@anonympins/fingerprint 0.6.7 → 0.7.1

package/src/php/Utils/RequestUtils.php

@@ -411,6 +411,9 @@ class RequestUtils
         }
 
         $score = 0.0;
+        if (!empty($metrics['prototypeTampered'])) {
+            $score += 80.0;
+        }
 
         $mouseAnalysis = self::analyzeMouseMovements($metrics['mouseMovementsHistory'] ?? null);
         $touch = self::analyzeTouchMovements($metrics['touchMovementsHistory'] ?? null);
@@ -501,6 +504,15 @@ class RequestUtils
                     $score += 35;
                 }
             }
+
+            // Détection de ferme mobile : Touch actif sur mobile sans aucune vibration physique (châssis/rack ADB)
+            $ua = $context->getHeader('user-agent') ?? '';
+            $isMobileDevice = str_contains($ua, 'Mobile');
+            if ($isMobileDevice && count($touchHistory) >= 5 && isset($metrics['motionVariance']) && is_numeric($metrics['motionVariance'])) {
+                if ((float)$metrics['motionVariance'] === 0.0) {
+                    $score += 50.0;
+                }
+            }
         }
 
         return ['behaviorScore' => min(100.0, $score)];
@@ -1025,13 +1037,20 @@ class RequestUtils
 
     public static function getThreatIntelScore(RequestContext $context, array $threatIntelConfig): array
     {
+        $score = 0.0;
         $zkpY = $context->zkpY;
-        if (empty($zkpY)) {
-            return ['threatIntelScore' => 0.0];
+        if (!empty($zkpY)) {
+            $store = StoreManager::getStore();
+            $isBanned = $store->has("banned-zkp-y:{$zkpY}");
+            if ($isBanned) {
+                $score = 100.0;
+            }
         }
-        $store = StoreManager::getStore();
-        $isBanned = $store->has("banned-zkp-y:{$zkpY}");
-        return ['threatIntelScore' => $isBanned ? 100.0 : 0.0];
+
+        $rttProxyScore = \Anonympins\Fingerprint\Ja3AnomalyDetector::getRttProxyScore($context);
+        $score = max($score, (float)$rttProxyScore);
+
+        return ['threatIntelScore' => $score];
     }
 
     /**
@@ -1237,6 +1256,36 @@ class RequestUtils
         return null;
     }
 
+    /**
+     * Calcule la longueur du préfixe commun (en bits) entre deux adresses IP (IPv4 ou IPv6).
+     */
+    public static function getIpCommonPrefixLength(string $ip1, string $ip2): int
+    {
+        $bin1 = @inet_pton($ip1);
+        $bin2 = @inet_pton($ip2);
+        if ($bin1 === false || $bin2 === false || strlen($bin1) !== strlen($bin2)) {
+            return 0;
+        }
+        $len = strlen($bin1);
+        $bits = 0;
+        for ($i = 0; $i < $len; $i++) {
+            $xor = ord($bin1[$i]) ^ ord($bin2[$i]);
+            if ($xor === 0) {
+                $bits += 8;
+            } else {
+                for ($b = 7; $b >= 0; $b--) {
+                    if (($xor & (1 << $b)) === 0) {
+                        $bits++;
+                    } else {
+                        break;
+                    }
+                }
+                break;
+            }
+        }
+        return $bits;
+    }
+
     /**
      * Met à jour les métriques agrégées pour un sous-réseau IP.
      * @param RequestContext $context
@@ -1256,7 +1305,8 @@ class RequestUtils
             'highScoreDevices' => [],
             'lastActivity' => 0,
             'ips' => [],
-            'uas' => []
+            'uas' => [],
+            'attackerIps' => []
         ];
 
         if (!isset($subnetData['highScoreDevices'])) {
@@ -1268,6 +1318,9 @@ class RequestUtils
         if (!isset($subnetData['uas'])) {
             $subnetData['uas'] = [];
         }
+        if (!isset($subnetData['attackerIps']) || !is_array($subnetData['attackerIps'])) {
+            $subnetData['attackerIps'] = [];
+        }
         $now = time();
         self::decaySubnetData($subnetData, $now);
 
@@ -1290,6 +1343,28 @@ class RequestUtils
         }
 
         $userAgent = $context->getHeader('user-agent') ?? '';
+        if ($finalScore >= 70.0) {
+            $foundAttacker = false;
+            foreach ($subnetData['attackerIps'] as &$att) {
+                if (isset($att['ip']) && $att['ip'] === $context->clientIp) {
+                    $att['lastSeen'] = $now;
+                    $att['score'] = max((float)($att['score'] ?? 0.0), $finalScore);
+                    $foundAttacker = true;
+                    break;
+                }
+            }
+            unset($att);
+            if (!$foundAttacker) {
+                $subnetData['attackerIps'][] = [
+                    'ip' => $context->clientIp,
+                    'lastSeen' => $now,
+                    'score' => $finalScore
+                ];
+                if (count($subnetData['attackerIps']) > 30) {
+                    array_shift($subnetData['attackerIps']);
+                }
+            }
+        }
         if (!empty($userAgent) && !in_array($userAgent, $subnetData['uas'], true)) {
             $subnetData['uas'][] = $userAgent;
         }
@@ -1319,9 +1394,10 @@ class RequestUtils
      * Calcule un score de suspicion basé sur l'activité historique du sous-réseau IP.
      * @param RequestContext $context
      * @param string $currentDeviceId
+     * @param array<string, mixed> $securityConfig
      * @return array{'subnetScore': float}
      */
-    public static function getSubnetScore(RequestContext $context, string $currentDeviceId): array
+    public static function getSubnetScore(RequestContext $context, string $currentDeviceId = '', array $securityConfig = []): array
     {
         $subnet = self::getIpSubnet($context->clientIp);
         if ($subnet === null) {
@@ -1355,24 +1431,72 @@ class RequestUtils
             return ['subnetScore' => 0.0];
         }
 
