PaperlayerView exact revision on arXiv

Source-linked AI summary

SPARC: Substation-to-Peering Assessment of Resilience and Cascades

Tanya Shreedhar, Kevin Vermeulen, Amreesh Phokeer, Italo Cunha, Fernando Kuipers

arXiv:2610.20070v1cs.NI

TL;DR

Operators lack a map showing which IXPs grid events cut off, when backup runs out, and where traffic reroutes. SPARC maps grid–Internet dependencies and measures failover and cascades; SPARC-Shield selects infrastructure to harden. Against a ten-substation attack, its selected hardening leaves fewer IXP presences offline than the best standard ranking.

  • Problem

    The grid–Internet interdependence is unmeasured at the scale needed to identify which IXPs a grid event takes down, when backup expires, and where traffic goes.

    Source: §1 · p. 2

  • Method

    SPARC maps substations to facility candidate feeders using open data validated against operator records, measures failover with controlled PEERING BGP withdrawals, and simulates grid cascades.

    Source: §1 · p. 2, §3 · p. 5

  • Results

    167 offline IXP presences fall to 47 with SPARC-Shield's ten selected substations hardened, versus 80 with the best standard ranking when an attacker disables ten substations.

    Source: §1 · p. 3

  • Takeaways & Limitations

    The best hardening set depends on the threat the operator plans for.

    Source: §1 · p. 3

    Island survival rules use topology and installed capacity, whereas real islands also depend on inertia, reserves, and under-frequency load shedding.

    Source: §7 · p. 21

Abstract

from arXiv · show

Internet Exchange Points (IXPs) operate from colocation facilities that draw power from regional grids and store limited backup fuel. In April 2025, the Iberian blackout kept the Spanish grid down for 16 hours, beyond the 12 hours of fuel required by the industry standard, while traffic at major Iberian IXPs fell by up to 70%. Yet operators cannot tell which facilities a grid event cuts off, whether it outlasts their backup, or where traffic from a failed IXP goes. We present SPARC, which maps power-grid and Internet dependencies from substations to IXPs and their traffic. Using open data validated against transmission operators, SPARC links 552 facilities hosting 275 IXPs to the substations that likely feed them. We spread grid events over this map and measure failover through controlled BGP withdrawals on the PEERING testbed. Disabling the most-shared 16% of facility-feeding substations cuts power to half of all IXP presences (an IXP at one facility), under half of what randomized maps require. Losing the 5% most central substations cuts power to 0.1% of IXP presences directly but to 9-52% once the grid splits into disconnected islands. Traffic often fails over to nearby sites that share the failing grid: a cascade affecting four metropolitan areas sends up to 40% of one area's monitored addresses to another of the four. We introduce SPARC-Shield to select substations to harden or facilities whose backup to extend. Against an attacker disabling ten substations, hardening the ten selected by SPARC-Shield reduces offline IXP presence by 72%, compared with 52% for the best standard ranking.

1 Introduction

Grid outages can outlast facility backup and disrupt IXP traffic, but the grid–Internet dependencies and traffic paths have been poorly measured. SPARC maps those dependencies and evaluates outage propagation, failover, and hardening choices.

RQ1

  • SPARC maps 20,085 substations to 552 facilities hosting 275 IXPs; validation recovers 98.1% and 96.7% of Dutch and French substations at 86.2% and 98.5% precision, respectively.The candidate feeders include the published feeder for 58 of 61 Dutch facilities.Source: §1 · p. 2
  • 16.2% of the most-shared facility-feeding substations suffice to cut power to half of European IXP presence, while shuffled or rewired maps need 2.1–2.4× as many.The comparison uses maps with IXP presences shuffled or candidate feeders rewired.Source: §1 · p. 3

RQ2

  • Most traffic from failed IXP sites moves to the nearest sites, which in Europe often share the failed site's grid; regional transit can also send some traffic thousands of kilometers.Measurements cover 404,957 addresses in 61,061 ASes.Source: §1 · p. 3

