Modelling & Analysis of High Impact Terrorist Attacks in India & Its Neighbors

Abstract

Terrorism perpetrated in any country by either internal or external actors jeopardizes the country’s security, economic growth, societal peace, and harmony. Hence, accurate modelling of terrorism has become a necessary component of the national security mission of most nations. This research extracted and analyzed high impact attacks (HIAs) perpetrated by terrorists in India and its neighboring countries since 1970 using the Global Terrorism Database (GTD). We evaluated the extraction efficacy of the Global Terrorism Index Impact Score (GTI-IS) against the GTD measure “nkill” using the iterative outlier analysis (IOA) heuristic. The heuristic identified 6117 common HIAs using nkill or GTI-IS attributes. GTI-IS extracted 1718 exclusive HIAs that nkill missed, while nkill extracted 2233 exclusive HIAs. We further classified the extracted HIAs into lethal and non-lethal attacks. Next, we conducted a rigorous spatiotemporal exploratory analysis of countries that reported the most HIAs. Though Afghanistan, India, and Sri Lanka exhibited global spatial autocorrelation, Pakistan did not. Ripley’s G function suggested the recurrence of lethal attacks near other similar events. This analysis showed that lethal and non-lethal attacks in those countries follow different statistical distributions, which can aid in focused counterterrorism tactics.

1. Introduction

Terrorism is a major national security concern and a threat to nations’ sovereignty [1]. After executing an act of premeditated violence by perpetrators of terrorism, the nation’s economy faces adverse impacts [2]. India is a victim of terrorism, predominantly sponsored by foreign entities. Similarly, most of India’s neighbors are facing either the wrath of terrorism or have supported terrorists on their soil [3]. Multiple definitions of terrorism exist, with regional fluctuations in its scope and meaning, thereby making it a contested concept [4]. The Global Terrorism Database (GTD) is a data collection effort funded by Homeland Security [5] to collect, maintain, and annually publish the relevant details of worldwide terrorism incidents. GTD defines a terrorist attack as the threatened or actual use of illegal force and violence by a non-state actor to attain a political, economic, religious, or social goal through fear, coercion, or intimidation [6]. GTD 2020 published data on 201,183 terrorism incidents from 1970 to 2019, where 135 associated attributes describe each incident. Four agencies collected data for GTD during these years, including Pinkerton Global Intelligence Service (PGIS) for part-I data, the Centre for Terrorism and Intelligence Studies (CETIS) championing part-II, the Institute for the Study of Violent Groups (ISVG) piloting part-III, and the National Consortium for the Study of Terrorism and Responses to Terrorism (START) compiling part-IV. Further, part I accounts for 33.55% of GTD, while part-II and part-III contributes to 9.27% and 8.71% of GTD data, respectively. Finally, part IV amounts to 48.45% of GTD data, which started from 2011 onwards [7].

The Global Terrorism Index (GTI) attempts to compare various terrorist attacks by creating an index using GTD data. The index utilizes the number killed (nkill), number wounded (nwound), property damage (propextent), and the number of attacks reported in a year to calculate the Impact Score (IS), as shown in Equation (1). We refer to this impact score as the Global Terrorism Index—Impact Score (GTI-IS) in this document. It ranks nations using the GTI score of attacks perpetrated for the last five years [8]. Conversion of the IS into the Weighted Impact Raw Score (WIRS) requires the latest five years of data, followed by scaling into a 1–10 interval to rank a nation.

Equation (1) Evaluation of Global Terrorism Index—Impact Score.

$$\mathrm{Impact} \mathrm{Score} \left(\mathrm{IS}\right)=3 \ast \mathrm{nkill} +1 \ast \mathrm{nwound} +2 \ast \mathrm{propextent} +1 \ast \mathrm{incidence}$$

Terrorists prefer vicious attacks that cause large-scale destruction in order to intimidate citizens. Executing such attacks requires organizational backing, manpower, financial support, and high risks, thereby making them infrequent. This study extracted such terrorism events, which we refer to hereafter as High Impact Attacks (HIA). However, most data in GTD are small-scale attacks that are primarily driven by radicalized individuals (ie. lone wolves). Hence, while conducting statistical analyses, HIAs become anomalies or outliers. Statistically, an outlier is an observation that significantly deviates from other observations in the dataset to arouse suspicions that it was generated by a different mechanism [9]. In any normal data analysis process, these HIAs will get discarded as outliers, and the analysis proceeds on the rest of the data. However, from a terrorism standpoint, these HIAs result in maximum societal impact. Such attacks require a lot more organizational support, manpower, and resources. The occurrences of them vary from region to region. The differences in the security norms associated with each region determine the frequency, magnitude, choice of weapon/target type, etc. Hence, it is almost impossible to analyze all these events in a generalized way. This hypothesis is validated through the region-specific and country-specific analyses of such HIAs in past contributions. It necessitates the development of country-specific models to study HIAs. Blázquez-García et al. provide a comprehensive compendium of outlier detection techniques for time series data. The authors demonstrated that such methods vary depending on the input data type, the outlier type, and the nature of the method [10].

