@anonympins/fingerprint 0.7.5 → 0.8.0

package/src/js/tests/fingerprint.client.test.js

@@ -7,12 +7,12 @@ import ClientLibrary from '../fingerprint.client.js';
 
 describe('ClientLibrary WASM Integration', () => {
     beforeEach(() => {
-        // Réinitialise le cache et les mocks avant chaque test
+        // Reset cache and spies before each test
         ClientLibrary._resetCache();
         vi.spyOn(console, 'log').mockImplementation(() => {});
         vi.spyOn(console, 'warn').mockImplementation(() => {});
 
-        // Supprime les mocks globaux pour éviter les fuites entre les tests
+        // Remove global mocks to prevent leakage across tests
         delete window.createFingerprintModule;
     });
 
@@ -21,28 +21,27 @@ describe('ClientLibrary WASM Integration', () => {
     });
 
     it('should successfully load WASM module and switch hasher', async () => {
-        // 1. Simuler un module WASM fonctionnel
+        // 1. Mock functional WASM module
         const mockWasmModule = {
-            _hash_string: vi.fn((str) => 99999), // Un mock qui retourne une valeur distincte
+            _hash_string: vi.fn((str) => 99999), // Distinct mock hash value
             _malloc: vi.fn().mockReturnValue(0),
             HEAPU8: new Uint8Array(4096)
         };
 
-        // 2. Simuler le chargement du script et l'initialisation du module
-        // On attache les fonctions de simulation à `window` car c'est ce que le code cherche
+        // 2. Mock script loading and module factory
         window.createFingerprintModule = vi.fn().mockResolvedValue(mockWasmModule);
 
-        // On simule l'injection du script en appelant directement `onload`
+        // Mock script element injection with direct onload callback
         vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
-            // Simule le chargement réussi du script
+            // Simulate successful script load
             script.onload();
             return script;
         });
 
-        // 3. Appeler la fonction d'initialisation
+        // 3. Initialize WASM module
         await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
 
-        // 4. Vérifier que le hasher a été remplacé
+        // 4. Verify hasher was switched
         const wasmHash = ClientLibrary._hasher("test");
         expect(wasmHash).toBe(99999);
         expect(mockWasmModule._hash_string).toHaveBeenCalledWith(0);
@@ -50,16 +49,16 @@ describe('ClientLibrary WASM Integration', () => {
     });
 
     it('should gracefully fall back to JS hasher if WASM module fails to load', async () => {
-        // 1. Simuler un échec de chargement du script
+        // 1. Simulate script loading failure
         vi.spyOn(document.head, 'appendChild').mockImplementation((script) => {
             script.onerror(new Error('Script loading failed'));
             return script;
         });
 
-        // 2. Appeler la fonction d'initialisation
+        // 2. Initialize WASM module
         await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
 
-        // 3. Vérifier que le hasher est toujours l'implémentation JS
+        // 3. Verify hasher falls back to JS implementation
         const jsHash = ClientLibrary._hasher("test");
         const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("test");
         
@@ -68,7 +67,7 @@ describe('ClientLibrary WASM Integration', () => {
     });
 
     it('should gracefully fall back if WASM module does not export _hash_string', async () => {
-        // 1. Simuler un module WASM malformé (sans la fonction attendue)
+        // 1. Simulate malformed WASM module missing required export
         const mockWasmModule = {};
         window.createFingerprintModule = vi.fn().mockResolvedValue(mockWasmModule);
 
@@ -77,14 +76,14 @@ describe('ClientLibrary WASM Integration', () => {
             return script;
         });
 
-        // 2. Appeler la fonction d'initialisation
+        // 2. Initialize WASM module
         await ClientLibrary.initializeWasm('/fake/path/to/fp.js');
 
-        // 3. Vérifier le fallback
+        // 3. Verify fallback
         const jsHash = ClientLibrary._hasher("test");
         const originalJsHash = (await import('../fingerprint.builder.js')).cyrb53("test");
         expect(jsHash).toBe(originalJsHash); 
-        // L'assertion est maintenant plus précise : elle vérifie le message générique ET le message d'erreur spécifique.
+        // Verify both generic error log and specific missing export cause
         expect(console.warn).toHaveBeenCalledWith(
             expect.stringContaining('WASM module failed to load'), 
             expect.objectContaining({ message: 'WASM module did not export _hash_string.' })

package/src/js/tests/fingerprint.test.js

@@ -1621,18 +1621,6 @@ describe('Fingerprint & PoW Security Suite', () => {
             expect(behaviorScore).toBe(0);
         });
 
