@anonympins/fingerprint 0.7.4 → 0.8.0

package/src/js/tests/ja3AnomalyDetector.test.js

@@ -1,136 +1,135 @@
-import crypto from 'crypto';
-import {getTlsSpoofingScore, parseJa3} from '../fingerprint.js';
-import {vi} from 'vitest';
-import { verifyZkpProof, decodePolymorphicFingerprint, deepMerge, getHeaderSignature, parseJa3, modPow, hashNetwork, normalizeReferer, isPrivateIp, parseUserAgent } from "../../js/fingerprint.utils.js";
-
-describe('JA3 Anomaly Detector (Node.js)', () => {
-    
-    // Mock d'un store de cache asynchrone en mémoire
-    const createMockStore = () => {
-        const storage = {};
-        return {
-            get: vi.fn(async (key) => storage[key] || null),
-            set: vi.fn(async (key, val) => { storage[key] = val; })
-        };
-    };
-
-    describe('parseJa3', () => {
-        it('devrait parser correctement une chaine JA3 brute', () => {
-            const rawJa3 = '771,4865-4866-4867,0-23-65281-10-11,29-23-24,0';
-            const parsed = parseJa3(rawJa3);
-            
-            expect(parsed).not.toBeNull();
-            expect(parsed.tlsVersion).toBe(771);
-            expect(parsed.ciphers).toEqual([4865, 4866, 4867]);
-            expect(parsed.extensions).toEqual([0, 23, 65281, 10, 11]);
-        });
-
-        it('devrait retourner null pour des chaines invalides', () => {
-            expect(parseJa3('')).toBeNull();
-            expect(parseJa3('771,4865')).toBeNull();
-        });
-    });
-
-    describe('getTlsSpoofingScore (Anomalies JA3 hachées)', () => {
-        it('devrait détecter l\'usurpation d\'identité d\'une bibliothèque (Python)', async () => {
-            const pythonJa3Hash = '47344a349b75c4e82333475553b5f358';
-            const chromeUa = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0';
-
-            const context = {
-                headers: {
-                    'user-agent': chromeUa,
-                    'x-ja3-hash': pythonJa3Hash
-                }
-            };
-
-            const result = await getTlsSpoofingScore(context);
-            expect(result.tlsSpoofingScore).toBe(90);
-        });
-
-        it('devrait détecter la rotation d\'User-Agent sur un même hash JA3 (Stagnation)', async () => {
-            const mockStore = createMockStore();
-            const unknownJa3 = '00000000000000000000000000000000';
-            
-            const contextChrome = {
-                headers: {
-                    'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0',
-                    'x-ja3-hash': unknownJa3
-                }
-            };
-
-            const contextFirefox = {
-                headers: {
-                    'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/120.0',
-                    'x-ja3-hash': unknownJa3
-                }
-            };
-
-            // Injecter le mockStore dans le module de test si nécessaire ou mocker l'importation du store global
-            // Premier passage : Chrome
-            const res1 = await getTlsSpoofingScore(contextChrome, mockStore);
-            
-            // Deuxième passage : Firefox (Détection de la rotation de UA)
-            const res2 = await getTlsSpoofingScore(contextFirefox, mockStore);
-            expect(res2.tlsSpoofingScore).toBe(85);
-        });
-    });
-
-    describe('getTlsSpoofingScore (Anomalies JA3 brutes)', () => {
-        it('devrait suspecter un faux Chrome n\'utilisant pas le mécanisme GREASE', async () => {
-            const chromeUa = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0';
-            // Pas de valeurs GREASE dans la suite
-            const ja3RawNoGrease = '771,4865-4866,0-23-10,29,0';
-            const ja3Hash = crypto.createHash('md5').update(ja3RawNoGrease).digest('hex');
