Towards a Realistic Model for Failure Propagation in Interdependent Networks

Transcription

1 Towards a Realisic Model for Failure Propagaion in Inerdependen Neworks Agosino Suraro, Simone Silvesri, Mauro Coni, Sajal K. Das Deparmen of Mahemaics, Universiy of Padua, agosino.suraro@sudeni.unipd.i, coni@mah.unipd.i Deparmen of Compuer Science, Missouri Universiy of Science and Technology, {silvesris, sdas}@ms.edu arxiv: v1 [cs.ni] 28 Oc 2015 Absrac Modern neworks are becoming increasingly inerdependen. As a prominen example, he smar grid is an elecrical grid conrolled hrough a communicaions nework, which in urn is powered by he elecrical grid. Such inerdependencies creae new vulnerabiliies and make hese neworks more suscepible o failures. In paricular, failures can easily spread across hese neworks due o heir inerdependencies, possibly causing cascade effecs wih a devasaing impac on heir funcionaliies. In his paper we focus on he inerdependence beween he power grid and he communicaions nework, and propose a novel realisic model, HINT (Heerogeneous Inerdependen NeTworks), o sudy he evoluion of cascading failures. Our model akes ino accoun he heerogeneiy of such neworks as well as heir complex inerdependencies. We compare HINT wih previously proposed models boh on synheic and real nework opologies. Experimenal resuls show ha exising models oversimplify he failure evoluion and nework funcionaliy requiremens, resuling in severe underesimaions of he cascading failures. I. INTRODUCTION Modern neworks, such as he smar grid and communicaions neworks, are becoming increasingly inerdependen [1] [8]. As an example, he smar grid is an elecrical grid moniored and conrolled by one or more conrol ceners [9] hrough a communicaions nework. These conrol ceners remoely inerac wih smar devices, such as: smar meers, Auomaic Generaion Conrols (AGCs) and Phasor Measuremen Unis (PMUs), which direcly operae on he elemens of he grid. For insance, AGCs conrol power plans for energy generaion, while PMUs monior ransmission and disribuion subsaions. In urn, such smar devices, and he communicaions nework iself, are powered by he elecrical grid, hus generaing complex poenial feedback loops. These complex inerdependencies may severely affec nework funcionaliies. In paricular, a few iniial failures may easily spread across he neworks due o such inerdependencies, possibly causing cascade effecs wih a devasaing impac. A well-known example of such effecs occurred in Ialy in 2003 [6], [10]. An iniial failure in he power nework This work is parially suppored by he Defense Threa Reducion Agency gran HDTRA and by he NSF gran CNS Mauro Coni is suppored by a Marie Curie Fellowship funded by he European Commission under he agreemen No. PCIG11-GA This work is also parially suppored by he TENACE PRIN Projec 20103P34XC funded by he Ialian MIUR, and by he Projec Tackling Mobile Malware wih Innovaive Machine Learning Techniques funded by he Universiy of Padua. caused he failure of several nodes in he communicaions nework, which generaed a cascading effec ha lef half of he counry wih no elecriciy for several hours. A similar even affeced he Norheasern and Midwesern Unied Saes, and he Canadian province of Onario, in 2003 [11]. These evens are no uncommon, as beween 2003 and 2012, more han 600 regional ouages occurred in he USA, which affeced millions of people [12]. While lile informaion is available abou he naure of hese evens (i.e., being accidenal or maliciously originaed), we believe ha inerdependencies beween he smar grid and communicaions neworks should be paricularly proeced from malicious exploiaion. For he above reasons i is of fundamenal imporance o sudy and undersand he evoluion of failures in inerdependen neworks. Previous works mainly considered high level absracions ha allow o formulae elegan mahemaical frameworks, generally based on percolaion heory [13]. Unforunaely, hese approaches overlook several feaures of hese sysems, and assume homogeneiy of nework elemens, unrealisic failure propagaion condiions and even unrealisic opological consrains [1], [2], [4], [5], [7], [8]. As a resul, hese approaches, alhough mahemaically elegan, canno accuraely predic he dynamics of failure evoluion in real neworks. In his paper we propose a realisic model, HINT (Heerogeneous Inerdependen NeTwork), o sudy he evoluion of cascading failures in inerdependen neworks. In paricular, we focus on he power grid, he communicaions nework, and heir inerdependencies. Unlike previous works, we address he heerogeneiy of he srucure of he power grid by considering is nodes o be funcionally separaed in hree caegories: generaion, ransmission and disribuion. Similarly, we differeniae nodes in he communicaions nework, idenifying he conrol ceners ha remoely operae he power grid, and he relay nodes which are only responsible for daa communicaion. We define a se of logical and physical inerdependencies as well as a se of condiions o deermine he evoluion of failures across neworks. We furher compare our model, HINT, wih wo previously proposed approaches, using realisic synheic opologies, as well as real opologies from he Minnesoa Power grid [14] and communicaions nework [15]. Our experimenal resuls show ha exising approaches largely underesimae he effecs of cascading failures, due o heir simplifying assumpions.

