Sign In

AbstractMany high profile societal problems involve an individual or group repeatedly attacking another from child parent disputes, sexual violence against women, civil unrest, violent conflicts and acts of terror, to current cyber attacks on national infrastructure and ultrafast cyber trades attacking stockholders. There is an urgent need to quantify the likely severity and timing of such future acts, shed light on likely perpetrators, and identify intervention strategies. Here we present a combined analysis of multiple datasets across all these domains which account for >100,000 events, and show that a simple mathematical law can benchmark them all. We derive this benchmark and interpret it, using a minimal mechanistic model grounded by state of the art fieldwork. Our findings provide quantitative predictions concerning future attacks; a tool to help detect common perpetrators and abnormal behaviors; insight into the trajectory of a 'lone wolf'; identification of a critical threshold for spreading a message or idea among perpetrators; an intervention strategy to erode the most lethal clusters; and more broadly, a quantitative starting point for cross disciplinary theorizing about human aggression at the individual and group level, in both real and online worlds.IntroductionHuman confrontations1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19,20,21,22,23,24,25 from one on one fights3,4,5 through to collective protests6,7,8,9,10, mass violence11,12,13,14,15,16,17,18,19,20,21,22,23 and even online acts of aggression24,25, are of great societal importance. against Blue). While 'big data' approaches to non confrontational human activities have revealed new patterns26,27,28,29,30,31,32,33, the presence of aggression and danger means that event records for a particular confrontation run the risk of being incomplete or biased15. These considerations motivate us to analyze a broad spectrum of heterogeneous event level datasets drawn from independent sources across multiple disciplines, not limited to armed conflict16,17,18,19, crossing from local to global geographic scales and in both real and online worlds. Our data sources are listed in the Supplementary Information (SI). We find that in all these systems, the distribution of the severity of events and the trend in the timing of events, are each described by a power law function of the form "ABC".ResultsEach point in Fig. 1 results from the maximum likelihood fitting of the power law Ms to the tail in the distribution of the severity of individual events within a given confrontation, where s is the severity of an individual event which, in the case of violent conflict, is the number killed or injured in an attack. is the power law exponent, M is the normalizing factor, and p is the goodness of fit16,17,18. Figure 1A inset illustrates this power law tail distribution, while full details of the statistical fitting procedure are described in the cited references of the fake van cleef inspired necklace Methods section. We can analyze event severities and timings separately since they show no systematic cross correlation, as illustrated in the SI. Specifically, while the event severity distribution is stationary throughout the confrontation to a good approximation, the timing of individual events is a non stationary process with periods of initial escalation or de escalation. 1A inset) for confrontations. (A) within a given continent (Africa); (B) across the globe, for different actors and different injury levels; (C) within a given country (departments in Colombia). (D) shows conventional wars and sexual violence against women5. Suicides etc. form a near continuum at p = 0 with 2.5. The darker the color of each data point, the larger the total number of victims (see SI). Red star shows value for global terrorism17, green ring is value for entire Africa database, purple ring is value for all interstate wars from 1860 1980. Dashed horizontal line shows theoretical benchmark = 2.5 derived from the simple version of our theory, as described in the text; SI shows = 2.5 result is robust to generalizations. Red shaded area corresponds to goodness of fit p 20. Fig. 1D lists other empirically determined values. Domains are omitted in Figs. 1,2,3 if we lacked the necessary data (see SI).Our results for the timing of individual events are summarized by Figs. 2 and 3, where each point results from the maximum likelihood fit of a power law 1n to the trend in successive inter event time intervals n between the n'th and the (n + 1)'th event within a given confrontation, with n = 1, 2, 3 etc. and with 1 being the intercept on a log log plot of n vs. n19. This procedure is illustrated in Fig. 3 upper inset. The event timing results in Figs. 2 and 3 mostly show escalation ( > 0) with some de escalation (Figure 2: Event timing benchmark across domains.