Abstract:

Security is an aspect of software development that is more important than ever! It is not for nothing that security has been included as a quality characteristic in ISO 25010. We usually use a wide variety of concepts, technologies and libraries to implement security concerns. However, these implementations and measures usually do not affect the core of our application - its domain layer: This is where the actual business logic is implemented and security is therefore particularly relevant. Because security is a holistic and global aspect it should be considered in all layers of an application.

This talk introduces "Security by Design" in the classic sense and then explains the relevance of the topic of security for the core of applications and their domain layer. Using various examples, it shows typical security problems and how we can counter them by using well-known design patterns, including some from domain-driven design (DDD). One of these examples is cross-site scripting, which we can already prevent by using value objects.

About the author:

Fabian Schneider leads the engineering, development and operations teams in the Access 4.0 Program at Deutsche Telekom since early 2022. Before he was responsible for the SDN Control development and the E2E system design of A4. He has been active since the beginning in the research and standards community around software-defined networks where he fostered the advancements of SDN, OpenFlow, higher-level network control abstractions and disaggregation in networks. Prior to joining Deutsche Telekom in Aug 2018, Fabian spent 18 years researching, standardizing, administrating and designing computer networks, focusing mainly on software-defined networking, network measurement and monitoring. As part of his scientific career, Fabian worked at NEC Laboratories Europe as a Senior Researcher and as research engineer/postdoc at UPMC, in Paris, France. Fabian holds a Ph.D. in computer science from TU Berlin, Germany and a Diplom from TU München, Germany.

Abstract:

The public perception of artificial intelligence is dominated by a few large, closed and proprietary solutions. A multi-billion dollar arms race between the big tech corporations creates the false impression that only the financially strongest providers can keep up. In this keynote talk, we want to differentiate this picture and take a look at the landscape of modern AI, from the common mainstream applications to the exciting possibilities beyond. To understand the spectrum, we present the current role of AI in our everyday lives and in technical innovations. Recent achievements will be explored and limitations highlighted. However, the focus of this talk is on the hidden but emerging world of open AI components, which not only put transparency and control in the hands of users, but also offer the opportunity to move from user to maker, from passive consumer to active technical designer. Academic institutions such as universities and colleges as well as a worldwide internet community are developing technologies that in some cases come very close to the commercial top dogs, and in some cases even surpass them. This lecture will use concrete examples and background information to show how these components pave the way to customized, personal AI solutions. The talk concludes with an inspiring call to action: to take the reins of AI into your own hands and democratize the world of AI with open components. This talk is suitable for audiences with a strategic interest as well as professionals who want to dive deeply into the technical aspects of AI. Discover how you can become part of the AI revolution yourself!

About the author:

Dr. Alexander Ebbes is chief architect of Xyna.AI, a platform for open Artificial Intelligence. Alexander has been guided by an enthusiasm for artificial intelligence ever since his studies in physics and his doctorate in parallel computing. He regularly posts on LinkedIn about AI and related topics. In the mentoring program of the German Physical Society (DPG), he accompanies the next generation on their way to a career in industry.

Download slides:

  AI beyond the mainstream

Abstract:

Interessiert dich, wie Schwachstellen schon vor der Entwicklung gefunden werden können? In einem Workshop zum Mitmachen zeigen wir dir, wie die STRIDE-Methode in einer Bedrohungsanalyse funktioniert. Dazu werden wir gemeinsam die Architektur eines Systems analysieren. Mitzubringen ist lediglich ein Interesse an IT-Sicherheit.

About the author:

Philipp Schneider ist Pentester und Security Engineer bei DB Systel, dem Digitalpartner der Deutschen Bahn. Web-Technologien, Cloud und DevOps sind sein Ding. Nach der Arbeit ist er gerne im Taunus unterwegs.

Tim Stoffel ist Pentester und Product Owner bei DB Systel, dem Digitalpartner der Deutschen Bahn. Wenn er nicht gerade nach Schwachstellen sucht, baut er mit Klemmbausteinen.

