A Survey of Interdependency Models for Critical Infrastructure Networks
The critical infrastructures of the nation such as the power grid and the communication network are highly interdependent. Also, it has been observed that there exists complex interdependent relationships between individual entities of the power grid and the communication network that further obfuscates the analysis, and mitigation of faults in such multi-layered networks. In recent years, the research community has made significant efforts towards gaining insight and understanding of the interdependency relations in such multi-layered networks, and accordingly, a number of models have been proposed and analyzed towards realizing this goal. In this chapter we study existing interdependency models proposed in the recent literature and discuss their approach, and inherent features, towards modeling interdependent multi-layer networks. We also provide a brief discussion into the drawbacks of each of these models and propose an alternate model that addresses these drawbacks by capturing the interdependency relationships using a combination of conjunctive and disjunctive relations.
Sen_Interdependency_Model.tex

\documentclass{IOS-Book-Article}

\usepackage{mathptmx}
\usepackage{graphicx}
\usepackage{amsmath}
\usepackage{epstopdf}
\usepackage{subfigure}

\newcommand\blfootnote[1]{%
  \begingroup
  \renewcommand\thefootnote{}\footnote{#1}%
  \addtocounter{footnote}{-1}%
  \endgroup
}

\begin{document}

\begin{frontmatter}

%\title{A Survey of Interdependent Models for Cascading Failures in Interdependent Infrastructures}
\title{A Survey of Interdependency Models for Critical Infrastructure Networks}
\author[A]{\fnms{Joydeep} \snm{Banerjee}%
\thanks{Correspondence To: Joydeep Banerjee, E-mail: jbanerje@asu.edu}},
\author[A]{\fnms{Arun} \snm{Das}%
\thanks{Correspondence To: Arun Das, E-mail: adas@asu.edu}}
and
\author[A]{\fnms{Arunabha} \snm{Sen}%
\thanks{Correspondence To: Arunabha Sen, E-mail: asen@asu.edu}
}

\runningauthor{J. Banerjee et al.}
\address[A]{Computer Science and Engineering Program\\
School of Computing, Informatics and Decision System Engineering\\
Arizona State University, Tempe, Arizona 85287, USA}

\begin{abstract}
The critical infrastructures of the nation such as the power grid and the communication network are highly interdependent. Also, it has been observed that there exists complex interdependent relationships between individual entities of the power grid and the communication network that further obfuscates the analysis, and mitigation of faults in such multi-layered networks. In recent years, the research community has made significant efforts towards gaining insight and understanding of the interdependency relations in such multi-layered networks, and accordingly, a number of models have been proposed and analyzed towards realizing this goal.

In this chapter we study existing interdependency models proposed in the recent literature and discuss their approach, and inherent features, towards modeling interdependent multi-layer networks. We also provide a brief discussion into the drawbacks of each of these models and propose an alternate model that addresses these drawbacks by capturing the interdependency relationships using a combination of conjunctive and disjunctive relations.
\end{abstract}

\begin{keyword}
Interdependent Network, Power Network, Communication Network, Cascading Failure
\end{keyword}
\end{frontmatter}


\section{Introduction}
\blfootnote{Acknowledgment: This research was supported in part by the DTRA grant HDTRA1-09-1-0032 and the AFOSR grant FA9550-09-1-0120. The Maricopa county communication network data used in this research was provided by GeoTel communications (www.geo-tel.com).}
%In the last few years there has been an increasing awareness in the research community that the critical infrastructures of the nation do not operate in isolation.  In fact they are closely coupled in the sense that well being of one infrastructure depends heavily on the well being of another. A case in point is the interdependency between the electric power grid and the communication network. The power grid entities, such as the SCADA systems that control power stations and sub-stations, receive their commands through communication networks, while the entities of communication network infrastructure, such as routers and cell towers, cannot operate without electric power. Cascading failures in power grid, which are not so uncommon phenomena, are even more complex now because of the coupling between power grid and communication network. Due to this coupling, not only entities in power networks, such as generators and transmission lines, can trigger power failure, communication network entities, such as routers and optical fiber lines,  can also trigger failure in the power grid. Thus, it is essential that the interdependency between different types of networks be understood well, so that preventive measures can be taken to avoid cascading catastrophic failures in such multi-layered network environments.

In the last few years there has been an increasing awareness in the research community that the critical infrastructures of the nation do not operate in isolation.  In fact, they are closely coupled with other infrastructures such that the well being of one infrastructure depends heavily on the well being of another. As an example, consider the interdependent relationship between the power, communication, and transport networks as shown in Figure \ref{fig:fig5} \cite{rinaldi2001}. If we focus exclusively on the power and communication networks we observe that entities of the power grid, such as the Supervisory Control and Data Acquisition (SCADA) systems, that control power stations and sub-stations, are dependent on the communication network to receive their operational commands. While entities of the communication network, such as routers and cell towers, are dependent on the power grid to remain operational. Compounding the complexity of analysis of this symbiotic relationship between the two networks, is the effect of cascading failures across these networks. For instance, not only can entities of the power networks, such as generators and transmission lines, trigger a power failure, but also  communication network entities, such as routers and optical fiber lines, can trigger failures in the power grid. Thus, it is essential that the interdependency between different types of networks be understood well, so that preventive measures can be taken to avoid cascading catastrophic failures in such multi-layered network environments.



%Interdependencies among networks is prominent in many real world critical infrastructures. For example, the power network is dependent on communication network (specifically Supervisory Control and Data Acquisition Systems (SCADA)) for power flow control signals and communication network depends on power network for their power supply. Failure of a set of nodes in one network causes cascade of failures affecting both the networks as a whole. Large scale power blackouts had been observed in many places around the world for example in Italy (2003), USA Northeast States and Canada blackout (2003) and more recently in India (2012). This blackouts are hypothesized to be a result of cascade of failures in power and communication infrastructure hit by an initial failure of certain entities in either network \cite{italy2003,usa2003,india2012}. Inspired from \cite{rinaldi2001} the Figure \ref{fig:fig5} represents the interdependence of power, communication and transportation infrastructures.

\begin{figure}[h]
\label{triangle}
  \centering
    \includegraphics[width=0.75\linewidth]{figure1.jpg}
    \caption{Interdependency between power, communication and transportation infrastructures}
    \label{fig:fig5}
\end{figure}

%During the recent years

%In recent years, the research community has recognized the need for a deeper understanding of the interdependency between multi-layered networks, and this topic has received a considerable amount of interest \cite{vespi2010}.
With the continued focus for developing realistic failure propagation models that aid in analyzing, and mitigating the effects of cascading faults across the entities of the multi-layered network, several failure propagation models have been studied that address the interdependency relationship between power, and communication networks \cite{buldyrev2010,rosato2008,thai2013,modiano2013}, and space based networks \cite{castet2013}.

In this chapter we present a survey of the existing interdependency models for critical infrastructure networks that have been proposed in the recent literature. In Section 2, we present the models and draw attention to some of their limitations. In Section 3 we outline the considerations that need to be taken into account for capturing the complex interdependency that exists between power grid and communication networks in the real world. In Section 4 we propose an alternative model that overcomes some of the limitations of existing models by capturing the interdependency between the networks using a combination of conjunctive and disjunctive relations. Finally, in Section 5 we present concluding remarks.


%The need to consider interdependent network properties in designing failure resistant interdependent systems has been a topic of major interest \cite{vespi2010}. Developing realistic failure propagation in interdependent networks and identifying critical nodes posing high vulnerability to critical infrastructures with interdependency is required to cope with the importance of the infrastructures involved. Interdependency and fault propagation models have been studied for interdependency in power and communication networks\cite{buldyrev2010,rosato2008,thai2013,modiano2013} and space based networks\cite{castet2013}.

%This chapter aims to study different interdependency models demonstrating critical infrastructure interdependency present in literature. For different interdependency models a simplified explanation of the interdependency considered, failure propagation model used, analysis of the models and drawback(s) of the models are discussed in Section 2 of this survey. Section 3 brings about the open issues that needs to be considered in designing and analyzing critical infrastructure interdependency models. A possible solution counteracting the issues described in Section 3 is presented in Section 4. This is followed by a brief conclusion in Section 5.



%In this chapter we study existing interdependency models proposed in the recent literature and discuss their approach, and inherent features, towards modeling interdependent multi-layer networks. We also provide a brief discussion into the drawbacks of each of these models and propose an alternate model that addresses these drawbacks by capturing the interdependency relationships using a combination of conjunctive and disjunctive relations.

\section{Interdependency Models}

\subsection{Buldyrev et al. Interdependency Model}

Motivated by the electricity blackout in Italy (2003) Buldyrev et al. \cite{buldyrev2010} proposed a cascading failure model for interdependent networks.
%To describe the model a graph is constructed....
%Assumption and connection relationship has to be explained....
%Elucidate P and C...
%When a node p_i of power network P fails, then p_i and all its incident edges are removed. Since the

The power and communication infrastructures can be represented as networks. These networks are depicted as two connected graphs $P$ (for power network) and $C$ (for communication network) with same number of nodes. To represent the interdependency between the networks, bidirectional links between $P$ and $C$, termed as $P \leftrightarrow C$ edges, are considered with every node in each graph connected to exactly one node in the other graph as shown in Figure \ref{fig:fig1}(a). These bidirectional links represent the interdependency relationship that a node in the power network is dependent on exactly one node in the communication network and vice-versa. Thus capturing the fact that a failure of a node in the power (communication) network causes the corresponding node in the  communication (power) network to fail. Hence the interdependent power and communication infrastructure can be represented as a network consisting of graphs $P$ and $C$ and $P \leftrightarrow C$ edges.\

%The networks are coupled with one to one bidirectional links (inter links) between their nodes representing the interdependency. This class of interdependency means that exactly one node in power network is dependent on one node in communication network and vice-versa. Failure of a node in power (communication) network causes the interdependent node in communication (power) network to fail.

%Failures are considered in the model when a fraction of the nodes from any of the two networks $P$, or $C$ are removed. The cascading failure propagation is now elaborated: Upon the introduction of a failure in the network, the failed nodes are removed. Correspondingly, the nodes in the other network that are connected via inter-links to the attacked nodes are also removed. Parallel to the node removals, any inter-links, or intra-links that do not have one node at each end point are also simultaneously removed. The cascade now proceeds as follows, for each node in network $C$, $c_i$, that has a path to another node $c_j$ in network $C$, if there does not exist a corresponding path between $p_i$ and $p_j$, the where $p_i$ and $p_j$ belong to network $P$.


Failures are considered in the model when a fraction of the nodes from any of the two graphs $P$, or $C$ are removed. Upon the introduction of a failure in the graph $P$, the failed nodes are removed and correspondingly, the nodes in the graph $C$ that are connected via $P \leftrightarrow C$ edges to the attacked nodes are also removed. Parallel to the node removals, any edge within graph $P$ or $C$, or $ P \leftrightarrow C$ edges that do not have one node at each end point are also simultaneously removed.

