@anonympins/fingerprint 0.0.5 → 0.0.7

package/README.md

@@ -13,12 +13,13 @@ This system identifies and slows down bots and automated scripts by evaluating t
 
 The process unfolds in three steps:
 
-1.  **Identification & Fingerprinting**: A unique fingerprint is generated for each device based on browser characteristics (client-side) and request headers (server-side). A `device_id` cookie is used to track the device over time.
+1.  **Identification & Fingerprinting**: A unique fingerprint is generated for each device. This combines a client-side browser fingerprint, server-side request headers, and the **JA3 fingerprint** from the TLS handshake, which reliably identifies the underlying HTTP client library (e.g., Chrome vs. a Python script). A `device_id` cookie is used to track the device over time.
 2.  **Suspicion Score Calculation**: Several indicators are analyzed to calculate a suspicion score:
     *   **Header Anomalies**: Missing `User-Agent`, `Accept-Language`, etc.
     *   **Device Behavior**: Rapid fingerprint changes (User-Agent rotation).
     *   **IP Behavior**: An excessive number of different devices seen from the same IP, or a single device using a large number of IPs (proxy rotation).
     *   **Inconsistency**: A low similarity score between the current fingerprint and the initial one associated with the `device_id` (cookie theft detection).
+    *   **Request Patterns**: Repetitive, rapid-fire, or sequential requests typical of scraping bots. The parameters for detecting these patterns (e.g., request velocity, burst detection) are dynamically adjusted by the auto-tuner for optimal performance.
     *   **Honeypot Trap**: Detection of bots that automatically fill hidden form fields or probe for common but unused URL parameters (e.g., `?debug=true`).
 3.  **Dynamic Challenge**: If the suspicion score exceeds a certain threshold, a challenge is presented to the user. The difficulty and type of challenge depend on the score:
     *   **Low to Medium Suspicion**: A combined CPU and Memory Proof-of-Work (PoW) challenge is issued. The difficulty of both the CPU (hash calculation) and Memory (allocation and computation) components scales progressively with the suspicion score. For low scores, the memory challenge is negligible, making it primarily a CPU task.
@@ -33,7 +34,7 @@ Once the challenge is solved, a clearance "ticket" is issued via a secure cookie
 -   **Pluggable Datastore**: Supports external datastores like Redis for state persistence and scalability across multiple server instances.
 -   **Express.js Middleware**: Easy integration into an Express application with `powMiddleware`. The datastore must support setting a Time-To-Live (TTL) for challenge secrets.
 -   **Timing Attack Protection**: Uses `crypto.timingSafeEqual` for secure ticket validation.
--   **Automatic Threshold Tuning**: Includes a genetic algorithm-based optimizer (`startThresholdAutoTuning`) that analyzes real traffic to dynamically adjust suspicion thresholds (`low`, `medium`, `high`), improving bot detection accuracy and reducing false positives over time.
+-   **Automatic Parameter Tuning**: Includes a genetic algorithm-based optimizer (`startThresholdAutoTuning`) that analyzes real traffic to dynamically adjust not only suspicion thresholds (`low`, `medium`, `high`) but also the parameters for behavioral pattern detection, improving accuracy and reducing false positives over time.
 
 ## Installation and Usage
 
@@ -66,6 +67,10 @@ app.use(cookieParser());
 app.use(bodyParser.json()); // For parsing application/json
 app.use(bodyParser.urlencoded({ extended: true })); // For parsing application/x-www-form-urlencoded
 
+// Array to store traffic analysis data for the auto-tuner.
+// In a real application, this could be a more robust logging system (e.g., writing to a file or a database).
+const trafficData = [];
+
 // Configuration of weights and thresholds for calculating the suspicion score.
 // These values should be adjusted based on traffic and expected user behavior.
 const securityConfig = {
@@ -73,6 +78,7 @@ const securityConfig = {
         historyScore: 0.3,       // Penalizes IP rotation (proxy)
         rotationScore: 0.5,      // Penalizes rapid fingerprint changes (user-agent, etc.)
         headerAnomalyScore: 0.1, // Penalizes abnormal headers (missing UA, etc.)
+        requestPatternScore: 0.6,// Penalizes bot-like request sequences (scraping, etc.)
         inconsistencyScore: 0.8, // Strongly penalizes inconsistency between the current and initial fingerprint (stolen cookie)
         honeypotScore: 1.0       // Strongly penalizes bots filling hidden form fields
     },
@@ -83,6 +89,13 @@ const securityConfig = {
         block: 95,  // Score above which the request is blocked outright (HTTP 403)
         isStaticResource: (req) => req.path.startsWith('/static/') // Optional: Custom function to identify static resources
     },
+    patterns: { // (Optional) Initial values for request pattern detection, optimized by auto-tuner if enabled.
+        velocityThreshold: 200, // ms between requests to be considered "fast"
+        burstThreshold: 500,    // ms for identical requests to be a "burst"
+        scrapeThreshold: 1000,  // ms for sequential requests to be "scraping"
+        historySize: 10,        // Number of requests to keep for pattern analysis
+        decayFactor: 0.9,       // How quickly the pattern score decays over time
+    },
     honeypot: {
         // List of field names that are traps for bots.
