## 4 Cause Estimation Algorithm
### Multimodel Estimator  
To estimate the cause of scan failure/delay where the conventional machine learning classifiers fail to correctly estimate new samples (i.e., cannot generalize samples of new scan response results), we propose an MM-LDA. Specifically, a two-class LDA is used to build a one-to-many model in our cause estimation algorithm, where three types of training data obtained from different network scenarios (i.e., normal, low-SNR, and congestion) are extracted as described above and combined to build each model. Figure 3 shows the cause estimation process used for the proposed MM-LDA, where the training samples N, S, and C correspond to the scan response results obtained from various scenarios (i.e., N--normal, S--low SNR, and C--congestion). To create the cause estimation model which is used in our estimation algorithm, firstly, as described in Section 4.2, we identify and select from the scan response the best features that can be used to estimate the cause of scan failure/delay and are combined with scan response RTT. Then, the combined data are used to create a training data set for our model. For this, three types of training sections (models) are prepared to determine the causes of scan failure/delay (i.e., normal, SNR insufficient, and NW congestion). As shown in Figure 3, each separated group of our training data is combined to create a model. The network scan traffic data from various scenarios are combined in the following order: model 1--normal and low SNR, model 2--normal and congestion, and model 3--low SNR and congestion. Thereafter, using a one-to-many model, the combined training samples are passed into the model. Based on the result obtained, the next model to be utilized is determined (e.g., if the scan response is determined to be normal in the first model, then the second model is selected as the next model; otherwise, the third model is selected). This approach will help to reduce the estimation error of the scan failure/delay where the data samples obtained in various scenarios overlapped. In our MM-LDA, two discriminant functions, \(f^{1}\) and \(f^{2}\), are calculated for each model. The data samples from the combined training data that correspond to each separate group are used to calculate the covariance matrix \(\mathbf{C}_{k}\) as in Equation (9), where \(\mathbf{x}_{k}\) are the data samples of a group \(k\), and \(N_{K}\) is the number of samples in the group \(k\). Thereafter, the pooled covariance matrix \(\widehat{\mathbf{C}}_{uv}\) is calculated for each model as in Equation (10), where \(\mathbf{C}_{k}\) is the data value of the covariance matrix \(\mathbf{C}\) of a group \(k\) in the combined training data, and \(N\) is the number of samples of the combined training data. \(u\) and \(v\) correspond to the group \(k\) of the combined training data in each model such that when the training sample from the normal and low SNR scenarios are combined, \(u=1\) and \(v=2\). \(L\) denotes the  
Figure 3: Cause estimation model formation and output. number of groups in the combined training sample. Each value of the pooled covariance is calculated separately using the corresponding values of the covariance matrix of the combined training data for each model. Furthermore, the inverse of pooled covariance \(\widehat{C}_{uv}^{-1}\) is calculated and applied into the discriminant function of each model (e.g., Equation (11)). \[C_{k}=\frac{\mathbf{x}_{k}\mathbf{x}_{k}^{T}}{N}, \tag{9}\]  
\[\widehat{C}_{uv}=\sum_{k=1}^{L}\frac{C_{k}N_{k}}{N}. \tag{10}\]  
In addition, as given in Equations (11)-(16), the mean \(\mu\) and the prior probability \(\log\Pi\) are calculated based on the size of the training data for each separate group (i.e., \(k_{1}\)--normal, \(k_{2}\)--low SNR, and \(k_{3}\)--congestion) of training data in each model.