Protection of multilayer network systems from successive attacks on the process of intersystem interactions Olexandr Polishchuk Pidstryhach Institute for Applied Problems of Mechanics and Mathematics, National Academy of Sciences of Ukraine, Naukova str, 3 Lviv, 79060, Ukraine Abstract Structural and flow approaches to the vulnerability analysis of multilayer network systems (MLNS) from targeted attacks and non-target lesions of various origins are considered. Local and global structural and flow characteristics of monoflow multilayer system elements are determined to build scenarios of successive targeted attacks on the structure and operation process of MLNS and evaluation their consequences. In order to simplify the construction and improve the efficiency of such scenarios, the concepts of structural and flow aggregate-networks of monoflow MLNS are introduced, and the relationship between the importance indicators of their elements and corresponding indicators of multilayer system nodes is shown. The advantages of flow approach over structural ones have been demonstrated, both in the sense of analyzing the vulnerability of real MLNS and evaluation the consequences of negative influences of different nature. Keywords Complex network, network system, intersystem interactions, multilayer network system, flow model, aggregate-network, influence, betweenness, targeted attack, vulnerability 1. Introduction Many internal and external negative influences can act on any real-world natural or man-made systems. Among such influences that can damage the system, we primarily highlight targeted attacks and its non-target lesions. A distinctive feature of targeted attacks is their intentionality and artificial nature (terrorist and hacker attacks, military aggression and financial and economic sanctions, etc.). In contrast to targeted attacks, non-target lesions can include various unintentional negative influences of natural or artificial origin (natural and man-made disasters, the spread of dangerous infectious diseases and so on). Such lesions can be local, group or system-wide and aimed at damaging both the structure and operation process of network systems (NS) and intersystem interactions. In paper [1], the typical scenarios of consecutive attacks on the structure and operation process of NS were considered and their connections with the development of countermeasures against the system non-target lesions were established. The usefulness of such scenarios lies in the fact that they, giving a picture of possible development of a certain type of lesion, allow creating the most effective means of protection against it [2, 3]. In particular, the structural and flow NS models make it possible not only to build scenarios of the spread of negative influences of various origins, but also, compared to other system models, evaluate the level of local and system-wide losses resulting from the action of such influences during and after lesion [1]. The development of strategies for the protection of multilayer network systems (MLNS), which describe the processes of intersystem interactions, is significantly complicated not only due to the increase of problem dimension, but also because the lesion of certain layer-system of such formation may not occur directly, for example, through a targeted attack on it, but consequentially as a result of attack on adjacent MLNS's layer [4, 5]. At the same time, lesions of various adjacent layers-systems can lead to different consequences (the influence of blocking the maritime and aviation layers of general transport system of Ukraine during Russian aggression on the railway and automobile layers is significantly different). _____________________________ ICST-2024: Information Control Systems & Technologies, September , 23 25, 2024, Odesa, Ukraine od_polishchuk@ukr.net (Olexandr Polishchuk); 0000-0002-0054-7159 (Olexandr Polishchuk) © 2024 Copyright for this paper by its authors. Use permitted under Creative Commons License Attribution 4.0 International (CC BY 4.0). CEUR ceur-ws.org Workshop ISSN 1613-0073 Proceedings Simultaneously, the quantity of local and global characteristics of MLNS elements, which describe the structural and functional features of not only internal, but also intersystem interactions, is increasing, and therefore, the amount of importance indicators of elements, which are used when building scenarios of targeted attacks on multilayer system, is increasing too [6]. The process of evaluation the consequences of MLNS lesions is also complicated, in particular, the successive negative influence of the directly damaged layers-systems on the adjacent ones [7, 8]. All these factors must be taken into account by the NS management systems, which are the part of man- made MLNS, for the effective organization of their protection and overcoming the consequences of various types of lesions. No large scale real-world complex system can protect or simultaneously restore all elements damaged by negative influences. Therefore, the calculation of objective importance indicators of nodes and edges of NS and MLNS plays a decisive role during the construction of effective scenarios of targeted attacks on them [9, 10]. Equally important is the value of these indicators for development the effective strategies for countering the spread of non-target lesions. The purpose of article is to determine on the basis of structural and flow models of intersystem interactions, the importance indicators of MLNS elements and formation of effective scenarios of successive targeted attacks on the structure and operation process of multilayer network systems, as well as evaluation of consequences of separate system elements lesions on different system layers and implementation of intersystem interactions in general. 