         // These should be hidden in forms for humans, or be URL parameters your app never uses.
@@ -91,8 +104,42 @@ const securityConfig = {
         // A request to one of these paths will immediately flag the device as malicious.
         trapUrls: ['/wp-admin', '/.env', '/admin.php', '/phpmyadmin'], // (Optional)
         // Automatically detect common SQL/NoSQL injection and RCE patterns in request values. (Optional, default: true)
-        detectInjections: true
-    }
+        detectInjections: true,
+        // (Optional) Plug in external, more robust analyzers. This allows you to extend the default detection with specialized libraries (e.g., WAFs, anti-spam) or your own custom logic.
+        // Each function receives an object with all query and body data and should return `true` if a threat is detected.
+        analyzers: [
+            // Example 1: Using a general-purpose WAF library.
+            // (npm install generic-waf)
+            (data) => {
+                const WAF = require('generic-waf');
+                const waf = new WAF();
+                // This WAF expects a string, so we stringify the data to check all values at once.
+                return waf.isMalicious(JSON.stringify(data));
+            },
+            // Example 2: Using a specialized library for XSS detection.
+            // (npm install xss)
+            (data) => {
+                const xss = require('xss');
+                const originalData = JSON.stringify(data);
+                // If the sanitized string is different from the original, it means malicious HTML/JS was found and removed.
+                return xss(originalData) !== originalData;
+            },
+            // Example 3: A custom function to detect specific keywords (e.g., for anti-spam).
+            (data) => {
+                const spamKeywords = ['viagra', 'free money', 'crypto pump'];
+                const dataString = JSON.stringify(data).toLowerCase();
+                return spamKeywords.some(keyword => dataString.includes(keyword));
+            }
+        ]
+    },
+    // The logger is required for auto-tuning. It collects data on requests.
+    logger: (log) => trafficData.push(log),
+    // (Optional) Configuration for the automatic threshold and pattern tuning.
+    autotuning: {
+        trafficData: trafficData,       // The data source for the genetic algorithm.
+        interval: 1800000,              // Optimization cycle every 30 minutes (in ms).
+        minDataPoints: 200              // Minimum requests before starting an optimization cycle.
+    },
 };
 
 // Create an instance of the middleware with your security configuration.
@@ -131,6 +178,8 @@ The main Express middleware. It orchestrates identification, suspicion calculati
 #### `configureStore(store)`
 Allows replacing the in-memory store with an external datastore (like Redis) for persistence and scaling.
 
+See the Datastore Integration Guide for a complete example of creating a Redis store.
+
 ```javascript
 import { configureStore } from './fingerprint.js';
 import { createRedisStore } from './redis-store.js'; // Assuming a redis store implementation exists
@@ -213,22 +262,23 @@ Although not exported for direct public use, understanding its role can be usefu
 
 While `powMiddleware` is convenient for Express, you can use the `FingerprintEngine` directly in any Node.js server environment (e.g., native `http`, Fastify, Koa). This gives you full control over the request/response cycle.
 
-The engine is available via the internal exports: `import { __internal } from './fingerprint.js'`.
+**For concrete examples with Koa and Fastify, see our Framework Integration Guide.**
+
+The engine is a named export from the main module.
 
 **Workflow:**
 
 1.  **Instantiate the Engine**: Create an instance with your `securityConfig`.
 2.  **Build the `requestContext`**: On each request, manually create a context object. It must include `clientIp`, `path`, `cookies`, `query`, `headers`, and mock `rawReq`/`rawRes` objects for cookie handling.
-3.  **Process the Request**: Call `engine.processRequest(requestContext)`.
+3.  **Process the Request**: Call `engine.processRequest(requestContext)`. This method is asynchronous.
 4.  **Handle the Decision**: The engine returns a decision object (`{ action: 'challenge' | 'redirect' | 'next', ... }`). You are responsible for implementing the corresponding HTTP response.
 
 **Example with native Node.js `http` server:**
 
 ```javascript
 import http from 'http';
-import { __internal } from './fingerprint.js'; // Adjust path
+import { FingerprintEngine } from './fingerprint.js'; // Adjust path
 
-const { FingerprintEngine } = __internal;
 const securityConfig = { /* ... your config ... */ };
 const engine = new FingerprintEngine(securityConfig);
 
@@ -268,42 +318,6 @@ const server = http.createServer(async (req, res) => {
 server.listen(3000, () => console.log('Server with manual fingerprint engine started on port 3000'));
 ```
 
-### Automatic Threshold Tuning
-
-Manually setting the `low`, `medium`, and `high` thresholds can be challenging. This library provides a powerful tool to automate this process based on real traffic data. It uses a genetic algorithm to find the optimal thresholds that maximize bot detection while minimizing the impact on legitimate users.
-
-#### How to use it:
-
-1.  **Enable Logging**: The auto-tuner needs data. You must provide a `logger` function in your security configuration. This function will be called for significant events (`challenge_issued`, `challenge_solved`, etc.).
