@anonympins/fingerprint 0.1.4 → 0.2.0

package/README.md

@@ -18,14 +18,20 @@ The process unfolds in three steps:
     *   **Header Anomalies**: Missing `User-Agent`, `Accept-Language`, etc.
     *   **Device Behavior**: Rapid fingerprint changes (User-Agent rotation).
     *   **IP Behavior**: An excessive number of different devices seen from the same IP, or a single device using a large number of IPs (proxy rotation).
-    *   **Inconsistency**: A low similarity score between the current fingerprint and the initial one associated with the `device_id` (cookie theft detection).
+    *   **Inconsistency**: A low similarity score between the current fingerprint and the one initially associated with the `device_id` (cookie theft detection).
+    *   **Cross-Layer Inconsistency**: Mismatches between client-side data (e.g., OS reported by the browser) and server-side headers (e.g., `User-Agent`).
     *   **Request Patterns**: Repetitive, rapid-fire, or sequential requests typical of scraping bots. The parameters for detecting these patterns (e.g., request velocity, burst detection) are dynamically adjusted by the auto-tuner for optimal performance.
     *   **Honeypot Trap**: Detection of bots that automatically fill hidden form fields or probe for common but unused URL parameters (e.g., `?debug=true`).
 3.  **Dynamic Challenge**: If the suspicion score exceeds a certain threshold, a challenge is presented to the user. The difficulty and type of challenge depend on the score:
-    *   **Low to Medium Suspicion**: A combined CPU and Memory Proof-of-Work (PoW) challenge is issued. The difficulty of both the CPU (hash calculation) and Memory (allocation and computation) components scales progressively with the suspicion score. For low scores, the memory challenge is negligible, making it primarily a CPU task.
+    *   **Low to Medium Suspicion**: A combined **CPU and Memory Proof-of-Work (PoW)** challenge is issued. The difficulty of both the CPU (hash calculation) and Memory (allocation and computation) components scales progressively with the suspicion score. For low scores, the memory challenge is negligible, making it primarily a CPU task.
     *   **High Suspicion**: For the most suspicious requests, the system issues a high-difficulty combined CPU/Memory challenge. The architecture allows for plugging in more complex challenges like CAPTCHAs if needed.
+    *   **New Devices**: To increase the cost for bots that simply clear their cookies, new (unseen) devices are systematically presented with a minimal, almost imperceptible challenge on their first visit, even if their suspicion score is low.
 
-Once the challenge is solved, a clearance "ticket" is issued via a secure cookie, exempting the user from new challenges for a set period. For API clients, the challenge is delivered as a `429` JSON response, and the client is expected to solve it and retry the request.
+Once the challenge is solved, a clearance "ticket" is issued via a secure cookie, exempting the user from new challenges. The duration of this ticket is dynamic:
+- **Probationary Ticket**: If the request was moderately suspicious, a very short-lived "probationary" ticket (e.g., 30 seconds) is issued. This forces the client to be re-evaluated quickly, increasing security.
+- **Optimal TTL Ticket**: For less suspicious requests, a genetic algorithm calculates the optimal ticket duration, balancing security (shorter TTL for higher risk) and user experience (longer TTL for lower risk).
+
+For API clients, the challenge is delivered as a `404` JSON response, and the client library can automatically solve it and retry the original request.
 
 ## Features
 
@@ -33,7 +39,7 @@ Once the challenge is solved, a clearance "ticket" is issued via a secure cookie
 -   **Secure Ticket System**: Uses HMAC-SHA256 signatures to validate clearances and prevent tampering.
 -   **Pluggable Datastore**: Supports external datastores like Redis for state persistence and scalability across multiple server instances.
 -   **Express.js Middleware**: Easy integration into an Express application with `powMiddleware`. The datastore must support setting a Time-To-Live (TTL) for challenge secrets.
--   **Timing Attack Protection**: Uses `crypto.timingSafeEqual` for secure ticket validation.
+-   **Timing Attack Protection**: Uses `crypto.timingSafeEqual` for secure validation of tickets and other signatures.
 -   **Bot Whitelisting**: Includes a DNS-based verification mechanism to reliably identify and whitelist legitimate crawlers like Googlebot and Bingbot, preventing them from being challenged. The results are cached for optimal performance.
 -   **Automatic Parameter Tuning**: Includes a genetic algorithm-based optimizer (`startThresholdAutoTuning`) that analyzes real traffic to dynamically adjust not only suspicion thresholds (`low`, `medium`, `high`) but also the parameters for behavioral pattern detection, improving accuracy and reducing false positives over time.
 
@@ -61,7 +67,7 @@ The `powMiddleware` requires a configuration object defining the weights of susp
 import express from 'express';
 import bodyParser from 'body-parser';
 import cookieParser from 'cookie-parser';
-import { powMiddleware, default_whitelist } from './fingerprint.js'; // Adjust the path
+import { powMiddleware, default_whitelist, default_analyzers } from './fingerprint.js'; // Adjust the path
 
 const app = express();
 app.use(cookieParser());
@@ -81,17 +87,16 @@ const securityConfig = {
         headerAnomalyScore: 0.1, // Penalizes abnormal headers (missing UA, etc.)
         requestPatternScore: 0.6,// Penalizes bot-like request sequences (scraping, etc.)
         inconsistencyScore: 0.8, // Strongly penalizes inconsistency between the current and initial fingerprint (stolen cookie)
-        behaviorScore: 0.7,    // Penalizes non-human interactions (no mouse/keyboard activity)
-        honeypotScore: 1.0       // Strongly penalizes bots filling hidden form fields
+        behaviorScore: 0.7,      // Penalizes non-human interactions (no mouse/keyboard activity)
+        honeypotScore: 1.0,      // Strongly penalizes bots filling hidden form fields
+        crossLayerInconsistencyScore: 0.4, // Penalizes mismatches between client-side data (e.g., OS) and server-side headers (e.g., User-Agent)
+        timeInconsistencyScore: 0.9 // Strongly penalizes large time gaps between client metric collection and server reception (replay attack)
     },
-    // A new, non-suspicious device will always have its score adjusted to a minimum of 1, ensuring it receives a minimal, almost imperceptible challenge on its first visit.
     thresholds: {
         low: 20,    // Score from which a CPU challenge is issued
         medium: 45, // Score for a more difficult combined CPU/Memory challenge
         high: 75,   // Score for a very difficult challenge
-        block: 95,  // Score above which the request is blocked outright (HTTP 403)
-        isStaticResource: (req) => req.path.startsWith('/static/'), // Optional: Custom function to identify static resources
-        isApiRequest: (req) => req.path.startsWith('/api/') || req.headers.accept?.includes('application/json') // Optional: Custom function to identify API requests
+        block: 95,  // Score above which the request is blocked outright (HTTP 404)
     },
     // (Optional) Configure the duration (in milliseconds) for various temporary data.
     ticketMaxAge: 3600000, // 1 hour. Duration for which a solved challenge ticket is valid.
@@ -114,27 +119,20 @@ const securityConfig = {
         // List of URL paths that should never be accessed by a legitimate user.
         // A request to one of these paths will immediately flag the device as malicious.
         trapUrls: ['/wp-admin', '/.env', '/admin.php', '/phpmyadmin'], // (Optional)
-        // Automatically detect common SQL/NoSQL injection and RCE patterns in request values. (Optional, default: true)
-        detectInjections: true,
-        // (Optional) Plug in external, more robust analyzers. This allows you to extend the default detection with specialized libraries (e.g., WAFs, anti-spam) or your own custom logic.
+        // Automatically detect common injection patterns. Can be a boolean or an array of specific types.
+        // - `true`: Enables all available detections (default).
+        // - `false`: Disables injection detection.
+        // - `['sql', 'rce']`: Enables only SQL injection and Remote Command Execution detection.
+        detectInjections: ['sql', 'rce', 'traversal', 'xxe', 'ssti', 'log4shell'], // (Optional, default: true)
+        // (Optional) Plug in external analyzers. This allows you to extend detection with specialized libraries or custom logic.
         // Each function receives an object with all query and body data and should return `true` if a threat is detected.
         analyzers: [
-            // Example 1: Using a general-purpose WAF library.
-            // (npm install generic-waf)
-            (data) => {
-                const WAF = require('generic-waf');
-                const waf = new WAF();
-                // This WAF expects a string, so we stringify the data to check all values at once.
-                return waf.isMalicious(JSON.stringify(data));
-            },
-            // Example 2: Using a specialized library for XSS detection.
-            // (npm install xss)
-            (data) => {
-                const xss = require('xss');
-                const originalData = JSON.stringify(data);
-                // If the sanitized string is different from the original, it means malicious HTML/JS was found and removed.
-                return xss(originalData) !== originalData;
-            },
+            ...default_analyzers(), // Includes the default XSS analyzer.
+
+            // Example 2: Enable a powerful WAF with ModSecurity and the OWASP Core Rule Set.
+            // Requires `npm install modsecurity-nodejs` and downloading the OWASP CRS rules.
+            // modsecurity_analyzer('/path/to/owasp-crs/crs-setup.conf'),
+
             // Example 3: A custom function to detect specific keywords (e.g., for anti-spam).
             (data) => {
                 const spamKeywords = ['viagra', 'free money', 'crypto pump'];
@@ -161,8 +159,10 @@ const securityConfig = {
         ...default_whitelist(), // Use the defaults
         { userAgent: 'MyIndustrySpecificBot', hostnameSuffix: '.my-bot-verifier.com' }, // Add a custom bot
     ],
-    // Or, if you only want the defaults:
-    // whitelist: default_whitelist(),
+    // Optional: Custom function to identify static resources
+    isStaticResource: (req) => req.path.startsWith('/static/'),
+    // Optional: Custom function to identify API requests
+    isApiRequest: (req) => req.path.startsWith('/api/') || req.headers.accept?.includes('application/json'),
     // The logger is required for auto-tuning. It collects data on requests.
     logger: (log) => trafficData.push(log),
     // (Optional) Configuration for the automatic threshold and pattern tuning.
@@ -171,6 +171,8 @@ const securityConfig = {
         interval: 1800000,              // Optimization cycle every 30 minutes (in ms).
         minDataPoints: 200              // Minimum requests before starting an optimization cycle.
     },
+    // Enables problem solving for suspicious activity (configurable in problems.config.json)
+    enableUsefulWork: true
 };
 