A box and whisker plot is a statistical tool that utilizes a five number diagrammatic summary, viz., (i) minimum, (ii) first quartile (25th percentile), (iii) median (50th percentile), (iv) third quartile (75th percentile), and (v) maximum on any univariate data series, which can also retrieve outliers [11]. A box and whisker plot provides two sets (lower and upper) of fences, viz., (i) inner fences and (ii) outer fences. The data points beyond the lower and upper outer fences become definite outliers, while the values between the inner and outer fences become potential outliers. However, this study considered data points beyond the Upper Inner Fence (UIF) as outliers, creating the HIA dataset. Researchers [12] proposed an iterative approach to detect outliers in laboratory recalibration for removing the drift in Uric acid measurements from the Atherosclerosis Risk in Communities (ARIC) study, where data points outside three standard deviations from the mean formed the outliers. Their proposed iterative procedure continued until a particular iteration failed to return any outliers. Another study utilized the boxplot-based classification strategy to study the relationship between public transit and crime [13]. They recursively identified outliers in service capability using a boxplot. We developed a similar yet heavily modified iterative heuristic that uses the UIF measure of the box and whisker plot to detect outliers. Using this heuristic, the authors separately demonstrated the extraction of HIAs using the global dataset [14] for the Middle East & North Africa region [15].

Terrorism incidents identified as HIAs contain information about the perpetrators’ choices of the type of weapon, type of target, and attack locations. Although multiple factors influence terrorists’ tactics, specific weapons or target types garner more prominence than others. Researchers proposed that terrorists may utilize conventional weapons for casualties, whereas they may prefer unconventional weapons to incite fear and panic by mass killing [16]. Bombs emerged as the preferential weapon of capable, armed terrorist groups rather than smaller groups [17].

Similarly, terrorists select their physical victims to inflict considerable psychological damage on their targets [18]. Recent studies attempted to decipher the logic behind the target choices of terrorists and concluded their preference to be relatively hard official targets [19]. This study identified and segregated HIAs that utilized the most preferred weapon choices and target selections, marking them as lethal attacks due to their resulting impacts.

Geospatial analysis of terrorism incidents can allude to the spatial choices of terrorists, thus effectively identifying fertile grounds for terrorist activities. The literature establishes that spatial locations reporting a history of attacks possess a higher tendency to witness similar events in proximity [20]. Exploratory spatial data analysis (ESDA) using spatial data is identical to the descriptive techniques used on aspatial data [21]. ESDA can detect spatial patterns and formulate hypotheses regarding geographical data. Centrographic statistics can extract the overall tendency of spatial data by providing the spatial equivalent of descriptive statistics [22]. This study utilizes spatial mean center, weighted mean center, and Manhattan median to provide an overall depiction of spatial HIA attacks’ distribution inside various national territories [23]. The standard deviation ellipse of each decade will facilitate the decrypting of the spatiotemporal evolution of these attacks.

Further, Edelsbrunner et al. developed an algorithm that returns the tightest polygon containing all points inside, known as the $\mathsf{\alpha }$-shape or $\mathsf{\alpha }$-hull of the points [24,25]. PySAL provides an optimized algorithm that can iteratively find the best value for $\mathsf{\alpha }$[26,27]. These computational geometric algorithms can facilitate identification of the closest and farthest polygon that encompasses all terrorist attacks in a geographical region. Spatial autocorrelation and spatial heterogeneity are two main effects that can identify the relationship between spatial observations and their neighborhoods. Joint count statistics is the simplest method to determine global spatial autocorrelation in qualitative variables, as they enumerate the number of times that similar or dissimilar values are present in the neighborhood [28].

Most research on terrorism focuses on identifying regional patterns that cannot provide the necessary granular information required for developing counterterrorism strategies at the local levels. Braithwaite and Li implemented hotspot detection of transnational terrorism at the country level to tackle this issue [20]. Marineau et al. explored the association of subnational factors with transnational terrorism. They identified that local experience with civil wars, proximity to urban areas, and population of urban areas increase the chances of transnational attacks [29]. Here, we utilized the first-level administrative boundaries of countries maintained by the EarthWorks project to explore spatial patterns in the extracted HIAs [30,31,32,33].

Another exciting characteristic of spatial point patterns is the colocation or clustering of data points. A well-established set of distance-based statistics functions developed and named after Ripley can provide statistical inferences about clustering in spatial data [34]. Ripley’s G function captures the proportion of data whose nearest neighbor distance is below a predefined threshold. Comparing the data generated by a completely spatial random (CSR) process with the observed data using Ripley’s G function can illustrate the similarity or dissimilarity of patterns. The Python Spatial Analysis Library (PySAL) implements Ripley’s G function and can perform CSR for generating the simulation envelope for statistical inference [26,35,36].

The rest of the paper contains the following sections: The immediate material and methods section details this study’s methodology to extract and explore patterns in HIAs. The results section quantifies the heuristic’s performance and country-wise spatial analysis of HIAs. A detailed discussion of results provides a comprehensive and comparative overview of the research performed in different countries and concludes the study with specific takeaways for counterterrorism analysts.

2. Materials and Methods

This study successfully extracted HIAs from the GTD and performed a comprehensive spatial and temporal analysis of the attacks of interest (AOI). Each terrorism incident record contains the associated casualties and other crucial information, such as attack type, weapon type, and target type, among other vital data regarding the attacks, using 135 distinct attributes. Figure 1 presents the complete flowchart of all the analyses performed in this study.

This study first implemented the Iterative Outlier Analysis (IOA) heuristic using the UIF value of the box and whisker plot to extract HIAs. The heuristic takes a univariate data series as input, from which an iterative extraction of local point outliers occurs using annual segregation of the data for each country until the UIF value converges between two consecutive iterations. As Equation (1) calculates the GTI-IS, the nkill attribute possesses maximum weightage as it quantifies the fatalities associated with an attack. Hence, this study utilized the nkill attribute as one criterion for HIA extraction using the IOA heuristic. It performs a Jaccard similarity with the HIA dataset obtained from the GTI-IS as an input for the algorithm. The proposed IOA algorithm, implemented using the Python ecosystem [37] and Pandas [38], is shown in Algorithm 1.