-
-2.  **Enable Auto-tuning**: Add an `autotuning` property to your security configuration. The middleware will automatically start the tuning process.
-
-```javascript
-import { powMiddleware } from './fingerprint.js';
-
-// Array to store traffic analysis data. In a real application, this could be
-// a more robust logging system.
-const trafficData = [];
-
-const securityConfig = {
-    weights: { /* ... */ },
-    thresholds: {
-        low: 20,    // Initial values, will be optimized
-        medium: 45,
-        high: 75
-    },
-    logger: (log) => trafficData.push(log), // The logger is required for auto-tuning
-    autotune: {
-        trafficData: trafficData,       // The data source for the algorithm
-        interval: 1800000,              // Optimization cycle every 30 minutes (optional)
-        minDataPoints: 200              // Minimum requests before starting optimization (optional)
-    }
-};
-
-const powMiddlewareInstance = powMiddleware(securityConfig);
-app.use(powMiddlewareInstance);
-```
-
 ---
 
 ## License

package/fingerprint.js

@@ -15,6 +15,50 @@ const getPowSecret = () => {
   return secret || "fallback-dev-secret-32-chars-minimum";
 };
 
+/**
+ * Calculates the JA3 fingerprint hash from the TLS Client Hello message.
+ * JA3 is a more reliable way to identify client applications (e.g., a specific browser or a script)
+ * based on the specifics of its TLS handshake.
+ * @param {object} context - The request context, containing the raw request object.
+ * @returns {string|null} The MD5 hash of the JA3 string, or null if it cannot be computed.
+ */
+function getJa3Hash(context) {
+    // 1. Prefer the JA3 hash from a trusted reverse proxy (e.g., Nginx, Cloudflare).
+    const ja3FromHeader = context.headers['x-ja3-hash'];
+    if (ja3FromHeader) {
+        return ja3FromHeader;
+    }
+
+    // 2. Fallback to calculating from the raw socket if available (requires Node.js to handle TLS).
+    const clientHello = context.rawReq?.socket?.clientHello;
+    if (!clientHello) {
+        return null;
+    }
+
+    try {
+        const { version, ciphers, extensions, ellipticCurves, ellipticCurvePointFormats } = clientHello;
+
+        // The official JA3 spec includes the TLS version.
+        // Node.js provides it as a string like 'TLSv1.3', we need the corresponding decimal value.
+        const tlsVersionMap = {
+            'TLSv1': 769, 'TLSv1.1': 770, 'TLSv1.2': 771, 'TLSv1.3': 772
+        };
+        const tlsVersionId = tlsVersionMap[version] || 0;
+
+        const ja3String = [
+            tlsVersionId,
+            // The ciphers array from clientHello is an array of objects, not just IDs.
+            Array.isArray(ciphers) ? ciphers.join('-') : '',
+            extensions?.join('-') || '',
+            ellipticCurves?.join('-') || '',
+            ellipticCurvePointFormats?.join('-') || ''
+        ].join(',');
+
+        return crypto.createHash('md5').update(ja3String).digest('hex');
+    } catch (e) {
+        return null; // Could fail if clientHello structure is unexpected.
+    }
+}
 /**
  * Creates a stable hash based on device characteristics, independent of the IP.
  * This is our "level 2 fingerprint".
@@ -43,6 +87,10 @@ export function getDeviceHash(context) {
     if (context.headers["sec-ch-ua-platform"])
         srv.add("os", context.headers["sec-ch-ua-platform"]);
     if (context.headers["sec-ch-ua"]) srv.add("ch", context.headers["sec-ch-ua"]);
+    // Add JA3 hash if available. This is a very strong signal.
+    const ja3 = getJa3Hash(context);
+    if (ja3) srv.add("ja3", ja3);
+
     srv.add("h_ord", getHeaderSignature(context));
     return srv.toString();
 }
@@ -406,6 +454,14 @@ function getHeaderAnomalies(context) {
  */
 function getHoneypotScore(context, honeypotConfig = {}) {
   const { fields = [], trapUrls = [], detectInjections = true } = honeypotConfig;
+  // (NOUVEAU) Permettre de brancher des analyseurs externes plus robustes.
+  // L'utilisateur pourrait passer une fonction qui prend les données de la requête
+  // et retourne `true` si une menace est détectée.
+  // Exemple: `(data) => myWafLibrary.isMalicious(data)`
+  const externalAnalyzers = honeypotConfig.analyzers || [];
+  if (typeof detectInjections === 'object' && detectInjections.analyzers) {
+      externalAnalyzers.push(...detectInjections.analyzers);
+  }
 
   // 1. Check for trap URL access
   if (trapUrls.some(trap => context.path.startsWith(trap))) {
@@ -434,28 +490,49 @@ function getHoneypotScore(context, honeypotConfig = {}) {
     }
   }
 
+  // 3. (NOUVEAU) Utiliser les analyseurs externes
+  const allData = { ...queryData, ...bodyData };
+  if (externalAnalyzers.length > 0) {
+      for (const analyzer of externalAnalyzers) {
+          // On passe à l'analyseur l'ensemble des données de la requête.
