## 4 Cause Estimation Algorithm
### Feature Extraction
#### 4.2.2 Features Ranking  
Another method utilized in our feature selection is the ranking of features. Here, each feature is ranked according to the order of its importance to the factor cause estimation, and the best feature is selected. To determine the importance of features, first, a \"chi-square (\(\chi^{2}\))\" statistical test for non-negative feature is used to determine a specified number of features as important. Given a scan response with features \(S_{1}\),..., \(S_{z}\), where \(z\) is the total number of features, the scan response features are arranged in a table such that each feature \(S_{z}\) corresponds to the \(jth\) column of the table and the values of the data samples \(S_{x_{m}}\) of each corresponding \(S_{z}\) are arranged in the \(qth\) row. Table 2 shows an example of the arrangement of four scan response features with each \(jth\) column of the table corresponding to an unsuccessful scan rate (\(s_{1}\)), scan jitter (\(s_{2}\)), scan maximum RTT (\(s_{3}\)), and scan minimum RTT (\(s_{4}\)), respectively. A sample of the scan response data of a feature is denoted as \(x_{mq}\), where \(x\) represents an individual sample point, \(m\) is the index of a sample, and \(q\) is the \(qth\) row of a sample in the table. The \(\chi^{2}\) is calculated as in Equation (2), where \(x\) is the observed value of the data sample of a feature obtained from the scan response results, and \(m\) is the index of the value of the feature (i.e., the index of a sample as stated above). \(E\) is the expected value of a sample, and it is calculated for each sample value as in Equation (3) by multiplying the sum total \(t_{q}\) of the values of all features in the \(qth\) row by the sum total of the values of a feature in the \(jth\) column divided by the grand total \(N\). \(N\) is calculated as in Equation (4), where \(t_{q}\) is the sum total of the values of all features in a row, and \(b\) and \(n\) are the index \begin{table}
\begin{tabular}{c c c c} \hline \hline \(S_{1}\) & \(S_{2}\) & \(S_{3}\) & \(S_{4}\) \\ \hline
0 & 0.022 & 0.049 & 0.008 \\
0 & 0.012 & 0.034 & 0.008 \\
0 & 0.029 & 0.023 & 0.008 \\
0 & 0.009 & 0.038 & 0.008 \\
0 & 0.024 & 0.022 & 0.015 \\
0 & 0.003 & 0.022 & 0.015 \\
0 & 0.004 & 0.021 & 0.015 \\
0 & 0.003 & 0.023 & 0.015 \\ \hline \hline \end{tabular}
\end{table} 
Table 2: An example of arrangement of features in a table for feature ranking. Figure 2: Scan failure/delay cause estimation process. and total number of samples of \(t_{q}\) respectively. Thereafter, the features with the highest _chi_ corresponding to the specified number of features are selected as important features \(S\). \[\chi^{2}=\sum_{m=1}\frac{(x_{m}-E)^{2}}{E}, \tag{2}\]  
\[E=\sum\frac{(t_{q}\times t_{j})}{N}. \tag{3}\]  
\[N=\sum_{b=1}^{a}t_{q_{b}}. \tag{4}\]  
Furthermore, a recursive feature elimination (RFE) [38] is utilized to select the best feature from the important features described above. The best feature is combined with the scan response RTT to achieve better estimation accuracy. RFE works by recursively removing the feature with the lowest ranking score at each iteration of the algorithm and building a model on those features that remain. It identifies features that can contribute the most to predicting the target class (i.e., the cause of scan response failure/delay). The process of using RFE is summarized in Algorithm 1 and is performed as follows. From the stored correlated features described above, perform a greedy search to find the best feature by considering smaller and smaller sets of features. Thereafter, train the selected features from \(S\) with a classification algorithm (e.g., SVM or LR). Iteratively create models and determine the best or the worst performing feature at each iteration (i.e., find features with the smallest ranking \(s_{r}\)). Any feature with the smallest ranking is eliminated. Then, construct the subsequent models with features that are left until all the features are explored.