@anonympins/fingerprint 0.6.4 → 0.6.5

package/src/php/AutoTuner.php

@@ -53,6 +53,47 @@ class AutoTuner
         $this->onCleanup = $options['onCleanup'] ?? null;
         $this->savePath = $options['savePath'] ?? null;
         $this->validationTolerance = $options['validationTolerance'] ?? 0.15;
+
+        if (isset($this->securityConfig['logger']) && is_callable($this->securityConfig['logger']) && !isset($this->securityConfig['logger_wrapped'])) {
+            $originalLogger = $this->securityConfig['logger'];
+            $maxPercentage = $this->securityConfig['autotuning']['maxDensityPercentage'] ?? 0.02;
+
+            $this->securityConfig['logger'] = function (array $log) use ($originalLogger, $maxPercentage) {
+                $ip = $log['clientIp'] ?? $log['ip'] ?? null;
+                $subnet = $ip ? RequestUtils::getIpSubnet($ip, 24, 48) : null;
+                $fp = $log['deviceHash'] ?? $log['fingerprint'] ?? $log['deviceFingerprint'] ?? null;
+                $stableFp = $fp ? RequestUtils::extractStablePart($fp) : null;
+
+                if (count($this->trafficData) > 0) {
+                    $total = count($this->trafficData);
+                    $ipMatchCount = 0;
+                    $fpMatchCount = 0;
+                    $matchedKey = null;
+
+                    foreach ($this->trafficData as $key => $existingLog) {
+                        $logIp = $existingLog['clientIp'] ?? $existingLog['ip'] ?? null;
+                        $logSubnet = $logIp ? RequestUtils::getIpSubnet($logIp, 24, 48) : null;
+                        $logFp = $existingLog['deviceHash'] ?? $existingLog['fingerprint'] ?? $existingLog['deviceFingerprint'] ?? null;
+                        $logStableFp = $logFp ? RequestUtils::extractStablePart($logFp) : null;
+
+                        $isIpMatch = $subnet && $logSubnet === $subnet;
+                        $isFpMatch = $stableFp && $logStableFp === $stableFp;
+                        if ($isIpMatch) $ipMatchCount++;
+                        if ($isFpMatch) $fpMatchCount++;
+                        if ($isIpMatch || $isFpMatch) $matchedKey = $key;
+                    }
+                    if (($subnet && ($ipMatchCount / $total) > $maxPercentage) || ($stableFp && ($fpMatchCount / $total) > $maxPercentage)) {
+                        if ($matchedKey !== null) {
+                            $this->trafficData[$matchedKey]['instancesCount'] = ($this->trafficData[$matchedKey]['instancesCount'] ?? 1) + 1;
+                            $this->trafficData[$matchedKey]['weight'] = ($this->trafficData[$matchedKey]['weight'] ?? 1.0) + 1.0;
+                        }
+                        return;
+                    }
+                }
+                $originalLogger($log);
+            };
+            $this->securityConfig['logger_wrapped'] = true;
+        }
     }
 
     /**

package/src/php/Challenge/ChallengeUtils.php

@@ -32,12 +32,33 @@ class ChallengeUtils
         return abs($hash % 1000000) / 1000000;
     }
 
-    public static function verifyGpuPow(string $seed, int $iterations, string $solution, array $sampleIndices = [0, 12, 35, 57]): bool
+    public static function deriveSampleIndices(string $clientIp, string $secret): array
+    {
+        $timeWindow = (int)floor(time() / (60 * 5));
+        $message = "{$clientIp}:{$timeWindow}";
+        $hmacHex = hash_hmac('sha256', $message, $secret ?: 'gpu-pow-salt');
+        $hmacBytes = array_values(unpack('C*', hex2bin($hmacHex)));
+
+        $indices = [];
+        for ($i = 0; $i < 4; $i++) {
+            $offset = ($i * 2) % count($hmacBytes);
+            $value = ($hmacBytes[$offset] << 8) | $hmacBytes[($offset + 1) % count($hmacBytes)];
+            $idx = $value % 64;
+            while (in_array($idx, $indices, true)) {
+                $idx = ($idx + 1) % 64;
+            }
+            $indices[] = $idx;
+        }
+        return $indices;
+    }
+
+    public static function verifyGpuPow(string $seed, int $iterations, string $solution, string $clientIp = '127.0.0.1', string $secret = 'gpu-pow-salt'): bool
     {
         $values = explode(',', $solution);
         if (count($values) !== 64) {
             return false;
         }
+        $sampleIndices = self::deriveSampleIndices($clientIp, $secret);
         $numericSeed = self::hashSeedToFloat($seed);
         $r = 3.9999;
         foreach ($sampleIndices as $idx) {
@@ -203,9 +224,22 @@ class ChallengeUtils
                 return ['error' => 'Missing signature'];
             }
 
