@anonympins/fingerprint 0.7.0 → 0.7.2

package/src/php/Tests/RequestUtilsTest.php

@@ -1,472 +1,472 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Tests;
-
-use Anonympins\Fingerprint\FingerprintBuilder;
-use Anonympins\Fingerprint\RequestContext;
-use Anonympins\Fingerprint\Utils\RequestUtils;
-use PHPUnit\Framework\TestCase;
-
-class RequestUtilsTest extends TestCase
-{
-    protected function setUp(): void
-    {
-        parent::setUp();
-        \Anonympins\Fingerprint\Store\StoreManager::configureStore(new \Anonympins\Fingerprint\Store\InMemoryStore());
-    }
-
-    private function createRequestContext(array $overrides = []): RequestContext
-    {
-        $defaults = [
-            'clientIp' => '127.0.0.1',
-            'path' => '/',
-            'headers' => ['user-agent' => 'Test UA'],
-            'query' => [],
-            'body' => null,
-            'cookies' => [],
-            'httpVersion' => '1.1',
-        ];
-        $params = array_merge($defaults, $overrides);
-        return new RequestContext(
-            $params['clientIp'], $params['path'], $params['headers'],
-            $params['query'], $params['body'], $params['cookies'], $params['httpVersion']
-        );
-    }
-
-    public function testGetCrossLayerInconsistencyViewportExceedsScreen(): void
-    {
-        $scrHash = FingerprintBuilder::cyrb53("1920x1080_24");
-        $context = $this->createRequestContext([
-            'headers' => [
-                'x-device-fingerprint' => "scr:{$scrHash}",
-                'sec-ch-viewport-width' => '2560'
-            ]
-        ]);
-
-        $score = RequestUtils::getCrossLayerInconsistency($context);
-        $this->assertEquals(20.0, $score['crossLayerInconsistencyScore']);
-    }
-    public function testGetRenderingAnomalyScoreEmpty(): void
-    {
-        $context = $this->createRequestContext();
-        $res = RequestUtils::getRenderingAnomalyScore($context);
-        $this->assertEquals(0.0, $res['renderingAnomalyScore']);
-    }
-
-    public function testGetRenderingAnomalyScoreSpoofed(): void
-    {
-        $metrics = [
-            'rendering' => [
-                'fps' => 60,
-                'jitter' => 12.5,
-                'offscreenAnom' => false
-            ]
-        ];
-        $context = $this->createRequestContext([
-            'headers' => ['x-behavior-metrics' => json_encode($metrics)]
-        ]);
-        $res = RequestUtils::getRenderingAnomalyScore($context);
-        $this->assertEquals(65.0, $res['renderingAnomalyScore']);
-    }
-    public function testGetClickVarianceScoreReturnsZeroForNoHistory(): void
-    {
-        $context = $this->createRequestContext([
-            'headers' => ['x-behavior-metrics' => json_encode([])]
-        ]);
-        $result = RequestUtils::getClickVarianceScore($context);
-        $this->assertEquals(0.0, $result['clickVarianceScore']);
-    }
-
-    public function testGetClickVarianceScoreReturnsZeroForInsufficientClicks(): void
-    {
-        $metrics = [
-            'clicksHistory' => [
-                ['x' => 10, 'y' => 10, 'targetId' => 'hash1'],
-                ['x' => 11, 'y' => 11, 'targetId' => 'hash1'],
-                ['x' => 100, 'y' => 100, 'targetId' => 'hash2']
-            ]
-        ];
-        $context = $this->createRequestContext(['headers' => ['x-behavior-metrics' => json_encode($metrics)]]);
-        $result = RequestUtils::getClickVarianceScore($context);
-        $this->assertEquals(0.0, $result['clickVarianceScore']);
-    }
-
-    public function testGetClickVarianceScoreReturnsHighScoreForLowVariance(): void
-    {
-        $metrics = [
-            'clicksHistory' => [
-                ['x' => 100, 'y' => 100, 'targetId' => 'hash1'],
-                ['x' => 100.1, 'y' => 100.2, 'targetId' => 'hash1'],
-                ['x' => 99.9, 'y' => 99.8, 'targetId' => 'hash1']
-            ]
-        ];
-        $context = $this->createRequestContext(['headers' => ['x-behavior-metrics' => json_encode($metrics)]]);
-        $result = RequestUtils::getClickVarianceScore($context);
-        $this->assertGreaterThan(90, $result['clickVarianceScore']);
-    }
-
-    public function testGetClickVarianceScoreReturnsLowScoreForHighVariance(): void
-    {
-        $metrics = [
-            'clicksHistory' => [
-                ['x' => 105, 'y' => 110, 'targetId' => 'hash1'],
-                ['x' => 98, 'y' => 102, 'targetId' => 'hash1'],
-                ['x' => 112, 'y' => 95, 'targetId' => 'hash1']
-            ]
-        ];
-        $context = $this->createRequestContext(['headers' => ['x-behavior-metrics' => json_encode($metrics)]]);
-        $result = RequestUtils::getClickVarianceScore($context);
-        $this->assertEquals(0.0, $result['clickVarianceScore']);
-    }
-
-    public function testSanitizeTrafficDataFiltersSybilAttacks(): void
-    {
-        $trafficData = [];
-        // Ajout de 100 logs provenant d'un attaquant (Sybil)
-        for ($i = 0; $i < 100; $i++) {
-            $trafficData[] = ['deviceId' => 'attacker_device', 'type' => 'trap_triggered'];
-        }
-        // Ajout de 10 logs d'utilisateurs légitimes distincts
-        for ($i = 0; $i < 10; $i++) {
-            $trafficData[] = ['deviceId' => "legit_device_{$i}", 'type' => 'challenge_solved'];
-        }
-
-        $sanitized = RequestUtils::sanitizeTrafficData($trafficData);
-
-        $attackerLogs = array_filter($sanitized, fn($log) => $log['deviceId'] === 'attacker_device');
-
-        // Total de 110 logs. 2% de 110 est 2.2 -> max(3, 2) = 3 logs maximum autorisés pour l'attaquant.
