An intelligent search method and device suitable for an open source software supply chain

Abstract

The application relates to an intelligent search method and device suitable for an open source software supply chain. The steps include: 1) accepting a natural language query sentence sent by a user, using multiple methods to identify key elements of the query sentence, and the specific identified elements include entities, concepts, relationship names, attribute names and numerical attributes; 2) generating a candidate path according to the identified key elements; and 3) converting the candidate path and using a matching and sorting model to perform path matching and sorting, so as to obtain a search result. The application provides a natural language search algorithm based on open source software supply chain knowledge graph data, and provides a high-performance interface for user search of graph data. The application comprehensively utilizes multiple methods to improve key element identification, thereby ensuring the result recall rate, and generates candidate paths under different conditions, thereby reducing the path matching and sorting range, and effectively improving the search effect of knowledge graph data by using natural language.

Description

Technical Field

[0001] This invention belongs to the field of computer technology and relates to an intelligent search method and device applicable to the open-source software supply chain. Background Technology

[0002] Open source software has become the foundation of today's applications. During the development and operation of open source software, all upstream communities, source code packages, binary packages, third-party component distribution markets, application software distribution markets, as well as developers, maintainers, communities, foundations, etc., are involved, forming a supply relationship network based on dependencies and combinations, thus constituting the open source software supply chain. The open source software supply chain typically uses knowledge graphs as information carriers and utilizes graph databases such as Neo4j for data storage. Querying supply chain knowledge graph data usually requires query statements such as Cypher. This query process not only requires the queryer to master basic syntax but also to have a certain understanding of the entity and relationship types of the graph data; however, in most cases, ordinary users do not possess these capabilities.

[0003] Currently, the mainstream methods for directly querying knowledge graphs using natural language include semantic parsing and information retrieval. Semantic parsing transforms natural language questions into a series of formalized logical expressions that convey the semantic information of the entire question. These expressions can be converted into query statements that can be executed within the knowledge graph, and finally, the target data is retrieved by querying the knowledge graph using the corresponding query statements. Information retrieval methods, on the other hand, identify and extract the central entity in the question, query the knowledge graph for the knowledge subgraph within the adjacent range of that entity's node, and treat each node, edge, or path in the subgraph as a candidate answer. A model is built to convert both the candidate answers and the question into feature vectors, and then the similarity between the candidate answers and the question is compared to rank the candidates and obtain the final result. However, given the complexity and diversity of real-world data resources, relying solely on a single method often results in unsatisfactory recall and precision. Therefore, when building a query system, multiple algorithms should be used comprehensively to expand early-stage recall and refine later-stage filtering. Summary of the Invention

[0004] The purpose of this invention is to provide an intelligent search method and apparatus suitable for the open-source software supply chain, comprising three parts: key element mining based on multi-method collaboration, candidate path generation under multiple conditions, and candidate path matching and ranking. This method comprehensively utilizes multiple methods to identify key elements, thereby ensuring high result recall, and generates candidate paths under different conditions, thereby effectively reducing the scope of path matching and ranking.

[0005] To achieve the above objectives, the present invention adopts the following technical solution:

[0006] A smart search method applicable to the open-source software supply chain, comprising the following steps:

[0007] It receives natural language query questions input by users and identifies key elements of the natural language query questions, among which the key elements are key elements in the open source software supply chain knowledge graph.

[0008] Based on the identified key elements, a multi-condition candidate path generation strategy is adopted to generate candidate paths;

[0009] Candidate paths are matched and ranked against natural language query questions, and the candidate path with the highest score in the matching and ranking results is taken as the final search result.

[0010] Furthermore, the key element identification specifically includes: entities, concepts, relationship names, attribute names, and numerical attributes in the open-source software supply chain knowledge graph.

