@anonympins/fingerprint 0.5.0 → 0.5.1

package/CHANGELOG.md

@@ -1,3 +1,25 @@
+## Version 0.5.1
+
+### ✨ New Features
+
+- **GPU Proof-of-Work (PoW) Challenge**: Introduced a highly parallelized chaotic logistic map float computation challenge utilizing WebGPU (with a fallback to WebGL2). This challenge is specifically designed to exhaust CPU-based headless emulators (such as SwiftShader). It includes sample-based server-side verification to prevent DoS vectors.
+- **Biometric Keystroke Dynamics (Dwell & Flight Times)**: Introduced advanced behavioral biometric tracking by measuring key press duration (*dwell time*) and key-to-key transition intervals (*flight time*) to build a unique digraph/trigraph motor profile for the user.
+    - *Why it's a Killer Feature*: Automated text-injecting bots often simulate simple randomized delays between characters, but they fail to replicate natural human muscle memory patterns (such as ultra-fast cognitive transitions between adjacent keys on physical or virtual layouts). Server-side statistical checks (utilizing standard deviation, variance thresholds, and Benford's Law) immediately flag these robotic, uniform input patterns.
+- **Stealthy Honeypot Traps (Shadow DOM)**: Implemented a new honeypot mechanism that conceals trap links and form fields within a closed Shadow DOM, with dynamic rendering styles calculated by nested CSS variables. This makes them invisible to legitimate users and standard browser automation tools, but highly detectable by bots that inject specific JS or use complex selectors, significantly increasing their behavioral signature.
+- **Hot-Reloadable Security Configuration**: Enabled dynamic, in-memory updates of security configurations (weights, thresholds, patterns) without requiring a server restart. This ensures continuous adaptability to evolving threats (e.g., DDoS L7, scraping campaigns) without service interruption or latency.
+
+### 🚀 Improvements
+
+- **Display & Protocol Anomaly Scoring**: Fully integrated `renderingAnomalyScore` and `quicAnomalyScore` across all backend engines (Node.js, PHP, Python). This enables real-time detection of virtual software framebuffers (like `Xvfb`) lacking physical V-Sync through jitter analysis, as well as HTTP/3 stream setting inconsistencies.
+- **Security Profile Tuning**: Integrated display and QUIC anomaly detectors into the default security profiles (`balanced`, `strict`, `blog`, `ecommerce`) with custom weights.
+- **Layout-Agnostic Client Tracking**: Enhanced the keystroke dynamics tracker to prioritize physical key locations (`KeyboardEvent.code`) over localized characters (`KeyboardEvent.key`), ensuring robust detection across different keyboard layouts (QWERTY, AZERTY) and virtual mobile keyboards.
+
+### 🐛 Bug Fixes
+
+- **Node.js 24 Test Suite Compatibility**: Fixed unit test suite execution and environment configuration issues specifically encountered on Node.js 24.
+
+---
+
 ## Version 0.5.0
 
 ### ✨ New Features

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anonympins/fingerprint",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "Advanced anti-bot library for Node.js using multi-layer fingerprinting (JA3, client-side, headers), behavioral analysis, and adaptive Proof-of-Work (PoW) challenges to mitigate scraping, scalping, and automated threats.",
   "main": "index.js",
   "type": "module",

package/src/js/fingerprint.client.js

@@ -340,6 +340,52 @@ const ClientLibrary = {
         document.addEventListener('touchend', handleTouch, { passive: true });
     },
 
