Wi-Fi Usage Profiles Evolution: A First Look on a
National K-12 Education Service Provider
Germán Capdehourat, Cecilia Aguerrebere, Federica Bascans, Germán Álvarez and Pedro Porteiro
{gcapdehourat, caguerrebere, fbascans, galvarez, pporteiro}@ceibal.edu.uy
Plan Ceibal, Avda. Italia 6201, Edificio Los Ceibos, 11500, Montevideo, Uruguay.
Abstract—This paper presents the first study with real-world
traffic data from a national K-12 Education Service Provider
(ESP). This ESP, which supports a one-to-one computing pro-
gram in Uruguay, is in charge of the Wi-Fi Internet access at
all K-12 schools in the country. Network users include teachers
and students, where the latter typically range between 6 and
18 years old. In order to gain knowledge of the user behavior
in such a novel scenario, the work is focused on finding out
the typical network usage patterns and study their evolution
during the year. Based on the selected features and proper
distance measures, four main Wi-Fi usage profiles were identified
through clustering algorithms. In addition, these classes are stable
throughout the year, which makes possible to implement a Wi-
Fi activity monitoring system trained with data collected during
the first weeks of the year only. The results suggest that network
traffic analysis could benefit the ESP for evidence-based decision
making, not only from the network operator perspective, but also
providing vital information for learning analytics purposes.
Index Terms—network traffic, education, clustering, usage
profiles.
I. I NTRODUCTION
The increasing data availability, jointly with recent advances
in machine learning and big data analysis, have laid the
groundwork for several studies with datasets from real-world
Wi-Fi networks (e.g. [1], [2], [3], [4]). These studies are
typically carried out with data from Internet service providers
(ISPs) or mobile network operators (MNOs). Although many
articles refer to educational settings such as university cam-
puses, studies in K-121 scenarios are very rare. In this paper,
we analyze traffic data from Plan Ceibal [5], a major K-12
education service provider2 (ESP), which leads a nationwide
one-to-one computing program in Uruguay. This governmental
agency provides technological support to the national K-12
education system, including Wi-Fi connectivity and videocon-
ference infrastructure for all public schools, as well as access
to educational platforms.
To the best of our knowledge, this work stands out from
the previous as the first of its kind in a K-12 scenario, where
most of the users are between 6 and 18 years old. The
main Wi-Fi usage profiles at schools were analyzed, based on
unsupervised classification from the collected traffic data. For
this purpose, relevant features were extracted, and appropriate
distance measures were selected and validated, ending up in
1 Term coined to refer to primary and secondary education (from 6 to 18
years old).
2 Education service provider (ESP): Organization which helps the education
system to implement comprehensive reforms.
a clustering method to identify the main usage profiles. The
methodology developed proved to be useful to compare the
profiles found in the two available datasets, corresponding to
the beginning and the end of the school year, respectively.
The results indicate that the main usage profiles identified
were the same in both periods, with a high level of coin-
cidence. This is a remarkable result, as it means that the
categories in which the users should be classified according to
their Wi-Fi network activity, remain stable during the school
year. Based on this result, it is possible to build a Wi-Fi
activity monitoring system which can be trained with data
collected during the first weeks of the year only. Once the
system has learned the usage profiles, the categories remain
fixed, and allow to monitor the individual evolution of users
during the rest of the school year (e.g. increase or decrease in
their activity). With this information, the ESP could provide
more personalized services to teachers and students, accord-
ing to their profile. Furthermore, the usage evolution could
be exploited for learning analytics purposes (e.g. study the
correlation with academic performance improvements).
II. P REVIOUS W ORK
Most of the previous works which are based on data from
real-world Wi-Fi networks, typically present a descriptive
analysis, including several empirical distributions from diverse
measurements [1]. We highlight some studies particularly
focused on pattern analysis, with traffic data from different
networks. Cerquitelli et al. [6] analyze users with a similar
Internet access performance, while Mirylenka et al. [3] look
for similar temporal activity patterns, both with ISP residential
clients data. Concerning the selected features they are at
opposite ends, from pure traffic histogram in the first case
(where time does not matter at all to describe each user), to
pure time series in the second case (where users must have
similar activity at the same time to be grouped together).
An intermediate approach is preferred by Mucelli et al. [4],
