Detecting Impossible Travel in the On-Premise Settings

A computer implemented method of determining impossible travel for a specific user entity associated with an on-premises site, the method comprising:

• identifying an estimated location of an on-premises site associated with an organization network, wherein identifying the estimated location of an on-premises site comprises aggregating connection information of remote devices, remote from the on-premises site connecting to the on-premises site;
• identifying information related to an on-premises connection event including the estimated location, time information, and a first user identification for an entity;
• identifying information related to a different connection event, where the information comprises location information, time information and a second user identification for the entity;
• and
• using the information related to the on-premises connection event and the information related to the different connection event, detecting impossible travel for the entity;
• and
• providing an alert indicating an impossible travel condition.

A computer system for determining impossible travel for a specific user entity associated with an on-premises site, the system comprising:

• a gateway configured to accept communications from devices connecting to the on-premises site;
• a monitor coupled to the gateway, wherein the monitor is configured to:
• aggregate connection information of remote devices, remote from the on-premises site connecting to the on-premises site and to estimate a location of the on-premises site;
• identify information related to an on-premises connection event including the estimated location, time information, and a first user identification for an entity;
• identify information related to a different connection event, where the information comprises location information, time information and a second user identification for the entity;
• and
• use the information related to the on-premises connection event and the information related to the different connection event, detecting impossible travel for the entity;
• and
• provide an alert indicating an impossible travel condition.