+    /**
+     * Démarre le suivi de la régularité d'affichage (V-Sync/rAF) pour détecter les framebuffers logiciels sans V-Sync.
+     */
+    startRenderingTracker() {
+        if (this._renderingTrackerAttached) return;
+        this._renderingTrackerAttached = true;
+
+        if (typeof window === 'undefined' || !window.requestAnimationFrame) return;
+
+        const rAfTimestamps = [];
+        let lastTime = performance.now();
+        const maxSamples = 15;
+
+        const checkOffscreenAnom = () => {
+            try {
+                if ('OffscreenCanvas' in window && HTMLCanvasElement.prototype.transferControlToOffscreen) {
+                    const nativeToString = Function.prototype.toString.call(HTMLCanvasElement.prototype.transferControlToOffscreen);
+                    return !nativeToString.includes('[native code]');
+                }
+            } catch (e) {}
+            return false;
+        };
+
+        const loop = (time) => {
+            const delta = time - lastTime;
+            lastTime = time;
+            if (rAfTimestamps.length < maxSamples) {
+                if (rAfTimestamps.length > 0) { // Skip first delta
+                    rAfTimestamps.push(delta);
+                }
+                window.requestAnimationFrame(loop);
+            } else {
+                const avg = rAfTimestamps.reduce((a, b) => a + b, 0) / rAfTimestamps.length;
+                const sqDiffs = rAfTimestamps.map(v => Math.pow(v - avg, 2));
+                const avgSqDiff = sqDiffs.reduce((a, b) => a + b, 0) / sqDiffs.length;
+                
+                metrics.rendering = {
+                    fps: Math.round((1000 / avg) * 100) / 100,
+                    jitter: Math.round(Math.sqrt(avgSqDiff) * 100) / 100,
+                    offscreenAnom: checkOffscreenAnom()
+                };
+            }
+        };
+        window.requestAnimationFrame(loop);
+    },
+
     /**
      * Initialise l'espace Proof-of-Space persistant dans l'IndexedDB locale.
      */
@@ -449,27 +495,77 @@ const ClientLibrary = {
     },
 
     /**
-     * Démarre le suivi de la dynamique de frappe pour calculer la latence.
+     * Démarre le suivi de la dynamique de frappe pour calculer le dwell time et le flight time (digraphie/trigraphie).
      * À appeler une fois sur la page.
      */
     startKeystrokeDynamicsTracker() {
         // S'assurer de ne pas attacher l'écouteur plusieurs fois
-        if (keystrokeTimestamps.length > 0) return;
+        if (this._keystrokeTrackerAttached) return;
+        this._keystrokeTrackerAttached = true;
 
-        document.addEventListener('keydown', () => {
+        const activeKeys = new Map();
+        let lastKeyDownTime = 0;
+        let lastKeyName = '';
+
+        document.addEventListener('keydown', (e) => {
             const now = performance.now();
+            const key = e.key;
+            const code = e.code;
+            if (!key && !code) return;
+
+            const keyIdentifier = code || key;
+
+            // Prevent key repeat triggering multiple events
+            if (activeKeys.has(keyIdentifier)) return;
+            activeKeys.set(keyIdentifier, now);
+
             if (keystrokeTimestamps.length > 0) {
                 const lastTimestamp = keystrokeTimestamps[keystrokeTimestamps.length - 1];
                 const latency = now - lastTimestamp;
-                // On ignore les latences irréalistes (trop longues ou trop courtes)
-                if (latency > 10 && latency < 2000) { // Augmenté à 2s
+                if (latency > 10 && latency < 2000) {
                     if (keystrokeLatencies.length >= KEYSTROKE_HISTORY_MAX) {
-                        keystrokeLatencies.shift(); // Garder la taille de l'historique
+                        keystrokeLatencies.shift();
                     }
                     keystrokeLatencies.push(latency);
                 }
             }
             keystrokeTimestamps.push(now);
+
+            // Flight Time (KeyDown to KeyDown)
+            if (lastKeyDownTime > 0) {
+                const flightTime = now - lastKeyDownTime;
+                if (flightTime > 10 && flightTime < 2000) {
+                    if (keystrokeFlightTimes.length >= KEYSTROKE_HISTORY_MAX) {
+                        keystrokeFlightTimes.shift();
+                    }
+                    const digraph = lastKeyName ? this._hasher(lastKeyName + "_" + keyIdentifier).toString() : "unknown";
+                    keystrokeFlightTimes.push({ digraph, time: flightTime });
+                }
+            }
+            lastKeyDownTime = now;
+            lastKeyName = keyIdentifier;
+        }, {passive: true});
+
+        document.addEventListener('keyup', (e) => {
+            const now = performance.now();
+            const key = e.key;
+            const code = e.code;
+            if (!key && !code) return;
+
+            const keyIdentifier = code || key;
+
+            if (activeKeys.has(keyIdentifier)) {
+                const pressTime = activeKeys.get(keyIdentifier);
+                const dwellTime = now - pressTime;
+                activeKeys.delete(keyIdentifier);
+
+                if (dwellTime > 5 && dwellTime < 1000) {
+                    if (keystrokeDwellTimes.length >= KEYSTROKE_HISTORY_MAX) {
+                        keystrokeDwellTimes.shift();
+                    }
+                    keystrokeDwellTimes.push(dwellTime);
+                }
+            }
         }, {passive: true});
     },
 
