@anonympins/fingerprint 0.4.3 → 0.4.5

package/src/js/fingerprint.js

@@ -4,6 +4,7 @@ import * as dns from "node:dns/promises";
 import {getProblemManager, problemManager} from "./problem-manager.js";
 import {Optimization} from "./library.js";
 import {cyrb53, FingerprintBuilder} from "./fingerprint.builder.js";
+import {DynamicWasmGenerator} from "./dynamic-wasm.js";
 import {readFileSync, existsSync} from "node:fs";
 import {fileURLToPath} from "node:url";
 import {dirname, join, resolve} from "node:path";
@@ -15,6 +16,87 @@ export { createRedisStore } from "./redis-store.js";
 export { createMongoDbStore } from "./mongodb-store.js";
 
 
+const base64UrlEncode = (buf) => buf.toString('base64').replace(/\+/g, '-').replace(/\//g, '_').replace(/=/g, '');
+const base64UrlDecode = (str) => {
+  let base64 = str.replace(/-/g, '+').replace(/_/g, '/');
+  while (base64.length % 4) {
+    base64 += '=';
+  }
+  return Buffer.from(base64, 'base64');
+};
+
+export function generateStatelessTicket(payload) {
+  const secret = getPowSecret();
+  const key = crypto.createHash('sha256').update(secret).digest();
+  const iv = crypto.randomBytes(16);
+  const cipher = crypto.createCipheriv('aes-256-cbc', key, iv);
+  let encrypted = cipher.update(JSON.stringify(payload));
+  encrypted = Buffer.concat([encrypted, cipher.final()]);
+  
+  const signature = crypto.createHmac('sha256', key).update(Buffer.concat([iv, encrypted])).digest();
+  return `${base64UrlEncode(iv)}.${base64UrlEncode(encrypted)}.${base64UrlEncode(signature)}`;
+}
+
+export function parseStatelessTicket(ticket) {
+  try {
+    const parts = ticket.split('.');
+    if (parts.length !== 3) return null;
+    
+    const iv = base64UrlDecode(parts[0]);
+    const encrypted = base64UrlDecode(parts[1]);
+    const signature = base64UrlDecode(parts[2]);
+    
+    if (iv.length !== 16) return null;
+    
+    const secret = getPowSecret();
+    const key = crypto.createHash('sha256').update(secret).digest();
+    
+    const expectedSignature = crypto.createHmac('sha256', key).update(Buffer.concat([iv, encrypted])).digest();
+    if (signature.length !== expectedSignature.length || !crypto.timingSafeEqual(signature, expectedSignature)) {
+      return null;
+    }
+    
+    const decipher = crypto.createDecipheriv('aes-256-cbc', key, iv);
+    let decrypted = decipher.update(encrypted);
+    decrypted = Buffer.concat([decrypted, decipher.final()]);
+    
+    return JSON.parse(decrypted.toString('utf8'));
+  } catch (e) {
+    return null;
+  }
+}
+
+/**
+ * Vérifie le limiteur de débit Token Bucket pour les demandes de challenge d'un sous-réseau.
+ * @param {string} clientIp - L'adresse IP du client.
+ * @returns {Promise<boolean>} True si la requête est autorisée, false si elle est limitée.
+ */
+async function checkChallengeRateLimit(clientIp) {
+  const subnet = getIpSubnet(clientIp);
+  if (!subnet) return false;
+
+  const key = `rate-limit:${subnet}`;
+  const rateLimitData = (await store.get(key)) || {
+    tokens: 5.0,
+    lastRefill: Date.now() / 1000
+  };
+
+  const capacity = 5.0;
+  const refillRate = 0.1; // 1 token toutes les 10 secondes
+  const now = Date.now() / 1000;
+
+  const elapsed = now - rateLimitData.lastRefill;
+  const tokens = Math.min(capacity, rateLimitData.tokens + elapsed * refillRate);
+
+  if (tokens < 1.0) {
+    await store.set(key, { tokens, lastRefill: now }, 60);
+    return false;
+  }
+
+  await store.set(key, { tokens: tokens - 1.0, lastRefill: now }, 60);
+  return true;
+}
+
 /**
  * @private
  * Deep merges two objects. The `source` object's properties overwrite the `target`'s.
@@ -54,7 +136,8 @@ const securityProfiles = {
             timeInconsistencyScore: 0.9,
             tlsSpoofingScore: 0.8, // NOUVEAU: Poids pour la détection de spoofing TLS
             subnetScore: 0.4, // NOUVEAU: Poids pour la réputation du sous-réseau
-            ipReputationScore: 0.5 // NOUVEAU: Poids pour la réputation IP
+            ipReputationScore: 0.5, // NOUVEAU: Poids pour la réputation IP
+            botnetClusterScore: 0.6 // NOUVEAU: Poids pour le clustering botnet
         },
         thresholds: { low: 20, medium: 45, high: 75, block: 95 },
         patterns: {
@@ -89,7 +172,8 @@ const securityProfiles = {
             timeInconsistencyScore: 1.0,
             tlsSpoofingScore: 1.0, // Plus agressif pour le spoofing TLS
             subnetScore: 0.5,
-            ipReputationScore: 0.6 // NOUVEAU: Poids pour la réputation IP
+            ipReputationScore: 0.6, // NOUVEAU: Poids pour la réputation IP
+            botnetClusterScore: 0.8 // NOUVEAU: Poids pour le clustering botnet
         },
         thresholds: { low: 10, medium: 35, high: 65, block: 90 },
         patterns: {
@@ -125,7 +209,8 @@ const securityProfiles = {
             timeInconsistencyScore: 0.8,
             tlsSpoofingScore: 0.7, // Important pour les API
             subnetScore: 0.4,
-            ipReputationScore: 0.5 // NOUVEAU: Poids pour la réputation IP
+            ipReputationScore: 0.5, // NOUVEAU: Poids pour la réputation IP
+            botnetClusterScore: 0.7 // NOUVEAU: Poids pour le clustering botnet
         },
         thresholds: { low: 25, medium: 50, high: 80, block: 95 },
         patterns: {
@@ -162,7 +247,8 @@ const securityProfiles = {
             timeInconsistencyScore: 0.8,
             tlsSpoofingScore: 0.6, // Moins critique pour les blogs
             subnetScore: 0.2,
-            ipReputationScore: 0.3 // NOUVEAU: Poids pour la réputation IP
+            ipReputationScore: 0.3, // NOUVEAU: Poids pour la réputation IP
+            botnetClusterScore: 0.5 // NOUVEAU: Poids pour le clustering botnet
         },
         thresholds: { low: 25, medium: 55, high: 80, block: 95 },
         patterns: {
@@ -198,7 +284,8 @@ const securityProfiles = {
             timeInconsistencyScore: 0.9,
             tlsSpoofingScore: 0.9, // Très important pour l'e-commerce
             subnetScore: 0.5,
-            ipReputationScore: 0.6 // NOUVEAU: Poids pour la réputation IP
+            ipReputationScore: 0.6, // NOUVEAU: Poids pour la réputation IP
+            botnetClusterScore: 0.9 // NOUVEAU: Poids pour le clustering botnet
         },
         thresholds: { low: 15, medium: 40, high: 70, block: 90 },
         patterns: {
@@ -319,12 +406,12 @@ function getTlsFingerprint(context) {
     let ja4 = null;
 
