A polyglot is a file that is valid in two or more formats. Polyglot files
pose a problem for malware detection systems that route files to
format-specific detectors/signatures, as well as file upload and sanitization
tools. In this work we found that existing file-format and embedded-file
detection tools, even those developed specifically for polyglot files, fail to
reliably detect polyglot files used in the wild, leaving organizations
vulnerable to attack. To address this issue, we studied the use of polyglot
files by malicious actors in the wild, finding $30$ polyglot samples and $15$
attack chains that leveraged polyglot files. In this report, we highlight two
well-known APTs whose cyber attack chains relied on polyglot files to bypass
detection mechanisms. Using knowledge from our survey of polyglot usage in the
wild -- the first of its kind -- we created a novel data set based on adversary
techniques. We then trained a machine learning detection solution, PolyConv,
using this data set. PolyConv achieves a precision-recall area-under-curve
score of $0.999$ with an F1 score of $99.20$% for polyglot detection and
$99.47$% for file-format identification, significantly outperforming all other
tools tested. We developed a content disarmament and reconstruction tool,
ImSan, that successfully sanitized $100$% of the tested image-based polyglots,
which were the most common type found via the survey. Our work provides
concrete tools and suggestions to enable defenders to better defend themselves
against polyglot files, as well as directions for future work to create more
robust file specifications and methods of disarmament.

在本研究中，我们发现现有的文件格式和嵌入式文件检测工具都不能可靠地检测出在野外使用的多格式文件，从而使组织面临攻击的风险。为了解决这个问题，我们研究了恶意攻击者在野外使用多格式文件的情况，并创建了一个新的数据集来训练机器学习检测解决方案，PolyConv。我们还开发了一个内容清除和重建工具，ImSan，有效地消毒了所有测试的基于图像的多格式文件。我们的工作为防御者提供了具体的工具和建议，以更好地抵御多格式文件，并为未来的工作提供方向，以创建更强大的文件规范和消除方法。

关于多语种文件的滥用和检测

On the Abuse and Detection of Polyglot Files

In this chapter, readers will explore how machine learning has been applied
to build malware detection systems designed for the Windows operating system.
This chapter starts by introducing the main components of a Machine Learning
pipeline, highlighting the challenges of collecting and maintaining up-to-date
datasets. Following this introduction, various state-of-the-art malware
detectors are presented, encompassing both feature-based and deep
learning-based detectors. Subsequent sections introduce the primary challenges
encountered by machine learning-based malware detectors, including concept
drift and adversarial attacks. Lastly, this chapter concludes by providing a
brief overview of the ongoing research on adversarial defenses.

该研究论文概述了如何利用机器学习构建用于 Windows 操作系统的恶意软件检测系统，介绍了机器学习流水线的主要组件、收集和维护最新数据集的挑战，以及包括基于特征和深度学习的最新恶意软件检测器。同时探讨了基于机器学习的恶意软件检测器所面临的主要挑战，包括概念漂移和对抗攻击，并简要总结了针对对抗性防御的正在进行的研究。

Windows 恶意软件检测和分类的机器学习方法、挑战与持续研究

Machine Learning for Windows Malware Detection and Classification:  Methods, Challenges and Ongoing Research

As the number and complexity of malware attacks continue to increase, there
is an urgent need for effective malware detection systems. While deep learning
models are effective at detecting malware, they are vulnerable to adversarial
attacks. Attacks like this can create malicious files that are resistant to
detection, creating a significant cybersecurity risk. Recent research has seen
the development of several adversarial attack and response approaches aiming at
strengthening deep learning models' resilience to such attacks. This survey
study offers an in-depth look at current research in adversarial attack and
defensive strategies for malware classification in cybersecurity. The methods
are classified into four categories: generative models, feature-based
approaches, ensemble methods, and hybrid tactics. The article outlines
cutting-edge procedures within each area, assessing their benefits and
drawbacks. Each topic presents cutting-edge approaches and explores their
advantages and disadvantages. In addition, the study discusses the datasets and
assessment criteria that are often utilized on this subject. Finally, it
identifies open research difficulties and suggests future study options. This
document is a significant resource for malware categorization and cyber
security researchers and practitioners.

这项调查研究针对网络安全中恶意软件分类展示了当前对抗性攻击和防御策略的研究，将方法分类为生成模型、基于特征的方法、集成方法和混合策略，并评估了每个领域的优点和缺点，同时讨论了常用的数据集和评估标准，最后提出了开放性研究难题和未来的研究选项。