Detecting trends and shocks in terrorist activities

Although there are some techniques for dealing with sparse and concentrated discrete data, standard time-series analyses appear ill-suited to understanding the temporal patterns of terrorist attacks due to the sparsity of the events. This article addresses these issues by proposing a novel technique for analysing low-frequency temporal events, such as terrorism, based on their cumulative curve and corresponding gradients. Using an iterative algorithm based on a piecewise linear function, our technique detects trends and shocks observed in the events associated with terrorist groups that would not necessarily be visible using other methods. The analysis leverages disaggregated data on political violence from the Armed Conflict Location & Event Data Project (ACLED) to analyse the intensity of the two most violent terrorist organisations in Africa: Boko Haram (including its splinter group, the Islamic State West Africa Province), and Al-Shabaab. Our method detects moments when terrorist groups change their capabilities to conduct daily attacks and, by taking into account the directionality of attacks, highlights major changes in the government’s strategies. Results suggest that security policies have largely failed to reduce both groups’ forces and restore stability.

Time series

Recent advances have also been made in understanding the temporal dimension of terrorism and the corresponding trends of terrorist attacks [32], a crucial dimension that complements the analysis of terrorist social and spatial patterns [33]. Detecting trends and cycles in terrorism can help identify shifts caused by anti-terrorist operations and internal struggles between factions [34, 35]. Such detection can be done by looking at the correlation between different types of attacks [36] or time intervals between consecutive events [37]. Time series analysis can be used in terrorism analysis [38, 39] to build auto-regressive models [40], observe self-exciting processes [6, 41–43], make predictions [44], and measure some of the impacts of terrorist attacks [45, 46]. Based on terrorism time series, it has been observed that the time between consecutive events is heavy-tailed [1, 47], meaning that significant periods of inactivity are frequently observed.

Time series often display an abrupt variation due to a transition between states, known as change points. Detecting change points is a powerful technique applied in terrorism studies [48, 49]. In general, detecting change points is based on dividing a series into distinct homogeneous segments, observing the probability distributions before and after some point, and identifying it as a “shock” if the two distributions are significantly different [50, 51]. However, although time series analysis is a powerful tool in terrorism studies, certain aspects of terrorism data considerably differ from the most common time series applications. Financial time series analysis, for instance, is based on a metric μ at a specific time t, say μt, such as the value of a stock or the exchange rate between two currencies. It is possible to model the data based on some smoothing technique, such as a moving average, splines, or a kernel density estimate [52, 53], and analyse the seasonality, long-term trends, and other temporal variations [54] such as weekly fluctuations [52]. Kalman filters and correlations with other series can also be calculated to understand the data structure and its noise or predict future values [55]. In time series, where μt indicates the value of the series at that specific moment, it is possible to differentiate it or to refine the time partition by considering not only the daily exchange rate but its hourly values or even smaller time intervals.

However, in the case of terrorism, there are some challenges to applying time series techniques. The most relevant challenge is that terrorism time series corresponds to counts of events that are relatively rare, sparse and concentrated, meaning that observations have to be grouped into long intervals (such as weeks or even months) to give insightful information. Besides that, precisely identifying all the events is often impossible to obtain. For large terrorist organisations, some events are missing, whereas others might wrongly be associated with the group. Periods with low activity can indicate that a terrorist group is losing its capabilities or, instead, planning for more severe attacks [1]. Finally, events in which terrorist groups are involved have two other critical elements. One is its severity, and the other one is its directionality. In terms of severity, some events could be relatively minor (if it has no casualties, no injured people and no infrastructure is damaged), but some could be highly severe. In terms of directionality, some events are committed by a terrorist group, but the group suffers from other events, losing members and resources. Thus, an increase in the number of events between state forces and a terrorist organisation can either be interpreted as a sign that the government is progressively dismantling its opponents or, on the contrary, losing ground when faced with a powerful non-state actor.

