@anonympins/fingerprint 0.4.3 → 0.4.5

package/src/php/Utils/RequestUtils.php

@@ -90,6 +90,7 @@ class RequestUtils
             "ch_model" => "sec-ch-ua-model",
             "ch_arch" => "sec-ch-ua-arch",
             "ch_bitness" => "sec-ch-ua-bitness",
+            "ch_full_version_list" => "sec-ch-ua-full-version-list",
             "upgrade_req" => "upgrade-insecure-requests",
             "accept_lang" => "accept-language",
             "accept_enc" => "accept-encoding",
@@ -289,7 +290,105 @@ class RequestUtils
 
         return ['avgSpeed' => $avgSpeed, 'avgAcceleration' => $avgAcceleration, 'straightness' => $straightness, 'pauses' => $pauses, 'segments' => array_column($segments, 'distance')];
     }
+    /**
+     * Analyse une série d'événements tactiles mobiles pour en extraire des indicateurs comportementaux.
+     * @param array|null $history
+     * @return array
+     */
+    private static function analyzeTouchMovements(?array $history): array
+    {
+        if (empty($history) || count($history) < 3) {
+            return [
+                'avgSpeed' => 0.0, 'avgAcceleration' => 0.0, 'straightness' => 1.0, 'pauses' => 0, 'segments' => [],
+                'avgPressure' => 0.0, 'avgRadius' => 0.0, 'pressureVariance' => 0.0, 'radiusVariance' => 0.0, 'maxTouches' => 1
+            ];
+        }
+
+        $segments = [];
+        $totalDistance = 0.0;
+        $pauses = 0;
+        $totalPressure = 0.0;
+        $totalRadius = 0.0;
+        $maxTouches = 1;
+
+        for ($i = 1; $i < count($history); $i++) {
+            $p1 = $history[$i - 1];
+            $p2 = $history[$i];
+            $dx = $p2['x'] - $p1['x'];
+            $dy = $p2['y'] - $p1['y'];
+            $dt = $p2['t'] - $p1['t'];
+            $distance = sqrt($dx * $dx + $dy * $dy);
+
+            $totalPressure += (float)($p2['p'] ?? 0.0);
+            $totalRadius += (float)($p2['r'] ?? 0.0);
+            if (($p2['num'] ?? 1) > $maxTouches) {
+                $maxTouches = (int)$p2['num'];
+            }
+
+            if ($dt > 0) {
+                $speed = $distance / $dt;
+                $segments[] = ['distance' => $distance, 'dt' => $dt, 'speed' => $speed];
+                $totalDistance += $distance;
+            }
+            if ($dt > 100 && $distance < 5) {
+                $pauses++;
+            }
+        }
+
+        $totalPressure += (float)($history[0]['p'] ?? 0.0);
+        $totalRadius += (float)($history[0]['r'] ?? 0.0);
+
+        $avgPressure = $totalPressure / count($history);
+        $avgRadius = $totalRadius / count($history);
+
+        $sqDiffPressureSum = 0.0;
+        $sqDiffRadiusSum = 0.0;
+        foreach ($history as $pt) {
+            $sqDiffPressureSum += pow((float)($pt['p'] ?? 0.0) - $avgPressure, 2);
+            $sqDiffRadiusSum += pow((float)($pt['r'] ?? 0.0) - $avgRadius, 2);
+        }
+        $pressureVariance = $sqDiffPressureSum / count($history);
+        $radiusVariance = $sqDiffRadiusSum / count($history);
+
+        if (count($segments) < 2) {
+            return [
+                'avgSpeed' => 0.0, 'avgAcceleration' => 0.0, 'straightness' => 1.0, 'pauses' => $pauses, 'segments' => [],
+                'avgPressure' => $avgPressure, 'avgRadius' => $avgRadius, 'pressureVariance' => $pressureVariance, 'radiusVariance' => $radiusVariance, 'maxTouches' => $maxTouches
+            ];
+        }
 