%The cascade now proceeds as follows, for the network $C$ the connected components formed by its intra-links are computed and are termed as {\em clusters}. For each cluster in network $C$, a {\em node group} is formed from the nodes in network $P$, that have an inter-link to each of the nodes in that cluster. Note that this process generates a set of {\em node groups} that equal the total number of clusters in network $C$. Now, for all the intra-links in network $P$ that connect nodes between two {\em node groups} are removed. The remaining connected components in network $P$ are are then identified as clusters of network $P$, and subsequently {\em node groups} in network $C$ are formed, and intra-links removed from $C$ in the same process as described for network $P$.

The cascade now proceeds as follows. In the first stage, the set of connected components in the graph $P$ is defined as $p_{1}$ clusters. The set of $C$ nodes connected to the $p_{1}$ clusters by $P \leftrightarrow C$ edges are termed as $c_{1}$ sets. Any edges in graph $C$, that connects these $c_{1}$ sets are removed. The set of connected components in graph $C$ after this removal of edges are defined as $c_{2}$ clusters. In the second stage using same procedure as that to find the $c_{2}$ cluster and $c_{1}$ sets, $p_{2}$ sets (from $c_{2}$ clusters and $p_{3}$ clusters are obtained. In subsequent stages this cascade process then oscillates between the two graphs until a {\em steady state} is reached when no further removal of edges in the graphs are possible. At the steady state, the interdependent network consists of {\em mutually connected clusters}. Each mutually connected cluster consists of nodes having the properties (a)  the nodes in graphs $P$ and $C$ are completely connected, (b) each of these nodes which belong to the graph $P$ ($C$) has $P \leftrightarrow C$ edge with graph $C$ ($P$). Note that there exists no intra-links between any of the mutually connected clusters. An example demonstrating this cascading process is shown in Figure \ref{fig:fig1}.

%Temporary clusters in network $P$ are formed with nodes that have an inter-link with the nodes in network $C$ clusters. For all the intra-links in network $P$ that connect nodes between the temporary clusters are removed. The connected components in network $P$ are then computed and are termed as clusters. The removal of intra links in network $C$ is done using the same procedure as was that for network $P$. The cascade continues with stepwise removal of intra-links of network $P$ and $C$ until a steady state is reached. At the steady state, the interdependent network consists of mutually connected clusters. The mutually connected clusters represent the functional sub components of an interdependent network that is resultant of a failure event. A mutually connected cluster has two properties --- (a)  nodes in the individual power and communication networks are completely connected through intra-links, (b) each node in the power (communication) network has a one to one interdependency to exactly one node in the communication (power) network via an inter-link. An example demonstrating the cascading process after a failure event is shown in Figure \ref{fig:fig1}.

%A failure event is defined as attack on a set of nodes in one network. To demonstrate the cascading failure model  two interdependent networks $A$ and $B$ are considered. On a failure event in network $A$, the nodes and their associated intra-links are removed. Due to interdependency, the nodes of network $B$ with which the failed nodes of network $A$ are coupled are removed along with their associated intra links. For all nodes in network $B$ having a path connecting them with their interdependent nodes in network $A$ without any path between them, the intra links of $B$ are removed such that these nodes does not have any connecting path. After the removal, intra links of network $A$ having the property mentioned are also removed. This cascading removal of intra links in network $A$ and $B$ continues until a steady state is reached. At steady state the interdependent network consists of mutually connected clusters. The mutually connected clusters represent the functional sub components of an interdependent network that is resultant of a failure event. A mutually connected cluster has two properties --- (a)  the power and communication network are individually connected (through intra links), (b) nodes in power and communication network has one to one correspondence interdependency. An example demonstrating the cascading process after a failure event is shown in Figure \ref{fig:fig1}.

\begin{figure}[h]
\label{triangle}
  \centering
    \includegraphics[width=0.75\linewidth]{figure2.jpg}
    %\caption{The interdependent network shown consists of power network nodes $p_{1}$, $p_{2}$, $p_{3}$ and $p_{4}$ and communication network nodes $c_{1}$, $c_{2}$, $c_{3}$ and $c_{4}$. Blue and green edges represent intra links in power and communication network respectively and black edges represent the interdependency (inter links). In the respective figures the cascading failure is demonstrated as follows --- (a) Node $p_{3}$ is attacked, (b) the node $p_{3}$ and its intra links are removed along with its interdependent node $c_{3}$ and its intra link, (c) the intra link $(c_{1},c_{4})$ is removed as the corresponding interdependent nodes $p_{1}$ and $p_{4}$ has no connecting path. The steady state is reached with two mutually connected clusters with cluster 2 as the largest mutually connected cluster.}
		\caption{The interdependent network shown consists of power network nodes $p_{1}$, $p_{2}$, $p_{3}$ and $p_{4}$ and communication network nodes $c_{1}$, $c_{2}$, $c_{3}$ and $c_{4}$. Blue and green edges represent intra links in power and communication network respectively and black edges represent the interdependency (inter links). In the respective figures the cascading failure is demonstrated as follows --- (a) Node $p_{3}$ is attacked, (b) the node $p_{3}$ and its intra links are removed along with its interdependent node $c_{3}$ and its intra link, (c) the intra link $(c_{1},c_{4})$ is removed using the cascade process defined. And finally, the steady state is reached comprising of two mutually connected clusters with cluster 2 as the largest mutually connected cluster.}
    \label{fig:fig1}
\end{figure}

The {\em largest mutually connected cluster} is defined as the cluster having the maximum number of nodes. Given a fraction $1-p$, ($0 \le p \le 1$) of nodes that are removed from the interdependent network (due to a failure), the ratio $P_{\infty}$ defines the number of nodes in the largest mutually connected cluster at the steady state, as compared to the initial number of nodes in the network. For the purpose of simulation and study, the power and communication networks are considered as, coupled scale free, Erdos Reyni \cite{erdos1959}, and random networks. Different values of $P_{\infty}$ were computed by varying the values of $p$, and the size of the network. It was observed that, above a percolation threshold $p_{c}$, the value of $P_{\infty}$ changes from the neighborhood of zero to the neighborhood of one for a given network size. From this observation the authors infer that when the fraction of failed node is below $1-p_{c}$ of the original number of nodes, the largest connected cluster has a size approximately equal to the size of initial pre-failure network. The percolation threshold $p_{c}$ for Erdos Reyni networks is validated by analytical results.

%For different continuous values of fraction $p$, and different values of the size of the interdependent network the ratio $P_{\infty}$ is obtained. Above a fraction $p_{c}$ (defined as the percolation threshold) the value of $P_{\infty}$ is observed to change from neighborhood of zero to neighborhood of one. This signifies that the largest connected cluster has a size approximately equal to the size of initial interdependent network when the fraction of failed node is below $1-p_{c}$.  For higher values of size of the interdependent network the observation is more prominent. The value of $p_{c}$ for Erdos Reyni networks is validated by analytical results.

In subsequent papers, Buldyrev et al. extend their work from their original cascading failure model (as discussed above), to interdependent networks with directional dependency \cite{buldyrev2011a}, and interdependency between more than one network \cite{buldyrev2011b}.

%Buldyrev et al. extended their work following their cascading failure model \cite{buldyrev2010} for interdependent networks with directional dependency \cite{buldyrev2011a} and interdependency between more than one network \cite{buldyrev2011b}.

%The model framed by Buldyrev et al. doesn't distinguish between nodes in either network as entities. This gives way to make considerations that a giant mutually connected cluster is functional. The power network in the giant mutually connected cluster may itself cascade due its physical limitations \cite{gil2012}. So consideration of physical properties of individual network is important to assess the applicability of the failure model.

One noticeable shortcoming of this model proposed by Buldyrev et al. is that it does not distinguish between nodes in either network as separate entities. Nodes in the power network may be functionally separate entities such as power plants, sub-stations, and load nodes. Similarly, nodes in the communication network may be functionally separate entities such as cell towers, and routers. When separate entities of the network are considered, the proposed cascading model may not work in the same way as assumed by the authors, and also the dependency relationship of one type of entity to the other may not be able to be captured with this model. Another potential drawback to this model is for the functionality of the mutually connected cluster. The mutually connected clusters generated after the cascade may not be completely functional because of the physical limitations of the network \cite{gil2012}. For example, the nodes from the power grid in a mutually connected cluster may not be able to provide sufficient power to the nodes in the communication network due to the limits on the power generation capacities. Thus, it would be wrong to assume that the residual mutually connected clusters continue to be functional after a cascade simply because they remain connected.

%This  raises questions gives way to make considerations that a largest mutually connected cluster is functional. The power network in the giant mutually connected cluster may itself cascade due its physical limitations \cite{gil2012}. So consideration of physical properties of individual network is important to assess the applicability of the failure model.

\subsection{Rosato et al. Coupling Model}

In \cite{rosato2008}, Rostato et al. model the power flow in the power grid, and the data flow in the communication network separately. They then analyze the effect of failures in the communication network, caused by failures in the power grid using a coupling model between the two infrastructures. Their analysis of the failure propagation is performed on the backdrop of the Italian high voltage electric transmission network (HVIET), and the high-bandwidth backbone of the Italian Internet network (GARR). Data for both the networks were gathered from documentation available in the public domain.

%Their analysis of the models is performed on Italian high voltage electric transmission network (HVIET) and the high-bandwidth backbone of the Italian Internet network (GARR). The effect of failures in the communication network due to failure in power grid using a simplistic coupling model between the two infrastructures is analyzed. The analysis of the models is performed on Italian high voltage electric transmission network (HVIET) and the high-bandwidth backbone of the Italian Internet network (GARR).

For modeling the power network, the HVIET network is represented by an undirected graph consisting of three type of vertices, namely, source nodes (nodes that supply power to the network), load nodes (nodes that draw power out of the network), and junction nodes (which neither draw nor supply power to network, but act as relays). The edges of the graph corresponds to the transmission lines. The power flow dynamics in the power grid relies on the DC power flow model as given by \cite{wood2012}. At every occurrence of a failure of one or more nodes, or transmission lines (edges), the power flow dynamics are recalculated using this model. It is to be noted here that the DC power flow model considers the physical constraints pertaining to the maximum power flow possible over a transmission line while computing the minimum load re-dispatch (reducing the power drawn out by the load nodes) after a failure. The authors define the quality of service (QoS) of the power network as the ratio of the change in the total power drawn by the load nodes after the failure event, as compared to the total power drawn by the load nodes before the failure event.

