@anonympins/fingerprint 0.6.3 → 0.6.4

package/src/php/FingerprintEngine.php

@@ -237,6 +237,9 @@
          $this->logger = isset($securityConfig['logger']) && is_callable($securityConfig['logger']) ? new Logger($securityConfig['logger']) : null;
          $this->dryRun = $securityConfig['dryRun'] ?? false;
          $this->validateConfig($securityConfig);
+         if ($this->securityConfig['reset'] ?? false) {
+             $this->resetStore();
+         }
      }
 
     /**
@@ -252,6 +255,18 @@
         $this->log('Configuration mise à jour à chaud (Hot-Reloaded)', $this->securityConfig);
     }
 
+    /**
+     * Réinitialise le store de persistance actif.
+     */
+    public function resetStore(): void
+    {
+        $store = StoreManager::getStore();
+        if (method_exists($store, 'clear')) {
+            $store->clear();
+        }
+        $this->log('Store has been reset/cleared.');
+    }
+
      private function validateConfig(array $config): void
      {
          if (empty($config)) {
@@ -266,7 +281,7 @@
              'autotuning', 'enableUsefulWork', 'usefulWorkConfigPath', 'challengeNewDevices', 'graphql_operation_allowlist', 'dryRun',
              'similarityThreshold', 'summary', 'description',
              'ed25519_private_key', 'ed25519_public_key',
-             'wasm', 'enableProofOfSpace', 'pospace', 'federatedPeers', 'federationSecret'
+             'wasm', 'enableProofOfSpace', 'pospace', 'federatedPeers', 'federationSecret', 'reset'
          ];
 
          if (empty($config['weights'])) {
@@ -497,28 +512,50 @@
       */
      private function checkAllowlists(RequestContext $context): bool
      {
+         $whitelisted = false;
+         $type = '';
+
          if ($this->isIpInAllowlist($context->clientIp)) {
-             $this->log('IP in allowlist - allowing request', ['clientIp' => $context->clientIp]);
-             return true;
-         }
-         if ($this->isPathInAllowlist($context->path)) {
-             $this->log('Path in allowlist - allowing request', ['path' => $context->path]);
-             return true;
-         }
-         if ($this->isHostPathInAllowlist($context->getHeader('host'), $context->path)) {
-             $this->log('Host and path in allowlist - allowing request', ['host' => $context->getHeader('host'), 'path' => $context->path]);
-             return true;
-         }
-         // NOUVEAU: Vérifier la liste blanche GraphQL
-         if ($context->graphqlOperation && $this->isGraphqlOperationInAllowlist($context->graphqlOperation['type'], $context->graphqlOperation['name'])) {
-             $this->log('GraphQL operation in allowlist - allowing request', ['operation' => "{$context->graphqlOperation['type']}:{$context->graphqlOperation['name']}"]);
-             return true;
-         }
-         if ($this->verifyWhitelistedBot($context)) {
-             $this->log('Whitelisted bot verified - allowing request', ['clientIp' => $context->clientIp]);
+             $whitelisted = true;
+             $type = 'allowlist';
+         } elseif ($this->isPathInAllowlist($context->path)) {
+             $whitelisted = true;
+             $type = 'path_allowlist';
+         } elseif ($this->isHostPathInAllowlist($context->getHeader('host'), $context->path)) {
+             $whitelisted = true;
+             $type = 'host_path_allowlist';
+         } elseif ($context->graphqlOperation && $this->isGraphqlOperationInAllowlist($context->graphqlOperation['type'], $context->graphqlOperation['name'])) {
+             $whitelisted = true;
+             $type = 'graphql_operation_allowlist';
+         } elseif ($this->verifyWhitelistedBot($context)) {
+             $whitelisted = true;
+             $type = 'bot';
+         }
+
+         if ($whitelisted) {
+             $filterWhitelist = $this->securityConfig['filterWhitelist'] ?? false;
+             $bypassWhitelist = false;
+             if ($filterWhitelist === true) {
+                 $bypassWhitelist = $this->hasCertainAttack($context);
+             } elseif (is_numeric($filterWhitelist)) {
+                 if ($context->preCalculatedScore === null) {
+                     $suspicionVector = [];
+                     $context->preCalculatedVector = $this->getSuspicionVector($context, $suspicionVector);
+                     $context->preCalculatedScore = $this->calculateFinalScore($context->preCalculatedVector);
+                 }
+                 if ($context->preCalculatedScore > $filterWhitelist) {
+                     $bypassWhitelist = true;
+                 }
+             }
+
+             if ($bypassWhitelist) {
+                 $this->log('Whitelisted request exceeds filter threshold - bypassing whitelist bypass', ['clientIp' => $context->clientIp, 'path' => $context->path]);
+                 return false;
+             }
+             $this->log("IP/Path in allowlist ({$type}) - allowing request", ['clientIp' => $context->clientIp, 'path' => $context->path]);
              return true;
          }
- 
+
          return false;
      }
 