analyzing a large dataset from a major MNO. A first clustering
stage is based on features extracted from traffic volumes,
identifying three main profiles: light, medium and heavy
users. Then, a second clustering is applied, now with features
based on the session frequency, resulting in two subcategories:
occasional and frequent users. We follow a similar approach,
combining both temporal patterns and traffic volumes to rep-
resent users’ behavior. However, instead of making a separate
sequential clustering, we decided to integrate them both in a
Fig. 1: Daily evolution of the total connected clients through-
out school days for the WIFI - END dataset (Set-Nov ’17).
single feature vector. Thus, we do not impose a fixed structure
of main clusters based on traffic volumes and sub-clusters
based on session frequency, but instead we explore the data
structure provided by the combined traffic-frequency features.
Furthermore, we compute separate features for different times
of the day, attending to the main education schedules, which
significantly affect the Wi-Fi usage in this context.
III. D ESCRIPTION OF THE DATASETS
The datasets used in this study were collected from urban
schools, which cover more than 95% of the K-12 students in
Uruguay. All these schools are provided with an optical fiber
Internet connection and Wi-Fi infrastructure. Each record in
the datasets corresponds to the amount of downlink and uplink
traffic per device, aggregated during 1 minute, and sampled
every 15 minutes. Data were collected from 8587 APs located
in 1110 schools, where 65% are primary schools and 35% are
secondary schools.
In order to analyze the evolution throughout the year, two
datasets were collected: one at the beginning of the school
year, right after Easter holidays (April to May 2017) and the
other one at the end of the school year, right after Spring break
(September to November 2017), hereafter referred to as WIFI -
INI and WIFI - END , respectively. The former corresponds to a
6 weeks period and includes records from 778.940 different
devices, where 28% correspond to the ones delivered by Plan
Ceibal, and the rest are due to BYOD3 . The latter corresponds
to an 8 weeks period and includes 975.441 unique devices,
21% provided Plan Ceibal and the remaining 79% BYOD.
Figure 1 shows the daily school days evolution of the total
number of simultaneous connected devices (the thick line is
the median). It is worth noting that, even with an important
increase in the total number of unique devices (25% more in
WIFI - END ), the number of simultaneous devices connected to
the Wi-Fi network is quite similar in both datasets. Figure 2
3 Bring Your Own Device (BYOD): Acronym which refers to the policy of
allowing students or employees to bring personally owned devices (laptops,
tablets, and smartphones) to their school or workplace.
Fig. 2: Traffic evolution during Set-Nov ’17 (WIFI -
END dataset).
compares the traffic evolution for each period, where the hori-
zontal lines indicate the median of the maximum daily values.
A clear boost is observed from April-May to September-
November (24% for downlink and 18% for uplink), which can
be explained by an increase in the Internet access bandwidth
for a large number of schools.
An additional dataset was collected, including traffic vol-
umes per application (e.g., Facebook, YouTube and Plan
Ceibal’s educational platforms), which was not considered for
the profiling stage, but only for the characterization of the
resulting clusters. This data was gathered at the beginning of
the school year (during the same period as WIFI - INI) from
a subset of 111 schools (10% of the main dataset) and is
hereafter referred to as APP - DATA. In this case the vantage
point was not the AP but the server located at each school,
where the NTOP tool [7] was used to collect traffic flow
data per application. The measurements were gathered every
5 minutes with a time window of 5 minutes. The resulting
dataset has records from 264.145 different devices, where 19%
were delivered by Plan Ceibal, and the remaining correspond
to BYOD.
IV. U NVEILING W I -F I N ETWORK U SAGE P ROFILES
In order to identify the main usage profiles in Plan
Ceibal’s wireless network, a standard unsupervised classifica-
tion pipeline was followed: preprocessing, feature extraction,
and clustering. First, a threshold-based filter was used in order
to discard many devices with scarce activity. For this purpose,
we defined minimum values for the accumulated downlink and
uplink traffic, and the number of days with network activity.
a) Features: The selected features combine temporal
activity with traffic volumes. For this purpose, we used a multi-
histogram feature vector, i.e., a concatenation of histograms of
different types: traffic histograms and frequency histograms.
All of them have the same traffic bins, which follow a quasi
logarithmic scale [6]: {0, 1kbps, 10kbps, 100kbps, 1Mbps,
10Mbps, 20Mbps, 50Mbps, 150Mbps} for downlink and {0,
0.1kbps, 1kbps, 10kbps, 100kbps, 1Mbps, 10Mbps, 20Mbps,
50Mbps} for uplink, which results in a 8-bin histogram for 1.00
●
● ● ●

