家庭と小規模オフィスの「古いWi-Fiルーター」が攻撃の踏み台にされる理由：
知らない間に加害者にされないための「5分点検ガイド」

#![forbid(unsafe_code)]

/// Connection telemetry comparing L4 TCP SYN-ACK RTT with L7 TLS/HTTP challenge RTT.
#[derive(Debug, Clone, Copy)]
pub struct ConnectionTimingSample {
    pub tcp_syn_rtt_micros: u32,
    pub tls_app_rtt_micros: u32,
    pub concurrent_distinct_tls_fingerprints: u16,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum ProxyBotnetVerdict {
    DirectResidentialClient,
    SuspectedSocks5RelayBot { skew_ratio_x100: u32 },
    InvalidTelemetrySample,
}

/// Detects compromised domestic routers acting as RFC 1928 Socks5 relays for overseas C2 nodes
/// by evaluating the ratio between transport-layer RTT and application-layer round-trip latency.
#[inline]
pub const fn classify_residential_proxy_skew(
    sample: &ConnectionTimingSample,
) -> ProxyBotnetVerdict {
    if sample.tcp_syn_rtt_micros == 0 || sample.tls_app_rtt_micros == 0 {
        return ProxyBotnetVerdict::InvalidTelemetrySample;
    }

    let skew_ratio_x100 = (sample.tls_app_rtt_micros as u64)
        .saturating_mul(100)
        .wrapping_div(sample.tcp_syn_rtt_micros as u64) as u32;

    // Domestic fiber L4 RTT < 20ms, but relayed L7 RTT > 180ms (skew > 9.0x)
    // OR multiple distinct JA4 TLS fingerprints originating from a single home IP simultaneously.
    if (sample.tcp_syn_rtt_micros < 20_000 && skew_ratio_x100 >= 900)
        || (sample.concurrent_distinct_tls_fingerprints >= 8 && skew_ratio_x100 >= 500)
    {
        return ProxyBotnetVerdict::SuspectedSocks5RelayBot { skew_ratio_x100 };
    }

    ProxyBotnetVerdict::DirectResidentialClient
}