BitDefender Alert Simulator - more events

BitDefender Alert Simulator.js

const fs = require('fs');
const path = require('path');
const winston = require('winston');

// customize file here or via CLI in future
const LOG_FILE = process.env.LOG_FILE || 'bitdefender_sim.log';

// Winston logger (console + file)
const logger = winston.createLogger({
  level: 'info',
  format: winston.format.combine(
    winston.format.timestamp(),
    winston.format.printf(({ timestamp, level, message }) => {
      return `${timestamp} - ${level.toUpperCase()}: ${message}`;
    })
  ),
  transports: [
    new winston.transports.Console(),
    new winston.transports.File({ filename: LOG_FILE })
  ]
});

// Event types to simulate
const EVENT_TYPES = [
  'SUSPICIOUS_DOWNLOAD',
  'MALWARE_DETECTED',
  'NETWORK_INTRUSION',
  'PHISHING_EMAIL',
  'RANSOMWARE_SIGNATURE',
  'FIREWALL_BLOCK',
  'IDS_ALERT',
  'SYSTEM_HEALTH_CHECK'
];

// payload generators
function randomIp() {
  return Array(4).fill(0).map(() => Math.floor(Math.random() * 255)).join('.');
}

function randomFilePath() {
  const names = ['secret', 'invoice', 'passwords', 'config', 'malware'];
  const exts = ['exe', 'zip', 'scr', 'docx', 'pdf'];
  return `${names[Math.floor(Math.random() * names.length)]}.${exts[Math.floor(Math.random() * exts.length)]}`;
}

function generateEvent(type) {
  const base = { type, timestamp: new Date().toISOString() };

  switch(type) {
    case 'SUSPICIOUS_DOWNLOAD':
      return { ...base, url: `http://${randomIp()}/download/${randomFilePath()}` };
    case 'MALWARE_DETECTED':
      return { ...base, file: randomFilePath(), severity: 'HIGH' };
    case 'NETWORK_INTRUSION':
      return { ...base, sourceIp: randomIp(), destPort: Math.floor(Math.random() * 65535) };
    case 'PHISHING_EMAIL':
      return { ...base, from: `${randomIp()}@phish.example.com`, subject: 'Verify your account' };
    case 'RANSOMWARE_SIGNATURE':
      return { ...base, process: randomFilePath(), action: 'ENCRYPT_START' };
    case 'FIREWALL_BLOCK':
      return { ...base, ip: randomIp(), rule: 'BLOCK_ALL' };
    case 'IDS_ALERT':
      return { ...base, signature: `IDS_SIG_${Math.floor(Math.random() * 1000)}` };
    case 'SYSTEM_HEALTH_CHECK':
      return { ...base, cpu: `${Math.random() * 100 | 0}%`, mem: `${Math.random() * 100 | 0}%` };
    default:
      return base;
  }
}

function logEvent(evt) {
  const line = JSON.stringify(evt);
  logger.info(line);
}

// continuous simulation
function startSimulation(ratePerSecond = 1) {
  logger.info(`Starting simulation: ~${ratePerSecond} evt/sec`);

  setInterval(() => {
    const type = EVENT_TYPES[Math.floor(Math.random() * EVENT_TYPES.length)];
    const evt = generateEvent(type);
    logEvent(evt);
  }, 1000 / ratePerSecond);
}

// burst mode
function burstEvents(count = 50) {
  logger.info(`Burst: generating ${count} events`);
  for(let i = 0; i < count; i++) {
    const type = EVENT_TYPES[Math.floor(Math.random() * EVENT_TYPES.length)];
    const evt = generateEvent(type);
    logEvent(evt);
  }
}

// simple CLI
const mode = process.argv[2];
if (mode === 'burst') {
  const count = parseInt(process.argv[3], 10) || 100;
  burstEvents(count);
} else {
  const rate = parseInt(process.argv[2], 10) || 2;
  startSimulation(rate);
}

module.exports = {
  generateEvent,
  EVENT_TYPES
};