each traffic direction. Records which lay out of the bounds ●

●
●

0.75 ●
●

are discarded as outliers. ●

●

TPR
●
●

For the traffic histograms, each bin counts the amount of 0.50 ●
●

traffic registered in the corresponding traffic range, at the 0.25 ●

●
●
●

given time of day (morning, afternoon, evening and nighttime) ●

●
●
●
●
●
●
●
●

●
●
●

on school days or anytime on weekends. For frequency his- 0.00 ●

●

0.00 0.25 0.50 0.75 1.00

tograms, each bin accumulates one for each day where the user FPR
has at least one record in the corresponding traffic range, dif- ●
Canb. Cross−Bin L1 L2−MinMax
ferentiating school days and weekends. Hence, the maximum Chi−2 Inter L_2 L2−Std
value for frequency histograms is the total number of days 1.00
●

under consideration. Therefore, the resulting feature vector has ●

●
●
●

dimension 112, 80 values for the traffic histograms (8 bins, 2 0.75 ●

●

●
●

directions, 5 temporal ranges: morning, afternoon, evening and

TPR
●

0.50 ●
●

nighttime on school days and anytime on weekends) and 32 ●

●
●
●

values corresponding to the frequency histograms (8 bins, 2 0.25 ●

●
●

●
●
●
●
●

directions, 2 type of days: school days and weekends). 0.00

●
●
●
●
●
●
●
●
●

Next, we present the discrimination power analysis of the
selected features, also taking into account the study of an
appropriate distance metric. Then, we discuss the clustering
strategy used in Section IV-B.
A. Features and Distance Measures Validation
In this section we evaluate the discrimination power of the
proposed features, comparing at the same time the perfor-
mance of a series of histogram distances. For this purpose,
we assume that each user has a relatively constant activity
pattern in the considered time period.Then, we assess the
performance of various histogram distances at the verification
task. That is, given a device feature vector and his identity
(i.e., the unique MAC address of the device), verify whether
the provided identity is correct.
a) Methodology: First, the considered dataset is split into
two subsets S1 and S2 , each one comprising a fraction of
the samples available for each user. Then, using the samples
in each subset, two independent feature representations are
computed for each user i, one to be used as ground-truth gi
and the other one for testing fi . Next, for each distance d(·) to
be evaluated, N users are randomly chosen and for each user
we compute, i) the distance between the feature representations
of the same user in both subsets d(fi , gi ), i = 1, . . . , N and,
ii) the distance between the feature representation of each user
and that of M randomly chosen different users d(fi , gj ), j =
1, . . . , M . If the distance between users is below a threshold
the users are assumed to be the same, otherwise they are not.
Then, the performance of each evaluated distance function d(·)
is computed as the percentage of correctly classified users.
Varying the verification threshold we obtain the ROC curves
shown in Figure 3.
b) Subset division: The division of the dataset into sub-
sets S1 and S2 is performed in two ways: i) sequential, where
S1 includes the samples of the first half of the considered time
period and S2 those of the second half, and ii) random, the
temporal order is not taken into consideration and both sub-
sets include samples corresponding to interleaved timestamps.
Comparing the results under these two division strategies sheds
0.00 0.25 0.50 0.75 1.00
FPR
Fig. 3: ROC curves for the evaluated histogram distances under
the random (left) and sequential (right) subset division.
light on the question about the temporal stationarity of users’