%The availability of the data of HVIET which generates the graph as defined is claimed to be inferred from analysis of available public documentations. The power flow in the network is solved by DC power flow model given by \cite{wood2012}. The power flow is recalculated using DC power flow model on occurrence of failure in one or more edges (transmission lines) or nodes in the graphs. The model considers the physical constraint corresponding to the maximum power flow across a transmission line in the solution of power flow in the network. An optimum load re-dispatching model (reducing the power extracted from the network by load nodes) is framed and used when the new solution, after considering edge or node failure(s), has one or more transmission line (edge) with power flow more than its defined capacity. The quality of service (QoS) of power network is defined as the ratio of the change in total power extracted by the load nodes in the graph due to a failure event and the initial extracted power by the load nodes.

For modeling the communication network, the GARR network is represented as a graph consisting of high-bandwidth backbone links as edges, and the Italian universities and research institutions as nodes. For computing the total amount of traffic inflow into the network, the probability that a node generates a packet $\lambda$, ($ 0 \le \lambda \le 1$) is considered at each time step. For each generated packet a random node is chosen as its destination. A probabilistic packet routing model is considered along the lines of \cite{echenique2004} for sending the packets to their intended destinations. The average delivery time is defined as the average of the packet transmission time from source to destination over all packets delivered correctly within a particular time interval. The average delivery time is then used as a metric to define the efficiency of the network for a given value of $\lambda$.

%The Italian GARR network is also claimed to be taken from public documentation. The network is represented in form of a graph consisting of high-bandwidth backbone links (edges) connecting Italian universities and research institutions (nodes). The amount of traffic inflow into the network is quantified into each time step by a parameter $\lambda$ ($ 0 \le \lambda \le 1$) which denotes the probability that a node in the graph will generate a packet. For each packet generated by a node, the destination node is chosen randomly. The packet routing model is considered probabilistic and the model as in \cite{echenique2004} is used. The average delivery time $<T>$ defined as the average of packet transmission time from source to destination over all packets delivered correctly within a particular simulation time is used as the metric to define the efficiency of the network for a given value of $\lambda$.

The coupling between the two networks is achieved by associating a node from the communication network to the closest load node from the power network (Euclidean distance). Note that this coupling is one directional, that is, for a node to be operational in the communication network it is dependent on a node from the power network, but the power network node is not dependent on the communication node for its survival. In a failure event, if a load node $i$ that was initially extracting power $P_{i}^{0}$ units, now extracts $P_{i}$ units of power after the subsequent load re-dispatching process. The communication nodes coupled to $i$ remain operational as long as the value of $P_{i}$ is greater than or equal to $\alpha P_{i}^{0}$, ($ 0 \le \alpha \le 1$). The coefficient $\alpha$ is termed as the strength of coupling between the two networks.

%The coupling (or interdependency) of the two networks is done by connecting a GARR node to the closest HVIET node (Euclidean distance). The coupling is rather directional (GARR node depended on the HVIET node) as modeling is done considering only the functional requirement of a GARR node based on the status of its corresponding HVIET node. For a load node which initially extracts power $P_{i}^{0}$ units and after a failure event extracts power $P_{i}$ units (due to load re-dispatching) the necessary condition of its coupled GARR node to be functional assumes that the value of $P_{i}$ should be greater than or equal to $\alpha P_{i}^{0}$ ($ 0 \le \alpha \le 1$). The coefficient $\alpha$ is termed as the strength of coupling between the two networks.

The authors then use the above coupling model to analyze and simulate the effect of random link failures in the power network for a fixed parameter of $\alpha$ (taken as $\alpha=0.75$). The main insight of their simulation is that even with small failure events in the power (HVIET) network (small with respect to number of transmission lines failed), the communication (GARR) network can get completely disconnected.

%Using the models for individual network and the coupling model, the Italian HVIET and GARR network is analyzed for random failure of links in the electric network and for a fixed parameter $\alpha$ (taken as $\alpha=0.75$). The main outcome of the simulation is that even with small failure events (small with respect to number of transmission lines failed) in electric network the GARR network can get disconnected completely.

The individualized modeling of the power and communication network done by Rostato et al. is realistic to a point, but the coupling model reflects only a one way dependency model and fails to represent the interdependency that exists between power and communication networks of today. This shortcoming may prohibit the accurate cascading failure scenarios when the faults originate from the communication network and cascade through to the power network.

%The individual modeling of the electric and communication network done by Rostato et al. is more realistic but the interdependency model lacks adequacy if it is assumed that failure in communication network also triggers failure in power network. In this respect a failure propagation model needs to be imbibed into the existing model.

\subsection{Nguyen et al. Interdependency Model}

In \cite{thai2013}, Nguyen et al. propose a cascading model in similar lines of \cite{buldyrev2010}, and address the problem for identifying the critical nodes in an interdependent network. In their model, the power network, and communication network are considered as graphs $G_{s}=(V_{s},E_{s})$ and $G_{c}=(V_{c},E_{c})$, and the interdependency is represented by an unidirectional edge set $E_{sc}$ that connect vertices from set $V_{s}$ with set $V_{c}$ in a composite graph containing this edge set, and both the power, and communication networks graphs. A failure due to a dependency relation is outlined by the assumption that, not only do the failed node(s) cease to operate, but also the nodes connected to the failed nodes via edges from the edge set $E_{sc}$ also become non-operational. Failures propagate in the following way: the failed nodes and the incident edges to these nodes that belong to $G_{s}$ (power network), and $G_{c}$ (communication network) are removed to generate $G'_{s}$ and $G'_{c}$ respectively. Then, the largest connected components $L_s$ and $L_c$ are computed for the graphs $G'_{s}$ and $G'_{c}$. Any node $n_s \in G'_{s}$ that does not belong to $L_s$, and any node $n_c \in G'_{c}$ that does not belong to $L_c$ are considered non-operational. Failures due to the dependency relations are simultaneously considered, and propagation ensues until a {\em steady state} is reached when no further nodes in either network can fail. An example showing this failure propagation is shown in Figure \ref{fig:fig2}.

%Nguyen et al. \cite{thai2013} used the cascading model in line of \cite{buldyrev2010} to find critical nodes in an interdependent network. The power network and communication network is considered as two connected graphs $G_{s}=(V_{s},E_{s})$ and $G_{c}=(V_{c},E_{c})$. The interdependency between the two networks is defined by an unidirectional edge set $E_{sc}$ connecting vertices from set $V_{s}$ with set $V_{c}$. For a failure of node(s) in the graph $G_{s}$ the interdependent node(s) of the the failed node in graph $G_{c}$ fails. The failure propagates with failure of nodes disconnected from largest connected component of the graph $G_{c}$l. This is impacted on the graph $G_{s}$ via the interdependency to cause failure of the interdependent nodes in $G_{s}$. The failure propagates until a steady state is reached i.e. there is no cascading failure in either network. An example showing the failure propagation is shown in Figure \ref{fig:fig2}.

\begin{figure}[h]
\label{triangle}
  \centering
    \includegraphics[width=0.75\linewidth]{figure3.jpg}
    \caption{Power Network consisting of nodes $p_{1}$,$p_{2}$,$p_{3}$,$p_{4}$ and Communication Network consisting of nodes $c_{1},c_{2},c_{3},c_{4}$. Blue and green edges represents intra links in power and communication network respectively and black edges represent the interdependency (interlinks). (a) The node $p_{3}$ is attacked. (b) The intra links of node $p_{3}$ are removed due to its failure along with its interdependent node $c_{3}$ in communication network and all its associated intra links. (c) The node $p_{1}$ fails as it is disconnected from the the largest connected component in the power network. The steady state is reached with nodes $p_{2}$ and $p_{4}$ in power network as functional nodes after the failure event.}
    \label{fig:fig2}
\end{figure}

Using the above defined failure propagation model, the authors consider the problem of identifying a set of critical nodes in the power network of size less than a positive integer $k$, such that at the steady state the size of the largest connected component in the power network is minimized. The authors show that this problem is NP-complete by reduction from the decision version of the Maximum Independent Set problem, and infer that this problem is in-approximable within a bound of $2-\epsilon$. Three greedy approximation algorithms are proposed by the authors for approximating the solution to this problem in polynomial time, namely, {\em Maximum Cascade} (Max-Cas),  {\em Iterative Interdependent Centrality} (IIC), and  {\em Hybrid}.
%The Max-Cas algorithm greedily selects a node that causes maximum damage to the interdependent network iteratively, until $k$ nodes are chosen. The IIC algorithm greedily selects a node that maximally reduces the structural strength (maximizes fragmentation) of the network at each iteration, until $k$ nodes are chosen. And finally, the Hybrid algorithm proceeds by executing selecting a node using Max-Cas for every odd node failure, and IIC for every even node failure, until $k$ nodes are chosen.

%The problem considers identifying set of critical nodes of size less than a positive integer $k$ in the power network such that after the cascading failure the size of the largest connected component in the power network is minimized. The problem is proved to be NP-complete by reduction from the decision version of Maximum Independent Set problem and is also proved to be in-approximable within a bound of $2-\epsilon$. Three greedy algorithms are provided for solving the problem in polynomial time --- \textbf{Maximum Cascade} (Max-Cas) algorithm that iteratively selects node that causes maximum damage to the interdependent network, \textbf{Iterative Interdependent Centrality} (IIC) algorithm that selects a node which reduces the structural strength of the network as much as possible and a \textbf{Hybrid} algorithm that runs Max-Cas for every odd node failure and IIC for every even node failure.

The authors perform an extensive simulation of the proposed algorithms using three different power network, and communication network data sets. The data sets considered were (i) US Western States power network, and a synthetic scale free communication network with an exponential factor, $\beta = 2.2$, (ii) Synthetic scale free power network with $\beta = 3.0$, and a synthetic scale free communication network with $\beta = 2.2$, and (ii) Scale free power and communication networks with the same $\beta = 2.6$. For each of the simulations the interdependency relationship between the two networks were setup using a random weighted permutation of nodes of the two networks.


%An extensive simulation study is performed for the given problem with the algorithms framed. Three different data sets for power network and communication network are considered for simulation that included synthetic network (scale free network with different exponential factor) and US Western States data \cite{watts1998} for power network and synthetic data  (scale free network with different exponential factor) for communication network. The coupling between the two network is done using random weighted permutation of nodes of the two networks.

In the simulations it was observed that the Hybrid algorithm takes lesser time and has better performance bounds than the other two algorithms. In the process of the simulations, it was observed that when interdependent systems are loosely connected they are more vulnerable to failure. Their observations also included that sparse interdependent networks are more vulnerable to cascading failures. This was observed from simulations carried out by varying the exponential factor of the scale free communication network, while keeping the exponential factor of the power network, and the total number of nodes constant. The simulations carried out by the authors by varying the total number of nodes of both the networks, while keeping a fixed exponential factor of the considered scale free networks, showed that large networks are more vulnerable to cascading failures.

