@anonympins/fingerprint 0.4.3 → 0.4.4

package/src/php/Store/RedisStore.php

@@ -1,54 +1,54 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Store;
-
-/**
- * Adaptateur de stockage Redis pour le moteur Fingerprint.
- * Compatible avec phpredis et predis.
- */
-class RedisStore implements IStore
-{
-    /**
-     * @var mixed Une instance de \Redis ou de \Predis\Client
-     */
-    private $redis;
-
-    /**
-     * @param mixed $redis Client Redis déjà configuré et connecté
-     */
-    public function __construct($redis)
-    {
-        $this->redis = $redis;
-    }
-
-    public function get(string $key)
-    {
-        $value = $this->redis->get($key);
-        if ($value === false || $value === null) {
-            return null;
-        }
-        return json_decode($value, true);
-    }
-
-    public function set(string $key, $value, ?int $ttl = null): void
-    {
-        $stringValue = json_encode($value);
-        if ($ttl !== null && $ttl > 0) {
-            $this->redis->setex($key, $ttl, $stringValue);
-        } else {
-            $this->redis->set($key, $stringValue);
-        }
-    }
-
-    public function has(string $key): bool
-    {
-        return (bool)$this->redis->exists($key);
-    }
-
-    public function delete(string $key): void
-    {
-        $this->redis->del($key);
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Store;
+
+/**
+ * Adaptateur de stockage Redis pour le moteur Fingerprint.
+ * Compatible avec phpredis et predis.
+ */
+class RedisStore implements IStore
+{
+    /**
+     * @var mixed Une instance de \Redis ou de \Predis\Client
+     */
+    private $redis;
+
+    /**
+     * @param mixed $redis Client Redis déjà configuré et connecté
+     */
+    public function __construct($redis)
+    {
+        $this->redis = $redis;
+    }
+
+    public function get(string $key)
+    {
+        $value = $this->redis->get($key);
+        if ($value === false || $value === null) {
+            return null;
+        }
+        return json_decode($value, true);
+    }
+
+    public function set(string $key, $value, ?int $ttl = null): void
+    {
+        $stringValue = json_encode($value);
+        if ($ttl !== null && $ttl > 0) {
+            $this->redis->setex($key, $ttl, $stringValue);
+        } else {
+            $this->redis->set($key, $stringValue);
+        }
+    }
+
+    public function has(string $key): bool
+    {
+        return (bool)$this->redis->exists($key);
+    }
+
+    public function delete(string $key): void
+    {
+        $this->redis->del($key);
+    }
 }

package/src/php/Tests/RequestUtilsTest.php

@@ -11,6 +11,12 @@ use PHPUnit\Framework\TestCase;
 
 class RequestUtilsTest extends TestCase
 {
+    protected function setUp(): void
+    {
+        parent::setUp();
+        \Anonympins\Fingerprint\Store\StoreManager::configureStore(new \Anonympins\Fingerprint\Store\InMemoryStore());
+    }
+
     private function createRequestContext(array $overrides = []): RequestContext
     {
         $defaults = [
@@ -166,6 +172,42 @@ class RequestUtilsTest extends TestCase
         $this->assertEquals(40.0, $scoreNoActivity['behaviorScore']);
     }
 