+        $totalTime = $history[count($history) - 1]['t'] - $history[0]['t'];
+        $avgSpeed = $totalTime > 0 ? array_sum(array_column($segments, 'speed')) / count($segments) : 0.0;
+
+        $totalAbsAcceleration = 0.0;
+        for ($i = 1; $i < count($segments); $i++) {
+            $s1 = $segments[$i - 1];
+            $s2 = $segments[$i];
+            if ($s2['dt'] > 0) {
+                $acceleration = ($s2['speed'] - $s1['speed']) / $s2['dt'];
+                $totalAbsAcceleration += abs($acceleration);
+            }
+        }
+        $avgAcceleration = $totalAbsAcceleration / (count($segments) - 1);
+
+        $startPoint = $history[0];
+        $endPoint = $history[count($history) - 1];
+        $straightDistance = sqrt(pow($endPoint['x'] - $startPoint['x'], 2) + pow($endPoint['y'] - $startPoint['y'], 2));
+        $straightness = $totalDistance > 0 ? $straightDistance / $totalDistance : 1.0;
+
+        return [
+            'avgSpeed' => $avgSpeed,
+            'avgAcceleration' => $avgAcceleration,
+            'straightness' => $straightness,
+            'pauses' => $pauses,
+            'segments' => array_column($segments, 'distance'),
+            'avgPressure' => $avgPressure,
+            'avgRadius' => $avgRadius,
+            'pressureVariance' => $pressureVariance,
+            'radiusVariance' => $radiusVariance,
+            'maxTouches' => $maxTouches
+        ];
+    }
 
     /**
      * Calcule un score basé sur les métriques comportementales envoyées par le client.
@@ -314,6 +413,7 @@ class RequestUtils
         $score = 0.0;
 
         $mouseAnalysis = self::analyzeMouseMovements($metrics['mouseMovementsHistory'] ?? null);
+        $touch = self::analyzeTouchMovements($metrics['touchMovementsHistory'] ?? null);
 
         if (isset($metrics['historyLength'])) {
             if ($metrics['historyLength'] === 1) $score += 15;
@@ -321,7 +421,7 @@ class RequestUtils
             elseif ($metrics['historyLength'] >= 2) $score -= 10;
         } else {
             // Pénalité pour absence totale d'interaction si l'historique n'est pas dispo
-            if ($mouseAnalysis['avgSpeed'] == 0 && ($metrics['keystrokeLatency'] ?? 0) == 0) {
+            if ($mouseAnalysis['avgSpeed'] == 0 && $touch['avgSpeed'] == 0 && ($metrics['keystrokeLatency'] ?? 0) == 0) {
                 $score += 40;
             }
         }
@@ -343,6 +443,30 @@ class RequestUtils
                 $score += 35;
             }
         }
+        // Analyse comportementale des événements tactiles (Touch Move)
+        $touchHistory = $metrics['touchMovementsHistory'] ?? null;
+        if (!empty($touchHistory)) {
+            if ($touch['avgSpeed'] > 0) {
+                if ($touch['avgSpeed'] > 5) $score += 30;
+                if ($touch['avgAcceleration'] > 0.8) $score += 20;
+                if ($touch['straightness'] > 0.98) $score += 35;
+                if ($touch['pauses'] === 0 && count($touch['segments']) > 25) $score += 15;
+
+                // Détection de l'émulation (pression et rayon de contact constants)
+                if ($touch['avgPressure'] > 0 && $touch['pressureVariance'] == 0) {
+                    $score += 30;
+                }
+                if ($touch['avgRadius'] > 0 && $touch['radiusVariance'] == 0) {
+                    $score += 30;
+                }
+            }
+            if (count($touch['segments']) > 10) {
+                $benfordDev = Optimization::benfordTest($touch['segments']);
+                if ($benfordDev > 0.18) {
+                    $score += 35;
+                }
+            }
+        }
 
         return ['behaviorScore' => min(100.0, $score)];
     }
@@ -444,6 +568,50 @@ class RequestUtils
             return ['clientHintsInconsistencyScore' => 0.0];
         }
 
