Clustering coefficient

Our model is an individual-level model where a node’s tendency to have a clustering structure depends on a metric known as the local clustering coefficient. Let an undirected graph G = (V, E) be a representation of a network where V is a set of vertices (nodes) and E is a set of edges (links). A link (u, v) ∈ E connects node u ∈ V and node v ∈ V. The set of neighbors of node v is denoted by N(v) = {u;(v, u) ∈ E ∧ (u, v) ∈ E}. Hence, the cardinality of N(v), also known as the degree of node v, expresses the number of neighbors of node v and can be written as |N(v)| = k_v, where k_v is the degree of node v. A clique of three nodes {u, v, w}, where (u, v), (u, w), (v, w) ∈ E are links that connect all three nodes, is a triangle in a network G [38]. Let T(v) = |{(u, w);w, u ∈ N(v), (u, w) ∈ E}| be the number of triangles formed with the center at node v. The local clustering coefficient for node v is defined as (1)

In terms of the relative density of connections in its neighborhood, it determines how connected its neighborhood is to a complete network. Thus, this metric measures the proportion of the number of triangles with the center at node v compared to the number of triangles between the neighbors of node v if all the neighbors are connected (complete network), namely, . For example, Fig 1 illustrates the difference in the local clustering coefficient values at node 1 (C₁). Node 1 has the same degree k_v = 4 for each structure. However, the relationship between its neighbors is different, which causes the local clustering coefficient value of node 1 to be different. In this case, the set of possible clustering coefficients for node 1 is . We have possible pairs between neighbors and zero if no neighbors are connected. Fig 1 shows the network structure of each possible clustering coefficient. Thus, we can conclude that a node with the same degree can have different clustering coefficient values. By adding the clustering coefficient factor to the epidemic model, we can characterize the dynamics of the virus spread based on the structure between neighbors.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 1. Local clustering coefficient of node 1.

Possible local clustering coefficient at node 1 (orange node or C₁) with degrees k₁ = 4 on an undirected graph. The blue dashed lines represent the possible connections between the neighbors, and the red solid lines represent the triangles between the neighbors of node 1.

https://doi.org/10.1371/journal.pone.0258867.g001

Regular graph

A regular graph with degree k denoted by k-regular graph is a graph G = (V, E) where the degree of each node is the same, namely, k_v = k for every v ∈ V. In other words, each node in graph G has the same number of neighbors. Several graph theories are needed to determine the existence of a k-regular graph.

1. Lemma 1 (The handshaking lemma [39]). In any graph G = (V, E) where |E| = m, the sum of all degrees of node v ∈ V or deg(v) is twice the number of links and can be written as (2)
2. Lemma 2 ([39]). Graph G = (V, E) has an even number of nodes with odd degrees.
3. Lemma 1 and Lemma 2 are met for all G = (V, E). Since the k-regular graph is a subset of G = (V, E), the following result is obtained:
4. Corollary 1. A regular graph has an even number of nodes with odd degrees.
5. Lemma 3 (The existence of a regular graph). The sufficient and necessary conditions for the existence of a k-regular graph with the order n are n > k + 1 and nk even.

Proof. The maximum edge (link) of a graph with the order n is in a complete graph and the order is n − 1. Thus, k = n − 1 or n = k + 1. This condition is the n minimum for a special k. Additionally, note that if a regular graph is of the order n, then the number of sides is ; thus, nk must be even. (3)

Therefore, for odd n, the regular graph is defined only for even k. Theoretical foundations for regular graphs are essential for the results and discussion sections to adequately describe the influence of clustering coefficients on regular graphs.

Risk model and rate making theory

This study considers the cyber risk model by Xu and Hua (2019) [19]. This risk model uses two types of threats faced by each node: (1) threats from outside the network (for example, infection because node v was attacked or the user visited a malicious site) and (2) threats from within the network (e.g., infected node v attacking its neighbors). Assume that if a node is infected, it can be repaired and returned to a safe status but is still vulnerable to reinfection.