-        $suspicionDensity = $highScoreCount / $deviceCount;
-        $ipDeviceRatio = $ipCount / $deviceCount;
+        // 1. Régularisation bayésienne continue de la densité
+        $bayesianDensity = ((float)$highScoreCount + 0.5) / ((float)$deviceCount + 2.5);
+
+        // 2. Dispersion IP / Terminal (CGNAT vs Proxy Pool)
+        $ipDispersion = min(2.0, (float)$ipCount / (float)$deviceCount);
+        $ipMultiplier = 0.6 + 0.4 * tanh($ipDispersion);
 
-        // Ratio User-Agent / Device : détecte la rotation/spoofing de navigateurs sur une même empreinte matérielle
-        $uaDeviceRatio = (double)max(1, $uaCount) / $deviceCount;
-        $uaMultiplier = 0.6 + (0.4 * min(2.5, $uaDeviceRatio));
+        // 3. Dispersion User-Agent / Terminal
+        $uaDispersion = min(3.0, (float)max(1, $uaCount) / (float)$deviceCount);
+        $uaMultiplier = 0.7 + 0.3 * tanh($uaDispersion - 1.0);
 
-        $baseScore = 100.0 * (1.0 - exp(-0.15 * $highScoreCount));
+        // 4. Intensité brute globale de la menace
+        $rawIntensity = (float)$highScoreCount * $bayesianDensity * $ipMultiplier * $uaMultiplier;
 
-        $densityMultiplier = 0.4 + (1.6 * $suspicionDensity);
-        $distributionMultiplier = 0.5 + (1.0 * $ipDeviceRatio);
+        // 5. Composante 1 : Score ambiant plafonné en zone Medium (asymptote au seuil medium)
+        $mediumThreshold = (float)($securityConfig['thresholds']['medium'] ?? 45.0);
+        $ambientAsymptote = $mediumThreshold;
+        $maxProximityBoost = max(0.0, 100.0 - $ambientAsymptote);
+        $scale = 10.0;
+        $ambientScore = $ambientAsymptote * tanh($rawIntensity / $scale);
 
-        $dampening = 1.0;
-        if( $highScoreCount < 3 ){
-            $dampening = $highScoreCount / 3.0;
+        // 6. Composante 2 : Boost de proximité micro-réseau avec des attaquants récents (le reste va jusqu'à 100)
+        $proximityBoost = 0.0;
+        $attackerIps = $subnetData['attackerIps'] ?? [];
+        $clientIp = $context->clientIp;
+
+        if (!empty($attackerIps) && !empty($clientIp)) {
+            $maxCommonPrefix = 0;
+            $isV4 = filter_var($clientIp, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) !== false;
+            $isV6 = filter_var($clientIp, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) !== false;
+
+            foreach ($attackerIps as $att) {
+                $attIp = $att['ip'] ?? '';
+                $lastSeen = $att['lastSeen'] ?? $now;
+                if ($attIp !== '' && ($now - $lastSeen) <= 1800) {
+                    $prefixLen = self::getIpCommonPrefixLength($clientIp, $attIp);
+                    if ($prefixLen > $maxCommonPrefix) {
+                        $maxCommonPrefix = $prefixLen;
+                    }
+                }
+            }
+
+            if ($isV4) {
+                if ($maxCommonPrefix >= 32) {
+                    $proximityBoost = $maxProximityBoost; // Même adresse IP exacte
+                } elseif ($maxCommonPrefix >= 30) {
+                    $proximityBoost = $maxProximityBoost * (45.0 / 55.0); // Même /30 (écart <= 3 adresses)
+                } elseif ($maxCommonPrefix >= 28) {
+                    $proximityBoost = $maxProximityBoost * (30.0 / 55.0); // Même /28 (bloc de 16 adresses)
+                } elseif ($maxCommonPrefix >= 26) {
+                    $proximityBoost = $maxProximityBoost * (15.0 / 55.0); // Même /26 (bloc de 64 adresses)
+                }
+            } elseif ($isV6) {
+                if ($maxCommonPrefix >= 128) {
+                    $proximityBoost = $maxProximityBoost; // Même IPv6 exacte
+                } elseif ($maxCommonPrefix >= 120) {
+                    $proximityBoost = $maxProximityBoost * (45.0 / 55.0); // Même /120
+                } elseif ($maxCommonPrefix >= 112) {
+                    $proximityBoost = $maxProximityBoost * (30.0 / 55.0); // Même /112
+                } elseif ($maxCommonPrefix >= 96) {
+                    $proximityBoost = $maxProximityBoost * (15.0 / 55.0); // Même /96
+                }
+            }
         }
-        $finalScore = min(100.0, round($baseScore * $densityMultiplier * $distributionMultiplier * $uaMultiplier * $dampening * 10.0) / 10.0);
 
