@anonympins/fingerprint 0.6.1 → 0.6.4

package/src/js/library.js

@@ -1551,23 +1551,72 @@ Optimization.Operators.solveFraudDetection = (context, options = {}) => {
  * @param {Array<object>} config.trafficData - Données de trafic collectées.
  * @returns {function(object): number[]} Une fonction de fitness qui prend une configuration complète et retourne les scores [taux de faux positifs, taux de faux négatifs].
  */
-Optimization.Operators.createFullSecurityConfigEvaluator = ({ trafficData }) => {
-  // Un "individu" est un objet de configuration complet
-  // { thresholds: { low, medium, high }, weights: { historyScore, ... }, patterns: { velocityThreshold, ... } }
+Optimization.Operators.createFullSecurityConfigEvaluator = (context) => {
+  const trafficData = context.trafficData || [];
+  const currentConfig = context.currentConfig || null;
+
+  // Ancres immuables (Baseline Anchors) pour forcer le calibrage d'échelle de suspicion
+  const STATIC_ANCHORS = [
+    {
+      type: 'request_passed',
+      weight: 15.0,
+      vector: {
+        historyScore: 0, rotationScore: 0, headerAnomalyScore: 0, requestPatternScore: 0,
+        inconsistencyScore: 0, behaviorScore: 0, honeypotScore: 0, botScore: 0,
+        crossLayerInconsistencyScore: 0, timeInconsistencyScore: 0, tlsSpoofingScore: 0,
+        clickVarianceScore: 0, clientHintsInconsistencyScore: 0, subnetScore: 0,
+        ipReputationScore: 0, botnetClusterScore: 0, tcpAnomalyScore: 0,
+        quicAnomalyScore: 0, renderingAnomalyScore: 0, threatIntelScore: 0
+      }
+    },
+    {
+      type: 'request_blocked',
+      weight: 15.0,
+      vector: {
+        historyScore: 100, rotationScore: 100, headerAnomalyScore: 80, requestPatternScore: 100,
+        inconsistencyScore: 100, behaviorScore: 0, honeypotScore: 100, botScore: 100,
+        crossLayerInconsistencyScore: 80, timeInconsistencyScore: 100, tlsSpoofingScore: 100,
+        clickVarianceScore: 100, clientHintsInconsistencyScore: 90, subnetScore: 100,
+        ipReputationScore: 100, botnetClusterScore: 100, tcpAnomalyScore: 100,
+        quicAnomalyScore: 100, renderingAnomalyScore: 100, threatIntelScore: 100
+      }
+    },
+    {
+      type: 'request_passed', // Profil humain sain avec du bruit (doit rester sous le seuil d'alerte, ex: < 20)
+      weight: 10.0,
+      vector: {
+        historyScore: 15, rotationScore: 10, headerAnomalyScore: 20, requestPatternScore: 15,
+        inconsistencyScore: 10, behaviorScore: 15, honeypotScore: 0, botScore: 0,
+        crossLayerInconsistencyScore: 10, timeInconsistencyScore: 10, tlsSpoofingScore: 10,
+        clickVarianceScore: 0, clientHintsInconsistencyScore: 10, subnetScore: 5,
+        ipReputationScore: 5, botnetClusterScore: 5, tcpAnomalyScore: 10,
+        quicAnomalyScore: 10, renderingAnomalyScore: 5, threatIntelScore: 0
+      }
+    },
+    {
+      type: 'challenge_issued', // Profil robot furtif moyen (doit être challengé, ex: > 35)
+      weight: 10.0,
+      vector: {
+        historyScore: 20, rotationScore: 20, headerAnomalyScore: 20, requestPatternScore: 40,
+        inconsistencyScore: 30, behaviorScore: 30, honeypotScore: 0, botScore: 0,
+        crossLayerInconsistencyScore: 20, timeInconsistencyScore: 20, tlsSpoofingScore: 30,
+        clickVarianceScore: 20, clientHintsInconsistencyScore: 20, subnetScore: 15,
+        ipReputationScore: 15, botnetClusterScore: 20, tcpAnomalyScore: 30,
+        quicAnomalyScore: 20, renderingAnomalyScore: 20, threatIntelScore: 0
+      }
+    }
+  ];
 