Suppose a cyberattack occurs on a network represented by an undirected graph G = (V, E) where V is a set of nodes, and E is a set of edges (links). Transmission on this network occurs via link (u, v) ∈ E so that node u and node v can attack each other. The number of nodes on the network is denoted by N = |V|. The degree of a node is the number of links associated with a node. The degree of node v is denoted by deg(v). An undirected graph G = (V, E) can be written into the adjacency matrix A = (a_uv) where (4) Let there be N computers or devices such that v ∈ 1, 2, ⋯, N. The status of the network at time t can be written as the vector I^⊤(t) = (I₁(t), I₂(t), ⋯, I_N(t)), where I_v(t) = 1 when node v is infected at times t and I_v(t) = 0 if node v is secure (but vulnerable to attack) at times t to v = 1, 2, ⋯, N. The infection probability vector is denoted by p^⊤(t) = (p₁(t), p₂(t), ⋯, p_N(t)), where p_v(t) = P(I_v(t) = 1) for v = 0, 1, 2, ⋯, N.

Fig 2 describes two types of risk that occur at a node in a network. Suppose that at the time of observation [0, T], a node v is safe at time t₀ and then has three infections, namely, at times t₁, t₃, and t₅. Such an infection can cause two types of losses:

1. Losses caused by infection, such as data corruption, extortion, information theft, hacking, denial of service and third-party fees.
2. Losses caused by the length of time to repair the computer (system downtime).

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 2. Losses faced by a computer (node).

Two types of losses are faced by node v in a network during the time interval [t₀, T]. L is losses caused by data damage, and R is losses caused by system downtime.

https://doi.org/10.1371/journal.pone.0258867.g002

At the first time t₁ infection caused data corruption or damage at node v is and loss due to system downtime is . The losses for the second infection are and , respectively, and the losses for the third infection are and , respectively. Thus, the total loss up to time t can be written as (5) where M_v(t) is the number of infections from node v to time t, μ_v(⋅) is the cost function due to infection and δ_v(⋅) is the cost function corresponding to the length of time-to-repair. The total loss faced by the firm until t is (6)

Thus, the key quantity is how to obtain M_v(t), which depends on the vector of network status up to time t, that is, I^⊤(t). Network status vectors are obtained using a modified Markov-based model (in-homogeneous SIS) process with an inhibition function of the clustering coefficient.

Modified Markov-based model

Wu and Liu (2008) [32] proposed a new model to study the effect of clustering coefficients on epidemics. According to their findings, the community level determined the spread of the virus in community networks. Conversely, an increase in clustering coefficients reduced the efficiency of epidemic spreading to a fixed community level. Using the SIS process, Bo Song et al. (2017) [33] concluded the same thing that in a homogeneous network (same degree for each node), clustering could inhibit epidemics. In contrast, there was no inhibitory effect during infection in the heterogeneous network. However, no one has yet created a model at the individual level that can explain a more specific dynamic process [34].

The clustering coefficient influences the infection rate for each node. Let the f(C_v) function describe the effect of the high cluster on the epidemic spread speed at node v. With the same assumptions, the necessary conditions for f(C_v) are

1. 0 < f(C_v) < 1, and
2. f(C_v) is a descending function that is .

Fig 3 describes the process of this clustering function affecting the infection rate of each node. Thus, the transition probability can be written as: (7) By supposing β_j = βf(C_j), this process is a process of an in-homogeneous SIS model [40].

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 3. Dynamics of the modified Markov-based model.

The dynamics of the infection and recovery processes of a network follow a modified ε-SIS model with local coefficient clustering factors f(C_v) for time steps t₁, t₂, and t₃. Red nodes indicate that the nodes are infected, and blue nodes indicate that the nodes are vulnerable at a certain time.

https://doi.org/10.1371/journal.pone.0258867.g003

An in-homogeneous SIS model accommodates different infection rates for each node. Van Mieghem and Omic (2013) introduced an in-homogeneous SIS model [40]. The model adjusts the characteristics of different nodes in carrying out attacks, for example, the speed of the data transfer signal. If node j is infected at a particular time, it will attack its neighbors at the rate of β_j.

Suppose that in an in-homogeneous SIS model, β_j is the infection rate for node j. If node j is infected, the time-to-infection of node v due to attack from node j is an exponential random variable with a mean equal to . The time it takes for node v to repair is an exponential random variable with a mean equal to . Likewise, the time-to-infection of node v due to external net factors is an exponential random variable with a mean of . The following equation gives the transition probability. (8) where I_j(t) is the status of node j at time t and the β_j attack rate of the infected neighbor of node v, i.e., node j. This model will be used to obtain the upper bound of infection probabilities and Monte Carlo simulations.

