@anonympins/fingerprint 0.4.4 → 0.4.6

package/src/js/tests/ip-reputation.test.js

@@ -1,132 +1,142 @@
-import {beforeEach, describe, expect, it} from 'vitest';
-import {__internal, configureStore, FingerprintEngine} from '../fingerprint.js';
-
-describe('IP Reputation Local System (Node.js)', () => {
-    let mockStore;
-
-    beforeEach(() => {
-        mockStore = {
-            _map: new Map(),
-            async get(key) { return this._map.get(key); },
-            async set(key, value) { this._map.set(key, value); },
-            async has(key) { return this._map.has(key); },
-            async delete(key) { this._map.delete(key); }
-        };
-        configureStore(mockStore);
-    });
-
-    it('should return a default score of 0 for unknown IPs', async () => {
-        const score = await __internal.getIpReputationScore('1.1.1.1');
-        expect(score).toBe(0);
-    });
-
-    it('should correctly increment and decrement score values', async () => {
-        const ip = '192.168.1.1';
-        await __internal.updateIpReputationScore(ip, 30);
-        let score = await __internal.getIpReputationScore(ip);
-        expect(score).toBe(30);
-
-        await __internal.updateIpReputationScore(ip, -10);
-        score = await __internal.getIpReputationScore(ip);
-        expect(score).toBe(20);
-    });
-
-    it('should clamp the reputation score within bounds [0, 100]', async () => {
-        const ip = '10.0.0.1';
-        await __internal.updateIpReputationScore(ip, 150);
-        let score = await __internal.getIpReputationScore(ip);
-        expect(score).toBe(100);
-
-        await __internal.updateIpReputationScore(ip, -200);
-        score = await __internal.getIpReputationScore(ip);
-        expect(score).toBe(0);
-    });
-
-    it('should apply passive decay of 2 points per hour of inactivity', async () => {
-        const ip = '172.16.0.1';
-        const now = Date.now();
-        
-        // Simulation d'un score de 50 mis à jour il y a 3 heures (3h * 2 points/heure = 6 points de perte)
-        await mockStore.set(`ip-reputation:${ip}`, {
-            score: 50,
-            lastUpdate: now - (3 * 60 * 60 * 1000)
-        });
-
-        const score = await __internal.getIpReputationScore(ip);
-        expect(score).toBe(44);
-    });
-
-    it('should integrate ipReputationScore into the final score calculation', async () => {
-        const ip = '1.2.3.4';
-        await __internal.updateIpReputationScore(ip, 60); // Set IP reputation to 60
-
-        const mockSecurityConfig = {
-            weights: {
-                ipReputationScore: 0.5, // Give it a weight
-                historyScore: 0.0, // Other weights to 0 for isolation
-                rotationScore: 0.0,
-                headerAnomalyScore: 0.0,
-                requestPatternScore: 0.0,
-                inconsistencyScore: 0.0,
-                honeypotScore: 0.0,
-                behaviorScore: 0.0,
-                botScore: 0.0,
-                crossLayerInconsistencyScore: 0.0,
-                tlsSpoofingScore: 0.0,
-                timeInconsistencyScore: 0.0,
-                clickVarianceScore: 0.0,
-                clientHintsInconsistencyScore: 0.0,
-                subnetScore: 0.0,
-            },
-            thresholds: { low: 0, medium: 0, high: 0, block: 100 }, // Irrelevant for this test
-        };
-
-        const ipRepScore = await __internal.getIpReputationScore(ip);
-        const suspicionVector = { ipReputationScore: ipRepScore };
-
-        const engine = new FingerprintEngine(mockSecurityConfig);
-        const finalScore = engine.calculateFinalScore(suspicionVector);
-
-        // Expected score: 60 (ipRepScore) * 0.5 (weight) = 30
-        expect(finalScore).toBe(30.0);
-    });
-
-    it('should return correct subnet for IPv4 and IPv6', async () => {