+        $fullVersionList = $context->getHeader('sec-ch-ua-full-version-list');
+        if (!empty($fullVersionList)) {
+            $chFullVersion = null;
+            $chFullBrowser = null;
+            if (preg_match_all('/"([^"]+)";v="([^"]+)"/', $fullVersionList, $matches, PREG_SET_ORDER)) {
+                foreach ($matches as $match) {
+                    $brand = $match[1];
+                    $version = $match[2];
+                    if ($brand === 'Google Chrome' || $brand === 'Chromium' || $brand === 'Microsoft Edge') {
+                        $chFullVersion = $version;
+                        $chFullBrowser = $brand === 'Microsoft Edge' ? 'Edge' : 'Chrome';
+                        if ($brand === 'Google Chrome' || $brand === 'Microsoft Edge') {
+                            break;
+                        }
+                    }
+                }
+            }
+            if ($chFullVersion && $chFullBrowser) {
+                if (preg_match('/(Chrome|Edg)\/([\d\.]+)/', $ua, $uaFullMatches)) {
+                    $uaBrowserMapped = $uaFullMatches[1] === 'Edg' ? 'Edge' : 'Chrome';
+                    $uaFullVersion = $uaFullMatches[2];
+                    if ($uaBrowserMapped === $chFullBrowser && $uaFullVersion !== $chFullVersion) {
+                        $parts1 = array_map('intval', explode('.', $uaFullVersion));
+                        $parts2 = array_map('intval', explode('.', $chFullVersion));
+                        $diffIndex = -1;
+                        $maxLen = max(count($parts1), count($parts2));
+                        for ($i = 0; $i < $maxLen; $i++) {
+                            $p1 = $parts1[$i] ?? 0;
+                            $p2 = $parts2[$i] ?? 0;
+                            if ($p1 !== $p2) {
+                                $diffIndex = $i;
+                                break;
+                            }
+                        }
+                        $baseScores = [95.0, 90.0, 85.0, 80.0];
+                        $baseScore = $baseScores[$diffIndex] ?? 80.0;
+                        $delta = abs(($parts1[$diffIndex] ?? 0) - ($parts2[$diffIndex] ?? 0));
+                        $finalFullScore = min(100.0, $baseScore + min(5.0, $delta * 5.0));
+                        return ['clientHintsInconsistencyScore' => $finalFullScore];
+                    }
+                }
+            }
+        }
+
         // 1. Extraire la version du navigateur depuis le User-Agent
         $uaVersion = null;
         if (preg_match('/(Chrome|Firefox|Edg|Safari)\/([\d\.]+)/', $ua, $uaMatches)) {
@@ -479,13 +647,19 @@ class RequestUtils
              return ['clientHintsInconsistencyScore' => 90.0];
         }
 
-        if ($versionDifference > 5) { // Un écart de plus de 5 versions majeures est très suspect
-            return ['clientHintsInconsistencyScore' => 80.0];
-        } elseif ($versionDifference > 1) { // Un petit écart est légèrement suspect
-            return ['clientHintsInconsistencyScore' => 40.0];
+        $clientHintsInconsistencyScore = 0.0;
+        if ($versionDifference > 0) {
+            if ($versionDifference <= 2) {
+                $clientHintsInconsistencyScore = $versionDifference * 20.0;
+            } elseif ($versionDifference <= 7) {
+                $clientHintsInconsistencyScore = 40.0 + ($versionDifference - 2) * 8.0;
+            } else {
+                $clientHintsInconsistencyScore = min(100.0, 80.0 + ($versionDifference - 7) * 3.33);
+            }
+            $clientHintsInconsistencyScore = round($clientHintsInconsistencyScore, 1);
         }
 
-        return ['clientHintsInconsistencyScore' => 0.0];
+        return ['clientHintsInconsistencyScore' => $clientHintsInconsistencyScore];
     }
     /**
      * Calcule les indicateurs comportementaux liés à l'historique de l'appareil.
@@ -553,7 +727,7 @@ class RequestUtils
      * @param string $fpString La chaîne d'empreinte complète.
      * @return string La sous-chaîne de l'empreinte contenant uniquement les parties stables.
      */
-    private static function extractStablePart(string $fpString): string
+    public static function extractStablePart(string $fpString): string
     {
         $stableKeys = ['ua', 'ja3', 'ja4', 'h2', 'tcp'];
         $parts = explode('|', $fpString);
@@ -584,6 +758,9 @@ class RequestUtils
         $patternWeight = $patternConfig['patternWeight'] ?? 80;
         $decayFactor = $patternConfig['decayFactor'] ?? 0.95;
         $inactivityReset = $patternConfig['inactivityReset'] ?? 180000;
+        $regularityRatio = $patternConfig['regularityRatio'] ?? 0.4;
+        $benfordRatio = $patternConfig['benfordRatio'] ?? 0.3;
+        $enumerationRatio = $patternConfig['enumerationRatio'] ?? 0.3;
 