-        it('should return a score of 0 when x-behavior-metrics is 1 (human verified client-side)', () => {
-            const context = { headers: { 'x-behavior-metrics': '1' } };
-            const { behaviorScore } = getBehaviorScore(context);
-            expect(behaviorScore).toBe(0);
-        });
-
-        it('should return a score of 100 when x-behavior-metrics is 0 (bot detected client-side)', () => {
-            const context = { headers: { 'x-behavior-metrics': '0' } };
-            const { behaviorScore } = getBehaviorScore(context);
-            expect(behaviorScore).toBe(100);
-        });
-
         it('should return a score of 100 for honeypot interaction', () => {
             const metrics = { honeypotInteraction: true, mouseEntropy: 50, keystrokeLatency: 120 };
             const context = { headers: { 'x-behavior-metrics': JSON.stringify(metrics) } };
@@ -3199,6 +3187,25 @@ describe('IP Registration and Filtering', () => {
             expect(process.env.ED25519_PRIVATE_KEY).toBe(dummyKeys.privateKey);
             expect(process.env.ED25519_PUBLIC_KEY).toBe(dummyKeys.publicKey);
         });
+
+        it('should generate issuer PEM files directly via generateIssuerPemKeys', async () => {
+            const fs = await import('node:fs');
+            const os = await import('node:os');
+            const path = await import('node:path');
+            const tempDir = path.join(os.tmpdir(), `fp-issuer-keys-${Date.now()}`);
+
+            try {
+                const keys = fingerprint.generateIssuerPemKeys(tempDir);
+                expect(keys.privateKeyPath).toContain('issuer-private.pem');
+                expect(keys.publicKeyPath).toContain('issuer-public.pem');
+                expect(keys.privateKey).toContain('-----BEGIN PRIVATE KEY-----');
+                expect(keys.publicKey).toContain('-----BEGIN PUBLIC KEY-----');
+                expect(fs.existsSync(keys.privateKeyPath)).toBe(true);
+                expect(fs.existsSync(keys.publicKeyPath)).toBe(true);
+            } finally {
+                fs.rmSync(tempDir, { recursive: true, force: true });
+            }
+        });
     });
 
