Bot Detection and Mitigation Overview

// Advanced browser fingerprinting service
interface BrowserFingerprint {
  canvas: string
  webgl: string
  fonts: string[]
  plugins: string[]
  screen: {
    width: number
    height: number
    colorDepth: number
    pixelRatio: number
  }
  timezone: string
  language: string
  platform: string
  cookieEnabled: boolean
  doNotTrack?: string
  hardwareConcurrency?: number
  deviceMemory?: number
}

class FingerprintCollector {
  async collectFingerprint(): Promise<BrowserFingerprint> {
    const fingerprint: BrowserFingerprint = {
      canvas: await this.getCanvasFingerprint(),
      webgl: await this.getWebGLFingerprint(),
      fonts: await this.getFontList(),
      plugins: await this.getPluginList(),
      screen: this.getScreenInfo(),
      timezone: Intl.DateTimeFormat().resolvedOptions().timeZone,
      language: navigator.language,
      platform: navigator.platform,
      cookieEnabled: navigator.cookieEnabled,
      doNotTrack: navigator.doNotTrack || undefined,
      hardwareConcurrency: navigator.hardwareConcurrency,
      deviceMemory: (navigator as any).deviceMemory
    }

    return fingerprint
  }

  private async getCanvasFingerprint(): Promise<string> {
    const canvas = document.createElement('canvas')
    const ctx = canvas.getContext('2d')!

    // Draw a complex pattern
    canvas.width = 280
    canvas.height = 60

    ctx.textBaseline = 'top'
    ctx.font = '14px Arial'
    ctx.fillStyle = '#f60'
    ctx.fillRect(125, 1, 62, 20)
    ctx.fillStyle = '#069'
    ctx.fillText('🎯 Browser Fingerprint', 2, 15)
    ctx.fillStyle = 'rgba(102, 204, 0, 0.7)'
    ctx.fillText('Canvas Test String', 4, 35)

    // Add noise
    for (let i = 0; i < 50; i++) {
      ctx.fillStyle = `rgba(${Math.floor(Math.random() * 255)}, ${Math.floor(Math.random() * 255)}, ${Math.floor(Math.random() * 255)}, 0.5)`
      ctx.fillRect(Math.random() * 280, Math.random() * 60, 1, 1)
    }

    return canvas.toDataURL()
  }

  private async getWebGLFingerprint(): Promise<string> {
    const canvas = document.createElement('canvas')
    const gl = canvas.getContext('webgl') || canvas.getContext('experimental-webgl')

    if (!gl) return 'no-webgl'

    const debugInfo = gl.getExtension('WEBGL_debug_renderer_info')
    const vendor = debugInfo ? gl.getParameter(debugInfo.UNMASKED_VENDOR_WEBGL) : 'unknown'
    const renderer = debugInfo ? gl.getParameter(debugInfo.UNMASKED_RENDERER_WEBGL) : 'unknown'

    return `${vendor}-${renderer}`
  }

  private async getFontList(): Promise<string[]> {
    const baseFonts = ['Arial', 'Courier New', 'Georgia', 'Times New Roman', 'Verdana']
    const testString = 'mmmmmmmmmmlli'
    const testSize = '72px'
    const h = document.getElementsByTagName('body')[0]

    const defaultWidth: Record<string, number> = {}
    const defaultHeight: Record<string, number> = {}

    // Measure base fonts first
    for (const font of baseFonts) {
      const span = document.createElement('span')
      span.style.fontSize = testSize
      span.style.fontFamily = font
      span.innerHTML = testString
      h.appendChild(span)
      defaultWidth[font] = span.offsetWidth
      defaultHeight[font] = span.offsetHeight
      h.removeChild(span)
    }

    const availableFonts: string[] = []
    const fontsToTest = [
      'Abadi MT Condensed Light', 'Adobe Fangsong Std', 'Adobe Hebrew',
      'Adobe Ming Std', 'Agency FB', 'Aharoni', 'Aldhabi', 'AmeriGothic',
      // ... more fonts
    ]

    for (const font of fontsToTest) {
      const span = document.createElement('span')
      span.style.fontSize = testSize
      span.style.fontFamily = font + ',' + baseFonts[0]
      span.innerHTML = testString
      h.appendChild(span)

      const width = span.offsetWidth
      const height = span.offsetHeight
      h.removeChild(span)

      // If dimensions differ from default, font is available
      if (width !== defaultWidth[baseFonts[0]] || height !== defaultHeight[baseFonts[0]]) {
        availableFonts.push(font)
      }
    }

    return availableFonts
  }

  private async getPluginList(): Promise<string[]> {
    // Note: Plugin detection is deprecated, but still useful for bot detection
    const plugins: string[] = []

    if (navigator.plugins) {
      for (let i = 0; i < navigator.plugins.length; i++) {
        plugins.push(navigator.plugins[i].name)
      }
    }

    return plugins
  }

  private getScreenInfo() {
    return {
      width: screen.width,
      height: screen.height,
      colorDepth: screen.colorDepth,
      pixelRatio: window.devicePixelRatio || 1
    }
  }
}

// Usage example
const collector = new FingerprintCollector()
const fingerprint = await collector.collectFingerprint()
console.log('Browser fingerprint collected:', fingerprint)

