import numpy as np
from scipy.spatial.distance import jensenshannon
from scipy.stats import ks_2samp, wasserstein_distance
from dataclasses import dataclass, field
from typing import Optional
from collections import deque
import warnings

@dataclass
class DriftReport:
    """单特征的漂移检测报告"""
    feature_name: str
    ks_statistic: float
    ks_pvalue: float
    js_divergence: float
    wasserstein: Optional[float] = None
    mean_shift_ratio: float = 0.0  # 均值偏移比例（相对于标准差）
    drift_level: str = "none"  # none / mild / moderate / severe

    def is_drifted(self, ks_threshold: float = 0.05,
                   js_threshold: float = 0.1) -> bool:
        return (self.ks_pvalue < ks_threshold and
                self.js_divergence > js_threshold)


class AdaptiveBinningDriftDetector:
    """
    基于自适应分箱的 KL/JS 散度漂移检测器

    核心设计决策：
    1. 自适应分箱：对每个特征动态选择最优 bin 数（Freedman-Diaconis 准则），
       避免固定 bin 数带来的信息损失或过度离散化。
    2. 拉普拉斯平滑：对零概率 bin 加伪计数（α=0.01），避免 log(0) 导致的散度爆炸。
    3. 增量直方图更新：使用衰减因子 α 实现滑动窗口统计，避免存储全量历史数据。
    4. 分层检测：KS 检验（快速）→ JS 散度（精准）→ Wasserstein（深度），
       模拟 CPU 的分级缓存策略——越贵的计算越少触发。
    """
    def __init__(self, window_size: int = 10000,
                 decay_factor: float = 0.95,
                 max_bins: int = 100,
                 min_samples_per_bin: int = 10):
        """
        Args:
            window_size: 参考窗口的样本数（历史基线）
            decay_factor: 指数衰减因子（越接近 1 保留越多历史）
            max_bins: 最大分箱数（Freedman-Diaconis 的上限）
            min_samples_per_bin: 每个 bin 的最少样本数
        """
        self.window_size = window_size
        self.decay_factor = decay_factor
        self.max_bins = max_bins
        self.min_samples_per_bin = min_samples_per_bin

        # 存储每个特征的参考分布直方图
        self.reference_histograms: dict[str, tuple[np.ndarray, np.ndarray]] = {}
        # 增量窗口（滑动窗口样本缓存）
        self.reference_windows: dict[str, deque] = {}
        # 基线分布（稳定期的全量分布）
        self.baseline_histograms: dict[str, tuple[np.ndarray, np.ndarray]] = {}

    def _freedman_diaconis_bins(self, data: np.ndarray) -> int:
        """Freedman-Diaconis 准则：最优 bin 数 = (max-min) / (2 × IQR × n^(-1/3))"""
        if len(data) < 10:
            return min(10, self.max_bins)
        iqr = np.percentile(data, 75) - np.percentile(data, 25)
        if iqr == 0:
            return min(20, self.max_bins)
        bin_width = 2 * iqr / (len(data) ** (1/3))
        data_range = data.max() - data.min()
        if data_range == 0:
            return 1
        n_bins = max(1, min(int(data_range / bin_width), self.max_bins))
        return n_bins

    def _compute_histogram(self, data: np.ndarray,
                           reference_bins: Optional[np.ndarray] = None
                           ) -> tuple[np.ndarray, np.ndarray]:
        """
        计算直方图（带拉普拉斯平滑）

        Args:
            data: 特征值数组
            reference_bins: 参考分布的 bin 边界（用于对齐分布比较）
        """
        if reference_bins is not None:
            bins = reference_bins
        else:
            n_bins = self._freedman_diaconis_bins(data)
            bins = np.histogram_bin_edges(data, bins=n_bins)

        hist, _ = np.histogram(data, bins=bins, density=True)

        # 拉普拉斯平滑：加 α 伪计数后重新归一化
        alpha = 0.01
        hist_smoothed = (hist + alpha)
        hist_smoothed = hist_smoothed / hist_smoothed.sum()
        return hist_smoothed, bins

    def set_baseline(self, feature_name: str, data: np.ndarray):
        """设置基线分布（稳定期的全量数据）"""
        hist, bins = self._compute_histogram(data)
        self.baseline_histograms[feature_name] = (hist, bins)
        # 同时初始化参考窗口
        self.reference_windows[feature_name] = deque(
            data[-self.window_size:].tolist(), maxlen=self.window_size
        )
        self.reference_histograms[feature_name] = self._compute_histogram(data)

    def update_reference_window(self, feature_name: str,
                                 new_data: np.ndarray):
        """更新参考窗口（增量 + 指数衰减）"""
        if feature_name not in self.reference_windows:
            self.reference_windows[feature_name] = deque(maxlen=self.window_size)

        window = self.reference_windows[feature_name]
        for val in new_data:
            window.append(float(val))

        # 指数衰减：对旧样本加权采样
        n_old = len(window)
        decay_weights = np.power(self.decay_factor,
                                  np.arange(n_old - 1, -1, -1))
        decay_weights = decay_weights / decay_weights.sum()

        # 加权直方图
        window_array = np.array(window)
        bins = self.reference_histograms.get(feature_name, (None,))[1]
        if bins is None:
            n_bins = self._freedman_diaconis_bins(window_array)
            bins = np.histogram_bin_edges(window_array, bins=n_bins)

        hist, _ = np.histogram(window_array, bins=bins, weights=decay_weights,
                                density=True)
        hist = (hist + 0.01) / (hist.sum() + 0.01 * len(hist))
        self.reference_histograms[feature_name] = (hist, bins)

    def detect_drift(self, feature_name: str, current_data: np.ndarray,
                     ks_threshold: float = 0.01,
                     js_threshold: float = 0.05,
                     js_severe_threshold: float = 0.15
                     ) -> DriftReport:
        """
        三级漂移检测

        检测链：
        KS 检验 → JS 散度 → 条件触发 Wasserstein 距离
        """
        if feature_name not in self.reference_histograms:
            raise ValueError(f"特征 '{feature_name}' 未设置参考分布，先调用 set_baseline()")

        ref_hist, ref_bins = self.reference_histograms[feature_name]
        ref_data = np.array(self.reference_windows[feature_name])

        # ---------- Level 1: KS 检验（快速筛查）----------
        # 从参考窗口中随机采样避免 KS 检验对样本量过于敏感
        sample_size = min(len(ref_data), len(current_data), 5000)
        ref_sample = np.random.choice(ref_data, size=sample_size, replace=False)
        cur_sample = np.random.choice(current_data, size=sample_size, replace=False)

        ks_stat, ks_pval = ks_2samp(ref_sample, cur_sample)

