M10. KNN Classification for user behavior anomaly detection