-        $this->assertLessThanOrEqual(3, count($attackerLogs));
-    }
-
-    public function testSanitizeTrafficDataFiltersHardwareClusters(): void
-    {
-        $trafficData = [];
-        // Simulated attacker rotating deviceId and IP, but keeping identical hardware fingerprint
-        for ($i = 0; $i < 100; $i++) {
-            $trafficData[] = [
-                'deviceId' => "attacker_device_{$i}",
-                'clientIp' => "192.168.1.{$i}",
-                'type' => 'trap_triggered',
-                'fingerprint' => 'gpu:heavy_nvidia_hash|cvs:canvas_hash_1'
-            ];
-        }
-        // Legit users with unique hardware fingerprints
-        for ($i = 0; $i < 10; $i++) {
-            $trafficData[] = [
-                'deviceId' => "legit_device_{$i}",
-                'clientIp' => "10.0.0.{$i}",
-                'type' => 'challenge_solved',
-                'fingerprint' => "gpu:legit_gpu_{$i}|cvs:legit_cvs_{$i}"
-            ];
-        }
-
-        $sanitized = RequestUtils::sanitizeTrafficData($trafficData);
-        $attackerLogs = array_filter($sanitized, fn($log) => str_starts_with($log['deviceId'], 'attacker_device_'));
-
-        // Max limit of 2% of 110 total = 2.2 -> max(3, 2) = 3 logs allowed for this hardware cluster
-        $this->assertLessThanOrEqual(3, count($attackerLogs));
-    }
-
-    public function testChallengePayloadSigningAndVerification(): void
-    {
-        $secret = 'test-fallback-dev-secret-32-chars-minimum';
-        $clientIp = '203.0.113.42';
-        $payload = [
-            'clientSecret' => 'some_client_secret',
-            'cpuTarget' => '00000000ffffffff',
-            'fingerprint' => 'os:hash|gpu:hash2',
-            'memDifficulty' => '16',
-            'originalPath' => '/submit',
-        ];
-
-        // 1. Cas nominal : Signature et vérification réussies
-        $signature = RequestUtils::signChallengePayload($secret, $payload, $clientIp);
-        $this->assertNotEmpty($signature);
-
-        $payloadWithSig = $payload;
-        $payloadWithSig['signature'] = $signature;
-
-        $isValid = RequestUtils::verifyChallengePayload($secret, $payloadWithSig, $clientIp);
-        $this->assertTrue($isValid, "La signature valide doit être acceptée.");
-
-        // 2. Détection de modification (tampering) sur cpuTarget
-        $tamperedPayload = $payloadWithSig;
-        $tamperedPayload['cpuTarget'] = 'ffffffffffffffff'; // Tentative de baisse de la difficulté
-        
-        $isTamperedValid = RequestUtils::verifyChallengePayload($secret, $tamperedPayload, $clientIp);
-        $this->assertFalse($isTamperedValid, "Un payload modifié doit être rejeté.");
-
-        // 3. Détection de modification sur le fingerprint
-        $tamperedFpPayload = $payloadWithSig;
-        $tamperedFpPayload['fingerprint'] = 'os:another_hash|gpu:hash2';
-        
-        $isTamperedFpValid = RequestUtils::verifyChallengePayload($secret, $tamperedFpPayload, $clientIp);
-        $this->assertFalse($isTamperedFpValid, "Un fingerprint modifié doit être rejeté.");
-
-        // 4. Détection d'usurpation d'adresse IP (IP mismatch)
-        $isIpMismatchValid = RequestUtils::verifyChallengePayload($secret, $payloadWithSig, '198.51.100.1');
-        $this->assertFalse($isIpMismatchValid, "Le payload ne doit pas être valide pour une autre adresse IP.");
-
-        // 5. Absence de signature
-        $isMissingSigValid = RequestUtils::verifyChallengePayload($secret, $payload, $clientIp);
-        $this->assertFalse($isMissingSigValid, "Un payload sans signature doit être rejeté.");
-    }
-
-    public function testGetBehaviorScoreReturnsProperScores(): void
-    {
-        $contextEmpty = $this->createRequestContext();
-        $scoreEmpty = RequestUtils::getBehaviorScore($contextEmpty);
-        $this->assertEquals(0.0, $scoreEmpty['behaviorScore']);
-
-        $metricsHoneypot = ['honeypotInteraction' => true];
-        $contextHoneypot = $this->createRequestContext([
-            'headers' => ['x-behavior-metrics' => json_encode($metricsHoneypot)]
-        ]);
-        $scoreHoneypot = RequestUtils::getBehaviorScore($contextHoneypot);
-        $this->assertEquals(100.0, $scoreHoneypot['behaviorScore']);
-
-        $metricsNoActivity = ['honeypotInteraction' => false, 'mouseMovementsHistory' => [], 'keystrokeLatency' => 0];
-        $contextNoActivity = $this->createRequestContext([
-            'headers' => ['x-behavior-metrics' => json_encode($metricsNoActivity)]
-        ]);
-        $scoreNoActivity = RequestUtils::getBehaviorScore($contextNoActivity);
-        $this->assertEquals(40.0, $scoreNoActivity['behaviorScore']);
-    }
-
-    public function testGetBehaviorScoreWithBotLikeKeystrokeDynamics(): void
-    {
-        $metrics = [
-            'honeypotInteraction' => false,
-            'keystrokeLatency' => 100.0,
-            'keystrokeDwellTimes' => [50, 50, 50, 50, 50],
-            'keystrokeFlightTimes' => [
-                ['digraph' => 'ab', 'time' => 100],
-                ['digraph' => 'bc', 'time' => 100],
-                ['digraph' => 'cd', 'time' => 100],
-                ['digraph' => 'de', 'time' => 100],
