I am working on a classification problem using IP addresses as input and I am trying to find which IP addresses or subnets are likely to belong to a spammer. I have data consisting of the four octets in the IP address as well as a label: SPAM or OK.

This feels like a good problem for a decision tree, but I am finding that most decision tree algorithms consider the order of the variables interchangeable. For example, `ctree` from `party` might output a rule interpreted as

`IF octet1 == 192 && octet4 == 190 THEN label => SPAM`

but with IP addresses, the order of the variables matters. That is, octet 2 must be considered after octet 1, and octet 3 must be considered after octet 2 and so on to yield rules like

`IF octet1 == 206 THEN label => OK`

`IF octet1 == 193 && octet2 == 64 && octet3 == 11 THEN label => SPAM`

What type of decision tree model is this and what algorithm/tool could help here? Is there some sort of variation I can use? I prefer to stick with R.