Quantitative Analysis of Global Terrorist Attacks Based on the Global Terrorism Database

Abstract

Terrorist attacks have become a serious source of risk affecting the security of the international community. Using the Global Terrorism Database (GTD), in order to quantitatively study past terrorist attacks and their temporal and spatial evolution the analytic hierarchy process (AHP) was used to classify the degree of damage from terrorist attacks. The various factors influencing terrorist attacks were extracted and represented in three dimensions. Subsequently, using MATLAB for analysis and processing, the grading standards for terrorist attacks were classified into five levels according to the degree of hazard. Based on this grading standard, the top ten terrorist attacks with the highest degree of hazard in the past two decades were listed. Because the characteristics and habits of a terrorist or group exhibit a certain consistency, the K-means cluster analysis method was used to classify terrorists according to region, type of attack, type of target and type of weapon used by the terrorists. Several attacks that might have been committed by the same terrorist organization or individual at different times and in different locations were classified into one category, and the top five categories were selected according to the degree of sabotage inflicted by the organization or individual. Finally, the spatiotemporal evolution of terrorist attacks in the past three years was analyzed, considering the terrorist attack targets and key areas of terrorist attacks. The Middle East, Southeast Asia, Central Asia, and Africa were predicted to be the regions that will be most seriously affected by future global terrorist events. The terrorist attacks in Southeast Asia are expected to become more severe, and the scope of terrorist attacks in Africa is expected to widen. Civilians are the targets most at risk for terrorist attacks, and the corresponding risk index is considerably higher than it is for other targets. The results of this research can help individuals and the government to enable a better understanding of terrorism, improve awareness to prevent terrorism and enhance emergency management and rescue, and provide a solid and reliable basis and reference for joint counterterrorism in various countries and regions.

1. Introduction

Terrorism is a complex political and social phenomenon [1,2]. Terrorist attacks are obviously destructive and violent. They have become one of the greatest threats to the peace and security of the international community and have become a hotspot of global concern. Terrorist attacks can be defined as involving illegal or criminal violence, threats or sabotage activities conducted by non-governmental organizations to achieve political, economic, religious or social goals through threats, coercion or intimidation [3,4]. Policymakers and pundits tend to cast terrorist attacks as either rational acts of crass material self-interest, or mental abnormality [5,6]. Terrorist attacks often target civilians [7], not only endangering people’s lives and property, but also affecting the order and stability of the entire society. Terrorist attacks, as unconventional emergencies, often cause a large number of casualties and have a huge social impact.

Terrorist activities intensified around the world after the Cold War. Various forms of terrorist attacks have become increasingly rampant and are a major public nuisance for the international community; presently, these attacks are the most severe security challenge facing the world [7,8,9,10]. In particular, several major vicious terrorist attacks have occurred in recent years, such as the Kunming Railway Station terrorist attack in China on 1 March 2014; Thailand’s four-faced Buddha bombings on 17 August 2015; the Paris, France terror attacks in November 2015; the terrorist attack in Nice, France on 14 July 2016; and the Sri Lanka bombings on 21 April 2019 [11,12,13], all of which caused critical overall damage. Therefore, evaluating the damage degree of terrorist attacks, determining the location of the perpetrators of terrorist attacks, and analyzing the future global situation regarding antiterrorism have become important topics pertaining to anti-terrorism research. Effective counterterrorism strategies and emergency rescue plans can be formulated only by conducting research on terrorist attacks, and analyzing the various factors influencing terrorist attacks. Several analytical studies on terrorist attacks have been conducted by different researchers. Risk assessment is essential for managers to control risks and make decisions [14]. The assessment of potential terrorist attack risks can improve the purpose of counter-terrorism, for example, reducing the possibility of a target being attacked and reducing the degree of destruction of the target [15,16]. Regarding the risk assessment of terrorist attacks, Guo Xuan et al. [17] proposed a risk assessment model for civil aviation airport terrorist attacks, based on event tree analysis (ETA) and probabilistic risk analysis (PRA), and used the model to simulate events considering aspects such as the terrorist attack mode, intrusion path and loss probability. From the four aspects of terrorism that have been determined based on the global terrorism database (GTD), specifically, the power law of frequency-fatalities, relationships between fatality levels and influential factors, spatial aggregation and spatial autocorrelation and risk assessment, Li Guohui [16] established a risk assessment model and risk distribution map. Based on the scenario risks associated with different terrorist attacks, Garrick et al. [15] developed a method for quantitatively assessing the risk of terrorism that focused on the catastrophic consequences of terrorist attacks. Ezell et al. [18,19] explored several existing and potential methods of risk analysis, and argued that PRA and ETA were effective methods for assessing the risk of terrorism, especially for the baseline comparison, in terms of risk generation. With the rapid development of terrorist organizations, especially international terrorist attacks, it has been difficult to counter it with the power of only one country. This problem requires improved research on the temporal and spatial distribution characteristics of terrorist attacks [20,21]. Regarding the temporal and spatial evolution of terrorist attacks, Siebeneck et al. [22,23] analyzed the spatial and temporal evolution of terrorist attacks in Iraq from 2004 to 2006, and used the geographic information system (GIS) to carry out a series of spatial and temporal cluster identification analyses regarding recent terrorist incidents in Iraq. Based on the GTD, Wei Zhenzhen [24] analyzed the consequences, sources and characteristics of post-9/11 terrorist attacks, and found the six major status quo and four major development trends of terrorism in the post-9/11 era. The status of international terrorism and terrorist attacks after the Iraq war was analyzed by Chen Jing [25], who noted that five major trends were present in the current development of international terrorism, and proposed counterterrorism measures against these five major trends. Clauset [26,27] proposed a frequency model for several terrorist attacks that predicts the severity of terrorist attacks in the form of an exponential function; the author next verified the effectiveness of the model through subsequent terrorism and terrorist attacks. Later, Clauset et al. [28] conducted static and dynamic analyses on global terrorist attacks from 1968 to 2008 and observed that the occurrence of violence tended to accelerate with the increase in scale and experience. Abrahms [29] studied 125 violent substate campaigns to assess the effectiveness of terrorism empirically. Drawing on political psychology, he explained why terrorist campaigns against military targets are significantly more effective than campaigns against civilian targets at inducing government concessions. Nearly 600 terrorist attacks in various regions of the United States from 1990 to 2011 were studied by Lafree [30,31], who found that terrorist attacks were more common in regions characterized by residential instability and high urbanization, and recommended that researchers and decision-makers should focus more on the underlying connections among measures of social disorganization, participation in terrorist attacks, and law enforcement. However, most of these studies were qualitative descriptions and lacked a theoretical basis. Only a few studies involved the performing of a quantitative analysis of terrorist attacks by considering the various influential factors.