The dynamic equation for the infection probability from the in-homogeneous SIS model can be obtained with N-intertwined mean-field approximation (NIMFA) [41] as follows: (9) Another approximation uses the upper bound for the infection probabilities. Cator and Mieghem proved that (10) In other words, I_v(t) and I_j(t) are nonnegatively correlated for all finite graphs. These results lead to the upper bound for the infection probabilities, previously introduced for the ε-SIS model [19].

Upper bounds for infection probabilities are conservative estimates of the premium [19]. These upper bounds are obtained by solving the dynamic equation for the infection probabilities.

Theorem 1. For the in-homogeneous SIS model with infection rate β_j for j = 1, 2, ⋯, N, recovery rate δ_v = δ and self-infection rate ε_v = ε, the upper bound of the infection probabilities are given by (11) where , ε^T = (ε₁, ε₂, ⋯, ε_N), and .

Proof. The upper bound of dynamic infection probabilities in matrix and vector notations is given by using the Markov condition with two states β_j = 0; ∀j ∈ 1, 2, ⋯, N for every t ≥ 0, δ_v = δ, and ε_j = ε, then we can obtain In other words, is the lower bound for the infection probability when there is no infection rate for every link. Thus, the equation for the upper bound of the infection probabilities is (12) Let then Eq (12) can be written as (13) This equation becomes a nonhomogeneous differential equation that can be solved in the same way as Xu and Hua (2019) [19], and the result is (14) Proposition 1. The upper bound for the stationary infection probability of node v is given by (15) where p_v∞ = lim_t→∞ p_v(t).

Proof. The dynamics of the upper bound enter a stationary state if for v = 1, ⋯, N. Consider Eq (9) and lim_t→∞ p_v(t) = p_v∞, we get (16) (17)

Simulation procedure

We used the simulation procedure provided by Xu and Hua (2019) by modifying the rate of the interarrival time distribution. Let be the set of infected neighbors, where and D_v be the number of infected neighbors of node v. The time-to-infection of node v due to attacks from neighbors is given by the random variables . In the Markov-based model, the random variables have exponential distributions. However, the rate of distribution may differ according to the inhibitory effect of infection at each node. Survival functions with different rates are , where j ∈ {1, 2, ⋯, N} is the index of the node. The time-to-infection due to malicious site access is given by the random variable Z_v with survival function , and the time-to-recovery is an exponential random variable R_v with rate δ. Using the theory of alternating renewal processes and the assumption of positive lower orthant dependence [19], the stationary upper bound of infection probability of node v is (18)

Consider that , using Jansen’s inequality Eq (18) can be written as (19)

The result in Eq (19) is a stationary upper bound, which is the same as the result of the IH-SIS model in Proposition 1. Thus, the simulation can be carried out using the procedure given by Algorithm 1.

Algorithm 1: Simulation of cybersecurity risk with clustering coefficient factor.

Input: Local clustering coefficient of node C_v, basic infection rate β, initial status, the number of simulations n_sim, contract period T, set of susceptible nodes.

Calculate the infection rate with inhibiting factor β_v = βf(C_v), v = 1, ⋯, N.

 for i = 1 to n_sim do

 while t < T do

  Calculate the number of infected nodes .

  Generate random time-to-recovery from exp(δ).

  for v in secure nodes do

   Determine the infected neighbors of node v, .

   Generate random time-to-infection based on their infection rate from exp(β_j), j ∈ 1, 2, ⋯, N.

   Generate time-of-self-infection z_v from exp(ε).

  end

  Determine time for the first event .

  if infection occurs then

   Change status from 0 to 1 and calculate the loss.

  else

   Change status from 0 to 1 and calculate the loss.

  end

 end

 return t, network status, the loss for every node

end

Calculate insurance premium until T.

Output: network status, total loss, premiums.