+          if (analyzer(allData)) {
+              return { honeypotScore: 100 };
+          }
+      }
+  }
+
   // 3. Check for injection attempts in values
   if (detectInjections) {
     // Regex for common SQL injection patterns
+    // WARNING: These are generic and may cause false positives.
+    // Consider using a dedicated WAF library or more specific regex for your application.
     const sqlRegex = new RegExp(
-      "('|\"|;|--|#|/\\*.*\\*/)|\\b(union|select|insert|update|delete|drop|truncate)\\b",
+      "('|\"|;|--|#|/\\*.*\\*/)|\\b(union|select|insert|update|delete|drop|truncate|from|where|and|or)\\b",
       "i"
     );
     // Regex for common NoSQL (MongoDB) injection patterns (e.g., keys starting with '$')
-    const nosqlKeyRegex = /"\$[^"]*":/;
+    // This looks for keys like "$where", "$ne", etc. in a stringified JSON.
+    const nosqlKeyRegex = /"\$(where|ne|gt|lt|in|nin)":/;
     // Regex for common Remote Code Execution (RCE) patterns
     const rceRegex = new RegExp(
       // File traversal, command execution functions, and shell commands
-      "(\\.\\./|\\.\\.\\\\)|\\b(exec|system|shell_exec|passthru|popen|proc_open|eval|assert|require|include)(_once)?\\s*\\(|\\b(wget|curl|bash|sh|powershell)\\b",
+      // Added process, child_process to catch Node.js specific RCE.
+      "(\\.\\./|\\.\\.\\\\)|\\b(exec|system|shell_exec|passthru|popen|proc_open|eval|assert|require|include|process|child_process)(_once)?\\s*\\(|\\b(wget|curl|bash|sh|powershell|php)\\b",
       "i"
     );
+    // Regex for Log4Shell (JNDI injection)
+    const log4shellRegex = new RegExp("\\$\\{jndi:", "i");
+    // Regex for Server-Side Template Injection (SSTI)
+    const sstiRegex = new RegExp(
+      "(\\{\\{|\\{%|#\\{)[^}]+(config|settings|self|class|application|request|session|process|env)", "i"
+    );
 
     const inspect = (obj) => {
         for (const key in obj) {
             if (Object.prototype.hasOwnProperty.call(obj, key)) {
                 const value = obj[key];
                 if (typeof value === 'string') {
-                    if (rceRegex.test(value) || sqlRegex.test(value)) return true;
+                    if (rceRegex.test(value) || sqlRegex.test(value) || log4shellRegex.test(value) || sstiRegex.test(value)) return true;
                 } else if (typeof value === 'object' && value !== null) {
                     // For NoSQL, we check the stringified version of the object to find keys like "$gt"
                     // This is more accurate when done on the object itself.
@@ -478,6 +555,106 @@ function getHoneypotScore(context, honeypotConfig = {}) {
   return { honeypotScore: 0 };
 }
 
+/**
+ * Analyzes server-side request patterns for a given device to detect bot-like behavior.
+ * This is a stateful check that looks for repetitive or unnaturally fast requests.
+ * @param {object} context - The request context.
+ * @param {object} deviceData - The device's activity data from the store.
+ * @returns {{requestPatternScore: number}}
+ */
+function getRequestPatternScore(context, deviceData, patternConfig = {}) {
+    if (!deviceData) return { requestPatternScore: 0 };
+
+    // Default values for the pattern detection logic, which can be overridden by the auto-tuner.
+    const {
+        velocityThreshold = 200, velocityWeight = 30,
+        burstThreshold = 500, burstWeight = 50,
+        scrapeThreshold = 1000, scrapeWeight = 20, scrapeBurstWeight = 40,
+        historySize = 10,
+        decayFactor = 0.9,
+        inactivityReset = 30000,
+        // Nouveau paramètre pour la détection de séquences
+        sequenceLength = 3, sequenceWeight = 60
+    } = patternConfig;
+
+    const now = Date.now();
+    const currentPath = context.path;
+    // Make the function robust to handle both URLSearchParams and plain objects for query.
+    // Ensure query parameters are consistently handled, whether they come from a URLSearchParams object or a plain object.
+    const params = context.query instanceof URLSearchParams ? context.query : new URLSearchParams(context.query);
+    params.sort(); // Sort for deterministic order
+    const currentQueryString = params.toString();
+
+    // Initialize request history if it doesn't exist
+    if (!deviceData.requestHistory) {
+        deviceData.requestHistory = [];
+    }
+
+    const history = deviceData.requestHistory;
+    let score = 0;
+
+    // --- Analyze patterns based on the last few requests ---
+    if (history.length > 0) {
+        const lastRequest = history[history.length - 1];
+        const timeSinceLast = now - lastRequest.timestamp; // 150
+
+        // 1. Velocity Check: Penalize requests that are too fast to be human.
+        if (timeSinceLast < velocityThreshold) { // 150 < 200 -> true
+            score += velocityWeight; // score = 30
+        }
+
+        // 2. Burst Check: Add additional penalty for identical requests in a very short time frame.
