Rowhammer attacks and DRAM side channel attacks require addresses that map to the same DRAM bank. Such addresses can be found using undocumented, reverse-engineered DRAM addressing functions. A recent large-scale Rowhammer study showed that existing reverse-engineering tools fail in about 50 % of real-world setups. These tools assume conventional setups with a power-of-two number of identical power-of-twosized DIMMs (PTID) but fail on asymmetric non-PTID setups.

In this paper, we discover that many non-PTID setups follow previously unknown conditional DRAM mappings, where different parts of memory obey different locally valid linear function sets. We present DREAMS, the first approach to recover DRAM bank addressing functions on non-PTID setups with such conditionally valid function sets. The key novelty is to model asymmetric mappings together with the conditions that select each function set, instead of assuming one globally valid linear function set. DREAMS detects bit-inconsistent behavior, i.e., cases where the influence of an address bit is not consistent across the address space, and uses this signal to infer whether the system is PTID or non-PTID. For non-PTID setups, DREAMS recovers the region- and channel-specific function sets and their selection conditions, and verifies the resulting conditional mapping entirely in software. For overlapping functions, DREAMS uses SAT constraints to model interactions between multiple candidate bits simultaneously, allowing the analytical recovery pipeline to handle functions that share bits. We evaluate DREAMS on 19 non-PTID DIMM configurations across 6 Intel and AMD DDR4/DDR5 systems, recovering mappings with up to 3 conditional function sets selected by address cutoffs and channel functions. We show that these reverse-engineered functions provide security-critical DRAM-bank information, e.g., for Rowhammer attacks, DRAM isolation mechanisms, and side-channel attacks. 

Digital Twin (DT) technology is increasingly used in manufacturing to enable realtime monitoring, prediction and decision support. In this work, we propose a DT dedicated to fault diagnosis in manufacturing systems modeled as Discrete Event Systems. Building on our previous contribution, which introduced a data-driven diagnostic method based on Long Short-Term Memory (LSTM) neural networks, we present an improved version of this approach and deliver a turnkey solution suitable for both shop-floor operators and plant managers. The effectiveness of the proposed DT is demonstrated using the CellFlex plant, a training and research platform at the URCA. CellFlex plant consists of eight stations operating around a central conveyor, forming a flexible miniaturized bottling line connected through industrialstandard networks. The obtained results confirm the relevance and practical applicability of the proposed approach for online fault diagnosis in industrial environments.

Tor is a privacy-enhancing technology that enables anonymous communication by leveraging onion routing. A client chooses a path of three Tor relays, known as a circuit, and encrypts the traffic for each relay in reverse order, sending it to the first relay. Each relay knows only its predecessor and successor, unaware of the entire circuit, thus enabling anonymous communication. Tor builds the circuit telescopically, i. e., the first relay establishes a TCP connection to the second, and the second establishes a TCP connection to the third. However, Tor allows cross-circuit interference (CCI), meaning that if two circuits share two consecutive relays, data transmitted over the same TCP connection interferes with each other.

In this paper, we demonstrate that CCI can be exploited as a side channel to conduct an off-path (non-MitM) website fingerprinting attack. An attacker builds a two-hop circuit between a shared link and measures the Round Trip Time (RTT), while the victim browses on the same link, visiting different websites. That creates a bottleneck, which reveals the website the victim was accessing. We conducted an open-world experiment and show that an attacker can distinguish between monitored and unmonitored websites, achieving an 𝐹1-score of 94.2 % in a single-class setup and 63.2 % in a multi-class setup, where we differentiate between all websites and unmonitored ones. Additionally, we conducted a closed-world experiment with different exit relays on the Tor network. We demonstrate that an attacker can achieve an 𝐹1-score of up to 66.7 % when distinguishing the top 95 websites using only 150 traces per website. We also show that the security settings in the Tor browser can be an effective countermeasure when set to safest, reducing the 𝐹1-score to 1.2 %, but making web surfing unusable. 

Although Vision Language Models (VLMs) have seen tremendous progress across all kinds of use cases, they still fall behind in answering questions regarding diagrams compared to photos. Although progress has been made in the area of bar charts, line charts and similar diagrams, there is still few research concerned with other types of diagrams, e.g. in the computer science domain. We identified a gap in research on visual question answering on UML class diagrams. Our objective is to fill the gap by analyzing the performance of popular open-weight VLMs on a self-constructed benchmark for visual question answering based on UML class diagrams which is both challenging and manageable. We further construct a large-scale training dataset with 16.000 image-question-an-swer triples based on real software repositories on GitHub. We focus on Java-based repositories and filter for project sizes that are small enough to fit on a single diagram with 4000x4000 pixels maximum in a readable manner. We ask questions based on 18 question templates. We show that a LoRA-based finetune of Qwen 2.5 VL 7B easily outperforms Qwen 3.5 27B, which is a recent and well-performing VLM in many other benchmarks.