Abstract:

Kaum ein Thema hat in den letzten Jahren so einen massiven Aufschwung erlebt wie die individuelle Entwicklung von Web- und Cloud-Applikationen - und in den einschlägigen Trend-Reports wird prognostiziert, dass es sich in Zukunft um eines der Top-Themen auf jeder IT-Agenda handelt. Der Weg von der Idee bis zum Release einer solchen Applikation ist mit zahlreichen Herausforderungen verbunden - die Learnings & Best Practices aus 15 Jahren Entwicklung individueller Web- und Cloud-Applikationen sind Gegenstand dieses Talks. Der Vortrag bietet einen umfassenden Überblick über den gesamten Entwicklungsprozess Im ersten Schritt machen wir einen Deep Dive in die Anforderungsanalyse - wie findet man heraus, was das wirkliche Problem ist und was wie man es am besten löst? Wir schauen uns dazu z.b. Wireframes, High Fidelity Screens und User Tests als Methodiken an. Im zweiten Schritt geht es um die technische Architektur - wie muss so eine Anwendung aufgebaut sein, wie hängt alles zusammen? Wie baut man skalierende, cloudbasierte, sichere Architekturen, welche Komponenten sind beteiligt - und welche Rolle spielen dabei “Serverless” und Microservice-Architekturen. Im dritten Schritt schauen wir uns die eigentlich Umsetzung an - wie navigiert man sich durch das Backlog, führt Zwischen-Releases durch, holt Feedback ein und arbeitet in kurzen Zyklen? Hier werden wir CI/CD & Infrastructure as Code genau so streifen wie SCRUM Best Practices. Letztlich gehen wir in die Release & Post-Release-Phase: Was tut man, damit eine Anwendung hochverfügbar ist und bleibt? In diesem Talk machen wir einen technisch geprägten Rundumschlag, um das gesamte Thema individueller Web- und Cloud-Applikationen end to end mit Learnings und Best Practices in einem etablierten Vorgehensmodell zu untermauern.

About the author:

David Müller ist als Managing Director in der Public Cloud Group zusammen mit über 300 Kolleg:innen für Cloud Native Software Development zuständig. Zusammen bauen sie robuste, sichere und skalierende Anwendungen in der Cloud.

Abstract:

E-commerce search engines are resource eating monsters. Low latency response times are extremly crucial which needs lots of heap and cpu for fulfiment. For a customer we tackled the challenge to reduce their AWS cloud costs for an existing Apache Solr installation. In this project report we'll plow through the changes we applied to the classical cloud architecture down to garbage collection tuning in the JVM. We'll point out the improvements of ARM processors over Intel/AMD processors. We'll dig into the real bottle necks we discovered in Apache Solr and the improvements more recent JDKs and the Z garbage collector brought. But most importantly: Due to our holistic approach we were able to cut the customers AWS bill in half!

About the author:

Torsten is a freelance search & operations engineer with a focus on open-source search, container, and cloud technology. As a Java software architect in a German insurance company, he started practising agile and DevOps methodology and fine-tuned it as a CTO in e-commerce. Nowadays as a freelancer, he builds Kubernetes clusters in the cloud and on bare-metal and tweaks Apache Solr installations.

Abstract:

In recent times, pharmaceutical companies are taking initial steps towards transition from batch to continuous manufacturing of solid dosage oral forms. The transition to continuous manufacturing brings significant advantages, but the complex interplay between critical process parameters and critical material attributes makes effective steering and implementation of quality by design a challenging task. In his talk, Dr. Victor Emenike will speak about a project at Boehringer Ingelheim, that uses an AI-based system for the automatic steering of the continuous manufacturing process to overcome this challenge.

About the author:

Victor Emenike is a Data Scientist at Boehringer Ingelheim. Previously, he served as a product owner and led a team that developed an AI-based system for the automatic control of a continuous manufacturing process at Boehringer Ingelheim. He holds a Bachelor’s degree in Chemical Engineering from Covenant University, a Master’s degree in Chemical Process Engineering from the University College London, and a PhD from the TU Braunschweig/International Max Planck Research School for Advanced Methods in Process and Systems Engineering.