+        if (currentPath === lastRequest.path && currentQueryString === lastRequest.queryString && timeSinceLast < burstThreshold) { // 150 < 500 -> true
+            score += burstWeight; // score = 30 + 50 = 80
+        }
+
+        // 3. Sequential Scraping Check: Add additional penalty for same path with different query params (potential scraping).
+        // This is a simplified check, now independent of the burst check.
+        if (currentPath === lastRequest.path && currentQueryString !== lastRequest.queryString && timeSinceLast < scrapeThreshold) {
+            const previousRequest = history.length > 2 ? history[history.length - 2] : null;
+            if (previousRequest && previousRequest.path === currentPath) {
+                score += scrapeBurstWeight; // This is at least the 3rd request in a sequence to the same path.
+            } else {
+                score += scrapeWeight; // First sign of a potential scraping pattern
+            }
+        }
+
+        // 4. (NOUVEAU) Détection de séquences répétitives (ex: A -> B -> C -> A -> B -> C)
+        if (history.length >= sequenceLength * 2) {
+            const lastSequence = history.slice(-sequenceLength);
+            const previousSequence = history.slice(-sequenceLength * 2, -sequenceLength);
+            
+            const isRepeating = lastSequence.every((req, i) => 
+                req.path === previousSequence[i].path && req.queryString === previousSequence[i].queryString
+            );
+            if (isRepeating) score += sequenceWeight;
+        }
+    }
+
+    // --- Update history ---
+    history.push({
+        timestamp: now,
+        path: currentPath,
+        queryString: currentQueryString,
+    });
+
+    // Keep history to a reasonable size (e.g., last 10 requests)
+    if (history.length > historySize) {
+        history.shift();
+    }
+
+    // Decay the score over time if behavior becomes normal again.
+    // We can store the score in deviceData and decay it.
+    deviceData.lastPatternScore = (deviceData.lastPatternScore || 0) * decayFactor + score; // Decay old score and add new
+
+    // If there hasn't been a request in a while, reset the pattern score.
+    if (history.length > 1 && (now - history[history.length - 2].timestamp > inactivityReset)) { // X ms inactivity
+        deviceData.lastPatternScore = 0;
+    }
+
+    return { requestPatternScore: Math.min(100, deviceData.lastPatternScore) };
+}
+
 const trapUrlTemplates = [
     '/includes/config-{RANDOM}.php',          // Classic PHP config file
     '/.env.{RANDOM}',                         // Environment file
@@ -512,7 +689,13 @@ function generateTrapUrl(nonce) {
  */
 function verifyTrapUrl(path, signature, nonce) {
     const expectedSignature = crypto.createHmac('sha256', getPowSecret()).update(nonce + path).digest('hex').substring(0, 16);
-    return signature === expectedSignature;
+    try {
+        // Use timingSafeEqual to prevent timing attacks where an attacker could guess the signature byte by byte.
+        return crypto.timingSafeEqual(Buffer.from(signature, 'hex'), Buffer.from(expectedSignature, 'hex'));
+    } catch {
+        // This will catch errors if buffers have different lengths or contain invalid hex characters, which is a failure case.
+        return false;
+    }
 }
 /**
  * @typedef {object} IStore
@@ -589,10 +772,13 @@ async function resolveRequestIdentity(context) {
     deviceData = {
       initialDeviceHash: currentDeviceHash, // Anchor the initial fingerprint.
       ips: new Set(),
+      requestHistory: [], // Initialize state for the new pattern score
       lastUpdate: Date.now(),
       lastFpHash: currentDeviceHash,
       lastChangeTimestamp: 0,
       rapidChangeCount: 0,
+      highScoreCount: 0,
+      lastHighScoreTimestamp: 0,
     };
     // The write will happen in getSuspicionVector after all modifications.
   }
@@ -692,6 +878,11 @@ export const getSuspicionVector = async (context, securityConfig) => {
   // Note: deviceData.ips is a Set, which may not serialize correctly in all stores (e.g., JSON). A Redis store should handle this via custom serialization or by converting to an array.
   await store.set(`device:${deviceId}`, deviceData);
 
+  // Ensure deviceData.ips is a Set for subsequent operations within the same request,
+  // even if the store returns an array.
+  if (Array.isArray(deviceData.ips)) {
+      deviceData.ips = new Set(deviceData.ips);
+  }
   return { ...behavioral, headerAnomalyScore, inconsistencyScore };
 };
 
@@ -926,7 +1117,7 @@ const staticExtensions = new RegExp(
 const isStaticResource = (path) => staticExtensions.test(path);
 
 // --- Middleware Proof-of-Work (Le péage) ---
-class FingerprintEngine {
+export class FingerprintEngine {
   constructor(securityConfig) {
     const isProduction = process.env.NODE_ENV === 'production';
     this.securityConfig = securityConfig;
@@ -935,30 +1126,56 @@ class FingerprintEngine {
 
   async processRequest(requestContext) {
     const { clientIp, path, cookies, query, isStatic } = requestContext;
-    const { weights, thresholds, logger } = this.securityConfig;
+    const { weights, thresholds, logger, onDeviceCompromised } = this.securityConfig;
 
     if (isStatic) {
       return { action: 'next', score: 0, vector: {} };
     }
 
+    const { pow_nonce } = query;
+
+    // Honeypot: Direct probing of challenge endpoints is highly suspicious.
