Skip to main content
edited tags; edited title
Link
user88
user88

Classifying IP Addressesaddresses with a Decision Treedecision tree

Source Link
Ryan Rosario
  • 471
  • 1
  • 3
  • 10

Classifying IP Addresses with a Decision Tree

I am working on a classification problem using IP addresses as input and I am trying to find which IP addresses or subnets are likely to belong to a spammer. I have data consisting of the four octets in the IP address as well as a label: SPAM or OK.

This feels like a good problem for a decision tree, but I am finding that most decision tree algorithms consider the order of the variables interchangeable. For example, ctree from party might output a rule interpreted as

IF octet1 == 192 && octet4 == 190 THEN label => SPAM

but with IP addresses, the order of the variables matters. That is, octet 2 must be considered after octet 1, and octet 3 must be considered after octet 2 and so on to yield rules like

IF octet1 == 206 THEN label => OK

IF octet1 == 193 && octet2 == 64 && octet3 == 11 THEN label => SPAM

What type of decision tree model is this and what algorithm/tool could help here? Is there some sort of variation I can use? I prefer to stick with R.