// Behavioral analysis engine
interface UserBehavior {
  mouseMovements: Array<{
    x: number
    y: number
    timestamp: number
    velocity: number
  }>
  clicks: Array<{
    x: number
    y: number
    timestamp: number
    target: string
    timeSincePageLoad: number
  }>
  scrolls: Array<{
    scrollY: number
    timestamp: number
    velocity: number
  }>
  keystrokes: Array<{
    key: string
    timestamp: number
    timeBetweenKeystrokes: number
  }>
  sessionDuration: number
  pageViews: number
  timeBetweenActions: number[]
}

interface BehaviorScore {
  isHuman: boolean
  confidence: number // 0-100
  suspiciousPatterns: string[]
  riskLevel: 'low' | 'medium' | 'high'
}

class BehaviorAnalyzer {
  private behaviorData: UserBehavior = {
    mouseMovements: [],
    clicks: [],
    scrolls: [],
    keystrokes: [],
    sessionDuration: 0,
    pageViews: 0,
    timeBetweenActions: []
  }

  private lastActionTime: number = Date.now()

  constructor() {
    this.initializeTracking()
  }

  private initializeTracking(): void {
    // Mouse movement tracking
    document.addEventListener('mousemove', (e) => {
      const now = Date.now()
      const lastMovement = this.behaviorData.mouseMovements[this.behaviorData.mouseMovements.length - 1]

      let velocity = 0
      if (lastMovement) {
        const distance = Math.sqrt(
          Math.pow(e.clientX - lastMovement.x, 2) +
          Math.pow(e.clientY - lastMovement.y, 2)
        )
        const timeDiff = now - lastMovement.timestamp
        velocity = distance / timeDiff
      }

      this.behaviorData.mouseMovements.push({
        x: e.clientX,
        y: e.clientY,
        timestamp: now,
        velocity
      })

      // Keep only recent movements (last 5 minutes)
      const fiveMinutesAgo = now - 5 * 60 * 1000
      this.behaviorData.mouseMovements = this.behaviorData.mouseMovements.filter(
        m => m.timestamp > fiveMinutesAgo
      )

      this.updateLastActionTime()
    })

    // Click tracking
    document.addEventListener('click', (e) => {
      const now = Date.now()
      const target = (e.target as Element).tagName.toLowerCase()

      this.behaviorData.clicks.push({
        x: e.clientX,
        y: e.clientY,
        timestamp: now,
        target,
        timeSincePageLoad: now - performance.now()
      })

      this.updateLastActionTime()
    })

    // Scroll tracking
    let lastScrollY = window.scrollY
    window.addEventListener('scroll', () => {
      const now = Date.now()
      const currentScrollY = window.scrollY
      const scrollDistance = currentScrollY - lastScrollY
      const timeDiff = now - (this.behaviorData.scrolls[this.behaviorData.scrolls.length - 1]?.timestamp || now)

      const velocity = Math.abs(scrollDistance) / Math.max(timeDiff, 1)

      this.behaviorData.scrolls.push({
        scrollY: currentScrollY,
        timestamp: now,
        velocity
      })

      lastScrollY = currentScrollY
      this.updateLastActionTime()
    })

    // Keystroke tracking (only for form inputs)
    document.addEventListener('keydown', (e) => {
      if (['INPUT', 'TEXTAREA'].includes((e.target as Element).tagName)) {
        const now = Date.now()
        const lastKeystroke = this.behaviorData.keystrokes[this.behaviorData.keystrokes.length - 1]

        const timeBetweenKeystrokes = lastKeystroke ? now - lastKeystroke.timestamp : 0

        this.behaviorData.keystrokes.push({
          key: e.key,
          timestamp: now,
          timeBetweenKeystrokes
        })

        this.updateLastActionTime()
      }
    })
  }

  private updateLastActionTime(): void {
    const now = Date.now()
    const timeDiff = now - this.lastActionTime

    if (timeDiff > 100) { // Only track significant delays
      this.behaviorData.timeBetweenActions.push(timeDiff)
    }

    this.lastActionTime = now
  }

  analyzeBehavior(): BehaviorScore {
    const analysis = {
      mouseAnalysis: this.analyzeMouseBehavior(),
      clickAnalysis: this.analyzeClickBehavior(),
      scrollAnalysis: this.analyzeScrollBehavior(),
      keystrokeAnalysis: this.analyzeKeystrokeBehavior(),
      sessionAnalysis: this.analyzeSessionBehavior()
    }

    const totalScore = (
      analysis.mouseAnalysis.score +
      analysis.clickAnalysis.score +
      analysis.scrollAnalysis.score +
      analysis.keystrokeAnalysis.score +
      analysis.sessionAnalysis.score
    ) / 5

    const suspiciousPatterns = [
      ...analysis.mouseAnalysis.patterns,
      ...analysis.clickAnalysis.patterns,
      ...analysis.scrollAnalysis.patterns,
      ...analysis.keystrokeAnalysis.patterns,
      ...analysis.sessionAnalysis.patterns
    ]

    const confidence = Math.max(0, Math.min(100, totalScore))

    return {
      isHuman: confidence > 60,
      confidence,
      suspiciousPatterns,
      riskLevel: confidence > 80 ? 'low' : confidence > 40 ? 'medium' : 'high'
    }
  }

  private analyzeMouseBehavior(): { score: number; patterns: string[] } {
    const patterns: string[] = []
    let score = 100

    // Check for robotic mouse movements
    if (this.behaviorData.mouseMovements.length > 0) {
      const velocities = this.behaviorData.mouseMovements.map(m => m.velocity)
      const avgVelocity = velocities.reduce((a, b) => a + b, 0) / velocities.length

      // Too consistent velocity suggests bot
      const velocityVariance = this.calculateVariance(velocities)
      if (velocityVariance < 0.1 && avgVelocity > 0) {
        patterns.push('Unnaturally consistent mouse velocity')
        score -= 40
      }

      // Too many perfectly straight movements
      const straightMovements = this.behaviorData.mouseMovements.filter((m, i) => {
        if (i === 0) return false
        const prev = this.behaviorData.mouseMovements[i - 1]
        const dx = m.x - prev.x
        const dy = m.y - prev.y
        return Math.abs(dx) > 0 && Math.abs(dy) < 2 // Horizontal movement only
      }).length

      if (straightMovements > this.behaviorData.mouseMovements.length * 0.3) {
        patterns.push('Excessive straight-line mouse movements')
        score -= 30
      }
    }

    return { score: Math.max(0, score), patterns }
  }

  private analyzeClickBehavior(): { score: number; patterns: string[] } {
    const patterns: string[] = []
    let score = 100

    if (this.behaviorData.clicks.length > 0) {
      // Too fast clicking suggests automation
      const clickTimes = this.behaviorData.clicks.map(c => c.timestamp)
      const avgTimeBetweenClicks = this.calculateAverageTimeBetween(clickTimes)

      if (avgTimeBetweenClicks < 100) { // Less than 100ms between clicks
        patterns.push('Unnaturally fast clicking pattern')
        score -= 50
      }

