@anonympins/fingerprint 0.6.3 → 0.6.5

package/src/php/Optimization/OptimizationOperators.php

@@ -70,18 +70,55 @@ class OptimizationOperators
      */
     public static function createFullSecurityConfigEvaluator(array $context): callable
     {
-        $trafficData = $context['trafficData'];
+        $trafficData = $context['trafficData'] ?? [];
+        $currentConfig = $context['currentConfig'] ?? null;
 
-        return function (array $config) use ($trafficData): array {
-            $falsePositives = 0;
-            $falseNegatives = 0;
-            $totalHumans = 0;
-            $totalBots = 0;
+        return function (array $config) use ($trafficData, $currentConfig): array {
+            $threatProfiles = [
+                'account_takeover' => [
+                    'importance' => 10.0,
+                    'ux_vs_security_ratio' => 0.1,
+                    'target_threshold' => 'block',
+                    'indicators' => ['requestPatternScore', 'behaviorScore', 'timeInconsistencyScore', 'clickVarianceScore']
+                ],
+                'active_exploitation' => [
+                    'importance' => 8.0,
+                    'ux_vs_security_ratio' => 0.2,
+                    'target_threshold' => 'block',
+                    'indicators' => ['honeypotScore', 'headerAnomalyScore']
+                ],
+                'mass_scraping' => [
+                    'importance' => 3.0,
+                    'ux_vs_security_ratio' => 0.8,
+                    'target_threshold' => 'low',
+                    'indicators' => ['requestPatternScore', 'renderingAnomalyScore', 'clientHintsInconsistencyScore']
+                ],
+                'distributed_botnets' => [
+                    'importance' => 6.0,
+                    'ux_vs_security_ratio' => 0.5,
+                    'target_threshold' => 'high',
+                    'indicators' => ['subnetScore', 'botnetClusterScore', 'ipReputationScore', 'tlsSpoofingScore']
+                ],
+                'basic_automation' => [
+                    'importance' => 5.0,
+                    'ux_vs_security_ratio' => 0.4,
+                    'target_threshold' => 'medium',
+                    'indicators' => ['botScore', 'tlsSpoofingScore', 'tcpAnomalyScore']
+                ]
+            ];
+
+            $threatStats = [];
+            foreach ($threatProfiles as $name => $profile) {
+                $threatStats[$name] = ['fp' => 0.0, 'fn' => 0.0, 'totalHumans' => 0.0, 'totalBots' => 0.0];
+            }
+
+            $maxHumanScore = 0.0;
+            $minBotScore = 100.0;
 
             $calculateScore = function (array $log) use ($config): float {
                 $score = 0.0;
                 foreach ($config['weights'] as $key => $weight) {
-                    $score += ($log['vector'][$key] ?? 0) * $weight;
+                    $score += ($log['vector'][$key] ?? 0.0) * $weight;
                 }
                 return $score;
             };
@@ -94,30 +131,84 @@ class OptimizationOperators
                 'trap_triggered' => 2.0,
             ];
 
+            // 1. Évaluation sur les logs de trafic réels
             foreach ($trafficData as $log) {
-                $confidence = $confidenceWeights[$log['type']] ?? 1.0;
-                $isLikelyBot = in_array($log['type'], ['challenge_issued', 'request_blocked', 'trap_triggered']);
-                $isLikelyHuman = in_array($log['type'], ['request_passed', 'challenge_solved']);
+                $weight = (float)($log['weight'] ?? 1.0);
+                $confidence = ($confidenceWeights[$log['type'] ?? ''] ?? 1.0) * $weight;
+                $isLikelyBot = in_array($log['type'] ?? '', ['challenge_issued', 'request_blocked', 'trap_triggered']);
+                $isLikelyHuman = in_array($log['type'] ?? '', ['request_passed', 'challenge_solved']);
+
+                $score = $calculateScore($log);
 
