Preventing batch operations from a single device-Fraud Detection(Fraud Detection)-阿里云帮助中心

In registration and marketing scenarios, black-market actors may exploit a device to perform batch operations for spam user registrations or promotion abuse. The decision engine is seamlessly integrated with Device Fraud Detection. If you integrate Device Fraud Detection SDK with your app and include the deviceToken field obtained from the SDK in the input parameters of the decision engine, you can prevent and control batch operations from the same device.

Add the deviceToken field to an event

You can add the deviceToken field to an event. The deviceToken field is an encrypted string. After the decision engine receives this field, the engine can automatically parse the device information based on the configured policy and use the information for risk control policy calculation.
You can call the getDevicetoken API operation of Device Fraud Detection SDK for Android or iOS to obtain the value of the deviceToken field. The value is collected by a client, sent to the server, and then aggregated with all other event fields before being sent to the decision engine.

In the Risk Detection console, navigate to the Event Management page and click Create Event. Enter an event name, such as "Prevent Batch Device Operations", and a description. In the event fields table, deviceToken (Mobile Device Token) is already included as a default system field of type string.

Create device-related velocity variables

On the Velocity Variable tab of the Variable Center module, create velocity variables related to the device ID to identify batch operations from the same device.
Take note of the following parameters:
1. Variable Type: Select Number. The system deduplicates data before calculation from the account dimension, which indicates that multiple identical actions by the same account are counted as one occurrence.
2. Time Window: Specify Recent 1 Day. This value is a rolling time period, which indicates that the calculation covers the past 24 hours from the current time.
3. Main object: Select the device ID. This value specifies that data of the same device is accumulated.
4. Cumulative object: Select the account ID.
After you click OK, find the velocity variable on the Velocity Variable tab and click Enable in the Actions column to enable the variable.

Use a velocity variable

On the Policy Management page, create a policy and associate it with the specified event.
Click the Conditional Content parameter and select the velocity variable that you created. If the number of registered accounts on the same device in one day is greater than 3, the highRisk tag is returned.

Set the Policy Output Tag type to Constant. When you finish, click Submit. To reduce operational risk, run the policy in trial mode before deploying it to production.

Verify the result

You can call Fraud Detection API in OpenAPI Explorer to verify the configuration of the event. The following example is provided only for reference.
Input: The deviceToken field in the input parameters is obtained from the same device. The field value obtained each time is different. The value of the accountId parameter is changed with each call. If a call is made four consecutive times, the cumulative variable value is 4.
```
{
  "eventCode": "de_example",
  "deviceToken": "***",
  "accountId": "example001"
}
```
Output: When the number of accounts accumulated on the same device is greater than 3 and the policy is hit, the highRisk tag is returned.
```
{
  "Message": "OK",
  "RequestId": "371B720E-D755-5008-80BB-528A4B744BD5",
  "Data": {
    "tags": "highRisk"
  },
  "Code": 200
}
```