Order-Book Imbalance as a One-Second Predictor

The raw inputs are a LOBSTER event file and a matching 10-level order-book file for AAPL on 2012-06-21. Message events are joined to their corresponding orderbook row by position; the orderbook file is treated as authoritative for top-five state after each event. The pipeline writes one canonical event-book output per cadence for downstream modeling and reporting.

Data appendix.

• Session window: 09:30:00.004 – 15:59:59.913 (6.5 hours).
• Event-book rows: 400,391 raw events.
• Trades extracted: 34,990; aggressor-flagged share: 100% (no tick-rule inference required on this sample because every trade carries an explicit aggressor flag).
• Duplicate sub-millisecond timestamps: 16,062 (kept; the cadence sampler uses backward-fill with a 1 s staleness guard so duplicates do not corrupt the snapshot stream).
• Crossed books, non-monotonic levels, non-positive sizes, missing levels: all zero.
• Spread distribution in the held-out slice: 36 distinct tick values, median 13 ticks, max 36 ticks (Figure 7). Spread quintile boundaries are non-degenerate, so the stratified spread analysis rests on a genuinely varied distribution.
• Labels after sampling: 114,426 valid 1-second labels (49.4% positive, 50.6% negative); 95,902 no-change ties dropped (45.6% tie share). The high tie share reflects sub-tick-stable mid-prices in 2012 when the top-of-book often did not move within 1 s.
• Quality status: pass.

Tick rule. The pipeline takes the explicit aggressor side from LOBSTER's direction field when present and falls back to a sign-from-price-change tick rule when not. On this sample the aggressor flag is present for every trade, so no tick-rule inference was needed.

Let $b_{\ell,t},a_{\ell,t}$ and $q^{b}_{\ell,t},q^{a}_{\ell,t}$ denote the level-$\ell$ bid/ask prices and visible sizes at event time $t$. Mid-price and spread are

The top-five depth imbalance is

The prior-one-second signed-trade imbalance, with $\tau_i$ the trade timestamp and $s_i\in\{-1,+1\}$ its aggressor sign, is

The cadence sampler chooses the most recent event-time state $\le$ each grid timestamp using a backward as-of merge with a 1 s tolerance, so no feature value uses information from after $t$. The forward label uses the first sampled mid at or after $t+h$ ($h=1$ s) and is recorded together with its source future timestamp for audit.

Worked example (real row, 100 ms cadence). At one sampled snapshot in the test window, the state has $b_1=583.06,\;a_1=583.19,\;\mathrm{spr}_t=13$ ticks, $\sum q^b_{1..5}\approx 2{,}010,\;\sum q^a_{1..5}\approx 1{,}730$, giving $I_t^{(5)}\approx 0.072$. The prior-second signed trade volume is negative against positive absolute, so $T_t^{(1\mathrm{s})}<0$. If the future mid one second later equals the current mid, the snapshot is a no-change tie and is dropped from the labeled panel; if it moves up by at least one tick, the snapshot enters the panel with $y=1$. In either case, the label construction remains leakage-safe because the future lookup is anchored strictly at or after $t+h$.

We fit logistic regression with $\ell_2$ regularization (regularization_strength $=10^{-4}$) on standardized features via L-BFGS-B, after replacing per-feature NaNs with the training-set median in the modeling pipeline. Three models are evaluated on the same chronological split:

• constant — predicts the training base rate;
• imbalance_only — $I^{(5)}_t$ as the sole regressor;
• full — $\{I^{(5)}_t,\,\mathrm{spr}_t,\,T^{(1\mathrm{s})}_t\}$.

What this says. On this real sample, trade-sign imbalance is the largest single contributor in the full model, and it points the opposite direction from a naive momentum reading. Recent aggressor buying is followed, on average, by a small reversal of the mid one second later — consistent with temporary price impact and partial liquidity replenishment. Depth imbalance contributes a smaller positive coefficient, and spread enters only marginally.

Feature-ablation (AUC & Brier on the test slice, 100 ms).

Depth imbalance alone clears $0.5$ but by less than two percentage points. The two added features — spread and trade-sign imbalance — raise AUC by another five percentage points. The trade-sign feature in particular does real, decoupled work; it is not redundant with depth imbalance.

Where the signal lives. On this single-day sample, predictive discrimination is roughly U-shaped in spread regime and rises toward the close. The lift does not concentrate in the widest-spread quintile: Q3 dominates, while Q5 is unremarkable. The stratified result is therefore more nuanced than a simple “wider spreads imply stronger predictability” story.