Unlike natural disasters, such as earthquakes and typhoons, terrorist attacks have the characteristics of premeditation, suddenness and sociality, and they evolve spatially and temporally [32]. Not only is it necessary to strengthen intelligence collection regarding recent terrorist attacks, but historical terrorist attacks must also be analyzed thoroughly to quantitatively study their temporal and spatial evolution. In this study, based on the GTD, the analytic hierarchy process (AHP) was used to classify the damage degree of terrorist attacks, and the various factors influencing terrorist attacks were extracted and represented in three dimensions. The K-means cluster analysis method was employed to classify the terrorists according to their common weapons, locations, attack methods, etc., and the terrorist attacks were analyzed from a quantitative perspective. Finally, the temporal and spatial evolution of terrorist attacks were analyzed from two aspects, the targets of terrorist attacks and the key areas of terrorist attacks. The research results are helpful for improving the pertinence and effectiveness of anti-terrorism strategies.

2. Global Terrorism Database

Current internationally published terrorism databases mainly include the global terrorism database (GTD), the RAND database of worldwide terrorism incidents (RDWTI), the “International Terrorism: Attributes of Terrorist Events” dataset (ITERATE), the world incident tracking system (WITS), and the “Terrorism in Western Europe: Events Database” (TWEED). Among these, the GTD is the most comprehensive database of terrorist incidents; it is open-source and includes information regarding terrorist events worldwide from 1970 through 2017. Unlike many other event databases, the GTD includes systematic data pertaining to transnational and international terrorist incidents that have occurred during the specified time period, and now includes more than 180,000 incidents. For each GTD incident, information regarding the date and location of the incident, the weapons used and the nature of the target, the number of casualties, and—when identifiable—the group or individual responsible, is available [33]. The terrorist attack data analyzed in this study were obtained entirely from the GTD (http://www.start.umd.edu/gtd/, accessed on 30 April 2020).

In this study, data in the GTD regarding terrorism incidents were selected to analyze the characteristics of terrorist attacks. First, using the advanced search function of the GTD database, all the terrorist incidents since the beginning of the 21st century were retrieved according to the time, and an Excel file was exported. Second, according to the types of attacks, weapons, target/victim types, murder information, damage results and other variables, the terrorist events were categorized and relevant data were obtained. The AHP method was used to rank the damage degree of the retrieved terrorist attacks, and the ten terrorist attacks involving the highest degree of harm in the past two decades were listed. In addition, six terrorist attacks that occurred in 2015 and that have not been categorized were selected. The K-means cluster analysis method was used to classify terrorists according to the region, type of attack, type of target, and type of weapon they used. Finally, the terrorist attacks that occurred from 2015 to 2017 were retrieved, and the GTD world maps for the period 2015–2017 were downloaded. The terrorist attacks over the past three years were analyzed, considering the two aspects of terrorist attacks and the key areas affected.

3. Assessment of Terrorist Attacks

Terrorist attacks are associated with mass destruction and can incur considerable casualties and property losses. Such events can lead to tremendous psychological pressure on people, cause a certain degree of turmoil in society, and hinder normal work and life order, thereby considerably hindering economic development. By grading the degree of damage associated with terrorist attacks, the severity of the damage caused by terrorist attacks on their targets can be clearly observed.

3.1. Establishment of an Evaluation Index System

3.1.1. Principle of Indicator Selection

Establishing an evaluation index system of terrorist attacks is a complex process involving factors related to the economics, culture, antiterrorism techniques, management, and other aspects of the attacked region. The process is also related to the organization that initiates the terrorist incident. A large number of cases must be considered to establish a risk classification system that corresponds to most terrorist incidents. The screening of hazard level indicators for typical terrorist incidents should follow the principles of rationality, comprehensiveness, the consideration of dynamics, systematization, and standardization.

3.1.2. Index Selection and the Construction of an Indicator System

The establishment of evaluation indicators is based on the case summary of the GTD database above. The factors that affect the consequences of terrorist attacks are identified and combined with the research experience of scholars to classify and summarize the corresponding indicators.

The analysis was performed by considering a large number of terrorist attacks and related references. Correctly evaluating the hazard level of terrorist attacks requires full consideration of the time, place, attack method, casualties and impacts of terrorist attacks; the evaluation factors and indicators of event grading were extracted based on this concept.