-        const ipv4Subnet = __internal.getIpSubnet('192.168.1.50', 24, 48);
-        expect(ipv4Subnet).toBe('192.168.1.0/24');
-
-        const ipv6Subnet = __internal.getIpSubnet('2001:db8:abcd:12::1', 24, 48);
-        expect(ipv6Subnet).toBe('2001:db8:abcd:0:0:0:0:0/48');
-    });
-
-    it('should calculate client hints inconsistency score correctly', async () => {
-        const mockContextMismatch = {
-            headers: {
-                'user-agent': 'Mozilla/5.0 Firefox/117.0',
-                'sec-ch-ua': '"Google Chrome";v="117"'
-            }
-        };
-        const scoreMismatch = __internal.getClientHintsInconsistencyScore(mockContextMismatch);
-        expect(scoreMismatch.clientHintsInconsistencyScore).toBe(90);
-
-        const mockContextVersionDrift = {
-            headers: {
-                'user-agent': 'Mozilla/5.0 Chrome/110.0',
-                'sec-ch-ua': '"Google Chrome";v="117"'
-            }
-        };
-        const scoreVersionDrift = __internal.getClientHintsInconsistencyScore(mockContextVersionDrift);
-        expect(scoreVersionDrift.clientHintsInconsistencyScore).toBe(80);
-    });
-
-    it('should integrate subnet history into subnet score', async () => {
-        const mockContext = { clientIp: '192.168.1.50' };
-        let score = await __internal.getSubnetScore(mockContext);
-        expect(score.subnetScore).toBe(0);
-        for (let i = 1; i <= 12; i++) {
-            await __internal.updateSubnetMetrics(mockContext, `dev-${i}`, 40);
-        }
-        score = await __internal.getSubnetScore(mockContext);
-        expect(score.subnetScore).toBeGreaterThan(0);
-    });
+import {beforeEach, describe, expect, it} from 'vitest';
+import {__internal, configureStore, FingerprintEngine} from '../fingerprint.js';
+
+describe('IP Reputation Local System (Node.js)', () => {
+    let mockStore;
+
+    beforeEach(() => {
+        mockStore = {
+            _map: new Map(),
+            async get(key) { return this._map.get(key); },
+            async set(key, value) { this._map.set(key, value); },
+            async has(key) { return this._map.has(key); },
+            async delete(key) { this._map.delete(key); }
+        };
+        configureStore(mockStore);
+    });
+
+    it('should return a default score of 0 for unknown IPs', async () => {
+        const score = await __internal.getIpReputationScore('1.1.1.1');
+        expect(score).toBe(0);
+    });
+
+    it('should correctly increment and decrement score values', async () => {
+        const ip = '192.168.1.1';
+        await __internal.updateIpReputationScore(ip, 30);
+        let score = await __internal.getIpReputationScore(ip);
+        expect(score).toBe(30);
+
+        await __internal.updateIpReputationScore(ip, -10);
+        score = await __internal.getIpReputationScore(ip);
+        expect(score).toBe(20);
+    });
+
+    it('should clamp the reputation score within bounds [0, 100]', async () => {
+        const ip = '10.0.0.1';
+        await __internal.updateIpReputationScore(ip, 150);
+        let score = await __internal.getIpReputationScore(ip);
+        expect(score).toBe(100);
+
+        await __internal.updateIpReputationScore(ip, -200);
+        score = await __internal.getIpReputationScore(ip);
+        expect(score).toBe(0);
+    });
+
+    it('should apply passive decay of 2 points per hour of inactivity', async () => {
+        const ip = '172.16.0.1';
+        const now = Date.now();
+        
+        // Simulation d'un score de 50 mis à jour il y a 3 heures (3h * 2 points/heure = 6 points de perte)
+        await mockStore.set(`ip-reputation:${ip}`, {
+            score: 50,
+            lastUpdate: now - (3 * 60 * 60 * 1000)
+        });
+
+        const score = await __internal.getIpReputationScore(ip);