 // Create an instance of the middleware with your security configuration.
@@ -196,7 +198,39 @@ app.use((req, res, next) => {
 
 app.listen(3000, () => console.log('Server started on port 3000'));
 ```
-### Customizing the Challenge Page
+
+
+---
+
+## Advanced Behavioral Analysis
+
+The FingerprintEngine includes sophisticated behavioral analysis to detect non-human patterns. This analysis is performed by the `getRequestPatternScore` function, which is a stateful check that looks for repetitive or unnaturally fast requests from a single device.
+
+This function uses several configurable parameters to identify suspicious behavior:
+
+### Core Pattern Detection
+
+These parameters form the basis of the request pattern analysis:
+
+*   `velocityThreshold`: (Default: 800ms) Penalizes requests that are too fast to be humanly possible. If the time since the last request from a device is less than this value, the suspicion score increases.
+*   `burstThreshold`: (Default: 1500ms) Adds a significant penalty for multiple identical requests (same path and query parameters) occurring in a very short time frame. This is a strong indicator of automated retries or brute-force attacks.
+*   `scrapeThreshold`: (Default: 1000ms) Penalizes sequential requests to the same path but with different query parameters. This pattern is typical of scraping bots that iterate through pages or product IDs.
+*   `sequenceLength`: (Default: 3) Detects repetitive sequences of requests (e.g., A -> B -> C -> A -> B -> C), which is a common pattern for scripted bots navigating a site.
+
+### Statistical Analysis (Benford's Law)
+
+To counter more advanced bots that might try to randomize their request timings, the engine employs statistical analysis based on Benford's Law.
+
+*   **How it works**: Benford's Law states that in many naturally occurring sets of numbers, the leading digit is more likely to be small. For example, the number 1 appears as the leading digit about 30% of the time, while 9 appears less than 5% of the time. The timings between a human's requests tend to follow this natural distribution, whereas a bot's randomized delays often do not.
+
+*   `benfordMinSamples`: (Default: 15) The minimum number of request timings to collect before performing a Benford's Law test.
+*   `benfordWeight`: (Default: 50) The weight applied to the suspicion score if the distribution of timings significantly deviates from Benford's Law.
+
+### Configuration and Auto-Tuning
+
+All these parameters are part of the `patterns` object within the main security configuration and can be fine-tuned.
+
+## Customizing the Challenge Page
 
 You can provide your own HTML template for the Proof-of-Work challenge page to maintain a consistent user experience with your brand.
 
@@ -251,7 +285,7 @@ The main Express middleware. It orchestrates identification, suspicion calculati
 
 #### `configureStore(store)`
 Allows replacing the in-memory store with an external datastore (like Redis) for persistence and scaling.
-The library provides ready-to-use adapters for popular datastores like Redis and MongoDB, which automatically handle the Time-To-Live (TTL) required for temporary data like challenge secrets.
+The library provides ready-to-use adapters for popular datastores like **Redis**, **MongoDB**, and any **SQL database** supported by Knex.js. These adapters automatically handle the Time-To-Live (TTL) required for temporary data like challenge secrets.
 
 **Redis Example:**
 
@@ -286,6 +320,32 @@ configureStore(mongoStore);
 // db.sessions.createIndex({ "expiresAt": 1 }, { expireAfterSeconds: 0 })
 ```
 
+**SQL Example (with Knex.js):**
+
+```javascript
+import { configureStore } from './fingerprint.js';
+import { createSqlStore } from './sql-store.js';
+import knex from 'knex';
+
+const knexClient = knex({
+  client: 'pg', // or 'mysql', 'sqlite3', etc.
+  connection: process.env.DATABASE_URL,
+});
+
+const sqlStore = createSqlStore(knexClient, 'fingerprint_sessions'); // 'fingerprint_sessions' is the table name
+configureStore(sqlStore);
+
+// IMPORTANT: For automatic expiration of challenges and other temporary data to work,
+// your table must have an `expiresAt` column. The store will handle cleanup of expired rows,
+// but you must create the table yourself.
+// Example schema for PostgreSQL:
+// CREATE TABLE fingerprint_sessions (
+//   "key" VARCHAR(255) PRIMARY KEY,
+//   "value" TEXT NOT NULL,
+//   "expiresAt" TIMESTAMPTZ
+// );
+```
+
 #### `identifyRequest(req, res)`
 An asynchronous function that returns an identification string for a given request, based on its suspicion level (`device:<id>`, `suspicious_medium:<ip>`, etc.). Useful for integration with a custom rate-limiter.
 
@@ -472,7 +532,7 @@ Although not exported for direct public use, understanding its role can be usefu
 
 While `powMiddleware` is convenient for Express, you can use the `FingerprintEngine` directly in any Node.js server environment (e.g., native `http`, Fastify, Koa). This gives you full control over the request/response cycle.
 
-**For concrete examples with Koa and Fastify, see our Framework Integration Guide.**
+**For concrete examples with Koa and Fastify, see our [Framework Integration Guide](https://github.com/anonympins/fingerprint/blob/main/INTEGRATION.md).**
 
 The engine is a named export from the main module.
 
@@ -498,7 +558,7 @@ const server = http.createServer(async (req, res) => {
         clientIp: req.socket.remoteAddress,
         path: req.url.split('?')[0],
         cookies: {}, // Parse cookies from req.headers.cookie
-        query: new URL(req.url, `http://${req.headers.host}`).searchParams,
+        query: Object.fromEntries(new URL(req.url, `http://${req.headers.host}`).searchParams),
         headers: req.headers,
         rawReq: req, // Pass the raw request
         rawRes: res, // Pass the raw response for cookie setting

package/fingerprint.client.js

@@ -202,6 +202,9 @@ const ClientLibrary = {
      * @returns {ClientBehaviorMetrics}
      */
     getClientBehaviorMetrics() {
+        // Ajoute un timestamp au moment de la collecte pour la détection de rejeu.
+        metrics.clientTimestamp = Date.now();
+
         // Normalise l'entropie de la souris
         if (mouseMovements > 10) {
             metrics.mouseEntropy /= mouseMovements;
@@ -357,6 +360,17 @@ const ClientLibrary = {
         url.searchParams.set(`pow_solution_${key}`, String(value));
       });
 
+      // Pour le challenge d'optimisation, la solution est un tableau d'objets
+      if (solution.population) {
+        url.searchParams.set('pow_solution_population', JSON.stringify(solution.population));
+      }
+
+      // Pour le challenge de travail utile
+      if (solution.work_result) {
+        url.searchParams.set('pow_solution_work_result', JSON.stringify(solution.work_result));
+        url.searchParams.set('pow_problem_id', solution.problem_id);
+      }
+
       // On utilise la chaîne d'intercepteurs pour la requête réessayée,
       // ce qui garantit que le fetch original est appelé avec le bon contexte.
       // Cela évite de réintroduire l'erreur "Illegal invocation".
@@ -417,6 +431,7 @@ const ClientLibrary = {
  * @property {number} mouseEntropy - Entropie des mouvements de la souris.
  * @property {number} keystrokeLatency - Latence moyenne entre les frappes.
  * @property {boolean} honeypotInteraction - Vrai si un honeypot a été touché.
+ * @property {number} clientTimestamp - Timestamp (Date.now()) de la collecte des métriques.
  */
 
