Can IP addresses considered as a useful feature for botnet attack stage detection?

Question

I\'m doing frequent itemset mining for network data. My dataset features are source IP, destination IP, source port, destination port, length, protocol. I\'m training a machine