+        expect(score).toBe(44);
+    });
+
+    it('should integrate ipReputationScore into the final score calculation', async () => {
+        const ip = '1.2.3.4';
+        await __internal.updateIpReputationScore(ip, 60); // Set IP reputation to 60
+
+        const mockSecurityConfig = {
+            weights: {
+                ipReputationScore: 0.5, // Give it a weight
+                historyScore: 0.0, // Other weights to 0 for isolation
+                rotationScore: 0.0,
+                headerAnomalyScore: 0.0,
+                requestPatternScore: 0.0,
+                inconsistencyScore: 0.0,
+                honeypotScore: 0.0,
+                behaviorScore: 0.0,
+                botScore: 0.0,
+                crossLayerInconsistencyScore: 0.0,
+                tlsSpoofingScore: 0.0,
+                timeInconsistencyScore: 0.0,
+                clickVarianceScore: 0.0,
+                clientHintsInconsistencyScore: 0.0,
+                subnetScore: 0.0,
+            },
+            thresholds: { low: 0, medium: 0, high: 0, block: 100 }, // Irrelevant for this test
+        };
+
+        const ipRepScore = await __internal.getIpReputationScore(ip);
+        const suspicionVector = { ipReputationScore: ipRepScore };
+
+        const engine = new FingerprintEngine(mockSecurityConfig);
+        const finalScore = engine.calculateFinalScore(suspicionVector);
+
+        // Expected score: 60 (ipRepScore) * 0.5 (weight) = 30
+        expect(finalScore).toBe(30.0);
+    });
+
+    it('should return correct subnet for IPv4 and IPv6', async () => {
+        const ipv4Subnet = __internal.getIpSubnet('192.168.1.50', 24, 48);
+        expect(ipv4Subnet).toBe('192.168.1.0/24');
+
+        const ipv6Subnet = __internal.getIpSubnet('2001:db8:abcd:12::1', 24, 48);
+        expect(ipv6Subnet).toBe('2001:db8:abcd:0:0:0:0:0/48');
+    });
+
+    it('should calculate client hints inconsistency score correctly', async () => {
+        const mockContextMismatch = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 Firefox/117.0',
+                'sec-ch-ua': '"Google Chrome";v="117"'
+            }
+        };
+        const scoreMismatch = __internal.getClientHintsInconsistencyScore(mockContextMismatch);
+        expect(scoreMismatch.clientHintsInconsistencyScore).toBe(90);
+
+        const mockContextVersionDrift = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 Chrome/110.0',
+                'sec-ch-ua': '"Google Chrome";v="117"'
+            }
+        };
+        const scoreVersionDrift = __internal.getClientHintsInconsistencyScore(mockContextVersionDrift);
+        expect(scoreVersionDrift.clientHintsInconsistencyScore).toBe(80);
+
+        const mockContextFullVersionMismatch = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.1.2 Safari/537.36',
+                'sec-ch-ua': '"Not_A Brand";v="8", "Chromium";v="120", "Google Chrome";v="120"',
+                'sec-ch-ua-full-version-list': '"Not_A Brand";v="8.0.0.0", "Chromium";v="120.0.1.3", "Google Chrome";v="120.0.1.3"'
+            }
+        };
+        const scoreFullVersionMismatch = __internal.getClientHintsInconsistencyScore(mockContextFullVersionMismatch);
+        expect(scoreFullVersionMismatch.clientHintsInconsistencyScore).toBe(85);
+    });
+
+    it('should integrate subnet history into subnet score', async () => {
+        const mockContext = { clientIp: '192.168.1.50' };
+        let score = await __internal.getSubnetScore(mockContext);
+        expect(score.subnetScore).toBe(0);
+        for (let i = 1; i <= 12; i++) {
+            await __internal.updateSubnetMetrics(mockContext, `dev-${i}`, 40);
+        }
+        score = await __internal.getSubnetScore(mockContext);
+        expect(score.subnetScore).toBeGreaterThan(0);
+    });
 });