2. A structural model of multilayer network system The structural model of intersystem interactions is described by multilayer networks (MLNs) and displayed in the form [11] GM = ( G ,  M m =1 m M ) m,k =1, m  k Emk , where Gm = (Vm , Em ) determines the structure of mth network layer of MLN; Vm and Em are the sets of nodes and edges of network Gm respectively; Emk is the set of connections between the nodes of Vm and Vk , m  k , m, k = 1, M , and M is the numder of MLN layers. The set M V M = m =1Vm will be called the total set of MLN nodes, N M the number of elements of V M . Multilayer network G M is fully described by an adjacency matrix A M = {A km }m M , k =1 , (1) in which the blocks A mm determine the structure of intralayer and blocks A km , m  k , interlayer interactions. Values aijkm =1 if the edge connected the nodes nik and n mj exists, and M aijkm =0, i, j = 1, N M , m, k = 1, M , A km = {aijkm }iN, j =1 , m, k = 1, M , of matrix are determined for the total set of MLN nodes, i.e. the problem of coordination of node numbers is removed in case of their independent numbering for each layer. In this paper, we consider partially overlapped MLN [12], in which connections are possible only between nodes with the same numbers from the total set of nodes V M (Figure 1). This means that each node can be an element of several systems and perform one function in them, but in different ways. Nodes through which interlayer interactions are carried out will be called MLNS transition points. Multidimensional (multiflow) networks, which describe the structure of interactions between layers, each of which ensures the movement of specific type of flow different from other layers, are considered the most general case of MLN [13]. An example of two-dimensional network is a general transport system that ensures the movement of passenger and cargo flows [1]. A feature of such formations is the impossibility of flow transition from one layer to another (transformation of passengers into cargo and vice versa). Figure 1: An example of structure of partially overlapped three-layer MLN Therefore, the characteristics of elements of multidimensional networks are usually described by vectors of these characteristics in each layer (degree, betweenness, closeness, eigenvector centralities and so on [14]). Scenarios of successive targeted attacks on the structure of such multilayer networks are built using precisely these vectors of importance indicators of their elements [4, 6]. In the article [1] was proposed a method of decomposing multidimensional MLNS into monoflow multilayer systems, all layers of which ensure the movement of certain type of flow by different carriers or operator systems (movement of passengers or cargos through four-layer transport networks, which include railway, automobile, aviation and water system layers, respectively). The centrality of elements of monoflow MLNS can be determined not only for separate layers, but also for a multilayer network in general by constructing their aggregate- networks [15]. In addition to reducing the dimensionality of MLNS model by at least M times, the use of such structures makes it possible to solve a number of practically important problems of the theory of complex networks much more effectively [16] (finding the shortest path in multilayer network; searching a path from arbitrary node of one layer to any node of another layer, especially if they lie outside the intersection of sets of nodes of these layers; countermeasures against the spread of epidemics or computer viruses, which due to interlayer interactions can expand much faster than in one layer, etc.). 2.1. Structural aggregate-network of multilayer system The local characterictic  ij of the edge ( ni , n j ) in MLN, where ni and n j are the nodes from the total set of nodes V M , which will be called its structural aggregate-weight, is the quantity of layers in which this edge is present. Structural aggregate-weight  ii ni is the quantity of layers of which it is a part, i, j = 1, N M . For arbitrary multilayer network, the M adjacency matrix Ε = { ij }iN, j =1 completely determines the weighted network (Figure 2), which will be called the structural aggregate-network of MLN. Since we are considering the case when interlayer connections are possible only between nodes with the same numbers of total set of M MLNS nodes, the structure Gag of this aggregate-network can be described in the form M Gag ( M = V M , E M = m =1 Em ) (2) in which the set EM will be called the total set of MLN edges. The elements of matrix E define integral structural characteristics of multilayer network nodes and edges. For multiflow multidimensional networks, the aggregate-weights of edges of weighted aggregate-network determine the quantity of interactions of various types between the nodes of such structures. For monoflow MLNs, the aggregate-weight