A method and system for intelligent diagnosis and optimization of network anomalies in iOS device apps

Abstract

This invention discloses a method and system for intelligent diagnosis and optimization of network anomalies in iOS device apps. The method specifically includes: parsing system logs to identify network error patterns, and temporally associating the identified network error patterns with user operation event sequences to form a preliminary diagnostic event chain; extracting features and performing semantic understanding on interface screenshots and voice descriptions, and matching them with a preset fault knowledge base to obtain preliminary fault inferences; constructing a relationship graph based on the preliminary diagnostic event chain and preliminary fault inferences, calculating the probability of each node as the root cause of the network anomaly, and outputting the root cause location result; and generating a targeted personalized configuration optimization suggestion sequence based on the root cause location result through interactive exploration. This invention achieves accurate diagnosis and personalized optimization of network anomalies in iOS device apps, enabling rapid location of the root cause of the problem, reducing the time and cost of manual troubleshooting, and improving fault handling efficiency and user experience.

Description

Technical Field

[0001] This invention relates to the field of network monitoring technology, and in particular to a method and system for intelligent diagnosis and optimization of network anomalies in iOS device apps. Background Technology

[0002] In today's digital age, iOS devices sold in China hold a significant position in the domestic mobile device market thanks to their superior performance, smooth user experience, and design that closely aligns with the usage habits and security standards of Chinese users. These devices come pre-loaded with a rich variety of applications (apps), covering a wide range of fields including social networking, entertainment, office work, and learning, fully meeting the diverse needs of Chinese users in their daily lives and work. As the fundamental support for the normal operation of these apps, network connectivity is crucial, and its stability and reliability are paramount. For most iOS apps sold in China, network functionality is one of their core features; whether it's data transfer, loading various content, or conducting real-time interactive operations, a stable network connection is highly dependent. Therefore, ensuring that apps can connect to the network normally is the primary prerequisite for conducting various functional tests.

[0003] However, in actual use, domestic users often encounter network connection problems when opening apps on iOS devices sold in China. This not only severely impacts the user experience but can also prevent users from using the app's functions properly, leading to inconvenience and losses. For example, in social networking apps sold in China on iOS, network connection problems may prevent messages from being sent and received in a timely manner, causing users to miss important communications; in financial apps sold in China on iOS, network problems may affect transaction operations, posing a risk to user funds; and in online education apps sold in China on iOS, network issues can interfere with the learning process and affect learning outcomes.

[0004] Currently, finding and resolving network connectivity issues on iOS devices (Chinese version) presents numerous challenges. Firstly, traditional troubleshooting methods rely heavily on manual experience. Technicians must manually check network settings, system status, and app configuration information—a tedious and inefficient process. Due to the involvement of multiple stages and numerous parameters, manual troubleshooting is prone to omissions and misjudgments, making it difficult to quickly and accurately pinpoint the root cause. This is especially true in China's complex network environment, where differences in network characteristics among different operators and regional network coverage further complicate manual troubleshooting. Secondly, existing diagnostic tools are relatively limited in function, often providing only limited network status information and failing to comprehensively analyze the complex causes of network anomalies. For example, some tools can only detect network connectivity but are powerless against deeper issues such as network error patterns, system configuration conflicts, and application module failures. Furthermore, the environments and usage habits of different Chinese users' iOS devices vary, leading to different manifestations and causes of network anomalies. Existing solutions lack personalization and struggle to provide precise and effective optimization suggestions for specific problems. Summary of the Invention

[0005] The purpose of this invention is to provide a method and system for intelligent diagnosis and optimization of network anomalies in iOS device apps. This method and system enables accurate diagnosis and personalized optimization of network anomalies in iOS device apps, quickly locates the root cause of the problem, reduces the time and cost of manual troubleshooting, and improves fault handling efficiency and user experience, thereby solving at least one of the aforementioned problems in the prior art.

[0006] In a first aspect, the present invention provides a method for intelligent diagnosis and optimization of network anomalies in iOS device apps, the method specifically comprising: Monitor the network connection status of the target application, and automatically collect the system logs and user operation event sequences of the iOS device when a network anomaly is detected. The system logs are parsed using a natural language processing model based on the Transformer architecture to identify network error patterns, and the identified network error patterns are correlated with user operation event sequences in a time sequence to form a preliminary diagnostic event chain. Feature extraction and semantic understanding are performed on the screenshots and voice descriptions uploaded by users regarding network anomalies, and the results are matched with a preset fault knowledge base to obtain a preliminary fault inference. Based on the preliminary diagnostic event chain and preliminary fault inference, network entities, system configuration items and application modules are modeled as nodes and a relationship graph is constructed. The probability of each node as the root cause of network anomalies is calculated through graph propagation and aggregation algorithms, and the root cause localization results are output. Based on the root cause localization results, the system takes the current network configuration and environmental status of the device as the state input, the configuration modification action as the output, and the network connection recovery speed and stability as the reward function. Through interactive exploration, it generates a targeted and personalized configuration optimization suggestion sequence.

[0007] Secondly, the present invention provides an intelligent diagnosis and optimization system for network anomalies in iOS device apps, the system specifically comprising: The network monitoring module is used to monitor the network connection status of the target application. When a network anomaly is detected, it automatically collects the system logs and user operation event sequences of the iOS device. The event diagnosis module is used to parse system logs using a natural language processing model based on the Transformer architecture to identify network error patterns, and to correlate the identified network error patterns with user operation event sequences in a time sequence to form a preliminary diagnostic event chain. The fault inference module is used to extract features and understand semantics from the screenshots and voice descriptions uploaded by users regarding network anomalies, and match them with a preset fault knowledge base to obtain a preliminary fault inference. The root cause localization module is used to model network entities, system configuration items, and application modules as nodes and construct a relationship graph based on the preliminary diagnostic event chain and preliminary fault inference. It calculates the probability of each node being the root cause of network anomalies through graph propagation and aggregation algorithms and outputs the root cause localization results. The configuration optimization module is used to generate a targeted and personalized configuration optimization suggestion sequence based on the root cause localization results, taking the current network configuration and environmental status of the device as the status input, the configuration modification action as the output, and the network connection recovery speed and stability as the reward function.

