URL Evaluator: Semi-automatic evaluation of suspicious URLs from honeypots

Botnets often rely on malicious URLs to distribute malware payloads over HTTP. Identifying these URLs is critical for network defense, as it enables the detection or blocking of access from within the network, thereby preventing potential malware infections. A promising approach for uncovering URLs used for malware distribution involves analyzing data from SSH honeypots. However, not every URL observed in a honeypot log is necessarily malicious. In this paper, we present the "URL Evaluator" system, which automates the extraction and analysis of suspicious URLs from SSH honeypot data. It employs a semi-automated evaluation process, which leverages multiple data sources and methods and escalates to human operators only when necessary. Confirmed malicious URLs are then used in a network monitoring system to detect any accesses to such URLs from within the defended network. Any such access is automatically reported to the responsible administrator or security team. Additionaly, the system contributes newly found malicious URLs to a large community blacklist. The paper describes the system architecture, key components, and its operational results.