@anonympins/fingerprint 0.3.7 → 0.4.0

package/src/php/Utils/MetricsManager.php

@@ -1,167 +1,167 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Utils;
-
-class MetricsManager
-{
-    /** @var array Stockage temporaire des compteurs Prometheus */
-    private static array $counters = [];
-
-    /** @var array Stockage temporaire des observations Prometheus */
-    private static array $observations = [];
-
-    /**
-     * Incrémente un compteur Prometheus.
-     *
-     * @param string $name Nom du compteur.
-     * @param array $labels Libellés/Labels associés.
-     */
-    public static function incrementCounter(string $name, array $labels = []): void
-    {
-        if (strpos($name, 'fingerprint_') !== 0) {
-            $name = 'fingerprint_' . $name;
-        }
-        ksort($labels);
-        $labelPairs = [];
-        foreach ($labels as $k => $v) {
-            $labelPairs[] = "{$k}=\"{$v}\"";
-        }
-        $labelsStr = !empty($labelPairs) ? '{' . implode(',', $labelPairs) . '}' : '';
-        $key = $name . $labelsStr;
-
-        if (!isset(self::$counters[$key])) {
-            self::$counters[$key] = [
-                'name' => $name,
-                'labelsStr' => $labelsStr,
-                'value' => 0
-            ];
-        }
-        self::$counters[$key]['value']++;
-    }
-
-    /**
-     * Enregistre une observation de valeur (ex: temps d'exécution, score).
-     *
-     * @param string $name Nom de la métrique.
-     * @param float $value Valeur observée.
-     * @param array $labels Libellés/Labels associés.
-     */
-    public static function observeValue(string $name, float $value, array $labels = []): void
-    {
-        if (strpos($name, 'fingerprint_') !== 0) {
-            $name = 'fingerprint_' . $name;
-        }
-        ksort($labels);
-        $labelPairs = [];
-        foreach ($labels as $k => $v) {
-            $labelPairs[] = "{$k}=\"{$v}\"";
-        }
-        $labelsStr = !empty($labelPairs) ? '{' . implode(',', $labelPairs) . '}' : '';
-        $key = $name . $labelsStr;
-
-        self::$observations[$key] = [
-            'name' => $name,
-            'labelsStr' => $labelsStr,
-            'value' => $value
-        ];
-    }
-
-    /**
-     * Réinitialise les compteurs enregistrés (utile pour l'isolation des tests).
-     */
-    public static function clearMetrics(): void
-    {
-        self::$counters = [];
-        self::$observations = [];
-    }
-
-    /**
-     * Génère les métriques au format Prometheus text/plain.
-     *
-     * @param array $securityConfig La configuration de sécurité active.
-     * @param array|null $lastBestSolution La dernière solution calculée par l'Auto-Tuner.
-     * @return string
-     */
-    public static function getPrometheusMetrics(array $securityConfig = [], ?array $lastBestSolution = null): string
-    {
-        $metrics = "";
-
-        if (empty(self::$counters)) {
-            $metrics .= "# HELP fingerprint_requests_total Total requests processed.\n";
-            $metrics .= "# TYPE fingerprint_requests_total counter\n";
-            $metrics .= "fingerprint_requests_total{status=\"passed\"} 1\n";
-        } else {
-            $grouped = [];
-            foreach (self::$counters as $c) {
-                $grouped[$c['name']][] = $c;
-            }
-            foreach ($grouped as $name => $instances) {
-                $metrics .= "# HELP {$name} Total requests processed.\n";
-                $metrics .= "# TYPE {$name} counter\n";
-                foreach ($instances as $instance) {
-                    $metrics .= "{$name}{$instance['labelsStr']} {$instance['value']}\n";
-                }
-            }
-        }
-
-        // Export des observations (Gauges)
-        if (!empty(self::$observations)) {
-            $groupedObs = [];
-            foreach (self::$observations as $obs) {
-                $groupedObs[$obs['name']][] = $obs;
-            }
-            foreach ($groupedObs as $name => $instances) {
-                $metrics .= "\n# HELP {$name} Value observation.\n";
-                $metrics .= "# TYPE {$name} gauge\n";
-                foreach ($instances as $instance) {
-                    $metrics .= "{$name}{$instance['labelsStr']} {$instance['value']}\n";
-                }
-            }
-        }
-
-        // 1. Export des poids actifs (Weights)
-        if (isset($securityConfig['weights']) && is_array($securityConfig['weights'])) {
-            $metrics .= "\n# HELP fingerprint_security_weight Active weight for each suspicion indicator.\n";
-            $metrics .= "# TYPE fingerprint_security_weight gauge\n";