+    public function testGetBehaviorScoreWithBotLikeTouchMovements(): void
+    {
+        $metrics = [
+            'honeypotInteraction' => false,
+            'touchMovementsHistory' => [
+                ['x' => 50, 'y' => 50, 't' => 1, 'p' => 0.5, 'r' => 10, 'num' => 1],
+                ['x' => 55, 'y' => 55, 't' => 100, 'p' => 0.5, 'r' => 10, 'num' => 1],
+                ['x' => 60, 'y' => 60, 't' => 200, 'p' => 0.5, 'r' => 10, 'num' => 1],
+                ['x' => 65, 'y' => 65, 't' => 300, 'p' => 0.5, 'r' => 10, 'num' => 1]
+            ]
+        ];
+        $context = $this->createRequestContext([
+            'headers' => ['x-behavior-metrics' => json_encode($metrics)]
+        ]);
+        $score = RequestUtils::getBehaviorScore($context);
+        $this->assertGreaterThan(60.0, $score['behaviorScore']);
+    }
+
+    public function testGetBehaviorScoreWithHumanLikeTouchMovements(): void
+    {
+        $metrics = [
+            'honeypotInteraction' => false,
+            'touchMovementsHistory' => [
+                ['x' => 50, 'y' => 50, 't' => 1, 'p' => 0.45, 'r' => 8.5, 'num' => 1],
+                ['x' => 60, 'y' => 52, 't' => 100, 'p' => 0.52, 'r' => 9.1, 'num' => 1],
+                ['x' => 72, 'y' => 60, 't' => 200, 'p' => 0.49, 'r' => 8.8, 'num' => 1],
+                ['x' => 80, 'y' => 80, 't' => 300, 'p' => 0.41, 'r' => 8.2, 'num' => 1]
+            ]
+        ];
+        $context = $this->createRequestContext([
+            'headers' => ['x-behavior-metrics' => json_encode($metrics)]
+        ]);
+        $score = RequestUtils::getBehaviorScore($context);
+        $this->assertLessThan(30.0, $score['behaviorScore']);
+    }
+
     public function testGetTimeInconsistencyScore(): void
     {
         $requestTimestamp = time() * 1000;
@@ -254,4 +296,92 @@ class RequestUtilsTest extends TestCase
         $this->assertEquals(2, $deviceData['rapidChangeCount']);
         $this->assertGreaterThan(0, $indicators['rotationScore']);
     }
+
+    public function testGetRequestPatternScoreWeightedSubscores(): void
+    {
+        $context = $this->createRequestContext(['path' => '/search']);
+        $deviceData = [
+            'requestHistory' => [],
+            'timingHistory' => [100, 100, 100, 100, 100, 100], // stdDev = 0
+            'lastPatternScore' => 0.0
+        ];
+        $patternConfig = [
+            'minSamples' => 5,
+            'regularityThreshold' => 50,
+            'benfordThreshold' => 0.15,
+            'patternWeight' => 80,
+            'decayFactor' => 0.9,
+            'inactivityReset' => 5000,
+            'regularityRatio' => 0.4,
+            'benfordRatio' => 0.3,
+            'enumerationRatio' => 0.3
+        ];
+
+        $result = RequestUtils::getRequestPatternScore($context, $deviceData, $patternConfig);
+        // regularityScore = 1.0. regularityRatio = 0.4.
+        // instantScore = 1.0 * 0.4 * 80 = 32.
+        $this->assertEquals(32.0, $result['requestPatternScore']);
+    }
+
+    public function testGetBotnetClusterScoreCalculations(): void
