The correct answer is C – Develop an anomaly detection system. According to AWS documentation, anomaly detection models are specifically used to identify unusual or suspicious patterns in data, such as unexpected IP access behavior, unusual network traffic, login anomalies, or deviations from normal usage patterns. Amazon SageMaker and Amazon Lookout for Metrics both support anomaly detection capabilities that detect deviations from learned baselines. AWS highlights that anomaly detection is widely used in cybersecurity, fraud detection, intrusion monitoring, and identifying suspicious IP addresses. Speech recognition (A) and NLP named entity recognition (B) do not classify threat behavior. Fraud forecasting (D) focuses on long-term prediction patterns, not real-time anomaly detection. Since identifying malicious IP sources requires spotting activity outside the normal distribution, anomaly detection is the most accurate and AWS-aligned solution.

Referenced AWS Documentation:

AWS Machine Learning Specialty Guide – Anomaly Detection Use Cases

Amazon SageMaker Documentation – Random Cut Forest (RCF) for Anomaly Detection