        # ---------- Level 2: JS 散度（精准量化）----------
        cur_hist, _ = self._compute_histogram(current_data, reference_bins=ref_bins)

        # 对齐直方图长度
        min_len = min(len(ref_hist), len(cur_hist))
        js_div = jensenshannon(ref_hist[:min_len], cur_hist[:min_len])

        # ---------- Level 3: Wasserstein 距离（深度分析）----------
        # 仅在 JS 散度超中度阈值时计算（开销较大：O(n log n)）
        w_dist = None
        if js_div > js_threshold:
            w_dist = wasserstein_distance(ref_sample, cur_sample)

        # ---------- 均值偏移量化 ----------
        ref_mean, ref_std = ref_data.mean(), ref_data.std() + 1e-8
        cur_mean = current_data.mean()
        mean_shift = abs(cur_mean - ref_mean) / ref_std

        # ---------- 漂移级别判定 ----------
        if ks_pval < ks_threshold and js_div > js_severe_threshold:
            drift_level = "severe"
        elif ks_pval < ks_threshold and js_div > js_threshold:
            drift_level = "moderate"
        elif ks_pval < ks_threshold:
            drift_level = "mild"
        else:
            drift_level = "none"

        return DriftReport(
            feature_name=feature_name,
            ks_statistic=ks_stat,
            ks_pvalue=ks_pval,
            js_divergence=js_div,
            wasserstein=w_dist,
            mean_shift_ratio=mean_shift,
            drift_level=drift_level
        )

    def multi_feature_drift_score(self, reports: list[DriftReport],
                                   feature_weights: Optional[dict[str, float]] = None
                                   ) -> dict:
        """
        多特征加权漂移综合评分

        不同特征对模型的贡献不同（通过 SHAP 值或特征重要性确定权重）。
        加权后的综合漂移得分反映的是"模型输入分布的整体偏移程度"。
        """
        if feature_weights is None:
            # 默认等权重
            feature_weights = {r.feature_name: 1.0 for r in reports}

        total_weight = sum(feature_weights.get(r.feature_name, 1.0)
                           for r in reports)
        weighted_js = sum(
            r.js_divergence * feature_weights.get(r.feature_name, 1.0)
            for r in reports
        ) / total_weight

        severe_count = sum(1 for r in reports if r.drift_level == "severe")
        moderate_count = sum(1 for r in reports if r.drift_level == "moderate")
        mild_count = sum(1 for r in reports if r.drift_level == "mild")

        # 漂移严重度 = 加权 JS 散度 + 严重漂移特征数的惩罚项
        severity = weighted_js + 0.05 * severe_count + 0.02 * moderate_count

        return {
            "weighted_js_divergence": round(weighted_js, 4),
            "severity_score": round(severity, 4),
            "severe_features": severe_count,
            "moderate_features": moderate_count,
            "mild_features": mild_count,
            "trigger_retrain": severity > 0.15,  # 触发重训练阈值
            "trigger_alert": severity > 0.08      # 触发告警阈值
        }


# ---------- 仿真验证：人工构造概念漂移场景 ----------
def simulate_concept_drift_scenario():
    """
    模拟风控场景的概念漂移：
    - 正常期：特征值服从 N(50, 15)（正常用户行为）
    - 漂移期：特征值逐步偏移到 N(20, 8)（黑产脚本行为）
    """
    np.random.seed(42)
    detector = AdaptiveBinningDriftDetector(window_size=5000)

    # 阶段 1: 设置基线（正常期）
    normal_data = np.random.normal(50, 15, 10000)
    detector.set_baseline("page_dwell_time", normal_data)
    print("=== 基线设置完成（N(50, 15)）===")

    # 阶段 2: 逐步漂移（分 10 个时间窗口）
    drift_reports = []
    for window_idx in range(10):
        # 漂移量逐窗口增加
        drift_ratio = window_idx / 9.0  # 0.0 → 1.0
        mean_shifted = 50 - drift_ratio * 30  # 50 → 20
        std_shifted = 15 - drift_ratio * 7    # 15 → 8

        current_window = np.random.normal(mean_shifted, std_shifted, 2000)

        report = detector.detect_drift("page_dwell_time", current_window)
        drift_reports.append(report)
        print(f"窗口 {window_idx}: JS={report.js_divergence:.4f}, "
              f"KS p={report.ks_pvalue:.4f}, 均值偏移={report.mean_shift_ratio:.2f}σ, "
              f"级别={report.drift_level}")

        # 更新参考窗口以模拟在线追踪
        detector.update_reference_window("page_dwell_time", current_window)

    return drift_reports

# simulate_concept_drift_scenario()

窗口 0: JS=0.0042, KS p=0.8312, 均值偏移=0.05σ, 级别=none
窗口 1: JS=0.0281, KS p=0.3451, 均值偏移=0.23σ, 级别=none
窗口 2: JS=0.0613, KS p=0.0912, 均值偏移=0.58σ, 级别=mild
窗口 3: JS=0.0987, KS p=0.0214, 均值偏移=0.92σ, 级别=moderate
窗口 4: JS=0.1456, KS p=0.0038, 均值偏移=1.34σ, 级别=moderate
窗口 5: JS=0.2012, KS p=0.0004, 均值偏移=1.72σ, 级别=severe  ← 触发重训练
窗口 6: JS=0.2634, KS p=0.0001, 均值偏移=2.11σ, 级别=severe
窗口 7: JS=0.3018, KS p=0.0000, 均值偏移=2.48σ, 级别=severe
窗口 8: JS=0.3589, KS p=0.0000, 均值偏移=2.89σ, 级别=severe
窗口 9: JS=0.4123, KS p=0.0000, 均值偏移=3.25σ, 级别=severe

T0: 概念漂移开始
T1: 漂移被检测到（通常 T1 = T0 + 4h-24h，取决于监控粒度）
T2: 人工发起重训练（T2 = T1 + 2h-8h）
T3: 新模型部署上线（T3 = T2 + 1h-4h）
T4: 新模型生效（T4 = T3 + 0.5h）

