@anonympins/fingerprint 0.7.0 → 0.7.2

package/src/php/Utils/MetricsManager.php

@@ -1,210 +1,210 @@
-<?php
-
-declare(strict_types=1);
-
-namespace Anonympins\Fingerprint\Utils;
-
-class MetricsManager
-{
-    /** @var array Stockage temporaire des compteurs Prometheus */
-    private static array $counters = [];
-
-    /** @var array Stockage temporaire des observations Prometheus */
-    private static array $observations = [];
-
-    /**
-     * Incrémente un compteur Prometheus.
-     *
-     * @param string $name Nom du compteur.
-     * @param array $labels Libellés/Labels associés.
-     */
-    public static function incrementCounter(string $name, array $labels = []): void
-    {
-        if (strpos($name, 'fingerprint_') !== 0) {
-            $name = 'fingerprint_' . $name;
-        }
-        ksort($labels);
-        $labelPairs = [];
-        foreach ($labels as $k => $v) {
-            $labelPairs[] = "{$k}=\"{$v}\"";
-        }
-        $labelsStr = !empty($labelPairs) ? '{' . implode(',', $labelPairs) . '}' : '';
-        $key = $name . $labelsStr;
-
-        if (!isset(self::$counters[$key])) {
-            self::$counters[$key] = [
-                'name' => $name,
-                'labelsStr' => $labelsStr,
-                'value' => 0
-            ];
-        }
-        self::$counters[$key]['value']++;
-    }
-
-    /**
-     * Enregistre une observation de valeur (ex: temps d'exécution, score).
-     *
-     * @param string $name Nom de la métrique.
-     * @param float $value Valeur observée.
-     * @param array $labels Libellés/Labels associés.
-     */
-    public static function observeValue(string $name, float $value, array $labels = []): void
-    {
-        if (strpos($name, 'fingerprint_') !== 0) {
-            $name = 'fingerprint_' . $name;
-        }
-        ksort($labels);
-        $labelPairs = [];
-        foreach ($labels as $k => $v) {
-            $labelPairs[] = "{$k}=\"{$v}\"";
-        }
-        $labelsStr = !empty($labelPairs) ? '{' . implode(',', $labelPairs) . '}' : '';
-        $key = $name . $labelsStr;
-
-        self::$observations[$key] = [
-            'name' => $name,
-            'labelsStr' => $labelsStr,
-            'value' => $value
-        ];
-    }
-
-    /**
-     * Helper method to retrieve a specific metric's values by name.
-     *
-     * @param string $name Name of the metric.
-     * @param array $securityConfig The security configuration.
-     * @return array Associative array of labels to values.
-     */
-    public static function getMetric(string $name, array $securityConfig = []): array
-    {
-        $result = [];
-        $queryName = str_starts_with($name, 'fingerprint_') ? $name : 'fingerprint_' . $name;
-
-        if ($queryName === 'fingerprint_security_weight') {
-            $weights = $securityConfig['weights'] ?? [];
-            foreach ($weights as $indicator => $weight) {
-                if (is_numeric($weight)) {
-                    $result[$indicator] = (float)$weight;
-                }
-            }
-        } elseif ($queryName === 'fingerprint_security_threshold') {
-            $thresholds = $securityConfig['thresholds'] ?? [];
-            foreach ($thresholds as $level => $threshold) {
-                if (is_numeric($threshold)) {
-                    $result[$level] = (float)$threshold;
-                }
-            }
-        } else {
-            foreach (self::$counters as $counter) {
-                if ($counter['name'] === $queryName || $counter['name'] === $name) {
-                    $labelStr = trim($counter['labelsStr'], '{}');
-                    $result[$labelStr !== '' ? $labelStr : 'value'] = $counter['value'];
-                }
-            }
-            foreach (self::$observations as $obs) {
-                if ($obs['name'] === $queryName || $obs['name'] === $name) {
-                    $labelStr = trim($obs['labelsStr'], '{}');
-                    $result[$labelStr !== '' ? $labelStr : 'value'] = $obs['value'];
-                }
-            }
-        }
-        return $result;
-    }
-
-    /**
-     * Réinitialise les compteurs enregistrés (utile pour l'isolation des tests).
-     */
-    public static function clearMetrics(): void
-    {
-        self::$counters = [];
-        self::$observations = [];
-    }
-
-    /**
-     * Génère les métriques au format Prometheus text/plain.
-     *