[0008] Thirdly, the present invention provides a computer device, including: a memory and a processor, and a computer program stored in the memory, wherein when the computer program is executed on the processor, it implements the iOS device APP network anomaly intelligent diagnosis and optimization method as described in any of the above methods.

[0009] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the iOS device APP network anomaly intelligent diagnosis and optimization method as described in any of the above methods.

[0010] Compared with the prior art, the present invention has at least one of the following technical effects: 1. This invention enables accurate diagnosis and personalized optimization of network anomalies in iOS device apps, quickly pinpointing the root cause of problems, reducing the time and cost of manual troubleshooting, and improving fault handling efficiency and user experience.

[0011] 2. This invention can comprehensively consider factors at all levels of the system, uncover potential configuration conflicts and dependencies, and provide more comprehensive and in-depth root cause localization results, providing a strong basis for subsequent optimization measures.

[0012] 3. This invention can dynamically adjust and optimize strategies according to the specific circumstances and network environment of different users, providing the most suitable configuration modification scheme, effectively improving the recovery speed and stability of network connection, and enhancing user experience.

[0013] 4. By using pre-trained models and simulators, this invention improves the system's generalization ability and adaptability, enabling it to cope with various complex network anomaly scenarios.

[0014] 5. This invention, through structured log processing, time-series correlation, and event sorting, can generate a clear chain of abnormal triggering processes, providing key clues for subsequent fault location.

[0015] 6. This invention is based on self-supervised pre-training using a domain-specific corpus, which enables the model to efficiently capture the semantic features and contextual patterns of system logs, thereby improving the accuracy of network error pattern recognition.

[0016] 7. This invention, through multimodal feature fusion and matching with a fault knowledge base, can quickly generate preliminary fault inferences and enhance the ability to understand user feedback information.

[0017] 8. The cross-modal contrastive learning task design of this invention enables the model to learn semantic alignment between different modal inputs, thereby improving the robustness of multimodal fault feature extraction.

[0018] 9. The graph propagation and aggregation algorithm based on heterogeneous graph reasoning in this invention can calculate the root cause probability by integrating multi-dimensional information and output high-confidence fault location results.

[0019] 10. This invention combines static patterns with real-time environmental information to construct a heterogeneous graph structure that fits the actual scenario, thereby improving the applicability of fault reasoning. Attached Figure Description

[0020] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0021] Figure 1 This is a flowchart illustrating an intelligent diagnosis and optimization method for network anomalies in iOS device apps according to an embodiment of the present invention. Figure 2 This is a schematic diagram of the structure of an intelligent diagnosis and optimization system for network anomalies in iOS devices and apps, provided in an embodiment of the present invention. Figure 3 This is a schematic diagram of the structure of a computer device provided in an embodiment of the present invention. Detailed Implementation

[0022] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0023] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0024] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0025] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0026] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0027] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0028] In this application embodiment, the entity executing the process includes a terminal device. This terminal device includes, but is not limited to, devices capable of executing the methods disclosed in this application, such as servers, computers, smartphones, and tablets. Figure 1 A flowchart illustrating an intelligent diagnosis and optimization method for network anomalies in iOS device apps, according to an embodiment of the present invention, is shown below in detail: S101, monitors the network connection status of the target application, and automatically collects the system logs and user operation event sequences of the iOS device when the network is determined to be abnormal; S102, using a natural language processing model based on the Transformer architecture to parse system logs to identify network error patterns, and then temporally correlate the identified network error patterns with user operation event sequences to form a preliminary diagnostic event chain; S103: Extract features and understand semantics from the screenshots and voice descriptions uploaded by users regarding network anomalies, and match them with a preset fault knowledge base to obtain a preliminary fault inference. S104, based on the preliminary diagnostic event chain and preliminary fault inference, models network entities, system configuration items and application modules as nodes and constructs a relationship graph. The probability of each node as the root cause of network anomalies is calculated through graph propagation and aggregation algorithms, and the root cause localization results are output. S105, based on the root cause localization results, takes the current network configuration and environmental status of the device as the status input, the configuration modification action as the output, and the network connection recovery speed and stability as the reward function, and generates a targeted personalized configuration optimization suggestion sequence through interactive exploration.

[0029] In this embodiment, when the target application runs on an iOS device, the system continuously monitors the application's network connection status. This monitoring is achieved by calling network-related interfaces provided by the iOS system. These interfaces provide real-time feedback on the application's connection to the network, such as whether the connection to the server was successful and whether data transmission was normal. When the monitoring system determines that the target application is experiencing a network anomaly, such as a network connection timeout or inability to access a specific server, the system automatically triggers a data collection mechanism. At this time, the system logs of the iOS device and user operation event sequences are collected. The system logs record various system-level information during device operation, including network-related error messages and system configuration changes; the user operation event sequences record the user's actions within the application, such as the time and sequence of actions like clicking buttons and swiping pages. This data collection is for subsequent comprehensive analysis of the causes of network anomalies, as the system logs may contain underlying information leading to network problems, and the user operation event sequences help understand the user's specific behavior when the network anomaly occurs, thereby determining whether it is related to user actions.

[0030] After collecting system logs, they are parsed using a Transformer-based natural language processing model. The Transformer architecture's natural language processing model possesses powerful text understanding and analysis capabilities, enabling it to identify network error patterns from the vast amounts of text information in the system logs. For example, it can identify frequently occurring specific error codes, error descriptions, and other network-related patterns in the logs. After identifying the network error patterns, they are temporally correlated with previously collected user operation event sequences. Temporal correlation refers to matching network error patterns with user operation events in chronological order, analyzing whether the network error pattern occurs after a specific user operation, or whether there is another temporal correlation between the network error pattern and the user operation. Through this correlation, a preliminary diagnostic event chain is formed. This preliminary diagnostic event chain clearly shows the system status of the device and user operations before and after the network anomaly occurred, providing important clues for further analysis of the cause of the network anomaly.