[0011] Furthermore, the key element identification of the query question involves using multiple methods to identify key elements of the query question, and the steps include:

[0012] 1) Entity, concept, relation, and attribute name identification based on a thesaurus. This step uses a word segmentation tool to segment the query statement and matches the resulting token with an offline-generated trie. The trie contains entity names, concept names, relation names, and attribute names from the knowledge graph, as well as synonyms and near-synonyms for each entry. To improve recall, the token and dictionary entries are case-normalized, and for English words, stemming and part-of-speech tagging are performed.

[0013] 2) Named Entity Recognition Based on Sequence Labeling Model. Since the number of real-world entities may be exhaustive, this invention employs deep learning for named entity recognition. A BERT+FLAT model is used for sequence labeling to complete entity recognition. FLAT uses positional encoding combined with additional lexical boundary information to improve the model's ability to recognize entity boundaries.

[0014] 3) Numerical attribute discovery and normalization. The search query may contain descriptions of certain numerical attributes, including descriptions of time. These descriptions require additional processing.

[0015] 4) Rule-based entity recognition. For open-source software supply chain knowledge graphs, the representative attributes of some types of entities in the graph have obvious rule characteristics. For these entities, this invention adopts a rule-based method for entity recognition.

[0016] Furthermore, based on the identified key elements, a multi-condition candidate path generation strategy is adopted to generate candidate paths, including: first-order and second-order path expansion for single key entities; candidate path selection and first-order and second-order path expansion for multiple key entities; screening and filtering candidate paths using the identified relationships; and screening and filtering candidate paths using specific type attributes.

[0017] Furthermore, the multi-condition candidate path generation strategy specifically includes the following steps:

[0018] 1) If only a single key entity in the knowledge graph is identified among the key elements, then that entity is used as the initial node, and it is expanded along the triple direction of the knowledge graph. The expansion includes first-order or second-order paths where the key entity exists as candidate paths.

[0019] 2) If a single key entity and a single relation name in the knowledge graph are identified in the key elements, then the entity is used as the initial node, and the first-order path equal to the identified relation name or the second-order path containing the identified relation is used as the candidate path.

[0020] 3) If two entities in the knowledge graph are identified in the key elements, the first-order or second-order path connecting the two entities is taken as the candidate path, and the candidate path is expanded by adding the first-order or second-order path of the head entity or the tail entity.

[0021] 4) If, in addition to identifying two entities, the key elements also include other relationships, then, based on 3), the candidate paths are filtered in the same way as in 2).

[0022] 5) If a numerical attribute of the knowledge graph is identified during the key element identification process, then candidate attributes are added to each node in the candidate path to restrict the filtering, and nodes that do not have this type of attribute are removed.

[0023] Furthermore, the process of matching and ranking candidate paths with natural language query questions includes: using the Sentence-BERT model as the path ranking model, extracting features using average pooling, and calculating similarity scores using cosine similarity to rank the paths.

[0024] Furthermore, the specific steps for matching and ranking candidate paths with natural language query questions include:

[0025] 1. Train a matching and ranking model using training data from an open-source software supply chain knowledge graph. This matching and ranking model is a Sentence-BERT model used to rank candidate paths.

[0026] 2. Since the paths constructed by triples in the graph cannot be directly processed by the BERT pre-trained model, this invention transforms the candidate paths constructed by triples according to preset rules to construct a candidate path expression in natural language form.

[0027] 3. Evaluation Metrics: The transformed candidate path representations are input into the matching and ranking model, and ranked according to the similarity of the questions. On the test set, the performance of the matching and ranking model is measured using ranking-related metrics.

[0028] 4. Input the candidate paths and the user-input query into the trained matching and ranking model. Based on the scores given by the matching and ranking model, select the candidate path with the highest score as the final search result.

[0029] A smart search device suitable for the open-source software supply chain, comprising:

[0030] The key element identification module is used to receive natural language query questions input by users and identify key elements in the natural language query questions. The key elements are the key elements in the open source software supply chain knowledge graph.

[0031] The candidate path generation module is used to generate candidate paths based on the identified key elements and employs a multi-condition candidate path generation strategy.