Abstract:

TBA

About the author:

TBA

Abstract:

Increasing digitalization and networking in a wide variety of areas not only offer great advantages but also great potential threats. Cryptography includes mathematical functions as well as associated procedures and protocols ensuring various security goals. It is therefore an essential tool for detecting and preventing attacks. However, cryptographic primitives and protocols always have and will be subject to the threat of compromise, which implies the need to substitute endangered schemes. The transition from classical to quantum-safe cryptography is currently the most prominent and far-reaching example of this kind. Sufficiently powerful quantum computers (QC), which may be available in some years, would be able to break asymmetric schemes in polynomial time. Alternative approaches urgently need to be identified and integrated into the existing infrastructure. Similar examples, such as the migrations from SHA-2 to SHA-3 and from DES to AES, have shown that these processes are time and resource intensive. However, proactive design of software and digital networks and a carefully developed and evaluated migration strategy can help to address this issue. In this context, the term cryptographic agility (CA) has come into use. It is often associated with the ability to agilely replace a cryptographic scheme with very little effort. In particular, the schemes used and overlaying protocols and applications should be known or even documented. In addition, an efficient and error-free adaptation to changes in the security status is aimed. In this work, we present strategies, procedures, and tools that we develop to contribute to an efficient and successful migration. The focus is on the integration of PQC, but also on designing IT systems in an agile manner to facilitate future changes.

About the authors:

Nouri Alnahawi, Johanna Hennrich, and Nicolai Schmitt are research assistants and doctoral candidates from the Department of Computer Science at Darmstadt University of Applied Sciences. Although they work on different projects of the research groups ‚Applied Cyber Security Darmstadt‘ and ‚User-Centered Security‘, they all study and investigate the various aspects revolving around Post-Quantum Cryptography (PQC), ranging from low-level hardware implementations and physical hardening measures, information theoretical security, and provable security, to protocol design, crypto-agility, and migration management. The presented work is a joint effort of the two research groups and their respective staff.

Download slides:

  owards Crypto-Agility Assessment and Cryptographic Migration

Abstract:

Today your software consists of software from other authors (or sources), sometimes without you knowing about it. This talk will try to convince you to think about your supply chain when deploying from your local machine to your run-time environment (probably in the cloud). After a brief introduction to the subject, we will try to find answers to questions like:

• What are you deploying where?
• Where is the deployed asset coming from?
• What are the components of the deployed asset?
• What are software bill of materials (SBOM) and how can they help us?

We will go over an example of an app deployed in a cloud environment to showcase how many software components are part of your deployed app. Then, we will take a look on some tools and concepts that can help in securing or detecting problems in your own supply chain. Finally we will summarize what you can do to secure your software supply chain.

About the author:

André Sterba is a Platform Engineer at Kaufland e-commerce focused on improving developer experience and tooling for product teams.

Abstract:

The technologies and communication protocols used in modern vehicles are undergoing change. For example, classic bus systems are being replaced by automotive Ethernet or protocols for service-oriented communication are being introduced. External connectivity is also increasing, e.g., software over the air updates from the manufacturer are installed via the Internet connection or an electric vehicle communicates with the charging station via the charging cable for authentication and billing. However, the change in technology and the increased connectivity also creates new opportunities for attacks. In this talk, I will present attacks on communication protocols of modern vehicles and corresponding security protocols that have been developed within the scope of our research. Thereby, I consider, protocols for service-oriented communication within vehicles, diagnostic protocols, and protocols of electric mobility.

About the author:

Prof. Dr. Christoph Krauß is professor for Network Security, spokesperson of the IT Security expert group, and head of the research group Applied Cyber Security Darmstadt (ACSD) at Darmstadt University of Applied Sciences. Furthermore, he is Head of Automotive Security Research at INCYDE GmbH, which he co-founded. He has over 15 years of experience in IT security. His research and interests include automotive security and privacy, railway security, intelligent energy networks security, trusted computing, network security, efficient and post-quantum cryptography, and security engineering.

Abstract:

Automated testing is an important topic in software development. Without testing, you simply won't produce any working software. Simply clicking through your interface will not find you all the bugs. Testing everything manually is a repetitive task that is boring and, in the long run, very expensive.

In this talk, Nils will show you how to test web-frontends automatically. This is not easy, because a frontend is naturally used by humans, not machines. But with the right tools and mindset, we will see that it is possible to automate frontend tests. It can even be fun.

