SBOM Analyzer with NLP Query System

SBOM Analyzer retrieves and analyzes software bill of materials data by querying a knowledge graph built by Purdue University scholars. Users input a product name through a React interface, and the system returns structured information about dependencies and vulnerabilities in JSON format. The tool includes a chatbot that allows non-technical users to query the knowledge graph using natural language instead of SPARQL syntax. The system detects user intent and translates requests into queries, making vulnerability and dependency information accessible without requiring database expertise.

The team built a Flask API backend that routes requests to an SBOM service, which queries a SPARQL endpoint using SPARQLWrapper and Apache Jena to retrieve data from the knowledge graph. They implemented indexed filtering and pagination to manage large datasets, plus data harmonization scripts to align mismatched product and version data across sources. The React frontend handles user input and displays results dynamically using Axios. For the chatbot component, they integrated language models through Hugging Face and Langchain framework for intent detection, training a GPT-2 model on two query types to translate natural language into database queries.

The tool addresses the challenge of managing software dependencies and vulnerabilities at scale, particularly for organizations tracking thousands of components. IT administrators can use it to assess vulnerability changes before upgrading software versions and maintain dashboards of current system risks. Development teams can check dependencies and vulnerabilities when planning new applications. The natural language interface makes the knowledge graph accessible to users without SPARQL expertise.