-
-            const context = {
-                headers: {
-                    'user-agent': chromeUa,
-                    'x-ja3-raw': ja3RawNoGrease,
-                    'x-ja3-hash': ja3Hash
-                },
-                httpVersion: '2.0'
-            };
-
-            const result = await getTlsSpoofingScore(context);
-            expect(result.tlsSpoofingScore).toBe(75);
-        });
-
-        it('devrait valider un Chrome légitime utilisant des valeurs GREASE', async () => {
-            const chromeUa = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0';
-            // 2570 est une suite GREASE valide
-            const ja3RawWithGrease = '771,4865-2570,0-23-10-16,29,0';
-            const ja3Hash = crypto.createHash('md5').update(ja3RawWithGrease).digest('hex');
-
-            const context = {
-                headers: {
-                    'user-agent': chromeUa,
-                    'x-ja3-raw': ja3RawWithGrease,
-                    'x-ja3-hash': ja3Hash
-                },
-                httpVersion: '2.0'
-            };
-
-            const result = await getTlsSpoofingScore(context);
-            expect(result.tlsSpoofingScore).toBeLessThan(70);
-        });
-
-        it('devrait détecter l\'absence d\'extension ALPN pour une connexion HTTP/2', async () => {
-            const chromeUa = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0';
-            // Pas d'extension 16 (ALPN)
-            const ja3RawNoAlpn = '771,4865-2570,0-23-10,29,0';
-            const ja3Hash = crypto.createHash('md5').update(ja3RawNoAlpn).digest('hex');
-
-            const context = {
-                headers: {
-                    'user-agent': chromeUa,
-                    'x-ja3-raw': ja3RawNoAlpn,
-                    'x-ja3-hash': ja3Hash
-                },
-                httpVersion: '2.0'
-            };
-
-            const result = await getTlsSpoofingScore(context);
-            expect(result.tlsSpoofingScore).toBe(70);
-        });
-    });
-});
+import crypto from 'crypto';
+import {getTlsSpoofingScore, parseJa3} from '../fingerprint.js';
+import {vi} from 'vitest';
+import { verifyZkpProof, decodePolymorphicFingerprint, deepMerge, getHeaderSignature, parseJa3, modPow, hashNetwork, normalizeReferer, isPrivateIp, parseUserAgent } from "../../js/fingerprint.utils.js";
+
+describe('JA3 Anomaly Detector (Node.js)', () => {
+    
+    // Mock async in-memory cache store
+    const createMockStore = () => {
+        const storage = {};
+        return {
+            get: vi.fn(async (key) => storage[key] || null),
+            set: vi.fn(async (key, val) => { storage[key] = val; })
+        };
+    };
+
+    describe('parseJa3', () => {
+        it('should correctly parse raw JA3 string', () => {
+            const rawJa3 = '771,4865-4866-4867,0-23-65281-10-11,29-23-24,0';
+            const parsed = parseJa3(rawJa3);
+            
+            expect(parsed).not.toBeNull();
+            expect(parsed.tlsVersion).toBe(771);
+            expect(parsed.ciphers).toEqual([4865, 4866, 4867]);
+            expect(parsed.extensions).toEqual([0, 23, 65281, 10, 11]);
+        });
+
+        it('should return null for invalid strings', () => {
+            expect(parseJa3('')).toBeNull();
+            expect(parseJa3('771,4865')).toBeNull();
+        });
+    });
+
+    describe('getTlsSpoofingScore (Anomalies JA3 hachées)', () => {
+        it('should detect library spoofing (Python)', async () => {
+            const pythonJa3Hash = '47344a349b75c4e82333475553b5f358';
+            const chromeUa = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0';
+
+            const context = {
+                headers: {