   return function fullConfigFitness(config) {
-    let falsePositives = 0; // Humains légitimes challengés ou bloqués
-    let falseNegatives = 0; // Bots qui sont passés
+    let falsePositives = 0;
+    let falseNegatives = 0;
     let totalHumans = 0;
     let totalBots = 0;
-    let totalChallenges = 0;
-    let totalChallengeCost = 0; // NOUVEAU: Coût cumulé des challenges
 
-    // Simule le calcul du score pour chaque point de données avec la configuration testée
+    let maxHumanScore = 0;
+    let minBotScore = 100;
+
     const calculateScore = (log) => {
-      // Cette fonction interne devrait répliquer la logique de `getSuspicionVector`
-      // en utilisant les poids et les paramètres de `config`.
-      // Pour cet exemple, nous utilisons une version simplifiée.
       let score = 0;
       for (const key in config.weights) {
         score += (log.vector?.[key] || 0) * config.weights[key];
@@ -1575,57 +1624,78 @@ Optimization.Operators.createFullSecurityConfigEvaluator = ({ trafficData }) =>
       return score;
     };
 
-    // Pondération de la confiance : un challenge résolu est un signal humain plus fort.
     const confidenceWeights = {
-        request_passed: 0.7,
-        challenge_issued: 1.0,
-        request_blocked: 1.0,
-        challenge_solved: 1.5, // Signal "humain" de très haute confiance
-        trap_triggered: 2.0,   // Signal "bot" de confiance absolue
+      request_passed: 0.7,
+      challenge_issued: 1.0,
+      request_blocked: 1.0,
+      challenge_solved: 1.5,
+      trap_triggered: 2.0,
     };
 
+    // 1. Évaluation sur les données de trafic réelles
     for (const log of trafficData) {
-      const confidence = confidenceWeights[log.type] || 1.0;
-
-      // On se base sur le comportement observé pour déterminer la nature "réelle" de la requête
-      const isLikelyBot = log.type === 'challenge_issued' || log.type === 'request_blocked';
+      const weight = log.weight || 1.0;
+      const confidence = (confidenceWeights[log.type] || 1.0) * weight;
+      const isLikelyBot = log.type === 'challenge_issued' || log.type === 'request_blocked' || log.type === 'trap_triggered';
       const isLikelyHuman = log.type === 'request_passed' || log.type === 'challenge_solved';
 
+      const score = calculateScore(log);
+
       if (isLikelyBot) {
-        totalBots++;
-        const score = calculateScore(log);
-        // Faux négatif : un bot qui aurait dû être challengé mais ne l'a pas été
+        totalBots += confidence;
+        minBotScore = Math.min(minBotScore, score);
         if (score < config.thresholds.low) {
           falseNegatives += confidence;
-        } else {
-          totalChallenges += confidence; // Un bot correctement challengé
-          // Calculer le coût de ce challenge (proportionnel à la difficulté)
-          const suspicionFactor = (score - config.thresholds.low) / (config.thresholds.high - config.thresholds.low);
-          totalChallengeCost += Math.min(1, Math.max(0, suspicionFactor)) * confidence;
         }
       } else if (isLikelyHuman) {
-        totalHumans++;
-        const score = calculateScore(log);
-        // Faux positif : un humain qui a été challengé inutilement
+        totalHumans += confidence;
+        maxHumanScore = Math.max(maxHumanScore, score);
         if (score >= config.thresholds.low) {
           falsePositives += confidence;
-          totalChallenges += confidence; // Un humain incorrectement challengé
-          const suspicionFactor = (score - config.thresholds.low) / (config.thresholds.high - config.thresholds.low);
-          totalChallengeCost += Math.min(1, Math.max(0, suspicionFactor)) * confidence;
+        }
+      }
+    }
+
+    // 2. Évaluation sur les ancres immuables pour fixer l'échelle
+    for (const anchor of STATIC_ANCHORS) {
+      const score = calculateScore(anchor);
+      const weight = anchor.weight;
+
+      if (anchor.type === 'request_blocked' || anchor.type === 'challenge_issued') {
+        totalBots += weight;
+        minBotScore = Math.min(minBotScore, score);
+        if (score < config.thresholds.low) {
+          falseNegatives += weight * 10; // Pénalité punitive forte
+        }
+      } else {
+        totalHumans += weight;
+        maxHumanScore = Math.max(maxHumanScore, score);
+        if (score >= config.thresholds.low) {
+          falsePositives += weight * 10; // Pénalité punitive forte
         }
       }
     }
 
