Introduction

One of important problems investigated in the theory of complex networks (TCN) is the search of groups of interconnected nodes, the identification of which contributes to a better understanding of principles of organizing the structure and operation processes of complex network systems. In real NS, the most common groups are so-called communitiessubnets, the connections between nodes of which are denser and stronger than between them and other network nodes [1,2]. Communities exist in the physical world, wildlife, economy, transportation, urban infrastructure [3,4], etc. In human society, communities can be considered public organizations, political parties, religious denominations, national diasporas, groups in social networks [5,6] and so on. Currently, the main attention is paid to the development of communities detection methods, which are based on the structural characteristics of network systemsthe smallest cut, hierarchical clustering, modularity or entropy evaluation, spectral properties of network or random walk [7,8], etc.

No less important and difficult is the problem of finding communities in MLNS, which describe the processes of intersystem interactions in suprasystem formations of various types [9,10]. In this case, the methods and approaches listed above are usually also used [11]. The main drawback of known communities detection methods, along with the computational complexity and resource intensity, is the lack of reliable theoretically based criterion that the group of nodes determined by any of these methods really forms a community, because if the term "network density" in TCN is sufficiently clear and easily calculated by well-known formula, the concept of "stronger" or "weaker" connection from a structural point of view is not sufficiently unambiguous [8]. This circumstance sometimes compels the use of visual research methods [12]. An additional drawback of existing structural methods is that they are usually aimed at finding already formed and sufficiently stable 161 communities, which consist of a sufficiently large number of nodes, but do not track the appearance of such communities in the network and their rapid development (increase, decrease, disappearance). Even dynamic structural models, i.e. models that take into account changes in the structure of NS and MLNS over time, are generally not able to solve this problem [4]. At the same time, in modern society there are many important and massive events organized by communities of various orientations, the course of which is limited to a few weeks or even days. The large number of existing methods for communities detection in NS and MLNS indicates a great interest in this issue and its importance in system research [13]. The purpose of this article is to develop criteria and methods for finding communities in such entities based on flow models of complex network and multilayer network systems.

Dynamics of communities formation and development in human society

One of the most interesting and relevant objects of research in TCN are communities that arise in human society and in one way or another influence its development [6,14]. Beginning with primitive tribes, such communities have often played a significant role in the historical process, both positive and negative. The creation of world religions and new states, changes in socio-economic formations always began with small, but highly motivated and sufficiently active groups of like-minded people. The emergence and activity of such groups usually had a positive effect on the development of society (communities of collectors created museums and libraries, lovers of culture -philharmonic societies and art galleries, scientistsuniversities and research laboratories, etc.). At the same time, the emergence and spread of racist, fascist, communist and other misanthropic ideologies had a negative impact on the course of historical processes. The events of recent years show that the threat of recurrence of similar phenomena, and with much more catastrophic consequences, has not disappeared. Along with this, diverse terrorist (Al-Qaeda, ISIS), hacker (Anonymous, LockBit), organized criminal (mafia, drug cartels) groups and religious sects (People's Temple, Aum Shinrikyo) constantly arose and are still emerging, which to one degree or another influenced and often now affect public safety and peace of citizens. Relatively small communities are constantly emerging that create suicidal moods in teenagers (Blue whale), force them to organize simultaneous mass fights in many cities of several countries around the world (PVC Redan), make them pessimistic about their future, tempt them to consume narcotic substances or involve them in extremist organizations of various kinds. The identification of such communities has not only scientific interest, but also the great social importance, since stopping their activities before proceeding to specific actions allows avoiding many victims and broken destinies.

The spread and development of world religions continued for centuries, Nazi and communist ideologies for decades, and various criminal groups for years. In today's world, with the development of information and communication technologies (ICT), the formation of communities can take days and even hours. That is, if previously such processes took years, decades and even centuries and were prompted by serious crisis situations, such as wars, famine, epidemics of dangerous infectious diseases, now with the use of social networks, the birth and activation of communities can be carried out very quickly. Usually, such processes are provoked by incorrect political and economic decisions or actions that disturb social consciousness (violation of human rights, inadequate doings of the police or authorities and so on). Only the beginning of 21 st century is full of such events -Maidans in Ukraine in 2004 and 2013, revolutions in Georgia, Kyrgyzstan, Libya, Tunisia, political disturbances in Kazakhstan, Belarus and France, etc. The defining feature of these events was the speed of unification of large groups of people and their mass performances, which was practically impossible in "pre-informatization" times. Simultaneously, such communities arose precisely in civil society, and social networks, as a tool of ICT, served as means that contributed to their formation as soon as possible. However, this tool makes it possible to quantitatively monitor the process of birth and development of such communities. It should also not be forgotten that many communities of different directions and interests exist in social networks themselves, which is also an interesting phenomenon of human life.

