@anonympins/fingerprint 0.6.4 → 0.6.6

package/src/php/Optimization/OptimizationOperators.php

@@ -48,6 +48,19 @@ class OptimizationOperators
         }
     }
 
+    /**
+     * Évalue un portefeuille pour un payload donné.
+     * 
+     * @param array $weights
+     * @param array $payload
+     * @return float
+     */
+    public static function calculatePortfolioMetrics(array $weights, array $payload): float
+    {
+        $fitnessFunction = self::createPortfolioAllocator($payload);
+        return $fitnessFunction($weights);
+    }
+
     /**
      * Crée un évaluateur pour l'optimisation de portefeuille.
      * @param array $config
@@ -74,10 +87,43 @@ class OptimizationOperators
         $currentConfig = $context['currentConfig'] ?? null;
 
         return function (array $config) use ($trafficData, $currentConfig): array {
-            $falsePositives = 0.0;
-            $falseNegatives = 0.0;
-            $totalHumans = 0.0;
-            $totalBots = 0.0;
+            $threatProfiles = [
+                'account_takeover' => [
+                    'importance' => 10.0,
+                    'ux_vs_security_ratio' => 0.1,
+                    'target_threshold' => 'block',
+                    'indicators' => ['requestPatternScore', 'behaviorScore', 'timeInconsistencyScore', 'clickVarianceScore']
+                ],
+                'active_exploitation' => [
+                    'importance' => 8.0,
+                    'ux_vs_security_ratio' => 0.2,
+                    'target_threshold' => 'block',
+                    'indicators' => ['honeypotScore', 'headerAnomalyScore']
+                ],
+                'mass_scraping' => [
+                    'importance' => 3.0,
+                    'ux_vs_security_ratio' => 0.8,
+                    'target_threshold' => 'low',
+                    'indicators' => ['requestPatternScore', 'renderingAnomalyScore', 'clientHintsInconsistencyScore']
+                ],
+                'distributed_botnets' => [
+                    'importance' => 6.0,
+                    'ux_vs_security_ratio' => 0.5,
+                    'target_threshold' => 'high',
+                    'indicators' => ['subnetScore', 'botnetClusterScore', 'ipReputationScore', 'tlsSpoofingScore']
+                ],
+                'basic_automation' => [
+                    'importance' => 5.0,
+                    'ux_vs_security_ratio' => 0.4,
+                    'target_threshold' => 'medium',
+                    'indicators' => ['botScore', 'tlsSpoofingScore', 'tcpAnomalyScore']
+                ]
+            ];
+
+            $threatStats = [];
+            foreach ($threatProfiles as $name => $profile) {
+                $threatStats[$name] = ['fp' => 0.0, 'fn' => 0.0, 'totalHumans' => 0.0, 'totalBots' => 0.0];
+            }
 
             $maxHumanScore = 0.0;
             $minBotScore = 100.0;
@@ -108,22 +154,56 @@ class OptimizationOperators
                 $score = $calculateScore($log);
 
                 if ($isLikelyBot) {
-                    $totalBots += $confidence;
                     $minBotScore = min($minBotScore, $score);
-                    if ($score < $config['thresholds']['low']) {
-                        $falseNegatives += $confidence;
-                    }
                 } elseif ($isLikelyHuman) {
-                    $totalHumans += $confidence;
                     $maxHumanScore = max($maxHumanScore, $score);
-                    if ($score >= $config['thresholds']['low']) {
-                        $falsePositives += $confidence;
+                }
+
+                foreach ($threatProfiles as $name => $profile) {
+                    $threatActivity = 0.0;
+                    foreach ($profile['indicators'] as $indicator) {
+                        $threatActivity += (float)($log['vector'][$indicator] ?? 0.0);
+                    }
+                    if ($threatActivity <= 0.0) {
+                        continue;
+                    }
+                    $effectiveConfidence = $confidence * ($threatActivity / 100.0);
+                    $targetThreshold = (float)($config['thresholds'][$profile['target_threshold']] ?? 20.0);
+
+                    if ($isLikelyBot) {
+                        $threatStats[$name]['totalBots'] += $effectiveConfidence;
+                        if ($score < $targetThreshold) {
+                            $threatStats[$name]['fn'] += $effectiveConfidence;
+                        }
+                    } elseif ($isLikelyHuman) {
+                        $threatStats[$name]['totalHumans'] += $effectiveConfidence;
+                        if ($score >= $targetThreshold) {
+                            $threatStats[$name]['fp'] += $effectiveConfidence;
+                        }
                     }
                 }
             }
 