     const falsePositiveRate = totalHumans > 0 ? falsePositives / totalHumans : 0;
     const falseNegativeRate = totalBots > 0 ? falseNegatives / totalBots : 0;
-    // NOUVEAU: Taux de challenge global
-    const challengeRate = (totalHumans + totalBots) > 0 ? totalChallenges / (totalHumans + totalBots) : 0;
-    // NOUVEAU: Coût moyen par challenge émis
-    const averageChallengeCost = totalChallenges > 0 ? totalChallengeCost / totalChallenges : 0;
-
-    // L'algorithme doit minimiser ces deux objectifs
-    // On a maintenant 4 objectifs à minimiser !
-    return [falsePositiveRate, falseNegativeRate, challengeRate, averageChallengeCost];
+
+    // 3. Pénalité de dérive d'échelle L2 (Régularisation par rapport au point d'origine)
+    let regularizationPenalty = 0;
+    if (currentConfig && currentConfig.weights) {
+      for (const key in config.weights) {
+        const originalVal = currentConfig.weights[key] || 0;
+        regularizationPenalty += Math.pow(config.weights[key] - originalVal, 2);
+      }
+    }
+
+    // 4. Maximisation de la marge de séparation (SVM-like Margin Loss)
+    const marginOverlap = Math.max(0, maxHumanScore - minBotScore);
+    const marginPenalty = marginOverlap / 100;
+
+    const obj1 = falsePositiveRate + (regularizationPenalty * 0.05);
+    const obj2 = falseNegativeRate + marginPenalty;
+
+    return [obj1, obj2];
   };
 };
 
@@ -1646,17 +1716,24 @@ Optimization.Operators.solveFullSecurityTuning = (context, options = {}) => {
             high: 70 + secureRandom() * 20,
         },
         weights: {
-            historyScore: secureRandom(),
-            rotationScore: secureRandom(),
-            headerAnomalyScore: secureRandom(),
-            requestPatternScore: 0.5 + secureRandom(),
-            inconsistencyScore: secureRandom(),
-            honeypotScore: 1.0, // Garder le honeypot à 1.0 est une bonne pratique
-            behaviorScore: secureRandom(),
-            crossLayerInconsistencyScore: secureRandom(),
-            timeInconsistencyScore: secureRandom(),
-            tlsSpoofingScore: secureRandom(),
-            botScore: secureRandom(),
+          historyScore: secureRandom(),
+          rotationScore: secureRandom(),
+          headerAnomalyScore: secureRandom(),
+          requestPatternScore: 0.5 + secureRandom(),
+          inconsistencyScore: secureRandom(),
+          honeypotScore: 1.0, // Garder le honeypot à 1.0 est une bonne pratique
+          behaviorScore: secureRandom(),
+          crossLayerInconsistencyScore: secureRandom(),
+          timeInconsistencyScore: secureRandom(),
+          tlsSpoofingScore: secureRandom(),
+          botScore: secureRandom(),
+          subnetScore: secureRandom(),
+          ipReputationScore: secureRandom(),
+          botnetClusterScore: secureRandom(),
+          tcpAnomalyScore: secureRandom(),
+          quicAnomalyScore: secureRandom(),
+          clickVarianceScore: secureRandom(),
+          clientHintsInconsistencyScore: secureRandom()
         },
         patterns: {
             velocityThreshold: 100 + secureRandom() * 400,

