@anonympins/fingerprint 0.4.3 → 0.4.5

package/src/js/tests/fingerprint.test.js

@@ -1747,7 +1747,9 @@ describe('getRequestPatternScore', () => {
         dateNowSpy = vi.spyOn(Date, 'now').mockReturnValue(10000);
 
         const { requestPatternScore } = getRequestPatternScore(context, deviceData, patternConfig);
-        expect(requestPatternScore).toBe(patternConfig.patternWeight); // 80
+        // regularityScore = 1.0 (stdDev = 0). regularityRatio = 0.4.
+        // instantScore = 1.0 * 0.4 * 80 = 32.
+        expect(requestPatternScore).toBe(32);
     });
 
     test('should assign a high pattern score for non-natural (Benford-violating) timings', () => {
@@ -1760,7 +1762,11 @@ describe('getRequestPatternScore', () => {
         dateNowSpy = vi.spyOn(Date, 'now').mockReturnValue(10000);
 
         const { requestPatternScore } = getRequestPatternScore(context, deviceData, patternConfig);
-        expect(requestPatternScore).toBe(patternConfig.patternWeight); // 80
+        // stdDev ~ 31.29. regularityScore = 1 - (31.29 / 50) = ~0.374.
+        // benfordDeviation ~ 2.07. benfordScore = 1.0 (capped).
+        // weightedScore = (0.374 * 0.4) + (1.0 * 0.3) = ~0.4496.
+        // instantScore = 0.4496 * 80 = ~35.97.
+        expect(requestPatternScore).toBeCloseTo(35.97, 1);
     });
 
     test('should apply decay factor to the score over time', () => {
@@ -1963,8 +1969,9 @@ describe('Regularity Detection (Standard Deviation)', () => {
 
         const { requestPatternScore } = getRequestPatternScore(context, deviceData, regularityConfig);
 
-        // stdDev is 0, which is < regularityThreshold, so the full patternWeight is applied.
-        expect(requestPatternScore).toBe(regularityConfig.patternWeight);
+                // stdDev is 0 (regularityScore = 1.0). regularityRatio = 0.4.
+                // Expected score: 1.0 * 0.4 * 60 = 24.
+                expect(requestPatternScore).toBe(24);
     });
 
     it('should apply a low penalty for slightly irregular requests', () => {
@@ -1975,7 +1982,9 @@ describe('Regularity Detection (Standard Deviation)', () => {
 
         const { requestPatternScore } = getRequestPatternScore(context, deviceData, localConfig);
 
-        expect(requestPatternScore).toBe(localConfig.patternWeight);
+                // stdDev is ~7.07 (regularityScore = 1 - 7.07/10 = 0.293).
+                // Expected score: 0.293 * 0.4 * 60 = 7.03.
+                expect(requestPatternScore).toBeCloseTo(7.03, 1);
     });
 
     it('should apply no penalty for highly irregular (human-like) requests', () => {
@@ -2060,7 +2069,7 @@ describe('getClientHintsInconsistencyScore', () => {
             }
         };
         const { clientHintsInconsistencyScore } = getClientHintsInconsistencyScore(context);
-        expect(clientHintsInconsistencyScore).toBe(80);
+        expect(clientHintsInconsistencyScore).toBe(97);
     });
 
     it('should return 40 for a small version mismatch', () => {
@@ -2125,19 +2134,27 @@ describe('Subnet Scoring (Node.js)', () => {
     });
 
     it('updateSubnetMetrics should create and update subnet data in the store', async () => {
-        const context = { clientIp: '10.0.0.25' };
-        await __internal.updateSubnetMetrics(context, 'device-1', 50);
+        const context1 = { clientIp: '10.0.0.25', headers: { 'user-agent': 'device-1' } };
+        await __internal.updateSubnetMetrics(context1, 'device-1', 50);
+
+        const fp1 = new FingerprintBuilder().add('ua', 'device-1').toString();
+        const expectedId1 = cyrb53(fp1).toString();
 
         const subnetData = await inMemoryStore.get('subnet:10.0.0.0/24');
         expect(subnetData).toBeDefined();
         expect(subnetData.highScoreCount).toBe(1);
-        expect(subnetData.deviceIds).toEqual(['device-1']);
+        expect(subnetData.deviceIds).toEqual([expectedId1]);
 
