A company wants to prompt users for additional verification when they access the site from unusual locations. They have terabytes of web logs with source IPs and, for authenticated requests, login names. Which approach should you use to build the ML-based decision that flags when to request extra information?

The IP Insights algorithm in Amazon SageMaker is specifically designed to detect anomalous IP address usage patterns, making it ideal for identifying unusual login locations. Scheduling nightly updates ensures the model learns from the latest access patterns and adapts to changes, maintaining accuracy. Using SageMaker Ground Truth to label successful/failed access is not directly relevant to detecting unusual locations, as both can originate from unusual IPs. Training a binary classifier with factorization machines (FM) or IP Insights on successful/failed access would predict authentication outcomes, not location anomalies. Object2Vec is for learning embeddings of objects and is not the best fit for this specific anomaly detection task.