(A) Each point denotes a unique infant parent pair, obtained using analysis in Fig. 3 upper inset. Underlying events are cry face attacks by infant (Red) against parent (Blue). The experiment is described in Ref. 4. (B) Each point denotes a unique geographic location. Underlying events are street protests by anti government groups (Red) against Polish government (Blue). (C) Each point denotes a unique sector of national cyber infrastructure. Underlying events are cyber attacks by foreign group (Red) against indicated sector's defenses (Blue). financial institution stock. Underlying events are attacks by ultrafast predatory traders (Red) against the remaining market replica van cleef inspired necklace of slower global investors (Blue). We can reject the null hypothesis that these linear fits emerge by chance, by randomizing event times and then comparing probability distribution of R2 fits to the real value in order to generate p significance values (Fig. 2A, , p = 0.0089; Fig. 2B, , p = 5.6 105; Fig. 2C, , p = 0.036; Fig. 2D, , p = 0.0087). See SI for more details. SI contains key to symbols. Several best fit lines are shown as a guide. Separate symbols for attacks against government forces, and against civilians. Red star shows result for global terrorism. Upper inset shows escalation of Red attacks in Belfast. Lower inset shows Belfast (solid red square) is abnormal compared to Armagh and Down (red squares with yellow centers).For the analysis of event severities in Figs. p > 0.05. (See the cited references in Methods for details on how to determine and interpret these p values). For the analysis of the trend in the timing of events (Figs. 2 3) the parameter governing the trend from the outset of the confrontation, shows an approximate linear dependence on log1, implying that within each domain the confrontations in which initial events are frequent tend to slow down over time ( negative when 1 is small) whereas they accelerate if events started slowly ( large positive when 1 is large). In Fig. 2A for infant attacks, this is particularly remarkable since each point corresponds to a different infant (and parent), and the experiment underlying each point is performed at separate times. A random process in which individuals become victims independently with a constant probability, would have yielded p = 0 with an arbitrary value in Fig. 1, thereby explaining the values in Fig. 1D for suicides, homicides, and death by accident and disease, while for timings the values would have been evenly scattered around = 0 with no strong linear dependence. (See SI for empirical confirmation of these statements). Our results benefit from out of sample testing: Ref. 34 provides a public, time stamped record of our 2005 pilot study of two wars that hinted at a severity distribution Ms with 2.5, while Ref. 16 adds seven more and terrorism. Likewise Ref. 19 records our 2011 pilot study of two wars suggesting 1n for event timings with linearly dependent on log 1. Here we move beyond wars and terrorism with Figs. 1,2,3 providing blind test results for every dataset made available to us in the interim years. cyber hackers, insurgents, terrorists, protestors, ultrafast traders, infant) who is in principle weaker than its Blue opposition (respectively, the national infrastructure, incumbent army, security forces, ruling government, global stock holders, parent), yet who manages to inflict a series of attacks that typically escalates ( > 0 in Figs. 2 3). We develop our explanatory model by referring to the most recent and detailed fieldwork available of such a Red group20: PIRA (the Provisional IRA) who inflicted an escalating number of attacks against the stronger British government forces (Blue) in Northern Ireland from 1969 onwards20. PIRA's operational network shown in Fig. online gold farmers35. Its resources which in Fig. 1D inset are people but for more general Red may include technology, predatory algorithms (Figs. 2C D) or even abstract cognitive processes for the case of infant (Fig. by phone). In short, network connections indicate empirical evidence of some coordinated activity, not spatial proximity. clusters coalesce)9,20,21,22,29 but can also lose internal coordination (cluster fragments) under conditions of external or internal stress9,20,21,22,29, just as a cluster of animals disperses if in danger or a start up company dissolves if it loses common purpose36. Adding the empirical finding that larger social clusters show more churn than smaller ones29, yields the simplest form of our dynamical cluster theory