%The Hybrid algorithm takes lesser time and has better performance (with respect to output of the problem defined) for different data sets used for simulation. In path of simulating for the number and identity of the critical nodes using the given algorithms it is concluded that interdependent systems are more vulnerable when they are loosely connected. Keeping the size (number of nodes) constant and varying the the exponential factor for a scale free communication network with power network unchanged shows that the interdependent network is more vulnerable when exponential factor of the scale free network is high. This shows that sparse interdependent networks are more vulnerable to cascading failure. Varying the total number of nodes in the power and communication network having scale free property with fixed exponential factor for each network shows that large network are more vulnerable to attacks.

The observable shortcomings of this model are similar to the drawbacks discussed above for the model proposed by Buldyrev et al. \cite{buldyrev2010}. Without the distinction of nodes in the networks into separate entities, such as power plants, and substations, for the power network, and cell towers, and routers for the communication network, the failure cascading model may not represent the workings of real world networks. Thus hindering the analysis, and mitigation of faults caused by cascading failures in multi-layer critical infrastructure networks.

%The model proposed by Nguyen et al. have same drawbacks as that of Buldyrev et al. model. They didn't signified the nodes in individual networks as separate entities which exists in real world power and communication network. Considering this would have enabled to take into account the effect of physical limitations of nodes in individual network for being a vulnerable node.

\subsection{Parandehgheibi et al. Interdependency Model}

Parandehgheibi et al. \cite{modiano2013} also consider the power and communication infrastructure networks to analyze the effect of cascading failures on these interdependent networks. In their model, the power network graph $P=(V_p, E_p)$ consist of vertices $V_p$ representing the generators, and substations, and edges $E_p$ representing the transmission lines. Similarly, the communication network graph $C=(V_c, E_c)$ consist of vertices $V_c$ representing the control centers, and routers, edges $E_c$ representing the communication lines. In the graphs, it is assumed that nodes represented by generators, and control centers, are {\em autonomous}, i.e. these nodes operate independently without any dependency on any other node across both the networks. In this model, dependency between network entities is represented by coupling the routers, and substations with edges $E$ (directed or undirected), in a composite graph of $G=(V, E, E_p, E_c), V=V_p \cup V_c$. Whether a node of this composite graph $G$ is operational or not is defined by the following functional rules: If the node represents a substation, it remains operational as long as, (i) there exists a path between the substation and a generator via the power network edges $E_p$, and (ii) there exists a path between the substation and a router (to receive control signals) via edges of $E$. If the node represents a router, it remains operational as long as, (i) there exists a path between the router and a control center via the communication network edges $E_c$, and (ii) there exists a path between the router and a substation (to receive power) via edges of $E$. Lastly, if the node represents a generator, or a control center, it remains continuously functional. At the time of the initial failure (due to a possible attack, or fault), the failed nodes, or edges are removed from the graph $G$. The failure propagation is then represented in the model by iteratively removing the failed nodes and all their incident edges from graph $G$ that do not satisfy the aforementioned functional rules. This propagation continues until a {\em steady state} is reached when no further removals of nodes, or edges are necessary. An example of the described failure propagation is illustrated in Figure \ref{fig:fig3}.

%Parandehgheibi et al.\cite{modiano2013} modeled the failure propagation between power and communication network with a restricted topology for each individual infrastructure. The power network is viewed as a graph consisting of generators and substations as vertices and transmission lines connecting between them as edges. Similarly the communication network is considered as a graph having control centers and routers as vertices and communication line connecting them as edges. It is assumed that the generators and control centers are autonomous i.e. they can operate independently without any dependency on communication and power network respectively. The routers and substations are coupled with edges (directed or undirected) denoting interdepndency. The failure propagation (cascading) model is framed by defining two properties of functionality for each substation in power network and each router in communication network. For a substation to operate it should have a path to a generator via the power network edges  and have atleast one interdepndent edge incident on it from a router in communication network to receive control signals. Similarly for a router to operate it should have a path to a control center via the communication lines and atleast one interdepndent edge incident on it from a substation to receive power. When there is a node or edge failure in an interdependent network, the failed nodes and its associated edges are removed. The substations and routers nodes that does not satisfy the functionality properties are deleted along with their associated edges. The failure cascades with removal of substations and routers and their associated edges in each step which doesn't satisfy the functionality property defined. An example of failure propagation using the model as in \cite{modiano2013} is illustrated in Figure \ref{fig:fig3}.

\begin{figure}[h]
\label{triangle}
  \centering
    \includegraphics[width=0.5\linewidth]{figure4.jpg}
    \caption{The power network consists of a generator $G$ and substations $s_{1},s_{2},s_{3}$ and communication network consists of control center $C$ and routers $r_{1},r_{2},r_{3}$. Blue edges denotes the power network edges (composed of transmission lines) and green edges denotes the communication network edges (composed of communication links). Black edges denotes the interdependency between substation of power network and routers in communication network. (a) The substation $s_{1}$ is attacked. (b) Failure of substation $s_{1}$ results in removal of all power network edges incident on $s_{1}$ and failure of interdependent router $r_{1}$ and removal of communication network edges incident on it. (c) Substations $s_{2}$, $s_{3}$ and routers $r_{2}$, $r_{3}$ fails and hence are removed as they do not satisfy both the properties for being being functional as mentioned. The edges incident on these substations and routers are subsequently removed. The resultant interdependent network after the failure consists of two autonomous nodes $G$ and $C$.}
    \label{fig:fig3}
\end{figure}

Keeping this failure model as their basis, the authors consider the problem of selection of the minimum number of non-autonomous nodes (substations, and routers), that need to be removed from the graph $G$, such that the resulting graph  generated at the steady state contains no non-autonomous nodes. The authors term this problem as the {\em Node-MTFR} (minimum total failure removal) problem. They also identify another similar problem {\em Edge-MTFR}, that concentrates on the selection of the minimum number of edges of $G$ such that the resulting graph generated at the steady state contains no non-autonomous node.

For solving these two problems the authors assume that the power network graph $P$, and the communication network graph $C$, are each star topology graphs. For the power network, the substations are directly connected to a generator without any connections between any other substations, i.e for all edges $(u,v) \in E_p$, node $u$ represents a substation, and node $v$ represents a generator. Similarly for the communication network the router are directly connected to a control center without any connections between any other routers, i.e for all edges $(u,v) \in E_c$, node $u$ represents a router node, and node $v$ represents a control center node. The authors now proceed to analyze the problem from the perspective of a bipartite graph, where the nodes in the bipartite graph comprise of the substations of the power network, and routers of the communication network (the nodes representing generators, and control centers are ignored). The edges of this bipartite graph is the set of dependency relations represented by edge set $E$, of graph $G$. The authors  analyze this problem from two interdependency perspectives, namely, unidirectional interdependency, and bi-directional interdependency.

%With the failure model defined, the problem considers the minimum number of non autonomous nodes that needs to be removed from the interdependent network such that the resulting network after failure propagation has no operating non autonomous node. The problem is termed as \textbf{Node-MTFR} (minimum total failure removal) problem. The same problem with respect to edge removal is termed as \textbf{Edge-MTFR} problem. For solving the problem it is assumed that the individual power network and communication network have star topology i.e. the substations are directly connected to a generator without any connection between them in powere network and the routers are directly connected to a control centers without any connection between them in communication network. With this assumption the failure of non autonomous nodes occurs only due to interdependency of routers and substations. For the defined problem and the underlying assumption, the interdependent network can be considered as a bipartite graph. The nodes in the bipartite graph are the substations in power network and routers in communication network respectively, with interdependency between the two set of nodes constituting the edges in the graph.

For unidirectional dependency, the Node-MTFR problem is shown to be NP-complete by reduction from the Feedback Vertex Set problem, and an optimal solution is proposed by an integer linear program (ILP). A greedy approximation algorithm is also proposed for this problem and its solution is compared with the optimal solution obtained from the ILP. The authors also prove that Edge-MTFR problem for unidirectional interdependency is NP-complete by reduction from  the Feedback Edge Set problem.

%The problem is addressed for two distinct type of interdependency between networks --- unidirectional interdependency and bi-directional interdependency. For the unidirectional dependency the Node-MTFR problem is proved to be NP complete by reduction from decision version of Feedback Vertex Set problem. The optimal solution is given by an integer linear program (ILP). A greedy approximation algorithm is also framed but instead of providing an approximation bound for the algorithm, a comparison of the optimal solution from the ILP with the solution given by the algorithm is done. The Edge-MTFR problem for unidirectional interdependency is also proved to be NP-complete by reduction from Feedback Edge Set problem.

For bidirectional interdependency, the authors show that the Node-MTFR problem corresponds to a minimum vertex cover problem for bipartite graphs, and using Konig's Theorem, show that this problem is equivalent to the maximum matching problem for bipartite graphs which has a known polynomial time solvable algorithm \cite{ahuja1993}. Thus showing that the Node-MTRFR problem for bidirectional interdependency is polynomially solvable. The authors also observe that for the Edge-MTFR problem with bidirectional interdependency all the edges of the bipartite graph must necessarily be removed, as any existing edge would denote the existence of operating non-autonomous nodes.

%For bidirectional interdependency the Node-MTRFR problem corresponds to minimum vertex cover in bipartite graphs. By Konig's Theorem, finding minimum vertex cover in bipartite is equivalent to maximum matching. Maximum matching is polynomially solvable for bipartite graphs \cite{ahuja1993}. This property is used to prove that the Node-MTFR problem for bidirectional interdependency is polynomial time solvable. For the Edge-MTFR problem all the edges are required to be removed as any existing edge would result in the presence of a router and substation denoting the existence of operating nodes.

For the purpose of experimentation and simulation, the authors use the Italian communication and power network data obtained from \cite{rosato2008}. To preserve the star topology configuration for the power and communication networks,  only substations directly connected to the generators, and routers directly connected to control centers are considered. Unidirectional dependency between the substations and routers is established by assuming that a substation receives  control signals from the nearest router, and a router receives power from the nearest substation. Using this setup the simulation is carried out to find the minimum number of nodes representing routers and substations that need to be removed, such that all non-autonomous nodes are removed from the graph (Node-MTFR). The experimental results showed that the north-western part of Italy is acutely vulnerable as removal of just three routers results in the failure of all substations and remaining routers.
%It was observed from these experiments that the north-western part of Italy is more vulnerable to blackouts as a complete blackout could be simulated just by the removal of three routers.

%The Italian communication and power network obtained from \cite{rosato2008} is considered for simulation. For power network only substations directly connected to the generators are considered and for communication network only the routers directly connected to control centers are considered to preserve the assumption of star topology. Unidirectional dependency between the substations and routers is established by assuming that a substation receives it control signal from nearest router and a router receive its power from nearest substation. Using this setup the simulation is done for finding the minimum number of node removals that causes complete blackout (i.e. the Node-MTFR problem) in Italy. It is found that Northwestern part of Italy is more vulnerable to node failure causing complete blackout with removal of only three routers.

