Logon fraud detection helps you protect user accounts that hold high-value assets, such as balances, bank cards, points, and credit limits. This prevents financial losses, customer complaints, and reputational damage caused by malicious attacks and account theft.
Editions
To meet the risk control needs of enterprises across various industries and at different stages, logon fraud detection is available in a basic edition and an advanced edition. The following table compares them.
Features | Basic edition | Advanced edition |
real-time analysis | Supported. | Supported. |
return value | quantitative score | quantitative score, risk tag |
Device risk monitoring | Not supported. | Supported. Detects anomalies such as emulators, multi-boxing, device farms, group-controlled devices, cloud phones, and hooking. |
device fingerprint | Not supported. | Supported. |
gang analysis | Not supported. | Supported. |
Log delivery to Log Service | Not supported. | Supported. You can authorize log delivery. Logs are stored for free for one year. |
Service event parameters
Service event parameters are passed in a specific field of the common parameters.
This field requires parameters in JSON format. The following table describes the request parameters for logon fraud detection events in both the basic and advanced editions.
For example, for the mobile field, you must verify that the input is a valid Chinese mainland mobile phone number, such as an 11-digit number starting with 1.
Parameter | Supported editions | Description | Type | Example | Required |
accountId | basic edition, advanced edition | A unique identifier for the account. | String | 10123**** | Conditionally required. One of |
operateTime | basic edition, advanced edition | The UTC timestamp of the operation, accurate to the second. Note If you scan historical data for risks, pass the actual historical timestamp to avoid inaccurate risk assessment from incorrect time calculations. | Long | For example, 2018-04-01 12:00:00 UTC maps to the timestamp 1522555200. | Yes |
mobile | basic edition, advanced edition | The mobile phone number. By default, this is for a number in the Chinese mainland. For numbers outside the Chinese mainland, you must include the country code in the format of | String |
| Conditionally required. One of |
mobileMd5 | basic edition, advanced edition | A 32-character lowercase alphanumeric string. It is the MD5 hash of an 11-digit mobile phone number that starts with 1. | String |
| Required if |
ip | basic edition, advanced edition | The client's public IPv4 address. | String | 42.120.XX.XX | Yes |
basic edition, advanced edition | The email address. | String | admin****@aliyun.com | Conditionally required. One of | |
deviceToken | advanced edition | The device token obtained from the Device Risk SDK. | String | MzQvo1d7scyZ3tl_RcJZo_QOytAjy1LWRRLoRKo5oZSoo_JGj1ZoR5JGoRo5jcdn57gV5kxVRcLER5RQoZSvRZZQRcROjcMW5csZR_RGy_55RKJ_oooqZ7dSV5gRnKxOV7eWVQQjRtlRQoAjRcM0 | Optional, but recommended for improved accuracy. |
nickName | basic edition, advanced edition | The account nickname. | String | admin**** | Optional, but recommended. |
userAgent | basic edition, advanced edition | The User-Agent field from the HTTP request header. | String | Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/63.0.3239.84 Safari/537.36 | Optional, but recommended. |
refer | basic edition, advanced edition | The Referer field from the HTTP request header. | String | https://www.aliyun.com/ | Optional, but recommended. |
mac | basic edition, advanced edition | The MAC address of the device. | String | C0:77:36:2E:XX:XX | Optional, but recommended. |
operateSource | basic edition, advanced edition | The client type. Valid values:
| String | PC | Optional, but recommended. |
appVersion | basic edition, advanced edition | The app version. | String | 1.0 | Optional, but recommended. |
deviceType | basic edition, advanced edition | The device type. Valid values:
| String | PC | Optional, but recommended. |
Response parameters
The response parameters for logon fraud detection include a score and risk tags. The risk tags are returned only for the advanced edition.
For the business meaning of the score field value in the Data response parameter, refer to the recommended actions in the following table. These recommendations are based on the experience of the Alibaba Cloud risk control team.
You can adapt these recommendations to your specific business needs.
Score range | Risk level | Recommended action |
[85, 100] | High risk | Require strong verification (such as SMS verification or real-person authentication), or restrict access to high-risk business operations. |
[65, 85) | Medium-high risk | Require stronger verification (such as CAPTCHA, real-person authentication, or SMS verification). |
[35, 65) | Medium risk | Require simple verification (such as SMS verification or security question verification). |
[0, 35) | Low risk | Allow the operation, or tag it for observation. |
For the business meaning of the tags field value in Data, you can refer to the Access Management - Risk Tag Definitions module in the Fraud Detection console. Go to the page.
For more information about common response parameters, see Common response parameters.