# Understanding Urban Behavior: Information Theory Insights from WhatsApp Traffic Analysis

Geymerson S Ramos, Razvan Stanica, Osvaldo A Rosso, Andre L L Aquino

► To cite this version:

Geymerson S Ramos, Razvan Stanica, Osvaldo A Rosso, Andre L L Aquino. Understanding Urban Behavior: Information Theory Insights from WhatsApp Traffic Analysis. ICC 2025 - IEEE International Conference on Communications, Jun 2025, Montreal, Canada. pp.7140-7145, 10.1109/ICC52391.2025.11161829. hal-05118743

HAL Id: hal-05118743

https://hal.science/hal-05118743v1

Submitted on 18 Jun 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Understanding Urban Behavior: Information Theory Insights from WhatsApp Traffic Analysis

Geymerson S. Ramos

Inria, INSA Lyon
CITI, UR3720

Villeurbanne, France

geymerson.ramos@inria.fr

Razvan Stanica

INSA Lyon, Inria
CITI, UR3720

Villeurbanne, France

razvan.stanica@inria.fr

Osvaldo A. Rosso

Federal University of Alagoas
Physics Institute

Maceio, Brazil

oarosso@laccan.ufal.br

Andre L. L. Aquino

Federal University of Alagoas
Computing Institute

Maceio, Brazil

alla@orion.ufal.br

**Abstract**—Instant messaging represents the most popular digital service worldwide, and WhatsApp is the most used app of this kind. By studying WhatsApp traffic, we can gain major insight into both human behavior and network infrastructure needs. This work presents a unique analysis of mobile networks using WhatsApp uplink traffic. We apply information theory metrics such as Shannon Permutation Entropy, Statistical Complexity, and the Causality Complexity-Entropy Plane to understand specific network patterns, usage behaviors, and areas where users are more likely to engage in online conversations. We also demonstrate how these metrics can be used as features for machine learning techniques such as the K-means algorithm, showing they can be used to identify regions with similar patterns in the WhatsApp network traffic.

**Index Terms**—Mobile Data Analysis, WhatsApp, Information Theory, CDR.

## I. INTRODUCTION

Messaging has transitioned from a simple tool for personal communication to a critical component in the broader societal fabric. Applications like WhatsApp, WeChat, Messenger, and Telegram are used today for business purposes and institutional communication. Analyzing messaging traffic is important for (at least) two different reasons. First, as one of the most used services in the world, it can guide us towards a deeper understanding of human behavior. Especially considering that WhatsApp presents the most urbanized usage among major mobile apps [1], studying this traffic can bring unprecedented insight into the understanding of urban behavior and human mobility. In this sense, previous works [2] had fairly good success in addressing route prediction by leveraging routine tasks to find common patterns in users mobility, but the infinity of unique events that can happen in a person's daily life can put any theoretical model to the test.

A second reason to analyze messaging traffic comes from the possible improvements this can bring to the design and deployment of mobile networks. While messaging traffic does not have major constraints in terms of quality of service (QoS), it has interesting properties from a network point of view. Most importantly, we note the fact that instant messaging originates as uplink traffic, and it is then distributed, possibly to multiple users in a group, on the downlink. Understanding when and

where this traffic appears, and studying its typical patterns, can help mobile operators better plan and control their networks, especially on the uplink side.

Our study focuses on the most popular messaging application worldwide, WhatsApp, and analyzes it through an original mix of information theory metrics: the Shannon Permutation Entropy, and the Statistical Complexity, in order to explore the following hypothesis: “Is it possible to characterize, based on information theory, specific areas where users are more likely to engage in online conversations?”. A key motivation for employing these metrics in the objective of land use detection and characterization is their heightened sensitivity and capacity to handle the substantial volume of network traffic data. These methods enable more precise segmentation of extensive regions with distinct characteristics associated with leisure, commercial, and indoor activities.

We build on a unique dataset covering the entire urban area in Lyon, France, collected in the Orange 4G network [3]. As far as our knowledge goes, this is the first large-scale study oriented on WhatsApp user behavior. The Causality Complexity-Entropy Plane representation allows us to conduct an in-depth spatio-temporal analysis, extracting typical traffic patterns in terms of WhatsApp traffic demand. Our main contributions can be summarized as follows: i) We propose an original information theory approach for mobile data analysis. From our knowledge, we are the first to apply these techniques in the general context of mobile network data; ii) We study WhatsApp traffic in one of the largest European metropolitan areas, using data representing more than 1M users. This is the first study of an instant messaging application at this scale; iii) We conduct a detailed spatio-temporal analysis, which allows us to extract typical patterns, both for specific times and specific places.