+    {
+        $stableFpHash = 'test-stable-hash';
+
+        $context1 = $this->createRequestContext(['clientIp' => '192.168.1.1']);
+        $score = RequestUtils::getBotnetClusterScore($context1, $stableFpHash);
+        $this->assertEquals(0.0, $score['botnetClusterScore']);
+
+        RequestUtils::getBotnetClusterScore($this->createRequestContext(['clientIp' => '192.168.1.2']), $stableFpHash);
+        $score = RequestUtils::getBotnetClusterScore($this->createRequestContext(['clientIp' => '192.168.1.3']), $stableFpHash);
+        $this->assertEquals(50.3, $score['botnetClusterScore']);
+
+        RequestUtils::getBotnetClusterScore($this->createRequestContext(['clientIp' => '192.168.1.4']), $stableFpHash);
+        $score = RequestUtils::getBotnetClusterScore($this->createRequestContext(['clientIp' => '192.168.1.5']), $stableFpHash);
+        $this->assertEquals(75.3, $score['botnetClusterScore']);
+
+        for ($i = 6; $i <= 10; $i++) {
+            $score = RequestUtils::getBotnetClusterScore($this->createRequestContext(['clientIp' => "192.168.1.{$i}"]), $stableFpHash);
+        }
+        $this->assertEquals(95.7, $score['botnetClusterScore']);
+    }
+
+    public function testRealWorldConsoleBotnetClustering(): void
+    {
+        $ps4Headers = [
+            'user-agent' => 'Mozilla/5.0 (PlayStation 4 11.50) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.50 Safari/605.1.15',
+            'x-ja3-hash' => '76993ef93bf89104037599723ab9f201',
+            'x-ja4-hash' => 't13d1516h2_8daaf6152771_390237aa04be',
+            'x-http2-fingerprint' => '1:65536;3:1000;4:6291456;6:65536',
+            'x-tcp-fingerprint' => '64240:128:1:mss,nop,ws,nop,nop,sok:df:0'
+        ];
+
+        for ($i = 1; $i <= 10; $i++) {
+            $context = $this->createRequestContext([
+                'clientIp' => "185.15.20.{$i}",
+                'headers' => array_merge($ps4Headers, [
+                    'cookie_keys' => "session_id=fake_sess_{$i}"
+                ])
+            ]);
+
+            $currentHash = RequestUtils::getCompositeDeviceHash($context);
+            $stableFp = RequestUtils::extractStablePart($currentHash);
+            $stableFpHash = FingerprintBuilder::cyrb53($stableFp);
+            
+            $score = RequestUtils::getBotnetClusterScore($context, $stableFpHash);
+
+            if ($i === 1) {
+                $this->assertEquals(0.0, $score['botnetClusterScore']);
+            } elseif ($i === 2) {
+                $this->assertEquals(29.5, $score['botnetClusterScore']);
+            } elseif ($i === 3) {
+                $this->assertEquals(50.3, $score['botnetClusterScore']);
+            } elseif ($i === 4) {
+                $this->assertEquals(65.0, $score['botnetClusterScore']);
+            } elseif ($i === 5) {
+                $this->assertEquals(75.3, $score['botnetClusterScore']);
+            } elseif ($i === 10) {
+                $this->assertEquals(95.7, $score['botnetClusterScore']);
+            }
+        }
+    }
 }