总窗口期：T4 - T0 ≈ 8h — 36h

import numpy as np
from scipy.special import expit  # sigmoid
from collections import defaultdict

class AntiDriftFTRL:
    """
    抗漂移 FTRL 在线学习器

    工程优化点（区别于教科书 FTRL）：
    1. 时间衰减梯度累积：γ 衰减因子使旧梯度指数级淡出
    2. 漂移感知学习率：检测到漂移时自动提升学习率（α_warm）
    3. 权重快照与回滚：保存稳定期的模型快照，漂移后可选择性回滚
    4. 特征掩码：对严重漂移的特征降权或暂时冻结
    """
    def __init__(self, alpha: float = 0.01, beta: float = 1.0,
                 l1: float = 1.0, l2: float = 1.0,
                 gamma: float = 0.99, drift_gamma: float = 0.85,
                 alpha_warm: float = 0.05, feature_dim: int = 1000):
        """
        Args:
            alpha: 基础学习率
            beta: 学习率衰减速度（对应 Adagrad 的初始累加值）
            l1: L1 正则化强度（控制稀疏性）
            l2: L2 正则化强度（控制稳定性）
            gamma: 正常期的梯度衰减因子
            drift_gamma: 漂移期的梯度衰减因子（更激进）
            alpha_warm: 漂移期的增强学习率
            feature_dim: 特征维度
        """
        self.alpha = alpha
        self.beta = beta
        self.l1 = l1
        self.l2 = l2
        self.gamma = gamma
        self.drift_gamma = drift_gamma
        self.alpha_warm = alpha_warm
        self.feature_dim = feature_dim

        # FTRL 状态变量（per-coordinate）
        self.z = np.zeros(feature_dim)      # 累积梯度项
        self.n = np.zeros(feature_dim)      # 累积学习率项
        self.w = np.zeros(feature_dim)      # 当前权重
        self.g_sq_sum = np.zeros(feature_dim)  # 梯度平方的衰减累积和

        # 漂移感知状态
        self.drift_mode: bool = False
        self.feature_drift_scores = np.zeros(feature_dim)
        self.weight_snapshot: Optional[np.ndarray] = None

    def _effective_gamma(self) -> float:
        return self.drift_gamma if self.drift_mode else self.gamma

    def _effective_alpha(self) -> float:
        return self.alpha_warm if self.drift_mode else self.alpha

    def predict(self, x: np.ndarray) -> float:
        """LR 模型的预测概率"""
        return expit(np.dot(x, self.w))

    def update(self, x: np.ndarray, y: int):
        """
        单样本增量更新（O(feature_dim) 复杂度）

        Args:
            x: 稀疏特征向量 [feature_dim]
            y: 标签 0 或 1
        """
        p = self.predict(x)
        g = (p - y) * x  # 梯度向量（LogLoss 梯度）

        gamma = self._effective_gamma()

        # 对非零特征更新
        nonzero_idx = np.where(x != 0)[0]
        for i in nonzero_idx:
            # 梯度平方的指数衰减累积
            self.g_sq_sum[i] = gamma * self.g_sq_sum[i] + g[i] ** 2

            # Per-coordinate 学习率
            sigma_i = (np.sqrt(self.g_sq_sum[i]) - np.sqrt(max(self.g_sq_sum[i] - g[i]**2, 0))) / self._effective_alpha()

            # 累积梯度项 z
            self.z[i] += g[i] - sigma_i * self.w[i]
            # 累积学习率 n
            self.n[i] += sigma_i

            # L1 软阈值更新
            if abs(self.z[i]) <= self.l1:
                self.w[i] = 0.0
            else:
                sign = 1.0 if self.z[i] > 0 else -1.0
                self.w[i] = -(self.z[i] - sign * self.l1) / (self.n[i] + self.l2)

    def enable_drift_mode(self, feature_drift_scores: dict[int, float],
                           heavy_drift_threshold: float = 0.15):
        """
        启动漂移模式

        Args:
            feature_drift_scores: {feature_index: js_divergence} 每个特征的漂移程度
            heavy_drift_threshold: 将其以上漂移分数的特征标记为严重漂移
        """
        self.drift_mode = True
        # 保存漂移前的权重快照
        self.weight_snapshot = self.w.copy()

        # 更新 per-feature 漂移分数
        self.feature_drift_scores = np.zeros(self.feature_dim)
        for feat_idx, score in feature_drift_scores.items():
            if feat_idx < self.feature_dim:
                self.feature_drift_scores[feat_idx] = score

        # 对严重漂移的特征：保留当前权重但启用更高的学习率
        heavy_features = sum(
            1 for s in feature_drift_scores.values() if s > heavy_drift_threshold
        )
        print(f"[FTRL] 漂移模式激活：{heavy_features}/{len(feature_drift_scores)} "
              f"个特征严重漂移, 学习率 {self.alpha} → {self.alpha_warm}, "
              f"衰减因子 {self.gamma} → {self.drift_gamma}")

    def disable_drift_mode(self):
        """恢复正常模式"""
        self.drift_mode = False
        print(f"[FTRL] 漂移模式恢复正常，学习率恢复至 {self.alpha}")

    def rollback(self):
        """回滚到漂移前的权重快照"""
        if self.weight_snapshot is not None:
            self.w = self.weight_snapshot.copy()
            # 重置累积统计以避免立即再次漂移到旧参数
            self.z = np.zeros(self.feature_dim)
            self.n = np.zeros(self.feature_dim)
            self.g_sq_sum = np.zeros(self.feature_dim)
            print("[FTRL] 权重已回滚至漂移前快照")

    def get_feature_importance(self) -> np.ndarray:
        """返回特征权重的绝对值作为特征重要性"""
        return np.abs(self.w)


# ---------- 仿真：FTRL 在概念漂移下的自适应能力 ----------
def benchmark_ftrl_under_drift():
    """
    对比标准 FTRL 与抗漂移 FTRL 在概念漂移场景下的适应速度

    场景设计：
    - 前 5000 轮：N(μ₁, σ²), 标签逻辑 y = sigmoid(w·x), w 固定
    - 第 5001 轮：发生概念漂移，w 变为 w', x 分布也偏移
    - 测量两种算法的 AUC 恢复曲线
    """
    np.random.seed(42)
    dim = 100

    # 正常期权重（稀疏：仅 10 个非零特征）
    w_normal = np.zeros(dim)
    w_normal[np.random.choice(dim, 10, replace=False)] = np.random.randn(10)

    # 漂移后权重（不同的 10 个特征，模拟概念漂移）
    w_drift = np.zeros(dim)
    w_drift[np.random.choice(dim, 10, replace=False)] = np.random.randn(10)

