图灵盾与反爬#

public class AccessFrequencyAnalyzer {
    
    private final SlidingWindowCounter counter;
    
    public FrequencyMetrics analyze(String clientId, RequestContext context) {
        String ip = context.getIp();
        String userId = context.getUserId();
        
        // 统计各种维度的访问频率
        long ipRequestCount = counter.getCount("ip:" + ip, Duration.ofMinutes(1));
        long userRequestCount = counter.getCount("user:" + userId, Duration.ofMinutes(1));
        long endpointRequestCount = counter.getCount(
            "endpoint:" + context.getPath(), Duration.ofMinutes(1));
        
        // 计算访问模式特征
        double ipRequestRate = ipRequestCount / 60.0;  // 每秒请求数
        double burstiness = calculateBurstiness(ip);   // 突发性
        double periodicity = calculatePeriodicity(ip); // 周期性
        
        return FrequencyMetrics.builder()
            .ipRequestRate(ipRequestRate)
            .userRequestRate(userRequestCount / 60.0)
            .endpointRequestRate(endpointRequestCount / 60.0)
            .burstiness(burstiness)
            .periodicity(periodicity)
            .build();
    }
    
    // 突发性：短时间内请求密度
    private double calculateBurstiness(String ip) {
        long currentSecond = counter.getCount("ip:" + ip, Duration.ofSeconds(1));
        long currentMinute = counter.getCount("ip:" + ip, Duration.ofMinutes(1));
        
        if (currentMinute == 0) return 0;
        // 突发比 = 秒级密度 / 分钟级密度
        return (currentSecond * 60.0) / currentMinute;
    }
    
    // 周期性：请求间隔的规律性（Bot 通常间隔固定）
    private double calculatePeriodicity(String ip) {
        List<Long> intervals = getRecentIntervals(ip, 100);
        if (intervals.size() < 10) return 0;
        
        // 计算间隔的标准差
        double mean = intervals.stream().mapToLong(Long::longValue).average().orElse(0);
        double variance = intervals.stream()
            .mapToDouble(i -> Math.pow(i - mean, 2))
            .average().orElse(0);
        double stdDev = Math.sqrt(variance);
        
        // 标准差越小，周期性越强（Bot 特征）
        // 归一化：标准差/均值，值越小说明越规律
        return mean > 0 ? stdDev / mean : 1;
    }
    
    public RiskLevel assessRisk(FrequencyMetrics metrics) {
        // 综合评分
        double score = 0;
        
        if (metrics.getIpRequestRate() > 10) score += 30;
        else if (metrics.getIpRequestRate() > 5) score += 15;
        
        if (metrics.getBurstiness() > 0.8) score += 20;
        
        if (metrics.getPeriodicity() < 0.2) score += 25; // 太规律
        
        if (metrics.getUserRequestRate() > 100) score += 25;
        
        if (score >= 70) return RiskLevel.HIGH;
        if (score >= 40) return RiskLevel.MEDIUM;
        return RiskLevel.LOW;
    }
}

public class MouseTrajectoryAnalyzer {
    
    public TrajectoryFeatures extract(List<MouseEvent> events) {
        if (events.size() < 10) {
            return TrajectoryFeatures.builder()
                .valid(false)
                .build();
        }
        
        // 1. 计算轨迹的总长度
        double totalDistance = calculateTotalDistance(events);
        
        // 2. 计算轨迹的直线距离（起点到终点）
        double directDistance = calculateDirectDistance(events);
        
        // 3. 计算效率比（直线距离/总长度）
        // 人类轨迹通常效率较低（有很多无效移动）
        double efficiency = directDistance / totalDistance;
        
        // 4. 计算速度变化
        double speedVariation = calculateSpeedVariation(events);
        
        // 5. 计算角度变化（方向改变的频率）
        double angleVariation = calculateAngleVariation(events);
        
        return TrajectoryFeatures.builder()
            .valid(true)
            .totalDistance(totalDistance)
            .directDistance(directDistance)
            .efficiency(efficiency)
            .speedVariation(speedVariation)
            .angleVariation(angleVariation)
            .build();
    }
    
    // Bot 特征：
    // - 效率过高（几乎是直线）
    // - 速度恒定
    // - 几乎没有角度变化
    public RiskLevel assessRisk(TrajectoryFeatures features) {
        if (!features.isValid()) {
            return RiskLevel.UNKNOWN;
        }
        
        double score = 0;
        
        // 效率过高（>0.9通常是 Bot）
        if (features.getEfficiency() > 0.9) score += 30;
        else if (features.getEfficiency() > 0.8) score += 15;
        
        // 速度过于恒定
        if (features.getSpeedVariation() < 0.1) score += 25;
        
        // 角度变化少
        if (features.getAngleVariation() < 0.2) score += 20;
        