-     * @param array $securityConfig La configuration de sécurité active.
-     * @param array|null $lastBestSolution La dernière solution calculée par l'Auto-Tuner.
-     * @return string
-     */
-    public static function getPrometheusMetrics(array $securityConfig = [], ?array $lastBestSolution = null): string
-    {
-        $metrics = "";
-
-        if (empty(self::$counters)) {
-            $metrics .= "# HELP fingerprint_requests_total Total requests processed.\n";
-            $metrics .= "# TYPE fingerprint_requests_total counter\n";
-            $metrics .= "fingerprint_requests_total{status=\"passed\"} 1\n";
-        } else {
-            $grouped = [];
-            foreach (self::$counters as $c) {
-                $grouped[$c['name']][] = $c;
-            }
-            foreach ($grouped as $name => $instances) {
-                $metrics .= "# HELP {$name} Total requests processed.\n";
-                $metrics .= "# TYPE {$name} counter\n";
-                foreach ($instances as $instance) {
-                    $metrics .= "{$name}{$instance['labelsStr']} {$instance['value']}\n";
-                }
-            }
-        }
-
-        // Export des observations (Gauges)
-        if (!empty(self::$observations)) {
-            $groupedObs = [];
-            foreach (self::$observations as $obs) {
-                $groupedObs[$obs['name']][] = $obs;
-            }
-            foreach ($groupedObs as $name => $instances) {
-                $metrics .= "\n# HELP {$name} Value observation.\n";
-                $metrics .= "# TYPE {$name} gauge\n";
-                foreach ($instances as $instance) {
-                    $metrics .= "{$name}{$instance['labelsStr']} {$instance['value']}\n";
-                }
-            }
-        }
-
-        // 1. Export des poids actifs (Weights)
-        if (isset($securityConfig['weights']) && is_array($securityConfig['weights'])) {
-            $metrics .= "\n# HELP fingerprint_security_weight Active weight for each suspicion indicator.\n";
-            $metrics .= "# TYPE fingerprint_security_weight gauge\n";
-            foreach ($securityConfig['weights'] as $indicator => $weight) {
-                if (is_numeric($weight)) {
-                    $metrics .= "fingerprint_security_weight{indicator=\"{$indicator}\"} {$weight}\n";
-                }
-            }
-        }
-
-        // 2. Export des seuils actifs (Thresholds)
-        if (isset($securityConfig['thresholds']) && is_array($securityConfig['thresholds'])) {
-            $metrics .= "\n# HELP fingerprint_security_threshold Active score threshold for each enforcement action level.\n";
-            $metrics .= "# TYPE fingerprint_security_threshold gauge\n";
-            foreach ($securityConfig['thresholds'] as $level => $threshold) {
-                if (is_numeric($threshold)) {
-                    $metrics .= "fingerprint_security_threshold{level=\"{$level}\"} {$threshold}\n";
-                }
-            }
-        }
-
-        // 3. Récupération auto de la dernière solution d'auto-tuning depuis le cache (savePath) si non fournie
-        if ($lastBestSolution === null && isset($securityConfig['autotuning']['savePath'])) {
-            $savePath = $securityConfig['autotuning']['savePath'];
-            if (file_exists($savePath)) {
-                $savedData = json_decode(file_get_contents($savePath), true);
-                if (is_array($savedData) && isset($savedData['objectives'])) {
-                    $lastBestSolution = $savedData;
-                }
-            }
-        }
-
-        // 4. Export des objectifs d'Auto-Tuning (Faux positifs & Faux négatifs calculés)
-        if ($lastBestSolution !== null && isset($lastBestSolution['objectives']) && is_array($lastBestSolution['objectives'])) {
-            $fpr = $lastBestSolution['objectives'][0] ?? 0.0;
-            $fnr = $lastBestSolution['objectives'][1] ?? 0.0;
-            $metrics .= "\n# HELP fingerprint_autotuning_false_positive_rate Current false positive rate calculated by the auto-tuner.\n# TYPE fingerprint_autotuning_false_positive_rate gauge\nfingerprint_autotuning_false_positive_rate {$fpr}\n";
-            $metrics .= "\n# HELP fingerprint_autotuning_false_negative_rate Current false negative rate calculated by the auto-tuner.\n# TYPE fingerprint_autotuning_false_negative_rate gauge\nfingerprint_autotuning_false_negative_rate {$fnr}\n";