package/src/php/Utils/RequestUtils.php

@@ -289,7 +289,105 @@ class RequestUtils
 
         return ['avgSpeed' => $avgSpeed, 'avgAcceleration' => $avgAcceleration, 'straightness' => $straightness, 'pauses' => $pauses, 'segments' => array_column($segments, 'distance')];
     }
+    /**
+     * Analyse une série d'événements tactiles mobiles pour en extraire des indicateurs comportementaux.
+     * @param array|null $history
+     * @return array
+     */
+    private static function analyzeTouchMovements(?array $history): array
+    {
+        if (empty($history) || count($history) < 3) {
+            return [
+                'avgSpeed' => 0.0, 'avgAcceleration' => 0.0, 'straightness' => 1.0, 'pauses' => 0, 'segments' => [],
+                'avgPressure' => 0.0, 'avgRadius' => 0.0, 'pressureVariance' => 0.0, 'radiusVariance' => 0.0, 'maxTouches' => 1
+            ];
+        }
+
+        $segments = [];
+        $totalDistance = 0.0;
+        $pauses = 0;
+        $totalPressure = 0.0;
+        $totalRadius = 0.0;
+        $maxTouches = 1;
+
+        for ($i = 1; $i < count($history); $i++) {
+            $p1 = $history[$i - 1];
+            $p2 = $history[$i];
+            $dx = $p2['x'] - $p1['x'];
+            $dy = $p2['y'] - $p1['y'];
+            $dt = $p2['t'] - $p1['t'];
+            $distance = sqrt($dx * $dx + $dy * $dy);
+
+            $totalPressure += (float)($p2['p'] ?? 0.0);
+            $totalRadius += (float)($p2['r'] ?? 0.0);
+            if (($p2['num'] ?? 1) > $maxTouches) {
+                $maxTouches = (int)$p2['num'];
+            }
+
+            if ($dt > 0) {
+                $speed = $distance / $dt;
+                $segments[] = ['distance' => $distance, 'dt' => $dt, 'speed' => $speed];
+                $totalDistance += $distance;
+            }
+            if ($dt > 100 && $distance < 5) {
+                $pauses++;
+            }
+        }
+
+        $totalPressure += (float)($history[0]['p'] ?? 0.0);
+        $totalRadius += (float)($history[0]['r'] ?? 0.0);
+
+        $avgPressure = $totalPressure / count($history);
+        $avgRadius = $totalRadius / count($history);
+
+        $sqDiffPressureSum = 0.0;
+        $sqDiffRadiusSum = 0.0;
+        foreach ($history as $pt) {
+            $sqDiffPressureSum += pow((float)($pt['p'] ?? 0.0) - $avgPressure, 2);
+            $sqDiffRadiusSum += pow((float)($pt['r'] ?? 0.0) - $avgRadius, 2);
+        }
+        $pressureVariance = $sqDiffPressureSum / count($history);
+        $radiusVariance = $sqDiffRadiusSum / count($history);
+
+        if (count($segments) < 2) {
+            return [
+                'avgSpeed' => 0.0, 'avgAcceleration' => 0.0, 'straightness' => 1.0, 'pauses' => $pauses, 'segments' => [],
+                'avgPressure' => $avgPressure, 'avgRadius' => $avgRadius, 'pressureVariance' => $pressureVariance, 'radiusVariance' => $radiusVariance, 'maxTouches' => $maxTouches
+            ];
+        }
+
+        $totalTime = $history[count($history) - 1]['t'] - $history[0]['t'];
+        $avgSpeed = $totalTime > 0 ? array_sum(array_column($segments, 'speed')) / count($segments) : 0.0;
+
+        $totalAbsAcceleration = 0.0;
+        for ($i = 1; $i < count($segments); $i++) {
+            $s1 = $segments[$i - 1];
+            $s2 = $segments[$i];
+            if ($s2['dt'] > 0) {
+                $acceleration = ($s2['speed'] - $s1['speed']) / $s2['dt'];
+                $totalAbsAcceleration += abs($acceleration);
+            }
+        }
+        $avgAcceleration = $totalAbsAcceleration / (count($segments) - 1);
 
