The confrontations that follow the benchmark behavior generally feature an actor (Red, e.g. cyber-hackers, insurgents, terrorists, protestors, ultrafast traders, infant) who is in principle weaker than its Blue opposition (respectively, the national infrastructure, incumbent army, security forces, ruling government, global stock holders, parent), yet who manages to inflict a series of attacks that typically escalates (β > 0 in Figs. 2–3). We develop our explanatory model by referring to the most recent and detailed fieldwork available of such a Red group20: PIRA (the Provisional IRA) who inflicted an escalating number of attacks against the stronger British government forces (Blue) in Northern Ireland from 1969 onwards20. PIRA's operational network shown in Fig. 1D inset, has a decentralized structure consistent with jihadist operational networks9,21,23 and with other clandestine and illicit groups, e.g. online gold farmers35. Its resources – which in Fig. 1D inset are people but for more general Red may include technology, predatory algorithms (Figs. 2C–D) or even abstract cognitive processes for the case of infant (Fig. 2A)3,4 – are partitioned into clusters (‘cells’ or ‘units’) where a cluster's components do not have to be spatially close, just coordinated in some way (e.g. by phone). In short, network connections indicate empirical evidence of some coordinated activity, not spatial proximity.

Clusters can begin to coordinate together over time (i.e. clusters coalesce)9,20,21,22,29 but can also lose internal coordination (cluster fragments) under conditions of external or internal stress9,20,21,22,29, just as a cluster of animals disperses if in danger or a start-up company dissolves if it loses common purpose36. Adding the empirical finding that larger social clusters show more churn than smaller ones29, yields the simplest form of our dynamical cluster theory whose exact solution (see SI) is a Red cluster-size distribution of the form Ms−α with α = 2.5, consistent with Fig. 1D inset, with gang sizes in Asia and Chicago (α = 2.3)12 and with cyber-crowds of traders through the proxy of trade size (α = 2.5)31. Following recent empirical findings linking size to lethality14,18, we take a cluster's size as proportional to the severity of an event in which it participates, hence reproducing the severity distribution Ms−α with α = 2.5. We explored many generalizations of this theory but find that Ms−α with α ≈ 2.5 is remarkably robust (see SI). Changing the rigidity of larger Red clusters successively from more rigid to less rigid, moves the α values from below 2 to above 3, hence providing an interpretation for individual confrontations in Figs. 1A–C. Restricting connectivity between Red clusters to physical contact on a two-dimensional grid like an urban street setting or battlefield, pushes α toward 1.9 with a weaker power-law (p → 0) hence explaining most of the conventional wars in Fig. 1D and the α = 2.0 value for Chicago strikes10.

The notion that Red's self-organized, decentralized cluster structure (Fig. 1D inset) helps it adapt faster and/or better than Blue, is consistent with recent findings that organic structures are more conducive to innovation than bureaucratic ones36. Indeed, ultrafast traders (Red, Fig. 2D) carry out their attacks in under a second. We introduce x(n) to represent Red's relative advantage over Blue following the last (n'th) attack, where x(n) follows a general stochastic process. For simplicity, we set the instantaneous rate of Red attacks as proportional to x(n) when x(n) > 0 (i.e. when Red has a relative advantage) and zero when x(n) < 0 (i.e. when Blue has a relative advantage) though this can be generalized. The rate of Red attacks in a confrontation that is generally escalating, then scales as x(n)| rms ∝ nβ′ (see SI) where β′ characterizes the correlations in x(n) (β′ = 0.5 for an uncorrelated process). The time between attacks, which is approximately the inverse rate, is therefore proportional to n−β′ enabling us to identify β′ = β. This explains why τ 1 n−β describes the attack timings and implies that if β > 0.5, Red's lead over Blue follows a positively correlated process, while it follows a negatively correlated one if 0 < β < 0.5. Confrontations that de-escalate (i.e. β < 0) can be treated similarly. Our theory then reproduces the linear dependence between β and log τ 1 if we introduce coupling between the underlying x(n) processes. Such coupling could arise if the same Red entity underlies attacks in different places, e.g. in Fig. 2B the same social movement underlies protests in different locations.