The grading factors of terrorist attacks include subjective and objective factors. Subjective factors include the factors related to the terrorist organization and are determined by the internal structure of the terrorist organization. The objective factors primarily include the time, region, target, and degree of damage, and are determined by multiple conditions. The specific indicators for each element can be described as follows.

(1) Degree of damage ($U_1$). This factor indicates the degree of damage caused by a terrorist incident to the attacked organizations or objects. This factor is the most significant and the easiest to consider. In this study, two indicators in the GTD database were used for quantitative calculations, specifically, casualties ($C_{11}$) and property losses ($C_{12}$). These aspects are required to be determined from the total number of deaths, total number of injuries, extent of property damage, total number of victims, total ransom, and the kidnapping/hostage results, among other factors. Depending on the degree of damage, the attacked areas adopt different levels of emergency rescue measures to minimize the number of casualties as much as possible. By considering the damage degree of past terrorist attacks in the region, the local early-warning security system can be improved, and the damage caused to the local residents by the next terrorist attack can be reduced.

(2) Time ($U_2$). This factor primarily includes the duration ($C_{21}$) of the terrorist attacks. In general, countries and regions in which terrorist incidents occur require time to deal with terrorist attacks and attempt to protect the damaged facilities, rescue the hostages, and quickly investigate the perpetrators of the terrorist attack. According to past quantitative analyses performed using the GTD database, a timely rescue helps reduce casualties and property damage [10,16,24]. Considering the Lanchester combat model, the extent of counterterrorism can be noted to be related to the duration of the terrorist attack. A longer duration corresponds to a slower rescue response, which in turn leads to panic spreading more easily in the society, a more difficult counterterrorism operation, and more harm [34].

(3) Region ($U_3$). A terrorist attack can influence terror differently in different regions. The level of casualties caused by terrorist attacks is related to the economic development of the region. Developed countries and regions are associated with low levels of death tolls, and developing countries (especially in parts of Africa and the Middle East) are associated with considerably higher levels of death tolls. The level of security in different areas, access to evacuation, and the number of targets that can be attacked in the region vary. Therefore, to determine the hazard level of a typical incident of a terrorist attack, it is necessary to consider the influence of various factors in different regions. In general, if the security of the area in which the terrorist incident occurs is high, a higher level of harm is caused by the terrorist attack. The national early warning system for homeland security formulated and implemented by the United States after the “9/11” incident has dynamic and intuitive characteristics, and it can be used as a benchmark for evaluating the security level of major regions and countries worldwide [35]. The Homeland Security Advisory System classifies hazard levels into five levels represented with the colors, in increasing severity, of green, blue, yellow, orange, and red. The green area ($C_{31}$) is the fifth level, indicating the lowest terrorist threat or nonhazardous state; this level is representative of a country or region with a particularly high degree of security, nearly perfect security measures, and an extremely low probability of occurrence of terrorist attacks. If a terrorist attack occurs in this country or region, the level of the attack will be extremely high. The blue area ($C_{32}$) is the fourth level, indicating a general threat. It means that the country or region has a high degree of security, the security measures are satisfactory, and the probability of a terrorist attack is low. If a terrorist attack occurs in this country or region, the level of the attack will be high. The yellow area ($C_{33}$) is the third level, which indicates that certain severe threats and dangers exist. If a terrorist attack occurs in this country or region, the level of the attack will be low. The relevant departments should strengthen the patrol, surveillance and defense of key targets, and develop emergency response plans to deal with unexpected events. The orange area ($C_{34}$) is the second level, indicating that the possibility of an attack is high. If a terrorist attack occurs in this country or region, the level of the attack will be considered extremely low, and the government departments must coordinate with the military and judicial personnel to adopt priority measures. Afghanistan, South Africa, Pakistan, Palestine and Israel are among the second-grade orange levels, corresponding to a higher risk probability. The red area ($C_{35}$) is the most dangerous level and represents an extremely critical threat. If a terrorist attack occurs in such a country or region, the level of attack can be considered particularly low.

(4) Target ($U_4$). This factor corresponds to the target of terrorist attacks, primarily including the government military ($C_{41}$), public foundations ($C_{42}$), and other ($C_{43}$) such categories. Terrorist attacks against different objects correspond to different levels of terrorist incidents. According to the two-segment power distribution defined by Li Guohui [16], tourist and public facilities are related to a high number of deaths. Attacks on the police and government are related to low death tolls. Government military objects are highly armed or are protected by armed forces and are difficult to attack. If a terrorist attacks a government-type military target of a country or region, the level of terrorist attacks will be high; the level pertaining to public foundations is the second highest, and other types of targets correspond to the lowest level of terrorist attacks. It can be seen that the target of terrorist incidents and the corresponding degree of damage are different for different cases. Therefore, the impact of different targets on the level of hazard typical for terrorist attacks needs to be considered.

