@anonympins/fingerprint 0.6.1 → 0.6.4

package/src/php/Utils/MetricsManager.php

@@ -1,167 +1,210 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Utils;
-
-class MetricsManager
-{
-    /** @var array Stockage temporaire des compteurs Prometheus */
-    private static array $counters = [];
-
-    /** @var array Stockage temporaire des observations Prometheus */
-    private static array $observations = [];
-
-    /**
-     * Incrémente un compteur Prometheus.
-     *
-     * @param string $name Nom du compteur.
-     * @param array $labels Libellés/Labels associés.
-     */
-    public static function incrementCounter(string $name, array $labels = []): void
-    {
-        if (strpos($name, 'fingerprint_') !== 0) {
-            $name = 'fingerprint_' . $name;
-        }
-        ksort($labels);
-        $labelPairs = [];
-        foreach ($labels as $k => $v) {
-            $labelPairs[] = "{$k}=\"{$v}\"";
-        }
-        $labelsStr = !empty($labelPairs) ? '{' . implode(',', $labelPairs) . '}' : '';
-        $key = $name . $labelsStr;
-
-        if (!isset(self::$counters[$key])) {
-            self::$counters[$key] = [
-                'name' => $name,
-                'labelsStr' => $labelsStr,
-                'value' => 0
-            ];
-        }
-        self::$counters[$key]['value']++;
-    }
-
-    /**
-     * Enregistre une observation de valeur (ex: temps d'exécution, score).
-     *
-     * @param string $name Nom de la métrique.
-     * @param float $value Valeur observée.
-     * @param array $labels Libellés/Labels associés.
-     */
-    public static function observeValue(string $name, float $value, array $labels = []): void
-    {
-        if (strpos($name, 'fingerprint_') !== 0) {
-            $name = 'fingerprint_' . $name;
-        }
-        ksort($labels);
-        $labelPairs = [];
-        foreach ($labels as $k => $v) {
-            $labelPairs[] = "{$k}=\"{$v}\"";
-        }
-        $labelsStr = !empty($labelPairs) ? '{' . implode(',', $labelPairs) . '}' : '';
-        $key = $name . $labelsStr;
-
-        self::$observations[$key] = [
-            'name' => $name,
-            'labelsStr' => $labelsStr,
-            'value' => $value
-        ];
-    }
-
-    /**
-     * Réinitialise les compteurs enregistrés (utile pour l'isolation des tests).
-     */
-    public static function clearMetrics(): void
-    {
-        self::$counters = [];
-        self::$observations = [];
-    }
-
-    /**
-     * Génère les métriques au format Prometheus text/plain.
-     *
-     * @param array $securityConfig La configuration de sécurité active.
-     * @param array|null $lastBestSolution La dernière solution calculée par l'Auto-Tuner.
-     * @return string
-     */
-    public static function getPrometheusMetrics(array $securityConfig = [], ?array $lastBestSolution = null): string
-    {
-        $metrics = "";
-
-        if (empty(self::$counters)) {
-            $metrics .= "# HELP fingerprint_requests_total Total requests processed.\n";
-            $metrics .= "# TYPE fingerprint_requests_total counter\n";
-            $metrics .= "fingerprint_requests_total{status=\"passed\"} 1\n";
-        } else {
-            $grouped = [];
-            foreach (self::$counters as $c) {
-                $grouped[$c['name']][] = $c;
-            }
-            foreach ($grouped as $name => $instances) {
-                $metrics .= "# HELP {$name} Total requests processed.\n";
-                $metrics .= "# TYPE {$name} counter\n";
-                foreach ($instances as $instance) {
-                    $metrics .= "{$name}{$instance['labelsStr']} {$instance['value']}\n";
-                }
-            }
-        }
-
-        // Export des observations (Gauges)
-        if (!empty(self::$observations)) {
-            $groupedObs = [];
-            foreach (self::$observations as $obs) {
-                $groupedObs[$obs['name']][] = $obs;
-            }
-            foreach ($groupedObs as $name => $instances) {
-                $metrics .= "\n# HELP {$name} Value observation.\n";
-                $metrics .= "# TYPE {$name} gauge\n";
-                foreach ($instances as $instance) {
-                    $metrics .= "{$name}{$instance['labelsStr']} {$instance['value']}\n";
-                }
-            }
-        }
-
-        // 1. Export des poids actifs (Weights)
-        if (isset($securityConfig['weights']) && is_array($securityConfig['weights'])) {
-            $metrics .= "\n# HELP fingerprint_security_weight Active weight for each suspicion indicator.\n";
-            $metrics .= "# TYPE fingerprint_security_weight gauge\n";
-            foreach ($securityConfig['weights'] as $indicator => $weight) {
-                if (is_numeric($weight)) {
-                    $metrics .= "fingerprint_security_weight{indicator=\"{$indicator}\"} {$weight}\n";
-                }
-            }
-        }
-
-        // 2. Export des seuils actifs (Thresholds)
-        if (isset($securityConfig['thresholds']) && is_array($securityConfig['thresholds'])) {
-            $metrics .= "\n# HELP fingerprint_security_threshold Active score threshold for each enforcement action level.\n";
-            $metrics .= "# TYPE fingerprint_security_threshold gauge\n";
