A Clustering Approach for Profiling LoRaWAN IoT Devices

  • Jacopo Maria Valtorta
  • Alessio Martino
  • Francesca Cuomo
  • Domenico GarlisiEmail author
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 11912)


Internet of Things (IoT) devices are starting to play a predominant role in our everyday life. Application systems like Amazon Echo and Google Home allow IoT devices to answer human requests, or trigger some alarms and perform suitable actions. In this scenario, any data information, related device and human interaction are stored in databases and can be used for future analysis and improve the system functionality. Also, IoT information related to the network level (wireless or wired) may be stored in databases and can be processed to improve the technology operation and to detect network anomalies. Acquired data can be also used for profiling operation, in order to group devices according to their characteristics. LoRaWAN (Long Range Wide Area Network) is one of the emerging IoT technologies in today’s world, it is a protocol based on LoRa modulation. In this work, we propose a methodology to process LoRaWAN packets and perform profiling of the IoT devices. Specifically, we use the k-means algorithm to group devices according to their radio and network behaviour. We tested our approach on a real LoRaWAN network where the entire captured traffic is stored in a proprietary database. Our analysis, performed on 286, 753 packets with 765 devices involved, leads to remarkable clustering performance according to validation indices such as the Silhouette and the Davies-Bouldin indices. Further, with the help of field-experts, we were able to analyze clusters’ contents, revealing results both in line with the current network behaviour and alerts on malfunctioning devices, remarking the reliability of the proposed approach.


IoT LoRa LoRaWAN Machine Learning k-means Anomaly detection Cluster analysis 



We thank UNIDATA S.p.A. who provided insight and expertise that greatly assisted our research, as well the access to a subset of the data for the analysis.


