Vulnerability of Multilayer Network Systems to Targeted Group Attacks⋆

Abstract

The main types of simultaneous targeted group attacks on complex network systems and the processes of intersystem interactions are discussed in this article. On the basis of the structural model of the multilayer network system (MLNS) and its aggregate network, the most important components from a structural point of view, namely, the cores of various types, whose damage will cause the greatest failures in the MLNS structure, are highlighted. On the basis of the flow model of a multilayer system and its flow aggregate network, the most important components from a functional point of view, namely, the flow cores of various types, whose damage will cause the greatest failures in the process of intersystem interactions, are determined. Effective scenarios of successive and simultaneous targeted group attacks on the structure and operation process of multilayer network systems have been developed using the structural and flow cores of aggregate networks of MLNS. The use of a flow-based approach allows us to construct much more effective scenarios of such attacks, as well as to more accurately evaluate the consequences of the resulting damage.

Keywords

• eol>complex network
• network system
• intersystem interactions
• multilayer network system
• flow model
• aggregate network
• core
• influence
• betweenness
• vulnerability
• targeted attack

1. Introduction

The main types of negative internal and external influences on complex network systems (NSs) and intersystem interaction processes were analyzed in [ 1 ]. Among these influences, targeted attacks and nontarget disruptions of complex systems, which can have local, group, or system-wide character and be aimed at damaging both the structure and operation process of network and multilayer network systems, have been highlighted. The authors also analyzed typical scenarios of sequential attacks on the structure and process of intersystem interactions, established their connection with the development of countermeasures against nontarget system disruptions, and proposed methods for evaluating the local and general losses caused by certain negative influences. No real-world large-scale complex system is capable of simultaneously protecting or restoring all the elements affected by negative influences [ 2, 3 ]. Currently, in the theory of complex networks (TCN), researchers' main focus is on constructing scenarios of sequential targeted attacks on the most structurally important elements of NS and MLNS [ 4, 5 ]. In a monograph [ 6 ], which is based on structural and flow models of intersystem interactions, the main local and global structural and functional indicators of the importance of MLNS elements were identified, allowing for the detection of system elements that require primary protection. To reduce the problem's dimensionality, the concepts of structural and flow aggregate networks of MLNS were introduced, through which effective scenarios of sequential targeted attacks on the system's structure and operation process were constructed. It is evident that simultaneous group and system-wide attacks on NS and MLNS are significantly more dangerous, both in terms of their protection against disruptions and their recovery afterward. For example, in Ukraine, the share of state banks in the country's banking system at the beginning of 2022 did not exceed 0.7%. At the same time, their share of assets in this system was 55.2%, and their share of individual deposits was 61.6% [ 7 ]. A successful attack on this small group of banks would lead to the greatest losses in the state's financial system. The massive DDoS attacks on January 14 and February 14-16, 2022, on more than 70 of Ukraine's most important state, security, financial, and social computer networks [ 8 ], can be considered an attempt at a system-wide strike on the information component of the state's governance system. This implies that to critically destabilize or shut down a real NS or MLNS, in many cases, it is enough to simultaneously damage the structure and/or operation process of a certain group of nodes. Indeed, sequential attacks on separate, even the most structurally important nodes of the network system, as proposed in currently developed targeted attack scenarios [ 9, 10 ], often allow us to redistribute their functions among other undamaged nodes. However, countering a simultaneous successful attack on a group of the most important elements of NS or MLNS, or the system as a whole, and, more importantly, overcoming the consequences of such an attack or large-scale nontarget disruptions, is incomparably more difficult [ 11, 12 ]. The purpose of this work is to determine, on the basis of structural and flow models of intersystem interactions, the importance indicators of MLNS components, develop effective scenarios of simultaneous group attacks on the structure and operation process of multilayer network systems, and evaluate the consequences of their damage for separate layer systems and the implementation of intersystem interactions in general. Solving these problems will facilitate correct decision making not only regarding ensuring the active and passive protection of the system but also organizing its recovery after damage and the fastest possible return to normal operation.