         // Second update
-        await __internal.updateSubnetMetrics(context, 'device-2', 60);
+        const context2 = { clientIp: '10.0.0.25', headers: { 'user-agent': 'device-2' } };
+        await __internal.updateSubnetMetrics(context2, 'device-2', 60);
+
+        const fp2 = new FingerprintBuilder().add('ua', 'device-2').toString();
+        const expectedId2 = cyrb53(fp2).toString();
+
         const updatedSubnetData = await inMemoryStore.get('subnet:10.0.0.0/24');
         expect(updatedSubnetData.highScoreCount).toBe(2);
-        expect(updatedSubnetData.deviceIds).toEqual(['device-1', 'device-2']);
+        expect(updatedSubnetData.deviceIds).toEqual([expectedId1, expectedId2]);
     });
 
     it('getSubnetScore should calculate score based on stored metrics', async () => {
@@ -2349,3 +2366,105 @@ describe('Additional Suspicion Vectors Coverage', () => {
         expect(crossLayerInconsistencyScore).toBe(50);
     });
 });
+
+describe('Botnet Cluster Scoring (Node.js)', () => {
+    const inMemoryStore = {
+        _map: new Map(),
+        async get(key) { return this._map.get(key); },
+        async set(key, value) { this._map.set(key, value); },
+        clear() { this._map.clear(); }
+    };
+
+    beforeEach(async () => {
+        inMemoryStore.clear();
+        await configureStore(inMemoryStore);
+    });
+
+    it('should calculate botnetClusterScore based on unique IPs within 10 minutes', async () => {
+        const { getBotnetClusterScore } = __internal;
+        const stableFpHash = 'test-stable-hash';
+
+        // 1. Première IP
+        let scoreData = await getBotnetClusterScore({ clientIp: '192.168.1.1' }, stableFpHash);
+        expect(scoreData.botnetClusterScore).toBe(0);
+
+        // 2. Ajout de 2 IPs uniques (total 3)
+        await getBotnetClusterScore({ clientIp: '192.168.1.2' }, stableFpHash);
+        scoreData = await getBotnetClusterScore({ clientIp: '192.168.1.3' }, stableFpHash);
+            expect(scoreData.botnetClusterScore).toBe(50.3);
+
+        // 3. Ajout de 2 IPs uniques (total 5)
+        await getBotnetClusterScore({ clientIp: '192.168.1.4' }, stableFpHash);
+        scoreData = await getBotnetClusterScore({ clientIp: '192.168.1.5' }, stableFpHash);
+            expect(scoreData.botnetClusterScore).toBe(75.3);
+
+        // 4. Ajout de 5 IPs uniques (total 10)
+        for (let i = 6; i <= 10; i++) {
+            scoreData = await getBotnetClusterScore({ clientIp: `192.168.1.${i}` }, stableFpHash);
+        }
+            expect(scoreData.botnetClusterScore).toBe(95.7);
+    });
+
+        it('should realistically group PS4 consoles with volatile differences (different IPs/cookies) under the same cluster score', async () => {
+            const { getSuspicionVector } = __internal;
+            
+            const ps4Headers = {
+                'user-agent': 'Mozilla/5.0 (PlayStation 4 11.50) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.50 Safari/605.1.15',
+                'x-ja3-hash': '76993ef93bf89104037599723ab9f201',
+                'x-ja4-hash': 't13d1516h2_8daaf6152771_390237aa04be',
+                'x-http2-fingerprint': '1:65536;3:1000;4:6291456;6:65536',
+                'x-tcp-fingerprint': '64240:128:1:mss,nop,ws,nop,nop,sok:df:0'
+            };
+
+            // Simule des requêtes provenant de 10 consoles PlayStation 4 infectées différentes (IPs différentes, pas de cookies communs)
+            for (let i = 1; i <= 10; i++) {
+                const context = {
+                    clientIp: `185.15.20.${i}`,
+                    path: '/api/login',
+                    headers: {
+                        ...ps4Headers,
+                        'cookie_keys': `session_id=fake_sess_${i}` // Élément volatil
+                    },
+                    cookies: {}, // Pas de cookie device_id partagé pour simuler des terminaux distincts
+                    query: {},
+                    httpVersion: '2.0',
+                    requestTimestamp: Date.now()
+                };
+
+                const vector = await getSuspicionVector(context, { honeypot: {}, patterns: {} });
+                
+                if (i === 1) {
+                    expect(vector.botnetClusterScore).toBe(0);
+                } else if (i === 2) {
+                    expect(vector.botnetClusterScore).toBe(29.5);
+                } else if (i === 3) {
+                    expect(vector.botnetClusterScore).toBe(50.3);
+                } else if (i === 4) {
+                    expect(vector.botnetClusterScore).toBe(65);
+                } else if (i === 5) {
+                    expect(vector.botnetClusterScore).toBe(75.3);
+                } else if (i === 10) {
+                    expect(vector.botnetClusterScore).toBe(95.7);
+                }
+            }
+        });
+});
+
+    test('Stateless Ticket Generation and Validation', async () => {
+        const payload = {
+            expiry: Date.now() + 3600000,
+            originalIp: '127.0.0.1',
+            deviceId: 'device-123',
+            deviceHash: 'hash-abc'
+        };
+        
+        const ticket = fingerprint.generateStatelessTicket(payload);
+        expect(ticket).toBeTruthy();
+        expect(ticket.split('.').length).toBe(3);
+        
+        const isValid = await fingerprint.isTicketValid('127.0.0.1', ticket, 'device-123', 'hash-abc');
+        expect(isValid).toBe(true);
+
+        const isDiffIpValid = await fingerprint.isTicketValid('192.168.1.1', ticket, 'device-123', 'hash-abc', false);
+        expect(isDiffIpValid).toBe(false);
+    });

