Using Network Measure to Reduce State Space Enumeration in Resilient Networks

Transcription

1 Using Network Measure to Reduce State Space Enumeration in Resilient Networks M. Todd Gardner 2 Federal Aviation Administration Kansas City, Missouri, USA todd.gardner@faa.gov Abstract Resilient network design has become a prominent research topic in the wake of recent disasters in Japan and the United States. Often communications networks that are designed to be highly reliable have significant outages when rare but important events occur. Finding rare events is generally difficult because it may require an exhaustive search of the network state space. Mission critical systems have specific qualities that enable enumerating the network space for important events more efficient. In this work, we use mission critical system qualities and requirements to create a tractable approach to evaluate a network for resiliency. With specific system requirements, the Self-Pruning Network State Generation algorithm is able to completely evaluate the failure modes of a network by examining approximately 90,000 events as opposed to an exhaustive search requiring 5.5 x events. In addition, a network resiliency metric is proposed that considers not only failure mode probability but also system impact. These approaches are also flexible, working with multiple network measures and network types. Keywords network reliability, resilient networks, survivability, reliable topology design I. INTRODUCTION One of the concerns with the design of mission critical networks is that a rare event may have catastrophic effects on the mission of that network. This affects many networks including telecommunications, transportation, and air traffic control. Examples of rare events include natural disasters, submarine cable cuts, and weather events. Sterbenz et al. provide a good description of many such rare events that had catastrophic network effects [8]. For example, a fire at the Hinsdale Illinois Bell switching office in 1988 caused disruptions in telecommunications and Air Traffic Control at both Midway and O Hare airports in Chicago. Although that network had been designed to be redundant, it was not resilient. This work focuses on the search for the elusive rare but important network events. The word rare is the reason that the problem is not trivial. However, the word important provides us with information that can be used to make the problem easier to solve. Traditional approaches (like enumerating most probable events) may not find rare events. If one were to conduct an exhaustive search in a network that has N components (either links or nodes), there would be 2 N possible failure modes if This work is supported in part by NSF under Grant No. CNS and by Federal Aviation Administration under Cooperative Agreement No. 11-G Cory Beard 2, Deep Medhi 1 Computer Science Electrical Engineering University of Missouri-Kansas City Kansas City, Missouri USA beardc@umkc.edu, dmedhi@umkc.edu each component has two modes (active and failed). In large networks, it is not tractable to evaluate 2 N states. Using simulation has the same type of problems. Because of the stochastic nature of random number generation, a simulation may not find the rare event without additional information. This paper presents the Self-Pruning Network State Generation algorithm, which is a resilient network evaluation method that uses characteristics of the network, network demands, and potential failure modes to search the network state space and find all failure modes within the constraints defined for the network. This approach provides insight to the problem of finding rare but important network events before they occur. With specific network requirements (like maximum hop count or maximum geographic radius of failures), a network evaluation on a 39 node network was performed by evaluating approximately 90,000 events as opposed to an exhaustive search requiring 5.5 x events. A network resiliency metric is also presented that evaluates resilience by focusing on impact rather than services lost. Advantages of this method are that they can be used with nodes or links (or both), they can be used in multilayer networks as long as a network measure can be tied to failure modes, and multiple network measures can be used to evaluate networks. The following observations inspired this work: Stochastically (and practically) speaking, all possible failure modes are not possible. They will be bounded by probability, geographic event, or other network characteristics. A mission critical network is typically considered functional with a smaller set of its services in an emergency situation, shedding less important traffic temporarily. Mission critical networks typically do not have highly connected uniform topologies (frequently for cost reasons). It is more likely, that they are sparsely connected groups of highly connected nodes. These observations enable us to make assumptions that allow analyses that are not possible otherwise. The rest of the paper is organized as follows. First we will take a look at related network state enumeration methods. Next, we look at a network resiliency metric followed by the network state generation approach. Finally, we demonstrate the approach on