@@ -908,6 +945,23 @@
          }
      }
 
+     /**
+      * Évalue si la requête présente des caractéristiques d'attaque flagrantes ou a déclenché un honeypot.
+      */
+     private function hasCertainAttack(RequestContext $context): bool
+     {
+         $honeypotConfig = $this->securityConfig['honeypot'] ?? [];
+         $honeypot = RequestUtils::getHoneypotScore($context, $honeypotConfig);
+         if (($honeypot['honeypotScore'] ?? 0.0) >= 100.0) {
+             return true;
+         }
+         $bot = RequestUtils::getBotScore($context);
+         if (($bot['botScore'] ?? 0.0) >= 100.0) {
+             return true;
+         }
+         return false;
+     }
+
      /**
       * Traite une requête entrante et retourne une décision.
       * @param RequestContext $context Le contexte de la requête.
@@ -1032,6 +1086,28 @@
                                 $problemManager = \Anonympins\Fingerprint\ProblemManager::getInstance($configPath, $store);
                                  // FIX: La solution est directement le $workResult, pas une sous-propriété.
                                  $problemManager->integrateSolution($problemId, $workResult);
+
+                             // Si le problème résolu est l'auto-tuning de sécurité et que l'auto-tuning est activé,
+                             // on applique directement la meilleure solution calculée au moteur en direct.
+                             if ($problemId === 'security_auto_tuning' && ($this->securityConfig['autotuning']['enabled'] ?? false)) {
+                                 $paretoFront = $workResult['paretoFront'] ?? null;
+                                 if (is_array($paretoFront) && !empty($paretoFront)) {
+                                     $bestSolution = $paretoFront[0];
+                                     $minDistance = sqrt(pow((float)$bestSolution['objectives'][0], 2) + pow((float)$bestSolution['objectives'][1], 2));
+                                     for ($i = 1; $i < count($paretoFront); $i++) {
+                                         $distance = sqrt(pow((float)$paretoFront[$i]['objectives'][0], 2) + pow((float)$paretoFront[$i]['objectives'][1], 2));
+                                         if ($distance < $minDistance) {
+                                             $minDistance = $distance;
+                                             $bestSolution = $paretoFront[$i];
+                                         }
+                                     }
+                                     if (isset($bestSolution['solution'])) {
+                                         $this->updateConfig($bestSolution['solution']);
+                                         $this->log('Useful Work auto-tuning applied successfully to live config.');
+                                     }
+                                 }
+                             }
+
                                  $isValid = true;
                                  // FIX: Générer un vrai ticket pour uPoW, comme pour un PoW normal.
                                  $ticketTtl = $this->securityConfig['ticketMaxAge'] ?? 3600000; // 1 heure par défaut
@@ -1113,8 +1189,8 @@
              return $decision;
          }
 
-         $suspicionVector = $this->getSuspicionVector($context, $suspicionVector);
-         $finalScore = $this->calculateFinalScore($suspicionVector);
+         $suspicionVector = $context->preCalculatedVector ?? $this->getSuspicionVector($context, $suspicionVector);
+         $finalScore = $context->preCalculatedScore ?? $this->calculateFinalScore($suspicionVector);
          $this->log('Suspicion vector and final score calculated', [
              'finalScore' => round($finalScore, 2),
              'vector' => $suspicionVector
@@ -1354,7 +1430,8 @@
                  $memDifficulty = (int)round($memActivationFactor * 48); // 0 à 48MB
 