The remainder of this paper is structured as follows: Sec. II presents related work. We discuss our methodology in Sec. III and the data used in our analysis in Sec. IV. Sec. V and Sec. VI present the results of our information theory-based data analysis, before concluding remarks in Sec. VII.

## II. RELATED WORK

WhatsApp, the world's leading messaging application, has been studied in various settings. Montag et al. [4] found

<footnote>This work was partially funded by the ANR COCO5G (ANR-22-CE25-0016) project.</footnote>
that younger people, females, lower education levels, and extroverts use WhatsApp more. Interviews in [5] compare WhatsApp with SMS, noting that WhatsApp is favored for cost and group community, while SMS is seen as providing better privacy. In [6], WhatsApp messages were used in high school education, with positive feedback and improved learning outcomes reported.

However, all these studies are conducted on relatively small-scale groups, with hundreds or thousands of users. Using mobile phone data from operators can extend these analyses to millions of users in the same area. Nevertheless, few studies consider WhatsApp traffic in their analysis. Singh et al. [1] examined mobile phone usage differences between urban and rural areas, highlighting WhatsApp as the most urbanized service among the 13 studied services. Ucar et al. [7] explored socio-economic factors affecting 40 mobile services, finding that, unlike a small-scale study in Germany [4], WhatsApp usage in France correlates with higher education levels.

In the networking community, most of the studies oriented on WhatsApp try to extract information from the encrypted traffic transported by the application. In this context, Ramraj et al. [8] conduct a packet-level analysis revealing patterns that allow distinguishing between the read and unread status of messages. Similarly, Cuadra et al. [9] manage to differentiate between packets transporting WhatsApp voice calls and other activities like video sharing, photo sharing, or text messages. Finally, Karpisek et al. [10] focus on observing signaling messages and manage to detect WhatsApp call termination messages and extract information such as the call duration.

Fiadino et al. [11] analyze WhatsApp traffic alongside external data to examine network architectures and the nature of transferred data. Seufert et al. [12] focus on group-based communication on WhatsApp, combining traffic analysis and surveys. They propose a WhatsApp group communication model based on a semi-Markov process, capable of generating network traffic resembling real group messaging.

Unlike these studies, our work is the first to analyze WhatsApp traffic on the scale of a large urban area, utilizing entirely original metrics derived from information theory.

### III. INFORMATION THEORY QUANTIFIERS

The analysis performed in this paper uses two information theory metrics: Shannon Permutation Entropy and Statistical Complexity. These metrics help identify patterns or anomalies in network traffic. For example, a sudden entropy increase may indicate unusual activities, such as unexpected user presence or atypical messaging.

#### A. Bandt-Pompe Method and Shannon Permutation Entropy

Before detailing the Shannon permutation entropy, we need to discuss the Bandt-Pompe method [13]. This methodology provides a tool for characterizing the structure and complexity of time series data, revealing underlying patterns that may not be apparent through conventional analysis methods. Consider the time series $X = \{x_1, x_2, ..., x_{(T-1)}, x_T\}$, of size $|T|$, the embedding dimension $D = \{n | n \in \mathbb{N}\}$, and the embedding

delay time $\tau \in \mathbb{N}$, which controls the number of time periods between the elements of each $D$-dimensional column in the matrix $V \in \mathbb{R}^{D \times k}$, defined as:

$$V = \begin{bmatrix} x_1 & x_2 & \cdots & x_k \\ x_2 & x_3 & \cdots & x_{(k+1)} \\ \vdots & \vdots & \ddots & \vdots \\ x_D & x_{D+1} & \cdots & x_T \end{bmatrix} \quad (1)$$

