Anomaly Detection in Global Financial Markets with Graph Neural Networks
  and Nonextensive Entropy
Anomaly detection is a challenging task, particularly in systems with many
variables. Anomalies are outliers that statistically differ from the analyzed
data and can arise from rare events, malfunctions, or system misuse. This study
investigated the ability to detect anomalies in global financial markets
through Graph Neural Networks (GNN) considering an uncertainty scenario
measured by a nonextensive entropy. The main findings show that the complex
structure of highly correlated assets decreases in a crisis, and the number of
anomalies is statistically different for nonextensive entropy parameters
considering before, during, and after crisis.
Kleyton da Costa
# Anomaly Detection in Global Financial Markets with Graph Neural Networks and Nonextensive Entropy

###### Abstract

Anomaly detection is a challenging task, particularly in systems with many variables. Anomalies are outliers that statistically differ from the analyzed data and can arise from rare events, malfunctions, or system misuse. This study investigated the ability to detect anomalies in global financial markets through Graph Neural Networks (GNN) considering an uncertainty scenario measured by a nonextensive entropy. The main findings show that the complex structure of highly correlated assets decreases in a crisis, and the number of anomalies is statistically different for nonextensive entropy parameters considering before, during, and after crisis.

## 1 Introduction

One of the main challenges in different fields is anomaly detection Chandola et al. (2009), especially in systems influenced by high-dimensional data Deng and Hooi (2021). When these variables are observed in multivariate (or high-dimensional) time series data the task becomes even more difficult. Anomaly detection in high-dimensional data can be applied in the detection of financial fraud in bank transfers, monitoring of patients in intensive care units, monitoring of industrial processes, identification of outbreaks of infectious diseases, and traffic control on highways and railways.

Anomaly detection is related to identifying abnormal behaviors in a dataset. We consider outliers the data points that statistically differ from the data. These outliers can arise from at least three causes: (i) the occurrence of rare events (such as in the case of an economic crisis or pandemic), (ii) malfunction (such as in the case of a system for manufacturing products), or (iii) misuse of a system (such as in the case of attempted invasion or deviation of functionalities). Anomalies can be represented through various types of data, and in this study, our research interest is focused on networks.

The use of networks has gained prominence over the past decades for its ability to relate social, physical, biological, economic phenomena, etc. relatively simply. Networks can be mathematically represented through graphs in which a set of nodes relates through edges, creating information in a network. The nodes represent elements that are part of a certain set \(V\) and the edges are the simple representation of the connections between the elements of \(V\), defined as a set of edges \(E\). When we combine the elements of \(V\) and \(E\), we have as a result a graph \(G\). Thus, a given graph \(G\) is defined by \(G=(V_{i},E_{j}),\;\forall\,i=(1,2,\ldots,n)\) and \(j=(1,2,\ldots,m)\).

This study aims to investigate the ability to detect anomalies in global financial markets through Graph Autoencoder (GAE), that is, an artificial neural network that receives input data through an encoder responsible for building a compact latent representation of the graph \(G\) and a decoder that reconstructs the original graph from the compact latent model. To achieve this goal we used non-extensive entropy to measure the level of uncertainty in global financial markets before, during, and after a crisis period.

The paper is organized as follows: section 2 presents the literature review conducted to identify gaps, state-of-the-art methods, and potentialities; Section 3 presents the methodology and data used, and describes the models and methodological strategies selected for evaluation; Section 4 presents the main results and discussions; and, finally, section 5 presents the conclusion and ideas for future research.

## 2 Background and Related Works

The applications of GNN for anomaly detection in time series can be obtained through telemetry data, that is, data for monitoring the status of a particular system. The work proposed by Xie et al. (2021) analyze anomaly detection in satellite systems with an accuracy of 98%, demonstrating a high level of efficiency and robustness. Additionally, works such as Li and Jung (2021)
present graph-based strategies for detecting anomalies based on spurious relationships. The work of Ahmed et al. (2017) apply a set of anomaly detection methods to the Australian Security Exchange (ASX), and the experimental results suggest that the LOF (Local Outlier Factor) and CMGOS (Clustering-based Multivariate Gaussian Outlier Score) are the best-performing anomaly detection techniques.