 /** @type {ClientBehaviorMetrics} */
@@ -424,6 +439,7 @@ const metrics = {
     mouseEntropy: 0,
     keystrokeLatency: 0,
     honeypotInteraction: false,
+    clientTimestamp: 0,
 };
 
 let lastMousePos = { x: 0, y: 0 };

package/fingerprint.js

@@ -1,6 +1,7 @@
 import crypto from "node:crypto";
 import { BlockList } from "node:net";
 import dns from "node:dns/promises";
+import { problemManager } from "./problem-manager.js";
 import { Optimization } from "./library.js";
 import { cyrb53, FingerprintBuilder } from "./fingerprint.builder.js";
 import { readFileSync } from "node:fs";
@@ -762,6 +763,25 @@ function getHoneypotScore(context, honeypotConfig = {}) {
   return { honeypotScore: 0 };
 }
 
+/**
+ * @private
+ * Map of malicious patterns grouped by type.
+ */
+const injectionPatterns = {
+    // SQL/NoSQL injections, including time-based attacks
+    sql: /(\$ne|' *OR *'1'='1|['";]\s*--|; ?(DROP|TRUNCATE|DELETE)|UNION SELECT|SLEEP\(|BENCHMARK\(|WAITFOR DELAY)/i,
+    // Log4Shell (JNDI injection)
+    log4shell: /\$\{jndi:(ldap|rmi|dns):/i,
+    // Server-Side Template Injection (SSTI) for engines like Jinja2, Twig, etc.
+    ssti: /\{\{.*\}\}|\{%.*%\}/,
+    // XML External Entity (XXE) injection
+    xxe: /<!ENTITY\s+.*SYSTEM/i,
+    // Path Traversal
+    traversal: /(\.\.\/|\.\.\\)/,
+    // Remote Command Execution (RCE)
+    rce: /`.*`|(^|[\n;&|]\s*)(ping|ls|whoami|cat|rm|ncat|nc|bash|sh|powershell|cmd)\b/i,
+};
+
 /**
  * Calcule un score basé sur les métriques comportementales envoyées par le client.
  * @param {object} context - Le contexte de la requête, contenant les en-têtes.
@@ -821,6 +841,29 @@ function getBehaviorScore(context) {
   }
 }
 
+/**
+ * Calcule un score basé sur l'incohérence temporelle entre le client et le serveur pour détecter les attaques par rejeu.
+ * @param {object} context - Le contexte de la requête, contenant le timestamp de la requête.
+ * @param {object} metrics - Les métriques comportementales parsées depuis le client.
+ * @returns {{timeInconsistencyScore: number}}
+ */
+function getTimeInconsistencyScore(context, metrics) {
+  const REPLAY_THRESHOLD_MS = 5000; // 5 secondes
+  let score = 0;
+
+  if (metrics.clientTimestamp && context.requestTimestamp) {
+    const timeDelta = context.requestTimestamp - metrics.clientTimestamp;
+
+    // Un delta très grand est un signal fort d'attaque par rejeu.
+    // Un delta négatif peut arriver si l'horloge du client est en avance, on l'ignore.
+    if (timeDelta > REPLAY_THRESHOLD_MS) {
+      // La pénalité est proportionnelle au dépassement du seuil.
+      score = Math.min(100, (timeDelta / REPLAY_THRESHOLD_MS - 1) * 50);
+    }
+  }
+  return { timeInconsistencyScore: score };
+}
+
 /**
  * Calcule un score d'incohérence entre les données du fingerprint client et les en-têtes serveur.
  * @param {object} context - Le contexte de la requête.
@@ -960,8 +1003,7 @@ function getRequestPatternScore(context, deviceData, patternConfig = {}) {
         // 5. (NOUVEAU) Analyse de la distribution des délais avec la loi de Benford
         if (deviceData.timingHistory.length >= benfordMinSamples) {
             // On concatène tous les délais en une seule chaîne de chiffres.
-            const timingString = deviceData.timingHistory.join('');
-            const benfordDeviation = Optimization.Operators.benfordTest(timingString);
+            const benfordDeviation = Optimization.Operators.benfordTest(deviceData.timingHistory);
 
             // Une déviation > 0.15 est suspecte. On peut pondérer la pénalité.
             // Une déviation de 0.3 (très suspecte) donnerait un score de 100 (0.3 / 0.3 * 100).
@@ -1242,6 +1284,9 @@ export const getSuspicionVector = async (context, securityConfig) => {
   // On appelle getHoneypotScore ici pour que son résultat soit inclus dans le vecteur.
   const { honeypotScore } = getHoneypotScore(context, honeypotConfig);
 
+  // NOUVEAU: On calcule le score d'incohérence temporelle.
+  const { timeInconsistencyScore } = getTimeInconsistencyScore(context, JSON.parse(context.headers['x-behavior-metrics'] || '{}'));
+
   // NOUVEAU: On calcule le score d'incohérence entre les couches.
   const { crossLayerInconsistencyScore } = getCrossLayerInconsistency(context);
 
@@ -1257,7 +1302,7 @@ export const getSuspicionVector = async (context, securityConfig) => {
       deviceData.ips = new Set(deviceData.ips);
   }
   // Le vecteur de suspicion est maintenant complet.
-  return { ...behavioral, headerAnomalyScore, inconsistencyScore, behaviorScore, honeypotScore, requestPatternScore, crossLayerInconsistencyScore };
+  return { ...behavioral, headerAnomalyScore, inconsistencyScore, behaviorScore, honeypotScore, requestPatternScore, crossLayerInconsistencyScore, timeInconsistencyScore };
 };
 
 // A residential user can change networks (home, 4G, public wifi).
@@ -1404,17 +1449,20 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
         const clientIp = ${JSON.stringify(clientIp)};
         const cpuTarget = BigInt("0x${target}");
         const memDifficulty = ${memoryDifficulty};
+        // The client-side fingerprint library must be available to generate the fingerprint
+        // of the machine solving the challenge. This assumes a client library is loaded.
+        // We need a function to get the client fingerprint. Let's assume it's available on window.
+        const getClientFingerprint = () => (window.ClientLibrary && typeof window.ClientLibrary.getDeviceFingerprint === 'function') ? window.ClientLibrary.getDeviceFingerprint() : '';
+        const fingerprint = getClientFingerprint();
 
         // --- CPU Challenge ---
         document.getElementById('loader').innerText = '⚙️ Performing CPU security calculation...';
-        const cpuSolution = await window.solveCpuChallengeInline(clientIp, nonce, cpuTarget, clientSecret, (progress) => {
+        const cpuSolution = await window.solveCpuChallengeInline(clientIp, nonce, cpuTarget, clientSecret, fingerprint, (progress) => {
             // Optional progress callback
         });
-
         // --- Memory Challenge ---
         document.getElementById('loader').innerText = '⚙️ Performing memory allocation and calculation... (' + memDifficulty + ' MB)';
         await new Promise(r => setTimeout(r, 10)); // Yield to update UI
-
         let memSolution = 0;
         try {
             const memSeed = nonce + ":" + clientSecret;
@@ -1423,7 +1471,7 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
             document.getElementById('loader').innerText = "Error: Insufficient memory. Please refresh.";
             return;
         }
-        window.location.href = path + "?pow_type=cpu_mem&pow_nonce=" + ${JSON.stringify(nonce)} + "&pow_solution_cpu=" + cpuSolution + "&pow_solution_mem=" + memSolution;
+        window.location.href = path + "?pow_type=cpu_mem&pow_nonce=" + ${JSON.stringify(nonce)} + "&pow_solution_cpu=" + cpuSolution + "&pow_solution_mem=" + memSolution + "&pow_fp=" + encodeURIComponent(fingerprint);
       }
       solve();
     `;
@@ -1458,10 +1506,11 @@ export function verifyCpuTargetPoWAndGenerateTicket(
   nonce,
   solution,
   clientSecret, // Le secret est maintenant requis
-  target, // La cible est maintenant passée directement en hexadécimal
+  target, // La cible est maintenant passée directement en hexadécimal,
+  fingerprint, // Le fingerprint du SOLVER, soumis par le client
 ) {
   const message = clientSecret
-    ? `${nonce}:${solution}:${clientSecret}` // FIX: Ne pas inclure l'IP si un secret client est utilisé
+    ? `${nonce}:${solution}:${clientSecret}:${fingerprint}`
     : `${clientIp}:${nonce}:${solution}`; // L'IP est utilisée uniquement pour les challenges sans secret (plus anciens/simples)
   const hash = crypto
     .createHash("sha256")
@@ -1483,106 +1532,6 @@ export function verifyCpuTargetPoWAndGenerateTicket(
   return null;
 }
 
