1194 research outputs found
Sort by
Dynamic Pentest Lab Framework
Get PDFIn collaboration with Hacking-Lab AG and under the guidance of Ivan Bütler at
the Department of Computer Science, Ostschweizerische Fachhochschule (OST), this
thesis presents the development of the Dynamic Pentest Lab Deployment Generator,
designed to facilitate the creation and deployment of cybersecurity penetration testing
environments. The project addresses the need for flexible, easily deployable lab environments
tailored to specific scenarios, streamlining the process for cybersecurity
professionals and educators.
The framework elaborated, leverages modern infrastructure-as-code tools and cloud
services to automate the deployment of virtual labs. Key components include Terraform
for infrastructure management, Django for backend operations, and Angular
with TailwindCSS and DaisyUI for the frontend interface. A centralized source has
been established via a JavaScript Object Notation (JSON) Model, streamlining extension
and enabling dynamic content hydration for the frontend. This approach
guarantees a scalable and maintainable application.
The fundamental aspects of the framework involve the creation and deployment of labs
to provide snapshots for quicker deployments for end-users, along with the capability
to save and reload pre-designed labs. The lab creation process allows the configuration
of Virtual Machines (VMs) and containers, the establishment of subnets and firewall
rules to control communication, and also supports custom installations using private
repositories or customized Docker images. Additionally, the framework automatically
sets up an OpenVPN Server to facilitate secure access to the penetration testing lab.
These features enable cybersecurity educators to construct complex, customized networked
environments for educational use.
While the project effectively establishes a solid foundation, there remains room for
enhancement, particularly in the realms of access technology and user experience.
Additionally, the integration of the existing deployment manager directly into the
generator application should be considered.
In summary, it can be concluded that a robust foundation has been established for the
framework that leverages existing architecture, thereby ensuring a smooth incorporation
into the Hacking-Lab platform.
Keywords: Pentesting, Hacking-Lab, Infrastructure as Cod
Urban Sprawl Metrics
Get PDFDas Thema der Zersiedelung ist nicht nur Bestandteil der Geographie, sondern auch eine gesellschaftliche Angelegenheit.
Dies zeigt sich vor allem in der Schweiz, wo die Zersiedelung in den letzten Jahren stark zugenommen hat.
Die "Zersiedlungsinitiaive vom 10. Februar 2019 bezeugt die Dringlichkeit der Thematik in der Politik.
Unter Zersiedelung versteht man die turbulente Ausdehnung der Siedlungsfläche auf Kosten der Landwirtschafts- und Naturflächen.
Das Bundesamt für Raumentwicklung (ARE) hat das Ziel zu überprüfen, wie man in der Planung Zersiedelungswerte einbetten kann, um die Zersiedelung unter anderem zu messen und folglich zu begrenzen.
Bereits Jäger und Schwick begründeten in ihrem Buch "Zersiedelung messen und begrenzen" Methoden zur Messung der Zersiedelung.
Für ein erstes Werkzeug der Eidgenössischen Forschungsanstalt für Wald, Schnee und Landschaft (WSL) ist die kommerzielle Software ArcGIS notwendig, worauf Horiguchi und Schwab (2020) das quelloffene Plugin "USM Toolset" für das Open Source Tool QGIS entwickelten.
Dieses bestehende QGIS-Plugin soll um eine quelloffene Erweiterung ergänzt werden, die eine Weboberfläche bietet.
Zusätzlich soll eine Schnittstelle (API) bereitgestellt werden.
Darüber hinaus ist die effiziente und wartbare Implementierung der Berechnungen ein weiteres Ziel.
Im Rahmen dieser Arbeit wurden diverse Varianten einer effizienten Parallelisierung der Berechnung implementiert und anhand ihrer Performance evaluiert.
Zusammen mit einer API-Schnittstelle, die es ermöglicht, einzelne Metriken zur Zersiedelung zu berechnen, wurde die Erweiterung realisiert.
Durch die Erweiterung können Metriken der Zersiedelung ohne QGIS berechnet werden.
Die Kalkulation einer kleinen Gemeinde der Schweiz ist in wenigen Sekunden abgeschlossen.
Mit dem Einsatz von Just-in-Time-Compilern und Parallelisierungsmethoden verbesserte sich die Performance, sodass Resultate für mittelgrosse Gemeinden in wenigen Sekunden berechnet werden können.