Clustering coefficient in k-regular graph

The relationship between the clustering coefficient and the order of the regular graph is given by Fig 5. The average of the local clustering coefficients grows as the degree of a node k increases for each n. This result shows the average clustering coefficient that approaches 0 as the n order becomes more extensive. Thus, if n is very large and k is very small, it can be concluded that there is a minimal clustering coefficient effect on the pricing procedure on the k-regular graph.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 5. Average local clustering coefficient.

Relationship between the average clustering coefficient and the order of graph n = 10, 12, 14, ⋯, 100 for several different k = 1, 2, ⋯, 9.

https://doi.org/10.1371/journal.pone.0258867.g005

Some of the theoretical results obtained concerning the clustering coefficient and premium calculation are as follows.

Lemma 4 (Minimum effect). For 2—connected regular graph G = (V, E) with n > 3, the clustering coefficient for each node is zero. In this case, there are minimum effects of the clustering coefficient on cyber insurance premiums ∀v ∈ V.

Proof. All 2-connected regular graphs for n > 3 are cycle graphs (ring networks). Thus, for all {u, v, w} ⊂ V, no triangles are formed, so (u, v), (u, w) ∈ E but (v, u) ∉ E. The implication is T(v) = 0 and C_v = 0, ∀v ∈ V. Consider the conditions for the cluster function f(C_v), namely, and 0 < f(C_v) < 1. Additionally, consider the effect of the clustering coefficient on the spread of the epidemic as β_v = βf(C_v). Because the f(C_v) function decreases, when C_v is at its minimum value, f(C_v) is at its maximum value; in other words, βf(C_v) → β for f(C_v) → 1, and there is a minimum decreasing effect of the clustering coefficient on the spread of the epidemic and the pricing of cyber insurance premiums.

Lemma 5 (Maximum effect). For a (n − 1)-connected regular graph G(V, E) with n ≥ 3, the clustering coefficient for each node is one. In this case, there are maximum effects of the clustering coefficient on the pricing of cyber insurance premiums ∀v ∈ V.

Proof. All (n − 1)-regular graphs for n ≥ 3 are complete graphs (K_n). Thus, for all {u, v, w} ⊂ V, triangles are always formed so that (u, v), (u, w), (v, u) ∈ E, ∀u, v, w ∈ V. The implications are and C_v = 1, ∀v ∈ V. Consider the conditions for the f(C_v) clustering function, namely, and 0 < f(C_v) < 1. Additionally, consider the effect of the clustering coefficient on the spread of the epidemic as β_v = βf(C_v). Because f(C_v) is a decreasing function, when C_v is at its maximum value, f(C_v) is at its minimum value, in other words, βf(C_v) → min{β_j} for f(C_v) → min{f(C_v)}. Thus, there are maximum decreasing effects of the clustering coefficient on the spread of the epidemic and the pricing of cyber insurance premiums.

The last two lemmas bring us to the following consequences:

Corollary 2. There is a minimum of one or more structures on a k-connected regular graph for k = 3, ⋯, n − 2 such that there is at least one node that has nonzero and not one clustering coefficient. Thus, there is an effect on a node in cyber insurance rate making with (23) Proof. Based on the results of Lemma 4 and Lemma 5, there is always a structure of k-regular graph for k = 3, ⋯, n − 2 with the specified order n and holds the existence of a regular graph that is nk even. This is because the formation process of the k-regular graph for k = 3, ⋯, n − 2 involves adding one link to the 2-connected regular graph or subtracting one link at the n − 1-connected regular graph continuously. As a consequence, at least one node in that structure with indicates that 0 < C_v < 1. Thus applies (24)

The three functions explaining the inhibitory effect of the clustering coefficient are defined as follows:

• The linear function is f(C_v) = −C_v + 1.
• The quadratic function is [33].
• The exponential function is .

Each function provides a different inhibitory effect. The choice of the operation depends on how much the community can reduce the effectiveness of the infection rate. The quadratic function represents low inhibition, the linear function represents moderate inhibition, and the exponential function represents high inhibition. The numerical studies in the following subsection consider these three functions.