2 a large U.S. reference test network and analyze some of the findings. II. OVERVIEW OF RESILIENT NETWORKS Performability is one of the metrics used to evaluate mission critical networks. From Medhi [1], performability uses the probability of network events and the network performance associated with that event to calculate an average network performance. This is shown in (1), where S i is the system state, X[S i ] is the network measure at state S i, and Pr[S i ] is the probability of network state S i. N is the number of network elements. The problem with this approach is that if X[S i ] is linear, high probability events tend to dominate performability and thus the design of the network. With mission critical networks, we are primarily interested in survivability and resilience rather than performability alone. We explore the concept of inversely relating network impact to network measure.! P =!!!! Pr S! Χ S! (1) Colbourn [5][6] defined network resiliency as the expected number of communicating pairs in a network. While this definition gives the possibility that a network will be able to meet its service requirements without taking into account the actual requirements, it is not sufficient. The definition that Sterbenz [8] uses relates the ability of the network to provide an acceptable level of service during network challenges, which can be simple faults to widespread events. Using this definition, we can construct a method to search a network for events that cause the network to not be able to provide an acceptable level of service. There are several surveys of network resiliency and network state space enumeration for purposes of calculating resiliency, availability, reliability and a variety of other metrics. Colbourn, Ball, and Provan [4][5] summarized several methods of state space enumeration, including exact computation, Monte Carlo methods, and a discussion of most relevant state methods. Cholda et al. [9] survey methods of providing resiliency, focusing on approaches related to resiliency differentiation. Our work bridges the gap between the types of work in these surveys, as we use differentiation of service to reduce the network state space. Network state space enumeration have been addressed in [4][10][11][12]. Li and Sylvester [2] was one of the first to propose using most probable state algorithms to calculate bounds for network reliability. Others that order network states based on most probable states (including multimode states) include [13][15][16]. Dotson and Gobien [14] calculate 2- terminal reliability by generating new states based on De Morgan s law. This allows network state pruning to be used when the 2-terminal test fails. If the probability of failure of each component is equal, the network states are generated in order of decreasing probability. We use a variation of this method to generate states in our work. Gardner, Beard, and Medhi [17][18] also use De Morgan s Law to compute geographically correlated vulnerabilities in networks. Related work includes papers that enumerate states based on the importance of the state instead of the probability of the state. Jarvis and Shier [15] improved the concept of ordering network states based on probability to include link capacity. They were able to generate states in order of non-increasing unmet demand. Colbourn and Farley [7] presented several metrics to represent reliability and resilience. These were all based loosely on the concept of the expected value of a metric given network state probabilities (1). These metrics generally were related to node connectivity. In 2009, Heegaard and Trivedi [3] extended the idea by using continuous time Markov chains (CTMC) to create performance models representing various failure modes. The concern with both of these models is that they are not flexible from a network measure perspective, being limited to the types of network measures that can be employed. To our knowledge, an approach to find rare but important states in a network has not been proposed except where the approach was specific to the network measure. Our contribution is a tractable method to find those important states for a subset of large complex network with multiple network measures. A metric to evaluate these networks for resiliency is also proposed. III. NETWORK RESILIENCE METRIC If an individual node is failed, we refer to that node as down and if the node if functioning, we refer to it as up. From (1), the network measure X[S i ] is related to the ability of the network to perform its function. Typically X[S i ] ranges from 0.0 (failed) to 1.0 (fully functioning). To see the impact we define Y[S i ] as shown in (2). A small delta (ε) is used to provide a maximum impact if X[S i ] is zero. S 0 represents the all nodes up state. α is an exponential scaling factor that can be used to adjust the shape of the impact curve. A higher value of α is required for networks that have only very rare events that cause high impact. Network resilience (R) can then be defined as shown in (3) where N is the number of network elements. Since high values of α may cause large values of R, we can normalize R using the network in a baseline or reference mode. The R found using the reference network (with Γ = 1) is used as the normalization constant (Γ) for topology changes to the reference network. R is then 1.0 for the reference network. Resiliency improvements to the reference network decrease R while degradation to the resilience increases R. Y S! = Illustration 0 i = 0 (no failures) 1 X S! + ε i > 0 R = Pr S! Y S! Γ (2) (!!!!)!!! (3) To illustrate this definition of network resilience, we define X[S i ] as the percentage of services functioning under failure state S i where Pr[S i ] is shown in (4). p is the probability of a node down and q=1.0-p. k i is the number of nodes down independently in state S i.

