1194 research outputs found
Sort by
Automation of Cloud Abuse Report Handling
No full textIn recent years, cyber security attacks have become an important issue in the Internet world.
There are various attacks such as phishing, malware, denial of service, etc. that aim to breach data.
Public cloud providers are most affected with issue and have to deal with it. Therefore, each cloud provider has a point of contact where issues or suspicious activity in the cloud can be reported via email, and each of these reported issues is analysed and investigated.
IBM Cloud has a dedicated team of analysts who analyse incoming reports of various types of suspected abuse in the cloud. The process of analysing the reports and deciding on the next steps consists of many repetitive tasks that are very time-consuming for any analyst. This is where an automated solution is needed to save valuable time.
The goal of this bachelor thesis is to implement a proof-of-concept that automates the manual and time-consuming tasks performed by analysts. At the beginning of the project, a detailed analysis and elaboration was performed, collecting all requirements together with the main stakeholder of the project, IBM Research Zurich. After prioritising the features to be implemented, implementation was started in the construction phase.
Throughout the project, regular meetings were held with stakeholders to receive feedback and new suggestions for improvement. The proof of concept created as the final product was then presented as a demo to analysts at IBM Cloud.
As a result, a web application is developed where key information extracted from reports manually from emails is entered on the user interface. This information is then analysed and enriched on the backend of the product using an external API. The enriched information is then displayed on the user interface along with a screenshot of the suspicious website provided by an additional external API.
Considering different types of information such as hashes, domain names etc. that can be extracted from reports, a major focus of this project was to build a flexible architecture for the product that would allow it to be easily extended in the future and add new functionality for new indicator types. This was achieved via message queues and task workers in the backend.
Keywords: Cloud abuse reports, Enriched reports, Security analysis, FastAPI, React, MongoDB, RabbitMQ, Celery, VirusTotal API, Screenshot AP
Admin-Portal (SA)
Get PDFAusgangslage
Das Unternehmen 2BIT betreibt eine Software-as-a-Service Lösung für Aufgaben im Bereich Personalwesen mit dem Namen 2getHR. Diese erlaubt gängige Prozesse wie Zeiterfassung, Ferien- und Spesenmanagement und On-Boarding automatisiert und benutzerfreundlich durchzuführen. Mit zunehmender Beliebtheit der Applikation entsteht für 2BIT ein erhöhter Supportaufwand. Um den Supportprozess zu unterstützen, wurde ein rudimentäres Admin-Portal entwickelt, welches es erlaubte, einige supportrelevante Daten einzusehen und bestimmte Daten zu löschen. Das bestehende Admin-Portal deckte jedoch nicht alle notwendigen Anforderungen ab. Zudem wurde nur eine Auswahl der supportrelevanten Daten abgebildet. In diesem Projekt wurde das bestehende Admin-Portal ausgebaut und benutzerfreundlicher gestaltet, um den Supportprozess zu vereinfachen und effizienter zu gestalten. Das neue Tool erlaubt es alle supportrelevanten Daten einzusehen, zwischen den Objekten zu navigieren, diese zu löschen und klar definierte Änderungen an Daten vorzunehmen.
Ansatz
Die Funktionalität und die Bedienbarkeit des neuen Admin-Portals wurden auf die Endbenutzer-Basis ausgelegt. In einem ersten Schritt wurde eine Analyse der Anforderungen des Supports durchgeführt, um ein Bild der bestehenden Situation zu erhalten.
Basierend auf dieser Analyse wurden Anforderungen und Wireframes ausgearbeitet und gemeinsam mit dem Product Owner und dem Supportpersonal von 2BIT auf Bedienbarkeit und Relevanz geprüft. In Form einer Priorisierung wurde bestimmt, in welcher Reihenfolge die Anforderungen umgesetzt werden sollten.
Mit der Analyse als Grundlage wurde eine Applikation konzipiert, welche die Bedürfnisse des Supports bestmöglich abdeckt. Während der Konstruktion wurde die Applikation wiederholt mit 2BIT getestet und die Priorisierung angepasst. Das Resultat ist eine Applikation, welche auf die Bedürfnisse von 2BIT abgestimmt ist.
Fazit
Automatisierte und manuelle Tests haben gezeigt, dass das neue Admin-Portal von 2BIT im produktiven Betrieb genutzt werden kann. Die bestehende Funktionalität des alten Tools wurde überarbeitet, fehlende Funktionen ergänzt sowie die Benutzbarkeit erhöht. Ein Ausblick auf weitere Features wurde ausgearbeitet. Diese können von 2BIT zu einem späteren Zeitpunkt umgesetzt werden.