                  $originalFingerprint = RequestUtils::getCompositeDeviceHash($context);
-                 $baseBlock = ChallengeUtils::createCpuChallengeBaseBlock($nonce, $clientSecret, $originalFingerprint);
+                 $tlsSessionId = $context->tlsSessionId ?? '';
+                 $baseBlock = ChallengeUtils::createCpuChallengeBaseBlock($nonce, $clientSecret, $originalFingerprint, $context->clientIp, $tlsSessionId);
 
                  $challengeContext = [
                      'clientSecret' => $clientSecret,

package/src/php/Optimization/OptimizationOperators.php

@@ -70,18 +70,22 @@ class OptimizationOperators
      */
     public static function createFullSecurityConfigEvaluator(array $context): callable
     {
-        $trafficData = $context['trafficData'];
+        $trafficData = $context['trafficData'] ?? [];
+        $currentConfig = $context['currentConfig'] ?? null;
 
-        return function (array $config) use ($trafficData): array {
-            $falsePositives = 0;
-            $falseNegatives = 0;
-            $totalHumans = 0;
-            $totalBots = 0;
+        return function (array $config) use ($trafficData, $currentConfig): array {
+            $falsePositives = 0.0;
+            $falseNegatives = 0.0;
+            $totalHumans = 0.0;
+            $totalBots = 0.0;
+
+            $maxHumanScore = 0.0;
+            $minBotScore = 100.0;
 
             $calculateScore = function (array $log) use ($config): float {
                 $score = 0.0;
                 foreach ($config['weights'] as $key => $weight) {
-                    $score += ($log['vector'][$key] ?? 0) * $weight;
+                    $score += ($log['vector'][$key] ?? 0.0) * $weight;
                 }
                 return $score;
             };
@@ -94,30 +98,50 @@ class OptimizationOperators
                 'trap_triggered' => 2.0,
             ];
 
+            // 1. Évaluation sur les logs de trafic réels
             foreach ($trafficData as $log) {
-                $confidence = $confidenceWeights[$log['type']] ?? 1.0;
-                $isLikelyBot = in_array($log['type'], ['challenge_issued', 'request_blocked', 'trap_triggered']);
-                $isLikelyHuman = in_array($log['type'], ['request_passed', 'challenge_solved']);
+                $weight = (float)($log['weight'] ?? 1.0);
+                $confidence = ($confidenceWeights[$log['type'] ?? ''] ?? 1.0) * $weight;
+                $isLikelyBot = in_array($log['type'] ?? '', ['challenge_issued', 'request_blocked', 'trap_triggered']);
+                $isLikelyHuman = in_array($log['type'] ?? '', ['request_passed', 'challenge_solved']);
+
+                $score = $calculateScore($log);
 
                 if ($isLikelyBot) {
                     $totalBots += $confidence;
-                    $score = $calculateScore($log);
+                    $minBotScore = min($minBotScore, $score);
                     if ($score < $config['thresholds']['low']) {
                         $falseNegatives += $confidence;
                     }
                 } elseif ($isLikelyHuman) {
                     $totalHumans += $confidence;
-                    $score = $calculateScore($log);
+                    $maxHumanScore = max($maxHumanScore, $score);
                     if ($score >= $config['thresholds']['low']) {
                         $falsePositives += $confidence;
                     }
                 }
             }
 
-            $falsePositiveRate = $totalHumans > 0 ? $falsePositives / $totalHumans : 0;
-            $falseNegativeRate = $totalBots > 0 ? $falseNegatives / $totalBots : 0;
+            $falsePositiveRate = $totalHumans > 0.0 ? $falsePositives / $totalHumans : 0.0;
+            $falseNegativeRate = $totalBots > 0.0 ? $falseNegatives / $totalBots : 0.0;
+
+            // 3. Pénalité de dérive d'échelle (L2 Regularization par rapport au profil d'origine)
+            $regularizationPenalty = 0.0;
+            if ($currentConfig && isset($currentConfig['weights'])) {
+                foreach ($config['weights'] as $key => $val) {
+                    $originalVal = (float)($currentConfig['weights'][$key] ?? 0.0);
+                    $regularizationPenalty += pow((float)$val - $originalVal, 2);
+                }
+            }
+
+            // 4. Maximisation de la marge
+            $marginOverlap = max(0.0, $maxHumanScore - $minBotScore);
+            $marginPenalty = $marginOverlap / 100.0;
+
+            $obj1 = $falsePositiveRate + ($regularizationPenalty * 0.05);
+            $obj2 = $falseNegativeRate + $marginPenalty;
 