     describe('Closed-Shadow DOM Honeypot Traps (Feature 19)', () => {

package/src/js/tests/ja3AnomalyDetector.test.js

@@ -1,136 +1,135 @@
-import crypto from 'crypto';
-import {getTlsSpoofingScore, parseJa3} from '../fingerprint.js';
-import {vi} from 'vitest';
-import { verifyZkpProof, decodePolymorphicFingerprint, deepMerge, getHeaderSignature, parseJa3, modPow, hashNetwork, normalizeReferer, isPrivateIp, parseUserAgent } from "../../js/fingerprint.utils.js";
-
-describe('JA3 Anomaly Detector (Node.js)', () => {
-    
-    // Mock d'un store de cache asynchrone en mémoire
-    const createMockStore = () => {
-        const storage = {};
-        return {
-            get: vi.fn(async (key) => storage[key] || null),
-            set: vi.fn(async (key, val) => { storage[key] = val; })
-        };
-    };
-
-    describe('parseJa3', () => {
-        it('devrait parser correctement une chaine JA3 brute', () => {
-            const rawJa3 = '771,4865-4866-4867,0-23-65281-10-11,29-23-24,0';
-            const parsed = parseJa3(rawJa3);
-            
-            expect(parsed).not.toBeNull();
-            expect(parsed.tlsVersion).toBe(771);
-            expect(parsed.ciphers).toEqual([4865, 4866, 4867]);
-            expect(parsed.extensions).toEqual([0, 23, 65281, 10, 11]);
-        });
-
-        it('devrait retourner null pour des chaines invalides', () => {
-            expect(parseJa3('')).toBeNull();
-            expect(parseJa3('771,4865')).toBeNull();
-        });
-    });
-
-    describe('getTlsSpoofingScore (Anomalies JA3 hachées)', () => {
-        it('devrait détecter l\'usurpation d\'identité d\'une bibliothèque (Python)', async () => {
-            const pythonJa3Hash = '47344a349b75c4e82333475553b5f358';
-            const chromeUa = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0';
-
-            const context = {
-                headers: {
-                    'user-agent': chromeUa,
-                    'x-ja3-hash': pythonJa3Hash
-                }
-            };
-
-            const result = await getTlsSpoofingScore(context);
-            expect(result.tlsSpoofingScore).toBe(90);
-        });
-
-        it('devrait détecter la rotation d\'User-Agent sur un même hash JA3 (Stagnation)', async () => {
-            const mockStore = createMockStore();
-            const unknownJa3 = '00000000000000000000000000000000';
-            
-            const contextChrome = {
-                headers: {
-                    'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0',
-                    'x-ja3-hash': unknownJa3
-                }
-            };
-
-            const contextFirefox = {
-                headers: {
-                    'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/120.0',
-                    'x-ja3-hash': unknownJa3
-                }
-            };
-
-            // Injecter le mockStore dans le module de test si nécessaire ou mocker l'importation du store global
-            // Premier passage : Chrome
-            const res1 = await getTlsSpoofingScore(contextChrome, mockStore);
-            
-            // Deuxième passage : Firefox (Détection de la rotation de UA)
-            const res2 = await getTlsSpoofingScore(contextFirefox, mockStore);
-            expect(res2.tlsSpoofingScore).toBe(85);
-        });
-    });
-
-    describe('getTlsSpoofingScore (Anomalies JA3 brutes)', () => {
-        it('devrait suspecter un faux Chrome n\'utilisant pas le mécanisme GREASE', async () => {
-            const chromeUa = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0';
-            // Pas de valeurs GREASE dans la suite
-            const ja3RawNoGrease = '771,4865-4866,0-23-10,29,0';
-            const ja3Hash = crypto.createHash('md5').update(ja3RawNoGrease).digest('hex');
-
-            const context = {
-                headers: {
-                    'user-agent': chromeUa,
-                    'x-ja3-raw': ja3RawNoGrease,
-                    'x-ja3-hash': ja3Hash
-                },
-                httpVersion: '2.0'
-            };
-
-            const result = await getTlsSpoofingScore(context);
-            expect(result.tlsSpoofingScore).toBe(75);
-        });
-
-        it('devrait valider un Chrome légitime utilisant des valeurs GREASE', async () => {
-            const chromeUa = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0';
-            // 2570 est une suite GREASE valide
-            const ja3RawWithGrease = '771,4865-2570,0-23-10-16,29,0';
-            const ja3Hash = crypto.createHash('md5').update(ja3RawWithGrease).digest('hex');
-
-            const context = {
-                headers: {
-                    'user-agent': chromeUa,
-                    'x-ja3-raw': ja3RawWithGrease,
-                    'x-ja3-hash': ja3Hash
-                },
-                httpVersion: '2.0'
-            };
-
-            const result = await getTlsSpoofingScore(context);
-            expect(result.tlsSpoofingScore).toBeLessThan(70);
-        });
-
-        it('devrait détecter l\'absence d\'extension ALPN pour une connexion HTTP/2', async () => {
-            const chromeUa = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0';
-            // Pas d'extension 16 (ALPN)
-            const ja3RawNoAlpn = '771,4865-2570,0-23-10,29,0';
-            const ja3Hash = crypto.createHash('md5').update(ja3RawNoAlpn).digest('hex');
-
-            const context = {
-                headers: {
-                    'user-agent': chromeUa,
-                    'x-ja3-raw': ja3RawNoAlpn,
-                    'x-ja3-hash': ja3Hash
-                },