Interpretation. AUC moves by less than $0.003$ across cadences and Brier by less than $0.0003$. This is a real robustness check on real data: at 50 ms many snapshots reuse the same event-book state because LOBSTER updates do not occur every 50 ms (backward-fill), while at 250 ms each snapshot reflects more information accumulated since the last sample. The signal is essentially scale-invariant on this day, which weakens the case for sub-100 ms snapshotting in production.

The decision rule converts probabilities into actions $d_t\in\{-1,0,+1\}$ via a symmetric threshold $p^\star$:

Per-action taker cost is $c_t = \mathrm{spr}_t \cdot \alpha + f \cdot m_t$ with full spread-crossing $\alpha=1$ and a 1 bp taker fee $f$. Net result is $r_t = d_t \cdot \Delta_h m_t - c_t \cdot \mathbf{1}\{d_t\ne 0\}$ and is scaled by a cost multiplier $\kappa\in\{0.5,1.0,1.5\}$ to stress-test the assumption.

Spread vs. fee breakdown.

At the primary $0.55/1.0\times$ cell, the average per-action transaction cost is $\$0.177$. Decomposed:

• Mean spread cost: average test-slice spread $\approx 0.129$ dollars (12.9 ticks), full-spread crossing $\alpha=1$ $\Rightarrow$ $\$0.129$/action.
• Mean fee cost: 1 bp on $\overline{m_t}\approx\$582$ $\Rightarrow$ $\$0.058$/action.

Spread dominates fees by roughly $2.2\times$ on this instrument-day. The gross edge is $\sim\$0.003$/action; the model would need a $\sim 60\times$ improvement in per-action edge — or a maker-rebate execution model that recovers most of the spread — to clear cost.

Deployability. A simple deployability indicator can be written as

On this sample, the first two conditions hold (AUC clears chance, reliability tracks the diagonal); the third fails in every cell of Table 3. The indicator evaluates to $0$.

What the result says. On a real, full LOBSTER trading day for AAPL, the three-feature logistic specification picks up genuine one-second-ahead directional information: AUC of $0.567$, calibration close to the diagonal across the full $[0.42, 0.57]$ predicted-probability range, and a coefficient ranking that is robust under feature ablation. Most of the lift comes from prior-one-second trade-sign imbalance (with a negative sign — short-horizon mean reversion), not from depth imbalance, which contributes a smaller positive effect. The cadence ablation establishes that the result is not a sub-second artifact: the same AUC obtains at 50, 100, and 250 ms.

What the result does not say. The AUC does not survive a taker execution model. At every threshold and every cost multiplier in the sweep, net expected value is negative; the gross edge of $\sim\$0.003$/action sits well below the typical $\sim\$0.13$ spread on this instrument-day. This is the central cost-after-execution gap in the study. It also says nothing about persistence across days, instruments, or venues because the analysis is limited to one instrument-day. The widest-spread-quintile hypothesis is not borne out: Q3 (mid spreads) shows the highest AUC, and Q5 is unremarkable.

What would change the result. Three concrete moves would materially shift the conclusion. First, a maker-style execution model with partial-fill assumptions and a passive-rebate term would recover most of the spread; under any reasonable rebate this signal becomes a candidate for queue-jumping work rather than taker prediction. Second, queue-position features (own-order rank at top-of-book, plus arrival/cancellation rates at the inside) would let the signal condition on the local micro-state of the LOB rather than aggregate top-five depth. Third, a multi-day panel (LOBSTER samples exist for AMZN, GOOG, INTC, MSFT, SPY in addition to AAPL) would let us measure cross-day stability rather than report a point estimate that may be specific to 2012-06-21.

1. Single instrument. Results are reported for AAPL only; the LOBSTER event file is one ticker per release. No cross-sectional or cross-instrument variance estimate.
2. Single day. 2012-06-21 is one trading day. This analysis does not measure cross-day stability and does not generalize.
3. Single session segment for held-out evaluation. The chronological 70/30 split places 09:30–12:28 in training and 12:28–16:00 in test; we make no out-of-sample claim about the open. The early-test bucket (12:00) is the noisiest.
4. High tie share (45.6%). The 1-second forward mid-price often does not change at all in 2012 AAPL; ties are dropped by construction of the binary up/down label, and the dropped share is large enough that the labeled panel is roughly half the snapshot count.
5. Taker execution only. The cost overlay assumes full spread crossing on every action. No maker / queue-position model is included; the negative result is a taker result.
6. No queue-position feature. Depth aggregates rather than own-order rank or LOB micro-events; queue-position features are the clearest next extension.
7. No cross-venue replication. The Binance BTC/USDT path is not run here, so the evidence is limited to the LOBSTER AAPL sample.
8. Trade-sign reliance on aggressor flag. On this LOBSTER sample 100% of trades carry an explicit aggressor; on samples or venues where the flag is missing, the tick-rule fallback would introduce additional noise into the dominant feature.