     // 1. Prefer JA4 hash from a trusted reverse proxy header.
-    const ja4FromHeader = context.headers['x-ja4-hash'];
+    const ja4FromHeader = context.headers ? context.headers['x-ja4-hash'] : null;
     if (ja4FromHeader) {
         ja4 = ja4FromHeader;
     }
     // 2. Prefer JA3 hash from a trusted reverse proxy header.
-    const ja3FromHeader = context.headers['x-ja3-hash']; // Assuming a proxy might provide JA3 too
+    const ja3FromHeader = context.headers ? context.headers['x-ja3-hash'] : null; // Assuming a proxy might provide JA3 too
     if (ja3FromHeader) {
         ja3 = ja3FromHeader;
     }
@@ -425,7 +512,7 @@ function getCompositeDeviceHash(context) {
     // notre propre fingerprint serveur pour le comparer.
     // Un attaquant qui forge un `clientFp` mais oublie de forger les en-têtes
     // correspondants sera détecté par l'incohérence.
-    const clientFp = context.headers['x-device-fingerprint'];
+    const clientFp = context.headers ? context.headers['x-device-fingerprint'] : null;
     if (clientFp && typeof clientFp === 'string' && clientFp.includes('cvs:')) {
         // On ajoute le hash du fingerprint client comme un composant du fingerprint serveur.
         // Si le clientFp change, le hash serveur changera aussi.
@@ -433,7 +520,7 @@ function getCompositeDeviceHash(context) {
     }
 
     // 1. SIGNAL FORT: User Agent (poids élevé)
-    const ua = context.headers["user-agent"];
+    const ua = context.headers ? context.headers["user-agent"] : null;
     if (ua) {
         srv.add("ua", ua); // User-Agent
     }
@@ -443,10 +530,10 @@ function getCompositeDeviceHash(context) {
     if (ja3) srv.add("ja3", ja3);
     if (ja4) srv.add("ja4", ja4);
 
-    const h2Fingerprint = context.headers['x-http2-fingerprint'];
+    const h2Fingerprint = context.headers ? context.headers['x-http2-fingerprint'] : null;
     if (h2Fingerprint) srv.add("h2", h2Fingerprint);
 
-    const tcpFingerprint = context.headers['x-tcp-fingerprint'];
+    const tcpFingerprint = context.headers ? context.headers['x-tcp-fingerprint'] : null;
     if (tcpFingerprint) srv.add("tcp", tcpFingerprint);
 
     // 3. SIGNAUX DE HAUT NIVEAU (Applicatif) Moins fiables, mais utiles pour la corroboration
@@ -457,6 +544,7 @@ function getCompositeDeviceHash(context) {
         "ch_model": "sec-ch-ua-model",
         "ch_arch": "sec-ch-ua-arch",
         "ch_bitness": "sec-ch-ua-bitness",
+        "ch_full_version_list": "sec-ch-ua-full-version-list",
         "upgrade_req": "upgrade-insecure-requests",
         "accept_lang": "accept-language",
         "accept_enc": "accept-encoding",
@@ -464,7 +552,7 @@ function getCompositeDeviceHash(context) {
     };
 
     for (const [key, headerName] of Object.entries(headersToCapture)) {
-        const headerValue = context.headers[headerName];
+        const headerValue = context.headers ? context.headers[headerName] : null;
         if (headerValue) {
             srv.add(key, headerValue);
         }
@@ -799,18 +887,16 @@ export const verifyPoWAndGenerateTicket = async (
     return null;
   }
 
-  // 2. Generate an opaque ticket ID and store session metadata securely on the server
-  const ticketId = crypto.randomUUID();
+  // 2. Generate a signed and encrypted stateless ticket
   const expiry = Date.now() + 3600000; // 1 hour
-
-  await store.set(`ticket:${ticketId}`, {
+  const payload = {
     expiry,
     originalIp: ip,
     deviceId,
     deviceHash
-  }, 3600); // 1 hour TTL
+  };
 
-  return ticketId;
+  return generateStatelessTicket(payload);
 };
 
 
@@ -866,7 +952,26 @@ export const isTicketValid = async (ip, ticket, deviceId = '', deviceHash = '',
   // Input validation: ensure the ticket is a non-empty string with the correct format.
   if (typeof ticket !== 'string' || ticket.length === 0) return false;
 
