Fraud Detection:Integrate the Fraud Detection SDK for Android

1. Initialize (initWithOptions)

This method completes SDK initialization and information collection. When performing Fraud Detection, call it as early as possible while meeting compliance requirements. You need to call it only once per app launch.

• Function prototype

public interface SecurityInitListener {
    // code indicates the API call status code
    void onInitFinish(int code);
}
public void initWithOptions(Context ctx,
                 String appKey,
                Map<String, String> options,
                 SecurityInitListener securityInitListener);

• Parameters

  • ctx: The current Application Context or Activity Context.

  • appKey: Used to identify the user. You can apply for it in Device App Management of the Alibaba Cloud console.

  • options: Optional information collection settings. Defaults to null. The available options are as follows.

  • securityInitListener: The initialization callback. You can use the callback to check whether initialization succeeds. Default value: null. For valid values of the code field, see Status return values.

  Field	Description	Example
  IPv6	Whether to use an IPv6 domain to report device information. 0 (default): uses an IPv4 domain. 1: uses an IPv6 domain.	"0"
  CustomUrl	Sets the domain name of the data reporting server. Used when reporting to a specific site. No configuration is required by default.	"https://cloudauth-device.aliyuncs.com"
  CustomHost	Sets the host of the data reporting server. Must be used together with CustomUrl. Neither CustomHost nor CustomUrl needs to be set by default.	"cloudauth-device.aliyuncs.com"
  DataType	Sets the types of device data not to collect. Empty by default (recommended), which collects all data. The configurable values are listed in the following table.	Single selection: NO_UNIQUE_DEVICE_DATA Multiple selection: NO_UNIQUE_DEVICE_DATA | NO_IDENTIFY_DEVICE_DATA

  DataType parameter description

  Type of data collected	Description	Device information field details
  NO_UNIQUE_DEVICE_DATA	Resettable unique device identifiers	Includes: Open Anonymous Device Identifier (OAID), Google Advertising ID, Android ID.
  NO_IDENTIFY_DEVICE_DATA	Non-resettable unique device identifiers	Includes: International Mobile Equipment Identity (IMEI), International Mobile Subscriber Identity (IMSI), SimSerial, BuildSerial (SN), MAC address.
  NO_BASIC_DEVICE_DATA	Basic device information	Includes: OS version, device model, screen resolution.
  NO_EXTRA_DEVICE_DATA	Device extended information	Includes: black/gray market app list, local area network (LAN) IP, DNS IP, connected Wi-Fi information (SSID, BSSID), nearby Wi-Fi list.

  CustomUrl and CustomHost parameter description

  To report to a specific site, set CustomUrl and CustomHost to the corresponding region. No configuration is required by default.

  Region	Address
  Singapore (default)	CustomUrl: https://cloudauth-device.ap-southeast-1.aliyuncs.com CustomHost: cloudauth-device.ap-southeast-1.aliyuncs.com
  China (Hong Kong)	CustomUrl: https://cloudauth-device.cn-hongkong.aliyuncs.com CustomHost: cloudauth-device.cn-hongkong.aliyuncs.com
  Germany	CustomUrl: https://cloudauth-device.eu-central-1.aliyuncs.com CustomHost: cloudauth-device.eu-central-1.aliyuncs.com
  US	CustomUrl: https://cloudauth-device.us-west-1.aliyuncs.com CustomHost: cloudauth-device.us-west-1.aliyuncs.com

public class CustomApplication extends Application {
    // Obtain this after creating an application in Device App Management of the Alibaba Cloud console
    private static String appKey = "<Obtain after creating an application in the console>";

    @Override
    public void onCreate() {
        super.onCreate();

        Map<String, String> options = new HashMap<>();
        options.put("IPv6", "0"); // Set to IPv4. Change to "1" to use IPv6.
        // Add a privacy data collection switch. For multiple selections, use | for bitwise OR, then convert to a string.
        //options.put("DataType",  String.valueOf(NO_UNIQUE_DEVICE_DATA | NO_IDENTIFY_DEVICE_DATA));
        // Set a custom data reporting region (not required by default; used only for specific sites)
        // options.put("CustomUrl", "https://cloudauth-device.aliyuncs.com");
        // options.put("CustomHost", "cloudauth-device.aliyuncs.com");

        // Method 1: Standard call (recommended when the initialization result is not concerned)
        SecurityDevice.getInstance().initWithOptions(this, appKey, options, null);

        // Method 2: Callback call (used when the initialization result needs to be monitored)
        SecurityDevice.getInstance().initWithOptions(this, appKey, options, new SecurityInitListener() {
              @Override
              public void onInitFinish(int code) {
                  if (SecurityCode.SC_SUCCESS != code) {
                      Log.d("AliyunDeviceRisk", "Initialization failed. Code=" + code);
                  } else {
                      Log.d("AliyunDeviceRisk", "Initialization succeeded");
                  }
              }
          });
    }
}

2. Obtain the client token (getDeviceToken)

Obtain the client token and report it to your business server. Then, obtain device risk information through the server-side Server-side API integration.

• Function prototype

public SecurityToken getDeviceToken();
// Recommended: pass bizId to associate the business ID with the deviceToken
public SecurityToken getDeviceToken(String bizId)

public class SecurityToken {
    // API call status code
    public int code;

    // Token string used to query results on the server side.
    public String token;
}

• Example

// Recommended to call on a non-main thread to avoid blocking the UI and causing ANR
new Thread() {
    @Override
    public void run() {
        // Recommended: pass bizId to bind the token with the business ID.
        // Pass the same bizId when querying results on the server to verify whether the token has been tampered with.
        String bizId = "1234567890abcdef1234567890ab";
        SecurityToken deviceToken = SecurityDevice.getInstance().getDeviceToken(bizId);
        if(null != deviceToken){
            if(SecurityCode.SC_SUCCESS == deviceToken.code){
                Log.d("AliyunDevice", "token: " + deviceToken.token);
            } else {
                Log.e("AliyunDevice", "getDeviceToken error, code: " + deviceToken.code);
            }
        } else {
            Log.e("AliyunDevice", "getDeviceToken is null.");
        }
    }
}.start();

3. Send the token to your business server

After successfully obtaining the deviceToken, pass the deviceToken as a parameter to your business server. The server then calls the Alibaba Cloud Device Fraud Detection API, passes in the deviceToken, and queries and verifies device risk information.