Eine API-Schnittstelle nach der OpenAPI Spezifikation ermöglicht die Integration in andere Anwendungen.
Die Berechnung der Metriken der Zersiedelung in einem Webservice kann effizient und wartbar implementiert werden.
Dies bietet die Möglichkeit, diese Berechnungsmethoden einer breiteren Öffentlichkeit und Anwenderschaft zur Verfügung zu stellen.
Raumplaner, Architekten, NGOs und politische Entscheidungsträger können so die Auswirkungen von geplanten Massnahmen auf die Siedlungsstruktur analysieren und visualisieren
Kubernetes Pod Scheduling based on Energy efficient Metrics
Get PDFInitial situation:
In modern cloud environments, Kubernetes has become the de facto standard for orchestrating containerized applications. However, traditional Kubernetes pod scheduling algorithms primarily focus on resource allocation metrics such as CPU and memory utilization. While effective for performance, these methods often neglect Energy consumption. This is where our project comes in. Our goal is to design a scheduler that works alongside the traditional scheduler, with a specific focus on renewable generated energy availability.
Approach and technologies:
This project introduces an energy-aware Kubernetes pod scheduling Approach that integrates energy availability metrics into the scheduling decision process. The proposed solution enhances the default Kubernetes scheduler by adding a new metric: the available energy for each worker node. For scheduling logic, we consider both the newly assigned priority of a pod and the available energy. Decisions are made based on these metrics, ranging from stopping pods to shutting down entire nodes. Additionally, we implemented a "move" function that allows Kubernetes pods to be manually transferred to another node. This feature demonstrates how workloads can be relocated seamlessly without noticeable service disruption.
Result:
The project was deployed on a solar-powered infrastructure to validate its effectiveness. The system successfully managed pod scheduling by automatically shifting workloads when solar energy was unavailable, and the battery charge dropped to critical levels. Critical system parameters, such as battery thresholds, were made configurable and easily accessible through an intuitive graphical user interface (GUI). To enhance user engagement and improve target audience understanding, containerized workloads were represented as freight containers, giving the project a playful and visually intuitive design. These findings highlight the potential of energy-aware scheduling to improve the sustainability and cost-effectiveness of Kubernetes-based cloud infrastructures, making it a promising step toward greener data center operations
Analysis of Risks and Mitigation Strategies in RAG
Get PDFLarge Language Models (LLMs) have become incredibly popular with the introduction of chatbots such as ChatGPT or Gemini. LLMs are very good at Natural Language Processing (NLP), which means they have the ability to understand and communicate in human language. However, they are limited to the knowledge used during training, so it is difficult and resource-intensive to keep them up-to-date and/or to integrate domain-specific knowledge. In addition, LLMs tend to hallucinate and give inaccurate answers when the specific data is not available in the language model.
To address these issues, Retrieval-Augmented Generation (RAG) has been introduced. This novel approach facilitates the incorporation of up-to-date and domain-specific data, while reducing the hallucination of LLMs by providing missing information in a targeted manner. These substantial benefits have led to the popularity of RAG.
While this approach offers significant benefits, at the same time it introduces new security challenges to the development and operation of RAG systems, that need to be addressed. Since this is a relatively new topic, getting an overview of the risks and mitigation strategies can be tedious. The information is scattered across many sources and each risk and mitigation strategy found needs to be evaluated individually to determine if it applies to one's RAG implementation.
We fill this gap by presenting a high-level framework (called a landscape) for systematically identifying and evaluating privacy and security related risks associated with RAG systems. It also outlines potential mitigation strategies tailored to these risks, thereby providing possible approaches for protecting RAG systems. By consolidating and analyzing current research and practice, we provide a risk and mitigation landscape that facilitates risk assessment and helps secure RAG pipelines, thereby supporting the responsible use of this promising technology.