2 On he conrary, our model is able o capure he complex funcionaliies and ineracions of hese sysems and represens an imporan sep owards an accurae model of cascading failures in inerdependen neworks. In summary, he major conribuions of his paper are: We propose HINT, a realisic model for failure propagaion in inerdependen power and communicaions neworks, which akes ino accoun heir heerogeneiy, as well as heir logical and physical inerdependencies. We define a se of condiions governing he evoluion of failures ha accoun for nework heerogeneiy and complex inerdependencies. We compare HINT wih previous models on synheic and real neworks. Resuls show ha our model beer predics he evoluion of cascading failures. II. EXISTING MODELS FOR FAILURE PROPAGATION Several models have been proposed o sudy he spreading of failures in inerdependen neworks [10], [16] [18]. Mos of hese works focus on he power grid and he communicaions nework, and share a common framework according o which boh neworks can be represened as undireced graphs. In paricular, he power grid is modeled as a graph G pow = (V pow, E pow ), while he communicaions nework as a graph G com = (V com, E com ). Dependencies beween nodes in he differen neworks are represened as a se E dep of edges beween nodes in he wo graphs. Due o he dependencies defined by he se E dep, a node failure in one nework may cause he failure of oher nodes wihin he same nework, as well as on he oher nework. Exising models for failure propagaion differ in how hey assign inerdependencies beween neworks and in how hey define he condiions ha a node mus mee in order o be considered operaional. In he following, we describe wo exising models ha we use for comparison wih he realisic model proposed in his paper. The firs model has been one of he firs proposed in his conex, in he pioneering work of Buldyrev e al. [10]. We refer o his model as he Uniform model. I is a relaively simple model, based on several simplifying assumpions. In conras, he second model has been recenly proposed [18], and addresses more general scenarios and more complex failure propagaion condiions. We refer o his model as he Small Clusers model. Figure 1 summarizes he noaions adoped for nodes and links. A. Uniform model The Uniform model [10] assumes ha all nodes, in boh he power and communicaions neworks, are homogeneous in erms of heir roles in he nework and in he failure propagaion process. Because of his uniform behavior, we refer o his model as he Uniform model. Inerdependencies: This model assumes he so called one-oone dependency, ha is, a node u in a nework depends on exacly one node v in he oher nework, and, vice-versa, v depends only on u. To represen his, we consider he edges in E dep o be undireced, and he iner-degree of each node o be exacly one. Figure 4a shows he srucure of he Uniform model. The roles of he represened nodes have no influence on his model. Boh assumpions menioned above considerably simplify he srucure of real neworks and heir inerdependencies. In fac, real neworks are highly heerogeneous, and heir inerdependencies can be muliple, direced and asymmerical. Failure propagaion: According o he Uniform model, a node u is considered operaional if i belongs o he gian componen of is nework and if he node v on which i depends, i.e., (u, v) E dep is also operaional. Le GC(G pow ) and GC(G com ) be he se of currenly operaional nodes in he gian componen of he power and communicaions nework, respecively. Le us consider a node u V pow in he power nework. This node fails if (i) u / GC(G pow ) (inra-nework failure), and (ii) (u, v) E dep s.. v GC(G com ) (iner-nework failure). Similar condiions can be easily defined for nodes in he communicaions nework. Given he above failure propagaion condiions, we provide in Algorihm Simulaion he scheme used o deermine he failure propagaion. We denoe by F 0 he iniial se of failed nodes a ime = 0, and we assume for simpliciy ha nodes iniially fail in he power nework 1, i.e., we assume F 0 V pow. Addiionally, we denoe by Fpow and Vpow he se of nodes ha a round are failed and operaional, respecively. We use a similar noaion, Fcom and Vcom, for he communicaions nework. Given he iniial failed nodes, he failure condiions are checked in phases. In he firs phase (lines 6-7), he algorihm checks he new inra-nework failures in he power nework, i.e., if here are nodes ha no more belong o he gian componen. In he second phase (lines 8-9), i checks if here are some addiional iner-nework failures, i.e., if some power nodes depend on failed communicaions nodes, and hence hey also fail. The las wo phases (lines 10-13) perform similar checks for nodes on he communicaions nework. The algorihm ieraes unil he cascading failure effecs converge and no more failures occur. B. Small clusers model The Small Clusers (SC) model [18] is more advanced and akes ino accoun differen roles of nodes in he communicaions nework, more complex nework inerdependencies and failure propagaion schemes. In paricular, his model inroduces wo ypes of nodes in he communicaions nework, conrol nodes and relay nodes. Conrol nodes are responsible for conrolling he funcionaliy of he nodes in he power grid, while relay nodes provide he communicaions infrasrucure of he communicaions nework. We refer o he se of conrol nodes as V cc, and o he se of relay nodes as V rl. Therefore, V com = V cc V rl. Figure 3a shows he srucure of he SC model. Only he roles of nodes in he communicaions nework are considered. 1 A similar approach can be used o consider nodes iniially failed in he communicaions nework, or in boh neworks.