Da das Tool im produktiven Betrieb eingesetzt werden soll, wurde besondere Aufmerksamkeit auf die Stabilität und Korrektheit der Features gelegt. Dies wurde mit Tests verifiziert. Um eine möglichst reibungslose Übergabe des Projektes an 2BIT zu ermöglichen, wurde die Applikation nach Vorgaben von 2BIT dokumentiert und der Code gemäss Coding Guidelines und Clean Code geschrieben.
In der folgenden Dokumentation wird ersichtlich, wie die Planung und Umsetzung des Projektes gehandhabt wurde und wie die enge Zusammenarbeit mit 2BIT das Resultat beeinflusst hat
Black Fennec
Get PDFIntroduction: Black Fennec is a simple and easy-to-use application for viewing and editing semi-structured data like JSON in a visually interpreted form. The target audience is people who come in contact with such data regularly and want to collect and manage it in an accessible way. It is positioned between Microsoft Word and Access and can be understood as a data editor.
It was originally developed by Lara Gubler, Leonie Däullary, Simon Kindhauser, and Caspar Martens as an engineering project with Thomas Kälin as Supervisor.
Building on the previous work, the goal of this project was to release Black Fennec as a stable and mature product with major quality-of-life improvements that potential users are keen to use.
Approach / Technology: Improving the stability of the application included major refactorings to many components of the application. Architecture-wise, some of the most significant changes were made to the document subsystem, extension handling, and the type system. This was made possible by an extensive and largely pre-existing automated test suite. The test suite itself also received a significant overhaul. The pre-existing suite, which was using the python unittest package, was largely extended and simplified through the use of pytest. To acquire the necessary skills the developers took part in a multi-day workshop organized by members of the pytest community. Currently, a thousand tests cover around 98% of the code base (branch coverage).
Thanks to the migration to GTK 4 and the use of libadwaita, the application integrates seamlessly into the GNOME desktop environment. It also improves Maintainability by providing a large set of components that are responsive and user-friendly by design. We leveraged these technologies in an effort to improve the user experience of the application. Amongst other things, this included the addition of application feedback and better error handling. With the introduction of actions to the extension ecosystem, we have also created a new way of interacting with the application. Actions allow the execution of previously defined operations that operates on a selected data structure. Overall, the extension API has matured and now offers a smorgasbord of extension points including actions, mime types, and more.
As a means of distribution, the application is now available as a flatpak package on Flathub. This allows for integrated installation and updates on all major Linux distributions through their native software center. Another advantage of flatpak is that it provides a sandboxed environment that adds another layer of security and protects our users from malicious intent.
Result: We are happy to announce that Black Fennec is now available as a stable and mature product. The application can be downloaded from Flathub and installed on virtually any Linux distribution. Complementary to the release of the application, we also published a simplistic website with all relevant information including a short description, a screenshot, and links to other relevant resources.
The website is available at
https://blackfennec.or
Prototype of an open GIS-to-BIM Converter
Get PDFUnterirdische Leitungskataster werden üblicherweise in 2D-Geoinformationssystemen verwaltet
(GIS) unter Verwendung standardisierter Formate wie dem SIA 405-INTERLIS-Standard in der Schweiz. Jedoch,
besteht ein wachsender Bedarf an der Darstellung dieser Versorgungsnetze in einem 3D-Format.
Insbesondere im Kontext von Building Information Modeling (BIM). Dieses Projekt präsentiert
ein Python Command Line Interface (CLI)-Prototyp, der die Konvertierung
von 2D-INTERLIS-Daten in gültige 3D-Daten im Industry Foundation Classes (IFC)-Format ermöglicht.
Der resultierende Prototyp verfügt über eine CLI, die es Benutzern ermöglicht, eine GeoPackage-Datei
einzugeben und einen Koordinatenbereich und ein Ausgabepfad für die resultierende IFC-Datei anzugeben
Er validiert die bereitgestellten Argumente und führt den Konvertierungsprozess mithilfe von Python-Bibliotheken,
wie GeoPandas und IfcOpenShell durch. Die resultierenden 3D-Daten enthalten zusätzliche Eigenschaften
zur Visualisierung, z. B. Untergrundtiefe, Elementdurchmesser und Farbschemata, welche
als „Intelligente Defaults“ definiert sind.