3 Fig. 1. R versus Average Node Degree (10 node network) Pr S! = p!!q (!!!!) (4) A random 10 node network with increasing connectivity is used for this illustration. The demands were simple connectivity from every node to every other node. The probability of a node down is defined as p = ε is defined as Fig. 1 shows R versus average node degree (indicating network density). If α is small, Pr[S i ] may dominate R (and not Y[S i ]). If α is large, the high impact states will have a larger impact on R helping to differentiate between more resilient networks. If we have a high density network, the probability of a failure that causes high impact is very small. The impact Y[S i ] must be large to be significant. This can be seen in Fig. 1. When the nodal degree increases from 6.0 to 6.8, the change in R becomes small even when α is 2.0. With α set to 8.0, the improvement in resiliency is noticeable. The exponential impact of α enables very small likelihood events to be significant. IV. NETWORK STATE GENERATION In order to understand the network state enumeration problem, we start with the definition of a network state. Definition 1. Network State. We define a network state S m as [s 1 s 2 s N ] where s i is 1 if the network component i is up and s i is 0 if the network component is down. Enumerating all network states without repetition, this creates 2 N unique network states. We further define S 0 = [1 1 1] in the case where all components are up. We assume ordering of the states is based on the number of 0 components and then lexicographic ordering. Another common way to express s i is s! if the component is failed and s i if it is up. Fig. 2 shows the lexicographic network state ordering for a 5 element network. With one network component down there are N states. With two simultaneous network components down, there are N(N-1)/2 network states, which is the number of combinations Fig. 2. Lexicographic Network State Ordering Fig. 3. Number of Network States versus Simultaneous Nodes Down in 39 Node Network of N components selected k at a time where k is the number of down components. The general equation is shown in (5). Fig. 3 shows the number of network states for a 39 node network versus the number of simultaneous components down. This is the reason many analysis techniques only look for a finite number of simultaneous nodes down. If the components have equal probability of failure, ordering the states by most probable to least probable is equivalent to starting from the left and working to the right as network states grow. Network States = N k =!!!!!!!! For example, in a 39 node network the total number of states is 2 N = 5.50 x network states. However, there are several ways to reduce the number of states. Using 1, 2, or 3 simultaneous components down, we have a total of 9919 network states to consider. In a geographic example, consider the case that at most 8 nodes could be affected simultaneously by a geographic event. There would be a maximum of 39 x 2 8 = 9984 network states that need to be evaluated. To take advantage of these improvements, we need an approach to evaluate only the network states related to both our network measure and node down possibilities which leads us to the definition of a relevant state. Definition: Relevant State. We define a relevant state as a network state that is considered a feasible network state and fails the established network measure. A. Self-Pruning Network State Generation To develop a more efficient approach to enumerate the relevant states possible with a given network, we make the following assumptions: Assumption 1 If a network state with node k down S i = [1 0 k 1] causes the network to be non-functional, X(S i ) < failed threshold (f ), then any S j that contains node k down will cause X(S j ) X(S i ). Therefore, S j does not need to be examined. This can be extended to any network state that contains all of the same nodes down as a non-functional state. Assumption 2 It is possible that if a node is not used in a solution for a demand in a large network, that node will not be used for that demand during a failure condition (even with rerouting). We see this with networks with only one connection between clusters of nodes and a demand that resides within one cluster. (5)

4 N C New_Nodes S i B i Q W X[S i] F TABLE I. NOTATION Number of Network Components Set of active nodes Set of nodes used in solution not contained in C. Network state i Base state used to create S i Event List of network states/base states to be analyzed New State List to be added to Q Network Measure Network Measure threshold As discussed in Section II, Dotson used De Morgan s Law (6) to reduce the search space necessary to calculate reliability [14]. We use a similar approach to create a state generation algorithm. if P = then P = (6) We first test the state S 0 = [ ]. If it is successful (which it should be), the nodes used in the solution are now the set of active nodes C. Considering only the nodes in C, we add the complement of S 0 to a list to test for both feasibility and if that state contains a previously failed state. This would include S 1 = [ ], S 2 =[ ], etc (if nodes 1, 2, are in C). We note the exact complement does not always specify the state of all network nodes. For example, {1 2} refers to [ ]. Even though