## 3 IoT Traffic Analysis with Two-Stage Clustering
### Procedure of the Proposed Method  
Figure 1 shows an overview of the IoT traffic analysis using the proposed method. This method analyzes IoT traffic in two steps at two locations: gateway routers installed in smart homes for the first step analysis and a cloud server for the second step analysis. In the first step, the IoT traffic data are preliminarily divided into data pieces per unit of time. From the divided traffic data pieces, feature values are extracted and subsequently clustered for each IoT device at the gateway router in each smart home. This is the _first clustering_. Next, representative values are extracted from each cluster generated by the first clustering and treated as the _cluster feature_. In this paper, a representative vector composed of the averages of all the feature values in each cluster was used. Thereafter, the cluster features were sent from each gateway router to the cloud server. Thus, by avoiding sending raw traffic data and feature values of all traffic data pieces, the communication load between the gateway routers and cloud server is reduced. In the second step, the cloud server executes another clustering process using all the cluster features for all the IoT devices gathered from the gateway routers: This is the _second clustering_. The clusters extracted by the second  
clustering on the cloud server are defined as the _unit traffic_. A series of unit traffic can represent a set of elemental patterns generated by IoT devices.  
The unit traffic patterns resulting from the second clustering are sent back from the cloud server to the gateway routers. The gateway routers compare the results of the first and second clustering and thereafter assign appropriate unit traffic numbers to all the original divided data pieces. Finally, the IoT traffic is represented by a series of unit traffic numbers as a time series representation. This process is illustrated in Figure 2.  
Here, we consider the treatment of traffic data when an IoT device has no communication in terms of the unit of time. Some IoT devices tend to have long intervals between communication periods because of periodic sensing operations or passive response behaviors, particularly in response to user requests. When the traffic data generated by such IoT devices are divided into a series of data pieces according to the value of the unit of time, a significant number of data pieces do not contain any communication information, which could affect the clustering results. However, a traffic data piece without any packet transmission can be clearly and easily recognized at the stage of capturing the IoT traffic. Therefore, traffic data pieces without any communication were removed from the datasets for the first and second clusters. Meanwhile, since the no-communication state is still important for characterizing IoT traffic, we defined the traffic data piece without any communication as _zero traffic_, which is one of the units of traffic patterns.  
Figure 1: Mechanism of the two-stage clustering. Each gateway router preliminarily divides IoT traffic data into data pieces per unit of time. Some feature values are extracted from the divided traffic data pieces and then clustered for each IoT device. The cluster features are sent from each gateway router to the cloud server and clustered again. The clusters extracted by the second clustering on the cloud server are defined as the unit traffic.