+    // A legitimate user only hits these endpoints via the challenge page itself, which is only served to suspicious users.
+    // If we see a pow_nonce on a request that isn't (yet) considered suspicious, it's a bot.
+    // We check this early, before the main suspicion calculation.
+    if (pow_nonce) {
+        const powCookie = cookies?.pow_clearance;
+        if (!isTicketValid(clientIp, powCookie)) { // Only check if there's no valid ticket
+            // This is a potential probe. We'll let the main logic confirm if it's not a legitimate challenge response.
+        }
+    }
+
     // Check for persisted "condemned" status early.
     const { deviceData } = await resolveRequestIdentity(requestContext);
     if (deviceData?.condemned) {
+        if (onDeviceCompromised) {
+            onDeviceCompromised({ deviceId: cookies?.device_id, clientIp, reason: 'Previously condemned', score: 100, vector: { honeypotScore: 100 } });
+        }
         return { action: 'block', status: 403, body: 'Forbidden', score: 100, vector: { honeypotScore: 100 } };
     }
 
+    // (NOUVEAU) Vérifier si un nouveau device_id a été créé lors de cette requête
+    const isNewDevice = requestContext._newCookies?.some(c => c.name === 'device_id');
+
     // The engine now works with the context directly, no more rawReq dependency here.
     const suspicionVector = await __internal.getSuspicionVector(requestContext, this.securityConfig);
     const { honeypotScore } = getHoneypotScore(requestContext, this.securityConfig.honeypot);
+    const { requestPatternScore } = getRequestPatternScore(requestContext, deviceData, this.securityConfig.patterns);
     suspicionVector.honeypotScore = honeypotScore;
+    suspicionVector.requestPatternScore = requestPatternScore;
 
     const finalScore =
       suspicionVector.historyScore * (weights.historyScore || 0) +
       suspicionVector.rotationScore * (weights.rotationScore || 0) +
-      suspicionVector.headerAnomalyScore * (weights.headerAnomalyScore || 0) +
+      suspicionVector.headerAnomalyScore * (weights.headerAnomalyScore || 0) + suspicionVector.requestPatternScore * (weights.requestPatternScore || 0) +
       suspicionVector.inconsistencyScore * (weights.inconsistencyScore || 0) +
       honeypotScore * (weights.honeypotScore || 0);
 
+    // Si c'est un nouvel appareil, on lui impose un challenge de base, même si son score est bas.
+    // Cela augmente le coût pour les bots qui tentent de simplement supprimer leurs cookies.
+    const requiresChallengeForNewDevice = isNewDevice && finalScore < thresholds.low;
+
+
     const isBlocked = finalScore >= (thresholds.block || 95);
 
     const isSuspiciousHigh = finalScore >= thresholds.high && !isBlocked;
@@ -973,7 +1190,7 @@ class FingerprintEngine {
         )
         : 0;
     const powCookie = cookies?.pow_clearance;
-    const { pow_type, pow_nonce, pow_solution, pow_solution_cpu, pow_solution_mem } = query;
+    const { pow_type, pow_solution, pow_solution_cpu, pow_solution_mem } = query;
 
     // Honeypot: Direct probing of challenge endpoints is highly suspicious.
     // A legitimate user only hits these endpoints via the challenge page itself.
@@ -983,12 +1200,15 @@ class FingerprintEngine {
       }
       suspicionVector.honeypotScore = 100; // Bot is probing. Max penalty.
       // Recalculate score and block immediately.
-      const newFinalScore = finalScore + (100 * (weights.honeypotScore || 0));
+      const newFinalScore = finalScore - (honeypotScore * (weights.honeypotScore || 0)) + (100 * (weights.honeypotScore || 0));
       return { action: 'block', status: 403, body: 'Forbidden', score: newFinalScore, vector: suspicionVector };
     }
 
     // If the action is to block, we should still include the score and vector for logging/testing.
     if (isBlocked) {
+      if (onDeviceCompromised) {
+        onDeviceCompromised({ deviceId: cookies?.device_id, clientIp, reason: 'Score exceeded block threshold', score: finalScore, vector: suspicionVector });
+      }
       return { action: 'block', status: 403, body: 'Forbidden', score: finalScore, vector: suspicionVector };
     }
 
@@ -997,11 +1217,17 @@ class FingerprintEngine {
     const lastNonce = deviceData?.lastChallengeNonce;
     if (lastNonce && query.sig && verifyTrapUrl(path, query.sig, lastNonce)) {
         deviceData.condemned = true; // This device is a bot. Condemn it.