3 Algorihm 1: Simulaion Inpu: G pow(v pow, E pow) power grid G com(v com, E com) communicaions nework F 0 V pow iniial se of failures Oupu: Graphs a seady sae, afer cascading failures // iniializaion 1 0; 2 Vpow Vpow 1 \ F 0 ; 3 Vcom V com; 4 while addiional failures are possible do 5 + 1; // Inra-nework failures for G pow 6 Fpow = nodes in Vpow 1 no in GC (G pow); 7 Vpow Vpow 1 \ Fpow; // Iner-nework failures for G pow 8 Fpow = nodes in Vpow wih no suppor in G com; 9 Vpow Vpow \ Fpow; // Inra-nework failures for G com 10 Fcom = nodes in Vcom 1 no in o GC (G com); 11 Vcom Vcom 1 \ Fcom; // Iner-nework failures for G com 12 Fcom = nodes in Vcom wih no suppor in G pow; 13 Vcom Vcom \ Fcom; Inerdependencies: The model adops an inerdependency srucure known as he k-n dependency, iniially proposed in [17]. According o his model each node in G pow depends on k conrol nodes in G com, while every conrol node in G com suppors n nodes in G pow. Addiionally, every node in G com depends on one power node in G pow for power supply. Dependencies are direcional and asymmeric, so if a node u depends on a node v, i does no imply ha v depends on u. Since dependencies are direcional (arcs insead of edges), wo differen ses of dependency arcs are inroduced, A crl V pow V com and A energy V com V pow, where is he Caresian produc operaion. An arc (u, v) A crl means ha he power node u is conrolled by he conrol cener v. Similarly, an arc (u, v) A energy means ha a communicaions node u is powered by a node v of he power nework. Failure propagaion: The SC model is based on he observaion ha he gian componen, as a crieria o deermine if a node is funcional, is no represenaive of he operaion of real sysems. The auhors poin ou in [18] ha sufficienly large componens can also be operaional, alhough disconneced from he gian componen. For his reason, he model inroduces a hreshold on he size of a componen, above which he nodes are considered o be able o operae. In addiion, such nodes also need o have a leas an inerlink o he oher nework. As a resul, some auonomous clusers can keep operaing alhough hey become disconneced from he gian componen. In he SC model, he propagaion of failures across neworks is deermined using a scheme similar o he Uniform model. We do no provide he pseudo-code due o space limiaions. However, i can be easily obained from Algorihm Simulaion by subsiuing he failure condiions of he Uniform model wih hose of he SC model. The SC model significanly improves previous approaches, however i sill overlooks several imporan aspecs of real sysems. In paricular, all nodes in he power neworks are considered homogeneous, while in real power sysem we observe nodes which produce energy, ransfer energy, and disribue energy. In addiion, he size of a componen alone is no sufficien o deermine is capabiliy o operae. For insance, a group of subsaions will no be able o disribue any energy if i is no conneced o any power plan. Finally, he SC model only considers logical dependencies of power nodes wih he conrol cener. I does no consider ha such conrol can only be realized if he power nodes can access he communicaions nework hrough a relay node o communicae wih heir conrol cener. In he nex secion we inroduce our realisic failure propagaion model, which akes ino accoun hese aspecs of real sysems. III. A REALISTIC MODEL FOR FAILURE PROPAGATION In his secion we inroduce HINT, our proposed model for realisic failure propagaion in inerdependen power and communicaions neworks. Unlike he Uniform and SC models, HINT specifically addresses he heerogeneiy of he srucure of boh neworks, and differeniaes beween logical and physical inerdependencies. Based on hese feaures, we define a se of condiions o deermine he spreading of inraand iner-nework failures. Nework heerogeneiy: We consider nodes in he power grid G pow o be funcionally separaed in hree caegories 2 : generaion nodes V gen, ransmission nodes V s, and disribuion nodes V ds. Generaion nodes, such as power plans, produce elecriciy. Transmission nodes connec power lines and are used for swiching curren. Finally, disribuion nodes are subsaions conaining ransformers ha sep down he volage and disribue elecriciy o he final users. Similarly, we differeniae nodes in he communicaions nework G com considering conrol ceners V cc, ha remoely operae he power grid, and relay nodes V rl which are only responsible for daa communicaion. Figure 2a shows he srucure