Keywords: Retrieval-Augmented Generation (RAG), Framework, Security Risks, Mitigation Strategies, Large Language Model (LLM
Containerbasiertes PaaS für individuelle VPS Infrastrukturen
Get PDFDiese Studienarbeit befasst sich mit der Entwicklung von QuickStack, einer selbst gehosteten Platform-as-a-Service (PaaS)-Lösung, die auf einer Virtual Private Server (VPS)-Infrastruktur betrieben wird und die effiziente Durchführung von Build- und Deployment-Prozessen sowie die Orchestrierung von laufenden Container-Anwendungen ermöglicht. Eine von uns durchgeführte Marktanalyse ergab signifikante Kostenvorteile gegenüber kommerziellen Cloud PaaS Angeboten. Nach einem Vergleich verschiedener Container-Orchestrierungstools wurde die Kubernetes-Distribution k3s aufgrund ihres geringen Ressourcenbedarfs und der einfachen Installation als Basis für QuickStack ausgewählt. Longhorn dient als Shared Storage Provider für persistente Daten über alle VPS-Nodes hinweg. Zu den Kernfunktionen von QuickStack gehören die einfache Installation über einen einzigen Kommandozeilenbefehl, die Unterstützung von Deployments aus einem öffentlichen oder privaten Git-Repository, ein Monitoring-Dashboard zur Überwachung des Ressourcenverbrauchs, Tools zum Debuggen laufender Container, darunter der Live-Log-Stream und das Web-Terminal, sowie die Anbindung von persistentem Speicher an einen oder mehrere Container über alle VPS hinweg. Durch die Bereitstellung dieser Funktionen vereinfacht QuickStack den Aufbau und Betrieb von Anwendungen auf einer VPS-Infrastruktur erheblich. Zukünftige Arbeiten könnten automatisierte Backups, weitere Debugging-Möglichkeiten und Deployment-Templates für Datenbanken und gängige Open-Source-Anwendungen umfassen
AI-Powered Invoice Automation
No full textIntroduction and Goal: Etter Consulting Partners (ECP) processes invoices from hundreds
of energy and utility providers manually. The lack of standardization and the diversity of
formats make extracting data into a unified structure a time-consuming and error-prone task.
This project addresses these challenges by developing a prototype to automate the extraction
of detailed information from PDF invoices and convert it into a structured, machine-readable
format. The extracted data is formatted as JavaScript Object Notation (JSON), facilitating
seamless integration into subsequent analytical processes.
Methodology and Technologies: The prototype consists of a Python program that integrates
multiple technologies to tackle the complexities of invoice processing. Docling OCR plays a
crucial role in converting diverse PDF formats, including scanned invoices, into structured
Markdown, forming the foundation for data extraction. Large Language Models (LLMs) are
central to the process, identifying invoice providers and extracting key details from the text. QR
code recognition complements this by directly extracting provider information and relevant data
embedded within QR codes when available. Additionally, vector similarity search is employed
to identify the invoice provider by comparing document embeddings to known provider profiles.
Each component was optimized to address specific challenges. A dataset of manually parsed
invoices from ECP served as the benchmark for evaluating the pipeline’s accuracy and reliability.
Result: The project successfully achieved its primary objective of accurately parsing invoice
data and converting it into structured JSON. Both Claude Sonnet 3.5 and OpenAI GPT-4
demonstrated strong performance, with a best-case accuracy of up to 94% in specific cases, and
overall accuracies of 66.66% and 63.66%, respectively. Llama 3.3-70b reached an overall accuracy
of 60.68%. These accuracy metrics were determined using a custom scoring system developed
for this project and validated across a large dataset, confirming the software’s capability to
reliably automate data extraction. Challenges were identified in the categorization of line items,
where the LLM occasionally assigned incorrect categories due to limited contextual information.
Providing additional data for each possible category is expected to improve categorization
accuracy. Especially, the prompt plays a significant role in influencing results: with better
prompts, the system’s accuracy improves substantially. The project not only delivered a robust
prototype but also highlighted key areas for further refinement to enhance system scalability
and precision. Specifically, achieving more accurate categorization by augmenting the category
information and meticulously tuning each provider-specific prompt. The final solution is a
functioning Python CLI, supporting parsing through OpenAI GPT, Anthropic Claude, and
Llama, and can be used in any environment capable of executing Python
OST ResearchNavigator: Projekt-Tracking-Software für die Ostschweizer Fachhochschule
Get PDFDie OST führt im Rahmen der angewandten Forschung vielfältige und innovative Projekte durch. Derzeit erfolgt die Veröffentlichung direkt in den fachspezifischen Kanälen. Eine zentrale Übersicht, die eine schnelle Suche nach Projekten anhand von unterschiedlichen Kriterien ermöglicht, existiert jedoch noch nicht. In einer neuen Lösung, dem OST ResearchNavigator, sollen Projekte aller Organisationseinheiten der OST einheitlich mit relevanten Inhalten erfasst und publiziert werden können. Durch diese einheitliche Lösung kann die Kommunikation in einem definierten Prozess von der OST besser überprüft werden.