A graph neural network (GNN) refers to any artificial neural network that receives graph data as input Wu et al. (2022) and this approach is effectively applied in anomaly detection task Wang and Yu (2022). According to Wang et al. (2022), the challenges for applying GNN to financial data are the need for more transparent results (explainability), diversification in the type of task where GNN are applied considering that node-level tasks have greater prominence than edge-level and graph-level tasks, the construction of benchmark datasets that enable the reproduction of generated results, and, finally, the need for GNN-based systems for financial applications to have a scalable infrastructure (enabling applications for real-world problems).

Tsallis entropy is used in studies that evaluate financial markets. The study proposed by Wang and Shang (2018) presents an approach called multiscale cross-distribution entropy based on Tsallis entropy, and the results indicate better performance in providing information about the relationship between two assets than the multiscale cross-sample entropy method Yin and Shang (2014).

The aim of this study is to contribute to the literature on using of GNN for anomaly detection in global financial markets using Tsallis entropy as an anomaly score. This section presents the methodology applied in this work.

### Network Structure of Global Financial Markets

#### 2.1.1 Global Financial Market Graph

The global financial market is formed by the relationships between assets that belong to each local financial market. In turn, each local financial market is a set of assets that are traded between companies seeking capital raising and investors. We assume that any asset that belongs to a particular local financial market is also part of the global financial market. The graph notation of a global financial market is

\[\mathcal{G}=(\mathcal{K}_{i},\mathcal{W}_{j}),\forall i=(1,\dots,k)\ \wedge\ j=(1,\dots,w) \tag{1}\]

where \(\mathcal{G}\) is the global financial market, \(\mathcal{K}\) is a set of all assets with \(k\in\mathcal{K}\) represent the total number of assets in \(\mathcal{G}\), \(\mathcal{W}_{j}\) is a set of all asset edges with \(w\in\mathcal{W}\) represent the total number of edges in \(\mathcal{G}\).

#### 2.1.2 Adjacency Matrix by Correlation Coefficients

A data structure used in graph theory is the adjacency matrix. The adjacency matrix (Eq. 2) is an \(n\times n\) matrix, where \(n\) is the number of nodes in the graph, and each entry \(a_{ij}\) shows whether there is an edge between two nodes or not.

\[A_{nn}=\left|\begin{array}{ccc}a_{11}&\dots&a_{1n}\\ \vdots&\ddots&\vdots\\ a_{n1}&\dots&a_{nn}\end{array}\right|\qquad a_{ij}=\left\{\begin{array}{ll}0 &if\frac{\pi}{2}\left(u,v\right)\\ 1&if\exists\left(u,v\right)\end{array}\right. \tag{2}\]

The correlation matrix between the assets in \(\mathcal{K}\) is a complete graph \(\mathcal{G}\), where each element of \(\mathcal{W}\) is a correlation. Thus, the correlation between two assets \(u\) and \(v\) represents the average of the products of their standardized values.

\[cor(u,v)=\frac{cov(u,v)}{std(u)\cdot std(v)} \tag{3}\]

where the covariance \((u,v)\) is the mean product of centered values, that is

\[cov(u,v)=\frac{\sum_{i=1}^{p}(u_{i}-\bar{u})(v_{i}-\bar{v})}{p} \tag{4}\]

Thus, the correlation matrix for the assets that belong to the global financial market was used to construct \(\mathcal{G}\). The matrix \(S_{kk}\) is a \(k\times k\) matrix, for all \(k\in\mathcal{K}\), where each entry \(a_{kk}\) is defined by a threshold value (\(\tau\)).

\[S_{kk}=\left|\begin{array}{ccc}s_{11}&\dots&s_{1k}\\ \vdots&\ddots&\vdots\\ s_{k1}&\dots&s_{kk}\end{array}\right|\qquad s_{kk}=\left\{\begin{array}{ll} 0&if\ corr(u,v)<\tau\\ 1&if\ corr(u,v)\geq\tau\end{array}\right. \tag{5}\]

#### 2.1.3 Estimated \(\tau\) and Minimum Spanning Tree

The approach to estimating \(\tau\) was a _winner-take-all_ strategy in which only correlation coefficients above a limit are considered as edges. In this study, the 99th percentile was adopted as the limit, meaning that the final graph considers only the top 1% of correlations, resulting in the graph \(\mathcal{G}^{{}^{\prime}}\). Finally, a minimum spanning tree (MST) algorithm was applied to \(\mathcal{G}^{{}^{\prime}}\) to verify the stability degree, as proposed in Micciche et al. (2003).