RQ3

  • Losing the 5% most central substations cuts power to 0.1% of IXP presence directly but to 8.8–51.7% after grid splits, depending on island-survival rules.With 12 hours of fuel and no refueling, only events lasting longer than 12 hours take IXP presence offline.Source: §1 · p. 3
  • 7–40% of monitored addresses in each of four affected metropolitan areas fail over to another of the four before reaching a working site.The study spreads grid events over the measured map and uses PEERING failover measurements.Source: §1 · p. 3

RQ4

  • SPARC-Shield reduces offline IXP presence from 167 to 47 when an attacker disables ten substations, while the best standard ranking leaves 80 offline.The best set also changes with the threat the operator plans for.Source: §1 · p. 3

2 Background and Related Work

The background describes how transmission-grid failures can split synchronous areas and how facility backup and shared buildings shape exposure. Related work addresses grid mapping, Internet outages, cascade modeling, and infrastructure protection, while SPARC connects these strands at substation scale.

2.1 Background

  • A grid failure can split a synchronous area into islands that must balance their own generation and load; facility batteries bridge generator startup, while on-site fuel is finite.The cited Tier Standard requires 12 hours of fuel at design load; 255 of 552 facilities host more than one IXP and together hold 79% of IXP presences.Source: §2.1 · pp. 3–4

2.2 Related Work

  • Prior grid–Internet maps use wide-area synchronous grids, while country-specific maps or a 220 kV floor miss substations relevant to many facilities; SPARC maps substations at ≥110 kV across its scope.The nearest substation of 74.1% of facilities operates at 110–220 kV.Source: §2.2 · p. 4
  • Prior outage studies detect failures after the fact or study site loss without its grid event; SPARC tests failover for sites a grid event would take down.Some prior measurement finds only 3% of IXPs with dependent networks have all members and dependents in their own country.Source: §2.2 · p. 4
  • Prior cascade models couple network failures or remove grid elements under targeted orderings; SPARC runs cascades on its measured map and bounds island survival with rules matched to documented splits.Infrastructure-hardening work protects grid assets against interdiction, whereas SPARC-Shield protects dependent Internet infrastructure by hardening substations or extending facility backup.Source: §2.2 · pp. 4–5
  • The SPARC pipeline proceeds from open grid and facility data through candidate-feeder mapping and validation to BGP failover measurements, cascade simulation, and hardening selections.The dependency graph links each facility to candidate feeder substations.Source: Figure 1 · p. 5

3 Mapping the Grid-Internet Dependency

SPARC builds a map linking European high-voltage substations to IXP facilities using open grid and facility data, then validates the map against transmission-operator references. The map finds concentrated dependencies on 110–220 kV substations, a tier omitted by open models with a 220 kV floor.

3 Mapping the Grid-Internet Dependency

  • The pipeline links each facility to its three nearest substations as candidate feeders, validates the map, measures traffic failover on PEERING, and models grid events and hardening choices.Because the actual facility feeder is a private arrangement, SPARC uses proximity to identify candidates.Source: §3 · p. 5, §3.3 · p. 7

3.1 1 Data Sources

  • SPARC takes grid infrastructure from OpenStreetMap and facility locations and IXP sites from PeeringDB.PeeringDB may underrepresent small IXPs.Source: §3.1 · p. 5

3.2 2 Power Grid

  • SPARC extracts 20,085 substations at ≥110 kV through five filtering and merging steps, then connects substations using 2.0 km line buffers.The resulting transmission graph has 37,180 edges and a mean degree of 2.99.Source: §3.2 · p. 6

3.3 3 Facilities and Their Candidate Feeders

  • For facilities hosting 56.8% of IXP presence, all candidate feeders are at 110–220 kV; 44 substations are the nearest high-voltage source for half of IXP presences.These substations account for under 0.3% of those in scope.Source: §3.3 · p. 7, §3.4 · p. 9

3.4 Validation

  • SPARC recovers 98.1% of TenneT substations at 86.2% precision, 96.7% of eligible RTE substations at 98.5% precision, and captures the published feeder for 95.1% of tested Dutch facilities.The Dutch feeder test covers 61 facilities; its random-candidate baseline captures 25.7%.Source: §3.4 · pp. 7–8, Table 1 · p. 7

4 Characterizing Internet Failover under Site Outages

SPARC emulates metropolitan outages by withdrawing an anycast prefix from PEERING sites and tracking where monitored addresses move. Failover usually favors nearby sites, often on the same synchronous grid, but cascades can sharply increase reroute distance and latency after nearby alternates fail.

