A process executed by a computer processor comprising: receiving data relating to events in an environment, the data comprising agents involved in the events, types of the events, and times of occurrence of the events; creating a dynamic stochastic network in real time using the data relating to the events, the dynamic stochastic network comprising super nodes (140, 210, 220), wherein each super node (140, 210, 220) represents events and agents of a particular type of intelligence data source, each super node (140, 210, 220) comprising local nodes (150, 230), wherein the local nodes (150, 230) represent the agents; wherein the dynamic stochastic network comprises connections (240, 242, 245) among the super nodes (140, 210, 220) and the local nodes (150, 230), the connections (240, 242, 245) comprising events that are related to the super nodes (140, 210, 220) and the local nodes (150, 230); and wherein strengths of the connections (240, 242, 245) between the super nodes (140, 210, 220) and local nodes (150, 230) are a function of a number of events that are common to the super nodes (140, 210, 220) and local nodes (150, 230); making and breaking the connections (240, 242, 245) among the super nodes (140, 210, 220) and the local nodes (150, 230) as the agents interact over a time period; increasing and decreasing strengths of the connections (240, 242, 245) among the super nodes (140, 210, 220) and local nodes (150, 230) as a function of a change in the number of events that the super nodes (140, 210, 220) and local nodes (150, 230) have in common; periodically calculating based on said dynamic stochastic network changed over time an instability metric for the dynamic stochastic network; and detecting in real time an emerging group threat behavior based on a deviation from the instability metric; wherein the emerging group threat behavior is detected in real time by computing a distance from the equilibrium vector of the stochastic network representing said deviation from the instability metric. receiving data relating to events in an environment, the data comprising agents involved in the events, types of the events, and times of occurrence of the events; creating a dynamic stochastic network in real time using the data relating to the events, the dynamic stochastic network comprising super nodes (140, 210, 220), wherein each super node (140, 210, 220) represents events and agents of a particular type of intelligence data source, each super node (140, 210, 220) comprising local nodes (150, 230), wherein the local nodes (150, 230) represent the agents; wherein the dynamic stochastic network comprises connections (240, 242, 245) among the super nodes (140, 210, 220) and the local nodes (150, 230), the connections (240, 242, 245) comprising events that are related to the super nodes (140, 210, 220) and the local nodes (150, 230); and wherein strengths of the connections (240, 242, 245) between the super nodes (140, 210, 220) and local nodes (150, 230) are a function of a number of events that are common to the super nodes (140, 210, 220) and local nodes (150, 230); making and breaking the connections (240, 242, 245) among the super nodes (140, 210, 220) and the local nodes (150, 230) as the agents interact over a time period; increasing and decreasing strengths of the connections (240, 242, 245) among the super nodes (140, 210, 220) and local nodes (150, 230) as a function of a change in the number of events that the super nodes (140, 210, 220) and local nodes (150, 230) have in common; periodically calculating based on said dynamic stochastic network changed over time an instability metric for the dynamic stochastic network; and detecting in real time an emerging group threat behavior based on a deviation from the instability metric; wherein the emerging group threat behavior is detected in real time by computing a distance from the equilibrium vector of the stochastic network representing said deviation from the instability metric.