[0031] When users encounter network anomalies, the system allows them to upload screenshots and voice descriptions. For uploaded screenshots, image feature extraction technology is used to extract key elements, such as error messages and network status icons. For uploaded voice descriptions, speech recognition technology converts them into text, followed by semantic understanding to extract key information, such as the network anomaly described by the user and the time of occurrence. The extracted screenshot features and semantic information from the voice description are then matched against a pre-set fault knowledge base. This knowledge base stores numerous known network fault cases and related information, including fault symptoms and possible causes. Through matching, the system finds the case most similar to the user-uploaded information, thus obtaining a preliminary fault inference. This preliminary inference provides a reference direction based on user feedback for subsequent network anomaly diagnosis.

[0032] Based on the preliminary diagnostic event chain and preliminary fault inference obtained above, network entities, system configuration items, and application modules are modeled as nodes. Network entities can include network connections, servers, etc.; system configuration items cover device network settings, system parameters, etc.; application modules refer to the various functional modules in the application. These nodes are constructed into a relationship graph, where edges represent the relationships between nodes, such as the connection between a network connection and a server, or the influence of system configuration items on application modules. Then, the probability of each node being the root cause of the network anomaly is calculated using a graph propagation and aggregation algorithm. The graph propagation and aggregation algorithm can analyze and calculate each node based on the relationships between nodes in the graph and the information from the preliminary diagnostic event chain and preliminary fault inference, determining the likelihood of it being the root cause of the network anomaly. Finally, the root cause localization result is output, clearly indicating the most likely cause of the network anomaly, such as an incorrect system configuration setting, a faulty application module, or a problem with the network connection itself.

[0033] Based on the root cause analysis, the system takes the current device's network configuration and environmental status as input. Network configuration includes network parameters such as the device's IP address, subnet mask, and gateway. Environmental status includes the network environment the device is in (e.g., Wi-Fi or mobile data network) and network signal strength. The output is a configuration modification action, which can be an adjustment of network parameters or a change to system configuration items. Simultaneously, network connection recovery speed and stability are used as a reward function. The reward function evaluates the effectiveness of the configuration modification action; a higher reward value is given if the network connection recovery speed is faster and stability is improved after the modification, and a lower reward value is given otherwise. Through interactive exploration, the system continuously tries different configuration modification actions and optimizes based on the feedback from the reward function, ultimately generating a targeted, personalized configuration optimization suggestion sequence. This personalized configuration optimization suggestion sequence can provide users with the most suitable configuration optimization solution based on the specific situation of the device and the cause of the network anomaly, helping users quickly restore network connectivity and improve network stability.

[0034] In some embodiments, step S102 above, which involves using a Transformer-based natural language processing model to parse system logs to identify network error patterns and then temporally associating the identified network error patterns with user operation event sequences to form a preliminary diagnostic event chain, specifically includes: The system logs are structured and key network entities are labeled to obtain standard log data; Standard log data is input into a natural language processing model based on the Transformer architecture to identify network error patterns and extract error event attributes, including error type and timestamp. The error event attributes are sequentially associated with the user operation event sequence, an associated time window is established for each error event, and related user operation events are filtered within the associated time window; The selected user operation events are associated with and sorted with the corresponding error events to generate a preliminary diagnostic event chain that reflects the abnormal triggering process and system response.

[0035] In this embodiment, when a target application on an iOS device experiences a network anomaly, the system automatically collects system logs. Since system logs are typically unstructured text containing a large amount of information of various types, they need to be structured for easier subsequent processing and analysis. This structuring process can be achieved using predefined log templates and rules, such as categorizing and organizing logs according to their source, time, and event type. Simultaneously, during structuring, key network entities in the system logs are labeled. Key network entities include, but are not limited to, network connection status identifiers (e.g., connected, disconnected), server addresses, port numbers, and network protocol types (e.g., TCP, UDP). Labeling these key network entities highlights important network-related information in the system logs, laying the foundation for accurate identification of network error patterns and ultimately obtaining standard log data. Standard log data has a unified structure and clearly labeled key information, facilitating subsequent model processing and analysis.

[0036] Standard log data, after structured processing and key network entity annotation, is input into a Transformer-based natural language processing (NLP) model. The Transformer model possesses powerful text understanding and feature extraction capabilities, enabling deep analysis of standard log data. During analysis, the model learns semantic and syntactic information from the log text to identify network error patterns. For example, it can recognize common network error expressions such as "network connection timeout" and "server unresponsive." Simultaneously, the model extracts error event attributes, including error type and timestamp. The error type clarifies the specific manifestation of the network anomaly, such as connection error or data transmission error; the timestamp records the specific time the network error occurred, which is crucial for subsequent time-series correlation analysis. Through this step, network errors can be accurately located from system logs, and their key attribute information can be obtained.

[0037] After identifying network error patterns and extracting error event attributes, it is necessary to temporally correlate these attributes with user action event sequences. To achieve this, a correlation time window is established for each error event. The correlation time window can be flexibly adjusted according to actual conditions; for example, it can be set within a certain time range before and after the error event, such as 5 minutes before and after. Within this correlation time window, relevant user action events are filtered from the user action event sequence. Relevant user action events refer to those events that are close in time to the network error event and may affect network connectivity. For example, a user might have clicked a function button that could trigger a network request before the error event occurred, or they might be performing a data upload operation when the error event occurred. By establishing correlation time windows and filtering relevant user action events, the temporal relationship between network error events and user actions can be preliminarily determined.

[0038] The selected user operation events are correlated and sorted with their corresponding error events to generate a preliminary diagnostic event chain reflecting the anomaly triggering process and system response. The correlation process involves matching user operation events and network error events chronologically to clarify the correspondence between each event. Sorting involves arranging all correlated events in ascending order based on their timestamps, forming a complete event sequence. This preliminary diagnostic event chain clearly shows what user actions and system responses occurred before and after the network anomaly, helping technicians intuitively understand the anomaly triggering process and system response. For example, the preliminary diagnostic event chain might show that a user clicked the "refresh" button at a certain time, subsequently resulting in a network connection timeout error. Such an event chain can preliminarily determine that the "refresh" operation may be related to the network connection timeout, providing important clues for further in-depth analysis of the network anomaly's cause.

