How Order-Book Responses Can Reveal Trading Algorithms

# What are the "sniffing" or "stalking" algorithms?


# What are the "sniffing" or "stalking" algorithms?












I was looking for all the sorts of trading algorithms used in stock market and I came across the so-called "sniffing" algorithms. However, the explanations of this concept I found are very poor and ambiguous.

The first explanation states:

- It is a kind of algorithm that searches for another trading algorithms.

The second explanation states:

- It is a kind of algorithm that detects whenever "smart money" made the transactions.

So here my questions to you:

> What is a sniffing algorithm?

> How does the algorithm that searches another algorithms look like? Does it use some tools such decomposition of signals?

> How to estimate the ratio of transactions made by big institutes and total volume in given day?

Thank you for any help.

## Answer by Jan Stuller (score 12, accepted)

https://quant.stackexchange.com/a/61341

Sniffing (or stalking) algo indeed detects other algorithms. How does that work in practice?

Imagine the order book for a particular equity is: Bid 1 = 99 (size 10,000), Bid 2 = 98 (size 25,000), Bid 3 = 97 (size 30,000), Offer 1 = 101 (size 10,000), Offer 2 = 102 (size 25,000), Offer 3 = 103 (size 30,000).

So in the example above, the bids and offers are perfectly symmetrical and the price is in perfect equilibrium (mid = 100).

Imagine someone hits the bid at 99, in size 8,000, and within a split second, someone else takes the remaining 2,000 bid at 99. This type of behavior is "momentum trading", and the algo's strategy here is to "hit the remaining quotes, whenever another market participant takes more than 50% of a specific quote".

There will be multiple algos at play at any point in time, and they are all capable of measuring each other's response time and behavior patterns: so for example, another algo would be able to see that the first algo responded within a certain (very small) time frame and took out the remaining size, and it would identify the first algo as "stalker".

The algo that took out the remaining 2,000 bid at price 99 would almost certainly NOT be a market-making algo, because market-makers try NOT to move the price when they trade (that's also why quite possible the algo that took out the initial 8,000 bid at price 99 would also not be a market-making algo, because that action also moved the price from 100 to 99).

Imagine a different scenario, when someone hits the bid at 99 but only in size 1,000: this will immediately mean that the last traded price of the equity is no longer 100, but rather 99. A market-making algo who is carrying out a "sell" execution would then quite possibly hit the 99 in size 8,000, but wouldn't take out the whole size at price 99, not to move the price lower away from 99.

When the price was 100 and no action was being taken, a market-making algo carrying out a sell exectution would probably patiently wait with some offers at 101, 102, etc: and only start hitting bids if it saw that other participants started hitting the bids as described above.

Last but not least, all algos try to keep a "record" of other algo's positions: so once someone has identified the first algo as "stalker" and identified its latency time in which it took out the bid at 99, it will try to keep a track of its position throughout each day (and the latency response time will be one way they can do that, i.e. comparing response time vs. other algos). It's not 100% reliable, but the accuracy can be high.

Hopefully the above helps a bit to paint the picture...