+                    'user-agent': chromeUa,
+                    'x-ja3-hash': pythonJa3Hash
+                }
+            };
+
+            const result = await getTlsSpoofingScore(context);
+            expect(result.tlsSpoofingScore).toBe(90);
+        });
+
+        it('should detect User-Agent rotation on identical JA3 hash (Stagnation)', async () => {
+            const mockStore = createMockStore();
+            const unknownJa3 = '00000000000000000000000000000000';
+            
+            const contextChrome = {
+                headers: {
+                    'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0',
+                    'x-ja3-hash': unknownJa3
+                }
+            };
+
+            const contextFirefox = {
+                headers: {
+                    'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/120.0',
+                    'x-ja3-hash': unknownJa3
+                }
+            };
+
+            // First call: Chrome
+            const res1 = await getTlsSpoofingScore(contextChrome, mockStore);
+            
+            // Second call: Firefox (Detects UA rotation)
+            const res2 = await getTlsSpoofingScore(contextFirefox, mockStore);
+            expect(res2.tlsSpoofingScore).toBe(85);
+        });
+    });
+
+    describe('getTlsSpoofingScore (Anomalies JA3 brutes)', () => {
+        it('should flag fake Chrome lacking GREASE values', async () => {
+            const chromeUa = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0';
+            // No GREASE values in ciphers/extensions
+            const ja3RawNoGrease = '771,4865-4866,0-23-10,29,0';
+            const ja3Hash = crypto.createHash('md5').update(ja3RawNoGrease).digest('hex');
+
+            const context = {
+                headers: {
+                    'user-agent': chromeUa,
+                    'x-ja3-raw': ja3RawNoGrease,
+                    'x-ja3-hash': ja3Hash
+                },
+                httpVersion: '2.0'
+            };
+
+            const result = await getTlsSpoofingScore(context);
+            expect(result.tlsSpoofingScore).toBe(75);
+        });
+
+        it('should validate legitimate Chrome using GREASE values', async () => {
+            const chromeUa = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0';
+            // 2570 is a valid GREASE value
+            const ja3RawWithGrease = '771,4865-2570,0-23-10-16,29,0';
+            const ja3Hash = crypto.createHash('md5').update(ja3RawWithGrease).digest('hex');
+
+            const context = {
+                headers: {
+                    'user-agent': chromeUa,
+                    'x-ja3-raw': ja3RawWithGrease,
+                    'x-ja3-hash': ja3Hash
+                },
+                httpVersion: '2.0'
+            };
+
+            const result = await getTlsSpoofingScore(context);
+            expect(result.tlsSpoofingScore).toBeLessThan(70);
+        });
+
+        it('should detect missing ALPN extension on HTTP/2 connections', async () => {
+            const chromeUa = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0';
+            // Missing extension 16 (ALPN)
+            const ja3RawNoAlpn = '771,4865-2570,0-23-10,29,0';
+            const ja3Hash = crypto.createHash('md5').update(ja3RawNoAlpn).digest('hex');
+
+            const context = {
+                headers: {
+                    'user-agent': chromeUa,
+                    'x-ja3-raw': ja3RawNoAlpn,
+                    'x-ja3-hash': ja3Hash
+                },
+                httpVersion: '2.0'
+            };
+
+            const result = await getTlsSpoofingScore(context);
+            expect(result.tlsSpoofingScore).toBe(70);
+        });
+    });
+});