@@ -509,22 +605,75 @@ const ClientLibrary = {
         });
         activeHoneypotListeners.clear();
 
-        // 2. Ajouter les nouveaux écouteurs
+        // 2. Ajouter les nouveaux écouteurs sur le DOM classique
         honeypotFieldNames.forEach(fieldName => {
             const field = document.querySelector(`[name="${fieldName}"]`);
             if (field) {
-                // On utilise une fonction nommée (ou une référence) pour pouvoir la supprimer plus tard.
-                // L'option { once: true } est excellente, mais pour une réinitialisation complète,
-                // il est plus propre de gérer le nettoyage nous-mêmes.
                 const listener = () => {
                     this.onHoneypotTrigger();
-                    // Se supprime lui-même après exécution, comme { once: true }
                     field.removeEventListener('input', listener);
                 };
                 field.addEventListener('input', listener);
                 activeHoneypotListeners.set(field, listener); // On stocke la référence
             }
         });
+
+        // 3. Générer des champs d'input pièges masqués dans un Shadow DOM fermé
+        if (typeof document !== 'undefined' && honeypotFieldNames.length > 0) {
+            const host = document.createElement('div');
+            host.setAttribute('aria-hidden', 'true');
+            host.style.position = 'absolute';
+            host.style.width = '0';
+            host.style.height = '0';
+            host.style.overflow = 'hidden';
+
+            const shadow = host.attachShadow({ mode: 'closed' });
+
+            const style = document.createElement('style');
+            style.textContent = `
+              :host {
+                --trap-pos-state: absolute;
+                --trap-off-val: -9999px;
+                --trap-vis-state: hidden;
+                --trap-scale-val: 0;
+              }
+              .shadow-form-wrapper {
+                position: var(--trap-pos-state);
+                left: var(--trap-off-val);
+                top: var(--trap-off-val);
+                visibility: var(--trap-vis-state);
+                transform: scale(var(--trap-scale-val));
+              }
+            `;
+            shadow.appendChild(style);
+
+            const wrapper = document.createElement('div');
+            wrapper.className = 'shadow-form-wrapper';
+
+            honeypotFieldNames.forEach(fieldName => {
+                const label = document.createElement('label');
+                label.textContent = fieldName;
+                const input = document.createElement('input');
+                input.type = 'text';
+                input.name = fieldName;
+                input.tabIndex = -1;
+                input.autocomplete = 'off';
+
+                const trigger = () => {
+                    this.onHoneypotTrigger();
+                };
+
+                input.addEventListener('input', trigger, { passive: true });
+                input.addEventListener('change', trigger, { passive: true });
+                input.addEventListener('focus', trigger, { passive: true });
+
+                wrapper.appendChild(label);
+                wrapper.appendChild(input);
+            });
+
+            shadow.appendChild(wrapper);
+            document.body.appendChild(host);
+        }
     },
 
     /**
@@ -544,6 +693,10 @@ const ClientLibrary = {
         // NOUVEAU: Inclure l'historique des mouvements de la souris pour une analyse côté serveur.
         metrics.mouseMovementsHistory = mouseMovementsHistory;
 