### Anomaly Detection with Graph Autoencoder

#### 2.2.1 Graph Autoencoder

An autoencoder can be defined as a type of neural network algorithm that utilizes a compressed latent feature representation to learn and reconstruct input data. By minimizing the difference between the original input and the reconstructed output, an autoencoder is able to effectively extract and encode meaningful features from complex data sets. Figure 1 shows the architecture of a typical autoencoder, which consists of an encoder network that maps the adjacency matrix to a compressed latent feature representation, and a decoder network that maps the latent representation back to the original input space (reconstructed input).
To detect anomalies in global financial markets, the autoencoder maps the adjacency matrix to a low-dimensional latent space, where anomalies correspond to data points that deviate significantly from the learned patterns of normal data.

Considering a train set \(\mathcal{D}=\{x_{i}|i=1,\ldots,T\},\ \ \forall x_{i}\in\mathbb{R},\ i\in\mathbb{N}\). The encoder can be written as

\[h_{i}=g(x_{i}) \tag{6}\]

where the latent feature representation \(h_{i}\) is the output of the encoder function \(g\). And the decoder can be represented as

\[\tilde{x}_{i}=f(g_{x_{i}}) \tag{7}\]

where \(\tilde{x}_{i}\) is the output of decoder function\(f\). In turn, the training of an autoencoder is to find the functions \(f\) and \(g\) such that

\[\arg\min_{f,g}<\Delta(x_{i},\tilde{x}_{i})> \tag{8}\]

where \(\Delta\) is a loss function that penalize the difference between \(x_{i}\) and \(\tilde{x}_{i}\); and the operator \(<.>\) is the average over all observations. The reconstruction error (RE) is a metric to evaluate the ability of the autoencoder to reconstruct \(x_{i}\). In this study, the mean squared errors (MSE),

\[RE\equiv MSE=\frac{1}{T}\sum_{i=1}^{T}|x_{i}-\tilde{x}_{i}|^{2} \tag{9}\]

#### 2.2.2 Anomaly Detection Scores

As described by Renyi (1961), let \(\mathcal{P}=(p_{1},p_{2},\ldots,p_{n})\) be a finite discrete probability distribution; the amount of uncertainty (concerning the output of an experiment) of \(\mathcal{P}\) is called entropy of the distribution \(\mathcal{P}\). This uncertainty (or randomness) is usually measured by Shannon entropy Shannon (1948), that is

\[H(\mathcal{P})=\sum_{k=1}^{n}p_{k}log_{2}\frac{1}{p_{k}} \tag{10}\]

When applied to issues related to the financial market, entropy-based tools can measure the level of randomness in the markets Delgado-Bonal (2019), analyzing and predicting the behavior of stocks Maasoumi and Racine (2002), Gu (2017), as well as pointing to a contagion effect of financial market uncertainty on other economic variables Ahn et al. (2019).

In this study, Tsallis entropy Tsallis (1988) was applied to measure uncertainty in global financial markets. Tsallis entropy is defined as

\[S_{q}=\frac{1-\sum_{i=1}^{W}p_{i}^{q}}{q-1} \tag{11}\]

where \(p_{i}\) is the probability of finding the system in the \(i\)-th state, \(q\) is a parameter that determines the degree of non-extensivity of the entropy, and \(W\) is the number of states in the system. When \(q\to 1\), Tsallis entropy reduces to \(H[\mathcal{P}]\).