                 if ($isLikelyBot) {
-                    $totalBots += $confidence;
-                    $score = $calculateScore($log);
-                    if ($score < $config['thresholds']['low']) {
-                        $falseNegatives += $confidence;
-                    }
+                    $minBotScore = min($minBotScore, $score);
                 } elseif ($isLikelyHuman) {
-                    $totalHumans += $confidence;
-                    $score = $calculateScore($log);
-                    if ($score >= $config['thresholds']['low']) {
-                        $falsePositives += $confidence;
+                    $maxHumanScore = max($maxHumanScore, $score);
+                }
+
+                foreach ($threatProfiles as $name => $profile) {
+                    $threatActivity = 0.0;
+                    foreach ($profile['indicators'] as $indicator) {
+                        $threatActivity += (float)($log['vector'][$indicator] ?? 0.0);
+                    }
+                    if ($threatActivity <= 0.0) {
+                        continue;
+                    }
+                    $effectiveConfidence = $confidence * ($threatActivity / 100.0);
+                    $targetThreshold = (float)($config['thresholds'][$profile['target_threshold']] ?? 20.0);
+
+                    if ($isLikelyBot) {
+                        $threatStats[$name]['totalBots'] += $effectiveConfidence;
+                        if ($score < $targetThreshold) {
+                            $threatStats[$name]['fn'] += $effectiveConfidence;
+                        }
+                    } elseif ($isLikelyHuman) {
+                        $threatStats[$name]['totalHumans'] += $effectiveConfidence;
+                        if ($score >= $targetThreshold) {
+                            $threatStats[$name]['fp'] += $effectiveConfidence;
+                        }
                     }
                 }
             }
 
-            $falsePositiveRate = $totalHumans > 0 ? $falsePositives / $totalHumans : 0;
-            $falseNegativeRate = $totalBots > 0 ? $falseNegatives / $totalBots : 0;
+            $weightedFpr = 0.0;
+            $weightedFnr = 0.0;
+            $totalImportance = 0.0;
 
-            return [$falsePositiveRate, $falseNegativeRate];
+            foreach ($threatProfiles as $name => $profile) {
+                $totalImportance += $profile['importance'];
+            }
+
+            foreach ($threatProfiles as $name => $profile) {
+                $stats = $threatStats[$name];
+                $fpr = $stats['totalHumans'] > 0 ? $stats['fp'] / $stats['totalHumans'] : 0.0;
+                $fnr = $stats['totalBots'] > 0 ? $stats['fn'] / $stats['totalBots'] : 0.0;
+
+                $importanceWeight = $profile['importance'] / $totalImportance;
+                $uxRatio = $profile['ux_vs_security_ratio'];
+                $secRatio = 1.0 - $uxRatio;
+
+                $weightedFpr += $fpr * $importanceWeight * $uxRatio;
+                $weightedFnr += $fnr * $importanceWeight * $secRatio;
+            }
+
+            // 3. Pénalité de dérive d'échelle (L2 Regularization par rapport au profil d'origine)
+            $regularizationPenalty = 0.0;
+            if ($currentConfig && isset($currentConfig['weights'])) {
+                foreach ($config['weights'] as $key => $val) {
+                    $originalVal = (float)($currentConfig['weights'][$key] ?? 0.0);
+                    $regularizationPenalty += pow((float)$val - $originalVal, 2);
+                }
+            }
+
+            // 4. Maximisation de la marge
+            $marginOverlap = max(0.0, $maxHumanScore - $minBotScore);
+            $marginPenalty = $marginOverlap / 100.0;
+
+            $obj1 = $weightedFpr + ($regularizationPenalty * 0.05);
+            $obj2 = $weightedFnr + $marginPenalty;
+
+            return [$obj1, $obj2];
         };
     }
 