-        }
-
-        return $metrics;
-    }
+<?php
+
+declare(strict_types=1);
+
+namespace Anonympins\Fingerprint\Utils;
+
+class MetricsManager
+{
+    /** @var array Stockage temporaire des compteurs Prometheus */
+    private static array $counters = [];
+
+    /** @var array Stockage temporaire des observations Prometheus */
+    private static array $observations = [];
+
+    /**
+     * Incrémente un compteur Prometheus.
+     *
+     * @param string $name Nom du compteur.
+     * @param array $labels Libellés/Labels associés.
+     */
+    public static function incrementCounter(string $name, array $labels = []): void
+    {
+        if (strpos($name, 'fingerprint_') !== 0) {
+            $name = 'fingerprint_' . $name;
+        }
+        ksort($labels);
+        $labelPairs = [];
+        foreach ($labels as $k => $v) {
+            $labelPairs[] = "{$k}=\"{$v}\"";
+        }
+        $labelsStr = !empty($labelPairs) ? '{' . implode(',', $labelPairs) . '}' : '';
+        $key = $name . $labelsStr;
+
+        if (!isset(self::$counters[$key])) {
+            self::$counters[$key] = [
+                'name' => $name,
+                'labelsStr' => $labelsStr,
+                'value' => 0
+            ];
+        }
+        self::$counters[$key]['value']++;
+    }
+
+    /**
+     * Enregistre une observation de valeur (ex: temps d'exécution, score).
+     *
+     * @param string $name Nom de la métrique.
+     * @param float $value Valeur observée.
+     * @param array $labels Libellés/Labels associés.
+     */
+    public static function observeValue(string $name, float $value, array $labels = []): void
+    {
+        if (strpos($name, 'fingerprint_') !== 0) {
+            $name = 'fingerprint_' . $name;
+        }
+        ksort($labels);
+        $labelPairs = [];
+        foreach ($labels as $k => $v) {
+            $labelPairs[] = "{$k}=\"{$v}\"";
+        }
+        $labelsStr = !empty($labelPairs) ? '{' . implode(',', $labelPairs) . '}' : '';
+        $key = $name . $labelsStr;
+
+        self::$observations[$key] = [
+            'name' => $name,
+            'labelsStr' => $labelsStr,
+            'value' => $value
+        ];
+    }
+
+    /**
+     * Helper method to retrieve a specific metric's values by name.
+     *
+     * @param string $name Name of the metric.
+     * @param array $securityConfig The security configuration.
+     * @return array Associative array of labels to values.
+     */
+    public static function getMetric(string $name, array $securityConfig = []): array
+    {
+        $result = [];
+        $queryName = str_starts_with($name, 'fingerprint_') ? $name : 'fingerprint_' . $name;
+
+        if ($queryName === 'fingerprint_security_weight') {
+            $weights = $securityConfig['weights'] ?? [];
+            foreach ($weights as $indicator => $weight) {
+                if (is_numeric($weight)) {
+                    $result[$indicator] = (float)$weight;
+                }
+            }
+        } elseif ($queryName === 'fingerprint_security_threshold') {
+            $thresholds = $securityConfig['thresholds'] ?? [];
+            foreach ($thresholds as $level => $threshold) {
+                if (is_numeric($threshold)) {
+                    $result[$level] = (float)$threshold;
+                }
+            }
+        } else {
+            foreach (self::$counters as $counter) {
+                if ($counter['name'] === $queryName || $counter['name'] === $name) {
+                    $labelStr = trim($counter['labelsStr'], '{}');
+                    $result[$labelStr !== '' ? $labelStr : 'value'] = $counter['value'];
+                }
+            }
+            foreach (self::$observations as $obs) {
+                if ($obs['name'] === $queryName || $obs['name'] === $name) {
+                    $labelStr = trim($obs['labelsStr'], '{}');
+                    $result[$labelStr !== '' ? $labelStr : 'value'] = $obs['value'];
+                }
+            }
+        }
+        return $result;
+    }
+
+    /**
+     * Réinitialise les compteurs enregistrés (utile pour l'isolation des tests).
+     */
+    public static function clearMetrics(): void
+    {
+        self::$counters = [];
+        self::$observations = [];
+    }
+
+    /**
+     * Génère les métriques au format Prometheus text/plain.
+     *
+     * @param array $securityConfig La configuration de sécurité active.