(5) Terrorist organization ($U_5$). This factor refers to the characteristics of the terrorists, including murder type ($C_{51}$), attack mode ($C_{52}$) and weapon type ($C_{53}$). The murderers can be classified into criminal and noncriminal groups. Considering the analysis of terrorist attacks in China, the consequences of terrorist attacks by the Uighur separatists, East Turkistan Islamic Movement, Muslim separatists and Tibetan independence organizations can be considered more severe than others. Furthermore, different terrorist organizations have different tendencies regarding different types of armed attacks, and the consequences of the attacks are also different. Attack methods can be divided into the first type (assassination, armed attack, bombing/explosion), the second type (hijacking, facility/infrastructure attack), and third type of attacks (hands-free attack and others). The results of different attacks are remarkably different, and the number of casualties caused by armed attacks and hijackings is the highest. Although the attack type of assassinations has the largest occurrence frequency, they do not lead to a large number of deaths because assassinations often have clear target figures and do not cause a large number of bystander casualties. Types of weapons include the first category of weapons (biochemical, nuclear, missile and, radiation weapons), the second category of weapons (light weapons, explosives/bombs/explosives, burning weapons), and the third category of weapons (fake weapons, vehicles, etc.). According to a case study carried out with the GTD database, the consequences of using different weapons are remarkably different. At present, the use of bombs and guns is the most frequent; however, the number of casualties and harmful consequences associated with terrorist attacks using vehicles and other chemical weapons are more critical. Therefore, a comprehensive evaluation of the three indicators of terrorist organizations is of considerable significance for the assessment of the level of hazard of typical terrorist incidents.

The evolution index system for terrorist attacks is shown in Figure 1.

3.2. Determination of Indicator Weights

The analytical hierarchy process (AHP) is a systematic and hierarchical analysis method combining qualitative and quantitative methods. It was proposed by the operational researcher T.L. Saaty in the 1970s [36]. The AHP decomposes the problem into different components according to the nature of the problem and the overall goal to be achieved, and combines the factors at different levels according to the interrelationship between the factors and the affiliation relationship, forming a multi-level analysis structure model. Therefore, the problem is ultimately attributed to the determination of the relatively important weight of the lowest level (plans, measures, etc.) to the highest level (the overall goal) or the arrangement of the relative priority and inferior order [37]. Based on the analytic hierarchy process, this paper presents the considered indicators in numerical form by introducing appropriate judgment scales to form a judgment matrix, which quantifies those qualitative problems that are difficult to quantify and provides a basis for evaluation and decision-making. The general process can be described as follows.

3.2.1. Hierarchical Model

The objectives of the decision, considered factors (decision criteria) and decision objects are divided into the highest layer, middle layer and lowest layer, according to the relationship among them, and the hierarchical structure diagram is obtained (Figure 1). The highest level corresponds to the purpose of decision-making and the problem to be solved. The lowest level corresponds to the alternatives when making decisions. The middle layer corresponds to the factors considered and the criteria for decision-making. For two adjacent layers, the upper layer is referred to as the target layer and the lower layer is the factor layer.

3.2.2. Structural Judgment Matrix

According to the uniform matrix method proposed by Saaty [36], by comparing two factors at a time, the relative scale is used to reduce the difficulty of comparing factors with different properties to improve the accuracy. For example, the schemes under a certain criterion are compared in pairs, and the grades are rated according to their importance. $a_{ij}$ denotes the comparison of the importance of the $i$ and $j$ elements, and

Table 1. Ratio-scaled table.

Comparison of Factors i and j	Quantitative Value
Equally important	1
Slightly important	3
More important	5
Strongly important	7
Extremely important	9
Intermediate value of two adjacent judgments	2, 4, 6, 8

lists the nine importance levels and their assignments, as defined by Saaty. The five evaluation factors of $U_1$, $U_2$, $U_3$, $U_4$ and $U_5$ are compared. Let $a_{ij}=U_i/U_j$ (If $a_{14}=U_1/U_4=9$, then, $U_1$ is extremely important compared to $U_4$). The matrix formed by the comparison result is called the judgment matrix, $A=\left(\begin{array}{ccc}{a}_{11}& \cdots & a_{1n}\\ ⋮& \ddots & ⋮\\ a_{n1}& \cdots & a_{nn}\end{array}\right)$.

(i)

Normalization of each column of the matrix is performed using $a_{ij}^{*}=a_{ij}/s_j$, $s_j={\displaystyle \sum _{i=1}^n{a}_{ij}}$($j$ = 1, 2, 3…n);

(ii)

For a matrix normalized by column, a sum by row is performed: $W_i={\displaystyle \sum _{j=1}^n{a}_{ij}/n}$, $S^{*}=(W_1,W_2,\cdots ,W_n)$ ($i$ = 1, 2, 3…n);

(iii)

The eigenvalue of the matrix is calculated as ${\lambda }_i=1/n{\displaystyle \sum _{i=1}^n\frac{{(AW)}_i}{S_i^{*}}}$.

3.2.3. Consistency Test of Judgment Matrix

(i)

Consistency indicator $CI=({\lambda }_{\max }-n)(n-1)$;

(ii)

Random consistency indicator $RI$, as shown in

Table 2. Random consistency indicator.

$\mathit{n}$	3	4	5	6	7	8	9	10	11	12	13	14	15
$RI$	0.49	0.75	1.15	1.21	1.26	1.42	1.46	1.48	1.49	1.56	1.58	1.59	1.61

;

(iii)

Consistency ratio $CR=CI/RI$. Normally, if $CR$ < 0.1, the judgment matrix is considered to pass the consistency test; otherwise, it does not have satisfactory consistency.

Based on previous research and expert scoring, the following judgment matrix can be obtained [38,39,40]:

$$A=\left\{\begin{array}{ccccc}1& 7& 3& 6& 9\\ 1/7& 1& 1/2& 4/5& 2\\ 1/3& 2& 1& 2& 3\\ 1/3& 5/4& 1/2& 1& 2\\ 1/9& 1/6& 1/3& 1/2& 1\end{array}\right\}$$

After the matrix is normalized, the results obtained and the weight of each index are shown in

Table 3. Weight results of each indicator.

