Answer: Unsupervised Learning

## Explanation **Unsupervised Learning** is the correct approach because: - **No predefined labels**: The team doesn't have attack labels, which means they cannot use supervised learning that requires labeled training data - **Anomaly detection**: Unsupervised learning algorithms can identify patterns and outliers in data without prior knowledge of what constitutes "normal" or "abnormal" behavior - **Pattern discovery**: These algorithms can cluster similar traffic patterns and detect deviations that might indicate potential attacks **Why other options are incorrect:** - **B) Supervised Learning**: Requires labeled training data with known attack patterns - **C) Reinforcement Learning**: Focuses on learning through trial-and-error interactions with an environment, not suitable for anomaly detection - **D) Regression**: Used for predicting continuous values, not for detecting anomalies or patterns In cybersecurity, unsupervised learning techniques like clustering, principal component analysis (PCA), and autoencoders are commonly used for detecting unusual network traffic patterns when attack signatures are unknown.

Author: Ritesh Yadav