-            // Ban the ZKP public key for 30 days
-            $store->set("banned-zkp-y:{$zkpY}", true, 86400 * 30);
-            return ['status' => 'synchronized'];
+            $peersKey = "fed-peers:{$zkpY}";
+            $reportedPeers = $store->get($peersKey) ?: [];
+            if (!is_array($reportedPeers)) {
+                $reportedPeers = [];
+            }
+            if (!in_array($clientIp, $reportedPeers, true)) {
+                $reportedPeers[] = $clientIp;
+                $store->set($peersKey, $reportedPeers, 86400 * 30);
+            }
+
+            $threshold = $config['federationConsensusThreshold'] ?? 3;
+            if (count($reportedPeers) >= $threshold) {
+                $store->set("banned-zkp-y:{$zkpY}", true, 86400 * 30);
+                return ['status' => 'synchronized', 'banned' => true];
+            }
+            return ['status' => 'synchronized', 'banned' => false, 'reportsCount' => count($reportedPeers)];
         }
 
         $nodeId = $params['node_id'] ?? '';

package/src/php/FingerprintEngine.php

@@ -1249,10 +1249,21 @@
                  // 1. Valider cryptographiquement la preuve avant de bannir/diffuser
                  if (ChallengeUtils::verifyZkpProof($zkpY, $zkpT, $zkpS)) {
                      // 2. Dédoublonner : Ne diffuser que si la clé n'est pas déjà bannie
-                     if (!$store->has("banned-zkp-y:{$zkpY}")) {
+                     $peersKey = "fed-peers:{$zkpY}";
+                     $reportedPeers = $store->get($peersKey) ?: [];
+                     if (!is_array($reportedPeers)) {
+                         $reportedPeers = [];
+                     }
+                     if (!in_array('local', $reportedPeers, true)) {
+                         $reportedPeers[] = 'local';
+                         $store->set($peersKey, $reportedPeers, 86400 * 30);
+                     }
+
+                     $threshold = $this->securityConfig['federationConsensusThreshold'] ?? 3;
+                     if (count($reportedPeers) >= $threshold) {
                          $store->set("banned-zkp-y:{$zkpY}", true, 86400 * 30);
-                         $this->broadcastBannedZkp($zkpY);
                      }
+                     $this->broadcastBannedZkp($zkpY);
                  }
              }
 

package/src/php/Optimization/OptimizationOperators.php

@@ -74,10 +74,43 @@ class OptimizationOperators
         $currentConfig = $context['currentConfig'] ?? null;
 
         return function (array $config) use ($trafficData, $currentConfig): array {
-            $falsePositives = 0.0;
-            $falseNegatives = 0.0;
-            $totalHumans = 0.0;
-            $totalBots = 0.0;
+            $threatProfiles = [
+                'account_takeover' => [
+                    'importance' => 10.0,
+                    'ux_vs_security_ratio' => 0.1,
+                    'target_threshold' => 'block',
+                    'indicators' => ['requestPatternScore', 'behaviorScore', 'timeInconsistencyScore', 'clickVarianceScore']
+                ],
+                'active_exploitation' => [
+                    'importance' => 8.0,
+                    'ux_vs_security_ratio' => 0.2,
+                    'target_threshold' => 'block',
+                    'indicators' => ['honeypotScore', 'headerAnomalyScore']
+                ],
+                'mass_scraping' => [
+                    'importance' => 3.0,
+                    'ux_vs_security_ratio' => 0.8,
+                    'target_threshold' => 'low',
+                    'indicators' => ['requestPatternScore', 'renderingAnomalyScore', 'clientHintsInconsistencyScore']
+                ],
+                'distributed_botnets' => [
+                    'importance' => 6.0,
+                    'ux_vs_security_ratio' => 0.5,
+                    'target_threshold' => 'high',
+                    'indicators' => ['subnetScore', 'botnetClusterScore', 'ipReputationScore', 'tlsSpoofingScore']
+                ],
+                'basic_automation' => [
+                    'importance' => 5.0,
+                    'ux_vs_security_ratio' => 0.4,
+                    'target_threshold' => 'medium',
+                    'indicators' => ['botScore', 'tlsSpoofingScore', 'tcpAnomalyScore']
+                ]
+            ];
+
+            $threatStats = [];
+            foreach ($threatProfiles as $name => $profile) {
+                $threatStats[$name] = ['fp' => 0.0, 'fn' => 0.0, 'totalHumans' => 0.0, 'totalBots' => 0.0];
+            }
 