4.1 4 Emulating Site Outages on PEERING

  • Experiments withdrew an anycast prefix from PEERING sites to emulate metropolitan outages; six in-scope sites represented their metropolitan areas, and measurements covered 404,957 addresses in 61,061 ASes.PEERING used 32 cloud data-center sites across six continents.Source: §4.1 · p. 9

4.2 Alternate Sites and Their Power Grid

  • Some addresses move across continents despite nearby sites remaining up because regional transit providers connect to PEERING at only a few sites.For example, 15% of Amsterdam's catchment moves to Mexico after that site fails.Source: §4.2 · p. 10

4.3 Isolated versus Cascading Outages

  • For isolated outages, median latency change was +14 ms and 56% of addresses changed by at most +20 ms; the 14% moving to distant sites gained 100 ms or more.For another 20%, latency fell because the failed site was not their fastest site.Source: §4.3 · p. 11
  • In cascades, reroute distance and latency stay near isolated levels until nearby alternates fail, then jump; Amsterdam's 75th-percentile reroute distance rose from ∼2,500 to ∼8,200 km at failure four.The jump occurs when the last nearby alternate fails; its timing follows the number of nearby alternates.Source: §4.3 · p. 11
  • A median of two thirds of monitored addresses move to the four nearest sites, and in continental Europe more than half stay on the same synchronous grid.If a grid event also takes nearby alternates down, traffic can move to sites thousands of kilometers away.Source: §4.3 · p. 12

5 Failure Analysis

SPARC follows grid events from de-energized substations to facilities that exhaust their backup, bounding cascade spread and backup duration where operator data are unavailable. Shared-substation attacks, grid islanding, and event duration produce distinct outage patterns.

5 Failure Analysis

  • SPARC treats a facility as dark when all three candidate substations within 15 km are de-energized, and counts its IXP presence offline only after the event exceeds facility backup.Counting presence rather than whole IXPs reflects that an IXP can retain powered facilities while losing others; the candidate-based estimate can understate, but not overstate, an outage when the actual feeder is among the candidates.Source: §5 · p. 12

5.1 Direct Loss of Shared Substations

  • 16.2% of facility-connected substations must be removed to cut power to half of IXP presence, versus 79.3% under random removal.The measured map requires fewer removals than shuffled and rewired maps because facilities with the most IXPs share their candidate substations.Source: §5.1 · p. 13, Figure 7 · p. 14

5.2 Spread Through Grid Islands

  • 8.8–51.7% of IXP presence goes offline after a 5% betweenness seed once island survival is modeled, versus 0.1% from the seed alone.The largest-island rule yields 51.7% offline; the generation-aware rule yields 14.6% at β=1, and each rule reproduces only one documented grid-split outcome.Source: §5.2 · pp. 14–15, Figure 8 · p. 15

5.3 Duration Against Facility Backup

  • A 16-hour event with 12-hour backup takes 51.7% of IXP presence offline under the largest-island rule, while 48-hour backup delays outages for events lasting 12–48 hours.When a quarter of facilities have 48-hour backup instead of 12-hour backup, a 16-hour event takes 38.6% offline rather than 51.7%.Source: §5.3 · p. 16
  • The Iberian blackout’s 12-hour Portuguese and 16-hour Spanish grid outages put facilities on opposite sides of the assumed 12-hour fuel threshold.The 12-hour minimum gives a pessimistic outage estimate; traffic at four major Iberian IXPs still fell by 33–70% even as operators kept data centers running.Source: §5.3 · p. 16

6 SPARC-Shield: Hardening Substations and Facilities

SPARC-Shield selects substations or facilities to harden under a budget, accounting for how hardening changes losses under attacks and grid cascades. Its best choices depend on the threat, and its ten-substation selection outperforms standard rankings across the evaluated threats.

