## 6 Evaluation
### Results and Discussion
#### 6.2.3 Scan Response Distribution  
According to the analysis of the scan response data and their features, we observed that there are situations in which the scan response samples from a particular scenario are linearly separable from the scan response samples of the other scenarios. On the other hand, the scan response samples of the other scenarios are not linearly separable from each other. This can make it difficult to apply conventional machine learning to classify these scan response data. As shown in Figure 6a-c, we observed that the distribution of features (scan traffic data) of the scan response data obtained in the first sample set is non-Gaussian distribution, although the maximum RTT (shown in Figure 6d) may be described as approximately Gaussian. Similarly, as shown in Figure 7, for the second set of the scan response samples, we observed that three out of the scan traffic features are non-Gaussian distributed. Furthermore, Figure 8 shows the details of the relationship between the features of the scan response samples of each scenario--normal, low SNR, and congestion (i.e., which scan response feature can be used in combination with the scan response RTT to classify the  
Figure 5: Network scan response analysis. Set 1: (**a**) Network scan success rate; (**b**) network scan response rate. Set 2: (**c**) Network scan success rate; (**d**) network scan response rate. cause of scan failure/delay). As shown in Figure 8a, for the first sample set, we observed that when using scan response RTT and scan response jitter, we can only distinguish the scan response data obtained in the congestion scenario from the other two scenarios (i.e., normal and low SNR scenarios). We confirmed that the scan response acquired in the normal scenario and the low SNR scenario mostly overlap. The same trend was observed when the other two features (i.e., minimum RTT and maximum RTT) were analyzed in relation to the scan response RTT. Figure 8b,c show that it is only possible to distinguish the scan response data obtained in the congestion scenario from the other two scenarios. Figure 6: Scan response set 1: Data distribution using histogram of the scan traffic features. (**a**) Scan RTT; (**b**) scan jitter: (**c**) scan minimum RTT; (**d**) scan maximum RTT. Figure 7: Scan response set 2: Data distribution using histogram of the scan traffic features. (**a**) Scan RTT; (**b**) scan jitter; (**c**) scan minimum RTT; (**d**) scan maximum RTT. In the second sample set, however, as shown in Figure 8d, we observed that when using scan response RTT and scan response jitter, we can only distinguish the scan response data obtained in the congestion scenario from the scan response data obtained in the low SNR scenarios. We confirmed that the scan response samples acquired in the normal scenario mostly overlap with the scan response samples of the other scenarios (i.e., low SNR and congestion scenarios). Similarly, as shown in Figure 8e, we observed that only the scan response samples of two scenarios can be distinguished (i.e., low SNR and congestion scenarios) when the scan response RTT and the minimum scan response RTT samples of all the scenarios were examined. The same trend is observed when the maximum scan response RTT feature is analyzed in relation to the scan response RTT. Figure 8f shows that it is only possible to distinguish the scan response data obtained in the congestion scenario from the other two scenarios. In addition, the relation between the scan response RTT and other features of the scan response samples obtained in various scenarios show that only scan response samples of a particular scenario can be linearly separated from the scan response samples of other scenarios. The features of the scan response samples are completely overlapped in two scenarios, as shown in Figure 8. Therefore, a method to achieve a good separation measure is required. Figure 8: Relationship of other features of the scan traffic to scan response RTT in all scenarios.