-                ['digraph' => 'ef', 'time' => 100]
-            ]
-        ];
-        $context = $this->createRequestContext([
-            'headers' => ['x-behavior-metrics' => json_encode($metrics)]
-        ]);
-        $score = RequestUtils::getBehaviorScore($context);
-        $this->assertGreaterThanOrEqual(70.0, $score['behaviorScore']);
-    }
-
-    public function testGetBehaviorScoreWithBotLikeTouchMovements(): void
-    {
-        $metrics = [
-            'honeypotInteraction' => false,
-            'touchMovementsHistory' => [
-                ['x' => 50, 'y' => 50, 't' => 1, 'p' => 0.5, 'r' => 10, 'num' => 1],
-                ['x' => 55, 'y' => 55, 't' => 100, 'p' => 0.5, 'r' => 10, 'num' => 1],
-                ['x' => 60, 'y' => 60, 't' => 200, 'p' => 0.5, 'r' => 10, 'num' => 1],
-                ['x' => 65, 'y' => 65, 't' => 300, 'p' => 0.5, 'r' => 10, 'num' => 1]
-            ]
-        ];
-        $context = $this->createRequestContext([
-            'headers' => ['x-behavior-metrics' => json_encode($metrics)]
-        ]);
-        $score = RequestUtils::getBehaviorScore($context);
-        $this->assertGreaterThan(60.0, $score['behaviorScore']);
-    }
-
-    public function testGetBehaviorScoreWithHumanLikeTouchMovements(): void
-    {
-        $metrics = [
-            'honeypotInteraction' => false,
-            'touchMovementsHistory' => [
-                ['x' => 50, 'y' => 50, 't' => 1, 'p' => 0.45, 'r' => 8.5, 'num' => 1],
-                ['x' => 60, 'y' => 52, 't' => 100, 'p' => 0.52, 'r' => 9.1, 'num' => 1],
-                ['x' => 72, 'y' => 60, 't' => 200, 'p' => 0.49, 'r' => 8.8, 'num' => 1],
-                ['x' => 80, 'y' => 80, 't' => 300, 'p' => 0.41, 'r' => 8.2, 'num' => 1]
-            ]
-        ];
-        $context = $this->createRequestContext([
-            'headers' => ['x-behavior-metrics' => json_encode($metrics)]
-        ]);
-        $score = RequestUtils::getBehaviorScore($context);
-        $this->assertLessThan(30.0, $score['behaviorScore']);
-    }
-
-    public function testGetTimeInconsistencyScore(): void
-    {
-        $requestTimestamp = time() * 1000;
-
-        $metricsNormal = ['clientTimestamp' => $requestTimestamp - 100];
-        $contextNormal = $this->createRequestContext([
-            'headers' => ['x-behavior-metrics' => json_encode($metricsNormal)]
-        ]);
-        $contextNormal->requestTimestamp = $requestTimestamp;
-        $scoreNormal = RequestUtils::getTimeInconsistencyScore($contextNormal);
-        $this->assertEquals(0.0, $scoreNormal['timeInconsistencyScore']);
-
-        $metricsReplay = ['clientTimestamp' => $requestTimestamp - 10000];
-        $contextReplay = $this->createRequestContext([
-            'headers' => ['x-behavior-metrics' => json_encode($metricsReplay)]
-        ]);
-        $contextReplay->requestTimestamp = $requestTimestamp;
-        $scoreReplay = RequestUtils::getTimeInconsistencyScore($contextReplay);
-        $this->assertGreaterThan(0.0, $scoreReplay['timeInconsistencyScore']);
-    }
-
-    public function testGetCrossLayerInconsistencyOSMismatch(): void
-    {
-        $windowsHash = FingerprintBuilder::cyrb53("Windows");
-        $context = $this->createRequestContext([
-            'headers' => [
-                'x-device-fingerprint' => "os:{$windowsHash}",
-                'user-agent' => 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15'
-            ]
-        ]);
-
-        $score = RequestUtils::getCrossLayerInconsistency($context);
-        $this->assertEquals(50.0, $score['crossLayerInconsistencyScore']);
-    }
-
-    public function testGetBotScoreDetections(): void
-    {
-        $contextBot = $this->createRequestContext([
-            'headers' => ['x-device-fingerprint' => 'ua:123|bot:true']
-        ]);
-        $scoreBot = RequestUtils::getBotScore($contextBot);
-        $this->assertEquals(100.0, $scoreBot['botScore']);
-
-        $contextCdp = $this->createRequestContext([
-            'headers' => ['x-device-fingerprint' => 'ua:123|cdp:true']
-        ]);
-        $scoreCdp = RequestUtils::getBotScore($contextCdp);
-        $this->assertEquals(100.0, $scoreCdp['botScore']);
-
-        $contextClean = $this->createRequestContext([
-            'headers' => ['x-device-fingerprint' => 'ua:123|os:456']
-        ]);
-        $scoreClean = RequestUtils::getBotScore($contextClean);
-        $this->assertEquals(0.0, $scoreClean['botScore']);
-    }
-
-    public function testGetHeaderAnomaliesFirefoxTE(): void
-    {
-        $contextFirefoxNoTe = $this->createRequestContext([
-            'headers' => [
-                'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0',
-                'accept-language' => 'en-US,en;q=0.9',
-            ]
-        ]);
-        $scoreFirefoxNoTe = RequestUtils::getHeaderAnomalies($contextFirefoxNoTe);
-        $this->assertEquals(30.0, $scoreFirefoxNoTe['headerAnomalyScore']);
-    }
-
-    public function testGetBehavioralIndicatorsRotationAndHistory(): void
-    {
-        $deviceData = [
-            'ips' => ['127.0.0.1'],
-            'lastFpHash' => 'cvs:original-canvas|gpu:original-gpu',