Algorithm 1. Iterative Outlier Analysis

Input: GTD 2020 – India & its neighbors

Output: Two datasets containing outliers based on nkill and GTI Impact score

Require: nkill, GTI score

procedure: IOA (data frame with nkill and GTI score)

for each attribute attr in {nkill, GTI score} do

Divide the data frame annually

repeat

for each year i with attribute attr do

uif_vali = Q3 + 1.5 * (Q3 – Q1)

uof_vali = Q3 + 3 * (Q3 – Q1)

uif_val_steadyi ← uif_vali

End for

until uif_val becomes steady at n iteration

repeat

for each year i with attribute attr do

Initialize Set1i & Set2i

for each incidence j of current dataset do

if attrj < uif_val_steady then

Set1i ← Set1i + incidencej

else

Set2i ← Set2i + incidencej

end if

end for

end for

until done

Outlier data frame $={\mathsf{\Sigma }}_{\mathrm{i}}\mathrm{Set}{2}_{\mathrm{i}}$

end for

end procedure

The IOA algorithm in Algorithm 1 separately extracted HIAs using the nkill attribute and GTI-IS. We chose the nkill attribute because the terrorists aiming to perpetuate maximum fear within the society will strive to maximize the fatalities associated with their attacks. Hence, the probability of an attack that resulted in significant fatalities (nkill) to be classified as HIA is relatively high. Further, Venn analysis on the resulting HIA datasets obtained using nkill and GTI-IS indicated the relative effectiveness in extracting a richer dataset using IOA.

Next, we considered the collections of HIAs extracted from nkill and GTI-IS as AOI, facilitating the downstream temporal and spatial analysis. Using the Pareto principle, we first investigated the AOI dataset’s most prominent target and weapon types. After that, we classified the AOI dataset into two distinct and mutually exclusive subsets, viz., (i) lethal and (ii) non-lethal attacks. Lethal attacks simultaneously incorporate any identified prominent weapon types and target types in an attack, whereas the non-lethal attacks contain other combinations of weapon type and target type. It is pertinent to mention that using only the prominent weapon type but not the target type and vice-versa will not qualify a terrorist event as a lethal attack.

Since terrorism is a regional phenomenon with an inherent temporal dimension, we conducted subsequent analyses for various countries that contributed the most to the AOI dataset. We first conducted a fundamental exploratory spatial data analysis for each such country on lethal and non-lethal attacks. It included finding the central tendency measures, such as the spatial mean center, the Manhattan median of the point patterns, and the weighted mean center of the marked point patterns. The GTI-IS of each attack served as the weight for finding the weighted mean center. The convex hull and the closest alpha patch of a country’s total lethal and non-lethal attacks mark the farthest and nearest boundary for these attacks, respectively.

The time between attacks (TBA) of lethal and non-lethal attack datasets is an important parameter. Hence, we conducted a hypothesis test to determine whether the TBA in these two datasets follows the same probability distribution. The hypothesis test used was a two-sided, two-sample Kolmogorov–Smirnov test [39,40]. The results section shows that the TBA of lethal and non-lethal attacks follow different distributions. Therefore, we performed a spatiotemporal analysis of each country for every decade to extract various spatial statistics of the lethal attacks.

This study further extended the spatial analysis to estimate the global autocorrelation in the neighboring provinces (administrative areas) of a country based on the accumulated GTI-IS of each province for lethal attacks by using the “within” operation to perform the point in polygon analysis [41]. The median of the derived statistic GTI-IS per km² of each province classified provinces into a binary category. The binary classification tested whether each province shares similar neighborhoods using the Joint count statistic. We further verified the autocorrelation by performing 999 simulated spatial permutations of the observed data to generate synthetic maps. These synthetic maps can test the null hypothesis that the observed patterns in the neighborhood are by chance and can statistically validate the results. Finally, this study performed statistical analysis using Ripley’s G function to identify spatial clustering. We conducted another 9999 simulations to synthetically generate the spatial point patterns (following CSR) for each analyzed country. We then compared the median simulation with Ripley’s G function curve for the observed pattern to statistically validate the presence of clusters in the lethal attacks data.

3. Results

GTD 2020 compiles data on terrorist attacks from 1970 to 2019 in four constituent parts, as explained earlier. This study focused on India and its neighboring countries, viz., India, Nepal, Bhutan, Myanmar, Bangladesh, China, Sri Lanka, Maldives, Afghanistan, and Pakistan. These countries collectively reported 52,243 incidents out of the total 201,183 incidents in the GTD.

Table 1. Terrorist incidences data from India and its neighbors.

Country	No. of Attacks
Afghanistan	16,313
Pakistan	15,208
India	13,477
Sri Lanka	3040
Bangladesh	1714
Nepal	1514
Myanmar	678
China	266
Maldives	27
Bhutan	6

summarizes the country-wise counts of reported terrorism incidents in descending order for these countries. Table 1 indicates that Afghanistan, Pakistan, and India account for the lion’s share of reported attacks.

Since GTI-IS utilizes the number of deaths (nkill), the number of wounded (nwound), and property damage (propextent) to generate its composite score, analysis of patterns associated with these attributes becomes critical. We found that both nkill and nwound attributes exhibit a positive skewness of 21.25 and 29.05, respectively.

Table 2. Category levels for property damage attributed to the terrorism data of India and its neighbors.