-            foreach ($securityConfig['thresholds'] as $level => $threshold) {
-                if (is_numeric($threshold)) {
-                    $metrics .= "fingerprint_security_threshold{level=\"{$level}\"} {$threshold}\n";
-                }
-            }
-        }
-
-        // 3. Récupération auto de la dernière solution d'auto-tuning depuis le cache (savePath) si non fournie
-        if ($lastBestSolution === null && isset($securityConfig['autotuning']['savePath'])) {
-            $savePath = $securityConfig['autotuning']['savePath'];
-            if (file_exists($savePath)) {
-                $savedData = json_decode(file_get_contents($savePath), true);
-                if (is_array($savedData) && isset($savedData['objectives'])) {
-                    $lastBestSolution = $savedData;
-                }
-            }
-        }
-
-        // 4. Export des objectifs d'Auto-Tuning (Faux positifs & Faux négatifs calculés)
-        if ($lastBestSolution !== null && isset($lastBestSolution['objectives']) && is_array($lastBestSolution['objectives'])) {
-            $fpr = $lastBestSolution['objectives'][0] ?? 0.0;
-            $fnr = $lastBestSolution['objectives'][1] ?? 0.0;
-            $metrics .= "\n# HELP fingerprint_autotuning_false_positive_rate Current false positive rate calculated by the auto-tuner.\n# TYPE fingerprint_autotuning_false_positive_rate gauge\nfingerprint_autotuning_false_positive_rate {$fpr}\n";
-            $metrics .= "\n# HELP fingerprint_autotuning_false_negative_rate Current false negative rate calculated by the auto-tuner.\n# TYPE fingerprint_autotuning_false_negative_rate gauge\nfingerprint_autotuning_false_negative_rate {$fnr}\n";
-        }
-
-        return $metrics;
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Utils;
+
+class MetricsManager
+{
+    /** @var array Stockage temporaire des compteurs Prometheus */
+    private static array $counters = [];
+
+    /** @var array Stockage temporaire des observations Prometheus */
+    private static array $observations = [];
+
+    /**
+     * Incrémente un compteur Prometheus.
+     *
+     * @param string $name Nom du compteur.
+     * @param array $labels Libellés/Labels associés.
+     */
+    public static function incrementCounter(string $name, array $labels = []): void
+    {
+        if (strpos($name, 'fingerprint_') !== 0) {
+            $name = 'fingerprint_' . $name;
+        }
+        ksort($labels);
+        $labelPairs = [];
+        foreach ($labels as $k => $v) {
+            $labelPairs[] = "{$k}=\"{$v}\"";
+        }
+        $labelsStr = !empty($labelPairs) ? '{' . implode(',', $labelPairs) . '}' : '';
+        $key = $name . $labelsStr;
+
+        if (!isset(self::$counters[$key])) {
+            self::$counters[$key] = [
+                'name' => $name,
+                'labelsStr' => $labelsStr,
+                'value' => 0
+            ];
+        }
+        self::$counters[$key]['value']++;
+    }
+
+    /**
+     * Enregistre une observation de valeur (ex: temps d'exécution, score).
+     *
+     * @param string $name Nom de la métrique.
+     * @param float $value Valeur observée.
+     * @param array $labels Libellés/Labels associés.
+     */
+    public static function observeValue(string $name, float $value, array $labels = []): void
+    {
+        if (strpos($name, 'fingerprint_') !== 0) {
+            $name = 'fingerprint_' . $name;
+        }
+        ksort($labels);
+        $labelPairs = [];
+        foreach ($labels as $k => $v) {
+            $labelPairs[] = "{$k}=\"{$v}\"";
+        }
+        $labelsStr = !empty($labelPairs) ? '{' . implode(',', $labelPairs) . '}' : '';
+        $key = $name . $labelsStr;
+
+        self::$observations[$key] = [
+            'name' => $name,
+            'labelsStr' => $labelsStr,
+            'value' => $value
+        ];
+    }
+
+    /**
+     * Helper method to retrieve a specific metric's values by name.
+     *
+     * @param string $name Name of the metric.
+     * @param array $securityConfig The security configuration.
+     * @return array Associative array of labels to values.
+     */
+    public static function getMetric(string $name, array $securityConfig = []): array
+    {
+        $result = [];
+        $queryName = str_starts_with($name, 'fingerprint_') ? $name : 'fingerprint_' . $name;
+
+        if ($queryName === 'fingerprint_security_weight') {
+            $weights = $securityConfig['weights'] ?? [];
+            foreach ($weights as $indicator => $weight) {
+                if (is_numeric($weight)) {
+                    $result[$indicator] = (float)$weight;
+                }
+            }
+        } elseif ($queryName === 'fingerprint_security_threshold') {
+            $thresholds = $securityConfig['thresholds'] ?? [];
+            foreach ($thresholds as $level => $threshold) {
+                if (is_numeric($threshold)) {
+                    $result[$level] = (float)$threshold;
+                }
+            }
+        } else {
+            foreach (self::$counters as $counter) {
+                if ($counter['name'] === $queryName || $counter['name'] === $name) {
+                    $labelStr = trim($counter['labelsStr'], '{}');