      // Perfect timing suggests bot
      const timeVariances = this.calculateTimeVariance(clickTimes)
      if (timeVariances < 0.1) {
        patterns.push('Robotically precise click timing')
        score -= 30
      }
    }

    return { score: Math.max(0, score), patterns }
  }

  private analyzeScrollBehavior(): { score: number; patterns: string[] } {
    const patterns: string[] = []
    let score = 100

    if (this.behaviorData.scrolls.length > 0) {
      // Check for unnatural scroll patterns
      const scrollVelocities = this.behaviorData.scrolls.map(s => s.velocity)
      const avgVelocity = scrollVelocities.reduce((a, b) => a + b, 0) / scrollVelocities.length

      // Too consistent scroll speed
      if (this.calculateVariance(scrollVelocities) < 0.2) {
        patterns.push('Unnaturally consistent scroll velocity')
        score -= 25
      }
    }

    return { score: Math.max(0, score), patterns }
  }

  private analyzeKeystrokeBehavior(): { score: number; patterns: string[] } {
    const patterns: string[] = []
    let score = 100

    if (this.behaviorData.keystrokes.length > 0) {
      const timeBetweenKeystrokes = this.behaviorData.keystrokes.map(k => k.timeBetweenKeystrokes)

      // Too consistent typing speed
      const avgTimeBetween = timeBetweenKeystrokes.reduce((a, b) => a + b, 0) / timeBetweenKeystrokes.length
      const timeVariance = this.calculateVariance(timeBetweenKeystrokes)

      if (timeVariance < 0.3 && avgTimeBetween < 200) {
        patterns.push('Robotically consistent typing rhythm')
        score -= 35
      }
    }

    return { score: Math.max(0, score), patterns }
  }

  private analyzeSessionBehavior(): { score: number; patterns: string[] } {
    const patterns: string[] = []
    let score = 100

    // Check session duration patterns
    if (this.behaviorData.sessionDuration > 0) {
      // Very short sessions with many actions suggest scraping
      if (this.behaviorData.sessionDuration < 30000 && // Less than 30 seconds
          this.behaviorData.clicks.length > 10) {
        patterns.push('Suspiciously short session with high activity')
        score -= 40
      }

      // Too many page views in short time
      if (this.behaviorData.sessionDuration < 60000 && // Less than 1 minute
          this.behaviorData.pageViews > 5) {
        patterns.push('Unusual page view frequency')
        score -= 30
      }
    }

    return { score: Math.max(0, score), patterns }
  }

  private calculateVariance(values: number[]): number {
    if (values.length === 0) return 0
    const mean = values.reduce((a, b) => a + b, 0) / values.length
    const squaredDiffs = values.map(value => Math.pow(value - mean, 2))
    return squaredDiffs.reduce((a, b) => a + b, 0) / values.length
  }

  private calculateAverageTimeBetween(timestamps: number[]): number {
    if (timestamps.length < 2) return 0

    const diffs = []
    for (let i = 1; i < timestamps.length; i++) {
      diffs.push(timestamps[i] - timestamps[i - 1])
    }

    return diffs.reduce((a, b) => a + b, 0) / diffs.length
  }

  private calculateTimeVariance(timestamps: number[]): number {
    const avgTime = this.calculateAverageTimeBetween(timestamps)
    if (avgTime === 0) return 0

    const diffs = []
    for (let i = 1; i < timestamps.length; i++) {
      diffs.push(Math.abs(timestamps[i] - timestamps[i - 1] - avgTime))
    }

    return diffs.reduce((a, b) => a + b, 0) / diffs.length / avgTime
  }
}

// Usage example
const behaviorAnalyzer = new BehaviorAnalyzer()

// After 30 seconds of user interaction, analyze behavior
setTimeout(() => {
  const score = behaviorAnalyzer.analyzeBehavior()
  console.log('Behavior analysis:', score)

  if (score.riskLevel === 'high') {
    // Trigger additional verification or rate limiting
    console.log('High risk behavior detected - implementing safeguards')
  }
}, 30000)

// Machine learning-based bot detection using TensorFlow.js
interface MLFeatures {
  canvasFingerprint: string
  webglFingerprint: string
  fontCount: number
  pluginCount: number
  avgMouseVelocity: number
  clickFrequency: number
  scrollVariability: number
  keystrokeConsistency: number
  sessionDuration: number
  pageViewRate: number
  timeBetweenActions: number[]
  requestRate: number
  endpointDiversity: number
  headerConsistency: number
}

class MLBotDetector {
  async predictBot(features: MLFeatures): Promise<boolean> {
    // Simplified ML prediction - in production use trained model
    const botScore = this.calculateBotScore(features)
    return botScore > 0.7
  }

  private calculateBotScore(features: MLFeatures): number {
    let score = 0

    // Browser fingerprinting score
    if (features.fontCount < 10) score += 0.3
    if (features.pluginCount === 0) score += 0.2

    // Behavioral analysis score
    if (features.avgMouseVelocity < 50) score += 0.3
    if (features.clickFrequency > 8) score += 0.2
    if (features.keystrokeConsistency > 0.9) score += 0.3

    // Session analysis score
    if (features.sessionDuration < 60 && features.pageViewRate > 3) score += 0.4

    return Math.min(1, score)
  }
}

### Advanced Machine Learning Bot Detection System

### Real-Time Traffic Analysis Engine

console.log('Real-time traffic analysis engine initialized')