Der Prototyp legt eine solide Grundlage für die zukünftige Entwicklung. Der Ausblick beinhaltet
weitere Verbesserungen, wie z. B. die Markierung intelligenter Defaults zur Verdeutlichung von Ungenauigkeiten,
die Erweiterung der Intelligent Defaults um zusätzliche Eigenschaften, die Unterstützung
andere Leitungskatastermedien und das Hinzufügen von Konfigurierbarkeits- und Erweiterbarkeitsfunktionen für
Benutzer. Insgesamt zeigt diese Untersuchung die Machbarkeit der Konvertierung von 2D-INTERLIS
Daten in ein 3D-IFC-Format, was Möglichkeiten für eine verbesserte Darstellung und Visualisierung von
unterirdischen Versorgungsnetzen im Bereich BIM eröffnet.
Schlüsselwörter: 2D-zu-3D-Konvertierung, INTERLIS, IFC, Python CLI, GeoPackage, Building Information
Modelling (BIM)
Automated Response to Cyber Security Threats
No full textCyber security threats continue to pose a major challenge to organizations. While there is an abun- dance of technologies and products assisting in the detection and investigation of cyber security threats, supporting security operation teams in responding to threats has received limited attention. Modern Intrusion Prevention Systems provide the possibility to react in real-time to cyber security threats but still lack the ability to predict the impact of the responses on the IT infrastructure.
This bachelor thesis builds on the proof of concept application developed in the student research project. The existing application is re-created with novel capabilities regarding the automated response to cyber security threats to assist in protecting IT infrastructures. The main focus is on supporting the cybersecurity analyst in the decision-making process selecting the best-suited response to a cyber security threat by providing additional information regarding the IT infrastructure.
The application fetches security alerts from a Security Information and Event Management system (SIEM) and processes the retrieved data. The responses of a predefined set are compared to the alert attributes to determine the possible responses and their impact on the IT environment. Addi- tionally, the possible responses are prioritized by calculating their impact cost based on the created cost function. Consequently, the analyst can decide on the preferred response, considering the impact on the IT environment. The application itself is a three-tier architecture that consists of a frontend, a backend and a persistence tier. The frontend provides a dashboard to the analyst and allows the inspection of an alert, containing the relevant information about the alert in order to decide on the best-suited response. Furthermore, it allows the triggering of the desired response. The backend is an API providing all required endpoints regarding the interaction with it, such as creating the abstracted environment model of the IT infrastructure and persisting it in a graph database.
The application implements different Threat Response Techniques to facilitate the handling of cyber security threats. It provides automated response determination capabilities, where the responses of the predefined set are matched to the alert, identifying the possible responses for the alert based on its attributes. Moreover, the impact calculation abstracts the impact of a response on the IT infras- tructure being represented by the environment model. Finally, the possible responses are prioritized by calculating their impact cost with the defined cost function, comprising the response’s impact as well as its attributes
Crypto Agility: Transition to post-quantum safe algorithms for secure key exchange and certificate generation
Get PDFThe quantum era is arriving, which poses a significant threat to traditional encryption and public-key cryptography standards. Due to this development, many cryptographic algorithms are broken, as the underlying mathematical problems could be solved by future quantum computers within a short amount of time. With the appearance of quantum computers, cryptographic algorithms have also evolved. New quantum-safe algorithms have been standardized in the past year, but only a few applications already use them. To ensure a secure environment this will need to change.
Faced with these challenges and the rapid improvements in the area of quantum computing, the global cybersecurity landscape plunges into a highly precarious state. It is therefore important to test and deploy the new cryptographic algorithms today.
This bachelor thesis aims to demonstrate how two recently standardized post-quantum secure algorithms can be used by testing their compatibility with a Hardware Security Module (HSM) in a controlled environment. To demonstrate how these could be implemented in a quantum-safe manner at a later stage, two different use cases will be realized. The algorithms used are CRYSTALS-Kyber and CRYSTALS-Dilithium.
First, two Proof of Concepts (PoCs) were written, that demonstrate the compatibility between the HSM architecture and the two CRYSTALS algorithms. Afterward work on the two use cases began in parallel. The use case: Bring Your Own Key (BYOK) demonstrates how locally generated keys can be imported into the HSM in a quantum-safe manner. In this demonstration, the Key Encapsulation Mechanism (KEM) CRYSTALS-Kyber is used to generate a
shared secret so that the client application can communicate to the HSM using AES.