Upper bound of infection probability

The upper bound of infection probabilities was obtained from Eq (12) in Theorem 1. The three functions in Fig 6 demonstrate the influence of the magnitude of the inhibition on the upper bound. We compared the upper bound with and without inhibitory effects. Fig 7 shows the upper bound of infection probabilities for four nodes, namely, node 5, node 10, node 15, and node 20. Each node represents a different clustering coefficient. The clustering coefficients of nodes 5, 10, 15, and 20 are zero, , , and , respectively.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 6. Representation of the inhibition of the epidemic by the clustering coefficient.

The inhibition considers three functions, namely, linear (f(C_v) = −C_v + 1), quadratic (), and exponential () functions.

https://doi.org/10.1371/journal.pone.0258867.g006

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 7. The upper bounds for infection probabilities.

A comparison between upper bounds for infection probabilities without and with clustering coefficients using three types of inhibition functions (linear, quadratic, and exponential). The red box reflects the upper bound for resizing all figures at t = [3,20], and the extension outcomes can be seen inside each figure.

https://doi.org/10.1371/journal.pone.0258867.g007

The effect of structural characterization with local clustering coefficients is visible. The upper bound obtained by the model without the clustering coefficient is the same as that obtained by Xu and Hua (2019) [19]. It can be seen from the upper bound of each node that coincides with each other. By studying regular graphs, Antonio and Indratno (2021) [26] support the substantial effect of degrees on the model. Other factors that impact the rate of infection have not been explored in this model. However, the clustering structure can affect the speed or effectiveness of propagation, where nodes can have different infection rates [32, 33]. Through local clustering coefficients, each node undergoes an infection rate adjustment that depends on the inhibitory function. The three inhibiting parts considered earlier had different impacts on the upper bound of infection probabilities. The upper bound with the quadratic function gives a slight change compared to the upper bound without the clustering coefficient effect. Then, the linear function has a moderate impact, and the exponential function has a reasonably strong influence. Therefore, these functions represent the level of impact of the clustering structure on the speed and effectiveness of the spread of the virus.

Based on the model in Eq (7), the transition probability of a node depends on the sum of the clustering coefficient functions of its neighbors. The upper bounds of the three functions have the same pattern. Node 5 always produces the highest upper bound and is followed by nodes 20, 10, and 15. Table 1 summarizes the clustering coefficients of the four neighbors of each node, the total clustering coefficients and the totals of the three functions. This fact supports the upper bound result. Node 5 produces the highest total clustering coefficient functions for linear, quadratic, and exponential functions. Sequentially, nodes 20, 10, and 15 have a total clustering coefficient in the linear, quadratic and exponential functions below node 5. This confirms that the upper bound depends on the clustering coefficient function of the neighbors.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 1. Characteristics of clustering coefficients for nodes in a 4-regular graph topology (Fig 4).

https://doi.org/10.1371/journal.pone.0258867.t001

We looked at the linear relationship between the total clustering coefficient function (TN) and the upper bound (UB) to prove this assertion. The outcome is depicted in Fig 8. For all three functions, the figure depicts a positive linear relationship between TN and UB, which means that while TN grows, UB grows as well. The linear relationship is given by α₀ represents the intercept, α₁ represents the slope of the linear model, and R² represents the coefficient of determination. The coefficient of determination measures how well the independent variable can predict the fluctuation of the dependent variable. The linear relationship is powerful when R² is close to one. When R² is close to one, the linear connection is quite strong. Let , and be R² for linear, quadratic, and exponential functions. With , the three functions have a strong relationship. As a result, TN can account for more than 90% of UB. For linear, quadratic, and exponential functions, α₀ is 0.12, 0.09, and 0.14, respectively. For linear, quadratic, and exponential functions, α₁ is 0.06, 0.07, and 0.05, respectively. The upper bound is affected more strongly by the exponential inhibition function. As a result, it is obvious that the risk of transmission is no longer homogenous (same upper bound when degrees are equal) but instead has a significant correlation with the total inhibitory function of neighbors.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 8. TN and UB relationship of twenty nodes in a 4-regular graph on linear, quadratic, and exponential functions.