             $maxHumanScore = 0.0;
             $minBotScore = 100.0;
@@ -108,22 +141,56 @@ class OptimizationOperators
                 $score = $calculateScore($log);
 
                 if ($isLikelyBot) {
-                    $totalBots += $confidence;
                     $minBotScore = min($minBotScore, $score);
-                    if ($score < $config['thresholds']['low']) {
-                        $falseNegatives += $confidence;
-                    }
                 } elseif ($isLikelyHuman) {
-                    $totalHumans += $confidence;
                     $maxHumanScore = max($maxHumanScore, $score);
-                    if ($score >= $config['thresholds']['low']) {
-                        $falsePositives += $confidence;
+                }
+
+                foreach ($threatProfiles as $name => $profile) {
+                    $threatActivity = 0.0;
+                    foreach ($profile['indicators'] as $indicator) {
+                        $threatActivity += (float)($log['vector'][$indicator] ?? 0.0);
+                    }
+                    if ($threatActivity <= 0.0) {
+                        continue;
+                    }
+                    $effectiveConfidence = $confidence * ($threatActivity / 100.0);
+                    $targetThreshold = (float)($config['thresholds'][$profile['target_threshold']] ?? 20.0);
+
+                    if ($isLikelyBot) {
+                        $threatStats[$name]['totalBots'] += $effectiveConfidence;
+                        if ($score < $targetThreshold) {
+                            $threatStats[$name]['fn'] += $effectiveConfidence;
+                        }
+                    } elseif ($isLikelyHuman) {
+                        $threatStats[$name]['totalHumans'] += $effectiveConfidence;
+                        if ($score >= $targetThreshold) {
+                            $threatStats[$name]['fp'] += $effectiveConfidence;
+                        }
                     }
                 }
             }
 
-            $falsePositiveRate = $totalHumans > 0.0 ? $falsePositives / $totalHumans : 0.0;
-            $falseNegativeRate = $totalBots > 0.0 ? $falseNegatives / $totalBots : 0.0;
+            $weightedFpr = 0.0;
+            $weightedFnr = 0.0;
+            $totalImportance = 0.0;
+
+            foreach ($threatProfiles as $name => $profile) {
+                $totalImportance += $profile['importance'];
+            }
+
+            foreach ($threatProfiles as $name => $profile) {
+                $stats = $threatStats[$name];
+                $fpr = $stats['totalHumans'] > 0 ? $stats['fp'] / $stats['totalHumans'] : 0.0;
+                $fnr = $stats['totalBots'] > 0 ? $stats['fn'] / $stats['totalBots'] : 0.0;
+
+                $importanceWeight = $profile['importance'] / $totalImportance;
+                $uxRatio = $profile['ux_vs_security_ratio'];
+                $secRatio = 1.0 - $uxRatio;
+
+                $weightedFpr += $fpr * $importanceWeight * $uxRatio;
+                $weightedFnr += $fnr * $importanceWeight * $secRatio;
+            }
 
             // 3. Pénalité de dérive d'échelle (L2 Regularization par rapport au profil d'origine)
             $regularizationPenalty = 0.0;
@@ -138,8 +205,8 @@ class OptimizationOperators
             $marginOverlap = max(0.0, $maxHumanScore - $minBotScore);
             $marginPenalty = $marginOverlap / 100.0;
 
-            $obj1 = $falsePositiveRate + ($regularizationPenalty * 0.05);
-            $obj2 = $falseNegativeRate + $marginPenalty;
+            $obj1 = $weightedFpr + ($regularizationPenalty * 0.05);
+            $obj2 = $weightedFnr + $marginPenalty;
 