The matrix $V$ represents the one-dimensional time series $X$ as a state space, where each column forms $D$-dimensional vectors mapped into unique permutations, so-called ordinal patterns. To match the time series complexity of length $|T|$, $D$ should be chosen properly, with $(3 \le n \le 7)$ recommended [13]. For columns $C = \{c_1, c_2, ..., c_k\}$, each column $c_1 = (x_1, x_2, ..., x_D)$, $c_2 = (x_2, x_3, ..., x_{D+1})$, etc., is mapped into a set of unique ordinal patterns, based on the relative values of $x_i$: the lowest value in a column corresponds to an ordinal value of 0, the second lowest to 1, etc. Practically, for $D = n$, there are $n!$ possible patterns representing all the permutations of the values $v = \{0, 1, ..., (D-1)\}$. For example, if $D = 3$, there are $3! = 6$ unique ordinal patterns, where the possible values of an ordinal pattern $\pi$ are:

$$\pi = \{(0, 1, 2), (0, 2, 1), (1, 0, 2), (1, 2, 0), (2, 0, 1), (2, 1, 0)\}$$

To showcase the mapping of $V$ into these ordinal patterns, we will use an example similar to Bandt-Pompe [13], in which $X_e = \{3, 4, 5, 6, 4, 7, 2\}$. When verifying the relative values of the elements $x$, the columns $c_1 = (3, 4, 5)$ and $c_2 = (4, 5, 6)$ are represented by the permutation $\pi_1 = (0, 1, 2)$ because both follow the ascending order $x_t < x_{t+1} < x_{t+2}$. Columns $c_3 = (5, 6, 4)$ and $c_5 = (4, 7, 2)$ correspond to $\pi_4 = (1, 2, 0)$ because $x_{t+2} < x_t < x_{t+1}$, while $c_4 = (6, 4, 7)$ is represented by $\pi_3 = (1, 0, 2)$, as $x_{t+1} < x_t < x_{t+2}$. By counting the occurrences of each permutation, we can compute the relative frequency according to Equation (2).

$$p(\pi) = \frac{\#\{t | t \le (T - D + 1), t \text{ has type } \pi\}}{T - D + 1} \quad (2)$$

The relative frequency $p(\pi)$ of the ordinal pattern $\pi$ is given by the number of times (#) the ordinal pattern is found in the time series, divided by the total number of ordinal patterns of the same time series. In the previous example, $X_e$ has $T = 7$ elements and $D = 3$, which results in $p(\pi_1) = 2/5$, $p(\pi_3) = 1/5$, and $p(\pi_4) = 2/5$. Knowing the relative frequencies of the ordinal patterns is a crucial step preceding the computation of the Shannon permutation entropy, defined as $S(n) = - \sum p(\pi) \ln p(\pi)$. For the chosen $D = n$, the values of $S(n)$ are computed by iterating over all $n!$ permutations $\pi$ to quantify the information from comparing $n$ successive values in the time series.

In a very predictable and well-behaved system, such as an increasing or decreasing sequence of values, $S(n) \approx 0$, categorizing a state of minimal entropy and maximum information. As for a totally random system (independent and identically distributed sequence), $S(n) \approx \ln(n!)$, and every one of the $n!$ potential permutations occurs with equal likelihood, following
a uniform probability distribution. Considering the maximum entropy $S(n) = \ln(n!) = S_{max}$, we can define the normalized Shannon permutation entropy $H_s(n) = \frac{S(n)}{\ln(n!)} = \frac{S(n)}{S_{max}}$, such that $0 \le H_s(n) \le 1$.

## B. Statistical Complexity

The Statistical Complexity metric aims to quantify the structure or patterns present in a system, combining both randomness and determinism in a single measure. It goes beyond mere disorder, captured by entropy, by also considering how much structure or correlation is present in the data. In the context of network traffic analysis, it can be a powerful tool for understanding user behavior and detecting anomalies.

Considering an arbitrary variable $X$, with a probability distribution $P$, the method proposed by López-Ruiz et al. [14] considers the normalized Shannon permutation entropy $H[P]$ and the disequilibrium $D[P]$, defined in Equation (3), to compute the Statistical Complexity $C_{LMC}[P] = H[P]D[P]$, which quantifies the distance between the probability distribution $P$ and the uniform probability distribution $P_e$. In practical terms, if the observed variable $X$ has a probability distribution $P = P_e$, $D[P] = 0$, and any event can occur with the same probability $p_i = 1/N$, which means full randomness, a state of minimal statistical complexity and minimal information.