of HINT, he noaion is explained in Figure 1. The roles of all he represened nodes are aken ino accoun by our model. Inerdependencies: HINT specifically considers logical and physical inerdependencies beween he power and he communicaions nework. Physical dependencies occur beween he nodes in he communicaions nework and nodes in he power nework. In paricular, a node in he communicaions nework has a physical dependency wih he nodes in he power nework from which i receives power. Differenly from previous works, we impose ha only disribuion nodes can provide power o he communicaions nodes, as is he case in real sysems. We represen such dependencies wih he se of direcional iner-arcs A energy. 2 We do no address he cusomer level of he power grid in his work, since i has marginal effecs on he failure propagaion. Neverheless, he model can be easily exended o also include such level.

4 Logical dependencies occur beween nodes in he power nework and conrol ceners in he communicaions nework. These dependencies represen he conrol ha power nodes need o operae, and are represened by he se of arcs A crl. Finally, we inroduce a new kind of physical dependencies beween power nodes and communicaions nodes. In fac, alhough a power node is conrolled by a conrol cener, his conrol is only possible if he power node can access he communicaions nework. For his reason, in our model each node in he power nework has a physical dependency wih a relay node, which is used o access he communicaions nework. We represen such dependencies wih he se of direcional iner-arcs A info. Noe ha he dependencies in A crl indicae he required logical informaion-exchange wih he conrol cener, while he dependencies in A info refer o acual links used o exchange such informaion. Failure propagaion: The failure propagaion scheme in HINT akes ino accoun he heerogeneiy of nodes as well as he physical and logical dependencies described above. In he following, we denoe by op(u) he fac ha node u is currenly operaional, and by op(u) oherwise. Addiionally, given wo nodes, u and v, in he same nework, we inroduce he funcion pah(u, v). This funcion reurns a se of nodes ha are currenly operaional and consiue a pah from u o v in heir nework, if i exiss, and oherwise. We consider a node u in he communicaions nework o fail only if none of he disribuion subsaions i draws power from is operaive. Tha is, u fails if v s.. (u, v) A info, op(u). Noe ha, as in real sysems, in our model he funcionaliy of a node in he communicaions nework does no depend on he size of he componen i belongs o, as long as i receives power. According o HINT, a node v in he power grid may fail for several reasons. Node v fails if all he conrol ceners ha are responsible for is operaion have failed, ha is u s.. (v, u) A crl, op(u). Addiionally, alhough some conrol ceners may be operaional afer he failure, such conrol canno be performed if v canno access he communicaions nework because he relay nodes i uses for his purpose have failed. For his reason we also inroduce he following condiion, v fails if u s.. (v, u) A info, op(u). The access o he communicaions nework is necessary bu no sufficien o ensure he operaion of v. In fac, for a conrol cener o be able o properly conrol v, here mus be conneciviy beween he conrol cener and a leas a relay node ha v uses o access he communicaions nework. Formally, v fails if u, q s.. (v, u) A info and (v, q) A crl, pah(u, q) =. Finally, a node v in he ransmission and disribuion nework can be operaional only if i receives power from a generaor. We model his by allowing v o be funcional only if here exiss a leas a pah in he power nework ha connecs v o a generaor which is currenly operaional. In oher words, a disribuion or ransmission node v fails if q V gen s.. op(q), pah(v, q) =. IV. AN EXAMPLE OF FAILURE PROPAGATION In his secion we presen an example o compare he evoluion of cascading failures under he Uniform, SC and HINT models. Figure 1 summarizes he noaions adoped for nodes and links. Figure 2a shows he considered example. The scenario includes a power grid wih wo generaors, wo ransmission subsaions, and hree disribuion nodes. The communicaions nework, on he oher hand, has a single conrol cener and several relay nodes ha enable communicaions wih he nodes in he power grid. All he nodes in he power grid have a logical dependency wih he conrol cener, bu hey also have physical dependencies wih relay nodes in he communicaions