Indicator	$\mathbf{Degree}\mathbf{of}\mathbf{Damage}{\mathit{U}}_1$	$\mathbf{Time}{\mathit{U}}_2$	$\mathbf{Region}{\mathit{U}}_3$	$\mathbf{Target}{\mathit{U}}_4$	$\mathbf{Terrorist}\mathbf{Organization}{\mathit{U}}_5$	$\mathbf{Weight}{\mathit{W}}_{\mathit{i}}$
Degree of damage $U_1$	0.8927	0.9389	0.9210	0.9270	0.9045	0.5212
Time $U_2$	0.1275	0.1341	0.1535	0.1236	0.2010	0.0922
Region $U_3$	0.2976	0.2682	0.3070	0.3090	0.3015	0.1111
Target $U_4$	0.2976	0.1677	0.1535	0.1545	0.2010	0.1105
Terrorist organization $U_5$	0.0992	0.0224	0.1023	0.0773	0.1005	0.0550

.

Here, ${\lambda }_{\max }=5.18$, and $CR=0.03913<0.1$; these values indicate that the weights obtained at this level are reasonable, the consistency is satisfactory, and no logic error is present. In addition, the same result can be obtained by transposing matrix A, which proves the rationality of the result.

The weights of the secondary indicators in each evaluation factor $U_1$, $U_2$, $U_3$, $U_4$, $U_5$ are respectively $A_1=[0.782,0.218]$, $A_2=[1]$, $A_3=[0.352,0.282,0.199,0.12,0.047]$, $A_4=[0.412,0.315,0.273]$, $A_5=[0.508,0.321,0.171]$.

The combined weight of each three-level indicator was calculated recursively, the weight of the third-level indicator was multiplied by that of the secondary indicator, and the following result was obtained.

$$\begin{array}{l}{C}_{11}=0.782\times 0.5212=0.4076,C_{12}=0.218\times 0.5212=0.1136,C_{21}=0.0922\times 1=0.0922,\\ C_{31}=0.352\times 0.1111=0.0391,C_{32}=0.282\times 0.1111=\mathrm{0.0.03133},C_{33}=0.199\times 0.1111=0.0221,\\ C_{34}=0.12\times 0.1111=0.0133,C_{35}=0.047\times 0.1111=0.0052,\\ C_{41}=0.412\times 0.1105=0.0455,C_{42}=0.315\times 0.1105=0.0348,C_{43}=0.273\times 0.1105=0.0301,\\ C_{51}=0.508\times 0.055=0.0279,C_{52}=0.321\times 0.055=0.0177,C_{53}=0.171\times 0.055=0.0094.\end{array}$$

The weights of the 14 evaluation indicators for the level of danger of terrorist attacks are as defined above. It can be seen that the casualty factor $C_{11}$ has the most considerable impact on the level of terrorist attacks, followed by the property loss factor $C_{12}$.

3.3. Terrorist Attack Classification

The level of terrorist attacks is determined by the expert scoring method. First, several indicators are selected according to the basic requirements of the evaluation object, and subsequently, the evaluation criteria are determined according to the evaluation indicators. According to the evaluation criteria, experts score the evaluation indicators in two stages: expert scoring process, expert blind review and screening process of invalid questionnaires. Finally, these scores are assembled.

3.3.1. Main Steps

Each indicator score value is assigned by each expert and obtained by using the following steps.

In the first step, based on the experience of experts and the statistical analysis of historical data [41,42], the ten-factor method is used to determine the index score range of 1–10 points. The most harmful (highest level) event corresponds to 10 points for each indicator, and the least harmful (lowest level) event is assigned 1 point for each indicator. The level scores for the highest and lowest level events are calculated:

$$V_{\min }=1,V_{\max }=10,\Delta x=(10-1)/4=2.25$$

Therefore, the hazard level of the terrorist attack is divided into five levels, namely, low hazard, lower hazard, higher hazard, high hazard and serious hazard levels. The level score standard is defined as follows: When $1\le V<2$, the hazard level is Class V, which is a lower hazard level. When $2\le V<4$, the hazard level is Class IV, which is a low hazard level. When $4\le V<6$, the hazard level is Class III, which is a high hazard level. When $6\le V<8$, the hazard level is Class II, which is a higher hazard level. When $8\le V\le 10$, the hazard level is Class I, which is a serious hazard level.

In the second step, each expert determines the score of each index according to his/her experience, knowledge and understanding of the terrorist attacks, and an average value is obtained. This step is an important part of the expert rating and grading work. Three specific requirements for expert scoring have been proposed. The first is that sufficient information must be collected, and the severity of the indicators must be introduced in detail at the meeting of the expert judges. The second is that the meaning of each factor and the criteria for judging the indicators must be explained in detail. Third, the experts must have a comprehensive understanding and overall consideration before grading; furthermore, to judge, compare and analyze the severity of each indicator from the complete evaluation area, firstly, a qualitative analysis should be performed. Next, the situation of each index must be compared with the others in pairs, and the score of each index must be evaluated quantitatively.

The third step involves multiplying the score by the weight to obtain an event level score V. Next, the event is attributed to the corresponding level according to the standard of the level score. The indicator scores are presented in

Table 4. Indicator score details.

