@anonympins/fingerprint 0.7.3 → 0.7.5

package/CHANGELOG.md

@@ -1,3 +1,44 @@
+## Version 0.7.5
+
+- 🛡️ **Differential Privacy on Federated Threat Intelligence**:
+  - **Laplacian Noise on Federation Timestamps ($\text{Laplace}(0, b)$)**: Added mathematical perturbation to exact event timestamps in federated ban exchanges (`share_threat_intel`) parameterized by sensitivity $\Delta t = 5000\text{ms}$ and privacy budget $\epsilon$ (`differentialPrivacy.epsilon`). Timestamps are bounded within a safe $\pm 60\text{s}$ window to satisfy anti-replay checks while completely preventing malicious or compromised federation nodes from reconstructing inter-domain browsing trajectories via millisecond timing correlation.
+  - **Randomized Response Decoy Injection (Chaffing)**: Implemented randomized response logic where nodes inject and broadcast synthetic ZKP public keys generated uniformly in $\mathbb{Z}_p$ with probability $p = 1 / (1 + e^{\epsilon})$ (or customizable `dummyRate`). Due to the negligible collision probability of 256-bit keys ($\approx 2^{-256}$), decoys never reach the collaborative consensus threshold ($K \ge 3$), guaranteeing mathematical plausible deniability without causing false positives.
+  - **Multi-Runtime Parity**: Fully implemented across JavaScript (`fingerprint.js`), PHP (`FingerprintEngine.php`), Python (`engine.py`), and Java (`FingerprintEngine.java`, `FingerprintProperties.java`).
+
+- 🌐 **Network Layer Anomaly Detection**:
+  - **MTU Anomaly Scoring (`mtuAnomalyScore`)**: Introduced `mtuAnomalyScore` to the suspicion vector and configuration weights across all runtimes. Evaluates passive TCP SYN options (specifically MSS — Maximum Segment Size) to detect anomalous MTU values typical of VPN/GRE tunneling, WireGuard encapsulation, or residential proxy backconnect chains attempting to masquerade as standard domestic browser connections.
+
+- ♿ **Accessibility (a11y) & Invisible Honeypot Hardening**:
+  - **Screen-Reader Compliant Honeypot Fields**: Hardened dynamic DOM honeypot generation within `FingerprintClient` with `aria-hidden="true"`, `tabindex="-1"`, and `autocomplete="off"` attributes combined with defensive offscreen CSS positioning (`position: absolute; left: -9999px; transform: scale(0); opacity: 0; pointer-events: none;`). Ensures assistive technologies (NVDA, JAWS, VoiceOver) and browser autofill routines ignore honeypot inputs for visually impaired users while maintaining a 100% trap catch rate against automated scrapers.
+
+- 🤖 **Crawler Whitelist Updates & Multi-Language Parity**:
+  - **Meta / Facebook Whitelist Addition**: Added dedicated IP subnets and CIDR definitions for Meta and Facebook crawlers (`facebookexternalhit`, `31.13.64.0/18`, `66.220.144.0/20`, `69.63.176.0/20`, `157.240.0.0/16`) to guarantee smooth link preview generation and indexing without challenge interruptions.
+  - **Cross-Platform Whitelist Synchronization**: Standardized crawler allowlists and DNS verification workflows (Googlebot, Bingbot, Yandex, Facebook) across all supported backend engines (Node.js, PHP, Python, and Java).
+
+- 🔧 **Core Engine Refinements**:
+  - **`fingerprint.js` Updates**: Synchronized client-side metric collectors, refined behavioral input tracking, and plugged federation broadcast hooks directly into the core security pipeline.
+  - **Java Configuration Enhancements**: Added missing getters/setters and mapped configuration fields (`quicAnomalyScore`, `virtualizationScore`, `differentialPrivacy`, `federatedPeers`) in `FingerprintProperties.java`.
+  - **PHP Store Lifecycle**: Resolved initialization order edge cases for store instances during request processing in `FingerprintEngine.php`.
+
+- 📖 **Documentation**:
+  - **Configuration Options Reference (`full_options.md`)**: Documented all new settings, including `mtuAnomalyScore`, `differentialPrivacy` block (`enabled`, `epsilon`, `dummyRate`), and federated threat sharing parameters.
+
+---
+
+## Version 0.7.4
+
+- 🛡️ **Security & Rate Limiting**:
+  - **Domain-Aware Challenge Rate Limiter**: Implemented a new rate-limiting mechanism that operates on a per-domain basis. This enhances stability in multi-tenant architectures and mitigates challenge-based DoS attacks by isolating traffic per host.
+  - **Transparent Service Worker Interception (`fingerprint.worker.js`)**: Introduced a dedicated Service Worker and client integration (`initServiceWorker`, `syncServiceWorkerCredentials`) for transparent network request decoration (`X-Device-Fingerprint`, `X-Behavior-Metrics`). This avoids monkey-patching `window.fetch` directly, keeping native prototypes intact to prevent prototype tampering triggers while supporting domain-scoped protection.
+- ⚖️ **Scoring Parity & Enhancements**:
+  - **`behaviorScore` Overhaul**: Reworked the behavioral scoring logic across all supported languages (Node.js, PHP, Java, Python) for more accurate detection of human-like interactions versus automated patterns.
+  - **`x-behavior-metrics` Direct Score & Binary Flag Support**: Added support for direct evaluation of client-side binary flags (`1` for verified human yielding a score of `0`, `0` for detected bot yielding a score of `100`) as well as raw numeric suspicion scores passed in the `x-behavior-metrics` header. (Contributed by @anonympins)
+  - **Cross-Language Weight Parity**: Harmonized the weights within all security profiles to ensure identical scoring and behavior across every runtime environment.
+  - **HTTP/2 Pseudo-Header Validation**: Hardened `protocolAnomalyScore` to detect and penalize invalid pseudo-headers in HTTP/2 fingerprints, improving detection of non-standard and bot-like clients.
+  - **Java Engine Parity**: The Java engine's auto-tuner and configuration management have been brought to full parity with the other language implementations.
+- 🔧 **Fixes & Maintenance**:
+  - Corrected library import paths and expanded test coverage for the updated `behaviorScore` logic.
+
 ## Version 0.7.3
 