Ziel dieser Studienarbeit ist die Erstellung eines Prototyps der gewünschten Lösung. Basierend auf den Strukturen und Prozessen der OST sowie den relevanten Projektmetadaten wurde ein geeignetes Datenmodell erstellt. Daraus wurden die wichtigsten Such- und Filterkriterien abgeleitet. Eine Technologieanalyse mit dem Fokus auf Erweiterbarkeit führte zur Auswahl der folgenden Komponenten: Ein Nuxt.js Web-Frontend, das mit einer ASP.NET Core API kommuniziert. Eine PostgreSQL Datenbank zur Speicherung der Projektdaten, sowie ein MinIO Fileserver, der zur Ablage von Projektdateien dient. Benutzertests mit zwei Professoren des Instituts für Interaktive Informatik trugen zur Optimierung der Benutzeroberfläche bei, die sich am OST-Design orientiert. Die Systemkomponenten wurden vollständig containerisiert, um eine hohe Portabilität und ein einfaches Deployment zu gewährleisten.
Der erfolgreiche Prototyp erlaubt es Mitarbeitenden der Hochschule, ihre Projekte einheitlich zu erfassen. Ein klar definierter Veröffentlichungsprozess stellt sicher, dass Projekte umfassend geprüft werden. Such- und Filterfunktionen ermöglichen es Projekte gezielt zu finden. Zusätzlich erleichtern OST-übergreifende Statistiken den Überblick über die Forschungsaktivitäten. Somit genügt der Prototyp allen Anforderungen, die für eine erste Pilotphase essentiell sind. Nicht-funktionale Anforderungen wie Bedienbarkeit, Performance und Wartbarkeit wurden mithilfe von Usability-Tests, Load-Tests und Metriken wie Branch-Coverage überprüft. Aus sicherheitstechnischer Sicht wurde eine einfache Benutzerautorisierung implementiert, die jedoch aus Gründen der Systemintegration noch keine Authentifizierung beinhaltet. Um den Kundennutzen sicherzustellen, wurden der Projektplan und der Projektfortschritt in regelmässigen Abständen dem Auftraggeber präsentiert. Das Resultat dieses Projektes stiess auf überwiegend positives Feedback beim Auftraggeber, was als erfolgreicher Projektabschluss aufgenommen wird.
In einer anschliessenden Bachelorarbeit wird das Produkt weiterentwickelt. Dabei soll die Benutzeroberfläche, sowie auch die Suchfunktionalität weiter verbessert werden. Ausserdem soll die Anwendung um weitere Funktionen wie beispielsweise eine Administrationsoberfläche, ein Authentifizierungssystem oder eine KI-basierte Datenextraktion erweitert werden
Rapid Prototyping in TypeScript
Get PDFBuilding a fullstack web application with NodeJS in today’s landscape of countless frameworks and libraries can be daunting. Which ones should be chosen? How to configure the chosen libraries so that they work together seamlessly rather than against each other? Many technologies and libraries feature a simple "hello world" tutorial but combining the technologies together to craft a powerful fullstack web application is not straightforward. The lack of a good introduction to a new technology slows down the development process and distracts developers from focusing on what truly matters: building features. For this purpose we developed an approach with rapid prototyping. Our proof of work focuses on fast development without the need of always adapting the API when changes are made. Our approach to rapid prototyping is based on a GraphQL API that supports code generation with the help of TypeGraphQL-Prisma, which creates the resolvers for create read update and delete operations for each data model out of the box. To bring rapid prototyping to the developers, we created an easy to understand tutorial with Docusaurus, a static website generator that makes it easy to build documentation-focused web applications that are accessible and engaging, that we refined based on feedback we gathered from user testing. The tutorial demonstrates our technologies in a realistic and easy to understand example application where you can make ticket reservations for a cinema chain
AI as a Teachers Assistant
Get PDFIntroduction:
Introduction: The digital transformation of higher
education has led to a significant shift in teaching
methods, with blended learning emerging as a
favored approach. In this paradigm, traditional faceto-face teaching is combined with online learning,
resulting in the well-known inverted classrooms. In
this setting, students begin with self-study, supported
by multimedia materials, followed by interactive faceto-face sessions.