About the author:

With over 16 years of professional experience as a web developer, Nils has a passion for automated tests and clean code. He has been working as a full stack engineer at cosee since 2019.

Abstract:

TBA

About the author:

TBA

Abstract:

TBA

About the author:

TBA

Abstract:

The current hype around ChatGPT has reached the masses. Besides the ability to answer questions amazingly well, the GPT models trained for it are also suitable for generating or completing code. But how does it work behind the scenes? Which models are available and how can they be profitably integrated into your own software? We will discuss these and other questions using the open source software "Xyna Factory" and our own "XyPilot". We will clarify what prompt engineering is for, what is behind the commercial offerings of OpenAI and GitHub, and what open source alternatives are available. All of this will be demonstrated using examples from networking technology ranging from Ethernet over IPv6 to 5G. - In a separate workshop, everything presented can be experienced and tried out for oneself.

In the corresponding session we introduced the software XyPilot, an Xyna.AI extension for pair programming in the open modeling environment Xyna Factory. Now we offer the possibility to gain own experiences. In guided experiments, XyPilot can be tried out on examples of network technology, from Ethernet to 5G. - Please bring your own laptop!

About the author:

TBA

Abstract:

OpenWrt is an embedded operating system targeting primarily network devices like wireless routers, access points and switches. While it’s ecosystem kept growing, more and more platform vendors started incorporating OpenWrt as base for their SDKs.

This talk discusses the implications of this trend and it’s impact on the project structure as well as accomplishments for the Open-Source project and it’s community.

About the author:

David is an active core-developer and project member of the OpenWrt project. In his free time he enjoys working with the local Freifunk community.

Abstract:

TBA

About the author:

TBA

Abstract:

TBA

About the author:

TBA

Abstract:

This presentation gives a brief introduction into Data Science and the work of a Data Scientist at Boehringer Ingelheim. It will dive into Data Science in a pharmaceutical company and the used technology stack. Furthermore, some insights on how Boehringer Ingelheim increases the data literacy of its employees via the Data Science Academy are given.

About the author:

Marius Hilt holds a PhD in theoretical physics and joined Boehringer Ingelheim in 2021, when the Data Science Academy was founded. During his professional career he worked for the insurance and pharmaceutical industry in data engineering and data science positions.

Abstract:

In this thesis we use the design science research method to develop an IOT device capable of documenting road safety and the attractiveness of cycling. This is done by automatically mapping the availability and quality of cy- cling infrastructure using modern 60GHz radar technology. These low-cost, high-performance radars are capable of measuring the distance and speed of passing cars up to 40 times per second. We are undertaking three successive development iterations, improving on the results of the previous evaluation. A key objective is to enable the prototype to operate without user interven- tion while the cyclist is riding. This requires sophisticated signal processing to detect cars and measure accurate distances at short duty cycles. In ad- dition, the collected data should be transmitted via Bluetooth to the user’s mobile phone for temporary storage. After each trip, the collected positions, speeds and distances are sent to a scalable infrastructure that enables collab- orative data collection for in-depth analysis. This data can be used to identify safer routes and highlight necessary improvements to cycle routes, support- ing urban development by prioritising roads with the best cost-benefit ratio. To do this, we used a clustering algorithm to find roads and locations with a significantly higher incidence of close encounters. All of this was validated through a series of experimental setups, culminating in a two-month deploy- ment of the functional prototype in real-world traffic conditions. In the end, the data highlighted three distinct locations. Despite a lack of urban plan- ning expertise, at least the reason why these locations were identified seems obvious, suggesting that the data and the sensor are promising. Concluding the thesis with a discussion of the limitations of the prototype and the future work that is required to make it a viable product, and to increase the user incentives to actually use it.

About the author:

Sebastian Schuch has recently submitted his thesis at the University of Applied Sciences Darmstadt, which will be the topic of the presentation, and currently works at exxeta.

Abstract:

We have been developing software in an agile way for over twenty years now. Methods like TDD, DDD, CI/CD and Scrum help us to build digital products right. Furthermore, products have been released operated and measured for more than ten years guided by DevOps principles. While it is imported to build a product right, it's even more important to build the right product. Because, as Peter Drucker said, there's nothing quite so useless as doing with great efficiency something that should not be done at all. Product Discovery helps us to find the right product.