package/src/js/tests/tcpFingerprint.test.js

@@ -0,0 +1,78 @@
+import { describe, expect, it } from 'vitest';
+import { __internal } from '../fingerprint.js';
+
+const { parseTcpSyn, classifyTcpOs, getTcpAnomalyScore } = __internal;
+
+describe('Passive TCP/IP Fingerprinting (Type p0f)', () => {
+    
+    // Mock d'un paquet IP + TCP SYN d'un système Linux (TTL=64, WS=7)
+    const mockLinuxSynPacket = Buffer.from([
+        0x45, 0x00, 0x00, 0x3c, 0x1a, 0x2b, 0x40, 0x00, 
+        0x40, 0x06, 0x3c, 0x1a, 0x7f, 0x00, 0x00, 0x01, // TTL=0x40 (64)
+        0x7f, 0x00, 0x00, 0x01, 
+        0x1f, 0x90, 0x00, 0x50, 0x00, 0x00, 0x00, 0x01, 
+        0x00, 0x00, 0x00, 0x00, 0xa0, 0x02, 0x72, 0x10, // Window=0x7210 (29200), TCP header len = 40 (0xa0)
+        0x3c, 0x1a, 0x00, 0x00,
+        0x02, 0x04, 0x05, 0xb4, // Option MSS: 1460 (0x05b4)
+        0x04, 0x02,             // Option SACK Permitted
+        0x01,                   // NOP
+        0x03, 0x03, 0x07        // Option WS: 7
+    ]);
+
+    // Mock d'un paquet IP + TCP SYN d'un système Windows (TTL=128, WS=8)
+    const mockWindowsSynPacket = Buffer.from([
+        0x45, 0x00, 0x00, 0x3c, 0x1a, 0x2b, 0x40, 0x00, 
+        0x80, 0x06, 0x3c, 0x1a, 0x7f, 0x00, 0x00, 0x01, // TTL=0x80 (128)
+        0x7f, 0x00, 0x00, 0x01, 
+        0x1f, 0x90, 0x00, 0x50, 0x00, 0x00, 0x00, 0x01, 
+        0x00, 0x00, 0x00, 0x00, 0xa0, 0x02, 0xfa, 0xf0, // Window=64240 (0xfaf0)
+        0x3c, 0x1a, 0x00, 0x00,
+        0x02, 0x04, 0x05, 0xb4, // Option MSS: 1460 (0x05b4)
+        0x04, 0x02,             // Option SACK Permitted
+        0x01,                   // NOP
+        0x03, 0x03, 0x08        // Option WS: 8
+    ]);
+
+    it('should correctly parse raw TCP SYN binary packets', () => {
+        const linuxFp = parseTcpSyn(mockLinuxSynPacket);
+        expect(linuxFp).not.toBeNull();
+        expect(linuxFp.ttl).toBe(64);
+        expect(linuxFp.windowSize).toBe(29200);
+        expect(linuxFp.mss).toBe(1460);
+        expect(linuxFp.ws).toBe(7);
+        expect(linuxFp.sack).toBe(true);
+
+        const windowsFp = parseTcpSyn(mockWindowsSynPacket);
+        expect(windowsFp.ttl).toBe(128);
+        expect(windowsFp.windowSize).toBe(64240);
+        expect(windowsFp.ws).toBe(8);
+    });
+
+    it('should classify OS correctly based on parsed parameters', () => {
+        const linuxFp = parseTcpSyn(mockLinuxSynPacket);
+        expect(classifyTcpOs(linuxFp)).toBe('Linux');
+
+        const windowsFp = parseTcpSyn(mockWindowsSynPacket);
+        expect(classifyTcpOs(windowsFp)).toBe('Windows');
+    });
+
+    it('should calculate correct TCP/IP anomaly scores', () => {
+        // Cas 1 : Le User-Agent prétend être Windows, mais la pile TCP/IP est Linux
+        const contextAnomaly = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0',
+            },
+            rawTcpBinary: mockLinuxSynPacket
+        };
+        expect(getTcpAnomalyScore(contextAnomaly).tcpAnomalyScore).toBe(80.1);
+
+        // Cas 2 : Cohérence complète (UA Windows et pile TCP/IP Windows)
+        const contextCoherent = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0',
+            },
+            rawTcpBinary: mockWindowsSynPacket
+        };
+        expect(getTcpAnomalyScore(contextCoherent).tcpAnomalyScore).toBe(0);
+    });
+});

package/src/php/AutoTuner.php

@@ -77,7 +77,7 @@ class AutoTuner
 
         echo sprintf("[AutoTuning] Démarrage du cycle d'optimisation complet avec %d points de données assainis.\n", count($sanitizedData));
 
-        $paretoFront = OptimizationOperators::solveFullSecurityTuning(['trafficData' => $sanitizedData]);
+        $paretoFront = OptimizationOperators::solveFullSecurityTuning(['trafficData' => $sanitizedData, 'currentConfig' => $this->securityConfig], []);
 
         if (empty($paretoFront)) {
             echo "[AutoTuning] L'optimisation n'a retourné aucune solution.\n";

package/src/php/Challenge/ChallengeUtils.php

@@ -5,6 +5,7 @@ declare(strict_types=1);
 namespace Anonympins\Fingerprint\Challenge;
 
 use Anonympins\Fingerprint\Store\StoreManager;
+use Anonympins\Fingerprint\FingerprintBuilder;
 use Anonympins\Fingerprint\Utils\BigInt;
 use Anonympins\Fingerprint\Utils\RequestUtils;
 