of each edge reflects the number of possible carriers or operator systems that can ensure the movement of corresponding type of flow. Therefore, the input (output) aggregate-degree of each node of weighted aggregate-network of monoflow MLNS is equal to the sum of input (output) degrees of this node in all its layers. The aggregate-degree of a node makes it possible to determine its importance in the MLN at a whole, even if the values of its degrees in each layer are relatively small. Figure 2: Aggregate-network of reflected in fig. 1 three-layer MLN ( ____ for  ij =3, _ _ _ for  ij =2, .. for  ij =1, i, j = 1, N M ) 2.2. Targeted attacks on multilayer systems We will build a scenario of targeted attack on monoflow multilayer network, using as importance indicator of its nodes the centrality of generalized degree d i of node ni in the total set of nodes VM of aggregate-network (the sum of input and output degrees, as well as aggregate- weight of node), i.e. M d i =  Nj =1, j i ( ij +  ji ) +  ii , i = 1, N M . (3) This scenario consists of sequentially executing the following steps: 1) create the list of nodes of the set VM in order of decreasing the values of their generalized degree centrality in aggregate-network; 2) delete the first node from created list; 3) if criterion of attack success is reached, then finish the execution of scenario, otherwise go to point 4; 4) since the structure of aggregate-network changes as a result of removal of node (and its connections), compile a new list of nodes of the set VM that remained, in order of decreasing recalculated values of their generalized degree centrality, and proceed to point 2. The criterion of attack success in this case can be division of MLN's aggregate-network into unconnected components, increase the average length of shortest path, etc. [9]. Likewise, similar scenarios can be developed for other types of structural centralities of aggregate-network nodes, including without recalculating the values of these centralities [17]. The last type scenarios are usually used when the system is unable to redistribute the functions of lesioned elements between those that remained undamaged. The main disadvantage of structural importance indicators of network system nodes is their ambiguity, because even D. Krackhardt, using example of fairly simple network, showed [18] that its node, which is important according to the value of one type centrality, may be unimportant according to the value of another type centrality. The most objective importance indicator of a node in MS's structure is its betweenness centrality [17], which is equal to the ratio of quantity of shortest paths passing through this node to the quantity of all shortest paths in the network [19]. However, the calculation of this indicator for networks that have billions of elements, is a rather difficult computational problem. 2.3. Evaluation of the lesion consequences In paper [1], it was shown that the structural model of MLNS makes it possible to determine the integral and partially local losses of multilayer network during and after targeted attack or its non- target lesion. The criterion of attack success can be not only the quantity of directly damged (dd), but also quantity of consequentially injured (ci) by this attack MLN elements. The aggregate- network model allows us to identify such elements of multilayer network. Let us denote by s  dd = {ni1 , ni2 ,..., nik } the set of directly damaged (that is destroyed, completely blocked), as a result of attack, nodes of aggregate-network, and through U (nil ) = {n1i , ni2 ,..., niml } the set of l l l nodes of this network adjacent to nil , l = 1, k . Then the set  ci s = lk=1U (nil ) determines the s group of consequentially injured by lesion of the set  dd nodes of MLN's aggregate-network. It is obvious that the defeat of a certain group of nodes with the highest generalized degree, which is realized by the above scenario, will lead to maximization of the set of consequentially injured multilayer network nodes, which can serve as the main attack goal. 3. A flow model of multilayer network system We will use the flow model proposed in the article [1] to determine the indicators of functional importance of monoflow MLNS's elements and build scenarios of successive targeted attacks on operation process of multilayer systems. This choice is explained by the fact that the majority of real-world systems are created precisely to ensure the movement of flows through the relevant networks (transport, financial, trade, energy, information, and so on) or the movement of flows directly ensures their vital activity (the movement of blood, lymph, neuroimpulses in a living organism, etc.). Stopping the movement of flows in such systems inevitably leads to the cessation of their existence. In general, by flow we mean a certain real positive function correlated to each edge of the network. Let us reflect the set of flows that pass through all edges of multilayer system in the form of flow adjacency matrix VM(t), the elements of which are determined by the volumes of flows that passed through the edges of MLN (1) for the period [t − T , t ] up to the current moment of time t  T : ~ M km N M km Vijkm (t ) V (t ) = {Vij (t )}i, j =1, k ,m=1, Vij (t ) = ~ sg , Vijkm (t )  [0, 1] , (4) max max {Vlp (t )} s , g =1, M l , p =1, N M ~ where Vijkm (t ) is the volume of flows that passed through the edge ( nik , n m j ) of multilayer network for the time period [t − T , t ] , i, j = 1, N M , k , m = 1, M , t  T  0 . It is obvious that structure of matrix VM(t) completely coincides with the structure of matrix . The elements of MLNS flow adjacency matrix are determined on the basis of empirical data about movement of flows through MLNS edges. Currently, with the help of modern means of information extraction, such data can be easily obtained for many natural and the vast majority of man-made systems [20]. The matrix VM(t) similarly to AM also has a block structure, in which the diagonal blocks V mm (t ) describe the volumes of intralayer flows in the mth layer, and the off-diagonal blocks V km (t ) , m  k , describe the volumes of flows between the mth and kth layers of MLNS, m, k = 1, M , t  T  0 . 3.1. Flow aggregate-network of multilayer system Let's define the concept of a flow aggregate-network of monoflow partially overlapped MLNS. Since we are considering the case when interlayer connections are possible only between nodes with the same numbers in total set of MLNS nodes, the structure of such aggregate-network can M also be described in the form (2). Then the adjacency matrix F(t ) = { fij (t )}iN, j =1 , the elements of which are calculated according to the formulas f ij (t ) = m M =1Vij (t ) , i  j , i, j = 1, N , and f ii (t ) = m,k =1, m  k Vii (t ) , i = 1, N , t  T , mm M M mk M completely defines a dynamic (in the sense of dependence on time) weighted network, which will be called the flow aggregate-network of this MLNS. The elements of matrix F(t) determine the integral flow characteristics of the edges and transition points of multilayer system, namely, the off-diagonal elements of this matrix are equal to the total volumes of flows passing through the edge ( ni , n j ) , and the diagonal elements are equal to the total volumes of flows passing through the transition point ni of MLNS during the time period [t − T , t ] , t  T  0 , where ( ni , n j ) are the edges from the total set of edges EM, and ni and n j , i, j = 1, N M , are the nodes from the total set of nodes V M . 3.2. Local flow characteristics of multilayer network systems elements Let's determine the most important local flow characteristics of the MLNS elements. By local we mean a characteristic that describes the properties of element itself or one or another aspect of its interaction with directly connected (adjacent) elements of the system. The local flow characteristic of the edge ( nik , n mj ) is equal to corresponding element of the flow model (4), i.e., the volume of flows that passed through this edge during the time period [t − T , t ], t  T . The local flow characteristic of edge ( ni , n j ) of the total set of edges is equal to the value of element f ij (t ) , i  j , and the transition points ni to the value of element f ii (t ) , i, j = 1, N M , of the flow adjacency matrix F(t), t  T . As mentioned above, during the study of monoflow MLNS properties, the flow characteristics can be determined for the set of interlayer interactions in general. Based on this, the parameters  ijin (t ) = m M mm  out (t ) = m =1V ji (t ) = f ji (t ) M mm =1Vij (t ) = f ij (t ) and ij determine the input and output flow connection strength between nodes ni and n j of the total set of nodes VM, taking into account all ways of implementing this connection in different layers of MLNS. Then parameters M M M M M  iin (t ) =  Nj=1  in ji (t ) =  j =1  ji (t ) =  j =1 f ji (t ) and  i (t ) =  j =1  ji (t ) =  j =1 f ij (t ) , N in N out N out N determine the input and output flow connection aggregate-strength of the node ni , i, j = 1, N M , with all adjacent nodes from the total set of MLNS nodes, respectively. Then the generalized flow aggregate-degree of node ni in the process of intra- and intersystem interactions is determined by the formula M  i (t ) =  iin (t ) +  iout (t ) + m M =1 k =1Vii (t ) =  j =1, j i ( f ij (t ) + f ji (t )) + f ii (t ) , t  T , M mk N and is a functional analogue of the concept of centrality by generalized degree d i , i = 1, N M , which is calculated by formula (3). Analogously to the above scenario of sequential targeted attack on MLNS structure (see section 2.2) using as importance indicators of elements the generalized structural degree d i , a scenario of attack on MLNS operation process is being built using the generalized flow aggregate-degree  i (t ) , t  T , i = 1, N M . A significant advantage of this scenario, compared to the structural one, is the consideration of not only aggregate-network nodes destroyed or completely blocked as a result of the attack, but also those whose operation process was limited as a result of the corresponding negative influence. For example, if 4 out of 11 fuel storage tanks were destroyed, the level of attack object lesion in the functional measure is approximately 36%. This would lead to a corresponding reduction in the volume of fuel supply to the final receivers, and not to its complete cessation, as would happen in the case of complete destruction of the oil depot. Thus, the flow approach makes it possible, even at the level of using local importance indicators of the elements, to more accurately determine both the results of targeted attack (the level