         $now = time() * 1000;
         $history = $deviceData['requestHistory'] ?? [];
@@ -606,7 +783,8 @@ class RequestUtils
         }
         $deviceData['requestHistory'] = $history;
 
-        $instantScore = 0;
+        $regularityScore = 0.0;
+        $benfordScore = 0.0;
         $timings = $deviceData['timingHistory'];
 
         // Analyse statistique si nous avons assez de données
@@ -621,18 +799,16 @@ class RequestUtils
             $stdDev = sqrt($variance);
             $benfordDeviation = Optimization::benfordTest($timings);
 
-            // Détection de régularité (bots de type "cron")
             if ($stdDev < $regularityThreshold) {
-                $instantScore = $patternWeight;
+                $regularityScore = 1.0 - ($stdDev / $regularityThreshold);
             }
-            // Détection de distribution non-naturelle (bots "faussement aléatoires")
-            elseif ($benfordDeviation > $benfordThreshold) {
-                $instantScore = $patternWeight;
+            if ($benfordDeviation > $benfordThreshold) {
+                $benfordScore = min(1.0, ($benfordDeviation - $benfordThreshold) / (0.5 - $benfordThreshold));
             }
         }
 
-        // Détection d'énumération de chemins (crawling/scraping de ressources séquentielles)
-        $enumerationScore = 0;
+        // Path enumeration progressif
+        $enumerationScore = 0.0;
         if (count($history) >= 3) {
             $templates = array_map(function($h) {
                 return preg_replace('/\d+/', '{num}', $h['path']);
@@ -646,10 +822,15 @@ class RequestUtils
             $maxTemplateRepetition = !empty($templateCounts) ? max($templateCounts) : 0;
 
             if ($maxTemplateRepetition >= 3 && count($uniquePaths) === count($history)) {
-                $enumerationScore = $patternWeight * 0.8;
+                $enumerationScore = min(1.0, ($maxTemplateRepetition - 2) / 5.0);
             }
         }
 
+        $weightedScore = ($regularityScore * $regularityRatio) +
+                         ($benfordScore * $benfordRatio) +
+                         ($enumerationScore * $enumerationRatio);
+        $instantScore = $weightedScore * $patternWeight;
+
         // Logique de décroissance et de score final
         $newPatternScore = $deviceData['lastPatternScore'] ?? 0;
 
@@ -660,7 +841,7 @@ class RequestUtils
         }
         $newPatternScore = max(0, $newPatternScore);
 
-        $deviceData['lastPatternScore'] = $newPatternScore + $instantScore + $enumerationScore;
+        $deviceData['lastPatternScore'] = max((float)$instantScore, (float)$newPatternScore);
 
         return ['requestPatternScore' => min(100.0, $deviceData['lastPatternScore'])];
     }
@@ -914,14 +1095,18 @@ class RequestUtils
             $subnetData['highScoreDevices'] = [];
         }
 
-        $currentDeviceContributions = $subnetData['highScoreDevices'][$deviceId] ?? 0;
+        // Utilisation de la partie stable du fingerprint matériel plutôt que l'ID de cookie volatil
+        $currentDeviceHash = self::getCompositeDeviceHash($context);
+        $stableFpId = FingerprintBuilder::cyrb53(self::extractStablePart($currentDeviceHash));
+
+        $currentDeviceContributions = $subnetData['highScoreDevices'][$stableFpId] ?? 0;
         if ($currentDeviceContributions < 5 && $finalScore < 95) {
-            $subnetData['highScoreDevices'][$deviceId] = $currentDeviceContributions + 1;
+            $subnetData['highScoreDevices'][$stableFpId] = $currentDeviceContributions + 1;
             $subnetData['highScoreCount']++;
         }
 
-        if (!in_array($deviceId, $subnetData['deviceIds'])) {
-            $subnetData['deviceIds'][] = $deviceId;
+        if (!in_array($stableFpId, $subnetData['deviceIds'], true)) {
+            $subnetData['deviceIds'][] = $stableFpId;
         }
         $subnetData['lastActivity'] = time();
 