-            foreach ($securityConfig['weights'] as $indicator => $weight) {
-                if (is_numeric($weight)) {
-                    $metrics .= "fingerprint_security_weight{indicator=\"{$indicator}\"} {$weight}\n";
-                }
-            }
-        }
-
-        // 2. Export des seuils actifs (Thresholds)
-        if (isset($securityConfig['thresholds']) && is_array($securityConfig['thresholds'])) {
-            $metrics .= "\n# HELP fingerprint_security_threshold Active score threshold for each enforcement action level.\n";
-            $metrics .= "# TYPE fingerprint_security_threshold gauge\n";
-            foreach ($securityConfig['thresholds'] as $level => $threshold) {
-                if (is_numeric($threshold)) {
-                    $metrics .= "fingerprint_security_threshold{level=\"{$level}\"} {$threshold}\n";
-                }
-            }
-        }
-
-        // 3. Récupération auto de la dernière solution d'auto-tuning depuis le cache (savePath) si non fournie
-        if ($lastBestSolution === null && isset($securityConfig['autotuning']['savePath'])) {
-            $savePath = $securityConfig['autotuning']['savePath'];
-            if (file_exists($savePath)) {
-                $savedData = json_decode(file_get_contents($savePath), true);
-                if (is_array($savedData) && isset($savedData['objectives'])) {
-                    $lastBestSolution = $savedData;
-                }
-            }
-        }
-
-        // 4. Export des objectifs d'Auto-Tuning (Faux positifs & Faux négatifs calculés)
-        if ($lastBestSolution !== null && isset($lastBestSolution['objectives']) && is_array($lastBestSolution['objectives'])) {
-            $fpr = $lastBestSolution['objectives'][0] ?? 0.0;
-            $fnr = $lastBestSolution['objectives'][1] ?? 0.0;
-            $metrics .= "\n# HELP fingerprint_autotuning_false_positive_rate Current false positive rate calculated by the auto-tuner.\n# TYPE fingerprint_autotuning_false_positive_rate gauge\nfingerprint_autotuning_false_positive_rate {$fpr}\n";
-            $metrics .= "\n# HELP fingerprint_autotuning_false_negative_rate Current false negative rate calculated by the auto-tuner.\n# TYPE fingerprint_autotuning_false_negative_rate gauge\nfingerprint_autotuning_false_negative_rate {$fnr}\n";
-        }
-
-        return $metrics;
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Utils;
+
+class MetricsManager
+{
+    /** @var array Stockage temporaire des compteurs Prometheus */
+    private static array $counters = [];
+
+    /** @var array Stockage temporaire des observations Prometheus */
+    private static array $observations = [];
+
+    /**
+     * Incrémente un compteur Prometheus.
+     *
+     * @param string $name Nom du compteur.
+     * @param array $labels Libellés/Labels associés.
+     */
+    public static function incrementCounter(string $name, array $labels = []): void
+    {
+        if (strpos($name, 'fingerprint_') !== 0) {
+            $name = 'fingerprint_' . $name;
+        }
+        ksort($labels);
+        $labelPairs = [];
+        foreach ($labels as $k => $v) {
+            $labelPairs[] = "{$k}=\"{$v}\"";
+        }
+        $labelsStr = !empty($labelPairs) ? '{' . implode(',', $labelPairs) . '}' : '';
+        $key = $name . $labelsStr;
+
+        if (!isset(self::$counters[$key])) {
+            self::$counters[$key] = [
+                'name' => $name,
+                'labelsStr' => $labelsStr,
+                'value' => 0
+            ];
+        }
+        self::$counters[$key]['value']++;
+    }
+
+    /**
+     * Enregistre une observation de valeur (ex: temps d'exécution, score).
+     *
+     * @param string $name Nom de la métrique.
+     * @param float $value Valeur observée.
+     * @param array $labels Libellés/Labels associés.
+     */
+    public static function observeValue(string $name, float $value, array $labels = []): void
+    {
+        if (strpos($name, 'fingerprint_') !== 0) {
+            $name = 'fingerprint_' . $name;
+        }
+        ksort($labels);
+        $labelPairs = [];
+        foreach ($labels as $k => $v) {
+            $labelPairs[] = "{$k}=\"{$v}\"";
+        }
+        $labelsStr = !empty($labelPairs) ? '{' . implode(',', $labelPairs) . '}' : '';
+        $key = $name . $labelsStr;
+
+        self::$observations[$key] = [
+            'name' => $name,
+            'labelsStr' => $labelsStr,
+            'value' => $value
+        ];
+    }
+
+    /**
+     * Réinitialise les compteurs enregistrés (utile pour l'isolation des tests).
+     */
+    public static function clearMetrics(): void
