A system creates a dynamic stochastic network using data relating to events. The dynamic stochastic network includes super nodes, local nodes, and agents. Connections among the super nodes and local nodes include events that are related to the super nodes and the local nodes. Strengths of the connections between the super nodes and local nodes are a function of a number of events that are common to the super nodes and local nodes. The connections are made and broken as the agents interact over time. The strengths of the connections increase and decrease as a function of a change in the number of events that the super nodes and local nodes have in common. An instability metric is calculated for the dynamic stochastic network, and an emerging group threat behavior is detected based on a deviation from the instability metric.