Unveiling Network Usage Profiles of a Nationwide
Education Service Provider
Germán Capdehourat, Cecilia Aguerrebere, Federica Bascans, Germán Álvarez and Pedro Porteiro
{gcapdehourat, caguerrebere, fbascans, galvarez, pporteiro}@ceibal.edu.uy
Plan Ceibal, Avda. Italia 6201, Edificio Los Ceibos, 11500, Montevideo, Uruguay.
Abstract—The present study addresses network’s usage profil-
ing in a novel educational context: an Education Service Provider
(ESP), which, among other tasks, provides Internet access at
schools. For this purpose, a multi-stage clustering method is
proposed, and applied to data from the ESP in charge of the
nationwide one-to-one K-12 computing program in Uruguay. The
selected features and distance measures are validated, studying
its discrimination power. The resulting profiles are analyzed,
including their temporal evolution, showing a stable behavior
throughout the school year. The applicability of these results is
twofold for an ESP evidence-based decision making: on the one
hand from a network operator perspective, and on the other hand
providing vital information for learning analytics purposes.
Index Terms—network traffic, education, clustering, usage
profiles.
I. I NTRODUCTION
Traditionally, traffic analysis and demand characterization
have been mostly focused on network planning, where the
main goal is to guarantee the minimum resources needed
to provide a good service [1]. Additionally, knowing the
typical traffic dynamics enables the detection of anomalies,
which may alert about network failures or traffic attacks [2].
The increasing data availability, jointly with recent advances
in machine learning and big data analysis, have laid the
groundwork for even more sophisticated studies (e.g. urban
mobility analysis [3]).
These studies are typically carried out with Internet service
providers (ISPs) or mobile network operators (MNOs) data.
Although many articles refer to educational settings such as
university campuses, studies in K-121 scenarios are very rare.
In this paper, we analyze traffic data from Plan Ceibal [4],
a major K-12 education service provider2 (ESP) which leads
a nationwide one-to-one computing program in Uruguay. It
provides technological support to the national K-12 education
system, including Wi-Fi connectivity and videoconference
infrastructure for all public schools, as well as access to educa-
tional platforms (e.g. a digital library, a learning management
system and an intelligent tutoring system for math).
To the best of our knowledge, this work stands out from
the previous as the first of its kind in a K-12 scenario. We
present a general methodology to identify the different network
usage profiles, based on the individuals’ traffic dynamics. For
this purpose, specific features were defined and validated,
1 Term
coined to refer to primary and secondary education.
2 Educationservice provider (ESP): Organization which helps the education
system to implement comprehensive reforms.
ending up in a multi-stage clustering method to determine
the main user profiles. In addition, the evolution of the users’
behavior throughout the school year was studied by comparing
the clustering results obtained at the beginning and at the
end of the year. The results indicate that the main four user
profiles identified were the same at both time periods. This is a
remarkable result, as it enables the user profile characterization
from data collected at the beginning of the school year and
then tracking the individuals’ evolution during the rest of the
year. The insights found are useful from a network operator
perspective, but also provide very valuable information for the
ESP management and learning analytics purposes.
II. P REVIOUS W ORK
Typical works found in the literature perform a descriptive
analysis, providing a deep view of the network operation
through data exploration and several empirical distributions
from diverse measurements [5]. However, there are some
works particularly focused on finding user behavior patterns.
For example, Cerquitelli et al. [6] looks for users with a similar
Internet access performance, while Mirylenka et al. [7] similar
temporal activity patterns, both with using ISP residential
clients data. The two works are at opposite ends concerning
the selected features, from pure traffic histogram in the first
case (where time does not matter at all to describe each user),
to pure time series in the second case (where users must have
similar activity at the same time to be grouped together).
An intermediate solution is preferred by Mucelli et al. [8], to
analyze a large dataset from a major MNO. A first clustering
stage is based on traffic volume features, finding three profiles:
light, medium and heavy users. Then, a second clustering is
applied, now based on the session frequency features, resulting
in two subcategories: occasional and frequent users. We follow
a similar approach, combining both temporal patterns and
traffic volumes to represent users’ behavior. However, instead
of making a separate sequential clustering, we integrate them
both in a single feature vector. This way, we do not impose a
fixed structure of traffic level clusters with session frequency
sub-clusters, but explore instead the data structure provided
by the combined traffic-frequency features. Furthermore, the
features selected are computed for different times of the day,
attending to the particular education context where different
shifts exist, which significantly affect the users’ behavior.