$$D[P] = \sum_{i=1}^{N} \left( p_i - \frac{1}{N} \right)^2 \quad (3)$$

Lamberti et al. [15] extended the metric proposed by López-Ruiz et al. [14] by replacing the quadratic Euclidean distance $D[P]$ between probability distributions. Their Statistical Complexity $C_{JS}$, defined in Equation (4), considers the normalized Shannon permutation entropy $H[P]$, and the Jensen-Shannon disequilibrium measure $Q_{JS}$, which is the distance between a given probability distribution $P$ and a reference (equilibrium) distribution $P_e$. According to the authors, their formulation can grasp essential details of the dynamics of the observed variables, and discern among different degrees of periodicity.

$$C_{JS}[P] = H[P]Q_{JS}[P, P_e] \quad (4)$$

The Jensen-Shannon disequilibrium measure $Q_{JS}$, as described in Equation (5), is regulated by the normalization constant $Q_0$, which is equal to the inverse of the maximum possible value of the Jensen-Shannon divergence $J_S[P, P_e]$, an information-theoretical-based divergence measure originally introduced by Lin [16]:

$$Q_{JS}[P, P_e] = Q_0 J_S[P, P_e] \\ = Q_0 \left\{ S \left[ \frac{P + P_e}{2} \right] - \frac{S[P] + S[P_e]}{2} \right\} \quad (5)$$

## C. Causality Complexity-Entropy Plane

Rosso et al. [17] introduced the Causality Complexity-Entropy Plane (CCEP) to evaluate systems using the quantifiers $H_S$ and $C_{JS}$. The CCEP serves as a tool to categorize chaotic and stochastic behaviors in time series by capturing permutation quantifier patterns. It plots $C_{JS}$ on the vertical

axis and $H_S$ on the horizontal axis, with $C_{JS}$ values ranging from $C_{JS}^{min}$ to $C_{JS}^{max}$ for a given $H_S$. The concept of "causality" is incorporated by analyzing temporal relationships between consecutive samples using the probability distribution $P = p(\pi)$, calculated via the Bandt-Pompe method. By examining $H_S$ and $C_{JS}$ on the CCEP, systems can be categorized, such as noises with a $f^\beta$ power spectrum [18]. Regular systems show low $H_S$ and $C_{JS}$, while uncorrelated stochastic systems approach high entropy $H_S \approx 1$ and low complexity $C_{JS} \approx 0$, resembling ideal noises ($\beta = 0$ and $\beta = 1$) [17].

## IV. DATASETS

We analyzed the NetMob23 dataset [3], which contains daily mobile network traffic linked with spatial data for the Lyon metropolitan area, covering 77 days from March 16 to May 31, 2019. We also generated a noise-infused traffic dataset to compare real-world traffic behavior with random models. The dataset structure and processing methods are detailed in the following subsections.

<figure><img src="image_2.png" /><figcaption>Fig. 1. Example of a region divided by a grid of tiles. Each tile covers an area of $(100 \times 100)m^2$ that is associated with daily network traffic.</figcaption></figure>

### A. Spatial Dataset

The spatial region of interest is represented by the Lyon metropolis, in France. The data provided in the NetMob dataset is organized in a total of 54013 tiles for this region, and their location data are stored in a GeoJSON file considering the WG84 coordinate system. Each tile is one square cell that covers an area of 100m x 100m, as illustrated in Fig. 1.

### B. Network Traffic Dataset

The dataset contains uplink and downlink data for 68 different mobile applications, formatted as [Tileid, x00:00,..., x23:30, x23:45], where Tileid is a unique tile, and xhh represents traffic volume for each 15-minute interval. This study focuses on WhatsApp uplink traffic to analyze active user interactions. The WhatsApp uplink traffic distribution across Lyon is shown in Fig. 2.

### C. 1/f-noise datasets

We generated synthetic noise datasets with varying power spectral densities (PSDs). Matching our real-world data structure, each dataset contains 77 time series with 96 samples
<figure><img src="image_3.png" /><figcaption>Fig. 2. Log normalized WhatsApp uplink network traffic for the timestamps 00:00, 06:00, 12:00, 18:00, on March 16th, 2019, Lyon metropolitan area.</figcaption></figure>

representing 24-hour periods divided into 15-minute intervals. The datasets were generated for different noise types, characterized by their spectral density scaling exponent $\beta$ (e.g., pink and Brownian noise). Using the inverse Fast Fourier Transform (iFFT), we converted spectrally-defined signals from the frequency to the time domain, applying a PSD proportional to $1/f^\beta$ with random phases to achieve the desired characteristics.

