论多语言文件（Polyglot Files）的滥用与检测
On the Abuse and Detection of Polyglot Files
AI总结：
本文首次系统调查了野外多语言文件滥用情况，基于对手技术构建数据集，提出检测方案PolyConv和净化工具ImSan，显著提升了对多语言文件的检测与防御能力。
摘要：
多语言文件（polyglot）是一种在两种或两种以上格式中均有效的文件。多语言文件给恶意软件检测系统带来了问题，这些系统将文件路由到特定格式的检测器/签名，同时也给文件上传和净化工具带来了问题。在这项工作中，我们发现现有的文件格式和嵌入式文件检测工具，即使是专门为多语言文件开发的工具，也无法可靠地检测出在野外使用的多语言文件，从而使组织容易受到攻击。为了解决这个问题，我们研究了恶意行为者在野外对多语言文件的使用情况，发现了30个多语言样本和15个利用多语言文件的攻击链。在本报告中，我们重点介绍了两个著名的APT（高级持续性威胁）组织，其网络攻击链依赖多语言文件来绕过检测机制。利用我们对野外多语言文件使用情况的调查所得的知识——这是同类调查中的首次——我们基于对手技术创建了一个新颖的数据集。然后，我们使用该数据集训练了一个机器学习检测解决方案PolyConv。PolyConv在多语言文件检测方面达到了0.999的精确率-召回率曲线下面积分数，F1分数为99.20%，在文件格式识别方面达到99.47%，显著优于所有其他测试工具。我们开发了一个内容解除武装与重建工具ImSan，该工具成功净化了100%的基于图像的多语言文件测试样本，这些样本是通过调查发现的最常见类型。我们的工作提供了具体的工具和建议，使防御者能够更好地防御多语言文件，同时为未来工作指明了方向，以创建更健壮的文件规范和解除武装方法。
英文摘要：
A polyglot is a file that is valid in two or more formats. Polyglot files pose a problem for malware detection systems that route files to format-specific detectors/signatures, as well as file upload and sanitization tools. In this work we found that existing file-format and embedded-file detection tools, even those developed specifically for polyglot files, fail to reliably detect polyglot files used in the wild, leaving organizations vulnerable to attack. To address this issue, we studied the use of polyglot files by malicious actors in the wild, finding $30$ polyglot samples and $15$ attack chains that leveraged polyglot files. In this report, we highlight two well-known APTs whose cyber attack chains relied on polyglot files to bypass detection mechanisms. Using knowledge from our survey of polyglot usage in the wild -- the first of its kind -- we created a novel data set based on adversary techniques. We then trained a machine learning detection solution, PolyConv, using this data set. PolyConv achieves a precision-recall area-under-curve score of $0.999$ with an F1 score of $99.20$% for polyglot detection and $99.47$% for file-format identification, significantly outperforming all other tools tested. We developed a content disarmament and reconstruction tool, ImSan, that successfully sanitized $100$% of the tested image-based polyglots, which were the most common type found via the survey. Our work provides concrete tools and suggestions to enable defenders to better defend themselves against polyglot files, as well as directions for future work to create more robust file specifications and methods of disarmament.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