Despite these challenges, some progress has been made to incorporate temporal data-driven models and detect shocks and pulses in similar time series. In the case of terrorism, a shifting intensity has been used to model a self-exciting terrorist activity [6], detect the factors which alter terrorist groups’ failure [56–58], or analyse the duration of peacetime periods between consecutive attacks [59], based on the premise that the daily intensity should observe shifts after major and significant changes in the group or its environment.

https://doi.org/10.1371/journal.pone.0291514.t001

https://doi.org/10.1371/journal.pone.0291514.t002

Abrupt changes and a stepwise intensity of events

The date, number of casualties, and type of event are considered for each event. The data consists of an ordered sequence of a finite number of n events, e1, e2, …, en, which correspond to the time at which each event occurs. From the n events, we construct the series yk as the cumulative number of events which have occurred before time τk as (1) where the function H(x) is the Heaviside step function, where H(x) = 1 if x ≥ 0 and zero otherwise. The series y1, y2, …, ym consists of m observations corresponding to the cumulative number of events on m days. The objective is to approximate the series yk by a piecewise linear function and analyse the linear pieces and their gradients and shifts.

Consider the expected cumulative curve of events up to a specific time, assuming some background rate of events. Formally, let C(t) be the expected cumulative number of events C of a specific type, from time t0 = 0 until time t > 0 in days. We model the daily number of events as an inhomogeneous point process with a time-varying intensity function λ(t). That is, we assume that the number of events on the day t is a point process with a time-varying rate λ(t). The underlying Poisson distribution of the point process is frequently used to model discrete counts of events, such as incorrect criminal verdict [61], casualties in interstate wars [62], armed conflicts [63], gang-related violence [64], or the impact of incarceration [65].

Our approach assumes that events are a point process resulting from a background distribution with a time-varying rate. We assume that the underlying distribution of the point process is Poisson, meaning that the number of events for the day tj follows a distribution Po(λ(tj)). The expected number of events on a day tj is given by λ(tj), meaning that the number can be directly interpreted for the distribution. Further, the distribution can be considered for more extended periods. For example, for a set of days, say [tj, tj+1, …, tj+k] the expected number of events is given by , so it provides an easy approximation for the expected number of events for longer intervals. A point process with a time-varying rate as the background intensity function is frequently used to model crime counts [66, 67] since it ignores small fluctuations but focuses on the daily rate λ(t). The function λ(t) ≥ 0 is known as the “intensity” of the events, and it is interpreted as the expected number of daily events in which a terrorist organisation takes part after the small fluctuations are removed. Thus, it permits us to observe the general evolution of violence instead of daily oscillations, which are often misleading.

Here, we are interested in abrupt changes in the intensity function λ(t). The intensity λ(t) is modelled as a stepwise function with multiple change points [68], so we assume that it is constant for some a set of days and then shifts from λ1 to λ2 at a certain break, and then shifts to λ3 and so on. Each λi corresponds to the daily rate, and the breaks correspond to events which alter the organisation’s capacity. The rate λ(t) is a step function. Let 0 = t1 ≤ t < t2 be the first interval, such that we can express λ(t) = λ1 ≥ 0. For t2 ≤ t < t3, we express λ(t) = λ2 ≥ 0 and so on for each interval. The expected number of cumulative events C(t) is obtained as (2)

That function can be expressed as a continuous piecewise linear non-decreasing function, for t ≥ 0 as (3) where κ is the number of intervals, and where the coefficients are defined by λ1 = β1, λ2 = β1 + β2, and in general λj = β1 + β2 + ⋯ + βj.

It is possible to model the number of events on a single day using other discrete distributions, such as a Binomial, Negative Binomial or even a Multinomial distribution. However, they require fixing some parameters, such as the maximum number of events on a single day. The Poisson model depends on a single parameter that matches the expected number of events on that day, so its interpretation is straightforward. It is also possible to extend the Poisson distribution to model events that trigger the occurrence of further events. A self–exciting process is based on the idea that the rate of events λ(t) can be modelled depending on the events that have occurred up to time t. A self-exciting process is one type of extension to the Poisson model where the function λ(t) is assumed to jump after the occurrence of an event, with a subsequent cooling down process, capturing some retaliation. This model has been used to model burglaries, gang violence, and terrorist events [6, 27, 36, 64, 69, 70].