@@ -986,6 +1171,56 @@ class RequestUtils
         return ['subnetScore' => min(100.0, $score)];
     }
 
+    /**
+     * Calcule le score d'anomalie de similarité réseau (Botnet Clustering).
+     * @param RequestContext $context
+     * @param string $stableFpHash
+     * @return array{'botnetClusterScore': float}
+     */
+    public static function getBotnetClusterScore(RequestContext $context, string $stableFpHash): array
+    {
+        if (empty($stableFpHash)) {
+            return ['botnetClusterScore' => 0.0];
+        }
+
+        $store = StoreManager::getStore();
+        $key = "botnet-cluster:{$stableFpHash}";
+        $now = time();
+        $tenMinutesAgo = $now - 600;
+
+        $clusterData = $store->get($key) ?? [];
+        if (!is_array($clusterData)) {
+            $clusterData = [];
+        }
+
+        $clusterData = array_filter($clusterData, function ($entry) use ($tenMinutesAgo) {
+            return isset($entry['timestamp']) && $entry['timestamp'] > $tenMinutesAgo;
+        });
+        $clusterData = array_values($clusterData);
+
+        $found = false;
+        foreach ($clusterData as &$entry) {
+            if (isset($entry['ip']) && $entry['ip'] === $context->clientIp) {
+                $entry['timestamp'] = $now;
+                $found = true;
+                break;
+            }
+        }
+        unset($entry);
+
+        if (!$found) {
+            $clusterData[] = ['ip' => $context->clientIp, 'timestamp' => $now];
+        }
+
+        $store->set($key, $clusterData, 600);
+        $uniqueIpsCount = count($clusterData);
+        $botnetClusterScore = 0.0;
+        if ($uniqueIpsCount >= 2) {
+            $botnetClusterScore = min(100.0, round(100.0 * (1.0 - exp(-0.35 * ($uniqueIpsCount - 1))), 1));
+        }
+        return ['botnetClusterScore' => $botnetClusterScore];
+    }
+
     /**
      * Calcule le score de réputation d'une IP en appliquant la décroissance temporelle.
      */
@@ -1130,6 +1365,183 @@ class RequestUtils
         return hash_equals($expectedSignature, $storedSignature);
     }
 