package/src/js/tests/ip-reputation.test.js

@@ -1,132 +1,142 @@
-import {beforeEach, describe, expect, it} from 'vitest';
-import {__internal, configureStore, FingerprintEngine} from '../fingerprint.js';
-
-describe('IP Reputation Local System (Node.js)', () => {
-    let mockStore;
-
-    beforeEach(() => {
-        mockStore = {
-            _map: new Map(),
-            async get(key) { return this._map.get(key); },
-            async set(key, value) { this._map.set(key, value); },
-            async has(key) { return this._map.has(key); },
-            async delete(key) { this._map.delete(key); }
-        };
-        configureStore(mockStore);
-    });
-
-    it('should return a default score of 0 for unknown IPs', async () => {
-        const score = await __internal.getIpReputationScore('1.1.1.1');
-        expect(score).toBe(0);
-    });
-
-    it('should correctly increment and decrement score values', async () => {
-        const ip = '192.168.1.1';
-        await __internal.updateIpReputationScore(ip, 30);
-        let score = await __internal.getIpReputationScore(ip);
-        expect(score).toBe(30);
-
-        await __internal.updateIpReputationScore(ip, -10);
-        score = await __internal.getIpReputationScore(ip);
-        expect(score).toBe(20);
-    });
-
-    it('should clamp the reputation score within bounds [0, 100]', async () => {
-        const ip = '10.0.0.1';
-        await __internal.updateIpReputationScore(ip, 150);
-        let score = await __internal.getIpReputationScore(ip);
-        expect(score).toBe(100);
-
-        await __internal.updateIpReputationScore(ip, -200);
-        score = await __internal.getIpReputationScore(ip);
-        expect(score).toBe(0);
-    });
-
-    it('should apply passive decay of 2 points per hour of inactivity', async () => {
-        const ip = '172.16.0.1';
-        const now = Date.now();
-        
-        // Simulation d'un score de 50 mis à jour il y a 3 heures (3h * 2 points/heure = 6 points de perte)
-        await mockStore.set(`ip-reputation:${ip}`, {
-            score: 50,
-            lastUpdate: now - (3 * 60 * 60 * 1000)
-        });
-
-        const score = await __internal.getIpReputationScore(ip);
-        expect(score).toBe(44);
-    });
-
-    it('should integrate ipReputationScore into the final score calculation', async () => {
-        const ip = '1.2.3.4';
-        await __internal.updateIpReputationScore(ip, 60); // Set IP reputation to 60
-
-        const mockSecurityConfig = {
-            weights: {
-                ipReputationScore: 0.5, // Give it a weight
-                historyScore: 0.0, // Other weights to 0 for isolation
-                rotationScore: 0.0,
-                headerAnomalyScore: 0.0,
-                requestPatternScore: 0.0,
-                inconsistencyScore: 0.0,
-                honeypotScore: 0.0,
-                behaviorScore: 0.0,
-                botScore: 0.0,
-                crossLayerInconsistencyScore: 0.0,
-                tlsSpoofingScore: 0.0,
-                timeInconsistencyScore: 0.0,
-                clickVarianceScore: 0.0,
-                clientHintsInconsistencyScore: 0.0,
-                subnetScore: 0.0,
-            },
-            thresholds: { low: 0, medium: 0, high: 0, block: 100 }, // Irrelevant for this test
-        };
-
-        const ipRepScore = await __internal.getIpReputationScore(ip);
-        const suspicionVector = { ipReputationScore: ipRepScore };
-
-        const engine = new FingerprintEngine(mockSecurityConfig);
-        const finalScore = engine.calculateFinalScore(suspicionVector);
-
-        // Expected score: 60 (ipRepScore) * 0.5 (weight) = 30
-        expect(finalScore).toBe(30.0);
-    });
-
-    it('should return correct subnet for IPv4 and IPv6', async () => {