6 SPARC-Shield: Hardening Substations and Facilities

  • SPARC-Shield reruns the outage-to-facility analysis with hardening, then selects budgeted substations or facilities to minimize offline IXP presence.Substations must be selected jointly because each unit’s protection depends on what is already hardened; facility backup protects only that facility.Source: §6 · pp. 16–17

6.1 Problem Formulation

  • For attacks, the worst attacker is recomputed after hardening; for cascades, substation selection is a maximum-coverage problem and facility selection is greedy-optimal.The attack problem is NP-hard, so SPARC-Shield computes attacks exactly with a mixed-integer program.Source: §6.1 · pp. 17–18

6.2 Evaluation

  • With ten substations hardened, SPARC-Shield removes 72% of loss under T1, 35% under T2, and 37% under T3, versus 52%, 17%, and 6% for the best ranking.Above two substations, it attains lower loss than every ranking under all three threats.Source: Figure 9 · p. 17, §6.2 · p. 18
  • Under T1, ten selected substations reduce offline IXP presence from 12.0% to 3.4%, while the best ranking leaves 5.7% offline.The selected substations cover every facility hit by the optimal attack, which then shifts to Stockholm and Zurich.Source: §6.2 · p. 18
  • Under T2, ten selected substations lower mean loss from 39.8% to 26.0%, versus 33.1% for the best ranking; under T3, they lower it from 12.4% to 7.9%, versus 11.7%.The selections target metros and islands that lose power under each cascade rule, unlike some baseline choices located in islands that remain energized.Source: §6.2 · pp. 18–19
  • A threat-specific selection retains only 0–72% of its protection under another threat, while a hedged set retains 62–81% across threats.The ten-substation evaluation assumes a 16-hour event and 48-hour backup for hardened units; facilities otherwise have 12-hour backup in the standard setup.Source: §6.1 · p. 17, §6.2 · p. 19, Figure 10 · p. 19
  • At a 5% T2 seed, 7–40% of monitored addresses in each of four down metros fail over to another of those metros, yielding 45.6 stranded IXP presences.This is a lower bound because experiments locate alternate sites for only 23–92% of monitored addresses; backing up SPARC-Shield’s first five substations removes all stranding in the tested threats.Source: §6.2 · p. 20

7 Conclusion

SPARC maps grid–Internet dependencies and finds concentrated IXP exposure, grid-propagation effects, and a threat-dependent hardening strategy. The conclusion also identifies limits in feeder data, grid modeling, and PEERING traffic measurement.

7 Conclusion

  • Hardening SPARC-Shield’s ten selected substations removes 72% of offline IXP presence, versus 52% for the best standard ranking.A set chosen for one threat retains only 0–72% of its protection under another.Source: §7 · p. 20
  • The feeder map uses each facility’s three nearest substations, validated only against primary feeders at 61 Dutch facilities; accuracy elsewhere remains untested.OSM also omits Frankfurt’s inner-city 110 kV cables, potentially understating cascades there.Source: §7 · p. 20
  • SPARC’s island rules use topology and installed capacity, while real island survival also depends on inertia, reserves, and under-frequency load shedding.PEERING withdraws a prefix from an entire metropolitan area at once, unlike facilities failing at different times as backup runs out; its anycast catchment only approximates member-to-member rerouting.Source: §7 · p. 21

A Use of Generative AI

  • The authors used generative AI to improve grammar and readability, while retaining technical content, analysis, and interpretation as their own.Source: A Use of Generative AI · p. 26

B.1 Backup Power at Facilities

The appendix grounds the facility-backup threshold, documents how failure orderings represent grid events, and details the substation extraction choices used by SPARC.

