Threat-Events™, In-App Threat Intelligence in Unity Apps with Native Android

This guide walks you through integrating Appdome’s Threat-Events™ into your Unity applications, offering a step-by-step approach to enhancing mobile app security.

What are Threat-Events?

Appdome Threat-Events is a robust threat-intelligence framework for Android and iOS apps. It consists of three elements: a Threat Event, the data from each Threat Event, and the Threat-Score™.

Threat-Events streamlines the process for mobile developers by enabling them to register for, listen to, and consume real-time attack and threat data, courtesy of Appdome’s suite of mobile app security, anti-fraud, and mobile anti-bot protection measures. This functionality offers mobile app developers the ability to customize business logic and the user experience based on the user’s risk profile and the specific attack or threat presented while also ensuring that their mobile application workflows are aware of attacks and threats. Furthermore, it facilitates the passing of threat data to other record systems. These include app servers, mobile fraud analysis systems, SIEMs, and other data collection points.

The purpose of Threat Events is to enable Android and iOS applications to adapt and respond to mobile app attacks and threats in real-time. This will ensure the safety of users, data, and transactions.

Mobile Application Threat-Events vs. Threat-Scores

Appdome Threat Events can be used as a stand-alone implementation in Unity Apps or in combination with Threat Scores. Threat Events provide in-app notifications of each attack or threat, as well as the metadata associated with the attack. Threat Scores provide the mobile developer with the ability to set a Threat Event event score for each threat, and receive the combined (aggregated) mobile end-user risk score at the time of the notification.

Prerequisites

Before implementing Threat-Events or Threat-Scores in your Unity app, ensure that the following conditions are met:

• Appdome account (Create a free Appdome account here)
• Mobile App (.apk or .aab for Android)
• Appdome account class: Appdome DEV or higher.
• Mobile Application Source Code.
• Signing Credentials: see Signing Secure Android Apps 
• Threat-Events or Threat-Scores have been enabled ( turned ON) for a specific protection.
• Correct identifiers for the Threat-Events for each protection.

Note: The specific identifiers for each Threat Event and Threat Score are in the knowledge base article associated with each protection.

Android

1. Enable Threat-Events
   • Select the checkbox next to Threat-Events for the desired runtime protection.
   • This enables (turns ON) Threat-Events for that feature.
2. Enable Threat Scores
   • Click the up/down arrow associated with Threat Scores to assign a specific score to each protection.
   • Assign a specific threat score between 1 and 999 to each protection.

Note: Threat-Events and Threat Scores can be used with or in place of server-based mobile anti-fraud solutions.

The figure below illustrates the locations of Threat Events and Threat Scores for various protections available on Appdome, including runtime mobile app security, anti-fraud, anti-malware, mobile Anti Bot, and more.

Communicating with Native Platforms in Unity

To communicate with native Android platforms in Unity, developers typically use native plugins or platform-specific APIs. Here’s a more detailed guide:

1. Native Plugins: Write code in Java/Kotlin for Android outside Unity. Connect it with Unity using Unity’s native plugin system. You can then call this code in Unity and receive messages back.
2. Unity’s APIs: Unity offers built-in APIs (`UnityEngine.Android`) to access device features directly from Unity scripts.
3. Third-Party Packages: Explore Unity Package Manager or the Asset Store for pre-built solutions that simplify communication with Android platforms.
4. Asset Store Plugins: Check the Unity Asset Store for plugins that provide ready-made solutions for native platform integration.

Pick the method that suits your project’s needs and your team’s skills.

Code Snippet Required for Using Threat-Events with Unity Apps with Native Android

Native Android Plugin:

1. Create a new Java file named JavaBroadcastReceiverInterface.java.
2. Add the following lines, which define JavaBroadcastReceiverInterface native Java interface for consuming threat events (will be implemented on the C# side):

   package com.unity3d.player;
   import android.content.Context;
   import android.content.Intent;
   public interface JavaBroadcastReceiverInterface 
   {
       void onReceive(Context var1, Intent var2);
   }

3. Create a new Java file named JavaBroadcastReceiver.java.
4. Add the following lines, which define JavaBroadcastReceiver class that implements BroadcastReceiver and introduces registerReceiver native Java method, that will register to a Threat Event (will be called from the C# side):

   package com.unity3d.player;
   import android.content.BroadcastReceiver;
   import android.content.Context;
   import android.content.Intent;
   import android.content.IntentFilter;
   public class JavaBroadcastReceiver extends BroadcastReceiver {
       private static JavaBroadcastReceiverInterface receiver;
       public JavaBroadcastReceiver(JavaBroadcastReceiverInterface unityReceiverProxy) {
           receiver = unityReceiverProxy;
       }
       public void onReceive(Context context, Intent intent) {
           if (receiver != null) {
               receiver.onReceive(context, intent);
           }
       }
       public void registerReceiver(Context context, String eventName) {
           context.registerReceiver(this, new IntentFilter(eventName));
       }
   }

5. Create an Android Archive (.aar) from these files.
6. Place the archive in Assets/Plugins/Android.

C# Scripts:

1. Create a new C# script named UnityBroadcastProxy.cs.
2. Add the following lines, which implement JavaBroadcastReceiverInterface that consumes threat events:
   

   using System.Collections;
   using System.Collections.Generic;
   using UnityEngine;
   using System;
   public class UnityBroadcastProxy : AndroidJavaProxy
   {
       public UnityBroadcastProxy() : base("com.unity3d.player.JavaBroadcastReceiverInterface") {}
       public void onReceive(AndroidJavaObject context, AndroidJavaObject intent)
       {
           string eventID = intent.Call<string>("getAction");
           switch (eventID)
           {
               case "RootedDevice":
                   string internalError = intent.Call<string>("GetStringExtra", "internalError");
                   string defaultMessage = intent.Call<string>("GetStringExtra", "defaultMessage");
                   string timestamp = intent.Call<string>("GetStringExtra", "timestamp");
                   string deviceID = intent.Call<string>("GetStringExtra", "deviceID");
                   string deviceModel = intent.Call<string>("GetStringExtra", "deviceModel");
                   string osVersion = intent.Call<string>("GetStringExtra", "osVersion");
                   string kernelInfo = intent.Call<string>("GetStringExtra", "kernelInfo");
                   string deviceManufacturer = intent.Call<string>("GetStringExtra", "deviceManufacturer");
                   string fusedAppToken = intent.Call<string>("GetStringExtra", "fusedAppToken");
                   string carrierPlmn = intent.Call<string>("GetStringExtra", "carrierPlmn");
                   string deviceBrand = intent.Call<string>("GetStringExtra", "deviceBrand");
                   string deviceBoard = intent.Call<string>("GetStringExtra", "deviceBoard");
                   string buildHost = intent.Call<string>("GetStringExtra", "buildHost");
                   string buildUser = intent.Call<string>("GetStringExtra", "buildUser");
                   string sdkVersion = intent.Call<string>("GetStringExtra", "sdkVersion");
                   //
                   // Respond to mobile app attacks and threats here
                   //
                   break;
               // Add cases for other actions here...
               default:
                   Debug.Log("unknown event received" + eventID);
                   break;
           }
       }
   }

    

3. Create a new C# script named ThreatEventsImp.cs.
4. Add the following lines, which add Appdome Threat-Events registration to Start()method (using the native Android callback registerReceiver):

   using System.Collections;
   using System.Collections.Generic;
   using UnityEngine;
   using UnityEngine.Android;
   public class ThreatEventsImp : MonoBehaviour
   {
       private AndroidJavaObject broadcastReceiver;
       void Start() 
       {
           // get current activity
           AndroidJavaObject activity = new AndroidJavaClass("com.unity3d.player.UnityPlayer").GetStatic<AndroidJavaObject>("currentActivity");
           // get application cotext
           AndroidJavaObject context = activity.Call<AndroidJavaObject>("getApplicationContext");
           // create new UnityBroadcastProxy
           UnityBroadcastProxy broadcastProxy = new UnityBroadcastProxy();
           // create new JavaBroadcastReceiver - onReceive will be called when the threat event occurs
           broadcastReceiver = new AndroidJavaObject("com.unity3d.player.JavaBroadcastReceiver", broadcastProxy);
           // register threat events
           broadcastReceiver.Call("registerReceiver", context, "RootedDevice");
       }
   }

5. Place these scripts in Assets/Scripts.

Compatibility with Android 14

Unity compatibility with Android 14 is seamless. The code sample provided above utilizes native platform implementations, ensuring that no modifications are needed to make your app fully compatible with Android 14.

Special Considerations

• Replace the event identifiers in your ThreatEventsImp according to the selections you made while fusing the application. To find the relevant Threat-Event context key, search for the specific feature via our knowledge base and navigate to the code sample section in the relevant article.
• You can stack multiple listeners for various events for comprehensive threat detection and response capabilities.
• For detailed information on advanced usage and alternative methods of implementation, please refer to the official documentation on the Native Android Plugin, BroadcastReceiver, and NSNotificationCenter.

Meta-Data for Mobile Application Threat-Events and Threat-Scores

Below is the list of metadata that can be associated with each mobile application, Threat-Event, and Threat-Score in Unity Apps.

At the discretion of the mobile developer, Unity Apps can consume some or all of the meta-data for each mobile application Threat-Event and Threat-Score and use it in combination with other mobile application data to modify the business logic or user experience when one or more attacks or threats are present.

Using Conditional Enforcement for Mobile Application Threat-Events and Threat-Scores

Conditional Enforcement is an extension of Appdome’s mobile application Threat-Event framework. By using conditional enforcement, developers can control when Appdome enforcement of each mobile application protection takes place or invoke backup, failsafe, and enforcement to any in-app enforcement used by the mobile developer.

Verifying Threat Events in Unity Apps

After you have implemented the required Threat-Event code in your Unity Apps, you can confirm that the Appdome protections in the Unity Apps properly recognize your Threat-Event implementation by reviewing the Certified Secure™ DevSecOps certificate for your build on Appdome.

The Certified Secure DevSecOps certificate displays an incorrect implementation of Threat Events in your mobile application, as shown below.

For more information on how to retrieve the Certified Secure DevSecOps certification for your mobile application on Appdome, please visit the knowledge base article: Using Certified Secure™ Android & iOS Apps Build Certification in DevOps CI/CD

Related Articles

• Threat-Events™, In-App Threat Intelligence in Kotlin Apps
• Threat-Events™, In-App Threat Intelligence in Flutter Apps
• Threat-Events™, In-App Threat Intelligence in Native iOS Apps
• Threat-Events™, In-App Threat Intelligence in React Native Apps
• Threat-Events™, In-App Threat Intelligence in Swift Apps
• Threat-Events™, In-App Threat Intelligence in Native Android Apps
• Threat-Events™, In-App Threat Intelligence in Maui, Xamarin Apps
• Implementing Threat Events – Best Practices
• How To Implement Threat-Events in Java

How Do I Learn More?

If you have any questions, please send them our way at support.appdome.com  or via the chat window on the Appdome platform.

Thank you!

Thanks for visiting Appdome! Our mission is to secure every app on the planet by making mobile app security easy. We hope we’re living up to the mission with your project.