// Comprehensive bot mitigation and response system
interface MitigationStrategy {
  id: string
  name: string
  type: 'rate_limiting' | 'challenge' | 'block' | 'redirect' | 'delay'
  conditions: {
    riskLevel: string[]
    botTypes: string[]
    trafficPatterns: string[]
    requestVolume: number
  }
  actions: {
    rateLimit?: {
      requestsPerMinute: number
      burstLimit: number
      windowSize: number
    }
    challenge?: {
      type: 'captcha' | 'proof_of_work' | 'device_fingerprint' | 'behavioral'
      difficulty: 'low' | 'medium' | 'high'
      timeout: number
    }
    block?: {
      duration: number // minutes
      reason: string
    }
    redirect?: {
      url: string
      preserveQuery: boolean
    }
    delay?: {
      milliseconds: number
      jitter: boolean
    }
  }
  priority: number
  enabled: boolean
}

interface MitigationAction {
  strategyId: string
  actionType: string
  timestamp: number
  ip: string
  sessionId?: string
  reason: string
  duration?: number
  metadata: Record<string, any>
}

class AdvancedMitigationEngine {
  private strategies: Map<string, MitigationStrategy> = new Map()
  private activeMitigations: Map<string, MitigationAction[]> = new Map()
  private mitigationStats: Map<string, { triggered: number; effective: number; falsePositive: number }> = new Map()

  constructor() {
    this.initializeDefaultStrategies()
    this.startMitigationMonitoring()
  }

  async applyMitigation(
    riskAssessment: any,
    trafficEvent: any,
    patterns: any[]
  ): Promise<{
    actions: MitigationAction[]
    blocked: boolean
    requiresVerification: boolean
    response: any
  }> {
    const applicableStrategies = this.findApplicableStrategies(riskAssessment, patterns)
    const actions: MitigationAction[] = []

    for (const strategy of applicableStrategies) {
      const action = await this.executeStrategy(strategy, riskAssessment, trafficEvent)
      if (action) {
        actions.push(action)
      }
    }

    // Determine if request should be blocked
    const blockingActions = actions.filter(a => a.actionType === 'block')
    const blocked = blockingActions.length > 0

    // Check if verification is required
    const challengeActions = actions.filter(a => a.actionType === 'challenge')
    const requiresVerification = challengeActions.length > 0

    // Generate response based on actions
    const response = this.generateMitigationResponse(actions, blocked, requiresVerification)

    // Record mitigation for analysis
    this.recordMitigationActions(actions, trafficEvent.ip)

    return {
      actions,
      blocked,
      requiresVerification,
      response
    }
  }

  private findApplicableStrategies(riskAssessment: any, patterns: any[]): MitigationStrategy[] {
    const applicable: MitigationStrategy[] = []

    for (const strategy of this.strategies.values()) {
      if (!strategy.enabled) continue

      // Check risk level condition
      if (strategy.conditions.riskLevel.length > 0 &&
          !strategy.conditions.riskLevel.includes(riskAssessment.level)) {
        continue
      }

      // Check bot type condition
      if (riskAssessment.botType && strategy.conditions.botTypes.length > 0 &&
          !strategy.conditions.botTypes.includes(riskAssessment.botType)) {
        continue
      }

      // Check traffic pattern condition
      if (strategy.conditions.trafficPatterns.length > 0) {
        const hasMatchingPattern = patterns.some(p =>
          strategy.conditions.trafficPatterns.includes(p.patternType)
        )
        if (!hasMatchingPattern) continue
      }

      applicable.push(strategy)
    }

    // Sort by priority
    return applicable.sort((a, b) => b.priority - a.priority)
  }

  private async executeStrategy(
    strategy: MitigationStrategy,
    riskAssessment: any,
    trafficEvent: any
  ): Promise<MitigationAction | null> {
    const action: MitigationAction = {
      strategyId: strategy.id,
      actionType: strategy.type,
      timestamp: Date.now(),
      ip: trafficEvent.ip,
      sessionId: trafficEvent.sessionId,
      reason: `Applied ${strategy.name} due to ${riskAssessment.level} risk`,
      metadata: {
        riskLevel: riskAssessment.level,
        botType: riskAssessment.botType,
        confidence: riskAssessment.confidence
      }
    }

    switch (strategy.type) {
      case 'rate_limiting':
        return await this.applyRateLimiting(action, strategy)

      case 'challenge':
        return await this.applyChallenge(action, strategy)

      case 'block':
        return await this.applyBlocking(action, strategy)

      case 'redirect':
        return await this.applyRedirect(action, strategy)

      case 'delay':
        return await this.applyDelay(action, strategy)

      default:
        return null
    }
  }

  private async applyRateLimiting(action: MitigationAction, strategy: MitigationStrategy): Promise<MitigationAction> {
    action.duration = strategy.actions.rateLimit?.windowSize || 60
    action.metadata.rateLimit = strategy.actions.rateLimit

    // In production, integrate with rate limiting service
    console.log(`Applied rate limiting for IP ${action.ip}: ${JSON.stringify(strategy.actions.rateLimit)}`)

    return action
  }

  private async applyChallenge(action: MitigationAction, strategy: MitigationStrategy): Promise<MitigationAction> {
    action.metadata.challenge = strategy.actions.challenge

    // In production, integrate with CAPTCHA or PoW service
    console.log(`Applied challenge for IP ${action.ip}: ${JSON.stringify(strategy.actions.challenge)}`)

    return action
  }

  private async applyBlocking(action: MitigationAction, strategy: MitigationStrategy): Promise<MitigationAction> {
    action.duration = strategy.actions.block?.duration || 60
    action.reason = strategy.actions.block?.reason || action.reason
    action.metadata.block = strategy.actions.block

    // In production, add IP to blocklist
    console.log(`Blocked IP ${action.ip} for ${action.duration} minutes: ${action.reason}`)

    return action
  }

  private async applyRedirect(action: MitigationAction, strategy: MitigationStrategy): Promise<MitigationAction> {
    action.metadata.redirect = strategy.actions.redirect

    // In production, handle redirect logic
    console.log(`Redirecting IP ${action.ip} to ${strategy.actions.redirect?.url}`)

    return action
  }

  private async applyDelay(action: MitigationAction, strategy: MitigationStrategy): Promise<MitigationAction> {
    action.metadata.delay = strategy.actions.delay