+        $startPoint = $history[0];
+        $endPoint = $history[count($history) - 1];
+        $straightDistance = sqrt(pow($endPoint['x'] - $startPoint['x'], 2) + pow($endPoint['y'] - $startPoint['y'], 2));
+        $straightness = $totalDistance > 0 ? $straightDistance / $totalDistance : 1.0;
+
+        return [
+            'avgSpeed' => $avgSpeed,
+            'avgAcceleration' => $avgAcceleration,
+            'straightness' => $straightness,
+            'pauses' => $pauses,
+            'segments' => array_column($segments, 'distance'),
+            'avgPressure' => $avgPressure,
+            'avgRadius' => $avgRadius,
+            'pressureVariance' => $pressureVariance,
+            'radiusVariance' => $radiusVariance,
+            'maxTouches' => $maxTouches
+        ];
+    }
 
     /**
      * Calcule un score basé sur les métriques comportementales envoyées par le client.
@@ -314,6 +412,7 @@ class RequestUtils
         $score = 0.0;
 
         $mouseAnalysis = self::analyzeMouseMovements($metrics['mouseMovementsHistory'] ?? null);
+        $touch = self::analyzeTouchMovements($metrics['touchMovementsHistory'] ?? null);
 
         if (isset($metrics['historyLength'])) {
             if ($metrics['historyLength'] === 1) $score += 15;
@@ -321,7 +420,7 @@ class RequestUtils
             elseif ($metrics['historyLength'] >= 2) $score -= 10;
         } else {
             // Pénalité pour absence totale d'interaction si l'historique n'est pas dispo
-            if ($mouseAnalysis['avgSpeed'] == 0 && ($metrics['keystrokeLatency'] ?? 0) == 0) {
+            if ($mouseAnalysis['avgSpeed'] == 0 && $touch['avgSpeed'] == 0 && ($metrics['keystrokeLatency'] ?? 0) == 0) {
                 $score += 40;
             }
         }
@@ -343,6 +442,30 @@ class RequestUtils
                 $score += 35;
             }
         }
+        // Analyse comportementale des événements tactiles (Touch Move)
+        $touchHistory = $metrics['touchMovementsHistory'] ?? null;
+        if (!empty($touchHistory)) {
+            if ($touch['avgSpeed'] > 0) {
+                if ($touch['avgSpeed'] > 5) $score += 30;
+                if ($touch['avgAcceleration'] > 0.8) $score += 20;
+                if ($touch['straightness'] > 0.98) $score += 35;
+                if ($touch['pauses'] === 0 && count($touch['segments']) > 25) $score += 15;
+
+                // Détection de l'émulation (pression et rayon de contact constants)
+                if ($touch['avgPressure'] > 0 && $touch['pressureVariance'] == 0) {
+                    $score += 30;
+                }
+                if ($touch['avgRadius'] > 0 && $touch['radiusVariance'] == 0) {
+                    $score += 30;
+                }
+            }
+            if (count($touch['segments']) > 10) {
+                $benfordDev = Optimization::benfordTest($touch['segments']);
+                if ($benfordDev > 0.18) {
+                    $score += 35;
+                }
+            }
+        }
 
         return ['behaviorScore' => min(100.0, $score)];
     }
@@ -553,7 +676,7 @@ class RequestUtils
      * @param string $fpString La chaîne d'empreinte complète.
      * @return string La sous-chaîne de l'empreinte contenant uniquement les parties stables.
      */
-    private static function extractStablePart(string $fpString): string
+    public static function extractStablePart(string $fpString): string
     {
         $stableKeys = ['ua', 'ja3', 'ja4', 'h2', 'tcp'];
         $parts = explode('|', $fpString);
@@ -584,6 +707,9 @@ class RequestUtils
         $patternWeight = $patternConfig['patternWeight'] ?? 80;
         $decayFactor = $patternConfig['decayFactor'] ?? 0.95;
         $inactivityReset = $patternConfig['inactivityReset'] ?? 180000;
+        $regularityRatio = $patternConfig['regularityRatio'] ?? 0.4;
+        $benfordRatio = $patternConfig['benfordRatio'] ?? 0.3;
+        $enumerationRatio = $patternConfig['enumerationRatio'] ?? 0.3;
 
         $now = time() * 1000;
         $history = $deviceData['requestHistory'] ?? [];
@@ -606,7 +732,8 @@ class RequestUtils
         }
         $deviceData['requestHistory'] = $history;
 
-        $instantScore = 0;
+        $regularityScore = 0.0;
+        $benfordScore = 0.0;
         $timings = $deviceData['timingHistory'];
 
         // Analyse statistique si nous avons assez de données
@@ -621,18 +748,16 @@ class RequestUtils
             $stdDev = sqrt($variance);
             $benfordDeviation = Optimization::benfordTest($timings);
 
-            // Détection de régularité (bots de type "cron")
             if ($stdDev < $regularityThreshold) {
-                $instantScore = $patternWeight;
+                $regularityScore = 1.0 - ($stdDev / $regularityThreshold);
             }
-            // Détection de distribution non-naturelle (bots "faussement aléatoires")
-            elseif ($benfordDeviation > $benfordThreshold) {
-                $instantScore = $patternWeight;
+            if ($benfordDeviation > $benfordThreshold) {
+                $benfordScore = min(1.0, ($benfordDeviation - $benfordThreshold) / (0.5 - $benfordThreshold));
             }
         }
 
-        // Détection d'énumération de chemins (crawling/scraping de ressources séquentielles)
-        $enumerationScore = 0;
+        // Path enumeration progressif
+        $enumerationScore = 0.0;
         if (count($history) >= 3) {
             $templates = array_map(function($h) {
                 return preg_replace('/\d+/', '{num}', $h['path']);
@@ -646,10 +771,15 @@ class RequestUtils
             $maxTemplateRepetition = !empty($templateCounts) ? max($templateCounts) : 0;
 
             if ($maxTemplateRepetition >= 3 && count($uniquePaths) === count($history)) {
-                $enumerationScore = $patternWeight * 0.8;
+                $enumerationScore = min(1.0, ($maxTemplateRepetition - 2) / 5.0);
             }
         }
 