However, experience shows that students may
struggle with self-study, highlighting the need for AIsupported learning assistants. These assistants
should provide students with personalized guidance,
feedback, and assessment, adapting to their
individual needs and learning styles. By leveraging AI,
primarily large language models (LLMs), these
assistants can help students progress towards
competency in an efficient and effective manner.
Approach: Three state-of-the-art LLMs (GPT-3.5,
GPT-4 and Mixtral-8x7B) are evaluated on three
subtasks based on lecture notes about political rights
in Switzerland:
- Generating questions
- Evaluating answers
- Providing feedback on the current study level
The models are fine-tuned and the quality of their
outputs were compared to their non-fine-tuned
equivalents.
A prototype application for a chat bot that supports
multiple languages, model selection from a graphical
user interface and an approach that combines chat
history and RAG is built. Model access is wrapped
under an abstracted class, allowing extensibility and
enabling rapid integration of new models.
Administrators assign documents and system
prompts to individual chat bots, giving them granular
control over their behavior and available information.
The documents get embedded with a locally hosted
Multilingual-E5-base instance.
Result: Our work has shown that while there is
potential in using LLMs as assistants for pre-study. It
was shown that existing chat models can work well on
text-based lecture scripts out of the box. However,
they could not interpret lecture scripts using images
and text. The vast range of possible user inputs in this
case makes finetuning challenging, as it would
require an enormous amount of specific training data.
Given that the non-finetuned versions already perform
well, finetuning with few datapoints actually worsened
the overall quality of the output.
The prototype serves as a blueprint for history-aware
and RAG-enabled chat bot applications. When
provided with a locally hosted Mixtral-8x7B instance,
the entire RAG process can be done locally. This
gives its users control over the use of their data and
ensures that classified information can be used to
enhance the chat bots.
In its current form, the prototype is primarily limited by
its resource consumption and therefore scalability
concerns
Assessing RISC Zero using ZKit: An Extensible Testing and Benchmarking Suite for ZKP Frameworks
Get PDFZero-Knowledge Proofs (ZKPs) are cryptographic protocols designed to verify a statement without disclosing any information beyond its boolean verification outcome. A prevalent use case for such protocols resides in the realm of digital cash, where payers whish to prove the validity of a token without disclosing any specification about the token in particular to uphold privacy. Numerous ZKP software libraries or frameworks have emerged to enhance accessibility for developers and encouraging the widespread adoption of this technology in practical applications.
The thesis introduces the readership to ZKPs, elucidating their fundamental attributes and delving into two key implementation families — namely, Succinct Non-Interactive Argument of Knowledge (SNARK) and Scalable Transparent Argument of Knowledge (STARK) systems. Our emphasis is on the latter, given its perceived post-quantum security. Furthermore, we provide an overview of promising STARK-based ZKP frameworks and discuss their distinguishing features.
One of such frameworks is RISC Zero, which facilitates verifiable general-purpose computations in zero-knowledge through its virtual machine. Essentially, it proves statements indirectly by proving the integrity of all chronologically recorded register states throughout a computational process. We elucidate its internal mechanisms and assess its efficiency by examining two different disciplines. The first involves proving a preimage to a hash value. The second entails proving the membership of a data leaf within a Merkle tree, also known as inclusion proofs (IP).
To streamline systematic analysis, we present the concept of ZKit, an extensible test and benchmark suite designed to accommodate diverse ZKP frameworks. ZKit enables the orchestration of activities through a command line interface and incorporates a suggested information exchange format for IPs. Additionally, it demonstrates the process of porting ZKP functionality defined in the Rust programming language to Go.
We utilize ZKit to benchmark RISC Zero across various settings and workloads. Our results reveal that generating a single STARK proof for a batch of IPs can be up to 3.9 times more efficient than proving each IP individually. Verifying such batch proofs can even offer a performance improvement of up to 14 times. The thesis concludes by discussing key insights gained during the research process and summarizes the implications of the findings