package/src/js/mongodb-store.js

@@ -154,6 +154,19 @@ export function createMongoDbStore(db, collectionName = 'fingerprint_store') {
         triggerFallback();
       }
     },
+    async clear() {
+      localStore.clear();
+      for (const timeout of localTimeouts.values()) {
+        clearTimeout(timeout);
+      }
+      localTimeouts.clear();
+      if (isDown) return;
+      try {
+        await collection.deleteMany({});
+      } catch (e) {
+        triggerFallback();
+      }
+    },
     async init() {
       try {
         // Automates index configuration

package/src/js/problem-manager.js

@@ -48,8 +48,12 @@ FunctionRegistry['facility.calculateEnergy'] = (facilities, payload) => {
  * @param {Array<{x: number, y: number}>} path - Un tableau de points représentant le chemin.
  * @returns {number} La distance totale du chemin.
  */
-FunctionRegistry['tsp.calculateEnergy'] = (path) => {
-    // Crée un tableau d'indices [0, 1, 2, ...] pour la fonction evaluatePathDistance.
+FunctionRegistry['tsp.calculateEnergy'] = (path, payload) => {
+    const cities = payload?.cities || payload?.points || [];
+    if (path && typeof path[0] === 'number') {
+        return Optimization.Utils.evaluatePathDistance(cities, path);
+    }
+    // Fallback: Crée un tableau d'indices [0, 1, 2, ...] pour la fonction evaluatePathDistance.
     const indices = Array.from({ length: path.length }, (_, i) => i);
     return Optimization.Utils.evaluatePathDistance(path, indices);
 };

package/src/js/redis-store.js

@@ -111,5 +111,18 @@ export function createRedisStore(redisClient) {
         triggerFallback();
       }
     },
+    async clear() {
+      localStore.clear();
+      for (const timeout of localTimeouts.values()) {
+        clearTimeout(timeout);
+      }
+      localTimeouts.clear();
+      if (isDown) return;
+      try {
+        await redisClient.flushdb();
+      } catch (e) {
+        triggerFallback();
+      }
+    }
   };
 }

