@anonympins/fingerprint 0.6.7 → 0.7.1

package/src/js/fingerprint.js

@@ -6,7 +6,7 @@ import {getProblemManager, problemManager} from "./problem-manager.js";
 import {Optimization} from "./library.js";
 import {cyrb53, FingerprintBuilder} from "./fingerprint.builder.js";
 import {DynamicWasmGenerator} from "./dynamic-wasm.js";
-import {writeFileSync, readFileSync, existsSync} from "node:fs";
+import {writeFileSync, readFileSync, existsSync, promises as fsPromises} from "node:fs";
 import {fileURLToPath} from "node:url";
 import {dirname, join, resolve} from "node:path";
 import {GpuPowSolver} from "./gpu_pow.solver.js";
@@ -29,6 +29,8 @@ import {
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 
+const secureRandomFloat = () => crypto.randomInt(0, 4294967296) / 4294967296;
+
 let dnsCircuitBreaker = {
   state: 'CLOSED', // 'CLOSED', 'OPEN', 'HALF-OPEN'
   failureCount: 0,
@@ -277,9 +279,7 @@ async function ensureLatestMapping() {
             mapping.timestamp = now;
 
             activeMappings.unshift(mapping);
-            if (activeMappings.length > 5) {
-                activeMappings.pop();
-            }
+            activeMappings = activeMappings.slice(0, 5);
             lastMappingTime = now;
 
             try {
@@ -402,16 +402,70 @@ function getProtocolAnomalyScore(context) {
                     if (kv.length === 2) params[kv[0]] = kv[1];
                 });
                 const priorityOrder = parts[2] || '';
+                const frameOrderRaw = parts[3] || context.headers?.['x-quic-frame-order'] || context.quicFrameOrder || '';
+                const frameOrder = frameOrderRaw.toLowerCase().split(',').map(s => s.trim()).filter(Boolean);
 
-                if (browser.startsWith('Chrome') || browser.startsWith('Edge')) {
-                    const maxData = parseInt(params['1'] || '0', 10);
-                    const maxStreams = parseInt(params['4'] || '0', 10);
+                const isChromium = browser.startsWith('Chrome') || browser.startsWith('Edge');
+                const isFirefox = browser.startsWith('Firefox');
+                const isSafari = browser.startsWith('Safari');
+
+                const maxData = parseInt(params['1'] || params['0x01'] || '0', 10);
+                const maxStreams = parseInt(params['4'] || params['8'] || params['0x08'] || '0', 10);
+                const bidiLocal = parseInt(params['5'] || params['0x05'] || '0', 10);
+                const bidiRemote = parseInt(params['6'] || params['0x06'] || '0', 10);
+
+                if (isChromium) {
+                    // Contrôle de flux global et nombre de flux bidirectionnels
                     if (maxData > 0 && maxData < 1048576) quicAnomaly += 40.0;
                     if (maxStreams > 0 && maxStreams !== 100) quicAnomaly += 30.0;
                     if (priorityOrder && !priorityOrder.includes('u=')) quicAnomaly += 30.0;
-                } else if (browser.startsWith('Firefox')) {
+
+                    // Contrôle de flux bidi (Chromium alloue 6MB = 6291456 ou au minimum 512 Ko)
+                    // curl-impersonate / quiche alloue 256 Ko (262144) ou 128 Ko (131072)
+                    if (bidiLocal > 0 && (bidiLocal < 524288 || bidiLocal === 262144)) quicAnomaly += 40.0;
+                    if (bidiRemote > 0 && (bidiRemote < 524288 || bidiRemote === 262144)) quicAnomaly += 30.0;
+
+                    // Ordre des trames de contrôle QUIC (SETTINGS, MAX_STREAMS, PRIORITY)
+                    if (frameOrder.length >= 2) {
+                        const sIdx = frameOrder.findIndex(f => f === 's' || f === 'settings' || f === '4');
+                        const mIdx = frameOrder.findIndex(f => f === 'm' || f === 'max_streams' || f === '18');
+                        const pIdx = frameOrder.findIndex(f => f === 'p' || f === 'priority' || f === 'priority_update' || f === '15');
+
+                        if (sIdx !== 0 && sIdx !== -1) {
+                            quicAnomaly += 50.0; // SETTINGS doit obligatoirement être la première trame
+                        }
+                        if (mIdx !== -1 && sIdx !== -1 && mIdx < sIdx) {
+                            quicAnomaly += 60.0; // MAX_STREAMS envoyé avant SETTINGS (défaut curl/quiche)
+                        }
+                        if (pIdx !== -1 && sIdx !== -1 && pIdx < sIdx) {
+                            quicAnomaly += 60.0;
+                        }
+                    }
+                } else if (isFirefox) {
                     const maxData = parseInt(params['1'] || '0', 10);
                     if (maxData > 0 && maxData > 5000000) quicAnomaly += 40.0;
+                    // Necko (Firefox) n'utilise pas 100 flux bidi par défaut ni un buffer bidi de 6 Mo
+                    if (maxStreams === 100) quicAnomaly += 50.0;
+                    if (bidiLocal === 6291456) quicAnomaly += 50.0;
+
+                    if (frameOrder.length >= 2) {
+                        const sIdx = frameOrder.findIndex(f => f === 's' || f === 'settings' || f === '4');
+                        if (sIdx !== 0 && sIdx !== -1) quicAnomaly += 50.0;
+                    }
+                } else if (isSafari) {
+                    // Safari Network.framework
+                    if (maxStreams === 100 && maxData === 1572864 && priorityOrder.includes('u=2,i')) {
+                        quicAnomaly += 60.0; // Usurpation par profil Cronet / curl-impersonate
+                    }
+                    if (bidiLocal === 6291456) quicAnomaly += 50.0;
+
+                    if (frameOrder.length >= 2) {
+                        const sIdx = frameOrder.findIndex(f => f === 's' || f === 'settings' || f === '4');
+                        const mIdx = frameOrder.findIndex(f => f === 'm' || f === 'max_streams');
+                        if (mIdx !== -1 && (mIdx === 0 || (sIdx !== -1 && mIdx < sIdx))) {
+                            quicAnomaly += 50.0;
+                        }
+                    }
                 }
             }
         }
@@ -422,7 +476,9 @@ function getProtocolAnomalyScore(context) {
             0.0,
             Math.min(100.0, http2Anomaly),
             Math.min(100.0, quicAnomaly)
-        )
+        ),
+        http2AnomalyScore: Math.min(100.0, http2Anomaly),
+        quicAnomalyScore: Math.min(100.0, quicAnomaly)
     };
 }
 /**
@@ -612,6 +668,7 @@ const securityProfiles = {
             protocolAnomalyScore: 0.8, // NOUVEAU: Poids pour l'anomalie HTTP/2
             renderingAnomalyScore: 0.8, // NOUVEAU: Poids pour l'anomalie de rendu
             threatIntelScore: 1.0, // NOUVEAU: Poids pour le réseau de Threat Intelligence Fédéré
+            virtualizationScore: 0.8,
         },
         thresholds: { low: 20, medium: 45, high: 75, block: 95 },
         patterns: {
@@ -840,17 +897,28 @@ const getPowSecret = () => {
   return secret || "fallback-dev-secret-32-chars-minimum";
 };
 
