I am trying to build a machine learning model which classifies attacks. My data has a bunch of IP addresses, and I don't know if I should use the IP address as a feature to detect attacks. I found this interesting argument:
"IP can be spoofed by the attacker. Hence, it may be infeasible to use it as a feature for attack classification in intrusion detection systems. Features which are independent and cannot be changed by attacker can be useful in classification problems."
This is pretty logical for me, but I don't know if I should completely ignore the IP address in intrusion detection, especially that my data (log files from different devices) has multi-step attack scenarios, What do you think?