Damage Code		Description	Incident Counts
Codebook	GTI
1	3	Catastrophic	0
2	2	Major	128
3	1	Minor	13,062
4	0	Unknown	39,053

summarizes the property damage attribute (propextent) from the data subset for India and its neighbors, where most reported incidents have unclear data (represented by unknown) for property damage. Further, GTD 2020 reported no terrorism event data that resulted in catastrophic property damage from India and its neighbors.

Five iterations of the IOA heuristic caused the UIF value to converge with the same value as the fourth iteration for the yearly data for both the nkill and GTI-IS attributes.

Table 3. IOA iteration details for nkill and GTI-IS values using the proposed IOA algorithm.

High Impact Attacks	NKILL Outlier Iter-1	NKILL Outlier Iter-4	GTI-IS Outlier Iter-1	GTI-IS Outlier Iter-4
Count	5603	8350	5351	7835
Mean	13.96	10.8	61.86	47.93
Standard Deviation	18.74	16.04	77.88	67.73
Minimum	0	3	1	6
25th Percentile	6	4	25	19
50th Percentile	9	7	41	30
75th Percentile	15	12	60	52
Maximum	518	518	1771	1771

tabulates the performance details and the five data values of the box and whisker plot at the beginning and ending iterations of the IOA heuristic. The “Count” row reports the number of attacks identified as HIAs in a particular iteration of IOA. The other rows of the table report the five-point summary of the boxplot with mean and standard deviation of the HIA set for an iteration.

A Jaccard similarity analysis between HIAs (outliers) extracted using nkill and GTI-IS data series revealed that the proposed IOA extracted more HIAs using the nkill attribute than the composite GTI-IS measure. IOA captured 2233 exclusive HIAs using nkill, which remained unidentified by the GTI-IS. Similarly, the GTI-IS identified 1718 exclusive HIAs that the nkill attribute missed. Additionally, 6117 HIAs were common to both nkill and GTI-IS attributes. The three distinct sets of outliers, viz., (i) exclusive nkill HIAs, (ii) exclusive GTI-IS HIAs, and (iii) common HIAs of nkill and GTI-IS obtained after Venn analysis are geospatially depicted in

Table 4. Country-wise HIAs identified by nkill and GTI-IS attribute.

Country	#Exclusive NKILL	#Common HIAs	#Exclusive GTI-IS
Afghanistan	1340	3436	499
Bangladesh	7	47	97
Bhutan	1	0	0
China	8	49	12
India	291	752	399
Maldives	0	1	0
Myanmar	37	69	15
Nepal	10	43	30
Pakistan	438	1231	573
Sri Lanka	101	489	93

.

Table 4 reports the HIAs extracted by the nkill attribute alone, in which Afghanistan alone contributed 60.01% of the HIAs. The following significant contributors of HIAs are Pakistan and India, with 19.61% and 13.03%, respectively. HIAs identified by GTI-IS alone report that Pakistan is the major contributor with a 33.35% share, whereas Afghanistan and India contribute 29.05% and 23.22% of HIAs, respectively. No terrorist attack got classified as HIA in Bhutan or Maldives by using the GTI-IS measure. The attacks classified as HIA by either attribute used with the IOA heuristic show that Afghanistan contributed 56.17% of the attacks. In contrast, Pakistan, India, and Sri Lanka contributed 20.12%, 12.29%, and 7.99% of HIAs, respectively.

Next, we considered HIAs extracted from nkill or GTI-IS as the attacks of interest (AOI) and analyzed them further to gain more insights into these extreme events. First, we removed all attacks having a specificity value of five (5) since they lacked locational information. We further eliminated fourteen incidents reporting zero for the attribute “day” of the event from further analysis. This study transformed the GTD 2020 data reported in the World Geodetic System (WGS) 1984 (with EPSG as 4326) coordinate reference system (CRS) into a projected CRS with EPSG 3857, also known as Web Mercator projection. This study also utilized the cylindrical equal area projection to calculate the area of the polygons of administrative boundaries. The complete dataset after pre-processing, as discussed above, has 9938 events.

Next, using the Pareto principle, we identified the most preferred weapon and target type choices from the AOI dataset. Explosives and firearms accounted for 83% of the AOI extracted from India and its neighbors. Using the AOI dataset, four target types, viz., police, private citizens and property, military, and government (general), constitute about 79% of the extracted AOIs. Further, among these four target types, 2714 attacks targeted police, while private citizens and property and the military accounted for 2399 and 1952 attacks, respectively. The final prominent target type, government (general), was a distant fourth with 825 reported attacks. An attack on these prominent targets is indicative of the solid strategic and economic support obtained by terrorists.

Using our analysis, we propose that any attack that utilizes the preferred weapon type (either explosives or firearms) to attack any prominent target type becomes a lethal attack. All other attacks formed non-lethal attacks. This classification dissected the AOI dataset into two distinct and mutually exclusive parts. The lethal dataset contains 6404 incidents, whereas 3534 attacks constitute the non-lethal attacks.

Table 5. Country-wise lethal & non-lethal attack counts in the Attacks of Interest dataset.

Country	Lethal Attacks Count	Non-Lethal Attacks Count
Afghanistan	3396	1858
Pakistan	1452	774
India	924	480
Sri Lanka	410	247
Myanmar	83	27
Bangladesh	64	72
Nepal	48	33
China	25	43
Maldives	1	0
Bhutan	1	0

compares the country-wise distribution of lethal & non-lethal attacks, which makes it evident that Afghanistan, Pakistan, India, and Sri Lanka reported most of them. Therefore, the study further separately analyzes these attacks in the four countries.

