I am working on a classification problem using IP addresses as input and I am trying to find which IP addresses or subnets are likely to belong to a spammer. I have data consisting of the four octets in the IP address as well as a label: SPAM or OK.
This feels like a good problem for a decision tree, but I am finding that most decision tree algorithms consider the order of the variables interchangeable. For example, ctree
from party
might output a rule interpreted as
IF octet1 == 192 && octet4 == 190 THEN label => SPAM
but with IP addresses, the order of the variables matters. That is, octet 2 must be considered after octet 1, and octet 3 must be considered after octet 2 and so on to yield rules like
IF octet1 == 206 THEN label => OK
IF octet1 == 193 && octet2 == 64 && octet3 == 11 THEN label => SPAM
What type of decision tree model is this and what algorithm/tool could help here? Is there some sort of variation I can use? I prefer to stick with R.