+        // NOUVEAU: Keystroke dynamics metrics (dwell and flight times)
+        metrics.keystrokeDwellTimes = keystrokeDwellTimes;
+        metrics.keystrokeFlightTimes = keystrokeFlightTimes;
+
         // Calcule la latence moyenne des frappes
         if (keystrokeLatencies.length > 0) {
             const sum = keystrokeLatencies.reduce((a, b) => a + b, 0);
@@ -672,24 +825,61 @@ const ClientLibrary = {
       return;
     }
 
-    const trapContainer = document.createElement('div');
-    trapContainer.setAttribute('aria-hidden', 'true');
-    trapContainer.style.position = 'absolute';
-    trapContainer.style.left = '-9999px';
-    trapContainer.style.top = '-9999px';
-      trapContainer.style.transform = 'scale(0)';
-      trapContainer.style.pointerEvents = 'none';
+    const host = document.createElement('div');
+    host.setAttribute('aria-hidden', 'true');
+    host.style.position = 'absolute';
+    host.style.width = '0';
+    host.style.height = '0';
+    host.style.overflow = 'hidden';
+
+    const shadow = host.attachShadow({ mode: 'closed' });
+
+    const style = document.createElement('style');
+    style.textContent = `
+      :host {
+        --trap-layout-pos: absolute;
+        --trap-offset-val: -9999px;
+        --trap-visibility-state: hidden;
+        --trap-scale-factor: 0;
+        --trap-ptr-events: none;
+      }
+      .shadow-trap-wrapper {
+        position: var(--trap-layout-pos);
+        left: var(--trap-offset-val);
+        top: var(--trap-offset-val);
+        visibility: var(--trap-visibility-state);
+        transform: scale(var(--trap-scale-factor));
+        pointer-events: var(--trap-ptr-events);
+      }
+      a {
+        color: transparent;
+        text-decoration: none;
+      }
+    `;
+    shadow.appendChild(style);
+
+    const wrapper = document.createElement('div');
+    wrapper.className = 'shadow-trap-wrapper';
 
-    urls.forEach((url,i) => {
+    urls.forEach((url, i) => {
       const link = document.createElement('a');
       link.href = url;
       link.rel = 'nofollow';
-      link.tabIndex = -1; // Make it unfocusable
-      link.innerHTML = `<span>&gt; ${i+1}</span>`; // SEO-insignificant content
-      trapContainer.appendChild(link);
+      link.tabIndex = -1;
+      link.innerHTML = `<span>&gt; ${i + 1}</span>`;
+
+      const trigger = () => {
+        this.onHoneypotTrigger();
+      };
+      link.addEventListener('click', trigger, { passive: true });
+      link.addEventListener('focus', trigger, { passive: true });
+      link.addEventListener('mouseover', trigger, { passive: true });
+
+      wrapper.appendChild(link);
     });
 
-    document.body.appendChild(trapContainer);
+    shadow.appendChild(wrapper);
+    document.body.appendChild(host);
   },
   /**
    * Intercepte une réponse de challenge JSON, le résout, et réessaie la requête.
@@ -749,6 +939,7 @@ const ClientLibrary = {
         keystrokes = true,
         clicks = true, // Add new option
         touches = true, // Nouveau paramètre tactiles
+            rendering = true,
             phantomTraps = true, // NOUVEAU
         honeypots = [],
         trapUrls = [], // Nouveau paramètre pour les URL pièges
@@ -773,6 +964,9 @@ const ClientLibrary = {
     if (touches) {
         this.startTouchEventTracker();
     }
+        if (rendering) {
+            this.startRenderingTracker();
+        }
         if (phantomTraps) {
             this.injectPhantomTraps();
         }
@@ -941,6 +1135,7 @@ const metrics = {
     honeypotInteraction: false,
     historyLength: 0,
     clientTimestamp: 0,
+    rendering: { fps: 0, jitter: 0, offscreenAnom: false },
 };
 