2. The simultaneous group targeted attacks on complex network and multilayer network systems

A targeted attack or nontarget disruption of even one of the most important elements of a realworld system can lead to dangerous consequences (ranging from widespread dissatisfaction with the quality of information services to the declaration of war): the cyberattack on Kyivstar on December 12, 2024, difficulties submitting electronic declarations in the spring of 2016 and 2017, the Chernobyl Nuclear Power Plant accident on May 26, 1986, the attack on Pearl Harbor on December 7, 1941, etc. Clearly, simultaneous group attacks or nontarget system disruptions can be much more difficult than point or sequential elementwise attacks, both in terms of system protection and overcoming the consequences. We categorize simultaneous group negative influence as one-time, repeated, or sequential. In the case of targeted attacks, this categorization is often determined by the attacker's ability to carry out subsequent mass attacks and the attacked system's ability to effectively defend against and counter them. Examples of one-time group negative influences include the terrorist attack by Al-Qaeda on the United States on September 11, 2001, which was carried out simultaneously on several civilian and military targets, and the Hamas missile attack on Israel on October 7, 2023, during which more than 2,500 rockets were launched. Repeated group attacks occur regularly over certain intervals on the same system targets. Examples 167 of repeated attacks include the 18 missile strikes on Kyiv throughout May 2023, the continuous shelling of border and front-line settlements in Ukraine during the russian-ukrainian war, earthquakes and tsunamis in Japan and Chile, seasonal flu, waves of COVID-19, and more. Sequential group attacks differ from repeated attacks in terms of damage targets: the series of missile attacks on Ukraine's oil depots in May-June 2022 and the airstrikes on Ukraine's power system transformer stations during 2022-2025, or the phased sanctions against russia's complex, and so on. Each of the aforementioned types of attacks requires the development of specific scenarios for its most likely realization. The simplest scenario of one-time group attack is realized by attempting to simultaneously strike a group of the most important MLNS elements, identified by a certain criterion. The scenario of repeated attack is realized by attempting to strike a previously selected and earlier attacked but not destroyed group of elements of the multilayer system. Scenario 1 of a sequential group attack involves gradually executing the following steps:

1) create a list of groups of nodes (subsystems) of the MLNS in descending order of their structural and/or functional importance in the system; 2) remove the first group from the created list; 3) if the attack success criterion is met, end the scenario; otherwise, proceed to step 4; 4) since the system structure and operation process changes due to the removal of a certain group of nodes (and their connections), create a new list of groups in descending order of recalculated structural and/or functional importance indicators in the MLNS, and return to step 2.

From the above scenarios, it follows that, in addition to determining the attack success criteria [ 6 ], the primary way to improve their effectiveness consists of selecting the structural and/or functional importance indicators of the group in the system, the damage of which would cause the greatest harm. The most obvious way to make such a selection is by forming a list of MLNS nodes in descending order of their structural or flow centrality of the chosen type and forming a group from the first nodes on this list, with the quantity of nodes determined by the intruder's ability to attack them simultaneously. The second approach is based on the principle of the nesting hierarchy [ 13 ]. For example, before a military offensive, it is advisable to first destroy the command centers and key logistical objects of the enemy's army in the region adjacent to the front line where this offensive is planned rather than those located far from it. If an epidemic of a dangerous infectious disease begins in a certain area of the country, this area should be prioritized for isolation (quarantine). A similar situation arises in zones of radioactive or chemical contamination, areas of forest fires, regions experiencing the proliferation of agricultural pests, etc. We will determine the importance indicators of MLNS groups of elements on the basis of their structural and flow models and the concepts of aggregate networks and cores of multilayer systems, which these models allow us to form.

3. A structural model of the MLNS

The structural model of intersystem interactions is described by multilayer networks (MLNs) and displayed in the form [ 14 ]

GM = ( mM=1Gm , mM,k=1, mk Emk ), where Gm = (Vm , Em ) determines the structure of the mth network layer of the MLN; Vm and Em are the sets of nodes and edges of network Gm , respectively; Emk is the set of connections between the nodes of Vm and Vk ; m  k ; m, k = 1, M ; and M is the quantity of MLN layers. The set

M V M = m=1Vm will be called the total set of MLN nodes, where N M is the quantity of elements of V M . In this work, we consider partially overlapped MLNs [ 15 ], in which connections are possible only between nodes with the same numbers from the total set of nodes V M (Fig. 1a). This means that each node can be an element of several systems and perform one function but in different ways. Nodes through which interlayer interactions are carried out are called MLNS transition points, and the set M

EM = m=1Em is the total set of edges, and LM is the quantity of elements of the set E M .

a) b) c)

The multilayer network GM is fully described by an adjacency matrix

AM = {Akm}mM,k =1 , in which the blocks Amm determine the structure of the intralayer and blocks Akm, m  k , interlayer interactions. Values aikjm =1 if the edge connecting nodes nik and n mj exists, and aikjm =0, i, j = 1, N M , m, k = 1, M , if such an edge does not exist. Blocks Akm = {aikjm}iN, jM=1 , m, k = 1, M , of matrix are determined for the total set of MLN nodes; i.e., the problem of coordination of node numbers is removed in the case of their independent numbering for each layer.

