@anonympins/fingerprint 0.6.7 → 0.7.0

package/src/php/Utils/RequestUtils.php

@@ -1025,13 +1025,20 @@ class RequestUtils
 
     public static function getThreatIntelScore(RequestContext $context, array $threatIntelConfig): array
     {
+        $score = 0.0;
         $zkpY = $context->zkpY;
-        if (empty($zkpY)) {
-            return ['threatIntelScore' => 0.0];
+        if (!empty($zkpY)) {
+            $store = StoreManager::getStore();
+            $isBanned = $store->has("banned-zkp-y:{$zkpY}");
+            if ($isBanned) {
+                $score = 100.0;
+            }
         }
-        $store = StoreManager::getStore();
-        $isBanned = $store->has("banned-zkp-y:{$zkpY}");
-        return ['threatIntelScore' => $isBanned ? 100.0 : 0.0];
+
+        $rttProxyScore = \Anonympins\Fingerprint\Ja3AnomalyDetector::getRttProxyScore($context);
+        $score = max($score, (float)$rttProxyScore);
+
+        return ['threatIntelScore' => $score];
     }
 
     /**
@@ -1355,23 +1362,24 @@ class RequestUtils
             return ['subnetScore' => 0.0];
         }
 
-        $suspicionDensity = $highScoreCount / $deviceCount;
-        $ipDeviceRatio = $ipCount / $deviceCount;
+        // 1. Régularisation bayésienne continue de la densité
+        $bayesianDensity = ((float)$highScoreCount + 0.5) / ((float)$deviceCount + 2.5);
 
-        // Ratio User-Agent / Device : détecte la rotation/spoofing de navigateurs sur une même empreinte matérielle
-        $uaDeviceRatio = (double)max(1, $uaCount) / $deviceCount;
-        $uaMultiplier = 0.6 + (0.4 * min(2.5, $uaDeviceRatio));
+        // 2. Dispersion IP / Terminal (CGNAT vs Proxy Pool)
+        $ipDispersion = min(2.0, (float)$ipCount / (float)$deviceCount);
+        $ipMultiplier = 0.6 + 0.4 * tanh($ipDispersion);
 
-        $baseScore = 100.0 * (1.0 - exp(-0.15 * $highScoreCount));
+        // 3. Dispersion User-Agent / Terminal
+        $uaDispersion = min(3.0, (float)max(1, $uaCount) / (float)$deviceCount);
+        $uaMultiplier = 0.7 + 0.3 * tanh($uaDispersion - 1.0);
 
-        $densityMultiplier = 0.4 + (1.6 * $suspicionDensity);
-        $distributionMultiplier = 0.5 + (1.0 * $ipDeviceRatio);
+        // 4. Intensité continue de la menace
+        $rawIntensity = (float)$highScoreCount * $bayesianDensity * $ipMultiplier * $uaMultiplier;
 
-        $dampening = 1.0;
-        if( $highScoreCount < 3 ){
-            $dampening = $highScoreCount / 3.0;
-        }
-        $finalScore = min(100.0, round($baseScore * $densityMultiplier * $distributionMultiplier * $uaMultiplier * $dampening * 10.0) / 10.0);
+        // 5. Asymptote continue via tanh (99.9 maximum strict, dérivable et sans saut)
+        $asymptote = 99.9;
+        $scale = 4.0;
+        $finalScore = round($asymptote * tanh($rawIntensity / $scale) * 10.0) / 10.0;
 
         return ['subnetScore' => $finalScore];
     }
@@ -2031,4 +2039,91 @@ class RequestUtils
 