The second use case focuses on a Public Key Infrastructure (PKI) based on a post-quantum secure infrastructure. The HSM is used as a key store to secure the identity of the Root Certificate Authority (CA), which acts as the root of trust. This ensures that keys are never exposed in clear text in memory. Furthermore, the quantum-safe signature scheme CRYSTALS-Dilithium is used to sign certificates which further increases security.,
Further research and development work can be carried out in the future based on the insights gained through the implementation of these use cases. In addition, the implementation facilitates the replication of a similar use case for enterprise architecture and the transition from today’s legacy algorithms to the new secure post-quantum algorithms with increased efficiency. Both the BYOK and PKI implementations could also still be extended to provide more functionality, and higher security standards based on the algorithm versions or protocol used. The PKI implementation could also be further improved by using a quantum-safe variant of Transfer Layer Security (TLS)
Model-Based Generation of Service Provider Network Topologies
Get PDFObjective:
Researchers and network engineers working for service providers need to validate network technologies to see how they scale on networks of varying sizes. Currently, these test networks are often created based on random graphs. Due to their randomness, they often lack characteristics found in real service provider network. The goal was to develop an approach to generate network topologies with specific characteristics of these service provider networks. Furthermore, the existing Graph Analyzer system created during the previous term project had to be expanded to include edge weights in graph property calculations. In addition, a new graph property indicating robustness needed to be implemented.
Approach:
The MOST-Model (Mesh-Oriented Service Provider Topology) has been developed to facilitate the generation of network topologies that structurally resemble service provider networks. The model consists of eight steps and is parameterised to provide flexibility in the generation process. The model is inspired by existing methodologies and uses approaches that lead to characteristics matching service provider networks. A Gabriel graph is used to create the topology with additional optimisations to ensure redundancy. In other published papers, it has been documented that this type of graph reflects backbone networks well. The newly created Graph Generator application uses the MOST-Model to generate topologies. An API provides the ability to interact with it. The Frontend of the Graph Analyzer system has been extended to integrate the Graph Generator. It allows the seamless generation and visualisation of topologies using adjustable model parameters. The generated result can subsequently be imported into the Graph Analyzer system. Graph property calculations have been extended by incorporating edge weights from imported topology data. An approach using a targeted attack on high-degree nodes was chosen to calculate the robustness of a graph.
Conclusion:
During the bachelor's thesis, the MOST-Model was developed to generate network topologies with service provider network characteristics. Due to the underlying use of the Gabriel graph, the number of edges is minimised while still providing redundancy through alternative paths. This property reflects service provider network requirements from a cost and availability perspective. Known issues of the Gabriel graph, such as stub links, are mitigated through applied optimisations. The model has been integrated into the Graph Analyzer system as a separate application. This separation allows the straightforward integration of the MOST-Model via the Graph Generator application into other systems and contexts. In addition, the results can be imported into other applications by providing the generated topologies in the commonly used GEXF and GraphML file formats. The resulting Graph Analyzer system provides an easy way to examine how networks are structured and can generate new topologies through the Graph Generator application. The source code is publicly available and published under the permissive MIT license
Fitness Gamification
Get PDFInitial Situation:
In today's world, gamification is used and implemented in more and more aspects of daily life. The purpose of gamification is to motivate users to do certain things. Another growing market is physical exercise, especially with young people. An increasing amount of people are trying to do more physical exercise. Everyone agrees that physical exercise is the key to a healthy life, but the main problem is that people often need more motivation. So we see massive potential in solutions that address this problem. A potential solution to motivate people to do more sports is a platform that gamifies physical exercise and makes it a fun, competitive game that can be played between friends and other users. The need for physical exercise and the motivation to do it will draw people to platforms and solutions like this.
Objective:
With this project, we aim to build a platform mobile app of this type. The main goal is to create an initial version of such a platform. That means we want to create an app that allows users to challenge their friends and other users to do physical exercises. We will implement various gamification aspects, such as allowing users to achieve milestones, track their data, and display that to other users. We plan to use a "turn-based" approach for the challenges, allowing users to play with users in an "async" fashion. That means participants can be online at different times.
