Our trade surveillance system alerts you: a proprietary trader is repeatedly placing large buy orders and canceling them milliseconds before execution, while executing small sell orders. How do you characterize this behavior, and what specific data would you look at to confirm it?