@@ -136,9 +227,7 @@ class OptimizationOperators
             $child = $c1;
             foreach (['thresholds', 'weights', 'patterns'] as $section) {
                 foreach ($child[$section] as $key => $value) {
-                    if ($key !== 'honeypotScore') {
-                        $child[$section][$key] = ($c1[$section][$key] + $c2[$section][$key]) / 2;
-                    }
+                    $child[$section][$key] = ($c1[$section][$key] + $c2[$section][$key]) / 2;
                 }
             }
             return $child;
@@ -153,7 +242,7 @@ class OptimizationOperators
             foreach (['thresholds', 'weights', 'patterns'] as $section) {
                 if (isset($config[$section]) && is_array($config[$section])) {
                     foreach ($config[$section] as $k => $v) {
-                        if (is_numeric($v) && $k !== 'honeypotScore') {
+                        if (is_numeric($v)) {
                             $randomVariation = 1.0 + (self::secureRandom() - 0.5) * 0.5; // Variation de +/- 25%
                             $ind[$section][$k] = $v * $randomVariation;
                         } else {
@@ -173,9 +262,9 @@ class OptimizationOperators
         $mutate = function (array $c, ?array $currentConfigRef = null) use ($currentConfig): array {
             $newConfig = $c;
             $sections = [
-                ['name' => 'patterns', 'weight' => 0.5],
-                ['name' => 'weights', 'weight' => 0.35],
-                ['name' => 'thresholds', 'weight' => 0.15]
+                ['name' => 'patterns', 'weight' => 0.50],
+                ['name' => 'thresholds', 'weight' => 0.25],
+                ['name' => 'weights', 'weight' => 0.25]
             ];
             $rand = self::secureRandom();
             $cumulativeWeight = 0;
@@ -191,13 +280,16 @@ class OptimizationOperators
             $keys = array_keys($newConfig[$sectionToMutate]);
             $keyToMutate = $keys[random_int(0, count($keys) - 1)];
 
-            if ($keyToMutate === 'honeypotScore') return $newConfig;
-
-            $mutationAmount = (self::secureRandom() - 0.5) * 0.4;
-            $newConfig[$sectionToMutate][$keyToMutate] *= (1 + $mutationAmount);
-
             if ($sectionToMutate === 'weights') {
-                $newConfig[$sectionToMutate][$keyToMutate] = max(0, min(1.5, $newConfig[$sectionToMutate][$keyToMutate]));
+                $newConfig[$sectionToMutate][$keyToMutate] = max(0.05, min(1.5, $newConfig[$sectionToMutate][$keyToMutate] + (self::secureRandom() - 0.5) * 0.1));
+            } elseif ($sectionToMutate === 'thresholds') {
+                $newConfig[$sectionToMutate][$keyToMutate] = (int)round($newConfig[$sectionToMutate][$keyToMutate] + (self::secureRandom() - 0.5) * 5.0);
+            } else {
+                if ($keyToMutate === 'decayFactor') {
+                    $newConfig['patterns']['decayFactor'] = max(0.8, min(0.999, $newConfig['patterns']['decayFactor'] + (self::secureRandom() - 0.5) * 0.05));
+                } elseif (str_contains($keyToMutate, 'Threshold') || str_contains($keyToMutate, 'Reset')) {
+                    $newConfig['patterns'][$keyToMutate] = max(50.0, $newConfig['patterns'][$keyToMutate] + (self::secureRandom() - 0.5) * 50.0);
+                }
             }
 
             $refConfig = $currentConfigRef ?? $currentConfig;

package/src/php/RequestContext.php

@@ -35,6 +35,10 @@ class RequestContext
     /** @var ?array<string, mixed> */
     public ?array $resolvedIdentity = null;
 
+    public ?float $preCalculatedScore = null;
+    /** @var ?array<string, float> */
+    public ?array $preCalculatedVector = null;
+
     // Propriétés spécifiques qui peuvent être fournies par un proxy inverse
     public ?string $ja3 = null;
     public ?string $ja4 = null;

package/src/php/Store/IStore.php

@@ -39,4 +39,10 @@ interface IStore
      * @return void
      */
     public function delete(string $key): void;
+
+    /**
+     * Supprime toutes les clés du stockage.
+     * @return void
+     */
+    public function clear(): void;
 }

package/src/php/Store/MongoDbStore.php

@@ -182,4 +182,16 @@ class MongoDbStore implements IStore
             $this->lastReconnectAttempt = microtime(true);
         }
     }
+
+    public function clear(): void
+    {
+        $this->fallbackStore->clear();
+        $this->checkConnection();
+        if ($this->isDown) return;
+        try {
+            $this->collection->deleteMany([]);
+        } catch (\Throwable $e) {
+            $this->isDown = true;
+        }
+    }
 }