         return !empty($deviceId) && !empty($deviceHash); // Match d'identité matérielle stricte (deviceId + deviceHash validés par HMAC)
     }
+
+    private static function imul(int $a, int $b): int
+    {
+        return ($a * $b) & 0xffffffff;
+    }
+
+    public static function cyrb53(string $str, int $seed = 0): int
+    {
+        $h1 = (0xdeadbeef ^ $seed) & 0xffffffff;
+        $h2 = (0x41c6ce57 ^ $seed) & 0xffffffff;
+        for ($i = 0; $i < strlen($str); $i++) {
+            $ch = ord($str[$i]);
+            $h1 = self::imul($h1 ^ $ch, 2654435761);
+            $h2 = self::imul($h2 ^ $ch, 1597334677);
+        }
+        $h1 = self::imul($h1 ^ ($h1 >> 16), 2246822507) ^ self::imul($h2 ^ ($h2 >> 13), 3266489909);
+        $h2 = self::imul($h2 ^ ($h2 >> 16), 2246822507) ^ self::imul($h1 ^ ($h1 >> 13), 3266489909);
+        $unsigned_h1 = $h1 & 0xffffffff;
+        return 4294967296 * (2097151 & $h2) + $unsigned_h1;
+    }
+
+    public static function getVirtualizationAnomalyScore(RequestContext $context): float
+    {
+        $clientFp = $context->headers['x-device-fingerprint'] ?? null;
+        if (!$clientFp) {
+            return 0.0;
+        }
+
+        $fpMap = [];
+        foreach (explode('|', $clientFp) as $part) {
+            $pair = explode(':', $part, 2);
+            if (count($pair) === 2) {
+                $fpMap[$pair[0]] = $pair[1];
+            }
+        }
+
+        $score = 0.0;
+        $clientGpuHash = $fpMap['gpu'] ?? null;
+        if ($clientGpuHash) {
+            $virtualGpus = [
+                "Google SwiftShader", "SwiftShader",
+                "Mesa llvmpipe", "llvmpipe", "Mesa Gallium",
+                "Microsoft Basic Render Driver", "HeadlessChrome",
+                "Intel(R) HD Graphics"
+            ];
+            $virtualGpuHashes = [];
+            foreach ($virtualGpus as $gpu) {
+                $virtualGpuHashes[] = (string)self::cyrb53($gpu);
+            }
+            if (in_array($clientGpuHash, $virtualGpuHashes, true)) {
+                $score += 75.0;
+            }
+        }
+
+        $clientScreenHash = $fpMap['scr'] ?? null;
+        if ($clientScreenHash) {
+            $headlessResolutions = ["800x600_24", "1024x768_24"];
+            $headlessHashes = [];
+            foreach ($headlessResolutions as $res) {
+                $headlessHashes[] = (string)self::cyrb53($res);
+            }
+            if (in_array($clientScreenHash, $headlessHashes, true)) {
+                $score += 25.0;
+            }
+        }
+
+        return min(100.0, $score);
+    }
+
+    /**
+     * Calcule un score d'incohérence analogique et lisse plafonnant à 99.9 max.
+     */
+    public static function calculateAnalogInconsistencyScore(float $consistencyScore, float $inflectionPoint = 0.72, float $steepness = 12.0): float
+    {
+        $s = max(0.0, min(1.0, $consistencyScore));
+        if ($s >= 0.98) {
+            return 0.0;
+        }
+
+        $asymptote = 99.9;
+        $raw = 1.0 / (1.0 + exp($steepness * ($s - $inflectionPoint)));
+        $minVal = 1.0 / (1.0 + exp($steepness * (1.0 - $inflectionPoint)));
+        $maxVal = 1.0 / (1.0 + exp($steepness * (0.0 - $inflectionPoint)));
+        $normalized = (($raw - $minVal) / ($maxVal - $minVal)) * $asymptote;
+
+        return min($asymptote, round($normalized, 1));
+    }
 }

package/src/php/Utils/TLSClientHelloParser.php

@@ -14,6 +14,150 @@ class TLSClientHelloParser
         35466, 39578, 43690, 47802, 51914, 55926, 60038, 64150
     ];
 