Physical Unclonable Functions (PUFs) exploit inherent manufacturing variations in electronic devices to create unique hardware fingerprints, which are typically used as a source of randomness for generating device-specific cryptographic keys. In this work, however, we explore the possibility of repurposing PUFs as a secure storage mechanism for pre-existing keys. First, we evaluate existing RH-PUFs, introduce five novel RH-PUF constructions, and compare all of them with respect to their suitability for cryptographic key generation. Second, we propose DRAmGON, a novel, unconventional PUF-based approach that enables the direct encoding of cryptographic keys into Rowhammer-susceptible DRAM, thereby allowing persistent data storage in volatile memory. Our experiments using FlippyRAM show that 81 % of the tested systems exhibit Rowhammer susceptibility, establishing RH-PUFs as a viable hardware-based security primitive. 

Background: The use of electronic headache diaries via smartphone apps has several advantages over paper and pencil diaries. Still, adherence is not always satisfactory. One potential strategy to improve adherence is the implementation of daily reminders, but their effect remains uncertain.

Objective: The DMKG-App (the headache diary app of the German Migraine and Headache Society, DMKG) sends daily reminders to encourage user adherence. Due to a technical problem, reminders failed for a 14-day period in early 2023. This provided a unique opportunity to evaluate the effect of daily reminders on adherence to the headache diary in the form of a retrospective longitudinal observational cohort study.

Methods: The failure period was compared to 14-day prefailure and postfailure periods and to corresponding periods of the previous year. We evaluated effects on the number of daily entries, delay to make the daily entry, and attrition rate, using ANOVA and logistic regression (α<.05). The effect of age, gender, headache frequency, and previous adherence was investigated using interaction analysis.

Results: The DMKG-App had 4236 active users before reminders failed (females 81.6%, 95% CI 80.5‐82.8), age 39.8 (95% CI 39.4‐40.2) years. During the failure period, the number of daily entries fell by 11.0% (95% CI 9.2‐12.8). More specifically, entries per 14-day period significantly declined from 10.2 (95% CI 10.1‐10.3) prefailure to 9.1 (95% CI 9.0‐9.2) during the failure period, followed by a rise to 10.2 (95% CI 10.1‐10.3) during the postfailure period (F_2,11498=79.2; P<.001). The delay to make the daily entry increased by 46.3% (95% CI 45.8‐46.8), from 1.90 (95% CI 1.89‐1.90) days prefailure to 2.78 (95% CI 2.77‐2.79) days during failure, and returned to 1.85 (95% CI 1.84‐1.86) days postfailure (F_2,39=155.4; P<.001). In addition, there was a significant rise in attrition rate by 32.2% (95% CI 8.1‐61.7) (from 4.0%, 95% CI 3.4‐4.6, in the prefailure period to 5.2%, 95% CI 4.6‐5.9, in the failure period, returning to 3.9%, 95% CI 3.4‐4.5, in the postfailure period, z=3.10; P=.002). Interaction analysis revealed that the effect of reminder failure was larger in males than in females (regarding entry delay), in persons with lower compared to higher headache frequencies (regarding number of daily entries and entry delay), and in persons with higher vs lower previous adherence rates (regarding number of daily entries, entry delay, and attrition). There was no interaction between age and reminder failure.

Conclusions: This is the first study investigating the effect of daily reminders in a digital headache diary app. Results suggest that reminders are an effective means to improve adherence. Males, persons with low headache frequencies, and those with high adherence during the presence of reminders seem to benefit most. These results are important additions to our knowledge on compliance with digital health apps.

Trial Registration: German Clinical Trials Register DRKS 00021081; https://drks.de/search/en/trial/DRKS00021081/details

The decision for construction works in existing buildings depends on technical feasibility, economic efficiency, and compliance with law. Decision-making can be supported by efficient digital services offering objective assessment criteria and recommending scalable and sustainable measures for new construction or renovation. This requires the digitalization of existing information such as floor and site plans as well as image files of the buildings making them available for digital services. The paper will demonstrate how intelligent tools for sustainable renovation may be offered legally market-ready by developing a Legal Governance Concept for sharing data and tools via con- struction service platforms. In this, Legal Governance depends on defining rights and roles as well as modeling compliant processes. The Legal Governance Concept was designed and implemented within the research project NaiS (Sustainable intelligent renovation measures).

Land cover classification from remote sensing data is an essential task in Earth observation, playing a crucial role in various applications, including environmental monitoring, urban planning, agriculture, and natural resource management. This paper evaluates four advanced deep learning architectures: ResNet50, EfficientNetB3, ConvNeXt, and Vision Transformer (ViT) on EuroSAT dataset with consistent experimental setups. From comparative analysis, EfficientNetB3 yields the highest result compared to other baseline models; therefore, an advanced MS-EfficientNetB3 architecture is proposed to improve land cover classification performance. In particular, the proposed framework consists of two stages: multi-scale feature extraction and feature fusion stage that can extract not only the fine-grained local feature but also high-level semantic information in remote sensing images. Label smoothing and cosine annealing are used to improve model generalization and optimization. Experiments show that the proposed architecture yields a classification accuracy of 99.37% which surpasses the baseline EfficientNetB3 model. The ablation study proves the effectiveness of each part of the proposed framework, especially the role of multi-scale feature learning.