online behavior. If users’ behavior changes drastically from the
time period used to build S1 to the one used to build S2 , the
expected classification performance of all the tested distance
functions should be low. Otherwise, it should be close to that
of the random division.
c) Histogram distances: A wide variety of histogram
distance functions have been proposed in the literature [8],
[9]. Most of them fall under one of two categories: bin to
bin or cross-bin, depending on whether information from
different bins is combined or not. Bin to bin distances are
often faster and simpler to compute, while cross-bin distances
tend to be more robust and performant, at the cost of a
higher computational complexity. In this study, we evaluate
a series of widely used bin to bin histogram distances: L1 ,
L2 , chi-squared, Canberra and intersection, as well as a cross-
bin distance: a quadratic form distance combining each bin
with its two adjacent neighbors with weights 1/2 and 1/4
respectively. For the L2 distance, two normalization strategies
are also evaluated: standard score and minmax scaling.
d) Results: Figure 3 shows the ROC curves for the evalu-
ated distances for the WIFI - INI dataset restricted to Frequent-
Active users only (c.f. Section V). All of them perform re-
markably well, considering the users’ activity profile described
by the proposed features is enough to verify their identity
well above 50%-50% performance. This shows the capacity of
the proposed features for user discrimination. Moreover, the
chi-squared distance outperforms the rest, reaching a 87.5%
true positive rate with a 12.5% false positive rate under the
random subset division. Similar results were obtained under
the sequential subset division. Although the classification
performance is slightly degraded, a high classification rate
 Sporadic Frequent
Active Inactive Sporadic
10% Active
14% 16%
Ceibal
BYOD 37% Frequent
Active
Sporadic 39% 40%
Inactive Sporadic
Inactive
(a) WIFI - INI data (Abr-May ’17) (b) WIFI - END
Fig. 4: Threshold-filter results for the beginning and the end
of the school year.
is still achieved, suggesting users’ online behavior is fairly
stationary.
B. Clustering Approach
Considering the discriminative capacity of the normalized
L2 distance has been validated, we propose to employ a sim-
ple, widely used algorithm: k-means. After the feature scaling
normalization, k-means algorithm is applied with different k
values. Then, the elbow method is used to find the optimal k,
by analyzing the evolution of the variance explained. Finally,
the clusters stability is studied. For this purpose, 85% of the
samples are randomly chosen and the k-means algorithm is
applied to partition this subset. The Jaccard index is then
computed to assess the similarity between the original and
the subset partition. If the original clusters are stable, we
expect them to remain after randomly dropping 15% of the
samples and therefore have a high Jaccard index with respect
to the original clusters. This process is repeated 100 times and
clusters with an average Jaccard index above 0.9 are kept.
V. DATA A NALYSIS AND R ESULTS
This section presents a summary of the analysis con-
ducted with the ESP data presented in Section III, using the
methodology described in Section IV. The first step was the
preprocessing, which corresponds to the data filtering based
on two thresholds: a minimum number of active days, defined
as 15% of the total number of days in each dataset; and a
minimum aggregated traffic volume, fixed in 1MB for both
datasets. This way, as depicted in Figure ??, four different