+    /**
+     * Lit un entier encodé en longueur variable QUIC (RFC 9000 section 16).
+     */
+    public static function readVarInt(string $data, int &$offset): ?int
+    {
+        $len = strlen($data);
+        if ($offset >= $len) {
+            return null;
+        }
+
+        $first = ord($data[$offset]);
+        $prefix = $first >> 6;
+        $firstVal = $first & 0x3f;
+
+        if ($prefix === 0) {
+            $offset += 1;
+            return $firstVal;
+        } elseif ($prefix === 1) {
+            if ($offset + 2 > $len) return null;
+            $val = ($firstVal << 8) | ord($data[$offset + 1]);
+            $offset += 2;
+            return $val;
+        } elseif ($prefix === 2) {
+            if ($offset + 4 > $len) return null;
+            $val = ($firstVal << 24) | (ord($data[$offset + 1]) << 16) | (ord($data[$offset + 2]) << 8) | ord($data[$offset + 3]);
+            $offset += 4;
+            return $val;
+        } else {
+            if ($offset + 8 > $len) return null;
+            $val = $firstVal;
+            for ($i = 1; $i < 8; $i++) {
+                $val = ($val << 8) | ord($data[$offset + $i]);
+            }
+            $offset += 8;
+            return $val;
+        }
+    }
+
+    /**
+     * Parse les paramètres de transport QUIC (RFC 9000 section 18.2).
+     */
+    public static function parseQuicTransportParameters(string $data): array
+    {
+        $params = [];
+        $offset = 0;
+        $len = strlen($data);
+
+        while ($offset < $len) {
+            $paramId = self::readVarInt($data, $offset);
+            if ($paramId === null) break;
+            $paramLen = self::readVarInt($data, $offset);
+            if ($paramLen === null || $offset + $paramLen > $len) break;
+
+            $paramValBytes = substr($data, $offset, $paramLen);
+            $offset += $paramLen;
+
+            if ($paramLen > 0 && in_array($paramId, [1, 3, 4, 5, 6, 7, 8, 9, 11, 14], true)) {
+                $valOffset = 0;
+                $numVal = self::readVarInt($paramValBytes, $valOffset);
+                $params[$paramId] = $numVal ?? $paramValBytes;
+            } else {
+                $params[$paramId] = bin2hex($paramValBytes);
+            }
+        }
+
+        return $params;
+    }
+
+    /**
+     * Analyse l'ordre des trames de contrôle QUIC / HTTP/3 (SETTINGS, MAX_STREAMS, PRIORITY).
+     */
+    public static function parseQuicControlFrames(string $streamData): array
+    {
+        $frames = [];
+        $frameOrder = [];
+        $settings = [];
+        $offset = 0;
+        $len = strlen($streamData);
+
+        if ($len === 0) {
+            return ['frames' => [], 'frame_order' => '', 'settings' => []];
+        }
+
+        if (ord($streamData[0]) === 0x00) {
+            $offset = 1; // Stream type Control Stream
+        }
+
+        while ($offset < $len) {
+            $frameType = self::readVarInt($streamData, $offset);
+            if ($frameType === null) break;
+            $frameLen = self::readVarInt($streamData, $offset);
+            if ($frameLen === null || $offset + $frameLen > $len) break;
+
+            $payload = substr($streamData, $offset, $frameLen);
+            $offset += $frameLen;
+
+            $abbr = match ($frameType) {
+                0x04 => 's', // SETTINGS
+                0x12, 0x02 => 'm', // MAX_STREAMS
+                0x0f, 0xaf, 0xf0700 => 'p', // PRIORITY_UPDATE
+                0x10, 0x0d => 'd', // MAX_DATA
+                0x07 => 'g', // GOAWAY
+                default => 'u'
+            };
+
+            $frames[] = ['type' => $frameType, 'length' => $frameLen];
+            $frameOrder[] = $abbr;
+
+            if ($frameType === 0x04) {
+                $sOffset = 0;
+                $sLen = strlen($payload);
+                while ($sOffset < $sLen) {
+                    $sId = self::readVarInt($payload, $sOffset);
+                    if ($sId === null) break;
+                    $sVal = self::readVarInt($payload, $sOffset);
+                    if ($sVal === null) break;
+                    $settings[$sId] = $sVal;
+                }
+            }
+        }
+
+        return [
+            'frames' => $frames,
+            'frame_order' => implode(',', $frameOrder),
+            'settings' => $settings
+        ];
+    }
+
+    public static function formatQuicFingerprint(array $params, string $priority = '', string $frameOrder = ''): string
+    {
+        $paramParts = [];
+        foreach ($params as $k => $v) {
+            $paramParts[] = "{$k}={$v}";
+        }
+        $fp = "1;" . implode(',', $paramParts);
+        if ($priority !== '' || $frameOrder !== '') {
+            $fp .= ";{$priority}";
+        }
+        if ($frameOrder !== '') {
+            $fp .= ";{$frameOrder}";
+        }
+        return $fp;
+    }
+
     /**
      * Parse le Client Hello brut et retourne l'empreinte JA3 et une approximation JA4.
      * 
@@ -72,6 +216,7 @@ class TLSClientHelloParser
             $supportedVersions = [];
             $hasSni = false;
             $alpnProtocol = '';
+        $quicParams = null;
 
         $extLimit = $offset + $extensionsLen;
         while ($offset < $extLimit && $offset + 4 <= $len) {
@@ -127,6 +272,11 @@ class TLSClientHelloParser
                             }
                         }
                     }
+                } elseif ($extType === 57 || $extType === 0xffa5) { // quic_transport_parameters (RFC 9001 / draft)
+                    if ($extLen > 0 && $offset + $extLen <= $len) {
+                        $quicData = substr($binary, $offset, $extLen);
+                        $quicParams = self::parseQuicTransportParameters($quicData);
+                    }
             }
             $offset += $extLen;
         }
@@ -204,10 +354,17 @@ class TLSClientHelloParser
 
             $ja4_hash = $ja4_a . "_" . $ja4_b . "_" . $ja4_c;
 
-        return [
+        $result = [
             'ja3_string' => $ja3String,
                 'ja3_hash'   => md5($ja3String),
                 'ja4_raw'    => $ja4_hash
         ];
+
+        if ($quicParams !== null) {
+            $result['quic_params'] = $quicParams;
+            $result['quic_fp'] = self::formatQuicFingerprint($quicParams);
+        }
+
+        return $result;
     }
 }