CIPSO Labeling of Network Packets to/from KVM Windows Guest OS

Is there any method by which KVM in conjunction with Netlabel or other 
labeling function can be configured such that  a statically configured 
label
 is added for all outgoing network traffic generated by a specific Windows 
Guest OS instance 
is verified and then removed for all incoming network traffic delivered to 
a specific Windows Guest OS instance

in a manner which is transparent to Windows and Windows applications?