### Abstract

Many complex systems display a surprising degree of tolerance against errors.
For example, relatively simple organisms grow, persist and reproduce despite
drastic pharmaceutical or environmental interventions, an error tolerance
attributed to the robustness of the underlying metabolic network^{1}.
Complex communication networks^{2} display a surprising degree
of robustness: although key components regularly malfunction, local failures
rarely lead to the loss of the global information-carrying ability of the
network. The stability of these and other complex systems is often attributed
to the redundant wiring of the functional web defined by the systems' components.
Here we demonstrate that error tolerance is not shared by all redundant systems:
it is displayed only by a class of inhomogeneously wired networks, called
scale-free networks, which include the World-Wide Web^{3, }^{4, }^{5},
the Internet^{6}, social networks^{7} and cells^{8}. We find that such networks display an unexpected degree of robustness,
the ability of their nodes to communicate being unaffected even by unrealistically
high failure rates. However, error tolerance comes at a high price in that
these networks are extremely vulnerable to attacks (that is, to the selection
and removal of a few nodes that play a vital role in maintaining the network's
connectivity). Such error tolerance and attack vulnerability are generic properties
of communication networks.

The increasing availability of topological data on large networks, aided
by the computerization of data acquisition, had led to great advances in our
understanding of the generic aspects of network structure and development^{9, }^{10, }^{11, }^{12, }^{13, }^{14, }^{15, }^{16}. The existing empirical and theoretical
results indicate that complex networks can be divided into two major classes
based on their connectivity distribution *P*(*k*), giving the probability
that a node in the network is connected to *k* other nodes. The first
class of networks is characterized by a *P*(*k*) that peaks at an
average *k* and decays exponentially for large *k*.
The most investigated examples of such exponential networks are the random
graph model of Erdös and Rényi^{9, }^{10} and the small-world
model of Watts and Strogatz^{11}, both leading to a fairly homogeneous
network, in which each node has approximately the same number of links, *
k* *k*. In contrast, results
on the World-Wide Web (WWW)^{3, }^{4, }^{5}, the Internet^{6}
and other large networks^{17, }^{18, }^{19} indicate that many systems
belong to a class of inhomogeneous networks, called scale-free networks, for
which *P*(*k*) decays as a power-law, that is *P*(*
k*) *k*^{-}, free of a characteristic
scale. Whereas the probability that a node has a very large number of connections
(*k* *k*) is practically
prohibited in exponential networks, highly connected nodes are statistically
significant in scale-free networks (Fig. 1).

##### Figure 1: Visual illustration of the difference between an exponential and a scale-free network.

**a**, The exponential network is homogeneous: most nodes have approximately
the same number of links. **b**, The scale-free network is inhomogeneous:
the majority of the nodes have one or two links but a few nodes have a large
number of links, guaranteeing that the system is fully connected. Red, the
five nodes with the highest number of links; green, their first neighbours.
Although in the exponential network only 27% of the nodes are reached by the
five most connected nodes, in the scale-free network more than 60% are reached,
demonstrating the importance of the connected nodes in the scale-free network
Both networks contain 130 nodes and 215 links (*k*
= 3.3). The network visualization was done using the Pajek program for
large network analysis: http://vlado.fmf.uni-lj.si/pub/networks/pajek/pajekman.htm.

We start by investigating the robustness of the two basic connectivity
distribution models, the Erdös–Rényi (ER) model^{9, }^{10}
that produces a network with an exponential tail, and the scale-free model^{17} with a power-law tail. In the ER model we first define the *
N* nodes, and then connect each pair of nodes with probability *p*.
This algorithm generates a homogeneous network (Fig. 1),
whose connectivity follows a Poisson distribution peaked at *k*
and decaying exponentially for *k* *k
*.

The inhomogeneous connectivity distribution of many real networks is reproduced
by the scale-free model^{17, }^{18} that incorporates two ingredients
common to real networks: growth and preferential attachment. The model starts
with *m*_{0} nodes. At every time step *t* a new node is
introduced, which is connected to *m* of the already-existing nodes.
The probability _{i} that the new node is connected to node *
i* depends on the connectivity *k*_{i} of node *
i* such that _{i} = *k*_{
i}/_{j}*k*_{
j}. For large *t* the connectivity distribution is
a power-law following *P*(*k*) = 2*
m*^{2}/*k*^{3}.