%One noticeable drawback of the analysis of this model is that it is restrictive. By restricting that the power and communication networks be a star topology network, it may prevent accurate modeling, and analysis of cascading failures across real world power and communication networks that may not be configured in a star topology. Unless this restriction is addressed in the analysis, proper planning, and mitigation for cascading failures in real world networks seems likely to be prohibitive.

A possible drawback to this model is that this model is able to represent dependencies that are in disjunctive form, for example, a sub-station survives as long it has a connection to a router. However, if there is a need to model a conjunctive dependency among network entities this model may not be adequate, for example, a scenario where a sub-station survives only when it is connected to two routers. In the real world, it is highly likely that entities in either the power or communication network have such conjunctive dependency amongst other entities, which this model may not be able to adequately represent. Another possible shortcoming of this model is the number of types of power, and communication entities that this model considers. For instance, in a real world communication network there may be communication entities such as cell towers whose survivability may have to be modeled very differently than the way routers are modeled. In the proposed model if support for additional entities are included that have different functional rules, it is not clear how this model will be able to accommodate them.

%-- handles only disjunctive dependency, combinations of and's and or's
%-- no. of entities considered is restrictive

%The star topology assumed by Parandehgheibi et al. is a greater restriction to the problem. For Italian network considered, the construction rule used for constructing the individual network might render the solution to the problem to be invalid as set of nodes and edges not satisfying the star topology are removed.

\subsection{Castet et al. Interdependency Model}
In \cite{castet2013}, Castet et al. develop a model for survivability analysis of networks with heterogeneous nodes (nodes that can perform more than one function), and apply their approach to space-based networks. The authors propose that heterogeneous networks can be modeled as interdependent multi-layer networks, thus enabling survivability analysis of these networks. They assert that in this approach, the multi-layer aspect captures the common functionalities across the different nodes (by construction of homogeneous sub-networks), and the interdependency aspect captures the physical characteristics of each node in the network.

In this paper the authors focuses on space-based networks (SBNs). In SBNs, each network entity (space-craft), may perform more than one function. SBN's operate by physically distributing functions in multiple orbiting space-crafts that are wirelessly connected to each other. The SBNs architecture allows the sharing of resources on-orbit, such as data processing, data storage, and downlinks among the network entities. In this study, Castet et al. attempt to assess their proposed approach of modeling heterogeneous networks as interdependent multi-layer networks on SBNs, and benchmark the survivability of a fractionated SBN architecture, against that of a traditional monolith spacecraft.

To represent the heterogeneous SBN as a multi-layer interdependent network the authors define the following terms:
\begin{itemize}
	\item {\em Super-Node}: A network entity that supports multiple functionalities
	\item {\em Node}: Component of a super-node that represents a single functionality of that super-node
	\item {\em Layer}: Set of nodes with the same functionality
	\item {\em Intra-Layer Link}: A link between two nodes in the same layer. The link can be directed (when one node is providing a resource and the other is receiving), or undirected (both provide, and receive resources)
	\item {\em Networked Layer}: A network possessing intra-layer links
	\item {\em Inter-Layer Link}: A directed link that captures the inter-dependency between functionalities (nodes) within a super-node. Specifically, this link implies the (directed) propagation of failure from one node to the other.
\end{itemize}

In their model two types of inter-layer links are considered that represent the two types of failure propagation possible in the model: (i) Inter-links for the {\em kill effect} failure propagation, defined by the propagation rule as follows: When a node fails, all nodes that have an incoming inter-link of this type from the failed node immediately fail, and (ii) Inter-links for the {\em precursor effect} failure propagation, defined by a conditional propagation rule as follows: When a node fails, and all the nodes with incoming intra-links to this failed node have also failed, all entities that have an incoming inter-link of this type from the failed node fails. This type of inter-link implicitly implies that as long as a super-node has access to a particular functionality, either from its own resources or from another super-node, all nodes in the super-node dependent on this functionality survive.

Figure \ref{fig:figure4} demonstrates the propagation rules and represents a sample SBN as an interdependent multi-layer network $N$ defined by $N(G_{1},..., G_{L},E_{k},E_{p})$, where:
\[
\begin{cases}
L & is\: the\: number\: of\: layers\: each\: numbered\: sequentially\: from\:1\: to\: L\\
 & G_{1},....,G_{L}\: are\: the\: graphs\: on\: each\: layer:\\
 & \quad\forall l\in[1,...,L],G_{l}=(V_{l},E_{l})\: with:\\
 & \qquad\qquad\begin{cases}
V_{l} & is\: the\: set\: of\: n_{l}\: nodes\: in\: G_{l}\\
E_{l} & is\: the\: set\: of\: intra-layer\: links\: in\: G_{l}
\end{cases}\\
E_{k} & is\: the\: set\: of\: inter-layer\: links\: representing\: the\:"kill\: effect"\\
E_{p} & is\: the\: set\: of\: inter-layer\: links\: representing\: the\:"precursor\: effect"
\end{cases}
\]

To analyze the survivability of an interdependent multi-layer network using the above network representation, and propagation rules, the authors carry out the following steps: (i) Generate the time to failure for each node and intra-layer link, (ii) propagate failures through inter-layer links for the kill effect, (iii) propagate failures through inter-layer links for the precursor effect, and (iv) combine all failure propagation effects to obtain the probability of failure of each node. Random times to failure for the nodes were generated using cumulative distribution functions representing the failure behavior of each node. Since links between two space-crafts (super-nodes) is established through a wireless unit, a two step process was followed for generating the times to failure for the intra-layer links: (i) times to failure of the wireless units on each spacecraft was generated using predetermined cumulative distribution functions, (ii) times to failures for each intra-layer link was generated by taking the minimum of the time to failures of the two associated wireless units.



%Space based networks are considered in the interdependency model proposed by Castet et al. in \cite{castet2013}. The authors consider two different failure propagation models for space based networks, and analyze the mean time to failure for individual nodes in the networks based on their proposed failure propagation models.

%Space based networks are heterogeneous networks and are modeled as multilayer networks by Castet et al. in \cite{castet2013}. Two different failure propagation models for space based networks are analyzed by the authors, and a failure propagation model based analysis of mean time to failure for individual nodes in the network are presented.

%Space based networks are heterogeneous networks and is modeled as a multilayer network by Castet et al. \cite{castet2013}. Two different failure propagation in space based networks are analyzed in \cite{castet2013} with an analysis of mean time to failure for individual nodes in the network based on the failure propagation models.

%The proposed failure propagation models operate on a space based network modeled as a graph $G=(G_{1},..., G_{L},E_{k},E_{p})$. Separate network layers are considered where each layer $i$, ($1 \le i \le L$) is represented by a graph $G_{i}$ comprised of nodes that offer similar type of functionality, and of directed or undirected edges (intra layer links) and nodes with same kind of functionality.

%The space based network is modeled as a graph $G=(G_{1},..., G_{L},E_{k},E_{p})$. The network consists of $L$ layers and each layer $i$, ($1 \le i \le L$), depending on the layer properties chosen, is represented by a graph $G_{i}$ consisting of directed or undirected edges (intra layer links), and nodes that have similar functionality. Note that the construction of the layer level graphs are completely dependent on the physical properties of the layer and is subject to the considerations of the designer.

%Two different types of dependency among nodes from different layers are represented by the edge sets $E_{k}$ and $E_{p}$ (inter layer links). The edge set $E_{k}$ consists of directed edges where, for an edge $(u,v) \in E_{k}$, when node $u$ gets killed then node $v$ also gets killed immediately. The authors term this type of failure propagation as the {\em kill effect}, where the failure of a node directly impacts another node(s) in a different layer. The edge set $E_{p}$ consists only of directed edges where, for an edge $(u,v) \in E_{p}$ the failure of the node $u$ doesn't immediately kill the node $v$, and instead the survival of node $v$ depends on the failure of nodes on which node $u$ depends. The authors term this type of failure propagation as the {\em precursor effect}. When both the failure propagation models are considered simultaneously, failure of nodes or edges (intra links, or inter links), in a specific layer propagates via the kill and precursor effect until the whole interdependent network reaches a {\em steady state} when no further failures are possible. A sample failure scenario, and its subsequent cascade using both the types of propagation is shown in Figure \ref{fig:figure4} for an arbitrary multi-layered network.

%The space based network is modeled as a graph $G=(G_{1},..., G_{L},E_{k},E_{p})$. The network consists of $L$ layers and each layer $i$ ($1 \le i \le L$) is represented by a graph $G_{i}$ consisting of directed or undirected edges (intra layer links) and nodes with same kind of functionality. Two different dependency of nodes in different layers are represented by the edge sets $E_{k}$ and $E_{p}$. The edge set $E_{k}$ consists of directed edges which are inter layer links. For an edge $(u,v) \in E_{k}$ when node $u$ gets killed then node $v$ also gets killed immediately. This kind of failure propagation is termed as the \textbf{kill effect} where the failure of a node directly impacts another node(s) in a different layer. The edge set $E_{p}$ consists only of directed edges which are inter layer links. For an edge $(u,v) \in E_{p}$ the failure of the node $u$ doesn't immediately kills the node $v$ instead the fate of node $v$ depends on failure of nodes on which $u$ depends. This kind of failure propagation is termed as \textbf{precursor effect}. On failure of a node(s) or edge(s) (intra link(s) or inter link(s)) in a specific layer the failure propagates via the kill and precursor effect till the whole interdependent network reaches a steady state. The failure propagation is shown in Figure \ref{fig:figure4} for an arbitrary multi-layered network.

\begin{figure}[h]
\label{triangle}
  \centering
    \includegraphics[width=0.55\linewidth]{figure5.jpg}
    \caption{Interdependent space based network consisting of three layers represented by graphs $G_{1}=(\{1,2\},\{(1,2),(2,1)\})$, $G_{2}=(\{3,4\},\emptyset )$, $G_{2}=(\{5\},\emptyset )$. Edge set $E_{k}=\{(3,1),(3,5),(4,2)\}$ and edge set $E_{p}=\{(1,3),(1,5),(2,4)\}$. If node $3$ fails, nodes $1$ and $5$ immediately fail ({\em kill effect}). If node $1$ fails then nodes $3$ and $5$ don't fail unless node $2$ also fails ({\em precursor effect}).}
    \label{fig:figure4}
\end{figure}

For simulation and study, the authors apply their model into three different SBN scenarios. In their first scenario they consider three different space network architectures. The first architecture considered consists of a traditional monolith spacecraft with three subsystems (or layers), namely, \textit{Telemetry Tracking and Command} (TTC), \textit{supporting subsystems}, and \textit{payload}. The second architecture consists of two space based networks, one of them a traditional monolith spacecraft, while the other spacecraft consists of two subsystems --- \textit{TTC} and \textit{supporting subsystems}. The two spacecrafts shares their TTC subsystems, i.e. a TTC redundancy is introduced, through a wireless link. This architecture is shown in Figure \ref{fig:figure4} with layer $1$,$2$ and $3$ denoting subsystems TTC, supporting subsystems, and payload respectively. A third architecture is considered which is comprised of the monolith spacecraft, and two spacecrafts having two subsystems --- \textit{TTC} and \textit{supporting subsystems}. These three spacecrafts share there TTC subsystems, i.e. there is a higher degree of TTC redundancy, through wireless links. Wireless links in the second and third spacecraft architecture are assumed to be perfect. The distribution of probability of unavailability (failure) of TTC subsystem with time, identified as a major spacecraft unreliability factor in \cite{castet3}, is obtained from \cite{castet2}. The probability of unavailability of the payload subsystem over time, for the three spacecrafts is computed considering the failure of the TTC subsystem using a Monte Carlo Simulation. The simulation results showed that for a given time, increasing the redundancy of the TTC subsystems reduces the probability of unavailability of the payload. However, it was observed that the percentage of this reduction is not linear with the redundancy introduced.