[0032] The matching and sorting module is used to match and sort candidate paths with natural language query questions, and the candidate path with the highest score in the matching and sorting results is taken as the final search result.

[0033] The beneficial effects of this invention are:

[0034] This invention designs and implements an intelligent search method based on an open-source software supply chain knowledge graph. This method automatically converts the user's natural language questions into query language and executes them, directly returning the target data that the user wants to query, thereby improving the user's query experience.

[0035] This invention addresses the insufficient recall rate of current mainstream search algorithms applied to supply chain knowledge graphs to some extent. It proposes a multi-method collaborative approach to identify key elements and utilizes a conditional path generation method to reduce the search range of candidate results. This invention provides a user-friendly natural language search model for open-source software supply chain knowledge graphs, effectively improving the ease of use of knowledge search while ensuring accuracy. Attached Figure Description

[0036] Figure 1 Flowchart of intelligent search methods applicable to the open-source software supply chain.

[0037] Figure 2 A schematic diagram of key element mining based on multi-method collaboration.

[0038] Figure 3 A schematic diagram of a multi-condition candidate path generation strategy.

[0039] Figure 4 A schematic diagram of the candidate path matching and sorting method. Detailed Implementation

[0040] To make the above-mentioned objectives, features and advantages of the present invention clearer, the present invention will be further described in detail below with reference to the accompanying drawings and specific embodiments.

[0041] This invention can be applied to intelligent search scenarios in the open-source software supply chain. For example, by providing an intelligent search interface for the software supply chain knowledge graph, users can query using natural language questions, and the system can return the relevant nodes and relationship attributes they expect. This function and device can reduce the learning cost for users to query graph data, thereby improving the efficiency of open-source software information processing.

[0042] Reference Figure 1 The flowchart of the intelligent search method applicable to the open-source software supply chain in this invention is shown, which mainly includes the following steps:

[0043] 1. Key element mining based on multi-method collaboration: Accepting natural language search queries from users, and using multiple methods to identify key elements in the queries. Specifically identified elements include: entities, concepts, relation names, attribute names, and numerical attributes.

[0044] 2. Multi-condition candidate path generation: Based on the identification of key elements, candidate paths are generated.

[0045] 3. Candidate path matching and ranking: The candidate paths are transformed and ranked using a pre-trained model.

[0046] Figure 2 This invention demonstrates the key element mining process for multi-method collaboration. Specifically, it includes the following:

[0047] 1. Identification of synonymous entities, concepts, relation names, and attribute names in the supply chain software graph. Specifically, the BabelNet multilingual knowledge base, the Synonyms Chinese synonym toolkit, and word vectors are used to obtain synonyms and near-synonyms for related objects. For relation names and attribute names represented by English words, their Chinese representations are obtained, and their Chinese synonyms and near-synonyms are then processed, including part-of-speech tagging and stemming. A trie is constructed for all objects' original and processed entries. This trie is then matched against the query statement to identify the matched entities, concepts, relation names, and attribute names.

[0048] 2. Introducing positional vectors for named entity recognition. Specifically, the Flat-Lattice Transformer (FLAT) NER model with a Lattice structure is used for entity recognition. The FLAT method adds two positional codes to each span (a string segment composed of characters or words), representing the start and end positions of the span in a sentence. For a single word, its start and end positions are the same, and FLAT uses relative distance to represent x. i and x j The relationship between x i and x j This represents two distinct spans, with x calculated from four different angles. i and x j Distance between:

[0049]

[0050]

[0051]

[0052]

[0053] Among them, s head [i] and s tail [i] represents span x i Head and tail position coordinates x represents i The starting position and x j The distance between the starting positions, x represents i The starting position and x j The distance between the ending positions, x represents i End position and x j The distance between the starting positions, x represents iEnd position and x j The distance between the ending positions. After calculation, four relative distance matrices are obtained. The four distances are concatenated and then subjected to a nonlinear transformation to obtain x. i and x y Position encoding vector:

[0054]

[0055] Among them W r It is a learnable parameter, P d This is the absolute positional encoding used by Transformer:

[0056]

[0057]

[0058] in, The position code representing even-numbered positions. This represents the position code for odd-numbered positions, where d represents... or k represents the dimension index of the position encoding, d model This represents the dimensions of the input and output of the encoder and decoder.