Parameter estimation

For parameter estimation, the first step is to detect if a homogeneous -constant- rate is sufficient for explaining the observed data. During m days, there were n events, so the rate λ0 = n/m is the estimated daily rate of events with no jumps or breaks. Based on this rate, it is possible to simulate the number of events. For each day, a Poisson distribution is considered SiPo(λ0) reflecting the possible number of events under a homogeneous rate. The simulated cumulative number of events S1(t) = ∑i≤tSi then is computed. In our case, the random sampling process is repeated a sufficiently large number of times, fixed at 100 repetitions. An arbitrarily large number, such as 100, is frequently used for simulating a point process to produce possible extreme values and intervals. A similar type of test, also using 100 repetitions, is frequently used to detect if the distribution of a spatial point process corresponds to one with a homogeneous rate [71]. With this process, we obtain the simulated number of events S1(t), S2(t), …, S100(t). For day t, we have 100 observations reflecting the possible number of events that could be observed under a homogeneous rate. We drop the top and bottom two observations to remove possible simulation outliers. We compute the lower bound, defined as Sl(t) = miniSi(t) and the upper bound, defined as Su(t) = maxiSi(t). These two simulated observations capture departures expected in the cumulative number of events assuming the homogeneous rate λ0. We then compare the simulated bounds [Su(t), Sl(t)] against the observed one C(t). If C(t) is outside the [Su(t), Sl(t)] for some days, then we reject a homogeneous rate.

Having rejected a homogeneous rate, the procedure then is to estimate those varying rates. We follow an iterative process to estimate the daily rate of events with an unknown number of breaks. We start with κ = 1 breaking point and estimate the rate of events assuming that the data has one point in the first observation (so the first day of the data). Then we iteratively add one extra breaking point and estimate the daily rate of events with κ breaking points. For κ breaking points, we need to estimate their location (the day of the intensity shifts) and the rates between each shift. The expected number of cumulative events C(t) depends on the location of such breakpoints 0 = t1, t2, …, tκ+1 and the gradient parameters β1, β2, …, βκ. They are obtained by minimising the Sum of Squares Error (SSE) between the observed number of cumulative events yk and the expected one C(tk) as (4) where 2κ+1 is the number of parameters estimated. The parameters βi are derived as a piecewise linear regression, using a package for segmented relationships in regression models called Segmented [72, 73]. This method implements a form of gradient descent to minimise the SSE concerning the breaking points and the rates.

With κ = 1, the intensity of events is constant, and we get that λ(t) = β1 = n/m. This way, the expected number of events after m days is exactly n, so C(t) = β1t, for t ≥ 0, where β1 is the daily speed at which events are accumulated. The rate β1 is the expected number of events per day. With κ = 2 there is a breaking point in t2, such that C(t) = β1t + β2(t − t2)H(t − t2), which means that for values of t in the [0, t1) interval, the speed is β1 and for values of t ≥ t1, we get that C(t) = (β1 + β2)t − β2t1, so that the speed of events, after t2 is (β1 + β2). For more intervals, with κ > 2, the piecewise speed is given by for t ∈ (ts, ts+1). Eq 3 gives a continuous non-decreasing function, where λj = β1 + β2 + ⋯ + βj, so that at all times, the speed of events stays non-negative.

The number of breaks on the series is unknown, and, as with many other data techniques, no rule applies to all cases [50]. In general, by adding more breaks, intervals between consecutive shocks get narrower and, eventually, too thin to be considered a trend. Thus, for the application of terrorism data, we assume that a shock and a change in the daily rate of events should be observed for roughly one month to be considered a shock. Thus, we stop the iterative procedure when any interval contains less than 30 days. It depends on the type of data considered and its length: 3,935 days of data are available for Boko Haram against 4,955 days for Al-Shabaab. Therefore, with our 30-day rule, we finish the procedure with 13 breaks for Boko Haram and 16 breaks for Al-Shabaab.

