02.2 Kor.ai Bayesian Node Library (Market Abuse)

This page defines the canonical node library for constructing Bayesian Networks (BNs) across market abuse typologies such as insider dealing, spoofing, layering, wash trades, price manipulation, and front-running. It supersedes and consolidates elements from 11.2_Node_Library for unified usage.

Each node includes a definition, example states, data inputs, and typical parent/child relationships. This supports modular model design, CPT consistency, and auditability across Kor.ai.

---

🔑 Core Latent Nodes (Inferred Concepts)

IntentToManipulate

• Whether the actor is deliberately attempting to distort the market.
• True, False, Uncertain
• Parents: OrderAggressiveness, LayeringPattern, QuoteImbalance, PNLSpike
• Children: MarketAbuseLikelihood

AccessToMNPI

• Whether the actor had access to material non-public information (MNPI).
• Yes, No
• Parents: Role, HRSignals, EmailKeywords, AccessLogs
• Children: IntentToTradeOnMNPI, MarketAbuseLikelihood

IntentToTradeOnMNPI

• Whether actor acted on privileged info.
• Yes, No, Unclear
• Parents: AccessToMNPI, TradeDirectionAligned, TimingProximity
• Children: MarketAbuseLikelihood

SpoofingDetected

• Signal indicating spoofing pattern.
• None, Suspected, Confirmed
• Parents: OrderPlacementRate, CancelRateRatio, BookPressure
• Children: IntentToManipulate, MarketAbuseLikelihood

WashTradeLikelihood

• Likelihood of wash trade behavior.
• Low, Medium, High
• Parents: CounterpartyMatch, VolumeMirror, TimeWindowRepetition
• Children: MarketAbuseLikelihood

ClusteredBehavior

• Pattern similarity with prior cases.
• None, Similar, HighlyCorrelated
• Parents: TraderID, BehaviorVector
• Children: MarketAbuseLikelihood

KnownRiskProfile

• Prior alert history or case exposure.
• Clean, PreviouslyFlagged, UnderInvestigation
• Inputs: STORs, alerts
• Children: MarketAbuseLikelihood

MarketAbuseLikelihood

• Posterior abuse score node.
• Low, Medium, High
• Parents: all above
• Children: AlertRaised, ExplainabilityModule

---

🔍 Evidence Nodes (Observable Inputs)

Trade Behavior

• OrderAggressiveness — Passive, Neutral, Aggressive
• OrderPlacementRate — Low, Medium, High
• CancelRateRatio — <50%, 50–90%, >90%
• BookPressure — Neutral, BidPressure, AskPressure
• LayeringPattern — None, Moderate, Strong
• TradeDirectionAligned — Yes, No, Neutral
• TimingProximity — <1h, SameDay, >1d
• TradeTimingWindow — NormalHours, EndOfDay, EventDriven
• VolumeSpike — None, Moderate, High

Trade Outcome

• PNLSpike — Absent, Mild, Extreme
• VolumeMirror — No, Partial, Full
• CounterpartyMatch — No, Possible, Likely
• TimeWindowRepetition — Absent, Moderate, Frequent

Comms / Access / HR

• EmailKeywords — Clean, Flagged, Escalated
• AccessLogs — Yes, No, Unknown
• ClientOrderVisibility — None, Limited, Full
• PreTradeBehavior — Neutral, MinorFrontRun, SignificantFrontRun
• HRSignals — Low, Moderate, High

KYC / Profile Context

• KYCRiskRating — Low, Medium, High
• TraderID — categorical key for linking history
• Role — Analyst, Sales, Trader, DeskHead, etc.

---

🧾 Output / UX Nodes

AlertRaised

• Whether score crosses alert threshold.
• True, False

ExplainabilityModule

• Captures key drivers of posterior.
• JSON structure includes:
  • node
  • value
  • score_impact
  • confidence
  • input_description
  • Optional tag

---

🧠 Integration Notes

• This library replaces 11.2 with additional structure, clustering, and front-running support.
• Each node has an alias (Q#) for compact model serialization.
• Nodes are reusable across modular DAG templates in 13.2.
• CPTs are stored and versioned separately.
• Explainability logic is powered by this same set.

---

Next: Ensure CPT scaffolds and typology mappings reflect this unified structure. DAG generation services and Agena model uploads should use this version going forward.