-const staticExtensions = new RegExp(
-  "\\.(js|css|png|jpg|jpeg|gif|svg|mp3|webp|ico|woff|woff2|ttf|otf|map|json|manifest|webmanifest)$",
-  "i",
-);
-const isStaticResource = (path) => staticExtensions.test(path);
-
-
-/**
- * Détermine le TTL optimal pour un ticket en utilisant un algorithme génétique multi-objectifs.
- * @param {number} suspicionScore - Le score de suspicion de la requête.
- * @returns {number} Le TTL optimal calculé en millisecondes.
-*/
-function determineOptimalTicketTtl(suspicionScore) {
-    // Définir les bornes pour la durée de vie du ticket (5 minutes à 24 heures)
-    const MIN_TTL = 300000;
-    const MAX_TTL = 86400000;
-
-    const solverFunction = () => {
-        const fitnessFunction = Optimization.Operators.createOptimalTtlEvaluator({ suspicionScore });
-
-        // Un "individu" est simplement une valeur de TTL en millisecondes.
-        const createIndividual = () => MIN_TTL + Math.random() * (MAX_TTL - MIN_TTL);
-        const crossover = (ttl1, ttl2) => (ttl1 + ttl2) / 2;
-        const mutate = (ttl) => {
-            const newTtl = ttl + (Math.random() - 0.5) * (MAX_TTL - MIN_TTL) * 0.1; // Mutation de +/- 10% max
-            return Math.max(MIN_TTL, Math.min(MAX_TTL, newTtl));
-        };
-
-        const paretoFront = Optimization.geneticAlgorithmMultiObjective(
-            createIndividual,
-            fitnessFunction,
-            crossover,
-            mutate,
-            {
-                generations: 40,
-                populationSize: 30,
-            }
-        );
-
-        // Pour runMultiple, on doit retourner un objet avec une propriété "fitness" ou "energy".
-        // Pour un front de Pareto, il n'y a pas de score unique. On choisit la meilleure solution
-        // en fonction du score de suspicion et on lui assigne un score de 0 pour que runMultiple la sélectionne.
-        if (!paretoFront || paretoFront.length === 0) {
-            return { solution: null, fitness: Infinity };
-        }
-
-        // Stratégie de sélection :
-        // Pour un score faible (< 50), on privilégie la solution avec le plus grand TTL (minimise la friction).
-        // Pour un score élevé (>= 50), on privilégie la solution avec le plus petit TTL (minimise le risque).
-        let bestSolutionInFront;
-        if (suspicionScore < 50) {
-            bestSolutionInFront = paretoFront.reduce((max, p) => Math.max(max, p.solution), 0);
-        } else {
-            bestSolutionInFront = paretoFront.reduce((min, p) => Math.min(min, p.solution), Infinity);
-        }
-        return { solution: bestSolutionInFront, fitness: 0 }; // fitness=0 car on a déjà la meilleure solution du cycle.
-    };
-
-    // On exécute le solveur 20 fois pour trouver une solution plus stable et robuste.
-    const { bestResult } = Optimization.runMultiple(solverFunction, 20);
-
-    if (!bestResult || !bestResult.solution || bestResult.solution === Infinity) {
-        // Fallback : si l'algo ne retourne rien, on applique une règle simple et sûre.
-        return Math.max(MIN_TTL, MAX_TTL - (suspicionScore / 100) * MAX_TTL);
-    }
-
-    // runMultiple choisit le meilleur résultat sur la base du score (ici, 0).
-    // La "meilleure" solution dépendra du cycle qui a trouvé le meilleur compromis.
-    return Math.round(bestResult.solution);
-}
-
-/**
- * Vérifie si une chaîne de caractères contient des patterns d'injection connus.
- * @param {string} str - La chaîne à vérifier.
- * @returns {boolean} - True si un pattern malveillant est détecté.
- * @private
- */
-function isMalicious(str) {
-    if (typeof str !== 'string') return false;
-    // Regex pour les injections SQL et NoSQL de base
-    // Ajout de la détection des injections basées sur le temps (SLEEP, BENCHMARK, WAITFOR) et d'autres commandes dangereuses.
-    const injectionRegex = /(\$ne|' *OR *'1'='1|['";]\s*--|; ?(DROP|TRUNCATE|DELETE)|UNION SELECT|SLEEP\(|BENCHMARK\(|WAITFOR DELAY)/i;
-    // Regex pour les injections plus avancées
-    const log4ShellRegex = /\$\{jndi:(ldap|rmi|dns):/i;
-    const sstiRegex = /\{\{.*\}\}|\{%.*%\}/; // Détecte les syntaxes de type Jinja2, Twig, etc.
-    const xxeRegex = /<!ENTITY\s+.*SYSTEM/i;
-    const pathTraversalRegex = /(\.\.\/|\.\.\\)/;
-    // Regex pour les injections de commandes.
-    // Elle détecte :
-    // 1. L'utilisation de backticks ``.
-    // 2. Des commandes dangereuses (rm, whoami...) qui sont soit au début de la chaîne,
-    //    soit précédées par un séparateur de commande (;, &&, ||, |) suivi d'espaces.
-    const commandInjectionRegex = /`.*`|(^|[\n;&|]\s*)(ping|ls|whoami|cat|rm|ncat|nc|bash|sh|powershell|cmd)\b/i;
-
-    return injectionRegex.test(str) || log4ShellRegex.test(str) || sstiRegex.test(str) || xxeRegex.test(str) || pathTraversalRegex.test(str) || commandInjectionRegex.test(str);
-}
-
-// --- Middleware Proof-of-Work (Le péage) ---
-export { isMalicious };
-
 export class FingerprintEngine {
   constructor(securityConfig) {
     const isProduction = process.env.NODE_ENV === 'production';
@@ -1609,7 +1558,8 @@ export class FingerprintEngine {
             (suspicionVector.inconsistencyScore || 0) * (weights.inconsistencyScore || 0) +
             (suspicionVector.honeypotScore || 0) * (weights.honeypotScore || 0) +
             (suspicionVector.behaviorScore || 0) * (weights.behaviorScore || 0) +
-            (suspicionVector.crossLayerInconsistencyScore || 0) * (weights.crossLayerInconsistencyScore || 0);
+            (suspicionVector.crossLayerInconsistencyScore || 0) * (weights.crossLayerInconsistencyScore || 0) +
+            (suspicionVector.timeInconsistencyScore || 0) * (weights.timeInconsistencyScore || 0);
 
         return Math.min(100, score);
     }
@@ -1746,7 +1696,7 @@ export class FingerprintEngine {
       this._log('Whitelisted bot verified - allowing request', { clientIp });
       return { action: 'next', score: 0, vector: { whitelisted: 100, type: 'bot' } };
     }
-
+    
     // Resolve identity and check for persisted "condemned" status early.
     const { deviceId, deviceData, newCookie } = await resolveRequestIdentity(requestContext, this.securityConfig);
     const isNewDevice = !!newCookie;
@@ -1792,6 +1742,7 @@ export class FingerprintEngine {
     const isSuspiciousHigh = finalScore >= thresholds.high && !isBlocked;
     const isSuspiciousMedium = finalScore >= thresholds.medium;
     const isSuspicious = finalScore >= thresholds.low;
+    const isVerySuspicious = finalScore >= thresholds.medium; // Seuil pour le challenge d'optimisation
 
     // Calculate an analog "suspicion factor" (0 to 1+) for progressive difficulty
     const suspicionFactor = isSuspicious
@@ -1816,10 +1767,10 @@ export class FingerprintEngine {
     // --- NOUVELLE LOGIQUE DE PRIORITÉ ---
     // Si une solution de challenge est soumise, on la traite en priorité absolue,
     // avant même de recalculer le score de suspicion.
-    const { pow_type, pow_solution, pow_solution_cpu, pow_solution_mem } = query;
+    const { pow_type, pow_solution, pow_solution_cpu, pow_solution_mem, pow_fp, pow_solution_population, pow_solution_work_result, pow_problem_id } = query;
     if (pow_nonce && (pow_solution || (pow_solution_cpu && pow_solution_mem))) {
         this._log('Challenge solution submitted', { pow_type, pow_nonce });
-        
+
         // On doit calculer le score de suspicion *avant* de valider le ticket,
         // car le TTL optimal en dépend.
         const preliminaryVector = suspicionVector; // Use the already calculated vector
@@ -1842,27 +1793,38 @@ export class FingerprintEngine {
         const probationaryTtl = 30000; // 30 secondes
 