package/src/js/tests/library.test.js

@@ -1,96 +1,95 @@
-import {describe, expect, it} from 'vitest';
-import {Optimization} from '../library.js';
-
-describe('Optimization.Operators.benfordTest', () => {
-
-    it('should return 0 for non-array inputs', () => {
-        expect(Optimization.Operators.benfordTest("12345")).toBe(0);
-        expect(Optimization.Operators.benfordTest(null)).toBe(0);
-        expect(Optimization.Operators.benfordTest(undefined)).toBe(0);
-        expect(Optimization.Operators.benfordTest({ a: 1 })).toBe(0);
-    });
-
-    it('should return 0 for arrays with less than 10 valid numbers', () => {
-        const smallArray = [1, 2, 3, 4, 5, 6, 7, 8, 9];
-        expect(Optimization.Operators.benfordTest(smallArray)).toBe(0);
-    });
-
-    it('should return 0 for an empty array', () => {
-        expect(Optimization.Operators.benfordTest([])).toBe(0);
-    });
-
-    it('should ignore zeros, non-numeric strings, and leading spaces', () => {
-        // This array contains only 9 valid leading digits.
-        const dirtyArray = [0, " 123", "abc", 2, 3, 4, 5, 6, 7, 8, 9, null, undefined];
-        expect(Optimization.Operators.benfordTest(dirtyArray)).toBe(0);
-    });
-
-    it('should return a very low score for a distribution that perfectly matches Benford\'s law', () => {
-        // Création d'un échantillon de 1000 nombres qui suit la loi de Benford
-        const benfordSample = [
-            ...Array(301).fill(100), // 301 nombres commençant par 1
-            ...Array(176).fill(200), // 176 nombres commençant par 2
-            ...Array(125).fill(300), // 125 nombres commençant par 3
-            ...Array(97).fill(400),  // etc.
-            ...Array(79).fill(500),
-            ...Array(67).fill(600),
-            ...Array(58).fill(700),
-            ...Array(51).fill(800),
-            ...Array(46).fill(900),
-        ];
-
-        const score = Optimization.Operators.benfordTest(benfordSample);
-        // Le score devrait être très proche de 0. On utilise toBeLessThan pour tolérer les imprécisions de calcul.
-        expect(score).toBeLessThan(1e-9);
-    });
-
-    it('should return a high (suspect) score for a uniform distribution', () => {
-        // Une distribution uniforme est très peu naturelle pour ce genre de données.
-        const uniformSample = [];
-        for (let i = 1; i <= 9; i++) {
-            for (let j = 0; j < 100; j++) {
-                uniformSample.push(i * 100 + j);
-            }
-        }
-
-        const score = Optimization.Operators.benfordTest(uniformSample);
-        // Un score > 0.15 est considéré comme suspect.
-        expect(score).toBeGreaterThan(0.15);
-    });
-
-    it('should return a high (suspect) score for a distribution skewed towards high digits', () => {
-        // L'inverse de la loi de Benford, très suspect.
-        const inverseBenfordSample = [
-            ...Array(46).fill(100),
-            ...Array(51).fill(200),
-            ...Array(58).fill(300),
-            ...Array(67).fill(400),
-            ...Array(79).fill(500),
-            ...Array(97).fill(600),
-            ...Array(125).fill(700),
-            ...Array(176).fill(800),
-            ...Array(301).fill(900),
-        ];
-
-        const score = Optimization.Operators.benfordTest(inverseBenfordSample);
-        expect(score).toBeGreaterThan(0.3); // Score attendu encore plus élevé
-    });
-
-    it('should handle real-world-like data (request timings)', () => {
-        // Simule des délais de requêtes générés par un bot (ex: aléatoire uniforme entre 500 et 1500ms)
-        const botTimings = Array.from({ length: 100 }, () => 500 + Math.random() * 1000);
-        const botScore = Optimization.Operators.benfordTest(botTimings);
-
-        // Simule des délais humains (plus de petits délais, quelques longs délais)
-        const humanTimings = [
-            123, 234, 180, 345, 150, 456, 110, 190, 210, 280, 567, 130, 890, 1200, 310, 160
-        ];
-        const humanScore = Optimization.Operators.benfordTest(humanTimings);
-
-        // Le score du bot devrait être significativement plus élevé que celui de l'humain.
-        // Les valeurs exactes peuvent varier, mais la tendance doit être claire.
