标题： 关于多语言文件的滥用与检测 显示英文标题

标题： On the Abuse and Detection of Polyglot Files

摘要： 多语言文件是一种同时符合两种或多种格式要求的文件。 对于依赖特定格式检测器/签名来路由文件的恶意软件检测系统以及文件上传和清理工具来说，多语言文件构成了问题。 在这项工作中，我们发现现有的文件格式和嵌入文件检测工具，即使那些专门为多语言文件开发的工具，在实际环境中也未能可靠地检测到多语言文件，使组织面临攻击风险。 为了解决这个问题，我们研究了恶意行为者在实际环境中使用多语言文件的情况，发现了$30$个多语言样本和$15$个利用多语言文件的攻击链。 在本报告中，我们强调了两个知名的高级持续威胁（APT）组织，它们的网络攻击链依赖于多语言文件来绕过检测机制。 利用我们在野外对多语言文件使用情况的调查知识——这是第一次此类调查——我们基于对手技术创建了一个新的数据集。 然后，我们使用这个数据集训练了一种机器学习检测解决方案 PolyConv。 PolyConv 的多语言文件检测的精确率-召回率曲线下的面积得分达到$0.999$，F1 得分为$99.20$%，文件格式识别得分为$99.47$%，显著优于所有其他测试工具。 我们还开发了一种内容清除与重建工具 ImSan，该工具成功清除了测试中$100$%的图像型多语言文件，这是通过调查发现的最常见的类型。 我们的工作为防御者提供了具体的工具和建议，以更好地防御多语言文件攻击，同时也为未来的研究指明了方向，以制定更健壮的文件规范和清除方法。 显示英文摘要

摘要： A polyglot is a file that is valid in two or more formats. Polyglot files pose a problem for malware detection systems that route files to format-specific detectors/signatures, as well as file upload and sanitization tools. In this work we found that existing file-format and embedded-file detection tools, even those developed specifically for polyglot files, fail to reliably detect polyglot files used in the wild, leaving organizations vulnerable to attack. To address this issue, we studied the use of polyglot files by malicious actors in the wild, finding $30$ polyglot samples and $15$ attack chains that leveraged polyglot files. In this report, we highlight two well-known APTs whose cyber attack chains relied on polyglot files to bypass detection mechanisms. Using knowledge from our survey of polyglot usage in the wild -- the first of its kind -- we created a novel data set based on adversary techniques. We then trained a machine learning detection solution, PolyConv, using this data set. PolyConv achieves a precision-recall area-under-curve score of $0.999$ with an F1 score of $99.20$% for polyglot detection and $99.47$% for file-format identification, significantly outperforming all other tools tested. We developed a content disarmament and reconstruction tool, ImSan, that successfully sanitized $100$% of the tested image-based polyglots, which were the most common type found via the survey. Our work provides concrete tools and suggestions to enable defenders to better defend themselves against polyglot files, as well as directions for future work to create more robust file specifications and methods of disarmament.