi from Dwaraka Doss Goverdhan Doss Vaishnav College in India have proposed a new way to catch these invisible manipulations. They call their approach the SECURE framework, a six-step process designed to watch, analyze, and react to data streams in real time. The name stands for Surveillance, Examination, Control, Understanding, Response, and Enhancement. The system begins by constantly watching the incoming flow of data, much like a security camera that never blinks. Once the data is gathered, it moves to the examination stage, where a computer program trained to recognize patterns looks for anything unusual. The researchers chose a specific type of pattern-recognition tool called a Random Forest, which works by building many different decision trees and asking them to vote on whether a piece of data is normal or suspicious. This method is particularly good at handling the noisy, chaotic nature of fast-moving data.

However, knowing that something is wrong is not enough; security experts need to know why. To solve this, the researchers added a layer of explainability to their system. They used a technique called SHAP, which acts like a spotlight, shining on the specific details that caused the computer to flag an event as suspicious. Instead of just saying "this is bad," the system can point to the exact price change or order size that triggered the alarm. This transparency helps human analysts trust the machine's judgment. The framework then moves to control, where it can block or flag the suspicious data, followed by a response stage where alerts are sent and records are kept. Finally, the system enters an enhancement phase, where it learns from new data to get better at spotting future tricks.

To test if this idea works, the researchers applied it to a real-world scenario: the stock market. They used a dataset of Level-2 order book data, which records every buy and sell order placed for a stock, including the price, quantity, and time. In this environment, they simulated two common types of market manipulation known as spoofing and layering. Spoofing happens when a trader places a massive order with no intention of buying, just to create a false sense of demand and trick others into buying. Layering involves placing many orders at different price levels to create artificial pressure. Both tactics change the data to influence the market without actually disrupting the trading system, making them perfect examples of integrity attacks. The researchers treated these manipulations as the "bad" data and normal trading as the "good" data, then fed everything into their SECURE framework.

The results showed that the new system was significantly better at catching these tricks than a standard computer model alone. When the researchers tested a basic version of their pattern-recognition tool without the full six-step framework, it correctly identified about 91.84 percent of the attacks. But when they added the full SECURE structure, including the specific steps for control and the explainability tools, the accuracy rose to 96.82 percent. The system became much better at finding the real attacks while making fewer mistakes about normal trading. The analysis of the data revealed that the system was paying attention to the right things. It learned that sudden changes in price movement, unusual quantities of shares, and spikes in volume at specific price levels were the strongest signals of manipulation. These are the exact behaviors that a human trader would look for, proving that the computer was not just guessing but recognizing logical patterns.

What makes this work particularly valuable is that it does not rely on knowing exactly what the attacker will do next. Instead of looking for a specific list of known bad behaviors, the system learns to spot the general shape of a lie in the data. This means the framework is not limited to just stock markets. The researchers suggest that the same method could be used to protect other fast-moving systems, such as networks of sensors in a smart city or medical devices that monitor patients in real time. In any place where data flows quickly and a small change can have a big impact, the ability to detect subtle manipulation is crucial. By combining a fast pattern-recognition tool with a method that explains its own thinking, the SECURE framework offers a way to keep high-speed systems honest. It shows that in the race to protect data, the key is not just to watch for the noise, but to understand the story the data is telling.