    // In production, add artificial delay
    console.log(`Adding delay for IP ${action.ip}: ${strategy.actions.delay?.milliseconds}ms`)

    return action
  }

  private generateMitigationResponse(
    actions: MitigationAction[],
    blocked: boolean,
    requiresVerification: boolean
  ): any {
    if (blocked) {
      return {
        status: 429,
        error: 'Request blocked',
        message: 'Your request has been blocked due to suspicious activity',
        retryAfter: Math.max(...actions.map(a => a.duration || 60))
      }
    }

    if (requiresVerification) {
      return {
        status: 200,
        requiresVerification: true,
        challenge: actions.find(a => a.actionType === 'challenge')?.metadata.challenge,
        message: 'Additional verification required'
      }
    }

    return {
      status: 200,
      mitigated: actions.length > 0,
      actions: actions.map(a => ({ type: a.actionType, strategy: a.strategyId }))
    }
  }

  private recordMitigationActions(actions: MitigationAction[], ip: string): void {
    if (!this.activeMitigations.has(ip)) {
      this.activeMitigations.set(ip, [])
    }

    this.activeMitigations.get(ip)!.push(...actions)

    // Clean up old actions (older than 1 hour)
    const oneHourAgo = Date.now() - 60 * 60 * 1000
    for (const [ipKey, ipActions] of this.activeMitigations.entries()) {
      const recentActions = ipActions.filter(a => a.timestamp > oneHourAgo)
      if (recentActions.length === 0) {
        this.activeMitigations.delete(ipKey)
      } else {
        this.activeMitigations.set(ipKey, recentActions)
      }
    }
  }

  private initializeDefaultStrategies(): void {
    const defaultStrategies: MitigationStrategy[] = [
      {
        id: 'critical_block',
        name: 'Critical Risk Blocking',
        type: 'block',
        conditions: {
          riskLevel: ['critical'],
          botTypes: [],
          trafficPatterns: [],
          requestVolume: 0
        },
        actions: {
          block: {
            duration: 60,
            reason: 'Critical risk bot activity detected'
          }
        },
        priority: 10,
        enabled: true
      },
      {
        id: 'high_risk_challenge',
        name: 'High Risk Challenge',
        type: 'challenge',
        conditions: {
          riskLevel: ['high'],
          botTypes: [],
          trafficPatterns: [],
          requestVolume: 0
        },
        actions: {
          challenge: {
            type: 'captcha',
            difficulty: 'medium',
            timeout: 300
          }
        },
        priority: 9,
        enabled: true
      },
      {
        id: 'burst_rate_limit',
        name: 'Burst Traffic Rate Limiting',
        type: 'rate_limiting',
        conditions: {
          riskLevel: [],
          botTypes: [],
          trafficPatterns: ['burst'],
          requestVolume: 50
        },
        actions: {
          rateLimit: {
            requestsPerMinute: 10,
            burstLimit: 5,
            windowSize: 60
          }
        },
        priority: 8,
        enabled: true
      },
      {
        id: 'scraper_delay',
        name: 'Scraper Delay',
        type: 'delay',
        conditions: {
          riskLevel: [],
          botTypes: ['scraper'],
          trafficPatterns: [],
          requestVolume: 0
        },
        actions: {
          delay: {
            milliseconds: 2000,
            jitter: true
          }
        },
        priority: 7,
        enabled: true
      },
      {
        id: 'credential_stuffer_block',
        name: 'Credential Stuffing Block',
        type: 'block',
        conditions: {
          riskLevel: ['medium', 'high', 'critical'],
          botTypes: ['credential_stuffer'],
          trafficPatterns: [],
          requestVolume: 0
        },
        actions: {
          block: {
            duration: 30,
            reason: 'Credential stuffing attempt detected'
          }
        },
        priority: 10,
        enabled: true
      }
    ]

    defaultStrategies.forEach(strategy => {
      this.strategies.set(strategy.id, strategy)
    })
  }

  private startMitigationMonitoring(): void {
    // Monitor mitigation effectiveness
    setInterval(() => {
      this.analyzeMitigationEffectiveness()
    }, 10 * 60 * 1000) // Every 10 minutes
  }

  private analyzeMitigationEffectiveness(): void {
    for (const [ip, actions] of this.activeMitigations.entries()) {
      const recentActions = actions.filter(a => a.timestamp > Date.now() - 30 * 60 * 1000)

      if (recentActions.length > 5) {
        console.log(`High mitigation frequency for IP ${ip}: ${recentActions.length} actions in 30 minutes`)

        // Consider escalating mitigation
        this.escalateMitigationForIP(ip)
      }
    }
  }

  private escalateMitigationForIP(ip: string): void {
    // In production, escalate to more aggressive mitigation
    console.log(`Escalating mitigation for persistent offender IP: ${ip}`)
  }

  // Strategy management
  addStrategy(strategy: MitigationStrategy): void {
    this.strategies.set(strategy.id, strategy)
  }

  removeStrategy(strategyId: string): void {
    this.strategies.delete(strategyId)
  }

  updateStrategy(strategyId: string, updates: Partial<MitigationStrategy>): void {
    const existing = this.strategies.get(strategyId)
    if (existing) {
      this.strategies.set(strategyId, { ...existing, ...updates })
    }
  }

  getActiveMitigations(ip?: string): MitigationAction[] {
    if (ip) {
      return this.activeMitigations.get(ip) || []
    }

    return Array.from(this.activeMitigations.values()).flat()
  }

  getMitigationStats(): Record<string, { triggered: number; effective: number; falsePositive: number }> {
    return Object.fromEntries(this.mitigationStats.entries())
  }
}

// Integration with Express.js
class MitigationMiddleware {
  private mitigationEngine: AdvancedMitigationEngine

  constructor() {
    this.mitigationEngine = new AdvancedMitigationEngine()
  }

  async applyMitigation(req: any, res: any, next: any): Promise<void> {
    // Skip mitigation for health checks and internal requests
    if (req.path.startsWith('/health') || req.path.startsWith('/internal')) {
      return next()
    }

    // Get bot detection results
    const botDetection = req.botDetection
    if (!botDetection) {
      return next()
    }

    try {
      // Apply mitigation based on risk assessment
      const mitigation = await this.mitigationEngine.applyMitigation(
        botDetection.prediction,
        {
          ip: req.ip,
          sessionId: req.sessionID,
          userAgent: req.get('User-Agent'),
          timestamp: Date.now()
        },
        [] // Would be populated with actual patterns
      )

