// Resource analysis rules and patterns
export const resourceRules = {
  // Suspicious file extensions
  suspiciousExtensions: [
    '.exe',
    '.msi',
    '.bat',
    '.cmd',
    '.ps1',
    '.vbs',
    '.js',
    '.jar',
    '.zip',
    '.rar',
    '.7z',
    '.tar',
    '.gz'
  ],

  // Suspicious MIME types
  suspiciousMimeTypes: [
    'application/x-msdownload',
    'application/x-ms-installer',
    'application/x-executable',
    'application/x-dosexec',
    'application/x-msdos-program',
    'application/x-java-archive',
    'application/zip',
    'application/x-rar-compressed',
    'application/x-7z-compressed',
    'application/x-tar',
    'application/gzip'
  ],

  // Suspicious resource patterns
  resourcePatterns: [
    /\/download\//i,
    /\/install\//i,
    /\/update\//i,
    /\/upgrade\//i,
    /\/patch\//i,
    /\/setup\//i,
    /\/installer\//i,
    /\/executable\//i,
    /\/binary\//i,
    /\/program\//i
  ],

  // Suspicious domains for resources
  suspiciousDomains: [
    /^(?!www\.)[a-zA-Z0-9-]+\.(tk|ml|ga|cf|gq)$/i,
    /^[0-9]+\.(com|net|org|edu|gov)$/i,
    /^[a-zA-Z0-9-]+\.(xyz|top|cc|club)$/i
  ],

  // Suspicious content types
  suspiciousContentTypes: [
    'application/javascript',
    'text/javascript',
    'application/x-javascript',
    'application/ecmascript',
    'text/ecmascript'
  ],

  // Weighting system for risk assessment
  weights: {
    extension: 2,
    mimeType: 2,
    resourcePattern: 1,
    domain: 2,
    contentType: 1
  },

  // Risk thresholds
  thresholds: {
    high: 4,
    medium: 2,
    low: 1
  },

  // Resource categories
  categories: {
    executable: ['exe', 'msi', 'bat', 'cmd', 'ps1', 'vbs', 'jar'],
    archive: ['zip', 'rar', '7z', 'tar', 'gz'],
    script: ['js', 'vbs', 'ps1'],
    document: ['pdf', 'doc', 'docx', 'xls', 'xlsx'],
    media: ['jpg', 'jpeg', 'png', 'gif', 'mp4', 'mp3']
  }
}; 