-        const ipv4Subnet = __internal.getIpSubnet('192.168.1.50', 24, 48);
-        expect(ipv4Subnet).toBe('192.168.1.0/24');
-
-        const ipv6Subnet = __internal.getIpSubnet('2001:db8:abcd:12::1', 24, 48);
-        expect(ipv6Subnet).toBe('2001:db8:abcd:0:0:0:0:0/48');
-    });
-
-    it('should calculate client hints inconsistency score correctly', async () => {
-        const mockContextMismatch = {
-            headers: {
-                'user-agent': 'Mozilla/5.0 Firefox/117.0',
-                'sec-ch-ua': '"Google Chrome";v="117"'
-            }
-        };
-        const scoreMismatch = __internal.getClientHintsInconsistencyScore(mockContextMismatch);
-        expect(scoreMismatch.clientHintsInconsistencyScore).toBe(90);
-
-        const mockContextVersionDrift = {
-            headers: {
-                'user-agent': 'Mozilla/5.0 Chrome/110.0',
-                'sec-ch-ua': '"Google Chrome";v="117"'
-            }
-        };
-        const scoreVersionDrift = __internal.getClientHintsInconsistencyScore(mockContextVersionDrift);
-        expect(scoreVersionDrift.clientHintsInconsistencyScore).toBe(80);
-    });
-
-    it('should integrate subnet history into subnet score', async () => {
-        const mockContext = { clientIp: '192.168.1.50' };
-        let score = await __internal.getSubnetScore(mockContext);
-        expect(score.subnetScore).toBe(0);
-        for (let i = 1; i <= 12; i++) {
-            await __internal.updateSubnetMetrics(mockContext, `dev-${i}`, 40);
-        }
-        score = await __internal.getSubnetScore(mockContext);
-        expect(score.subnetScore).toBeGreaterThan(0);
-    });
+import {beforeEach, describe, expect, it} from 'vitest';
+import {__internal, configureStore, FingerprintEngine} from '../fingerprint.js';
+
+describe('IP Reputation Local System (Node.js)', () => {
+    let mockStore;
+
+    beforeEach(() => {
+        mockStore = {
+            _map: new Map(),
+            async get(key) { return this._map.get(key); },
+            async set(key, value) { this._map.set(key, value); },
+            async has(key) { return this._map.has(key); },
+            async delete(key) { this._map.delete(key); }
+        };
+        configureStore(mockStore);
+    });
+
+    it('should return a default score of 0 for unknown IPs', async () => {
+        const score = await __internal.getIpReputationScore('1.1.1.1');
+        expect(score).toBe(0);
+    });
+
+    it('should correctly increment and decrement score values', async () => {
+        const ip = '192.168.1.1';
+        await __internal.updateIpReputationScore(ip, 30);
+        let score = await __internal.getIpReputationScore(ip);
+        expect(score).toBe(30);
+
+        await __internal.updateIpReputationScore(ip, -10);
+        score = await __internal.getIpReputationScore(ip);
+        expect(score).toBe(20);
+    });
+
+    it('should clamp the reputation score within bounds [0, 100]', async () => {
+        const ip = '10.0.0.1';
+        await __internal.updateIpReputationScore(ip, 150);
+        let score = await __internal.getIpReputationScore(ip);
+        expect(score).toBe(100);
+
+        await __internal.updateIpReputationScore(ip, -200);
+        score = await __internal.getIpReputationScore(ip);
+        expect(score).toBe(0);
+    });
+
+    it('should apply passive decay of 2 points per hour of inactivity', async () => {
+        const ip = '172.16.0.1';
+        const now = Date.now();
+        
+        // Simulation d'un score de 50 mis à jour il y a 3 heures (3h * 2 points/heure = 6 points de perte)
+        await mockStore.set(`ip-reputation:${ip}`, {
+            score: 50,
+            lastUpdate: now - (3 * 60 * 60 * 1000)
+        });
+
+        const score = await __internal.getIpReputationScore(ip);