nework o realize such conrol. Finally, nodes in he communicaions nework also have physical dependencies on he nodes in he disribuion level of he power grid, from which hey receive power supply. In his example, we consider an aack ha disables he disribuion subsaion D3. According o our model, HINT, he apparenly innocuous failure of D3 has devasaing effecs. In paricular, he failure of D3 causes he failure of he relay R6, since D3 provides energy o i. However, R6 is used by T2 o access he communicaions nework, and hence T2 also fails. This disconnecs he generaor G2, leading o several oher cascading effecs on boh neworks and erminaing in he configuraion shown in Figure 2b. We consider he same scenario under he SC model in Figure 3. We se = 4. Figure 3a shows he iniial configuraion. I is imporan o noe ha he SC model does no consider he physical dependencies beween power nodes and he relay nodes used o access he communicaions nework. As a resul, his model does no fully capure he cascade generaed by he failure of D3. In paricular, he failure of D3 only causes he failure of R6. No addiional failure occurs, since he dependency of T2 from R6 is no considered by he model, and he surviving componens are larger han. As a resul, he model underesimaes he final failures, as shown in Figure 3b. In his example, any value of less han 6 leads o he same final resul. Figure 4 shows he same scenario under he Uniform model. We recall ha his model imposes one-o-one dependencies. As a resul, we canno include all he acual dependencies. In order o keep as many as possible, we use a maximum maching algorihm. Firs we creae a biparie graph consising of power grid nodes, communicaions nework nodes and heir inerdependencies. Then we run he algorihm o selec he larges se of edges such ha no wo edges share a common verex. This way, we can keep he maximum number of dependencies wihou violaing he one-o-one requiremen of he model and obain he iniial configuraion shown in Figure 4a. Several dependencies are necessarily lef ou, which reduces he accuracy of he model. In paricular, he failure of D3 only causes he failure of R6, because afer hese failures all nodes are sill par of he gian componen of heir respecive neworks. Therefore, he Uniform model also underesimaes he final failures, as shown in Figure 4b.

5 Fig. 1: Graphical noaion used for nodes and links in Figures. Fig. 2: Scenario 1, proposed realisic model HINT: iniial configuraion, final sable sae. Fig. 3: Scenario 1, SC model: iniial configuraion, final sable sae = 4. Fig. 4: Scenario 1, Uniform model: iniial configuraion, final sable sae. V. EXPERIMENTAL RESULTS In his secion we compare our model, HINT wih he Uniform and SC models hrough simulaion experimens. We use realisic synheic nework opologies as well as real nework opologies. The simulaor we developed o run hese experimens uses he NeworkX library [19], we called i TiedNes and made i freely available on GiHub [20]. The synheic power nework is creaed according o he realisic RT-nesed-Smallworld model proposed in [21]. This model generaes a given number of well conneced subneworks, which are subsequenly inerconneced. We generaed power neworks wih 1000 nodes and 20 subneworks. The average node degree is 4, which is a ypical value for real neworks such as he Unied Saes Norheasern power nework and he European power nework [21]. Since he model does no specify how o classify nodes in he resuling power grid, we used 100 generaors, 270 ransmission subsaions and 630 disribuion subsaions. We assigned such roles so ha each subne has a similar proporion of nodes in each caegory. We generaed a synheic communicaions nework using he Barabási-Alber model [22]. This model is well known o generae scale-free neworks wih power-law degree disribuion, and opological srucures similar o real communicaions neworks such as he Inerne. In his model, nodes are added ieraively. Each newly added node connecs o m exising nodes. The probabiliy of connecing o a node is proporional o is degree. In our experimens we se m = 3. We consider a special node in he nework as a conrol cener, while he remaining nodes are relay nodes. Also in his case we generaed a nework of 1000 nodes. We inerconnec he wo synheic neworks as follows. Each node in he power nework has a logical dependency from he conrol cener and also a physical dependency from a relay node in he communicaions nework. Each node in he communicaions nework has