3.1. Afghanistan

Figure 2 illustrates the 3396 lethal and 1858 non-lethal attacks in Afghanistan using yellow and cyan colors, respectively, from the AOI dataset with 50% opacity, bounded by the convex hull and alpha patch of these attacks. In the EPSG 4326 CRS, (33.83, 67.06) and (34.10, 66.77) represent the mean centers of lethal and non-lethal attacks, respectively. Similarly, (33.88, 67.16) degrees and (34.19, 66.91) degrees denote the weighted mean centers of lethal and non-lethal attacks, respectively. A distance of 11.25 km separates the mean and weighted mean centers of lethal attacks in Afghanistan, whereas a similar statistic for non-lethal attacks is 16.02 km. The distance between the mean center for lethal and non-lethal attacks is 39.92 km, whereas the weighted mean centers are 41.59 km apart. Since the mean center and weighted mean center in both cases are very near, it is evident that the attack intensity is almost uniform in lethal/non-lethal attacks.

The Manhattan median, represented by a cross sign in Figure 2 for lethal and non-lethal attacks, is located at (33.69, 67.65) degrees and (34.12, 66.79) degrees. In contrast with the non-lethal attacks, the Manhattan median is significantly farther away from the mean and weighted mean center of lethal attacks. The standard deviation ellipse is almost similar for the location of the spatial attack in Afghanistan with a similar 60° rotation in the clockwise direction representing that both lethal and non-lethal attacks have similar geographical dispersion. The large standard deviation ellipses represent huge dispersion in the dataset.

The temporal characteristics of these attacks can provide insights into occurrence. Figure 3 depicts an ECDF of the time between consecutive lethal attacks (left) and the corresponding QQ plot for them (right). The ECDF plot indicates about 40 days between two successive lethal attacks [42]. However, Afghanistan also witnessed a prolonged duration of 1400 days between lethal attacks. The QQ plot suggests that the data follows an exponential distribution. The best fit exponential distribution has a rate parameter of 3.40 days using the distfit library [43].

Similarly, Figure 4 shows the ECDF plot of the time between consecutive non-lethal attacks in Afghanistan and the QQ plot for the observed data. Evidently, 99% of the attacks occurred within 100 days of the most recent attack. The QQ plot confirms that the observed data follows an exponential distribution, and the best-fit rate parameter is 7.93 days using the distfit library [43].

Next, we conducted a two-sample, two-sided KS-test to test the null hypothesis that the observed data distribution of lethal and non-lethal TBA are identical. The KS test statistic was 0.11; a p-value less than 0.001 suggests a significant difference between the two underlying data distributions. This allows us to conclude that the planning and execution of lethal and non-lethal attacks occur differently. Therefore, the rest of the analysis for the Afghanistan region focuses on lethal attacks only.

Figure 5 comprehensively decrypts the spatiotemporal evolution of lethal attacks in Afghanistan. According to Figure 5, six, nine, 286, and 3095 lethal attacks were identified in the four decades from 1980, with no lethal attacks reported in the first decade of the 1970s. The standard deviation ellipses maintain an almost similar orientation in all decades, alluding to the identical dispersion patterns in the time and space of attacks. The steep increasing trend exhibited by the ellipse’s minor axis since 1980–1989 turns the ellipse into more of a circle, indicating large dispersions in all directions. The central tendency indicators remained spatially very close to each other for all decades except for 2010–2020, during which the Manhattan median moved farther away.

This study utilized the first-level administrative divisions of Afghanistan to investigate spatial autocorrelation further. First, we aggregated all attacks orchestrated in a particular province. Then, a derived statistic viz. GTI-IS per km² (or GTI-IS density) for each province was created using the total GTI-IS within a specific administrative boundary. Cylindrical equal area spatial projection facilitated computation of the geographical area of the province’s polygon. The median value of GTI-IS per km² segregates the provinces into two binary categories, depicted using blue and green colors in Figure 6. The threshold median value of GTI-IS density is 0.18, where blue shows the high density of GTI-IS and green represents otherwise.

This differentiation facilitated the exploration of global spatial autocorrelation using joint count statistics. We conducted a series of experiments by varying the number of K-nearest neighbors value for generating spatial weights, with their results summarized in

Table 6. Joint count statistics for spatial autocorrelation in Afghanistan.

#KNN	BB	WW	BW	BB p-Value	BW p-Value
2	11.5	10	12.5	0.024	0.979
4	22.5	21	24.5	0.011	0.993
6	32.5	30.5	39	0.009	0.996
8	44.5	37	54.5	0.005	0.995

. This study varied the KNN from two to eight and ran 999 simulations on each instance to capture how likely it is to obtain the observed similar and dissimilar neighboring provinces. In all cases, the low p-value of similar colored provinces (BB) established the spatial correlation of Afghanistan provinces, i.e., provinces with high GTI density tend to surround other provinces with similar characteristics.

The next logical step is to investigate any statistical indication of clustering in the attack location using autocorrelation in provinces. Ripley’s G function facilitates finding the number of attacks with the nearest neighbor distance below a given threshold. Figure 7 shows Ripley’s G function for the observed and generated data from a completely spatial random process. The teal-colored curve for the observed pattern represents the proportion of nearest neighbor distances below a certain distance (d). A total of 88.7% of the attacks have the nearest neighboring distance below 6527 m. The gray-colored band plots Ripley’s G function for the simulated data, and the yellow curve is the median simulation curve. The observed data has a relatively high number of nearest neighbors for shorter distances than the simulated spatially random data. This establishes that most data is statistically clustered in the Afghanistan region.