Communities can exist both in separate layers-systems of MLNS, and in the process of interactions between them, constantly arising, combining, overlapping or leveling each other. Therefore, for a better understanding of intersystem interactions processes, the search for communities must be carried out both in separate layers and in MLNS as a whole. Communities in the modern world, in particular civil and social, are usually quite dynamic structures that can appear, develop, and disappear quickly, and the methods of identifying such formations must take this feature into account. Structural models of complex network systems and intersystem interactions are usually not able to fully solve this problem. Therefore, dynamic models that describe the operation processes of NS and MLNS become extremely important. Let's consider a flow approach to communities detection in such systems and intersystem formations.

Structural and flow models of multilayer network system

The structure of intersystem interactions is described by multilayer networks (MLNs) and represented in the form [1]

              M k m k m mk M m m M E G G , 1 , 1 , ,(1) where , 3 , 2 , ), , (   n R G E V G n m m m m

determines the structure of m th network layer of MLN;

k m  , M k m , 1 ,  , М is a number of layers (interconnected systems) of MLN. The set  M m m M V V 1 

 will be call the total set of nodes, and the set

   ) ( ) ( , 1 , 1 M k m k m mk M m m M E E E     will beM N j i , 1 ,  ,

if there is no such edge. At the same time, blocks mm A describe the structure of intralayer interactions in m th layer, and blocks km A describe the structure of interlayer interactions between m th and k th layers of MLN,

k m  , M k m , 1 , 

. If all blocks of the matrix M A are defined for the total set of MLN nodes, then the problem of coordination of node numbers in the case of their independent numbering for each layer is removed.

Most real-world intersystem interactions are multipurpose and multifunctional. This is primarily expressed in the multiflow nature of such formations, i.e. ensuring the movement of various types of flows. In TCN, the structure of such intersystem interactions is represented by so-called multidimensional networks [15]. A multidimensional network is MLN, in which each layer reflects the structure of system, which ensures the movement of flows a type of which is generally different from flows in other layers. As an example, consider a general transport system that provides the movement of two main types of flowspassenger and cargo, that is, its structure can be depicted in the form of two-dimensional network. A feature of this structure, like most multidimensional networks, is the impossibility of flow transition from one layer to another (transformation of passengers into cargo and vice versa). To simplify the analysis of intersystem interactions process in two-dimensional general transport system, it can be divided into two four-layer monoflow MLNSs, the layers of which (railway, road, aviation and water) ensure the movement of only one type of flow passenger or cargo. A characteristic feature of monoflow transport MLNS is the difference of flow carriers in each layer (trains, motor vehicles, planes, ships). In general, when detailing the structure of real multidimensional networks, it is advisable at first distinguish the layers that ensure the movement of various types of flows, and then depict each of these monoflow layers as MLNS, each layer of which ensures the movement of these flows by a specific carrier or operator system. Communication in social and other information and communication networks is carried out by exchanging information flows. That is, such formations can be considered as monoflow multilayer systems. Separate layers of such systems usually reflect the operation process various systems-operators of information flows, as it happens in the systems of mobile and fixed phone communication, cable and satellite television, email and regular mail, Internet, social networks and so on.

We will represent the flow model of monoflow MLNS [16] in the form of adjacency matrix V М (t), the elements of which are determined by the volumes of flows that have passed through the edges of MLNS (1)

during period ] , [ t T t  until the current moment of time T t  : , )} ( { max max ) ( ) ( , , )} ( { ) ( , 1 , , 1 , 1 , 1 , t V t V t V t V t sg lp N p l M g s km ij km ij M m k N j i km ij M M       V(2)

where

   t T t km ij km ij d v t V   ) ( ) ( ~; ; ) , ( ) ( ) , (   m j k i n n km ij km ij dl t t v x  ; , )} , ( { ) , ( 1 , 1 , M m k N j i km ij M t x t    x ρ  and ) , ( x t km ij



is the density of flow that pass through the edge ) , (

m j k i n n MLNS in the current moment of time 0  t , ... , 3 , 2 , ) , (    n R n n n m j k i x , M m k N j i M , 1 , , , 1 ,  

. The elements of flow adjacency matrix V М (t) are determined on the basis of empirical data about movement of flows through its edges. Currently, with the help of modern means of information extraction, it is quite easy to obtain such data for many natural and the vast majority of man-made systems, including information NS [17]. The matrix V M (t) has a block structure, in which the diagonal blocks

k m  , M k m , 1 ,  .