We combine the rates obtained for different breaking points into a single rate for each day by considering the mean and lower and upper bounds to obtain departures of the daily rate. Formally, for day t, the obtained rates for s breakpoints λ(s)(t), for s = 1, 2, 3, …, κ, are considered. We define the rate as , and upper and lower values give us the corresponding intervals. The daily rate λ(t) is the expected number of daily events in which a terrorist organisation participates.

The daily rate λ(t) combines piecewise linear functions. The values obtained for the daily rate λ(k) help us construct intervals for the number of observed events. For day k, we simulate a point process sk for the number of events, and then, we consider the cumulative number of events . Following the same procedure a sufficiently large number of times (in our case, set to 100) and removing the simulated outliers, we obtain an interval for the expected number of cumulative events by day k. The principle is the same as the one applied to reject a homogeneous rate. Instead of a unique value of λ0, we use the varying λ(t). The obtained intervals capture the departures and variability given our estimated daily rate.

The λ(t) is a step function with up to κ(κ + 1)/2 breaks. However, some of those shocks might reveal almost negligible shifts in the daily rate, whilst some might show drastic changes in the before and after rates. Our method for detecting shocks from a series of events is based on the cumulative sum of the distribution and observing when the cumulative sum departures exceed a specified threshold [74]. We say that a shock happened at some time τ if |λ(τ + 7) − λ(τ)| > 1.2λ(τ), meaning that the rate varied by more than 20% in less than one week, and the events near those dates identify the shocks. Although our definition of a shock is based on the arbitrary 20% increase or decrease in the rate, it results in a manageable number of events to interpret. This method’s effectiveness depends on the data being considered, particularly the length of the period, the number of events, and their variability.

In sum, we use the cumulative curve as a series of n observations, representing the total number of events before each day. First, we test whether a homogeneous rate is sufficient for explaining the fluctuation of events. If the homogeneous rate is rejected, a constant rate of events is insufficient to explain the data, so we estimate a time-varying rate. The cumulative curve is then approximated by a piecewise linear function, considering an increasing number of breaking points. The daily rates for a different number of breaking points are combined by computing the mean considering intervals. It is possible to simulate the number of events for each day from the daily rates. Then, shocks are obtained by detecting moments where the daily rate varies drastically over a short period (Fig 1).

Fig 1. Model based on the cumulative number of events.

The number of events in a certain time interval, plotted as marks in the top part, forms the cumulative number of events (red polygon in the middle part). The cumulative curve is estimated by a piecewise linear function with a specific number of breaks (the yellow and the purple polygons in the middle part, with one and three breaks as an example). Each section’s gradient is considered the organisation’s daily rate from the piecewise linear function, represented as the yellow and purple polygons in the bottom part of the figure. The corresponding rates are combined (below) into the average rate (orange line) for each day in the analysis.

https://doi.org/10.1371/journal.pone.0291514.g001

The obtained daily rates inform a single day’s expected number of events. Rather than detecting a single day with many events, our method picks on substantial and sustained changes in the daily rate. Shocks are detected and analysed based on the political and social events that could have caused an increase or decrease in the rate of terrorist events around those dates. Events are filtered using the corresponding labels to analyse other aspects, such as the specialisation or the objectives. The cumulative curves and daily rates are constructed following the same procedure.

From the observed data to the daily rate

A simple example shows how to estimate rates from some data. Fig 2 has 20 days of simulated data. The first ten days were obtained from a point process with a rate λ1 = 1 and the next ten days with a rate λ2 = 4, so we expect 50 events. We observe fluctuations in the daily number of events, even with a fixed rate. For instance, there are zero or two events during the first ten days even if the rate is λ1 = 1. The cumulative number of events is then constructed. The change in the daily rate is quite noticeable. Before day ten, for every k days, we expect to accumulate k events, but after day ten, for every j days, we expect 4j events.