  1. 1.
    Aceto, G., Ciuonzo, D., Montieri, A., Pescapé, A.: Mobile encrypted traffic classification using deep learning: experimental evaluation, lessons learned, and challenges. IEEE Trans. Netw. Serv. Manag. 16(2), 445–458 (2019)CrossRefGoogle Scholar
  2. 2.
    Arthur, D., Vassilvitskii, S.: K-means++: the advantages of careful seeding. In: Proceedings of the Eighteenth Annual ACM-SIAM Symposium on Discrete Algorithms, SODA 2007, pp. 1027–1035. Society for Industrial and Applied Mathematics, Philadelphia (2007)Google Scholar
  3. 3.
    Barrachina-Muñoz, S., Adame, T., Bel, A., Bellalta, B.: Towards energy efficient LPWANs through learning-based multi-hop routing. In: 2019 IEEE 5th World Forum on Internet of Things (WF-IoT), pp. 644–649 (2019)Google Scholar
  4. 4.
    Bhatt, P., Morais, A.: Hads: hybrid anomaly detection system for IoT environments. In: 2018 International Conference on Internet of Things, Embedded Systems and Communications (IINTEC), pp. 191–196 (2018)Google Scholar
  5. 5.
    Croce, D., Gucciardo, M., Tinnirello, I., Garlisi, D., Mangione, S.: Impact of spreading factor imperfect orthogonality in LoRa communications. In: Piva, A., Tinnirello, I., Morosi, S. (eds.) TIWDC 2017. CCIS, vol. 766, pp. 165–179. Springer, Cham (2017). Scholar
  6. 6.
    Davies, D.L., Bouldin, D.W.: A cluster separation measure. IEEE Trans. Pattern Anal. Mach. Intell. PAMI–1(2), 224–227 (1979)CrossRefGoogle Scholar
  7. 7.
    Del Campo, G., Gomez, I., Sierra, S.C., Martinez, R., Santamaria, A.: Power distribution monitoring using LoRa: coverage analysis in suburban areas. In: Proceedings of the 2018 International Conference on Embedded Wireless Systems and Networks, EWSN 2018, pp. 233–238 (2018)Google Scholar
  8. 8.
    Di Noia, A., Martino, A., Montanari, P., Rizzi, A.: Supervised machine learning techniques and genetic optimization for occupational diseases risk prediction. Soft Comput. (2019).
  9. 9.
    Hammerschmidt, C., Marchal, S., State, R., Pellegrino, G., Verwer, S.: Efficient learning of communication profiles from IP flow records. In: 2016 IEEE 41st Conference on Local Computer Networks (LCN), pp. 559–562 (2016)Google Scholar
  10. 10.
    Jain, A.K., Murty, M.N., Flynn, P.J.: Data clustering: a review. ACM Comput. Surv. (CSUR) 31(3), 264–323 (1999)CrossRefGoogle Scholar
  11. 11.
    Kim, D.Y., Kim, S.: Data transmission using k-means clustering in low power wide area networks with mobile edge cloud. Wirel. Pers. Commun. 105(2), 567–581 (2019)CrossRefGoogle Scholar
  12. 12.
    Lueth, K.L., et al.: State of the IoT & short-term outlook (2018)Google Scholar
  13. 13.
    Kumar, A., Lim, T.J.: Edima: early detection of IoT malware network activity using machine learning techniques. In: 2019 IEEE 5th World Forum on Internet of Things (WF-IoT), pp. 289–294 (2019)Google Scholar
  14. 14.
    Kurniabudi, K., Purnama, B., Sharipuddin, S., Stiawan, D., Darmawijoyo, D., Budiarto, R.: Preprocessing and framework for unsupervised anomaly detection in IoT: work on progress. In: 2018 International Conference on Electrical Engineering and Computer Science (ICECOS), pp. 345–350 (2018)Google Scholar
  15. 15.
    Lloyd, S.: Least squares quantization in PCM. IEEE Trans. Inf. Theory 28(2), 129–137 (1982)MathSciNetCrossRefGoogle Scholar
  16. 16.
    MacQueen, J.: Some methods for classification and analysis of multivariate observations. In: Proceedings of the Fifth Berkeley Symposium on Mathematical Statistics and Probability, Oakland, CA, USA, vol. 1, pp. 281–297 (1967)Google Scholar
  17. 17.
    Marchette, D.: A statistical method for profiling network traffic. In: Proceedings of the Workshop on Intrusion Detection and Network Monitoring, pp. 119–128. USENIX Association, Berkeley (1999)Google Scholar
  18. 18.
    Martino, A., Giuliani, A., Rizzi, A.: Granular computing techniques for bioinformatics pattern recognition problems in non-metric spaces. In: Pedrycz, W., Chen, S.M. (eds.) Computational Intelligence for Pattern Recognition. SCI, vol. 777, pp. 53–81. Springer, Cham (2018). Scholar
  19. 19.
    Martino, A., Rizzi, A., Frattale Mascioli, F.M.: Efficient approaches for solving the large-scale k-medoids problem. In: Proceedings of the 9th International Joint Conference on Computational Intelligence - Volume 1: IJCCI, pp. 338–347. INSTICC, SciTePress (2017)Google Scholar
  20. 20.
    Martino, A., Rizzi, A., Frattale Mascioli, F.M.: Distance matrix pre-caching and distributed computation of internal validation indices in k-medoids clustering. In: 2018 International Joint Conference on Neural Networks (IJCNN), pp. 1–8 (2018)Google Scholar
  21. 21.
    Martino, A., Rizzi, A., Frattale Mascioli, F.M.: Efficient approaches for solving the large-scale k-medoids problem: towards structured data. In: Sabourin, C., Merelo, J.J., Madani, K., Warwick, K. (eds.) IJCCI 2017. SCI, vol. 829, pp. 199–219. Springer, Cham (2019). Scholar
  22. 22.
    Mostafa, B.: Monitoring internet of things networks. In: 2019 IEEE 5th World Forum on Internet of Things (WF-IoT), pp. 295–298 (2019)Google Scholar
  23. 23.
    Muntean, V.H., Muntean, G.: A novel adaptive multimedia delivery algorithm for increasing user quality of experience during wireless and mobile e-learning. In: 2009 IEEE International Symposium on Broadband Multimedia Systems and Broadcasting, pp. 1–6 (2009)Google Scholar
  24. 24.
    Nivaashini, M., Thangaraj, P.: A framework of novel feature set extraction based intrusion detection system for internet of things using hybrid machine learning algorithms. In: 2018 International Conference on Computing, Power and Communication Technologies (GUCON), pp. 44–49 (2018)Google Scholar
  25. 25.
    Nõmm, S., Bahşi, H.: Unsupervised anomaly based botnet detection in IoT networks. In: 2018 17th IEEE International Conference on Machine Learning and Applications (ICMLA), pp. 1048–1053 (2018)Google Scholar
  26. 26.
    Rousseeuw, P.J.: Silhouettes: a graphical aid to the interpretation and validation of cluster analysis. J. Comput. Appl. Math. 20, 53–65 (1987)CrossRefGoogle Scholar
  27. 27.
    Semtech: LoRa. EP2763321 from 2013 and U.S. Patent 7,791,415 from 2008Google Scholar
  28. 28.
    Sornin, N., Yegin, A., et al.: LoRaWAN 1.1 Specification (2017).
  29. 29.
    Tao, M., Ming, Y.C., Juan, C.: Profiling and identifying users’ activities with network traffic analysis. In: 2015 6th IEEE International Conference on Software Engineering and Service Science (ICSESS), pp. 503–506 (2015)Google Scholar
  30. 30.
    Thorndike, R.L.: Who belongs in the family? Psychometrika 18(4), 267–276 (1953)CrossRefGoogle Scholar
  31. 31.
    Verzegnassi, E.G.M., Tountas, K., Pados, D.A., Cuomo, F.: Data conformity evaluation: a novel approach for IoT security. In: 2019 IEEE 5th World Forum on Internet of Things (WF-IoT), pp. 842–846 (2019)Google Scholar
  32. 32.
    Zhang, H.W., Sun, L., Zhang, H.: Research on data packets clustering algorithm in the wireless multiple hop network. Appl. Mech. Mater. 651, 1905–1908 (2014)CrossRefGoogle Scholar
  33. 33.
    Zhang, J., Chen, J.: An adaptive clustering algorithm for dynamic heterogeneous wireless sensor networks. Wirel. Netw. 25(1), 455–470 (2019)CrossRefGoogle Scholar

Copyright information

© Springer Nature Switzerland AG 2019

Authors and Affiliations

  1. 1.Department of Information Engineering, Electronics and TelecommunicationsUniversity of Rome “La Sapienza”RomeItaly
  2. 2.University of PalermoPalermoItaly
  3. 3.Consorzio Nazionale Interuniversitario per le Telecomunicazioni (CNIT)ParmaItaly

Personalised recommendations