%For example, after $15$ years, the second architecture has a probability of unavailability reduction by $1.8 \%$ when compared to the first architecture with the third architecture having a reduction of $2.1 \%$. They concluded from this study that though TTC redundancy reduces the probability of unavailability yet a trade off analysis of the cost of introducing this redundancy with the gain due to this reduction is required. This analysis could highlight the benefits of TTC redundancy in space based networks.

The second scenario was aimed to study the impact of wireless link failure. A Weibull distribution is considered for probability of unavailability of wireless link failure with time. The parameters of Weibull distribution are set such that the wireless link has a probability of $0.5$ to fail after 15 years. Simulations were carried out to compute the probability of unavailability of payload for the second architecture of the first application with the given wireless link failure distribution. The result is compared with the first and second architecture with perfect wireless link (the previous scenario). Compared with the first scenario, it was observed that for the second architecture the probability of unavailability of payload increases with time when wireless link failure is considered. At a given point in time, it surpasses the probability of unavailability of monolith spacecraft thus negating the effect of a TTC redundancy. The conclusion that can be drawn from these observations are that failure behavior of wireless links is a critical consideration to analyze the advantage of space based networks with TTC redundancy, over adoption of traditional monolith space crafts.

In the third scenario the authors consider a more complex space based network by including two new subsystems into the traditional monolith spacecraft. The new subsystems included are a Control Processor (CP) subsystem (the main computer of the spacecraft), and a Data Handling (DH) subsystem (handling exchange and storage of data). Another space craft is considered with all the subsystems as stated except the payload. These two spacecrafts share DH, TTC and CP subsystems, thus introducing redundancy. The resources are shared via wireless links. Hence the space based network represented by this architecture has 5 layers with 3 networked layer. The distribution of probability of unavailability of these subsystems with time is obtained from \cite{castet2}. Assuming perfect wireless link, a Monte Carlo simulation is carried out to compute the probability of unavailability of payload with time. The simulation result is compared with traditional monolith spacecraft, and the second spacecraft architecture's (from the first scenario) payload failure distribution. It is observed that after 15 years this architecture reduces the risk of failure by $20.5 \%$ over the monolith spacecraft. This makes way to draw a conclusion that this architecture has greater improvement in reduction of failure over monolith spacecraft, than by only introducing TTC redundancy (as considered in first scenario).

% ARUN The authors carry out an analysis for mean time to failure for different nodes in the interdependent network by considering the failure propagation model described above. Random time to failure for individual nodes are calculated independently using cumulative distribution function. The mean time to failure for each node is then recalculated considering the kill and precursor effects. For example if the mean time to failure of a node $u$ is $t_{u}$ and mean time to failure of a node $v$ is $t_{v}$ and $(u,v) \in E_{k}$ with $t_{v} \ge t_{u}$ then the probability that node $v$ will fail at time $t_{u}$ is greater than when it will fail at time $t_{v}$ due to the kill effect. The authors conduct different case studies for networks with node redundancy, link failures etc. and present the mean time to failure and the probability of availability of a component (node) in space based networks.

%An analysis for mean time to failure for different nodes in the interdependent network is done by considering the failure propagation model described. Random time to failure for individual nodes are calculated independently using cumulative distribution function. Considering kill and precursor effect the mean time to failure for each nodes are recalculated. For example if the mean time to failure of a node $u$ is $t_{u}$ and mean time to failure of a node $v$ is $t_{v}$ and $(u,v) \in E_{k}$ with $t_{v} \ge t_{u}$ then the probability that node $v$ will fail at time $t_{u}$ is greater than it will fail at time $t_{v}$ due to kill effect. Different case studies for networks having node redundancy, link failures etc. is done for calculating the mean time to failure and probability of availability of a component (node) in space based networks.

%A possible shortcoming of this model is that, congestion of links in case of excess data flows are not considered. In a node failure scenario, wireless links across super-nodes may become heavily congested to compensate for the failed node, however, due to possible physical limitations of these links, they may not be able to carry the required load and thus may trigger new failure events.

%A possible shortcoming of this model is that, congestion of links in case of excess data flows are not considered. In a node failure scenario, wireless links across super-nodes may become heavily congested and thus may trigger new failure events.

%The interdependent model and failure propagation of Castet et al. \cite{castet2013} considered entities specific to space based network and the interdependency demonstrated is validated with interdependency that originally exists. Congestion of links in case of excess data flow (physical limitations) due to a failure event which might trigger a new failure is not considered which could make the model more concrete.

%\section{Open Issues}
%In \cite{chen2012}, communication system (SCADA system) and power system test base were made for a case study to experiment the effect of cyberintrusion in communication network on power network. The actual series of events that occur in the power network when a communication system entity malfunctions (due to cyber intrusion) is described. Their case studies signify the importance of considering the realistic interaction between interdependent infrastructures in modeling critical infrastructure interdependency. In \cite{peeta1}, in solving network flow dynamics in multilayer networks different kind of interdependency between networks were considered. This included physical, functional, budgetary, market, information and environmental interdependencies. Depending upon the nature of failure in an infrastructure, different type of interdependency might have to be considered to characterize the coupling of interdependent systems.
%
%The above discussion shows that most of the interdependency models discussed in Section 2 eludes the physical limitations and realistic coupling of the networks considered. For example, in \cite{thai2013} the largest connected component in power network formed after the cascading failure is claimed to be stable and no further failure takes place. Taking into account the DC power flow model considered in \cite{rosato2008} the new power flow in the power network might effect the communication network (due to reduction of power by load re-dispatching available in the load nodes) triggering failure. Realistic cascading model is required that takes into account the physical limitations of entities in the interdependent networks in the modeling.
%
%Modeling the coupling of interdependent networks is limited by the understanding of realistic interaction between critical infrastructures in real world. Considering unvalidated coupling scheme for finding vulnerable nodes in interdependent networks causes identification of critical nodes which might not well be critical in reality. Taking into account the criticality different interdependent infrastructure poses this can be disastrous.
%
%\section{Possible Solution to Existing Issues}
%
%An ongoing work by Dr. Arunabha Sen at Arizona State University is focusing on identifying critical entities in interdependent network with predefined dependency between the entities. For two networks the entities present in them are distinguished. For example, in power network a set of entities can be composed of generators, loads, transmission lines and junction points (or substations). For a network $A$ with $n$ entities, there can be be more than one node of one type of entity (for example, generator is a type of entity but there can be more than one generator in a power network). The set of nodes for the network $A$ can be labeled as $\{(a_{11},a_{12},...,a_{1,\alpha_{1}}),(a_{21},a_{22},...,a_{2,\alpha_{2}}),...,(a_{n1},a_{n2},...,a_{1,\alpha_{n}})\}$, where $\alpha_{i}$ denotes the number of nodes of entity type $i$. For two interdependent networks $A$ and $B$, the survivability of each individual node can be represented as a function comprising of conjunction and disjunction of nodes in the other network. For example, the survivability of a node $a_{11}$ in network $A$ depends upon the survivability of nodes $b_{12}$ and $b_{21}$ or the survivability of node $b_{33}$ in network $B$, then $a_{11} \leftarrow b_{12}b_{21}+b_{33}$. This representation denotes that if $a_{11}$ is alive then either $b_{33}$ is alive or both of $b_{12}$ and $b_{21}$ are alive. This set of equations are termed as \textit{life equation}.
%
%Based on the set of life equations an initial failure of node(s) in network $A$  might trigger failure of nodes in network $B$ which might again trigger failure of nodes in network $A$ following a cascade of failures. This is demonstrated in Figure \ref{fig:fig6}. The problem is then addressed as follows --- given the set of life equations for all nodes in both the networks by a predefined model of generating these equations, the problem is to find $k$ nodes from either networks which when killed would minimize the total number of alive nodes in the networks after the cascading failure. The problem is proved to be NP-complete by reduction from the Maximum Clique problem and an integer linear program has been formulated for finding the optimal solution.
%
%
%\begin{figure}[h]
%\label{triangle}
%  \centering
%    \includegraphics[width=0.75\linewidth]{cascadeEffect.jpg}
%    \caption{Failure of nodes in network $A$ triggers failure of node in network $B$ which in turn triggers failure of new nodes in network $A$ and the failure cascades. The same cascading steps occurs for failure of nodes in network $B$. After $p$ steps the cascading stops (reaches a steady state) with an initial trigger of failure of nodes in network $A$ and network $B$.}
%    \label{fig:fig6}
%\end{figure}
%
%The \textit{life equations} considered in this model is implicative and when derived from validated interdependency in interdependent infrastructures gives appropriate identification of critical nodes in these infrastructures. This work is currently ongoing and is expected to be reported in near future.
%
%\section{Conclusion}
%
%Understanding and modeling interdependency in infrastructures is critical for identification of vulnerable portions of an infrastructure and consequences of a failure event. Various interdependency models have been proposed for identification of critical sections in these interdependent network. But these models eludes the physical limitations of the infrastructures and assumes unvalidated or restricted coupling between them. Identifying critical sections of the interdependent systems using these models might have incorrect implications. This calls for realistic assumptions and coupling schemes in designing models for catching critical infrastructure interdependency which opens a challenging prospect for research in this domain.

\section{Limitations of Current Modeling Approaches and Possible Solutions}

As discussed in the previous section, significant efforts have been made in the research community in the last few years to develop an appropriate model of interdependency between the entities of a multi-layer critical infrastructure network \cite{buldyrev2010, buldyrev2011a, buldyrev2011b, rosato2008, peeta1, castet2013, modiano2013, chen2012, thai2013,Sen091,Zus11}. Unfortunately, many of the proposed models are overly simplistic in nature and as such they fail to capture the complex interdependency that exists between power grid and communication networks. As noted in section 2.1, the highly cited paper due to Buldyrev et al. \cite{buldyrev2010}, assume that every node in one network can depend on one and only one node of the other network. Obviously, this assumption is not valid in an interdependent power-communication network that spans countries and continents,  Even the authors in a follow up paper \cite{buldyrev2011b} recognize that the assumption may not be valid in the real world and a single node in one network may depend on more than one node in the other network and vice-versa. A node in one network may be functional (``alive'') as long as one supporting node on the other network is functional.