a dependency wih a node in he power nework from which i receives energy. All physical dependencies are randomly assigned. In order o validae HINT and compare i wih he Uniform and SC models, we also use real nework opologies. In paricular, we use he Minnesoa Power grid [14]. Our daa provides exremely deailed opological informaion, wih all power lines down o 69 kv and mos subsaions of he Sae. We wan o highligh ha his is he firs work ha makes use of such deailed daa. The nework has 1022 nodes. In addiion, we include generaor nodes using he lis of power plans provided in [23] and heir posiions [24]. Overall, we idenify 69 power plans ha include all power plans in he sae wih a producion higher han or equal o 14 MW. The oal number of nodes in he nework is hus The real communicaions nework is he fiber opics nework of Minnesoa provided by AuroraNe [15]. The nework has 681 nodes, o which we aach a node as a conrol cener, locaed in he viciniy of he mos populaed areas. We inerconnec he real neworks as follows. All nodes in he power nework have a logical dependency wih he conrol cener. We assign physical dependency using a geographic crierion. In paricular, power nodes depend on he neares relay node, while communicaions nodes depend on he neares disribuion subsaion. In all he following experimens, we average he resuls of several runs and show he achieved sandard deviaion. A. Random aacks In he firs se of experimens we compare he models under random aacks. In paricular, we iniially fail a given number of nodes seleced uniformly a random, and hen compare he

6 No. oal failures afer cascades HINT SC =20 SC =200 Uniform No. iniial failures from aacks No. iniial failures from aacks Fig. 5: Random aacks on synheic neworks, and on real neworks. No. oal failures afer cascades HINT SC =20 SC =200 Uniform 2000 final number of nodes ha have failed under he considered models afer he cascade. Figure 5a shows he resuls on synheic neworks. Our proposed model demonsraes he significan vulnerabiliy of he considered neworks agains random aacks. Aacking as few as 2.5% of he oal nodes may cause a complee ouage of boh he power and he communicaions neworks. The heerogeneiy of roles in boh nework, as well as he complex rules ha define he nodes abiliy o operae, unveil he exreme vulnerabiliy of hese neworks when coupled ogeher. These resuls highligh he imporance of considering nework inerdependencies when designing fuure smar grids, o improve heir robusness and reliabiliy. On he conrary, he oher wo models significanly underesimae he size of he cascade. In paricular, for he SC model we use wo seings for he hreshold, such as = 20 and = 200. The firs seing is used in [18], however, ha paper does no provide a mehodology o se. For comparison, we also considered = 200, ha imposes a significanly larger componen size for nodes o correcly operae. Neverheless, as Figure 5a shows, boh seing behave similarly. This is due o he high conneciviy of boh he power and he communicaions neworks, which prevens nework pariioning due o random aacks [25], and hus prevens furher spreading of failures. The only case of large scale failures occurs when he conrol cener fails due o he iniial aack. This jusifies he large variabiliy of he resuls shown by he error bars. The Uniform model apparenly performs beer han he SC model, being able o predic he failure of a higher number of nodes. However, his is due o he insabiliy of he sysem ha resuls from he one-o-one dependency assignmen requiremen by he model. Alhough we maximize he number of dependencies hanks o he use of he maximum maching (discussed in Secion IV), a perfec maching may no be possible, herefore leaving some nodes wih no dependency and unable o operae. Figure 5b shows he resuls for he random aacks in real neworks. HINT shows ha real neworks are more robus compared o he random neworks. This is due o he geographical assignmen of he dependencies, which closely resembles how nodes are inerconneced in realiy. In paricular, he geographic assignmen ends o localize failures in he nework, making i harder for few iniial failures o achieve a global cascading effec. On he conrary, in he synheic neworks inerdependencies are assigned a random, and a failure originaed in one par of a nework can easily spread o remoe pars of he oher nework. These resuls highligh he imporance of using real nework opologies for sudying he evoluion of cascading failures, which may reveal unexpeced