-            $falsePositiveRate = $totalHumans > 0.0 ? $falsePositives / $totalHumans : 0.0;
-            $falseNegativeRate = $totalBots > 0.0 ? $falseNegatives / $totalBots : 0.0;
+            $weightedFpr = 0.0;
+            $weightedFnr = 0.0;
+            $totalImportance = 0.0;
+
+            foreach ($threatProfiles as $name => $profile) {
+                $totalImportance += $profile['importance'];
+            }
+
+            foreach ($threatProfiles as $name => $profile) {
+                $stats = $threatStats[$name];
+                $fpr = $stats['totalHumans'] > 0 ? $stats['fp'] / $stats['totalHumans'] : 0.0;
+                $fnr = $stats['totalBots'] > 0 ? $stats['fn'] / $stats['totalBots'] : 0.0;
+
+                $importanceWeight = $profile['importance'] / $totalImportance;
+                $uxRatio = $profile['ux_vs_security_ratio'];
+                $secRatio = 1.0 - $uxRatio;
+
+                $weightedFpr += $fpr * $importanceWeight * $uxRatio;
+                $weightedFnr += $fnr * $importanceWeight * $secRatio;
+            }
 
             // 3. Pénalité de dérive d'échelle (L2 Regularization par rapport au profil d'origine)
             $regularizationPenalty = 0.0;
@@ -138,8 +218,8 @@ class OptimizationOperators
             $marginOverlap = max(0.0, $maxHumanScore - $minBotScore);
             $marginPenalty = $marginOverlap / 100.0;
 
-            $obj1 = $falsePositiveRate + ($regularizationPenalty * 0.05);
-            $obj2 = $falseNegativeRate + $marginPenalty;
+            $obj1 = $weightedFpr + ($regularizationPenalty * 0.05);
+            $obj2 = $weightedFnr + $marginPenalty;
 
             return [$obj1, $obj2];
         };
@@ -160,9 +240,7 @@ class OptimizationOperators
             $child = $c1;
             foreach (['thresholds', 'weights', 'patterns'] as $section) {
                 foreach ($child[$section] as $key => $value) {
-                    if ($key !== 'honeypotScore') {
-                        $child[$section][$key] = ($c1[$section][$key] + $c2[$section][$key]) / 2;
-                    }
+                    $child[$section][$key] = ($c1[$section][$key] + $c2[$section][$key]) / 2;
                 }
             }
             return $child;
@@ -177,7 +255,7 @@ class OptimizationOperators
             foreach (['thresholds', 'weights', 'patterns'] as $section) {
                 if (isset($config[$section]) && is_array($config[$section])) {
                     foreach ($config[$section] as $k => $v) {
-                        if (is_numeric($v) && $k !== 'honeypotScore') {
+                        if (is_numeric($v)) {
                             $randomVariation = 1.0 + (self::secureRandom() - 0.5) * 0.5; // Variation de +/- 25%
                             $ind[$section][$k] = $v * $randomVariation;
                         } else {
@@ -197,9 +275,9 @@ class OptimizationOperators
         $mutate = function (array $c, ?array $currentConfigRef = null) use ($currentConfig): array {
             $newConfig = $c;
             $sections = [
-                ['name' => 'patterns', 'weight' => 0.5],
-                ['name' => 'weights', 'weight' => 0.35],
-                ['name' => 'thresholds', 'weight' => 0.15]
+                ['name' => 'patterns', 'weight' => 0.50],
+                ['name' => 'thresholds', 'weight' => 0.25],
+                ['name' => 'weights', 'weight' => 0.25]
             ];
             $rand = self::secureRandom();
             $cumulativeWeight = 0;
@@ -215,13 +293,16 @@ class OptimizationOperators
             $keys = array_keys($newConfig[$sectionToMutate]);
             $keyToMutate = $keys[random_int(0, count($keys) - 1)];
 