3.2. Pakistan

We analyzed the lethal and non-lethal attacks from Pakistan’s AOI dataset using the administrative boundaries. The administrative boundaries used here shows Gilgit Baltistan in Pakistan which is a disputed area between India & Pakistan. The administrative boundaries used here is available at Earthworks [31,32]. GTD also classified the attacks in the disputed region under Pakistan as it is currently administered by Pakistan authorities. There are 1452 lethal and 774 non-lethal attacks in Pakistan. The location of the mean center of lethal attacks at (31.47, 69.78) and the weighted mean center at (31.83, 70.17) are 55.42 km apart. Similarly, the locations of mean and weighted mean centers for non-lethal attacks at (30.82, 69.82) and (31.17, 70.29), respectively, are 59.64 km apart. The distance of 71.91 km separates the mean center of lethal and non-lethal attacks, whereas the corresponding distance between the weighted mean center statistic is 73.84 km. Both lethal and non-lethal attacks exhibit an almost uniform intensity due to the closeness of the mean and weighted mean centers. The Manhattan median is significantly farther away at (32.93, 70.46) and (31.83, 70.62) when compared with other central tendency indicators for lethal and non-lethal attacks, respectively. The standard deviation ellipse is almost similar in size and orientation, except that the minor axis for non-lethal attacks is 17% longer than its counterpart for lethal attacks. This implies that AOIs in Pakistan are also spreading in the minor axis direction of the standard deviation ellipse.

Figure 8 presents the ECDF plot for the time between consecutive lethal attacks in Pakistan and the corresponding QQ plot. It suggests that 95% of the lethal attacks were within 25 days of the most recent attacks. The most prolonged duration recorded for a lethal attack is 1265 days. The QQ plot hints that the time between attacks follows an exponential distribution, and the best-fit parameter for lethal attacks is 10.23 days.

Figure 9 summarizes the time between non-lethal attacks in Pakistan. In contrast with lethal attacks, approximately 95% of non-lethal attacks happened within 69 days of the most recent non-lethal attack. The most extended duration between two consecutive non-lethal attacks in Pakistan is 2469 days. The QQ plot suggested an underlying exponential distribution with a best-fit rate of 20.29 days. We used a two-sample, two-sided KS test to examine whether the underlying data distributions were identical. The resulting KS test statistic is 0.21 with a p-value less than 0.001, concluding that lethal and non-lethal attacks follow different distributions.

Figure 10 depicts the spatiotemporal evolution of lethal attacks in Pakistan in the last four decades since 1980. The first decade of 1970–1979 contained only one lethal attack in Pakistan. There are 14, 63, 226, and 1148 lethal attacks reported in 1980–1989, 1990–1999, 2000–2009, and 2010–2020, respectively. The central tendency indicators reveal the migration of conflicts to many Pakistani provinces. The lethal attacks recorded in the last two decades show that conflict has been growing in provinces that share a border with Afghanistan. Unlike Afghanistan, the central tendency indicators of Pakistan in all decades are located further away from each other. The standard deviation ellipse is almost similar in size and orientation for all the decades, as shown in Figure 10. The growing size of the ellipse hints that the attacks are getting spatially dispersed with changing decades.

The next step is to investigate the global spatial autocorrelation of the lethal attacks in Pakistan. Figure 11 portrays the administrative boundaries of Pakistan with binary segregation based on GTI-IS density using the median value as a threshold. The threshold value for segregation is 0.036 in the case of lethal attacks in Pakistan. As shown in Figure 11, four administrative areas are below the threshold, and four are above.

This segregation facilitated the investigation of spatial autocorrelation using the joint count statistic.

Table 7. Joint count statistics for spatial autocorrelation in Pakistan.

#KNN	BB	WW	BW	BB p-Value	BW p-Value
2	2	1	5	0.473	0.411
4	3.5	3	9.5	0.538	0.488
6	5.5	4.0	14.5	0.447	0.271

summarizes the experimental data obtained by varying the number of K-nearest neighbors for evaluating spatial weights. It is evident from the simulated random permutations of the observed data and the large p-values that the administrative areas are devoid of spatial autocorrelation.

Figure 12 illustrates the application of Ripley’s G function on the lethal attacks reported in Pakistan. Approximately 90% of the nearest neighbor distances are shorter than 9594 m, as shown by the teal-colored curve of the attack data. The gray-colored band is Ripley’s G function for the simulated spatially random data generated by 9999 iterations. The yellow-colored line represents the median simulation line for Pakistan. Since most of the observed data have short nearest-neighbor distances, the clustering of attacks is quite evident.

3.3. India

The AOI dataset for India consists of 924 lethal and 480 non-lethal attacks. The perpetrators executed the lethal attacks in the four major conflict zones in the country. The mean center and the weighted mean center of lethal attacks in India are located at (26.77, 82.11) and (27.22, 81.42), which are 85.13 km apart. Similarly, the mean center and the weighted mean center for non-lethal attacks are 216.41 km apart and located at (26.18, 82.06) and (25.66, 79.98), respectively. This indicates that the intensity of lethal attacks is almost uniform, whereas the intensity for non-lethal attacks is disproportionately distributed in spatial orientation. The distance between lethal and non-lethal attacks’ mean center is 65.16 km. However, the distance between the weighted mean center of lethal and non-lethal attacks is 224.62 km. The Manhattan median for lethal and non-lethal attacks does not significantly vary. The standard deviation ellipse for non-lethal attacks has a minor axis 16% longer than that of lethal attacks, showing more dispersion in non-lethal attacks in India.

Figure 13 depicts the ECDF plot for the time between consecutive lethal attacks (left) and the associated QQ plot (right). A total of 95% of the lethal attacks happened within 50 days of the previous attack. In India, the longest period without a fatal attack is 1700 days. The observed data’s QQ plot suggests an exponential distribution. The best-fit distribution for the observed data is an exponential distribution with a rate parameter of 17.74 days.

