A data scientist at a healthcare company wants to train a model to detect anomalous access patterns in EHR systems. She has 3 years of access logs but no labeled examples of actual insider threats - no one was ever caught and labeled. What ML approach is most appropriate given the absence of labeled data?

• A.Unsupervised anomaly detection (e.g., isolation forest, autoencoder, or clustering) that learns the distribution of normal access patterns and flags statistical outliers without requiring labeled examples of malicious behavior
• B.Supervised classification is the only valid approach; without labeled examples of insider threats, no ML model can be trained
• C.Transfer learning from a publicly available labeled insider threat dataset, since labeled examples from other organizations will generalize to this environment