+        $weightedScore = ($regularityScore * $regularityRatio) +
+                         ($benfordScore * $benfordRatio) +
+                         ($enumerationScore * $enumerationRatio);
+        $instantScore = $weightedScore * $patternWeight;
+
         // Logique de décroissance et de score final
         $newPatternScore = $deviceData['lastPatternScore'] ?? 0;
 
@@ -660,7 +790,7 @@ class RequestUtils
         }
         $newPatternScore = max(0, $newPatternScore);
 
-        $deviceData['lastPatternScore'] = $newPatternScore + $instantScore + $enumerationScore;
+        $deviceData['lastPatternScore'] = max((float)$instantScore, (float)$newPatternScore);
 
         return ['requestPatternScore' => min(100.0, $deviceData['lastPatternScore'])];
     }
@@ -914,14 +1044,18 @@ class RequestUtils
             $subnetData['highScoreDevices'] = [];
         }
 
-        $currentDeviceContributions = $subnetData['highScoreDevices'][$deviceId] ?? 0;
+        // Utilisation de la partie stable du fingerprint matériel plutôt que l'ID de cookie volatil
+        $currentDeviceHash = self::getCompositeDeviceHash($context);
+        $stableFpId = FingerprintBuilder::cyrb53(self::extractStablePart($currentDeviceHash));
+
+        $currentDeviceContributions = $subnetData['highScoreDevices'][$stableFpId] ?? 0;
         if ($currentDeviceContributions < 5 && $finalScore < 95) {
-            $subnetData['highScoreDevices'][$deviceId] = $currentDeviceContributions + 1;
+            $subnetData['highScoreDevices'][$stableFpId] = $currentDeviceContributions + 1;
             $subnetData['highScoreCount']++;
         }
 
-        if (!in_array($deviceId, $subnetData['deviceIds'])) {
-            $subnetData['deviceIds'][] = $deviceId;
+        if (!in_array($stableFpId, $subnetData['deviceIds'], true)) {
+            $subnetData['deviceIds'][] = $stableFpId;
         }
         $subnetData['lastActivity'] = time();
 
@@ -986,6 +1120,56 @@ class RequestUtils
         return ['subnetScore' => min(100.0, $score)];
     }
 
+    /**
+     * Calcule le score d'anomalie de similarité réseau (Botnet Clustering).
+     * @param RequestContext $context
+     * @param string $stableFpHash
+     * @return array{'botnetClusterScore': float}
+     */
+    public static function getBotnetClusterScore(RequestContext $context, string $stableFpHash): array
+    {
+        if (empty($stableFpHash)) {
+            return ['botnetClusterScore' => 0.0];
+        }
+
+        $store = StoreManager::getStore();
+        $key = "botnet-cluster:{$stableFpHash}";
+        $now = time();
+        $tenMinutesAgo = $now - 600;
+
+        $clusterData = $store->get($key) ?? [];
+        if (!is_array($clusterData)) {
+            $clusterData = [];
+        }
+
+        $clusterData = array_filter($clusterData, function ($entry) use ($tenMinutesAgo) {
+            return isset($entry['timestamp']) && $entry['timestamp'] > $tenMinutesAgo;
+        });
+        $clusterData = array_values($clusterData);
+
+        $found = false;
+        foreach ($clusterData as &$entry) {
+            if (isset($entry['ip']) && $entry['ip'] === $context->clientIp) {
+                $entry['timestamp'] = $now;
+                $found = true;
+                break;
+            }
+        }
+        unset($entry);
+
+        if (!$found) {
+            $clusterData[] = ['ip' => $context->clientIp, 'timestamp' => $now];
+        }
+
+        $store->set($key, $clusterData, 600);
+        $uniqueIpsCount = count($clusterData);
+        $botnetClusterScore = 0.0;
+        if ($uniqueIpsCount >= 2) {
+            $botnetClusterScore = min(100.0, round(100.0 * (1.0 - exp(-0.35 * ($uniqueIpsCount - 1))), 1));
+        }
+        return ['botnetClusterScore' => $botnetClusterScore];
+    }
+
     /**
      * Calcule le score de réputation d'une IP en appliquant la décroissance temporelle.
      */