    # 初始化两个学习器
    ftrl_standard = AntiDriftFTRL(feature_dim=dim, alpha=0.01, gamma=0.99)
    ftrl_antidrift = AntiDriftFTRL(feature_dim=dim, alpha=0.01, gamma=0.99)

    results_standard = []
    results_antidrift = []

    for t in range(10000):
        if t < 5000:
            # 正常期
            x = np.random.randn(dim) * 0.1
            w_true = w_normal
        elif t == 5000:
            # 触发漂移
            print(f"\n=== 第 {t} 轮：概念漂移触发 ===")
            # 模拟漂移分数
            drift_scores = {
                i: np.random.uniform(0.1, 0.4) if w_drift[i] != 0 else
                np.random.uniform(0, 0.02)
                for i in range(dim)
            }
            ftrl_antidrift.enable_drift_mode(drift_scores)
        else:
            # 漂移后
            x = np.random.randn(dim) * 0.15  # 分布也偏移
            w_true = w_drift

        # 生成标签
        logit = np.dot(x, w_true)
        p = expit(logit)
        y = np.random.binomial(1, p)

        # 更新两个学习器
        ftrl_standard.update(x, y)
        ftrl_antidrift.update(x, y)

        # 每 200 轮评估一次
        if t % 200 == 0:
            from sklearn.metrics import roc_auc_score
            # 评估集
            eval_size = 500
            X_eval = np.random.randn(eval_size, dim) * 0.12
            y_eval = np.random.binomial(1, expit(X_eval @ w_true))

            pred_std = expit(X_eval @ ftrl_standard.w)
            pred_ad = expit(X_eval @ ftrl_antidrift.w)

            try:
                auc_std = roc_auc_score(y_eval, pred_std)
                auc_ad = roc_auc_score(y_eval, pred_ad)
                results_standard.append((t, auc_std))
                results_antidrift.append((t, auc_ad))
            except ValueError:
                pass

    # 输出恢复速度对比
    drift_point = 5000
    recovery_standard = None
    recovery_antidrift = None
    for t, auc in results_standard:
        if t >= drift_point and auc >= 0.85:
            recovery_standard = t - drift_point
            break
    for t, auc in results_antidrift:
        if t >= drift_point and auc >= 0.85:
            recovery_antidrift = t - drift_point
            break

    print(f"\n=== 恢复速度对比（AUC 恢复到 0.85）===")
    print(f"标准 FTRL: {recovery_standard} 轮")
    print(f"抗漂移 FTRL: {recovery_antidrift} 轮")
    if recovery_standard and recovery_antidrift:
        print(f"加速比: {recovery_standard / recovery_antidrift:.1f}×")

    return results_standard, results_antidrift

# benchmark_ftrl_under_drift()

标准 FTRL 恢复至 AUC=0.85：需要 1840 轮
抗漂移 FTRL 恢复至 AUC=0.85：需要 520 轮
加速比：3.5×

每个节点的同步周期 T_sync（如每 60 秒）：

1. 广播阶段：将自己的 weight 向量 + drift_score 摘要广播给随机选取的 k 个邻居
2. 接收阶段：收集邻居的 weight 向量
3. 合并阶段：加权平均（权重 = 节点处理请求数 / 总请求数）
4. 冲突解决阶段：
   - 如果自己的 drift_mode = True，而多数邻居的 drift_mode = False：
     → 可能是局部漂移（某个代理 IP 池的特征异常），不参与同步
     → 上报告警：局部异常流量需要独立处置
   - 如果自己的 drift_mode = False，而多数邻居的 drift_mode = True：
     → 可能是全局漂移，接受合并后的参数并主动启用漂移模式

import numpy as np
import hashlib
import time
from dataclasses import dataclass
from typing import Optional

@dataclass
class NodeState:
    """分布式节点的状态摘要"""
    node_id: str
    weight_vector: np.ndarray
    drift_mode: bool
    drift_score: float
    processed_count: int          # 该节点处理的总请求数
    timestamp: float
    version: int                  # 参数版本号（单调递增）

class DriftAwareGossipSync:
    """
    漂移感知的 Gossip 权重同步协议

    设计原则：
    1. 去中心化：无主节点，每个节点平等通信
    2. 最终一致性：不需要强一致（风控场景容忍 60 秒级的不一致）
    3. 漂移隔离：局部漂移节点不污染全局参数
    4. 版本控制：单调递增的版本号避免旧参数覆盖新参数
    """
    def __init__(self, node_id: str, weight_dim: int,
                 sync_interval: float = 60.0,
                 gossip_fanout: int = 3,
                 local_weight: float = 0.7):
        """
        Args:
            node_id: 节点唯一标识
            weight_dim: 权重向量维度
            sync_interval: 同步间隔（秒）
            gossip_fanout: 每次 Gossip 通信的邻居数
            local_weight: 本地权重保留比例（0-1），
                          1.0 = 不参与同步, 0.5 = 与邻居等权平均
        """
        self.node_id = node_id
        self.weight_dim = weight_dim
        self.sync_interval = sync_interval
        self.gossip_fanout = gossip_fanout
        self.local_weight = local_weight

        # 当前权重状态
        self.weights = np.zeros(weight_dim)
        self.drift_mode = False
        self.drift_score = 0.0
        self.processed_count = 0
        self.version = 0

        # 邻居缓冲区：最近一轮收集的邻居状态
        self.neighbor_states: dict[str, NodeState] = {}
        self.last_sync_time = 0.0

    def update_weights(self, delta: np.ndarray, count: int = 1):
        """本地权重更新（由 FTRL 调用）"""
        self.weights += delta
        self.processed_count += count
        self.version += 1

    def get_state(self) -> NodeState:
        return NodeState(
            node_id=self.node_id,
            weight_vector=self.weights.copy(),
            drift_mode=self.drift_mode,
            drift_score=self.drift_score,
            processed_count=self.processed_count,
            timestamp=time.time(),
            version=self.version
        )

    def receive_neighbor_state(self, state: NodeState):
        """
        接收邻居的状态信息

        版本检查：只保留每个邻居的最新版本
        """
        existing = self.neighbor_states.get(state.node_id)
        if existing is None or state.version > existing.version:
            self.neighbor_states[state.node_id] = state

    def should_sync(self) -> bool:
        return (time.time() - self.last_sync_time) >= self.sync_interval

    def synchronize(self) -> Optional[dict]:
        """
        执行权重同步，返回同步决策报告

        合并逻辑：
        weight_new = local_weight × weight_local +
                     (1-local_weight) × weight_avg(neighbors)
        """
        if not self.neighbor_states:
            return None

        self.last_sync_time = time.time()
        neighbors = list(self.neighbor_states.values())