This paper presents a numerical investigation and performance optimization of a large-scale, stratified thermal energy storage system integrated into a public research building. The system combines multiple renewable heat sources — including solar thermal collectors and a photovoltaic-powered power-to-heat unit — with various thermal heating loads. The methodology integrates both simultaneous and sequential building energy demand and generation modeling with transient CFD simulations in OpenFOAM® to analyze internal mixing and thermocline dynamics. A generally applicable performance evaluation is based on the internal temperature distribution, the temporal evolution of temperature gradients, Reynolds and Richardson number under various operating scenarios. Results confirm that carefully matched inlet temperatures and injection heights significantly enhance stratification stability. The best performance was observed during summer operation with reduced charging temperatures to better fit stratification levels while maintaining thermal power, and during winter with increased temperatures at reduced volumetric flow rates. These adjustments result in thermoclines up to 22% thinner during summer and up to 42% thinner during winter compared to sequential operation.

Background

Methods

Results

Conclusions

Semantic segmentation of high-resolution aerial imagery is a crucial task in remote sensing, which enables the pixel-level understanding of complex peri-urban and urban environments. Accurate segmentation remains challenging due to class imbalance, fine boundary ambiguity, and presence of multi-scale objects. In this paper, a comprehensive feature pyramid network (FPN) combined with encoder-decoder-based semantic segmentation architectures is evaluated on a publicly available highresolution aerial imagery dataset. The dataset is pre-processed using a patch extraction technique, followed by data augmentation to optimize model performance. Furthermore, we experimented with different segmentation frameworks and, based on the evaluation metrics, the ResNeXt-101 backbone in combination with the FPN framework outperformed other models for this multi-resolution semantic segmentation problem. 

Der Beitrag untersucht die gegenwärtige Renaissance des politischen Denkens Carl Schmitts im Umfeld US-amerikanischer Technolibertarians und analysiert deren Bedeutung für das Staats- und Politikverständnis während der zweiten Amtszeit Donald Trumps. Ausgangspunkt ist die Beobachtung, dass zentrale schmittsche Konzepte insbesondere das Freund-Feind-Kriterium, der Dezisionismus sowie der Begriff des Ausnahmezustands im Silicon Valley nicht lediglich rezipiert, sondern aktiv in eine technologiegetriebene Gesellschafts- und Herrschaftstheorie übersetzt werden. Anhand zentraler Akteure und Diskursstränge (u. a. Neoreactionary Movement, Dark Enlightenment, Network-State-Konzepte) zeigt der Beitrag, wie Schmitts Kritik am Liberalismus mit technolibertären Vorstellungen von Effizienz, Exit-Strategien und privater Souveränität verschränkt wird. Der Souverän erscheint dabei nicht mehr als staatliche Institution, sondern als Gründer, CEO oder Code-basierte Exekutivinstanz, während demokratische Verfahren durch marktbasierte Leistungs- und Outputlegitimation ersetzt werden. Der Artikel argumentiert, dass diese Transformation nicht nur eine ideologische Verschiebung innerhalb der Tech-Eliten darstellt, sondern auf eine tiefgreifende Reartikulation des Politischen zielt, in der Demokratie als Hindernis und Technologie als Medium autoritärer Ordnung fungiert. Abschließend wird gezeigt, dass die technolibertäre Fortschreibung Schmittscher Motive zu einem postdemokratischen, plutokratischen Politikmodell führt, das mit klassischen demokratischen Legitimitätsvorstellungen fundamental bricht.

We present BXAgent, a tool that automatically generates Java code for
bidirectional model transformations between EMF/Ecore metamodels from a
natural-language description. Given two .ecore files and a short
textual specification, an LLM-backed pipeline produces a single Java class
that supports (i) batch transformations in both directions,
(ii) incremental synchronisation after single-sided edits, and
(iii) concurrent synchronisation (csync) when both models are edited
independently. Unlike conventional bx tools that require a formal
specification in a dedicated transformation language (e.g. TGGs or lenses),
BXAgent's only user-facing input is natural language. The generated code is
deterministic and stable: because the transformation logic is produced by a
fixed FreeMarker template, repeated runs yield identical output for the same
mapping specification. We applied BXAgent to the revised Families-to-Persons (F2P)
benchmark of TTC 2026, which extends the classic case with 13 concurrent
test cases and 3 round-trip cases in addition to the original 34 batch and
incremental tests. BXAgent passes 46 out of 50 tests, including all
four genuine conflict cases. We describe the tool architecture,
the generated synchronisation algorithm, our conflict resolution strategy,
and discuss the four failing cases together with their root causes.