1. A method, comprising: receiving, at a device in a network, a set of output label dependencies for a set of attack detectors that exploit dependencies between overlapping labels used by different attack detection classifiers; identifying, by the device, applied labels that were applied by the attack detectors to input data regarding the network, wherein probabilities are associated with the applied labels; determining, by the device, a combined probability for two or more of the applied labels based on the output label dependencies and the probabilities associated with the two or more labels; and selecting, by the device, one of the applied labels as a finalized label for the input data based on the probabilities associated with the applied labels and on the combined probability for the two or more labels.