I was reading about past attacks on Ethereum network and I pictured the following hypothetical scenario: there is a tool or automated, machine learning based anomalous monitor to check out constantly account's behavior, considering some factors such as account's level of activity, gas spent/received and so on.
Given this scenario, I would like to post the following question: who would benefit at most of being aware of what could be considered anomalous activity accounts? Who would be interested to know about any report generated by this hypothetic monitor?