Cascade-based attacks on complex networks ——Adilson E. Motter,中英文对照版

Cascade-based attacks on complex networks

Adilson E. Motter1, ?and Ying-Cheng Lai1, 2

1Department of Mathematics, CSSER, Arizona State University, Tempe, Arizona 85287

2Departments of Electrical Engineering and Physics, Arizona State University, Tempe, Arizona 85287 We live in a modern world supported by large, complex networks. Examples range from financial marketsto communication and transportation systems. In many realistic（现实的）situations the flow of physical quantities in thenetwork, as characterized by the loads on nodes, is important. We show that for such networks where loads canredistribute among the nodes, intentional attacks can lead to a cascade of overload failures, which can in turncause the entire or a substantial part of the network to collapse. This is relevant for real-world networks thatpossess a highly heterogeneous distribution of loads, such as the Internet and power grids. We demonstrate thatthe heterogeneity of these networks makes them particularly vulnerable to attacks in that a large-scale cascademay be triggered by disabling a single key node. This brings obvious concerns on the security of such systems.

我们生活在一个由庞大复杂网络构成的社会。例子从金融市场到通信传输系统。在很多现实的情况下，网络中一些物理量的流动——比如节点的负载——是很重要的。在一个负载可以在节点之间重新分布的网络中，我们指出，蓄意的攻击可以导致级联的超载失效，进而导致整个或大部分网络崩溃。这和拥有很高非均衡负载分布的现实世界的网络，例如电网，是相似的。我们表示那些网络的非均衡使它们在受到攻击时特别脆弱，一个大规模级联的网络也许就会因为单个关键节点的失效而瘫痪，比如印度电网。

Complex networks are an essential part of a modern society[1, 2]. It has been shown that many networks, such as theworld-wide web , the Internet, and electrical powergrids, present a surprisingly small average distance betweennodes and a highly organized distribution of links per node[3, 4, 5]. Generally, the average distance will not be affectedby the removal of a random subset of nodes, but it will increasesignificantly if the removed nodes are among the mostconnected ones [3] (see also Refs. [6, 7, 8]). The existence ofa giant connected component in the network, however, doesnot depend on the presence of highly connected nodes.

复杂网络是现在社会最基础的部分。很多网络，比如万维网、互联网、电网，呈现出一个相当小的节点间平均距离和高度有序的分布的节点间的连接。大体上来说，平均距离不会被任何一个子节点的移除所影响，但会因为移除一个与之相连的节点数最多的节点而显著增长。一个网络中高度相连的一部分的存在与否，however，并不依赖一个高度相连的节点的存在。Forinstance, the WWW has homepages with many thousands ofhyperlinks and can remain well connected after the removal ofall homepages with five or more hyperlinks [9]. In addition,the giant component itself is typically a small-world network[10] even after the removal of all highly connected nodes [11].These pioneering studies on network security address mainlystatic properties, i.e., the effect of different networkarchitectures.They suggest that the network connectivity, and henceits functionability, is robust against random failure of nodes[3, 6, 7] and to some extent is even robust against intentionalattacks [9, 11]. Here we show that for many physical networks,the removal of nodes can have a much more devastatingconsequence when the intrinsic dynamics of flows ofphysical quantities in the network is taken into account.

比如，万维网中，有上千个超链接的主页，即使在去掉数个超链接后，也可以很好的与其它页面相连。此外，网络的一个大的组成部分，即使在去掉所有高度连接的节点后，自己也是一个典型的小世界网络。这些前沿的有关网络安全上的学术研究，主要是关于静态的内容的，也就是说，是关于不同网络结构的作用的。他们指出，网络的连接性，假设他们是可以用方程表示，在随机节点失效下是强健的，甚至在某种程度上，在故意攻击下仍然强健。现在我们提出，在很多物理网络中，考虑网络中物理量本质的流动特性，节点的移除可能会带来一个远比想象中大得多的毁灭性结果。

In apower transmission grid, for instance, each node (power station)deals with a load of power. The removal of nodes, eitherby random breakdown or intentional attacks, changes the balanceof flows and leads to a global redistribution of loads overall the network. This can trigger a cascade of overload failures[12, 13], as the one that happened on August 10, 1996 inthe western United States power grid [14, 15]. Another exampleis the Internet [16, 17, 18], where the load represents theamount of information a node (router) is requested to transmitper unit of time, and overloads correspond to congestion [19].Internet collapses caused by congestion have been reportedsince its very beginning [20]. In this Rapid Communication,we introduce a model for cascading failure in complex networksand show that it is applicable to realistic networks suchas the Internet and power grids.