of lesion of directly attacked nodes) and the consequences of this attack for consequentially injured adjacent nodes of MLNS. Moreover, structural and functional scenarios can be combined. In particular, if the first several nodes in the list of the most important in terms of generalized flow aggregate-degree have the same value of this indicator, then they can be additionally ordered according to the decreasing values of generalized structural degree of these nodes. However, as in the case of structural, the functional scenarios, which use as importance indicators the local characteristics of MLNS elements, among the consequentially injured only adjacent to directly damaged nodes are taken into account. This situation is quite acceptable for assortative networks [21], in which connections between elements are generally limited to adjacent nodes, but not for disassortative ones, the structure of which has the majority of man-made NCs, the connections between elements of which are usually implemented by paths. Another advantage of the flow approach compared to the structural ones is the possibility of prioritizing the recovery of damaged but not completely destroyed system elements. The list of recovery priorities in general may not coincide with the list of the most important MLNS nodes according to a certain centrality. In particular, the importance of object restoration can be determined by the formula (  =  1 −  after  before  max ) in which  is the value of selected centrality for the damaged node,  max is the maximum value of this centrality for all system nodes,  after is the average volume of flows in the node after damage,  before is the average volume of flows in the node before the lesion. According to this formula, a more damaged node among less important ones may require priority restoration. 3.3. Global flow characteristics of multilayer network system elements Let's determine the most important global flow characteristics of the MLNS elements. By global we mean the characteristics of system element which describe one or another aspect of its interaction with all other elements or the system at a whole [16]. 3.3.1. Influence parameters of system noge Denote by V out (t , nim , nlj ) the total volume of flows generated in the node nim and directed for final acceptance at MLNS node n lj for the period [t − T , t ], t  T . Parameter V out (t , nim , nlj ) determines the real strength of influence of node nim on node n lj of multilayer system for the duration period T, i, j = 1, N M , m, l = 1, M . Denote by Rim,l ,out (t ) = { jil ,..., jil } the set of 1 Lml i (t ) numbers of all nodes of the lth MLNS layer, which are the final receivers of flows generated in the m,l , out node nim , Lml i (t ) is the quantity of elements of the set Ri (t ) , which can also change during the period [t − T , t ], t  T . Parameter  im,l ,out (t ) =  jR m,l ,out (t ) V out (t , nim , n lj ) s(V M (t )) ,  im,l ,out (t )  [0, 1] , (5) i determines the strength of influence of node nim , as a flow generator, on the lth layer-system in general, t  T , i = 1, N M , m, l = 1, M . In formula (5), the value M s(V M (t )) = m M ,k =1 i , j =1Vij (t ) , N mk as the sum of all elements of matrix V M (t ) is the global flow characteristic of MLNS, which is equal to the total volumes of flows that passed through the multilayer system during the period [t − T , t ], t  T . The power of influence of node nim on the lth layer-system is determined by means of parameter pim,l ,out (t ) = Lml M m,l , out i (t ) / N , pi  [0, 1] , and the set Rim,l ,out (t ) will be called the influence domain of node nim on the lth MLNS layer- system. Parameters im,l ,out (t ) , pim,l ,out (t ) , and Rim,l ,out (t ) will be called the output influence parameters of the node nim as generators of flows on the lth MLNS layer-system, i = 1, N M , m, l = 1, M . Analogously to the output ones are determined parameters of the strength  il , m,in (t ) , power pil , m,in (t ) , and domain Ril , m,in (t ) of input influence, which will be called the input influence parameters of the lth MLNS layer-system on the node nim , as final receiver of flows generated in the nodes of the lth layer. The values of input and output influence parameters of the node nim on lth layer make it possible to quantitatively determine how the lesion of this node will influence on functioning of the lth MLNS layer, namely, how many, which elements of the lth layer and in which measure will be consequentially injured, i = 1, N M , m, l = 1, M , [t − T , t ], t  T . The output strength of influence of the node nim as generator of flows on MLNS at a whole during the time period [t − T , t ], t  T , is calculated according to the formula  im,out (t ) = lM=1 im,l ,out (t ) / M ,  im,out (t )  [0, 1] , (6) in which the value im,l ,out (t ) is determined by the formula (5). Domain of output influence Rim, out (t ) of the node nim on MLNS is defined by the ratio Rim,out (t ) = lM=1 Rim,l ,out (t ) . Then the power pim, out (t ) of output influence of the node nim on MLNS is equal to the ratio of quantity of elements of the set Rim,out (t ) to the value NM. Similarly to output ones, the strength im,in (t ) , domain Rim,in (t ) and power pim,in (t ) of the MLNS input influence on the node nim , i = 1, N M , m = 1, M , as the final receiver of flows, during the time period [t − T , t ], t  T are determined. Lesion of the node-generator of flows means the need to find a new source of supply for the final receivers, and the receiver node to search for new markets for producers, which will lead to at least temporary difficulties in their functioning. The influence parameters of separate node of MLNS allow us to determine what quantitative losses this will lead to and how many elements and which elements of intra- and intersystem interactions will spread. 