Algorithm 1 performs a set of basic operations considering a matrix \(P\) with \(k\) vectors of size \(n\) as input. Assuming that \(k\leq n\), we can assume that the complexity of calculating the mean and standard deviation is \(O(kn)\). Computing the covariance matrix involves three steps: (i) calculating the mean of each variable, \(O(kn)\); (ii) centering the data by subtracting the mean of each variable, \(O(kn)\); and (iii) multiplying the centered matrix and its transpose, \(O(k^{2}n)\). The calculation of the correlation matrix can be performed in \(O(k^{2})\). Similarly, creating a graph from a list of edges takes time \(O(k^{2})\). Thus, the algorithm for constructing an undirected graph for asset returns is \(O(k^{2}n)\), i.e., the execution time grows linearly with the input size \(n\) and quadratically with the number of variables \(k\).

```
1:\(means=\) mean of each vector of \(P\)
2:\(m=\) size of mean
3:\(stds=\) standard deviation of \(P\)
4:\(P_{cov}=\) compute the covariance matrix of \(P\)
5:\(P_{corr}=\) create an empty matrix \(m\times m\)
6:for\(i=0\)to\(n\)do
7:for\(j=0\)to\(m\)do
8:\(P_{corr}[i,j]=\frac{P_{cov}[i,j]}{stds[i]\times stds[j]}\)
9:\(edges=\) stack the correlation matrix \(P_{corr}\)
10:\(edges\_w.self=\) remove the self-correlations
11:\(asset\_graph=\) create a graph with \(edges\_w.self\)
12:endfor
13:endfor
14:return\(asset\_graph\)
```

**Algorithm 1** Undirected graph for asset returns

Algorithm 2 is a simplified representation of the process of detecting anomalies in global financial markets using the autoencoder architecture and Tsallis entropy as an anomaly score. Disregarding the running time for training the autoencoder, the algorithm performs a set of basic operations for each node in the global financial markets. Thus, we can estimate that the anomaly detection algorithm is \(O(n)\).

Figure 1: Autoencoder architecture
## 3 Results and Discussion

This study uses the financial asset return dataset developed in Koshiyama et al. (2022). After a preliminary data cleaning to remove observations with different periods, the analysis considered a dataset with 1847 observations for 802 stocks. The data covers the period from 2004-10-27 to 2019-03-15.

The results were analyzed considering the global financial crisis (GFC) between 2007 and 2010. Thus, we follow three periods: the period before the crisis is from 2004-10-27 to 2007-06-27, the period during the crisis is from 2007-06-29 to 2010-08-24, and the period after the crisis is from 2010-08-25 to 2019-03-15.

Figure 2 shows the network for the global financial market before the crisis. It can be observed from Table 1 that in this period, 455 edges were observed in the top 1% of correlations. In this scenario, approximately 40% of the stocks did not have edges. Analyzing the degree of centrality of each stock, it is possible to observe that the maximum value for the centrality degree is 60, with a distribution showing that most of the stocks are concentrated in the range between 0 and 40.

Figure 4 presents the network for the global financial market during the crisis. In this period, 294 edges were observed in the top 1% of correlations. In this scenario, approximately 64% of the stocks did not have edges. Analyzing the degree of centrality of each stock, it is possible to observe that the maximum value for the degree of centrality is approximately 168, with a distribution showing that most stocks are concentrated close to

Figure 4: _During Crisis_ - Association network and community structure in the high-correlated global financial market. The figure shows the global financial market correlation-based network with a threshold that selects only the high links weighted by correlations and runs in an MST algorithm.

Figure 5: The rank of degree and distribution of degree centrality during crisis network

Figure 3: The rank of degree and distribution of degree centrality before crisis network

Figure 2: _Before Crisis_ - Association network and community structure in the high-correlated global financial market. The figure shows the global financial market correlation-based network with a threshold that selects only the high links weighted by correlations and runs in an MST algorithm.
Figure 6 presents the network for the global financial market after the crisis. In this period, 488 edges were observed in the top 1% of correlations. In this scenario, approximately 64% of the stocks did not have edges. Analyzing the degree of centrality of each stock, it is possible to observe that the maximum value for the degree of centrality is 95, with a distribution showing that most stocks are concentrated in the range between 0 and 25.