[0039] Furthermore, the pre-training steps of the natural language processing model based on the Transformer architecture include: A domain-specific pre-trained corpus is built based on the system logs of iOS devices, and self-supervised training samples are constructed based on the pre-trained corpus. Construct and initialize a Transformer encoder model, input self-supervised training samples into the Transformer encoder model, and perform multiple rounds of iterative training on the Transformer encoder model with the goal of jointly optimizing the pre-training task, so that it learns the semantic features and contextual rules of the system logs, and obtains a natural language processing model based on the Transformer architecture. The pre-training tasks include an entity-aware masked language modeling task and a next log prediction task. The entity-aware masked language modeling task is used to train the Transformer encoder model to make predictions based on context by masking key technical entities in the logs. The next log prediction task is used to train the Transformer encoder model to understand the temporal correlation between logs by judging the continuity of log segments.

[0040] In this embodiment, the iOS device's system logs encompass records generated by the iOS device under various operating states, including log information under normal circumstances and in cases of network anomalies or other malfunctions. After collecting a sufficient amount of system logs, they are organized and categorized based on their content, format, and key network-related information to construct a domain-specific pre-training corpus. This corpus focuses on the iOS device system log domain, providing highly targeted and data-rich foundational materials for subsequent model training.

[0041] Based on the pre-trained corpus, self-supervised training samples are further constructed. The construction of self-supervised training samples leverages the characteristics of the system logs themselves, eliminating the need for additional manual annotation. For example, segments can be selected from the logs, processed according to specific rules, and used to generate sample formats suitable for model training, providing data support for subsequent pre-training tasks.

[0042] Based on the principles and design requirements of the Transformer architecture, a Transformer encoder model is constructed. This model contains several key components, such as a multi-head attention mechanism layer and a feedforward neural network layer. These components work together to effectively process the input text. After construction, the model is initialized. The initialization process involves assigning initial values ​​to the various parameters in the model. These initial values ​​are usually generated randomly, but follow a certain distribution pattern to ensure that the model has a reasonable initial state at the start of training, laying the foundation for subsequent optimization training.

[0043] The constructed self-supervised training samples are input into the initialized Transformer encoder model to train a masked language modeling task based on entity awareness. In this task, key technical entities are identified from system logs. These key technical entities include, but are not limited to, network connection status identifiers, server addresses, port numbers, network error codes, and other core network-related information. Then, these key technical entities are masked; that is, when input into the Transformer encoder model, these entities are replaced with specific mask symbols. After receiving the masked input, the Transformer encoder model needs to predict the masked key technical entities based on contextual information. Through multiple rounds of iterative training, the Transformer encoder model continuously adjusts its parameters to improve prediction accuracy. In this process, the Transformer encoder model gradually learns the semantic relationships between key technical entities and context in the system logs, enabling it to better understand the logical connections between different parts of the log content, thereby enhancing its ability to grasp the semantic features of the system logs.

[0044] While training the entity-aware masked language modeling task, the next log prediction task is trained in parallel. The core of the next log prediction task is to determine the continuity of log segments. Specifically, continuous log segments are selected from the pre-training corpus and split into two parts: one part is used as input, and the other part is used as the target output. The Transformer encoder model needs to predict the subsequent log content based on the input log segments.

[0045] Through multiple rounds of iterative training, the Transformer encoder model continuously optimizes its parameters to more accurately determine the temporal relationships between log segments. In this process, the model gradually understands the logical order and inherent connections between records at different points in time in the system log, enabling it to grasp the temporal patterns of the logs and thus further enhance its ability to understand system logs.

[0046] After multiple rounds of iterative training for the entity-aware masked language modeling task and the next log prediction task, the Transformer encoder model is comprehensively trained with the goal of jointly optimizing these two pre-trained tasks. Joint optimization means considering the objective functions of both tasks simultaneously during training, and adjusting the model parameters to achieve good performance on both tasks.

[0047] After multiple rounds of joint optimization training, the Transformer encoder model has fully learned the semantic features and contextual patterns of the system logs, enabling it to accurately understand various information within the logs, including key technical entities, semantic relationships, and temporal correlations. At this point, a natural language processing model based on the Transformer architecture is obtained. This model can be used for subsequent parsing of iOS device system logs to identify network error patterns, providing strong support for the intelligent diagnosis of network anomalies in iOS device apps.

[0048] In some embodiments, step S103 above, which involves performing feature extraction and semantic understanding on the screenshots and voice descriptions uploaded by the user regarding network anomalies, and matching them with a preset fault knowledge base to obtain a preliminary fault inference, specifically includes: It receives screenshots and voice descriptions of network anomalies uploaded by users, performs standardized preprocessing on the screenshots, and converts the voice descriptions into descriptive text through speech recognition. The standardized preprocessed screenshots and descriptive text are input into a pre-trained multimodal encoder model to extract image feature vectors and text feature vectors, respectively. The image feature vector and the text feature vector are fused to generate the user feedback feature vector; In a pre-built fault knowledge base, the semantic similarity between the user feedback feature vector and the various standard fault feature vectors stored in the fault knowledge base is calculated. The fault mode corresponding to the standard fault feature vector with the highest semantic similarity is output as the initial fault inference for network anomalies.

[0049] In this embodiment, when iOS users on Chinese-made devices encounter network issues while using the app, they can upload screenshots and voice descriptions of the network problem through a pre-defined feedback entry point within the app. Upon receiving the uploaded screenshots, the system performs standardized preprocessing. This preprocessing includes uniformly adjusting the screenshot size to ensure all screenshots have the same specifications for easier subsequent processing; it also optimizes parameters such as color mode and contrast to eliminate image quality differences caused by device variations or shooting environments, improving image clarity and recognizability. For the user-uploaded voice descriptions, the system calls the speech recognition module to convert them into descriptive text. The speech recognition module employs advanced speech recognition technology, accurately recognizing speech content with different accents and speaking speeds, and converting it into accurate text information, providing a foundation for subsequent processing.