In monograph [ 6 ], to simplify the analysis of the MLNS structure and development of scenarios for sequential targeted attacks, the concept of its aggregate network was introduced, which is fully described by an adjacency matrix

N M Ε = { ij }i, j=1 .

The off-diagonal elements  ij , i  j , of matrix E represent the structural aggregate weights of the edges (ni , n j ) , i.e., the quantity of layers in which these edges are present. The diagonal elements  ii correspond to the structural aggregate weights of nodes in the multilayer network, i.e., the quantity of layers to which these nodes belong, where ni and n j , i, j = 1, N M , are nodes from the total set of nodes V M . The structure of this aggregate network can be described as follows (Fig. 1a):

GaMg = (V M , E M ) .

3.1. Structural cores of the MLNS

To solve the problem of identifying the most structurally important components of intersystem interactions, we introduce the concept of the p-core G~ p = (V~ p , E~ p ) of a partially overlapped multilayer network, which is defined as its largest multilayer subnetwork, where the nodes belong (1) (2) to at least p, 2  p  M , layers (Fig. 1b, c). The structure of the p-core is described by an adjacency matrix A~ Mp , which is derived from the adjacency matrix AM by removing those rows and columns where the aggregate weights of nodes are less than p. If the maximum value p, at which the partially overlapped multilayer network G~ p does not degenerate into an empty set, is equal to M, we call such MLN coreness; otherwise, it is coreless. Clearly, the core G~М of coreness MLN has a multiplex structure (Fig. 1c) [ 16 ].

The elements of matrix E define the integral structural characteristics of the nodes and edges of the multilayer network (Fig. 2a). The projections of p-cores, 2  p  M , onto the aggregate network GaMg are called the pag-cores of this aggregate network (Fig. 2b, c).

a) b) c) most structurally important groups of nodes for the organization of intersystem interactions in a partially overlapped multilayer network, which can become the primary targets for attacks on such interactions.

To highlight the most important components of a complex network, the concept of its k-core is introduced, which is defined as the largest subnetwork of the source network whose structural degree of nodes is no less than k > 1 [ 17 ]. The analogous concept in a multilayer network is the socalled k-core [ 18 ], represented as a vector k = {k1, k2,...,kM} , which is a combination of km-cores of separate MLN layers. In this case, the value of km, m =1, M , may vary across different layers. Generally, the k-core defines components that are structurally important for the MLN layers but not for the organization of interlayer interactions within it and is used to analyze so-called multidimensional (multiflow) MLNs [ 19 ]. For monoflow multilayer networks, which are considered in this article, we can introduce the concept of the k-core as the largest multilayer subnetwork of the source MLN, whose generalized structural degree of nodes (the sum of quantities of input and output edges of nodes in network layers and its interlayer links at the transition point [ 6 ]) is no less than k. Unlike the p-cores of the MLN, their k-cores highlight the most important groups of nodes for both intersystem and intrasystem interactions in a partially overlapped multilayer network, which may become the primary targets for attack. We call the projection of the MLN kcore onto the aggregate network GaMg its kag-core. The structures of k- and kag-cores are described by the adjacency matrices AkM and Ek, which are obviously derived from the matrices AM and E, respectively.

3.2. Targeted group attacks on the MLNS structure

Notably, when identifying -, ag-, k-, or kag-cores in the structures of real-world MLNs, many disconnected groups of nodes included in these cores may appear. This raises the issue of determining the importance indicators of these groups in the MLN or its aggregate network to form appropriate lists for scenarios of targeted simultaneous group attacks. To determine such importance indicators, one can use the following: • the specific weight of the quantity of nodes in the group in the total set of nodes V M ; • the specific weight of the quantity of edges between the nodes of the group in the total set of edges E M ; • the specific weights of the transition points of the group in the total set of transition points of the multilayer network.

