Amazing work! There's some intersting projects collecting attackers ip's from honeypots across Europe. One of them is Stratosphere IPS from Prague Tech University. It would be nice to consider adding these ip's data to your Ml models =)