+        if (onDeviceCompromised) {
+            onDeviceCompromised({ deviceId: cookies?.device_id, clientIp, reason: 'Triggered signed honeypot trap URL', score: 100, vector: { honeypotScore: 100 } });
+        }
+        if (logger) {
+            logger({ type: 'trap_triggered', deviceId: cookies?.device_id, score: 100, path: path, timestamp: Date.now() });
+        }
         await store.set(`device:${cookies.device_id}`, deviceData);
         return { action: 'block', status: 403, body: 'Forbidden', score: 100, vector: { honeypotScore: 100 } };
     }
 
-    if (isSuspicious && !isTicketValid(clientIp, powCookie)) {
+    if ((isSuspicious || requiresChallengeForNewDevice) && !isTicketValid(clientIp, powCookie)) {
         // --- CHALLENGE SOLUTION HANDLING ---
         if (pow_nonce && (pow_solution || (pow_solution_cpu && pow_solution_mem))) {
             let isValid = false,
@@ -1097,7 +1323,7 @@ class FingerprintEngine {
         }
 
         // UNIFIED CHALLENGE LOGIC for all suspicion levels (low, medium, high)
-        if (isSuspicious) { // Couvre à la fois low et medium
+        if (isSuspicious || requiresChallengeForNewDevice) { // Couvre à la fois low et medium
             // Generate some trap URLs to embed in the challenge page.
             // These links are visually hidden but present in the DOM to trap bots.
             const trapUrls = Array.from({ length: 3 }, () => generateTrapUrl(nonce));
@@ -1163,12 +1389,14 @@ class FingerprintEngine {
 
     const vector = await __internal.getSuspicionVector(requestContext, this.securityConfig); // Pass the config
     const { honeypotScore } = getHoneypotScore(requestContext, this.securityConfig.honeypot);
+    const { requestPatternScore } = getRequestPatternScore(requestContext, (await store.get(`device:${requestContext.cookies?.device_id}`)), this.securityConfig.patterns);
     const score =
       vector.historyScore * (this.securityConfig.weights.historyScore || 0.3) +
       vector.rotationScore * (this.securityConfig.weights.rotationScore || 0.5) +
       vector.headerAnomalyScore * (this.securityConfig.weights.headerAnomalyScore || 0.1) +
       vector.inconsistencyScore * (this.securityConfig.weights.inconsistencyScore || 0.8) +
-      honeypotScore * (this.securityConfig.weights.honeypotScore || 0);
+      honeypotScore * (this.securityConfig.weights.honeypotScore || 0) +      
+      requestPatternScore * (this.securityConfig.weights.requestPatternScore || 0);
 
     if (score >= this.securityConfig.thresholds.high) return `suspicious_high:${clientIp}`;
     if (score >= this.securityConfig.thresholds.low) return `suspicious_medium:${clientIp}`; // Use medium for any suspicion
@@ -1204,6 +1432,8 @@ export const powMiddleware = (securityConfig) => {
       isStatic: isStaticResource(req.path),
       // Add the newly required properties for full decoupling
       rawHeaders: req.rawHeaders,
+      // Pass the raw request object for advanced inspection (e.g., JA3)
+      rawReq: req,
       httpVersion: req.httpVersion,
     };
 
@@ -1251,7 +1481,7 @@ export const __internal = {
     cyrb53, // Export for testing
     FingerprintBuilder, // Export for testing
     calculateTarget,
-    FingerprintEngine, // Expose for advanced testing
+    getRequestPatternScore, // Expose for testing
 };
 
 // --- THRESHOLD AUTO-TUNING SECTION ---
@@ -1272,45 +1502,78 @@ function runThresholdOptimization(securityConfig, trafficData, minDataPoints) {
     }
     console.log(`[AutoTuning] Démarrage du cycle d'optimisation avec ${trafficData.length} points de données.`);
 
-    // Identify "bots" (those who received a challenge but never solved it)
-    // and "humans" (those who passed the challenge or never received one).
+    // Classify historical requests with a confidence weight.
     const solvedDevices = new Set(trafficData.filter(e => e.type === 'challenge_solved').map(e => e.deviceId));
+    const challengedDevices = new Set(trafficData.filter(e => e.type === 'challenge_issued').map(e => e.deviceId));
+
     const historicalRequests = trafficData.map(log => {
-        let isBot = false;
-        if (log.type === 'challenge_issued' && !solvedDevices.has(log.deviceId)) {
-            isBot = true; // Assumption: a challenge issued and not solved is a bot.
+        // Assign a label ('bot' or 'human') and a confidence weight to each log entry.
+        switch (log.type) {
+            case 'honeypot_probe':
+            case 'trap_triggered':
+                return { score: log.score, label: 'bot', confidence: 10.0 }; // Very high confidence
+            
+            case 'challenge_issued':
+                // A challenge issued to a device that never solved it is a strong bot signal.
+                if (!solvedDevices.has(log.deviceId)) {
+                    return { score: log.score, label: 'bot', confidence: 3.0 }; // High confidence
+                }
+                // If the challenge was eventually solved, this specific log is neutral.
+                return null;
+
+            case 'challenge_solved':
+                return { score: log.score, label: 'human', confidence: 5.0 }; // High confidence
+
+            case 'request_passed':
+                // A passed request from a device that was never even challenged is likely a human.