Conclusion:
In this project, we created a prototype for a mobile app that gamifies physical exercise. We created this mobile App using React Native and Expo in our Frontend and Firebase as our Backend. Our App allows users to create an account using their phone number and challenge anyone in their contact list or a random user. The user can select the challenge type and duration one has to perform in the challenge. Challenges then get completed in a turn-based fashion. A user performs a challenge, and it gets sent to his opponent. The opponent can then perform, and it will get sent back. This goes back and forth until one user cannot beat the other user's score. We will track various statistics for the user, which will be displayed in his profile and displayed to other users to generate a more competitive and gamified environment. We implemented one challenge type for this initial version, "Pull-ups." In the future, this should be extended to allow the user to perform various challenges and can generally be expanded upon due to the modularity we considered while implementing it
SSoT Based Network Service Deployment
Get PDFIn the field of network automation, a fully Single Source ofTruth (SSoT) based deployment is considered something of a holy grail, as it promotes reliable, repeatable, and documented procedures. While many proprietary solutions exist in this space, many of the open-source alternatives currently lack in capability, ease of use, or code quality. At its core, NetBox is an open-source project composed of a pre-defined database structure and a Django-based graphical interface. Its purpose is to document network infrastructure, covering both the hardware itself and its configuration. However, it lacks a mechanism for deploying said documented network in an automated manner, where the documentation dictates the network configuration, rather than the inverse. The goal of this project is to expand the capabilities of NetBox by adding support for network services through a plugin and implementing a mechanism for generating and deploying the corresponding configuration to the relevant network devices. We began by researching multiple network services before settling on MPLS L3 VPN, which encompasses the LDP, VRF, and BGP protocols, of which only VRF was already part of NetBox. After comparing various tools for network device configuration, we decided to use Napalm for device interactions and configuration management, with Nornir serving as a parallelization layer. During development, emphasis was placed on keeping the project extensible for future additions and making the deployment process as simple and intuitive as possible. The resulting software is comprised of two parts: the Argos-NetBox plugin, which extends NetBox and adds support for the aforementioned protocols, and Argos-NAC, which queries the necessary data from NetBox and handles the generation and deployment of the various device configurations. Argos-NetBox can be used standalone and is vendor-independent, making Argos-NAC an optional addition to it. The protocols covered by this project can be used separately and are designed to be interchangeable, should alternatives to them be added in the future.
It is worth noting that, in addition to this paper, a separate MkDocs has been created which outlines aspects of the project relevant to its future development and offers an
introduction to the dependencies upon which the project relies
Cilium CNI Plugins for Kubernetes Cluster Networking
No full textIntroduction:
Traditional routing protocols do not fully fit the needs regarding flexibility and scalability of telecommunication providers. More modern and flexible cloud approaches replace legacy technologies. In recent years, providers have struggled to scale private networking connections within their networks. Cloud deployed applications drive the need for flexible and custom routing capabilities.
Software engineers should not have to worry about networking. While deploying applications on the network’s edge, only the network to run it on should be specified. The network connecting to the customer should automatically be configured in the background, enabling a private connection.
Cilium – a container network interface for Kubernetes – offers many abstraction abilities, including Segment Routing over IPv6 (SRv6). Using SRv6, network packets may be sent along a predefined and the most suitable path. As example, VOIP packets would be sent along segments allowing low latency. In addition, SRv6 provides an abstraction of per-tenant virtual networks allowing VPN networking.
This thesis aimed to prove if such an approach works with SRv6 and Cilium.
Approach / Technology:
An IPv6 network infrastructure simulating a provider network was set up. Multiple provider edge and multiple customer edge routers connect backbone data centers and customers’ Kubernetes environments.L3VPN connections were entirely based on SRv6, allowing multi-VRF environments.Multiple Kubernetes clusters running Cilium with SRv6 were placed in the network as provider edge. A VRF connecting pods on a provider edge cluster linking the customer network attached to the customer edge interface was provided using L3VPN. Another BGP-only scenario was implemented with a customer Kubernetes cluster routing data to another customer site network via L3VPN running on the ISP’s network.
Result:
The pods’ network was successfully routed via L3VPN from a customer Kubernetes environment to a customer router proving the functionality of the customer edge scenario.The provider edge scenario with Cilium SRv6 was not functional during the project. The reason for the not fully functional scenario is a not fully operational software.
The entire concept should be considered by telcos and enterprises running Kubernetes clusters, as they can segment and separate their cloud applications from different networks. This approach allows heavy decoupling between software engineering and providing secure as well as private networks for applications