Assuming no rate jumps, the estimated intensity gives . This estimation (orange polygon) does not resemble the observed data well (it misses the break in the middle). We add one break to the estimation (purple polygon) and obtain that the SSE drops from 1364 to 153. There seemingly is a third jump around day 16. Due to randomness, days 11 to 16 seem to have a higher intensity than the subsequent days. We obtain between days 11 and 16 and a rate of from days 17 and 20 with the value of the SSE going from 153 to 100. With four breaks, the SSE does not decrease further, so we stop with three breaks. Notice that the jump in day 16 is only due to randomness. In general, this is the case since the background rates are unknown. With an unknown number of jumps, we average the rate for each day by considering all values obtained for a different number of jumps. In the example, by taking the average with up to two jumps, we get an estimated rate of between days 1 and 10; an estimated rate of between days 11 and 16, and an estimated rate of for days 17 to 20. We report a shock on day ten only since the jump in day 16 alters the rate by less than 20%.

Boko Haram events

First, we test a homogeneous rate. For Boko Haram, we observe that λ0 = 1.28, so if events followed a homogeneous rate, we would expect 1.28 each day. By March 24 2014, there were 950 events, while with a homogeneous rate, we would have expected between [Su(t), Sl(t)] = [2112, 2355]. Therefore, we reject a homogeneous rate. We proceed with the stepwise model. The cumulative number of events at the top of Fig 3 suggests that Boko Haram and ISWAP experienced prolonged periods when they could produce roughly the same impact daily (straight lines), for example, from 2016 to 2018. The figure also suggests several breaking points during which the cumulative distribution of events is no longer linear, as in 2012 or 2020. One can assume that these breaks correspond to changes in leadership between competing factions or intense pressure from counter-insurgency forces that have forced Boko Haram and ISWAP to continuously adapt their military strategy and tactics. The bottom of the figure represents the same evolution by disaggregating violent events into three categories: battles, violence against civilians, and remote violence.

The data shows that until early 2015, the number of battles and attacks against civilians increased roughly at the same speed. This changed rapidly after the Nigerian military and the Multinational Joint Task Force (MNJTF) launched a series of counter-offensives that contributed to weakening Boko Haram and accelerated internal divisions within the organisation. In March 2015, Boko Haram pledged allegiance to the Islamic State during the worst possible moment for the organisation. Shortly afterwards, Boko Haram splits into two competing factions, one led by Abubakar Shekhau and the other by Abu Mus’ab Al-Barnawi, known today as ISWAP. These events led to a temporary decrease in the number of attacks against civilians and a growing number of armed clashes between government and insurgent forces, which exceeded the number of attacks against civilians until the end of 2017. The increasing gap between the two types of attacks during this period suggests that Boko Haram and ISWAP were increasingly fighting a coordinated military force. The number of events that led the government to regain territory, shown at the bottom of Fig 3, increased accordingly. Since 2018, attacks against civilians have resumed and expanded considerably.

A total of 12 breaking points can be observed in the Boko Haram time series for nearly 4,000 days of data, corresponding to 13 different segments from January 2010 to March 2020. Some of the breaking points correspond to rapid changes in event rates and can be classified as shocks (Fig 4). The first shock was observed in the first week of November 2010. Before, Boko Haram took part in roughly one event every 16 days, but it took part roughly in one event roughly every 3 to 4 days, becoming a pervasive problem in Nigeria. A few months later, a second shock was observed in April 2011, a few days after Goodluck Jonathan won the presidential election. The daily rate of events went from roughly one every three days (so λ = 1/3) to one every day (so λ = 1). Boko Haram started a bombing campaign that targeted the Nigerian police and United Nations in the federal capital of Abuja before launching a series of deadly attacks against Christian churches. In December 2011, President Jonathan declared a state of emergency in the northern part of the country and shut land borders with Cameroon, Chad and Niger to prevent militants’ movement to neighbouring countries. These measures were followed by a period of relative calm, with some shocks recorded in the daily rate of events between 2012 and 2013, such as the April 2013 Baga massacre, whose responsibility is disputed.