-let cachedPowSolverCode = null;
 /**
  * Loads the pow.solver.js content for inlining in HTML pages.
  * @returns {string} The solver JavaScript code.
  */
+let cachedPowSolverCode = "";
+async function preloadPowSolverCode() {
+    if (!cachedPowSolverCode) {
+        try {
+            const solverPath = join(__dirname, 'pow.solver.inline.js');
+            cachedPowSolverCode = await fsPromises.readFile(solverPath, 'utf-8');
+        } catch (e) {
+            console.error('[Fingerprint] Failed to pre-load inline solver:', e.message);
+        }
+    }
+}
+
 const getPowSolverCode = () => {
-  if (!cachedPowSolverCode) {
-    const solverPath = join(__dirname, 'pow.solver.inline.js'); // Utilise la version inline
-    cachedPowSolverCode = readFileSync(solverPath, 'utf-8');
-  }
-  return cachedPowSolverCode;
+    if (!cachedPowSolverCode) {
+        const solverPath = join(__dirname, 'pow.solver.inline.js');
+        cachedPowSolverCode = readFileSync(solverPath, 'utf-8');
+    }
+    return cachedPowSolverCode;
 };
 /**
  * Extracts the "stable" part of a fingerprint string.
@@ -1807,7 +1875,7 @@ export async function generateSpaceChallenge(clientIp, nonce, suspicionFactor, o
   const queries = [];
   const maxBlocks = sizeMb * 1024;
   while (queries.length < numQueries) {
-    const idx = Math.floor(Math.random() * maxBlocks);
+    const idx = crypto.randomInt(0, maxBlocks);
     if (!queries.includes(idx)) {
       queries.push(idx);
     }
@@ -1824,7 +1892,7 @@ export async function generateSpaceChallenge(clientIp, nonce, suspicionFactor, o
   const peer = await findPeerInSubnet(clientIp, nonce);
   if (peer) {
     challenge.peerId = peer.nodeId;
-    challenge.peerBlockIdx = Math.floor(Math.random() * maxBlocks);
+    challenge.peerBlockIdx = crypto.randomInt(0, maxBlocks);
 
     await store.set(`coop-assoc:${nonce}`, {
       peerNodeId: peer.nodeId,
@@ -1861,7 +1929,12 @@ function generateSpaceChallengePage(challengeDetails, clientSecret, securityConf
         const hashBuffer = await crypto.subtle.digest("SHA-256", data);
         return Array.from(new Uint8Array(hashBuffer)).map(b => b.toString(16).padStart(2, '0')).join('');
       }
-      
+       
+       async function sendWebRtcSignal(targetId, type, data) {
+         const sig = await signCoop("webrtc_signal", nodeId, targetId + ":" + type + ":" + data);
+         await fetch(window.location.pathname + "?coop_op=webrtc_signal&node_id=" + nodeId + "&target_peer_id=" + targetId + "&signal_type=" + type + "&signal_data=" + encodeURIComponent(data) + "&coop_sig=" + sig);
+       }
+
       document.getElementById('loader').innerText = '⚙️ Checking persistent local storage...';
       await new Promise(r => setTimeout(r, 10));
       
@@ -1874,47 +1947,110 @@ function generateSpaceChallengePage(challengeDetails, clientSecret, securityConf
               await fetch(window.location.pathname + "?coop_op=register&node_id=" + nodeId + "&seed=" + encodeURIComponent(nonce + ":" + clientSecret) + "&coop_sig=" + sig);
           }
 