+                    $result[$labelStr !== '' ? $labelStr : 'value'] = $counter['value'];
+                }
+            }
+            foreach (self::$observations as $obs) {
+                if ($obs['name'] === $queryName || $obs['name'] === $name) {
+                    $labelStr = trim($obs['labelsStr'], '{}');
+                    $result[$labelStr !== '' ? $labelStr : 'value'] = $obs['value'];
+                }
+            }
+        }
+        return $result;
+    }
+
+    /**
+     * Réinitialise les compteurs enregistrés (utile pour l'isolation des tests).
+     */
+    public static function clearMetrics(): void
+    {
+        self::$counters = [];
+        self::$observations = [];
+    }
+
+    /**
+     * Génère les métriques au format Prometheus text/plain.
+     *
+     * @param array $securityConfig La configuration de sécurité active.
+     * @param array|null $lastBestSolution La dernière solution calculée par l'Auto-Tuner.
+     * @return string
+     */
+    public static function getPrometheusMetrics(array $securityConfig = [], ?array $lastBestSolution = null): string
+    {
+        $metrics = "";
+
+        if (empty(self::$counters)) {
+            $metrics .= "# HELP fingerprint_requests_total Total requests processed.\n";
+            $metrics .= "# TYPE fingerprint_requests_total counter\n";
+            $metrics .= "fingerprint_requests_total{status=\"passed\"} 1\n";
+        } else {
+            $grouped = [];
+            foreach (self::$counters as $c) {
+                $grouped[$c['name']][] = $c;
+            }
+            foreach ($grouped as $name => $instances) {
+                $metrics .= "# HELP {$name} Total requests processed.\n";
+                $metrics .= "# TYPE {$name} counter\n";
+                foreach ($instances as $instance) {
+                    $metrics .= "{$name}{$instance['labelsStr']} {$instance['value']}\n";
+                }
+            }
+        }
+
+        // Export des observations (Gauges)
+        if (!empty(self::$observations)) {
+            $groupedObs = [];
+            foreach (self::$observations as $obs) {
+                $groupedObs[$obs['name']][] = $obs;
+            }
+            foreach ($groupedObs as $name => $instances) {
+                $metrics .= "\n# HELP {$name} Value observation.\n";
+                $metrics .= "# TYPE {$name} gauge\n";
+                foreach ($instances as $instance) {
+                    $metrics .= "{$name}{$instance['labelsStr']} {$instance['value']}\n";
+                }
+            }
+        }
+
+        // 1. Export des poids actifs (Weights)
+        if (isset($securityConfig['weights']) && is_array($securityConfig['weights'])) {
+            $metrics .= "\n# HELP fingerprint_security_weight Active weight for each suspicion indicator.\n";
+            $metrics .= "# TYPE fingerprint_security_weight gauge\n";
+            foreach ($securityConfig['weights'] as $indicator => $weight) {
+                if (is_numeric($weight)) {
+                    $metrics .= "fingerprint_security_weight{indicator=\"{$indicator}\"} {$weight}\n";
+                }
+            }
+        }
+
+        // 2. Export des seuils actifs (Thresholds)
+        if (isset($securityConfig['thresholds']) && is_array($securityConfig['thresholds'])) {
+            $metrics .= "\n# HELP fingerprint_security_threshold Active score threshold for each enforcement action level.\n";
+            $metrics .= "# TYPE fingerprint_security_threshold gauge\n";
+            foreach ($securityConfig['thresholds'] as $level => $threshold) {
+                if (is_numeric($threshold)) {
+                    $metrics .= "fingerprint_security_threshold{level=\"{$level}\"} {$threshold}\n";
+                }
+            }
+        }
+
+        // 3. Récupération auto de la dernière solution d'auto-tuning depuis le cache (savePath) si non fournie
+        if ($lastBestSolution === null && isset($securityConfig['autotuning']['savePath'])) {
+            $savePath = $securityConfig['autotuning']['savePath'];
+            if (file_exists($savePath)) {
+                $savedData = json_decode(file_get_contents($savePath), true);
+                if (is_array($savedData) && isset($savedData['objectives'])) {
+                    $lastBestSolution = $savedData;
+                }
+            }
+        }
+
+        // 4. Export des objectifs d'Auto-Tuning (Faux positifs & Faux négatifs calculés)
+        if ($lastBestSolution !== null && isset($lastBestSolution['objectives']) && is_array($lastBestSolution['objectives'])) {
+            $fpr = $lastBestSolution['objectives'][0] ?? 0.0;
+            $fnr = $lastBestSolution['objectives'][1] ?? 0.0;
+            $metrics .= "\n# HELP fingerprint_autotuning_false_positive_rate Current false positive rate calculated by the auto-tuner.\n# TYPE fingerprint_autotuning_false_positive_rate gauge\nfingerprint_autotuning_false_positive_rate {$fpr}\n";
+            $metrics .= "\n# HELP fingerprint_autotuning_false_negative_rate Current false negative rate calculated by the auto-tuner.\n# TYPE fingerprint_autotuning_false_negative_rate gauge\nfingerprint_autotuning_false_negative_rate {$fnr}\n";
+        }
+
+        return $metrics;
+    }
 }

