Zum Hauptinhalt springen
Echtzeit-Radar & Feeds
Alle RSS Feeds ➔
👥 Community & Social
IT Security ToolsODPure(25.09.2026 um 07:32 Uhr)
••
IT Security NachrichtenDuelbits Confirms $7 Million Hot-Wallet Hack, forcing Systems offline(25.09.2026 um 07:41 Uhr)
•
IT Security NachrichtenBitget Confirms $351.6 Million Hot Wallet Hack, Suspends Withdrawals(25.09.2026 um 08:02 Uhr)
•
IT Security NachrichtenAttackers Drain Payy Network After Exploiting Ethereum Bridge Contract(25.09.2026 um 08:09 Uhr)
•
IT Security NachrichtenDuelbits Hot Wallet Hack Drains $7 Million, Forces Platform Offline(25.09.2026 um 08:16 Uhr)
•••••
IT Security ToolsODPure(25.09.2026 um 07:32 Uhr)
••
IT Security NachrichtenDuelbits Confirms $7 Million Hot-Wallet Hack, forcing Systems offline(25.09.2026 um 07:41 Uhr)
•
IT Security NachrichtenBitget Confirms $351.6 Million Hot Wallet Hack, Suspends Withdrawals(25.09.2026 um 08:02 Uhr)
•
IT Security NachrichtenAttackers Drain Payy Network After Exploiting Ethereum Bridge Contract(25.09.2026 um 08:09 Uhr)
•
IT Security NachrichtenDuelbits Hot Wallet Hack Drains $7 Million, Forces Platform Offline(25.09.2026 um 08:16 Uhr)
•••••
Intelligence View
⚡ tsecurity.de Intelligence

Building a RAG-Based Subsidy Matching System from Scratch with Python

What I Built A RAG (Retrieval-Augmented Generation) system that helps Japanese small businesses find government subsidies. Users describe their business situation, and the system retrieves relevant subsidies from a vector database, then…

0
↗ Quelle (dev.to)
Reagiere als Erste:r — dein Feedback zählt!




What I Built



A RAG (Retrieval-Augmented Generation) system that helps Japanese small businesses find government subsidies. Users describe their business situation, and the system retrieves relevant subsidies from a vector database, then generates a detailed answer using Claude API.






Why RAG Instead of Just Using an LLM?



LLMs alone have three problems for this use case:





  1. Hallucination — They confidently make up subsidy details that don't exist


  2. Stale data — Subsidy information updates frequently; LLM training data can't keep up


  3. No sources — Users need to verify the information, but LLMs don't cite where it came from



RAG solves all three by retrieving real data first, then passing it to the LLM as context. The LLM generates answers grounded in actual documents, not its training data.






Architecture






User Query
│
▼
┌─────────────┐ ┌──────────────┐
│ Retriever │────▶│ Generator │
│ (embed + │ │ (Claude API) │
│ search) │ └──────┬───────┘
└──────┬──────┘ │
│ ▼
┌──────▼──────┐ AI Answer
│ ChromaDB │ with sources
│ (Vector DB) │
└─────────────┘






The data ingestion pipeline:




JSON Data → Sentence Chunker → Embedding Model → ChromaDB









Tech Stack and Why

































Layer Choice Why
Embedding multilingual-e5-large Best multilingual performance for free. Runs locally — no data leaves the machine
Vector DB ChromaDB Zero config. pip install and it works with local persistence
LLM Claude API Strong long-context handling and Japanese language quality
Frontend Streamlit Full UI in ~40 lines of Python





Why Not LangChain/LlamaIndex?



I intentionally built the pipeline from scratch first. Frameworks abstract away the internals, which is great for production but bad for learning. By writing each step manually — chunking, embedding, storing, retrieving, prompting — I understood exactly what each piece does and why it matters.






Key Implementation Details






1. Sentence-Boundary Chunking



The most impactful decision was how to split documents into chunks.



Naive approach (fixed-size split):




...eligible IT tools include accounting software, ord  ← cut mid-sentence
er management software, payment software... ← next chunk






My approach (split at Japanese sentence boundaries 。):




sentences = text.split("。")
# Greedily pack sentences into chunks up to CHUNK_SIZE
# Overlap the tail for context continuity






This preserves semantic meaning in each chunk, which directly improves retrieval accuracy.






2. Embedding with Prefix



multilingual-e5 requires specific prefixes to distinguish between stored passages and search queries:




# When indexing documents
prefixed = [f"passage: {text}" for text in texts]

# When searching
query_embedding = model.encode(f"query: {user_query}")






Missing this prefix is a common mistake that silently degrades search quality.






3. Prompt Design for Grounded Answers



The generation prompt explicitly constrains the LLM:




prompt = """You are a Japanese subsidy advisor.
Answer based on the reference information below.
If information is insufficient, state that explicitly.
For critical details like deadlines and amounts, be precise.
"""






This reduces hallucination by telling the model to stick to the provided context.






Evaluation: Measuring What Matters



Building a RAG that "seems to work" isn't enough. I created a test suite with 10 queries, each with an expected correct subsidy:











































Query Expected Result Rank
"Want to introduce accounting software" Digital/AI Subsidy 1st
"Want to install new manufacturing equipment" Manufacturing Subsidy 2nd
"Small shop wanting to attract customers via flyers" Small Business Sustainability Subsidy 1st
"Restaurant wanting to start EC business" New Business Advancement Subsidy 3rd
"Want to convert part-timers to full-time" Career Up Grant 1st
... ... ...