-  // 1. Resolve opaque ticket session from server-side store
+  // 1. Resolve stateless ticket first (zero database I/O cost)
+  const statelessData = parseStatelessTicket(ticket);
+  if (statelessData) {
+    const { expiry, originalIp, deviceId: storedDeviceId, deviceHash: storedDeviceHash } = statelessData;
+
+    if (!expiry || Date.now() > expiry) {
+      return false;
+    }
+
+    if (ip === originalIp) return true;
+    const currentSubnet = getIpSubnet(ip);
+    const originalSubnet = getIpSubnet(originalIp);
+    if (currentSubnet && originalSubnet && currentSubnet === originalSubnet) return true;
+
+    if (!allowCrossNetworkRoaming) return false;
+
+    return !!(deviceId && deviceId === storedDeviceId && deviceHash && deviceHash === storedDeviceHash);
+  }
+
+  // 2. Resolve opaque ticket session from server-side store
   const ticketData = await store.get(`ticket:${ticket}`);
   if (ticketData) {
     const { expiry, originalIp, deviceId: storedDeviceId, deviceHash: storedDeviceHash } = ticketData;
@@ -886,7 +991,7 @@ export const isTicketValid = async (ip, ticket, deviceId = '', deviceHash = '',
     return !!(deviceId && deviceId === storedDeviceId && deviceHash && deviceHash === storedDeviceHash);
   }
 
-  // 2. Legacy fallback verification (backward compatibility for old client tokens)
+  // 3. Legacy fallback verification (backward compatibility for old client tokens)
   let expiry, originalIp, sig;
   if (ticket.includes('|')) {
     const parts = ticket.split('|');
@@ -1149,6 +1254,79 @@ function analyzeMouseMovements(history) {
     return { avgSpeed, avgAcceleration, straightness, pauses, segments: segments.map(s => s.distance) };
 }
 
+/**
+ * @private
+ * Analyse une série d'événements tactiles mobiles pour en extraire des indicateurs comportementaux robustes.
+ * @param {Array<{x: number, y: number, t: number, p: number, r: number, num: number}>} history
+ * @returns {{avgSpeed: number, avgAcceleration: number, straightness: number, pauses: number, segments: Array<number>, avgPressure: number, avgRadius: number, pressureVariance: number, radiusVariance: number, maxTouches: number}}
+ */
+function analyzeTouchMovements(history) {
+    if (!history || history.length < 3) {
+        return { avgSpeed: 0, avgAcceleration: 0, straightness: 1, pauses: 0, segments: [], avgPressure: 0, avgRadius: 0, pressureVariance: 0, radiusVariance: 0, maxTouches: 1 };
+    }
+
+    const segments = [];
+    let totalDistance = 0;
+    let pauses = 0;
+    let totalPressure = 0;
+    let totalRadius = 0;
+    let maxTouches = 1;
+
+    for (let i = 1; i < history.length; i++) {
+        const p1 = history[i - 1];
+        const p2 = history[i];
+        const dx = p2.x - p1.x;
+        const dy = p2.y - p1.y;
+        const dt = p2.t - p1.t;
+        const distance = Math.sqrt(dx * dx + dy * dy);
+
+        totalPressure += p2.p || 0;
+        totalRadius += p2.r || 0;
+        if (p2.num > maxTouches) {
+            maxTouches = p2.num;
+        }
+
+        if (dt > 0) {
+            const speed = distance / dt;
+            segments.push({ distance, dt, speed });
+            totalDistance += distance;
+        }
+        if (dt > 100 && distance < 5) {
+            pauses++;
+        }
+    }
+
+    totalPressure += history[0].p || 0;
+    totalRadius += history[0].r || 0;
+
+    const avgPressure = totalPressure / history.length;
+    const avgRadius = totalRadius / history.length;
+
+    let sqDiffPressureSum = 0;
+    let sqDiffRadiusSum = 0;
+    for (const pt of history) {
+        sqDiffPressureSum += Math.pow((pt.p || 0) - avgPressure, 2);
+        sqDiffRadiusSum += Math.pow((pt.r || 0) - avgRadius, 2);
+    }
+    const pressureVariance = sqDiffPressureSum / history.length;
+    const radiusVariance = sqDiffRadiusSum / history.length;
+
+    if (segments.length < 2) {
+        return { avgSpeed: 0, avgAcceleration: 0, straightness: 1, pauses, segments: [], avgPressure, avgRadius, pressureVariance, radiusVariance, maxTouches };
+    }
+
+    const totalTime = history[history.length - 1].t - history[0].t;
+    const avgSpeed = totalTime > 0 ? segments.reduce((sum, s) => sum + s.speed, 0) / segments.length : 0;
+    const avgAcceleration = segments.reduce((sum, s) => sum + (s.speed / s.dt), 0) / segments.length;
+
+    const startPoint = history[0];
+    const endPoint = history[history.length - 1];
+    const straightDistance = Math.sqrt(Math.pow(endPoint.x - startPoint.x, 2) + Math.pow(endPoint.y - startPoint.y, 2));
+    const straightness = totalDistance > 0 ? straightDistance / totalDistance : 1;
+
+    return { avgSpeed, avgAcceleration, straightness, pauses, segments: segments.map(s => s.distance), avgPressure, avgRadius, pressureVariance, radiusVariance, maxTouches };
+}
+
 /**
  * Calcule un score basé sur les métriques comportementales envoyées par le client.
  * @param {object} context - Le contexte de la requête, contenant les en-têtes.
@@ -1171,9 +1349,10 @@ function getBehaviorScore(context) {
 
     // 2. Analyse des mouvements de la souris
     const { avgSpeed, avgAcceleration, straightness, pauses, segments } = analyzeMouseMovements(metrics.mouseMovementsHistory);
+    const touchAnalysis = analyzeTouchMovements(metrics.touchMovementsHistory);
 
