We're trying to label the training data as normal or abnormal network activities. Does the training data already have a column for label or we need define abnormal network ourselves? Shall we define the criteria based on our network knowledge for labelling?
Training data is unsupervised data, it don't have any labeling for abnormal network. You can define criteria based on your network knowledge or go with unsupervised algorithms.