package/src/php/Store/RedisStore.php

@@ -131,4 +131,16 @@ class RedisStore implements IStore
             $this->lastReconnectAttempt = microtime(true);
         }
     }
+
+    public function clear(): void
+    {
+        $this->fallbackStore->clear();
+        $this->checkConnection();
+        if ($this->isDown) return;
+        try {
+            $this->redis->flushdb();
+        } catch (\Throwable $e) {
+            $this->isDown = true;
+        }
+    }
 }

package/src/php/Tests/ChallengeUtilsTest.php

@@ -53,7 +53,9 @@ class ChallengeUtilsTest extends TestCase
 
         // Tamper with value on verified sample index 12
         $tampered = $solutions;
-        $tampered[12] = (string)((float)$tampered[12] + 0.0002); // Out of tolerance
+        $sampleIndices = ChallengeUtils::deriveSampleIndices('127.0.0.1', 'gpu-pow-salt');
+        $tamperedIndex = $sampleIndices[0];
+        $tampered[$tamperedIndex] = (string)((float)$tampered[$tamperedIndex] + 0.0002); // Out of tolerance
         $this->assertFalse(ChallengeUtils::verifyGpuPow($seed, $iterations, implode(',', $tampered)));
     }
 
@@ -85,8 +87,10 @@ class ChallengeUtilsTest extends TestCase
         }
         $solutionString = implode(',', $solutions);
         $this->assertTrue(ChallengeUtils::verifyGpuPow($seed, $iterations, $solutionString));
+        $sampleIndices = ChallengeUtils::deriveSampleIndices('127.0.0.1', 'gpu-pow-salt');
+        $tamperedIndex = $sampleIndices[0];
         $tamperedSolutions = $solutions;
-        $tamperedSolutions[0] = (string)((float)$tamperedSolutions[0] + 0.1);
+        $tamperedSolutions[$tamperedIndex] = (string)((float)$tamperedSolutions[$tamperedIndex] + 0.1);
         $this->assertFalse(ChallengeUtils::verifyGpuPow($seed, $iterations, implode(',', $tamperedSolutions)));
     }
 

package/src/php/Tests/FingerprintEngineTest.php

@@ -228,6 +228,52 @@ class FingerprintEngineTest extends TestCase
         $this->assertContains($decision['action'], ['challenge', 'block']);
     }
 
+    public function testAllowsWhitelistedIpWithNumericFilterBelowThreshold(): void
+    {
+        $config = SecurityProfiles::createSecurityProfile('strict', [
+            'whitelist' => [['type' => 'allowlist', 'entries' => ['10.0.0.1']]],
+            'filterWhitelist' => 50.0,
+            'weights' => ['headerAnomalyScore' => 1.0],
+            'thresholds' => ['low' => 20, 'medium' => 45, 'high' => 75, 'block' => 95]
+        ]);
+        $engine = new FingerprintEngine($config);
+
+        $context = $this->createRequestContext([
+            'clientIp' => '10.0.0.1',
+            'headers' => [
+                'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36',
+                'accept-language' => 'en-US,en;q=0.9'
+            ]
+        ]);
+        $decision = $engine->processRequest($context);
+
+        $this->assertEquals('next', $decision['action']);
+        $this->assertEquals(0, $decision['score']);
+    }
+
+    public function testAllowsWhitelistedIpWithNumericFilterExceedingThreshold(): void
+    {
+        $config = SecurityProfiles::createSecurityProfile('strict', [
+            'whitelist' => [['type' => 'allowlist', 'entries' => ['10.0.0.1']]],
+            'filterWhitelist' => 20.0,
+            'weights' => ['headerAnomalyScore' => 1.0],
+            'thresholds' => ['low' => 20, 'medium' => 45, 'high' => 75, 'block' => 95]
+        ]);
+        $engine = new FingerprintEngine($config);
+
+        $context = $this->createRequestContext([
+            'clientIp' => '10.0.0.1',
+            'headers' => [
+                'user-agent' => 'Chrome',
+                'accept-language' => 'en-US,en;q=0.9'
+            ]
+        ]);
+        $decision = $engine->processRequest($context);
+
+        $this->assertEquals('challenge', $decision['action']);
+        $this->assertEquals(60, $decision['score']);
+    }
+
     public function testAllowsWhitelistedIp(): void
     {
         $config = SecurityProfiles::createSecurityProfile('strict', [

package/src/php/Tests/IpReputationTest.php

@@ -25,6 +25,7 @@ class IpReputationTest extends TestCase
             public function set(string $key, $value, ?int $ttl = null): void { $this->data[$key] = $value; }
             public function has(string $key): bool { return isset($this->data[$key]); }
             public function delete(string $key): void { unset($this->data[$key]); }
+            public function clear(): void { $this->data = []; }
         };
 