The ECDF plot (left) for non-lethal attacks in India is shown in Figure 14, with the corresponding QQ plot (right). Approximately 95% of the data occurred within 120 days of the most recent attack, as indicated by the ECDF plot. The longest time between two consecutive non-lethal attacks in India is 543 days. The QQ plots indicate an exponential distribution for the observed data. The best-fit distribution for the observed period between attacks was an exponential distribution with a rate parameter of 29.15 days. A two-sample, two-sided KS test to determine if the underlying distribution was identical yielded a KS statistic of 0.14 and a p-value less than 0.001.

Figure 15 depicts the spatiotemporal evolution of lethal attacks in India. Only two fatal episodes have been documented in the years from 1970 to 1979. However, other decades had 69, 172, 333, and 348 attacks in 1980–1989, 1990–1999, 2000–2009, and 2010–2020, respectively. Indicators of central tendency, such as the geographical mean center, the weighted mean center, and the Manhattan median, remained spatially closer to one another throughout all decades. It is evident that central tendencies are shifting toward the southeast. It indicates that lethal attacks have been regulated in the other direction over time. In the recent decade, 2010–2020, the standard deviation ellipse is nearly circular, indicating that the spatial locations of attacks have similar departures from the mean along both axes.

The administrative divisions of Indian states are shown in Figure 16, along with each state’s classification based on GTI-IS density. A total of 14 Indian states had GTI-IS densities above the threshold median, while 23 have densities below it. The threshold for this classification is 0.007.

Table 8. Joint count statistics for spatial autocorrelation in India.

#KNN	BB	WW	BW	BB p-Value	BW p-Value
2	9.5	13.5	14	0.001	0.941
4	15.5	28.5	30	0.014	0.94
6	22	44.5	44.5	0.009	0.971
8	27	62.5	58.5	0.025	0.979

reports the experiments performed to investigate India’s global spatial autocorrelation by varying the K-nearest neighbors for spatial weights. The joint count statistics of similarly colored regions (BB) are statistically significant for all experiments. It indicates that similarly colored regions surround the Indian states.

The Ripley’s G function for the observed and simulated spatially random data is shown in Figure 17. The teal-colored curve in Figure 17 illustrates that 90% of the nearest neighbor distances are less than 33,008 m. When compared with the simulated data, the proportion of observed nearest neighbor data rises sharply, indicating that the attack locations are clustered.

3.4. Sri Lanka

The AOI dataset of Sri Lanka reported 410 lethal attacks and 247 non-lethal attacks. The mean center of lethal and non-lethal attacks is situated 40.24 km apart at (8.27, 80.70) and (7.91, 80.76). The weighted mean centers of lethal and non-lethal attacks are situated 63.04 km apart at (8.32, 80.68) and (7.77, 80.56), respectively. The distance between the mean center and the weighted mean center of lethal attacks is 6.22 km. However, the same distance is only 27.25 km for non-lethal attacks. In a spatial sense, it is obvious that the intensity of lethal attacks is equally distributed among the attacks, but this is not the case for non-lethal attacks. For both lethal and non-lethal attacks, the Manhattan median continues to be closer to other central tendency measures. Lethal and non-lethal attacks have drastically varied standard deviation ellipses. The rotation of the ellipse for the lethal attack is −14.4°, but that of the non-lethal attack is merely −2.7°. In both instances, the minor axis is wider than the major axis. However, non-lethal attacks have a minor axis that is roughly the same length as its major axis, giving the ellipse a circular form.

Figure 18 depicts ECDF plots of time between consecutive lethal attacks (left) and the corresponding QQ plot (right) for the observed data. Approximately 95% of the data showed a maximum of 71 days between attacks. Sri Lanka’s longest period between consecutive lethal attacks is 1134 days. The exponential distribution for the observed attacks is shown by the QQ plot. An exponential distribution with a rate value of 23.07 days best fits the observed data.

Figure 19 illustrates ECDF (left) and QQ plots (right) of time between consecutive non-lethal attacks. Approximately 95% of the data exhibited a 195-day interval between non-lethal attacks. Sri Lanka’s longest period between consecutive non-lethal attacks is 1860 days. The QQ plot represents the exponential distribution of observed attacks. The exponential distribution with a rate parameter of 52.07 days best describes the observed data.

The spatiotemporal progression of the deadly attacks in Sri Lanka is depicted in Figure 20. No fatal attacks were reported during 1970–1979, while only one fatal incident was reported during 2010–2019. Figure 20 shows 135, 189, and 85 fatal attacks in 1980–1989, 1990–1999, and 2000–2009, respectively. Throughout the three decades, the spatial mean center remained close to the weighted mean center. These indicators have shifted from the center of Sri Lanka to the eastern border and then back to the center.

The administrative boundaries of Sri Lanka and their classification into two distinct categories based on GTI-IS density are depicted in Figure 21. A total of 14 provinces out of Sri Lanka’s 25 are below the median density level, while 11 are above. This classification’s threshold value is 0.22.

Table 9. Joint count statistics for spatial autocorrelation in Sri Lanka.

#KNN	BB	WW	BW	BB p-Value	BW p-Value
2	8	11.5	5.5	0.008	1
4	15	21.5	13.5	0.001	1
6	20.5	33.5	21	0.006	1
8	22.5	42.5	35	0.056	1

details the experiments conducted to examine spatial autocorrelation in Sri Lanka by altering the spatial weights of the K-nearest neighbors. The joint count statistics of similarly colored regions (BB) are statistically significant for all experiments, demonstrating that similarly colored regions surround Sri Lankan provinces.