@@ -23,6 +24,65 @@ class ChallengeUtils
         '/.git/config_{RANDOM}'
     ];
 
+    private static function imul(int $a, int $b): int
+    {
+        $ah = ($a >> 16) & 0xffff;
+        $al = $a & 0xffff;
+        $bh = ($b >> 16) & 0xffff;
+        $bl = $b & 0xffff;
+        $lo = $al * $bl;
+        $hi = (($lo >> 16) + ($al * $bh) + ($ah * $bl)) & 0xffff;
+        return (($hi << 16) | ($lo & 0xffff)) | 0;
+    }
+
+    private static function generateBlock(string $seed, int $blockIndex, int $blockSize = 1024): string
+    {
+        $block = str_repeat("\x00", $blockSize);
+        $h = FingerprintBuilder::cyrb53($seed . ":" . $blockIndex);
+        
+        $h_int = (int)bcmod($h, '4294967296');
+        for ($i = 0; $i < $blockSize; $i++) {
+            $h_int = self::imul($h_int ^ $i, 1597334677);
+            $block[$i] = chr($h_int & 0xff);
+        }
+        return $block;
+    }
+
+    public static function generateSpaceChallenge(string $clientIp, string $nonce, float $suspicionFactor, string $originalUrl, array $securityConfig): array
+    {
+        $pospaceConfig = $securityConfig['pospace'] ?? [];
+        $sizeMb = $pospaceConfig['sizeMb'] ?? 100;
+        $numQueries = $pospaceConfig['numQueries'] ?? 10;
+
+        $queries = [];
+        $maxBlocks = $sizeMb * 1024;
+        while (count($queries) < $numQueries) {
+            $idx = random_int(0, $maxBlocks - 1);
+            if (!in_array($idx, $queries, true)) {
+                $queries[] = $idx;
+            }
+        }
+
+        return [
+            'type' => 'pospace',
+            'nonce' => $nonce,
+            'sizeMb' => $sizeMb,
+            'queries' => $queries,
+            'path' => $originalUrl
+        ];
+    }
+
+    public static function verifySpacePoW(string $nonce, string $solution, array $queries, string $seed, string $clientSecret): bool
+    {
+        $combined = '';
+        foreach ($queries as $idx) {
+            $combined .= self::generateBlock($seed, (int)$idx);
+        }
+        $finalBlock = $combined . $nonce . ":" . $clientSecret;
+        $hash = hash('sha256', $finalBlock);
+        return hash_equals($hash, $solution);
+    }
+
     /**
      * Récupère la clé secrète pour les PoW depuis les variables d'environnement.
      */
@@ -35,6 +95,52 @@ class ChallengeUtils
         return $secret ?: "fallback-dev-secret-32-chars-minimum";
     }
 
+    /**
+     * Génère un ticket stateless chiffré et signé contenant le contexte d'autorisation.
+     * @param array $payload
+     * @return string
+     */
+    public static function generateStatelessTicket(array $payload): string
+    {
+        $key = hash('sha256', self::getPowSecret(), true);
+        $iv = random_bytes(16);
+        $encrypted = openssl_encrypt(json_encode($payload), 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
+        $signature = hash_hmac('sha256', $iv . $encrypted, $key, true);
+        
+        return rtrim(strtr(base64_encode($iv), '+/', '-_'), '=') . '.' .
+               rtrim(strtr(base64_encode($encrypted), '+/', '-_'), '=') . '.' .
+               rtrim(strtr(base64_encode($signature), '+/', '-_'), '=');
+    }
+
+    /**
+     * Décode et valide un ticket stateless chiffré et signé.
+     * @param string $ticket
+     * @return array|null
+     */
+    public static function parseStatelessTicket(string $ticket): ?array
+    {
+        $parts = explode('.', $ticket);
+        if (count($parts) !== 3) {
+            return null;
+        }
+        $base64UrlDecode = function ($input) {
+            return base64_decode(strtr($input, '-_', '+/'));
+        };
+        $iv = $base64UrlDecode($parts[0]);
+        $encrypted = $base64UrlDecode($parts[1]);
+        $signature = $base64UrlDecode($parts[2]);
+        if (!$iv || !$encrypted || !$signature || strlen($iv) !== 16) {
+            return null;
+        }
+        $key = hash('sha256', self::getPowSecret(), true);
+        $expectedSignature = hash_hmac('sha256', $iv . $encrypted, $key, true);
+        if (!hash_equals($expectedSignature, $signature)) {
+            return null;
+        }
+        $decrypted = openssl_decrypt($encrypted, 'aes-256-cbc', $key, OPENSSL_RAW_DATA, $iv);
+        return $decrypted !== false ? json_decode($decrypted, true) : null;
+    }
+
     /**
      * Vérifie si un ticket de passage est valide (supporte les tickets opaques via store et le fallback legacy).
      */
@@ -49,6 +155,31 @@ class ChallengeUtils
             return false;
         }
 
