Question answering method and device, equipment and medium

Abstract

The invention discloses a question answering method and device, equipment and a medium. The method comprises the following steps: acquiring target problem information; determining target retrieval information according to the target problem information; according to the target retrieval information, performing retrieval in a target software supply chain atlas to obtain a target retrieval result, the target software supply chain atlas being used for representing target entities and target entity relationships in a target software supply chain, the target entities comprising target component entities and target vulnerability entities in the target software supply chain, and the target component entities comprising target component entities and target vulnerability entities in the target software supply chain; the target entity relationship comprises a dependency relationship between the target component entities and a hit relationship between the target component entities and the target vulnerability entities; the target answer information corresponding to the target question information is generated according to the target retrieval result, the software supply chain related questions can be inquired and answered through a natural language, a user can conveniently know and master component information and vulnerability information used by software, and the safety of the software supply chain is guaranteed.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and in particular to a question-answering method, device, equipment and medium. Background Art

[0002] Most software is usually a combination of various software artifacts that include open source components. The extensive use of open source components has led to an increasingly complex and diverse software supply chain. However, open source components referenced in software are prone to vulnerabilities that are difficult to detect. It is becoming increasingly difficult for developers to control the security of third-party components. Therefore, supply chain security protection is an important responsibility of every enterprise and security team. Summary of the invention

[0003] The embodiments of the present application provide a question-answering method, device, equipment and medium, which can query and answer software supply chain related questions through natural language, facilitate users to understand and grasp the component information and vulnerability information used in the software, and ensure the security of the software supply chain. The above technical solution is as follows: In a first aspect, an embodiment of the present application provides a question-answering method, the method comprising: Get target problem information; Determine target retrieval information according to the target question information; According to the above target search information, a search is performed in the target software supply chain graph to obtain a target search result; the above target software supply chain graph is used to characterize the target entities and target entity relationships in the target software supply chain; the above target entities include target component entities and target vulnerability entities in the above target software supply chain, and the above target entity relationships include dependency relationships between the above target component entities and hit relationships between the above target component entities and the above target vulnerability entities; The target question information and the target search results are input into the target macro model, and the target answer information corresponding to the target question information is output based on the target search results.

[0004] In a possible implementation, the target search information includes at least one of the following: a target search statement, a target search entity; The above-mentioned determining the target retrieval information according to the above-mentioned target question information includes: Generate the above target search sentence according to the above target question information; and / or The target retrieval entity is extracted from the target question information.

[0005] In a possible implementation, the target search information includes at least one of the following: a target search statement, a target search entity; According to the above target search information, the target software supply chain graph is searched to obtain the target search results, including: According to the target search statement, a search is performed in the target software supply chain graph to obtain a target statement search result; the target statement search result includes target result information corresponding to the target search statement obtained from the target software supply chain graph; and / or According to the above target retrieval entity, a search is performed in the above target software supply chain graph to obtain a target entity retrieval result; the above target entity retrieval result includes information related to the above target retrieval entity in the above target software supply chain graph.

[0006] In a possible implementation, the target entity is searched in the target software supply chain graph according to the target search entity to obtain the target entity search result, including: According to the target retrieval entity, a search is performed in the target software supply chain graph to obtain a target retrieval subgraph corresponding to the target retrieval entity; the target retrieval subgraph is used to represent target-related entities and target-related entity relationships in the target software supply chain graph; the target-related entities include designated target entities corresponding to the target retrieval entity in the target software supply chain graph, and target entities whose relationship path length with the designated target entity is within a preset length range; The target entity retrieval result is determined based on the above target retrieval subgraph.

[0007] In a possible implementation manner, the target entity further includes a target license entity in the target software supply chain, and the target entity relationship further includes a license relationship between the target component entity and the target license entity.

[0008] In a possible implementation, the step of obtaining target problem information includes: Get user question information; The user question information is preprocessed to obtain target question information; the preprocessing includes translation processing and / or similarity expansion processing; the target question information includes at least one of the following: a target question, a translation question and at least one similar question corresponding to the user question information.

[0009] In a possible implementation, after generating the target answer information corresponding to the target question information according to the target search result, the method further includes: Generate target question recommendation information based on the historical question and answer information and the above target search results; the above historical question and answer information includes the above target answer information and / or the above target question information.

[0010] In a possible implementation, the method further includes: Obtain target entities and target entity relationships in the target software supply chain; A target software supply chain graph corresponding to the target software supply chain is constructed based on the target entities and the target entity relationships.

[0011] In a possible implementation, the step of obtaining the target entity and the target entity relationship in the target software supply chain includes: Scan the target software supply chain to obtain target scanning results; the target scanning results include target component scanning results and target vulnerability scanning results; Extracting the target component entity from the component scanning result, and extracting the target vulnerability entity from the vulnerability scanning result; A dependency relationship between the target component entities is constructed based on the component scanning results, and a hit relationship between the target component entity and the target vulnerability entity is constructed based on the vulnerability scanning results.

[0012] In a possible implementation, the target entity further includes a target license entity in the target software supply chain, and the target entity relationship further includes a license relationship between the target component entity and the target license entity; After scanning the target software supply chain and obtaining the target scanning result, the method further includes: Extract the target license entity from the component scanning result; A license relationship between the target component entity and the target license entity is established according to the component scanning result.

[0013] In a possible implementation, after obtaining the target entity and the target entity relationship in the target software supply chain, the method further includes: The target index information corresponding to the target software supply chain graph is generated according to the target entity and the target entity relationship.

[0014] In a second aspect, an embodiment of the present application provides a question-answering device, the question-answering device comprising: The first acquisition module is used to acquire target problem information; A determination module, used to determine target retrieval information according to the target question information; A retrieval module is used to search in a target software supply chain graph according to the target retrieval information to obtain a target retrieval result; the target software supply chain graph is used to characterize target entities and target entity relationships in the target software supply chain; the target entities include target component entities and target vulnerability entities in the target software supply chain, and the target entity relationships include dependency relationships between the target component entities and hit relationships between the target component entities and the target vulnerability entities; The answer generation module is used to input the above-mentioned target question information and the above-mentioned target retrieval results into the target macro model, and output the target answer information corresponding to the above-mentioned target question information based on the above-mentioned target retrieval results.