+        expect(score).toBe(44);
+    });
+
+    it('should integrate ipReputationScore into the final score calculation', async () => {
+        const ip = '1.2.3.4';
+        await __internal.updateIpReputationScore(ip, 60); // Set IP reputation to 60
+
+        const mockSecurityConfig = {
+            weights: {
+                ipReputationScore: 0.5, // Give it a weight
+                historyScore: 0.0, // Other weights to 0 for isolation
+                rotationScore: 0.0,
+                headerAnomalyScore: 0.0,
+                requestPatternScore: 0.0,
+                inconsistencyScore: 0.0,
+                honeypotScore: 0.0,
+                behaviorScore: 0.0,
+                botScore: 0.0,
+                crossLayerInconsistencyScore: 0.0,
+                tlsSpoofingScore: 0.0,
+                timeInconsistencyScore: 0.0,
+                clickVarianceScore: 0.0,
+                clientHintsInconsistencyScore: 0.0,
+                subnetScore: 0.0,
+            },
+            thresholds: { low: 0, medium: 0, high: 0, block: 100 }, // Irrelevant for this test
+        };
+
+        const ipRepScore = await __internal.getIpReputationScore(ip);
+        const suspicionVector = { ipReputationScore: ipRepScore };
+
+        const engine = new FingerprintEngine(mockSecurityConfig);
+        const finalScore = engine.calculateFinalScore(suspicionVector);
+
+        // Expected score: 60 (ipRepScore) * 0.5 (weight) = 30
+        expect(finalScore).toBe(30.0);
+    });
+
+    it('should return correct subnet for IPv4 and IPv6', async () => {
+        const ipv4Subnet = __internal.getIpSubnet('192.168.1.50', 24, 48);
+        expect(ipv4Subnet).toBe('192.168.1.0/24');
+
+        const ipv6Subnet = __internal.getIpSubnet('2001:db8:abcd:12::1', 24, 48);
+        expect(ipv6Subnet).toBe('2001:db8:abcd:0:0:0:0:0/48');
+    });
+
+    it('should calculate client hints inconsistency score correctly', async () => {
+        const mockContextMismatch = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 Firefox/117.0',
+                'sec-ch-ua': '"Google Chrome";v="117"'
+            }
+        };
+        const scoreMismatch = __internal.getClientHintsInconsistencyScore(mockContextMismatch);
+        expect(scoreMismatch.clientHintsInconsistencyScore).toBe(90);
+
+        const mockContextVersionDrift = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 Chrome/110.0',
+                'sec-ch-ua': '"Google Chrome";v="117"'
+            }
+        };
+        const scoreVersionDrift = __internal.getClientHintsInconsistencyScore(mockContextVersionDrift);
+        expect(scoreVersionDrift.clientHintsInconsistencyScore).toBe(80);
+
+        const mockContextFullVersionMismatch = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.1.2 Safari/537.36',
+                'sec-ch-ua': '"Not_A Brand";v="8", "Chromium";v="120", "Google Chrome";v="120"',
+                'sec-ch-ua-full-version-list': '"Not_A Brand";v="8.0.0.0", "Chromium";v="120.0.1.3", "Google Chrome";v="120.0.1.3"'
+            }
+        };
+        const scoreFullVersionMismatch = __internal.getClientHintsInconsistencyScore(mockContextFullVersionMismatch);
+        expect(scoreFullVersionMismatch.clientHintsInconsistencyScore).toBe(85);
+    });
+
+    it('should integrate subnet history into subnet score', async () => {
+        const mockContext = { clientIp: '192.168.1.50' };
+        let score = await __internal.getSubnetScore(mockContext);
+        expect(score.subnetScore).toBe(0);
+        for (let i = 1; i <= 12; i++) {
+            await __internal.updateSubnetMetrics(mockContext, `dev-${i}`, 40);
+        }
+        score = await __internal.getSubnetScore(mockContext);
+        expect(score.subnetScore).toBeGreaterThan(0);
+    });
 });