B.1 Backup Power at Facilities

  • The analysis uses 12 hours as the minimum facility backup because it is the only fuel reserve duration stated by the cited standards, and 48 hours as the longest stated operator backup.The Uptime Institute Tier Standard requires 12 hours of fuel at design load; a higher Tier adds redundancy, not a longer reserve, while the European standard states no hours.Source: §B.1 · p. 26, Table 5 · p. 26

B.2 Failure Orderings and Documented Grid Events

  • Failure-ordering rules model which substations fail first, not why; random, most-shared, betweenness/corridor, and country-wide failures represent different documented event patterns.These patterns correspond respectively to non-role-dependent events, direct attacks, synchronous-area corridor losses, and national-grid de-energization.Source: §B.2 · p. 26, Table 6 · p. 27

C.1 Extraction Steps in Detail

  • The five-step OSM extraction reduces 24,900 European substations to 20,085 in scope, beginning with substation objects and lines or cables tagged at ≥110 kV.Polygons are represented by interior points, and multi-value voltage tags take their maximum.Source: §C.1 · pp. 26–27
  • The extraction excludes eight non-transmission subtypes and keeps industrial, generation, and converter subtypes only at ≥220 kV.Source: §C.1 · p. 27
  • The quality gate keeps 23,736 voltage-tagged and 15,748 named candidates, then proximity validation retains 3,928 named candidates near high-voltage lines.Named candidates must be within 1,000 m of a line at ≥220 kV or within 500 m of a 110–220 kV line.Source: §C.1 · p. 27
  • A 300 m DBSCAN radius deduplicates station features; recall against TenneT at a 500 m match falls from 96.4% at 300 m to 77.8% at 2,000 m.Larger radii can merge distinct stations, while the figure reports that overcount shrinks smoothly as radius grows and recall falls once stations merge.Source: §C.1 · pp. 27–28, Figure 12 · p. 28

C.2 Validation in Detail

Validation compares SPARC’s station map with TenneT, PyPSA-Eur, and RTE records, while a separate analysis identifies concentration in the nearest sources to IXP presences.

C.2 Validation in Detail

  • Excluding three Amsterdam facilities assigned to a station 6 km away would leave a candidate set with k=3 containing the feeder for 58 of 64 facilities (90.6%).The facilities share a postcode with the Science Park, where a 150 kV station stands inside the postcode.Source: §C.2 · p. 28
  • At 2 km, recall is at least 99.5% in each of four voltage tiers from 110 to 380 kV; across match radii, recall varies by only 2.5 percentage points and chance baselines stay at or below 15.0%.Precision rises from 72.9% at 250 m to 86.2% at 2 km.Source: §C.2 · p. 28, Table 7 · p. 29
  • SPARC and PyPSA-Eur station counts agree across 33 countries (Pearson r=0.983; Spearman ρ=0.979), with a median count ratio of 0.97.SPARC counts are 1.36–1.73× PyPSA-Eur in Austria, France, Germany, Italy, and the Netherlands; the authors attribute the excess to bus-section duplication and retain the 300 m radius to avoid merging distinct stations.Source: §C.2 · pp. 28–29
  • Of 1,066 RTE substations, 167 match no SPARC station; 98 are excluded by design, 38 have codes absent from OSM, and 31 are merged or clipped from scope.Source: §C.2 · p. 29

C.3 Substations Nearest to the Most IXP Presence

  • The 44 substations nearest to the most IXP presence are the nearest source for half of all 1,394 IXP presences.Losing a nearest source alone does not darken a facility because all three candidate feeders must fail.Source: §C.3 · p. 29

D PEERING Experiments in Detail

The PEERING deployment measures routes and latency to monitored addresses during site-specific announcements, and reports reroute-distance distributions by address grouping and traffic weighting.

D PEERING Experiments in Detail

  • Each announcement configuration remains active for 90 minutes to avoid route-flap dampening and allow catchment and route measurements.Source: §D.1 · p. 29
  • Latency is measured by pinging 404,957 monitored addresses from the router during a site-only prefix announcement and subtracting the baseline latency to the site.Source: §D.1 · p. 29
  • The reroute-distance distributions grouped by AS and weighted by AS traffic volume both resemble the distribution over individual addresses.Traffic volume is estimated from the APNIC AS-population dataset [92].Source: Figure 13 · p. 30

D.2 Additional Discussion of Outage Experiments

Most rerouted traffic moves relatively short distances, but some outages send substantial shares to more distant sites, including across oceans.