### D. General Trends

We can derive valuable insights from an initial exploratory data analysis of our dataset. Fig. 3 shows the average traffic time series $\bar{X}$ for each day across all 54,013 tiles in Lyon. The average network traffic (unitless in the dataset) at any given time is represented by $\bar{x}_{hh:mm}$. As expected, activity increases during the day, with traffic rising around 6:00. Network activity is high from 10:00 to 22:00, then declines, likely aligning with typical bedtimes. Weekends see increased WhatsApp traffic, with a delayed rise starting around 7:00. On Friday and Saturday nights after 22:00, there is a rise in usage, indicating later bedtimes compared to other days.

<figure><img src="image_4.png" /><figcaption>Fig. 3. The average WhatsApp traffic time series for each day, considering all the tiles in the Lyon metropolitan area.</figcaption></figure>

## V. INFORMATION THEORY DATA ANALYSIS

In this section, we compute the metrics previously described in Sec. III, using the data presented in Sec. IV. To understand

whether our metrics can also be used to extract information at the tile level, we organize the tiles based on their daily average traffic, and subsequently, we compute the $H_s$ and $C_{JS}$ values. The input time series for each tile $t$ is given by $X_t = \{X_{d1} \cup X_{d2} \cup \dots \cup X_{dn}\}$, which is the concatenation of the tile time series, chronologically, considering the timestamps from 06:00 to 23:45. We build four categories of tiles based on their WhatsApp traffic load: i) low (belonging to the first quartile in terms of traffic), ii) medium (second quartile), iii) high (third quartile), and iv) very high (fourth quartile). Fig. 4(a) presents the CCEP plot for the tiles in the 1st quartile. The colour of each point represents the normalized WhatsApp traffic for this specific category of tiles. We also plot the values of the $1/f^{\beta-}$ noise function for $\beta = \{0.5, 1, 1.5, 2, 2.5, 3\}$ as a means of comparing the network dynamics with well-known models.

In Fig. 4(a), tiles with low average traffic are dispersed across the CCEP plane. As traffic increases, tiles display chaotic behavior with $H_s \approx 1$ and $C_{JS} \approx 0$ (Fig. 4(d)), resembling the randomness of ideal noises at $\beta = 0.5$. This implies a decline in information and predictability of the network traffic time series. However, it would be incorrect to assume network randomness directly correlates with traffic volume. This high entropy and low complexity result from diverse WhatsApp user behavior, where asynchronous texting reduces predictability and information. In Fig. 4(b), some tiles with higher network traffic show lower $H_s$ and $C_{JS}$. In an ideal scenario of maximum predictability, if a tile has high but constant traffic (with zero or very few underlying patterns), then $H_s \approx 0$ and $C_{JS} \approx 0$.

## VI. CLUSTERING ANALYSIS

In this part, we aim to explore the potential for clustering tiles by utilizing the network traffic time series and their ordinal patterns. This approach is expected to uncover underlying usage behaviors and identify similarities among specific regions within the Lyon metropolitan area.

### A. Classes from External Information

We categorized tiles within a 30-meter range from labeled areas in Lyon using public data [19], resulting in the following classes: C1) Education Centers (208 tiles); C2) Events (74
<figure><img src="image_5.png" /><figcaption>Fig. 4. The CCEP planes, considering $D = 6$, $τ = 1$, for tiles with low (a), medium (b), high (c), and very high (d) average network traffic per day in the Lyon metropolitan area.</figcaption></figure>

tiles); C3) Commerce (67 tiles); C4) Hotels (58 tiles); C5) Sports (57 tiles); C6) Restaurants (51 tiles); C7) Religious Centers (41 tiles); C8) Hospitals (31 tiles); C9) Train Station (5 tiles). The objective of this categorization approach is to group tiles that exhibit similar urban features, derived from the daily activities of individuals present in these areas. For each class, we calculated the average weekday uplink traffic, shown in Fig. 5.

<figure><img src="image_6.png" /><figcaption>Fig. 5. The average uplink traffic during Weekdays for the tile classes.</figcaption></figure>

The *Train Stations* class (C9) has the highest average uplink traffic, peaking around 18:00, reflecting the evening commute. In the CCEP plane (Fig. 6), *Train Stations* show lower permutation entropy and higher statistical complexity than the *Commerce* class (C3). This may be because train stations have structured, predictable patterns as people arrive and leave stations at specific and somehow controlled times every day. The *Commerce* involves varied businesses with diverse customer routines and no fixed schedules. Additionally, spatial factors may influence behavior, and the *Commerce* class covers more tiles, widely distributed.