Factor	Index	Situation	Weight	Score
Damage factor $U_1$	Number of casualties	Death toll < 3 or number of critically injured < 10	0.4076	4
		3 ≤ death toll < 10 or 10 ≤ number of critically injured < 50		6
		10 ≤ death toll < 30, or 50 ≤ number of critically injured < 100		8
		30 ≤ death toll, or 100 ≤ number of critically injured		10
	Degree of property loss	unknown	0.1136	4
		Direct economic loss < $1 million		6
		$1 million ≤ direct economic loss < $1 billion		8
		$1 billion ≤ direct economic loss		10
Time factor $U_2$	Duration	Within 1 day	0.0922	4
		1–7 days		6
		7–30 days		8
		30 days–1 year		10
Geographical factor $U_3$	Green area	Old European Union countries, such as Western European countries	0.0391	10
	Blue area	North America, Eastern Europe, Australia and East Asia	0.03133	8
	Yellow area	South America, Southeast Asia, South Asia	0.0221	6
	Orange area	Middle East and Africa	0.0133	4
	Red area	Countries in a state of unrest, such as Iraq	0.0052	2
Target/victim factor $U_4$	Government military	Government, police, military, diplomacy	0.0455	10
	Public foundation class	Public utilities, transportation, telecommunications, educational institutions, airports and aircraft	0.0348	7
	Others	Business, journalists, citizens themselves and private property, religious figures/institutions, tourists	0.0301	4
Terrorist organization factor $U_5$	Perpetrator information	Criminal gang	0.0279	10
		Noncriminal group		6
	Attack mode	First type of attack (assassination, armed attack, bombing/explosion)	0.0177	10
		Second type of attack (hijacking, facility/infrastructure attack)		7
		Third type of attack (hand attack and other)		3
	Weapon type	First category (biochemical, nuclear, missile wand, radiation weapons)	0.0094	10
		Second category (light weapons, explosives/bombs/explosives, burning weapons)		7
		Third category (fake weapons, vehicles, etc.)		4

.

3.3.2. Determination of Evaluation Criteria

Considering the actual situation of terrorist attacks, the criteria for the indicators refer to the existing national, local and industrial standards or norms, and simultaneously draw on relevant statistical data, the results of qualitative analysis by experts, to quantify effective solutions to the boundary problem evaluation process and related literature research results, and then determine a reasonable evaluation standard.

According to the abovementioned model, the degree of harm of terrorist attacks since the beginning of the 21st century was calculated, and the top ten terrorist attacks with the highest degree of harm were selected according to the scores. The hazard level was Class I, and the severity level was critical. The details are presented in

Table 5. Data for ten terrorist attacks.

Event Number	Time of Occurrence	Event Name	Launch Organization	Death Toll	Number of Injured	Arms
200109110005	11 November 2001	September 11 attacks	Al-Qaida	1383	8191	Vehicle, incendiary bomb, melee
200403110007	11 March 2004	Madrid subway serial bombing	Al-Qaida	190	1500	Explosives, vehicles
200409010002	1 September 2004	Russia’s Beslan SNO school attacked near Republic of Chechnya ruins	Riadus-Salixin Chechen Martyrs Scouting Destruction Camp Organization	344	727	Explosives, vehicles
200901170021	17 January 2009	Attack on the Tora Catholic Church in the Democratic Republic of the Congo	The Army of God boycotts LRA	400	Unknown	Bomb/burning bomb, gun
201405050053	5 May 2014	Armed attack in the town of Gamboru Ngala	Boko Holy Land	315	Unknown	Explosives/bombs/explosives, firearms, incendiary bombs
201406100042	10 June 2014	Terrorists attack Iraqi Baghdad prison	Extreme organization “Islamic State”(ISIL)	670	0	Explosives/bombs/explosives, guns
201411070002	12 June 2014	IS kills 1700 captured Iraqi soldiers	Extreme organization “Islamic State”(ISIL)	1700	0	Explosives/bombs/explosives
201408030059	3 August 2014	Kidnapping of the Sinjar hostages in Iraq	Extreme organization “Islamic State”(ISIL)	500	Unknown	Firearms
201504090006	9 April 2015	Armed attacks on civilians in the province of Anbar, Iraq	Extreme organization “Islamic State”(ISIL)	300	Unknown	Unknown

.

4. Mining Data Features to Identify Criminal Masterminds

In the terrorist attacks that occurred, a number of incidents have not yet been identified, which is not conducive to the development of targeted counterterrorism strategies. Several cases may have been committed by the same terrorist organization or individuals at different times and in different locations. If these cases are concatenated for unified investigation, the efficiency of the case can be improved, and early detection of new or hidden terrorists can be facilitated. Therefore, in this study, six terrorist attacks that occurred in 2015 that have not yet been categorized or taken responsibility for were selected. Based on the hierarchical clustering technique [43,44], the terrorist organizations (or individuals) that committed multiple crimes at different times and in different locations were classified and identified. The corresponding unknown crime organizations or individuals were marked with different codes; the top five among these were selected according to the harm caused by the organization or individual and recorded as Nos. 1–5. Subsequently, for the terrorist attacks listed in

Table 6. Sample data of terrorist attacks involving unidentified masterminds.

Event Number	Area Codes	Area	Code of Type of Attack	Type of Attack	Target/Victim Information Code	Target/Victim Information	Code of Weapon Type	Weapon Type
201501010001	3	Middle East and North Africa	3	Bombing/explosion	8	Educational institution	6	Explosives/bombs/explosives
201501010002	2	Western Europe	7	Facility/infrastructure attack	15	Religious figures/institutions	8	Burning weapon
201501010003	3	Middle East and North Africa	3	Bombing/explosion	17	Terrorist/nonstate militia	6	Explosives/bombs/explosives
201501010004	3	Middle East and North Africa	3	Bombing/explosion	1	Business	6	Explosives/bombs/explosives
201501010005	3	Middle East and North Africa	3	Bombing/explosion	14	Citizens and private property	6	Explosives/bombs/explosives
201501010006	3	Middle East and North Africa	3	Bombing/explosion	1	Business	6	Explosives/bombs/explosives

, the five suspects were sorted according to the degree of suspicion.