D.2 Additional Discussion of Outage Experiments

  • 44% of rerouted addresses, 44% of ASes, and 41% of estimated traffic volume move less than 1,000 km from the failed site.Address-, AS-, and estimated-volume-weighted distance distributions are similar.Source: §D.2 · p. 30
  • The four nearest alternate sites receive a median 67.2% of addresses across 29 outages, and at least half in 23 outages.Source: §D.2 · p. 30
  • In 12 of 29 outages, a farther site receives more addresses than the nearest; New Jersey sends about 27% each to Atlanta and Chicago, versus 0.5% to Toronto.12.8% of New Jersey's addresses move to Amsterdam, Frankfurt, and Madrid, about 5,900 km away.Source: §D.2 · p. 30
  • 54% of Amsterdam's catchment lies over 2,000 km away; the same is true of 32% of Frankfurt's and 27% of London's addresses.Distant addresses may reach Amsterdam through remote peering and move to a closer site when it fails.Source: §D.2 · p. 30

E.1 Outage Rule and Direct Loss of Shared Substations

The direct outage analysis treats a facility as dark only when all candidate feeders fail, yielding a conservative estimate when the true feeder is among those candidates. Shared feeders concentrate direct losses, and that concentration persists under alternative maps and feeder assumptions.

E.1 Outage Rule and Direct Loss of Shared Substations

  • A facility is called dark only when all its candidates fail; if its true feeder is among them, adding candidates can only lower the estimated offline presence.Source: §E.1 · pp. 30–31
  • 16.2% of facility-connected substations cuts half of European IXP presence in the measured map, while random tie orders require 21.3–27.9%.The most-shared order's threshold is 11.2% in the Netherlands; random tie orders require 11.2–17.8%.Source: §E.1 · p. 31
  • Every shuffled and rewired map draw is less concentrated than the measured map (p<0.001).The altered maps preserve the dependency graph or its facility and substation degrees, respectively.Source: Table 9 · p. 32, §E.1 · p. 32
  • With calibrated single feeders, half of IXP presence loses power after 12.5% of substations are removed, versus 16.2% under three candidates.Across calibrated draws the threshold is 10.8–14.0%; random removal requires 51.3%, or 4.1 times as many substations. Figure 14 compares the three-candidate, nearest-only, and calibrated rules; three candidates yield the least offline presence in every setting.Source: §E.1 · p. 32, Figure 14 · p. 32
  • In Amsterdam and Frankfurt, most-shared removal takes half of IXP presence offline after 35% of candidate substations, versus 81% for random removal.Grid-betweenness removal is no faster than random in any of the three metros; Figure 15 also covers Paris.Source: §E.1 · p. 33, Figure 15 · p. 33

E.2 Spread Through Grid Islands

Grid-island rules and overload cascades determine how far outages spread beyond directly failed substations. The reported maximum is constrained by which facilities have all candidate feeders inside the modeled backbone.

E.2 Spread Through Grid Islands

  • 79 of 552 facilities have all candidate feeders outside the extracted largest component, which omits the Nordic area and has geographic line-data gaps.At a 5% seed, alternative backbone constructions yield 52.5% and 50.6% offline presence, versus 51.7% on the extracted component.Source: §E.2 · p. 33
  • The 65.2% ceiling comes from 382 facilities with 908 of 1,392 IXP presences whose candidates all lie in the largest component.Island rules de-energize only substations in that component, so facilities with candidates outside it cannot all be dark.Source: §E.2 · p. 34
  • The seed sweep spans 0–40% in 80 steps; generation-aware island survival uses dispatchable plants and a country-level peak-load proxy.The rule is evaluated at β=0.5, 0.75, and 1; the study also seeds transmission corridors by edge betweenness.Source: §E.2 · p. 34
  • With 2026 capacity, the generation-aware rule keeps all four reconstructed areas energized, matching the 2006 islands but missing Italy's 2003 collapse.Source: §E.2 · p. 35
  • The overload model recalculates substation betweenness after each trip and removes every surviving station whose load exceeds its capacity.It tests overload tolerance α from 0.1 to 1.0 and can then apply the largest-island rule.Source: §E.2 · p. 35
  • At a 5% seed, the largest-island rule following the overload cascade takes 64.7% of IXP presence offline, near the 65.2% ceiling.Source: §E.2 · pp. 34, 36

E.3 Duration and Sensitivity of the Results

The sensitivity analysis tests backup duration and feeder choices, while SPARC-Shield selects substations or facilities to protect under specified outage scenarios. Its guarantees depend on the threat model: fixed-scenario protection is a coverage problem, unlike the worst-case attacker setting.

