## 4 Case Study
### Working Memory, Inference Engine, and Visual Notifications
Through analysing accurate classifications and misclassifications, we were able to drill into a specific sub route group and discover which attributes are critical in network disruption detection. The analysis was performed using sub route group SUB_GRP_2, as it has the highest number of misclassifications. The classification decision tree in Figure 7 shows that the attributes MIS_X4, SNR_X1 and MODCOD_X4 made a major difference between misclassified instances and those that were classified correctly. Unlike the previous single threshold scheme used by the satellite engineers, this showed that there were a number of attributes that could affect a terminal's performance. Figure 6: Classification decision tree for all sub route groups for many terminals. \begin{table}
\begin{tabular}{c c c c c c c c} \hline \hline
**Predicted** & **SUB\_GRP\_3** & **SUB\_GRP\_8** & **SUB\_GRP\_6** & **SUB\_GRP\_5** & **SUB\_GRP\_7** & **SUB\_GRP\_1** & **SUB\_GRP\_4** & **SUB\_GRP\_2** \\ \hline \multicolumn{6}{c}{**Actual**} & \multicolumn{6}{c}{} \\
**SUB\_GRP\_3** & 6688 & 0 & 469 & 1 & 1 & 0 & 0 & 0 \\
**SUB\_GRP\_8** & 0 & 7180 & 0 & 0 & 4 & 7 & 1 & 0 \\
**SUB\_GRP\_6** & 10 & 0 & 2048 & 0 & 1 & 0 & 0 & 0 \\
**SUB\_GRP\_5** & 0 & 0 & 0 & 9228 & 755 & 0 & 3 & 0 \\
**SUB\_GRP\_7** & 0 & 0 & 1254 & 7523 & 0 & 0 & 0 \\
**SUB\_GRP\_1** & 0 & 0 & 0 & 3 & 12,416 & 1 & 0 \\
**SUB\_GRP\_4** & 0 & 0 & 0 & 1 & 0 & 1026 & 0 \\
**SUB\_GRP\_2** & 0 & 0 & 0 & 7938 & 13 & 0 & 8 & 43,422 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Confusion matrix in sub route groups. Using the misclassified terminals, the next step was to distinguish which state the terminal was in--was it experiencing a hardware fault, undergoing short term transient conditions in at the geographical location (e.g., passing rain clouds), or was it experiencing a spatiotemporal condition such as a tree growing in front of its antenna. 2. Identifying transients: We assumed that the terminals in the network could be in three different states: a normal working state, a transient state with cloud covering or tree waving in front of satellite dish, and an abnormal (broken) state. In this work, SNR_X1 was identified as one of the crucial variables in the dataset. This was determined through PCA and the analysis that was conducted in earlier sections. As a result, SNR_X1 was investigated to find out if this variable could be used to estimate either a short transient or spatiotemporal conditions happening in the vicinity of the terminals, such as cloud covering or a hardware failure caused by a broken terminal. A k-means clustering algorithm was used to derive two clusters, C1 (abnormal) and C2 (normal), from the ADBs. The clustered data were used as input for the classification decision tree, which enabled us to analyse which ranges of SNR_X1 that the majority of the clustered data belonged to. The decision tree is shown in Figure 8. The root of the tree marked in Figure 7 shows which cluster the majority of the data belongs to. In this particular case, it is shown that 64.8% of all data entries belong to cluster C2 (normal). As the majority of entries belong to cluster C2, it is assumed that this cluster represented \"normal network behaviour\". The cluster C1 (abnormal) contains remaining 35.2%, which can be considered as an outliers group with possible signal quality issues. K-means method was then applied to derive two clusters- C1a (clouds) and C1b (disruptions) from the C1 cluster. The clustered data from the C1 cluster were used to build a classification decision tree, which classifies which cluster a new terminal's data set belongs to. The classification decision tree was then used to tag the terminal time series data. Figure 9 presents the time vs Terminal ID, which allows users to observe that the states of all terminals vary as time changes. Some terminals might be in similar locations, as they exhibit similar disruption patterns.