[0015] In a third aspect, an embodiment of the present application provides an electronic device, including: a processor and a memory; The processor is connected to the memory; The above-mentioned memory is used to store executable program code; The processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method provided by the first aspect of the embodiment of this specification or any possible implementation of the first aspect.

[0016] In a fourth aspect, an embodiment of the present specification provides a computer storage medium, wherein the computer storage medium stores a plurality of instructions, wherein the instructions are suitable for being loaded by a processor and executing the method provided by the first aspect of the embodiment of the present specification or any possible implementation of the first aspect.

[0017] In one or more embodiments of the present application, according to the target search information corresponding to the target question information, the target software supply chain map is searched, and the target search results retrieved are used as knowledge support to answer the target question information, and the corresponding target answer is generated, so that the software supply chain related questions can be queried and answered through natural language, which is convenient for users to understand and master the component information and vulnerability information used in the software, and ensure the security of the software supply chain. At the same time, the target question information and the target search results are input into the target large model, and other information in the target software supply chain that is not related to the target question information interferes with the target large model, so that the target large model can use the target search results corresponding to the target question information as knowledge support, and more efficiently and accurately output the target answer information corresponding to the target question information, avoiding the waste of computing resources of the target large model.

[0018] The above description is only an overview of the technical solution of the present application. In order to more clearly understand the technical means of the present application, it can be implemented in accordance with the contents of the specification. In order to make the above and other purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are listed below. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0020] Figure 1 A schematic diagram of the architecture of a question-answering system provided for an exemplary embodiment of the present application; Figure 2 A flowchart of a question-answering method provided for an exemplary embodiment of the present application; Figure 3 A schematic diagram of an implementation process of a question-answering method provided by an exemplary embodiment of the present application; Figure 4 A schematic diagram of a target software supply chain map provided for an exemplary embodiment of the present application; Figure 5 A schematic diagram of a target retrieval sub-graph provided for an exemplary embodiment of the present application; Figure 6 A flowchart of a method for constructing a software supply chain graph provided by an exemplary embodiment of the present application; Figure 7 A schematic diagram of the implementation process of a method for constructing a software supply chain graph provided by an exemplary embodiment of the present application; Figure 8 A schematic diagram of the structure of a question-answering device provided by an exemplary embodiment of the present application; Fig. 9 A schematic diagram of the structure of a software supply chain graph construction device provided by an exemplary embodiment of the present application; Fig.10 A schematic diagram of the structure of an electronic device provided as an exemplary embodiment of the present application. DETAILED DESCRIPTION

[0021] In order to make the features and advantages of the present application more obvious and easy to understand, the technical solutions in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present application.

[0022] The terms "first", "second", "third", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish different objects, rather than to describe a specific order. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions. For example, a process, method, system, product or device that includes a series of steps or units is not limited to the listed steps or units, but optionally includes steps or units that are not listed, or optionally includes other steps or units inherent to these processes, methods, products or devices.

[0023] Please refer to the following Figure 1 , which is a schematic diagram of the architecture of a question-answering system provided by an exemplary embodiment of this specification. Figure 1 As shown, the question-answering system may include: a terminal 110 and a server 120. Among them: The terminal 110 can interact with the server 120 through the network to receive messages from the server 120 or send messages to the server 120. The terminal 110 can be hardware or software. When the terminal 120 is hardware, it can be various electronic devices, including but not limited to smart watches, smart phones, tablet computers, laptop portable computers and desktop computers. When the terminal 110 is software, it can be installed in the electronic devices listed above, which can be implemented as multiple software or software modules (for example: used to provide distributed services), or it can be implemented as a single software or software module, which is not specifically limited here.

[0024] In the embodiment of the present specification, the terminal 110 may be a user terminal corresponding to a user who needs to ask questions, such as a software developer. When a user wants to ask questions or search for a target software supply chain or wants to understand and master the components and vulnerability information in a target software supply chain, the corresponding target question information may be entered into the question-answering software on the terminal 110, but is not limited to, such as but not limited to the target question text related to the software supply chain. After obtaining the target question information, the terminal 110 may first determine the target search information according to the target question information; then, according to the target search information, search in the target software supply chain graph to obtain the target search result; the target software supply chain graph is used to characterize the target entity and the target entity relationship in the target software supply chain; the target entity includes the target component entity and the target vulnerability entity in the target software supply chain, and the target entity relationship includes the dependency relationship between the target component entities and the hit relationship between the target component entity and the target vulnerability entity; finally, the target answer information corresponding to the target question information is generated according to the target search result.

[0025] Optionally, after the terminal 110 receives the target question information input by the user, it can also directly send the above target question information to the server 120 through the network, so that the server 120 generates and returns the target answer information corresponding to the target question information according to the question and answer method provided in the embodiment of the present application.

[0026] The server 120 may be a server that provides various question-and-answer services or software supply chain map building services. It should be noted that the server 120 may be hardware or software. When the server 120 is hardware, it may be implemented as a distributed server cluster consisting of multiple servers, or it may be implemented as a single server. When the server 120 is software, it may be implemented as multiple software or software modules (for example, used to provide distributed services), or it may be implemented as a single software or software module, which is not specifically limited here. The server 120 may be, but is not limited to, a hardware server, a virtual server, a cloud server, etc.

[0027] Specifically, after receiving the target question information sent by the terminal 110 , the server 120 may also perform corresponding question answering through the question answering method provided in the embodiment of the present application and return the generated corresponding target answer information to the terminal 110 .

[0028] It can be understood that the question-and-answer method and software supply chain graph construction method provided in the embodiments of the present application can be executed by the terminal 110 alone, by the server 120 alone, or by the terminal 110 and the server 120 together, and the embodiments of the present application are not limited to this.

[0029] The network may be a medium providing a communication link between the terminal 110 and the server 120, or may be the Internet including network devices and transmission media, but is not limited thereto. The transmission media may be a wired link, such as but not limited to coaxial cable, optical fiber, and digital subscriber line (DSL), or a wireless link, such as but not limited to wireless fidelity (WIFI), Hypertext Transfer Protocol (HTTP), Bluetooth, and mobile device network, etc.