例如，在一个传电网络中，每个节点（电厂）处理一部分电力负载。不管是随机损坏或者蓄意攻击，移除一个节点会改变电力流向的平衡，并会带来整个网络负载的重新分布。这会触法一个级联超载失效，正如在1996年8月10号美国西部的电网那样。另一个例子是关于互联网的，负载表示一个路由每单位时间需要处理的信息量，过载的话则会发生拥堵。很早就有关于互联网因为拥堵而导致崩溃的报道。在这个快速通信系统中，我们介绍了一个复杂网络中级联失效的模型，并证实它适用于证实的网络，比如互联网和电网。

For a given network, suppose that at each time step one unitof the relevant quantity, which can be information, energy,etc., is exchanged between every pair of nodes and transmittedalong the shortest path connecting them.The load at a nodeis then the total number of shortest paths passing through thenode [21, 22, 23]. The capacity of a node is themaximumloadthat the node can handle. In

man-made networks, the capacityis severely limited by cost. Thus, it is natural to assume thatthe capacity C j of node j is proportional to its initial load L j，

C j=（1+α）L j，j=1,2,..., N, (1) where the constantα≥0is the tolerance parameter, and N is the initial number of nodes. When all the nodes are on, thenetwork operates in a free-flow state insofar asα≥0. But,the removal of nodes in general changes the distribution ofshortest paths. The load at a particular node can then change.

对于一个给定的网络，假定每个时间单元，一个单位的相关的量，例如信息、电力等，从每一对节点之间传递，并且传递的路线是连接他们的最短路径。那么，一个节点的负载就是经过这个节点的所有最短路径的总的数量。一个节点的容量是它最大能处理的负载量。在人造网络中，容量严格地被成本限制着。因此，很自然的可以假设节点的容量C j正比于它的初始负载L j：

C j=（1+α）L j，j=1,2,..., N, (1) 其中，常数α≥0是容忍参量，N是初始节点数量。当所有节点正常工作的时候，只要α≥0，网络呈现出一种自由流动的状态。但是，节点的移除会导致全局最短路径的重新分布。特定节点的负载也会改变。

If it increases and becomes larger than the capacity, the correspondingnode fails. Any failure leads to a new redistributionof loads and, as a result, subsequent failures can occur. Thisstep-by-step process is what we call a cascading failure, or acascade. It can stop after a few steps but it can also propagateand shutdown a considerable fraction of the whole network[24]. A fundamental question is: under what conditions cansuch a global cascade take place?

如果负载一直增加，以至于大于了节点的容量，那么相应的节点就会失效。任何一个节点的失效又会导致一个新的负载重分布，那么，随后的失效也有可能发生。这样的一个一步一步的过程，我们称之为级联失效。它可能在几步后停下来，也可能继续，并瘫痪掉整个网络中可观的一部分。一个基本的问题是：在什么条件下，这样的整体级联失效会发生？

Here we focus on cascades triggered by the removal of asingle node. If a node has a relatively small load, its removalwill not cause major changes in the balance of loads,and subsequent overload failures are unlikely to occur. However,when the load at the node is relatively large, its removalis likely to

affect significantly loads at other nodes and possiblystarts a sequence of overload failures. Our result is thefollowing: global cascades occur if (1) the network exhibitsa highly heterogeneous distribution of loads; (2) the removednode is among those with higher load. Otherwise, cascadesare not expected. The distribution of loads is in turn highlycorrelated with the distribution of links: networks with heterogeneousdistribution of links are expected to be heterogeneouswith respect to load so that on average, nodes withlarger number of links will have higher load [22]. This resultconfirms the

robust-yet-fragile property of heterogeneousnetworks, which was first observed in Ref. [3] for the attackon several nodes. The cascade effect is important, however,because a large damage can be caused in this case by the attackon a single node. While a network with more links canbe more resistant against cascading failures, in practice thenumber of links is limited by cost.