 - 🛡️ **Scoring Corrections & Anti-Spoofing Fixes**:

package/README.md

@@ -91,7 +91,7 @@ In your **pom.xml**, add :
 <dependency>
     <groupId>com.anonympins</groupId>
     <artifactId>fingerprint-engine</artifactId>
-    <version>0.7.3</version>
+    <version>0.7.5</version>
 </dependency>
 ```
 ## Documentation

package/package.json

@@ -1,107 +1,109 @@
-{
-  "name": "@anonympins/fingerprint",
-  "version": "0.7.3",
-  "description": "Advanced anti-bot library for Node.js using multi-layer fingerprinting (JA3, client-side, headers), behavioral analysis, and adaptive Proof-of-Work (PoW) challenges to mitigate scraping, scalping, and automated threats.",
-  "main": "index.js",
-  "type": "module",
-  "engines": {
-    "node": ">=20.0.0"
-  },
-  "scripts": {
-    "test": "vitest run --reporter=verbose",
-    "pub": "npm run build && npm login && npm publish --access public",
-    "build": "node src/js/build-client.js"
-  },
-  "exports": {
-    ".": "./index.js",
-    "./client": {
-      "import": "./src/js/fingerprint.client.obfuscated.js",
-      "require": "./src/js/fingerprint.client.obfuscated.js",
-      "browser": "./src/js/fingerprint.client.obfuscated.js"
-    },
-    "./client/src/*": "./src/js/*",
-    "./fp.wasm": "./public/fp.wasm",
-    "./fp.js": "./public/fp.js",
-    "./package.json": "./package.json"
-  },
-  "files": [
-    "index.js",
-    "src/js/",
-    "public/",
-    "README.md",
-    "LICENSE",
-    "CHANGELOG.md",
-    "src/php/",
-    "composer.json",
-    "phpunit.xml"
-  ],
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/anonympins/fingerprint.git"
-  },
-  "keywords": [
-    "anti-bot",
-    "bot-detection",
-    "security",
-    "middleware",
-    "express",
-    "nodejs",
-    "fingerprint",
-    "device-fingerprinting",
-    "ja3",
-    "tls-fingerprinting",
-    "proof-of-work",
-    "pow",
-    "useful-proof-of-work",
-    "upow",
-    "waf",
-    "scraping",
-    "scalping",
-    "mitigation",
-    "rate-limiting",
-    "honeypot",
-    "behavioral-analysis"
-  ],
-  "author": "anonympins",
-  "license": "MIT",
-  "bugs": {
-    "url": "https://github.com/anonympins/fingerprint/issues"
-  },
-  "homepage": "https://github.com/anonympins/fingerprint#readme",
-  "devDependencies": {
-    "cookie-parser": "^1.4.6",
-    "express": "^4.22.2",
-    "javascript-obfuscator": "^4.1.0",
-    "jsdom": "^24.0.0",
-    "prom-client": "^15.1.2",
-    "terser": "^5.30.3",
-    "vitest": "^4.1.11"
-  },
-  "overrides": {
-    "body-parser": "2.3.0",
-    "qs": "6.16.0"
-  },
-  "peerDependencies": {
-    "ioredis": "^5.3.2",
-    "knex": ">=3.0.0",
-    "mongodb": "^6.3.0",
-    "sqlite3": "^5.1.7"
-  },
-  "peerDependenciesMeta": {
-    "ioredis": {
-      "optional": true
-    },
-    "mongodb": {
-      "optional": true