     // Pénalité pour absence totale d'interaction (pas de mouvements, pas de frappes).
-    if (avgSpeed === 0 && metrics.keystrokeLatency === 0) {
+    if (avgSpeed === 0 && touchAnalysis.avgSpeed === 0 && metrics.keystrokeLatency === 0) {
       score += 40;
     }
 
@@ -1197,6 +1376,30 @@ function getBehaviorScore(context) {
         if (pauses === 0 && segments.length > 20) score += 15; // Mouvement continu sans micro-pauses
     }
 
+    // 4. Analyse comportementale des événements tactiles (Touch Move)
+    const touchHistory = metrics.touchMovementsHistory;
+    if (touchHistory && touchHistory.length > 0) {
+        const touch = analyzeTouchMovements(touchHistory);
+        if (touch.avgSpeed > 0) {
+            if (touch.avgSpeed > 5) score += 30; // Touch d'une vitesse anormale/robotique
+            if (touch.avgAcceleration > 0.8) score += 20;
+            if (touch.straightness > 0.98) score += 35; // Un tracé de doigt humain n'est jamais parfaitement rectiligne
+            if (touch.pauses === 0 && touch.segments.length > 25) score += 15;
+
+            // Détection de l'émulation (pression et rayon de contact constants)
+            if (touch.avgPressure > 0 && touch.pressureVariance === 0) {
+                score += 30; // Spoofed force/pressure
+            }
+            if (touch.avgRadius > 0 && touch.radiusVariance === 0) {
+                score += 30; // Spoofed pointer area size
+            }
+        }
+        if (touch.segments.length > 10) {
+            const benfordDev = Optimization.Operators.benfordTest(touch.segments);
+            if (benfordDev > 0.18) score += 35;
+        }
+    }
+
     // Plausibilité de la latence de frappe
     if (metrics.keystrokeLatency > 0 && metrics.keystrokeLatency < 40) score += 25; // Frappe trop rapide pour un humain.
     if (metrics.keystrokeLatency > 1000) score += 15; // Latence très élevée, peut être un script lent.
@@ -1513,6 +1716,48 @@ function getClientHintsInconsistencyScore(context) {
         return { clientHintsInconsistencyScore: 0 };
     }
 
+    const fullVersionList = context.headers['sec-ch-ua-full-version-list'];
+    if (fullVersionList) {
+        let chFullVersion = null;
+        let chFullBrowser = null;
+        const matches = [...fullVersionList.matchAll(/"([^"]+)";v="([^"]+)"/g)];
+        for (const match of matches) {
+            const brand = match[1];
+            const version = match[2];
+            if (brand === 'Google Chrome' || brand === 'Chromium' || brand === 'Microsoft Edge') {
+                chFullVersion = version;
+                chFullBrowser = brand === 'Microsoft Edge' ? 'Edge' : 'Chrome';
+                if (brand === 'Google Chrome' || brand === 'Microsoft Edge') {
+                    break;
+                }
+            }
+        }
+        if (chFullVersion && chFullBrowser) {
+            let uaFullVersion = null;
+            const uaFullMatch = ua.match(/(Chrome|Edg)\/([\d\.]+)/);
+            if (uaFullMatch) {
+                const uaBrowserMapped = uaFullMatch[1] === 'Edg' ? 'Edge' : 'Chrome';
+                uaFullVersion = uaFullMatch[2];
+                if (uaBrowserMapped === chFullBrowser && uaFullVersion !== chFullVersion) {
+                    const parts1 = uaFullVersion.split('.').map(Number);
+                    const parts2 = chFullVersion.split('.').map(Number);
+                    let diffIndex = -1;
+                    for (let i = 0; i < Math.max(parts1.length, parts2.length); i++) {
+                        if ((parts1[i] || 0) !== (parts2[i] || 0)) {
+                            diffIndex = i;
+                            break;
+                        }
+                    }
+                    const baseScores = [95, 90, 85, 80];
+                    const baseScore = baseScores[diffIndex] || 80;
+                    const delta = Math.abs((parts1[diffIndex] || 0) - (parts2[diffIndex] || 0));
+                    const finalFullScore = Math.min(100, baseScore + Math.min(5, delta * 5));
+                    return { clientHintsInconsistencyScore: finalFullScore };
+                }
+            }
+        }
+    }
+
     // 1. Extract browser and version from User-Agent
     let uaVersion = null;
     let uaBrowser = null;
@@ -1547,10 +1792,19 @@ function getClientHintsInconsistencyScore(context) {
 
     const versionDifference = Math.abs(parseInt(uaVersion, 10) - parseInt(chVersion, 10));
 
-    if (versionDifference > 5) return { clientHintsInconsistencyScore: 80 };
-    if (versionDifference > 1) return { clientHintsInconsistencyScore: 40 };
+        let clientHintsInconsistencyScore = 0;
+        if (versionDifference > 0) {
+            if (versionDifference <= 2) {
+                clientHintsInconsistencyScore = versionDifference * 20;
+            } else if (versionDifference <= 7) {
+                clientHintsInconsistencyScore = 40 + (versionDifference - 2) * 8;
+            } else {
+                clientHintsInconsistencyScore = Math.min(100, 80 + (versionDifference - 7) * 3.33);
+            }
+            clientHintsInconsistencyScore = Math.round(clientHintsInconsistencyScore);
+        }
 
-    return { clientHintsInconsistencyScore: 0 };
+        return { clientHintsInconsistencyScore };
 }
 
 /**
@@ -1738,14 +1992,18 @@ async function updateSubnetMetrics(context, deviceId, finalScore) {
         subnetData.highScoreDevices = {};
     }
 