 let lastMousePos = { x: 0, y: 0 };
@@ -953,6 +1148,8 @@ const CLICKS_HISTORY_MAX = 50;
 let activeHoneypotListeners = new Map(); // Garde une trace des écouteurs actifs
 let keystrokeTimestamps = [];
 let keystrokeLatencies = []; // NOUVEAU: Tableau dédié pour les latences
+let keystrokeDwellTimes = [];
+let keystrokeFlightTimes = [];
 const KEYSTROKE_HISTORY_MAX = 20; // On garde l'historique des 20 dernières frappes
 
 
@@ -966,6 +1163,7 @@ export const startMouseEntropyTracker = ClientLibrary.startMouseEntropyTracker.b
 export const startKeystrokeDynamicsTracker = ClientLibrary.startKeystrokeDynamicsTracker.bind(ClientLibrary);
 export const startClickTracker = ClientLibrary.startClickTracker.bind(ClientLibrary);
 export const startTouchEventTracker = ClientLibrary.startTouchEventTracker.bind(ClientLibrary);
+export const startRenderingTracker = ClientLibrary.startRenderingTracker.bind(ClientLibrary);
 export const initializeHoneypots = ClientLibrary.initializeHoneypots.bind(ClientLibrary);
 export const getClientBehaviorMetrics = ClientLibrary.getClientBehaviorMetrics.bind(ClientLibrary);
 export const protectedFetch = ClientLibrary.protectedFetch.bind(ClientLibrary);

package/src/js/fingerprint.js

@@ -189,7 +189,82 @@ export function generateStatelessTicket(payload) {
   const signature = crypto.createHmac('sha256', key).update(Buffer.concat([iv, encrypted])).digest();
   return `${base64UrlEncode(iv)}.${base64UrlEncode(encrypted)}.${base64UrlEncode(signature)}`;
 }
+/**
+ * Détecte les anomalies de flux QUIC/HTTP3 par rapport au User-Agent.
+ * @private
+ * @param {object} context - Le contexte de la requête.
+ * @returns {{quicAnomalyScore: number}}
+ */
+function getQuicAnomalyScore(context) {
+    const quicFp = context.headers?.['x-quic-fp'] || context.quicFingerprint || null;
+    if (!quicFp || typeof quicFp !== 'string') {
+        return { quicAnomalyScore: 0.0 };
+    }
+
+    const parts = quicFp.split(';');
+    if (parts.length < 2) return { quicAnomalyScore: 0.0 };
+
+    const params = {};
+    parts[1].split(',').forEach(p => {
+        const kv = p.split('=');
+        if (kv.length === 2) params[kv[0]] = kv[1];
+    });
+    const priorityOrder = parts[2] || '';
+
+    const ua = context.headers?.['user-agent'] || '';
+    const uaParts = parseUserAgent(ua);
+    const browser = uaParts.browser;
+
+    if (!browser) return { quicAnomalyScore: 0.0 };
 