whose exact solution (see SI) is a Red cluster size distribution of the form Ms with = 2.5, consistent with Fig. 1D inset, with gang sizes in Asia and Chicago ( = 2.3)12 and with cyber crowds of traders through the proxy of trade size ( = 2.5)31. Following recent empirical findings linking size to lethality14,18, we take a cluster's size as proportional to the severity of an event in which it participates, hence reproducing the severity distribution Ms with = 2.5. We explored many generalizations of this theory but find that Ms with 2.5 is remarkably robust (see SI). Changing the rigidity of larger Red clusters successively from more rigid to less rigid, moves the values from below 2 to above 3, hence providing an interpretation for individual confrontations in Figs. 1A C. Restricting connectivity between Red clusters to physical contact on a two dimensional grid like an urban street setting or battlefield, pushes toward 1.9 with a weaker power law (p 0) hence explaining most of the conventional wars in Fig. 1D and the = 2.0 value for Chicago strikes10.The notion that Red's self organized, decentralized cluster structure (Fig. 1D inset) helps it adapt faster and/or better than Blue, is consistent with recent findings that organic structures are more conducive to innovation than bureaucratic ones36. Indeed, ultrafast traders (Red, Fig. 2D) carry out their attacks in under a second. We introduce x(n) to represent Red's relative advantage over Blue following the last (n'th) attack, where x(n) follows a general stochastic process. when Red has a relative advantage) and zero when x(n) x(n)rms n (see SI) where characterizes the correlations in x(n) ( = 0.5 for an uncorrelated process). The time between attacks, which is approximately the inverse rate, is therefore proportional to n enabling us to identify = . This explains why 1n describes the attack timings and implies that if > 0.5, Red's lead over Blue follows a positively correlated process, while it follows a negatively correlated one if 0 and log 1 if we introduce coupling between the underlying x(n) processes. in Fig. 2B the same social movement underlies protests in different locations.Figures 1,2,3 reveal surprising dynamical equivalences between confrontations and hence offer novel data proxies and cross domain insights: The escalation of events in Magdalena, Colombia (black oval ring) is representative of all confrontations in Fig. 3; the relative position of General Electric (GE) in Fig. 2D makes predatory trade attacks on it akin to cyber attacks on the Hi tech Electronics sector (Fig. 2C) which in turn mimic specific infant parent dyads (Fig. 2A) and protest locations (Fig. 2B); and the conflict in Sierra Leone, Africa, has the same (p, ) in Fig. 1 as the narco guerilla war in Antioquia, Colombia. Angola in Fig. 1A, which serves to warn researchers against using such a confrontation as representative. The time interval abnormality in Fig. 3 (upper inset) turns out to straddle the 'Bloody Sunday' attack by Blue on civilians on 30 January 1972, implying that neighboring points offer insight into the build up to, and consequences of, an extreme Blue intervention. Interestingly Bloody Sunday appears as the culmination of escalating PIRA attacks, not their trigger, hence raising new questions about its strategic importance. The fact that Belfast's (1, ) values in Fig. 3 (lower inset) destroy any linear dependence, is consistent with the recent fieldwork finding20 that Belfast's PIRA network is quite distinct to Fig. 1D inset. The fact that sexual attacks against women do not appear as an outlier in Fig. 1, hints at some hidden clustering (like Fig. 1D inset) of attackers or attacks.We have shown that both the severities and the timings of events in a wide range of systems, follow a power law functional form. There are various practical prediction tools and policies that follow from our work, as we now discuss. Suppose some sporadic attacks have been observed in a given location or sector in the real or online world. If the trend in successive time intervals between attacks is found to follow 1n, this suggests a single Red Blue process (x(n)) underlies them. Blue has not yet counter adapted), this points to a single attacking Red individual or group. If attacks then emerge in different locations or sectors, detecting an approximate linear relationship in vs. log 1 points to this same Red operating in these different places. Figure 2C hence supports media speculation that current cyber attacks against different sectors of US infrastructure come from a single Red entity24. Likewise, Fig. 2D suggests that a common set of predatory algorithms and/or trading firms (Red) may underlie recent 'flash' instabilities