-            'lastChangeTimestamp' => (time() * 1000) - 500,
-            'rapidChangeCount' => 1
-        ];
-
-        $context = $this->createRequestContext([
-            'headers' => [
-                'x-device-fingerprint' => 'cvs:new-canvas|gpu:new-gpu',
-                'user-agent' => 'Test UA'
-            ]
-        ]);
-
-        $indicators = RequestUtils::getBehavioralIndicators($context, $deviceData);
-        $this->assertEquals(2, $deviceData['rapidChangeCount']);
-        $this->assertGreaterThan(0, $indicators['rotationScore']);
-    }
-
-    public function testGetRequestPatternScoreWeightedSubscores(): void
-    {
-        $context = $this->createRequestContext(['path' => '/search']);
-        $deviceData = [
-            'requestHistory' => [],
-            'timingHistory' => [100, 100, 100, 100, 100, 100], // stdDev = 0
-            'lastPatternScore' => 0.0
-        ];
-        $patternConfig = [
-            'minSamples' => 5,
-            'regularityThreshold' => 50,
-            'benfordThreshold' => 0.15,
-            'patternWeight' => 80,
-            'decayFactor' => 0.9,
-            'inactivityReset' => 5000,
-            'regularityRatio' => 0.4,
-            'benfordRatio' => 0.3,
-            'enumerationRatio' => 0.3
-        ];
-
-        $result = RequestUtils::getRequestPatternScore($context, $deviceData, $patternConfig);
-        // regularityScore = 1.0. regularityRatio = 0.4.
-        // instantScore = 1.0 * 0.4 * 80 = 32.
-        $this->assertEquals(32.0, $result['requestPatternScore']);
-    }
-
-    public function testGetBotnetClusterScoreCalculations(): void
-    {
-        $stableFpHash = 'test-stable-hash';
-
-        $context1 = $this->createRequestContext(['clientIp' => '192.168.1.1']);
-        $score = RequestUtils::getBotnetClusterScore($context1, $stableFpHash);
-        $this->assertEquals(0.0, $score['botnetClusterScore']);
-
-        RequestUtils::getBotnetClusterScore($this->createRequestContext(['clientIp' => '192.168.1.2']), $stableFpHash);
-        $score = RequestUtils::getBotnetClusterScore($this->createRequestContext(['clientIp' => '192.168.1.3']), $stableFpHash);
-        $this->assertEquals(30.2, $score['botnetClusterScore']);
-
-        RequestUtils::getBotnetClusterScore($this->createRequestContext(['clientIp' => '192.168.1.4']), $stableFpHash);
-        $score = RequestUtils::getBotnetClusterScore($this->createRequestContext(['clientIp' => '192.168.1.5']), $stableFpHash);
-        $this->assertEquals(45.2, $score['botnetClusterScore']);
-
-        for ($i = 6; $i <= 10; $i++) {
-            $score = RequestUtils::getBotnetClusterScore($this->createRequestContext(['clientIp' => "192.168.1.{$i}"]), $stableFpHash);
-        }
-        $this->assertEquals(57.4, $score['botnetClusterScore']);
-    }
-
-    public function testRealWorldConsoleBotnetClustering(): void
-    {
-        $ps4Headers = [
-            'user-agent' => 'Mozilla/5.0 (PlayStation 4 11.50) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.50 Safari/605.1.15',
-            'x-ja3-hash' => '76993ef93bf89104037599723ab9f201',
-            'x-ja4-hash' => 't13d1516h2_8daaf6152771_390237aa04be',
-            'x-http2-fingerprint' => '1:65536;3:1000;4:6291456;6:65536',
-            'x-tcp-fingerprint' => '64240:128:1:mss,nop,ws,nop,nop,sok:df:0'
-        ];
-
-        for ($i = 1; $i <= 10; $i++) {
-            $context = $this->createRequestContext([
-                'clientIp' => "185.15.20.{$i}",
-                'headers' => array_merge($ps4Headers, [
-                    'cookie_keys' => "session_id=fake_sess_{$i}"
-                ])
-            ]);
-
-            $currentHash = RequestUtils::getCompositeDeviceHash($context);
-            $stableFp = RequestUtils::extractStablePart($currentHash);
-            $stableFpHash = FingerprintBuilder::cyrb53($stableFp);
-            
-            $score = RequestUtils::getBotnetClusterScore($context, $stableFpHash);
-
-            if ($i === 1) {
-                $this->assertEquals(0.0, $score['botnetClusterScore'], "Expected score for 1 IP");
-            } else if ($i === 2) {
-                $this->assertEquals(17.7, $score['botnetClusterScore'], "Expected score for 2 IPs");
-            } else if ($i === 3) {
-                $this->assertEquals(30.2, $score['botnetClusterScore'], "Expected score for 3 IPs");
-            } else if ($i === 4) {
-                $this->assertEquals(39.0, $score['botnetClusterScore'], "Expected score for 4 IPs");
-            } else if ($i === 5) {
-                $this->assertEquals(45.2, $score['botnetClusterScore'], "Expected score for 5 IPs");
-            } else if ($i === 10) {
-                $this->assertEquals(57.4, $score['botnetClusterScore'], "Expected score for 10 IPs");
-            }
-        }
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Tests;
+
+use Anonympins\Fingerprint\FingerprintBuilder;
+use Anonympins\Fingerprint\RequestContext;
+use Anonympins\Fingerprint\Utils\RequestUtils;
+use PHPUnit\Framework\TestCase;
+
+class RequestUtilsTest extends TestCase
+{
+    protected function setUp(): void
+    {