-                httpVersion: '2.0'
-            };
-
-            const result = await getTlsSpoofingScore(context);
-            expect(result.tlsSpoofingScore).toBe(70);
-        });
-    });
-});
+import crypto from 'crypto';
+import {getTlsSpoofingScore, parseJa3} from '../fingerprint.js';
+import {vi} from 'vitest';
+import { verifyZkpProof, decodePolymorphicFingerprint, deepMerge, getHeaderSignature, parseJa3, modPow, hashNetwork, normalizeReferer, isPrivateIp, parseUserAgent } from "../../js/fingerprint.utils.js";
+
+describe('JA3 Anomaly Detector (Node.js)', () => {
+    
+    // Mock async in-memory cache store
+    const createMockStore = () => {
+        const storage = {};
+        return {
+            get: vi.fn(async (key) => storage[key] || null),
+            set: vi.fn(async (key, val) => { storage[key] = val; })
+        };
+    };
+
+    describe('parseJa3', () => {
+        it('should correctly parse raw JA3 string', () => {
+            const rawJa3 = '771,4865-4866-4867,0-23-65281-10-11,29-23-24,0';
+            const parsed = parseJa3(rawJa3);
+            
+            expect(parsed).not.toBeNull();
+            expect(parsed.tlsVersion).toBe(771);
+            expect(parsed.ciphers).toEqual([4865, 4866, 4867]);
+            expect(parsed.extensions).toEqual([0, 23, 65281, 10, 11]);
+        });
+
+        it('should return null for invalid strings', () => {
+            expect(parseJa3('')).toBeNull();
+            expect(parseJa3('771,4865')).toBeNull();
+        });
+    });
+
+    describe('getTlsSpoofingScore (Anomalies JA3 hachées)', () => {
+        it('should detect library spoofing (Python)', async () => {
+            const pythonJa3Hash = '47344a349b75c4e82333475553b5f358';
+            const chromeUa = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0';
+
+            const context = {
+                headers: {
+                    'user-agent': chromeUa,
+                    'x-ja3-hash': pythonJa3Hash
+                }
+            };
+
+            const result = await getTlsSpoofingScore(context);
+            expect(result.tlsSpoofingScore).toBe(90);
+        });
+
+        it('should detect User-Agent rotation on identical JA3 hash (Stagnation)', async () => {
+            const mockStore = createMockStore();
+            const unknownJa3 = '00000000000000000000000000000000';
+            
+            const contextChrome = {
+                headers: {
+                    'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0',
+                    'x-ja3-hash': unknownJa3
+                }
+            };
+
+            const contextFirefox = {
+                headers: {
+                    'user-agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Firefox/120.0',
+                    'x-ja3-hash': unknownJa3
+                }
+            };
+
+            // First call: Chrome
+            const res1 = await getTlsSpoofingScore(contextChrome, mockStore);
+            
+            // Second call: Firefox (Detects UA rotation)
+            const res2 = await getTlsSpoofingScore(contextFirefox, mockStore);
+            expect(res2.tlsSpoofingScore).toBe(85);
+        });
+    });
+
+    describe('getTlsSpoofingScore (Anomalies JA3 brutes)', () => {
+        it('should flag fake Chrome lacking GREASE values', async () => {
+            const chromeUa = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0';
+            // No GREASE values in ciphers/extensions
+            const ja3RawNoGrease = '771,4865-4866,0-23-10,29,0';
+            const ja3Hash = crypto.createHash('md5').update(ja3RawNoGrease).digest('hex');
+
+            const context = {
+                headers: {
+                    'user-agent': chromeUa,
+                    'x-ja3-raw': ja3RawNoGrease,
+                    'x-ja3-hash': ja3Hash
+                },
+                httpVersion: '2.0'
+            };
+
+            const result = await getTlsSpoofingScore(context);
+            expect(result.tlsSpoofingScore).toBe(75);
+        });
+
+        it('should validate legitimate Chrome using GREASE values', async () => {
+            const chromeUa = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0';
+            // 2570 is a valid GREASE value
+            const ja3RawWithGrease = '771,4865-2570,0-23-10-16,29,0';
+            const ja3Hash = crypto.createHash('md5').update(ja3RawWithGrease).digest('hex');
+
+            const context = {
+                headers: {
+                    'user-agent': chromeUa,
+                    'x-ja3-raw': ja3RawWithGrease,
+                    'x-ja3-hash': ja3Hash
+                },
+                httpVersion: '2.0'
+            };
+
+            const result = await getTlsSpoofingScore(context);
+            expect(result.tlsSpoofingScore).toBeLessThan(70);
+        });
+
+        it('should detect missing ALPN extension on HTTP/2 connections', async () => {
+            const chromeUa = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0';
+            // Missing extension 16 (ALPN)
+            const ja3RawNoAlpn = '771,4865-2570,0-23-10,29,0';
+            const ja3Hash = crypto.createHash('md5').update(ja3RawNoAlpn).digest('hex');
+
+            const context = {
+                headers: {
+                    'user-agent': chromeUa,
+                    'x-ja3-raw': ja3RawNoAlpn,
+                    'x-ja3-hash': ja3Hash
+                },
+                httpVersion: '2.0'
+            };
+
+            const result = await getTlsSpoofingScore(context);
+            expect(result.tlsSpoofingScore).toBe(70);
+        });
+    });
+});