the network state is filled with up nodes, we remember the original base that created the state. This is to allow us to capture all combinations given the base. Use of De Morgan s law allows the current state to generate the next level of states to be tested. Pruning of network states occurs during network state generation and addition to the event list. After state S 0 is tested and new network states are generated, the new states are tested for feasibility. Examples of the feasibility check include the maximum number of simultaneous down nodes that are possible or that all simultaneous down nodes must be related geographically. Then the new states are checked to confirm that the down nodes in previously failed states are not contained in the new state (also making it a failed state). The remaining new states are then added to the Event List. As the algorithm progresses, if new nodes (not in C) are used as the solution. The new nodes are added to C and the state is reset to S 0 (which starts the iteration again). The algorithm stops when the event list is empty and no new states are waiting to be added. The progression of the algorithm examines single node failures before simultaneous double node failures and double node failures before simultaneous triple node failures. Algorithm 1 provides a technical description of the Self-Pruning Network Event Generation algorithm. B. Network State Generation Analysis In the following two theorems, we show that the algorithm enumerates all relevant states. For this, we introduce the following definition: Definition: Network Space Classification. We define the network space classification as a representation of all network states as Non-Feasible, Success, and Failed such that: Algorithm 1 Self-Pruning Network State Generation C {} Node_set {} S 0 = [1 1 1] B 0 = {} Q <S 0, B 0 > while (Q {}) do while (Q {} New_Nodes = 0) do <S i, B i > Q 1 Q i Q i+1 if X[S i ] > f then if C X[S i ]{nodes_used} if S 1..k = Complement of B i then for i = 1:length{C-B i } do if S i feasible 1 then W W+<S i, B i > else Success Success + S i else New_Nodes = 1 C C U {nodes_used} S 0 = [1 1 1] B 0 = {} Q <S 0, B 0 > else Failed Failed + S i if (New_Nodes = 0) then while (W {}) do <S i, B i > W 1 W i W i+1 InFail = 0 for j = 1:size(Failed) do if (Failed j S i ) then InFail = 1 if InFail = 0 then Q Q + <S i, B i > for i=1:size(failed) do R = R + (Pr[Failed i ]*Y[Failed i ]) Notes: 1: feasible denotes the feasibility test. A Failed network state causes the network measure for the network at that state to be less than a preset threshold that defines minimum network function. X(Si) < f (Network Measure Threshold). A network state that contains the same down nodes (or components) as an already classified failed network state will itself fail and therefore its network space is also classified as Failed per Assumption 1. A network state that contains the same down nodes (or components) as an already classified Non-Feasible network state will itself be Non-Feasible (for the same reason that the first network state is Non-Feasible) and therefore its network space is classified as Non- Feasible.

5 A network space that is classified as Success is a single network state. Since that state can always suffer more nodes (components) down (except for the all nodes down network state), states that contain at least the same failed nodes (components) as a previously classified Success state cannot be assigned the same designation. In fact, the space must be divided further and analyzed. Theorem 1. Using Algorithm 1, the network space represented by the nodes in C, is classified as either 1) Non- Feasible, 2) Success, or 3) Failed. Proof: From De Morgan s Law, we know that S 0 = [1 1 1] and its complement {S 1 + S S M } where M is the number of nodes in C, represents the entire set of network states. S 0 is classified as Successful or Failed. If S 0 is Failed, the network with no nodes down is Failed. The complement would be failed also. If S 0 classified as Success, the remaining states that exist is the complement of S 0 also per De Morgan s law. S 1, S 2,, S M are analyzed next. Each state S i is classified as Non-Feasible, Failed, Success. Per Definition 1, if the state is classified as Non-Feasible or Failed no further analysis is necessary because any states generated by that state would contain the same failed nodes that earned the previous classification. If S i contains all of the down nodes that a previously Non-Feasible or Failed classified state contains, S i would not need to be classified since it is a part of the previously classified network space. If S i is classified as Success, and its complement does not exist, then no subset of S i that contains additional down nodes is possible. If S i is classified as Success and its complement does exist, its complement is added to the list to be analyzed. By induction, the entire network space is classified as Non-Feasible, Failed, or Success which concludes the proof. Theorem 2. Using Algorithm 1 and Theorem 1, the entire network space is classified as either 1) Non-Feasible, 2) Successful, or 3) Failed. Assumption 3: We assume that the network will effectively reroute around down network components to satisfy a network measure if that path exists among up components that allows it to do so. Proof: Since Algorithm 1 enumerates the network space associated with any set of nodes C and per Assumption 3, we know that the network will attempt to route around any down nodes (components) using any nodes if it is possible. Any nodes used for the solution that are not contained in C are added to C and the analysis is started over, therefore all nodes that would ever be needed to meet the requirements of the network measure are eventually included in C and enumerated for classification as Non-Feasible, Failed, or Success per Theorem 1. The only exception is if a network state is enumerated with a new set of nodes C that contain the same down nodes as a previously Non-Feasible or Failed classified state. Per definition, this state can also be classified as the previously classified state. This completes the proof. V. EXPERIMENTAL RESULTS The test network was chosen from [19] and is shown in Figure 4. Table 2 shows the nodes and US cities in which they Fig Node JANOS-US-CA Reference Network [19] are paired. For this set of experiments, we used two types of network measures. The first was simple connectivity between the demands shown in Table 3. The network measure was implemented using breadth first shortest path algorithms (BFS) to provision the demands in Table 3. If all 9 demands (or less if that was the test) were provisioned, then the network measure was successful. The second network measure was provisioning the demands listed in Table 3 across a capacitated network. All links in the network was assumed to be 200 MB/s TABLE II. JANOS-US-CA REFERENCE NETWORK NODES [19] Node City Node City Node City 1 Los 14 Houston 27 Philadelphia 2 New 15 Indianapolis 28 Portland 3 Atlanta 16 Kansas City 29 Sacramento 4 Boston 17 Las Vegas 30 St. Louis 5 Calgary 18 Memphis 31 Salt Lake City 6 Charlotte 19 Miami 32 San Diego 7 Chicago 20 Minneapolis 33 San Francisco 8 Cincinnati 21 Montreal 34 Seattle 9 Cleveland 22 Nashville 35 Tampa 10 Dallas 23 New Orleans 36 Toronto 11 Denver 24 Oklahoma City 37 Vancouver 12 Detroit 25 Phoenix 38 Washington 13 El Paso 26 Pittsburgh 39 Winnipeg TABLE III. JANOS-US-CA REFERENCE NETWORK NODES [19] Demand From To Bandwidth From City To City Node Node Required 1 1 Los Angeles 2 New York 50 MB/s 2 2 New York 34 Seattle 50 MB/s 3 2 New York 33 San Francisco 50 MB/s 4 2 New York 7 Chicago 50 MB/s 5 2 New York 3 Atlanta 50 MB/s 6 1 Los Angeles 3 Atlanta 50 MB/s 7 1 Los Angeles 33 San Francisco 50 MB/s 8 1 Los Angeles 7 Chicago 50 MB/s 9 1 Los Angeles 34 Seattle 50 MB/s TABLE IV. CONFIGURABLE SETTINGS Feasibility Type Possible Values Default Value Max Simultaneous Node Failures Geographically Correlated Distance miles 300 miles Network Measure Possible Values Default Value Demand Connectivity Demand Bandwidth 1-9 x 50 MB 9 x 50 MB Max Hops in Solution success threshold

6 (a) (b) (c) Fig. 5. Number of Demands vs. (a) Number of Events (b) Computation Time (c) Number of Failed States links. This was also implemented using BFS algorithm to look for the needed bandwidth. If paths with enough bandwidth were available for all required demands then the network measure was successful. Both network measures could be constrained to allow a maximum number of hops in the path. The network state feasibility checks that were used in these experiments include maximum number of simultaneous node failures or maximum distance failed nodes could be located from each other (geographically correlated failures). Table 4 shows default values for these checks and network measures. The algorithm was run using Octave [20] on a laptop computer with an Intel Core I7 processor (2.4 GHz). A. Test 1- Variable Number of Demands As we can see from Fig. 5(a)-(c), the following observations can be made. First, as the number of demands increased, the number of events processed decreased and reached a floor at approximately demand 5. The processing time decreased with the addition of demands 4 and 5 and then increased linearly. A similar decrease was noted in the number of failed states when demands 4 and 5 were added. Demands 4 and 5 were New York to Chicago and New York to Atlanta. Both of these demands have finite hop counts and generally regional routing. Since all demands are required to be considered a success (per the success_threshold = 0.90) the elimination of the Chicago node would have caused an immediate failure and thus Chicago could not have participated in any of the two node down scenarios that crossed the country. The algorithm would have pruned any failure modes that included the Chicago node, which is what occurred. To test this theory, the success_threshold was set to 0.75 (allowing for a couple of demands to not be met) to see the effect on the solutions generated. The computation time was 483 seconds and there were 90 failed network states. Since Chicago could now be down (and the network still be viable), network states that include Chicago were now included which increased the number of failed states. There also seems to be a point when the demands cover enough of the network that increases in the number of failed states and events processed cease. It is likely that this is related to the number of nodes being examined also stabilizing. When demand 5 was added, the number of nodes used grew to 37 (out of 39) and this did not change through demand 