+    {
+        self::$counters = [];
+        self::$observations = [];
+    }
+
+    /**
+     * Génère les métriques au format Prometheus text/plain.
+     *
+     * @param array $securityConfig La configuration de sécurité active.
+     * @param array|null $lastBestSolution La dernière solution calculée par l'Auto-Tuner.
+     * @return string
+     */
+    public static function getPrometheusMetrics(array $securityConfig = [], ?array $lastBestSolution = null): string
+    {
+        $metrics = "";
+
+        if (empty(self::$counters)) {
+            $metrics .= "# HELP fingerprint_requests_total Total requests processed.\n";
+            $metrics .= "# TYPE fingerprint_requests_total counter\n";
+            $metrics .= "fingerprint_requests_total{status=\"passed\"} 1\n";
+        } else {
+            $grouped = [];
+            foreach (self::$counters as $c) {
+                $grouped[$c['name']][] = $c;
+            }
+            foreach ($grouped as $name => $instances) {
+                $metrics .= "# HELP {$name} Total requests processed.\n";
+                $metrics .= "# TYPE {$name} counter\n";
+                foreach ($instances as $instance) {
+                    $metrics .= "{$name}{$instance['labelsStr']} {$instance['value']}\n";
+                }
+            }
+        }
+
+        // Export des observations (Gauges)
+        if (!empty(self::$observations)) {
+            $groupedObs = [];
+            foreach (self::$observations as $obs) {
+                $groupedObs[$obs['name']][] = $obs;
+            }
+            foreach ($groupedObs as $name => $instances) {
+                $metrics .= "\n# HELP {$name} Value observation.\n";
+                $metrics .= "# TYPE {$name} gauge\n";
+                foreach ($instances as $instance) {
+                    $metrics .= "{$name}{$instance['labelsStr']} {$instance['value']}\n";
+                }
+            }
+        }
+
+        // 1. Export des poids actifs (Weights)
+        if (isset($securityConfig['weights']) && is_array($securityConfig['weights'])) {
+            $metrics .= "\n# HELP fingerprint_security_weight Active weight for each suspicion indicator.\n";
+            $metrics .= "# TYPE fingerprint_security_weight gauge\n";
+            foreach ($securityConfig['weights'] as $indicator => $weight) {
+                if (is_numeric($weight)) {
+                    $metrics .= "fingerprint_security_weight{indicator=\"{$indicator}\"} {$weight}\n";
+                }
+            }
+        }
+
+        // 2. Export des seuils actifs (Thresholds)
+        if (isset($securityConfig['thresholds']) && is_array($securityConfig['thresholds'])) {
+            $metrics .= "\n# HELP fingerprint_security_threshold Active score threshold for each enforcement action level.\n";
+            $metrics .= "# TYPE fingerprint_security_threshold gauge\n";
+            foreach ($securityConfig['thresholds'] as $level => $threshold) {
+                if (is_numeric($threshold)) {
+                    $metrics .= "fingerprint_security_threshold{level=\"{$level}\"} {$threshold}\n";
+                }
+            }
+        }
+
+        // 3. Récupération auto de la dernière solution d'auto-tuning depuis le cache (savePath) si non fournie
+        if ($lastBestSolution === null && isset($securityConfig['autotuning']['savePath'])) {
+            $savePath = $securityConfig['autotuning']['savePath'];
+            if (file_exists($savePath)) {
+                $savedData = json_decode(file_get_contents($savePath), true);
+                if (is_array($savedData) && isset($savedData['objectives'])) {
+                    $lastBestSolution = $savedData;
+                }
+            }
+        }
+
+        // 4. Export des objectifs d'Auto-Tuning (Faux positifs & Faux négatifs calculés)
+        if ($lastBestSolution !== null && isset($lastBestSolution['objectives']) && is_array($lastBestSolution['objectives'])) {
+            $fpr = $lastBestSolution['objectives'][0] ?? 0.0;
+            $fnr = $lastBestSolution['objectives'][1] ?? 0.0;
+            $metrics .= "\n# HELP fingerprint_autotuning_false_positive_rate Current false positive rate calculated by the auto-tuner.\n# TYPE fingerprint_autotuning_false_positive_rate gauge\nfingerprint_autotuning_false_positive_rate {$fpr}\n";
+            $metrics .= "\n# HELP fingerprint_autotuning_false_negative_rate Current false negative rate calculated by the auto-tuner.\n# TYPE fingerprint_autotuning_false_negative_rate gauge\nfingerprint_autotuning_false_negative_rate {$fnr}\n";
+        }
+
+        return $metrics;
+    }
 }