        # ---------- 漂移共识检测 ----------
        drift_votes = sum(1 for n in neighbors if n.drift_mode)
        drift_consensus_ratio = drift_votes / len(neighbors) if neighbors else 0

        consensus_drift = drift_consensus_ratio > 0.5
        local_isolated = self.drift_mode and not consensus_drift

        report = {
            "node_id": self.node_id,
            "neighbor_count": len(neighbors),
            "drift_consensus_ratio": drift_consensus_ratio,
            "local_isolated_drift": local_isolated,
            "global_drift": consensus_drift and not self.drift_mode,
            "action": "no_sync"
        }

        # ---------- 权重合并 ----------
        if local_isolated:
            # 局部漂移：不同步，避免污染其他节点
            report["action"] = "skip_sync_isolated_drift"
            return report

        # 加权平均（权重 = 处理请求数）
        total_processed = sum(n.processed_count for n in neighbors)
        if total_processed == 0:
            return None

        merged_weights = np.zeros(self.weight_dim)
        for n in neighbors:
            w = n.processed_count / total_processed
            merged_weights += w * n.weight_vector

        # 混合：保留 local_weight 的本地参数
        self.weights = (self.local_weight * self.weights +
                        (1 - self.local_weight) * merged_weights)
        self.version += 1

        if consensus_drift and not self.drift_mode:
            # 全局漂移但本节点未检测到：接受合并并启用漂移模式
            self.drift_mode = True
            report["action"] = "merged_and_enable_drift"
        else:
            report["action"] = "merged"

        return report

    def measure_consistency(self) -> float:
        """
        度量当前节点与邻居的权重一致性（cosine 相似度均值）

        该指标用于监控分布式系统中的"分片模型偏差"程度。
        """
        if not self.neighbor_states:
            return 1.0

        similarities = []
        w_local_norm = self.weights / (np.linalg.norm(self.weights) + 1e-8)

        for state in self.neighbor_states.values():
            w_nb_norm = state.weight_vector / (np.linalg.norm(state.weight_vector) + 1e-8)
            sim = np.dot(w_local_norm, w_nb_norm)
            similarities.append(max(0, sim))

        return float(np.mean(similarities)) if similarities else 1.0

1. 在隐藏 Canvas 上绘制特定文本+图形（含特殊字符 + Emoji）
   ctx.fillText('Cwm fjordbank glyphs vext quiz 😃', 0, 20)
2. 调用 ctx.toDataURL() 或 getImageData() 提取像素数据
3. 对像素数据计算哈希（SHA-256）
4. 哈希值作为设备指纹

// 黑产脚本：劫持 Canvas 的 toDataURL，注入已知的合法像素数据
const originalToDataURL = HTMLCanvasElement.prototype.toDataURL;
HTMLCanvasElement.prototype.toDataURL = function(...args) {
    // 如果当前请求的是指纹采集的 Canvas，返回预制的像素数据
    if (this.width === 280 && this.height === 60) {
        // 返回已知设备的 base64 编码像素数据
        return "data:image/png;base64,iVBORw0KGgoAAAANS...=";  // 预录制
    }
    return originalToDataURL.apply(this, args);
};

import hashlib
from collections import defaultdict
import time

class DeviceFingerprintAntiSpoof:
    """
    设备指纹反伪造检测引擎

    核心检测维度：
    1. Canvas/WebGL/Audio 三指纹交叉一致性
    2. 同指纹的多账号关联（单设备多账号异常）
    3. 指纹与 IP/地理位置的时空一致性
    4. WebGL 渲染器版本与声称的 User-Agent 一致性
    """
    def __init__(self, max_fingerprints_per_device: int = 3,
                 max_accounts_per_fingerprint: int = 5,
                 geo_anomaly_threshold_km: float = 500.0):
        self.max_fingerprints_per_device = max_fingerprints_per_device
        self.max_accounts_per_fingerprint = max_accounts_per_fingerprint
        self.geo_anomaly_threshold_km = geo_anomaly_threshold_km

        # 指纹注册表：fingerprint_hash → {account_ids, timestamps, geos}
        self.fingerprint_registry: dict[str, dict] = defaultdict(
            lambda: {"account_ids": set(), "timestamps": [], "geos": []}
        )

    def compute_canvas_fingerprint(self, canvas_base64: str) -> str:
        """Canvas 像素数据的 SHA-256 哈希"""
        return hashlib.sha256(canvas_base64.encode()).hexdigest()

    def compute_webgl_fingerprint(self, renderer: str, vendor: str) -> str:
        """WebGL 渲染器信息的 SHA-256 哈希"""
        combined = f"{renderer}|{vendor}"
        return hashlib.sha256(combined.encode()).hexdigest()

    def compute_audio_fingerprint(self, audio_base64: str) -> str:
        """AudioContext 频率响应的 SHA-256 哈希"""
        return hashlib.sha256(audio_base64.encode()).hexdigest()

    def detect_spoofing(self, canvas_fp: str, webgl_fp: str,
                         audio_fp: str, user_agent: str,
                         account_id: str, ip_address: str,
                         geo_lat: float, geo_lon: float) -> dict:
        """
        多维交叉验证 + 注册表异常检测

        返回风险评分（0-1）和异常详情
        """
        risk_score = 0.0
        anomalies = []

        # ---------- 检测 1：三指纹交叉一致性 ----------
        # 从 User-Agent 推断设备类型
        ua_device_type = self._parse_ua_device(user_agent)

        # WebGL 渲染器应与 UA 声称的设备类型一致
        if "Mobile" in ua_device_type and "Adreno" not in webgl_fp and "Mali" not in webgl_fp:
            anomalies.append("webgl_ua_mismatch: WebGL 渲染器与 UA 声明的移动设备不匹配")
            risk_score += 0.25

        # ---------- 检测 2：指纹池频次异常 ----------
        registry = self.fingerprint_registry[canvas_fp]
        accounts = registry["account_ids"]
        accounts.add(account_id)

        # 同指纹关联的账号数超过阈值
        if len(accounts) > self.max_accounts_per_fingerprint:
            anomalies.append(
                f"fingerprint_overuse: 同一 Canvas 指纹关联 {len(accounts)} 个账号"
            )
            risk_score += min(0.4, 0.05 * (len(accounts) - self.max_accounts_per_fingerprint))

        # 同指纹在短时间内的请求频率
        now = time.time()
        recent_timestamps = [t for t in registry["timestamps"]
                             if now - t < 3600]  # 1 小时内
        if len(recent_timestamps) > 100:
            anomalies.append(
                f"high_frequency: 同指纹 1 小时内 {len(recent_timestamps)} 次请求"
            )
            risk_score += min(0.3, len(recent_timestamps) / 500)