9. B. Test 2 Variable Maximum Hop Count in Solution Looking at Fig. 6(a)-(c), we noticed that as the maximum number of hops increased from 14 to 15, the computation time and number of failed states and total events decreased. This was not expected. The assumption was that if the maximum number of hops increased so would the number and complexity of solutions received. As we reviewed the failed states, we noticed that when the maximum number of hops was 14, nodes were included in failure states that were not included when the maximum was 15. An example was the failure state = [ ]. This combination was not included when the maximum was 15. This was because when the maximum hop count was increased but the maximum number of simultaneous failures (3) was unchanged, node 10 no longer was able to cause failures in the networks (reroutes become feasible). Additionally, looking at the number of events processed during the last iteration for max_hop = 14 and max_hop = 15 was similar (37780 vs ). However, the total number of (a) (b) (c) Fig. 6. Maximum Number of Hops in Solution vs. (a) Number of Events (b) Computation Time (c) Number of Failed States

7 (a) (b) (c) Fig. 7. Geographically Correlated Distance (miles) vs. (a) Number of Events (b) Computation Time (c) Number of Failed States events during the entire algorithm was vs This indicates that there was interaction as new nodes were added when max_hop = 14 that did not occur when max_hop = 15. C. Test 3 Variable Maximum Simultaneous Node Failures Of the tests that were conducted, the results from the variable maximum simultaneous node down tests were the most predictable ranging from 33 seconds with 2 down to 2729 seconds with 4 down. As more simultaneous nodes down are allowed, the number of possible network states grows by approximately factor of (N new maximum + 1)/(new maximum) per (5). D. Test 4 Geographically Correlated Failures The final set of tests that was conducted are related to the work previously done by Gardner, Beard, and Medhi [17][18]. It involves changing the feasibility criteria from a maximum hop count to a requirement that all down nodes are located within a given distance from one another. This type of analysis provides insight into the impact of a geographic event. Fig. 8 shows a graphical representation of the location of a geographic event that would disrupt a single demand between New York and Los Angeles. The shade indicates the diameter of the event required to disrupt the path. One important finding was that the simultaneous failure of the Cleveland and Detroit nodes (only about 92 m/148 km apart) does not sever a connection but does reduce the capacity of traffic leaving New York to 200 MB. This is not sufficient to support the 5 each 50 MB demands leaving New York. Since, there was no limitation on the number of simultaneous nodes down (other than geographic correlation), it was easy to see the size of geographic events needed to isolate a node. Fig. 7(a)-(c). show the number of events and computation time required for different geographic event diameters. As the diameter grows, the number of nodes that may be included in a geographic event grows which increases the number of events that would be considered in the resilience analysis to 2 M, where M is the maximum number of nodes in a geographic event diameter. Fig. 7(c). shows the number of failed network states associated with each geographic event diameter. The results were as expected. VI. SUMMARY A novel metric that uses the impact of the important events to determine network resiliency was presented and illustrated. It includes system impact into a metric that takes state probability into account. This metric can be used with nodes or links, with multilayer networks as long as a network measure can be tied to failure modes, and with multiple network measures. An approach was also presented to look for and evaluate rare but important network state. The ability of the Self Pruning Network State Generation Algorithm to enumerate relevant states was proven. Several tests were conducted to assess the computational power of the approach. These tests included varying the number of demands, varying the maximum hop count in the solution, varying the number of simultaneous failures, and varying the size of a geographically correlated network event. Both un-capacitated and capacitated networks were tested. With specific network requirements network evaluation was performed by evaluating approximately 90,000 events as opposed to an exhaustive search requiring 5.5 x events. The approach presented in this work focuses on the concept that the network state space can be pruned as it is generated in a number of ways. First, the feasibility of a given network state can provide a way to prune the network space. This can include simple feasibility checks like maximum number of simultaneous node failures or more complex feasibility checks like geographically correlated failures. The other way that a network state space can be pruned is during the calculation of Fig. 8. Impact caused by failures in specific geographic areas. Shade bar is in approximate miles. Shading indicates approximate size and location of event to disconnect Demand 1 (New York (2) to Los Angeles (1)). Lat-Long coordinates shown on map (eastern longitude shown).