+        // Gestionnaire de connexions WebRTC P2P
+           const peerConnections = {};
+
           // Écoute des requêtes entrantes de nos pairs
           setInterval(async () => {
-              try {
-                  const sig = await signCoop("poll_requests", nodeId);
-                  const res = await fetch(window.location.pathname + "?coop_op=poll_requests&node_id=" + nodeId + "&coop_sig=" + sig);
-                  const data = await res.json();
-                  if (data.requests && data.requests.length > 0) {
-                      for (const req of data.requests) {
-                          document.getElementById('loader').innerText = '📤 Transfert coopératif de bloc vers le pair...';
-                          const blockData = await window.readSpaceBlock(req.block_idx);
-                          const respSig = await signCoop("respond_block", nodeId, req.requester_id + ":" + req.req_id + ":" + blockData);
-                          await fetch(window.location.pathname + "?coop_op=respond_block&node_id=" + nodeId + "&requester_id=" + req.requester_id + "&req_id=" + req.req_id + "&block_data=" + encodeURIComponent(blockData) + "&coop_sig=" + respSig);
-                      }
-                  }
-              } catch (e) {
-                  console.error("Cooperative polling error", e);
-              }
-          }, 1000);
+try {
+                   // 1. Récupération des signaux WebRTC P2P entrants
+                   const sigWebrtc = await signCoop("poll_signals", nodeId);
+                   const resWebrtc = await fetch(window.location.pathname + "?coop_op=poll_signals&node_id=" + nodeId + "&coop_sig=" + sigWebrtc);
+                   const dataWebrtc = await resWebrtc.json();
+                   if (dataWebrtc.signals && dataWebrtc.signals.length > 0) {
+                       for (const sig of dataWebrtc.signals) {
+                           const fromId = sig.from_peer_id;
+                           if (sig.signal_type === 'offer') {
+                               const pc = new RTCPeerConnection({ iceServers: [] });
+                               peerConnections[fromId] = pc;
+                               pc.onicecandidate = (e) => {
+                                   if (e.candidate) sendWebRtcSignal(fromId, 'candidate', JSON.stringify(e.candidate));
+                               };
+                               pc.ondatachannel = (e) => {
+                                   const dc = e.channel;
+                                   dc.onmessage = async (evt) => {
+                                       try {
+                                           const req = JSON.parse(evt.data);
+                                           if (req.type === 'get_block') {
+                                               document.getElementById('loader').innerText = '📤 Transfert direct P2P (WebRTC) du bloc vers le pair...';
+                                               const blockData = await window.readSpaceBlock(req.block_idx);
+                                               dc.send(JSON.stringify({ type: 'block_data', block_data: blockData }));
+                                           }
+                                       } catch (err) {}
+                                   };
+                               };
+                               await pc.setRemoteDescription(new RTCSessionDescription(JSON.parse(sig.signal_data)));
+                               const answer = await pc.createAnswer();
+                               await pc.setLocalDescription(answer);
+                               await sendWebRtcSignal(fromId, 'answer', JSON.stringify(answer));
+                           } else if (sig.signal_type === 'answer' && peerConnections[fromId]) {
+                               await peerConnections[fromId].setRemoteDescription(new RTCSessionDescription(JSON.parse(sig.signal_data)));
+                           } else if (sig.signal_type === 'candidate' && peerConnections[fromId]) {
+                               await peerConnections[fromId].addIceCandidate(new RTCIceCandidate(JSON.parse(sig.signal_data)));
+                           }
+                       }
+                   }
+               } catch (e) {}
+          }, 800);
 
           let peerBlock = "";
           if (peerId && peerBlockIdx !== -1) {
-              document.getElementById('loader').innerText = '📥 Téléchargement du bloc de validation du pair (' + peerId + ')...';
-              const reqId = Math.random().toString(36).substring(2);
-              const reqSig = await signCoop("request_peer_block", nodeId, peerId + ":" + peerBlockIdx + ":" + reqId);
-              await fetch(window.location.pathname + "?coop_op=request_peer_block&node_id=" + nodeId + "&peer_id=" + peerId + "&block_idx=" + peerBlockIdx + "&req_id=" + reqId + "&coop_sig=" + reqSig);
-              
-              let attempts = 0;
-              while (attempts < coopTimeout) {
-                  const pollSig = await signCoop("poll_response", nodeId, reqId);
-                  const res = await fetch(window.location.pathname + "?coop_op=poll_response&node_id=" + nodeId + "&req_id=" + reqId + "&coop_sig=" + pollSig);
-                  const data = await res.json();
-                  if (data.status === 'ready') {
-                      peerBlock = data.block_data;
-                      break;
-                  }
-                  await new Promise(r => setTimeout(r, 1000));
-                  attempts++;
-              }
-              if (!peerBlock) {
-                  document.getElementById('loader').innerText = '⚠️ Peer de sous-réseau injoignable. Validation solo...';
-              }
+               document.getElementById('loader').innerText = '📥 Connexion WebRTC P2P directe au pair (' + peerId + ')...';
+ 
+               // 1. Tentative d'échange direct via WebRTC DataChannel (charge serveur = 0)
+               const webrtcTransferPromise = new Promise(async (resolve) => {
+                   if (!window.RTCPeerConnection) return resolve(null);
+                   try {
+                       const pc = new RTCPeerConnection({ iceServers: [] });
+                       peerConnections[peerId] = pc;
+                       const dc = pc.createDataChannel("pospace-transfer");
+                       pc.onicecandidate = (e) => {
+                           if (e.candidate) sendWebRtcSignal(peerId, 'candidate', JSON.stringify(e.candidate));
+                       };
+                       dc.onopen = () => {
+                           dc.send(JSON.stringify({ type: 'get_block', block_idx: peerBlockIdx }));
+                       };
+                       dc.onmessage = (e) => {
+                           try {
+                               const msg = JSON.parse(e.data);
+                               if (msg.type === 'block_data' && msg.block_data) {
+                                   resolve(msg.block_data);
+                               }
+                           } catch (err) {}
+                       };
+                       const offer = await pc.createOffer();
+                       await pc.setLocalDescription(offer);
+                       await sendWebRtcSignal(peerId, 'offer', JSON.stringify(offer));
+                   } catch (err) {
+                       resolve(null);
+                   }
+               });
+ 
+               const webrtcTimeoutPromise = new Promise((resolve) => setTimeout(() => resolve(null), 5000));
+               peerBlock = await Promise.race([webrtcTransferPromise, webrtcTimeoutPromise]);
+ 
+               if (peerBlock) {
+                   document.getElementById('loader').innerText = '⚡ Bloc reçu en direct via WebRTC P2P sans transit serveur !';
+               } else {
+                   // 2. Repli transparent vers la boîte aux lettres HTTP en cas de restriction réseau
+                   document.getElementById('loader').innerText = '⚠️ WebRTC P2P indisponible. Téléchargement via relais HTTP...';
+                   const reqId = Math.random().toString(36).substring(2);
+                   const reqSig = await signCoop("request_peer_block", nodeId, peerId + ":" + peerBlockIdx + ":" + reqId);
+                   await fetch(window.location.pathname + "?coop_op=request_peer_block&node_id=" + nodeId + "&peer_id=" + peerId + "&block_idx=" + peerBlockIdx + "&req_id=" + reqId + "&coop_sig=" + reqSig);
+                   
+                   let attempts = 0;
+                   while (attempts < coopTimeout) {
+                       const pollSig = await signCoop("poll_response", nodeId, reqId);
+                       const res = await fetch(window.location.pathname + "?coop_op=poll_response&node_id=" + nodeId + "&req_id=" + reqId + "&coop_sig=" + pollSig);
+                       const data = await res.json();
+                       if (data.status === 'ready') {
+                           peerBlock = data.block_data;
+                           break;
+                       }
+                       await new Promise(r => setTimeout(r, 1000));
+                       attempts++;
+                   }
+               }
           }
 