Results:




















Metric Score
Hit Rate @5
100% (10/10)
MRR @5 0.817




  • Hit Rate @5: The correct answer appeared in the top 5 results for every query


  • MRR (Mean Reciprocal Rank): On average, the correct answer ranked between 1st and 2nd place






Why These Metrics?





  • Hit Rate tells you "can the system find the right answer at all?"


  • MRR tells you "how quickly does it find it?" (1st place = 1.0, 2nd = 0.5, 3rd = 0.33)



Both are standard IR (Information Retrieval) metrics. Having these numbers lets you objectively compare different chunking strategies, embedding models, or retrieval parameters.






What I Learned






1. Chunking strategy matters more than the embedding model



Switching from fixed-size to sentence-boundary chunking had a bigger impact on retrieval quality than I expected. The embedding model can only work with what it's given — if chunks are semantically broken, even the best model can't fix that.






2. Evaluation should come before optimization



Building the evaluation script early gave me a baseline to measure improvements against. Without it, I would have been tuning blindly.






3. Start simple, verify, then add complexity



The entire system is ~200 lines of Python (excluding tests). No frameworks, no complex abstractions. This made debugging straightforward — when something went wrong, there were very few places to look.






What's Next





  • Reranker: Add a cross-encoder reranker to improve ranking quality (especially for Q4 and Q9 which ranked 3rd)


  • Hybrid search: Combine vector similarity with keyword matching (BM25) for better recall


  • More data: Scale from 15 to 100+ subsidies with automated collection


  • Production frontend: Migrate from Streamlit to Next.js + FastAPI for a proper web application






If you're building a RAG system for the first time, I'd recommend the same approach: build from scratch first, measure with real metrics, then decide if you need a framework. The understanding you gain is worth far more than the time saved by a framework.

1. Sofort-Triage & Abwehrmaßnahmen

SOC Incident Playbook: Remote Code Execution (RCE) Defense
Syntax validiert (0 Fehler)
title: Detect Exploitation - Building a RAG-Based Subsidy Matching System from Scratch with Python
id: e73c39c0-0040-4888-909c-456608ec42d0
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-25
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access
Syntax validiert (0 Fehler)
rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-25"
        description = "YARA Signature for "
    strings:
        $str = "Building a RAG-Based Subsidy M" ascii wide
    condition:
        any of them
}
Syntax validiert (0 Fehler)
index=security sourcetype IN ("cisco:asa", "pan:traffic", "zeek_conn", "suricata", "WinEventLog:Security")
("Building a RAG-Based Subsidy Matching Sy")
| stats count earliest(_time) as first_seen latest(_time) as last_seen by src_ip, dest_ip, dest_host, signature
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count
Syntax validiert (0 Fehler)
message: "*Building a RAG-Based Subsidy Matching Sy*"
Syntax validiert (0 Fehler)
CommonSecurityLog
| where Message has "Building a RAG-Based Subsidy Matching Sy"
| summarize EventCount = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by SourceIP, DestinationIP, DestinationPort, Activity
| extend DetectionRule = "iShareStuff-CTI-Compiled"
| sort by EventCount desc

2. Cyber Threat Intelligence & Forensik

CTI Threat Relationship Graph2 Knoten / 1 Relationen
CVE / Incident Software MITRE ATT&CK CWE Weakness IoC
🎯
MITRE ATT&CK Matrix Navigator 14 Taktiken
Reconnaissance
-
Resource Development
-
Initial Access
Execution
Persistence
-
Privilege Escalation
Defense Evasion
Credential Access
-
Discovery
-
Lateral Movement
-
Collection
-
Command and Control
Exfiltration
-
Impact
tsecurity.de Cognitive Threat RAG
Fokus-Vektor:

Kognitive Analyse für identifizierte Bedrohung: Erhöhte Bedrohungslage im Bereich Building a RAG-Based Subsidy Matching Sy.... Basierend auf 368k Vektor-Korrelationen werden sofortige Isolationsmaßnahmen für betroffene Endpunkte empfohlen.

🛡️ Angriffsfläche & Exposure

Netzwerk/Remote-Zugriff ohne Vorauthentifizierung möglich.

⚡ Empfohlene Sofortmaßnahmen
  • 1. Perimeter-Inspektion: Relevante Portfreigaben und exponierte Endpunkte unverzüglich scannen.
  • 2. Patch-Applikation: Hersteller-Hotfix einspielen oder betroffene Daemons in isolierte DMZ-Segmente überführen.
  • 3. Telemetrie & EDR-Alerts: Prozessaufrufe und Child-Processes auf anomale Shell-Spawns überwachen.
🔗 Semantisch verwandte Zero-Days MariaDB 11.7 VEC
Ähnliche Beiträge
🔍 Verwandte News

Auch interessante Nachrichten Building a RAG-Based Subsidy Matching System from Scratch with Python

Thematisch verwandte Begriffe: Building, RAGBased, Subsidy, Matching · 6 Treffer

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Laden...

Beiträge werden geladen ...

Laden...

Videos werden geladen ...

Zum Aktualisieren ziehen
ZERO-DAY CVE-2026-97647 | A security vulnerability has been detected in ningzichun student-managem…
Advisory →
tsecurity.de Icon
Offline-Lesen, Eilmeldungen & 0ms Ladezeit

Installiere tsecurity.de direkt auf deinen Home-Bildschirm für das ultimative Vollbild-Magazinerlebnis ohne Browser-Leisten.

Nächster Beitrag