-            if ($keyToMutate === 'honeypotScore') return $newConfig;
-
-            $mutationAmount = (self::secureRandom() - 0.5) * 0.4;
-            $newConfig[$sectionToMutate][$keyToMutate] *= (1 + $mutationAmount);
-
             if ($sectionToMutate === 'weights') {
-                $newConfig[$sectionToMutate][$keyToMutate] = max(0, min(1.5, $newConfig[$sectionToMutate][$keyToMutate]));
+                $newConfig[$sectionToMutate][$keyToMutate] = max(0.05, min(1.5, $newConfig[$sectionToMutate][$keyToMutate] + (self::secureRandom() - 0.5) * 0.1));
+            } elseif ($sectionToMutate === 'thresholds') {
+                $newConfig[$sectionToMutate][$keyToMutate] = (int)round($newConfig[$sectionToMutate][$keyToMutate] + (self::secureRandom() - 0.5) * 5.0);
+            } else {
+                if ($keyToMutate === 'decayFactor') {
+                    $newConfig['patterns']['decayFactor'] = max(0.8, min(0.999, $newConfig['patterns']['decayFactor'] + (self::secureRandom() - 0.5) * 0.05));
+                } elseif (str_contains($keyToMutate, 'Threshold') || str_contains($keyToMutate, 'Reset')) {
+                    $newConfig['patterns'][$keyToMutate] = max(50.0, $newConfig['patterns'][$keyToMutate] + (self::secureRandom() - 0.5) * 50.0);
+                }
             }
 
             $refConfig = $currentConfigRef ?? $currentConfig;

package/src/php/ProblemManager.php

@@ -238,6 +238,28 @@ class ProblemManager
                         return;
                     }
                 }
+
+                    // VÉRIFICATION PAR ÉCHANTILLONNAGE (Parité avec JS)
+                    $fitnessFunction = FunctionRegistry::get('portfolio.calculateMetrics');
+                    if ($fitnessFunction) {
+                        $sampleSize = min(5, count($solutionData['population']));
+                        $sampleKeys = (array)array_rand($solutionData['population'], $sampleSize);
+                        
+                        foreach ($sampleKeys as $key) {
+                            $individual = $solutionData['population'][$key];
+                            if (isset($individual['chromosome'])) {
+                                $recalculated = $fitnessFunction($individual['chromosome'], $problem['payload'] ?? []);
+                                if (isset($individual['fitness']) && $individual['fitness'] !== -1) {
+                                    if (abs($individual['fitness'] - $recalculated) > 1e-4) {
+                                        error_log("[ProblemManager] Triche détectée pour {$problemId}! Fitness déclaré: {$individual['fitness']}, recalculé: {$recalculated}");
+                                        return; // Rejeter en cas d'incohérence
+                                    }
+                                }
+                                $solutionData['population'][$key]['fitness'] = $recalculated;
+                            }
+                        }
+                    }
+
                     $problem['state']['population'] = $solutionData['population'];
                     $problem['state']['lastUpdate'] = (new \DateTime())->format(\DateTime::ATOM);
                     $stateChanged = true;

package/src/php/Tests/ChallengeUtilsTest.php

@@ -40,7 +40,8 @@ class ChallengeUtilsTest extends TestCase
         };
 
         for ($idx = 0; $idx < 64; $idx++) {
-            $x = $fround($numericSeed + $idx * 0.015);
+            $x = $fround(fmod($numericSeed + $idx * 0.015, 1.0));
+            $x = $fround(fmod($numericSeed + $idx * 0.015, 1.0));
             $rFloat = $fround($r);
             for ($i = 0; $i < $iterations; $i++) {
                 $x = $fround($rFloat * $x * $fround(1.0 - $x));
@@ -53,7 +54,9 @@ class ChallengeUtilsTest extends TestCase
 