      // Add mitigation info to request
      req.mitigation = mitigation

      // Handle blocking
      if (mitigation.blocked) {
        return res.status(mitigation.response.status).json(mitigation.response)
      }

      // Handle challenges
      if (mitigation.requiresVerification) {
        // In production, serve challenge page or API
        return res.status(mitigation.response.status).json(mitigation.response)
      }

      next()

    } catch (error) {
      console.error('Mitigation middleware error:', error)
      next()
    }
  }
}

// Initialize mitigation system
const mitigationEngine = new AdvancedMitigationEngine()
const mitigationMiddleware = new MitigationMiddleware()

// Apply mitigation middleware
app.use('/api', mitigationMiddleware.applyMitigation)

// Mitigation management endpoints
app.get('/api/mitigation/strategies', (req, res) => {
  const strategies = Array.from(mitigationEngine['strategies'].values())

  res.json({
    strategies,
    timestamp: new Date().toISOString()
  })
})

app.post('/api/mitigation/strategies', (req, res) => {
  try {
    const strategy: MitigationStrategy = req.body

    if (!strategy.id || !strategy.name || !strategy.type) {
      return res.status(400).json({ error: 'Invalid strategy format' })
    }

    mitigationEngine.addStrategy(strategy)

    res.json({
      message: 'Strategy added successfully',
      strategy,
      timestamp: new Date().toISOString()
    })

  } catch (error) {
    console.error('Strategy creation error:', error)
    res.status(500).json({ error: 'Strategy creation failed' })
  }
})

app.put('/api/mitigation/strategies/:id', (req, res) => {
  try {
    const { id } = req.params
    const updates = req.body

    mitigationEngine.updateStrategy(id, updates)

    res.json({
      message: 'Strategy updated successfully',
      strategyId: id,
      timestamp: new Date().toISOString()
    })

  } catch (error) {
    console.error('Strategy update error:', error)
    res.status(500).json({ error: 'Strategy update failed' })
  }
})

app.delete('/api/mitigation/strategies/:id', (req, res) => {
  try {
    const { id } = req.params

    mitigationEngine.removeStrategy(id)

    res.json({
      message: 'Strategy removed successfully',
      strategyId: id,
      timestamp: new Date().toISOString()
    })

  } catch (error) {
    console.error('Strategy removal error:', error)
    res.status(500).json({ error: 'Strategy removal failed' })
  }
})

app.get('/api/mitigation/active', (req, res) => {
  const { ip } = req.query

  const mitigations = mitigationEngine.getActiveMitigations(ip as string)

  res.json({
    mitigations,
    count: mitigations.length,
    timestamp: new Date().toISOString()
  })
})

app.get('/api/mitigation/stats', (req, res) => {
  const stats = mitigationEngine.getMitigationStats()

  res.json({
    stats,
    timestamp: new Date().toISOString()
  })
})

console.log('Advanced mitigation strategies system initialized')

// Real-time dashboard for bot detection monitoring and analytics
interface DashboardMetrics {
  timestamp: number
  totalRequests: number
  botRequests: number
  humanRequests: number
  blockedRequests: number
  challengedRequests: number
  averageResponseTime: number
  systemHealth: 'healthy' | 'warning' | 'critical'
  topBotTypes: Array<{ type: string; count: number; percentage: number }>
  topRiskyIPs: Array<{ ip: string; riskScore: number; requests: number }>
  patternTrends: Array<{ pattern: string; trend: 'increasing' | 'decreasing' | 'stable'; change: number }>
}

interface AlertRule {
  id: string
  name: string
  condition: {
    metric: string
    operator: '>' | '<' | '=' | '>=' | '<='
    threshold: number
    duration: number // minutes
  }
  severity: 'low' | 'medium' | 'high' | 'critical'
  enabled: boolean
  lastTriggered?: number
  notificationChannels: string[]
}

interface AlertNotification {
  ruleId: string
  timestamp: number
  severity: string
  title: string
  description: string
  metrics: Record<string, number>
  recommendations: string[]
}

class BotDetectionDashboard {
  private metrics: DashboardMetrics[] = []
  private alertRules: Map<string, AlertRule> = new Map()
  private alertHistory: AlertNotification[] = []
  private subscribers: Set<any> = new Set()

  constructor() {
    this.initializeDefaultAlertRules()
    this.startMetricsCollection()
    this.startAlertMonitoring()
  }

  async getCurrentMetrics(): Promise<DashboardMetrics> {
    // Aggregate current metrics from various sources
    const currentMetrics = await this.collectCurrentMetrics()

    // Calculate trends and health status
    const healthStatus = this.calculateSystemHealth(currentMetrics)
    const trends = await this.calculatePatternTrends()

    return {
      ...currentMetrics,
      systemHealth: healthStatus,
      patternTrends: trends,
      topBotTypes: await this.getTopBotTypes(),
      topRiskyIPs: await this.getTopRiskyIPs()
    }
  }

  private async collectCurrentMetrics(): Promise<Partial<DashboardMetrics>> {
    // In production, collect from monitoring systems
    // For demo, simulate metrics collection

    return {
      timestamp: Date.now(),
      totalRequests: Math.floor(Math.random() * 10000) + 5000,
      botRequests: Math.floor(Math.random() * 1000) + 200,
      humanRequests: Math.floor(Math.random() * 8000) + 4000,
      blockedRequests: Math.floor(Math.random() * 100) + 20,
      challengedRequests: Math.floor(Math.random() * 200) + 50,
      averageResponseTime: Math.random() * 200 + 100
    }
  }

  private calculateSystemHealth(metrics: Partial<DashboardMetrics>): 'healthy' | 'warning' | 'critical' {
    const botPercentage = metrics.botRequests! / metrics.totalRequests!
    const errorRate = metrics.blockedRequests! / metrics.totalRequests!