           document.getElementById('loader').innerText = '⚙️ Generating Proof of Space...';
@@ -2211,7 +2347,9 @@ function getBehaviorScore(context) {
     if (metrics.honeypotInteraction) {
       return { behaviorScore: 100 };
     }
-
+  if (metrics.prototypeTampered) {
+      score += 80; // Altération flagrante de l'environnement JS
+  }
     // 2. Analyse des mouvements de la souris
     const { avgSpeed, avgAcceleration, straightness, pauses, segments } = analyzeMouseMovements(metrics.mouseMovementsHistory);
     const touchAnalysis = analyzeTouchMovements(metrics.touchMovementsHistory);
@@ -2263,6 +2401,14 @@ function getBehaviorScore(context) {
             const benfordDev = Optimization.Operators.benfordTest(touch.segments);
             if (benfordDev > 0.18) score += 35;
         }
+
+        // Détection de ferme mobile : Touch actif sur mobile sans aucune vibration physique (châssis/rack ADB)
+        const isMobileDevice = (context.headers['user-agent'] || '').includes('Mobile');
+        if (isMobileDevice && touchHistory.length >= 5 && typeof metrics.motionVariance === 'number') {
+            if (metrics.motionVariance === 0) {
+                score += 50; // Terminal fixé sur un châssis mécanique (rack ADB)
+            }
+        }
     }
 
     // Plausibilité de la latence de frappe
@@ -2896,6 +3042,62 @@ function getIpSubnet(ip, ipv4Prefix = 24, ipv6Prefix = 48) { // eslint-disable-l
   return null;
 }
 
+/**
+ * Calcule la longueur du préfixe commun (en bits) entre deux adresses IP (IPv4 ou IPv6).
+ * @param {string} ip1
+ * @param {string} ip2
+ * @returns {number} Nombre de bits identiques en tête (0 à 32 pour IPv4, 0 à 128 pour IPv6).
+ */
+function getIpCommonPrefixLength(ip1, ip2) {
+  if (!ip1 || !ip2) return 0;
+  if (isIPv4(ip1) && isIPv4(ip2)) {
+    const b1 = ip1.split('.').map(Number);
+    const b2 = ip2.split('.').map(Number);
+    const int1 = ((b1[0] << 24) | (b1[1] << 16) | (b1[2] << 8) | b1[3]) >>> 0;
+    const int2 = ((b2[0] << 24) | (b2[1] << 16) | (b2[2] << 8) | b2[3]) >>> 0;
+    const xor = (int1 ^ int2) >>> 0;
+    return xor === 0 ? 32 : Math.clz32(xor);
+  }
+  if (isIPv6(ip1) && isIPv6(ip2)) {
+    const normalize = (ip) => {
+      let normalized = ip.trim().toLowerCase();
+      if (normalized.includes("::")) {
+        const parts = normalized.split("::");
+        const left = parts[0] ? parts[0].split(":") : [];
+        const right = parts[1] ? parts[1].split(":") : [];
+        const missing = 8 - (left.length + right.length);
+        const middle = Array(missing).fill("0000");
+        normalized = [...left, ...middle, ...right].join(":");
+      } else {
+        const parts = normalized.split(":");
+        if (parts.length !== 8) return null;
+      }
+      return normalized.split(":").map(g => parseInt(g, 16) || 0);
+    };
+
+    try {
+      const g1 = normalize(ip1);
+      const g2 = normalize(ip2);
+      if (!g1 || !g2) return 0;
+      let prefix = 0;
+      for (let i = 0; i < 8; i++) {
+        const xor = (g1[i] ^ g2[i]) & 0xffff;
+        if (xor === 0) {
+          prefix += 16;
+        } else {
+          // clz32 opère sur des entiers 32 bits, ajuster pour 16 bits
+          prefix += (Math.clz32(xor) - 16);
+          break;
+        }
+      }
+      return prefix;
+    } catch (e) {
+      return 0;
+    }
+  }
+  return 0;
+}
+
 /**
  * Applies temporal decay (half-life of 30 minutes) to subnet metrics.
  * @private
@@ -2943,6 +3145,11 @@ function decaySubnetData(subnetData, now) {
             subnetData.uas = subnetData.uas.slice(0, newLen);
         }
 
+        if (Array.isArray(subnetData.attackerIps)) {
+            const maxAttackerAgeMs = 60 * 60 * 1000; // 1 heure max
+            subnetData.attackerIps = subnetData.attackerIps.filter(a => (now - (a.lastSeen || now)) < maxAttackerAgeMs);
+        }
+
         subnetData.lastActivity = now - (inactivityMs % (30 * 60 * 1000));
     }
     return subnetData;
@@ -2965,7 +3172,8 @@ async function updateSubnetMetrics(context, deviceId, finalScore) {
         highScoreDevices: {},
         lastActivity: 0,
         ips: [],
-        uas: []
+        uas: [],
+        attackerIps: []
     };
 
     if (!subnetData.highScoreDevices) {
@@ -2977,6 +3185,9 @@ async function updateSubnetMetrics(context, deviceId, finalScore) {
         subnetData.ips = [];
     }
     if (!subnetData.uas) subnetData.uas = [];
+    if (!Array.isArray(subnetData.attackerIps)) {
+        subnetData.attackerIps = [];
+    }
 
     const now = Date.now();
     decaySubnetData(subnetData, now);
@@ -3000,6 +3211,20 @@ async function updateSubnetMetrics(context, deviceId, finalScore) {
     }
 