         // Tamper with value on verified sample index 12
         $tampered = $solutions;
-        $tampered[12] = (string)((float)$tampered[12] + 0.0002); // Out of tolerance
+        $sampleIndices = ChallengeUtils::deriveSampleIndices('127.0.0.1', 'gpu-pow-salt');
+        $tamperedIndex = $sampleIndices[0];
+        $tampered[$tamperedIndex] = (string)((float)$tampered[$tamperedIndex] + 0.0002); // Out of tolerance
         $this->assertFalse(ChallengeUtils::verifyGpuPow($seed, $iterations, implode(',', $tampered)));
     }
 
@@ -76,7 +79,7 @@ class ChallengeUtilsTest extends TestCase
             return unpack('f', pack('f', $value))[1];
         };
         for ($idx = 0; $idx < 64; $idx++) {
-            $x = $fround($numericSeed + $idx * 0.015);
+            $x = $fround(fmod($numericSeed + $idx * 0.015, 1.0));
             $rFloat = $fround($r);
             for ($i = 0; $i < $iterations; $i++) {
                 $x = $fround($rFloat * $x * $fround(1.0 - $x));
@@ -85,8 +88,10 @@ class ChallengeUtilsTest extends TestCase
         }
         $solutionString = implode(',', $solutions);
         $this->assertTrue(ChallengeUtils::verifyGpuPow($seed, $iterations, $solutionString));
+        $sampleIndices = ChallengeUtils::deriveSampleIndices('127.0.0.1', 'gpu-pow-salt');
+        $tamperedIndex = $sampleIndices[0];
         $tamperedSolutions = $solutions;
-        $tamperedSolutions[0] = (string)((float)$tamperedSolutions[0] + 0.1);
+        $tamperedSolutions[$tamperedIndex] = (string)((float)$tamperedSolutions[$tamperedIndex] + 0.1);
         $this->assertFalse(ChallengeUtils::verifyGpuPow($seed, $iterations, implode(',', $tamperedSolutions)));
     }
 

package/src/php/Tests/IpReputationTest.php

@@ -155,7 +155,7 @@ class IpReputationTest extends TestCase
         $this->assertEquals(0.0, $score['subnetScore']);
 
         for ($i = 1; $i <= 12; $i++) {
-            RequestUtils::updateSubnetMetrics($context, "device-{$i}", 30.0);
+            RequestUtils::updateSubnetMetrics($context, "device-{$i}", 50.0);
         }
 
         $scoreWithHistory = RequestUtils::getSubnetScore($context, 'device-1');

package/src/php/Tests/ProblemManagerTest.php

@@ -372,6 +372,6 @@ class ProblemManagerTest extends TestCase
             );
 
         $manager = ProblemManager::getInstance($this->configPath, $storeMock);
-        $manager->integrateSolution($problemId, ['population' => [['chromosome' => [1.0], 'fitness' => -0.15]]]);
+        $manager->integrateSolution($problemId, ['population' => [['chromosome' => [1.0], 'fitness' => -1.0]]]);
     }
 }

package/src/php/Tests/QuicFingerprintTest.php

@@ -10,15 +10,15 @@ use PHPUnit\Framework\TestCase;
 
 class QuicFingerprintTest extends TestCase
 {
-    public function testGetQuicAnomalyScoreReturnsZeroIfNoFp(): void
+    public function testGetProtocolAnomalyScoreReturnsZeroIfNoFp(): void
     {
         $context = $this->createMock(RequestContext::class);
         $context->method('getHeader')->willReturn(null);
-        $res = RequestUtils::getQuicAnomalyScore($context);
-        $this->assertEquals(0.0, $res['quicAnomalyScore']);
+        $res = RequestUtils::getProtocolAnomalyScore($context);
+        $this->assertEquals(0.0, $res['protocolAnomalyScore']);
     }
 