         if (challengeContext) {
-            optimalTtl = determineOptimalTicketTtl(preliminaryScore);
-            finalTtl = isProbationary ? probationaryTtl : optimalTtl;
-            this._log('Challenge context found, verifying solution', { optimalTtl, finalTtl });
-
-            if (pow_type === "cpu_target" && pow_solution) {
-                // On passe la durée de vie du ticket configurée
-                console.log("ticket");
-                ticket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, pow_solution, challengeContext.clientSecret, challengeContext.cpuTarget);
-                console.log(ticket !== null)
-                isValid = ticket !== null;
-                this._log('CPU target challenge verification', { isValid });
-            } else if (pow_type === "cpu_mem" && pow_solution_cpu && pow_solution_mem) {
-                const cpuTicket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, pow_solution_cpu, challengeContext.clientSecret, challengeContext.cpuTarget);
-                const isMemValid = verifyMemoryPoW(pow_nonce, pow_solution_mem, challengeContext.memDifficulty, challengeContext.clientSecret);
-                isValid = cpuTicket !== null && isMemValid;
-                if (isValid) ticket = cpuTicket; // Le ticket est le même, on le réutilise
-                this._log('Combined CPU+Memory challenge verification', {
-                    cpuValid: cpuTicket !== null,
-                    memValid: isMemValid,
-                    isValid
+            // *** NOUVELLE VÉRIFICATION CRUCIALE ***
+            // On compare le fingerprint soumis par le solver (`pow_fp`) avec celui stocké
+            // lors de l'émission du challenge (`challengeContext.fingerprint`).
+            const solverFingerprint = pow_fp;
+            const originalFingerprint = challengeContext.fingerprint;
+
+            if (solverFingerprint !== originalFingerprint) {
+                this._log('Fingerprint mismatch - challenge solved on a different machine!', {
+                    original: originalFingerprint,
+                    solver: solverFingerprint,
                 });
+                isValid = false;
+            } else {
+                optimalTtl = determineOptimalTicketTtl(preliminaryScore);
+                finalTtl = isProbationary ? probationaryTtl : optimalTtl;
+                this._log('Challenge context found, verifying solution', { optimalTtl, finalTtl });
+
+                if (pow_type === "cpu_target" && pow_solution) {
+                    ticket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, pow_solution, challengeContext.clientSecret, challengeContext.cpuTarget, solverFingerprint);
+                    isValid = ticket !== null;
+                    this._log('CPU target challenge verification', { isValid });
+                } else if (pow_type === "cpu_mem" && pow_solution_cpu && pow_solution_mem) {
+                    const cpuTicket = verifyCpuTargetPoWAndGenerateTicket(clientIp, finalTtl, pow_nonce, pow_solution_cpu, challengeContext.clientSecret, challengeContext.cpuTarget, solverFingerprint);
+                    const isMemValid = verifyMemoryPoW(pow_nonce, pow_solution_mem, challengeContext.memDifficulty, challengeContext.clientSecret);
+                    isValid = cpuTicket !== null && isMemValid;
+                    if (isValid) ticket = cpuTicket; // Le ticket est le même, on le réutilise
+                    this._log('Combined CPU+Memory challenge verification', {
+                        cpuValid: cpuTicket !== null,
+                        memValid: isMemValid,
+                        isValid
+                    });
+                }
             }
         } else {
             this._log('Challenge context not found or expired', { pow_nonce });
@@ -1888,11 +1850,12 @@ export class FingerprintEngine {
             finalSearchParams.delete('pow_solution');
             finalSearchParams.delete('pow_solution_cpu');
             finalSearchParams.delete('pow_solution_mem');
+            finalSearchParams.delete('pow_fp'); // Ne pas oublier de nettoyer le fingerprint
 
             // 4. On reconstruit le chemin final.
             const finalQueryString = finalSearchParams.toString();
             const finalRedirectPath = finalQueryString ? `${originalUrl.pathname}?${finalQueryString}` : originalUrl.pathname;
-            this._log('Redirecting to clean path', { finalRedirectPath });
+            this._log('Redirecting to clean path', { finalRedirectPath, cookieMaxAge: finalTtl });
             return {
               action: 'redirect',
               path: finalRedirectPath,
@@ -1900,8 +1863,8 @@ export class FingerprintEngine {
               vector: { challenge_solved: 100 },
               cookie: {
                 name: 'pow_clearance',
-                value: ticket,
-                options: { httpOnly: true, secure: this.isProduction, maxAge: finalTtl }
+                value: ticket, // The ticket itself
+                options: { httpOnly: true, secure: this.isProduction, maxAge: finalTtl } // Options for setting the cookie
               }
             };
         } else {
@@ -1911,6 +1874,60 @@ export class FingerprintEngine {
             suspicionVector.honeypotScore = 100; // Invalid solution is a strong bot signal.
             finalScore = this.calculateFinalScore(suspicionVector);
         }
+    } else if (pow_nonce && pow_type === 'optimization_task' && pow_solution_population) {
+        this._log('Optimization task solution submitted', { pow_nonce });
+        const challengeContext = await store.get(`secret:${pow_nonce}`);
+        let isValid = false;
+
+        if (challengeContext?.optimizationProblem) {
+            try {
+                const submittedChromosomes = JSON.parse(pow_solution_population);
+                // Vérification simple : le client a-t-il renvoyé le bon nombre de solutions ?
+                if (Array.isArray(submittedChromosomes) && submittedChromosomes.length === challengeContext.optimizationProblem.population.length) {
+                    // Le serveur recalcule la fitness pour la nouvelle population.
+                    const fitnessFunction = Optimization.Operators.createFullSecurityConfigEvaluator({ trafficData: challengeContext.optimizationProblem.trafficData });
+                    const newPopulation = submittedChromosomes.map(chromosome => ({ chromosome, fitness: fitnessFunction(chromosome) }));
+                    
+                    // On met à jour le problème principal avec la nouvelle population.
+                    challengeContext.optimizationProblem.population = newPopulation;
+                    await store.set(`device:${deviceId}`, deviceData); // Sauvegarde l'état mis à jour
+                    isValid = true;
+                }
+            } catch (e) {
+                this._log('Error parsing optimization solution', { error: e.message });
+            }
+        }
+
+        if (isValid) {
+            await store.delete(`secret:${pow_nonce}`);
+            // La solution est valide, on accorde un ticket et on redirige.
+            const ticket = "valid_ticket_placeholder"; // Générer un vrai ticket ici
+            return { action: 'redirect', path: path, score: 0, vector: { challenge_solved: 100 }, cookie: { name: 'pow_clearance', value: ticket, options: { httpOnly: true, secure: this.isProduction, maxAge: 60000 } } };
+        } else {
+            this._log('Optimization task solution invalid', { pow_nonce });
+            suspicionVector.honeypotScore = 100;
+            finalScore = this.calculateFinalScore(suspicionVector);
+        }
+    } else if (pow_nonce && pow_type === 'useful_work_task' && pow_solution_work_result && pow_problem_id) {
+        this._log('Useful work solution submitted', { problemId: pow_problem_id });
+        const challengeContext = await store.get(`secret:${pow_nonce}`);
+        if (challengeContext) {
+            try {
+                const workResult = JSON.parse(pow_solution_work_result);
+                problemManager.integrateSolution(pow_problem_id, workResult);
+
+                await store.delete(`secret:${pow_nonce}`);
+                // Accorder un ticket de passage comme pour un PoW normal
+                const ticket = "valid_ticket_placeholder"; // Générer un vrai ticket ici
+                return { action: 'redirect', path: path, score: 0, vector: { challenge_solved: 100 }, cookie: { name: 'pow_clearance', value: ticket, options: { httpOnly: true, secure: this.isProduction, maxAge: 60000 } } };
+
+            } catch (e) {
+                this._log('Error parsing useful work solution', { error: e.message });
+            }
+        }
+        // Si la validation échoue, on pénalise fortement
+        suspicionVector.honeypotScore = 100;
+        finalScore = this.calculateFinalScore(suspicionVector);
     }
     // --- FIN DE LA LOGIQUE DE PRIORITÉ ---
 
@@ -1961,13 +1978,25 @@ export class FingerprintEngine {
         const nonce = crypto.randomBytes(16).toString("hex");
         const clientSecret = crypto.randomBytes(16).toString("hex");
 
-        // LEVEL 3: CAPTCHA (the highest)
-        if (isSuspiciousHigh) {
-            // ... logic for TSP/Captcha challenge
-        }
+        // Pour les scores élevés, on choisit aléatoirement entre un challenge de travail utile et un PoW classique.
+        // Cela rend l'automatisation plus difficile pour un attaquant.
+        if (isSuspicious && this.securityConfig.enableUsefulWork && Math.random() > 0.5) {
+            this._log('Issuing a useful work challenge', { finalScore });
+
+            const { problemId, task } = problemManager.dispatchWork(suspicionFactor);
 