https://doi.org/10.1371/journal.pone.0258867.g008

Premiums setting

We performed simulations using Algorithm 1 to produce premiums. Cyber incident data are generated based on transmission parameters. Determining the number of simulations (n_sim) is one of the challenges of this method. We considered ten numbers of simulations. n_sim = {10, 25, 50, 100, 250, 500, 1000, 1500, 2000, and 2500} to find the convergence of n_sim. We ran simulations with β = 0.2 and no inhibition from local clustering coefficients to demonstrate convergence. Fig 9 reveals the convergence of the Monte Carlo simulation for mean infection, mean loss, and premiums of 20 nodes. For each variable, the average of 20 nodes is also displayed. In addition, the difference (Δ) for each (n_sim) is taken into consideration. When n_sim is increased, all three variables converge to the same value. At n_sim = 500, all figures are convergent on average. However, divergence is still apparent for each node at n_sim = 500. At n_sim = 2000, each node has begun to converge. If the difference (Δ) between the number of simulations is close to or equal to zero, the percentage change (Δ) implies convergence. As seen in Fig 9 for the variables ΔInfection Mean, ΔLoss Mean, and ΔPremiums, all nodes and their averages approach zero as n_sim is increased, and the simulation is considered to be convergent at n_sim = 2000. Finally, for the premium set, we choose n_sim = 2000 as the number of simulations.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 9. Convergence of the Monte Carlo simulation.

Convergence for Infection Mean, Loss Mean, and Premiums.

https://doi.org/10.1371/journal.pone.0258867.g009

On the 4-regular graph, premiums have been modified to account for the clustering structure. The linear relationship (correlation) between the total linear, quadratic, and exponential inhibitory functions (TN) and the premium is visualized in Fig 10. For twenty nodes with linear, quadratic, and exponential functions, the correlation between TN and P is more than 0.6, suggesting a strong and moderately strong linear relationship. The correlations for the linear, quadratic, and exponential functions are 0.77, 0.66, and 0.82, respectively.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 10. Correlation between the total function of the clustering coefficient (TN) and the premium (P).

TN and P relationship of twenty nodes in a 4-regular graph on linear, quadratic, and exponential functions.

https://doi.org/10.1371/journal.pone.0258867.g010

TN is a representation of two network entities: the degree and the local clustering coefficient. As a result, these findings incorporate the influence of the clustering structure on the premium. If the premium is based just on degrees, it is often homogenous. Indeed, the clustering structure influences the efficacy of epidemic propagation. This fact shows that when the effect of the inhibitory function increases or the speed of epidemic spread decreases due to the clustering coefficient, then the premium corresponds to the total inhibitory function of the neighbors. Additionally, these findings suggest the existence of a significant linear connection between UB and TN. UB has been verified as the initial premium estimate.

The premiums for the twenty nodes on the four-regular graph are shown in Table 2. Nodes 5, 10, 15, and 20 were bolded to illustrate the presence of various local clustering coefficients. The overall inhibitory function (TN) adjusted premiums in line with TN. As in the upper bound (UB), this outcome is impacted significantly by the TN in Table 1. Premiums without clustering coefficients (without CC) are compared, along with linear, quadratic, and exponential inhibition functions. The premiums without CC in Xu and Hua’s (2019) model [19] are 12.3 units. Each node has four degrees in total. As previously stated, TN accounts for two network properties: degree and the local clustering coefficient. TN has a premium of approximately 12.3 units while having a value close to 4. Conversely, the TN that is less than the degree corrects the premiums by the difference between TN and degrees. Node 5, with the largest TN for linear, quadratic, and exponential functions, provides the most extensive premium in comparison to other nodes. TN decreases when the trend of inhibitory function decreases, resulting in a decrease in the premium reduction trend. Premiums with an exponential inhibition function are the least expensive option. The premiums are more realistic than when only degrees are included. Additionally, the premium is not uniform but is adapted according to the cluster structure of its neighbors. Premiums that use this strategy might be cheaper, making them more competitive in the market.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 2. Premiums in a 4-regular graph topology (Fig 4).

https://doi.org/10.1371/journal.pone.0258867.t002

Application on real network

To validate the results, we used a real communication network (see Fig 11). The real network is an email communication network. Rossi and Ahmed (2015) [43] provided communication data, which may be viewed online (https://networkrepository.com/email-enron-only.php). Table 3 presents the characteristics of the email-Enron network in the form of the number of nodes (|V|), number of links (|E|), density (D), maximum degree (d_max), minimum degree (d_min), the mean of degrees (d_avg), the number of triangles (|T|), average triangles formed by a link (|T|_avg), the maximum number of triangles formed by a link (|T|_max), the average clustering coefficient (C_avg), and the global clustering coefficient (C).