package/src/php/Utils/RequestUtils.php

@@ -1254,12 +1254,20 @@ class RequestUtils
             'highScoreCount' => 0,
             'deviceIds' => [],
             'highScoreDevices' => [],
-            'lastActivity' => 0
+            'lastActivity' => 0,
+            'ips' => [],
+            'uas' => []
         ];
 
         if (!isset($subnetData['highScoreDevices'])) {
             $subnetData['highScoreDevices'] = [];
         }
+        if (!isset($subnetData['ips'])) {
+            $subnetData['ips'] = [];
+        }
+        if (!isset($subnetData['uas'])) {
+            $subnetData['uas'] = [];
+        }
 
         // Utilisation de la partie stable du fingerprint matériel plutôt que l'ID de cookie volatil
         $currentDeviceHash = self::getCompositeDeviceHash($context);
@@ -1274,6 +1282,16 @@ class RequestUtils
         if (!in_array($stableFpId, $subnetData['deviceIds'], true)) {
             $subnetData['deviceIds'][] = $stableFpId;
         }
+
+        if (!in_array($context->clientIp, $subnetData['ips'], true)) {
+            $subnetData['ips'][] = $context->clientIp;
+        }
+
+        $userAgent = $context->getHeader('user-agent') ?? '';
+        if (!empty($userAgent) && !in_array($userAgent, $subnetData['uas'], true)) {
+            $subnetData['uas'][] = $userAgent;
+        }
+
         $subnetData['lastActivity'] = time();
 
