Risk signal reference
Risk Signals: Risk signal reference
Each signal should provide a clear explanation in the Risk Signal Dictionary. When customers review signals, focus on the following information:
| Information | What you can do with it |
|---|---|
| Signal Code | Accurately identify the signal in events, APIs, and logs |
| Display name | Quickly understand the meaning of the signal |
| English name | Compare with technical documentation, SDK or overseas team |
| Risk Classification | Understanding signals as device, network, client, or bot risks |
level | Understand the level of experience risk |
confidence (confidence score) | Understand the statistical confidence of test results |
| Supported platforms | Determine whether the signal is applicable to Web, iOS, Android or mini programs |
| Trigger conditions | Understand under what circumstances the signal will occur |
| Special situations | Understand scenarios where misjudgment may be possible or where business judgment is required |
| Recommended actions | Reference for choosing observation, verification, restriction or blocking methods |
Signal Code
Signal Code is the stable identifier for a signal in the console, API, and event log. When troubleshooting or contacting support, provide the Signal Code rather than only the display name.
Signal Code maps one-to-one to the risk code, although display formats may differ by product. Geelab returns signal, level, and confidence in the signal object; do not treat level or confidence as the Signal Code.
The difference between level and confidence
level and confidence answer different questions:
level: What is the degree of risk of this signal from an empirical point of view.confidence: How reliable are the test results from a statistical perspective?
A high risk level does not necessarily mean that every detection has the same level of confidence; a higher level of confidence does not mean that the business should be rejected. Signal meanings, business actions and historical behaviors should be referenced at the same time when handling.
Support platform
Whether the signal appears is related to the platform capabilities. The device environments available for Web, iOS, Android, and applets are different, so the same signal may not necessarily be available on all platforms.
If a field displays — or the signal does not appear on the current platform, access has not necessarily failed; the platform may simply not provide that detection capability.
The current product information specifically points out: Domestic device fingerprint solutions support mini programs, and Geelab mini program capabilities need to be confirmed based on specific product solutions. When you need small program access, please contact Geelab to confirm the support scope. Do not directly use the configuration assumptions of Web, iOS or Android.
Trigger conditions and special situations
The trigger should tell you the device or network characteristics that the signal was detected on, such as:
- The device runs in an emulator environment.
- The request comes from a proxy or VPN network.
- The client detected a tampering tool.
- Applications are at risk of being re-signed or cloned.
The special situation description is used to remind you that the signal may have reasonable business explanations and cannot be handled directly outside the scenario. For example, testers, cloud phone operations, corporate proxy networks, or private browsers may all generate specific signals.