+        parent::setUp();
+        \Anonympins\Fingerprint\Store\StoreManager::configureStore(new \Anonympins\Fingerprint\Store\InMemoryStore());
+    }
+
+    private function createRequestContext(array $overrides = []): RequestContext
+    {
+        $defaults = [
+            'clientIp' => '127.0.0.1',
+            'path' => '/',
+            'headers' => ['user-agent' => 'Test UA'],
+            'query' => [],
+            'body' => null,
+            'cookies' => [],
+            'httpVersion' => '1.1',
+        ];
+        $params = array_merge($defaults, $overrides);
+        return new RequestContext(
+            $params['clientIp'], $params['path'], $params['headers'],
+            $params['query'], $params['body'], $params['cookies'], $params['httpVersion']
+        );
+    }
+
+    public function testGetCrossLayerInconsistencyViewportExceedsScreen(): void
+    {
+        $scrHash = FingerprintBuilder::cyrb53("1920x1080_24");
+        $context = $this->createRequestContext([
+            'headers' => [
+                'x-device-fingerprint' => "scr:{$scrHash}",
+                'sec-ch-viewport-width' => '2560'
+            ]
+        ]);
+
+        $score = RequestUtils::getCrossLayerInconsistency($context);
+        $this->assertEquals(20.0, $score['crossLayerInconsistencyScore']);
+    }
+    public function testGetRenderingAnomalyScoreEmpty(): void
+    {
+        $context = $this->createRequestContext();
+        $res = RequestUtils::getRenderingAnomalyScore($context);
+        $this->assertEquals(0.0, $res['renderingAnomalyScore']);
+    }
+
+    public function testGetRenderingAnomalyScoreSpoofed(): void
+    {
+        $metrics = [
+            'rendering' => [
+                'fps' => 60,
+                'jitter' => 12.5,
+                'offscreenAnom' => false
+            ]
+        ];
+        $context = $this->createRequestContext([
+            'headers' => ['x-behavior-metrics' => json_encode($metrics)]
+        ]);
+        $res = RequestUtils::getRenderingAnomalyScore($context);
+        $this->assertEquals(65.0, $res['renderingAnomalyScore']);
+    }
+    public function testGetClickVarianceScoreReturnsZeroForNoHistory(): void
+    {
+        $context = $this->createRequestContext([
+            'headers' => ['x-behavior-metrics' => json_encode([])]
+        ]);
+        $result = RequestUtils::getClickVarianceScore($context);
+        $this->assertEquals(0.0, $result['clickVarianceScore']);
+    }
+
+    public function testGetClickVarianceScoreReturnsZeroForInsufficientClicks(): void
+    {
+        $metrics = [
+            'clicksHistory' => [
+                ['x' => 10, 'y' => 10, 'targetId' => 'hash1'],
+                ['x' => 11, 'y' => 11, 'targetId' => 'hash1'],
+                ['x' => 100, 'y' => 100, 'targetId' => 'hash2']
+            ]
+        ];
+        $context = $this->createRequestContext(['headers' => ['x-behavior-metrics' => json_encode($metrics)]]);
+        $result = RequestUtils::getClickVarianceScore($context);
+        $this->assertEquals(0.0, $result['clickVarianceScore']);
+    }
+
+    public function testGetClickVarianceScoreReturnsHighScoreForLowVariance(): void
+    {
+        $metrics = [
+            'clicksHistory' => [
+                ['x' => 100, 'y' => 100, 'targetId' => 'hash1'],
+                ['x' => 100.1, 'y' => 100.2, 'targetId' => 'hash1'],
+                ['x' => 99.9, 'y' => 99.8, 'targetId' => 'hash1']
+            ]
+        ];
+        $context = $this->createRequestContext(['headers' => ['x-behavior-metrics' => json_encode($metrics)]]);
+        $result = RequestUtils::getClickVarianceScore($context);
+        $this->assertGreaterThan(90, $result['clickVarianceScore']);
+    }
+
+    public function testGetClickVarianceScoreReturnsLowScoreForHighVariance(): void
+    {
+        $metrics = [
+            'clicksHistory' => [
+                ['x' => 105, 'y' => 110, 'targetId' => 'hash1'],
+                ['x' => 98, 'y' => 102, 'targetId' => 'hash1'],
+                ['x' => 112, 'y' => 95, 'targetId' => 'hash1']
+            ]
+        ];
+        $context = $this->createRequestContext(['headers' => ['x-behavior-metrics' => json_encode($metrics)]]);
+        $result = RequestUtils::getClickVarianceScore($context);
+        $this->assertEquals(0.0, $result['clickVarianceScore']);
+    }
+
+    public function testSanitizeTrafficDataFiltersSybilAttacks(): void
+    {
+        $trafficData = [];
+        // Ajout de 100 logs provenant d'un attaquant (Sybil)
+        for ($i = 0; $i < 100; $i++) {
+            $trafficData[] = ['deviceId' => 'attacker_device', 'type' => 'trap_triggered'];
+        }
+        // Ajout de 10 logs d'utilisateurs légitimes distincts
+        for ($i = 0; $i < 10; $i++) {
+            $trafficData[] = ['deviceId' => "legit_device_{$i}", 'type' => 'challenge_solved'];
+        }
+
+        $sanitized = RequestUtils::sanitizeTrafficData($trafficData);
+
+        $attackerLogs = array_filter($sanitized, fn($log) => $log['deviceId'] === 'attacker_device');
+
+        // Total de 110 logs. 2% de 110 est 2.2 -> max(3, 2) = 3 logs maximum autorisés pour l'attaquant.