-    public function testGetQuicAnomalyScoreDetectsSpoofedChrome(): void
+    public function testGetProtocolAnomalyScoreDetectsSpoofedChrome(): void
     {
         $context = $this->createMock(RequestContext::class);
         $context->method('getHeader')->willReturnCallback(function($name) {
@@ -31,11 +31,11 @@ class QuicFingerprintTest extends TestCase
             return null;
         });
 
-        $res = RequestUtils::getQuicAnomalyScore($context);
-        $this->assertEquals(100.0, $res['quicAnomalyScore']);
+        $res = RequestUtils::getProtocolAnomalyScore($context);
+        $this->assertEquals(100.0, $res['protocolAnomalyScore']);
     }
 
-    public function testGetQuicAnomalyScoreAllowsLegitChrome(): void
+    public function testGetProtocolAnomalyScoreAllowsLegitChrome(): void
     {
         $context = $this->createMock(RequestContext::class);
         $context->method('getHeader')->willReturnCallback(function($name) {
@@ -48,7 +48,7 @@ class QuicFingerprintTest extends TestCase
             return null;
         });
 
-        $res = RequestUtils::getQuicAnomalyScore($context);
-        $this->assertEquals(0.0, $res['quicAnomalyScore']);
+        $res = RequestUtils::getProtocolAnomalyScore($context);
+        $this->assertEquals(0.0, $res['protocolAnomalyScore']);
     }
 }

package/src/php/Utils/RequestUtils.php

@@ -1268,13 +1268,15 @@ class RequestUtils
         if (!isset($subnetData['uas'])) {
             $subnetData['uas'] = [];
         }
+        $now = time();
+        self::decaySubnetData($subnetData, $now);
 
         // Utilisation de la partie stable du fingerprint matériel plutôt que l'ID de cookie volatil
         $currentDeviceHash = self::getCompositeDeviceHash($context);
         $stableFpId = FingerprintBuilder::cyrb53(self::extractStablePart($currentDeviceHash));
 
         $currentDeviceContributions = $subnetData['highScoreDevices'][$stableFpId] ?? 0;
-        if ($currentDeviceContributions < 5 && $finalScore < 95) {
+        if ($currentDeviceContributions < 1 && $finalScore < 95) {
             $subnetData['highScoreDevices'][$stableFpId] = $currentDeviceContributions + 1;
             $subnetData['highScoreCount']++;
         }
@@ -1291,8 +1293,7 @@ class RequestUtils
         if (!empty($userAgent) && !in_array($userAgent, $subnetData['uas'], true)) {
             $subnetData['uas'][] = $userAgent;
         }
-
-        $subnetData['lastActivity'] = time();
+        $subnetData['lastActivity'] = $now;
 
         // Limiter la taille du tableau des deviceIds pour éviter une consommation mémoire excessive.
         if (count($subnetData['deviceIds']) > 100) {
@@ -1340,19 +1341,16 @@ class RequestUtils
         $inactivitySec = $now - ($subnetData['lastActivity'] ?? $now);
         $halfLives = (int)floor($inactivitySec / 1800);
 
+        if ($halfLives > 0) {
+            self::decaySubnetData($subnetData, $now);
+            $store->set($key, $subnetData, 86400);
+        }
+
         $highScoreCount = $subnetData['highScoreCount'] ?? 0;
         $deviceCount = isset($subnetData['deviceIds']) ? count($subnetData['deviceIds']) : 0;
         $ipCount = isset($subnetData['ips']) ? count($subnetData['ips']) : 1;
         $uaCount = isset($subnetData['uas']) ? count($subnetData['uas']) : 1;
 