Figures 1,2,3 reveal surprising dynamical equivalences between confrontations and hence offer novel data proxies and cross-domain insights: The escalation of events in Magdalena, Colombia (black oval ring) is representative of all confrontations in Fig. 3; the relative position of General Electric (GE) in Fig. 2D makes predatory trade attacks on it akin to cyber-attacks on the Hi-tech Electronics sector (Fig. 2C) which in turn mimic specific infant-parent dyads (Fig. 2A) and protest locations (Fig. 2B); and the conflict in Sierra Leone, Africa, has the same (p, α) in Fig. 1 as the narco-guerilla war in Antioquia, Colombia. Deviations from the benchmark behavior act as a novel alert mechanism for abnormalities in Red and/or Blue behavior, e.g. Angola in Fig. 1A, which serves to warn researchers against using such a confrontation as representative. The time-interval abnormality in Fig. 3 (upper inset) turns out to straddle the ‘Bloody Sunday’ attack by Blue on civilians on 30 January 1972, implying that neighboring points offer insight into the build-up to and consequences of, an extreme Blue intervention. Interestingly Bloody Sunday appears as the culmination of escalating PIRA attacks, not their trigger, hence raising new questions about its strategic importance. The fact that Belfast's (τ 1 , β) values in Fig. 3 (lower inset) destroy any linear dependence, is consistent with the recent fieldwork finding20 that Belfast's PIRA network is quite distinct to Fig. 1D inset. The fact that sexual attacks against women do not appear as an outlier in Fig. 1, hints at some hidden clustering (like Fig. 1D inset) of attackers or attacks.

We have shown that both the severities and the timings of events in a wide range of systems, follow a power-law functional form. There are various practical prediction tools and policies that follow from our work, as we now discuss. Suppose some sporadic attacks have been observed in a given location or sector in the real or online world. If the trend in successive time-intervals between attacks is found to follow τ 1 n−β, this suggests a single Red-Blue process (x(n)) underlies them. Assuming Red dominates the Red-Blue dynamic x(n) (i.e. Blue has not yet counter-adapted), this points to a single attacking Red individual or group. If attacks then emerge in different locations or sectors, detecting an approximate linear relationship in β vs. log τ 1 points to this same Red operating in these different places. Figure 2C hence supports media speculation that current cyber-attacks against different sectors of US infrastructure come from a single Red entity24. Likewise, Fig. 2D suggests that a common set of predatory algorithms and/or trading firms (Red) may underlie recent ‘flash’ instabilities in different stocks25. For Fig. 2A, the independence of the participants suggests that this linear pattern is revealing a new innate feature of how infants and parents interact.

Now imagine the scenario in which two attacks occur in a new location that was previously quiet and that this same Red is suspected. An estimate for β in this new location can be read off from the existing β vs. log τ 1 plot by inputting this single inter-event time as an estimate for τ 1 . Future attack times can then be estimated using τ 1 n−β (see SI for examples).

Next consider the severities of events as they begin to emerge in a given sector. Suppose a crude Ms−α distribution is found with α ≈ 2.5 and p > 0.05. This points to Red having a similar delocalized cluster structure to our model. Indeed, even without any observed events and hence without any event severities from which to estimate the distribution, the weight of evidence in Fig. 1 suggests that any future confrontation involving a similarly structured Red will produce a severity distribution Ms−α with α ≈ 2.5 and p > 0.05. The expected number of victims in a future attack is therefore approximately [(α − 1)/(α − 2)]s min where s min is the cut-off in the maximum-likelihood fit37. Taking α ≈ 2.5 as in Fig. 1 and s min ≈ 1, this expected number is 3, which happens to coincide with the recent Boston marathon attack. The probability the next attack will be twice as lethal, is (s/s min )1−α ≈ (s/s min )−1.5 with s = 6, giving 0.07 (i.e. 7%). The severity of the most fatal attack will grow as the number of attacks n grows, following n1/(α−1) ≈ n0.67. Dividing attacks equally into less violent and more violent, the fraction of victims falling in the most violent half is given by 2−(α−2)/(α−1) = 0.8 meaning that a few attacks will produce the majority of the victims. Another relevant consequence of our clustering theory is that the ongoing coalescence-fragmentation process means that a ‘lone wolf’ actor is only truly alone for short periods of time, which is again consistent with recent field studies22 and provides an estimate for how long ago contact was made with other Red clusters.