+        // Tentative de validation stateless d'abord
+        $ticketData = self::parseStatelessTicket($ticket);
+        if ($ticketData !== null) {
+            $expiry = $ticketData['expiry'] ?? null;
+            $originalIp = $ticketData['originalIp'] ?? null;
+            $storedDeviceId = $ticketData['deviceId'] ?? '';
+            $storedDeviceHash = $ticketData['deviceHash'] ?? '';
+
+            if (!$expiry || (int)floor(microtime(true) * 1000) > (int)$expiry) {
+                return false;
+            }
+            if ($ip === $originalIp) {
+                return true;
+            }
+            $currentSubnet = RequestUtils::getIpSubnet($ip);
+            $originalSubnet = RequestUtils::getIpSubnet($originalIp);
+            if ($currentSubnet !== null && $originalSubnet !== null && $currentSubnet === $originalSubnet) {
+                return true;
+            }
+            if (!$allowCrossNetworkRoaming) {
+                return false;
+            }
+            return !empty($deviceId) && $deviceId === $storedDeviceId && !empty($deviceHash) && $deviceHash === $storedDeviceHash;
+        }
+
         $store = StoreManager::getStore();
         $ticketData = $store->get("ticket:{$ticket}");
 
@@ -152,27 +283,21 @@ class ChallengeUtils
         $finalBlock = $baseBlock . $solution;
         $hash = hash('sha256', $finalBlock);
 
-        $hashAsInt = BigInt::fromHex($hash);
-        $targetAsInt = BigInt::fromHex($cpuTargetHex);
-
-        $isValid = $hashAsInt->compareTo($targetAsInt) < 0;
+        // Pad target to 64 hex characters to allow direct O(1) lexicographical comparison
+        $paddedTarget = str_pad($cpuTargetHex, 64, '0', STR_PAD_LEFT);
+        $isValid = strcmp($hash, $paddedTarget) < 0;
 
         if ($isValid) {
             error_log('[FP Server Verify] CPU PoW verification PASSED.');
             
-            // Génération d'un jeton opaque et unique
-            $ticketId = bin2hex(random_bytes(16));
             $expiry = (int)floor(microtime(true) * 1000) + $ticketTtl;
-            
-            $store = StoreManager::getStore();
-            $store->set("ticket:{$ticketId}", [
+            $payload = [
                 'expiry' => $expiry,
                 'originalIp' => $clientIp,
                 'deviceId' => $deviceId,
                 'deviceHash' => $deviceHash
-            ], (int)ceil($ticketTtl / 1000));
-            
-            return $ticketId;
+            ];
+            return self::generateStatelessTicket($payload);
         }
 
         // Log details on failure
@@ -336,6 +461,43 @@ class ChallengeUtils
         return file_get_contents($solverPath) ?: '';
     }
 