+     * @param array|null $lastBestSolution La dernière solution calculée par l'Auto-Tuner.
+     * @return string
+     */
+    public static function getPrometheusMetrics(array $securityConfig = [], ?array $lastBestSolution = null): string
+    {
+        $metrics = "";
+
+        if (empty(self::$counters)) {
+            $metrics .= "# HELP fingerprint_requests_total Total requests processed.\n";
+            $metrics .= "# TYPE fingerprint_requests_total counter\n";
+            $metrics .= "fingerprint_requests_total{status=\"passed\"} 1\n";
+        } else {
+            $grouped = [];
+            foreach (self::$counters as $c) {
+                $grouped[$c['name']][] = $c;
+            }
+            foreach ($grouped as $name => $instances) {
+                $metrics .= "# HELP {$name} Total requests processed.\n";
+                $metrics .= "# TYPE {$name} counter\n";
+                foreach ($instances as $instance) {
+                    $metrics .= "{$name}{$instance['labelsStr']} {$instance['value']}\n";
+                }
+            }
+        }
+
+        // Export des observations (Gauges)
+        if (!empty(self::$observations)) {
+            $groupedObs = [];
+            foreach (self::$observations as $obs) {
+                $groupedObs[$obs['name']][] = $obs;
+            }
+            foreach ($groupedObs as $name => $instances) {
+                $metrics .= "\n# HELP {$name} Value observation.\n";
+                $metrics .= "# TYPE {$name} gauge\n";
+                foreach ($instances as $instance) {
+                    $metrics .= "{$name}{$instance['labelsStr']} {$instance['value']}\n";
+                }
+            }
+        }
+
+        // 1. Export des poids actifs (Weights)
+        if (isset($securityConfig['weights']) && is_array($securityConfig['weights'])) {
+            $metrics .= "\n# HELP fingerprint_security_weight Active weight for each suspicion indicator.\n";
+            $metrics .= "# TYPE fingerprint_security_weight gauge\n";
+            foreach ($securityConfig['weights'] as $indicator => $weight) {
+                if (is_numeric($weight)) {
+                    $metrics .= "fingerprint_security_weight{indicator=\"{$indicator}\"} {$weight}\n";
+                }
+            }
+        }
+
+        // 2. Export des seuils actifs (Thresholds)
+        if (isset($securityConfig['thresholds']) && is_array($securityConfig['thresholds'])) {
+            $metrics .= "\n# HELP fingerprint_security_threshold Active score threshold for each enforcement action level.\n";
+            $metrics .= "# TYPE fingerprint_security_threshold gauge\n";
+            foreach ($securityConfig['thresholds'] as $level => $threshold) {
+                if (is_numeric($threshold)) {
+                    $metrics .= "fingerprint_security_threshold{level=\"{$level}\"} {$threshold}\n";
+                }
+            }
+        }
+
+        // 3. Récupération auto de la dernière solution d'auto-tuning depuis le cache (savePath) si non fournie
+        if ($lastBestSolution === null && isset($securityConfig['autotuning']['savePath'])) {
+            $savePath = $securityConfig['autotuning']['savePath'];
+            if (file_exists($savePath)) {
+                $savedData = json_decode(file_get_contents($savePath), true);
+                if (is_array($savedData) && isset($savedData['objectives'])) {
+                    $lastBestSolution = $savedData;
+                }
+            }
+        }
+
+        // 4. Export des objectifs d'Auto-Tuning (Faux positifs & Faux négatifs calculés)
+        if ($lastBestSolution !== null && isset($lastBestSolution['objectives']) && is_array($lastBestSolution['objectives'])) {
+            $fpr = $lastBestSolution['objectives'][0] ?? 0.0;
+            $fnr = $lastBestSolution['objectives'][1] ?? 0.0;
+            $metrics .= "\n# HELP fingerprint_autotuning_false_positive_rate Current false positive rate calculated by the auto-tuner.\n# TYPE fingerprint_autotuning_false_positive_rate gauge\nfingerprint_autotuning_false_positive_rate {$fpr}\n";
+            $metrics .= "\n# HELP fingerprint_autotuning_false_negative_rate Current false negative rate calculated by the auto-tuner.\n# TYPE fingerprint_autotuning_false_negative_rate gauge\nfingerprint_autotuning_false_negative_rate {$fnr}\n";
+        }
+
+        return $metrics;
+    }
 }