-            return [$falsePositiveRate, $falseNegativeRate];
+            return [$obj1, $obj2];
         };
     }
 

package/src/php/RequestContext.php

@@ -35,6 +35,10 @@ class RequestContext
     /** @var ?array<string, mixed> */
     public ?array $resolvedIdentity = null;
 
+    public ?float $preCalculatedScore = null;
+    /** @var ?array<string, float> */
+    public ?array $preCalculatedVector = null;
+
     // Propriétés spécifiques qui peuvent être fournies par un proxy inverse
     public ?string $ja3 = null;
     public ?string $ja4 = null;

package/src/php/Store/IStore.php

@@ -39,4 +39,10 @@ interface IStore
      * @return void
      */
     public function delete(string $key): void;
+
+    /**
+     * Supprime toutes les clés du stockage.
+     * @return void
+     */
+    public function clear(): void;
 }

package/src/php/Store/MongoDbStore.php

@@ -182,4 +182,16 @@ class MongoDbStore implements IStore
             $this->lastReconnectAttempt = microtime(true);
         }
     }
+
+    public function clear(): void
+    {
+        $this->fallbackStore->clear();
+        $this->checkConnection();
+        if ($this->isDown) return;
+        try {
+            $this->collection->deleteMany([]);
+        } catch (\Throwable $e) {
+            $this->isDown = true;
+        }
+    }
 }

package/src/php/Store/RedisStore.php

@@ -131,4 +131,16 @@ class RedisStore implements IStore
             $this->lastReconnectAttempt = microtime(true);
         }
     }
+
+    public function clear(): void
+    {
+        $this->fallbackStore->clear();
+        $this->checkConnection();
+        if ($this->isDown) return;
+        try {
+            $this->redis->flushdb();
+        } catch (\Throwable $e) {
+            $this->isDown = true;
+        }
+    }
 }

package/src/php/Tests/FingerprintEngineTest.php

@@ -228,6 +228,52 @@ class FingerprintEngineTest extends TestCase
         $this->assertContains($decision['action'], ['challenge', 'block']);
     }
 
+    public function testAllowsWhitelistedIpWithNumericFilterBelowThreshold(): void
+    {
+        $config = SecurityProfiles::createSecurityProfile('strict', [
+            'whitelist' => [['type' => 'allowlist', 'entries' => ['10.0.0.1']]],
+            'filterWhitelist' => 50.0,
+            'weights' => ['headerAnomalyScore' => 1.0],
+            'thresholds' => ['low' => 20, 'medium' => 45, 'high' => 75, 'block' => 95]
+        ]);
+        $engine = new FingerprintEngine($config);
+
+        $context = $this->createRequestContext([
+            'clientIp' => '10.0.0.1',
+            'headers' => [
+                'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
+                'accept-language' => 'en-US,en;q=0.9'
+            ]
+        ]);
+        $decision = $engine->processRequest($context);
+
+        $this->assertEquals('next', $decision['action']);
+        $this->assertEquals(0, $decision['score']);
+    }
+
+    public function testAllowsWhitelistedIpWithNumericFilterExceedingThreshold(): void
+    {
+        $config = SecurityProfiles::createSecurityProfile('strict', [
+            'whitelist' => [['type' => 'allowlist', 'entries' => ['10.0.0.1']]],
+            'filterWhitelist' => 20.0,
+            'weights' => ['headerAnomalyScore' => 1.0],
+            'thresholds' => ['low' => 20, 'medium' => 45, 'high' => 75, 'block' => 95]
+        ]);
+        $engine = new FingerprintEngine($config);
+
+        $context = $this->createRequestContext([
+            'clientIp' => '10.0.0.1',
+            'headers' => [
+                'user-agent' => 'Chrome',
+                'accept-language' => 'en-US,en;q=0.9'
+            ]
+        ]);
+        $decision = $engine->processRequest($context);
+
+        $this->assertEquals('challenge', $decision['action']);
+        $this->assertEquals(60, $decision['score']);
+    }
+
     public function testAllowsWhitelistedIp(): void
     {
         $config = SecurityProfiles::createSecurityProfile('strict', [

package/src/php/Tests/IpReputationTest.php

@@ -25,6 +25,7 @@ class IpReputationTest extends TestCase
             public function set(string $key, $value, ?int $ttl = null): void { $this->data[$key] = $value; }
             public function has(string $key): bool { return isset($this->data[$key]); }
             public function delete(string $key): void { unset($this->data[$key]); }
+            public function clear(): void { $this->data = []; }
         };
 