-        // UNIFIED CHALLENGE LOGIC for all suspicion levels (low, medium, high)
-        if (isSuspicious) { // Couvre à la fois low et medium
+            await store.set(`secret:${nonce}`, { clientSecret, originalPath: path }, 300);
+
+            const challengePayload = {
+                challenge: {
+                    type: 'useful_work_task',
+                    nonce: nonce,
+                    clientSecret: clientSecret,
+                    usefulWorkTask: { problemId, task }
+                }
+            };
+            return { action: 'challenge', score: finalScore, vector: suspicionVector, status: 404, body: challengePayload };
+        } else if (isSuspicious) { // Pour les scores bas/moyens ou si le travail utile n'est pas choisi
             // Generate some trap URLs to embed in the challenge page.
             // These links are visually hidden but present in the DOM to trap bots.
             const trapUrls = Array.from({ length: 3 }, () => generateTrapUrl(nonce));
@@ -1990,12 +2019,15 @@ export class FingerprintEngine {
                 memDifficulty,
                 cpuTarget: cpuChallengeDetails.target
             });
+            // (NOUVEAU) On stocke le fingerprint de la requête qui a déclenché le challenge.
+            const originalFingerprint = requestContext.headers['x-device-fingerprint'] || getCompositeDeviceHash(requestContext);
 
             // Store the entire challenge context with a short TTL (e.g., 5 minutes)
             await store.set(`secret:${nonce}`, {
                 clientSecret,
                 cpuTarget: cpuChallengeDetails.target,
                 suspicionScore: finalScore, // *** FIX: Store the score that triggered the challenge ***
+                fingerprint: originalFingerprint, // *** NOUVEAU ***
                 memDifficulty: memDifficulty,
                 originalPath: path, // *** FIX: Store the original path ***
             }, this.securityConfig.challengeTtl || 300); // NOUVEAU: TTL configurable (5min par défaut)
@@ -2017,7 +2049,7 @@ export class FingerprintEngine {
             }
 
             // Check if the request is an API request to return a JSON challenge
-            const isApi = requestContext.rawReq && this.securityConfig.thresholds?.isApiRequest?.(requestContext.rawReq);
+            const isApi = requestContext.rawReq && this.securityConfig?.isApiRequest?.(requestContext.rawReq);
 
             if (isApi) {
                 // For API clients, send a JSON response with challenge details.
@@ -2110,6 +2142,176 @@ export class FingerprintEngine {
   }
 }
 
+const staticExtensions = new RegExp(
+  "\\.(js|css|png|jpg|jpeg|gif|svg|mp3|webp|ico|woff|woff2|ttf|otf|map|json|manifest|webmanifest)$",
+  "i",
+);
+const isStaticResource = (path) => staticExtensions.test(path);
+
+
+/**
+ * Détermine le TTL optimal pour un ticket en utilisant un algorithme génétique multi-objectifs.
+ * @param {number} suspicionScore - Le score de suspicion de la requête.
+ * @returns {number} Le TTL optimal calculé en millisecondes.
+*/
+function determineOptimalTicketTtl(suspicionScore) {
+    // Définir les bornes pour la durée de vie du ticket (5 minutes à 24 heures)
+    const MIN_TTL = 300000;
+    const MAX_TTL = 86400000;
+
+    const solverFunction = () => {
+        const fitnessFunction = Optimization.Operators.createOptimalTtlEvaluator({ suspicionScore });
+
+        // Un "individu" est simplement une valeur de TTL en millisecondes.
+        const createIndividual = () => MIN_TTL + Math.random() * (MAX_TTL - MIN_TTL);
+        const crossover = (ttl1, ttl2) => (ttl1 + ttl2) / 2;
+        const mutate = (ttl) => {
+            const newTtl = ttl + (Math.random() - 0.5) * (MAX_TTL - MIN_TTL) * 0.1; // Mutation de +/- 10% max
+            return Math.max(MIN_TTL, Math.min(MAX_TTL, newTtl));
+        };
+
+        const paretoFront = Optimization.geneticAlgorithmMultiObjective(
+            createIndividual,
+            fitnessFunction,
+            crossover,
+            mutate,
+            {
+                generations: 40,
+                populationSize: 30,
+            }
+        );
+
+        // Pour runMultiple, on doit retourner un objet avec une propriété "fitness" ou "energy".
+        // Pour un front de Pareto, il n'y a pas de score unique. On choisit la meilleure solution
+        // en fonction du score de suspicion et on lui assigne un score de 0 pour que runMultiple la sélectionne.
+        if (!paretoFront || paretoFront.length === 0) {
+            return { solution: null, fitness: Infinity };
+        }
+
+        // Stratégie de sélection :
+        // Pour un score faible (< 50), on privilégie la solution avec le plus grand TTL (minimise la friction).
+        // Pour un score élevé (>= 50), on privilégie la solution avec le plus petit TTL (minimise le risque).
+        let bestSolutionInFront;
+        if (suspicionScore < 50) {
+            bestSolutionInFront = paretoFront.reduce((max, p) => Math.max(max, p.solution), 0);
+        } else {
+            bestSolutionInFront = paretoFront.reduce((min, p) => Math.min(min, p.solution), Infinity);
+        }
+        return { solution: bestSolutionInFront, fitness: 0 }; // fitness=0 car on a déjà la meilleure solution du cycle.
+    };
+
+    // On exécute le solveur 20 fois pour trouver une solution plus stable et robuste.
+    const { bestResult } = Optimization.runMultiple(solverFunction, 20);
+
+    if (!bestResult || !bestResult.solution || bestResult.solution === Infinity) {
+        // Fallback : si l'algo ne retourne rien, on applique une règle simple et sûre.
+        return Math.max(MIN_TTL, MAX_TTL - (suspicionScore / 100) * MAX_TTL);
+    }
+
+    // runMultiple choisit le meilleur résultat sur la base du score (ici, 0).
+    // La "meilleure" solution dépendra du cycle qui a trouvé le meilleur compromis.
+    return Math.round(bestResult.solution);
+}
+
+/**
+ * Vérifie si une chaîne de caractères contient des patterns d'injection connus.
+ * @private
+ * @param {string} str - La chaîne à vérifier.
+ * @param {string[]} [typesToDetect=['sql', 'log4shell', 'ssti', 'xxe', 'traversal', 'rce']] - Les types d'injections à détecter.
+ * @returns {boolean} - True si un pattern malveillant est détecté.
+ */
+function isMalicious(str, typesToDetect = Object.keys(injectionPatterns)) {
+    if (typeof str !== 'string') return false;
+
+    for (const type of typesToDetect) {
+        const regex = injectionPatterns[type];
+        if (regex && regex.test(str)) {
+            return true;
+        }
+    }
+
+    return false;
+}
+
+// --- Middleware Proof-of-Work (Le péage) ---
+export { isMalicious };
+
+/**
+ * Returns a default list of security analyzers for honeypot detection.
+ * This list can be used as a base and extended with custom rules.
+ * Currently includes an XSS detection analyzer.
+ * @returns {Array<Function>}
+ */
+export const default_analyzers = () => [
+    // Analyzer for Cross-Site Scripting (XSS) detection.
+    // It uses the 'xss' library, which should be installed by the user (`npm install xss`).
+    // If 'xss' is not available, this analyzer will be safely ignored.
+    xss_analyzer
+];
+
+export const xss_analyzer = async (data) => {
+    try {
+        // Dynamically import the 'xss' library.
+        // The module is loaded only once by Node's cache.
+        const xss = (await import('xss')).default;
+        const originalData = JSON.stringify(data);
+        // If the sanitized string is different, it means malicious HTML/JS was found and removed.
+        return xss(originalData) !== originalData;
+    } catch (error) {
+        // This catch block handles the case where the 'xss' module is not installed.
+        if (error.code === 'ERR_MODULE_NOT_FOUND') {
+            console.warn('[Fingerprint] Warning: The "xss" package is not installed. The default XSS analyzer is disabled. Run "npm install xss" to enable it.');
+            // To avoid repeated warnings, we can replace this function with a no-op.
+            this.isXssAnalyzerAvailable = false; // A flag to prevent future attempts.
+        }
+        return false; // In case of any error, we assume the data is not malicious.
+    }
+}
+/**
+ * Returns a powerful WAF (Web Application Firewall) analyzer based on ModSecurity.
+ * This analyzer is highly effective against a wide range of attacks (SQLi, XSS, RCE, etc.)
+ * by using the OWASP Core Rule Set.
+ *
+ * **Note:** This is an optional and advanced feature.
+ * 1. The user must install the package: `npm install modsecurity-nodejs`
+ * 2. ModSecurity rules (like the OWASP CRS) must be available on the server.
+ *
+ * If the package is not installed, the analyzer will be safely ignored.
+ *
+ * @param {string} rulesPath - The path to the ModSecurity rules configuration file (e.g., `crs-setup.conf`).
+ * @returns {Function} An analyzer function to be used in the `honeypot.analyzers` array.
+ */
+export const modsecurity_analyzer = (rulesPath) => {
+    let wafInstance = null; // Singleton instance for the WAF
+
+    return async (data) => {
+        if (!rulesPath) {
+            console.warn('[Fingerprint] ModSecurity analyzer disabled: `rulesPath` is not provided.');
+            return false;
+        }
+
+        try {
+            if (!wafInstance) {
+                // Dynamically import the library only when needed.
+                const { ModSecurity } = await import('modsecurity-nodejs');
+                wafInstance = new ModSecurity();
+                wafInstance.init();
+                wafInstance.addRules(rulesPath);
+                console.log('[Fingerprint] ModSecurity WAF analyzer initialized successfully.');
+            }
+
+            // The `transaction` method checks the data against the loaded rules.
+            // It returns `null` if no rules are matched, or an object with intervention details if a threat is found.
+            const result = wafInstance.transaction(data);
+            return result !== null; // A non-null result means a threat was detected.
+        } catch (error) {
+            if (error.code === 'ERR_MODULE_NOT_FOUND') {
+                console.warn('[Fingerprint] Warning: "modsecurity-nodejs" is not installed. The WAF analyzer is disabled. Run "npm install modsecurity-nodejs" to enable it.');
+            }
+            return false; // Assume data is safe if any error occurs.
+        }
+    };
+};
 /**
  * Returns a default list of whitelisting rules for common and legitimate web crawlers.
  * This list can be used as a base and extended with custom rules.
@@ -2228,9 +2430,8 @@ export const powMiddleware = (securityConfig) => {
 
