Providing information security to an entity by detecting impossible travel events across multiple cloud-based application services

Abstract

For an entity having access to a plurality of independent cloud-based applications and including a member having access to at least one cloud-based application from the plurality of independent cloud-based applications via at least one member account associated with the at least one cloud-based application, a plurality of activities performed using the at least one member account can be analyzed with at least one machine learning model configured to flag an activity of an activity type from the plurality of activities in response to (1) the activity being associated with a geolocation outside a trusted geolocation cluster at an entity level for the entity, a trusted geolocation cluster at an activity level for the activity type, and/or a trusted geolocation cluster at a member level for the member, or (2) the activity being associated with an internet service provider (ISP) that is not recognized as being (a) a trusted ISP at the entity level for the entity, (b) a trusted ISP at the activity level for the activity type, and/or (c) a trusted ISP at the member level for the member.