## 1 Introduction  
The Internet is inextricably linked to information and property security. On trading platforms such as those for bulk commodities, stocks, and e-commerce, a misoperation by a user can cause serious property security issues. For example, a shareholder of Shenzhen Changfang Company mistakenly sold 16,000 shares by entering the wrong stock code, and an operator of a manufacturing giant, Sany Heavy Industry, mistakenly sold nearly 100,000 shares ([[https://www.cnbc.com/2020/09/09/more-chinese-companies-blaming-trading-typos-for-insider-stock-sales.html](https://www.cnbc.com/2020/09/09/more-chinese-companies-blaming-trading-typos-for-insider-stock-sales.html)]([https://www.cnbc.com/2020/09/09/more-chinese-companies-blaming-trading-typos-for-insider-stock-sales.html](https://www.cnbc.com/2020/09/09/more-chinese-companies-blaming-trading-typos-for-insider-stock-sales.html)), accessed on 10 April 2023). These events suggest that to protect the interests of users, trading platforms should introduce anomaly-detection algorithms to determine anomalous user behavior and notify users on time. However, in trading platforms, the habits of different users vary widely, and behavior that is normal for one user may be anomalous for another [1]. Therefore, separate custom models for anomaly detection are needed for different users, and generic algorithms similar to intrusion detection cannot be used to detect user anomalies. The data on trading platforms are also unlabeled, which poses a challenge for anomaly-detection.  
[PERSON] et al. focused on the anomalous behavior of individual users in a social network [2]. They first extracted and normalized node network features and then built a node evolution model based on the extracted node features. Finally, they used an anomaly-detection method for a multivariate time series to detect possible anomalies. [PERSON] et al. at eBay also focused on the differences in detecting anomalous behavior between users.  
They used density estimation or principal component analysis (PCA) to generate profiles per system user and predict user activities based on their prior profiles [3]. Both studies used anomaly-detection algorithms designed for a single multivariate time series when detecting user behavior anomalies. When existing unsupervised methods are used for detection, a model needs to be trained for each user with only a small amount of data; thus, the model cannot be trained adequately. In this study, we aimed to solve the unsupervised training and the underfitting problems.  
The methods used by [PERSON] et al. and [PERSON] et al. aim to detect outlier points in a time series, a system, or some datasets, such as the KDDCUP99 dataset [4; 5]. These methods only focus on anomalies in the entire dataset or system, such as price manipulation and deception; we assume that they have only \"one user\" of the data. NASA used long short-term memory (LSTM) algorithms to detect radiation, power, instrumentation, and computational activities for spacecraft to ensure their proper functioning [6]. [PERSON] et al. used autoencoders (AEs) to overcome the difficulties of the absence of standard data in detecting anomalies in IT systems [7]. [PERSON] et al. detected user behavior to determine the occurrence of attacks against IoT devices [8]. Anomaly-detection methods for multi-user data have been designed to detect anomalous users. [PERSON] et al. used graph convolutional networks to detect malicious threat user groups by detecting malicious behaviors [9]. [PERSON] et al. also used user behavior modeling along with density estimation, PCA, and clustering to detect insider threats [10]. [PERSON] et al. used graph spectra for anomaly-detection [11].