现在我们主要研究移除一个节点所触发的级联失效。如果一个节点的负载相对比较小的话，移除它并不会影响整体的负载平衡，其后的过载失效并不太可能会发生。然而，当一个节点的负载相对比较大的时候，移除它很可能显著地影响其它节点的负载，然后导致一系列的过载失效。我们的结论如下：下列条件下，全局级联失效会发生：（1）网络呈现出高度的负载不均衡性；（2）移除的节点负载较高。其它情况下，级联失效并不太可能发生。负载的分布一次高度依赖于连接的分布：平均而言，网络连接的非均衡性导致了负载也具有非均衡性，有着更多连接的节点会有更高的负载。这个结论证实了非均衡网络的健壮和脆弱的双重特性。级联效应很重要，因为一个很大的损坏可能只是因为针对一个节点的攻击。虽然拥有更多连接的网络可以更能抵抗级联失效，可是实际上连接的数量会被成本所限制。

Now we provide evidence for our result. We study cascadestriggered by randombreakdown and by intentional attacks. Tosimulate the former, we choose a trigger at random among allthe nodes of the network, as can occur in networks such aspower grids [14]. In the case of attack the targeted node is selectedfrom those with highest loads or largest degrees (numberof links at a node). We consider heterogeneous networkswith algebraic (scale-free) distribution P of links, as observedin real systems [2, 5, 25, 26],

P k~k?γ, (2) where k denotes the degree and γthe scaling exponent, andcompare them with an equivalent homogeneous configuration.These networks are generated according to the procedure inRefs. [27, 28], where the nodes are connected randomly fora given degree distribution, and selfand repeated links areforbidden. The damage caused by a cascade is quantified interms of the relative size G of the largest connected component,

G=N′N(3) where N and N’are the numbers of nodes in the largest componentbefore and after the cascade, respectively.

我们现在为结论提供论据。我们知道级联失效可能因为随机损坏或者故意攻击。为了模拟前者，我们在网络中随机选择一个节点作为触发，正如电网中可能发生的一样。在故意攻击的情况下，目标节点是从那些负载最高，或者度（节点的连接数）最大的节点中选取。我们设非均匀网络有着代数P分布，这和实际观察系统中的一致：

P k~k?γ, (2) 其中k表示度，γ表示衰减指数，将它们和均衡分布结构相比。这些网络由附录27和28的步骤产生，其中节点随机地由给定的度分布连接（？），并且不允许自己和自己连接，也不允许重复的连接。由级联失效带来的影响定义为失效后最大部分的大小与总大小的比值G:

G=N′N(3) 其中N和N’分别代表在级联失效前和后，网络中最大部分的节点数目。

Figure 1 shows the relative size G of the largest componentafter cascading, as a function of the tolerance parameterα,for a scale-free network. We can see that on average G remainsclose to unity in the case of random breakdowns but itis significantly reduced under intentional attacks, even

forαunrealistically large. Indeed, the size of the largest componentis reduced by more than 20% forα= 1, i.e., for a capacityas large as two times the capacity required for the system tooperate when all the nodes function normally. This result isin agreement with intuition, because in the case of randombreakdown the trigger is probably one of the many nodes withsmall load, while in the case of intentional attack it is a nodewith very large load. The damage is larger for smaller values ofα, as it is for load-based attacks when compared withdegree-based attacks. For instance, in the load-based attackforα= 0.2, more than 60% of the nodes are affected. For the5000-node networks used in our simulations, it means that acascade triggered by the attack on a single node shuts downand disconnects more than 3000 others!

图1显示，对于一个无标网络，级联失效后，相对大小G是一个以容忍度α为变量的方程。在随机损坏的情况下，平均的G很接近于1，但是G在故意攻击下会有明显的下降，即使α大到了一个实际情况中很夸张的值的时候。事实上，最大剩余部分在α=1，——实际容量是正常情况下系统要求容量的两倍——的时候都减少了20%以上。这样的结果很容易想象，因为在随机损坏的时候，影响系统的节点很可能只是那些负载很小的；但是在故意攻击的时候，失效的节点总是那些负载较大的。这样的瘫痪随着α变小而增大，同时攻击负载高的节点比攻击度大的节点瘫痪更大。比如，在α=0.2的时候，攻击负载高的节点会导致60%以上的节点受到影响。在模拟中，一个5000个节点的网络，攻击单一的一个节点带来的级联失效，断开了超过3000个节点的连接。

FIG. 1: Cascading failure in scale-free networks, as triggered bythe removal of a single node chosen at random (squares), or amongthose with largest degrees (asterisks) or highest loads (circles), whereαis the tolerance parameter and G is the relative size of the largestconnected component. Each curve corresponds to the average over5 triggers and 10 realizations of the network. The error bars representthe standard deviation. The networks are generated accordingto the algebraic distribution (2). For the computations shown we setγ= 3 and 5000 ≤N ≤5100. The average degree in the largestcomponent is k≈2.0.