-        if ($halfLives > 0) {
-            $decay = pow(2, $halfLives);
-            $highScoreCount = max(0, (int)floor($highScoreCount / $decay));
-            $deviceCount = max(0, (int)floor($deviceCount / $decay));
-            $ipCount = max(1, (int)floor($ipCount / $decay));
-            $uaCount = max(1, (int)floor($uaCount / $decay));
-        }
-
         if ($deviceCount === 0) {
             return ['subnetScore' => 0.0];
         }
@@ -1369,6 +1367,42 @@ class RequestUtils
 
         return ['subnetScore' => $finalScore];
     }
+    /**
+     * Applies temporal decay (half-life of 30 minutes) to subnet metrics.
+     *
+     * @param array &$subnetData Subnet data passed by reference.
+     * @param int $now Current timestamp.
+     */
+    private static function decaySubnetData(array &$subnetData, int $now): void
+    {
+        $inactivitySec = $now - ($subnetData['lastActivity'] ?? $now);
+        $halfLives = (int)floor($inactivitySec / 1800);
+
+        if ($halfLives > 0) {
+            $decay = pow(2, $halfLives);
+            $subnetData['highScoreCount'] = max(0, (int)floor(($subnetData['highScoreCount'] ?? 0) / $decay));
+
+            if (isset($subnetData['highScoreDevices'])) {
+                foreach ($subnetData['highScoreDevices'] as $fpId => $val) {
+                    $decayedVal = (int)floor($val / $decay);
+                    if ($decayedVal <= 0) {
+                        unset($subnetData['highScoreDevices'][$fpId]);
+                    } else {
+                        $subnetData['highScoreDevices'][$fpId] = $decayedVal;
+                    }
+                }
+            }
+
+            foreach (['deviceIds', 'ips', 'uas'] as $field) {
+                if (isset($subnetData[$field])) {
+                    $newLen = max(0, (int)floor(count($subnetData[$field]) / $decay));
+                    $subnetData[$field] = array_slice($subnetData[$field], 0, $newLen);
+                }
+            }
+
+            $subnetData['lastActivity'] = $now - ($inactivitySec % 1800);
+        }
+    }
 
     /**
      * Calcule le score d'anomalie de similarité réseau (Botnet Clustering).
@@ -1820,52 +1854,75 @@ class RequestUtils
     }
 
     /**
-     * Détecte les anomalies de flux QUIC/HTTP3 par rapport au User-Agent.
+     * Détecte les anomalies de protocole (HTTP/2 et QUIC/HTTP3) par rapport au User-Agent.
      * @param RequestContext $context
-     * @return array{'quicAnomalyScore': float}
+     * @return array{'protocolAnomalyScore': float}
      */
-    public static function getQuicAnomalyScore(RequestContext $context): array
+    public static function getProtocolAnomalyScore(RequestContext $context): array
     {
-        $quicFp = $context->getHeader('x-quic-fp') ?? $context->quicFingerprint ?? null;
-        if (empty($quicFp) || !is_string($quicFp)) {
-            return ['quicAnomalyScore' => 0.0];
-        }
-
-        $parts = explode(';', $quicFp);
-        if (count($parts) < 2) {
-            return ['quicAnomalyScore' => 0.0];
-        }
-
-        $params = [];
-        foreach (explode(',', $parts[1]) as $p) {
-            $kv = explode('=', $p, 2);
-            if (count($kv) === 2) {
-                $params[$kv[0]] = $kv[1];
-            }
-        }
-        $priorityOrder = $parts[2] ?? '';
+        $http2Anomaly = 0.0;
+        $quicAnomaly = 0.0;
 
         $ua = $context->getHeader('user-agent') ?? '';
         $uaParts = self::parseUserAgent($ua);
         $browser = $uaParts['browser'] ?? null;
 