But dev and ops people today often feel they can't work with product management and design on Product Discovery as equals partners. I'll give you a 101 on product discovery techniques. That will enable you to take an active part in this discussion.

About the author:

Konstantin Diener is CTO at cosee. He has been developing software for more than 20 years. His CTO role made him shift his focus to (agile) leadership topics and to Product Management eventually.

Konstantin speaks at conferences and was author of „DevOps Stories“, a column about culture, leadership, agile and DevOps.

Abstract:

Cellular networks are prone to jamming attacks, which can physically disrupt coverage in mission-critical applications such as factory automation or autonomous driving. In this talk, we will describe a method to detect smart jammers with machine learning based on loose observations. First, we will specify the “smart jammer” as an ideal physical attacker and distinguish it from simple interference generators. Second, we will describe the necessary radio signals and the benefits of their "loose observation" by a simple watchdog. Third, we will present a powerful machine learning model based on a convolutional autoencoder (CAE) along with experimental results. Our technique shows high detection rates in a real 5G network and is being further investigated with support from the German Federal Office for Information Security.

About the author:

Stefan Valentin is Professor for Mobile Networks at the Darmstadt University of Applied Sciences, where he also serves as chairman of the examination board and speaker of the Telecommunications Group. His research contributed mostly to indoor localization and resource allocation in mobile networks. Stefan’s algorithms are deployed in mobile networks around the world and more than 30 patent applications have been filed for them. His research papers have received various awards. Stefan is a member of the IEEE, founded the Steinbeis Center for Wireless Technologies and co-founded the startup Industrial Radio Systems.

Abstract:

We have continuous integration. We have continuous deployment. We have infrastructure as code. We have automated testing. Perfect world? Not quite! These are all useful and necessary islands on our way to fully automated environment setup, but the glue for their integration is still missing, requiring manual work (and associated time and effort). Using the example of the Lufthansa Cargo's Booking Platform, Peer will show which pieces were missing, what was built for bridging the gaps, and how to address the missing aspects on the journey towards automated environment setup, including Cloud infrastructure, software applications, and service configuration.

About the author:

Abstract:

This presentation gives an insight into applied research of distributed systems by means of a striking example. For this purpose, the effects of quality of service parameters such as delay, jitter and packet loss on the outcome of multiplayer online games are investigated. The use of an artificial intelligence makes it possible to eliminate the need for human interaction in the experiments. Thus, thousands of experiments could be conducted with different network configurations to systematically investigate their impact on game outcome. Complementing previous studies, this provides a solid database for statistical analysis. From this, mathematical models are derived that allow the calculation of scoring and winning probabilities. Thus, one is able to predict the outcome statistics of an ideal game with respect to the network conditions.

About the author:

Michael von Rüden is Professor of Distributed Systems at the Department of Computer Science at the University of Applied Sciences Darmstadt. His teaching and research focus is on distributed systems, cloud computing systems, cloud computing, big data, DevOps and CI/CD. Furthermore, he is interested in Software Defined Networking, wireless networks and the Internet of Things.

Prior to his current position, Prof. Von Rüden worked, among others, for the California Institute of Technology at CERN in Geneva. His research and development focused on the optimization of high-speed wide-area networks and large-scale data transfers using using Software Defined Networking especially for the Large Hadron Collider.

Anschrift

Hochschule Darmstadt
University of Applied Sciences
Haardtring 100
64295 Darmstadt
Tel.: 06151 16-02 (Vermittlung)
E-mail: info@h-da.de

Verantwortlich für den Inhalt

Für die angebotenen Inhalte sind die jeweiligen Personen verantwortlich.

Freistellungserklärung

Die Angaben wurden nach bestem Wissen erstellt, Fehler können jedoch nicht mit letzter Sicherheit ausgeschlossen werden. Rechtlich verbindlich sind ausschließlich die Festlegungen in den einschlägigen Rechtsgrundlagen (Gesetze, Verordnungen, Satzungen).

Datenschutz

Für die Verarbeitung personenbezogener Daten im Rahmen unseres Angebots gilt die Datenschutzerklärung der Hochschule Darmstadt