[0030] Understandably, Figure 1 The number of terminals 110 and servers 120 in the question-answering system shown is only an example. In a specific implementation, the question-answering system may include any number of terminals 110 and servers 120.

[0031] Next, combine Figure 1, taking the question answering performed by the server 120 as an example, the question answering method provided by an exemplary embodiment of the present application is introduced. Figure 2 , which exemplarily shows a flow chart of a question-answering method provided in an embodiment of the present application. Figure 2 As shown, the question-answering method includes the following steps: S201, obtaining target question information.

[0032] Specifically, the target question information may include, but is not limited to, user question information input by the user for the target code repository, and the user question information may include, but is not limited to, at least one of the following types of questions: dependency questions, vulnerability questions, and license questions; the dependency questions are used to characterize problems related to component dependencies in the software supply chain, such as, but not limited to, "which components depend on component a", "which components does component a depend on", etc.; the vulnerability questions are used to characterize problems related to the vulnerability hits of components in the software supply chain, such as, but not limited to, "does component a have vulnerabilities", "if component a has vulnerabilities, please describe its vulnerabilities in detail and give repair suggestions", etc.; the license questions are used to characterize problems related to the license status of components in the software supply chain, such as, but not limited to, "what is the license of component a", "which components have license X", etc. The user question information may include, but is not limited to, the target question text related to the target software supply chain input by the user, and the target question text may be in Chinese or English, which is not limited in the embodiments of the present application.

[0033] In some possible embodiments, when the user understands and grasps the component status or vulnerability information in the target software supply chain, the server 120 can obtain the user question information input by the user and sent by the terminal 110 through the network. In order to ensure the accuracy and comprehensiveness of the question and answer, and improve the adaptability and generalization ability of the question and answer, such as Figure 3 As shown, after obtaining the user question information, the user question information may be preprocessed, but not limited to, to obtain the target question information. The preprocessing may include, but not limited to, translation processing and / or similarity expansion processing. The target question information may include, but not limited to, at least one of the following: the target question corresponding to the user question information (i.e., the question input by the user), the translation question (i.e., the question obtained after translating the question input by the user), and at least one similar question (i.e., the question obtained after similarity expansion processing of the question input by the user), etc.

[0034] Optionally, in order to ensure the accuracy and efficiency of subsequent retrieval of the target software supply chain graph, when the language used in the user's question information is inconsistent with the language used in the target software supply chain graph, it is possible but not limited to first translating the target question corresponding to the user's question information into the same language as the target software supply chain graph, and then generating subsequent target retrieval statements and extracting target retrieval entities based on the translated question corresponding to the user's question information, thereby enhancing the questions before answering user questions about the software supply chain, so as to ensure that the user's questions about the target software supply chain can be better answered later.

[0035] Optionally, since there are certain limitations in the user's description and expression of the question, in order to avoid the problem that the limitations of the user's question lead to deviations in the question and answer or the answer is not accurate and comprehensive enough, after obtaining the user's question information, similarity expansion processing can also be performed on the user's question information, for example, but not limited to inputting the target question in the user's question information into a similar language model, and outputting at least one corresponding similar question, the above-mentioned similar language model is trained based on multiple question information corresponding to known similar question information, or, first, the target question in the user's question information is segmented, and then the similar words corresponding to each segmentation of the target question are reorganized to obtain at least one similar question whose similarity to the target question is greater than a preset value, etc., thereby improving the comprehensiveness and accuracy of the knowledge related to the user's question information subsequently obtained according to the target question information, and providing more comprehensive, accurate and powerful knowledge support for the subsequent answering of the user's question information.

[0036] Optionally, the implementation process of preprocessing the user question information to obtain the target question information may include, but is not limited to: inputting the user question information and the question preprocessing prompt words into the target large model, and outputting the target question information; wherein the question preprocessing prompt words may include, but are not limited to, task description information corresponding to the question preprocessing task that the target large model needs to perform for the user question information; the question preprocessing task may include, but is not limited to, translation tasks and / or similar expansion tasks, etc. The target large model may be, but is not limited to, a large language model (LLM) that has been pre-trained and fine-tuned to perform the question preprocessing task.

[0037] Please continue to refer to Figure 2 ,like Figure 2 As shown, in the above S201, after obtaining the target question information, the question-answering method further includes: S202: Determine target retrieval information according to the target question information.

[0038] Specifically, the above-mentioned target retrieval information may include but is not limited to at least one of the following: target retrieval statements, target retrieval entities. The above-mentioned target retrieval statements may be but are not limited to Cypher statements, which are used for declarative queries of the graph database (target software supply chain graph), and can extract, modify or manage data in the graph database (target software supply chain graph) by matching nodes (target entities) and relationships (target entity relationships) in the pattern graph (target software supply chain graph). The above-mentioned target retrieval entity may be but is not limited to the target keyword or target entity in the target question information, etc., and the embodiments of the present application do not limit this.

[0039] Alternatively, if Figure 3 As shown, after obtaining the target question information, the corresponding target search statement can be generated directly according to the target question information, but not limited to, for example, the search statement elements such as the target, screening conditions and expected result set corresponding to the target question information can be determined first, and then these search statement elements can be combined according to the preset search statement structure to generate the corresponding target search statement, or the target question information can be directly input into the target large model and the target search statement can be output to meet different data query and operation requirements. The above-mentioned target large model can be, but not limited to, a large language model that has been pre-trained and fine-tuned to perform the search statement generation task.

[0040] Alternatively, if Figure 3 As shown, after obtaining the target question information, the target retrieval entity can also be directly extracted from the target question information, but is not limited to, for example, the target retrieval entity can be directly extracted from the target question information using an entity extraction model or a keyword extraction model, or the target question information can be directly input into a target large model to output the target retrieval entity. The above target large model can be, but is not limited to, a large language model that has been pre-trained and fine-tuned to perform retrieval entity extraction tasks.

[0041] It can be understood that the number of target search statements generated and the number of target search entities extracted can be one or more, and the embodiments of the present application do not limit this. After obtaining the target question information, the target search statement can be generated only based on the target question information, or the target search entity can be extracted only from the target question information, or the target search statement can be generated based on the target question information and the target search entity can be extracted from the target question information. The specific setting can be based on the actual question and answer requirements, and the embodiments of the present application do not limit this.