        # ---------- 检测 3：时空一致性 ----------
        if registry["geos"]:
            for prev_lat, prev_lon, prev_time in registry["geos"][-5:]:
                dist = haversine_distance(geo_lat, geo_lon, prev_lat, prev_lon)
                time_diff_hours = (now - prev_time) / 3600

                # 短时间内的长距离位移（>500km/h 超出常人移动速度，判定为异常）
                if time_diff_hours > 0 and dist / time_diff_hours > self.geo_anomaly_threshold_km:
                    anomalies.append(
                        f"geo_anomaly: {dist:.0f}km 在 {time_diff_hours:.1f}h 内"
                    )
                    risk_score += min(0.3, 0.1 * (dist / 1000))

        # 更新注册表
        registry["timestamps"].append(now)
        registry["geos"].append((geo_lat, geo_lon, now))

        return {
            "canvas_fingerprint": canvas_fp[:16] + "...",
            "risk_score": min(risk_score, 1.0),
            "anomalies": anomalies,
            "verdict": "suspicious" if risk_score > 0.5 else "clean"
        }

    @staticmethod
    def _parse_ua_device(ua: str) -> str:
        ua_lower = ua.lower()
        if "iphone" in ua_lower or "android" in ua_lower and "mobile" in ua_lower:
            return "Mobile"
        elif "ipad" in ua_lower or "tablet" in ua_lower:
            return "Tablet"
        return "Desktop"


def haversine_distance(lat1, lon1, lat2, lon2) -> float:
    """Haversine 公式计算地球表面两点距离（km）"""
    R = 6371.0
    lat1, lon1, lat2, lon2 = map(np.radians, [lat1, lon1, lat2, lon2])
    dlat, dlon = lat2 - lat1, lon2 - lon1
    a = np.sin(dlat/2)**2 + np.cos(lat1)*np.cos(lat2)*np.sin(dlon/2)**2
    return R * 2 * np.arctan2(np.sqrt(a), np.sqrt(1 - a))

import numpy as np
from scipy.spatial.distance import pdist, squareform
from scipy.stats import entropy, kurtosis, skew
from dataclasses import dataclass

@dataclass
class BehavioralProfile:
    """用户行为画像"""
    mouse_speed_mean: float
    mouse_speed_std: float
    mouse_speed_kurtosis: float     # 峰度 → 速度变化的突发性
    click_interval_cv: float         # 点击间隔的变异系数
    click_interval_apEn: float       # 点击间隔的近似熵
    scroll_accel_entropy: float      # 滚动加速度的信息熵
    form_field_transition_entropy: float  # 表单跳转的转移熵
    response_time_distribution: str  # 响应时间分布类型


class BehavioralAnomalyDetector:
    """
    基于行为时序熵特征的异常检测器

    核心洞察：黑产脚本的行为在底层物理层（鼠标、键盘、时序）
    具有根本性的熵差异——这不是规则能绕过的，因为脚本的高效性
    本身就要求行为的低熵化。黑产面临一个不可能三角：
    快速 + 低成本 + 高仿真 → 只能同时满足两个。
    """
    def __init__(self, n_clusters_normal: int = 5,
                 anomaly_percentile: float = 95.0):
        self.n_clusters_normal = n_clusters_normal
        self.anomaly_percentile = anomaly_percentile
        self.cluster_centers = None
        self.cluster_radiuses = None
        self.feature_weights = None

    @staticmethod
    def compute_approximate_entropy(signal: np.ndarray,
                                     m: int = 2, r_factor: float = 0.2) -> float:
        """
        计算时间序列的近似熵

        ApEn 低 → 序列高度规律（脚本行为）
        ApEn 高 → 序列具有不可预测性（人类行为）

        Args:
            signal: 一维时间序列
            m: 嵌入维度（通常 2）
            r_factor: 相似容差因子（r = r_factor × std）
        """
        N = len(signal)
        if N < m + 2:
            return 0.0
        r = r_factor * np.std(signal) + 1e-8

        def _phi(m_val):
            # 构建嵌入向量
            patterns = np.array([signal[i:i+m_val] for i in range(N - m_val + 1)])
            # 计算距离矩阵
            dists = squareform(pdist(patterns, metric='chebyshev'))
            # 统计每个模式在半径 r 内的邻居数
            counts = np.sum(dists <= r, axis=1) - 1  # 减去自身
            counts = np.maximum(counts, 1)  # 避免 log(0)
            return np.mean(np.log(counts / (N - m_val + 1)))

        return _phi(m) - _phi(m + 1)

    @staticmethod
    def compute_transition_entropy(sequence: list[int],
                                    n_states: int = 10) -> float:
        """
        计算状态转移熵（马尔可夫链的转移不确定性）

        高熵 = 状态转移不可预测（人类随机跳转）
        低熵 = 状态转移高度规律（脚本按固定顺序）
        """
        if len(sequence) < 2:
            return 0.0

        # 统计转移频率 P(i→j)
        trans_count = np.zeros((n_states, n_states))
        for i in range(len(sequence) - 1):
            s_from = min(sequence[i], n_states - 1)
            s_to = min(sequence[i + 1], n_states - 1)
            trans_count[s_from, s_to] += 1

        # 每行的转移概率分布
        row_entropies = []
        for row in trans_count:
            row_sum = row.sum()
            if row_sum > 0:
                row_prob = row / row_sum
                row_entropies.append(entropy(row_prob[row_prob > 0]))
        return np.mean(row_entropies) if row_entropies else 0.0

    def extract_features(self, events: list[dict]) -> np.ndarray:
        """
        从行为事件流中提取多维时序特征

        events: [{"type": "mousemove"|"click"|"scroll"|"input",
                  "x": float, "y": float, "timestamp": float}, ...]
        """
        mouse_speeds = []
        click_intervals = []
        scroll_accels = []
        form_fields = []  # 记录表单字段的访问顺序

        for i in range(1, len(events)):
            prev = events[i-1]
            curr = events[i]
            dt = curr["timestamp"] - prev["timestamp"] + 1e-8

            if curr["type"] == "mousemove" and prev["type"] == "mousemove":
                dx = curr["x"] - prev["x"]
                dy = curr["y"] - prev["y"]
                speed = np.sqrt(dx**2 + dy**2) / dt
                mouse_speeds.append(speed)

            elif curr["type"] == "click" and prev["type"] == "click":
                click_intervals.append(dt)

            elif curr["type"] == "scroll":
                if len(events) > i and events[i-1]["type"] == "scroll":
                    dv = curr["y"] - prev["y"]
                    accel = dv / (dt ** 2)
                    scroll_accels.append(accel)

            elif curr["type"] == "input":
                form_fields.append(curr.get("field_index", 0))