[0059] In this way, each span fully interacts with any other span, and then uses self-attention based on relative position encoding in Transformer-XL:

[0060]

[0061] in, Indicates attention weights. W k,E W k,R u T v T Represents the learnable parameters. x represents i The corresponding embedding vector transpose, x represents j The corresponding embedding vector.

[0062] During NER training, we used general NER labeled data, NER labeled data obtained from general KBQA questions using weak supervision methods, and manually labeled data for domain-specific questions.

[0063] 3. Rule-based Entity Recognition. This invention is based on intelligent search using an open-source software supply chain knowledge graph. Since the representative attributes of some types of entities in the software graph exhibit obvious rule-based characteristics, they can be identified using regular expressions. For these entities, we use a rule-based method for entity recognition. Some examples are shown in Table 1:

[0064] Table 1

[0065] Entity type Typical expression Regular expressions Vulnerability cve-2021-44228 cve-\\d+-\\d+ Weakness cwe-125 cwe-\\d+

[0066] 4. Numerical Attribute Discovery and Normalization. The search queries may contain descriptions of certain numerical attributes, including descriptions of time. These descriptions require additional processing and must be converted into a standardized representation. Some examples are shown in Table 2:

[0067] Table 2

[0068] Query Questions Original description Description after unification What vulnerabilities were present in January 2020? January 2020 2020-01 A software program that is 223 MB in size? 223 223

[0069] Figure 3 The flowchart demonstrates the method for generating candidate paths from identified key elements. The specific explanation is as follows:

[0070] 1. If only a single key entity in the knowledge graph is identified among the key elements, such as only a (nano) entity, then this entity is used as the initialization node. It is then expanded along the triples of the knowledge graph, and the expanded first-order or second-order paths containing the (nano) entity are used as candidate paths. Here, in this invention, (E) represents an unknown node generated by the strategy, and [R] represents an unknown relation generated by the strategy. The possible paths in this step include the following three cases:

[0071] (nano)-[R]-(E)

[0072] (nano)-[R]-(E)-[R]-(E)

[0073] (E)–[R]-(nano)-[R]-(E)

[0074] 2. If a single key entity and a single relation type are identified in the key elements of the graph, then that entity is used as the initialization node, and it is considered as a first-order path for identifying relation names or a second-order path containing already identified relations as a candidate path. This step can be seen as a filtering of case 1. For example, if the (nano) entity and the [author] relation are identified, the following path example might be generated:

[0075] (nano)-[Author]-(E)

[0076] (nano)-[R]-(E)-[Author]-(E)

[0077] (E)–[Author]-(nano)-(R)-(E)

[0078] 3. If two entities in the spectrum are identified in the key elements, then the first-order or second-order paths connecting the two entities are used as candidate paths, and the candidate paths are extended. The extension method is to add the first-order or second-order paths of the head entity or the tail entity. For example, if the entities (nano) and (BSD) are identified, then the possible path examples generated at this time are as follows:

[0079] (nano)-(R)-(E)-(R)-(BSD)

[0080] (nano)-[R]-(E)-[R]-(BSD)-(R)-(E)

[0081] 4. If there are other relationships in the key elements in addition to the two entities, on the basis of 3, handle them according to 2. For example, if the entities (nano) and (BSD) are identified and the relationship [dependency] is identified, then the possible path examples generated at this time are as follows:

[0082] (nano)-[dependency]-(E)-(R)-(BSD)

[0083] (nano)-[dependency]-(E)-[R]-(BSD)-(R)-(E)