package/src/php/Utils/RequestUtils.php

@@ -906,10 +906,20 @@ class RequestUtils
         $subnetData = $store->get($key) ?? [
             'highScoreCount' => 0,
             'deviceIds' => [],
+            'highScoreDevices' => [],
             'lastActivity' => 0
         ];
 
-        $subnetData['highScoreCount']++;
+        if (!isset($subnetData['highScoreDevices'])) {
+            $subnetData['highScoreDevices'] = [];
+        }
+
+        $currentDeviceContributions = $subnetData['highScoreDevices'][$deviceId] ?? 0;
+        if ($currentDeviceContributions < 5 && $finalScore < 95) {
+            $subnetData['highScoreDevices'][$deviceId] = $currentDeviceContributions + 1;
+            $subnetData['highScoreCount']++;
+        }
+
         if (!in_array($deviceId, $subnetData['deviceIds'])) {
             $subnetData['deviceIds'][] = $deviceId;
         }
@@ -917,7 +927,12 @@ class RequestUtils
 
         // Limiter la taille du tableau des deviceIds pour éviter une consommation mémoire excessive.
         if (count($subnetData['deviceIds']) > 100) {
-            array_shift($subnetData['deviceIds']);
+            $oldDeviceId = array_shift($subnetData['deviceIds']);
+            if (isset($subnetData['highScoreDevices'][$oldDeviceId])) {
+                $oldContributions = $subnetData['highScoreDevices'][$oldDeviceId];
+                $subnetData['highScoreCount'] = max(0, $subnetData['highScoreCount'] - $oldContributions);
+                unset($subnetData['highScoreDevices'][$oldDeviceId]);
+            }
         }
 
         // TTL de 24 heures pour les données de sous-réseau.
@@ -945,16 +960,28 @@ class RequestUtils
             return ['subnetScore' => 0.0];
         }
 
+        // Application d'une décroissance temporelle (demi-vie de 30 minutes soit 1800 secondes)
+        $now = time();
+        $inactivitySec = $now - ($subnetData['lastActivity'] ?? $now);
+        $halfLives = (int)floor($inactivitySec / 1800);
+
+        $highScoreCount = $subnetData['highScoreCount'] ?? 0;
+        $deviceCount = isset($subnetData['deviceIds']) ? count($subnetData['deviceIds']) : 0;
+
+        if ($halfLives > 0) {
+            $highScoreCount = max(0, (int)floor($highScoreCount / pow(2, $halfLives)));
+            $deviceCount = max(0, (int)floor($deviceCount / pow(2, $halfLives)));
+        }
+
         $score = 0.0;
 
         // Pénalité basée sur le nombre de devices uniques vus depuis ce sous-réseau.
-        $deviceCount = count($subnetData['deviceIds']);
         if ($deviceCount > 10) {
             $score += min(80.0, ($deviceCount - 10) * 5);
         }
 