The next major shock occurred in early 2014 when the daily rate of events nearly doubled. This period corresponds to a surge in Boko Haram activities, particularly against civilians, who were more regularly killed or kidnapped by the insurgents [75] and by increasing clashes between Boko Haram, government forces and allied militias, such as the Civilian Joint Task Force (CJTF). The Nigerian government launched a series of military operations against Boko Haram, without much success, due to the inadequate training, corruption and lack of equipment of the Nigerian army.

In 2015, Boko Haram reached its most significant territorial expansion and committed numerous massacres in Borno State that culminated with the killing of up to 2000 civilians in the city of Baga and the destruction of the headquarters of the MNJTF in January. The Nigerian military responded to the degradation of the security situation with a large-scale offensive launched under the umbrella of the MNJTF. Forces from Chad, Cameroon, and Niger supported the Nigerian military in a series of coordinated attacks that inflicted heavy losses on Boko Haram and forced the organisation to relocate to remote areas such as the Mandara mountains of Cameroon or the islands of Lake Chad. The last major shock occurred in 2019 when the insurgents regained power in the countryside, from which the military retreated.

Directionality of events

Thus far, our analysis has considered all violent events in which Boko Haram and ISWAP had been involved, either as perpetrators or as targets of attacks. However, an overall increase in the number of attacks associated with one organisation can either mean that it is becoming more dangerous or that the government is increasingly targeting it. For this reason, distinguishing between perpetrators and targets of a terrorist incident is crucial to understanding long-term shocks and trends. In what follows, we analyse the notes associated with each event to determine the directionality of each attack recorded since 2010. For each event, we determine if it was committed by Boko Haram, ISWAP and their adversaries or against them. For example, if ACLED mentioned that Boko Haram members attack civilians on the island of Boram, we considered that Boko Haram was responsible for the attack. If, on the contrary, ACLED mentioned that Military forces launched a raid on a Boko Haram hideout in Bulabulim, we assumed that the event was committed against Boko Haram. Civilians were always considered victims of violent events.

The results show that Boko Haram and ISWAP were responsible for 69.5% of the 5,048 events observed in the region. Military, police and state forces were accountable for 24.6% of the events. Other actors, including vigilantes, initiated 1.1% of the events (Table 3). In some cases, we were unable to determine the directionality of attacks. This is the case for several battles between military forces and Boko Haram. For example, if ACLED mentioned that Boko Haram and military forces clashed in Amchide, both actors can be seen as perpetrators or victims of the event. These incidents, representing only 6.7% of the events, were classified in a separate category.

The directionality of attacks allows us to understand better the evolution of the daily rate of attacks of Boko Haram and ISWAP (Fig 5). Generally speaking, while Boko Haram and ISWAP experience significant fluctuations in the number of events committed against their common enemies, government forces retaliate at a considerably lower rate. The daily rate of events committed by Boko Haram and ISWAP was nearly 0 in 2010 and increased rapidly over the decade, reaching one daily event in 2018 (λ2018 = 1). Since 2018, the daily rate of attacks by Boko Haram and ISWAP has more than doubled, while the rate of events against the two Jihadist organisations has remained stable (λ = 0.5). These findings suggest that Boko Haram and its splinter group are primarily responsible for intensifying the northern conflict and that government forces are mainly unable to cope with the steady increase in attacks.