+        $this->assertLessThanOrEqual(3, count($attackerLogs));
+    }
+
+    public function testSanitizeTrafficDataFiltersHardwareClusters(): void
+    {
+        $trafficData = [];
+        // Simulated attacker rotating deviceId and IP, but keeping identical hardware fingerprint
+        for ($i = 0; $i < 100; $i++) {
+            $trafficData[] = [
+                'deviceId' => "attacker_device_{$i}",
+                'clientIp' => "192.168.1.{$i}",
+                'type' => 'trap_triggered',
+                'fingerprint' => 'gpu:heavy_nvidia_hash|cvs:canvas_hash_1'
+            ];
+        }
+        // Legit users with unique hardware fingerprints
+        for ($i = 0; $i < 10; $i++) {
+            $trafficData[] = [
+                'deviceId' => "legit_device_{$i}",
+                'clientIp' => "10.0.0.{$i}",
+                'type' => 'challenge_solved',
+                'fingerprint' => "gpu:legit_gpu_{$i}|cvs:legit_cvs_{$i}"
+            ];
+        }
+
+        $sanitized = RequestUtils::sanitizeTrafficData($trafficData);
+        $attackerLogs = array_filter($sanitized, fn($log) => str_starts_with($log['deviceId'], 'attacker_device_'));
+
+        // Max limit of 2% of 110 total = 2.2 -> max(3, 2) = 3 logs allowed for this hardware cluster
+        $this->assertLessThanOrEqual(3, count($attackerLogs));
+    }
+
+    public function testChallengePayloadSigningAndVerification(): void
+    {
+        $secret = 'test-fallback-dev-secret-32-chars-minimum';
+        $clientIp = '203.0.113.42';
+        $payload = [
+            'clientSecret' => 'some_client_secret',
+            'cpuTarget' => '00000000ffffffff',
+            'fingerprint' => 'os:hash|gpu:hash2',
+            'memDifficulty' => '16',
+            'originalPath' => '/submit',
+        ];
+
+        // 1. Cas nominal : Signature et vérification réussies
+        $signature = RequestUtils::signChallengePayload($secret, $payload, $clientIp);
+        $this->assertNotEmpty($signature);
+
+        $payloadWithSig = $payload;
+        $payloadWithSig['signature'] = $signature;
+
+        $isValid = RequestUtils::verifyChallengePayload($secret, $payloadWithSig, $clientIp);
+        $this->assertTrue($isValid, "La signature valide doit être acceptée.");
+
+        // 2. Détection de modification (tampering) sur cpuTarget
+        $tamperedPayload = $payloadWithSig;
+        $tamperedPayload['cpuTarget'] = 'ffffffffffffffff'; // Tentative de baisse de la difficulté
+        
+        $isTamperedValid = RequestUtils::verifyChallengePayload($secret, $tamperedPayload, $clientIp);
+        $this->assertFalse($isTamperedValid, "Un payload modifié doit être rejeté.");
+
+        // 3. Détection de modification sur le fingerprint
+        $tamperedFpPayload = $payloadWithSig;
+        $tamperedFpPayload['fingerprint'] = 'os:another_hash|gpu:hash2';
+        
+        $isTamperedFpValid = RequestUtils::verifyChallengePayload($secret, $tamperedFpPayload, $clientIp);
+        $this->assertFalse($isTamperedFpValid, "Un fingerprint modifié doit être rejeté.");
+
+        // 4. Détection d'usurpation d'adresse IP (IP mismatch)
+        $isIpMismatchValid = RequestUtils::verifyChallengePayload($secret, $payloadWithSig, '198.51.100.1');
+        $this->assertFalse($isIpMismatchValid, "Le payload ne doit pas être valide pour une autre adresse IP.");
+
+        // 5. Absence de signature
+        $isMissingSigValid = RequestUtils::verifyChallengePayload($secret, $payload, $clientIp);
+        $this->assertFalse($isMissingSigValid, "Un payload sans signature doit être rejeté.");
+    }
+
+    public function testGetBehaviorScoreReturnsProperScores(): void
+    {
+        $contextEmpty = $this->createRequestContext();
+        $scoreEmpty = RequestUtils::getBehaviorScore($contextEmpty);
+        $this->assertEquals(0.0, $scoreEmpty['behaviorScore']);
+
+        $metricsHoneypot = ['honeypotInteraction' => true];
+        $contextHoneypot = $this->createRequestContext([
+            'headers' => ['x-behavior-metrics' => json_encode($metricsHoneypot)]
+        ]);
+        $scoreHoneypot = RequestUtils::getBehaviorScore($contextHoneypot);
+        $this->assertEquals(100.0, $scoreHoneypot['behaviorScore']);
+
+        $metricsNoActivity = ['honeypotInteraction' => false, 'mouseMovementsHistory' => [], 'keystrokeLatency' => 0];
+        $contextNoActivity = $this->createRequestContext([
+            'headers' => ['x-behavior-metrics' => json_encode($metricsNoActivity)]
+        ]);
+        $scoreNoActivity = RequestUtils::getBehaviorScore($contextNoActivity);
+        $this->assertEquals(40.0, $scoreNoActivity['behaviorScore']);
+    }
+
+    public function testGetBehaviorScoreWithBotLikeKeystrokeDynamics(): void
+    {
+        $metrics = [
+            'honeypotInteraction' => false,
+            'keystrokeLatency' => 100.0,
+            'keystrokeDwellTimes' => [50, 50, 50, 50, 50],
+            'keystrokeFlightTimes' => [
+                ['digraph' => 'ab', 'time' => 100],
+                ['digraph' => 'bc', 'time' => 100],