package/src/js/sql-store.js

@@ -1,78 +1,81 @@
-/**
- * @file Creates a store adapter for Knex.js.
- * This adapter is compatible with various SQL databases like PostgreSQL, MySQL, and SQLite.
- * It handles serialization of complex objects and TTL for automatic data expiration.
- */
-
-/**
- * Creates a store adapter for a Knex.js client.
- *
- * **Note:** You must create the table yourself before using the store.
- * The table should have at least the following columns:
- * - `key` (string, primary key)
- * - `value` (text or json/jsonb)
- * - `expiresAt` (datetime or timestamp with time zone)
- *
- * Example schema for PostgreSQL:
- * ```sql
- * CREATE TABLE your_table_name (
- *   "key" VARCHAR(255) PRIMARY KEY,
- *   "value" TEXT NOT NULL,
- *   "expiresAt" TIMESTAMPTZ
- * );
- * ```
- *
- * @param {import('knex').Knex} knex - An instance of the Knex client.
- * @param {string} [tableName='fingerprint_store'] - The name of the table to use.
- * @returns {import('./fingerprint.js').IStore} An object that complies with the IStore interface.
- */
-export function createSqlStore(knex, tableName = 'fingerprint_store') {
-  // Custom replacer/reviver to handle Set serialization, similar to the Redis store.
-  const replacer = (k, v) => (v instanceof Set ? Array.from(v) : v);
-  const reviver = (k, v) => (k === 'ips' && Array.isArray(v) ? new Set(v) : v);
-
-  return {
-    async get(key) {
-      const row = await knex(tableName).where('key', key).first();
-      if (!row) return null;
-
-      // Manually check for expiration, as not all SQL databases have automatic TTL cleanup.
-      if (row.expiresAt && new Date(row.expiresAt) < new Date()) {
-        await this.delete(key); // Clean up expired key.
-        return null;
-      }
-
-      try {
-        return JSON.parse(row.value, reviver);
-      } catch (e) {
-        // In case of malformed JSON, treat it as a miss.
-        return null;
-      }
-    },
-
-    async set(key, value, ttl) {
-      const stringValue = JSON.stringify(value, replacer);
-      const expiresAt = ttl ? new Date(Date.now() + ttl * 1000) : null;
-
-      // Use native upsert capabilities of Knex for different SQL dialects.
-      await knex(tableName)
-        .insert({ key, value: stringValue, expiresAt })
-        .onConflict('key')
-        .merge();
-    },
-
-    async has(key) {
-      const row = await knex(tableName).where('key', key).first('key');
-      if (!row) return false;
-      // Also check for expiration here.
-      if (row.expiresAt && new Date(row.expiresAt) < new Date()) {
-        return false;
-      }
-      return true;
-    },
-
-    async delete(key) {
-      await knex(tableName).where('key', key).del();
-    },
-  };
+/**
+ * @file Creates a store adapter for Knex.js.
+ * This adapter is compatible with various SQL databases like PostgreSQL, MySQL, and SQLite.
+ * It handles serialization of complex objects and TTL for automatic data expiration.
+ */
+
+/**
+ * Creates a store adapter for a Knex.js client.
+ *
+ * **Note:** You must create the table yourself before using the store.
+ * The table should have at least the following columns:
+ * - `key` (string, primary key)
+ * - `value` (text or json/jsonb)
+ * - `expiresAt` (datetime or timestamp with time zone)
+ *
+ * Example schema for PostgreSQL:
+ * ```sql
+ * CREATE TABLE your_table_name (
+ *   "key" VARCHAR(255) PRIMARY KEY,
+ *   "value" TEXT NOT NULL,
+ *   "expiresAt" TIMESTAMPTZ
+ * );
+ * ```
+ *
+ * @param {import('knex').Knex} knex - An instance of the Knex client.
+ * @param {string} [tableName='fingerprint_store'] - The name of the table to use.
+ * @returns {import('./fingerprint.js').IStore} An object that complies with the IStore interface.
+ */
+export function createSqlStore(knex, tableName = 'fingerprint_store') {
+  // Custom replacer/reviver to handle Set serialization, similar to the Redis store.
+  const replacer = (k, v) => (v instanceof Set ? Array.from(v) : v);
+  const reviver = (k, v) => (k === 'ips' && Array.isArray(v) ? new Set(v) : v);
+
+  return {
+    async get(key) {
+      const row = await knex(tableName).where('key', key).first();
+      if (!row) return null;
+
+      // Manually check for expiration, as not all SQL databases have automatic TTL cleanup.
+      if (row.expiresAt && new Date(row.expiresAt) < new Date()) {
+        await this.delete(key); // Clean up expired key.
+        return null;
+      }
+
+      try {
+        return JSON.parse(row.value, reviver);
+      } catch (e) {
+        // In case of malformed JSON, treat it as a miss.
+        return null;
+      }
+    },
+
+    async set(key, value, ttl) {
+      const stringValue = JSON.stringify(value, replacer);
+      const expiresAt = ttl ? new Date(Date.now() + ttl * 1000) : null;
+
+      // Use native upsert capabilities of Knex for different SQL dialects.
+      await knex(tableName)
+        .insert({ key, value: stringValue, expiresAt })
+        .onConflict('key')
+        .merge();
+    },
+
+    async has(key) {
+      const row = await knex(tableName).where('key', key).first('key');
+      if (!row) return false;
+      // Also check for expiration here.
+      if (row.expiresAt && new Date(row.expiresAt) < new Date()) {
+        return false;
+      }
+      return true;
+    },
+
+    async delete(key) {
+      await knex(tableName).where('key', key).del();
+    },
+    async clear() {
+      await knex(tableName).del();
+    }
+  };
 }

package/src/js/tests/fingerprint.engine.test.js

@@ -92,8 +92,7 @@ describe('FingerprintEngine Challenge Validation', () => {
 
         // The client solves the challenge
         // --- FIX: Simulate the client creating the baseBlock for the solver ---
-        const messageBase = `${nonce}:${challengeContext.clientSecret}:fingerprint-A:`;
-        const baseBlock = new TextEncoder().encode(messageBase);
+        const baseBlock = new Uint8Array(challengeContext.baseBlock);
 