## B. K-Means Clustering

We employed the K-means algorithm [20], using the Euclidean distance metric, to the input vector defined as $\vec{H}_S = \{h_{00:00}, h_{00:15}, ..., h_{23:45}\}$. In this particular case, we have a vector of network traffic values $x_{hh:mm}$, for the same timestamp across different days, arranged chronologically. This vector is utilized to compute the permutation entropy $h_{hh:mm}$, which composes the vector of entropy values calculated for each timestamp, as illustrated in Fig. 7. As a result, we can make interpretations such as: if a tile $t$ has high permutation

<figure><img src="image_7.png" /><figcaption>Fig. 6. CCEP for the tiles classes, considering the average uplink traffic time series in Weekdays ($D = 4, τ = 1$).</figcaption></figure>

entropy at 14:00 ($h_{14:00} = 0.96$), it means the traffic is highly unpredictable, making it difficult to forecast demand at that specific time. In contrast, low or moderate permutation entropy indicates stability and predictability, often reflecting consistent user behaviors, such as regular commuting patterns. Results from this method, as shown in Fig. 8(a), demonstrate better spatial consistency and tile clustering compared to a standard time-series input method. The clustering results in Fig. 8(b) were obtained using the feature vector $\vec{H}_{S_{id}} = \{h_{S1}, ..., h_{Sτ}\}$, which consists of seven entropy points calculated from the concatenated network traffic time series for each day of the week (i.e., all Sundays, all Mondays, etc.).

<figure><img src="image_8.png" /><figcaption>Fig. 7. Entropy vector $\vec{H}_S$, computed considering sequences of traffic values at for each timestamp.</figcaption></figure>
<figure><img src="image_9.png" /></figure>

<figure><img src="image_10.png" /></figure>

<figure><img src="image_11.png" /><figcaption>Fig. 8. Results for the tile clustering with K-means, Euclidean distance metric, *k* = 100, with different feature vectors as input.</figcaption></figure>

We selected some clusters obtained with the feature vector $\ddot{H}_S$ and observed the typical network traffic in their geographic locations. Fig. 9 illustrates two locations in the Lyon metropolitan area, namely: Groupama Stadium in Fig. 9(a), used for sports and entertainment; and Lyon-Bron Airport in Fig. 9(c), primarily serving business and general aviation. For each of the mentioned places, we computed the average time series for tiles of each cluster, illustrated respectively in Figs. 9(b) and 9(d). Grouping tiles with similar permutation entropy and statistical complexity per timestamp formed clusters with similar network traffic patterns and spatial correlation. These clusters show different time series signatures, revealing traffic changes throughout the day. For Groupama Stadium, the standard deviation closely matches the average traffic, indicating similar time series shapes across tiles. The area shows a traffic peak at 2:00, reflecting nighttime activity, and a spike between 20:00 and 23:00, coinciding with typical evening events like soccer matches and concerts.

<figure><img src="image_12.png" /><figcaption>(a) Cluster 1: Groupama Stadium.</figcaption></figure>

<figure><img src="image_13.png" /><figcaption>(b) Groupama Stadium time series.</figcaption></figure>

<figure><img src="image_14.png" /><figcaption>(c) Cluster 2: Lyon-Bron Airport.</figcaption></figure>

<figure><img src="image_15.png" /><figcaption>(d) Lyon-Bron Airport time series.</figcaption></figure>

<caption>Fig. 9. Example of clusters (and their network traffic time series) within the Lyon metropolitan area.</caption>

## VII. CONCLUSION AND FUTURE WORK

This work presents a network traffic analysis using WhatsApp uplink traffic. We relied on information theory metrics, such as Shannon Permutation Entropy, Statistical Complexity, and the Causality Complexity-Entropy Plane to understand

specific network patterns, usage behavior, and areas where users are more likely to engage in online conversations. We also demonstrated how these metrics could be used as features for machine learning techniques, such as the K-means algorithm, and we were able to observe their feasibility in identifying regions with similar network traffic. For future work, we intend to explore other metrics, such as Statistical Complexity and Fisher Information, as input features, propose categorizations for the identified groups, and study points of interest by applying these metrics.