3.3.2. Betweenness parameters of system node The next type of global flow characteristics of MLNS elements are their betweenness parameters [16], which determine the importance of a node or an edge of multilayer network system in ensuring the movement of transit flows during intra- and intersystem interactions. In order to shorten the presentation, we will focus on the determination of betweenness parameters of MLNS transition points, as the most important elements that ensure intersystem interactions in monoflow partially overlapped multilayer systems. Denote by Viml (t ) the total volume of flows that passed through the transition point niml during period [t − T , t ], t  T , i = 1, N M , m, l = 1, M . The value  iml (t ) = Viml (t ) s (V M (t )) ,  iml (t )  [0,1] , (7) which determines the specific weight in the system the flows passing through the transition point niml during time period [t − T , t ], t  T , will be called the measure of betweenness of this transition point in the process of interaction of the lth and mth MLNS layers. The set M iml of all nodes of lth and mth MLNS layers, which are generators and final receivers of flows transiting through the node niml , will be called the betweenness domain, and the ratio iml of the quantity of nodes in the set M iml to the value NM is the betweenness power of transition point niml , i = 1, N M , m, l = 1, M . The betweenness parameters of transition point nim in the process of intersystem interactions within the entire MLNS will be determined as follows. The measure of betweenness  im (t ) of transition point nim in the entire multilayer system can be calculated using the formula  im (t ) = lM=1, l  m  iml (t ) /( M − 1),  im (t )  [0,1], (8) in which the value  iml (t ) is calculated according to (7). The betweenness domain of transition point nim in the entire MLNS is determined by the ratio M im (t ) = lM=1, l  m M iml (t ) . Then the power Ν im (t ) of betweenness of transition point nim in the MLNS at a whole is equal to the ratio of quantity of elements of the set  im (t ) to the value NM. Note, that for nodes that are not transition points of MLNS, the parameters of measure, domain and power of betweenness are determined according to the same principles. Similarly, it is possible to determine the parameters of measure  ijm (t ) , domain M ijm (t ) , and power N ijm (t ) of betweenness for the edge ( nim , n mj ) of MLNS mth layer, i, j = 1, N M , m = 1, M , [t − T , t ], t  T . This means that betweenness parameters of MLNS elements make it possible to establish the participation in intersystem interactions even those nodes and edges that are part of only one layer of multilayer network system. The values of betweenness parameters of MLNS node nim , i = 1, N M , m = 1, M , allow us by means of quantitative measurement to determine how the lesion of this node will affect the provision of transit flows through the multilayer system and to what extent, how many and which elements will be consequentially injured. 3.3.3. Specific scenarios of targeted attacks The importance of node ni of the total set of MLNS nodes as generator, final receiver or flow transitor is calculated using formulas  iout (t ) = m M =1 i m,out (t ) M , (9)  iin (t ) = m M =1 i m,in (t ) / M ,  iout ,  iin (t )  [0, 1] , (10)  i (t ) = m M =1  i (t ) / M ,  i (t )  [0,1] , i = 1, N m M , [t − T , t ], t  T , (11) respectively. Domains of input Riin (t ) , output Riout (t ) influence, and betweenness M i (t ) of the node ni in MLNS will determine by formulas M M M Riin (t ) = m m,in =1 Ri (t ) , Riout (t ) = m m,out =1 Ri (t ) , M i (t ) = m m =1 M i (t ) , and the powers of input piin (t ) , output piout (t ) influence, and betweenness N i (t ) of the node ni on MLNS at a whole as the ratio of quantity of elements of the sets Riin (t ) , Riout (t ) , and M i (t ) , i = 1, N M , to the value NM respectively. Depending on the purpose of attack, the targets of lesion can be nodes-generators, nodes final receivers, nodes-transitors of flows or only transition points of MLNS. For each of these types of multilayer system elements, it is possible to build specific scenarios of targeted attacks, using as importance indicators of nodes the parameters of influence or betweenness, determined above by formulas (5), (6), (9), (10) or (7), (8), (11) respectively. For example, an embargo on energy carriers means blocking generator nodes (countries that extract and supply such carriers), a ban on the supply of high-tech products (microcircuits, modern computers or equipment) blocking the final receivers of flows (countries or companies that use such products ), blocking of transit nodes (prohibition of international air flights over the territory of Russia or crossing of the Bosphorus Strait by its military ships) redirection of the flow traffic by other routes. One of disadvantages of targeted attack scenarios, which are based on local importance indicators of MLNS nodes, is that only a set of system elements adjacent to damaged can reasonably be considered consequentially injured by them. Before carrying out an attack on generator (final receivers) or transit nodes, it is possible to identify domains of output (input) influence or domains of betweenness, which allow us to identify nodes that may be consequentially injured by the attack, as well as to quantify the possible level of their losses. It makes sense to carry out such actions before imposing sanctions against the aggressor country. Quantifying the losses of sanctioning party compared to the damage done to attacked system allows us to determine the feasibility of attack. 