[0042] In an embodiment of the present application, after obtaining the target question information, a corresponding target search statement can be directly generated based on the target question information, so that the target search statement can be used to accurately query the results corresponding to the target question information in the target software supply chain graph, thereby realizing a refined search of the target software supply chain graph, thereby improving the efficiency and accuracy of subsequently generating target answer information based on the target search results; and / or, after obtaining the target question information, the target search entity can also be directly extracted from the target question information, so that all information related to the target question information can be retrieved in the target software supply chain graph through the target search entity, thereby realizing a relevance search of the target software supply chain graph, thereby improving the integrity and comprehensiveness of subsequently generating target answer information based on the target search results.

[0043] S203, searching in the target software supply chain graph according to the target search information to obtain the target search result. The target software supply chain graph is used to characterize the target entities and target entity relationships in the target software supply chain.

[0044] Specifically, the target entity may include, but is not limited to, a target component entity and a target vulnerability entity in the target software supply chain, and the target entity relationship may include, but is not limited to, a dependency relationship between target component entities and a hit relationship between target component entities and target vulnerability entities. The target component entity may be the name of the target component in the target software supply chain. The target component is a basic building block in the target software supply chain, which may be, but is not limited to, a code library, a library file, a module, a framework, a middleware, a service, an application program interface (API), etc., and can play a role in the development, integration, testing, deployment and maintenance of the target software. The target vulnerability entity is a security defect or weakness existing in the target component in the target software supply chain, which may be exploited by attackers, thereby posing a threat to the confidentiality, integrity, availability or access control of the target software system. The dependency relationship is used to characterize that the target component corresponding to the target component entity in the target software supply chain needs to rely on the capabilities or data of other target components when performing its functions or providing services. The hit relationship is used to characterize that the target component corresponding to the target component entity in the target software supply chain has a target vulnerability corresponding to the target vulnerability entity.

[0045] Optionally, the target entity may also include, but is not limited to, a target license entity in a target software supply chain, and the target entity relationship may also include, but is not limited to, a license relationship between a target component entity and a target license entity. The target license entity is the name of a target license corresponding to a target component in a target software supply chain, and a target license is a legally binding contract between a copyright holder of a target component and a user, which specifies the conditions under which the target component may be used, modified, and distributed. The license relationship is used to characterize that the license of a target component corresponding to a target component in a target software supply chain is a target license corresponding to a target license entity.

[0046] In an embodiment of the present application, the target software supply chain map not only includes the target component entities and target vulnerability entities in the target software supply chain, the dependency relationship between the target component entities, and the hit relationship between the target component entities and the target vulnerability entities, but also includes the target license entities in the target software supply chain and the license relationship between the target component entity and the target license entity. Through a more detailed and comprehensive target software supply chain map, users can understand and grasp the information in the target software supply chain more conveniently, comprehensively and accurately through question and answer.

[0047] For example, Figure 4 As shown, the target software supply chain graph consists of target component entities (e.g. Figure 4 componenta, componentb, componentc, componentd, componente, componentf, componentg, componenth), target license entity (e.g. Figure 4 License A, License B, License C, License D), target vulnerability entity (e.g. Figure 4 Vulnerability Y, Vulnerability Z shown), dependencies between target component entities (e.g. Figure 4 As shown in the figure, component a depends on component b, component b depends on component c, component c depends on component d, component a depends on component e, etc.), the hit relationship between the target component entity and the target vulnerability entity (for example Figure 4 Component a hits vulnerability Y, component c hits vulnerability Z) and the license relationship between the target component entity and the target license entity (e.g. Figure 4 The license of component a shown in the figure is license A, the license of component c is license B, etc. Each node (target entity) of the target software supply chain graph may store, but is not limited to, type information, attribute information, version information, etc. of the corresponding target entity.

[0048] Optionally, the target search information may include but is not limited to at least one of the following: a target search statement, a target search entity. Figure 3As shown, after generating the target search statement, it is possible but not limited to search in the target software supply chain graph according to the target search statement to obtain the target statement search result; the above target statement search result may include but is not limited to the target result information corresponding to the target search statement obtained from the target software supply chain graph; and / or, according to the target search entity, search is performed in the target software supply chain graph to obtain the target entity search result. The above target result information may include but is not limited to at least one of the following: the target entity corresponding to the target search statement, the target entity relationship, the target result statement (such as but not limited to the vulnerability description statement, the vulnerability repair suggestion statement, etc.). The above target entity search result may include but is not limited to information related to the target search entity in the target software supply chain graph, such as but not limited to the target entity or target entity relationship related to the target search entity.

[0049] Further, the above-mentioned implementation process of searching in the target software supply chain graph according to the target search entity and obtaining the target entity search result may include, but is not limited to: searching in the target software supply chain graph according to the target search entity to obtain the target search subgraph corresponding to the target search entity, and then determining the target entity search result according to the target search subgraph, for example, but not limited to directly determining the target search subgraph as the target entity search result or extracting each target entity and each target entity relationship in the target search subgraph, and determining these target entities and target entity relationships as the target entity search result. The above-mentioned target search subgraph is used to characterize the target-related entities and target-related entity relationships in the target software supply chain graph, and the above-mentioned target-related entities include the specified target entity corresponding to the target search entity in the target software supply chain graph, and the target entity whose relationship path length with the specified target entity is within a preset length range. The above-mentioned preset length range may be, but is not limited to, any range within one hop, two hops, three hops, etc., and may also be any length range input by the user, that is, when the user inputs the target question information, he may also input the search requirement information of the corresponding length range of its corresponding relationship path, which is not limited in the embodiment of the present application.

[0050] For example, if the target retrieval entity is: component b, license, then in Figure 4 By searching the target software supply chain graph shown in the figure, we can get the corresponding entity of the target search (component b, license) Figure 5 The target retrieval sub-graph shown in Figure 5As shown, the target retrieval subgraph includes the designated target entity (component b) and the target entity whose relationship path length with the designated target entity (component b) is within two hops. That is, the target retrieval result retrieved through the above target retrieval entity may include target-related entities whose relevance to the designated target entity corresponding to the target retrieval entity is within two hops and related information such as the target-related entity relationship.