4.1. Problem Analysis

A terrorist or group exhibits a certain consistency in their crime characteristics and tendencies. In this study, we selected four data types for analysis, and some data that were not important or relevant for this analysis were discarded. The analysis process is illustrated in Figure 2.

(1) The region is a common factor. For a specific organization or individual, due to the limited scope of activities, the crime sites tend to be concentrated in a specific area. (2) The target factor is a crucial factor affecting the terrorist attack. (3) According to historical data and previous analyses, the attack methods of a particular terrorist exhibit similarities. (4) The types of weapons employed also tend to be similar.

4.2. Principle of Clustering Algorithm

The basic idea of the clustering algorithm analysis is to observe the close relationships among the samples, according to the numerical characteristics of the objects [45,46,47]. Once the distance between the samples has been defined, the samples with smaller distances are grouped together. The K-Means algorithm is an unsupervised clustering algorithm; it is simple to implement, and the clustering effect is satisfactory. Therefore, this algorithm was employed for performing the calculations.

For a given sample set, the sample set is divided into $k$ clusters according to the distance between the samples. Let the points in the cluster be connected as closely as possible, and let the distance between the clusters be as large as possible. If we use a data expression assuming that the cluster is divided into $(C_1,C_2,\dots C_k)$, the goal is to minimize the squared error $E$:

$$E={{\displaystyle \sum _{i=1}^k{\displaystyle \sum _{x_i\in c_i}\Vert x-{\mu }_i\Vert }}}_2^2$$

where ${\mu }_i$ is the mean vector of cluster $C_i$, which is sometimes known as the centroid, and it can be expressed as follows:

$${\mu }_i=\frac{1}{\left|C_i\right|}{\displaystyle \sum _{x\in C_i}x}$$

The flow of the K-means algorithm can be described as follows:

The input is the sample set $D=\left\{x_1,x_2,\dots x_m\right\}$, the cluster tree of the cluster is $k$, and the maximum number of iterations is $N$. The output is clustered as $C=\left\{C_1,C_2,\dots C_k\right\}$.

(1)

Randomly select $k$ samples from the data set $D$ as the initial centroid vector: $\left\{{\mu }_1,{\mu }_2,\dots ,{\mu }_k\right\}$;

(2)

For $n=1,2,\dots ,N$;

(i)

To make $C_i=\varnothing \left(1\le i\le k\right)$;

(ii)

Calculate the distance between the samples to the $k$ mean vector for all sample points; take the mark of the mean vector corresponding to the shortest distance as the cluster mark of the point, and add the point to the corresponding cluster $C_i$;

(iii)

Calculate the new mean vector ${\mu }_i=\frac{1}{\left|C_i\right|}{\displaystyle \sum _{x\in C_i}x}$ for each cluster. If there is a change from the previous vector, update it and use it as the new mean vector. If there is no change, the mean vector remains the same;

(3)

Output cluster division $C=\left\{C_1,C_2,\dots C_k\right\}$.

4.3. Identification of Criminal Masterminds

In this study, six terrorist attacks that occurred in 2015 and that have not been claimed responsibility for by organizations or individuals were selected, as described in the following table.

Due to the major differences between the various attributes, to eliminate the influence of the order of magnitude, the dispersion needs to be standardized before clustering. The standardized sample data are presented in

Table 7. Standardized sample data.

Event Number	Area	Type of Attack	Target/Victim	Type of Weapon
201501010001	0.318182	0.25	0.333333	0.363636
201501010002	0.236364	0.75	0.666667	0.545455
201501010003	0.318182	0.25	0.761905	0.363636
201501010004	0.318182	0.25	0	0.363636
201501010005	0.318182	0.25	0.619048	0.363636
201501010006	0.318182	0.25	0	0.363636

.

After the data are processed, the modeling data is generated. The K-means clustering algorithm is used to cluster the modeling data, based on the spatiotemporal feature cases of the terrorist attacks, and the pedigree clustering graph is obtained, as shown in Figure 3.

For the clustering results, a line graph of the five features according to different types is plotted, as shown in Figure 4. There may be several cases in which the same terrorist organization or individual has committed multiple crimes at different times and in different locations. The corresponding unknown crime organizations or individuals were marked with different codes, and the first five of them were selected according to the degree of damage inflicted by the organization or individual; these entities were recorded as Nos. 1–5.

Table 8. Results for terrorist suspects.

Event Number	Suspect No. 1	Suspect No. 2	Suspect No. 3	Suspect No. 4	Suspect No. 5
201501010001	3	1	4	5	2
201501010002	4	3	2	1	5
201501010003	4	5	3	2	1
201501010004	3	1	4	5	2
201501010005	5	3	2	1	4
201501010006	3	1	4	5	2

lists the terrorist attacks and the five suspects, sorted according to the degree of suspicion.

For suspect 1, the terrorist attack has geographical characteristics with a value of less than 0.5, the corresponding actual area is an area with a value of less than 5, such as North America, South America, East Asia, the Middle East and North Africa; the other attack types have values less than 0.3. The corresponding types of attacks are mostly assassinations, armed attacks and bombings/explosions. In the target types with values less than 0.4, the corresponding target range is still relatively wide, the characteristics are not notable, the weapon type has values in the range 0.3–0.7, and the corresponding weapon types are nuclear weapons, light weapons, explosives, and burning weapons.