package/src/js/tests/library.test.js

@@ -1,96 +1,95 @@
-import {describe, expect, it} from 'vitest';
-import {Optimization} from '../library.js';
-
-describe('Optimization.Operators.benfordTest', () => {
-
-    it('should return 0 for non-array inputs', () => {
-        expect(Optimization.Operators.benfordTest("12345")).toBe(0);
-        expect(Optimization.Operators.benfordTest(null)).toBe(0);
-        expect(Optimization.Operators.benfordTest(undefined)).toBe(0);
-        expect(Optimization.Operators.benfordTest({ a: 1 })).toBe(0);
-    });
-
-    it('should return 0 for arrays with less than 10 valid numbers', () => {
-        const smallArray = [1, 2, 3, 4, 5, 6, 7, 8, 9];
-        expect(Optimization.Operators.benfordTest(smallArray)).toBe(0);
-    });
-
-    it('should return 0 for an empty array', () => {
-        expect(Optimization.Operators.benfordTest([])).toBe(0);
-    });
-
-    it('should ignore zeros, non-numeric strings, and leading spaces', () => {
-        // This array contains only 9 valid leading digits.
-        const dirtyArray = [0, " 123", "abc", 2, 3, 4, 5, 6, 7, 8, 9, null, undefined];
-        expect(Optimization.Operators.benfordTest(dirtyArray)).toBe(0);
-    });
-
-    it('should return a very low score for a distribution that perfectly matches Benford\'s law', () => {
-        // Création d'un échantillon de 1000 nombres qui suit la loi de Benford
-        const benfordSample = [
-            ...Array(301).fill(100), // 301 nombres commençant par 1
-            ...Array(176).fill(200), // 176 nombres commençant par 2
-            ...Array(125).fill(300), // 125 nombres commençant par 3
-            ...Array(97).fill(400),  // etc.
-            ...Array(79).fill(500),
-            ...Array(67).fill(600),
-            ...Array(58).fill(700),
-            ...Array(51).fill(800),
-            ...Array(46).fill(900),
-        ];
-
-        const score = Optimization.Operators.benfordTest(benfordSample);
-        // Le score devrait être très proche de 0. On utilise toBeLessThan pour tolérer les imprécisions de calcul.
-        expect(score).toBeLessThan(1e-9);
-    });
-
-    it('should return a high (suspect) score for a uniform distribution', () => {
-        // Une distribution uniforme est très peu naturelle pour ce genre de données.
-        const uniformSample = [];
-        for (let i = 1; i <= 9; i++) {
-            for (let j = 0; j < 100; j++) {
-                uniformSample.push(i * 100 + j);
-            }
-        }
-
-        const score = Optimization.Operators.benfordTest(uniformSample);
-        // Un score > 0.15 est considéré comme suspect.
-        expect(score).toBeGreaterThan(0.15);
-    });
-
-    it('should return a high (suspect) score for a distribution skewed towards high digits', () => {
-        // L'inverse de la loi de Benford, très suspect.
-        const inverseBenfordSample = [
-            ...Array(46).fill(100),
-            ...Array(51).fill(200),
-            ...Array(58).fill(300),
-            ...Array(67).fill(400),
-            ...Array(79).fill(500),
-            ...Array(97).fill(600),
-            ...Array(125).fill(700),
-            ...Array(176).fill(800),
-            ...Array(301).fill(900),
-        ];
-
-        const score = Optimization.Operators.benfordTest(inverseBenfordSample);
-        expect(score).toBeGreaterThan(0.3); // Score attendu encore plus élevé
-    });
-
-    it('should handle real-world-like data (request timings)', () => {
-        // Simule des délais de requêtes générés par un bot (ex: aléatoire uniforme entre 500 et 1500ms)
-        const botTimings = Array.from({ length: 100 }, () => 500 + Math.random() * 1000);
-        const botScore = Optimization.Operators.benfordTest(botTimings);
-
-        // Simule des délais humains (plus de petits délais, quelques longs délais)
-        const humanTimings = [
-            123, 234, 180, 345, 150, 456, 110, 190, 210, 280, 567, 130, 890, 1200, 310, 160
-        ];
-        const humanScore = Optimization.Operators.benfordTest(humanTimings);
-
-        // Le score du bot devrait être significativement plus élevé que celui de l'humain.
-        // Les valeurs exactes peuvent varier, mais la tendance doit être claire.