Although this generalization can account for {\em disjunctive dependency} of a node in the $A$ network (say $a_i$) on more than one node in the $B$ network (say, $b_j$ and $b_k$), implying that $a_i$ may be ``alive'' as long as either $b_i$ or $b_j$ is alive, it cannot account for {\em conjunctive dependency} of the form when {\em both $b_j$ and $b_k$} has to be alive in order for $a_i$ to be alive. In a real network the dependency is likely to be even more complex involving both disjunctive and conjunctive components. For example, $a_i$ may be alive if (i) $b_j$ {\em and} $b_k$ {\em and} $b_l$ are alive, {\em or} (ii) $b_m$ {\em and} $b_n$ are alive, {\em or} (iii) $b_p$ is alive. The graph based interdependency models proposed in the literature \cite{buldyrev2011a, rosato2008, peeta1, castet2013, modiano2013, thai2013} including \cite{buldyrev2010, buldyrev2011b} cannot capture such complex interdependency between entities of multi-layer networks. In order to capture such complex interdependency, we propose recently a new model of interdependency using Boolean logic \cite{Sen14}. In the following, we briefly describe this model.

We outline the model for an interdependent network with two layers. However, the concept can easily be generalized to deal with networks with more layers. Suppose that the network entities in layer 1 are referred to as the $A$ type entities, $A = \{a_1, \ldots, a_n\}$ and entities in layer 2 are referred to as the $B$ type entities, $B = \{b_1, \ldots, b_m\}$. If the layer 1 entity $a_i$ is {\em operational} if (i) the layer 2 entities $b_j, b_k, b_l$ are operational, or (ii) $b_m, b_n$ are operational, or (iii) $b_p$ is operational, we express it in terms of {\em Live Equations} of the form $a_i \leftarrow b_jb_kb_l + b_mb_n + b_p$.  The Live Equation for a $B$ type entity $b_r$ can be expressed in a similar fashion in terms of $A$ type entities. If $b_r$ is {\em operational} if (i) the layer 1 entities $a_s, a_t, a_u, a_v$ are operational, or (ii) $a_w, a_z$ are operational, we express it in terms of {\em Live Equations} of the form $b_r \leftarrow a_sa_ta_ua_v + a_wa_z$. It may be noted that the {\em live equations} only provide a {\em necessary condition} for entities such as $a_i$ or $b_r$ to be {\em operational}. In other words, $a_i$ or $b_r$ may {\em fail} independently and may be {\em not operational} even when the conditions given by the corresponding {\em live equations} are {\em satisfied}.
A live equation in general will have the following form: \[ x_i \leftarrow \sum_{j = 1}^{T_i}\prod_{k = 1}^{t_j} y_{j, k}\] where $x_i$ and $y_{j, k}$ are elements of the set $A$ ($B$) and $B$ ($A$) respectively, $T_i$ represents the {\em number} of min-terms in the live equation and $t_j$ refers to the {\em size} of the $j$-th min-term (the size of a min-term is equal to the number of $A$ or $B$ elements in that min-term). In the example $a_i \leftarrow b_jb_kb_l + b_mb_n + b_p$, $T_i = 3$, $t_1= 3, t_2 = 2, t_3 = 1$, $x_i = a_i$, $y_{2, 1} = b_m$, $y_{2, 2} = b_p$.

\begin{table*}[h]
\begin{center}
\begin{tabular}{|c||c|}  \hline
{\bf Power Network} & {\bf Communication Network} \\ \hline
$a_1\leftarrow b_1 + b_2$ & $b_1 \leftarrow a_1 + a_2a_3$ \\ \hline
$a_2 \leftarrow  b_1b_3 + b_2$ & $b_2 \leftarrow a_1 + a_3$ \\ \hline
$a_3 \leftarrow b_1b_2b_3$ & $b_3 \leftarrow a_1a_2$ \\ \hline
$a_4 \leftarrow b_1 + b_2 + b_3$ & $--$ \\ \hline
\end{tabular}
%\vspace{0.02in}
\caption{Life Equations for a Multi-layer Network}
\protect\label{eqTbl}
\end{center}
\end{table*}
\vspace{-0.3in}
\begin{table*}[h]
\begin{center}
\begin{tabular}{|c|c|c|c|c|c|c|c|}  \hline
\multicolumn{1}{|c|}{Entities} & \multicolumn{7}{c|}{Time Steps}\\
\cline{2-8} & $t_0$ & $t_1$ & $t_2$ & $t_3$ & $t_4$ & $t_5$ & $t_6$ \\\hline \hline
$a_1$ & $1$ & $1$ & $1$ & $1$ & $1$ & $1$ & $1$ \\ \hline
$a_2$ & $0$ & $0$ & $0$ & $0$ & $1$ & $1$ & $1$ \\ \hline
$a_3$ & $0$ & $0$ & $1$ & $1$ & $1$ & $1$ & $1$ \\ \hline
$a_4$ & $0$ & $0$ & $0$ & $0$ & $1$ & $1$ & $1$ \\ \hline
$b_1$ & $0$ & $0$ & $0$ & $1$ & $1$ & $1$ & $1$ \\ \hline
$b_2$ & $0$ & $0$ & $0$ & $1$ & $1$ & $1$ & $1$ \\ \hline
$b_3$ & $0$ & $1$ & $1$ & $1$ & $1$ & $1$ & $1$ \\ \hline
%{\em Optimal} & $a_0$ & $a_1$ &  $\cdots$ & $\cdots$ &  $a_k$ \\ \hline
%{\em Greedy } & $b_0$ & $b_1$ & $\cdots$ & $\cdots$ &  $b_k$ \\ \hline
\end{tabular}
%\vspace{0.02in}
\caption{Time Stepped Cascade Effect for a Multi-layer Network}
\protect\label{cascadeTbl}
\end{center}
\end{table*}
\vspace{-0.2in}
We refer to the live equations of the form $a_i \leftarrow b_jb_kb_l + b_mb_n + b_p$ as {\em First Order Dependency Relations} also, because these relations express direct dependency of the $A$ type entities on $B$ type entities and vice-versa. It may be noted however that as $A$ type entities are dependent on $B$ type entities, which in turn depends on $A$ type entities, failure of some $A$ type entities can trigger failure of other $A$ type entities, though {\em indirectly} through some $B$ type entities. Such interdependency creates a {\em cascade of failures} in multi-layered networks when only a few entities of either $A$ type or $B$ type (or a combination) fails. We illustrate this with the help of an example. The live equations for this example is shown in Table \ref{eqTbl}.

\begin{figure*}[ht]
  \subfigure[Cascading failures reach steady state after $p$ time steps]{\label{fig:cascade}\includegraphics[width=0.45\textwidth, keepaspectratio]{cascadeEffect.eps}}
  \subfigure[Cascading failures as a fixed point system]{\label{fig:fixedPoint}\includegraphics[width=0.45\textwidth, keepaspectratio]{fixedPoint.eps}}
  \caption{Cascading Failures in Multi-layered Networks}  \label{fig:cascadeFixedPoint}
\end{figure*}


As shown in Table \ref{cascadeTbl}, in this example the failure of only one entity $a_1$ at time step $t_0$ triggered a chain of failures that resulted in the failure of all the entities of the network after by timestep $t_4$. A table entry of 1 indicates that the entity is ``dead''. In this example, the failure of $a_1$ at $t_0$ triggered the failure of $b_3$ at $t_1$, which in turn triggered the failure of $a_3$ at $t_2$. The failure of $b_3$ at $t_1$ was due to the dependency relation $b_3 \leftarrow a_1a_2$ and the failure of $a_3$ at $t_2$ was due to the dependency relation $a_3 \leftarrow b_1b_2b_3$. The cascading failure process initiated by failure (or death) of a subset of $A$ type entities at timestep $t = 0$, $A_{d}^0$ and a subset of $B$ type entities $B_{d}^{0}$ till it reaches its final steady state is shown diagrammatically in Figure \ref{fig:cascade}. Accordingly, a multi-layered network can be viewed as a ``closed loop'' control system as shown in Figure \ref{fig:fixedPoint}. Finding the steady state after an initial failure in this case is equivalent of computing the {\em fixed point} of a function $F(.)$ such that $F (A_{d}^p \cup B_{d}^p) = A_{d}^p \cup B_{d}^p$, where $p$ represents the number of steps when the system reaches the steady state.

We define a set of $k$ entities in a multi-layered network as “most vulnerable” if failure of these $k$ entities triggers the failure of the largest number of other entities. The goal of the $k$ most vulnerable nodes in multi-layered network problem is to identify this set of nodes. This is equivalent to identifying $A_{d}^0 \subseteq A$, $B_{d}^0 \subseteq B$, that {\em maximizes} $|A_{d}^p \cup B_{d}^p|$, subject to the constraint that $|A_{d}^0 \cup B_{d}^0| = k$.

The dependency relations (live equations) can be formed either after careful analysis of the multi-layer network along the lines carried out in \cite{Zus11}, or after consultation with the engineers of the local utility and internet service providers.

Utilizing this comprehensive model, we provide techniques to identify the $k$ most vulnerable nodes of an interdependent multi-layered network system in \cite{Sen14}, so that preventive measures can be taken to strengthen the network. We show that the this problem can be solved in polynomial time for some special cases, whereas for some others, the problem is NP-complete. We also show that this problem is equivalent to computation of a {\em fixed point} \cite{Fud2010} of a {\em closed loop system} and we provide a technique utilizing Integer Linear Programming to compute that fixed point. Finally, we present the efficacy of our technique using real data collected from power grid and communication networks that span the Maricopa county of Arizona in \cite{Sen14}. 

\section{Conclusion}

In order to build a robust and resilient system, a deep understanding of the complex interdependency that exists between critical infrastructures such as the power grid and the communication network is essential. Unfortunately, many of the proposed models are unable to capture such complex interdependency. In our opinion, the model proposed in \cite{Sen14} is a step in the right direction. However many problems, including the problem of model validation, still remain open. These problems will most likely draw the attention of the researchers in this domain for many years to come.

%Understanding and modeling interdependency in infrastructures is critical for identification of vulnerable portions of an infrastructure and consequences of a failure event. Various interdependency models have been proposed for identification of critical sections in these interdependent network. But these models eludes the physical limitations of the infrastructures and assumes unvalidated or restricted coupling between them. Identifying critical sections of the interdependent systems using these models might have incorrect implications. This calls for realistic assumptions and coupling schemes in designing models for catching critical infrastructure interdependency which opens a challenging prospect for research in this domain.