-    const currentDeviceContributions = subnetData.highScoreDevices[deviceId] || 0;
+    // Utilisation d'un identifiant d'appareil stable (fingerprint matériel) plutôt que l'ID de cookie volatil
+    const currentDeviceHash = getCompositeDeviceHash(context);
+    const stableFpId = cyrb53(extractStablePart(currentDeviceHash)).toString();
+
+    const currentDeviceContributions = subnetData.highScoreDevices[stableFpId] || 0;
     if (currentDeviceContributions < 5) {
-        subnetData.highScoreDevices[deviceId] = currentDeviceContributions + 1;
+        subnetData.highScoreDevices[stableFpId] = currentDeviceContributions + 1;
         subnetData.highScoreCount++;
     }
 
-    if (!subnetData.deviceIds.includes(deviceId)) {
-        subnetData.deviceIds.push(deviceId);
+    if (!subnetData.deviceIds.includes(stableFpId)) {
+        subnetData.deviceIds.push(stableFpId);
     }
     subnetData.lastActivity = Date.now();
 
@@ -1792,6 +2050,40 @@ async function getSubnetScore(context) {
     return { subnetScore: Math.min(100, deviceCountPenalty + highScorePenalty) };
 }
 
+/**
+ * Calcule le score d'anomalie de similarité réseau (Botnet Clustering).
+ * @param {object} context - Le contexte de la requête.
+ * @param {string} stableFpHash - Le hash de la partie stable de l'empreinte.
+ * @returns {Promise<{botnetClusterScore: number}>}
+ */
+async function getBotnetClusterScore(context, stableFpHash) {
+  if (!stableFpHash) return { botnetClusterScore: 0 };
+  const key = `botnet-cluster:${stableFpHash}`;
+  const now = Date.now();
+  const tenMinutesAgo = now - 600 * 1000;
+
+  let clusterData = (await store.get(key)) || [];
+  if (!Array.isArray(clusterData)) {
+    clusterData = [];
+  }
+
+  clusterData = clusterData.filter(entry => entry.timestamp > tenMinutesAgo);
+  const existingIndex = clusterData.findIndex(entry => entry.ip === context.clientIp);
+  if (existingIndex !== -1) {
+    clusterData[existingIndex].timestamp = now;
+  } else {
+    clusterData.push({ ip: context.clientIp, timestamp: now });
+  }
+
+  await store.set(key, clusterData, 600);
+  const uniqueIpsCount = clusterData.length;
+  let botnetClusterScore = 0;
+  if (uniqueIpsCount >= 2) {
+    botnetClusterScore = Math.min(100, Math.round(1000 * (1 - Math.exp(-0.35 * (uniqueIpsCount - 1)))) / 10);
+  }
+  return { botnetClusterScore };
+}
+
 /**
  * Retrieves the current local IP reputation score, applying time-based decay.
  * @param {string} ip - The client's IP address.
@@ -1858,7 +2150,10 @@ function getRequestPatternScore(context, deviceData, patternConfig = {}) {
         benfordThreshold = 0.15,    // Seuil de déviation de Benford au-dessus duquel la distribution est "non naturelle".
         patternWeight = 80,         // Pénalité FORTE et unique si un pattern est détecté.
         decayFactor = 0.95,         // Décroissance du score dans le temps.
-        inactivityReset = 180000    // Réinitialisation du score après 3 minutes d'inactivité.
+        inactivityReset = 180000,   // Réinitialisation du score après 3 minutes d'inactivité.
+        regularityRatio = 0.4,      // (NOUVEAU) Poids relatif de l'écart-type
+        benfordRatio = 0.3,         // (NOUVEAU) Poids relatif de Benford
+        enumerationRatio = 0.3      // (NOUVEAU) Poids relatif de l'énumération de chemins
     } = patternConfig;
 
     const now = Date.now();
@@ -1888,24 +2183,24 @@ function getRequestPatternScore(context, deviceData, patternConfig = {}) {
         deviceData.timingHistory.push(timeSinceLast);
     }
 
-    let instantScore = 0;
+    let regularityScore = 0;
+    let benfordScore = 0;
     const timings = deviceData.timingHistory;
 
     // Analyse statistique unifiée si nous avons assez de données
     if (timings.length >= minSamples) {
-        const timings = deviceData.timingHistory;
         const mean = timings.reduce((a, b) => a + b, 0) / timings.length;
         const variance = timings.reduce((a, b) => a + Math.pow(b - mean, 2), 0) / timings.length;
         const stdDev = Math.sqrt(variance);
         const benfordDeviation = Optimization.Operators.benfordTest(timings);
 
-        // Détection de régularité (bots de type "cron")
+        // Calcul progressif de la régularité (stdDev proche de 0 = score max)
         if (stdDev < regularityThreshold) {
-            instantScore = patternWeight;
+            regularityScore = 1 - (stdDev / regularityThreshold);
         }
-        // Détection de distribution non-naturelle (bots "faussement aléatoires")
-        else if (benfordDeviation > benfordThreshold) {
-            instantScore = patternWeight;
+        // Calcul progressif de Benford (excès par rapport au seuil)
+        if (benfordDeviation > benfordThreshold) {
+            benfordScore = Math.min(1, (benfordDeviation - benfordThreshold) / (0.5 - benfordThreshold));
         }
     }
 
@@ -1919,12 +2214,18 @@ function getRequestPatternScore(context, deviceData, patternConfig = {}) {
         templates.forEach(t => templateCounts[t] = (templateCounts[t] || 0) + 1);
 
         const maxTemplateRepetition = Math.max(...Object.values(templateCounts), 0);
-        // Si une même structure de route est répétée mais sur des URLs réelles différentes
         if (maxTemplateRepetition >= 3 && uniquePaths.size === history.length) {
-            enumerationScore = patternWeight * 0.8; // Appliquer une forte pénalité
+            enumerationScore = Math.min(1, (maxTemplateRepetition - 2) / 5);
         }
     }
 