    if (botPercentage > 0.3 || errorRate > 0.1) {
      return 'critical'
    }

    if (botPercentage > 0.15 || errorRate > 0.05) {
      return 'warning'
    }

    return 'healthy'
  }

  private async calculatePatternTrends(): Promise<Array<{ pattern: string; trend: 'increasing' | 'decreasing' | 'stable'; change: number }>> {
    // In production, analyze historical pattern data
    // For demo, simulate trend analysis

    const patterns = ['burst', 'periodic', 'sequential', 'suspicious']
    return patterns.map(pattern => ({
      pattern,
      trend: ['increasing', 'decreasing', 'stable'][Math.floor(Math.random() * 3)] as any,
      change: (Math.random() - 0.5) * 20
    }))
  }

  private async getTopBotTypes(): Promise<Array<{ type: string; count: number; percentage: number }>> {
    const botTypes = [
      { type: 'scraper', count: Math.floor(Math.random() * 200) + 50 },
      { type: 'credential_stuffer', count: Math.floor(Math.random() * 100) + 20 },
      { type: 'spammer', count: Math.floor(Math.random() * 150) + 30 },
      { type: 'click_fraud', count: Math.floor(Math.random() * 80) + 10 }
    ]

    const total = botTypes.reduce((sum, type) => sum + type.count, 0)

    return botTypes
      .sort((a, b) => b.count - a.count)
      .slice(0, 5)
      .map(type => ({
        ...type,
        percentage: Math.round((type.count / total) * 100)
      }))
  }

  private async getTopRiskyIPs(): Promise<Array<{ ip: string; riskScore: number; requests: number }>> {
    // In production, get from risk scoring system
    // For demo, simulate risky IP data

    const riskyIPs = []
    for (let i = 0; i < 10; i++) {
      riskyIPs.push({
        ip: `192.168.1.${Math.floor(Math.random() * 255)}`,
        riskScore: Math.floor(Math.random() * 100),
        requests: Math.floor(Math.random() * 1000) + 100
      })
    }

    return riskyIPs
      .sort((a, b) => b.riskScore - a.riskScore)
      .slice(0, 10)
  }

  private initializeDefaultAlertRules(): void {
    const defaultRules: AlertRule[] = [
      {
        id: 'high_bot_percentage',
        name: 'High Bot Traffic Percentage',
        condition: {
          metric: 'botPercentage',
          operator: '>',
          threshold: 25,
          duration: 5
        },
        severity: 'high',
        enabled: true,
        notificationChannels: ['email', 'slack']
      },
      {
        id: 'critical_system_health',
        name: 'Critical System Health',
        condition: {
          metric: 'systemHealth',
          operator: '=',
          threshold: 0, // critical
          duration: 2
        },
        severity: 'critical',
        enabled: true,
        notificationChannels: ['email', 'slack', 'sms']
      },
      {
        id: 'rapid_response_time_increase',
        name: 'Rapid Response Time Increase',
        condition: {
          metric: 'averageResponseTime',
          operator: '>',
          threshold: 500,
          duration: 3
        },
        severity: 'medium',
        enabled: true,
        notificationChannels: ['email']
      }
    ]

    defaultRules.forEach(rule => {
      this.alertRules.set(rule.id, rule)
    })
  }

  private startMetricsCollection(): void {
    // Collect metrics every minute
    setInterval(async () => {
      const metrics = await this.getCurrentMetrics()
      this.metrics.push(metrics)

      // Keep only last 24 hours of metrics
      const twentyFourHoursAgo = Date.now() - 24 * 60 * 60 * 1000
      this.metrics = this.metrics.filter(m => m.timestamp > twentyFourHoursAgo)

      // Notify subscribers
      this.notifySubscribers(metrics)
    }, 60 * 1000)
  }

  private startAlertMonitoring(): void {
    // Check alerts every minute
    setInterval(() => {
      this.checkAlertConditions()
    }, 60 * 1000)
  }

  private async checkAlertConditions(): Promise<void> {
    const currentMetrics = await this.getCurrentMetrics()

    for (const rule of this.alertRules.values()) {
      if (!rule.enabled) continue

      const shouldTrigger = await this.evaluateAlertCondition(rule, currentMetrics)

      if (shouldTrigger) {
        await this.triggerAlert(rule, currentMetrics)
      }
    }
  }

  private async evaluateAlertCondition(rule: AlertRule, metrics: DashboardMetrics): Promise<boolean> {
    // Check if condition has been met for the required duration
    const recentMetrics = this.metrics.slice(-rule.condition.duration)

    if (recentMetrics.length < rule.condition.duration) {
      return false
    }

    // Check if all recent metrics meet the condition
    return recentMetrics.every(m => {
      const value = this.getMetricValue(m, rule.condition.metric)
      return this.compareValues(value, rule.condition.threshold, rule.condition.operator)
    })
  }

  private getMetricValue(metrics: DashboardMetrics, metricName: string): number {
    switch (metricName) {
      case 'botPercentage':
        return (metrics.botRequests / metrics.totalRequests) * 100
      case 'systemHealth':
        return metrics.systemHealth === 'critical' ? 0 : metrics.systemHealth === 'warning' ? 1 : 2
      case 'averageResponseTime':
        return metrics.averageResponseTime
      default:
        return 0
    }
  }

  private compareValues(value: number, threshold: number, operator: string): boolean {
    switch (operator) {
      case '>': return value > threshold
      case '<': return value < threshold
      case '=': return Math.abs(value - threshold) < 0.01
      case '>=': return value >= threshold
      case '<=': return value <= threshold
      default: return false
    }
  }

  private async triggerAlert(rule: AlertRule, metrics: DashboardMetrics): Promise<void> {
    // Check if already triggered recently (avoid spam)
    const recentAlerts = this.alertHistory.filter(a =>
      a.ruleId === rule.id && a.timestamp > Date.now() - 60 * 60 * 1000 // 1 hour cooldown
    )

    if (recentAlerts.length > 0) {
      return
    }

    const alert: AlertNotification = {
      ruleId: rule.id,
      timestamp: Date.now(),
      severity: rule.severity,
      title: rule.name,
      description: `Alert condition met: ${rule.condition.metric} ${rule.condition.operator} ${rule.condition.threshold}`,
      metrics: {
        [rule.condition.metric]: this.getMetricValue(metrics, rule.condition.metric)
      },
      recommendations: this.generateAlertRecommendations(rule, metrics)
    }

    this.alertHistory.push(alert)
    rule.lastTriggered = Date.now()