Through the autoencoder approach described in the methodology of this work, a convolutional neural network was trained with the task of label classification from a latent feature considering the correlation matrix for a set of countries that make up the selected financial markets. As observed in Table 1, the clustering coefficient shows that the tendency of data clustering decreases during the crisis period and increases after the crisis, following the same pattern observed through the number of edges for the top 1% of correlations between assets. In other words, the results suggest that the financial markets become more interconnected and clustered after the crisis, which is consistent with the idea of increased global financial integration. Additionally, the analysis of the degree of centrality of each stock reveals that there are some stocks with high centrality that play an important role in the network, and that the distribution of centrality values is skewed towards lower values, indicating that most stocks are not highly connected.

The Figure 8 presents the outcomes obtained by applying the loss function during the training process of the GNN. The results indicate that the model was successful in reducing its error for the training set in all three periods analyzed. This suggests that the GNN was capable of learning and improving its predictions over time. Furthermore, it are observed that the GNN had greater difficulty reconstructing the adjacency matrix before and after the crisis periods, in comparison to during the crisis period. This finding suggests that the model may have struggled to capture the underlying patterns and dynamics of the network during the pre- and post-crisis periods, which could have led to less accurate predictions of the network's behavior.

Figure 9 shows that, in the before-crisis period, the number of detected anomalies decreased as the value of \(q\) increased. The same behavior is observed in the after-crisis period. However, the results indicate that, during the crisis period, there is stability in the number of detected anomalies, which becomes higher than the number observed in the other periods. This finding suggests that the parameter \(q\) does not influence anomaly detection during the crisis period. To test the null hypothesis that the anomaly detection is different among the periods, a t-test was applied to compare the mean between two groups.

\begin{table}
\begin{tabular}{l c c c} \hline  & **Before** & **During** & **After** \\ \hline Number of Edges & 455 & 294 & 488 \\ Nodes Without Edges & 39.52\% & 59.97\% & 37.53\% \\ Max Degree & 60 & 168 & 95 \\ Mean Degree & 6.14 & 18.38 & 8.49 \\ Std Degree & 9.43 & 38.36 & 14.70 \\ Clustering Coeff. & 0.30 & 0.26 & 0.37 \\ \hline \end{tabular}
\end{table}
Table 1: Summary of results for before, during, and after crisis networks

Figure 8: Loss function and reconstruction error of graph neural network training

Figure 6: _After Crisis_ - Association network and community structure in the high-correlated global financial market. The figure shows the global financial market correlation-based network with a threshold that selects only the high links weighted by correlations and runs in an MST algorithm.

Figure 7: The rank of degree and distribution of degree centrality after crisis network
Table 2 shows the results of the t-test applied to the number of anomalies detected by Tsallis entropy for positive and negative values of \(q\) (ranging from -0.5 to 0.5). Based on the analysis of the p-value, it is possible to reject the null hypothesis of equality between the means. Therefore, the results generated by the anomaly detection in the three periods are statistically different.

## 4 Conclusion

The detection of anomalies in financial markets is an important task for different economic agents. Equity fund managers can use this information to improve their decision-making process and, eventually, improve their results. Central banks can use anomaly detection to identify dysfunctions in markets and act to mitigate the harmful effects of an economic crisis originating from the financial system, thus fulfilling their role as regulators and stabilizers of price levels, employment, and output.

The objective of this article was to investigate the use of graph neural networks for anomaly detection in a graph constructed from the correlation matrix for the stocks that make up different local financial markets, forming a representative graph of the global financial market. The results indicate a trade-off between the correlations observed during the crisis period: the correlation between all assets increases, but when we consider only the stocks with more connections (top 1%), the correlation decreases. Thus, we indicate that during a crisis period, the graph for the global financial market becomes more sparse.

The limitations of the paper are primarily focused on the fact that the anomalies selected by the scores cannot be validated through a ground truth dataset. Therefore, in future studies, it is important to use a supervised learning strategy to calculate metrics that establish the accuracy of the model based on labeled anomalies.

## 5 Acknowledgments

The author thanks Simone D.J. Barbosa (DI/PUC-Rio) and Bernando Modenesi (University of Michigan) for their comments and suggestions. Any errors and inaccuracies are the responsibility of the author.