[0084] 5. If a numerical attribute is identified in the key element recognition, then candidate attribute restrictions are added to each node in its candidate path respectively for screening, and the nodes that do not have this type of attribute are excluded. For example, if the entity (nano) is identified and a numerical attribute is identified, then the possible path examples generated at this time are as follows:

[0085] (nano)-[R]-(E<E has a numerical attribute>)

[0086] Figure 4 The method model for path matching and sorting in the present invention is shown. By using the siamese network structure, the vector representation of the sentence pair is obtained, and the similarity of the sentence pair is calculated to sort the paths. The specific description is as follows:

[0087] 1. Input the sentence pair into two BERT models with shared parameters, and then the BERT model outputs all the word vectors of the sentence and passes them into the Pooling (pooling) layer for average pooling to obtain the sentence vector representation of each sentence.

[0088] 2. Construct an objective function for the vectors generated by the sentence through the Sentence-BERT model, which includes three methods:

[0089] ① Concatenate the two sentence vectors with their positional difference vectors:

[0090] o = softmax(W t (u,v,|uv|))

[0091] Where u and v represent two sentence vectors, o represents the objective function, and W t This represents the learnable weight parameters, and |·| represents the bitwise difference.

[0092] ② Calculate the cosine similarity between the two sentence vectors:

[0093]

[0094]

[0095] Where l represents the loss function, cos(θ) represents the cosine similarity, n represents the number of samples, y represents the actual label, y' represents the predicted label, and MSE(y,y') represents the mean squared error.

[0096] ③ And the use of anchor sentences and positive / negative samples:

[0097] l = max(||s a -s p ||-||s a -s n ||+∈,0)

[0098] Where s a s p s n Representing the anchor sentence and positive / negative samples respectively, l represents the loss function, ||·|| represents the Euclidean distance, and ∈ represents s. a With s p The distance should be at least greater than s a With s n The distance is close to ∈.

[0099] Considering that obtaining positive samples is much more difficult than obtaining negative samples in practical applications, in order to achieve the best results, method ③ is used during training in this invention, and then transferred to method ② for prediction.

[0100] 3. During training, the model input includes sentence a, the correct result p, and randomly constructed negative samples n. Both p and n can be used as input for candidate paths b. Parameters include the training batch size (batch_size), the number of iterations (epochs), and the pre-trained model used (word_embedding_model).

[0101] 4. When used for path ranking, the model input includes a query and candidate paths. The model outputs a similarity score between the two. All candidate paths are ranked based on their scores, and the path with the highest score is returned as the result.

[0102] Another embodiment of the present invention provides an intelligent search device suitable for the open-source software supply chain, comprising:

[0103] The key element identification module is used to receive natural language query questions input by users and identify key elements in the natural language query questions. The key elements are the key elements in the open source software supply chain knowledge graph.

[0104] The candidate path generation module is used to generate candidate paths based on the identified key elements and employs a multi-condition candidate path generation strategy.

[0105] The matching and sorting module is used to match and sort candidate paths with natural language query questions, and the candidate path with the highest score in the matching and sorting results is taken as the final search result.

[0106] Another embodiment of the present invention provides a computer device (computer, server, smartphone, etc.) including a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the steps of the method of the present invention.

[0107] Another embodiment of the present invention provides a computer-readable storage medium (such as ROM / RAM, disk, optical disk) storing a computer program that, when executed by a computer, implements the various steps of the method of the present invention.

[0108] The specific embodiments of the present invention disclosed above are intended to help understand the content of the present invention and to implement it accordingly. Those skilled in the art will understand that various substitutions, changes, and modifications are possible without departing from the spirit and scope of the present invention. The present invention should not be limited to the content disclosed in the embodiments of this specification; the scope of protection of the present invention is defined by the claims.