8 the network measure. If a state fails a network measure, a future state that contains the same failed nodes would also fail. In addition, filters related to the network measure or the solution can be used. An example is a maximum hop count in the solution or a maximum end-to-end delay. The advantage of this approach is the ability to use various network measure and various network state feasibility checks. The disadvantage is that even with these efficiencies, there are still conditions related to topology, state feasibility, and network measure that prevent the network analysis from being tractable. This work attempts to give insight into understanding the complexity of a particular network and network measure. Network state space reduction using methods described here seems to work well for large networks with some or all of the following attributes: Sparsely connected networks (or sparsely connected groups of highly connected nodes). Network resilience measure that does not utilize a large percentage of the total number of nodes. Fulfilling the critical demand may not require the network nodes in extremely remote area of the network and therefore may not be needed in the analysis. Networks that can bound the types of failures that may occur. For example, we may not need to consider more than a certain number of simultaneous nodes down or more than a certain number of simultaneous nodes down that are not geographically correlated. Future work includes further development on the network state generation algorithm to more efficiently search certain types of topologies and use more complex network measures including multi-layer network measures. An example would be the performance of mission critical service oriented architectures. More work is planned on the network resiliency metric including additional testing on various networks and topologies. Specifically, more work is needed to learn how to calculate the metric when a complete network state probability distribution or complete network measure is not available. REFERENCES [1] D. Medhi, Network Reliability and Fault-Tolerance, in Wiley Encyclopedia of Electrical and Electronics Engineering [2] V. Li and J. Silvester. "Performance analysis of networks with unreliable components." IEEE Trans. Commun.,vol. 32, pp , [3] P.E. Heegaard and K. S. Trivedi, Network survivability modeling, Computer Networks, Vol. 53, pp , [4] C.J. Colbourn. "Reliability issues in telecommunications network planning", in Telecommunications Network Planning, P. Soriano and B. Sanso, Eds. Kluwer Academic Publishers, pp , [5] M.O. Ball, C.J. Colbourn, and J.S. Provan. Network Reliability, Handbooks in Operations Research and Management Science, pp Elsevier Science, [6] C.J. Colbourn, Network resilience. SIAM Journal on Matrix Analysis and Applications, 8(3), 404-6, [7] T. Farley, and C.J. Colbourn, "Multiterminal measures for network reliability and resilience." Proc. Of DRCN [8] J. Sterbenz, et al. "Resilience and survivability in communication networks: Strategies, principles, and survey of disciplines." Computer Networks, vol. 54, pp , [9] P. Cholda, A. Mykkeltveit, B.E. Helvik, O.J.Wittner, and A. Jajszczyk, "A survey of resilience differentiation frameworks in communication networks," IEEE Commun. Surveys & Tutorials, vol. 9, no. 4, pp , [10] Y. Lam, and V. Li. "Reliability modeling and analysis of communication networks with dependent failures." IEEE Trans. Commun., vol. 34, pp , [11] M. Veeraraghavan and K. S. Trivedi. "An improved algorithm for symbolic reliability analysis." IEEE Trans. Reliab., vol. 40, pp , [12] M. Ball "Computational Complexity of Network Reliability Analysis: An Overview." IEEE Trans. Reliab., Vol. 35, pp , [13] T. Gomes, J. Craveirinha, and L. Martins. An efficient algorithm for sequential generation of failures in a network with multi-mode components. Reliability Engineering & System Safety, Vol. 77, pp , [14] W.P. Dotson, J.O. Gobien, "A new Analysis Technique for Probabilistic Graphs", IEEE Trans. Circuits Syst., Vol. 26, No. 10, pp , October [15] J.P. Jarvis and D. R. Shier. "An improved algorithm for approximating the performance of stochastic flow networks." INFORMS Journal on Computing, vol. 8, pp , [16] C.L. Yang and P. Kubat. Efficient computation of most probable states for communication networks with multimode components. IEEE Trans. Commun., vol. 37, pp , [17] M.T. Gardner and C. Beard, "Evaluating geographic vulnerabilities in networks," Proc IEEE Int. Workshop on Communications Quality and Reliability (CQR), [18] M. T. Gardner, C. Beard, and D. Medhi,, "Avoiding high impacts of geospatial events in mission critical and emergency networks using linear and swarm optimization," Proc IEEE Int. Multi- Disciplinary Conf. Cognitive Methods in Situation Awareness and Decision Support (CogSIMA), New Orleans, LA, 2012, [19] S. Orlowski, R. Wessaly, M. Pioro, and A. Tomaszewski SNDlib 1.0 Survivable Network Design Library. Networks. 55, 3 (May 2010), , Wiley. [20] J.W. Eaton, Gnu Octave Manual. Network Theory Ltd. (2002).