Hopefully explaining this is the right way. Apologies if some of it is unclear at all.
I am working with network data and want to use a supervised approach to identify whether a sample (packet) is malicious or not, so a binary classification.
In my head I have a number of rows/samples which represent the packets and in there are features that could be used to identify whether a sample is malicious. A simple one would be say performing a ping of death attack to have samples that have the size of the packet/payload above what would be normal for a ping. This I can see as you would mark the pings of death with a 1 and a normal ping with a 0.
My issue comes when looking at multiple samples that need to be combined in order to identify an attack. For instance with some attacks a solitary sample will not signal an attack but a particular pattern of samples or frequency of samples would. Does anyone know a way of preparing the data or a supervised model you can do this with?