+        $finalScore = min(100.0, round(($ambientScore + $proximityBoost) * 10.0) / 10.0);
         return ['subnetScore' => $finalScore];
     }
     /**
@@ -1408,6 +1532,12 @@ class RequestUtils
                 }
             }
 
+            if (isset($subnetData['attackerIps']) && is_array($subnetData['attackerIps'])) {
+                $subnetData['attackerIps'] = array_values(array_filter($subnetData['attackerIps'], function ($att) use ($now) {
+                    return ($now - ($att['lastSeen'] ?? $now)) < 3600;
+                }));
+            }
+
             $subnetData['lastActivity'] = $now - ($inactivitySec % 1800);
         }
     }
@@ -2031,4 +2161,91 @@ class RequestUtils
 
         return !empty($deviceId) && !empty($deviceHash); // Match d'identité matérielle stricte (deviceId + deviceHash validés par HMAC)
     }
+
+    private static function imul(int $a, int $b): int
+    {
+        return ($a * $b) & 0xffffffff;
+    }
+
+    public static function cyrb53(string $str, int $seed = 0): int
+    {
+        $h1 = (0xdeadbeef ^ $seed) & 0xffffffff;
+        $h2 = (0x41c6ce57 ^ $seed) & 0xffffffff;
+        for ($i = 0; $i < strlen($str); $i++) {
+            $ch = ord($str[$i]);
+            $h1 = self::imul($h1 ^ $ch, 2654435761);
+            $h2 = self::imul($h2 ^ $ch, 1597334677);
+        }
+        $h1 = self::imul($h1 ^ ($h1 >> 16), 2246822507) ^ self::imul($h2 ^ ($h2 >> 13), 3266489909);
+        $h2 = self::imul($h2 ^ ($h2 >> 16), 2246822507) ^ self::imul($h1 ^ ($h1 >> 13), 3266489909);
+        $unsigned_h1 = $h1 & 0xffffffff;
+        return 4294967296 * (2097151 & $h2) + $unsigned_h1;
+    }
+
+    public static function getVirtualizationAnomalyScore(RequestContext $context): float
+    {
+        $clientFp = $context->headers['x-device-fingerprint'] ?? null;
+        if (!$clientFp) {
+            return 0.0;
+        }
+
+        $fpMap = [];
+        foreach (explode('|', $clientFp) as $part) {
+            $pair = explode(':', $part, 2);
+            if (count($pair) === 2) {
+                $fpMap[$pair[0]] = $pair[1];
+            }
+        }
+
+        $score = 0.0;
+        $clientGpuHash = $fpMap['gpu'] ?? null;
+        if ($clientGpuHash) {
+            $virtualGpus = [
+                "Google SwiftShader", "SwiftShader",
+                "Mesa llvmpipe", "llvmpipe", "Mesa Gallium",
+                "Microsoft Basic Render Driver", "HeadlessChrome",
+                "Intel(R) HD Graphics"
+            ];
+            $virtualGpuHashes = [];
+            foreach ($virtualGpus as $gpu) {
+                $virtualGpuHashes[] = (string)self::cyrb53($gpu);
+            }
+            if (in_array($clientGpuHash, $virtualGpuHashes, true)) {
+                $score += 75.0;
+            }
+        }
+
+        $clientScreenHash = $fpMap['scr'] ?? null;
+        if ($clientScreenHash) {
+            $headlessResolutions = ["800x600_24", "1024x768_24"];
+            $headlessHashes = [];
+            foreach ($headlessResolutions as $res) {
+                $headlessHashes[] = (string)self::cyrb53($res);
+            }
+            if (in_array($clientScreenHash, $headlessHashes, true)) {
+                $score += 25.0;
+            }
+        }
+
+        return min(100.0, $score);
+    }
+
+    /**
+     * Calcule un score d'incohérence analogique et lisse plafonnant à 99.9 max.
+     */
+    public static function calculateAnalogInconsistencyScore(float $consistencyScore, float $inflectionPoint = 0.72, float $steepness = 12.0): float
+    {
+        $s = max(0.0, min(1.0, $consistencyScore));
+        if ($s >= 0.98) {
+            return 0.0;
+        }
+
+        $asymptote = 99.9;
+        $raw = 1.0 / (1.0 + exp($steepness * ($s - $inflectionPoint)));
+        $minVal = 1.0 / (1.0 + exp($steepness * (1.0 - $inflectionPoint)));
+        $maxVal = 1.0 / (1.0 + exp($steepness * (0.0 - $inflectionPoint)));
+        $normalized = (($raw - $minVal) / ($maxVal - $minVal)) * $asymptote;
+
+        return min($asymptote, round($normalized, 1));
+    }
 }