图1：无标网络中的级联失效效应。正方形、星形、圆形分别代表移除随机节点、度最高的节点和负载最高节点后剩下最大网络的相对大小。α是容忍量，G是剩下最大网络的相对大小。每个曲线代表网络中超过5种触发条件和10种现实情况的平均数。错误条表示标准偏差。网络根据代数式（2）建立。在计算的时候，我们去γ= 3 和5000 ≤N ≤5100。最大部分的平均度为k≈2.0。

Figure 2 shows the corresponding results for a homogeneousnetwork with the same number of nodes and exactly3 links per node. To make a meaningful comparison we displayin the inset results for an algebraic network with aboutthe same average degree (actually larger, which strengthensour conclusions). The homogeneous network does not experiencecascading failures due either to random breakdown orto intentional attacks forαas small as 0.05. For the heterogeneous(scale-free) network, for the same value of α, cascadestriggered by the attack on a key node can reduce the largestconnected component to less than 10% of the original size,as shown in the inset. Therefore, homogeneous networks appearto be more robust against attacks than the heterogeneousones.

图2显示，有着和图1同样多节点数，但是每个节点都有3个链接的均衡网络的结果。为了让对比更有说服力，我们嵌入了有着差不多的平均度的代数网络（实际上度要大一点，这样可以使结论更有说服力）。即使α已经小到了0.05的时候，无论是随机损坏还是故意攻击，均衡网络都没有表现出级联失效的现象。嵌入的图表示，对于无标非均衡网络，在α相同的时候，故意攻击关键节点导致的级联失效会使最大剩余部分变得不超过原来大小的10%。因此，均衡网络的鲁棒性比非均衡网络更好。

This conclusion does not rely on the particularities ofthese models, as the same was also observed

for classes ofnetworks with exponential and Poisson-like distributions ofdegrees (e.g., the

Erd¨os-R′enyi model [29]): their homogeneitymakes them relatively resistant to cascades triggered byattacks. The networks corresponding to the inset of Fig. 2 aregenerated according to the same scaling distribution of thosein Fig. 1, except that in this case the minimal number of linksat a node is set to be 2. Therefore, this inset shows that thefragility of scale-free networks is due to their heterogeneityand does

not rely on the presence of nodes with degree one,which are easily disconnectable. Naturally, the increase of theaverage degree reduces the damage of the cascade, as can beseen from a comparison between Fig. 1 and the inset of Fig.2.

从我们观测的度数遵从泊松分布的网络来看，上述结果并不依赖于模型的一些具体细节。他们的均衡特性让他们在攻击下更不容易发生级联失效。图2内嵌的图的网络是采用和图1相同衰减比例分布产生的，只是一个节点最小的连接数变成了2.因此，内嵌的图表明了无标度网络的脆弱性是因为它的非均衡特性，而不是依赖于一个可以轻易被拆掉的度为1的节点的存在。自然的，网络的平均度的增加会减少级联失效效应，我们可以对比图1和图2来得出此结论。

FIG. 2: Cascading failure in homogeneous networks. All nodes areset to have the same degree k = 3 and N = 5000. In the inset, thenetworks are generated according to the algebraic distribution (2) for k ≥2, γ= 3, and N = 5000. The resulting average degree is k≈3.1. The legends and other parameters are the same as in Fig.1

.图2：均衡网络的级联失效。所有的节点都有k=3的度，节点数N=5000。内嵌图的网络是由代数分布（2）产生的，其中k ≥2, γ= 3,N = 5000。结果的平均度约等于3.1。图例和其它参数和图1一致。

Many real-world networks are heterogeneous and as suchare expected to undergo large-scale cascades if some vitalnodes are attacked, but rarely in the case of random breakdown.As an example we consider the Internet at autonomoussystem level [30], which displays an algebraic distribution oflinks [3]. The damage caused by triggers of higher load or degreeis much larger than that by random breakdown, as shownin Fig. 3. The cascading failures are rarely triggered by randombreakdownfor α>0.05, butmore than 20%of the nodescan be disconnected with the intentional attack on only onenode forα≤0.4.