## REFERENCES

[1] R. Singh, M. Fiore, M. Marina, A. Tarable, and A. Nordio, "Urban Vibes and Rural Charms: Analysis of Geographic Diversity in Mobile Service Usage at National Scale," in Proc. ACM TheWebConf, 2019, pp. 1724-1734.

[2] C. Song, Z. Qu, N. Blumm, and A.-L. Barabási, "Limits of predictability in human mobility," Science, vol. 327, no. 5968, pp. 1018-1021, 2010.

[3] O. E. Martínez-Durive, S. Mishra, C. Ziemlicki, S. Rubrichi, Z. Smoreda, and M. Fiore, "The NetMob23 dataset: A high-resolution multi-region service-level mobile data traffic cartography," https://doi.org/10.48550/arXiv.2305.06933, 2023.

[4] C. Montag, K. Blaszkiewicz, B. Lachmann, I. Andone, B. Trendafilov, M. Eibes, and A. Markowets, "Smartphone Usage in the 21st Century: Who is Active on WhatsApp?" BMC Research Notes, vol. 8, no. 331, 2015.

[5] K. Church and R. De Oliveira, "What's up with WhatsApp?: Comparing Mobile Instant Messaging Behaviors with Traditional SMS," in Proc. ACM MobileHCI, 2013, pp. 352-361.

[6] L. Cetinkaya, "The impact of whatsapp use on success in education process," International Review of Research in Open and Distributed Learning, vol. 18, no. 7, pp. 59-74, 2017.

[7] I. Ucar, M. Gramaglia, M. Fiore, Z. Smoreda, and E. Moro, "News or social media? socio-economic divide of mobile service consumption," Journal of the Royal Society Interface, vol. 18, no. 350, 2021.

[8] S. Ramraj and G. Usha, "Signature identification and user activity analysis on WhatsApp web through network data," Microprocessors and Microsystems, vol. 97, p. 104756, 2023.

[9] A. Cuadra-Sanchez and J. Aracil, "A novel blind traffic analysis technique for detection of WhatsApp VoIP calls," International Journal of Network Management, vol. 27, no. 2, p. e1968, 2017.

[10] F. Karpisek, I. Baggili, and F. Breitinger, "WhatsApp network forensics: Decrypting and understanding the WhatsApp call signaling messages," Digital Investigation, vol. 15, pp. 110-118, 2015.

[11] P. Fiadino, M. Schiavone, and P. Casas, "Vivisecting whatsapp in cellular networks: Servers, flows, and quality of experience," in Proc. IFIP TMA, 2015, pp. 49-63.

[12] M. Seufert, A. Schwind, T. Hoßfeld, and P. Tran-Gia, "Analysis of group-based communication in WhatsApp," in Proc. EAI MONAMI, 2015, pp. 225-238.

[13] C. Bandt and B. Pompe, "Permutation entropy: a natural complexity measure for time series," Physical review letters, vol. 88, no. 17, p. 174102, 2002.

[14] R. Lopez-Ruiz, H. L. Mancini, and X. Calbet, "A statistical measure of complexity," Physics letters A, vol. 209, no. 5-6, pp. 321-326, 1995.

[15] P. W. Lamberti, M. Martin, A. Plastino, and O. Rosso, "Intensive entropic non-triviality measure," Physica A: Statistical Mechanics and its Applications, vol. 334, no. 1-2, pp. 119-131, 2004.

[16] J. Lin, "Divergence measures based on the shannon entropy," IEEE Transactions on Information theory, vol. 37, no. 1, pp. 145-151, 1991.

[17] O. A. Rosso, H. Larrondo, M. T. Martin, A. Plastino, and M. A. Fuentes, "Distinguishing noise from chaos," Physical review letters, vol. 99, no. 15, p. 154102, 2007.

[18] M. S. Keshner, "1/f noise," Proceedings of the IEEE, vol. 70, no. 3, pp. 212-218, 1982.

[19] Data Grand Lyon, https://data.grandlyon.com/portail/fr/accueil, last visited on March 7, 2025.

[20] J. A. Hartigan and M. A. Wong, "Algorithm as 136: A k-means clustering algorithm," Journal of the Royal Statistical Society, vol. 28, no. 1, pp. 100-108, 1979.