classes were defined, according to whether the users were
frequent or sporadic, and whether they were active or not.
It is worth noting that the percentages in each category were
very similar for the data of both times of the year.
From now on, we focus only on the Frequent-Active subset,
which has 288.413 different devices for the WIFI - INI dataset
and 359.319 for the WIFI - END dataset. In both cases the subset
corresponds to 37% of the total number of unique MACs
observed in the original datasets. Moreover, the resulting
sharing between devices delivered by Ceibal and BYOD after
the filter is also the same for both datasets: 32% and 68%
respectively.
Frequent MED MED
Inactive
7% 30% 30%
HIGH+WK HIGH+WK
6% 5%
Ceibal
37% Frequent Ceibal Ceibal
Active
BYOD BYOD BYOD 15% HIGH
17%
HIGH
47%
50%
LOW
LOW
data (Set-Nov ’17) (a) WIFI - INI data (Abr-May ’17) (b) WIFI - END data (Set-Nov ’17)
Fig. 5: Clustering results for the beginning and the end of the
school year.
A. Wi-Fi Usage Profiles and Evolution During the Year
In order to study the evolution of the Wi-Fi usage profiles
during the year, two different questions were addressed:
1) Are the clusters found in the WIFI - INI and WIFI - END
datasets the same?
2) Do users have the same usage profile throughout the
year?
To answer the first question we need to assess whether the
feature space partition given by the selected clustering method
is the same for both datasets. First, we found that the optimal
number of stable clusters for both datasets was four. Then,
we aligned the clusters of both datasets by computing the
distances between the centroids and matching the closest
ones. This way, we found that the defined cluster mapping
corresponds to a bijective function. Moreover, the minimum
distances were small, meaning that the typical usage profiles
identified in both time periods are equivalent. Figure ?? shows
the four clusters found in the Frequent-Active subsets. The
cluster labels (LOW, MED, HIGH and HIGH + WK) are related
to the activity level for each usage profile, as detailed in the
characterization presented in Table I. The difference between
HIGH and HIGH + WK is mainly explained by the activity on
weekends. The results also show that the percentage of BYOD
increases with usage intensity.
This result is quite relevant, since it implies that the partition
defined from the data at the beginning of the year has a high
level of coincidence with the partition generated from the
data at the end of the year. Thus, it is possible to model the
usage profiles only once at the beginning of the school year.
Then, the resulting model could be used to monitor the users’
behavior evolution for the rest of the year, which enables to
detect changes in user activity and give more personalized
services according to their usage profile.
The fact that the clusters found in both datasets are equiva-
lent does not imply that the same users fall in the same clusters
at both time periods, as each individual’s behavior can vary
during the year. Thus, attending to the second question, we
focused on the common devices between the two datasets to
analyze the individual’s behavior changes. The intersection
set has 142.688 devices, that is 49.7% of those included
in the WIFI - INI dataset. This is explained by the devices’
replacement carried out by Plan Ceibal during the year, as well
 TABLE I: Main Wi-Fi usage profiles characterization. b) User sessions statistics: Three indicators were defined
WIFI - INI dataset (Apr-May ’17)
in order to analyze user sessions: total sessions per day, session
WIFI - END dataset (Sep-Nov ’17)