The cumulative curve of events (Fig 5) highlights some crucial breakpoints in the speed of accumulation of events, particularly when it comes to attacks against civilians, as during the Christmas Events (2012), the Chibok kidnapping (2014), or the Baga massacre (2015). These key events become even more visible when the data is disaggregated by event types (Fig 6). Both figures suggest that Boko Haram and ISWAP have targeted government forces and civilians alternatively, depending on the strength and willingness of the Nigerian military and its allies to fight. In other words, the contrasting evolution of the daily event rates of the insurgents and government forces is explained by changes in the military strategies of the Nigerian army, by far the largest in the region.

From 2010 to 2015, Boko Haram was equally active in fighting the military and attacking civilians, a situation that reflected both the weakness of government forces and its inability to protect local populations effectively. The growing involvement of Nigerian forces since 2015 has forced Boko Haram to respond more aggressively to the military. As a result, 1.8 armed clashes were recorded for each attack against civilians. The peak in government attacks against the insurgents was reached in early 2015 following the MNJTF intervention. This major effort was followed by a series of military operations that progressively exhausted the fighting capability of Nigerian armed forces without eliminating Boko Haram and ISWAP permanently from the region. In 2016, for example, the Nigerian military launched two operations (Crackdown and Rescue Final) to destroy insurgents and rescue hostages in the Sambisa forest and two other operations (Karya Gwuia and Hard Knock) against Boko Haram camps in southern Borno State and the Lake Chad region. In 2017 and 2018, the Nigerian Army renewed its efforts against the stronghold of the Sambisa forest (Operation Deep Punch I) and the Lake Chad basin (Deep Punch II and Last Hold) [8].

The Nigerian military has gone on the defensive in recent years. This allowed Boko Haram and ISWAP to expand in several rural regions of northern Nigeria and continue their attacks against civilians and government forces. Soldiers stationed in the countryside lacked the firepower and military training necessary to fight insurgents successfully, and, as a result, their forward outposts were systematically overrun. Mobile patrols were also increasingly targeted by the insurgents, making outposts even more challenging to support in case of attack. As troops’ morale and willingness to fight insurgents quickly declined, the Nigerian military announced in 2019 that its soldiers would be pulled back from their forward posts and gathered in fortified camps. Nigerian troops and thousands of civilians were gathered in “super camps” inside garrison towns such as Bama or Monguno, leaving Boko Haram and ISWAP to fill the void left by government forces in the countryside [76]. Today, the daily rate of attacks by the government is well below that of Boko Haram and ISWAP and declining. The lowest daily rate of attacks against Boko Haram and ISWAP was reached in 2019 when the government decided to withdraw from the countryside.

From a tactical perspective, a noticeable change is the increasing use of suicide attacks by both Boko Haram and ISWAP between 2015 and mid-2018, with more than one event per week. Before Boko Haram conducted its first suicide attack in Abuja in June 2011, this tactic was virtually unknown in Nigeria. The use of suicide bombers in the country is explained by some observers by the influence of more globalised violent extremist organisations such as Al-Qaeda and Al-Shabaab [77]. Boko Haram has capitalised on other extremist organisations’ training and experience to develop this technique that now involves female suicide bombers [78, 79]. In the Lake Chad region, suicide bombings committed since 2011 have overwhelmingly targeted civilians (76%) rather than government buildings and military forces (6%) and have primarily been concentrated in Nigeria, where 80% of all fatalities are recorded. Yet, from early 2018, the number of suicide bombings has decreased to a minimal number by 2020.

Constructing intervals and breaking points

Taking into account the daily rate of events committed by and against Boko Haram and ISWAP, results show that the simulated intervals are a narrow band, with departures that are roughly 5% of the expected number of events (Fig 7). Furthermore, the observed number of cumulative events falls inside the obtained intervals. Thus, the obtained values of the daily rate λ(k) capture the daily fluctuations in how Boko Haram and ISWAP commit events.

Between two and eight breaking points, the most extended segment has at least 360 days, corresponding to an estimated rate of nearly a year. Between 9 and 13 breaking points, the smallest interval has at least 29 days, which means that our results estimate the daily rate for a month. Beyond 13 breakpoints, the segments are smaller. Seven shocks in the daily rate of events by Boko Haram are identified, the first in September 2010 and the latest in November 2019 (Table 4).