    // Send notifications
    await this.sendAlertNotifications(alert, rule)

    console.log(`🚨 Alert triggered: ${alert.title}`)
  }

  private generateAlertRecommendations(rule: AlertRule, metrics: DashboardMetrics): string[] {
    switch (rule.id) {
      case 'high_bot_percentage':
        return [
          'Review bot detection thresholds',
          'Increase mitigation aggressiveness',
          'Check for new bot patterns'
        ]

      case 'critical_system_health':
        return [
          'Immediate investigation required',
          'Check system resources',
          'Review recent configuration changes',
          'Consider emergency mitigation measures'
        ]

      case 'rapid_response_time_increase':
        return [
          'Check system performance',
          'Review recent traffic spikes',
          'Consider scaling resources'
        ]

      default:
        return ['Review system status and recent changes']
    }
  }

  private async sendAlertNotifications(alert: AlertNotification, rule: AlertRule): Promise<void> {
    // In production, send to configured channels (email, Slack, etc.)
    console.log(`Sending alert notification to channels: ${rule.notificationChannels.join(', ')}`)
  }

  // WebSocket support for real-time dashboard updates
  subscribeToUpdates(ws: any): void {
    this.subscribers.add(ws)

    ws.on('close', () => {
      this.subscribers.delete(ws)
    })
  }

  private notifySubscribers(metrics: DashboardMetrics): void {
    const update = {
      type: 'dashboard_update',
      metrics,
      timestamp: new Date().toISOString()
    }

    this.subscribers.forEach(ws => {
      if (ws.readyState === 1) { // WebSocket.OPEN
        ws.send(JSON.stringify(update))
      }
    })
  }

  // Alert management
  addAlertRule(rule: AlertRule): void {
    this.alertRules.set(rule.id, rule)
  }

  removeAlertRule(ruleId: string): void {
    this.alertRules.delete(ruleId)
  }

  getAlertHistory(hours: number = 24): AlertNotification[] {
    const cutoff = Date.now() - hours * 60 * 60 * 1000
    return this.alertHistory.filter(a => a.timestamp > cutoff)
  }

  getAlertRules(): AlertRule[] {
    return Array.from(this.alertRules.values())
  }
}

// Initialize dashboard
const botDetectionDashboard = new BotDetectionDashboard()

// Dashboard API endpoints
app.get('/api/dashboard/metrics', async (req, res) => {
  try {
    const metrics = await botDetectionDashboard.getCurrentMetrics()

    res.json({
      metrics,
      timestamp: new Date().toISOString()
    })

  } catch (error) {
    console.error('Dashboard metrics error:', error)
    res.status(500).json({ error: 'Metrics unavailable' })
  }
})

app.get('/api/dashboard/alerts', (req, res) => {
  const { hours = 24 } = req.query

  const alerts = botDetectionDashboard.getAlertHistory(Number(hours))

  res.json({
    alerts,
    count: alerts.length,
    timestamp: new Date().toISOString()
  })
})

app.get('/api/dashboard/alert-rules', (req, res) => {
  const rules = botDetectionDashboard.getAlertRules()

  res.json({
    rules,
    timestamp: new Date().toISOString()
  })
})

app.post('/api/dashboard/alert-rules', (req, res) => {
  try {
    const rule: AlertRule = req.body

    if (!rule.id || !rule.name || !rule.condition) {
      return res.status(400).json({ error: 'Invalid alert rule format' })
    }

    botDetectionDashboard.addAlertRule(rule)

    res.json({
      message: 'Alert rule added successfully',
      rule,
      timestamp: new Date().toISOString()
    })

  } catch (error) {
    console.error('Alert rule creation error:', error)
    res.status(500).json({ error: 'Alert rule creation failed' })
  }
})

app.delete('/api/dashboard/alert-rules/:id', (req, res) => {
  try {
    const { id } = req.params

    botDetectionDashboard.removeAlertRule(id)

    res.json({
      message: 'Alert rule removed successfully',
      ruleId: id,
      timestamp: new Date().toISOString()
    })

  } catch (error) {
    console.error('Alert rule removal error:', error)
    res.status(500).json({ error: 'Alert rule removal failed' })
  }
})

// Real-time dashboard WebSocket
app.ws('/api/dashboard/live', (ws: any) => {
  console.log('Dashboard client connected')

  botDetectionDashboard.subscribeToUpdates(ws)

  // Send initial metrics
  botDetectionDashboard.getCurrentMetrics().then(metrics => {
    ws.send(JSON.stringify({
      type: 'initial_metrics',
      metrics,
      timestamp: new Date().toISOString()
    }))
  }).catch(error => {
    console.error('Initial metrics error:', error)
  })
})

console.log('Bot detection dashboard and monitoring system initialized')

Bot Detection and Mitigation Architecture

class ComprehensiveBotProtection {
  private detector: BotDetectionEngine
  private mitigator: BotMitigationSystem
  
  constructor() {
    this.detector = new BotDetectionEngine()
    this.mitigator = new BotMitigationSystem()
  }
  
  async protect(req: any): Promise<{
    allowed: boolean
    action: string
    reason?: string
  }> {
    const analysis = await this.detector.analyzeRequest(req)
    
    if (analysis.isBot && analysis.confidence > 80) {
      return await this.mitigator.mitigate(analysis)
    }
    
    return { allowed: true, action: 'allow' }
  }
}

const BOT_RESPONSE_PLAYBOOKS = {
  'scraping_bot': {
    action: 'throttle',
    severity: 'medium',
    escalate: false
  },
  'ddos_bot': {
    action: 'block',
    severity: 'critical',
    escalate: true
  },
  'credential_stuffing': {
    action: 'challenge',
    severity: 'high',
    escalate: true
  }
}