@anonympins/fingerprint 0.6.5 → 0.6.6

package/src/php/Utils/RequestUtils.php

@@ -1268,13 +1268,15 @@ class RequestUtils
         if (!isset($subnetData['uas'])) {
             $subnetData['uas'] = [];
         }
+        $now = time();
+        self::decaySubnetData($subnetData, $now);
 
         // Utilisation de la partie stable du fingerprint matériel plutôt que l'ID de cookie volatil
         $currentDeviceHash = self::getCompositeDeviceHash($context);
         $stableFpId = FingerprintBuilder::cyrb53(self::extractStablePart($currentDeviceHash));
 
         $currentDeviceContributions = $subnetData['highScoreDevices'][$stableFpId] ?? 0;
-        if ($currentDeviceContributions < 5 && $finalScore < 95) {
+        if ($currentDeviceContributions < 1 && $finalScore < 95) {
             $subnetData['highScoreDevices'][$stableFpId] = $currentDeviceContributions + 1;
             $subnetData['highScoreCount']++;
         }
@@ -1291,8 +1293,7 @@ class RequestUtils
         if (!empty($userAgent) && !in_array($userAgent, $subnetData['uas'], true)) {
             $subnetData['uas'][] = $userAgent;
         }
-
-        $subnetData['lastActivity'] = time();
+        $subnetData['lastActivity'] = $now;
 
         // Limiter la taille du tableau des deviceIds pour éviter une consommation mémoire excessive.
         if (count($subnetData['deviceIds']) > 100) {
@@ -1340,19 +1341,16 @@ class RequestUtils
         $inactivitySec = $now - ($subnetData['lastActivity'] ?? $now);
         $halfLives = (int)floor($inactivitySec / 1800);
 
+        if ($halfLives > 0) {
+            self::decaySubnetData($subnetData, $now);
+            $store->set($key, $subnetData, 86400);
+        }
+
         $highScoreCount = $subnetData['highScoreCount'] ?? 0;
         $deviceCount = isset($subnetData['deviceIds']) ? count($subnetData['deviceIds']) : 0;
         $ipCount = isset($subnetData['ips']) ? count($subnetData['ips']) : 1;
         $uaCount = isset($subnetData['uas']) ? count($subnetData['uas']) : 1;
 
-        if ($halfLives > 0) {
-            $decay = pow(2, $halfLives);
-            $highScoreCount = max(0, (int)floor($highScoreCount / $decay));
-            $deviceCount = max(0, (int)floor($deviceCount / $decay));
-            $ipCount = max(1, (int)floor($ipCount / $decay));
-            $uaCount = max(1, (int)floor($uaCount / $decay));
-        }
-
         if ($deviceCount === 0) {
             return ['subnetScore' => 0.0];
         }
@@ -1369,6 +1367,42 @@ class RequestUtils
 
         return ['subnetScore' => $finalScore];
     }
+    /**
+     * Applies temporal decay (half-life of 30 minutes) to subnet metrics.
+     *
+     * @param array &$subnetData Subnet data passed by reference.
+     * @param int $now Current timestamp.
+     */
+    private static function decaySubnetData(array &$subnetData, int $now): void
+    {
+        $inactivitySec = $now - ($subnetData['lastActivity'] ?? $now);
+        $halfLives = (int)floor($inactivitySec / 1800);
+
+        if ($halfLives > 0) {
+            $decay = pow(2, $halfLives);
+            $subnetData['highScoreCount'] = max(0, (int)floor(($subnetData['highScoreCount'] ?? 0) / $decay));
+
+            if (isset($subnetData['highScoreDevices'])) {
+                foreach ($subnetData['highScoreDevices'] as $fpId => $val) {
+                    $decayedVal = (int)floor($val / $decay);
+                    if ($decayedVal <= 0) {
+                        unset($subnetData['highScoreDevices'][$fpId]);
+                    } else {
+                        $subnetData['highScoreDevices'][$fpId] = $decayedVal;
+                    }
+                }
+            }
+
+            foreach (['deviceIds', 'ips', 'uas'] as $field) {
+                if (isset($subnetData[$field])) {
+                    $newLen = max(0, (int)floor(count($subnetData[$field]) / $decay));
+                    $subnetData[$field] = array_slice($subnetData[$field], 0, $newLen);
+                }
+            }
+
+            $subnetData['lastActivity'] = $now - ($inactivitySec % 1800);
+        }
+    }
 
     /**
      * Calcule le score d'anomalie de similarité réseau (Botnet Clustering).
@@ -1820,52 +1854,75 @@ class RequestUtils
     }
 