+                ['digraph' => 'cd', 'time' => 100],
+                ['digraph' => 'de', 'time' => 100],
+                ['digraph' => 'ef', 'time' => 100]
+            ]
+        ];
+        $context = $this->createRequestContext([
+            'headers' => ['x-behavior-metrics' => json_encode($metrics)]
+        ]);
+        $score = RequestUtils::getBehaviorScore($context);
+        $this->assertGreaterThanOrEqual(70.0, $score['behaviorScore']);
+    }
+
+    public function testGetBehaviorScoreWithBotLikeTouchMovements(): void
+    {
+        $metrics = [
+            'honeypotInteraction' => false,
+            'touchMovementsHistory' => [
+                ['x' => 50, 'y' => 50, 't' => 1, 'p' => 0.5, 'r' => 10, 'num' => 1],
+                ['x' => 55, 'y' => 55, 't' => 100, 'p' => 0.5, 'r' => 10, 'num' => 1],
+                ['x' => 60, 'y' => 60, 't' => 200, 'p' => 0.5, 'r' => 10, 'num' => 1],
+                ['x' => 65, 'y' => 65, 't' => 300, 'p' => 0.5, 'r' => 10, 'num' => 1]
+            ]
+        ];
+        $context = $this->createRequestContext([
+            'headers' => ['x-behavior-metrics' => json_encode($metrics)]
+        ]);
+        $score = RequestUtils::getBehaviorScore($context);
+        $this->assertGreaterThan(60.0, $score['behaviorScore']);
+    }
+
+    public function testGetBehaviorScoreWithHumanLikeTouchMovements(): void
+    {
+        $metrics = [
+            'honeypotInteraction' => false,
+            'touchMovementsHistory' => [
+                ['x' => 50, 'y' => 50, 't' => 1, 'p' => 0.45, 'r' => 8.5, 'num' => 1],
+                ['x' => 60, 'y' => 52, 't' => 100, 'p' => 0.52, 'r' => 9.1, 'num' => 1],
+                ['x' => 72, 'y' => 60, 't' => 200, 'p' => 0.49, 'r' => 8.8, 'num' => 1],
+                ['x' => 80, 'y' => 80, 't' => 300, 'p' => 0.41, 'r' => 8.2, 'num' => 1]
+            ]
+        ];
+        $context = $this->createRequestContext([
+            'headers' => ['x-behavior-metrics' => json_encode($metrics)]
+        ]);
+        $score = RequestUtils::getBehaviorScore($context);
+        $this->assertLessThan(30.0, $score['behaviorScore']);
+    }
+
+    public function testGetTimeInconsistencyScore(): void
+    {
+        $requestTimestamp = time() * 1000;
+
+        $metricsNormal = ['clientTimestamp' => $requestTimestamp - 100];
+        $contextNormal = $this->createRequestContext([
+            'headers' => ['x-behavior-metrics' => json_encode($metricsNormal)]
+        ]);
+        $contextNormal->requestTimestamp = $requestTimestamp;
+        $scoreNormal = RequestUtils::getTimeInconsistencyScore($contextNormal);
+        $this->assertEquals(0.0, $scoreNormal['timeInconsistencyScore']);
+
+        $metricsReplay = ['clientTimestamp' => $requestTimestamp - 10000];
+        $contextReplay = $this->createRequestContext([
+            'headers' => ['x-behavior-metrics' => json_encode($metricsReplay)]
+        ]);
+        $contextReplay->requestTimestamp = $requestTimestamp;
+        $scoreReplay = RequestUtils::getTimeInconsistencyScore($contextReplay);
+        $this->assertGreaterThan(0.0, $scoreReplay['timeInconsistencyScore']);
+    }
+
+    public function testGetCrossLayerInconsistencyOSMismatch(): void
+    {
+        $windowsHash = FingerprintBuilder::cyrb53("Windows");
+        $context = $this->createRequestContext([
+            'headers' => [
+                'x-device-fingerprint' => "os:{$windowsHash}",
+                'user-agent' => 'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15'
+            ]
+        ]);
+
+        $score = RequestUtils::getCrossLayerInconsistency($context);
+        $this->assertEquals(50.0, $score['crossLayerInconsistencyScore']);
+    }
+
+    public function testGetBotScoreDetections(): void
+    {
+        $contextBot = $this->createRequestContext([
+            'headers' => ['x-device-fingerprint' => 'ua:123|bot:true']
+        ]);
+        $scoreBot = RequestUtils::getBotScore($contextBot);
+        $this->assertEquals(100.0, $scoreBot['botScore']);
+
+        $contextCdp = $this->createRequestContext([
+            'headers' => ['x-device-fingerprint' => 'ua:123|cdp:true']
+        ]);
+        $scoreCdp = RequestUtils::getBotScore($contextCdp);
+        $this->assertEquals(100.0, $scoreCdp['botScore']);
+
+        $contextClean = $this->createRequestContext([
+            'headers' => ['x-device-fingerprint' => 'ua:123|os:456']
+        ]);
+        $scoreClean = RequestUtils::getBotScore($contextClean);
+        $this->assertEquals(0.0, $scoreClean['botScore']);
+    }
+
+    public function testGetHeaderAnomaliesFirefoxTE(): void
+    {
+        $contextFirefoxNoTe = $this->createRequestContext([
+            'headers' => [
+                'user-agent' => 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0',
+                'accept-language' => 'en-US,en;q=0.9',
+            ]
+        ]);
+        $scoreFirefoxNoTe = RequestUtils::getHeaderAnomalies($contextFirefoxNoTe);
+        $this->assertEquals(30.0, $scoreFirefoxNoTe['headerAnomalyScore']);
