  Identifying market abuse activity from data on investors' trading activity is
very challenging both for the data volume and for the low signal to noise
ratio. Here we propose two complementary unsupervised machine learning methods
to support market surveillance aimed at identifying potential insider trading
activities. The first one uses clustering to identify, in the vicinity of a
price sensitive event such as a takeover bid, discontinuities in the trading
activity of an investor with respect to his/her own past trading history and on
the present trading activity of his/her peers. The second unsupervised approach
aims at identifying (small) groups of investors that act coherently around
price sensitive events, pointing to potential insider rings, i.e. a group of
synchronised traders displaying strong directional trading in rewarding
position in a period before the price sensitive event. As a case study, we
apply our methods to investor resolved data of Italian stocks around takeover
bids.