The importance of a group in the MLN can also be determined by its generalized structural degree. In fact, the generalized structural degree of a group determines the quantity of MLN nodes that can be consequentially injured as a result of simultaneous attacks on this group. The sum of directly damaged and consequentially injured nodes due to such attack on the multilayer network can be considered the most suitable structural indicator of the group's importance. On the basis of these considerations and using, for example, the concept of kag-core, we can formulate Scenario 2 of sequential targeted simultaneous group attack on the MLN structure: 1) set the value q = max {kag}; 2) create a list of groups of nodes that are part of the q-core in the MLN aggregate network; 3) sort the compiled list of groups in descending order according to the selected importance indicator in the aggregate network, for example, the generalized structural degree of the group; 4) remove the first group from the sorted list; 5) if the attack success criterion is met, terminate the execution of the scenario; otherwise, proceed to point 6; 6) if the list of groups with the current value of q is not exhausted, return to point 3; otherwise, proceed to point 7; 7) set q=q q is less than the minimum kag value, terminate the execution of the scenario; otherwise, return to point 2.

If during the execution of Scenario 2, a certain group of nodes contains too many elements for the attacker to target simultaneously, that group should be divided into the minimum quantity of connected subgroups available for such attacks. Additionally, the scenario may end when the attacker's resources for continuing the attack are exhausted. Notably, as the value of q sequentially decreases in the above scenario, the group attack gradually evolves into a system-wide attack.

4. A flow model of the MLNS

A method for decomposing multidimensional MLNS into monoflow multilayer systems was proposed, and a flow model of these systems was considered in [ 1 ], which allows us to calculate the main local and global functional characteristics of the elements of such formations and construct scenarios of successive group attacks on the process of intersystem interactions. By the flow on an edge, we mean a certain positive real-valued function associated with this edge (e.g., the number of passengers or tons of cargo transported between two neighboring stations per day, the quantity of cars that drove between two adjacent intersections of a city street per hour, the volume of natural gas that passed between two distribution stations during a month, the volume in kilobytes of a letter sent from one email user to another, etc.). Let us reflect the set of flows that pass through all edges of the multilayer system in the form of a flow adjacency matrix VM(t), the elements of which are determined by the volumes of flows that passed through the edges of MLN (1) for the period [t − T , t] up to the current moment of time t  T :

V M (t) = {Vijkm(t)}iN, j=1, kM,m=1, Vijkm(t) = V~ijkm(t) max max s,g=1,M l, p=1,N M {V~lpsg (t)}, (3) where V~ijkm(t) is the volume of flows that passed through the edge ( nik , n mj ) of the multilayer network for time period [t − T , t] , i, j = 1, N M , k, m = 1, M , and t  T  0 , [ 6 ]. The structure of matrix VM(t) completely coincides with the structure of matrix . The elements of the MLNS flow adjacency matrix are determined on the basis of empirical data concerning the movement of flows through MLNS edges. Currently, with the help of modern means of information extraction, such data can be easily obtained for many natural and vast majority of man-made systems [ 20 ]. The matrix VM(t), similar to AM, also has a block structure, in which the diagonal blocks Vmm(t) describe the volumes of intralayer flows in the mth layer, and the off-diagonal blocks Vkm(t) , m  k , describe the volumes of flows between the mth and kth layers of MLNS, m, k = 1, M , t  T  0 .

To identify the functionally most important components of a monoflow multilayer system, the concept of its flow  -core is introduced. The adjacency matrix VM (t) of this core is determined from model (3) via the following relation:

VM (t) = {Vk,mij (t)}N M M V ikjm(t), if V ikjm(t)   , i, j=1 k,m=1, Vk,mij (t) = 

 0,if V ikjm(t)   ,  [ 0, 1 ] , t  T  0 , i, j = 1, N M , k, m = 1, M .

The larger the value of  is, the more functionally significant the component of the multilayer system represented by its flow  -core. This core may become one of the primary targets for simultaneous group attacks.

The concept of a flow aggregate network of monoflow partially overlapped MLNS was introduced in a monograph [ 6 ]. Since we are considering the case in which interlayer connections are possible only between nodes with the same numbers in the total set of MLNS nodes, the structure of such an aggregate network can also be described in the form of (2). Then, the adjacency matrix the elements of which are calculated according to the following formulas:

N M

F(t) = { fij (t)}i, j=1 , fij (t) = mM=1Vijmm(t) M , i  j , fii (t) = mM,k=1, mk Viimk (t) (M −1)2 , i, j = 1, N M , completely defines a dynamic (in the sense of dependence on time) weighted network, which is called the flow aggregate network of this MLNS. The elements of matrix F(t) determine the integral flow characteristics of the edges and transition points of the multilayer system, namely, the offdiagonal elements of this matrix are equal to the total volume of flows passing through edge (ni , n j ) , and the diagonal elements are equal to the total volume of flows passing through transition point ni of the MLNS during time period [t − T , t] , t  T  0 , where (ni , n j ) represents the edges from the total set of edges EM, and where ni , n j , i, j = 1, N M , represent the nodes from the total set of nodes V M .