3.3.4. Aggregate-network and lesion consequences It is obvious that the influence and betweenness parameters of MLNS nodes and edges are related to the influence and betweenness parameters of nodes and edges of its flow aggregate- network. Thus, the output strength of influence of node ni of the general set VM in the aggregate- network is equal to the value  iout (t ) calculated by formula (9), the domain of output influence of this node is the projection of domain Riout (t ) onto the aggregate-network (2), and the power of output influence is equal to the ratio of quantity of elements of this projection to the value NM. The input strength of aggregate-network influence on a node ni is equal to the value iin (t ) , which is calculated by formula (10), the domain of input influence of this node is the projection of domain Riin (t ) onto the aggregate-network (2), and the power of the input influence is equal to the ratio of quantity of elements of this projection to the value NM. The measure of betweenness of node ni in the aggregate-network is equal to the value  i (t ) , which is calculated by formula (11), the domain of betweenness of this node is the projection of domain M i (t ) onto the aggregate-network (2), and the power of betweenness is equal to the ratio of quantity of elements of this projection to the value NM. Figure 3 contains an example of lesions received by MLNS aggregate-network as a result of targeted attack. Here the black squares bounded by continuous curve indicate the directly damaged nodes, and dark gray squares bounded by a dashed curve indicate the consequentially injured nodes adjacent to the directly damaged ones obtained on the basis of structural approach, white squares indicate undamaged nodes (Figure 3 a). In Figure 3 b, the gray rhombuses, triangles, and circles bounded by a dotted curve indicate consequentially injured generator, final receivers, and transitor nodes obtained on the basis of flow approach, respectively. As follows from these figures, the domain of consequentially injured elements determined on the basis of flow approach can be much larger and more accurate in the sense of displaying the node type than the domain of adjacent to directly damaged nodes of the network system determined on the basis of the structural approach. a) b) Figure 3: Consequences of targeted attack, obtained on the basis of analysis of structural aggregate-network (a) and parameters of influence and betweenness of flow aggregate-network nodes (b) 3.3.5. Paramerers of interaction and comprehensive functional targeted attack scenario Based on the input and output influence, and betweenness parameters of the node ni , we can determine the global indicators of interaction of this node with the MLNS at a whole, namely, the parameter  i (t ) of interaction strength of the node ni with multilayer system, which is calculated according to the formula  i (t ) = (iout (t ) + iin (t ) +  i (t )) / 3, t  T , (12) determines its overall role in multilayer system as generator, final receiver and flow transitor; the domain i (t ) of interaction of the node ni with MLNS is determined by the formula i (t ) = Riin (t ) Riout (t ) M i (t ) , and the power of interaction of the node ni with MLNS is equal to the ratio of quantity of elements of domain i (t ) , t  T , to the value NM. It is obvious that interaction parameters of MLNS nodes are related to the interaction parameters of its flow aggregate-network nodes. Thus, the strength of interaction of node ni of the general set of nodes VM with the MLNS flow aggregate-network is equal to the value  i (t ) , which is calculated according to formula (12), the domain of interaction of this node is the projection of domain i (t ) onto the aggregate-network (2), and the power of interaction is equal to the ratio of quantity of elements of this projection to the value NM. Let's build a scenario of consistent targeted attack on multilayer system, choosing as an importance indicator of node the strength of its interaction with MLNS flow aggregate-network. Such scenario, which achieves the comprehenciveness of attack on the functionally most important system nodes, will look like this: 1) compile a list of nodes of the set VM in order of decreasing values of their strength of interaction with the flow aggregate-network; 2) delete the first node from the created list; 3) if the criterion of attack success is reached, then finish the execution of scenario, otherwise go to point 4; 4) since the operation process of flow aggregate-network changes as a result of removing a node (and its connections), compile a new list of nodes of the set VM that remained in the order of decreasing recalculated values of their interaction strength with flow aggregate- network and proceed to point 2. In this case, it is advisable to choose a reduction in the volume of flows in MLNS by a certain predetermined value as the criterion for the attack success. 