     /**
-     * Détecte les anomalies de flux QUIC/HTTP3 par rapport au User-Agent.
+     * Détecte les anomalies de protocole (HTTP/2 et QUIC/HTTP3) par rapport au User-Agent.
      * @param RequestContext $context
-     * @return array{'quicAnomalyScore': float}
+     * @return array{'protocolAnomalyScore': float}
      */
-    public static function getQuicAnomalyScore(RequestContext $context): array
+    public static function getProtocolAnomalyScore(RequestContext $context): array
     {
-        $quicFp = $context->getHeader('x-quic-fp') ?? $context->quicFingerprint ?? null;
-        if (empty($quicFp) || !is_string($quicFp)) {
-            return ['quicAnomalyScore' => 0.0];
-        }
-
-        $parts = explode(';', $quicFp);
-        if (count($parts) < 2) {
-            return ['quicAnomalyScore' => 0.0];
-        }
-
-        $params = [];
-        foreach (explode(',', $parts[1]) as $p) {
-            $kv = explode('=', $p, 2);
-            if (count($kv) === 2) {
-                $params[$kv[0]] = $kv[1];
-            }
-        }
-        $priorityOrder = $parts[2] ?? '';
+        $http2Anomaly = 0.0;
+        $quicAnomaly = 0.0;
 
         $ua = $context->getHeader('user-agent') ?? '';
         $uaParts = self::parseUserAgent($ua);
         $browser = $uaParts['browser'] ?? null;
 
-        if (empty($browser)) {
-            return ['quicAnomalyScore' => 0.0];
+        // HTTP/2 Anomaly logic
+        $h2Fp = $context->getHeader('x-http2-fingerprint') ?? $context->http2Fingerprint ?? null;
+        if ($h2Fp && is_string($h2Fp) && $browser) {
+            $parts = explode('|', $h2Fp);
+            if (count($parts) >= 4) {
+                $connWindow = (int)$parts[1];
+                $headerOrder = $parts[3];
+                $isChromium = str_starts_with($browser, 'Chrome') || str_starts_with($browser, 'Edge');
+                $isFirefox = str_starts_with($browser, 'Firefox');
+                $isSafari = str_starts_with($browser, 'Safari');
+
+                if ($isChromium) {
+                    if ($headerOrder && $headerOrder !== 'm,a,s,p') $http2Anomaly += 60.0;
+                    if ($connWindow === 65535 || $connWindow === 65536) $http2Anomaly += 40.0;
+                } elseif ($isFirefox) {
+                    if ($headerOrder && $headerOrder !== 'm,s,p,a') $http2Anomaly += 60.0;
+                } elseif ($isSafari) {
+                    if ($headerOrder && $headerOrder !== 'm,s,p,a') $http2Anomaly += 60.0;
+                }
+            }
         }
 
-        $anomaly = 0.0;
-        if (str_starts_with($browser, 'Chrome') || str_starts_with($browser, 'Edge')) {
-            $maxData = isset($params['1']) ? (int)$params['1'] : 0;
-            $maxStreams = isset($params['4']) ? (int)$params['4'] : 0;
-            if ($maxData > 0 && $maxData < 1048576) $anomaly += 40.0;
-            if ($maxStreams > 0 && $maxStreams !== 100) $anomaly += 30.0;
-            if (!empty($priorityOrder) && !str_contains($priorityOrder, 'u=')) $anomaly += 30.0;
-        } elseif (str_starts_with($browser, 'Firefox')) {
-            $maxData = isset($params['1']) ? (int)$params['1'] : 0;
-            if ($maxData > 0 && $maxData > 5000000) $anomaly += 40.0;
+        // QUIC Anomaly logic
+        $quicFp = $context->getHeader('x-quic-fp') ?? $context->quicFingerprint ?? null;
+        if ($quicFp && is_string($quicFp) && $browser) {
+            $parts = explode(';', $quicFp);
+            if (count($parts) >= 2) {
+                $params = [];
+                foreach (explode(',', $parts[1]) as $p) {
+                    $kv = explode('=', $p, 2);
+                    if (count($kv) === 2) {
+                        $params[$kv[0]] = $kv[1];
+                    }
+                }
+                $priorityOrder = $parts[2] ?? '';
+
+                if (str_starts_with($browser, 'Chrome') || str_starts_with($browser, 'Edge')) {
+                    $maxData = isset($params['1']) ? (int)$params['1'] : 0;
+                    $maxStreams = isset($params['4']) ? (int)$params['4'] : 0;
+                    if ($maxData > 0 && $maxData < 1048576) $quicAnomaly += 40.0;
+                    if ($maxStreams > 0 && $maxStreams !== 100) $quicAnomaly += 30.0;
+                    if (!empty($priorityOrder) && !str_contains($priorityOrder, 'u=')) $quicAnomaly += 30.0;
+                } elseif (str_starts_with($browser, 'Firefox')) {
+                    $maxData = isset($params['1']) ? (int)$params['1'] : 0;
+                    if ($maxData > 0 && $maxData > 5000000) $quicAnomaly += 40.0;
+                }
+            }
         }
 
-        return ['quicAnomalyScore' => max(0.0, min(100.0, $anomaly))];
+        return [
+            'protocolAnomalyScore' => max(
+                0.0,
+                min(100.0, $http2Anomaly),
+                min(100.0, $quicAnomaly)
+            )
+        ];
     }
 
     /**