     const userAgent = context.headers?.['user-agent'] || '';
+
+    if (finalScore >= 70) {
+        const existingAttacker = subnetData.attackerIps.find(a => a.ip === context.clientIp);
+        if (existingAttacker) {
+            existingAttacker.lastSeen = now;
+            existingAttacker.score = Math.max(existingAttacker.score || 0, finalScore);
+        } else {
+            subnetData.attackerIps.push({ ip: context.clientIp, lastSeen: now, score: finalScore });
+            if (subnetData.attackerIps.length > 30) {
+                subnetData.attackerIps.shift();
+            }
+        }
+    }
+
     if (userAgent && !subnetData.uas.includes(userAgent)) {
         subnetData.uas.push(userAgent);
     }
@@ -3019,13 +3244,37 @@ async function updateSubnetMetrics(context, deviceId, finalScore) {
 
     await store.set(key, subnetData, 86400); // 24-hour TTL
 }
+/**
+ * Calcule un score d'incohérence analogique lisse plafonnant à une asymptote de 99.9.
+ * @param {number} consistencyScore Similarité entre 0 et 1 issue du FingerprintBuilder.
+ * @param {number} [inflectionPoint=0.72] Point d'inflexion où la suspicion accélère.
+ * @param {number} [steepness=12] Raideur de la transition sigmoïdale.
+ * @returns {number} Score de 0 à 99.9 sans saut de palier ni certitude absolue à 100.
+ */
+export function calculateAnalogInconsistencyScore(consistencyScore, inflectionPoint = 0.72, steepness = 12) {
+    const s = Math.max(0.0, Math.min(1.0, consistencyScore));
+    if (s >= 0.98) return 0.0;
+
+    const asymptote = 99.9;
+    const raw = 1.0 / (1.0 + Math.exp(steepness * (s - inflectionPoint)));
+    const minVal = 1.0 / (1.0 + Math.exp(steepness * (1.0 - inflectionPoint)));
+    const maxVal = 1.0 / (1.0 + Math.exp(steepness * (0.0 - inflectionPoint)));
+    const normalized = ((raw - minVal) / (maxVal - minVal)) * asymptote;
+
+    return Math.min(asymptote, Math.round(normalized * 10.0) / 10.0);
+}
 
 /**
  * Calculates a suspicion score based on the historical activity of the IP subnet.
  * @param {object} context The request context.
+ * @param {string} [deviceId=''] The device ID.
+ * @param {object} [securityConfig=null] Security configuration containing thresholds.
  * @returns {Promise<{subnetScore: number}>}
  */
-async function getSubnetScore(context) {
+async function getSubnetScore(context, deviceId = '', securityConfig = null) {
+    if (typeof deviceId === 'object' && deviceId !== null && !securityConfig) {
+        securityConfig = deviceId;
+    }
     const subnet = getIpSubnet(context.clientIp);
     if (!subnet) return { subnetScore: 0 };
     const key = `subnet:${subnet}`;
@@ -3054,28 +3303,76 @@ async function getSubnetScore(context) {
         return { subnetScore: 0.0 };
     }
 
-    // Calculs analogues continus (sans sauts brusques)
-    const suspicionDensity = highScoreCount / deviceCount;
-    const ipDeviceRatio = ipCount / deviceCount;
-
-    // Ratio User-Agent / Device : détecte la rotation/spoofing de navigateurs sur une même empreinte matérielle
-    const uaDeviceRatio = Math.max(1, uaCount) / deviceCount;
-    const uaMultiplier = 0.6 + (0.4 * Math.min(2.5, uaDeviceRatio));
-
-    // Base score continu basé sur le volume de menaces
-    const baseScore = 100 * (1 - Math.exp(-0.15 * highScoreCount));
-
-    // Multiplicateurs continus
-    const densityMultiplier = 0.4 + (1.6 * suspicionDensity); // Favorise les densités de suspicion élevées
-    const distributionMultiplier = 0.5 + (1.0 * ipDeviceRatio); // NAT (faible ratio IP/Device) vs Proxy distribué (fort ratio)
+    // 1. Estimation Bayésienne de densité (évite les sur-réactions sur 1 ou 2 appareils)
+    // Prior: alpha=0.5, beta=2.0 (a priori réseau sain)
+    const bayesianDensity = (highScoreCount + 0.5) / (deviceCount + 2.5);
+
+    // 2. Ratio IP / Terminal (distingue un proxy distribué d'un gros NAT / CGNAT)
+    // Sur un proxy distribué, chaque terminal utilise une IP différente (ratio >= 1.0)
+    // Sur un CGNAT, des dizaines de terminaux partagent peu d'IPs (ratio << 1.0)
+    const ipDispersion = Math.min(2.0, ipCount / deviceCount);
+    const ipMultiplier = 0.6 + 0.4 * Math.tanh(ipDispersion);
+
+    // 3. Volatilité des User-Agents (rotation de navigateurs sur matériel identique)
+    const uaDispersion = Math.min(3.0, Math.max(1, uaCount) / deviceCount);
+    const uaMultiplier = 0.7 + 0.3 * Math.tanh(uaDispersion - 1.0);
+
+    // 4. Intensité brute continue de la menace
+    const rawThreatIntensity = highScoreCount * bayesianDensity * ipMultiplier * uaMultiplier;
+
+    // 5. Composante 1 : Score ambiant plafonné en zone Medium (asymptote au seuil medium)
+    const mediumThreshold = (securityConfig?.thresholds?.medium !== undefined)
+        ? Number(securityConfig.thresholds.medium)
+        : 45.0;
+    const ambientAsymptote = mediumThreshold;
+    const maxProximityBoost = Math.max(0.0, 100.0 - ambientAsymptote);
+    const scaleFactor = 10.0;
+    const ambientScore = ambientAsymptote * Math.tanh(rawThreatIntensity / scaleFactor);
+
+    // 6. Composante 2 : Boost de proximité micro-réseau avec des attaquants récents (le reste va jusqu'à 100)
+    let proximityBoost = 0.0;
+    const attackerIps = subnetData.attackerIps || [];
+    const clientIp = context.clientIp;
+
+    if (attackerIps.length > 0 && clientIp) {
+        let maxCommonPrefix = 0;
+        const isClientV4 = isIPv4(clientIp);
+        const isClientV6 = isIPv6(clientIp);
+
+        for (const att of attackerIps) {
+            if (att.ip && (now - (att.lastSeen || now)) <= 30 * 60 * 1000) {
+                const prefixLen = getIpCommonPrefixLength(clientIp, att.ip);
+                if (prefixLen > maxCommonPrefix) {
+                    maxCommonPrefix = prefixLen;
+                }
+            }
+        }
 