package/src/php/Utils/RequestUtils.php

@@ -411,6 +411,9 @@ class RequestUtils
         }
 
         $score = 0.0;
+        if (!empty($metrics['prototypeTampered'])) {
+            $score += 80.0;
+        }
 
         $mouseAnalysis = self::analyzeMouseMovements($metrics['mouseMovementsHistory'] ?? null);
         $touch = self::analyzeTouchMovements($metrics['touchMovementsHistory'] ?? null);
@@ -501,6 +504,15 @@ class RequestUtils
                     $score += 35;
                 }
             }
+
+            // Détection de ferme mobile : Touch actif sur mobile sans aucune vibration physique (châssis/rack ADB)
+            $ua = $context->getHeader('user-agent') ?? '';
+            $isMobileDevice = str_contains($ua, 'Mobile');
+            if ($isMobileDevice && count($touchHistory) >= 5 && isset($metrics['motionVariance']) && is_numeric($metrics['motionVariance'])) {
+                if ((float)$metrics['motionVariance'] === 0.0) {
+                    $score += 50.0;
+                }
+            }
         }
 
         return ['behaviorScore' => min(100.0, $score)];
@@ -1244,6 +1256,36 @@ class RequestUtils
         return null;
     }
 
+    /**
+     * Calcule la longueur du préfixe commun (en bits) entre deux adresses IP (IPv4 ou IPv6).
+     */
+    public static function getIpCommonPrefixLength(string $ip1, string $ip2): int
+    {
+        $bin1 = @inet_pton($ip1);
+        $bin2 = @inet_pton($ip2);
+        if ($bin1 === false || $bin2 === false || strlen($bin1) !== strlen($bin2)) {
+            return 0;
+        }
+        $len = strlen($bin1);
+        $bits = 0;
+        for ($i = 0; $i < $len; $i++) {
+            $xor = ord($bin1[$i]) ^ ord($bin2[$i]);
+            if ($xor === 0) {
+                $bits += 8;
+            } else {
+                for ($b = 7; $b >= 0; $b--) {
+                    if (($xor & (1 << $b)) === 0) {
+                        $bits++;
+                    } else {
+                        break;
+                    }
+                }
+                break;
+            }
+        }
+        return $bits;
+    }
+
     /**
      * Met à jour les métriques agrégées pour un sous-réseau IP.
      * @param RequestContext $context
@@ -1263,7 +1305,8 @@ class RequestUtils
             'highScoreDevices' => [],
             'lastActivity' => 0,
             'ips' => [],
-            'uas' => []
+            'uas' => [],
+            'attackerIps' => []
         ];
 
         if (!isset($subnetData['highScoreDevices'])) {
@@ -1275,6 +1318,9 @@ class RequestUtils
         if (!isset($subnetData['uas'])) {
             $subnetData['uas'] = [];
         }
+        if (!isset($subnetData['attackerIps']) || !is_array($subnetData['attackerIps'])) {
+            $subnetData['attackerIps'] = [];
+        }
         $now = time();
         self::decaySubnetData($subnetData, $now);
 
@@ -1297,6 +1343,28 @@ class RequestUtils
         }
 
         $userAgent = $context->getHeader('user-agent') ?? '';
+        if ($finalScore >= 70.0) {
+            $foundAttacker = false;
+            foreach ($subnetData['attackerIps'] as &$att) {
+                if (isset($att['ip']) && $att['ip'] === $context->clientIp) {
+                    $att['lastSeen'] = $now;
+                    $att['score'] = max((float)($att['score'] ?? 0.0), $finalScore);
+                    $foundAttacker = true;
+                    break;
+                }
+            }
+            unset($att);
+            if (!$foundAttacker) {
+                $subnetData['attackerIps'][] = [
+                    'ip' => $context->clientIp,
+                    'lastSeen' => $now,
+                    'score' => $finalScore
+                ];
+                if (count($subnetData['attackerIps']) > 30) {
+                    array_shift($subnetData['attackerIps']);
+                }
+            }
+        }
         if (!empty($userAgent) && !in_array($userAgent, $subnetData['uas'], true)) {
             $subnetData['uas'][] = $userAgent;
         }
@@ -1326,9 +1394,10 @@ class RequestUtils
      * Calcule un score de suspicion basé sur l'activité historique du sous-réseau IP.
      * @param RequestContext $context
      * @param string $currentDeviceId
+     * @param array<string, mixed> $securityConfig
      * @return array{'subnetScore': float}
      */
-    public static function getSubnetScore(RequestContext $context, string $currentDeviceId): array
+    public static function getSubnetScore(RequestContext $context, string $currentDeviceId = '', array $securityConfig = []): array
     {
         $subnet = self::getIpSubnet($context->clientIp);
         if ($subnet === null) {
@@ -1373,14 +1442,61 @@ class RequestUtils
         $uaDispersion = min(3.0, (float)max(1, $uaCount) / (float)$deviceCount);
         $uaMultiplier = 0.7 + 0.3 * tanh($uaDispersion - 1.0);
 