   // Provide a default for isApiRequest if not specified by the user.
   // This makes API challenge handling work more seamlessly out-of-the-box.
-  if (!securityConfig.thresholds?.isApiRequest) {
-    if (!securityConfig.thresholds) securityConfig.thresholds = {};
-    securityConfig.thresholds.isApiRequest = (req) => 
+  if (!securityConfig?.isApiRequest) {
+    securityConfig.isApiRequest = (req) =>
       req.headers?.accept?.includes('application/json');
   }
 
@@ -2242,9 +2443,10 @@ export const powMiddleware = (securityConfig) => {
       query: req.query,
       body: req.body,
       headers: req.headers,
-      isStatic: isStaticResource(req.path),
+      isStatic: securityConfig?.isStaticResource?.(req.path) || isStaticResource(req.path),
       // Pass the original request object for the isApiRequest function
       rawReq: req,
+      requestTimestamp: Date.now(), // Timestamp de début de requête
       // Add the newly required properties for full decoupling
       rawHeaders: req.rawHeaders,
       // Pass the raw request object for advanced inspection (e.g., JA3)
@@ -2306,6 +2508,7 @@ export const __internal = {
     getBehaviorScore, // Expose for testing
     getCrossLayerInconsistency, // Expose for testing
     // Expose page generators for security testing
+    getTimeInconsistencyScore,
     generateCpuTargetChallengePage,
     generateCombinedPoWChallengePage,
 };

package/library.js

@@ -289,20 +289,23 @@ const Optimization = {
    * @param {number} numCycles - Le nombre total de cycles à exécuter.
    * @param {boolean} [logProgress=false] - Si true, affiche la progression dans la console.
    * @param {object} [options={}] - Options pour la parallélisation.
-   * @param {number} [options.concurrency] - Le nombre de workers à utiliser en parallèle. Par défaut, le nombre de cœurs CPU.
+   * @param {number} [options.concurrency] - Le nombre de workers à utiliser en parallèle. Par défaut, le nombre de cœurs CPU. 
+   * @param {function(number): Array<any>} [options.workerDataGenerator] - Une fonction qui, pour chaque cycle (index), génère les arguments spécifiques à passer au solveur. Si non fournie, `baseSolverArgs` est utilisé tel quel.
    * @returns {Promise<{bestResult: object, stats: {scores: Array<number>, average: number, stdDev: number}}>} Le meilleur résultat et des statistiques.
    */
   async runMultipleParallel(
     solverName,
-    baseSolverArgs,
+    baseSolverArgs = [], // Default to empty array if not provided
     numCycles,
     logProgress = false,
     options = {},
   ) {
     const concurrency = options.concurrency || os.cpus().length;
+    const workerDataGenerator = options.workerDataGenerator;
+
     if (logProgress) {
       console.log(
-        `   (Utilisation d'un pool de ${concurrency} workers pour ${numCycles} cycles)`,
+        `   (Utilisation d'un pool de ${concurrency} workers pour ${numCycles} cycles avec le solveur ${solverName})`,
       );
     }
 
@@ -317,18 +320,15 @@ const Optimization = {
 
         const workerData = {
           solverName,
-          solverArgs: [
-            // Chaque worker génère son propre jeu de données aléatoires pour garantir l'indépendance des cycles.
-            Array.from({ length: 50 }, () => ({
-              x: Math.random() * 100,
-              y: Math.random() * 100,
-            })),
-            ...baseSolverArgs,
-          ],
+          solverArgs: workerDataGenerator
+            ? workerDataGenerator(taskIndex)
+            : baseSolverArgs,
         };
 
-        const result = await new Promise((resolve, reject) => {
-          const worker = new Worker("./worker.js", { workerData });
+        const result = await new Promise(async (resolve, reject) => {
+          // Le chemin du worker doit être absolu ou relatif au fichier appelant.
+          // On utilise import.meta.url pour résoudre le chemin de manière fiable.
+          const worker = new Worker(new URL('./optimization.worker.js', import.meta.url), { workerData });
           worker.on("message", resolve);
           worker.on("error", reject);
           worker.on("exit", (code) => {
@@ -1313,15 +1313,21 @@ Optimization.Operators.createOptimalTtlEvaluator = ({ suspicionScore }) => {
  * @param {string} numberString - Une chaîne de chiffres (ex: "123456789").
  * @returns {number} Un score de déviation (0 = parfait, > 0.15 = suspect).
  */
-Optimization.Operators.benfordTest = (numberString) => {
-    const firstDigits = numberString.replace(/[^1-9]/g, ''); // Garde uniquement les chiffres de 1 à 9
-    if (firstDigits.length < 10) {
+Optimization.Operators.benfordTest = (numbers) => {
+    if (!Array.isArray(numbers)) {
+        // Si l'entrée n'est pas un tableau, on ne peut pas l'analyser.
+        return 0;
+    }
+    const leadingDigits = numbers.map(n => String(n).trim().charAt(0))
+                                 .filter(d => d >= '1' && d <= '9'); // On ne garde que les chiffres de 1 à 9.
+
+    if (leadingDigits.length < 10) {
         return 0; // Pas assez de données pour un test fiable
     }
 
     const counts = Array(10).fill(0);
-    for (let i = 0; i < firstDigits.length; i++) {
-        counts[parseInt(firstDigits[i], 10)]++;
+    for (let i = 0; i < leadingDigits.length; i++) {
+        counts[parseInt(leadingDigits[i], 10)]++;
     }
 
     // Distribution attendue selon la loi de Benford pour le premier chiffre
@@ -1332,7 +1338,7 @@ Optimization.Operators.benfordTest = (numberString) => {
 
     let totalDeviation = 0;
     for (let i = 1; i <= 9; i++) {
-        const observedFrequency = (counts[i] / firstDigits.length) * 100;
+        const observedFrequency = (counts[i] / leadingDigits.length) * 100;
         const expectedFrequency = benfordDistribution[i];
         totalDeviation += Math.pow(observedFrequency - expectedFrequency, 2);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anonympins/fingerprint",
-  "version": "0.1.4",
+  "version": "0.2.0",
   "description": "An HTTP(S) client mitigation and anti-bot protection library for Node.js/Express, based on digital fingerprinting and dynamic Proof-of-Work (PoW) challenges.",
   "main": "fingerprint.js",
   "type": "module",

package/pow.solver.js

@@ -1,6 +1,9 @@
 /**
  * @file @/pow.solver.js
  * @description Contient les fonctions côté client pour résoudre les différents types de challenges Proof-of-Work.
+ * IMPORTANT: Pour les tâches d'optimisation, ce fichier a besoin d'accéder aux algorithmes de `library.js`.
+ * Dans un vrai projet, il faudrait bundler une version client de `library.js` et l'importer ici.
+ * Pour cet exemple, nous allons copier/coller les fonctions nécessaires.
  * Fichier compatible à la fois avec l'import de modules ES6 et l'injection directe dans un script HTML.
  */
 
@@ -169,13 +172,164 @@ export async function solveTsp(cities, targetMaxDistance) {
     return { path: solutionPath, distance: solutionDistance };
 }
 