The interconnectedness of a network is described by its diameter *d*,
defined as the average length of the shortest paths between any two nodes
in the network. The diameter characterizes the ability of two nodes to communicate
with each other: the smaller *d* is, the shorter is the expected path
between them. Networks with a very large number of nodes can have quite a
small diameter; for example, the diameter of the WWW, with over 800 million
nodes^{20}, is around 19 (ref. 3),
whereas social networks with over six billion individuals are believed to
have a diameter of around six^{21}. To compare the two network
models properly, we generated networks that have the same number of nodes
and links, such that *P*(*k*) follows a Poisson distribution for
the exponential network, and a power law for the scale-free network.

To address the error tolerance of the networks, we study the changes in
diameter when a small fraction *f* of the nodes is removed. The malfunctioning
(absence) of any node in general increases the distance between the remaining
nodes, as it can eliminate some paths that contribute to the system's interconnectedness.
Indeed, for the exponential network the diameter increases monotonically with *
f* (Fig. 2a); thus, despite its redundant wiring
(Fig. 1), it is increasingly difficult for the remaining
nodes to communicate with each other. This behaviour is rooted in the homogeneity
of the network: since all nodes have approximately the same number of links,
they all contribute equally to the network's diameter, thus the removal of
each node causes the same amount of damage. In contrast, we observe a drastically
different and surprising behaviour for the scale-free network (
Fig. 2a): the diameter remains unchanged under an increasing level
of errors. Thus even when as many as 5% of the nodes fail, the communication
between the remaining nodes in the network is unaffected. This robustness
of scale-free networks is rooted in their extremely inhomogeneous connectivity
distribution: because the power-law distribution implies that the majority
of nodes have only a few links, nodes with small connectivity will be selected
with much higher probability. The removal of these 'small' nodes
does not alter the path structure of the remaining nodes, and thus has no
impact on the overall network topology.

#####
Figure 2: Changes in the diameter *d* of the network as a function of the
fraction *f* of the removed nodes.

**a**, Comparison between the exponential (E) and scale-free (SF) network
models, each containing *N* = 10,000 nodes and 20,000
links (that is, *k* = 4). The blue symbols
correspond to the diameter of the exponential (triangles) and the scale-free
(squares) networks when a fraction *f* of the nodes are removed randomly
(error tolerance). Red symbols show the response of the exponential (diamonds)
and the scale-free (circles) networks to attacks, when the most connected
nodes are removed. We determined the *f* dependence of the diameter for
different system sizes (*N* = 1,000; 5,000; 20,000)
and found that the obtained curves, apart from a logarithmic size correction,
overlap with those shown in **a**, indicating that the results are independent
of the size of the system. We note that the diameter of the unperturbed (*
f* = 0) scale-free network is smaller than that of the exponential
network, indicating that scale-free networks use the links available to them
more efficiently, generating a more interconnected web. **b**, The changes
in the diameter of the Internet under random failures (squares) or attacks
(circles). We used the topological map of the Internet, containing 6,209 nodes
and 12,200 links (*k* = 3.4), collected
by the National Laboratory for Applied Network Research http://moat.nlanr.net/Routing/rawdata/. **
c**, Error (squares) and attack (circles) survivability of the World-Wide
Web, measured on a sample containing 325,729 nodes and 1,498,353 links^{3}, such that *k* = 4.59.

An informed agent that attempts to deliberately damage a network will not
eliminate the nodes randomly, but will preferentially target the most connected
nodes. To simulate an attack we first remove the most connected node, and
continue selecting and removing nodes in decreasing order of their connectivity *
k*. Measuring the diameter of an exponential network under attack, we find
that, owing to the homogeneity of the network, there is no substantial difference
whether the nodes are selected randomly or in decreasing order of connectivity
(Fig. 2a). On the other hand, a drastically different
behaviour is observed for scale-free networks. When the most connected nodes
are eliminated, the diameter of the scale-free network increases rapidly,
doubling its original value if 5% of the nodes are removed. This vulnerability
to attacks is rooted in the inhomogeneity of the connectivity distribution:
the connectivity is maintained by a few highly connected nodes (
Fig. 1b), whose removal drastically alters the network's topology,
and decreases the ability of the remaining nodes to communicate with each
other.