effecs no capured by synheic models. The SC model in his case also underesimaes he final size of he cascade. For hese experimens we consider wo seing for he hreshold, = 20 and 200. Alhough he wo seings behave slighly differenly, in boh cases he model underesimaes he effecs of he failure. Overall, he inabiliy of he SC model o include physical dependencies and heerogeneiy of he power nework, significanly penalizes is accuracy and causes underesimaion of he final size of he cascade. Using real nework opologies, he Uniform model is criically unsable, due o he inabiliy of finding a suiable maximum maching. Because of he cascade of failures caused by he large number of unsuppored nodes, mos nodes fail wihou being aacked. B. Targeed aacks In he second se of experimens, we consider how HINT reacs o argeed aacks. Several previous works consider similar aacks [2], [4], generally based on he node degree. However, hese works are based on simplified models similar o he Uniform model, prevening a fine granulariy of he aack. In our work, we consider argeed aacks which specifically ake ino accoun he role of nodes in he nework and heir inerdependency wih he oher nework. In paricular our aacks focus on he power grid and es four kinds of aacks. The firs aack iniially fails disribuion nodes in he power grid, in decreasing order of heir iner-degrees (he number of nodes ha depend on hem in he oher nework). The oher hree aacks, insead, consider disribuion, ransmission and generaion nodes, respecively, in decreasing order of heir inra-degree (he number of nodes hey are conneced o in heir own nework). Figure 6 shows he resuls of he experimens discussed above. As he figure poins ou, aacking disribuion subsaions according o heir iner-degrees is he mos effecive in erms of final failures. In fac, hese aacks cause he failure of several relay nodes ha depend upon hose disribuion subsaions, herefore limiing he access o he communicaions nework and riggering furher failures ha overall generae devasaing effecs. The aack on disribuion and ransmission subsaions, based on inra-degrees, has less effecs. Neverheless, he aack on disribuion subsaions has more impac due o heir role in providing energy o he communicaions nework. The aack on sole generaors has no paricular impac unil here is a leas one acive generaor. We recall ha we have 69 generaors in he real opologies ha we consider. This shows a limiaion of our approach ha only considers conneciviy o he generaors as a sufficien condiion for a power node o provide sufficien energy o

7 No. oal failures afer cascades No. iniial failures from aacks Iner-degree disribuion Inra-degree disribuion Inra-degree generaor Inra-degree ransmission Fig. 6: Targeed aacks on real neworks. he communicaions nework. In realiy, generaors have a maximum producion capaciy ha canno be exceeded. We will consider hese aspecs in our fuure works. VI. RELATED WORKS The sudy of failure propagaion in inerdependen neworks has received considerable aenion in recen years [1] [8], [26] [28]. Buldyrev e al. inroduced his new research area in heir pioneering work [10]. In our work, we adop he Uniform model described in his paper. In paricular, an iniial failure is generaed by failing a fracion 1 p of nodes. Addiional failures occur wihin neworks, according o a crieria based on he gian componen, and across nework, due o he inerdependencies. The Uniform model has been exended in numerous ways, surveyed in [13]. In paricular, in [29] nodes are allowed o have a random number of inerdependencies. In [27], [28], [30] iner-edges are assigned according o an iner-similariy measure such ha nodes wih high inra-degrees end o be dependen on each oher. The auhors of [2], [4] consider nonuniform argeed aacks, while he works in [1], [26], [31], [32] consider a generalizaion o he case of n inerdependen neworks. Finally, a recen work [18] proposes he small clusers (SC) model discussed in his paper. This model exends he analysis by considering clusers of nodes above a cerain size as operaional. VII. CONCLUSION In his paper we proposed a realisic model for failure propagaion in he inerdependen power and communicaions neworks. Our model, HINT, considers heerogeneiy of nework elemens, complex logical and physical inerdependencies, as well as complex failure propagaion condiions. We experimenally compare HINT agains wo exising models. We adoped synheic and real neworks and considered random and argeed