Claims

1. An intelligent search method applicable to the open-source software supply chain, comprising the following steps: It receives natural language query questions input by users and identifies key elements of the natural language query questions, among which the key elements are key elements in the open source software supply chain knowledge graph. Based on the identified key elements, a multi-condition candidate path generation strategy is adopted to generate candidate paths; The candidate paths are matched and sorted with the natural language query questions, and the candidate path with the highest score in the matching and sorting results is taken as the final search result. The multi-condition candidate path generation strategy includes: 1) If only a single key entity in the knowledge graph is identified among the key elements, then the entity is used as the initial node, and it is expanded along the triple direction of the knowledge graph. The expansion includes first-order or second-order paths where the key entity exists as candidate paths. 2) If a single key entity and a single relation name in the knowledge graph are identified in the key elements, then the entity is used as the initial node, and the first-order path equal to the identified relation name or the second-order path containing the identified relation is used as the candidate path. 3) If two entities in the knowledge graph are identified in the key elements, the first-order or second-order path connecting the two entities is taken as the candidate path, and the candidate path is expanded by adding the first-order or second-order path of the head entity or the tail entity. 4) If, in addition to identifying two entities, the key elements also include other relationships, then, based on 3), the candidate paths will be filtered in the same way as in 2). 5) If a numerical attribute of the knowledge graph is identified during the key element identification process, then candidate attributes will be added to each node in its candidate path to restrict the filtering, and nodes that do not have that type of attribute will be removed.

2. The method as described in claim 1, characterized in that, The key element identification of natural language query questions is achieved by integrating multiple methods, including: entity, concept, relation name, and attribute name identification based on a thesaurus; entity identification based on a sequence labeling model; rule-based entity identification; and numerical attribute discovery and normalization.

3. The method as described in claim 1, characterized in that, Based on the identified key elements, a multi-condition candidate path generation strategy is adopted to generate candidate paths, including: first-order and second-order path expansion for single key entities; candidate path selection and first-order and second-order path expansion for multiple key entities; and screening and filtering candidate paths using the identified relationships. Candidate paths can be filtered using specific type attributes.

4. The method as described in claim 1, characterized in that, The process of matching and ranking candidate paths with natural language query questions includes: using the Sentence-BERT model as the path ranking model, extracting features using average pooling, and calculating similarity scores using cosine similarity for ranking.

5. The method as described in claim 4, characterized in that, The objective function is constructed from the vectors generated by the Sentence-BERT model, including three methods: ① Concatenate the two sentence vectors with their positional difference vectors: o=softmax(W t (u,v,|uv|)) Where u and v represent two sentence vectors, o represents the objective function, and W t This represents the learnable weight parameters, and |·| represents the bitwise difference. ② Calculate the cosine similarity between the two sentence vectors: Where l represents the loss function, cos(θ) represents the cosine similarity, n represents the number of samples, y represents the actual label, y' represents the predicted label, and MSE(y,y') represents the mean squared error. ③ And the use of anchor sentences and positive / negative samples: l=max(||s a -s p ||-||s a -s n ||+∈,0) Among them, s a s p s n Representing the anchor sentence and positive / negative samples respectively, l represents the loss function, ||·|| represents the Euclidean distance, and ∈ represents s. a With s p The distance should be at least greater than s a With s n The distance is close to ∈.

6. The method as described in claim 5, characterized in that, Method ③ was used during training, and then transferred to method ② for prediction.

7. A smart search device suitable for the open-source software supply chain, employing the method described in any one of claims 1 to 6, characterized in that, include: The key element identification module is used to receive natural language query questions input by users and identify key elements in the natural language query questions. The key elements are the key elements in the open source software supply chain knowledge graph. The candidate path generation module is used to generate candidate paths based on the identified key elements and employs a multi-condition candidate path generation strategy. The matching and sorting module is used to match and sort candidate paths with natural language query questions, and the candidate path with the highest score in the matching and sorting results is taken as the final search result.

8. A computer device, characterized in that, It includes a memory and a processor, the memory storing a computer program configured to be executed by the processor, the computer program including instructions for performing the method of any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program, which, when executed by a computer, implements the method according to any one of claims 1 to 6.

Images