To identify the functionally most important components of the MLNS flow aggregate network, we introduce the concept of its flow  ag -core, whose adjacency matrix is determined by the following relation:

F ag (t) = { f ijag (t)}iN, jM=1, f ijag (t) =  f ij (t), if f ij (t)  ag , ag [ 0, 1 ] , t  T  0 .

 0,if f ij (t)  ag ,

The larger the value of  ag is, the more functionally significant component of the MLNS flow aggregate network represented by its  ag -core. It is also advisable to select this core as one of the primary targets for simultaneous group attacks. Notably, the structures of the projections onto the aggregate network  -core and the  ag -core, for equal values of  and  ag , generally differ, and the  ag -core determines the integral importance indicators of the MLNS components.

5. Importance indicators for flow cores of the MLNS

The global flow characteristics of MLNS nodes, such as their input and output influence and betweenness parameters, were introduced in a monograph [ 6 ]. These parameters allow us to determine the importance of separate nodes in the operation of a multilayer system as generators, final receivers, and transitors of flows and to develop effective scenarios of targeted sequential elementwise attacks on the process of intra- and intersystem interactions. However, to form effective scenarios of simultaneous group attacks, it is advisable to calculate the functional importance indicators of separate MLNS subsystems. To simplify the presentation, we define such indicators for the  ag -core of the MLNS aggregate network.

5.1. Influence parameters of the flow cores

Let us set the value ag [ 0, 1 ] and denote by H ag = {niag }iN=1ag the set of nodes in the  ag core of the multilayer system aggregate network. The set Gout denotes the set of all nodeag generators of flows that belong to H ag , and Rout is the set of indices of nodes that are the final ag receivers of flows generated by the nodes belonging to Gout . The set Rout is divided into two ag ag subsets:

Rout = Rout

ag ag,int  Roaugt,ext , where Rout ag ,int is the subset of indices of nodes from Rout that belong to H ag and where ag Rout ag ,ext is the subset of indices of nodes from Rout that belong to the complement of H ag in the ag source aggregate network. The set Rout

ag ,ext is called the domain of the output influence of the  ag -core onto the MLNS flow aggregate network, and the quantity of elements pout ag ,ext in this set is the power of this influence.

The external and internal output strengths of influence of the node-generators of flows belonging to the set Goaugt on the subnetworks Roaugt,ext and Roaugt,int are calculated via the following parameters:  out  out (t) / poaugt,ext ,

ag,ext (t) = iRoaugt ,ext i  out  out (t) / poaugt,int , ag,int (t) = iRoaugt ,int i (4) respectively. In formula (4), the value of iout (t) determines the total volume of flows generated at node ni Gout , that is, the influence strength of this node on the flow aggregate network of the ag multilayer system [ 6 ], and the value of pout ag ,int is equal to the quantity of elements in subset Roaugt,int . The parameters oaugt,ext , Roaugt,ext , and poaugt,ext are called the output parameters of influence of  ag -core onto the flow aggregate network. Similarly, the parameters  in ag,ext , Rin ag,ext of the input influence of the MLNS aggregate network onto its  ag -core, ag ,ext , and pin i.e., the set of nodes-generators of flows outside this core in the MLNS aggregate network on the nodes final receivers of flows within the  ag -core, are determined. The disruption of the nodegenerator of flows means that the nodes final receivers must find new sources of supply, whereas the damage of node final receivers means that producers must find new markets, leading to at least temporary difficulties in their operations. The input and output influence parameters of the  ag -core make it possible to quantify the losses resulting from a successful simultaneous attack on it and how far and to what extent such an attack will spread across the elements of intra- and intersystem interactions.