[0050] The standardized preprocessed screenshots of the interface and the converted descriptive text are input into a pre-trained multimodal encoder model. This multimodal encoder model, trained on a large amount of data, is capable of processing both image and text data simultaneously. For the input screenshots, the model analyzes them using structures such as convolutional neural networks to extract key features from the image, such as the layout, color, and shape of interface elements, and converts them into image feature vectors. For the descriptive text, the model uses natural language processing techniques, such as word embeddings and recurrent neural networks, to extract and encode semantic information from the text, generating text feature vectors. In this way, the model can obtain key features of user feedback information from both image and text dimensions.

[0051] After obtaining the image and text feature vectors, the system employs a specific fusion strategy to combine them. The fusion process is not a simple concatenation, but rather considers the correlation and complementarity between the image and text modalities. For example, through attention mechanisms and other methods, the model automatically learns which features in the image and text are related and which are complementary. Then, based on these relationships, the image and text feature vectors are organically combined to generate a comprehensive user feedback feature vector. This user feedback feature vector can more comprehensively and accurately reflect the network anomalies reported by the user, covering key information from both the image and text aspects.

[0052] A pre-built fault knowledge base stores a large number of known standard fault feature vectors and their corresponding fault modes. These standard fault feature vectors are obtained through the analysis and processing of a large number of past network anomaly cases, and are representative and typical. After generating user feedback feature vectors, the system calculates the semantic similarity between the user feedback feature vector and each standard fault feature vector in the fault knowledge base. The semantic similarity calculation uses an advanced similarity algorithm, which can accurately measure the degree of similarity between two vectors at the semantic level. Through calculation, the system can obtain the similarity value between the user feedback feature vector and each standard fault feature vector.

[0053] After calculating all semantic similarity scores, the system identifies the standard fault feature vector with the highest semantic similarity. The fault mode corresponding to this standard fault feature vector is the system's preliminary fault inference based on the current network anomaly reported by the user. The system outputs this preliminary fault inference, providing an important basis for subsequent network anomaly diagnosis and optimization. For example, if the fault mode corresponding to the standard fault feature vector with the highest semantic similarity is "weak network signal causing connection anomalies," then the system will output this result as a preliminary fault inference, indicating to technicians that there may be a problem with the network signal. In this way, the system can quickly and accurately make a preliminary judgment on the network anomaly reported by the user, improving the efficiency and accuracy of fault diagnosis.

[0054] Furthermore, the pre-training steps of the multimodal encoder model include: A multimodal pre-training corpus is constructed based on historical network anomaly interface screenshots and voice descriptions. The multimodal pre-training corpus includes multiple related interface screenshot and description text pairs. Construct and initialize a multimodal encoder model containing a visual encoder and a text encoder; A cross-modal contrastive learning task is designed based on a multimodal pre-training corpus. The cross-modal contrastive learning task is used to make correctly paired screenshots and descriptive texts have high similarity in the shared semantic space learned by the multimodal encoder model, and to make unpaired screenshots and texts have low similarity. Multimodal pre-training corpora are input into a multimodal encoder model to optimize the cross-modal contrastive learning task. The multimodal encoder model is iteratively trained so that it learns to map inputs from different modalities to an aligned semantic feature space.

[0055] In this embodiment, a large number of historical screenshots and corresponding voice descriptions related to network anomalies are collected. This historical data can be obtained from various channels, such as past user feedback records and simulated network anomalies in test environments. The collected screenshots and voice descriptions are meticulously organized and matched to ensure that each screenshot has an accurate corresponding voice description, thus forming multiple associated screenshot-description pairs. These text pairs together constitute the multimodal pre-training corpus. For example, in a network anomaly scenario, a user-uploaded screenshot shows an error message indicating that the app cannot connect to the network, while the voice description details the time of the error, the steps to take, etc. Such screenshots and descriptions are paired and included in the multimodal pre-training corpus. In this way, a rich, diverse, and representative multimodal pre-training corpus is constructed, providing sufficient data support for subsequent model training.

[0056] After constructing a multimodal pre-training corpus, a multimodal encoder model is built. This model comprises two core components: a visual encoder and a text encoder. The visual encoder is specifically designed for processing image data such as screenshots. It employs an advanced convolutional neural network structure to automatically extract key features from images, such as the shape, color, and position of interface elements. The text encoder processes descriptive text, using natural language processing techniques, such as word embeddings and recurrent neural networks, to transform the semantic information in the text into numerical representations that computers can understand. After constructing the basic model structure, the various parameters in the model are initialized. The initialization process uses a random initialization method, assigning an initial random value to each parameter to provide a starting point for subsequent model training. For example, the convolutional kernel parameters in the visual encoder and the word embedding matrix parameters in the text encoder are all assigned initial values ​​through random initialization, ensuring that the model is in a relatively random but adjustable state at the start of training.

[0057] To enable the multimodal encoder model to accurately understand the semantic relationships between data from different modalities, a cross-modal contrastive learning task is designed. The core objective of this task is to ensure that correctly paired screenshots and descriptive text have high similarity in the shared semantic space learned by the model, while unpaired screenshots and texts have low similarity. Specifically, during training, for each correct screenshot-text pair, it is treated as a positive sample. Simultaneously, other unpaired screenshots and texts are randomly selected from the multimodal pre-training corpus to form negative samples. In this way, a training sample set containing both positive and negative samples is constructed. During training, the model needs to learn to distinguish between positive and negative samples, ensuring that the screenshots and texts in the positive samples are as close as possible in the shared semantic space (high similarity), while the screenshots and texts in the negative samples are as far apart as possible (low similarity). For example, in a training batch containing a correct screenshot-text pair and multiple unpaired screenshots and texts, the model continuously adjusts its parameters to make the correct screenshots and texts semantically closer, while the unpaired ones become more distant, thereby learning the semantic associations of data from different modalities.

