Public Wi-Fi Risk Assessment Using K-Means Clustering of Multidimensional Network Traffic Features

Public Wi-Fi networks generate heterogeneous traffic that complicates the identification of unusually intensive communication behavior. This study proposes a K-Means clustering framework for relative risk prioritization using network traffic captured from three cafe Wi-Fi environments in West, Central, and North Surabaya. Packet traces were transformed into five numerical features: RequestCount, PacketCount, TotalBytes, DestinationCount, and RequestRate. The features were normalized using Min-Max scaling and clustered using a single K-Means model, while location labels were retained for post-clustering comparison. The number of clusters was evaluated using the Elbow Method, Silhouette Score, and Davies-Bouldin Index. K = 3 produced the highest Silhouette Score (0.61) and the lowest Davies-Bouldin Index (0.72) among the tested values. The resulting clusters separated low-, medium-, and high-intensity communication patterns, with West Surabaya containing the largest observed RequestCount (48,183). These clusters represent relative traffic intensity rather than confirmed malicious activity and are intended to prioritize entities for further inspection using protocol analysis, deep packet inspection, or threat-intelligence correlation.