Detecting spoofing by eye is slow and inconsistent. A real-time algorithm has to answer one question many times per second: did a large resting order just disappear without trading as price came near it? Each part of that question is harder than it looks.
Keep the book and the tape in step
A level in the order book can shrink for two reasons. Either someone traded against it, or the owner cancelled. The book update alone looks the same in both cases. To tell them apart, a detector needs the trade tape too, with each trade classified by aggressor side and price.
The Vantedge Level 2 engine, shared by the BookScope indicator and the BookPilot strategy, keeps both: order book state for the first 10 levels on each side, and a trade tape with aggressor classification. When size at a price falls, trades at that price explain part of it. Whatever is left was pulled.
Define "large" relative to the book
A fixed contract count does not work, because a big order on one instrument is ordinary on another, and books thicken and thin through the day. The engine compares each level with a baseline: the average size of the levels from the Split Depth (default 2, counting the best price as 0) out to the 10th level.
A level counts as a wall when it is at least the Pulled Wall Ratio (default 2.2) times that baseline. The scan band runs from the Start Depth (2) to the Pulled Wall Depth (4), which by default means the 3rd and 4th levels. The touch is skipped on purpose, because size at the best bid and ask changes constantly as normal trading eats it.
Follow each wall through its life
Once found, a wall is tracked as a small state machine. It can be appeared, approached, pulled, filled or expired. Price within 2 ticks counts as approached. A wall tracked for longer than the Max Wall Age, 30 seconds by default, is dropped.
A wall counts as pulled when at least the Pull Fraction (0.6) of its peak size is gone without trading. A wall that trades away is filled, which is a very different event: the size was real.
Score the pull, and show the working
A pull is not automatically a spoof. Plenty of traders cancel orders for honest reasons. So each pull gets a spoof probability between 0.0 and 1.0, built from parts you can inspect:
| Component | Points |
|---|---|
| Base score for a pull | 0.35 |
| Wall was approached by price | +0.20 |
| Short life (under 5 s) | +0.15 |
| Frequent size changes | +0.15 |
| Opposite aggressive volume | +0.15 |
A signal fires when the score reaches the Fire Probability, 0.6 by default. Because every component is listed, you can see why one pull scored 0.70 and another 0.35. That matters when you tune it: raising the threshold to 0.70 or above keeps only the most spoof-like pulls, while 0.55 or lower lets any approached pull qualify.
Drive it by event time, not the clock
A detector that reads the computer's clock behaves differently every time you run it. The Vantedge engine is driven by the timestamps on the market events themselves. That makes it deterministic: replay a session and you get the same walls, the same scores and the same signals. For testing a strategy in Market Replay, that repeatability is what lets you compare one setting with another fairly.
What the algorithm cannot know
- Intent. A spoof probability is a statistical diagnostic, not a legal finding of manipulation.
- Activity beyond the visible book. Anything outside the 10 published levels is invisible.
- Normal order management. Liquidity providers move quotes all the time, which is why partial reductions below the Pull Fraction do not count.
Where to see it
In BookScope the tracked walls appear as boxes with pull marks, alongside signal markers and alerts. In Vantedge BookPilot the same scanner, called Pulled Wall, can trade against the wall. The BookPilot user guide documents every scanner setting, and the glossary covers terms such as spoofing and market depth.
A spoof score is a probability, so some flagged pulls will be innocent and some fakes will slip through. Treat any strategy built on it as risky until it has run in Market Replay and SIM, before an evaluation, funded or live account.