-    // Amortissement pour éviter les faux positifs sur les réseaux NAT résidentiels (petits nombres d'appareils suspects)
-    let dampening = 1.0;
-    if (highScoreCount < 3) {
-        dampening = highScoreCount / 3.0; // 0.33 pour 1 appareil, 0.66 pour 2 appareils
+        if (isClientV4) {
+            if (maxCommonPrefix >= 32) {
+                proximityBoost = maxProximityBoost; // Même adresse IP exacte
+            } else if (maxCommonPrefix >= 30) {
+                proximityBoost = maxProximityBoost * (45.0 / 55.0); // Même /30 (écart <= 3 adresses)
+            } else if (maxCommonPrefix >= 28) {
+                proximityBoost = maxProximityBoost * (30.0 / 55.0); // Même /28 (bloc de 16 adresses)
+            } else if (maxCommonPrefix >= 26) {
+                proximityBoost = maxProximityBoost * (15.0 / 55.0); // Même /26 (bloc de 64 adresses)
+            }
+        } else if (isClientV6) {
+            if (maxCommonPrefix >= 128) {
+                proximityBoost = maxProximityBoost; // Même IPv6 exacte
+            } else if (maxCommonPrefix >= 120) {
+                proximityBoost = maxProximityBoost * (45.0 / 55.0); // Même /120
+            } else if (maxCommonPrefix >= 112) {
+                proximityBoost = maxProximityBoost * (30.0 / 55.0); // Même /112
+            } else if (maxCommonPrefix >= 96) {
+                proximityBoost = maxProximityBoost * (15.0 / 55.0); // Même /96
+            }
+        }
     }
 
-    const finalScore = Math.min(100, Math.round(baseScore * densityMultiplier * distributionMultiplier * uaMultiplier * dampening * 10) / 10);
+    const finalScore = Math.min(100.0, Math.round((ambientScore + proximityBoost) * 10) / 10);
+
     return { subnetScore: finalScore };
 }
 
@@ -3565,6 +3862,46 @@ async function getBehavioralIndicators(context, deviceData) {
   return { historyScore, rotationScore };
 }
 
+function getVirtualizationAnomalyScore(context) {
+    const clientFp = context.headers?.['x-device-fingerprint'];
+    if (!clientFp) return 0.0;
+
+    const fpMap = {};
+    clientFp.split('|').forEach(part => {
+        const pair = part.split(':');
+        if (pair.length === 2) {
+            fpMap[pair[0]] = pair[1];
+        }
+    });
+
+    let score = 0.0;
+    const clientGpuHash = fpMap['gpu'];
+    if (clientGpuHash) {
+        const virtualGpus = [
+            "Google SwiftShader", "SwiftShader",
+            "Mesa llvmpipe", "llvmpipe", "Mesa Gallium",
+            "Microsoft Basic Render Driver", "HeadlessChrome",
+            "Intel(R) HD Graphics"
+        ];
+        const virtualGpuHashes = new Set(virtualGpus.map(gpu => cyrb53(gpu).toString()));
+        if (virtualGpuHashes.has(clientGpuHash)) {
+            score += 75.0;
+        }
+    }
+
+    const clientScreenHash = fpMap['scr'];
+    if (clientScreenHash) {
+        const headlessResolutions = ["800x600_24", "1024x768_24"];
+        const headlessHashes = new Set(headlessResolutions.map(res => cyrb53(res).toString()));
+        if (headlessHashes.has(clientScreenHash)) {
+            score += 25.0;
+        }
+    }
+
+    return Math.min(100.0, score);
+}
+
+
 /**
  * Returns a vector of raw (unweighted) suspicion scores.
  * @param {object} context - The request context object.
@@ -3611,9 +3948,9 @@ export const getSuspicionVector = async (context, securityConfig) => {
         _ // store.set result
       ] = await Promise.all([
         getBehavioralIndicators(context, deviceData), // This modifies deviceData, so it must be done before saving deviceData
-        getThreatIntelScore(zkpY), // NOUVEAU: Score de Threat Intelligence Fédéré
+        getThreatIntelScore(context, zkpY), // NOUVEAU: Score de Threat Intelligence Fédéré
         getTlsSpoofingScore(context),
-        getSubnetScore(context, deviceId),
+        getSubnetScore(context, deviceId, securityConfig),
         getIpReputationScore(clientIp),
         getBotnetClusterScore(context, stableFpHash),
         store.set(`ip-device:${clientIp}`, deviceId, 600) // Link the IP to the device for 10 minutes
@@ -3621,12 +3958,8 @@ export const getSuspicionVector = async (context, securityConfig) => {
 
       // Synchronous calculations
       const { headerAnomalyScore } = getHeaderAnomalies(context);
-      let inconsistencyScore = Math.min(100, Math.max(0, (1 - consistencyScore) * 200)); // Amplified score
-
-      // NOUVEAU: Si l'incohérence est très forte (cookie probablement volé), on applique une pénalité maximale.
-      if (consistencyScore < 0.7) { // Seuil de rupture
-          inconsistencyScore = 100;
-      }
+    const similarityThreshold = securityConfig?.similarityThreshold ?? 0.72;
+    const inconsistencyScore = calculateAnalogInconsistencyScore(consistencyScore, similarityThreshold);
 
       const { behaviorScore } = getBehaviorScore(context); // Appel de la fonction
 
@@ -3652,6 +3985,7 @@ export const getSuspicionVector = async (context, securityConfig) => {
   const { tcpAnomalyScore } = getTcpAnomalyScore(context);
     const { protocolAnomalyScore } = getProtocolAnomalyScore(context);
     const { renderingAnomalyScore } = getRenderingAnomalyScore(context);
+    const virtualizationScore = getVirtualizationAnomalyScore(context);
 