5.2. Betweenness parameters of the flow cores

No less important for the analysis of the participation of the  ag -core in the operation process of the MLNS flow aggregate network are the betweenness parameters of this core, which are determined as follows. The set PKag = {pkag }kK=1ag denotes the set of paths that connect the ag generator nodes and final receiver nodes of flow aggregate network, which lie outside the  ag core but pass through the elements of the set H ag . Let vk (t) be the volume of flows that ag passed through path pk

ag through the  ag -core during the period [t − T , t] . Then, the value

from the generator node to the final receiver node and therefore determines the total volume of flows that passed through the set of paths PKag and therefore ag through the  ag -core during the same period of time. The value

VKagag (t) = kK=1ag vkag (t) 

Kag (t) / s(F(t)) , ag = Vag (5) which determines the specific weight of flows transiting through the  ag -core for period [t −T,t], t  T , is called the measure of betweenness of this core in the operation process of the MLNS aggregate network. In formula (5), the value s(F(t)) is equal to the sum of the elements of the flow adjacency matrix F(t) . The set Mag of all aggregate network nodes that lie on paths from the set PKag outside the  ag -core is called the betweenness domain, and the quantity ag ag of these nodes is called the betweenness power of the  ag -core in the operation process of the MLNS aggregate network. The parameters of the measure, domain and power of betweenness of the  ag -core are global characteristics of its importance in the operation process of the multilayer system aggregate network. They determine how the blocking of this core affects the work of the betweenness domain, the size of this domain and, as a result, the entire system.

5.3. Comprehensive scenario of targeted group attack

As in the case of nodes of the MLNS aggregate network [ 6 ], the values of the influence and betweenness parameters of the  ag -core can be generalized, considering that it can simultaneously be a generator, final receiver and transitor of flows. Specifically, the generalized parameter ag (t) of interaction strength of the  ag -core with the MLNS aggregate network in general is calculated by the following formula:

ag (t) = (oaugt,ext (t) +inag,ext (t) + ag (t)) / 3, t  T , defines the overall role of the  ag -core in the aggregate network of the multilayer system as the generator, final receiver and transitor of flows; the domain ag (t) of the interaction of the  ag core with the MLNS aggregate network is determined by the following ratio:  ag (t) = Rin

ag ,ext (t) Roaugt,ext (t) Mag (t) , and the power ag of the interaction of the  ag -core with the MLNS aggregate network is equal to the ratio of the number of elements of domain ag (t) , t  T , to the value NM. The parameters of the interaction of the flow  ag -core with the MLNS clearly determine the level of their dependence on each other and make it possible to quantitatively define how damage to this core affects the process of intersystem interactions in general, how many and exactly which elements of the aggregate network of the multilayer system are affected and to what extent. That is, in the case of disruption of the  ag -core, the domain ag (t) determines the totality of all the consequentially injured MLNS elements, and parameter ag is their number. By means of the concept of the  ag -core and generalized parameter ag (t) of the strength of their interaction with the MLNS flow aggregate network as an importance indicator of a group of nodes, we can form Scenario 3 of successive targeted simultaneous group attacks on the process of intersystem interactions: 1) set the value  ag = 1; aggregate network; 3) sort the compiled list of groups in decreasing order on the basis of the strength of their interaction with the MLNS aggregate network; 4) remove the first group from the sorted list; 5) if the attack success criterion is met, terminate the execution of the scenario; otherwise, proceed to step 6; 6) if the list of groups with the current value  ag is not exhausted, return to step 3; otherwise, proceed to step 7; 7) set ag =ag − , where   1,  [ 0,1 ] is a predefined value, for example,  = 0,1 ; if  ag is less than its minimum value for the flow aggregate network, terminate the execution of the scenario; otherwise, return to step 2.

If during the execution of Scenario 3, a certain group of nodes contains too many elements that the attacker is unable to target simultaneously, such a group is divided into the minimum number of connected subgroups accessible for such attacks. Additionally, the scenario may terminate when the intruder runs out of resources to continue the attack. Notably, as the value of  ag decreases in the above scenario, the group attack increasingly transforms into a system-wide attack.

Depending on the goal of attack, the targets may include generators, final receivers, flow transitors, or only transition points of the  ag -core of the MLNS flow aggregate network. For each of these types of nodes, specific targeted attack scenarios can be constructed using the influence or betweenness parameters defined above in formulas (4) or (5), respectively, as indicators of group importance. One of the drawbacks of targeted attack scenarios based on local structural or functional importance indicators of MLNS nodes is that only the elements directly adjacent to the damaged nodes can reasonably be considered consequentially injured. Before conducting an attack on generators, final receivers, transitors, or transition points of the MLNS, it is possible to identify the domains of input and output influence and betweenness, which helps determine the elements that may be consequentially injured as a result of the attack, as well as to calculate the potential level of their losses. A quantitative measure of these losses relative to the damage inflicted on the attacked system allows us to determine the feasibility of conducting the attack, for example, the imposition of specific sanctions against an aggressor country.

