Research Data and Code for "Contain, Leave, or Verify First? Incident Response at Electronic Trading Gateways When Compromise and Fault Look Alike"

Research data and code for the article "Contain, Leave, or Verify First? Incident Response at Electronic Trading Gateways When Compromise and Fault Look Alike" (C. Mejrissi, A. Kouki, S. Missaoui, L. Latrach). The article asks when a costly check is worth running before acting. At an electronic trading gateway, order flow alone cannot always tell a compromised account from a benign fault, but the operator can verify authorization with a check that has a sensitivity, a specificity, a cost and a delay. The article derives when such a check lowers the cost of ambiguity, and the critical delay beyond which no check pays. It then applies the rule, exploratorily, to the cells of an earlier identifiability study, under analysis plans fixed before each analysis was run. This deposit contains:- the code that rebuilds every table and number of the article from the stored results, with no data download;- every per-cell result file, each with a manifest giving the method, seeds, sample sizes, software versions and SHA-256 checksums;- the analysis code and each run's scripts and run records;- a comparative study of the decision rule against baseline policies (always contain, always leave, a passive rule, verify everything, the classifier alone) and two ablations, on a synthetic grid, under departures from the model's assumptions, on the simulated cells and on replayed order flow;- for each pre-specified analysis, including the comparative study, a dated record of its plan, amendments and outcome, with a crosswalk to the article's table of pre-specified outcomes (the original plans are available from the corresponding author on request);- the SHA-256 checksum of every file. The simulated feature arrays of the earlier study are not included; the deposit gives their identifiers (checksums, shapes and seed pools), and the arrays are available on request. Raw third-party market data are not redistributed. Licence: code under the MIT License; results, records and documentation under CC BY 4.0.