-        expect(botScore).toBeGreaterThan(0.1);
-        expect(humanScore).toBeLessThan(botScore);
-    });
-
+import {describe, expect, it} from 'vitest';
+import {Optimization} from '../library.js';
+
+describe('Optimization.Operators.benfordTest', () => {
+
+    it('should return 0 for non-array inputs', () => {
+        expect(Optimization.Operators.benfordTest("12345")).toBe(0);
+        expect(Optimization.Operators.benfordTest(null)).toBe(0);
+        expect(Optimization.Operators.benfordTest(undefined)).toBe(0);
+        expect(Optimization.Operators.benfordTest({ a: 1 })).toBe(0);
+    });
+
+    it('should return 0 for arrays with less than 10 valid numbers', () => {
+        const smallArray = [1, 2, 3, 4, 5, 6, 7, 8, 9];
+        expect(Optimization.Operators.benfordTest(smallArray)).toBe(0);
+    });
+
+    it('should return 0 for an empty array', () => {
+        expect(Optimization.Operators.benfordTest([])).toBe(0);
+    });
+
+    it('should ignore zeros, non-numeric strings, and leading spaces', () => {
+        // This array contains only 9 valid leading digits.
+        const dirtyArray = [0, " 123", "abc", 2, 3, 4, 5, 6, 7, 8, 9, null, undefined];
+        expect(Optimization.Operators.benfordTest(dirtyArray)).toBe(0);
+    });
+
+    it('should return a very low score for a distribution that perfectly matches Benford\'s law', () => {
+        // Sample of 1000 numbers matching Benford's Law distribution
+        const benfordSample = [
+            ...Array(301).fill(100), // 301 numbers leading with 1
+            ...Array(176).fill(200), // 176 numbers leading with 2
+            ...Array(125).fill(300), // 125 numbers leading with 3
+            ...Array(97).fill(400),  // etc.
+            ...Array(79).fill(500),
+            ...Array(67).fill(600),
+            ...Array(58).fill(700),
+            ...Array(51).fill(800),
+            ...Array(46).fill(900),
+        ];
+
+        const score = Optimization.Operators.benfordTest(benfordSample);
+        // Score should be close to 0; tolerance used for floating point variance
+        expect(score).toBeLessThan(1e-9);
+    });
+
+    it('should return a high (suspect) score for a uniform distribution', () => {
+        // Uniform distribution is unnatural for this category of metrics
+        const uniformSample = [];
+        for (let i = 1; i <= 9; i++) {
+            for (let j = 0; j < 100; j++) {
+                uniformSample.push(i * 100 + j);
+            }
+        }
+
+        const score = Optimization.Operators.benfordTest(uniformSample);
+        // A score > 0.15 is considered suspicious
+        expect(score).toBeGreaterThan(0.15);
+    });
+
+    it('should return a high (suspect) score for a distribution skewed towards high digits', () => {
+        // Inverted Benford distribution: highly unnatural
+        const inverseBenfordSample = [
+            ...Array(46).fill(100),
+            ...Array(51).fill(200),
+            ...Array(58).fill(300),
+            ...Array(67).fill(400),
+            ...Array(79).fill(500),
+            ...Array(97).fill(600),
+            ...Array(125).fill(700),
+            ...Array(176).fill(800),
+            ...Array(301).fill(900),
+        ];
+
+        const score = Optimization.Operators.benfordTest(inverseBenfordSample);
+        expect(score).toBeGreaterThan(0.3); // Significantly elevated score expected
+    });
+
+    it('should handle real-world-like data (request timings)', () => {
+        // Simulates bot request intervals (uniform random between 500 and 1500ms)
+        const botTimings = Array.from({ length: 100 }, () => 500 + Math.random() * 1000);
+        const botScore = Optimization.Operators.benfordTest(botTimings);
+
+        // Simulates human timings (more short delays, few long pauses)
+        const humanTimings = [
+            123, 234, 180, 345, 150, 456, 110, 190, 210, 280, 567, 130, 890, 1200, 310, 160
+        ];
+        const humanScore = Optimization.Operators.benfordTest(humanTimings);
+
+        // Bot score should be significantly higher than human score
+        expect(botScore).toBeGreaterThan(0.1);
+        expect(humanScore).toBeLessThan(botScore);
+    });
+
 });