         StoreManager::setStore($this->store);

package/src/php/Utils/RequestUtils.php

@@ -1482,20 +1482,20 @@ class RequestUtils
             return [];
         }
 
-        $suspiciousLogs = [];
-        $passedLogs = [];
+        $rawLogs = $trafficData;
+        $totalCount = count($rawLogs);
+
+        $maxLogsPerDevice = max(3, (int)floor($totalCount * 0.02));
+        $maxLogsPerIp = max(3, (int)floor($totalCount * 0.02));
+        $maxLogsPerSubnet = max(5, (int)floor($totalCount * 0.05));
+        $maxLogsPerHardwareCluster = max(3, (int)floor($totalCount * 0.02));
+
         $deviceCounts = [];
         $ipCounts = [];
         $subnetCounts = [];
         $hardwareClusterCounts = [];
         $hwClusterCache = [];
 
-        $totalCount = count($trafficData);
-        $maxLogsPerDevice = max(3, (int)floor($totalCount * 0.02)); // Max 2% contribution per device
-        $maxLogsPerIp = max(3, (int)floor($totalCount * 0.02));      // Max 2% par adresse IP individuelle
-        $maxLogsPerSubnet = max(5, (int)floor($totalCount * 0.05));  // Max 5% par bloc réseau (anti-proxy-rotation)
-        $maxLogsPerHardwareCluster = max(3, (int)floor($totalCount * 0.02)); // Max 2% par cluster matériel stable
-
         $getHardwareCluster = function (array $log) use (&$hwClusterCache): string {
             $fp = $log['deviceHash'] ?? $log['fingerprint'] ?? $log['deviceFingerprint'] ?? '';
             if (!empty($fp) && is_string($fp)) {
@@ -1522,7 +1522,40 @@ class RequestUtils
             return $log['deviceId'] ?? 'anonymous-cluster';
         };
 
-        foreach ($trafficData as $log) {
+        // --- REVOLUTION : Compression de Cohorte par Densité Vectorielle (Anti-Sybil) ---
+        $getVectorDistance = function (array $v1, array $v2): float {
+            $sum = 0.0;
+            $keys = array_unique(array_merge(array_keys($v1), array_keys($v2)));
+            foreach ($keys as $key) {
+                $sum += pow((float)($v1[$key] ?? 0.0) - (float)($v2[$key] ?? 0.0), 2);
+            }
+            return sqrt($sum);
+        };
+
+        $clusteredLogs = [];
+        foreach ($rawLogs as $log) {
+            $matchedClusterKey = null;
+            foreach ($clusteredLogs as $key => $cluster) {
+                if (($log['type'] ?? '') === ($cluster['type'] ?? '') && $getVectorDistance($log['vector'] ?? [], $cluster['vector'] ?? []) < 5.0) {
+                    $matchedClusterKey = $key;
+                    break;
+                }
+            }
+            if ($matchedClusterKey !== null) {
+                $clusteredLogs[$matchedClusterKey]['instancesCount'] = ($clusteredLogs[$matchedClusterKey]['instancesCount'] ?? 1) + 1;
+                $clusteredLogs[$matchedClusterKey]['weight'] = 1.0 + log((float)$clusteredLogs[$matchedClusterKey]['instancesCount']);
+            } else {
+                $logCopy = $log;
+                $logCopy['instancesCount'] = 1;
+                $logCopy['weight'] = 1.0;
+                $clusteredLogs[] = $logCopy;
+            }
+        }
+
+        $suspiciousLogs = [];
+        $passedLogs = [];
+
+        foreach ($clusteredLogs as $log) {
             $devId = $log['deviceId'] ?? 'anonymous';
             $ip = $log['clientIp'] ?? $log['ip'] ?? 'unknown';
             $subnet = self::getIpSubnet($ip) ?? 'unknown-subnet';