        // 移动距离过短
        if (features.getTotalDistance() < 100) score += 25;
        
        if (score >= 60) return RiskLevel.HIGH;
        if (score >= 30) return RiskLevel.MEDIUM;
        return RiskLevel.LOW;
    }
}

public class ClickPatternAnalyzer {
    
    public ClickMetrics analyze(String userId, List<ClickEvent> clicks) {
        // 统计点击间隔
        List<Long> intervals = calculateIntervals(clicks);
        
        // 计算点击速度的一致性
        double speedConsistency = calculateConsistency(intervals);
        
        // 检测是否总是点击相同位置
        double positionVariance = calculatePositionVariance(clicks);
        
        // 检测是否按固定顺序点击
        double sequencePattern = calculateSequencePattern(clicks);
        
        return ClickMetrics.builder()
            .clickCount(clicks.size())
            .speedConsistency(speedConsistency)    // Bot 速度一致
            .positionVariance(positionVariance)    // Bot 位置固定
            .sequencePattern(sequencePattern)      // Bot 有固定顺序
            .build();
    }
    
    // 检测可疑的固定点击模式
    private double calculateSequencePattern(List<ClickEvent> clicks) {
        // 记录点击的 DOM 路径序列
        List<String> paths = clicks.stream()
            .map(ClickEvent::getDomPath)
            .toList();
        
        // 计算序列的熵
        // 熵越低，序列越规律（Bot 特征）
        return calculateEntropy(paths);
    }
}

public class DeviceFingerprint {
    
    public String generateFingerprint(HttpRequest request, 
                                    ClientScriptData scriptData) {
        List<String> components = new ArrayList<>();
        
        // 1. User-Agent
        components.add(request.getHeader("User-Agent"));
        
        // 2. Canvas 指纹
        components.add(scriptData.getCanvasHash());
        
        // 3. WebGL 渲染器指纹
        components.add(scriptData.getWebglRenderer());
        
        // 4. 屏幕分辨率
        components.add(scriptData.getScreenResolution());
        
        // 5. 时区
        components.add(scriptData.getTimezone());
        
        // 6. 语言设置
        components.add(request.getHeader("Accept-Language"));
        
        // 7. 平台信息
        components.add(scriptData.getPlatform());
        
        // 8. 插件列表
        components.add(scriptData.getPlugins());
        
        // 9. WebRTC 本地 IP（如果有）
        components.add(scriptData.getWebrtcLocalIp());
        
        // 计算组合指纹
        return sha256(String.join("|", components));
    }
    
    // 同一指纹的访问频率
    public boolean isSuspicious(String fingerprint, Duration window) {
        long count = cache.get("fp:" + fingerprint, window);
        return count > 10; // 超过10次可能是共享指纹或爬虫
    }
}

public class SlidingCaptchaService {
    
    private final FingerprintService fingerprintService;
    private final TrajectoryAnalyzer trajectoryAnalyzer;
    private final ImageProcessor imageProcessor;
    
    public CaptchaChallenge generateChallenge() {
        // 随机选择背景图和缺口位置
        String backgroundImage = imageLibrary.randomBackground();
        Point gapPosition = randomGapPosition();
        
        // 生成带缺口的图片
        String captchaImage = imageProcessor.addGap(
            backgroundImage, gapPosition);
        
        // 生成唯一挑战 ID
        String challengeId = UUID.randomUUID().toString();
        
        // 存储挑战信息（带过期时间）
        cache.put(challengeId, new CaptchaChallenge(
            backgroundImage, gapPosition, Instant.now().plusSeconds(300)
        ));
        
        return new CaptchaChallenge(
            challengeId, captchaImage, gapPosition
        );
    }
    
    public VerificationResult verify(String challengeId, 
                                     Point sliderPosition,
                                     List<Point> trajectory,
                                     ClientData clientData) {
        CaptchaChallenge challenge = cache.get(challengeId);
        if (challenge == null || challenge.isExpired()) {
            return VerificationResult.EXPIRED;
        }
        
        // 1. 验证滑块位置
        double positionDiff = calculateDistance(
            sliderPosition, challenge.getGapPosition());
        if (positionDiff > MAX_POSITION_TOLERANCE) {
            return VerificationResult.POSITION_MISMATCH;
        }
        
        // 2. 验证轨迹
        TrajectoryFeatures features = trajectoryAnalyzer.extract(trajectory);
        RiskLevel trajectoryRisk = trajectoryAnalyzer.assessRisk(features);
        
        if (trajectoryRisk == RiskLevel.HIGH) {
            return VerificationResult.SUSPICIOUS_TRAJECTORY;
        }
        
        // 3. 验证设备指纹
        String fingerprint = fingerprintService.generate(clientData);
        RiskLevel fingerprintRisk = fingerprintService.assessRisk(fingerprint);
        
        if (fingerprintRisk == RiskLevel.HIGH) {
            return VerificationResult.SUSPICIOUS_DEVICE;
        }
        