[0051] S204, input the target question information and the target search results into the target macro model, and output the target answer information corresponding to the target question information based on the target search results.

[0052] Specifically, after retrieving the target retrieval results, the target retrieval results and the target question information may be directly input into the target large model or the target question-answering model, and the corresponding target answer information may be output, but is not limited to. The target question-answering model may be trained based on multiple question information with known answer information, but is not limited to it. The target large model may be obtained by fine-tuning the pre-trained initial large model based on the question-answering analysis prompt words, but is not limited to being a large language model capable of performing question-answering tasks. The question-answering analysis prompt words may include, but are not limited to, descriptive information corresponding to the question-answering tasks that the target large model needs to perform for the target question information and the target retrieval results.

[0053] In the embodiment of the present application, according to the target search information corresponding to the target question information, the target software supply chain map is searched, and the target search results retrieved are used as knowledge support to answer the target question information, and the corresponding target answer is generated, so that the software supply chain related questions can be queried and answered through natural language, which is convenient for users to understand and master the component information and vulnerability information used in the software, and ensure the security of the software supply chain. At the same time, the target question information and the target search results are input into the target large model, and other information in the target software supply chain that is not related to the target question information interferes with the target large model, so that the target large model can use the target search results corresponding to the target question information as knowledge support, and more efficiently and accurately output the target answer information corresponding to the target question information, avoiding the waste of computing resources of the target large model.

[0054] In some possible embodiments, after generating the target answer information corresponding to the target question information according to the target search results, the target answer information and / or target question information can also be used as historical question and answer information, and natural language processing technology can be used to generate target question recommendation information based on the historical question and answer information and the corresponding target search results, that is, to identify potential knowledge gaps or aspects that the user may be interested in, and finally generate a series of question recommendations closely related to the target question information or the target software supply chain. In addition to the target answer information and target question information, the historical question and answer information may also include other historical question information of the user corresponding to the target question information and other corresponding historical answer information, which is not limited in the embodiments of the present application.

[0055] Optionally, the historical question and answer information, the corresponding target search results, and the question recommendation prompt words can also be directly input into the target macro model to output the target question recommendation information. The question recommendation prompt words can include, but are not limited to, description information corresponding to the question recommendation task that the target macro model needs to perform for the historical question and answer information and the corresponding target search results.

[0056] In an embodiment of the present application, after obtaining the target answer information corresponding to the target question information, corresponding target question recommendation information can also be generated based on the historical question and answer information and the corresponding target retrieval results, so as to realize the recommendation of subsequent questions after the question and answer, and recommend questions that the user may need to ask or questions that he is interested in, thereby improving the reliability and ease of use of the question and answer, reducing the professional requirements of the questioner, making the question and answer more practical and adaptable, and improving the question and answer experience of users such as developers who need to conduct question and answer.

[0057] Next, combine Figure 1 , taking the server 120 executing the software supply chain graph construction as an example, the software supply chain graph construction method provided by an exemplary embodiment of the present application is introduced. For details, please refer to Figure 6 , which exemplarily shows a flowchart of a method for constructing a software supply chain graph provided in an embodiment of the present application. Figure 6 As shown in the figure, the software supply chain graph construction method includes the following steps: S601, obtaining target entities and target entity relationships in the target software supply chain, wherein the target entities include target component entities and target vulnerability entities in the target software supply chain, and the target entity relationships include dependency relationships between target component entities and hit relationships between target component entities and target vulnerability entities.

[0058] Specifically, Figure 7As shown, when the user wants to build a target software supply chain graph corresponding to the target software supply chain, the user can, but is not limited to, send a corresponding graph construction instruction to the server through the terminal. After the server receives the graph construction instruction, it can generate a corresponding target software supply chain scanning command (such as but not limited to an SCA command) according to the graph construction instruction, and respond to the target software supply chain scanning command to scan the target software supply chain, such as but not limited to scanning files and images in the target software supply chain to obtain a target scanning result; the above-mentioned target scanning result includes a target component scanning result and a target vulnerability scanning result. Then, the target component entity is extracted from the component scanning result, and the target vulnerability entity is extracted from the vulnerability scanning result, and the dependency relationship between the target component entities is constructed according to the component scanning result, and the hit relationship between the target component entity and the target vulnerability entity is constructed according to the vulnerability scanning result.

[0059] Optionally, the target entity may also include, but is not limited to, a target license entity in the target software supply chain, and the target entity relationship may also include, but is not limited to, a license relationship between a target component entity and a target license entity. Figure 7 As shown, the target license entity can also be extracted from the component scanning result, and a license relationship between the target component entity and the target license entity can be constructed according to the component scanning result.

[0060] The above component description results may include, but are not limited to, the target components in the scanned target software supply chain and component information corresponding to each target component, such as, but not limited to, component attributes, component versions, component types, and licenses corresponding to components. The above target vulnerability scanning results may include, but are not limited to, vulnerability information corresponding to target vulnerabilities in the scanned target software supply chain, such as, but not limited to, vulnerability numbers, vulnerability attributes, target components that hit the target vulnerability, vulnerability types, and vulnerability impact ranges.

[0061] S602, constructing a target software supply chain graph corresponding to the target software supply chain according to the target entity and the target entity relationship.

[0062] Specifically, a target software supply chain graph corresponding to the target software supply chain can be constructed based on target entities and target entity relationships using a graph modeling tool (such as but not limited to NetworkX) or a graph processing framework (such as but not limited to Apache Jena).

[0063] In some possible embodiments, since the target software supply chain graph contains a large number of data points and connections, directly querying (retrieval) on the target software supply chain graph may be very time-consuming and complicated. In order to improve the retrieval performance of the target software supply chain graph, it is also possible but not limited to generating target index information corresponding to the target software supply chain graph based on the target entities and target entity relationships (for example but not limited to generating target index items corresponding to each target entity and its target entity relationship based on the index structure, etc.), and associating the target index information with its corresponding target software supply chain graph structure in the database, thereby improving the efficiency of retrieval in the target software supply chain graph.