Similarly, for the  ag -core, functional importance indicators and corresponding scenarios can be formed arbitrarily, e.g., hierarchically nested MLNS subsystems [ 13 ], connected groups of aggregate network elements, or the  -core of the multilayer system as a whole.

6. Comparison of structural and flow-based scenarios of simultaneous targeted group attacks

Let us consider the railway transport system (RTS) of the western region of Ukraine as an example of a component of the multilayer general transportation system of the country. This MLNS includes railway, automotive, water, and aviation layers. The structural model of RTS is built on the basis of the railway connection map of the region (in this case, it includes 354 nodes). To develop a flow model, we use data concerning freight transportation volumes carried by rail during 2021 (in the next few years, access to such data has been significantly restricted for understandable reasons). For better comprehension, Fig. 3a shows the structural model of this network system without transit nodes of degree 2. This model includes 29 nodes and 62 edges. Fig. 3b shows a weighted network schematically reflecting the flow volumes that passed through the RTS edges during a specified period (the line thickness is proportional to these flow volumes). Fig. 3c presents the structural 4-core of this network system, which includes 12 nodes and 35 edges, whereas Fig. 3d shows its flow 0.8-core, comprising 4 nodes and 12 edges. From the presented figures, one can observe a major drawback of k-cores: they may exclude functionally important system components from their structure (e.g., the path A B).

The provided examples indicate that the quantity of targets in a group attack scenario based on the concept of the flow core is three times smaller than that in a scenario using the k-core concept. Analyzing the influence and betweenness parameters of directly damaged nodes (attack targets) for the presented network system indicates that all RTS elements are affected in this case. Thus, the flow-based approach enables the development of significantly more efficient group attack scenarios in terms of the number of attack targets, causing no less damage than the structural approach does.

Nodes of the transportation network that facilitate movement of the largest volumes of flows within the system require priority protection from targeted attacks. Moreover, during the spread of epidemics caused by dangerous infectious diseases, such nodes need to be promptly isolated to block passenger traffic. Thus, blocking separate NS components can serve both as an attack goal and as a method of system protection. Consequently, the problem of system vulnerability can be conditionally divided into two tasks. The first of them, discussed in the previous example, involves identifying the elements that need to be prioritized for protection to prevent system destabilization or operational failure. The second task focuses on determining the elements whose blocking minimizes the losses expected from the spread of the disruption. Using an example of a railway passenger transportation system, we demonstrate that scenarios designed to protect the NS from targeted attacks can be effectively applied to counteract the spread of nontarget disruptions. The structural model of the passenger transportation system, excluding nodes of degree 2 (Fig. 4a) and its 4-core coincides with the structural model of the freight transportation system. To develop a flow model for passenger movement, we use data on passenger traffic volumes handled by the railway in 2019 (prior to the beginning of the COVID-19 pandemic). Fig. 4b schematically illustrates this model (as before, the line thickness is proportional to the flow volume). Fig. 4d shows the flow 0.8-core of the passenger transportation system, which contains 3 nodes and 8 edges. This finding indicates that halting passenger traffic requires blocking 4 times fewer elements than does using the structural 4-core of the corresponding network system.

7. Conclusions

The main types of simultaneous targeted group attacks on complex network systems and intersystem interaction processes are considered in this article. On the basis of the structural model of the multilayer network system and its aggregate network, the most important structural components, namely, cores of various types, were identified, the disruption of which would cause the greatest damage to the MLNS structure. On the basis of the flow model of the multilayer system and its flow aggregate network, the most functionally important components were determined, specifically flow cores of different types, the disruption of which would cause the greatest disruptions in the intersystem interaction process. Using the structural and flow cores of MLNS aggregate networks, effective scenarios of targeted simultaneous group attacks on the structure and operation process of multilayer network systems were developed. The application of the flow-based approach allows us to create significantly more effective attack scenarios and more accurately evaluate attack damage consequences. The next steps of our research are the development of methods for system-wide attacks on complex network systems and intersystem interaction processes, the analysis of the problem of the scale of consequences from targeted attacks and nontarget disruptions, and the creation of methods for optimizing counteraction scenarios against various negative influences on multilayer network systems.

Declaration on Generative AI

The authors have not employed any Generative AI tools.

References

[1] O. Polishchuk , M. Yadzhak , On the Vulnerability and Protection Strategies of Complex Network Systems and Intersystem Interactions , CEUR-WS 3538 ( 2023 ) 267 - 281 .