Figure 22 illustrates Ripley’s G function for the real and simulated spatially random data for Sri Lanka. The teal-colored curve in Figure 22 demonstrates that almost 76% of nearest neighbor distances are less than 3536 m. The proportion of observed nearest neighbor data rapidly increases in comparison to the simulated data, indicating that attack locations are clustered.

4. Discussion

The proposed IOA heuristic successfully extracted HIAs using two different attributes, (i) nkill and (ii) GTI-IS. Venn analysis of the detected HIAs from the nkill and GTI-IS data series indicated that exclusive HIA events extracted using the nkill attribute and the composite GTI-IS value are 2233 and 1718, respectively. Both measures identified 6117 HIAs in common. As a standalone attribute, the number killed (nkill) is more capable of identifying HIAs than a composite measure, such as GTI-IS. Considering all HIAs from both input data series as attacks of interest (AOI), the heuristic flagged 32.34% of the reported incidences from Afghanistan, 25.94% from China, 22.48% from Sri Lanka, 17.85% from Myanmar, 16.67% from Bhutan, 14.74% from Pakistan, and 10.70% data from India. Within the extracted AOIs, the Taliban perpetrated the majority share (40.67%) of HIAs, with Tehrik-i-Taliban Pakistan (TTP), Liberation Tigers of Tamil Eelam (LTTE), and Communist Party of India—Maoist (CPI—Maoist) accounting for 5.43%, 4.57%, and 3.02%, respectively. Unidentified perpetrators accounted for 26.52% of HIAs. Additionally, a detailed classification of identified HIAs into multiple categories can replace the Jaccard similarity method. These categories can then be compared to perform efficacy analysis as a future contribution to the literature.

Further, this study segregated AOIs into lethal and non-lethal attacks based on the perpetrators’ choices for the most prominent weapon type and target type. Out of all the countries, the top four contributors, Afghanistan, Pakistan, India, and Sri Lanka, underwent a detailed geospatial and temporal analysis. The distance between the mean and weighted mean centers of lethal and non-lethal attacks in Afghanistan and Pakistan are very similar. However, the same is not valid for India and Sri Lanka.

This study also identified differences in the temporal characteristics of lethal and non-lethal attacks. The underlying distribution of time between lethal and non-lethal attacks is not identical for all four countries. It concludes that the perpetrators execute different kinds of HIAs, i.e., lethal or non-lethal attacks, differently.

The first-level administrative boundaries facilitated investigation of global spatial autocorrelation using the GTI-IS density of lethal attacks in each province. The study proposed a methodology to distinguish provinces based on GTI-IS densities and facilitate area-based spatial analysis. The threshold value of GTI-IS density was high for Afghanistan and Sri Lanka at 0.18 and 0.22, respectively, hinting at large attacks occurring all over the country. Similar statistics for India and Pakistan were 0.007 and 0.018, suggesting that large attacks are contained in only some provinces. Except for Pakistan, all other countries depicted high spatial autocorrelation, suggesting that the provinces in these countries have similar neighborhoods.

The application of Ripley’s G function with simulation envelope techniques indicated that most of the attacks in Afghanistan have a nearest neighbor distance of fewer than 6527 m, Pakistan at 9594 m, India at 33,008 m, and Sri Lanka at 3536 m. It alludes that the choice for lethal attack locations is very close in the cases of Sri Lanka, Afghanistan, and Pakistan, but is relatively distant in India. The spatial clustering of most attacks is also evident from this statistical analysis.

5. Conclusions

Most reported events in GTD are low-impact attacks that are usually perpetrated by radicalized individuals. The increasingly dramatic events that cause large-scale destruction have relatively fewer counts in GTD. Often these events get discarded from the analysis as outliers. However, the information provided by these HIAs is valuable in formulating effective counterterrorism strategies/tactics for each society. This mandates the need for an effective approach to extract HIAs from the GTD for analysis. This study used an IOA heuristic using two attributes, nkill, and GTI-IS, to extract HIAs for detailed analysis. The comparative analysis established the superiority of nkill in extracting richer and more diverse HIAs than the composite GTI-IS. The study identified prominent target and weapon types in HIAs and proposed a relevant classification strategy to segregate HIAs into lethal and non-lethal attacks. Further, identifying different probability distributions associated with each country’s lethal and non-lethal HIAs alluded to the need for terrorism models with appropriate granularity. Diversity in the occurrence patterns exhibited by HIAs of various countries is a crucial insight that suggests the development of focused policies for different categories of attacks to contain future threats.

Detailed analysis of the spatiotemporal evolution of attacks in each country unveiled threat progression over time and can facilitate the identification of future hotspot locations. This study proposed a methodology to segregate provinces based on aggregate GTI-IS per km² and showed that the administrative regions in countries report global spatial autocorrelation. Thus, proximity also plays a pivotal role in the case of HIAs. This observation is similar to the existing literature on transnational terrorism. Ripley’s G analysis showed statistical evidence of the clustering of attacks, where India reported the highest threshold of approximately 33 km, and Sri Lanka reported the lowest of approximately 3.5 km. The spatiotemporal analysis with various insights presented in this study suggests the need for location-specific counterterrorism policies by treating lethal and non-lethal attacks separately. Such vital insights regarding HIAs can facilitate the framing of multi-dimensional strategies/tactics that consider various dimensions, including terrorist organizations, spatial preferences, weapons, and target choices. It can also aid in the long-term understanding of these events by accommodating various socioeconomic factors to study the reasons behind the spatial choices of perpetrators.