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 11. Real communication network.

An email-Enron network with nodes representing email accounts or devices and links representing email exchange.

https://doi.org/10.1371/journal.pone.0258867.g011

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 3. Characteristics of an email-Enron network.

https://doi.org/10.1371/journal.pone.0258867.t003

According to these parameters, this network has 143 nodes and 623 links. With the density D equal to 0.0613, this network is classified as of extremely low density. Out of the 142 potential communications, the maximum communication (d_max) occurs only between 42 accounts (neighbors). C_avg and C can be used to characterize the clustering structure of this network. C_avg = 0.4339 shows that some nodes have a high local clustering coefficient, while others have a low coefficient. The clustering coefficient at the global level is C = 0.3590. This measure suggests that |T| = 2700 accounts for approximately 35.9% of all triangles constructed in this network. If we focus just on the degree component, we see that nodes with a high degree have an increased risk and premium. However, the more neighbors a node has, the less successful it is in spreading the disease. By including the clustering structure of neighbors in the model, the premium for nodes of the same degree may be rendered in-homogeneous.

On large networks, the simulation complexity increases significantly and takes ample time. Because of these conditions, we modified the transmission parameters in the simulation of a real network. We dropped the infection rate to ε = 0.05 and boosted the recovery rate to δ = 10 for each node. The modification implies that the average time to infection of a device due to clicking on malicious emails has grown to 20 days. The average time-to-recovery of a device has increased to 2.4 hours. Parameters are chosen based on the assumption that the security system for each device is more robust and the ability to recover is faster in a large company. We compare the computations with and without the inhibitory function to demonstrate the influence on premiums. n_sim = 2000 was used in the calculations to account for simulation convergence.

We chose ten users from a total of 143 to highlight the significance of the findings. The node is selected based on its degree, the overall clustering coefficient of its neighbors, and its location. Table 4 summarizes the ten nodes chosen, along with the parameters that impact the premium. The nodes correspond to the degrees from greatest to lowest. Two nodes with the same degree, namely, node 3 and node 9, were chosen to demonstrate the influence of their local clustering coefficients of neighbors. As expected, nodes with a high degree also have a high total C. However, it does not occur on all nodes. For instance, node 136 with degrees 17 and node 17 with degrees 30 have the same total C. Nodes 95 and 48 have a lower total clustering coefficient than node 136 due to their degrees 23 and 20. This measure incorporates both degrees and the local clustering coefficient. Thus, nodes with the same degree do not always have the same premium as those in Table 2 or prior studies by Xu and Hua (2019) [19] and Antonio and Indratno (2021) [26].

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 4. Ten nodes were chosen from a total of 143 nodes.

They were selected based on their degree and uniqueness of behavior.

https://doi.org/10.1371/journal.pone.0258867.t004

At various rates, the inhibitory action reduces the effectiveness of infections. Quadratic functions have the highest overall value, followed by linear and exponential functions. Policy underwriters can choose these functions based on indications of cybersecurity or network requirements. For instance, the speed of data transmission is decreasing if they have a long route. To obtain a more accommodating premium for network features, we use the function resulting in a more realistic premium change than would be obtained without the clustering structure component.

The premium simulation results and 95% confidence intervals for each of the ten selected nodes are shown in Table 5. Additionally, high-degree nodes pose a high threat. The most expensive premium is provided by node 105, which has the highest degree 42. The premium associated with the clustering coefficient demonstrates a shift by offering a lower price. Three functions quadratic, linear, or exponential are all adaptations of the function, with the faster-shrinking function resulting in reduced premiums. At nodes 3 and 9, the importance of the results is immediately apparent. Both nodes have a degree of 12. Without regard for the clustering arrangement, these two nodes offer the identical premium of 2.9. (currency unit). However, after adapting to the clustering structure of its neighbors, node 3 provides a lower price. These findings are consistent with the fact that node 3 has a lower total clustering inhibition function than node 4. This approach is successful because it takes the metric under consideration so that the premium is dependent on both the degree and the clustering structure.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Table 5. The premium of the ten selected nodes.