When nodes are removed from a network, clusters of nodes whose links to
the system disappear may be cut off (fragmented) from the main cluster. To
better understand the impact of failures and attacks on the network structure,
we next investigate this fragmentation process. We measure the size of the
largest cluster, *S*, shown as a fraction of the total system size, when
a fraction *f* of the nodes are removed either randomly or in an attack
mode. We find that for the exponential network, as we increase *f*, *
S* displays a threshold-like behaviour such that for *f*
> *f*^{e}_{c} 0.28 we have *
S* 0. Similar behaviour is observed when we monitor the
average size *s* of the isolated clusters (that is, all the
clusters except the largest one), finding that *s* increases
rapidly until *s* 2 at *
f*^{e}_{c}, after which it decreases to *
s* = 1. These results indicate the following breakdown scenario
(Fig. 3a). For small *f*, only single nodes break
apart, *s* 1, but as *f* increases,
the size of the fragments that fall off the main cluster increases, displaying
unusual behaviour at *f*^{e}_{c}. At *
f*^{e}_{c} the system falls apart; the main cluster
breaks into small pieces, leading to *S* 0, and
the size of the fragments, *s*, peaks. As we continue to
remove nodes (*f* > *f*^{e}_{
c}), we fragment these isolated clusters, leading to a decreasing *
s*. Because the ER model is equivalent to infinite dimensional percolation^{22}, the observed threshold behaviour is qualitatively similar to the
percolation critical point.

##### Figure 3: Network fragmentation under random failures and attacks.

The relative size of the largest cluster *S* (open symbols) and the
average size of the isolated clusters *s* (filled symbols)
as a function of the fraction of removed nodes *f* for the same systems
as in Fig. 2. The size *S* is defined as the fraction of nodes contained
in the largest cluster (that is, *S* = 1 for *
f* = 0). **a**, Fragmentation of the exponential network under
random failures (squares) and attacks (circles). **b**, Fragmentation of
the scale-free network under random failures (blue squares) and attacks (red
circles). The inset shows the error tolerance curves for the whole range of *
f*, indicating that the main cluster falls apart only after it has been
completely deflated. We note that the behaviour of the scale-free network
under errors is consistent with an extremely delayed percolation transition:
at unrealistically high error rates (*f*_{max}
0.75) we do observe a very small peak in *s* (*
s*_{max} 1.06) even in the case of random
failures, indicating the existence of a critical point. For **a** and **
b** we repeated the analysis for systems of sizes *N*
= 1,000, 5,000 and 20,000, finding that the obtained *S* and *
s* curves overlap with the one shown here, indicating that the overall
clustering scenario and the value of the critical point is independent of
the size of the system. **c**, **d**, Fragmentation of the Internet
(**c**) and WWW (**d**), using the topological data described in Fig.
2. The symbols are the same as in **b**. *s* in **d**
in the case of attack is shown on a different scale, drawn in the right side
of the frame. Whereas for small *f* we have *s*
1.5, at *f*^{w}_{c} = 0.067 the
average fragment size abruptly increases, peaking at *s*_{
max} 60, then decays rapidly. For the attack curve in **
d** we ordered the nodes as a function of the number of outgoing links, *
k*_{out}. We note that while the three studied networks, the scale-free
model, the Internet and the WWW have different , *k*
and clustering coefficient^{11}, their response to attacks and
errors is identical. Indeed, we find that the difference between these quantities
changes only *f*_{c} and the magnitude of *d*, *S*
and *s*, but not the nature of the response of these networks
to perturbations.

However, the response of a scale-free network to attacks and failures is
rather different (Fig. 3b). For random failures no threshold
for fragmentation is observed; instead, the size of the largest cluster slowly
decreases. The fact that *s* 1 for
most *f* values indicates that the network is deflated by nodes breaking
off one by one, the increasing error level leading to the isolation of single
nodes only, not clusters of nodes. Thus, in contrast with the catastrophic
fragmentation of the exponential network at *f*^{e}_{
c}, the scale-free network stays together as a large cluster for
very high values of *f*, providing additional evidence of the topological
stability of these networks under random failures. This behaviour is consistent
with the existence of an extremely delayed critical point (
Fig. 3) where the network falls apart only after the main cluster
has been completely deflated. On the other hand, the response to attack of
the scale-free network is similar (but swifter) to the response to attack
and failure of the exponential network (Fig. 3b): at
a critical threshold *f*^{sf}_{c}
0.18, smaller than the value *f*^{e}_{c}
0.28 observed for the exponential network, the system breaks apart, forming
many isolated clusters (Fig. 4).