+    let anomaly = 0.0;
+    if (browser.startsWith('Chrome') || browser.startsWith('Edge')) {
+        const maxData = parseInt(params['1'] || '0', 10);
+        const maxStreams = parseInt(params['4'] || '0', 10);
+        if (maxData > 0 && maxData < 1048576) anomaly += 40.0;
+        if (maxStreams > 0 && maxStreams !== 100) anomaly += 30.0;
+        if (priorityOrder && !priorityOrder.includes('u=')) anomaly += 30.0;
+    } else if (browser.startsWith('Firefox')) {
+        const maxData = parseInt(params['1'] || '0', 10);
+        if (maxData > 0 && maxData > 5000000) anomaly += 40.0;
+    }
+
+    return { quicAnomalyScore: Math.max(0.0, Math.min(100.0, anomaly)) };
+}
+/**
+ * Détecte les anomalies de rendu (V-Sync, FPS, gigue) à partir des métriques d'affichage.
+ * @private
+ * @param {object} context - Le contexte de la requête.
+ * @returns {{renderingAnomalyScore: number}}
+ */
+function getRenderingAnomalyScore(context) {
+  const behaviorHeader = context.headers?.['x-behavior-metrics'];
+  if (!behaviorHeader) {
+    return { renderingAnomalyScore: 0.0 };
+  }
+  try {
+    const metrics = JSON.parse(behaviorHeader);
+    if (!metrics || !metrics.rendering) {
+      return { renderingAnomalyScore: 0.0 };
+    }
+    const rendering = metrics.rendering;
+    let score = 0.0;
+    if (rendering.offscreenAnom) {
+      score += 100.0;
+    }
+    const fps = parseFloat(rendering.fps || 0.0);
+    const jitter = parseFloat(rendering.jitter || 0.0);
+    if (fps > 250.0 || (fps > 0.0 && fps < 15.0)) {
+      score += 50.0;
+    }
+    if (jitter > 6.0) {
+      score += Math.min(80.0, (jitter - 6.0) * 10.0);
+    }
+    return { renderingAnomalyScore: Math.min(100.0, score) };
+  } catch (e) {
+    return { renderingAnomalyScore: 0.0 };
+  }
+}
 export function parseStatelessTicket(ticket) {
   try {
     if (ticket.startsWith('ed25519.')) {
@@ -304,7 +379,10 @@ const securityProfiles = {
             tlsSpoofingScore: 0.8, // NOUVEAU: Poids pour la détection de spoofing TLS
             subnetScore: 0.4, // NOUVEAU: Poids pour la réputation du sous-réseau
             ipReputationScore: 0.5, // NOUVEAU: Poids pour la réputation IP
-            botnetClusterScore: 0.6 // NOUVEAU: Poids pour le clustering botnet
+            botnetClusterScore: 0.6, // NOUVEAU: Poids pour le clustering botnet
+            tcpAnomalyScore: 0.8, // NEW: Anomalie de pile TCP/IP
+            quicAnomalyScore: 0.8, // NOUVEAU: Poids pour l'anomalie QUIC
+            renderingAnomalyScore: 0.8 // NOUVEAU: Poids pour l'anomalie de rendu
         },
         thresholds: { low: 20, medium: 45, high: 75, block: 95 },
         patterns: {
@@ -340,7 +418,8 @@ const securityProfiles = {
             tlsSpoofingScore: 1.0, // Plus agressif pour le spoofing TLS
             subnetScore: 0.5,
             ipReputationScore: 0.6, // NOUVEAU: Poids pour la réputation IP
-            botnetClusterScore: 0.8 // NOUVEAU: Poids pour le clustering botnet
+            botnetClusterScore: 0.8, // NOUVEAU: Poids pour le clustering botnet
+            renderingAnomalyScore: 1.0 // NOUVEAU: Poids pour l'anomalie de rendu
         },
         thresholds: { low: 10, medium: 35, high: 65, block: 90 },
         patterns: {
@@ -377,7 +456,9 @@ const securityProfiles = {
             tlsSpoofingScore: 0.7, // Important pour les API
             subnetScore: 0.4,
             ipReputationScore: 0.5, // NOUVEAU: Poids pour la réputation IP
-            botnetClusterScore: 0.7 // NOUVEAU: Poids pour le clustering botnet
+            botnetClusterScore: 0.7, // NOUVEAU: Poids pour le clustering botnet
+            tcpAnomalyScore: 0.8, // NEW: Anomalie de pile TCP/IP
+            quicAnomalyScore: 0.8 // NOUVEAU: Poids pour l'anomalie QUIC
         },
         thresholds: { low: 25, medium: 50, high: 80, block: 95 },
         patterns: {
@@ -415,7 +496,10 @@ const securityProfiles = {
             tlsSpoofingScore: 0.6, // Moins critique pour les blogs
             subnetScore: 0.2,
             ipReputationScore: 0.3, // NOUVEAU: Poids pour la réputation IP
-            botnetClusterScore: 0.5 // NOUVEAU: Poids pour le clustering botnet
+            botnetClusterScore: 0.5, // NOUVEAU: Poids pour le clustering botnet
+            tcpAnomalyScore: 0.5, // NEW: Anomalie de pile TCP/IP
+            quicAnomalyScore: 0.5, // NOUVEAU: Poids pour l'anomalie QUIC
+            renderingAnomalyScore: 0.5 // NOUVEAU: Poids pour l'anomalie de rendu
         },
         thresholds: { low: 25, medium: 55, high: 80, block: 95 },
         patterns: {
@@ -452,7 +536,10 @@ const securityProfiles = {
             tlsSpoofingScore: 0.9, // Très important pour l'e-commerce
             subnetScore: 0.5,
             ipReputationScore: 0.6, // NOUVEAU: Poids pour la réputation IP
-            botnetClusterScore: 0.9 // NOUVEAU: Poids pour le clustering botnet
+            botnetClusterScore: 0.9, // NOUVEAU: Poids pour le clustering botnet
+            tcpAnomalyScore: 0.9, // NEW: Anomalie de pile TCP/IP
+            quicAnomalyScore: 0.9, // NOUVEAU: Poids pour l'anomalie QUIC
+            renderingAnomalyScore: 0.9 // NOUVEAU: Poids pour l'anomalie de rendu
         },
         thresholds: { low: 15, medium: 40, high: 70, block: 90 },
         patterns: {
@@ -1600,6 +1687,41 @@ function getBehaviorScore(context) {
     if (metrics.keystrokeLatency > 0 && metrics.keystrokeLatency < 40) score += 25; // Frappe trop rapide pour un humain.
     if (metrics.keystrokeLatency > 1000) score += 15; // Latence très élevée, peut être un script lent.
 