Premiums and confidence intervals (CI 95%) for selected nodes without clustering functions, and with clustering functions (quadratic, linear, exponential).

https://doi.org/10.1371/journal.pone.0258867.t005

The premium with the quadratic function produces a minor change, whereas the exponential function produces the most difference. Additionally, the resultant premium supports the overall result of the neighbor clustering function (TN), which lowers as the function becomes quicker. The total clustering inhibition function of neighbors, which combines the degree and local clustering coefficient, is the crucial metric of a network for calculating the premium with this approach.

Fig 12 illustrates the premium findings in the confidence interval plot. The top position of each node is always determined by the premium without the clustering coefficient, followed by the quadratic inhibition function. The exponential gives the most change of premiums. The nodes have been arranged according to their degree. In general, there are still impacts of degree, although this is not the only impact. At nodes 9 and 3, which have the same degree, both premiums and improvements using the clustering effect are different.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 12. Premium comparison for ten selected nodes.

Confidence interval plot with 95% CI without and with clustering coefficients.

https://doi.org/10.1371/journal.pone.0258867.g012

Additionally, the figure depicts how premium fluctuations become more significant as risk grows. The disparity between premiums with and without clustering coefficients is more critical at node 105 with the highest premium than at other nodes with lower premiums. When applied to very high-risk instances, this condition requires an adjustment factor to guarantee that the premium remains enough to cover future risks.

We provide premiums for 143 nodes to confirm the overall results. Premium boxplots of 143 nodes without and with clustering coefficients are shown in Fig 13. The boxplot findings corroborate the evidence of an improvement in the premium price model with the clustering structure. Each range of boxplots decreases when the model without CC is replaced with the model with CC using quadratic, linear, and exponential functions. Similarly, an outlier in each boxplot, namely, the best premium, shows that each function decreases.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 13. Boxplot of premium comparison of control variables (without CC).

Boxplot considers without CC and with CC (quadratic, linear, exponential).

https://doi.org/10.1371/journal.pone.0258867.g013

In aggregate, Fig 14 is a combination of a confidence interval plot and a bar plot depicting a network’s premiums (a total of 143 nodes). These findings also corroborate earlier findings that the presence of a clustering structure might lower premiums. With clustering coefficients, the premiums for quadratic, linear, and exponential functions fell by 2.99%, 8.07%, and 11.78%, respectively. Thus, the overall premium generated by the inhibition function is lower than the premium without the clustering structure.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 14. Bar plot and confidence interval plot of premiums for the whole network.

Comparison of the total premium (one network premium) in the absence and presence of CC. The text in the bar plot represents the percentage of premium modifications made to the premium without clustering coefficients for each quadratic, linear, and exponential inhibition function.

https://doi.org/10.1371/journal.pone.0258867.g014

Fig 15 shows the linear correlation between degrees (deg), the total clustering coefficient functions of neighbors (F. QUA, F. LIN, F. EXP), the premium without clustering coefficient (P), the premiums with a linear function (P. LIN), a quadratic function (P. QUA), and an exponential function (P.EXP). Degree, F. QUA, F. LIN, and F. EXP are highly correlated because they are the sum of local clustering coefficients from neighboring nodes. The distinction is in the scale of the adjacency matrix of the model. The value is now between zero and one (in the range of C and f(C)). The correlation between premiums is extremely strong, with values greater than 0.9. Premiums with local clustering coefficients are used to compensate without clustering coefficients. The correlation between premiums and degree (Deg), F. QUA, F. LIN, and F. EXP decreased from P, P. QUA, P. LIN, and P. EXP sequentially. The more quickly the clustering function decays, the stronger the connection between the premium and the inhibition function. This result means that the inhibitory function chosen affects this relationship.

Download:

• PPT
  PowerPoint slide
• PNG
  larger image
• TIFF
  original image

Fig 15. Premium correlation plot.

Correlation between degrees (Deg), the total local clustering coefficient (Total C), the premium without CC (P), the premium with a quadratic function (P. QUA), the premium with a linear function (P. LIN), and the premium with an exponential function (P.EXP).

https://doi.org/10.1371/journal.pone.0258867.g015