[0058] The constructed multimodal pre-training corpus is input into the multimodal encoder model to iteratively train the model with the goal of optimizing the cross-modal contrastive learning task. In each iteration, the model receives input screenshots and text data, extracting image feature vectors and text feature vectors through visual encoders and text encoders, respectively. Then, based on the designed cross-modal contrastive learning task, the similarity loss between positive and negative samples is calculated. The similarity loss reflects the model's understanding of the semantic associations of different modal data under the current parameters; the smaller the loss value, the stronger the model's ability to distinguish between positive and negative samples, i.e., the better the learning effect on the semantic associations of different modal data. Based on the calculated similarity loss, the backpropagation algorithm is used to update and adjust the parameters in the model. The backpropagation algorithm can automatically adjust the magnitude and direction of the parameters based on the gradient information of the model parameters with respect to the loss value, enabling the model to better optimize the cross-modal contrastive learning task in the next iteration. Through repeated training iterations, the model continuously learns and improves, gradually learning to map inputs from different modalities to an aligned semantic feature space. This enables it to accurately extract features and understand semantics from user-uploaded screenshots and voice descriptions. For example, after thousands or even more training iterations, the model can quickly and accurately extract semantically representative feature vectors when processing new screenshot-text pairs, providing strong support for subsequent network anomaly diagnosis.

[0059] In some embodiments, in step S104 above, the step of modeling network entities, system configuration items, and application modules as nodes and constructing a relationship graph based on the preliminary diagnostic event chain and preliminary fault inference, calculating the probability of each node as the root cause of network anomalies through graph propagation and aggregation algorithms, and outputting the root cause localization result specifically includes: A heterogeneous graph is constructed based on a predefined graph pattern. The nodes of the heterogeneous graph represent network entities, system configuration items, and application modules, and the edges of the heterogeneous graph represent dependency, configuration, or conflict relationships between nodes. Based on the preliminary diagnostic event chain and preliminary fault inference, the initial feature vectors of relevant nodes in the heterogeneous graph are assigned and enhanced to embed abnormal context information. The heterogeneous graph after feature injection is input into a pre-built multi-layer graph convolutional network. The multi-layer graph convolutional network performs message propagation and feature aggregation operations layer by layer, so that the feature representation of each node is fused with the association state information of its multi-hop neighborhood, and the final feature representation of each node is output. Based on the final feature representation of each node, a classifier is used to calculate the probability score of each node as the root cause of network anomalies. The nodes are sorted and filtered according to their probability scores, and one or more candidate root cause nodes and their confidence scores are output to obtain the root cause localization results.

[0060] In this embodiment, a heterogeneous graph is constructed based on a predefined graph pattern. This heterogeneous graph forms the foundation of the entire root cause localization process, where nodes are carefully designed to represent network entities, system configuration items, and application modules. Network entities can encompass information such as network connection type (e.g., Wi-Fi, mobile data) and network operator; system configuration items include device network settings parameters and system version-related configurations; application modules involve various functional modules within an app, such as the messaging module in a social app or the transaction processing module in a financial app. The edges of the heterogeneous graph represent dependencies, configurations, or conflicts between nodes. For example, there is a dependency between network connection type and network operator, and specific system configurations may conflict with certain application modules. Through this explicit and detailed definition of nodes and edges, a comprehensive heterogeneous graph that accurately reflects the relationships between elements is constructed, providing a solid foundation for subsequent analysis.

[0061] After constructing the heterogeneous graph, the initial feature vectors of relevant nodes in the graph are assigned values ​​and enhanced based on the preliminary diagnostic event chain and preliminary fault inference. The preliminary diagnostic event chain records a series of related events and their temporal relationships when a network anomaly occurs, while the preliminary fault inference provides a preliminary judgment on the possible causes of the network anomaly. Using this information, anomaly context information is embedded into the initial feature vectors of relevant nodes. For example, if the preliminary diagnostic event chain shows that a user performed a specific operation before the network anomaly occurred, and the preliminary fault inference points to an application module related to that operation, then relevant information about that operation, such as operation time and operation type, is incorporated into the initial feature vector of the corresponding application module node. In this way, the node's feature vector not only contains its own inherent attribute information but also incorporates context information closely related to the current network anomaly, thus more comprehensively and accurately reflecting the node's state during a network anomaly.

[0062] The heterogeneous graph, after feature injection, is input into a pre-built multi-layer graph convolutional network. Multi-layer graph convolutional networks are powerful graph data processing models that can perform message propagation and feature aggregation operations layer by layer. In each layer, nodes receive messages from their neighboring nodes, which contain feature information about those neighbors. By processing and integrating these messages, nodes can fuse the associated state information of their direct neighbors and update their own feature representations. As the number of layers increases, the scope of this message propagation and feature aggregation expands, and each node's feature representation can incorporate the associated state information of its multi-hop neighborhood. For example, after processing a network entity node through a multi-layer graph convolutional network, its feature representation not only includes its own network attribute information but also incorporates information from related system configuration items and application modules, thus more comprehensively reflecting the node's state in the entire network's abnormal environment. After multiple layers of such operations, the final feature representations of each node are output.

[0063] Based on the final feature representations of each node, a classifier is used to calculate the probability score of each node as the root cause of network anomalies. A classifier is a model that classifies samples based on input features. Here, it determines the likelihood of each node being the root cause of a network anomaly based on its final feature representation and assigns a corresponding probability score. For example, for a system configuration item node, the classifier calculates the probability score of that node causing the network anomaly based on information contained in its final feature representation, such as its correlation with network anomaly events and the degree of anomaly in its feature values. The higher the probability score, the greater the likelihood that the node is the root cause of the network anomaly.

[0064] Finally, the nodes are sorted and filtered based on the calculated probability scores. All nodes are sorted from highest to lowest probability score, with higher-scoring nodes given priority. Then, based on preset filtering criteria, such as a probability score threshold or selecting a few top-ranked nodes, one or more candidate root cause nodes and their confidence levels are output. The confidence level, which can be obtained by transforming the probability score, reflects our degree of confidence that the node is the root cause of the network anomaly. In this way, the root cause localization result is finally obtained, providing a clear direction and basis for subsequent network anomaly repair and optimization. For example, if the output candidate root cause node is a specific application module with a high confidence level, then technicians can focus on checking and repairing that module to improve the efficiency and accuracy of network anomaly resolution.