aacks. Resuls show ha previous approaches overlooked several criical aspecs of he sysem funcionaliy, which ofen resul in an underesimaion of he failure propagaion process. HINT provides he basis for fuure developmen of formal frameworks o predic he evoluion of failures, as well as o analyze and improve heir robusness. REFERENCES [1] J. Gao, S. V. Buldyrev e al., Neworks formed from inerdependen neworks, Naure Physics, vol. 8, no. 1, [2] G. Dong, J. Gao e al., Percolaion of parially inerdependen neworks under argeed aack, Physical Review E, vol. 85, no. 1, [3] G. Dong, L. Tian e al., Robusness of n inerdependen neworks wih parial suppor-dependence relaionship, EPL (Europhysics Leers), vol. 102, no. 6, Jun [4] X. Huang, J. Gao e al., Robusness of inerdependen neworks under argeed aack, Physical Review E, vol. 83, no. 6, [5] M. Barhlemy, Spaial neworks, Physics Repors, vol. 499, no. 13, [6] V. Rosao, L. Issacharoff e al., Modelling inerdependen infrasrucures using ineracing dynamical models, Inernaional Journal of Criical Infrasrucures, vol. 4, no. 1, pp , [7] Y. Hu, B. Ksherim e al., Percolaion in inerdependen and inerconneced neworks: Abrup change from second- o firs-order ransiions, Physical Review E, vol. 84, no. 6, [8] A. Bashan, R. Parshani, and S. Havlin, Percolaion in neworks composed of conneciviy and dependency links, Physical Review E, vol. 83, no. 5, [9] G. Locke and P. D. Gallagher, NIST framework and roadmap for smar grid ineroperabiliy sandards, release 1.0, Naional Insiue of Sandards and Technology, [10] S. V. Buldyrev, R. Parshani e al., Caasrophic cascade of failures in inerdependen neworks, Naure, vol. 464, no. 7291, Apr [11] U.S.-Canada Power Sysem Ouage Task Force, Final Repor on he Augus 14, 2003 Blackou in he Unied Saes and Canada, [12] Execuive Office of he Presiden, Economic benefis of increasing elecric grid resilience o weaher ouages, [13] J. Gao, D. Li, and S. Havlin, From a single nework o a nework of neworks, Naional Science Review, Jul [14] Minnesoa Dep. of Commerce, Minnesoa high volage ransmission line and subsaion daa, [15] Minnesoa Fiber-Opic Nework, Aurora fiber-opic neworks, [16] S. V. Buldyrev, N. W. Shere, and G. A. Cwilich, Inerdependen neworks wih idenical degrees of muually dependen nodes, Physical Review E, vol. 83, no. 1, [17] Z. Huang, C. Wang e al., Balancing Sysem Survivabiliy and Cos of Smar Grid Via Modeling Cascading Failures, IEEE Transacions on Emerging Topics in Compuing, vol. 1, no. 1, Jun [18] Z. Huang, C. Wang e al., Small Cluser in Cyber Physical Sysems: Nework Topology, Inerdependence and Cascading Failures, IEEE Transacions on Parallel and Disribued Sysems, vol. 26, no. 8, Aug [19] A. A. Hagberg, D. A. Schul, and P. J. Swar, Exploring nework srucure, dynamics, and funcion using NeworkX, in Proceedings of he 7h Pyhon in Science Conference (SciPy2008), Aug [20] TiedNes, hps://gihub.com/tiednes/tiednes, [21] Z. Wang, A. Scaglione, and R. Thomas, Generaing Saisically Correc Random Topologies for Tesing Smar Grid Communicaion and Conrol Neworks, IEEE Transacions on Smar Grid, vol. 1, no. 1, Jun [22] A.-L. Barabsi and R. Alber, Emergence of Scaling in Random Neworks, Science, vol. 286, no. 5439, Oc [23] Power plans in Minnesoa, hp:// accessed: [24] Enipedia, hp://enipedia.udelf.nl, accessed: [25] R. Alber, H. Jeong, and A.-L. Barabasi, Error and aack olerance of complex neworks, Naure, vol. 406, no. 6794, Jul [26] S.-W. Son, G. Bizhani e al., Percolaion heory on inerdependen neworks based on epidemic spreading, EPL (Europhysics Leers), vol. 97, no. 1, Jan [27] D. Cellai, E. Lpez e al., Percolaion in muliplex neworks wih overlap, Physical Review E, vol. 88, no. 5, Nov [28] R. Parshani, S. V. Buldyrev, and S. Havlin, Criical effec of dependency groups on he funcion of neworks, Proceedings of he Naional Academy of Sciences, vol. 108, no. 3, Jan [29] J. Shao, S. V. Buldyrev e al., Cascade of failures in coupled nework sysems wih muliple suppor-dependence relaions, Physical Review E, vol. 83, no. 3, Mar [30] Y. Hu, D. Zhou e al., Percolaion of inerdependen neworks wih inersimilariy, Physical Review E, vol. 88, no. 5, Nov [31] G. Dong, J. Gao e al., Robusness of nework of neworks under argeed aack, Physical Review E, vol. 87, no. 5, [32] J. Gao, S. V. Buldyrev e al., Robusness of a nework formed by n inerdependen neworks wih a one-o-one correspondence of dependen nodes, Physical Review E, vol. 85, no. 6, 2012.