[2] M. Chenlia , S. Bannerman , E. Abrokwah, Reviewing the global economic impacts and mitigating measures of COVID-19 , Total Quality Management & Business Excellence, 33 ( 13 - 14 ) ( 2022 ) 1573 - 1587 . doi: 10 .1080/14783363. 2021 . 1981130 .

[3] F.G. Hoffman , Conflict in the 21st century: The rise of hybrid wars , Arlington, Virginia, 2007 .

[4] M. Bellingerio , D. Cassi , S. Vincenzi , Efficiency of attack strategies on complex model and realworld networks , Physica A: Statistical Mechanics and its Applications , 414 ( 2014 ) 174 - 180 . doi: 0.1016/j.physa. 2014 . 06 .079.

[5] Q. Nguyen et al, Conditional attack strategy for real-world complex networks , Physica A: Statistical Mechanics and its Applications , 530 ( 2019 ) 12156 . doi: 10 .1016/j.physa. 2019 . 121561 .

[6] O. Polishchuk , M. Yadzhak , Models and methods of comprehensive research of complex network systems and intersystem interactions , Pidstryhach Institute for Applied Problems of Mechanics and Mathematics, National Academy of Sciences of Ukraine , Lviv, 2023 .

[7] Osnovni pokznyky dialnosti bankiv , 2022 . URL: https://index.minfin.com.ua/ua/banks/stat/.

[8] Use pro kiberataku na Ukrainu 15 lutogo: postrazdaly banky, uriad ta saity sylovyh vidomstv , 2022 . URL: https://24tv.ua /use-pro-kiberataku-ukrayinu-15-lyutogo-postrazhdali-golovninovini_n1868773

[9] J. Mariyam , D.S. Lekha , Need for a realistic measure of attack severity in centrality based node attack strategies , in: Benito R.M. et al (Eds.), Complex Networks and Their Applications XI , Springer, Cham, 2022 , pp. 857 - 866 .

[10] M. Kurant , P. Thiran , P. Hagmann , Error and attack tolerance of layered complex networks , Physical Review E , 76 ( 2 ) ( 2007 ) 026103 . doi: 10 .1103/PhysRevE.76. 026103.

[11] Y. Sawada , M. Bhattacharyay , T. Kotera, Aggregate impacts of natural and man-made disasters: A quantitative comparison , International Journal of Development and Conflict , 9 ( 1 ) ( 2019 ) 43 - 73 .

[12] A. Proletarsky et al, Decision support system to prevent crisis situations in the sociopolitical sphere , Cyber-Physical Systems: Industry 4.0 Challenges , 1 ( 2020 ) 301 - 314 . doi: 10 .1007/978-3- 030 -32648-7_ 24 .

[13] O. Polishchuk , M. Yadzhak , Network structures and systems: III. Hierarchies and networks , System research and informational technologies , 4 ( 2018 ) 82 - 95 . doi: 0.20535/SRIT. 2308- 8893 . 2018 . 4 .07.

[14] S. Boccaletti et al, The structure and dynamics of multilayer networks , Physics Reports , 544 ( 1 ) ( 2014 ) 1 - 122 . doi: 10 .1016/j.physrep. 2014 . 07 .001.

[15] L.G. Alvarez-Zuzek et al., Dynamic vaccination in partially overlapped multiplex network , Physical Review E, 99 ( 2019 ) 012302 . doi: 10 .1103/PhysRevE.99.012302.

[16] G. Bianconi , Multilayer Networks: Structure and Function , Oxford University Press, Oxford, 2018 . doi: 10 .1093/oso/9780198753919.001.0001.

[17] S.N. Dorogovtsev , A.V. Goltsev , J.F.F. Mendes , K-core organization of complex networks , Physical review letters , 96 ( 4 ) ( 2006 ) 040601 . doi: 10 .1103/PhysRevLett. 96.040601.

[18] Y.X. Kong et al, k-core: Theories and applications , Physics Reports , 832 ( 2019 ) 1 - 32 . doi: 10 .1016/j.physrep. 2019 . 10 .004.

[19] M. Berlingerio et al, Multidimensional networks: foundations of structural analysis , Worldwide Web , 16 ( 2013 ) 567 593. doi: 10 .1007/s11280-012-0190-4.

[20] A.-L. Barabasi , The architecture of complexity , IEEE Control Systems Magazine , 27 ( 4 ) ( 2007 ) 33 - 42 . doi: 10 .1109/ MCS . 2007 . 384127 .