[0065] Furthermore, the construction of heterogeneous graphs based on predefined graph patterns specifically includes: A predefined static graph pattern is used to specify the classification system for node types and the semantic system for edge relationship types. For the target iOS device and target application to be diagnosed, dynamically collect current configuration information, target application composition information and hardware environment information; The current configuration information, target application composition information and hardware environment information collected are instantiated according to the static graph pattern. A corresponding node instance is created for each identified entity, and a corresponding edge instance is created for each pair of related entities. All created node instances and edge instances are integrated to form a complete heterogeneous graph.

[0066] In this embodiment, a static graph schema is predefined, which clearly defines the classification system for node types and the semantic system for edge relationship types. Regarding the node type classification system, different types of nodes are distinguished, such as network entities, system configuration items, and application modules. For example, network entity nodes can be further subdivided into Wi-Fi networks, mobile data networks, and networks of different operators; system configuration item nodes cover network settings parameters (such as IP address, subnet mask, gateway, etc.), system version information, security settings, etc.; application module nodes include various functional modules within an app, such as the messaging module and payment module in a social app, and the transaction module and account management module in a financial app. For the semantic system of edge relationship types, the specific meanings of relationships such as dependency, configuration, or conflict between nodes are clearly defined. For example, a dependency relationship indicates that the normal operation of an application module depends on a specific network entity or system configuration item; a configuration relationship reflects the configuration effect of system configuration items on network entities or application modules; and a conflict relationship describes the potential conflicts between certain system configuration items or application modules. This detailed predefinition provides a clear and accurate standard for subsequent construction of heterogeneous graphs.

[0067] For the target iOS device and application to be diagnosed, it is necessary to dynamically collect current configuration information, target application structure information, and hardware environment information. When collecting configuration information, the device's network settings parameters are obtained, such as the current network type (Wi-Fi or mobile data), network name, and IP address allocation method. System version information, security settings (such as firewall rules and permission settings), and app-related configuration information are also collected, such as the app's network access permissions and caching settings. For the target application structure information, the various functional modules of the app are analyzed to understand their architecture and interrelationships, such as determining which modules are responsible for data transmission and which modules handle user interaction. Hardware environment information includes the device model, processor performance, and memory size, which may affect network connectivity and app operation. By comprehensively and dynamically collecting this information, the current state of the target device and application can be accurately grasped, providing rich data support for constructing a heterogeneous graph.

[0068] Based on a predefined static graph pattern, the collected current configuration information, target application structure information, and hardware environment information are instantiated. During this process, a corresponding node instance of a specific type is created for each identified entity. For example, if the collected information indicates that the device is currently connected to China Mobile's Wi-Fi network, a network entity node instance representing the China Mobile Wi-Fi network will be created; if a message sending module is found in the app, a corresponding application module node instance will be created. Simultaneously, edge instances of a corresponding relationship type are created for each pair of related entities. For instance, if the normal operation of the message sending module depends on a stable Wi-Fi network connection, an edge instance representing the dependency relationship will be created between the message sending module node instance and the China Mobile Wi-Fi network node instance. In this way, the collected abstract information is transformed into concrete nodes and edge instances in the heterogeneous graph, enabling the heterogeneous graph to accurately reflect the actual situation of the target device and application.

[0069] Finally, all created node instances and edge instances are integrated to form a complete heterogeneous graph. During this process, it is crucial to ensure the accuracy of the connections between nodes and edges, guaranteeing that each node can establish correct relationships with other relevant nodes through edges. For example, nodes representing different network entities, system configuration item nodes, and application module nodes are connected according to their actual relationships, forming an organic whole. This complete heterogeneous graph comprehensively and intuitively displays the complex relationships between the target iOS device and various elements within the target application, providing a solid foundation for subsequent calculations of the probability of each node being the root cause of network anomalies using graph propagation and aggregation algorithms. Through these steps, a heterogeneous graph conforming to a predefined graph pattern is successfully constructed, marking a crucial step towards accurately locating the root cause of network anomalies.

[0070] In some embodiments, in step S105 above, the step of generating a targeted personalized configuration optimization suggestion sequence based on the root cause localization result, using the current network configuration and environmental status of the device as the state input, the configuration modification action as the output, and the network connection recovery speed and stability as the reward function, through interactive exploration, specifically includes: A reinforcement learning model framework is constructed, which encodes the device network configuration, environmental state and root cause localization results as state inputs, defines feasible configuration modification operations as action outputs, and quantifies network recovery speed and stability indicators as reward functions. A device network environment simulator is established. The device network environment simulator is used to receive action commands and simulate the execution of configuration changes. At the same time, it calculates the instant reward according to the reward function and generates a new state. By enabling the reinforcement learning model to interact with the simulator in multiple rounds, the interaction experience is collected to iteratively update the parameters of the reinforcement learning model framework, so that it learns the configuration modification strategy that maximizes long-term cumulative rewards. The root cause localization results are input into the trained reinforcement learning model framework, which outputs a personalized configuration optimization suggestion sequence with the highest expected return.

[0071] In this embodiment, a reinforcement learning model framework is constructed. The core function of this framework is to encode device network configuration, environmental state, and root cause localization results into state inputs that the model can understand and process. For example, device network configuration may include parameters such as IP address, subnet mask, and gateway; environmental state may involve the current network type (such as Wi-Fi or mobile data), network signal strength, and the geographical location of the device; and root cause localization results identify the possible factors causing network anomalies, such as specific system configuration conflicts or application module failures. This information is then comprehensively encoded to form a complete state input vector.

[0072] Define feasible configuration modification operations as action outputs. These actions can be adjusting network settings parameters, such as changing DNS server addresses or switching network connection modes; they can also be changing system configurations, such as adjusting firewall rules or updating system versions; or they can be operations on application modules, such as resetting application caches or updating application versions. Each action corresponds to a possible configuration change method.

[0073] Network recovery speed and stability metrics are quantified into reward functions. Network recovery speed can be measured by the time required from executing a configuration modification action to restoring normal network connectivity; the shorter the time, the higher the reward value. Network stability can be evaluated by metrics such as the number of network connection interruptions and the packet loss rate of data transmission over a period of time; the better the stability, the higher the reward value. In this way, these two abstract metrics, network recovery speed and stability, are transformed into concrete numerical values, serving as the basis for the reinforcement learning model to optimize configuration modification strategies.