[0064] Please refer to the following Figure 8 , which is a schematic diagram of the structure of a question-answering device provided by an exemplary embodiment of the present application. Figure 8 As shown, the question-answering device 800 includes: A first acquisition module 810 is used to acquire target question information; A determination module 820 is used to determine target retrieval information according to the target question information; The retrieval module 830 is used to search in the target software supply chain graph according to the target retrieval information to obtain the target retrieval result; the target software supply chain graph is used to characterize the target entities and target entity relationships in the target software supply chain; the target entities include the target component entities and target vulnerability entities in the target software supply chain, and the target entity relationships include the dependency relationships between the target component entities and the hit relationships between the target component entities and the target vulnerability entities; The answer generation module 840 is used to generate target answer information corresponding to the target question information according to the target search result.

[0065] In a possible implementation, the target search information includes at least one of the following: a target search statement, a target search entity; The determination module 820 is specifically used to: generate the target search sentence according to the target question information; and / or extract the target search entity from the target question information.

[0066] In a possible implementation, the target search information includes at least one of the following: a target search statement and a target search entity; and the search module 830 is specifically used to: According to the above-mentioned target search statement, a search is performed in the target software supply chain graph to obtain a target statement search result; the above-mentioned target statement search result includes the target result information corresponding to the above-mentioned target search statement obtained from the above-mentioned target software supply chain graph; and / or, according to the above-mentioned target search entity, a search is performed in the above-mentioned target software supply chain graph to obtain a target entity search result; the above-mentioned target entity search result includes information related to the above-mentioned target search entity in the above-mentioned target software supply chain graph.

[0067] In a possible implementation, the retrieval module 830 is specifically used to: According to the above-mentioned target retrieval entity, a search is performed in the above-mentioned target software supply chain graph to obtain a target retrieval sub-graph corresponding to the above-mentioned target retrieval entity; the above-mentioned target retrieval sub-graph is used to characterize the target-related entities and target-related entity relationships in the above-mentioned target software supply chain graph; the above-mentioned target-related entities include the specified target entity corresponding to the above-mentioned target retrieval entity in the above-mentioned target software supply chain graph, and the target entity whose relationship path length with the above-mentioned specified target entity is within a preset length range; the target entity retrieval result is determined according to the above-mentioned target retrieval sub-graph.

[0068] In a possible implementation manner, the target entity further includes a target license entity in the target software supply chain, and the target entity relationship further includes a license relationship between the target component entity and the target license entity.

[0069] In a possible implementation, the answer generation module 840 is specifically used to: The target question information and the target search results are input into the target macro model, and the target answer information corresponding to the target question information is output based on the target search results.

[0070] In a possible implementation, the first acquisition module 810 is specifically configured to: Obtain user question information; pre-process the user question information to obtain target question information; the pre-processing includes translation processing and / or similarity expansion processing; the target question information includes the target question, translation question and at least one similar question corresponding to the user question information.

[0071] In a possible implementation, the question-answering device 800 further includes: The question recommendation module is used to generate target question recommendation information based on the historical question and answer information and the above target search results; the above historical question and answer information includes the above target answer information and / or the above target question information.

[0072] Please refer to the following Fig. 9 , which is a schematic diagram of a software supply chain graph construction device provided by an exemplary embodiment of the present application. Fig. 9 As shown, the software supply chain graph construction device 900 includes: The second acquisition module 910 is used to acquire target entities and target entity relationships in the target software supply chain; the target entities include target component entities and target vulnerability entities in the target software supply chain, and the target entity relationships include dependency relationships between the target component entities and hit relationships between the target component entities and the target vulnerability entities; The construction module 920 is used to construct a target software supply chain graph corresponding to the target software supply chain according to the target entity and the target entity relationship.

[0073] In a possible implementation, the second acquisition module 910 is specifically configured to: Scan the target software supply chain to obtain target scanning results; the target scanning results include target component scanning results and target vulnerability scanning results; extract the target component entity from the component scanning results, and extract the target vulnerability entity from the vulnerability scanning results; construct the dependency relationship between the target component entities according to the component scanning results, and construct the hit relationship between the target component entity and the target vulnerability entity according to the vulnerability scanning results.

[0074] In a possible implementation, the target entity further includes a target license entity in the target software supply chain, and the target entity relationship further includes a license relationship between the target component entity and the target license entity; The software supply chain graph construction device 900 further includes: An extraction module, used for extracting the target license entity from the component scanning result; The relationship building module is used to build a license relationship between the target component entity and the target license entity according to the component scanning result.

[0075] In a possible implementation, the software supply chain graph construction device 900 further includes: An index generation module is used to generate target index information corresponding to the target software supply chain graph based on the target entity and the target entity relationship.

[0076] The division of each module in the above-mentioned question-and-answer device and the software supply chain map construction device is only for illustration. In other embodiments, the question-and-answer device and the software supply chain map construction device can be divided into different modules as needed to complete all or part of the functions of the above-mentioned question-and-answer device and the software supply chain map construction device. The implementation of each module in the question-and-answer device and the software supply chain map construction device provided in the embodiments of this specification can be in the form of a computer program. The computer program can be run on a terminal or a server. The program modules constituted by the computer program can be stored in the memory of a terminal or a server. When the computer program is executed by the processor, all or part of the steps of the question-and-answer method and the software supply chain map construction method described in the embodiments of this specification are implemented.

[0077] See next Fig.10 , which is a schematic diagram of the structure of an electronic device provided by an exemplary embodiment of this specification. Fig.10 As shown, the electronic device 1000 may include: at least one processor 1010 , at least one communication bus 1020 , a user interface 1030 , at least one network interface 1040 , and a memory 1050 .

[0078] The communication bus 1020 may be used to realize the connection and communication among the above-mentioned components.

[0079] The user interface 1030 may include a display screen (Display) and a camera (Camera), and the optional user interface 1030 may also include a standard wired interface and a wireless interface.

[0080] The network interface 1040 may optionally include a Bluetooth module, a Near Field Communication (NFC) module, a Wireless Fidelity (Wi-Fi) module, and the like.