        // 4. 综合评分
        double totalScore = calculateTotalScore(
            positionDiff, features, fingerprintRisk);
        
        if (totalScore < PASS_THRESHOLD) {
            return VerificationResult.FAILED;
        }
        
        // 生成验证通过凭证
        String token = generateToken(challengeId, fingerprint);
        return VerificationResult.success(token);
    }
}

public class RiskBasedCaptchaService {
    
    private final BehaviorAnalyzer behaviorAnalyzer;
    private final CaptchaChallengeGenerator captchaGenerator;
    
    public CaptchaResponse evaluate(HttpRequest request, 
                                   ClientData clientData,
                                   UserContext userContext) {
        // 1. 计算基础风险分
        double baseRiskScore = calculateBaseRiskScore(
            request, clientData, userContext);
        
        // 2. 行为分析风险
        double behaviorRiskScore = behaviorAnalyzer.analyze(clientData);
        
        // 3. 综合评分
        double totalScore = baseRiskScore * 0.4 + behaviorRiskScore * 0.6;
        
        // 4. 根据风险等级决定行动
        if (totalScore < LOW_RISK_THRESHOLD) {
            // 无感知通过
            return CaptchaResponse.pass();
        }
        
        if (totalScore < MEDIUM_RISK_THRESHOLD) {
            // 中风险：轻量级验证
            CaptchaChallenge challenge = captchaGenerator.generateLightweight();
            return CaptchaResponse.challenge(challenge);
        }
        
        // 高风险：强验证
        CaptchaChallenge challenge = captchaGenerator.generateStrong();
        return CaptchaResponse.challenge(challenge);
    }
    
    private double calculateBaseRiskScore(HttpRequest request,
                                         ClientData clientData,
                                         UserContext userContext) {
        double score = 0;
        
        // IP 风险
        if (ipReputationService.isSuspicious(request.getClientIp())) {
            score += 30;
        }
        
        // 新设备
        if (!deviceRepository.isKnownDevice(clientData.getFingerprint())) {
            score += 20;
        }
        
        // 异地登录
        if (userContext.hasUnusualLocation()) {
            score += 25;
        }
        
        // 短时间内的验证失败
        if (hasRecentFailures(request.getClientIp())) {
            score += 30;
        }
        
        return Math.min(score, 100);
    }
}

public class DynamicChallengeManager {
    
    private final RiskEvaluator riskEvaluator;
    private final ChallengeGenerator challengeGenerator;
    private final TrustScoreManager trustScoreManager;
    
    public ChallengeDecision decide(HttpRequest request, 
                                   ClientData clientData) {
        String fingerprint = clientData.getFingerprint();
        
        // 1. 获取设备信任分
        double trustScore = trustScoreManager.getTrustScore(fingerprint);
        
        // 2. 计算当前风险分
        double riskScore = riskEvaluator.evaluate(request, clientData);
        
        // 3. 动态调整阈值
        ChallengeThresholds thresholds = calculateThresholds(trustScore);
        
        // 4. 做出决策
        if (riskScore < thresholds.getLowRiskThreshold()) {
            return ChallengeDecision.pass();
        }
        
        if (riskScore < thresholds.getMediumRiskThreshold()) {
            Challenge challenge = challengeGenerator.generateLight(challenge);
            return ChallengeDecision.challenge(challenge);
        }
        
        Challenge challenge = challengeGenerator.generateStrong();
        return ChallengeDecision.challenge(challenge);
    }
    
    // 信任分高的设备，阈值更宽松
    private ChallengeThresholds calculateThresholds(double trustScore) {
        double lowThreshold = 30 - (trustScore * 0.1); // 信任分越高，阈值越低
        double mediumThreshold = 70 - (trustScore * 0.2);
        
        return new ChallengeThresholds(
            Math.max(10, lowThreshold),
            Math.max(40, mediumThreshold)
        );
    }
}

public class AutomationDetector {
    
    public AutomationFeatures detect(ClientData clientData) {
        List<String> indicators = new ArrayList<>();
        
        // 1. 检测自动化框架特征
        if (clientData.hasWebDriver()) {
            indicators.add("webdriver_detected");
        }
        
        // 2. 检测模拟浏览器特征
        if (clientData.isLikelyAutomated()) {
            indicators.add("automation_likely");
        }
        
        // 3. 检测不常见的浏览器属性
        List<String> uncommonProperties = detectUncommonProperties(clientData);
        if (!uncommonProperties.isEmpty()) {
            indicators.add("uncommon_properties:" + uncommonProperties);
        }
        
        // 4. 检测自动化相关事件
        if (clientData.hasAutomationEvents()) {
            indicators.add("automation_events");
        }
        
        return AutomationFeatures.builder()
            .indicators(indicators)
            .automationScore(calculateScore(indicators))
            .build();
    }
}