         // Limiter la taille du tableau des deviceIds pour éviter une consommation mémoire excessive.
@@ -1285,6 +1303,12 @@ class RequestUtils
                 unset($subnetData['highScoreDevices'][$oldDeviceId]);
             }
         }
+        if (count($subnetData['ips']) > 100) {
+            array_shift($subnetData['ips']);
+        }
+        if (count($subnetData['uas']) > 50) {
+            array_shift($subnetData['uas']);
+        }
 
         // TTL de 24 heures pour les données de sous-réseau.
         $store->set($key, $subnetData, 86400);
@@ -1318,23 +1342,32 @@ class RequestUtils
 
         $highScoreCount = $subnetData['highScoreCount'] ?? 0;
         $deviceCount = isset($subnetData['deviceIds']) ? count($subnetData['deviceIds']) : 0;
+        $ipCount = isset($subnetData['ips']) ? count($subnetData['ips']) : 1;
+        $uaCount = isset($subnetData['uas']) ? count($subnetData['uas']) : 1;
 
         if ($halfLives > 0) {
-            $highScoreCount = max(0, (int)floor($highScoreCount / pow(2, $halfLives)));
-            $deviceCount = max(0, (int)floor($deviceCount / pow(2, $halfLives)));
+            $decay = pow(2, $halfLives);
+            $highScoreCount = max(0, (int)floor($highScoreCount / $decay));
+            $deviceCount = max(0, (int)floor($deviceCount / $decay));
+            $ipCount = max(1, (int)floor($ipCount / $decay));
+            $uaCount = max(1, (int)floor($uaCount / $decay));
         }
 
-        $score = 0.0;
-
-        // Pénalité basée sur le nombre de devices uniques vus depuis ce sous-réseau.
-        if ($deviceCount > 10) {
-            $score += min(80.0, ($deviceCount - 10) * 5);
+        if ($deviceCount === 0) {
+            return ['subnetScore' => 0.0];
         }
 
-        // Pénalité basée sur le nombre de scores élevés enregistrés.
-        $score += min(40.0, $highScoreCount * 2);
+        $suspicionDensity = $highScoreCount / $deviceCount;
+        $ipDeviceRatio = $ipCount / $deviceCount;
+
+        $baseScore = 100.0 * (1.0 - exp(-0.15 * $highScoreCount));
+
+        $densityMultiplier = 0.4 + (1.6 * $suspicionDensity);
+        $distributionMultiplier = 0.5 + (1.0 * $ipDeviceRatio);
+
+        $finalScore = min(100.0, round($baseScore * $densityMultiplier * $distributionMultiplier * 10.0) / 10.0);
 
-        return ['subnetScore' => min(100.0, $score)];
+        return ['subnetScore' => $finalScore];
     }
 
     /**
@@ -1364,10 +1397,15 @@ class RequestUtils
         });
         $clusterData = array_values($clusterData);
 
+        $userAgent = $context->getHeader('user-agent') ?? '';
+        $subnet = self::getIpSubnet($context->clientIp) ?? 'unknown';
+
         $found = false;
         foreach ($clusterData as &$entry) {
             if (isset($entry['ip']) && $entry['ip'] === $context->clientIp) {
                 $entry['timestamp'] = $now;
+                $entry['ua'] = $userAgent;
+                $entry['subnet'] = $subnet;
                 $found = true;
                 break;
             }
@@ -1375,14 +1413,26 @@ class RequestUtils
         unset($entry);
 
         if (!$found) {
-            $clusterData[] = ['ip' => $context->clientIp, 'timestamp' => $now];
+            $clusterData[] = [
+                'ip' => $context->clientIp,
+                'timestamp' => $now,
+                'ua' => $userAgent,
+                'subnet' => $subnet
+            ];
         }
 