-        // 4. Intensité continue de la menace
+        // 4. Intensité brute globale de la menace
         $rawIntensity = (float)$highScoreCount * $bayesianDensity * $ipMultiplier * $uaMultiplier;
 
-        // 5. Asymptote continue via tanh (99.9 maximum strict, dérivable et sans saut)
-        $asymptote = 99.9;
-        $scale = 4.0;
-        $finalScore = round($asymptote * tanh($rawIntensity / $scale) * 10.0) / 10.0;
+        // 5. Composante 1 : Score ambiant plafonné en zone Medium (asymptote au seuil medium)
+        $mediumThreshold = (float)($securityConfig['thresholds']['medium'] ?? 45.0);
+        $ambientAsymptote = $mediumThreshold;
+        $maxProximityBoost = max(0.0, 100.0 - $ambientAsymptote);
+        $scale = 10.0;
+        $ambientScore = $ambientAsymptote * tanh($rawIntensity / $scale);
+
+        // 6. Composante 2 : Boost de proximité micro-réseau avec des attaquants récents (le reste va jusqu'à 100)
+        $proximityBoost = 0.0;
+        $attackerIps = $subnetData['attackerIps'] ?? [];
+        $clientIp = $context->clientIp;
+
+        if (!empty($attackerIps) && !empty($clientIp)) {
+            $maxCommonPrefix = 0;
+            $isV4 = filter_var($clientIp, FILTER_VALIDATE_IP, FILTER_FLAG_IPV4) !== false;
+            $isV6 = filter_var($clientIp, FILTER_VALIDATE_IP, FILTER_FLAG_IPV6) !== false;
+
+            foreach ($attackerIps as $att) {
+                $attIp = $att['ip'] ?? '';
+                $lastSeen = $att['lastSeen'] ?? $now;
+                if ($attIp !== '' && ($now - $lastSeen) <= 1800) {
+                    $prefixLen = self::getIpCommonPrefixLength($clientIp, $attIp);
+                    if ($prefixLen > $maxCommonPrefix) {
+                        $maxCommonPrefix = $prefixLen;
+                    }
+                }
+            }
 
+            if ($isV4) {
+                if ($maxCommonPrefix >= 32) {
+                    $proximityBoost = $maxProximityBoost; // Même adresse IP exacte
+                } elseif ($maxCommonPrefix >= 30) {
+                    $proximityBoost = $maxProximityBoost * (45.0 / 55.0); // Même /30 (écart <= 3 adresses)
+                } elseif ($maxCommonPrefix >= 28) {
+                    $proximityBoost = $maxProximityBoost * (30.0 / 55.0); // Même /28 (bloc de 16 adresses)
+                } elseif ($maxCommonPrefix >= 26) {
+                    $proximityBoost = $maxProximityBoost * (15.0 / 55.0); // Même /26 (bloc de 64 adresses)
+                }
+            } elseif ($isV6) {
+                if ($maxCommonPrefix >= 128) {
+                    $proximityBoost = $maxProximityBoost; // Même IPv6 exacte
+                } elseif ($maxCommonPrefix >= 120) {
+                    $proximityBoost = $maxProximityBoost * (45.0 / 55.0); // Même /120
+                } elseif ($maxCommonPrefix >= 112) {
+                    $proximityBoost = $maxProximityBoost * (30.0 / 55.0); // Même /112
+                } elseif ($maxCommonPrefix >= 96) {
+                    $proximityBoost = $maxProximityBoost * (15.0 / 55.0); // Même /96
+                }
+            }
+        }
+
+        $finalScore = min(100.0, round(($ambientScore + $proximityBoost) * 10.0) / 10.0);
         return ['subnetScore' => $finalScore];
     }
     /**
@@ -1416,6 +1532,12 @@ class RequestUtils
                 }
             }
 
+            if (isset($subnetData['attackerIps']) && is_array($subnetData['attackerIps'])) {
+                $subnetData['attackerIps'] = array_values(array_filter($subnetData['attackerIps'], function ($att) use ($now) {
+                    return ($now - ($att['lastSeen'] ?? $now)) < 3600;
+                }));
+            }
+
             $subnetData['lastActivity'] = $now - ($inactivitySec % 1800);
         }
     }