Fraud Detection:Integrate Device Fraud Detection SDK for Android

Prerequisites

• Android 4.0.3 or later and minSdkVersion 15 or later are used.

• To ensure that integration of SDKs meets privacy rules, you must use the latest versions of SDKs that are released on the official website of Alibaba Cloud. This prevents privacy leaks and ensures that your business meets compliance regulations. Before you use Device Fraud Detection, make sure that you understand the relevant rules of personal information processing and Fraud Detection SDK Privacy Policy. Make sure that you integrate the SDK based on the descriptions provided in Compliant use of Device Fraud Detection SDK.

Permission description

To improve the efficiency of device fraud detection, we recommend that you grant specific permissions. The following table describes the permissions.

Download and configure the SDK

1. Download the Android SDK package and decompress it. The SDK package is a standard .aar package for Android.

2. Copy and paste the .aar SDK package to the libs directory of your project. Add the following dependencies to the build.gradle file of the app:

   // The SDK package.
   implementation files('libs/Android-AliyunDevice-Version number.aar')
   
   // Third-party network library dependencies.
   implementation 'com.squareup.okhttp3:okhttp:3.11.0'
   implementation 'com.squareup.okio:okio:1.14.0'

   Important

   You must add the third-party network library dependencies. Otherwise, the SDK is unable to connect to the Internet.

Collect information

When you use Device Fraud Detection, you must call the following function to collect the required data. We recommend that the function be called at the earliest opportunity when compliance requirements are met.

• Function syntax

public interface SecurityInitListener {
    // The code parameter specifies the status code of the operation.
    void onInitFinish(int code);
}
public void initWithOptions(Context ctx, 
                 	String appKey, 
                	Map<String, String> options,
                 	SecurityInitListener securityInitListener);

• Parameters

  ctx: Valid values are Application Context and Activity Context.

  appKey: the identity of a user. You can obtain the identity on the Device APP management tab in the Fraud Detection console.

  options: the optional parameters for data collection. The value can be null. The following table describes the optional parameters.

securityInitListener: the callback operation for data collection by using the Device Fraud Detection SDK, which can be used to determine whether data is collected. For more information about the value range of the code parameter, see the "Status codes" section of this topic.

• Return value

  None.

Obtain the client token

Obtain a client token, send the token to the server, and then obtain the device risk information based on the event parameters and response parameters. For more information, see Service event parameters and response parameters for Device Fraud Detection

• Function syntax

public class Securitytoken {
    // The status code of the operation.
    public int code;
    
    // The token that is used to query the result on the server side. 
    public String token;
}

public Securitytoken getDevicetoken();

• Return values

  The value is a Securitytoken class.

  code: the status code of the operation. The parameter indicates whether the operation is successful. For more information about the value range of the code parameter, see the "Status codes" section of this topic.

  token: the token that is returned to the client. The data type of the token is string. The token can be used to call the Device Fraud Detection API.

Status codes

Sample code

When you use Device Fraud Detection, you must call the data collection operation. We recommend that the operation be called at the earliest opportunity when compliance requirements are met.

The value of the ALIYUN_APPKEY parameter is used to identify a user. You can obtain the identity on the Device APP management tab in the Fraud Detection console.

You can use the DataType field of the options parameter to configure the specific type for data collection. This helps meet the privacy protection requirements in specific business scenarios.

public class CustomApplication extends Application {
    private static String ALIYUN_APPKEY = "xxxx";

    @Override
    public void onCreate() {
        super.onCreate();

        // Manage privacy data collection by excluding specific types of data. If you set the value to NO_IDENTIFY_DEVICE_DATA, non-resettable device identifiers are excluded. You can specify multiple data types. Separate the data types with vertical bars (|). The input of "(NO_IDENTIFY_DEVICE_DATA))" cannot be empty. 
        Map<String, String> options = new HashMap<>();      
        options.put("DataType", String.valueOf(NO_IDENTIFY_DEVICE_DATA));
        
        If you use the Device Fraud Detection SDK to collect data, make sure that the data collection operation is called at the earliest opportunity in risk scenarios. 
        SecurityDevice.getInstance().initWithOptions(this, ALIYUN_APPKEY, options, null);
    }
}

In scenarios that require fraud detection, such as account registration and promotional events, the client token must be obtained and sent to the application server. Make sure that the interval between the call for data collection and the call getDevicetoken is at least 2 seconds.

The getDeviceToken operation is relatively time-consuming. Make sure that the client calls the operation by using a non-main thread.

new Thread() {
    @Override
    public void run() {
        Securitytoken st = SecurityDevice.getInstance().getDevicetoken();
        if(null != st){
            if(SecurityCode.SC_SUCCESS == st.code){
                Log.d("AliyunDevice", "token: " + st.token);

                // Send the token to the self-managed application server and call the Device Fraud Detection API. 
                // sendToAPPServer(st.token);
            } else {
                Log.e("AliyunDevice", "getDevicetoken error, code: " + st.code);
            }
        } else {
            Log.e("AliyunDevice", "getDevicetoken is null.");
        }
    }
}.start();

Operation obfuscation

-keep class net.security.device.api.** {*;}
-dontwarn net.security.device.api.**

Call the Device Fraud Detection API

Use the deviceToken parameter and other related parameters to call the Device Fraud Detection API. For more information, see the following topic:

Service event parameters and response parameters for Device Fraud Detection

FAQ

1. Which architectures are supported by the Device Fraud Detection SDK?

The Device Fraud Detection SDK supports the ARM, ARMv7, and ARM64 architectures.

2. What is the size of the SDK package?

The size of a mono-architecture Shared Object (SO) file is approximately 1.8 MB.

To prevent reverse engineering and ensure the security of data in transit, an SDK contains a large number of obfuscation, dilation, and cryptographic operations. Therefore, the size of the SDK package is also large.

3. What is the validity period of a device token? Can I use a device token to call the server-side API multiple times?

A device token is valid for seven days. You can use the same device token to call the server-side API multiple times.