   // Save the updated device state to the store
   // Note: deviceData.ips is a Set, which may not serialize correctly in all stores (e.g., JSON). A Redis store should handle this via custom serialization or by converting to an array.
@@ -3663,7 +3997,7 @@ export const getSuspicionVector = async (context, securityConfig) => {
       deviceData.ips = new Set(deviceData.ips);
   }
   // Le vecteur de suspicion est maintenant complet.
-  return { ...behavioral, headerAnomalyScore, inconsistencyScore, behaviorScore, honeypotScore, botScore, requestPatternScore, crossLayerInconsistencyScore, timeInconsistencyScore, tlsSpoofingScore, clickVarianceScore, clientHintsInconsistencyScore, subnetScore, ipReputationScore, botnetClusterScore, tcpAnomalyScore, protocolAnomalyScore, renderingAnomalyScore, threatIntelScore };
+  return { ...behavioral, headerAnomalyScore, inconsistencyScore, behaviorScore, honeypotScore, botScore, requestPatternScore, crossLayerInconsistencyScore, timeInconsistencyScore, tlsSpoofingScore, clickVarianceScore, clientHintsInconsistencyScore, subnetScore, ipReputationScore, botnetClusterScore, tcpAnomalyScore, protocolAnomalyScore, renderingAnomalyScore, threatIntelScore, virtualizationScore };
 };
 
 // A residential user can change networks (home, 4G, public wifi).
@@ -3879,6 +4213,8 @@ function generateCombinedPoWChallengePage(cpuChallengeDetails, memoryDifficulty,
     const clientInitConfig = {
         mouse: true,
         keystrokes: true,
+        wasmPath: securityConfig?.wasmPath || '/fp.wasm',
+        workerPath: securityConfig?.workerPath || '/pow.worker.js',
         trapUrls: trapUrls // On passe directement le tableau d'URL
     };
 
@@ -4047,14 +4383,40 @@ function parseGraphQLQuery(body) {
  * @param {string} zkpY - The 'y' component of the ZKP proof (public key).
  * @returns {Promise<{threatIntelScore: number}>}
  */
-async function getThreatIntelScore(zkpY) {
-    if (!zkpY) return { threatIntelScore: 0 };
+async function getThreatIntelScore(context, zkpY) {
+    let score = 0;
+    if (zkpY) {
+        const isBanned = await store.has(`banned-zkp-y:${zkpY}`);
+        if (isBanned) {
+            score = 100;
+        }
+    }
+
+    const tcpRttHeader = context.headers?.['x-tcp-rtt'] || context.headers?.['x-real-rtt'];
+    const tcpRtt = tcpRttHeader ? parseInt(tcpRttHeader, 10) : null;
 
-    const isBanned = await store.has(`banned-zkp-y:${zkpY}`);
-    if (isBanned) {
-        return { threatIntelScore: 100 };
+    const behaviorHeader = context.headers?.['x-behavior-metrics'];
+    if (behaviorHeader) {
+        try {
+            const metrics = JSON.parse(behaviorHeader);
+            if (metrics && metrics.clientTimestamp && context.requestTimestamp) {
+                const appLatency = context.requestTimestamp - metrics.clientTimestamp;
+                if (tcpRtt !== null && !isNaN(tcpRtt) && tcpRtt > 0) {
+                    const clientToProxyDelta = appLatency - tcpRtt;
+                    if (tcpRtt < 35 && clientToProxyDelta > 150) {
+                        score = Math.max(score, 85);
+                    }
+                } else {
+                    if (appLatency > 350) {
+                        score = Math.max(score, 40);
+                    }
+                }
+            }
+        } catch (e) {
+            // Ignorer silencieusement
+        }
     }
-    return { threatIntelScore: 0 };
+    return { threatIntelScore: score };
 }
 
 export class FingerprintEngine {
@@ -4116,6 +4478,10 @@ export class FingerprintEngine {
     this._validateConfig(finalConfig); // Validate the configuration
     this.verbose = finalConfig.verbose || false;
     this.dryRun = finalConfig.dryRun || false;
+    
+    // Preload solver file asynchronously to liberate event loop during run
+    preloadPowSolverCode().catch(() => {});
+
     if (finalConfig.reset) {
       this.resetStore().catch(err => {
         console.error('[FingerprintEngine] Failed to reset store on startup:', err.message);
@@ -5136,9 +5502,12 @@ export class FingerprintEngine {
     // 2. La requête est très suspecte (dépasse le seuil 'high'), ce qui annule la validité du ticket actuel.
     const zkpProof = requestContext.headers['x-zkp-proof'] || query.pow_zkp || '';
     const hasValidTicket = await isTicketValid(clientIp, powCookie, deviceId, currentDeviceHash, allowRoaming, zkpProof);
-    const mustReChallenge = isSuspiciousHigh && !isBlocked && hasValidTicket;
+    // Correction : Pour éviter une boucle infinie de challenges (qui mène à l'erreur 429),
+    // on fait confiance au ticket valide tant qu'il n'a pas expiré.
+    const maxIndicatorsCount = Object.values(suspicionVector).filter(val => typeof val === 'number' && val >= 100).length;
+    const mustReChallenge = (suspicionVector.honeypotScore >= (thresholds.medium ?? 45)) || (maxIndicatorsCount >= 1);
 
-    if (isSuspicious && (!hasValidTicket || mustReChallenge)) {
+    if ((isSuspicious && !hasValidTicket) || mustReChallenge) {
         if (mustReChallenge) {
             this._log('High suspicion score detected - overriding valid ticket to re-issue challenge', { finalScore, deviceId });
         }
@@ -5185,7 +5554,7 @@ export class FingerprintEngine {
         let usefulWorkDispatched = false;
         let challengePayload = null;
 
-        if (isSuspicious && shouldUseUsefulWork) {
+        if ((isSuspicious || mustReChallenge) && shouldUseUsefulWork) {
             this._log('Issuing a useful work challenge', { finalScore });
 
             try {
@@ -5217,7 +5586,7 @@ export class FingerprintEngine {
             }
         }
 