\vspace{-0.2in}
\begin{thebibliography}{10}
%\bibitem{italy2003}
 % \emph{UCTE Final Report of the Investigation Committee on the 28 September 2003 Blackout in Italy.}

%\bibitem{usa2003}
  %\emph{Interim Report: Causes of the August 14th Blackout in the United States and Canada}

%\bibitem{india2012}
  %\emph{Report of the Enquiry Committee on Grid Disturbance in Northern Region on 30th July 2012 and in Northern, Eastern  and North-Eastern Regions on 31st July 2012.}

\bibitem{rinaldi2001}
Rinaldi, Steven M., James P. Peerenboom, and Terrence K. Kelly.
\emph{Identifying, understanding, and analyzing critical infrastructure interdependencies.}
 Control Systems,
IEEE,
 21.6,
11-25,
2001.

\bibitem{vespi2010}
Vespignani, Alessandro.
\emph{Complex networks: The fragility of interdependency}
Nature,
464.7291,
984-985,
2010.

\bibitem{buldyrev2010}
Buldyrev, Sergey V., et al.
 \emph{Catastrophic cascade of failures in interdependent networks.}
Nature 464.7291,
1025-1028,
2010.

\bibitem{buldyrev2011a}
Shao, Jia, et al.
 \emph{Cascade of failures in coupled network systems with multiple support-dependence relations}
Physical Review E 83.3,
2011.

\bibitem{buldyrev2011b}
Gao, Jianxi, et al.
 \emph{Networks formed from interdependent networks}
Nature Physics 8.1,
40-48,
2011.

\bibitem{peeta1}
Zhang, Pengcheng, Srinivas Peeta, and Terry Friesz.
 \emph{Dynamic game theoretic model of multi-layer infrastructure networks.}
Networks and Spatial Economics 5.2,
147-178,
2005.

\bibitem{rosato2008}
Rosato, Vittorio, et al.
  \emph{Modelling interdependent infrastructures using interacting dynamical models.}
International Journal of Critical Infrastructures 4.1,
63-79,
2008.

\bibitem{thai2013}
Nguyen, Dung T., Yilin Shen, and My T. Thai.
 \emph{ Detecting Critical Nodes in Interdependent Power Networks for Vulnerability Assessment.}
IEEE Trans. on Smart Grid,
4.1,
1-9,
2013.

\bibitem{modiano2013}
Parandehgheibi, Marzieh, and Eytan Modiano.
 \emph{ Robustness of Interdependent Networks: The case of communication networks and the power grid.}
GlobeCom (to appear),
2013.

\bibitem{castet2013}
Castet, Jean-Francois, and Joseph H. Saleh.
 \emph{Interdependent Multi-Layer Networks: Modeling and Survivability Analysis with Applications to Space-Based Networks.}
PloS one 8.4,
2013.

\bibitem{chen2012}
Liu, Chen-Ching, et al.
 \emph{Intruders in the Grid.}
Power and Energy Magazine,
IEEE,
10.1 58-66,
2012.

\bibitem{wood2012}
Wood, Allen J., and Bruce F. Wollenberg.
\emph{Power generation, operation, and control.}
John Wiley \& Sons,
2012.

\bibitem{echenique2004}
Echenique, Pablo, Jesús Gómez-Gardeñes, and Yamir Moreno.
 \emph{Improved routing strategies for Internet traffic delivery.}
Physical Review E,
 70.5,
2004.

\bibitem{ahuja1993}
Ahuja, Ravindra K., Thomas L. Magnanti, and James B. Orlin.
 \emph{Network flows: theory, algorithms, and applications.}
1993.

\bibitem{erdos1959}
Erdos P., and A. R\& WI.
 \emph{On random graphs I.}
Publ. Math. Debrecen 6,
290-297'
1959.

\bibitem{gil2012}
Bernstein, Andrey, et al..
 \emph{Power grid vulnerability to geographically correlated failures-analysis and control implications.}
arXiv:1206.1099,
2012.

\bibitem{watts1998}
Watts, Duncan J., and Steven H. Strogatz.
 \emph{Collective dynamics of ‘small-world’networks.}
nature 393.6684,
440-442,
1998.

\bibitem{castet2}
Castet, Jean-François.
 \emph{Reliability, multi-state failures and survivability of spacecraft and space-based networks.},
2012.

\bibitem{castet3}
Saleh, Joseph Homer.
 \emph{Spacecraft reliability and multi-state failures: a statistical approach.},
Wiley. com,
2011.

\bibitem{Sen14}
Sen, A. and Mazumder, A. and Banerjee, J. and Das, A. and Compton, R.
 \emph{Identification of k most vulnerable nodes in multi-layered network using a new model of interdependency},
To be presented in the International Workshop on Network Science for Communication Networks (INFOCOM workshop),
IEEE,
2014.

\bibitem{Zus11}
Bernstein, Andrey and Bienstock, Daniel and Hay, David and Uzunoglu, Meric and Zussman, Gil.
 \emph{Power grid vulnerability to geographically correlated failures-analysis and control implications},
arXiv preprint arXiv:1206.1099,
2012.

\bibitem{Fud2010}
Fudenberg, A. and Tirole, J..
 \emph{Game Theory},
Ane Books,
2010.

\bibitem{Sen091}
Sen, Arunabha, Pavel Ghosh, Vijay Vittal, and Bo Yang.
 \emph{A new min‐cut problem with application to electric power network partitioning.},
European Transactions on Electrical Power 19(6):778-797,
2009.
Sen091


\end{thebibliography}
\end{document}

1702.05407.extracted_bib
{italy2003 % UCTE Final Report of the Investigation Committee on the 28 September 2003 Blackout in Italy. %
1702.05407.extracted_bib
{usa2003 %Interim Report: Causes of the August 14th Blackout in the United States and Canada %
1702.05407.extracted_bib
{india2012 %Report of the Enquiry Committee on Grid Disturbance in Northern Region on 30th July 2012 and in Northern, Eastern and North-Eastern Regions on 31st July 2012.
1702.05407.extracted_bib
{rinaldi2001 Rinaldi, Steven M., James P. Peerenboom, and Terrence K. Kelly. Identifying, understanding, and analyzing critical infrastructure interdependencies. Control Systems, IEEE, 21.6, 11-25, 2001.
1702.05407.extracted_bib
{vespi2010 Vespignani, Alessandro. Complex networks: The fragility of interdependency Nature, 464.7291, 984-985, 2010.
1702.05407.extracted_bib
{buldyrev2010 Buldyrev, Sergey V., et al. Catastrophic cascade of failures in interdependent networks. Nature 464.7291, 1025-1028, 2010.
1702.05407.extracted_bib
{buldyrev2011a Shao, Jia, et al. Cascade of failures in coupled network systems with multiple support-dependence relations Physical Review E 83.3, 2011.
1702.05407.extracted_bib
{buldyrev2011b Gao, Jianxi, et al. Networks formed from interdependent networks Nature Physics 8.1, 40-48, 2011.
1702.05407.extracted_bib
{peeta1 Zhang, Pengcheng, Srinivas Peeta, and Terry Friesz. Dynamic game theoretic model of multi-layer infrastructure networks. Networks and Spatial Economics 5.2, 147-178, 2005.
1702.05407.extracted_bib
{rosato2008 Rosato, Vittorio, et al. Modelling interdependent infrastructures using interacting dynamical models. International Journal of Critical Infrastructures 4.1, 63-79, 2008.
1702.05407.extracted_bib
{thai2013 Nguyen, Dung T., Yilin Shen, and My T. Thai. Detecting Critical Nodes in Interdependent Power Networks for Vulnerability Assessment. IEEE Trans. on Smart Grid, 4.1, 1-9, 2013.
1702.05407.extracted_bib
{modiano2013 Parandehgheibi, Marzieh, and Eytan Modiano. Robustness of Interdependent Networks: The case of communication networks and the power grid. GlobeCom (to appear), 2013.
1702.05407.extracted_bib
{castet2013 Castet, Jean-Francois, and Joseph H. Saleh. Interdependent Multi-Layer Networks: Modeling and Survivability Analysis with Applications to Space-Based Networks. PloS one 8.4, 2013.
1702.05407.extracted_bib
{chen2012 Liu, Chen-Ching, et al. Intruders in the Grid. Power and Energy Magazine, IEEE, 10.1 58-66, 2012.
1702.05407.extracted_bib
{wood2012 Wood, Allen J., and Bruce F. Wollenberg. Power generation, operation, and control. John Wiley \& Sons, 2012.
1702.05407.extracted_bib
{echenique2004 Echenique, Pablo, Jesús Gómez-Gardeñes, and Yamir Moreno. Improved routing strategies for Internet traffic delivery. Physical Review E, 70.5, 2004.
1702.05407.extracted_bib
{ahuja1993 Ahuja, Ravindra K., Thomas L. Magnanti, and James B. Orlin. Network flows: theory, algorithms, and applications. 1993.
1702.05407.extracted_bib
{erdos1959 Erdos P., and A. R\& WI. On random graphs I. Publ. Math. Debrecen 6, 290-297' 1959.
1702.05407.extracted_bib
{gil2012 Bernstein, Andrey, et al.. Power grid vulnerability to geographically correlated failures-analysis and control implications. arXiv:1206.1099, 2012.
1702.05407.extracted_bib
{watts1998 Watts, Duncan J., and Steven H. Strogatz. Collective dynamics of ‘small-world’networks. nature 393.6684, 440-442, 1998.
1702.05407.extracted_bib
{castet2 Castet, Jean-François. Reliability, multi-state failures and survivability of spacecraft and space-based networks., 2012.
1702.05407.extracted_bib
{castet3 Saleh, Joseph Homer. Spacecraft reliability and multi-state failures: a statistical approach., Wiley. com, 2011.
1702.05407.extracted_bib
{Sen14 Sen, A. and Mazumder, A. and Banerjee, J. and Das, A. and Compton, R. Identification of k most vulnerable nodes in multi-layered network using a new model of interdependency, To be presented in the International Workshop on Network Science for Communication Networks (INFOCOM workshop), IEEE, 2014.
1702.05407.extracted_bib
{Zus11 Bernstein, Andrey and Bienstock, Daniel and Hay, David and Uzunoglu, Meric and Zussman, Gil. Power grid vulnerability to geographically correlated failures-analysis and control implications, arXiv preprint arXiv:1206.1099, 2012.
1702.05407.extracted_bib
{Fud2010 Fudenberg, A. and Tirole, J.. Game Theory, Ane Books, 2010.
1702.05407.extracted_bib
{Sen091 Sen, Arunabha, Pavel Ghosh, Vijay Vittal, and Bo Yang. A new min‐cut problem with application to electric power network partitioning., European Transactions on Electrical Power 19(6):778-797, 2009. Sen091