Fraud Detection:Integrate the Fraud Detection SDK for Android

Initialize the SDK (initWithOptions)

Call this method early in your app lifecycle to start collecting device information. Complete all privacy compliance steps before calling this method.

• Function prototype

  public interface SecurityInitListener {
      // code indicates the API call status
      void onInitFinish(int code);
  }
  public void initWithOptions(Context ctx,
                   String appKey,
                  Map<String, String> options,
                   SecurityInitListener securityInitListener);

• Parameters

  ctx: The current Application Context or Activity Context.

  appKey: Identifies your app. Obtain this value from the Developer Center.

  options: Optional data collection settings. Defaults to null. Available options are as follows.

  Field	Description	Example
  IPv6	Whether to use an IPv6 domain to report device information. 0 (default): Uses an IPv4 domain. 1: Uses an IPv6 domain.	"1"
  CustomUrl	Sets the domain name of the data reporting server.	"https://cloudauth-device.aliyuncs.com"
  CustomHost	Sets the host of the data reporting server.	"cloudauth-device.aliyuncs.com"
  DataType	Specifies the types of sensitive data not to collect. Default (empty): Collects all data. Configurable values are listed in the following table.	Single selection: NO_UNIQUE_DEVICE_DATA Multiple selection: NO_UNIQUE_DEVICE_DATA | NO_IDENTIFY_DEVICE_DATA

  Sensitive Data Type	Description	Device Information Fields
  NO_UNIQUE_DEVICE_DATA	Resettable unique device identifiers	Includes: OAID, Google Advertising ID, Android ID.
  NO_IDENTIFY_DEVICE_DATA	Non-resettable unique device identifiers	Includes: IMEI, IMSI, SimSerial, BuildSerial (SN), MAC address.
  NO_BASIC_DEVICE_DATA	Basic device identifiers	Includes: Device name (Build.DEVICE), Android version (Build.VERSION#RELEASE), screen resolution.
  NO_EXTRA_DEVICE_DATA	Extended sensitive information	Includes: Black/gray market app list, LAN IP, DNS IP, connected Wi-Fi info (SSID, BSSID), nearby Wi-Fi list, location info.

  Note

  To report to a specific region, set CustomUrl and CustomHost to the corresponding endpoint. No configuration is needed by default.

  Default endpoints:

  • Singapore: https://cloudauth-device.ap-southeast-1.aliyuncs.com

  • Hong Kong (China): https://cloudauth-device.cn-hongkong.aliyuncs.com

  • Germany: https://cloudauth-device.eu-central-1.aliyuncs.com

  • US: https://cloudauth-device.us-west-1.aliyuncs.com

  securityInitListener: Initialization callback. Check the callback to determine whether initialization succeeded. You can pass null if you don't need a callback. For valid values of the code field, see Return codes.

  public interface SecurityInitListener {
      // code indicates the API call status
      void onInitFinish(int code);
  }

• Example

  public class CustomApplication extends Application {
      private static String USER_PRODUCT_KEY = "123e4567e89b12d3a45642661417****";
  
      @Override
      public void onCreate() {
          super.onCreate();
  
          Map<String, String> options = new HashMap<>();
          options.put("IPv6", "0"); // Use IPv4
          // Configure sensitive data collection. Use | to combine multiple values, then convert to a string.
          //options.put("DataType",  String.valueOf(NO_UNIQUE_DEVICE_DATA | NO_IDENTIFY_DEVICE_DATA));
          // Set a custom data reporting endpoint
          // options.put("CustomUrl", "xxx"); Reporting site URL
          // options.put("CustomHost", "xxx"); Reporting site host
  
          // Standard call (recommended)
          SecurityDevice.getInstance().initWithOptions(this, USER_PRODUCT_KEY,
                                                      options, null);
  
          // Callback call
          SecurityDevice.getInstance().initWithOptions(this, USER_PRODUCT_KEY,
                                        options, new SecurityInitListener() {
                @Override
                public void onInitFinish(int code) {
                    if (SecurityCode.SC_SUCCESS != code) {
                        Log.d("AliyunDeviceRisk", "Initialization failed");
                    } else {
                        Log.d("AliyunDeviceRisk", "Initialization succeeded");
                    }
                }
            });
      }
  }

Obtain the device token (getDeviceToken)

Obtain the device token and send it to your business server. Your server then calls the Device Fraud Detection API to check the fraud detection result.

• Function prototype

  public SecurityToken getDeviceToken();
  // Recommended: pass bizId
  public SecurityToken getDeviceToken(String bizId)

• Parameters

  bizId: A business-specific identifier to associate with the token. Optional.

• Return value

  Returns a SecurityToken object, defined as follows:

  public class SecurityToken {
      // API call status code
      public int code;
  
      // Token string used to query results on the server side.
      public String token;
  }

  • code: The API call status code. Check this value to determine whether the call succeeded. For valid values, see Return codes.

  • token: The token string to use in subsequent calls to the Device Fraud Detection API.

    Important

    On a stable network, the token is approximately 600 bytes. On a weak connection, it grows to approximately 2.5 KB with a special prefix:

    • International: Good connection "U0dfTkxxxx", weak connection "U0dfUFxxxx".

    If you see many long tokens:

    • Verify that the client network is stable.

    • Wait at least 3 seconds between calling initWithOptions and getDeviceToken with an interval of at least 2 seconds with an interval of at least 3 seconds.

• Example

  new Thread() {
      @Override
      public void run() {
          // Pass bizId to prevent deviceToken tampering.
          String bizId = "1234567890abcdef1234567890ab****";
          SecurityToken deviceToken = SecurityDevice.getInstance().getDeviceToken(bizId);
          if(null != deviceToken){
              if(SecurityCode.SC_SUCCESS == deviceToken.code){
                  Log.d("AliyunDevice", "token: " + deviceToken.token);
              } else {
                  Log.e("AliyunDevice", "getDeviceToken error, code: " + deviceToken.code);
              }
          } else {
              Log.e("AliyunDevice", "getDeviceToken is null.");
          }
      }
  }.start();

After you obtain the deviceToken, pass it to your business server. Your server then calls the Device Fraud Detection API with this token to query and verify device risk information.