[0081] Among them, the processor 1010 may include one or more processing cores. The processor 1010 uses various interfaces and lines to connect various parts of the entire electronic device 1000, and executes various functions and processes data of the routing electronic device 1000 by running or executing instructions, programs, code sets or instruction sets stored in the memory 1050, and calling data stored in the memory 1050. Optionally, the processor 1010 can be implemented in at least one hardware form of digital signal processing (Digital Signal Processing, DSP), field programmable gate array (Field-Programmable Gate Array, FPGA), and programmable logic array (Programmable Logic Array, PLA). The processor 1010 can integrate one or a combination of a processor (Central Processing Unit, CPU), a graphics processor (Graphics Processing Unit, GPU) and a modem. Among them, the CPU mainly processes the operating system, user interface and application programs; the GPU is responsible for rendering and drawing the content to be displayed on the display screen; the modem is used to process wireless communications. It can be understood that the above-mentioned modem may not be integrated into the processor 1010, but implemented separately through a chip.

[0082] Among them, the memory 1050 may include a random access memory (Random Access Memory, RAM) and may also include a read-only memory (Read-Only Memory, ROM). Optionally, the memory 1050 includes a non-transitory computer-readable medium. The memory 1050 can be used to store instructions, programs, codes, code sets or instruction sets. The memory 1050 may include a program storage area and a data storage area, wherein the program storage area may store instructions for implementing an operating system, instructions for at least one function (such as an acquisition function, a software supply chain map building function, a question and answer function, etc.), instructions for implementing the above-mentioned various method embodiments, etc.; the data storage area may store data involved in the above-mentioned various method embodiments, etc. The memory 1050 may also be optionally at least one storage device located away from the aforementioned processor 1010. As Fig.10 As shown, the memory 1050 as a computer storage medium may include an operating system, a network communication module, a user interface module, and program instructions.

[0083] In some possible embodiments, the electronic device 1000 may be the aforementioned Figure 8In the question and answer device 800 shown, the processor 1010 can be used to call the program instructions stored in the memory 1050, and specifically perform the following operations: obtain target question information; determine target retrieval information based on the above target question information; search in the target software supply chain graph based on the above target retrieval information to obtain target retrieval results; the above target software supply chain graph is used to characterize the target entities and target entity relationships in the target software supply chain; the above target entities include target component entities and target vulnerability entities in the above target software supply chain, and the above target entity relationships include the dependency relationships between the above target component entities and the hit relationships between the above target component entities and the above target vulnerability entities; generate target answer information corresponding to the above target question information based on the above target retrieval results.

[0084] In some possible embodiments, the target retrieval information includes at least one of the following: a target retrieval statement, a target retrieval entity; when the processor 1010 executes the above-mentioned determination of the target retrieval information according to the target question information, it is specifically used to execute: generating the target retrieval statement according to the target question information; and / or extracting the target retrieval entity from the target question information.

[0085] In some possible embodiments, the target search information includes at least one of the following: a target search statement, a target search entity; when the processor 1010 performs the search in the target software supply chain graph according to the target search information and obtains the target search result, it is specifically used to execute: According to the above-mentioned target search statement, a search is performed in the target software supply chain graph to obtain a target statement search result; the above-mentioned target statement search result includes the target result information corresponding to the above-mentioned target search statement obtained from the above-mentioned target software supply chain graph; and / or, according to the above-mentioned target search entity, a search is performed in the above-mentioned target software supply chain graph to obtain a target entity search result; the above-mentioned target entity search result includes information related to the above-mentioned target search entity in the above-mentioned target software supply chain graph.

[0086] In some possible embodiments, when the processor 1010 executes the above-mentioned search in the target software supply chain graph according to the target retrieval entity and obtains the target entity retrieval result, it is specifically used to execute: according to the target retrieval entity, search in the target software supply chain graph to obtain a target retrieval sub-graph corresponding to the target retrieval entity; the target retrieval sub-graph is used to characterize the target-related entities and the target-related entity relationships in the target software supply chain graph; the target-related entities include the specified target entity corresponding to the target retrieval entity in the target software supply chain graph, and the target entity whose relationship path length with the specified target entity is within a preset length range; the target entity retrieval result is determined according to the target retrieval sub-graph.

[0087] In some possible embodiments, the target entity further includes a target license entity in the target software supply chain, and the target entity relationship further includes a license relationship between the target component entity and the target license entity.

[0088] In some possible embodiments, when the processor 1010 executes the above-mentioned generation of the target answer information corresponding to the above-mentioned target question information according to the above-mentioned target search result, it is specifically used to execute: The target question information and the target search results are input into the target macro model, and the target answer information corresponding to the target question information is output based on the target search results.

[0089] In some possible embodiments, when the processor 1010 executes the above-mentioned acquisition of target question information, it is specifically used to execute: Obtain user question information; pre-process the user question information to obtain target question information; the pre-processing includes translation processing and / or similarity expansion processing; the target question information includes the target question, translation question and at least one similar question corresponding to the user question information.

[0090] In some possible embodiments, after the processor 1010 generates the target answer information corresponding to the target question information according to the target search result, it is further configured to execute: Generate target question recommendation information based on the historical question and answer information and the above target search results; the above historical question and answer information includes the above target answer information and / or the above target question information.

[0091] In some possible embodiments, the electronic device 1000 may be the aforementioned Fig. 9In the software supply chain graph construction device 900 shown, the processor 1010 can be used to call the program instructions stored in the memory 1050, and specifically perform the following operations: obtain the target entities and target entity relationships in the target software supply chain; the above-mentioned target entities include the target component entities and target vulnerability entities in the above-mentioned target software supply chain, and the above-mentioned target entity relationships include the dependency relationships between the above-mentioned target component entities and the hit relationships between the above-mentioned target component entities and the above-mentioned target vulnerability entities; construct a target software supply chain graph corresponding to the above-mentioned target software supply chain according to the above-mentioned target entities and the above-mentioned target entity relationships.

[0092] In some possible embodiments, when the processor 1010 executes the acquisition of the target entity and the target entity relationship in the target software supply chain, it is specifically configured to execute: Scan the target software supply chain to obtain target scanning results; the target scanning results include target component scanning results and target vulnerability scanning results; extract the target component entity from the component scanning results, and extract the target vulnerability entity from the vulnerability scanning results; construct the dependency relationship between the target component entities according to the component scanning results, and construct the hit relationship between the target component entity and the target vulnerability entity according to the vulnerability scanning results.