         StoreManager::setStore($this->store);

package/src/php/Utils/RequestUtils.php

@@ -1482,20 +1482,20 @@ class RequestUtils
             return [];
         }
 
-        $suspiciousLogs = [];
-        $passedLogs = [];
+        $rawLogs = $trafficData;
+        $totalCount = count($rawLogs);
+
+        $maxLogsPerDevice = max(3, (int)floor($totalCount * 0.02));
+        $maxLogsPerIp = max(3, (int)floor($totalCount * 0.02));
+        $maxLogsPerSubnet = max(5, (int)floor($totalCount * 0.05));
+        $maxLogsPerHardwareCluster = max(3, (int)floor($totalCount * 0.02));
+
         $deviceCounts = [];
         $ipCounts = [];
         $subnetCounts = [];
         $hardwareClusterCounts = [];
         $hwClusterCache = [];
 
-        $totalCount = count($trafficData);
-        $maxLogsPerDevice = max(3, (int)floor($totalCount * 0.02)); // Max 2% contribution per device
-        $maxLogsPerIp = max(3, (int)floor($totalCount * 0.02));      // Max 2% par adresse IP individuelle
-        $maxLogsPerSubnet = max(5, (int)floor($totalCount * 0.05));  // Max 5% par bloc réseau (anti-proxy-rotation)
-        $maxLogsPerHardwareCluster = max(3, (int)floor($totalCount * 0.02)); // Max 2% par cluster matériel stable
-
         $getHardwareCluster = function (array $log) use (&$hwClusterCache): string {
             $fp = $log['deviceHash'] ?? $log['fingerprint'] ?? $log['deviceFingerprint'] ?? '';
             if (!empty($fp) && is_string($fp)) {
@@ -1522,7 +1522,40 @@ class RequestUtils
             return $log['deviceId'] ?? 'anonymous-cluster';
         };
 
-        foreach ($trafficData as $log) {
+        // --- REVOLUTION : Compression de Cohorte par Densité Vectorielle (Anti-Sybil) ---
+        $getVectorDistance = function (array $v1, array $v2): float {
+            $sum = 0.0;
+            $keys = array_unique(array_merge(array_keys($v1), array_keys($v2)));
+            foreach ($keys as $key) {
+                $sum += pow((float)($v1[$key] ?? 0.0) - (float)($v2[$key] ?? 0.0), 2);
+            }
+            return sqrt($sum);
+        };
+
+        $clusteredLogs = [];
+        foreach ($rawLogs as $log) {
+            $matchedClusterKey = null;
+            foreach ($clusteredLogs as $key => $cluster) {
+                if (($log['type'] ?? '') === ($cluster['type'] ?? '') && $getVectorDistance($log['vector'] ?? [], $cluster['vector'] ?? []) < 5.0) {
+                    $matchedClusterKey = $key;
+                    break;
+                }
+            }
+            if ($matchedClusterKey !== null) {
+                $clusteredLogs[$matchedClusterKey]['instancesCount'] = ($clusteredLogs[$matchedClusterKey]['instancesCount'] ?? 1) + 1;
+                $clusteredLogs[$matchedClusterKey]['weight'] = 1.0 + log((float)$clusteredLogs[$matchedClusterKey]['instancesCount']);
+            } else {
+                $logCopy = $log;
+                $logCopy['instancesCount'] = 1;
+                $logCopy['weight'] = 1.0;
+                $clusteredLogs[] = $logCopy;
+            }
+        }
+
+        $suspiciousLogs = [];
+        $passedLogs = [];
+
+        foreach ($clusteredLogs as $log) {
             $devId = $log['deviceId'] ?? 'anonymous';
             $ip = $log['clientIp'] ?? $log['ip'] ?? 'unknown';
             $subnet = self::getIpSubnet($ip) ?? 'unknown-subnet';