-        expect(botScore).toBeGreaterThan(0.1);
-        expect(humanScore).toBeLessThan(botScore);
-    });
-
+import {describe, expect, it} from 'vitest';
+import {Optimization} from '../library.js';
+
+describe('Optimization.Operators.benfordTest', () => {
+
+    it('should return 0 for non-array inputs', () => {
+        expect(Optimization.Operators.benfordTest("12345")).toBe(0);
+        expect(Optimization.Operators.benfordTest(null)).toBe(0);
+        expect(Optimization.Operators.benfordTest(undefined)).toBe(0);
+        expect(Optimization.Operators.benfordTest({ a: 1 })).toBe(0);
+    });
+
+    it('should return 0 for arrays with less than 10 valid numbers', () => {
+        const smallArray = [1, 2, 3, 4, 5, 6, 7, 8, 9];
+        expect(Optimization.Operators.benfordTest(smallArray)).toBe(0);
+    });
+
+    it('should return 0 for an empty array', () => {
+        expect(Optimization.Operators.benfordTest([])).toBe(0);
+    });
+
+    it('should ignore zeros, non-numeric strings, and leading spaces', () => {
+        // This array contains only 9 valid leading digits.
+        const dirtyArray = [0, " 123", "abc", 2, 3, 4, 5, 6, 7, 8, 9, null, undefined];
+        expect(Optimization.Operators.benfordTest(dirtyArray)).toBe(0);
+    });
+
+    it('should return a very low score for a distribution that perfectly matches Benford\'s law', () => {
+        // Sample of 1000 numbers matching Benford's Law distribution
+        const benfordSample = [
+            ...Array(301).fill(100), // 301 numbers leading with 1
+            ...Array(176).fill(200), // 176 numbers leading with 2
+            ...Array(125).fill(300), // 125 numbers leading with 3
+            ...Array(97).fill(400),  // etc.
+            ...Array(79).fill(500),
+            ...Array(67).fill(600),
+            ...Array(58).fill(700),
+            ...Array(51).fill(800),
+            ...Array(46).fill(900),
+        ];
+
+        const score = Optimization.Operators.benfordTest(benfordSample);
+        // Score should be close to 0; tolerance used for floating point variance
+        expect(score).toBeLessThan(1e-9);
+    });
+
+    it('should return a high (suspect) score for a uniform distribution', () => {
+        // Uniform distribution is unnatural for this category of metrics
+        const uniformSample = [];
+        for (let i = 1; i <= 9; i++) {
+            for (let j = 0; j < 100; j++) {
+                uniformSample.push(i * 100 + j);
+            }
+        }
+
+        const score = Optimization.Operators.benfordTest(uniformSample);
+        // A score > 0.15 is considered suspicious
+        expect(score).toBeGreaterThan(0.15);
+    });
+
+    it('should return a high (suspect) score for a distribution skewed towards high digits', () => {
+        // Inverted Benford distribution: highly unnatural
+        const inverseBenfordSample = [
+            ...Array(46).fill(100),
+            ...Array(51).fill(200),
+            ...Array(58).fill(300),
+            ...Array(67).fill(400),
+            ...Array(79).fill(500),
+            ...Array(97).fill(600),
+            ...Array(125).fill(700),
+            ...Array(176).fill(800),
+            ...Array(301).fill(900),
+        ];
+
+        const score = Optimization.Operators.benfordTest(inverseBenfordSample);
+        expect(score).toBeGreaterThan(0.3); // Significantly elevated score expected
+    });
+
+    it('should handle real-world-like data (request timings)', () => {
+        // Simulates bot request intervals (uniform random between 500 and 1500ms)
+        const botTimings = Array.from({ length: 100 }, () => 500 + Math.random() * 1000);
+        const botScore = Optimization.Operators.benfordTest(botTimings);
+
+        // Simulates human timings (more short delays, few long pauses)
+        const humanTimings = [
+            123, 234, 180, 345, 150, 456, 110, 190, 210, 280, 567, 130, 890, 1200, 310, 160
+        ];
+        const humanScore = Optimization.Operators.benfordTest(humanTimings);
+
+        // Bot score should be significantly higher than human score
+        expect(botScore).toBeGreaterThan(0.1);
+        expect(humanScore).toBeLessThan(botScore);
+    });
+
 });