[0093] In some possible embodiments, the target entity also includes a target license entity in the target software supply chain, and the target entity relationship also includes a license relationship between the target component entity and the target license entity; after the processor 1010 performs the above-mentioned scanning of the target software supply chain and obtains the target scanning result, it is also used to execute: extracting the target license entity from the component scanning result; and constructing a license relationship between the target component entity and the target license entity according to the component scanning result.

[0094] In some possible embodiments, after executing the above-mentioned acquisition of the target entities and target entity relationships in the target software supply chain, the above-mentioned processor 1010 is also used to execute: generating target index information corresponding to the above-mentioned target software supply chain graph according to the above-mentioned target entities and the above-mentioned target entity relationships.

[0095] The embodiment of the present application also provides a computer storage medium, which stores instructions, and when the instructions are executed on a computer or a processor, the computer or the processor executes one or more steps in any of the above methods. If the components of the above question-answering device are implemented in the form of software functional units and sold or used as independent products, they can be stored in the above storage medium.

[0096] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented using software, it can be implemented in whole or in part in the form of a computer program product. The above computer program product includes one or more computer instructions. When the above computer program instructions are loaded and executed on a computer, the above process or function according to the embodiment of the present application is generated in whole or in part. The above computer may be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The above computer instructions may be stored in a computer-readable storage medium or transmitted through the above computer-readable storage medium. The above computer instructions may be transmitted from a website site, computer, server or data center to another website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) means. The above computer-readable storage medium may be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The above available medium may be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid state disk (SSD)), etc.

[0097] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. The aforementioned storage medium includes: ROM, RAM, magnetic disk or optical disk and other media that can store program codes. In the absence of conflict, the technical features in this embodiment and the implementation scheme can be combined arbitrarily.

[0098] The above-mentioned embodiments are merely preferred embodiments of the present application and are not intended to limit the scope of the present application. Without departing from the design spirit of the present application, various modifications and improvements made to the technical solutions of the present application by ordinary technicians in this field should fall within the protection scope determined by the claims of the present application.

Claims

1. A question-answering method, characterized in that: The method comprises: Get target problem information; Determine target retrieval information according to the target question information; According to the target search information, a search is performed in the target software supply chain graph to obtain a target search result; the target software supply chain graph is used to characterize the target entities and target entity relationships in the target software supply chain; the target entities include target component entities and target vulnerability entities in the target software supply chain, and the target entity relationships include dependency relationships between the target component entities and hit relationships between the target component entities and the target vulnerability entities; The target question information and the target search result are input into a target macro model, and the target answer information corresponding to the target question information is output based on the target search result.

2. The method according to claim 1, characterized in that The target search information includes at least one of the following: a target search statement, a target search entity; The step of determining target retrieval information according to the target question information includes: Generate the target search statement according to the target question information; and / or The target retrieval entity is extracted from the target question information.

3. The method according to claim 1, characterized in that The target search information includes at least one of the following: a target search statement, a target search entity; The step of searching the target software supply chain graph according to the target search information to obtain the target search results includes: According to the target search statement, a search is performed in the target software supply chain graph to obtain a target statement search result; the target statement search result includes target result information corresponding to the target search statement obtained from the target software supply chain graph; and / or According to the target retrieval entity, a search is performed in the target software supply chain graph to obtain a target entity retrieval result; the target entity retrieval result includes information related to the target retrieval entity in the target software supply chain graph.

4. The method according to claim 3, characterized in that The step of searching the target software supply chain graph according to the target search entity to obtain the target entity search result includes: According to the target retrieval entity, a search is performed in the target software supply chain graph to obtain a target retrieval subgraph corresponding to the target retrieval entity; the target retrieval subgraph is used to characterize target-related entities and target-related entity relationships in the target software supply chain graph; the target-related entities include a designated target entity corresponding to the target retrieval entity in the target software supply chain graph, and a target entity whose relationship path length with the designated target entity is within a preset length range; The target entity retrieval result is determined according to the target retrieval subgraph.

5. The method according to claim 1, characterized in that The method further comprises: Acquire target entities and target entity relationships in the target software supply chain; A target software supply chain graph corresponding to the target software supply chain is constructed according to the target entity and the target entity relationship.

6. The method according to claim 5, characterized in that The obtaining of the target entity and the target entity relationship in the target software supply chain includes: Scanning the target software supply chain to obtain target scanning results; the target scanning results include target component scanning results and target vulnerability scanning results; Extracting the target component entity from the component scanning result, and extracting the target vulnerability entity from the vulnerability scanning result; A dependency relationship between the target component entities is constructed according to the component scanning result, and a hit relationship between the target component entity and the target vulnerability entity is constructed according to the vulnerability scanning result.

7. The method according to claim 6, characterized in that The target entity also includes a target license entity in the target software supply chain, and the target entity relationship also includes a license relationship between the target component entity and the target license entity; After scanning the target software supply chain and obtaining the target scanning result, the method further includes: Extracting the target license entity from the component scanning result; A license relationship between the target component entity and the target license entity is established according to the component scanning result.

8. A question-answering device, characterized in that: The question-answering device comprises: The first acquisition module is used to acquire target problem information; A determination module, used to determine target retrieval information according to the target question information; A retrieval module, used to search in a target software supply chain graph according to the target retrieval information to obtain a target retrieval result; the target software supply chain graph is used to characterize target entities and target entity relationships in the target software supply chain; the target entities include target component entities and target vulnerability entities in the target software supply chain, and the target entity relationships include dependency relationships between the target component entities and hit relationships between the target component entities and the target vulnerability entities; The answer generation module is used to input the target question information and the target search result into the target macro model, and output the target answer information corresponding to the target question information based on the target search result.

9. An electronic device, characterized in that: include: processor and memory; wherein, The processor is connected to the memory; the memory is used to store executable program code; The processor runs a program corresponding to the executable program code by reading the executable program code stored in the memory, so as to execute the method steps according to any one of claims 1 to 7.

10. A computer storage medium, characterized in that: The computer storage medium stores a plurality of instructions, which are suitable for being loaded by a processor and executing the method steps according to any one of claims 1-7.

Images