-        if (empty($browser)) {
-            return ['quicAnomalyScore' => 0.0];
+        // HTTP/2 Anomaly logic
+        $h2Fp = $context->getHeader('x-http2-fingerprint') ?? $context->http2Fingerprint ?? null;
+        if ($h2Fp && is_string($h2Fp) && $browser) {
+            $parts = explode('|', $h2Fp);
+            if (count($parts) >= 4) {
+                $connWindow = (int)$parts[1];
+                $headerOrder = $parts[3];
+                $isChromium = str_starts_with($browser, 'Chrome') || str_starts_with($browser, 'Edge');
+                $isFirefox = str_starts_with($browser, 'Firefox');
+                $isSafari = str_starts_with($browser, 'Safari');
+
+                if ($isChromium) {
+                    if ($headerOrder && $headerOrder !== 'm,a,s,p') $http2Anomaly += 60.0;
+                    if ($connWindow === 65535 || $connWindow === 65536) $http2Anomaly += 40.0;
+                } elseif ($isFirefox) {
+                    if ($headerOrder && $headerOrder !== 'm,s,p,a') $http2Anomaly += 60.0;
+                } elseif ($isSafari) {
+                    if ($headerOrder && $headerOrder !== 'm,s,p,a') $http2Anomaly += 60.0;
+                }
+            }
         }
 
-        $anomaly = 0.0;
-        if (str_starts_with($browser, 'Chrome') || str_starts_with($browser, 'Edge')) {
-            $maxData = isset($params['1']) ? (int)$params['1'] : 0;
-            $maxStreams = isset($params['4']) ? (int)$params['4'] : 0;
-            if ($maxData > 0 && $maxData < 1048576) $anomaly += 40.0;
-            if ($maxStreams > 0 && $maxStreams !== 100) $anomaly += 30.0;
-            if (!empty($priorityOrder) && !str_contains($priorityOrder, 'u=')) $anomaly += 30.0;
-        } elseif (str_starts_with($browser, 'Firefox')) {
-            $maxData = isset($params['1']) ? (int)$params['1'] : 0;
-            if ($maxData > 0 && $maxData > 5000000) $anomaly += 40.0;
+        // QUIC Anomaly logic
+        $quicFp = $context->getHeader('x-quic-fp') ?? $context->quicFingerprint ?? null;
+        if ($quicFp && is_string($quicFp) && $browser) {
+            $parts = explode(';', $quicFp);
+            if (count($parts) >= 2) {
+                $params = [];
+                foreach (explode(',', $parts[1]) as $p) {
+                    $kv = explode('=', $p, 2);
+                    if (count($kv) === 2) {
+                        $params[$kv[0]] = $kv[1];
+                    }
+                }
+                $priorityOrder = $parts[2] ?? '';
+
+                if (str_starts_with($browser, 'Chrome') || str_starts_with($browser, 'Edge')) {
+                    $maxData = isset($params['1']) ? (int)$params['1'] : 0;
+                    $maxStreams = isset($params['4']) ? (int)$params['4'] : 0;
+                    if ($maxData > 0 && $maxData < 1048576) $quicAnomaly += 40.0;
+                    if ($maxStreams > 0 && $maxStreams !== 100) $quicAnomaly += 30.0;
+                    if (!empty($priorityOrder) && !str_contains($priorityOrder, 'u=')) $quicAnomaly += 30.0;
+                } elseif (str_starts_with($browser, 'Firefox')) {
+                    $maxData = isset($params['1']) ? (int)$params['1'] : 0;
+                    if ($maxData > 0 && $maxData > 5000000) $quicAnomaly += 40.0;
+                }
+            }
         }
 
-        return ['quicAnomalyScore' => max(0.0, min(100.0, $anomaly))];
+        return [
+            'protocolAnomalyScore' => max(
+                0.0,
+                min(100.0, $http2Anomaly),
+                min(100.0, $quicAnomaly)
+            )
+        ];
     }
 
     /**