+    // Score instantané combiné linéaire pondéré
+    const weightedScore = (regularityScore * regularityRatio) +
+        (benfordScore * benfordRatio) +
+        (enumerationScore * enumerationRatio);
+
+    const instantScore = weightedScore * patternWeight;
+
     // Garder l'historique à une taille raisonnable
     if (history.length > historySize) {
         history.shift();
@@ -1943,7 +2244,7 @@ function getRequestPatternScore(context, deviceData, patternConfig = {}) {
     }
     newPatternScore = Math.max(0, newPatternScore);
 
-    deviceData.lastPatternScore = newPatternScore + instantScore + enumerationScore;
+    deviceData.lastPatternScore = Math.max(instantScore, newPatternScore);
 
     return { requestPatternScore: Math.min(100, deviceData.lastPatternScore) };
 }
@@ -2175,6 +2476,7 @@ export const getSuspicionVector = async (context, securityConfig) => {
     const { deviceId, deviceData, consistencyScore, newCookie } = await resolveRequestIdentity(context, securityConfig);
 
   const clientIp = context.clientIp;
+  const currentDeviceHash = getCompositeDeviceHash(context);
 
   // If a new cookie needs to be set, attach it to the request object
   // so the middleware can handle it. This is a temporary state holder.
@@ -2230,6 +2532,12 @@ export const getSuspicionVector = async (context, securityConfig) => {
 
   const ipReputationScore = await getIpReputationScore(clientIp);
 
+  const stableFp = extractStablePart(currentDeviceHash);
+  const stableFpHash = cyrb53(stableFp).toString();
+  const { botnetClusterScore } = await getBotnetClusterScore(context, stableFpHash);
+
+    const { tcpAnomalyScore } = getTcpAnomalyScore(context);
+
   // Save the updated device state to the store
   // Note: deviceData.ips is a Set, which may not serialize correctly in all stores (e.g., JSON). A Redis store should handle this via custom serialization or by converting to an array.
   await store.set(`device:${deviceId}`, deviceData);
@@ -2240,7 +2548,7 @@ export const getSuspicionVector = async (context, securityConfig) => {
       deviceData.ips = new Set(deviceData.ips);
   }
   // Le vecteur de suspicion est maintenant complet.
-  return { ...behavioral, headerAnomalyScore, inconsistencyScore, behaviorScore, honeypotScore, botScore, requestPatternScore, crossLayerInconsistencyScore, timeInconsistencyScore, tlsSpoofingScore, clickVarianceScore, clientHintsInconsistencyScore, subnetScore, ipReputationScore };
+  return { ...behavioral, headerAnomalyScore, inconsistencyScore, behaviorScore, honeypotScore, botScore, requestPatternScore, crossLayerInconsistencyScore, timeInconsistencyScore, tlsSpoofingScore, clickVarianceScore, clientHintsInconsistencyScore, subnetScore, ipReputationScore, botnetClusterScore, tcpAnomalyScore };
 };
 
 // A residential user can change networks (home, 4G, public wifi).
@@ -2536,19 +2844,15 @@ export async function verifyCpuTargetPoWAndGenerateTicket(
   if (isValid) {
       console.log('[FP Server Verify] CPU PoW verification PASSED. Details:', {
       });
-    // Generate an opaque ticket ID and store session metadata securely on the server
-    const ticketId = crypto.randomUUID();
     const ttl = ticketTtl || 3600000; // Calculates expiration from TTL
     const expiry = Date.now() + ttl;
 
-    await store.set(`ticket:${ticketId}`, {
+    return generateStatelessTicket({
       expiry,
       originalIp: clientIp,
       deviceId,
       deviceHash
     }, Math.ceil(ttl / 1000));
-
-    return ticketId;
   }
 
   return null;
@@ -2644,12 +2948,14 @@ export class FingerprintEngine {
             (suspicionVector.behaviorScore || 0) * (weights.behaviorScore || 0) +
             (suspicionVector.botScore || 0) * (weights.botScore || 0) + // Ajout du nouveau score
             (suspicionVector.crossLayerInconsistencyScore || 0) * (weights.crossLayerInconsistencyScore || 0) +
+            (suspicionVector.botnetClusterScore || 0) * (weights.botnetClusterScore || 0) +
             (suspicionVector.tlsSpoofingScore || 0) * (weights.tlsSpoofingScore || 0) + // NOUVEAU: TLS Spoofing
             (suspicionVector.timeInconsistencyScore || 0) * (weights.timeInconsistencyScore || 0) +
             (suspicionVector.clickVarianceScore || 0) * (weights.clickVarianceScore || 0) +
             (suspicionVector.clientHintsInconsistencyScore || 0) * (weights.clientHintsInconsistencyScore || 0) +
             (suspicionVector.subnetScore || 0) * (weights.subnetScore || 0) +
-            (suspicionVector.ipReputationScore || 0) * (weights.ipReputationScore || 0);
+            (suspicionVector.ipReputationScore || 0) * (weights.ipReputationScore || 0) +
+            (suspicionVector.tcpAnomalyScore || 0) * (weights.tcpAnomalyScore || 0);
 
         return Math.min(100, score);
     }
@@ -3374,6 +3680,28 @@ export class FingerprintEngine {
         if (mustReChallenge) {
             this._log('High suspicion score detected - overriding valid ticket to re-issue challenge', { finalScore, deviceId });
         }
+
+        // --- AJOUT : Limiteur de débit (Token Bucket) ---
+        const rateLimitPassed = await checkChallengeRateLimit(clientIp);
+        if (!rateLimitPassed) {
+            this._log('Challenge rate limit exceeded - blocking with 429', { clientIp });
+            const decision = {
+                action: 'block',
+                status: 429,
+                body: 'Too Many Requests',
+                score: finalScore,
+                vector: suspicionVector
+            };
+            if (this.dryRun) {
+                this._log(`[Dry Run] Intended action: ${decision.action}`, { score: decision.score });
+                decision.intendedAction = decision.action;
+                decision.action = 'next';
+                delete decision.status;
+                delete decision.body;
+            }
+            return decision;
+        }
+
         this._log('Suspicious request without valid ticket - issuing challenge', { finalScore, hasPowCookie: !!powCookie });
 