+// --- Fonctions d'optimisation copiées/adaptées de library.js pour le client ---
+
+const ClientOptimizers = {
+    simulatedAnnealing(initialSolution, evaluator, neighbor, iterations, temp, cooling) {
+        let currentSolution = initialSolution;
+        let currentEnergy = evaluator(currentSolution);
+        let temperature = temp;
+
+        for (let i = 0; i < iterations; i++) {
+            const newSolution = neighbor(currentSolution);
+            const newEnergy = evaluator(newSolution);
+            if (newEnergy < currentEnergy || Math.random() < Math.exp((currentEnergy - newEnergy) / temperature)) {
+                currentSolution = newSolution;
+                currentEnergy = newEnergy;
+            }
+            temperature *= cooling;
+        }
+        return { solution: currentSolution, energy: currentEnergy };
+    },
+
+    geneticAlgorithm(createIndividual, fitness, crossover, mutate, generations, popSize) {
+        let population = Array.from({ length: popSize }, () => {
+            const chromosome = createIndividual();
+            return { chromosome, fitness: fitness(chromosome) };
+        });
+
+        for (let gen = 0; gen < generations; gen++) {
+            population.sort((a, b) => a.fitness - b.fitness);
+            const newPopulation = [population[0]]; // Elitism
+            while (newPopulation.length < popSize) {
+                const p1 = population[Math.floor(Math.random() * (popSize / 2))];
+                const p2 = population[Math.floor(Math.random() * (popSize / 2))];
+                let offspring = crossover(p1.chromosome, p2.chromosome);
+                if (Math.random() < 0.1) offspring = mutate(offspring);
+                newPopulation.push({ chromosome: offspring, fitness: fitness(offspring) });
+            }
+            population = newPopulation;
+        }
+        return population;
+    }
+};
+
+/**
+ * Résout une unité de travail utile (Useful Work Unit).
+ * @param {object} task - La tâche envoyée par le serveur.
+ * @returns {Promise<object>} Le résultat du calcul.
+ */
+async function solveUsefulWorkTask(task) {
+    await new Promise(r => setTimeout(r, 10)); // Yield thread
+
+    switch (task.type) {
+        case 'simulated_annealing_iterations': {
+            const { cities } = task.payload;
+            const distance = (c1, c2) => Math.sqrt(Math.pow(c1.x - c2.x, 2) + Math.pow(c1.y - c2.y, 2));
+            const evaluator = (path) => {
+                let total = 0;
+                for (let i = 0; i < path.length - 1; i++) total += distance(cities[path[i]], cities[path[i + 1]]);
+                total += distance(cities[path[path.length - 1]], cities[path[0]]);
+                return total;
+            };
+            const neighbor = (path) => {
+                const newPath = [...path];
+                const [i, j] = [Math.floor(Math.random() * path.length), Math.floor(Math.random() * path.length)];
+                [newPath[i], newPath[j]] = [newPath[j], newPath[i]];
+                return newPath;
+            };
+            const initialSolution = task.initialSolution || Array.from({ length: cities.length }, (_, i) => i).sort(() => 0.5 - Math.random());
+            
+            return ClientOptimizers.simulatedAnnealing(initialSolution, evaluator, neighbor, task.iterations, task.payload.options.initialTemperature, task.payload.options.coolingRate);
+        }
+
+        case 'genetic_algorithm_generations': {
+            const { assets, maxVolatility } = task.payload;
+            const fitness = (weights) => {
+                const total = weights.reduce((s, w) => s + w, 0);
+                if (total === 0) return Infinity;
+                const normW = weights.map(w => w / total);
+                const ret = normW.reduce((s, w, i) => s + w * assets[i].expectedReturn, 0);
+                const vol = normW.reduce((s, w, i) => s + w * assets[i].volatility, 0);
+                if (vol > maxVolatility) return 1000 + (vol - maxVolatility);
+                return -ret;
+            };
+            const createIndividual = () => Array.from({ length: assets.length }, Math.random);
+            const crossover = (p1, p2) => p1.map((w, i) => (w + p2[i]) / 2);
+            const mutate = p => { const n = [...p], i = Math.floor(Math.random() * n.length); n[i] += (Math.random() - 0.5) * 0.2; return n.map(v => Math.max(0, v)); };
+            
+            // Le client doit recréer la population si elle n'est pas fournie
+            const initialPopulation = task.initialPopulation || Array.from({ length: task.payload.options.populationSize }, () => ({ chromosome: createIndividual(), fitness: 0 }));
+            initialPopulation.forEach(p => p.fitness = fitness(p.chromosome));
+
+            const finalPopulation = ClientOptimizers.geneticAlgorithm(createIndividual, fitness, crossover, mutate, task.generations, task.payload.options.populationSize);
+            return { population: finalPopulation };
+        }
+
+        case 'run_multiple_parallel':
+            // Côté client, on ne peut pas utiliser de vrais workers pour `runMultipleParallel`.
+            // On exécute donc une version simplifiée : un seul cycle du solveur demandé.
+            // Cela reste un travail coûteux et valide le principe du "Useful Work".
+            const { solverName, baseSolverArgs } = task;
+            const clientSolver = ClientOptimizers[solverName];
+            if (!clientSolver) throw new Error(`Solver ${solverName} not found on client.`);
+            
+            // On simule l'appel avec les arguments de base.
+            // Note: `baseSolverArgs` peut contenir des options.
+            return clientSolver(...baseSolverArgs);
+
+        default:
+            throw new Error(`Unknown useful work type: ${task.type}`);
+    }
+}
+
+/**
+ * Résout une tâche d'optimisation basée sur un algorithme génétique.
+ * Reçoit une population et la fait évoluer pendant un certain nombre de générations.
+ * NOTE: Cette fonction est une version simplifiée de l'AG de `library.js` adaptée au client.
+ * @param {Array<object>} initialPopulation - La population de départ.
+ * @param {number} generations - Le nombre de générations à exécuter.
+ * @returns {Promise<Array<object>>} La population finale après évolution.
+ */
+export async function solveOptimizationTask(initialPopulation, generations) {
+    // Fonctions AG simplifiées (croisement, mutation)
+    const crossover = (p1, p2) => p1.map((w, i) => (w + p2[i]) / 2);
+    const mutate = (p) => {
+        const newP = [...p];
+        const i = Math.floor(Math.random() * newP.length);
+        newP[i] += (Math.random() - 0.5) * 0.2;
+        return newP;
+    };
+
+    let population = initialPopulation;
+
+    for (let gen = 0; gen < generations; gen++) {
+        // Sélection simple : on garde les 50% meilleurs
+        const parents = population.sort((a, b) => a.fitness - b.fitness).slice(0, Math.ceil(population.length / 2));
+        const newPopulation = [...parents]; // Élitisme
+
+        while (newPopulation.length < population.length) {
+            const parent1 = parents[Math.floor(Math.random() * parents.length)];
+            const parent2 = parents[Math.floor(Math.random() * parents.length)];
+            let offspring = crossover(parent1.chromosome, parent2.chromosome);
+            if (Math.random() < 0.1) offspring = mutate(offspring);
+            // La fitness sera recalculée côté serveur pour la vérification.
+            newPopulation.push({ chromosome: offspring, fitness: -1 });
+        }
+        population = newPopulation;
+        // Pause pour ne pas geler l'UI sur les longues tâches
+        if (gen % 10 === 0) await new Promise(r => setTimeout(r, 0));
+    }
+    return population;
+}
+
 /**
  * Fonction principale qui reçoit un objet challenge et le résout.
  * @param {object} challenge - L'objet challenge reçu du serveur.
  * @returns {Promise<object>} Un objet contenant la ou les solutions.
  */
 export async function solveChallenge(challenge) {
-    const { type, nonce, clientSecret, cpuTarget, memDifficulty, cities, clientIp, targetMaxDistance } = challenge;
+    const { type, nonce, clientSecret, cpuTarget, memDifficulty, cities, clientIp, targetMaxDistance, optimizationTask, usefulWorkTask } = challenge;
     const solutions = {};
 
     switch (type) {
@@ -219,6 +373,15 @@ export async function solveChallenge(challenge) {
             solutions.tsp = tspResult.path;
             solutions.distance = tspResult.distance;
             break;
+        case 'optimization_task':
+            const finalPopulation = await solveOptimizationTask(optimizationTask.population, optimizationTask.generations);
+            solutions.population = finalPopulation.map(p => p.chromosome); // On ne renvoie que les chromosomes
+            break;
+        case 'useful_work_task':
+            const workResult = await solveUsefulWorkTask(usefulWorkTask.task);
+            solutions.work_result = workResult;
+            solutions.problem_id = usefulWorkTask.problemId;
+            break;
         default:
             throw new Error(`Unknown challenge type: ${type}`);
     }