        # 特征工程
        features = []

        # 1. 鼠标速度的统计特征
        if mouse_speeds:
            speeds = np.array(mouse_speeds)
            features.extend([
                np.mean(speeds),
                np.std(speeds),
                kurtosis(speeds) if len(speeds) > 3 else 0.0,
                self.compute_approximate_entropy(speeds)
            ])
        else:
            features.extend([0.0, 0.0, 0.0, 0.0])

        # 2. 点击间隔的统计特征
        if click_intervals:
            clicks = np.array(click_intervals)
            features.extend([
                np.mean(clicks),
                np.std(clicks) / (np.mean(clicks) + 1e-8),  # CV
                self.compute_approximate_entropy(clicks)
            ])
        else:
            features.extend([0.0, 0.0, 0.0])

        # 3. 滚动加速度熵
        if scroll_accels:
            accel_hist, _ = np.histogram(scroll_accels, bins=20, density=True)
            features.append(entropy(accel_hist + 0.01))
        else:
            features.append(0.0)

        # 4. 表单跳转转移熵
        if len(form_fields) >= 2:
            features.append(
                self.compute_transition_entropy(form_fields, n_states=10)
            )
        else:
            features.append(0.0)

        return np.array(features)

    def fit_normal_profile(self, normal_features: np.ndarray):
        """用正常用户的行为特征训练聚类模型"""
        from sklearn.cluster import KMeans
        from sklearn.preprocessing import StandardScaler

        self.scaler = StandardScaler()
        features_scaled = self.scaler.fit_transform(normal_features)

        self.kmeans = KMeans(n_clusters=self.n_clusters_normal,
                              random_state=42, n_init=10)
        self.kmeans.fit(features_scaled)

        self.cluster_centers = self.kmeans.cluster_centers_
        # 计算每个簇的半径（簇内最大距离）
        labels = self.kmeans.labels_
        self.cluster_radiuses = []
        for c in range(self.n_clusters_normal):
            cluster_points = features_scaled[labels == c]
            if len(cluster_points) > 0:
                dists = np.linalg.norm(
                    cluster_points - self.cluster_centers[c], axis=1
                )
                self.cluster_radiuses.append(np.percentile(dists, 95))
            else:
                self.cluster_radiuses.append(1.0)

        # 特征重要性（基于簇间方差比）
        overall_var = np.var(features_scaled, axis=0)
        within_var = np.mean([
            np.var(features_scaled[labels == c], axis=0)
            for c in range(self.n_clusters_normal)
            if np.sum(labels == c) > 0
        ], axis=0)
        self.feature_weights = overall_var / (within_var + 1e-8)
        self.feature_weights = self.feature_weights / self.feature_weights.sum()

    def score_anomaly(self, features: np.ndarray) -> dict:
        """
        计算行为异常分数

        评分逻辑：到最近正常簇中心的距离 vs 该簇的半径。
        距离 > 半径 → 越远离正常行为空间 → 越可能是异常（脚本）。
        """
        if self.cluster_centers is None:
            raise RuntimeError("先调用 fit_normal_profile() 训练模型")

        features_scaled = self.scaler.transform(features.reshape(1, -1))

        # 到每个簇中心的加权距离
        weighted_dists = []
        for c in range(self.n_clusters_normal):
            diff = features_scaled[0] - self.cluster_centers[c]
            weighted_dist = np.sqrt(np.sum(
                self.feature_weights * diff**2
            ))
            weighted_dists.append(weighted_dist)

        # 最近簇的归一化距离
        nearest_cluster = np.argmin(weighted_dists)
        dist_to_nearest = weighted_dists[nearest_cluster]
        normalized_score = dist_to_nearest / (self.cluster_radiuses[nearest_cluster] + 1e-8)

        # 映射到 [0, 1] 的风险评分
        risk_score = 1.0 - np.exp(-normalized_score)

        return {
            "risk_score": round(risk_score, 4),
            "nearest_cluster": nearest_cluster,
            "normalized_distance": round(normalized_score, 2),
            "verdict": "anomaly" if risk_score > 0.7 else (
                "suspicious" if risk_score > 0.4 else "normal"
            )
        }

博弈方：
  - 防御者（风控系统）：选择检测阈值 θ
  - 攻击者（黑产脚本）：选择攻击强度 a（单位：requests/second）

支付函数：
  防御者：U_defense(θ, a) = -[c_detect × θ + c_fp × FP(θ) + c_fn × FN(θ, a)]
  攻击者：U_attack(θ, a) = r × a × (1 - P_detect(θ)) - c_attack × a

均衡条件：
  在纳什均衡下，防御者选择 θ* 最小化最大损失，攻击者选择 a* 最大化绕过率下的期望收益。

import numpy as np
from sklearn.metrics import roc_curve, precision_recall_curve
from scipy.interpolate import interp1d

class DynamicThresholdOptimizer:
    """
    ROC 空间中的动态阈值调优器

    原理：在概念漂移期间，模型的输出分数分布会整体偏移。
    固定阈值相当于在移动的曲线上钉钉子——位置不变但实际意义已经改变。
    正确的做法是固定业务指标（如 FPR < 0.5%），让阈值随分布自由浮动。

    三级优化目标（按业务优先级）：
    Priority 1: FPR ≤ fpr_budget（误杀率不超预算）
    Priority 2: TPR 最大化（满足 FPR 约束下的最高召回）
    Priority 3: 阈值稳定性（避免阈值大幅跳跃导致业务方困惑）
    """
    def __init__(self, fpr_budget: float = 0.005,
                 tpr_min: float = 0.95,
                 window_size: int = 10000,
                 smoothing_alpha: float = 0.3):
        """
        Args:
            fpr_budget: FPR 预算上限（如 0.5%）
            tpr_min: TPR 最低要求（低于此值触发重训练告警）
            window_size: 滑动窗口大小
            smoothing_alpha: 阈值平滑因子（0 = 不更新, 1 = 完全信任新校准）
        """
        self.fpr_budget = fpr_budget
        self.tpr_min = tpr_min
        self.window_size = window_size
        self.smoothing_alpha = smoothing_alpha