         // --- SELECTION AND SENDING OF THE APPROPRIATE CHALLENGE ---
@@ -3773,6 +4101,185 @@ function determineOptimalTicketTtl(suspicionScore) {
     return ttl;
 }
 
+
+/**
+ * Parse une trame TCP SYN brute (IPv4 ou IPv6).
+ * @private
+ * @param {Buffer|Uint8Array} binary - Le paquet binaire.
+ * @returns {object|null}
+ */
+function parseTcpSyn(binary) {
+    if (!binary || binary.length < 40) return null;
+    let ttl = 64;
+    let tcpOffset = 20;
+    const version = binary[0] >> 4;
+
+    if (version === 4) {
+        ttl = binary[8];
+        const ihl = binary[0] & 0x0f;
+        tcpOffset = ihl * 4;
+    } else if (version === 6) {
+        ttl = binary[7]; // Hop Limit
+        tcpOffset = 40;
+    } else {
+        tcpOffset = 0;
+        ttl = 64;
+    }
+
+    if (binary.length < tcpOffset + 20) return null;
+
+    const windowSize = (binary[tcpOffset + 14] << 8) | binary[tcpOffset + 15];
+    const dataOffset = (binary[tcpOffset + 12] >> 4) * 4;
+    const optionsEnd = tcpOffset + dataOffset;
+
+    let mss = null;
+    let ws = null;
+    let sack = false;
+
+    let i = tcpOffset + 20;
+    while (i < optionsEnd && i < binary.length) {
+        const optType = binary[i];
+        if (optType === 0) break;
+        if (optType === 1) {
+            i++;
+            continue;
+        }
+        if (i + 1 >= binary.length) break;
+        const optLen = binary[i + 1];
+        if (optLen < 2 || i + optLen > binary.length) break;
+
+        if (optType === 2 && optLen === 4) {
+            mss = (binary[i + 2] << 8) | binary[i + 3];
+        } else if (optType === 3 && optLen === 3) {
+            ws = binary[i + 2];
+        } else if (optType === 4 && optLen === 2) {
+            sack = true;
+        }
+        i += optLen;
+    }
+
+    return { ttl, windowSize, mss, ws, sack };
+}
+
+/**
+ * Classifie l'OS à partir du fingerprint de la pile TCP/IP.
+ * @private
+ * @param {object|null} fingerprint
+ * @returns {string}
+ */
+function classifyTcpOs(fingerprint) {
+    if (!fingerprint) return 'unknown';
+    const ttl = fingerprint.ttl ?? 64;
+    const windowSize = fingerprint.windowSize ?? 0;
+    const ws = fingerprint.ws ?? null;
+
+    if (ttl > 64 && ttl <= 128) {
+        return 'Windows';
+    }
+    if (ttl > 32 && ttl <= 64) {
+        if (windowSize === 29200 || windowSize === 14600 || windowSize === 5840) {
+            return 'Linux';
+        }
+        return 'Linux';
+    }
+    if (ttl <= 64) {
+        if (windowSize === 65535 && (ws === 6 || ws === 8 || ws === 5)) {
+            return 'macOS/iOS';
+        }
+    }
+    if (ttl > 64) return 'Windows';
+    if (ttl > 0) return 'Linux';
+    return 'unknown';
+}
+
+/**
+ * Détecte les anomalies de pile réseau par rapport au User-Agent.
+ * @private
+ * @param {object} context - Le contexte de la requête.
+ * @returns {{tcpAnomalyScore: number}}
+ */
+function getTcpAnomalyScore(context) {
+    let fp = null;
+    const rawTcpBinary = context.headers?.['x-raw-tcp-binary'] || context.rawTcpBinary || null;
+    if (rawTcpBinary) {
+        const binary = Buffer.isBuffer(rawTcpBinary) ? rawTcpBinary : (typeof rawTcpBinary === 'string' ? Buffer.from(rawTcpBinary, 'hex') : rawTcpBinary);
+        fp = parseTcpSyn(binary);
+    }
+
+    if (!fp) {
+        const tcpHeader = context.headers?.['x-tcp-fingerprint'] || context.tcpFingerprint || null;
+        if (tcpHeader && typeof tcpHeader === 'string') {
+            const parts = tcpHeader.split(':');
+            if (parts.length >= 2) {
+                fp = {
+                    ttl: parseInt(parts[0], 10),
+                    windowSize: parseInt(parts[1], 10),
+                    mss: parts[2] ? parseInt(parts[2], 10) : null,
+                    ws: parts[3] ? parseInt(parts[3], 10) : null,
+                    sack: parts[4] === '1' || parts[4] === 'true'
+                };
+            }
+        }
+    }
+
+    if (!fp) {
+        return { tcpAnomalyScore: 0.0 };
+    }
+
+    const tcpOs = classifyTcpOs(fp);
+    const ua = context.headers?.['user-agent'] || '';
+    const uaParts = parseUserAgent(ua);
+    const uaOs = uaParts.os;
+
+    if (!uaOs || tcpOs === 'unknown') {
+        return { tcpAnomalyScore: 0.0 };
+    }
+
+        let mappedOs = null;
+        if (uaOs.startsWith('Windows')) mappedOs = 'Windows';
+        else if (uaOs.startsWith('Mac') || uaOs.startsWith('macOS')) mappedOs = 'macOS';
+        else if (uaOs.startsWith('iOS')) mappedOs = 'iOS';
+        else if (uaOs.startsWith('Linux')) mappedOs = 'Linux';
+
+        if (!mappedOs) {
+            return { tcpAnomalyScore: 0.0 };
+        }
+
+        const OS_EXPECTED_TCP = {
+            'Windows': { ttl: 128, windowSize: 64240, ws: 8, mss: 1460, sack: true },
+            'Linux': { ttl: 64, windowSize: 29200, ws: 7, mss: 1460, sack: true },
+            'macOS': { ttl: 64, windowSize: 65535, ws: 6, mss: 1460, sack: true },
+            'iOS': { ttl: 64, windowSize: 65535, ws: 6, mss: 1460, sack: true }
+        };
+
+        const expected = OS_EXPECTED_TCP[mappedOs];
+        const ttlDiff = Math.abs(fp.ttl - expected.ttl) / expected.ttl;
+        const winDiff = Math.abs(fp.windowSize - expected.windowSize) / expected.windowSize;
+        const wsDiff = expected.ws !== null && fp.ws !== null ? Math.abs(fp.ws - expected.ws) / expected.ws : 0.0;
+        const mssDiff = expected.mss !== null && fp.mss !== null ? Math.abs(fp.mss - expected.mss) / expected.mss : 0.0;
+        const sackDiff = (fp.sack ?? true) === (expected.sack ?? true) ? 0.0 : 1.0;
+
+        const deviation = (
+            Math.min(1.0, ttlDiff) * 0.50 +
+            Math.min(1.0, winDiff) * 0.25 +
+            Math.min(1.0, wsDiff) * 0.15 +
+            Math.min(1.0, mssDiff) * 0.05 +
+            sackDiff * 0.05
+        );
+
+        let tcpAnomalyScore = 0.0;
+        if (tcpOs !== mappedOs && tcpOs !== 'unknown') {
+            const baseAnomaly = mappedOs === 'Windows' ? 80.0 :
+                                (mappedOs === 'macOS' || mappedOs === 'iOS' ? 85.0 : 75.0);
+            tcpAnomalyScore = baseAnomaly + (deviation - 0.4) * 10.0;
+        } else {
+            tcpAnomalyScore = deviation * 40.0;
+        }
+
+        tcpAnomalyScore = Math.max(0.0, Math.min(100.0, Math.round(tcpAnomalyScore * 10) / 10));
+        return { tcpAnomalyScore };
+}
+
 /**
  * Vérifie si une chaîne de caractères contient des patterns d'injection connus.
  * @private
@@ -4037,8 +4544,19 @@ export const powMiddleware = (securityConfig) => {
 
