How do you design ML models for malicious network detection?