E.3 Duration and Sensitivity of the Results

  • 25.8% of IXP presence goes offline in a 2-hour event when half of facilities have UPS-only backup (5th–95th percentile: 22.3–29.5%).With all facilities on UPS only or all holding 48 hours of fuel, loss is 51.7%, reached at 15 minutes or 48 hours, respectively.Source: §E.3 · p. 36
  • Across eight feeder configurations, most-shared removal takes half of IXP presence offline after 13–28% of connected substations, versus 50–87% for random removal.At a 5% seed, the cascade takes 50–56% of IXP presence offline across those configurations.Source: §E.3 · p. 36

F.1 The Hardening Problem

  • SPARC-Shield compares substation hardening and facility backup extensions to 48 hours while holding the measured grid-and-facility map fixed.For a 16-hour event, hardening helps only when event duration exceeds ordinary backup but does not exceed the hardened backup window.Source: §F.1 · p. 36
  • For equal ordinary backup b, hardening lowers loss only when b<T≤B_hard; loss is zero for T≤b and unchanged for T>B_hard.Source: §F.1 · p. 37
  • For fixed scenarios with λ=0, substation protection is monotone submodular and greedy achieves at least 1−1/e of optimum; facility backup is modular and greedy is optimal.Source: §F.1 · p. 37
  • Against the T1 worst-case attacker, protection is not submodular, and both attacker and defender problems are NP-hard for k≥2.The stated greedy guarantee therefore does not apply to this attacker setting.Source: §F.1 · pp. 37–38

F.2 Solver

  • SPARC-Shield solves the T1 attacker exactly with a mixed-integer linear program and searches defender hardening choices using implicit enumeration.For fixed-scenario T2 and T3, the defender solves the coverage problem as a mixed-integer linear program.Source: §F.2 · p. 38
  • The greedy defender is optimal at every T3 budget; its largest gaps are 11 of 41 presences in T1 and 5.5 of 236 (2.3%) in T2.The gap for λ>0 in T2 and T3 was not measured because the coverage guarantee does not apply to that thresholded objective.Source: Table 13 · p. 38, §F.2 · p. 39

F.3 Additional Results

SPARC-Shield’s ten-substation backup leaves no IXP down against the ten-substation attacker, while additional results examine stranded traffic, backup-assignment variability, and protection per hardened unit.

F.3 Additional Results

  • Zero IXP presences are down and 21 are degraded after backing up SPARC-Shield’s ten substations, versus 5 down and 46 degraded without hardening.Source: §F.3 · p. 39
  • At the 5% seed of the largest-island rule, Amsterdam receives 40.3% of Warsaw’s and 24.0% of Paris’s monitored addresses; Paris receives 17.2% of Madrid’s and 6.9% of Amsterdam’s.Of 45.6 stranded IXP presences, 21.0 come from Warsaw.Source: §F.3 · p. 39
  • With heterogeneous backup assignments sampled 20 times, using a uniform 12-hour assumption leaves only 4–10 more IXP presences offline than assignment-specific choices at a budget of 10.The hedged set is computed greedily under the k=3 feeder model.Source: §F.3 · p. 39
  • Substation backup protects 1.3–2.0× as much IXP presence per hardened unit as facility backup; its advantage is largest under T2 and shrinks with budget under T1.Source: Figure 17 · p. 40
  • Table 15 reports offline IXP presence for a ten-unit cost budget across relative substation costs, while Table 16 covers stranded presence under backup and metro-down scenarios.Source: Table 15 · p. 40, Table 16 · p. 40
Loading 2610.20070v1…