       if (jsFile && req.path === jsPath) {
         try {
-          const fileContent = readFileSync(jsFile);
-          res.setHeader('Content-Type', 'application/javascript');
+          if (wasmConfig === 'dynamic' || wasmConfig.dynamic || wasmConfig.polymorphic) {
+            console.log('[Fingerprint] Generating dynamic polymorphic WASM module...');
+            // Génère des constantes aléatoires uniques pour cette session / requête
+            const seed = crypto.randomBytes(4).readInt32LE(0);
+            const multiplier = crypto.randomBytes(4).readInt32LE(0) | 1; // Doit être impair pour un LCG optimal
+            const adder = crypto.randomBytes(4).readInt32LE(0);
+            
+            const wasmBuffer = DynamicWasmGenerator.generate({ seed, multiplier, adder });
+            res.setHeader('Content-Type', 'application/wasm');
+            return res.send(wasmBuffer);
+          }
+          const fileContent = readFileSync(wasmFile);
+          res.setHeader('Content-Type', 'application/wasm');
           return res.send(fileContent);
         } catch (e) {
           // Fallback
@@ -4046,6 +4564,16 @@ export const powMiddleware = (securityConfig) => {
       }
       if (wasmFile && req.path === wasmPath) {
         try {
+          if (wasmConfig === 'dynamic' || wasmConfig.dynamic || wasmConfig.polymorphic) {
+            // Génère des constantes aléatoires uniques pour cette session / requête
+            const seed = crypto.randomBytes(4).readInt32LE(0);
+            const multiplier = crypto.randomBytes(4).readInt32LE(0) | 1; // Doit être impair pour un LCG optimal
+            const adder = crypto.randomBytes(4).readInt32LE(0);
+            
+            const wasmBuffer = DynamicWasmGenerator.generate({ seed, multiplier, adder });
+            res.setHeader('Content-Type', 'application/wasm');
+            return res.send(wasmBuffer);
+          }
           const fileContent = readFileSync(wasmFile);
           res.setHeader('Content-Type', 'application/wasm');
           return res.send(fileContent);
@@ -4143,7 +4671,10 @@ export const __internal = {
     getTlsFingerprint, // NOUVEAU: Expose pour les tests
     sanitizeTrafficData, // NOUVEAU: Expose pour l'auto-tuner/tests
     getTlsSpoofingScore, // NOUVEAU: Expose pour les tests
+    generateStatelessTicket,
+    parseStatelessTicket,
     parseJa3,
+    getBotnetClusterScore, // NOUVEAU: Expose pour les tests
     generateCpuTargetChallengePage,
     getClientHintsInconsistencyScore, // Expose for testing
     generateCombinedPoWChallengePage,
@@ -4154,6 +4685,9 @@ export const __internal = {
     getIpReputationScore, // Expose for testing
     updateIpReputationScore, // Expose for testing
     setLastBestSolution: (val) => { lastBestSolution = val; }, // Expose to test auto-tuning metrics
+    parseTcpSyn, // Expose for testing
+    classifyTcpOs, // Expose for testing
+    getTcpAnomalyScore // Expose for testing
 };
 
 // --- THRESHOLD AUTO-TUNING SECTION ---