         const cpuSolution = await solveCpuTargetInline(baseBlock, cpuTarget, null);
         // The memory challenge seed does not include the fingerprint.
@@ -153,7 +152,7 @@ describe('FingerprintEngine Challenge Validation', () => {
         // --- 2. Second request: Solution is submitted from "Machine B" ---
         // --- FIX: Simulate the client creating the baseBlock for the solver ---
         // The solver uses the fingerprint of the machine it's running on.
-        const messageBase = `${nonce}:${challengeContext.clientSecret}:fingerprint-B:`;
+        const messageBase = `${nonce}:${challengeContext.clientSecret}:fingerprint-B:127.0.0.1::`;
         const baseBlock = new TextEncoder().encode(messageBase);
 
         const cpuSolution = await solveCpuTargetInline(baseBlock, cpuTarget, null);

package/src/js/tests/fingerprint.test.js

@@ -739,7 +739,7 @@ describe('Fingerprint & PoW Security Suite', () => {
             const memDifficulty = parseInt(challengeBody.match(/const memDifficulty = (\d+)/)[1], 10);
 
             // The client constructs the base block and solves the challenge
-            const baseBlock = new TextEncoder().encode(`${nonce}:${clientSecret}:${solverFingerprint}:`);
+            const baseBlock = new TextEncoder().encode(`${nonce}:${clientSecret}:${solverFingerprint}:${ip}::`);
             const cpuSolution = await solveCpuTargetInline(baseBlock, cpuTargetHex, () => {});
             const memSolution = await solveMemory(`:${nonce}:${clientSecret}`, memDifficulty);
 
@@ -821,7 +821,7 @@ describe('Fingerprint & PoW Security Suite', () => {
             const memDifficulty = parseInt(challengeBody.match(/const memDifficulty = (\d+)/)[1], 10);
 
             // The server stores the challenge context. We need to ensure the `baseBlock` is present for verification.
-            const baseBlock = new TextEncoder().encode(`${nonce}:${clientSecret}:${solverFingerprint}:`);
+            const baseBlock = new TextEncoder().encode(`${nonce}:${clientSecret}:${solverFingerprint}:${ip}::`);
             await inMemoryStore.set(`secret:${nonce}`, {
                 clientSecret: clientSecret,
                 cpuTarget: cpuTargetHex,
@@ -2405,7 +2405,7 @@ describe('Subnet Scoring (Node.js)', () => {
             deviceIds: ['d1', 'd2'], // count < 10, score += 0
         });
         ({ subnetScore } = await __internal.getSubnetScore(context, 'device-1'));
-        expect(subnetScore).toBe(10);
+        expect(subnetScore).toBe(100);
 
         // 3. Many devices and high scores
         const deviceIds = Array.from({ length: 20 }, (_, i) => `d${i}`);
@@ -2414,7 +2414,7 @@ describe('Subnet Scoring (Node.js)', () => {
             deviceIds: deviceIds, // count = 20. score += (20-10)*5 = 50
         });
         ({ subnetScore } = await __internal.getSubnetScore(context, 'device-1'));
-        expect(subnetScore).toBe(90); // 40 + 50
+        expect(subnetScore).toBe(100);
     });
 });
 
@@ -2714,18 +2714,18 @@ describe('Botnet Cluster Scoring (Node.js)', () => {
         // 2. Ajout de 2 IPs uniques (total 3)
         await getBotnetClusterScore({ clientIp: '192.168.1.2' }, stableFpHash);
         scoreData = await getBotnetClusterScore({ clientIp: '192.168.1.3' }, stableFpHash);
-            expect(scoreData.botnetClusterScore).toBe(50.3);
+            expect(scoreData.botnetClusterScore).toBe(30.2);
 