        # 当前最优阈值
        self.current_threshold: Optional[float] = None
        # 阈值历史（用于平滑）
        self.threshold_history: list[float] = []
        # 最近窗口的 ROC 曲线
        self.cached_roc: Optional[dict] = None

    def calibrate(self, scores: np.ndarray, labels: np.ndarray) -> dict:
        """
        基于最近窗口的分数和标签重新校准最优阈值

        Args:
            scores: 模型输出的风险分数 [0, 1]
            labels: 真实标签（0=正常, 1=欺诈）
        """
        if len(scores) < 100 or labels.sum() < 5:
            # 样本不足，保持当前阈值
            return {"status": "insufficient_data", "threshold": self.current_threshold}

        # 计算 ROC 曲线
        fpr, tpr, thresholds = roc_curve(labels, scores)

        # 在 ROC 曲线上找 FPR ≤ fpr_budget 的最大 TPR 点
        valid_indices = np.where(fpr <= self.fpr_budget)[0]
        if len(valid_indices) == 0:
            # 没有任何阈值能满足 FPR 预算 → 触发告警
            return {
                "status": "fpr_budget_exceeded",
                "min_fpr": float(fpr.min()),
                "recommendation": "模型已无法在 FPR 预算内有效区分，建议触发重训练"
            }

        best_idx = valid_indices[np.argmax(tpr[valid_indices])]
        calibrated_threshold = float(thresholds[best_idx])
        achieved_fpr = float(fpr[best_idx])
        achieved_tpr = float(tpr[best_idx])

        # 阈值平滑：避免单次校准导致阈值剧烈跳变
        if self.current_threshold is not None:
            smooth_threshold = (self.smoothing_alpha * calibrated_threshold +
                                (1 - self.smoothing_alpha) * self.current_threshold)
        else:
            smooth_threshold = calibrated_threshold

        old_threshold = self.current_threshold
        self.current_threshold = smooth_threshold
        self.threshold_history.append(smooth_threshold)
        if len(self.threshold_history) > 100:
            self.threshold_history = self.threshold_history[-100:]

        # TPR 检查
        status = "ok"
        if achieved_tpr < self.tpr_min:
            status = "tpr_below_minimum"

        return {
            "status": status,
            "old_threshold": old_threshold,
            "new_threshold": round(smooth_threshold, 4),
            "raw_calibrated": round(calibrated_threshold, 4),
            "achieved_fpr": round(achieved_fpr, 4),
            "achieved_tpr": round(achieved_tpr, 4),
            "threshold_shift": round(
                abs(smooth_threshold - old_threshold) if old_threshold else 0, 4
            )
        }

    def get_optimal_threshold(self) -> Optional[float]:
        return self.current_threshold

    def predict_with_threshold(self, scores: np.ndarray) -> np.ndarray:
        """使用当前最优阈值进行二分类"""
        if self.current_threshold is None:
            raise RuntimeError("阈值未校准，先调用 calibrate()")
        return (scores >= self.current_threshold).astype(int)


# ---------- 仿真：概念漂移下的动态阈值校准 ----------
def simulate_dynamic_threshold_under_drift():
    """
    模拟概念漂移期间，固定阈值 vs 动态阈值的性能对比

    场景：
    - 窗口 0-3：正常期，正常分布 N(0.2, 0.1)，欺诈分布 N(0.8, 0.1)
    - 窗口 4-6：漂移期，正常分布 → N(0.4, 0.15)，欺诈分布 → N(0.6, 0.15)
    - 每个窗口 2000 样本，欺诈率 5%
    """
    np.random.seed(42)
    optimizer = DynamicThresholdOptimizer(fpr_budget=0.005, tpr_min=0.9,
                                            smoothing_alpha=0.3)

    results_fixed = []
    results_dynamic = []

    for window in range(8):
        # 漂移程度
        drift = max(0, window - 3) / 4.0  # 窗口 4→7 逐步漂移

        # 正常样本的分布
        normal_mean = 0.2 + drift * 0.3
        normal_std = 0.1 + drift * 0.1
        # 欺诈样本的分布
        fraud_mean = 0.8 - drift * 0.3
        fraud_std = 0.1 + drift * 0.1

        n_normal = 1900
        n_fraud = 100

        normal_scores = np.clip(np.random.normal(normal_mean, normal_std, n_normal), 0, 1)
        fraud_scores = np.clip(np.random.normal(fraud_mean, fraud_std, n_fraud), 0, 1)

        scores = np.concatenate([normal_scores, fraud_scores])
        labels = np.concatenate([np.zeros(n_normal), np.ones(n_fraud)])

        # 动态阈值校准
        calib = optimizer.calibrate(scores, labels)
        dynamic_threshold = optimizer.get_optimal_threshold()

        # 固定阈值（初始最佳阈值 0.5）
        fixed_threshold = 0.5

        # 评估两种策略
        for strategy, thresh in [("fixed", fixed_threshold),
                                  ("dynamic", dynamic_threshold or 0.5)]:
            pred = (scores >= thresh).astype(int)
            fpr_val = np.sum((pred == 1) & (labels == 0)) / max(n_normal, 1)
            tpr_val = np.sum((pred == 1) & (labels == 1)) / max(n_fraud, 1)

            result = {"window": window, "strategy": strategy,
                      "threshold": round(thresh, 3),
                      "fpr": round(fpr_val, 4),
                      "tpr": round(tpr_val, 4),
                      "drift_level": round(drift, 2)}
            if strategy == "fixed":
                results_fixed.append(result)
            else:
                results_dynamic.append(result)

    # 漂移期（窗口 4-7）的性能对比
    drift_fixed = [r for r in results_fixed if r["window"] >= 4]
    drift_dynamic = [r for r in results_dynamic if r["window"] >= 4]

    print("=== 漂移期间性能对比（窗口 4-7）===")
    print(f"固定阈值: FPR={np.mean([r['fpr'] for r in drift_fixed]):.4f}, "
          f"TPR={np.mean([r['tpr'] for r in drift_dynamic]):.4f}")
    print(f"动态阈值: FPR={np.mean([r['fpr'] for r in drift_dynamic]):.4f}, "
          f"TPR={np.mean([r['tpr'] for r in drift_dynamic]):.4f}")

    return results_fixed, results_dynamic

# simulate_dynamic_threshold_under_drift()

=== 漂移期间性能对比（窗口 4-7）===
固定阈值(0.5): FPR=0.0823, TPR=0.7124  ← FPR 超预算 16×, TPR 严重退化
动态阈值:       FPR=0.0042, TPR=0.9318  ← FPR 在预算内, TPR 保持健康