Avg. # Days (%) Acum. Down.a(%) Avg. # Days (%)

start time and duration. For each indicator, we consider the
Acum. Down.a(%)
average among each cluster sessions. The time granularity for
Cluster Sch. Days Wknds Morn. After. Even. Sch. Days Wknds Morn. After. Even.
the session duration is given by the sampling rate, which in
LOW 30 3.7 22 21 6 27 3.8 14 13 3
MED 61 6.6 42 38 12 56 6.3 this case
34 was
33 15 minutes.
8 Table II summarizes the results,
HIGH 84 5.8 100 86 22 77 5.8 where 100we can81 see 13 that the amount and duration of sessions
HIGH + WK 82 49 78 49 25 81 43 85 52 24
a
increase for higher activity profiles. This result, combined with
Normalized to 100% for the maximum value observed during the corresponding period.
the characterization shown in Table I, indicates that the most
frequent and with higher traffic volume users are also those
who connect to the network more often (have more sessions
per day) and spend more time online (have longer sessions).
Moreover, all clusters have an average start time close to noon,
which is the middle time between the two main schools shifts
(morning and afternoon). However, as the usage increases,
the average start time is earlier. This is consistent with the
results in Table I, where the bias towards the morning shift
is larger for the for the most active clusters. This fact is also
related to the school type, since secondary schools have more
Fig. 6: Cluster mobility during the school year. activity in the morning, and as we saw above, they have much
greater incidence in the clusters HIGH and HIGH + WK. On the
contrary, in primary schools, which have greater incidence
in the clusters LOW and MED, the activity is higher in the
as those users who renew their own devices. To study the users afternoon.
behavior evolution, we applied the k-means partition learned
from the WIFI - INI dataset to the WIFI - END dataset. Then, we
focused the analysis in the intersection set only, looking for Primary
the cluster mobility observed between the two time periods. H+WK 4.9% 95.1% Secondary
Figure 6 summarizes the results, where we highlight that,
for all the clusters, a large amount of users remain in the HIGH 8.8% 91.2%
same cluster, i.e., 67%, 44%, 46% and 55%, for LOW, MED,
HIGH and HIGH + WK respectively. However, considering all MED 20.9%
the devices and not just the intersection set, we have found 79.1%
that newer devices (i.e., those included only in WIFI - END but LOW 46.6%
not in WIFI - INI) represent a larger proportion in the most 53.4%
active clusters, while the number of devices in those clusters 0 20000 40000 60000 80000
remained almost the same (HIGH + WK fell 2.9%, while the Number of devices
union of HIGH + WK and HIGH fell 0.3%). This insight suggests
that renewing the devices promotes an increase in online Fig. 7: School type distribution.
activity, an effect that has already been observed in previous c) Most popular applications: Which are the most pop-
studies [?]. ular applications per cluster? In order to answer this question,
we use the APP - DATA dataset to compute two indicators:
B. School Type, Sessions Time and Relevant Applications the average number of days (as a percentage of the total
This section introduces an in-depth analysis of the identified days) that each application was used, and the percentage of
usage profiles, focused on other relevant aspects: school type users in each cluster that have used it. It is worth recalling
distribution, user sessions and most common applications us- that the schools considered in the APP - DATA dataset are a
age. In this context, a user session is defined as the time period subsample of those in the WIFI - INI dataset, which covers more
the user was connected to the Wi-Fi network uninterruptedly. than 30% of the users. Figure 8 summarizes the results for
Results are presented for the WIFI - INI dataset only, as they are the top 5 applications. We observe that Google, Facebook,
quite similar for the WIFI - END dataset. and WhatsApp are the most popular applications in terms of
a) School type: Figure 7 shows the clusters’ composition average days usage for all clusters, and the average days usage
according to the school type. As we can see, the trend is very is larger for higher activity profiles. Regarding the percentage
clear, showing that the vast majority of the most active users of users in the cluster that use the app, Google and Facebook
in the network correspond to secondary schools. Furthermore, are almost equally (highly) used among clusters, whereas
73% of the devices corresponding to primary schools are in Instagram or WhatsApp have much larger penetration for the