+    // NOUVEAU: Analyse de digraphie/trigraphie (dwell & flight times)
+    const dwellTimes = metrics.keystrokeDwellTimes || [];
+    const flightTimes = metrics.keystrokeFlightTimes || [];
+
+    if (dwellTimes.length >= 5) {
+        const meanDwell = dwellTimes.reduce((a, b) => a + b, 0) / dwellTimes.length;
+        const varDwell = dwellTimes.reduce((a, b) => a + Math.pow(b - meanDwell, 2), 0) / dwellTimes.length;
+        const stdDevDwell = Math.sqrt(varDwell);
+
+        if (stdDevDwell < 2.0) {
+            score += 35; // Suspicion d'automatisation (pas de variation humaine de pression)
+        }
+        if (meanDwell < 15.0) {
+            score += 25; // Dwell time irréaliste
+        }
+    }
+
+    if (flightTimes.length >= 5) {
+        const times = flightTimes.map(f => f.time);
+        const meanFlight = times.reduce((a, b) => a + b, 0) / times.length;
+        const varFlight = times.reduce((a, b) => a + Math.pow(b - meanFlight, 2), 0) / times.length;
+        const stdDevFlight = Math.sqrt(varFlight);
+
+        if (stdDevFlight < 3.0) {
+            score += 35; // Pas de variation de transition (flight time robotique)
+        }
+        if (meanFlight < 25.0) {
+            score += 25; // Transitions trop rapides
+        }
+        const benfordDev = Optimization.Operators.benfordTest(times);
+        if (benfordDev > 0.18) {
+            score += 30; // Les intervalles ne suivent pas la loi de Benford
+        }
+    }
+
     // 4. Analyse de la distribution avec la loi de Benford (si les valeurs sont non nulles).
     if (segments.length > 10) {
         const benfordDeviation = Optimization.Operators.benfordTest(segments);
@@ -2766,8 +2888,9 @@ export const getSuspicionVector = async (context, securityConfig) => {
   const stableFp = extractStablePart(currentDeviceHash);
   const stableFpHash = cyrb53(stableFp).toString();
   const { botnetClusterScore } = await getBotnetClusterScore(context, stableFpHash);
-
-    const { tcpAnomalyScore } = getTcpAnomalyScore(context);
+  const { tcpAnomalyScore } = getTcpAnomalyScore(context);
+  const { quicAnomalyScore } = getQuicAnomalyScore(context);
+  const { renderingAnomalyScore } = getRenderingAnomalyScore(context);
 