         $store->set($key, $clusterData, 600);
         $uniqueIpsCount = count($clusterData);
         $botnetClusterScore = 0.0;
         if ($uniqueIpsCount >= 2) {
-            $botnetClusterScore = min(100.0, round(100.0 * (1.0 - exp(-0.35 * ($uniqueIpsCount - 1))), 1));
+            $uniqueSubnets = count(array_unique(array_filter(array_column($clusterData, 'subnet'))));
+            $uniqueUserAgents = count(array_unique(array_filter(array_column($clusterData, 'ua'))));
+
+            $subnetMultiplier = $uniqueSubnets > 1 ? 1.3 : 0.6;
+            $uaRotationMultiplier = $uniqueUserAgents > 1 ? 1.5 : 1.0;
+
+            $baseScore = 100.0 * (1.0 - exp(-0.35 * ($uniqueIpsCount - 1)));
+            $botnetClusterScore = min(100.0, round($baseScore * $subnetMultiplier * $uaRotationMultiplier * 10.0) / 10.0);
         }
         return ['botnetClusterScore' => $botnetClusterScore];
     }
@@ -1432,20 +1482,20 @@ class RequestUtils
             return [];
         }
 
-        $suspiciousLogs = [];
-        $passedLogs = [];
+        $rawLogs = $trafficData;
+        $totalCount = count($rawLogs);
+
+        $maxLogsPerDevice = max(3, (int)floor($totalCount * 0.02));
+        $maxLogsPerIp = max(3, (int)floor($totalCount * 0.02));
+        $maxLogsPerSubnet = max(5, (int)floor($totalCount * 0.05));
+        $maxLogsPerHardwareCluster = max(3, (int)floor($totalCount * 0.02));
+
         $deviceCounts = [];
         $ipCounts = [];
         $subnetCounts = [];
         $hardwareClusterCounts = [];
         $hwClusterCache = [];
 
-        $totalCount = count($trafficData);
-        $maxLogsPerDevice = max(3, (int)floor($totalCount * 0.02)); // Max 2% contribution per device
-        $maxLogsPerIp = max(3, (int)floor($totalCount * 0.02));      // Max 2% par adresse IP individuelle
-        $maxLogsPerSubnet = max(5, (int)floor($totalCount * 0.05));  // Max 5% par bloc réseau (anti-proxy-rotation)
-        $maxLogsPerHardwareCluster = max(3, (int)floor($totalCount * 0.02)); // Max 2% par cluster matériel stable
-
         $getHardwareCluster = function (array $log) use (&$hwClusterCache): string {
             $fp = $log['deviceHash'] ?? $log['fingerprint'] ?? $log['deviceFingerprint'] ?? '';
             if (!empty($fp) && is_string($fp)) {
@@ -1472,7 +1522,40 @@ class RequestUtils
             return $log['deviceId'] ?? 'anonymous-cluster';
         };
 
-        foreach ($trafficData as $log) {
+        // --- REVOLUTION : Compression de Cohorte par Densité Vectorielle (Anti-Sybil) ---
+        $getVectorDistance = function (array $v1, array $v2): float {
+            $sum = 0.0;
+            $keys = array_unique(array_merge(array_keys($v1), array_keys($v2)));
+            foreach ($keys as $key) {
+                $sum += pow((float)($v1[$key] ?? 0.0) - (float)($v2[$key] ?? 0.0), 2);
+            }
+            return sqrt($sum);
+        };
+
+        $clusteredLogs = [];
+        foreach ($rawLogs as $log) {
+            $matchedClusterKey = null;
+            foreach ($clusteredLogs as $key => $cluster) {
+                if (($log['type'] ?? '') === ($cluster['type'] ?? '') && $getVectorDistance($log['vector'] ?? [], $cluster['vector'] ?? []) < 5.0) {
+                    $matchedClusterKey = $key;
+                    break;
+                }
+            }
+            if ($matchedClusterKey !== null) {
+                $clusteredLogs[$matchedClusterKey]['instancesCount'] = ($clusteredLogs[$matchedClusterKey]['instancesCount'] ?? 1) + 1;
+                $clusteredLogs[$matchedClusterKey]['weight'] = 1.0 + log((float)$clusteredLogs[$matchedClusterKey]['instancesCount']);
+            } else {
+                $logCopy = $log;
+                $logCopy['instancesCount'] = 1;
+                $logCopy['weight'] = 1.0;
+                $clusteredLogs[] = $logCopy;
+            }
+        }
+
+        $suspiciousLogs = [];
+        $passedLogs = [];
+
+        foreach ($clusteredLogs as $log) {
             $devId = $log['deviceId'] ?? 'anonymous';
             $ip = $log['clientIp'] ?? $log['ip'] ?? 'unknown';
             $subnet = self::getIpSubnet($ip) ?? 'unknown-subnet';