4. Conclusions The concepts of structural and flow aggregate-networks of monoflow multilayer network system are introduced in the article in order to reduce the dimensionality of MLNS models and simplify the analysis of their vulnerability to heterogeneous negative influences. The main local and global structural and flow characteristics of multilayer system and its aggregate-network elements are determined and the relationship between them is established. These characteristics are chosen as importance indicators of MLNS nodes, with the help of which effective structural and functional scenarios of successive targeted attacks on multilayer network systems are built. It is shown how, on the basis of various models of intersystem interactions, the domains of directly damaged and consequentially injured by the negative influence the system elements are determined. The advantages of flow approach for studying the vulnerability of intersystem interactions process and quantifying the level of losses caused to this process as a result of consistent negative influences are established. The next steps of our research are the study of MLNS vulnerability to simultaneous group and system-wide targeted attacks and development of optimal scenarios for their implementation. References [1] O. Polishchuk, M. Yadzhak, On the Vulnerability and Protection Strategies of Complex Network Systems and Intersystem Interactions, CEUR-WS 3538 (2023) 267-281. [2] M. Bellingerio, D. Cassi, S. Vincenzi, Efficiency of attack strategies on complex model and real- world networks, Physica A: Statistical Mechanics and its Applications 414 (2014) 174-180. doi: 10.1016/j.physa.2014.06.079. [3] Q. Nguyen et al, Conditional attack strategy for real-world complex networks, Physica A: Statistical Mechanics and its Applications 530 (2019) 12156. doi: 10.1016/j.physa.2019. 121561. [4] M. Alonso et al, Cyber-physical vulnerability assessment in smart grids based on multilayer complex networks, Sensors 21 17 (2021) 5826. [5] F. Zhou et al, Influence of interlink topology on multilayer network robustness, Sustainability 12(3) (2020) 1202. doi: 10.3390/su12031202. [6] B. Fan et al, Critical nodes identification for vulnerability analysis of power communication networks, IET Communications 14 4 (2020) 703-713. doi: 10.1049/iet-com.2019.0179. [7] J. Bluszcz, M. Valente, The Economic Costs of Hybrid Wars: The Case of Ukraine, Defence and Peace Economics 33 1 (2022) 1-25. doi: 10.1080/10242694.2020.1791616. [8] N. Vindegaard, M.E. Benros, COVID-19 pandemic and mental health consequences: Sys- tematic review of the current evidence, Brain, Behavior, and Immunity 89 (2020) 531-542. doi: 10.1016/j.bbi.2020.05.048. [9] J. Mariyam, D.S. Lekha, Need for a realistic measure of attack severity in centrality based node attack strategies, in Complex Networks and Their Applications XI, R.M. Benito et al, Eds. Springer: Cham (2022) 857-866. [10] L. Glenn, Understanding the influence of all nodes in a network, Science Reports 5 (2015) 8665. doi: 10.1038/srep08665. [11] S. Boccaletti et al, The structure and dynamics of multilayer networks, Physics Reports 544 1 (2014) 1-122. doi: 10.1016/j.physrep.2014.07.001. [12] L.G. Alvarez-Zuzek et all, Dynamic vaccination in partially overlapped multiplex network, Physical Review E 99 (2019) 012302. doi: 10.1103/PhysRevE.99.012302. [13] M. Berlingerio et all, Multidimensional networks: foundations of structural analysis, World Wide Web 16 (2013) 567 593. doi: 10.1007/s11280-012-0190-4. [14] A. Saxena, S. Iyengar, Centrality measures in complex networks: A survey, arXiv: 2011. 07190, 2020. [15] O. Polishchuk, Structural Cores and Problems of Vulnerability of Partially Overlapped Multilayer Networks, in Complex Networks and Their Applications XI, H. Cherifi et al, Eds. Springer: Cham (2023) 613-624. doi: 10.1007/978-3-031-21127-0_50. [16] O.D. Polishchuk, M.S. Yadzhak, Models and methods of comprehensive research of complex network systems and intersystem interactions. Pidstryhach Institute for Applied Problems of Mechanics and Mathematics, National Academy of Sciences of Ukraine: Lviv, 2023. [17] Yu. Holovach et al, Complex networks, Journal of physical studies 10 4 (2006) 247 289. doi: 10.30970/jps.10.247. [18] D. Krackhardt, Assessing the political landscape: Structure, cognition, and power in organiza- tions, Administrative Science Quarterly 35 2 (1990) 342 369. doi: 10.2307/2393394. [19] A. Barrett, M. Barthelemy, A. Vespignani, The architecture of complex weighted networks: Measurements and models, in Large Scale Structure and Dynamics of Complex Networks, G. Caldarelli, Eds. World Scientific: Singapore (2007) 67-92. doi: 10.1142/9789812771681_ 0005. [20] A.-L. Barabasi, The architecture of complexity, IEEE Control Systems Magazine 27 4 (2007) 33- 42. doi: 10.1109/MCS.2007.384127. [21] R. Noldus, P. Van Mieghem, Assortativity in complex networks, Journal of Complex Networks 3 4 (2015) 507-542. doi: 10.1093/comnet/cnv005.