+    /**
+     * Parse une trame TCP SYN brute (IPv4 ou IPv6).
+     */
+    public static function parseTcpSyn(?string $binary): ?array
+    {
+        if (!$binary || strlen($binary) < 40) return null;
+        $ttl = 64;
+        $tcpOffset = 20;
+        $version = ord($binary[0]) >> 4;
+
+        if ($version === 4) {
+            $ttl = ord($binary[8]);
+            $ihl = ord($binary[0]) & 0x0f;
+            $tcpOffset = $ihl * 4;
+        } elseif ($version === 6) {
+            $ttl = ord($binary[7]); // Hop Limit
+            $tcpOffset = 40;
+        } else {
+            $tcpOffset = 0;
+            $ttl = 64;
+        }
+
+        if (strlen($binary) < $tcpOffset + 20) return null;
+
+        $windowSize = (ord($binary[$tcpOffset + 14]) << 8) | ord($binary[$tcpOffset + 15]);
+        $dataOffset = (ord($binary[$tcpOffset + 12]) >> 4) * 4;
+        $optionsEnd = $tcpOffset + $dataOffset;
+
+        $mss = null;
+        $ws = null;
+        $sack = false;
+
+        $i = $tcpOffset + 20;
+        while ($i < $optionsEnd && $i < strlen($binary)) {
+            $optType = ord($binary[$i]);
+            if ($optType === 0) break;
+            if ($optType === 1) {
+                $i++;
+                continue;
+            }
+            if ($i + 1 >= strlen($binary)) break;
+            $optLen = ord($binary[$i + 1]);
+            if ($optLen < 2 || $i + $optLen > strlen($binary)) break;
+
+            if ($optType === 2 && $optLen === 4) {
+                $mss = (ord($binary[$i + 2]) << 8) | ord($binary[$i + 3]);
+            } elseif ($optType === 3 && $optLen === 3) {
+                $ws = ord($binary[$i + 2]);
+            } elseif ($optType === 4 && $optLen === 2) {
+                $sack = true;
+            }
+            $i += $optLen;
+        }
+
+        return ['ttl' => $ttl, 'windowSize' => $windowSize, 'mss' => $mss, 'ws' => $ws, 'sack' => $sack];
+    }
+
+    /**
+     * Classifie l'OS à partir du fingerprint de la pile TCP/IP.
+     */
+    public static function classifyTcpOs(?array $fingerprint): string
+    {
+        if (!$fingerprint) return 'unknown';
+        $ttl = $fingerprint['ttl'] ?? 64;
+        $windowSize = $fingerprint['windowSize'] ?? 0;
+        $ws = $fingerprint['ws'] ?? null;
+
+        if ($ttl > 64 && $ttl <= 128) {
+            return 'Windows';
+        }
+        if ($ttl > 32 && $ttl <= 64) {
+            if ($windowSize === 29200 || $windowSize === 14600 || $windowSize === 5840) {
+                return 'Linux';
+            }
+            return 'Linux';
+        }
+        if ($ttl <= 64) {
+            if ($windowSize === 65535 && ($ws === 6 || $ws === 8 || $ws === 5)) {
+                return 'macOS/iOS';
+            }
+        }
+        if ($ttl > 64) return 'Windows';
+        if ($ttl > 0) return 'Linux';
+        return 'unknown';
+    }
+
+    /**
+     * Détecte les anomalies de pile réseau par rapport au User-Agent.
+     */
+    public static function getTcpAnomalyScore(RequestContext $context): array
+    {
+        $fp = null;
+        $rawTcpBinary = $context->getHeader('x-raw-tcp-binary') ?? $context->headers['x-raw-tcp-binary'] ?? null;
+        if ($rawTcpBinary) {
+            $binary = @hex2bin($rawTcpBinary) ?: $rawTcpBinary;
+            $fp = self::parseTcpSyn($binary);
+        }
+
+        if (!$fp) {
+            $tcpHeader = $context->getHeader('x-tcp-fingerprint') ?? $context->tcpFingerprint ?? null;
+            if ($tcpHeader && is_string($tcpHeader)) {
+                $parts = explode(':', $tcpHeader);
+                if (count($parts) >= 2) {
+                    $fp = [
+                        'ttl' => (int)$parts[0],
+                        'windowSize' => (int)$parts[1],
+                        'mss' => isset($parts[2]) ? (int)$parts[2] : null,
+                        'ws' => isset($parts[3]) ? (int)$parts[3] : null,
+                        'sack' => isset($parts[4]) && ($parts[4] === '1' || $parts[4] === 'true')
+                    ];
+                }
+            }
+        }
+
+        if (!$fp) {
+            return ['tcpAnomalyScore' => 0.0];
+        }
+
+        $tcpOs = self::classifyTcpOs($fp);
+        $ua = $context->getHeader('user-agent') ?? '';
+        $uaParts = self::parseUserAgent($ua);
+        $uaOs = $uaParts['os'] ?? null;
+
+        if (!$uaOs || $tcpOs === 'unknown') {
+            return ['tcpAnomalyScore' => 0.0];
+        }
+
+        $mappedOs = null;
+        if (str_starts_with($uaOs, 'Windows')) {
+            $mappedOs = 'Windows';
+        } elseif (str_starts_with($uaOs, 'Mac') || str_starts_with($uaOs, 'macOS')) {
+            $mappedOs = 'macOS';
+        } elseif (str_starts_with($uaOs, 'iOS')) {
+            $mappedOs = 'iOS';
+        } elseif (str_starts_with($uaOs, 'Linux')) {
+            $mappedOs = 'Linux';
+        }
+
+        if ($mappedOs === null) {
+            return ['tcpAnomalyScore' => 0.0];
+        }
+
+        $osExpectedTcp = [
+            'Windows' => ['ttl' => 128, 'windowSize' => 64240, 'ws' => 8, 'mss' => 1460, 'sack' => true],
+            'Linux' => ['ttl' => 64, 'windowSize' => 29200, 'ws' => 7, 'mss' => 1460, 'sack' => true],
+            'macOS' => ['ttl' => 64, 'windowSize' => 65535, 'ws' => 6, 'mss' => 1460, 'sack' => true],
+            'iOS' => ['ttl' => 64, 'windowSize' => 65535, 'ws' => 6, 'mss' => 1460, 'sack' => true]
+        ];
+
+        $expected = $osExpectedTcp[$mappedOs];
+        $ttlDiff = abs($fp['ttl'] - $expected['ttl']) / $expected['ttl'];
+        $winDiff = abs($fp['windowSize'] - $expected['windowSize']) / $expected['windowSize'];
+        $wsDiff = $expected['ws'] !== null && ($fp['ws'] ?? null) !== null ? abs($fp['ws'] - $expected['ws']) / $expected['ws'] : 0.0;
+        $mssDiff = $expected['mss'] !== null && ($fp['mss'] ?? null) !== null ? abs($fp['mss'] - $expected['mss']) / $expected['mss'] : 0.0;
+        $sackDiff = ($fp['sack'] ?? true) === ($expected['sack'] ?? true) ? 0.0 : 1.0;
+
+        $deviation = (
+            min(1.0, $ttlDiff) * 0.50 +
+            min(1.0, $winDiff) * 0.25 +
+            min(1.0, $wsDiff) * 0.15 +
+            min(1.0, $mssDiff) * 0.05 +
+            $sackDiff * 0.05
+        );
+
+        $tcpAnomalyScore = 0.0;
+        if ($tcpOs !== $mappedOs && $tcpOs !== 'unknown') {
+            $baseAnomaly = $mappedOs === 'Windows' ? 80.0 :
+                (($mappedOs === 'macOS' || $mappedOs === 'iOS') ? 85.0 : 75.0);
+            $tcpAnomalyScore = $baseAnomaly + ($deviation - 0.4) * 10.0;
+        } else {
+            $tcpAnomalyScore = $deviation * 40.0;
+        }
+
+        $tcpAnomalyScore = max(0.0, min(100.0, round($tcpAnomalyScore, 1)));
+        return ['tcpAnomalyScore' => $tcpAnomalyScore];
+    }
+
     /**
      * Vérifie si un ticket de clearance (PoW) est valide, en supportant la tolérance au roaming.
      *
@@ -1146,6 +1558,47 @@ class RequestUtils
             return false;
         }
 