+                if (!challengedDevices.has(log.deviceId)) {
+                    return { score: log.score, label: 'human', confidence: 0.5 }; // Low confidence
+                }
+                // If the device was challenged at some point, this log is ambiguous.
+                return null;
+            
+            default:
+                return null;
         }
-        return { score: log.score, isBot };
-    });
+    }).filter(Boolean); // Remove null entries
 
     // The "fitness" function evaluates the quality of a set of thresholds.
     // A lower score is better.
     const fitnessFunction = (solution) => {
-        const [low, medium, high] = solution;
-        // Constraints: thresholds must be ordered and within a reasonable range.
-        if (low >= medium || medium >= high || low <= 10 || high >= 90) return Infinity;
+        const [low, medium, high, velocityThreshold, burstThreshold, scrapeThreshold] = solution;
+        if (low >= medium || medium >= high || low < 10 || high > 90) return Infinity;
+        if (velocityThreshold < 50 || velocityThreshold > burstThreshold || burstThreshold > scrapeThreshold) return Infinity;
 
-        let falsePositives = 0; // Humans challenged unnecessarily.
-        let falseNegatives = 0; // Undetected bots.
+        let weightedFalsePositives = 0; // Humans challenged unnecessarily.
+        let weightedFalseNegatives = 0; // Undetected bots.
 
         for (const req of historicalRequests) {
-            if (req.isBot) {
-                if (req.score < low) falseNegatives++;
-            } else { // Human
-                if (req.score >= low) falsePositives++;
+            if (req.label === 'bot') {
+                if (req.score < low) weightedFalseNegatives += req.confidence;
+            } else { // 'human'
+                if (req.score >= low) weightedFalsePositives += req.confidence;
             }
         }
-        // Penalize passing bots 2x more than inconvenienced humans.
-        return (falsePositives * 1.0) + (falseNegatives * 2.0);
+        // The penalty for false negatives is implicitly higher due to the higher confidence scores of bot signals.
+        return weightedFalsePositives + weightedFalseNegatives;
     };
 
     // Functions for the genetic algorithm.
-    const createIndividual = () => [10 + Math.random() * 20, 30 + Math.random() * 30, 60 + Math.random() * 30];
-    const crossover = (p1, p2) => [(p1[0] + p2[0]) / 2, (p1[1] + p2[1]) / 2, (p1[2] + p2[2]) / 2];
+    const createIndividual = () => [
+        10 + Math.random() * 20, // low
+        30 + Math.random() * 30, // medium
+        60 + Math.random() * 30, // high
+        100 + Math.random() * 150, // velocityThreshold (100-250ms)
+        300 + Math.random() * 400, // burstThreshold (300-700ms)
+        800 + Math.random() * 700, // scrapeThreshold (800-1500ms)
+    ];
+    const crossover = (p1, p2) => p1.map((val, i) => (val + p2[i]) / 2);
     const mutate = (s) => {
         const n = [...s];
-        const i = Math.floor(Math.random() * 3);
-        n[i] += (Math.random() - 0.5) * 5;
+        const i = Math.floor(Math.random() * n.length);
+        // Adjust mutation range based on parameter
+        const mutationRange = i < 3 ? 5 : 50;
+        n[i] += (Math.random() - 0.5) * mutationRange;
         return n;
     };
 
@@ -1320,16 +1583,26 @@ function runThresholdOptimization(securityConfig, trafficData, minDataPoints) {
         populationSize: 40
     });
 
-    const [newLow, newMedium, newHigh] = result.solution;
+    const [newLow, newMedium, newHigh, newVelocity, newBurst, newScrape] = result.solution;
 
     // Update the configuration live.
-    securityConfig.thresholds = {
-        low: Math.round(newLow),
-        medium: Math.round(newMedium),
-        high: Math.round(newHigh)
-    };
+    // Ensure thresholds object exists
+    if (!securityConfig.thresholds) securityConfig.thresholds = {};
+    securityConfig.thresholds.low = Math.round(newLow);
+    securityConfig.thresholds.medium = Math.round(newMedium);
+    securityConfig.thresholds.high = Math.round(newHigh);
+
+    // Update pattern detection parameters
+    if (!securityConfig.patterns) securityConfig.patterns = {};
+    securityConfig.patterns.velocityThreshold = Math.round(newVelocity);
+    securityConfig.patterns.burstThreshold = Math.round(newBurst);
+    securityConfig.patterns.scrapeThreshold = Math.round(newScrape);
+    // Weights could also be optimized, but let's keep it to thresholds for now for simplicity.
 
     console.log("[AutoTuning] Nouveaux seuils optimisés appliqués :", securityConfig.thresholds);
+    if (securityConfig.patterns) {
+        console.log("[AutoTuning] Nouveaux paramètres de pattern appliqués :", securityConfig.patterns);
+    }
 }
 
 /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anonympins/fingerprint",
-  "version": "0.0.5",
+  "version": "0.0.7",
   "description": "An HTTP(S) client mitigation and anti-bot protection library for Node.js/Express, based on digital fingerprinting and dynamic Proof-of-Work (PoW) challenges.",
   "main": "fingerprint.js",
   "type": "module",