             return [$obj1, $obj2];
         };
@@ -160,9 +227,7 @@ class OptimizationOperators
             $child = $c1;
             foreach (['thresholds', 'weights', 'patterns'] as $section) {
                 foreach ($child[$section] as $key => $value) {
-                    if ($key !== 'honeypotScore') {
-                        $child[$section][$key] = ($c1[$section][$key] + $c2[$section][$key]) / 2;
-                    }
+                    $child[$section][$key] = ($c1[$section][$key] + $c2[$section][$key]) / 2;
                 }
             }
             return $child;
@@ -177,7 +242,7 @@ class OptimizationOperators
             foreach (['thresholds', 'weights', 'patterns'] as $section) {
                 if (isset($config[$section]) && is_array($config[$section])) {
                     foreach ($config[$section] as $k => $v) {
-                        if (is_numeric($v) && $k !== 'honeypotScore') {
+                        if (is_numeric($v)) {
                             $randomVariation = 1.0 + (self::secureRandom() - 0.5) * 0.5; // Variation de +/- 25%
                             $ind[$section][$k] = $v * $randomVariation;
                         } else {
@@ -197,9 +262,9 @@ class OptimizationOperators
         $mutate = function (array $c, ?array $currentConfigRef = null) use ($currentConfig): array {
             $newConfig = $c;
             $sections = [
-                ['name' => 'patterns', 'weight' => 0.5],
-                ['name' => 'weights', 'weight' => 0.35],
-                ['name' => 'thresholds', 'weight' => 0.15]
+                ['name' => 'patterns', 'weight' => 0.50],
+                ['name' => 'thresholds', 'weight' => 0.25],
+                ['name' => 'weights', 'weight' => 0.25]
             ];
             $rand = self::secureRandom();
             $cumulativeWeight = 0;
@@ -215,13 +280,16 @@ class OptimizationOperators
             $keys = array_keys($newConfig[$sectionToMutate]);
             $keyToMutate = $keys[random_int(0, count($keys) - 1)];
 
-            if ($keyToMutate === 'honeypotScore') return $newConfig;
-
-            $mutationAmount = (self::secureRandom() - 0.5) * 0.4;
-            $newConfig[$sectionToMutate][$keyToMutate] *= (1 + $mutationAmount);
-
             if ($sectionToMutate === 'weights') {
-                $newConfig[$sectionToMutate][$keyToMutate] = max(0, min(1.5, $newConfig[$sectionToMutate][$keyToMutate]));
+                $newConfig[$sectionToMutate][$keyToMutate] = max(0.05, min(1.5, $newConfig[$sectionToMutate][$keyToMutate] + (self::secureRandom() - 0.5) * 0.1));
+            } elseif ($sectionToMutate === 'thresholds') {
+                $newConfig[$sectionToMutate][$keyToMutate] = (int)round($newConfig[$sectionToMutate][$keyToMutate] + (self::secureRandom() - 0.5) * 5.0);
+            } else {
+                if ($keyToMutate === 'decayFactor') {
+                    $newConfig['patterns']['decayFactor'] = max(0.8, min(0.999, $newConfig['patterns']['decayFactor'] + (self::secureRandom() - 0.5) * 0.05));
+                } elseif (str_contains($keyToMutate, 'Threshold') || str_contains($keyToMutate, 'Reset')) {
+                    $newConfig['patterns'][$keyToMutate] = max(50.0, $newConfig['patterns'][$keyToMutate] + (self::secureRandom() - 0.5) * 50.0);
+                }
             }
 
             $refConfig = $currentConfigRef ?? $currentConfig;

package/src/php/Tests/ChallengeUtilsTest.php

@@ -53,7 +53,9 @@ class ChallengeUtilsTest extends TestCase
 
         // Tamper with value on verified sample index 12
         $tampered = $solutions;
-        $tampered[12] = (string)((float)$tampered[12] + 0.0002); // Out of tolerance
+        $sampleIndices = ChallengeUtils::deriveSampleIndices('127.0.0.1', 'gpu-pow-salt');
+        $tamperedIndex = $sampleIndices[0];
+        $tampered[$tamperedIndex] = (string)((float)$tampered[$tamperedIndex] + 0.0002); // Out of tolerance
         $this->assertFalse(ChallengeUtils::verifyGpuPow($seed, $iterations, implode(',', $tampered)));
     }
 
@@ -85,8 +87,10 @@ class ChallengeUtilsTest extends TestCase
         }
         $solutionString = implode(',', $solutions);
         $this->assertTrue(ChallengeUtils::verifyGpuPow($seed, $iterations, $solutionString));
+        $sampleIndices = ChallengeUtils::deriveSampleIndices('127.0.0.1', 'gpu-pow-salt');
+        $tamperedIndex = $sampleIndices[0];
         $tamperedSolutions = $solutions;
-        $tamperedSolutions[0] = (string)((float)$tamperedSolutions[0] + 0.1);
+        $tamperedSolutions[$tamperedIndex] = (string)((float)$tamperedSolutions[$tamperedIndex] + 0.1);
         $this->assertFalse(ChallengeUtils::verifyGpuPow($seed, $iterations, implode(',', $tamperedSolutions)));
     }