-        if (isSuspicious && usefulWorkDispatched) {
+        if ((isSuspicious || mustReChallenge) && usefulWorkDispatched) {
             if (isApi) {
                 return { action: 'challenge', score: finalScore, vector: suspicionVector, status: 404, body: challengePayload };
             } else {
@@ -5233,7 +5602,7 @@ export class FingerprintEngine {
                 </script></body></html>`;
                 return { action: 'challenge', score: finalScore, vector: suspicionVector, status: 404, body: html };
             }
-        } else if (isSuspicious) { // Pour les scores bas/moyens ou si le travail utile n'est pas choisi / a échoué                
+        } else if (isSuspicious || mustReChallenge) { // Pour les scores bas/moyens ou si le travail utile n'est pas choisi / a échoué                
             const decision = { action: 'challenge', score: finalScore, vector: suspicionVector, status: 404 };
                 if (this.dryRun) {
                     this._log(`[Dry Run] Intended action: ${decision.action}`, { score: decision.score });
@@ -5489,7 +5858,7 @@ export async function findPeerInSubnet(clientIp, excludeNodeId) {
     if (activePeers.length === 0) return null;
 
     // Select a random peer
-    const randomIndex = Math.floor(Math.random() * activePeers.length);
+    const randomIndex = crypto.randomInt(0, activePeers.length);
     return activePeers[randomIndex];
 }
 
@@ -5597,6 +5966,15 @@ export async function handleCooperativeRequest(params, clientIp = '127.0.0.1', c
         case 'register':
             expectedMsg = `${clientSecret}:register:${nodeId}:${params.seed || ''}`;
             break;
+        case 'find_peer':
+            expectedMsg = `${clientSecret}:find_peer:${nodeId}`;
+            break;
+        case 'webrtc_signal':
+            expectedMsg = `${clientSecret}:webrtc_signal:${nodeId}:${params.target_peer_id || ''}:${params.signal_type || ''}:${params.signal_data || ''}`;
+            break;
+        case 'poll_signals':
+            expectedMsg = `${clientSecret}:poll_signals:${nodeId}`;
+            break;
         case 'request_peer_block':
             expectedMsg = `${clientSecret}:request_peer_block:${nodeId}:${params.peer_id || ''}:${params.block_idx || '0'}:${params.req_id || ''}`;
             break;
@@ -5625,14 +6003,49 @@ export async function handleCooperativeRequest(params, clientIp = '127.0.0.1', c
             await registerCooperativeNode(clientIp, nodeId, seed);
             return { status: 'registered' };
 
+        case 'find_peer': {
+            const peer = await findPeerInSubnet(clientIp, nodeId);
+            if (!peer) {
+                return { status: 'no_peers' };
+            }
+            return { status: 'peer_found', peer_id: peer.nodeId };
+        }
+
+        case 'webrtc_signal': {
+            const targetPeerId = params.target_peer_id || '';
+            const signalType = params.signal_type || '';
+            const signalData = params.signal_data || '';
+            if (!targetPeerId || !signalType) {
+                return { error: 'Invalid parameters' };
+            }
+            const signalQueueKey = `coop-webrtc:signals:${targetPeerId}`;
+            const signals = (await store.get(signalQueueKey)) || [];
+            signals.push({
+                from_peer_id: nodeId,
+                signal_type: signalType,
+                signal_data: signalData
+            });
+            await store.set(signalQueueKey, signals, 30);
+            return { status: 'signal_queued' };
+        }
+
+        case 'poll_signals': {
+            const pollSignalKey = `coop-webrtc:signals:${nodeId}`;
+            const signals = (await store.get(pollSignalKey)) || [];
+            if (signals.length > 0) {
+                await store.delete(pollSignalKey);
+            }
+            return { status: 'ok', signals };
+        }
+
         case 'request_peer_block':
+        {
             const peerId = params.peer_id || '';
             const blockIdx = parseInt(params.block_idx || '0', 10);
             const requestId = params.req_id || '';
             if (!peerId || !requestId) {
-                return { error: 'Invalid parameters' };
+                return {error: 'Invalid parameters'};
             }
-
             const queueKey = `coop-mailbox:queue:${peerId}`;
             const requests = (await store.get(queueKey)) || [];
             requests.push({
@@ -5641,7 +6054,8 @@ export async function handleCooperativeRequest(params, clientIp = '127.0.0.1', c
                 block_idx: blockIdx
             });
             await store.set(queueKey, requests, 30);
-            return { status: 'queued' };
+            return {status: 'queued'};
+        }
 
         case 'poll_requests':
             const pollQueueKey = `coop-mailbox:queue:${nodeId}`;
@@ -6481,6 +6895,7 @@ export const __internal = {
     calculateTarget,
     determineOptimalTicketTtl,
     runBackgroundTtlOptimization,
+    calculateAnalogInconsistencyScore,
     getRequestPatternScore, // Expose for testing
     getBehaviorScore, // Expose for testing
     getCrossLayerInconsistency, // Expose for testing
@@ -6500,6 +6915,7 @@ export const __internal = {
     generateCombinedPoWChallengePage,
     problemManager, // Re-export the problemManager promise
     getIpSubnet, // Expose for testing
+    getIpCommonPrefixLength, // Expose for testing
     updateSubnetMetrics, // Expose for testing
     getSubnetScore, // Expose for testing
     getIpReputationScore, // Expose for testing
@@ -6646,7 +7062,7 @@ export function sanitizeTrafficData(trafficData) {
   const minDataPoints = 200; // Seuil par défaut
   const maxPassedAllowed = Math.max(minDataPoints, suspiciousLogs.length * 9);
   if (passedLogs.length > maxPassedAllowed) {
-    const shuffledPassed = passedLogs.sort(() => 0.5 - Math.random());
+    const shuffledPassed = passedLogs.sort(() => 0.5 - secureRandomFloat());
     return [...suspiciousLogs, ...shuffledPassed.slice(0, maxPassedAllowed)];
   }
   return [...suspiciousLogs, ...passedLogs];