   // Save the updated device state to the store
   // Note: deviceData.ips is a Set, which may not serialize correctly in all stores (e.g., JSON). A Redis store should handle this via custom serialization or by converting to an array.
@@ -2779,7 +2902,7 @@ export const getSuspicionVector = async (context, securityConfig) => {
       deviceData.ips = new Set(deviceData.ips);
   }
   // Le vecteur de suspicion est maintenant complet.
-  return { ...behavioral, headerAnomalyScore, inconsistencyScore, behaviorScore, honeypotScore, botScore, requestPatternScore, crossLayerInconsistencyScore, timeInconsistencyScore, tlsSpoofingScore, clickVarianceScore, clientHintsInconsistencyScore, subnetScore, ipReputationScore, botnetClusterScore, tcpAnomalyScore };
+  return { ...behavioral, headerAnomalyScore, inconsistencyScore, behaviorScore, honeypotScore, botScore, requestPatternScore, crossLayerInconsistencyScore, timeInconsistencyScore, tlsSpoofingScore, clickVarianceScore, clientHintsInconsistencyScore, subnetScore, ipReputationScore, botnetClusterScore, tcpAnomalyScore, quicAnomalyScore, renderingAnomalyScore };
 };
 
 // A residential user can change networks (home, 4G, public wifi).
@@ -3144,6 +3267,18 @@ export class FingerprintEngine {
     this.dryRun = finalConfig.dryRun || false;
   }
 
+  /**
+   * Applique à chaud une nouvelle configuration de sécurité (poids, seuils, etc.)
+   * sans nécessiter de redémarrage.
+   * @param {object} newConfig - La nouvelle configuration partielle ou complète.
+   */
+  updateConfig(newConfig) {
+    this._validateConfig(newConfig);
+    this.securityConfig = deepMerge(this.securityConfig, newConfig);
+    this.dryRun = this.securityConfig.dryRun || false;
+    this._log('Configuration mise à jour à chaud (Hot-Reloaded)', this.securityConfig);
+  }
+
   /**
    * Validates the security configuration object to detect potential typos or missing essential keys.
    * @private
@@ -3208,7 +3343,9 @@ export class FingerprintEngine {
             (suspicionVector.clientHintsInconsistencyScore || 0) * (weights.clientHintsInconsistencyScore || 0) +
             (suspicionVector.subnetScore || 0) * (weights.subnetScore || 0) +
             (suspicionVector.ipReputationScore || 0) * (weights.ipReputationScore || 0) +
-            (suspicionVector.tcpAnomalyScore || 0) * (weights.tcpAnomalyScore || 0);
+            (suspicionVector.tcpAnomalyScore || 0) * (weights.tcpAnomalyScore || 0) +
+            (suspicionVector.quicAnomalyScore || 0) * (weights.quicAnomalyScore || 0) + // NOUVEAU: QUIC Anomaly
+            (suspicionVector.renderingAnomalyScore || 0) * (weights.renderingAnomalyScore || 0); // NOUVEAU: Rendering Anomaly
 
         return Math.min(100, score);
     }
@@ -5186,6 +5323,8 @@ export const __internal = {
     parseTcpSyn, // Expose for testing
     classifyTcpOs, // Expose for testing
     getTcpAnomalyScore, // Expose for testing,
+    getQuicAnomalyScore, // NOUVEAU: Expose pour les tests
+    getRenderingAnomalyScore, // NOUVEAU: Expose pour les tests
     registerCooperativeNode,
     findPeerInSubnet,
     handleCooperativeRequest