in different stocks25. For Fig. 2A, the independence of the participants suggests that this linear pattern is revealing a new innate feature of how infants and parents interact.Now imagine the scenario in which two attacks occur in a new location that was previously quiet, and that this same Red is suspected. An estimate for in this new location can be read off from the existing vs. log 1 plot by inputting this single inter event time as an estimate for 1. Future attack times can then be estimated using 1n (see SI for examples).Next consider the severities of events imitation van cleef and arpels long necklace as they begin to emerge in a given sector. Suppose a crude Ms distribution is found with 2.5 and p > 0.05. This points to Red having a similar delocalized cluster structure to our model. Indeed, even without any observed events and hence without any event severities from which to estimate the distribution, the weight of evidence in Fig. 1 suggests that any future confrontation involving a similarly structured Red will produce a severity distribution Ms with 2.5 and p > 0.05. The expected number of victims in a future attack is therefore approximately [( 1)/( 2)]smin where smin is the cut off in the maximum likelihood fit37. Taking 2.5 as in Fig. 1 and smin 1, this expected number is 3, which happens to coincide with the recent Boston marathon attack. 7%). The severity of the most fatal attack will grow as the number of attacks n grows, following n1/(1) n0.67. Dividing attacks equally into less violent and more violent, the fraction of victims falling in the most violent half is given by 2(2)/(1) = 0.8 meaning that a few attacks will produce the majority of the victims. Another relevant consequence of our clustering theory is that the ongoing coalescence fragmentation process means that a 'lone wolf' actor is only truly alone for short periods of time, which is again consistent with recent field studies22, and provides an estimate for how long ago contact was made with other Red clusters.The stability of in Fig. 1 throughout a given confrontation (see SI) suggests that the corresponding Red group self organizes rapidly after its inception, as confirmed by our model's dynamics, and hence latent Red groups that have not yet launched any attacks may already have a structure resembling Fig. 1D inset. More generally, although the overall command structure of a present or future Red might be hierarchical, or publicly portrayed as so, our theory aligns with recent empirical findings9,20,21,23 in predicting that operationally Red will self organize into a far flatter, clustered structure similar to Fig. 1D inset. less powerful) ones. The mathematics specifies conditions required to keep formation of large (lethal) clusters below a desired rate, and so reduce the threat level of large future attacks. It also warns that if Blue is insufficiently active in counter measures, and hence the overall rate at which it fragments Red clusters becomes too small ( where N is an estimate of Red's size38) then Red will grow exponentially fast into one super cluster of maximum possible lethality. Finally, our clustering theory predicts a necessary condition39 fragp/coalq > 1 that must be met before a covert message or doctrine can spread within Red, where coal is the cluster coalescence rate, p is the transmission rate of the message between two people in a Red cluster, and q is the rate at which this message gets forgotten or corrupted.MethodsThe power law analysis that we use to obtain our results in Fig. 1 for the tail in the distribution of the severity of individual events, follows exactly the state of the art testing procedure described in Refs. 16,17,18 and firmly established in Ref. 40. Our analysis of the trend in the timings of individual events follows exactly the method presented in Ref. 19. Our proposed model of cluster coalescence fragmentation for Red, which reproduces the 2.5 power law result for the severity distribution, comprises a population of objects (agents) that self organize into clusters according to the stated rules of cluster coalescence and fragmentation. The mathematical derivation of the 2.5 result is given in the SI. We have also investigated many variants of this coalescence fragmentation cluster model and found (see SI) that most retain a power law with exponent near 2.5. For the trend in the timings of attacks, a null model comparison showing the statistical significance of our benchmark result is given in the SI, together with the derivation of our stochastic model for Red's relative advantage over Blue which reproduces this timings benchmark. et al. Computational Social Science. Science 323, 721 723 (2009).

## The Wall