A security team lead describes a system that flags anomalous login patterns by learning the normal behavior of each user account over time, without being told in advance what 'anomalous' looks like. Which category of machine learning best describes this approach?

• ASupervised learning, since the system is trained on labeled examples of attacks
• BUnsupervised learning, since the system learns baseline patterns from unlabeled behavioral data
• CReinforcement learning, since the system is rewarded for correct classifications
• DFederated learning, since the model trains across multiple decentralized devices