## 3 IoT Traffic Analysis with Two-Stage Clustering
### Experimental Conditions  
In these experiments, \(k\)-means clustering [21] was used as the clustering method. The \(k\)-means clustering algorithm is a nonhierarchical clustering algorithm in which the number of clusters must be specified in advance, and the samples are divided into a predetermined number of clusters. It has the advantages of high computing efficiency and generality regardless of the data size. However, it is necessary to determine the number of clusters. Furthermore, the results of \(k\)-means clustering depend on the initial values of the cluster centroids, which are generally randomly determined. The procedure for \(k\)-means clustering is as follows [21]:  
1. Set \(k\) centroids of clusters randomly (initialization). The number of clusters, \(k\), must be determined in advance. 2. Traverse all data points and calculate the distances between all centroids and data points. Clusters are formed based on the minimum distance from the centroids. 3. The average value of the data in each cluster is calculated as the new cluster centroid. 4. The second and third steps are repeated until the centroids stop moving; that is, the centroids no longer change their positions and become static. In \(k\)-means clustering, the number of clusters must be determined in advance, and the appropriateness of this value should be verified. Therefore, in this paper, we used silhouette analysis [22] as a metric to evaluate the validity of the number of clusters. Silhouette analysis is based on the silhouette coefficient in which a data point \(x_{i}\) classified into cluster \(C_{in}\) is calculated, which is defined as follows:  
Figure 2: Mechanism for transforming IoT traffic into time series representation using unit traffic patterns. The unit traffic patterns resulting from the second clustering are sent back from the cloud server to the gateway routers. After comparing the results of the first and second clustering, the appropriate unit traffic numbers are assigned to all the original divided data pieces. Finally, IoT traffic will be represented by the series of unit traffic numbers as the time series representation. Calculate the average distance \(a_{i}\) between \(x_{i}\) and the other data points within \(C_{in}\) by using the following equation:  
\[a_{i}=\frac{1}{|C_{in}|-1}\sum_{x_{j}\in C_{in}}\|x_{i}-x_{j}\|. \tag{1}\]
2. Calculate the average distance \(b_{i}\) between \(x_{i}\) and all data points assigned to \(C_{near}\), which is the cluster nearest to \(x_{i}\) other than \(C_{in}\), using the following equation: \[b_{i}=\frac{1}{|C_{near}|}\sum_{x_{j}\in C_{near}}\|x_{i}-x_{j}\|.\] (2)
3. Calculate the silhouette coefficient \(s_{i}\) using \(a_{i}\) and \(b_{i}\) through the following equation: \[s_{i}=\frac{b_{i}-a_{i}}{\max{(a_{i},b_{i})}}.\] (3)  
As expressed in Equation (3), the range of \(s_{i}\) is \([-1,1]\). The clustering performance was found to be the best when \(s_{i}=1\). Meanwhile, we found that data point \(x_{i}\) may not be correctly clustered if \(s_{i}<0\). After calculating the silhouette coefficient for all data points using the aforementioned steps, the clustering performance was measured using the average value. For feature values, we selected 10 indices consisting of both sending and receiving features of the following five factors: average throughput (abbreviated as ave, particularly in figures; the same applies hereafter), maximum throughput (max), the variation coefficient of throughput (CV), the number of IP addresses (IP), and the number of ports (port) in units of time. The units of time were set at 30, 60, 120, 300, 600, and 900 s. We used the dataset captured by [PERSON] et al. on 28 September and 4 October 2016 [23], which contains the traffic data of 21 IoT devices, as summarized in Table 1.