## 4 Analysis and Discussion
### Capture the Traffic Flow Change Under the Critical-Link Attacks  
This study systematically characterized the traffic flow changes caused by critical-link attacks for each considered topological parameter aspect. The traffic volume changes corresponding to each critical-link attack in the network could be clearly identified. In this regard, this study evaluated the empirical distribution functions of the traffic volume distribution under critical-link attacks for each topological parameter. Since the main focus needs to be on the tail of the distribution function, as it contains the response of the critical road segments, which contain more traffic volume than the other road segments, this study employed the CCDF that was previously introduced. Figure 4 shows the CCDF of the traffic volume distribution under critical-link attacks of each topological parameter for undisruptive conditions and for the first 10% of critical-link attacks. To gain a more comprehensive understanding of the changes in traffic volume corresponding to each individual critical-link attack, we individually calculated the first 10% of the attacks. These attacks comprised 32 individual critical-link attacks lying between the undisrupted condition (0 state) and a 10% disruption (from 1 to 32) in the CCDF functions. As depicted in Figure 5, under the undisrupted condition (state 0), the CCDF curve exhibits a smoother decline, reflecting a well-distributed traffic flow across the network. However, as disruptions progress from 1 to 32, the curves drop more steeply, particularly at the tail, where critical links with higher traffic volumes are targeted. This sharp decline in the tail indicates the significant loss of flow capacity in key road segments, which play a crucial role in handling the highest traffic volumes. The tail of the distribution represents the critical network links of the network, which carry a greater traffic volume than the segments at the head. Therefore, all the distribution functions exhibit heavy-tailed behaviour with a greater probability and very high criticality of their respective traffic volumes. However, this tendency gradually decreases as each critical-link segment carrying more traffic flow is attacked in each iteration. This results in a significant reduction in the traffic volume in the network. There are two major reasons for this: (I) there is no available segment to redirect the excess traffic once the critical link has been attacked or (II) the failure of certain roads has a lesser impact on the network when the critical segments are attacked. Meanwhile, the increasing probability at the head of the distribution suggests that remaining road segments absorb displaced traffic, reflecting the flow redistribution to less critical or alternative paths. The differences between curves highlight the network's growing fragility under critical-link attacks, as higher disruptions lead to congestion, bottlenecks, and eventual fragmentation. These patterns underscore the network's reduced capacity to maintain traffic flow efficiency and resilience, particularly as critical links with high flow-concentrated importance are progressively removed. Importantly, this study revealed that attacks on certain critical road segments caused a significant drain of the traffic volume at the tail because there is no alternative segment available to transfer the excess traffic once the critical link has been attacked; the remaining segments are unable to cater to the increasing demand owing to a lack of service level, or no alternative paths exist after the particular critical segment has been attacked to complete the ride to the desired origin and destination point (refer to the dashed lines depicted in Figure 5). Such critical links caused a significant drain of traffic volume from the network compared to other critical-link attacks, as their jump had significant gaps from the initial position to the position after the critical-link attacks.