+    public static function generateSpaceChallengePage(array $challengeDetails, string $clientSecret, array $securityConfig): string
+    {
+        $nonce = $challengeDetails['nonce'];
+        $sizeMb = $challengeDetails['sizeMb'];
+        $queries = $challengeDetails['queries'];
+        $path = $challengeDetails['path'];
+
+        $solverCode = self::getPowSolverCode();
+        $queriesJson = json_encode($queries);
+
+        $challengeScript = <<<JS
+          async function solve() {
+            const nonce = "{$nonce}";
+            const path = "{$path}";
+            const clientSecret = "{$clientSecret}";
+            const queries = {$queriesJson};
+            const sizeMb = {$sizeMb};
+            
+            document.getElementById('loader').innerText = '⚙️ Checking persistent local storage...';
+            await new Promise(r => setTimeout(r, 10));
+            
+            try {
+                await window.initializeSpace(nonce + ":" + clientSecret, sizeMb);
+                document.getElementById('loader').innerText = '⚙️ Generating Proof of Space...';
+                const hash = await window.solveSpaceChallenge(nonce + ":" + clientSecret, queries, nonce, clientSecret);
+                
+                window.location.href = path + "?pow_type=pospace&pow_nonce=" + nonce + "&pow_solution_space=" + hash;
+            } catch(e) {
+                document.getElementById('loader').innerText = "Error initializing local storage: " + e.message;
+            }
+          }
+          solve();
+JS;
+
+        return "<html><head><title>Security Check</title></head><body style=\"font-family:sans-serif; text-align:center; padding-top:50px;\"><h1>Security Check (Level 2)</h1><p>We are verifying your storage allocation. This may take a few seconds on first load.</p><div id=\"loader\" style=\"margin:20px;\">⚙️ Initializing storage space...</div><script>{$solverCode}</script><script>{$challengeScript}</script></body></html>";
+    }
+
     /**
      * Génère le contenu HTML pour un challenge combiné CPU + Mémoire.
      * @param array $cpuChallengeDetails

package/src/php/Config/SecurityProfiles.php

@@ -40,6 +40,8 @@ class SecurityProfiles
                 'clickVarianceScore' => 0.6, // Poids pour la variance des clics
                 'subnetScore' => 0.5, // Pénalise les sous-réseaux IP avec une activité suspecte agrégée
                 'botnetClusterScore' => 0.6, // NOUVEAU: Poids pour le clustering botnet
+                'tcpAnomalyScore' => 0.8, // NEW: Anomalie de pile TCP/IP
+
             ],
             'thresholds' => ['low' => 20, 'medium' => 45, 'high' => 75, 'block' => 95],
             'patterns' => [
@@ -84,6 +86,8 @@ class SecurityProfiles
                 'clickVarianceScore' => 0.7, // High weight for click variance
                 'subnetScore' => 0.7, // Poids plus élevé en mode strict
                 'botnetClusterScore' => 0.8, // NOUVEAU: Poids pour le clustering botnet
+                'tcpAnomalyScore' => 1.0, // NEW: Anomalie de pile TCP/IP
+
             ],
             'thresholds' => ['low' => 10, 'medium' => 35, 'high' => 65, 'block' => 90],
             'patterns' => [
@@ -128,6 +132,8 @@ class SecurityProfiles
                 'clickVarianceScore' => 0.3, // Low weight as not applicable to APIs
                 'subnetScore' => 0.8, // Très important pour les API pour détecter les botnets
                 'botnetClusterScore' => 0.7, // NOUVEAU: Poids pour le clustering botnet
+                'tcpAnomalyScore' => 0.8, // NEW: Anomalie de pile TCP/IP
+
             ],
             'thresholds' => ['low' => 25, 'medium' => 50, 'high' => 80, 'block' => 95],
             'patterns' => [
@@ -174,6 +180,8 @@ class SecurityProfiles
                 'clickVarianceScore' => 0.5, // Moderate weight for click variance
                 'subnetScore' => 0.4, // Utile contre le spam de commentaires coordonné
                 'botnetClusterScore' => 0.5, // NOUVEAU: Poids pour le clustering botnet
+                'tcpAnomalyScore' => 0.5, // NEW: Anomalie de pile TCP/IP
+
             ],
             'thresholds' => ['low' => 25, 'medium' => 55, 'high' => 80, 'block' => 95],
             'patterns' => [
@@ -219,6 +227,8 @@ class SecurityProfiles
                 'clickVarianceScore' => 0.8, // Very high weight for click variance
                 'subnetScore' => 0.9, // Crucial contre les attaques de scalping distribuées
                 'botnetClusterScore' => 0.9, // NOUVEAU: Poids pour le clustering botnet
+                'tcpAnomalyScore' => 0.9, // NEW: Anomalie de pile TCP/IP
+
             ],
             'thresholds' => ['low' => 15, 'medium' => 40, 'high' => 70, 'block' => 90],
             'patterns' => [