the cluster with less network activity (LOW). most active clusters (HIGH and HIGH + WK), which clearly
 % Days % Users to improve the discrimination power. Another relevant aspect
LOW
MED
YouTube HIGH YouTube for the ESP will be to analyze the correlation between the
HIGH+WK
Wi-Fi usage profiles and the users’ activity in the educational
Instagram 75 WhatsApp Instagram 75 WhatsApp platforms.
50 50
25
E THICAL S TATEMENT
The datasets used in this study were de-identified and han-
dled according to the Uruguayan privacy protection legislation.
Facebook Google Facebook Google
R EFERENCES
Fig. 8: Popular applications usage for each cluster.
[1] S. Biswas, J. Bicket, E. Wong, R. Musaloiu-E, A. Bhartia, and D. Aguayo,
“Large-scale measurements of wireless network behavior,” in Proceedings
of ACM SIGCOMM 2015, pp. 153–165.
[2] A. Frömmgen, J. Heuschkel, P. Jahnke, F. Cuozzo, I. Schweizer, P. Eug-
relates to the larger incidence of secondary school students ster, M. Mühlhäuser, and A. Buchmann, “Crowdsourcing measurements
and BYOD in this clusters. of mobile network performance and mobility during a large scale event,”
in Proceedings of PAM 2016, pp. 70–82.
C. Digging Deeper in the Usage Profiles [3] K. Mirylenka, V. Christophides, T. Palpanas, I. Pefkianakis, and M. May,
“Characterizing Home Device Usage From Wireless Traffic Time Series,”
In order to deepen the analysis of each usage profile, the in Proceedings of EDBT 2016, Bordeaux, France, 2016.
same method based on k-means was applied on each of the first [4] E. M. R. Oliveira, A. C. Viana, K. Naveen, and C. Sarraute, “Mobile
level clusters. In this case, the number of sub-clusters found data traffic modeling: Revealing temporal facets,” Computer Networks,
vol. 112, no. Supplement C, pp. 176 – 193, 2017.
was 13, again the same for both datasets. For each cluster, 3 [5] Plan Ceibal, “One-to-one program implementation in Uruguay.” 2007-
sub-clusters were identified, with the exception of HIGH + WK, 2018. [Online]. Available: https://www.ceibal.edu.uy/en/institucional
for which there were 4. The novelty observed in these fine- [6] T. Cerquitelli, A. Servetti, and E. Masala, “Discovering users with similar
internet access performance through cluster analysis,” Expert. Syst. Appl.,
grained usage profiles was that most of them are associated vol. 64, no. Supplement C, pp. 536 – 548, 2016.
to the main school shifts (i.e. morning or afternoon), which [7] ntop, “High-Speed Web-based Traffic Analysis and
did not happen for any of the first level clusters. Moreover, Flow Collection,” accessed: 2018-01-26. [Online]. Available:
https://www.ntop.org/products/traffic-analysis/ntop/
comparing both periods the result was also different, since the [8] S.-H. Cha and S. N. Srihari, “On measuring the distance between
sub-clusters alignment was not perfect as previously. Some histograms,” Pattern Recognition, vol. 35, no. 6, pp. 1355–1370, 2002.
clusters were split in a different way, such as HIGH. For this [9] P. A. Marı́n-Reyes, J. Lorenzo-Navarro, and M. Castrillón-Santana,
“Comparative study of histogram distance measures for re-identification,”
cluster, in the WIFI - INI dataset 2 sub-clusters were identified arXiv preprint arXiv:1611.08134, 2016.
associated with the morning shift and 1 to the afternoon shift,
while for the WIFI - END dataset the cluster was divided into 2
sub-clusters corresponding to the afternoon shift and only 1 to
the morning shift. Considering all subclasses, 5 out of the 13
sub-clusters match between both time periods (i.e. centroids
are pretty close to each other). This means that still some
of those fine-grained usage profiles are also stable during the
year.
VI. C ONCLUSIONS
The present work tackles the analysis of Wi-Fi usage
profiles in a novel context: a national K-12 education service
provider. For this purpose, relevant features and distance mea-
sures were selected and validated, studying their discrimina-
tion power among different Wi-Fi connectivity usage patterns.
Then, the main usage profiles at schools were identified,
comparing the results for the beginning and the end of the
school year. The evolution showed a quite stable behavior
throughout the year. An in-depth analysis of the resulting
clusters was presented, with different insights about the users
activity in the network. The study shows how ESPs could
take advantage of network data in order to obtain valuable
information for evidence-based decision making. This is not
only from a network operator perspective, but also for learning
analytics purposes, which in the end is the final goal of an ESP.
For future work, different features could be explored, as well
as introducing weights to the different components, as a way