For suspect 2, the attack area is relatively broad and does not have any obvious features. The attack type has a value less than 0.5. The corresponding attack types are mostly assassinations, armed attacks, bombings or explosions, hijackings, and discrimination, and the target type has a value less than 0.5; the corresponding target range is still relatively wide, and the features are not sufficiently obvious. The weapon type range is 0–1, and no characteristic mark is present.

For suspect 3, the most notable feature is the type of weapon, including mainly fake weapons, vehicles, and equipment.

For suspect 4, the main feature is the type of attack, primarily concentrated in the value range of 0.4–0.9.

For suspect 5, in contrast to suspect 4, the attack type is mainly concentrated in the value range of 0–0.4, and the other characteristics are not highly differentiated.

5. Analysis of Spatiotemporal Evolution of Terrorism

5.1. Distribution Map of Key Regions of Terrorist Attacks

According to the analytical hierarchy process, it can be concluded that the intensity of terrorist attacks is mainly divided by the degree of casualties and property losses. It is shown that the main areas of terrorist attacks in the past three years can be roughly divided into four regions, especially the Middle East, Southeast Asia, Central Asia and Central Africa. Figure 5 [33] show the concentration and intensity of terrorist incidents in the past three years. The intensity of terrorist attacks has increased every year in Southeast Asia, which should be the focus of international counterterrorism. For the war-torn regions in the Middle East and Africa, which are the hotspots of global terrorist activity and cannot effectively resist terrorist attacks, antiterrorism efforts should be strengthened, and international support should be requested [48]. According to the spatiotemporal characteristics, spreading characteristics and grade distribution of terrorist attacks, it can be concluded that the key regions for future global terrorist attacks are the Middle East, Southeast Asia, Central Asia and Africa; terrorist attacks in Southeast Asia are expected to become more critical, and the scope of terrorist attacks in Africa is expected to widen.

5.2. Analysis of Terrorist Targets

There were 39,454 terrorist attacks that took place from 2015–2017; thus, the state of terrorist attacks is critical. The top five targets of terrorist attacks are citizens, the military, the police, governments, and businesses, as shown in Figure 6. In these three years, 11,502 terrorist attacks targeting citizens occurred, accounting for 29.2% of the total number of terrorist attacks. The second-largest target was the military, with 7920 attacks, accounting for 20.1% of all terrorist attacks. Civilians were the targets most at risk, and their risk index was considerably higher than that of other targets for the following reasons. First, after the 9/11 terrorist attack, the security at “hard targets” such as airports and stations was increased, rendering carrying out terrorist attacks difficult; therefore, terrorist attacks have turned to “soft targets” such as low-defense civilians. Second, the effective strength of terrorist organizations was weakened by the large-scale war on terror launched by the United States, and the structure of terrorist organizations has tended to become decentralized; thus, large-scale terrorist attacks, such as the 9/11 attack, have become difficult to organize, and the tendency is now to carry out “lone-wolf”-type civilian attacks. Third, a high level of civilian deaths is likely because defense facilities are not organized, the self-protection ability of civilians is weak, and a terrorist attack is sudden and critical. While military targets are inherently more resistant, terrorists tend to attack them to combat government prestige, create a terrorist atmosphere or achieve political goals [16]. Therefore, large-scale and planned terrorist attacks on military targets may result in a high death toll of military targets. The corresponding counterterrorism strategy could be formulated considering the risk index distribution of various targets. At present, the protection of civilian targets should be strengthened through specific measures such as accelerating the construction of intelligence systems, increasing the number of security personnel for important activities in important locations during high-risk periods, and improving the efficiency of emergency management after terrorist attacks.

6. Conclusions

Terrorist attacks have gradually become a critical issue of social concern. Based on the GTD, the AHP and the K-means cluster analysis method were used to evaluate the terrorist attacks from both qualitative and quantitative aspects. The terrorist attack targets and key regions of terrorist attacks in the past three years were emphatically analyzed. The research results help people get a clearer understanding of terrorism, improve the government’s vigilance and emergency management capabilities in the face of terrorist attacks, and provide a solid and reliable basis and reference for the joint counterterrorism of various countries and regions. The main conclusions are as follows:

(1) The AHP was used to classify the damage degree of terrorist attacks; certain variables with overlapping information and intricate relationships were attributed to a few unrelated comprehensive factors, and the grading standards of terrorist attacks were defined, in which the indicator of casualty degree had the greatest impact on the grade of terrorist attacks, followed by the property loss indicators. The top ten terrorist attacks with the highest degree of harm in the past two decades were listed.

(2) The K-means cluster analysis method was used to classify terrorists according to the region, type of attack, type of target and type of weapons used by the terrorists. The top five suspects in the 2015 terrorist attacks whose perpetrators had not yet been determined were identified.

(3) Terrorist attacks are showing a gathering trend that the vast majority of terrorist attacks and deaths have been concentrated in a few regions. The Middle East, Southeast Asia, Central Asia, and Africa were predicted to be the most severe areas of future global terrorist events according to the distribution map of key areas of terrorist attacks. The terrorist attacks in Southeast Asia will likely become more severe, and the scope of terrorist attacks in Africa is expected to widen. It shows a tendency to become a new hotspot area for terrorist attacks.

(4) According to the analysis of the targets of terrorist attacks in the past three years, civilians are the target most at risk from terrorist attacks, and their risk index is considerably higher than that for other targets. Decision-makers should focus on this and improve the response mechanism to terrorist attacks.