Impossible Travel Detection Across Cloud Apps Using Trusted Location Clusters
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Detecting impossible travel events across multiple cloud-based application services is complex due to the distributed nature of these services, which can include virtual private networks, satellite offices, and variations in IP address reporting, posing security risks for entities using these services.
Innovation Solution
A method involving machine learning models to determine trusted geolocation clusters and trusted internet service providers (ISPs) at entity, activity, and member levels, flagging activities outside these clusters or associated with untrusted ISPs, and applying secondary filtration to identify potential security threats.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If distributed cloud-based application services are used to provide versatile access, then adaptability and service availability are improved, but device complexity and difficulty of detecting impossible travel events increase
Solution Approach 1:
The patent segments the detection system into multiple independent components: geolocation concentration analysis, IP address concentration analysis, trustworthiness scoring, and impossible travel detection. Each component processes specific data types and can be independently configured for different cloud services, reducing overall system complexity while maintaining versatility across distributed services
Solution Approach 2:
The patent creates a universal detection framework that works across multiple cloud-based application services simultaneously. The system analyzes geolocation and IP address concentrations from various services (email, storage, collaboration tools) using the same core algorithms, enabling the system to handle diverse services without requiring service-specific implementations
2Reliability
If multiple cloud-based application services are monitored to improve security coverage, then reliability of security detection is improved, but device complexity and measurement difficulty increase
Solution Approach 1:
The patent introduces intermediary analysis layers that aggregate and normalize data from multiple cloud services before final impossible travel detection. Geolocation concentrations and IP address concentrations serve as intermediary metrics that simplify the detection process by pre-processing raw activity data into meaningful patterns that are easier to analyze for impossible travel events
Solution Approach 2:
The system implements feedback mechanisms where trustworthiness scores from initial analysis feed into the impossible travel detection process. Activities with low trustworthiness scores trigger more stringent impossible travel analysis, while high-trust activities are monitored with reduced intensity, optimizing detection reliability across multiple services
3Measurement precision
If geolocation concentrations and IP address concentrations are analyzed to identify trusted sources, then measurement precision is improved, but loss of time and computational overhead increase
Solution Approach 1:
The patent applies partial analysis by focusing computational resources on activities that deviate from established concentration patterns. Instead of analyzing every activity in detail, the system identifies activities outside normal geolocation/IP ranges and applies intensive analysis only to these anomalies, reducing overall analysis time while maintaining precision for critical detections
Solution Approach 2:
The system performs preliminary analysis by continuously building geolocation and IP address concentration models from historical activity data. These pre-computed concentration profiles enable faster real-time detection, as new activities can be quickly compared against established patterns without requiring full re-analysis of historical data
4Measurement precision
If trustworthiness scores are generated based on multiple factors to improve detection accuracy, then measurement precision is improved, but device complexity increases
Solution Approach 1:
The patent uses parameter changes by dynamically adjusting the weightings of different factors (geolocation concentration, IP address concentration, service type, time of day) in the trustworthiness score calculation. The system adapts these parameters based on learned patterns from historical data, allowing precise measurement of trustworthiness while managing complexity through adaptive rather than static multi-factor analysis
Data Source
AI summary
For an entity having access to a plurality of independent cloud-based applications and including a member having access to at least one cloud-based application from the plurality of independent cloud-based applications via at least one member account associated with the at least one cloud-based application, a plurality of activities performed using the at least one member account can be analyzed with at least one machine learning model configured to flag an activity of an activity type from the plurality of activities in response to (1) the activity being associated with a geolocation outside a trusted geolocation cluster at an entity level, an activity level, and/or a member level, or (2) the activity being associated with an internet service provider (ISP) that is not recognized as being (a) a trusted ISP at the entity level, the activity level, and/or the member level.