+    }
+
+    public function testGetBehavioralIndicatorsRotationAndHistory(): void
+    {
+        $deviceData = [
+            'ips' => ['127.0.0.1'],
+            'lastFpHash' => 'cvs:original-canvas|gpu:original-gpu',
+            'lastChangeTimestamp' => (time() * 1000) - 500,
+            'rapidChangeCount' => 1
+        ];
+
+        $context = $this->createRequestContext([
+            'headers' => [
+                'x-device-fingerprint' => 'cvs:new-canvas|gpu:new-gpu',
+                'user-agent' => 'Test UA'
+            ]
+        ]);
+
+        $indicators = RequestUtils::getBehavioralIndicators($context, $deviceData);
+        $this->assertEquals(2, $deviceData['rapidChangeCount']);
+        $this->assertGreaterThan(0, $indicators['rotationScore']);
+    }
+
+    public function testGetRequestPatternScoreWeightedSubscores(): void
+    {
+        $context = $this->createRequestContext(['path' => '/search']);
+        $deviceData = [
+            'requestHistory' => [],
+            'timingHistory' => [100, 100, 100, 100, 100, 100], // stdDev = 0
+            'lastPatternScore' => 0.0
+        ];
+        $patternConfig = [
+            'minSamples' => 5,
+            'regularityThreshold' => 50,
+            'benfordThreshold' => 0.15,
+            'patternWeight' => 80,
+            'decayFactor' => 0.9,
+            'inactivityReset' => 5000,
+            'regularityRatio' => 0.4,
+            'benfordRatio' => 0.3,
+            'enumerationRatio' => 0.3
+        ];
+
+        $result = RequestUtils::getRequestPatternScore($context, $deviceData, $patternConfig);
+        // regularityScore = 1.0. regularityRatio = 0.4.
+        // instantScore = 1.0 * 0.4 * 80 = 32.
+        $this->assertEquals(32.0, $result['requestPatternScore']);
+    }
+
+    public function testGetBotnetClusterScoreCalculations(): void
+    {
+        $stableFpHash = 'test-stable-hash';
+
+        $context1 = $this->createRequestContext(['clientIp' => '192.168.1.1']);
+        $score = RequestUtils::getBotnetClusterScore($context1, $stableFpHash);
+        $this->assertEquals(0.0, $score['botnetClusterScore']);
+
+        RequestUtils::getBotnetClusterScore($this->createRequestContext(['clientIp' => '192.168.1.2']), $stableFpHash);
+        $score = RequestUtils::getBotnetClusterScore($this->createRequestContext(['clientIp' => '192.168.1.3']), $stableFpHash);
+        $this->assertEquals(30.2, $score['botnetClusterScore']);
+
+        RequestUtils::getBotnetClusterScore($this->createRequestContext(['clientIp' => '192.168.1.4']), $stableFpHash);
+        $score = RequestUtils::getBotnetClusterScore($this->createRequestContext(['clientIp' => '192.168.1.5']), $stableFpHash);
+        $this->assertEquals(45.2, $score['botnetClusterScore']);
+
+        for ($i = 6; $i <= 10; $i++) {
+            $score = RequestUtils::getBotnetClusterScore($this->createRequestContext(['clientIp' => "192.168.1.{$i}"]), $stableFpHash);
+        }
+        $this->assertEquals(57.4, $score['botnetClusterScore']);
+    }
+
+    public function testRealWorldConsoleBotnetClustering(): void
+    {
+        $ps4Headers = [
+            'user-agent' => 'Mozilla/5.0 (PlayStation 4 11.50) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.50 Safari/605.1.15',
+            'x-ja3-hash' => '76993ef93bf89104037599723ab9f201',
+            'x-ja4-hash' => 't13d1516h2_8daaf6152771_390237aa04be',
+            'x-http2-fingerprint' => '1:65536;3:1000;4:6291456;6:65536',
+            'x-tcp-fingerprint' => '64240:128:1:mss,nop,ws,nop,nop,sok:df:0'
+        ];
+
+        for ($i = 1; $i <= 10; $i++) {
+            $context = $this->createRequestContext([
+                'clientIp' => "185.15.20.{$i}",
+                'headers' => array_merge($ps4Headers, [
+                    'cookie_keys' => "session_id=fake_sess_{$i}"
+                ])
+            ]);
+
+            $currentHash = RequestUtils::getCompositeDeviceHash($context);
+            $stableFp = RequestUtils::extractStablePart($currentHash);
+            $stableFpHash = FingerprintBuilder::cyrb53($stableFp);
+            
+            $score = RequestUtils::getBotnetClusterScore($context, $stableFpHash);
+
+            if ($i === 1) {
+                $this->assertEquals(0.0, $score['botnetClusterScore'], "Expected score for 1 IP");
+            } else if ($i === 2) {
+                $this->assertEquals(17.7, $score['botnetClusterScore'], "Expected score for 2 IPs");
+            } else if ($i === 3) {
+                $this->assertEquals(30.2, $score['botnetClusterScore'], "Expected score for 3 IPs");
+            } else if ($i === 4) {
+                $this->assertEquals(39.0, $score['botnetClusterScore'], "Expected score for 4 IPs");
+            } else if ($i === 5) {
+                $this->assertEquals(45.2, $score['botnetClusterScore'], "Expected score for 5 IPs");
+            } else if ($i === 10) {
+                $this->assertEquals(57.4, $score['botnetClusterScore'], "Expected score for 10 IPs");
+            }
+        }
+    }
 }