         // Pénalité basée sur le nombre de scores élevés enregistrés.
-        $score += min(40.0, $subnetData['highScoreCount'] * 2);
+        $score += min(40.0, $highScoreCount * 2);
 
         return ['subnetScore' => min(100.0, $score)];
     }

package/src/php/Utils/TLSClientHelloParser.php

@@ -0,0 +1,117 @@
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Utils;
+
+/**
+ * Décode nativement un paquet TLS Client Hello binaire pour calculer l'empreinte JA3/JA4.
+ */
+class TLSClientHelloParser
+{
+    private const GREASE_VALUES = [
+        2570, 6682, 10794, 14906, 19018, 23130, 27242, 31354,
+        35466, 39578, 43690, 47802, 51914, 55926, 60038, 64150
+    ];
+
+    /**
+     * Parse le Client Hello brut et retourne l'empreinte JA3 et une approximation JA4.
+     * 
+     * @param string $binary Le premier paquet TCP reçu sur la socket.
+     * @return array{ja3_string: string, ja3_hash: string, ja4_raw: string}|null
+     */
+    public static function parse(string $binary): ?array
+    {
+        $len = strlen($binary);
+        if ($len < 43) {
+            return null; // Paquet trop court
+        }
+
+        // 1. Vérification du Record Layer Type (0x16 = Handshake)
+        if (ord($binary[0]) !== 0x16) {
+            return null;
+        }
+
+        // 2. Vérification du Handshake Type (0x01 = Client Hello)
+        if (ord($binary[5]) !== 0x01) {
+            return null;
+        }
+
+        $offset = 43; // Sauter l'en-tête, la version et le Random Client (32 octets)
+        if ($len < $offset + 1) return null;
+
+        // 3. Lecture du Session ID
+        $sessionLen = ord($binary[$offset]);
+        $offset += 1 + $sessionLen;
+        if ($len < $offset + 2) return null;
+
+        // 4. Lecture des Cipher Suites
+        $ciphersLen = unpack('n', substr($binary, $offset, 2))[1];
+        $offset += 2;
+        if ($len < $offset + $ciphersLen + 1) return null;
+
+        $ciphers = [];
+        for ($i = 0; $i < $ciphersLen; $i += 2) {
+            $ciphers[] = unpack('n', substr($binary, $offset + $i, 2))[1];
+        }
+        $offset += $ciphersLen;
+
+        // 5. Lecture des Compression Methods
+        $compressionLen = ord($binary[$offset]);
+        $offset += 1 + $compressionLen;
+        if ($len < $offset + 2) return null;
+
+        // 6. Lecture des Extensions
+        $extensionsLen = unpack('n', substr($binary, $offset, 2))[1];
+        $offset += 2;
+
+        $extensions = [];
+        $curves = [];
+        $points = [];
+
+        $extLimit = $offset + $extensionsLen;
+        while ($offset < $extLimit && $offset + 4 <= $len) {
+            $extType = unpack('n', substr($binary, $offset, 2))[1];
+            $extLen = unpack('n', substr($binary, $offset + 2, 2))[1];
+            $offset += 4;
+
+            if ($offset + $extLen > $len) break;
+
+            $extensions[] = $extType;
+
+            if ($extType === 10) { // Extension Supported Groups (Elliptic Curves)
+                if ($extLen >= 2) {
+                    $curvesLen = unpack('n', substr($binary, $offset, 2))[1];
+                    for ($j = 2; $j < $curvesLen + 2; $j += 2) {
+                        $curves[] = unpack('n', substr($binary, $offset + $j, 2))[1];
+                    }
+                }
+            } elseif ($extType === 11) { // Extension EC Point Formats
+                if ($extLen >= 1) {
+                    $pointsLen = ord($binary[$offset]);
+                    for ($j = 1; $j < $pointsLen + 1; $j++) {
+                        $points[] = ord($binary[$offset + $j]);
+                    }
+                }
+            }
+            $offset += $extLen;
+        }
+
+        // Nettoyage des valeurs GREASE (RFC 8701) pour la conformité JA3
+        $filterGrease = fn(array $arr) => array_values(array_filter($arr, fn($v) => !in_array($v, self::GREASE_VALUES, true)));
+
+        $sslVersion = unpack('n', substr($binary, 9, 2))[1];
+        $ja3String = implode(',', [
+            $sslVersion,
+            implode('-', $filterGrease($ciphers)),
+            implode('-', $filterGrease($extensions)),
+            implode('-', $filterGrease($curves)),
+            implode('-', $filterGrease($points))
+        ]);
+
+        return [
+            'ja3_string' => $ja3String,
+            'ja3_hash'   => md5($ja3String)
+        ];
+    }
+}