We calculate the values of matrix V M (t) elements on the time interval ] , [ t T t  , T t  , in order to level out random disturbances that may occur during the movement of flows at certain moments of time. These values are dynamic, as they are determined up to the current moment of time, and therefore change continuously. The duration of interval T depends on the dynamics of system's behavior. For example, for the mass social disturbances mentioned in the previous section, which took place in many countries of the world, this interval should not usually exceed one day. This is evidenced by the fact that even on November 29, 2013, almost no one could predict that the beating of students in Kyiv on the night of November 30 would provoke the appearance of a new Maidan in Ukraine almost the next day. For models of Covid-19 spreading, the interval T (to smooth out the difference in the number of newly diagnosed infections on weekdays and weekends) was usually equal to a week [18]. Communities can arise both in separate layers-systems and in MLNS as a whole. At the same time, they can both strengthen, overlap or intersect, and level each other. Thus, the writing society is quite clearly divided into communities of authors of detective, fantasy, historical and other genres. However, the author of crime novels can introduce into them elements of fiction or historical events, fictiona detective or historical component, etc. Simultaneously, communities of the sports society, which consist of athletes of various kinds of sport, intersect much less. Indeed, it is rare that a football player does weightlifting, and a weightlifter does chess or marathon running at the same professional level. This means that it is appropriate to start the communities detection from separate layers of multilayer network system.

Communities in layers of multilayer network systems

To simplify the presentation, in this section we will denote the flow adjacency matrix of arbitrary

layer-system of MLNS as , )} ( { ) ( 1 , N j i ij t V t   V

Communities detection based on the nestedness hierarchy

In real large scale systems, the first "candidates" for communities are subsystems of different levels of hierarchy built according to the nesting principle, when the smaller is part of the larger [19] (Fig. 1). Indeed, students of class communicate more among themselves than with students of other classes or courses, people of certain professionsmore often than with representatives of other specialties, representatives of different social groups or age categories also prefer to communicate with people of the same groups or categories. That is, to singled out by a certain feature of homogeneity of elements, NS's subsystems have a higher probability for the formation of community. is the total volume of flows that passed through the system S during the time interval [t-T, t], i.e. , than between them and other nodesgenerators of flows in the system S at a whole.

   N j i ij t V t s 1 , ) ( )) ( (V , T t  . Let us  out l S l G i out i l out S R R   , is   in l S l G i in i in S t s t t )) ( ( / ) ( ) ( V     in ext l S l R i in i in ext S t s t t , )) ( ( / ) ( ) ( , V   and    in in t l S l R i in i in int S t s t t , )) ( ( / ) ( ) ( , V   respectively. Then the value ) ( ) ( ) (

It is natural to assume that the greater the volumes of flow movement between two NS nodes, the stronger the relationship between them. This statement defines a sufficiently justified criterion for the existence of community within a certain group (subsystem) of NS nodes. Therefore, a pair of parameters

)) ( ), ( ( t t in S out S l l   , namely the compatible fulfillment of conditions , 1 ) ( , 1 ) (     с in S с out S t t l l     (3)

where с  is a predetermined value, makes it possible to determine a sufficiently objective criterion that the subsystem Sl forms a community in the network system S. Indeed, the smaller the value of these parameters, the smaller the external interaction of subsystem Sl, L l , 1  , with the system S as a whole and the greater the interactions within this subsystem, which is, in fact, the definition of community.

Summarizing, since by definition the community is considered as a certain group of nodes (subsystem S*) of system S, the connections between which are denser (structural indicator) and stronger (functional indicator) than between them and other nodes of network system S, then objective criteria for existence of community within the subsystem S* can be considered:

1) indicator of relative density of connections (edges) of subsystem S*, which is calculated according to the formula

               N L N L S S * * * ) , ( 

where N* is the number of nodes and L* is the number of connections of subsystem S*, N is the number of nodes and L is the number of connections of system S;

2) indicator of relative flow power of interconnections of subsystem S*, which is calculated according to the formula

               N t s N t s S S S )) ( ( )) ( ( ) , ( * * * V V  ,

and determines the ratio of specific power of interconnections between nodes in subsystem S* and system S, respectively. If the indicators of specific density and flow power of interconnections for subsystem S* significantly exceed the corresponding indicators for system S, then it is quite reasonable to assume that the subsystem S* forms a community in the source network system. Obviously, the concept of "significantly exceed" is quite vague. Therefore, it is advisable to determine the concrete values of  are the predetermined values. Note that condition (5) is weaker than condition (3) and generally does not impose such strict restrictions on the interaction of subsystem S* with the rest of system S. In addition, the value

)) ( ( )) ( ( ) , ( * * t s t s S S S V V  

makes it possible to track the role of subsystem S* in functioning of network system S and the dynamics of changes in this role over time. If no communities are found at this level of nesting hierarchy, then we move to the next, higher level of this hierarchy. The main drawback of method discussed above is that it is focused on identifying communities formed over a sufficiently long period of time, which enables for the construction of appropriate nesting hierarchies. Consider the method that allows us to track the emergence and dynamic development of communities in network system, focusing primarily on the predominant power of interconnections between its elements.