package/src/js/tests/obfuscation.test.js

@@ -1,13 +1,13 @@
 import { describe, expect, it } from 'vitest';
 import { __internal } from '../fingerprint.js';
 
-describe('Système de Polymorphisme et Compilateur d\'Obfuscation', () => {
+describe('Polymorphic System and Obfuscation Compiler', () => {
     
     it('should generate a valid session mapping with randomized headers and globals', () => {
         const mapping1 = __internal.generateSessionMapping();
         const mapping2 = __internal.generateSessionMapping();
 
-        // Vérification de la présence des structures attendues
+        // Verify expected mapping structure
         expect(mapping1).toBeDefined();
         expect(mapping1.headers).toHaveProperty('x-device-fingerprint');
         expect(mapping1.headers).toHaveProperty('x-behavior-metrics');
@@ -17,7 +17,7 @@ describe('Système de Polymorphisme et Compilateur d\'Obfuscation', () => {
         expect(mapping1.keys).toHaveProperty('ua');
         expect(mapping1.wasmConstants).toHaveProperty('seed');
 
-        // Vérification de l'aléa (deux sessions consécutives doivent avoir des mappings uniques)
+        // Verify randomness: two consecutive sessions must yield unique mappings
         expect(mapping1.headers['x-device-fingerprint']).not.toBe(mapping2.headers['x-device-fingerprint']);
         expect(mapping1.globals['ClientLibrary']).not.toBe(mapping2.globals['ClientLibrary']);
         expect(mapping1.keys['ua']).not.toBe(mapping2.keys['ua']);
@@ -27,22 +27,22 @@ describe('Système de Polymorphisme et Compilateur d\'Obfuscation', () => {
     it('should compile and obfuscate client script asynchronously using the obfuscation worker', async () => {
         const mapping = __internal.generateSessionMapping();
         
-        // On lance la compilation lourde qui instancie le Worker d'arrière-plan
+        // Run background worker obfuscation task
         const obfuscatedCode = await __internal.compilePolymorphicJs(mapping);
 
         expect(obfuscatedCode).toBeDefined();
         expect(typeof obfuscatedCode).toBe('string');
         expect(obfuscatedCode.length).toBeGreaterThan(0);
 
-        // Vérification que les placeholders originaux ont bien été purgés du code client final
+        // Verify original identifiers were rewritten in compiled client script
         expect(obfuscatedCode).not.toContain('X-Device-Fingerprint');
         expect(obfuscatedCode).not.toContain('X-Behavior-Metrics');
         expect(obfuscatedCode).not.toContain('ClientLibrary');
 
-        // Vérification que le code est minifié/obfusqué (ne contient pas de commentaires de développement par exemple)
+        // Verify code is obfuscated without plain dev comments
         expect(obfuscatedCode).not.toContain('// Nom trompeur aléatoire pour attirer les analyseurs');
         
-        // La structure globale de javascript-obfuscator génère typiquement un tableau de chaînes au début
+        // Obfuscator emits string array wrapper prefix
         expect(obfuscatedCode).toMatch(/_0x/);
-    }, 15000); // Augmentation du timeout à 15s car l'obfuscation via Worker thread consomme du CPU
+    }, 15000); // 15s timeout for CPU-intensive worker execution
 });