-    },
-    "knex": {
-      "optional": true
-    },
-    "sqlite3": {
-      "optional": true
-    }
-  },
-  "dependencies": {
-    "@tensorflow/tfjs": "^4.22.0"
-  }
-}
+{
+  "name": "@anonympins/fingerprint",
+  "version": "0.7.5",
+  "description": "Advanced anti-bot library for Node.js using multi-layer fingerprinting (JA3, client-side, headers), behavioral analysis, and adaptive Proof-of-Work (PoW) challenges to mitigate scraping, scalping, and automated threats.",
+  "main": "index.js",
+  "type": "module",
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "scripts": {
+    "test": "vitest run --reporter=verbose",
+    "pub": "npm run build && npm login && npm publish --access public",
+    "build": "node src/js/build-client.js"
+  },
+  "exports": {
+    ".": "./index.js",
+    "./client": {
+      "import": "./src/js/fingerprint.client.obfuscated.js",
+      "browser": "./src/js/fingerprint.client.obfuscated.js"
+    },
+    "./worker": {
+      "import": "./src/js/fingerprint.worker.js",
+      "default": "./src/js/fingerprint.worker.js"
+    },
+    "./fp.wasm": "./public/fp.wasm",
+    "./fp.js": "./public/fp.js",
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "index.js",
+    "src/js/",
+    "public/",
+    "README.md",
+    "LICENSE",
+    "CHANGELOG.md",
+    "src/php/",
+    "composer.json",
+    "phpunit.xml"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/anonympins/fingerprint.git"
+  },
+  "keywords": [
+    "anti-bot",
+    "bot-detection",
+    "security",
+    "middleware",
+    "express",
+    "nodejs",
+    "fingerprint",
+    "device-fingerprinting",
+    "ja3",
+    "tls-fingerprinting",
+    "proof-of-work",
+    "pow",
+    "useful-proof-of-work",
+    "upow",
+    "waf",
+    "scraping",
+    "scalping",
+    "mitigation",
+    "rate-limiting",
+    "honeypot",
+    "behavioral-analysis"
+  ],
+  "author": "anonympins",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/anonympins/fingerprint/issues"
+  },
+  "homepage": "https://github.com/anonympins/fingerprint#readme",
+  "devDependencies": {
+    "cookie-parser": "^1.4.6",
+    "express": "^4.22.2",
+    "javascript-obfuscator": "^4.1.0",
+    "jsdom": "^24.0.0",
+    "prom-client": "^15.1.2",
+    "terser": "^5.30.3",
+    "vitest": "^4.1.11"
+  },
+  "overrides": {
+    "body-parser": "2.3.0",
+    "qs": "6.16.0"
+  },
+  "peerDependencies": {
+    "ioredis": "^5.3.2",
+    "knex": ">=3.0.0",
+    "mongodb": "^6.3.0",
+    "sqlite3": "^5.1.7"
+  },
+  "peerDependenciesMeta": {
+    "ioredis": {
+      "optional": true
+    },
+    "mongodb": {
+      "optional": true
+    },
+    "knex": {
+      "optional": true
+    },
+    "sqlite3": {
+      "optional": true
+    }
+  },
+  "dependencies": {
+    "@tensorflow/tfjs": "^4.22.0"
+  }
+}