Communities and flow cores of network systems

Let us introduce the concept of flow  -core of network system [20], as the largest subsystem of the source NS, for which the elements of flow adjacency matrix V(t) satisfy the inequalities

N j i t V ij , 1 , , ) (    , ] 1 , 0 [ ,    T t .

The concept of NS's flow core allows us to build, on the basis of criterion (3) or ( 5), the following communities detection algorithm in the network system (Fig. 2a ;

2) gradually increase the value  until the condition (3) or ( 5) is fulfilled for a certain

1   i  

, or at least one of the components of i  -core detected earlier is divided into unconnected components (Fig. 2c, 2d);

3) if the value

1 1   i  , then accept 1   i i

and proceed to point 2, otherwise, finish the execution of algorithm.

By adjusting the value T in the direction of decrease or increase, we make the procedure for communities detection using the NS's flow model and  -core method more or less sensitive to rapid changes in the structure of detected communities. Note that for the shown in Fig. 2a regular network, criterion (4) is not fulfilled for any of its subnets. However, in the case of irregular networks, this criterion can be used to check whether the connections in NS's subsystem detected by criterion (5) are indeed denser than the average in network. That is, the functional criteria (3) or (5) make it possible to identify communities in the network system for which known structural methods do not work. It is obvious that the structure and composition of nodes and links of communities detected using the algorithm described above is easily determined from the matrix V(t), T t  . It is obvious that the NS's flow model enables continuous monitoring of changes in the volume of flows moving between nodes of network system. This makes it possible to monitor the processes of emergence and development of communities in the network almost in real time, which is much more difficult to do with the help of structural methods.

Thus, until 2014, Donbas was one of the most industrially developed region of Ukraine with very close connections between mines, deposits, mining and processing and metallurgical enterprises located on its territory. This was accompanied by the need for a transport and energy infrastructure that was much denser than the national average. In general, such formation can be considered as industrial community. However, after 2014, as a result of closure of a large part of mines and deposits and the cessation of work of many metallurgical plants, this community practically ceased to exist, although the dense transport and energy networks did not disappear anywhere. Many similar examples can be cited: the autoindustry center in Detroit, coal industry in Great Britain and Germany, wine industry in France and many other industrial regions, the demand for products manufactured in them gradually decreased and disappeared, or the mineral deposits mined in these regions were exhausted. That is, from a structural point of view, according to criterion (4), a subsystem may form a community, but functionally, according to criteria (3) or (5), it not form it, and vice versa.

Note, that here and below we intentionally use such simple examples of network system structures, since known numerical and visual structural methods of communities detection practically do not work on them. Similar examples can be given for much more complex real network structures, for example, the system of interconnections between the regions of Ukraine (Fig. 3), which are also generally regular, despite the visual complexity. . For an arbitrary multilayer network, the adjacency matrix

M N j i ij 1 , } {    Ε

completely determines the weighted network, which we will call the structural aggregate-network of MLN. The elements of matrix E determine the integral structural characteristics of multilayer network's nodes and edges (Fig. 4). For monoflow MLNs, the weight of each edge reflects the number of possible carriers or operator-systems that can ensure the movement of corresponding type of flow and the weight of each node is the number of systems it is a part of. The transition to aggregate-networks can be used to develop structural methods for communities detection in MLN [7]. We will call the structural ag p -core of MLNS aggregate-network the network whose the adjacency matrix elements are determined by the ratio An example of such situation is the sports society already mentioned in section 3, in which separate communities by kinds of sports practically do not overlap. In this case, the independent communities that exist in 1-3 layers of three-layer MLNS (Figs. 7a -7c) practically "merge" into its aggregatenetwork, forming a single community (Fig. 7d), which in fact does not correspond to reality. Note that this method cannot determine the specific contribution of each layer in the "fusion" of such communities, as well as structural methods based on the use of its ag p -core concept. In addition, the flow ag λ -cores of MLNS's aggregate-network do not make it possible to establish intersystem interactions between communities that exist in different layers of multilayer system. Therefore, the development of communities detection methods in MLNS, in particular, the selection of such formations in separate layers and the establishment of interactions between them is no less important. Obviously, such communities usually also have the appearance of multilayer system.

Communities detection in multilayer network systems

nodes, the stronger the connection between them, seems to be well-founded. The dynamism of formation and development of communities in modern human society, at least some of which pose an obvious or hidden threat to public peace and security, makes the problem of timely detection of such formations even more urgent. The communities detection methods proposed in the article, which are based on the use of network flow core and MLNS's aggregate-network and the flow cores of multilayer network system concepts, make this problem solvable even in real time. An additional advantage of proposed methods is the possibility of their application in those cases when the structure of network or multilayer network system makes other known approaches practically unworkable.