##### Figure 4: Summary of the response of a network to failures or attacks.

**a–f**, The cluster size distribution for various values of *
f* when a scale-free network of parameters given in Fig. 3b is subject
to random failures (**a–c**) or attacks (**d–f**). Upper
panels, exponential networks under random failures and attacks and scale-free
networks under attacks behave similarly. For small *f*, clusters of different
sizes break down, although there is still a large cluster. This is supported
by the cluster size distribution: although we see a few fragments of sizes
between 1 and 16, there is a large cluster of size 9,000 (the size of the
original system being 10,000). At a critical *f*_{c} (see Fig.
3) the network breaks into small fragments between sizes 1 and 100 (**b**)
and the large cluster disappears. At even higher *f* (**c**) the clusters
are further fragmented into single nodes or clusters of size two. Lower panels,
scale-free networks follow a different scenario under random failures: the
size of the largest cluster decreases slowly as first single nodes, then small
clusters break off. Indeed, at *f* = 0.05 only single
and double nodes break off (**d**). At *f* = 0.18,
the network is fragmented (**b**) under attack, but under failures the
large cluster of size 8,000 coexists with isolated clusters of sizes 1 to
5 (**e**). Even for an unrealistically high error rate of *f
* = 0.45 the large cluster persists, the size of the broken-off
fragments not exceeding 11 (**f**).

Although great efforts are being made to design error-tolerant and low-yield components for communication systems, little is known about the effect of errors and attacks on the large-scale connectivity of the network. Next, we investigate the error and attack tolerance of two networks of increasing economic and strategic importance: the Internet and the WWW.

Faloutsos *et al.*^{6} investigated the topological properties
of the Internet at the router and inter-domain level, finding that the connectivity
distribution follows a power-law, *P*(*k*) *
k*^{-2.48}. Consequently, we expect that it should display
the error tolerance and attack vulnerability predicted by our study. To test
this, we used the latest survey of the Internet topology, giving the network
at the inter-domain (autonomous system) level. Indeed, we find that the diameter
of the Internet is unaffected by the random removal of as high as 2.5% of
the nodes (an order of magnitude larger than the failure rate (0.33%) of the
Internet routers^{23}), whereas if the same percentage of the most
connected nodes are eliminated (attack), *d* more than triples (Fig. 2b). Similarly, the large connected cluster persists
for high rates of random node removal, but if nodes are removed in the attack
mode, the size of the fragments that break off increases rapidly, the
critical point appearing at *f*^{I}_{c}
0.03 (Fig. 3b).

The WWW forms a huge directed graph whose nodes are documents and edges
are the URL hyperlinks that point from one document to another, its topology
determining the search engines' ability to locate information on it. The WWW
is also a scale-free network: the probabilities *P*_{out}(*
k*) and *P*_{in}(*k*) that a document has *k* outgoing
and incoming links follow a power-law over several orders of magnitude, that
is, *P*(*k*) *k*^{
-}, with _{in} = 2.1 and _{
out} = 2.45^{3, }^{4, }^{24}. Since no complete topological
map of the WWW is available, we limited our study to a subset of the web containing
325,729 nodes and 1,469,680 links (*k* = 4.59
) (ref. 3). Despite the directedness of the
links, the response of the system is similar to the undirected networks we
investigated earlier: after a slight initial increase, *d* remains constant
in the case of random failures and increases for attacks (
Fig. 2c). The network survives as a large cluster under high rates
of failure, but the behaviour of *s* indicates that under
attack the system abruptly falls apart at *f*^{w}_{
c} = 0.067 (Fig. 3c).

In summary, we find that scale-free networks display a surprisingly high
degree of tolerance against random failures, a property not shared by their
exponential counterparts. This robustness is probably the basis of the error
tolerance of many complex systems, ranging from cells^{8} to distributed
communication systems. It also explains why, despite frequent router problems^{23}, we rarely experience global network outages or, despite the temporary
unavailability of many web pages, our ability to surf and locate information
on the web is unaffected. However, the error tolerance comes at the expense
of attack survivability: the diameter of these networks increases rapidly
and they break into many isolated fragments when the most connected nodes
are targeted. Such decreased attack survivability is useful for drug design^{8}, but it is less encouraging for communication systems, such as the
Internet or the WWW. Although it is generally thought that attacks on networks
with distributed resource management are less successful, our results indicate
otherwise. The topological weaknesses of the current communication networks,
rooted in their inhomogeneous connectivity distribution, seriously reduce
their attack survivability. This could be exploited by those seeking to damage
these systems.