package/src/js/tests/quicFingerprint.test.js

@@ -43,4 +43,51 @@ describe('Protocol Anomaly Flow Profiling', () => {
         const score = getProtocolAnomalyScore(context);
         expect(score.protocolAnomalyScore).toBe(100.0);
     });
+
+    it('should detect RFC 9218 invalid urgency value out of range (u=9)', () => {
+        const context = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+                'x-quic-fp': '1;1=1572864,4=100;u=9,i'
+            }
+        };
+        const score = getProtocolAnomalyScore(context);
+        expect(score.quicAnomalyScore).toBeGreaterThanOrEqual(50.0);
+    });
+
+    it('should detect HTTP/2 flat dependency tree from Go net/http2 scraper', () => {
+        const context = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+                'x-http2-fingerprint': 's:1:65536,2:0,3:1000,4:6291456,6:262144|15663105|1:0:0:16|m,a,s,p|p:3,w:4,c:1'
+            },
+            httpVersion: '2.0'
+        };
+        const score = getProtocolAnomalyScore(context);
+        expect(score.http2AnomalyScore).toBeGreaterThanOrEqual(55.0);
+    });
+
+    it('should detect HTTP/2 self-dependency violation', () => {
+        const context = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+                'x-http2-fingerprint': 's:1:65536,2:0,3:1000,4:6291456,6:262144|15663105|3:0:3:256|m,a,s,p|p:3,w:4,c:1'
+            },
+            httpVersion: '2.0'
+        };
+        const score = getProtocolAnomalyScore(context);
+        expect(score.http2AnomalyScore).toBeGreaterThanOrEqual(60.0);
+    });
+
+    it('should detect scrapers with 0 dynamic table entries on repeated requests', () => {
+        const context = {
+            headers: {
+                'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+                'x-compression-info': 'req_count:5,dynamic_table_entries:0'
+            },
+            httpVersion: '2.0'
+        };
+        const score = getProtocolAnomalyScore(context);
+        expect(score.http2AnomalyScore).toBeGreaterThanOrEqual(45.0);
+    });
 });

package/src/js/tests/tcpFingerprint.test.js

@@ -5,7 +5,7 @@ const { parseTcpSyn, classifyTcpOs, getTcpAnomalyScore } = __internal;
 
 describe('Passive TCP/IP Fingerprinting (Type p0f)', () => {
     
-    // Mock d'un paquet IP + TCP SYN d'un système Linux (TTL=64, WS=7)
+    // Mock Linux IP + TCP SYN packet (TTL=64, WS=7)
     const mockLinuxSynPacket = Buffer.from([
         0x45, 0x00, 0x00, 0x3c, 0x1a, 0x2b, 0x40, 0x00, 
         0x40, 0x06, 0x3c, 0x1a, 0x7f, 0x00, 0x00, 0x01, // TTL=0x40 (64)
@@ -19,7 +19,7 @@ describe('Passive TCP/IP Fingerprinting (Type p0f)', () => {
         0x03, 0x03, 0x07        // Option WS: 7
     ]);
 
-    // Mock d'un paquet IP + TCP SYN d'un système Windows (TTL=128, WS=8)
+    // Mock Windows IP + TCP SYN packet (TTL=128, WS=8)
     const mockWindowsSynPacket = Buffer.from([
         0x45, 0x00, 0x00, 0x3c, 0x1a, 0x2b, 0x40, 0x00, 
         0x80, 0x06, 0x3c, 0x1a, 0x7f, 0x00, 0x00, 0x01, // TTL=0x80 (128)
@@ -57,7 +57,7 @@ describe('Passive TCP/IP Fingerprinting (Type p0f)', () => {
     });
 
     it('should calculate correct TCP/IP anomaly scores', () => {
-        // Cas 1 : Le User-Agent prétend être Windows, mais la pile TCP/IP est Linux
+        // Case 1: User-Agent claims Windows, but TCP/IP stack signature is Linux
         const contextAnomaly = {
             headers: {
                 'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0',
@@ -66,7 +66,7 @@ describe('Passive TCP/IP Fingerprinting (Type p0f)', () => {
         };
         expect(getTcpAnomalyScore(contextAnomaly).tcpAnomalyScore).toBe(80.1);
 
-        // Cas 2 : Cohérence complète (UA Windows et pile TCP/IP Windows)
+        // Case 2: Consistent stack (Windows UA and Windows TCP/IP stack)
         const contextCoherent = {
             headers: {
                 'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0',