package/src/js/tests/tcpFingerprint.test.js

@@ -0,0 +1,78 @@
+import { describe, expect, it } from 'vitest';
+import { __internal } from '../fingerprint.js';
+
+const { parseTcpSyn, classifyTcpOs, getTcpAnomalyScore } = __internal;
+
+describe('Passive TCP/IP Fingerprinting (Type p0f)', () => {
+    
+    // Mock d'un paquet IP + TCP SYN d'un système Linux (TTL=64, WS=7)
+    const mockLinuxSynPacket = Buffer.from([
+        0x45, 0x00, 0x00, 0x3c, 0x1a, 0x2b, 0x40, 0x00, 
+        0x40, 0x06, 0x3c, 0x1a, 0x7f, 0x00, 0x00, 0x01, // TTL=0x40 (64)
+        0x7f, 0x00, 0x00, 0x01, 
+        0x1f, 0x90, 0x00, 0x50, 0x00, 0x00, 0x00, 0x01, 
+        0x00, 0x00, 0x00, 0x00, 0xa0, 0x02, 0x72, 0x10, // Window=0x7210 (29200), TCP header len = 40 (0xa0)
+        0x3c, 0x1a, 0x00, 0x00,
+        0x02, 0x04, 0x05, 0xb4, // Option MSS: 1460 (0x05b4)
+        0x04, 0x02,             // Option SACK Permitted
+        0x01,                   // NOP
+        0x03, 0x03, 0x07        // Option WS: 7
+    ]);
+
+    // Mock d'un paquet IP + TCP SYN d'un système Windows (TTL=128, WS=8)
+    const mockWindowsSynPacket = Buffer.from([
+        0x45, 0x00, 0x00, 0x3c, 0x1a, 0x2b, 0x40, 0x00, 
+        0x80, 0x06, 0x3c, 0x1a, 0x7f, 0x00, 0x00, 0x01, // TTL=0x80 (128)
+        0x7f, 0x00, 0x00, 0x01, 
+        0x1f, 0x90, 0x00, 0x50, 0x00, 0x00, 0x00, 0x01, 
+        0x00, 0x00, 0x00, 0x00, 0xa0, 0x02, 0xfa, 0xf0, // Window=64240 (0xfaf0)
+        0x3c, 0x1a, 0x00, 0x00,
+        0x02, 0x04, 0x05, 0xb4, // Option MSS: 1460 (0x05b4)
+        0x04, 0x02,             // Option SACK Permitted
+        0x01,                   // NOP
+        0x03, 0x03, 0x08        // Option WS: 8
+    ]);
+
+    it('should correctly parse raw TCP SYN binary packets', () => {
+        const linuxFp = parseTcpSyn(mockLinuxSynPacket);
+        expect(linuxFp).not.toBeNull();
+        expect(linuxFp.ttl).toBe(64);
+        expect(linuxFp.windowSize).toBe(29200);
+        expect(linuxFp.mss).toBe(1460);
+        expect(linuxFp.ws).toBe(7);
+        expect(linuxFp.sack).toBe(true);
+
+        const windowsFp = parseTcpSyn(mockWindowsSynPacket);
+        expect(windowsFp.ttl).toBe(128);
+        expect(windowsFp.windowSize).toBe(64240);
+        expect(windowsFp.ws).toBe(8);
+    });
+
+    it('should classify OS correctly based on parsed parameters', () => {
+        const linuxFp = parseTcpSyn(mockLinuxSynPacket);
+        expect(classifyTcpOs(linuxFp)).toBe('Linux');
+
+        const windowsFp = parseTcpSyn(mockWindowsSynPacket);
+        expect(classifyTcpOs(windowsFp)).toBe('Windows');
+    });
+
+    it('should calculate correct TCP/IP anomaly scores', () => {
+        // Cas 1 : Le User-Agent prétend être Windows, mais la pile TCP/IP est Linux
+        const contextAnomaly = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0',
+            },
+            rawTcpBinary: mockLinuxSynPacket
+        };
+        expect(getTcpAnomalyScore(contextAnomaly).tcpAnomalyScore).toBe(80.1);
+
+        // Cas 2 : Cohérence complète (UA Windows et pile TCP/IP Windows)
+        const contextCoherent = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0',
+            },
+            rawTcpBinary: mockWindowsSynPacket
+        };
+        expect(getTcpAnomalyScore(contextCoherent).tcpAnomalyScore).toBe(0);
+    });
+});