         // 3. Ajout de 2 IPs uniques (total 5)
         await getBotnetClusterScore({ clientIp: '192.168.1.4' }, stableFpHash);
         scoreData = await getBotnetClusterScore({ clientIp: '192.168.1.5' }, stableFpHash);
-            expect(scoreData.botnetClusterScore).toBe(75.3);
+            expect(scoreData.botnetClusterScore).toBe(45.2);
 
         // 4. Ajout de 5 IPs uniques (total 10)
         for (let i = 6; i <= 10; i++) {
             scoreData = await getBotnetClusterScore({ clientIp: `192.168.1.${i}` }, stableFpHash);
         }
-            expect(scoreData.botnetClusterScore).toBe(95.7);
+            expect(scoreData.botnetClusterScore).toBe(57.4);
     });
 
         it('should realistically group PS4 consoles with volatile differences (different IPs/cookies) under the same cluster score', async () => {
@@ -2759,15 +2759,15 @@ describe('Botnet Cluster Scoring (Node.js)', () => {
                 if (i === 1) {
                     expect(vector.botnetClusterScore).toBe(0);
                 } else if (i === 2) {
-                    expect(vector.botnetClusterScore).toBe(29.5);
+                    expect(vector.botnetClusterScore).toBe(17.7);
                 } else if (i === 3) {
-                    expect(vector.botnetClusterScore).toBe(50.3);
+                    expect(vector.botnetClusterScore).toBe(30.2);
                 } else if (i === 4) {
-                    expect(vector.botnetClusterScore).toBe(65);
+                    expect(vector.botnetClusterScore).toBe(39.0);
                 } else if (i === 5) {
-                    expect(vector.botnetClusterScore).toBe(75.3);
+                    expect(vector.botnetClusterScore).toBe(45.2);
                 } else if (i === 10) {
-                    expect(vector.botnetClusterScore).toBe(95.7);
+                    expect(vector.botnetClusterScore).toBe(57.4);
                 }
             }
         });
@@ -2874,4 +2874,41 @@ describe('IP Registration and Filtering', () => {
         expect(storedData.ips.has(ip1)).toBe(true);
         expect(storedData.ips.has(ip2)).toBe(true);
     });
+
+    describe('Ed25519 Key Generation & Reopening', () => {
+        beforeEach(() => {
+            delete process.env.ED25519_PRIVATE_KEY;
+            delete process.env.ED25519_PUBLIC_KEY;
+            vi.restoreAllMocks();
+        });
+
+        it('should generate new keys and save to disk if not present', async () => {
+            const fs = await import('node:fs');
+            const existsSpy = vi.spyOn(fs, 'existsSync').mockReturnValue(false);
+            const writeSpy = vi.spyOn(fs, 'writeFileSync').mockImplementation(() => {});
+
+            const config = { ed25519: 'auto', weights: {}, thresholds: {} };
+            new FingerprintEngine(config);
+
+            expect(process.env.ED25519_PRIVATE_KEY).toBeDefined();
+            expect(process.env.ED25519_PUBLIC_KEY).toBeDefined();
+            expect(writeSpy).toHaveBeenCalled();
+        });
+
+        it('should load keys from disk if they already exist', async () => {
+            const fs = await import('node:fs');
+            const dummyKeys = {
+                privateKey: '-----BEGIN PRIVATE KEY-----\ndummy-private-key\n-----END PRIVATE KEY-----',
+                publicKey: '-----BEGIN PUBLIC KEY-----\ndummy-public-key\n-----END PUBLIC KEY-----'
+            };
+            const existsSpy = vi.spyOn(fs, 'existsSync').mockReturnValue(true);
+            const readSpy = vi.spyOn(fs, 'readFileSync').mockReturnValue(JSON.stringify(dummyKeys));
+
+            const config = { ed25519: 'auto', weights: {}, thresholds: {} };
+            new FingerprintEngine(config);
+
+            expect(process.env.ED25519_PRIVATE_KEY).toBe(dummyKeys.privateKey);
+            expect(process.env.ED25519_PUBLIC_KEY).toBe(dummyKeys.publicKey);
+        });
+    });
 });