+        if (str_contains($ticket, '.')) {
+            $parts = explode('.', $ticket);
+            if (count($parts) === 3) {
+                $base64UrlDecode = function ($input) {
+                    return base64_decode(strtr($input, '-_', '+/'));
+                };
+                $iv = $base64UrlDecode($parts[0]);
+                $encrypted = $base64UrlDecode($parts[1]);
+                $signature = $base64UrlDecode($parts[2]);
+                if ($iv && $encrypted && $signature && strlen($iv) === 16) {
+                    $key = hash('sha256', $secret ?: "fallback-dev-secret-32-chars-minimum", true);
+                    $expectedSignature = hash_hmac('sha256', $iv . $encrypted, $key, true);
+                    if (hash_equals($expectedSignature, $signature)) {
+                        $decrypted = openssl_decrypt($encrypted, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
+                        if ($decrypted !== false) {
+                            $ticketData = json_decode($decrypted, true);
+                            if ($ticketData) {
+                                $expiry = $ticketData['expiry'] ?? null;
+                                $originalIp = $ticketData['originalIp'] ?? null;
+                                $storedDeviceId = $ticketData['deviceId'] ?? '';
+                                $storedDeviceHash = $ticketData['deviceHash'] ?? '';
+                                if (!$expiry || (time() * 1000) > (int)$expiry) {
+                                    return false;
+                                }
+                                if ($ip === $originalIp) {
+                                    return true;
+                                }
+                                $currentSubnet = self::getIpSubnet($ip);
+                                $originalSubnet = self::getIpSubnet($originalIp);
+                                if ($currentSubnet !== null && $originalSubnet !== null && $currentSubnet === $originalSubnet) {
+                                    return true;
+                                }
+                                return !empty($deviceId) && $deviceId === $storedDeviceId && !empty($deviceHash) && $deviceHash === $storedDeviceHash;
+                            }
+                        }
+                    }
+                }
+            }
+            return false;
+        }
+
         if (str_contains($ticket, '|')) {
             $parts = explode('|', $ticket);
             if (count($parts) < 3) return false;