很多真实世界的网络都是非均衡的，因此都会在关键节点被攻击的时候——而不是随机损坏下——经受大规模级联失效。我们以一个在自制系统的层面上，有着代数分布式连接的因特网为例子。如图3所示，因为高负载或者度高的节点所触发的破坏远比随机损坏大。当α>0.05的时候，大规模级联失效几乎就不可能因为随机损坏发生；但是，α≤0.4的时候，故意攻击仅一个节点可以瘫痪至少20%的节点。

We have also considered the electricalpower grid of the western United States [31]. The degree distributionin this network is consistent with an exponential [32]and is thus relatively homogeneous. The distribution of loads,however, is more skewed than that displayed by semirandomnetworks [27, 28]

with the same distribution of links, indicatingthat the power grid has structures that are not captured bythese models. As a result, global cascades can be triggered byload-based intentional attacks but not

by random or degreebasedremoval of nodes, as shown in Fig. 4. We see thatthe attack on a single node with large load reduces the largestconnected component to less than a half of its initial size, evenwhen the network is highly tolerant (e.g., α= 1).

我们同样考虑了美国西部的电网。电网的度分布符合一个指数分布，因此它相当均衡。但是负载的分布和连接的分布，和半随机网络并不相同，因此电网有着和模型中都不相同的结构。因此有着图4的结论，全局的级联失效会被基于负载的故意攻击引起，而不会被随机损坏或者基于度的故意攻击引起。我们发现攻击一个高负载的节点会使剩下的连接的最大部分剩下不到原来的50%，哪怕这样的网络有着相当高的容忍度（即α=1）。

FIG. 3: Cascading failure in the Internet at autonomous system level[30]. The network has N = 6474 nodes and

k≈3.88linksper node, on average. Each curve corresponds to the average over 5triggers for attacks and 50 for random breakdown. The legends areas defined in Fig. 1.

因特网独立系统层面上的级联失效。网络节点数N=6474，每个节点的度平均值为k≈3.88。每条曲线代

表5个攻击触发的结果和50个随机损坏。图例和图1一样。

FIG. 4: Cascading failure in the Western U.S. power transmissiongrid [31], which has N = 4941 and k≈2.67. The average isobtained via 5 triggers for attacks and 50 for random breakdown.The legends are the same as in Fig. 1.

美国西部输电网络的级联失效图。节点数N=4941，平均度k≈2.67。每条曲线代表5个攻击触发的结果和50个随机损坏。图例和图1一样。

Our result is thus that real networks are naturally evolvedto be quite resistant to random failure of nodes, but the presenceof a few nodes with exceptionally large load, which isknown to be ubiquitous

in natural and man-made networks,has a disturbing side effect: the attack on a single importantnode (one of those with high load) may trigger a cascade ofoverload failures capable of disabling the network almost entirely.Such an event has dramatic consequences on the networkperformance, because the functionability of a networkrelies on the ability of the nodes to communicate efficientlywith each other. What is the use, say, of having a phone if youcannot call anybody?

我们的结论显示了，现实网络已经自然进化到了可以抵御节点的随机损坏，但是一些节点的存在，特别是普遍存在于人造网络的高负载节点，有着令人不安的副作用：对单个重要节点（有着高负载的节点）的攻击可能会引发让整个网络瘫痪的级联超载失效。这样的事情让网络的表现带有一些戏剧性，因为一个网络的可用方程表示的特性依赖于节点之间能够有效地相互交流。打个比方就是，一个不能打电话的电话，它又能做什么呢？

We conclude with some thoughts on the meaning of our resultsfor security. An effective attack relies on identifying vulnerabilitiesand is far from being random. Our society is geographicallydistributed in a way that natural hazards are by nomeans random [33]. An example is the crowding of

people,communication, transportation, and financial centers aroundseismic areas, like the Pacific Rim. Natural disasters and intentionalattacks can then have devastating consequences onthe complex networks underlying the society. These consequenceswill be more severe if the damage on one or fewnodes is capable of spreading over the entire network. Inthis sense a cascade-based attack can be much more destructivethan any other strategies of attack previously considered[3, 7, 8, 9, 28, 34, 35, 36].

我们以一些在安全方面的有意义的结论来总结这篇文章。一个有效的攻击是基于弱点识别而远不是随机地去试。我们的社会在地质灾害上的分布从来不是随机的。例子就是环太平洋地震带的人口密度，通信，交通，金融中心。自然灾害和故意攻击都可以对社会潜在的网络有着毁灭性的影响。如果这些灾害发生在一个或者数个关键节点上，那么将会影响到整个网络。这种情况下，级联失效带来的影响会比之前讨论的攻击策略更加具有毁灭性。