Removing Nodes in a Network Can Protect Against Cascading Failures

Using an idealized model of a scale-free network, mathematician Adilson Motter from the Max Planck Institute for the Physics of Complex Systems in Dresden, Germany, has devised a strategy to mitigate the extent of the damage early in the process before the cascade can fracture the network. ² The model’s basis is simple: Each node in the grid serves as a source, destination, and typically a conduit of some quantity—a packet of information or a signal, perhaps—exchanged between every pair of nodes and transmitted along a path that connects them. Each node also is assigned a finite capacity for what it can handle, the “load” being the amount of information or signal that passes through it per unit time. The scale-free nature of the model guarantees a heterogeneous distribution of loads; some nodes are positioned to handle more load than others. Removing one (or more) of the highly connected nodes forces the load to redistribute among the others that remain and can trigger a cascade, thus overloading other nodes down the line. When overloaded, a node is removed from the network.

Motter’s prescription to halt the cascade’s size and spread can be likened to what foresters do when they deliberately set up firebreaks to control the spread of burning forest. If certain nodes trigger the problem, then intentionally removing others may cure it. But which ones? Networks are more intricately arranged than forests.

The goal is to identify the nodes whose removal would lessen the load on the most central, connected ones. Shutting down the least connected nodes should do the job best; that is, preserve a large connected component of the network. Specifically, an operator chooses those nodes by calculating at each stage in the cascade which ones have the largest disparity between the load they generate and the load they channel. The removal of those peripheral nodes alleviates the load in the whole network—they’re no longer expecting or sending out a packet—with little penalty to connectivity because the nodes had channeled the least traffic. Other parts of the system would then pick up the slack.

Made more resilient, the network can then handle the loss of key nodes as shown in the figure above. Alternatively, removing well-chosen links between nodes could also redistribute load to effectively preserve the network’s connectivity. In simulations using a network of 5000 nodes, Motter showed that the largest connected component remaining after a cascade began was 10 times greater if his prescription was followed than if the cascade was left untouched.

Although the model was designed to simulate a simple idealized case of network breakup, one can reasonably ask whether it may be adapted to realistic cases.

Networks do not have to be scale-free to undergo cascading failure. Power grids are structured networks, for instance. What makes Motter’s model potentially relevant are the heterogeneous loads he sets up in a dynamic system. In a real grid, generators produce power that transmission lines distribute to load centers formed by aggregates of consumers. Most nodes are either generators or consumers, but not both. In the event of a cascade, shutting down selected consumer nodes and permitting local blackouts on the ends of the grid can sometimes make sense.

MIT’s George Verghese wonders if Motter’s model is too idealized. “You don’t have anything like a packet going from each node to every other node in power systems,” he says. And, he adds, there are real capacities on transmission lines (or links) with potential-driven flows through them that can lead to counterintuitive re-distributions of power as the system responds to changes and follows Kirchhoff’s circuit laws. Moreover, blackouts occur not because nodes are overloaded specifically, but because generators and transformers are hardwired to save themselves in response to a drastic change. Motter’s model does account for both global and local effects, and the strategy of playing with topology to influence stability is one that interests power-grid designers. But Verghese questions whether, once the rules are rewritten to reflect more closely the constraints of power flow, the prescription wouldn’t change.

The model may be more directly relevant for the internet, where information flow is bidirectional. Worms or virus attacks can certainly infect a communications network, causing router congestion that leads to denial-of-service errors; these behave in a way analogous to overloading, though no nodes are really killed.

The extent to which some nodes are more vulnerable than others is controversial. Many network theorists argue that the internet is scale-free on the level of autonomous domains (university.edu domains, or huge service providers like AOL or MCI). But AT&T network researcher Walter Willinger cautions that this scaling perspective is a red herring. “Technologically, routers in the core of the network just cannot accommodate large numbers of high-bandwidth connections.” The core networks of large service providers really consist of a large number of high capacity routers, for instance, that may be widely spread around the world. “It’s hard to imagine taking out a node … by effectively attacking all the core routers as a group” he says.

Motter’s method of cascade control does not depend on any particular network structure or details of the flow. The task of catering to specific requirements still remains. In fact, he is now adapting his model to the much different system of social networks, where each node—a person—can influence just a few others or up to tens of thousands (see Physics Today, Physics Today 0031-9228 51 9 1998 17  https://doi.org/10.1063/1.882433 September 1998, page 17 ). Imagine that a rumor starts somehow and you’d like to shut down its spread. The idea would be to prevent a transition between a phase in which few are persuaded and one in which many are, without fracturing the social network. The algorithm for such an action might be one that politicians and their spin doctors find useful.