f0c8fe81c6
- Add multi-interface TC attachment (default "any" = all UP interfaces) - Add BPF LPM_TRIE map ignored_src for kernel-side CIDR filtering - Add userspace ignore_src filtering for SSL/accept4 path via net.IPNet.Contains() - Add AcceptCache for fd→SessionKey correlation with TTL and Close() - Add 5 test files covering writer, procutil, dispatcher, accept_cache, and cmd - Fix formatTCPOptions infinite loop on EOL (case 0 break→return) - Fix pseudoOrderToShort panic on empty slice (negative cap) - Fix AcceptCache goroutine leak (add done channel + Close()) - Update config.yml.example with interfaces, listen_ports, ignore_src - Rewrite docs/services/ja4ebpf.md (was massively stale: XDP, RingBuffer, etc.) - Fix stale XDP/RingBuffer references in docs/architecture.md, thesis, tls.go Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Détection et Classification du Trafic HTTP Malveillant
Document technique — Avril 2026 — Version 4.0
Ce document est divisé en 9 parties :
| Fichier | Contenu | Lignes |
|---|---|---|
| 00_resume.md | Titre, résumé, table des matières | 75 |
| 01_introduction.md | Section 1 — Introduction, contexte, générations de défenses | 50 |
| 02_etat_de_lart.md | Section 2 — État de l'art (règles statiques, fingerprinting, ML) | 208 |
| 03_architecture.md | Section 3.1–3.8 — Architecture multi-couches, pipeline ML | 767 |
| 04_browser_matcher.md | Section 3.9 — Browser Signature Detection (browser_matcher) | 481 |
| 05_features.md | Section 4 — Taxonomie des 96 features (8 familles) | 682 |
| 06_techniques_avancees.md | Section 5 — Techniques comportementales avancées (§5.1–5.8) | 669 |
| 07_discussion_limites.md | Section 6 — Discussion, limites, scalabilité, RGPD | 207 |
| 08_conclusion_references.md | Sections 7–8 — Conclusion et références | 277 |