## 4 Analytical Results
### Unit Traffic Patterns Extracted by One/Two-Stage Clustering  
Figure 5 shows the number of unit traffic patterns extracted using one- and two-stage clustering in red and blue, respectively. A larger number of unit traffic patterns was extracted by two-stage clustering than by one-stage clustering, except when the unit of time was set at 600 s. In addition, the number of unit traffic patterns extracted using two-stage clustering varied significantly depending on the length of the unit time. Figures 6 and 7 show the cluster features of the unit traffic patterns extracted using one- and two-stage clustering using radar charts, respectively. Comparing these two figures, although some types of characteristic shapes can be extracted, there were several overlapping  
Figure 4: Mechanism for transforming IoT traffic into time series representation with unit traffic patterns. Unit traffic patterns extracted using clustering on the cloud server are sent to gateway routers, and IoT traffic is transformed into a time-series representation that is a series of unit traffic numbers. Figure 5: Number of unit traffic patterns extracted using one- and two-stage clustering. A larger number of unit traffic patterns was extracted by two-stage clustering than by one-stage clustering when the unit of time was set to 30, 60, 120, 300, and 900 s. The amount of unit traffic patterns extracted using the two-stage clustering varied greatly depending on the length of the unit of time. parts in the radar charts when the two-stage clustering was used. Since the overlap of shapes in the radar chart indicates the similarity of features, two-stage clustering tends to redundantly extract unit traffic patterns with similar features. In contrast, while it could be considered that the one-stage clustering can extract the minimum number of unit traffic patterns necessary to express the features of IoT traffic in several cases, these patterns may appear overly simplistic, since all 10 feature values are solely classified as large or small. Figures 8 and 9 show the frequency distributions of the Euclidean distances of the feature values of each divided traffic data piece (i.e., representative vector) from the cluster features of the unit traffic corresponding to that data piece (i.e., cluster centroid) for one- and two-stage clustering, respectively. These two figures show that the spread of the distance distributions for two-stage clustering was narrower than that for one-stage clustering. Table 2 lists the statistical data of the Euclidean distances shown in Figures 8 and 9. The left  
Figure 6: Cluster features of unit traffic patterns extracted using one-stage clustering. Figure 7: Cluster features of unit traffic patterns extracted using two-stage clustering. column of Table 2 presents the four statistical metrics: the average, maximum, minimum, and variance in distances from the corresponding cluster features when the unit time was 120 s. For two-stage clustering, all the metrics were significantly smaller than those for one-stage clustering. Thus, two-stage clustering can be used to classify segmented traffic data with similar characteristics. The right column of Table 2 presents the metrics at all the settings of the unit of time. The average and maximum distances were greater for the two-stage clustering. Although the minimum distance of two-stage clustering was less than that of one-stage clustering, this does not indicate poor clustering performance when the number of unit traffic patterns extracted using one- and two-stage clustering is considered. According to the results regarding the Euclidean distances of the traffic data pieces from the corresponding cluster centroids, two-stage clustering can extract unit traffic patterns with different characteristics and is less likely to misclassify traffic patterns with different features into the same unit traffic pattern.