No shock was identified for the events committed by Boko Haram between February 2012 and November 2018, although the rate was not constant. Instead, it means that the transitions were relatively smooth and progressive. Also, eleven shocks are identified in the events committed against Boko Haram and ISWAP, three of which reduce the daily before-and-after rate of events (Table 5).

There are other methods for detecting shocks, although many of them are based on the assumption that the underlying distribution has some Gaussian noise [80, 81]. In the case of a discrete distribution, including daily counts such as the terrorism time series, the techniques are more limited. We validate our results with the E-Agglomerative algorithm for change point that gives a divisive hierarchical estimation algorithm for multiple change point analysis [82]. We detect an overlap in roughly 70% of the detected change points for the different time series we analysed, confirming that there are moments where the point process has changed its daily rate.

The number of shocks depends on the threshold accepted as a jump in the seven-day moving average of the before-and-after rates. With a small threshold, relatively small shocks are detected, with up to 60 shocks for the events against Boko Haram and more than 40 for the events by Boko Haram (Fig 8). With a higher threshold, fewer -but more impactful- shocks are detected. With a threshold of 40% in the before and after rates, only one shock is detected in the daily rate of events by Boko Haram and three shocks in the daily rate of events against it.

An application to Al-Shabaab events

Al-Shabaab (“The Youth” in Arabic) is a radical extremist organisation affiliated with Al-Qaeda whose political goal is to overthrow the Somali government and establish a new societal model based on a strict interpretation of Islamic law in the Horn of Africa [83]. Founded in late 2006 as a splinter group of the Islamic Courts Union (ICU), Al-Shabaab has become one of the most active militant groups in Africa [84]. The organisation has been involved in more than 14,000 attacks against the Somali government and the African Union Mission in Somalia (AMISOM), killing more than 35,000 people, according to ACLED. While Al-Shabaab has perpetrated spectacular attacks in neighbouring Kenya, most of the violent events and fatalities involving Al-Shabaab since the mid-2000s are located in Somalia (>95%).

We apply our technique to the Al-Shabaab events to test our method in a separate case study. The first Al-Shabaab event recorded in the ACLED database happened in August 2006, and more than 13,000 events have occurred since then (Fig 9). On average, there are 2.7 events each day. We test whether a homogeneous rate λ0 = 2.7 works for fitting the data. By June 2012, there were 2,129 events, but with a homogeneous rate, we expect between [Su(t), Sl(t)] = [5537, 5833] events. Thus, we reject a uniform event rate. Like Boko Haram, the data shows that Al-Shabaab is becoming stronger, with nearly four events each day in the past year but only one event each week during their first year of operations. Having rejected a homogeneous rate, we follow our procedure and look at the cumulative curve (as in Fig 1).

We obtain κ = 16 breaking points (Fig 10). After December 2007, Al-Shabaab participates in roughly 0.8 events daily, and this rate has been mostly stable for over two years. In February 2012, Al-Shabaab pledged allegiance to Al-Qaeda, which corresponds precisely to a shock that increased the daily number of Al-Shabaab events by nearly 75%. From 2012 to 2017, Al-Shabaab had roughly the same rate of 3.6 daily events with more than nine casualties daily. During this period, the terrorist group was heavily targeted by AMISOM, withdrew from the capital of Mogadishu, and largely avoided major battles. In early 2017 there was a shock when the daily number of Al-Shabaab events considerably increased from less than four events each day to more than five. For nearly a year, Al-Shabaab had its most intense and violent episode, with more than 37 events and 92 casualties each week. This period corresponds to a major resurgence of the group, which conducted numerous suicide attacks in Somalia and Kenya and considerably expanded its influence in rural areas. In total, Al-Shabaab has participated in more than 21 events each week since late 2012, with more than 50 weekly casualties.