[0074] To test and optimize configuration modification strategies without affecting actual device usage, a device network environment simulator needs to be built. This simulator can receive action commands output by the reinforcement learning model and simulate the execution of corresponding configuration changes. For example, when the model outputs an action command to modify the DNS server address, the simulator will change the device's DNS server address to the specified address in the virtual environment.

[0075] After simulating a configuration change, the simulator calculates an immediate reward based on a predefined reward function. This immediate reward reflects the immediate impact of the configuration change on network recovery speed and stability. Simultaneously, the simulator generates a new state based on the changed device status and network environment, feeding this new state back to the reinforcement learning model for further decision-making. In this way, the simulator provides the reinforcement learning model with a virtual testing environment, allowing it to interact, explore, and learn in a secure setting.

[0076] Multi-round interaction between the reinforcement learning model and the simulator is a crucial step in optimizing the configuration modification policy. In each round, the reinforcement learning model selects an action output based on the current state input and sends this action instruction to the simulator. After the simulator executes the action, it calculates the immediate reward and generates a new state, then feeds this information back to the reinforcement learning model. The reinforcement learning model collects interaction experience based on the received immediate reward and the new state. This interaction experience includes information such as the current state, the selected action, the obtained immediate reward, and the new state. By continuously collecting and analyzing this interaction experience, the model iteratively updates its parameters using specific learning algorithms (such as deep Q-network algorithms or policy gradient algorithms). The goal of parameter updates is to enable the reinforcement learning model to learn a configuration modification policy that maximizes the cumulative reward in the long run, i.e., selecting configuration modification actions that can restore network connectivity most quickly and stably.

[0077] After multiple rounds of interactive exploration and model parameter updates, the reinforcement learning model has learned optimized configuration modification strategies. At this point, the root cause localization results are input into the trained reinforcement learning model framework. Based on the network anomaly reflected in the root cause localization results, combined with the current device network configuration and environmental state, the model selects the action sequence with the highest expected return from all feasible configuration modification actions.

[0078] This sequence of actions provides personalized configuration optimization suggestions for current device and network anomalies. For example, if root cause analysis indicates a network anomaly is due to a DNS resolution problem, the model might suggest changing the DNS server address to a specific public DNS server; if the problem is caused by excessive application caching, the model might suggest resetting the application cache. These suggestion sequences accurately target the root cause of network anomalies, thereby improving network connection stability and reliability and providing a better user experience.

[0079] Furthermore, the step of inputting the root cause localization results into the trained reinforcement learning model framework and outputting the personalized configuration optimization suggestion sequence with the highest expected return specifically includes: Receive root cause analysis results and synchronously collect real-time network environment and configuration status of iOS devices; By using a pre-trained state encoder, joint feature extraction and fusion are performed on the root cause localization results and the real-time network environment and configuration state to generate a joint state feature vector that comprehensively represents the current problem and status quo. The joint state feature vector is input into the trained reinforcement learning model framework. Through internal simulated sequential reasoning, multiple candidate configuration modification action sequences are generated, and the expected total benefit of each candidate configuration modification action sequence is evaluated. Select the candidate configuration modification action sequence with the highest expected total benefit from the candidate configuration modification action sequence as the personalized configuration optimization suggestion sequence.

[0080] In this embodiment, the root cause analysis clearly identifies the underlying reason for the iOS device's app network anomaly, which could be a specific network entity failure, system configuration conflicts, or problems with application modules. Simultaneously, the system collects real-time network environment and configuration status data for the iOS device. The real-time network environment includes the currently connected network type (e.g., Wi-Fi, 4G, 5G), network signal strength, and network operator information; the configuration status covers the device's network settings (e.g., IP address, subnet mask, DNS server address), system configuration (e.g., firewall settings, system version), and application-related configurations (e.g., application cache settings, permission settings). By comprehensively collecting this information, accurate foundational data can be provided for generating subsequent optimization suggestions.

[0081] After obtaining the root cause localization results and the real-time network environment and configuration status, the system invokes a pre-trained state encoder. The state encoder is a model trained on a large amount of data, capable of feature extraction and fusion of different types of data. The state encoder first extracts features from the root cause localization results, the real-time network environment, and the configuration status separately. For the root cause localization results, it extracts key features related to the root cause of the network anomaly, such as the fault type and involved network components. For the real-time network environment, it extracts features reflecting the current network condition, such as network speed and stability indicators. For the configuration status, it extracts configuration parameter features related to network connectivity. Then, the state encoder fuses these extracted features to generate a joint state feature vector. This joint state feature vector comprehensively represents the essence of the current iOS device app's network anomaly and the actual network environment and configuration status of the device, providing comprehensive and accurate state information for the reinforcement learning model.

[0082] The generated joint state feature vector is input into the trained reinforcement learning model framework. The reinforcement learning model framework has the ability to simulate inference; based on the input joint state feature vector and its learned configuration modification policies, it generates multiple candidate configuration modification action sequences. These candidate configuration modification action sequences include various possible configuration adjustment schemes, such as changing the DNS server address, adjusting the network connection mode, updating the system version, and resetting the application cache.

[0083] For each candidate configuration modification action sequence, the reinforcement learning model framework evaluates the expected total reward. The expected total reward is calculated based on a predefined reward function that comprehensively considers factors such as network connection recovery speed and stability. Faster network connection recovery and higher stability result in a larger reward value and a higher expected total reward. In this way, the reinforcement learning model framework can quantitatively evaluate the potential effect of each candidate configuration modification action sequence, providing a basis for subsequent selection.

[0084] After evaluating the expected total benefit of all candidate configuration modification action sequences, the system selects the one with the highest expected total benefit. This sequence is considered the most likely configuration modification solution to quickly and stably restore the iOS device's app network connectivity, given the current root cause analysis and real-time network environment and configuration status. The system outputs this candidate configuration modification action sequence with the highest expected total benefit as a personalized configuration optimization suggestion sequence to the user or relevant technical personnel. Users or technical personnel can then make corresponding configuration modifications to the iOS device based on this optimization suggestion sequence, thereby resolving app network anomalies, improving network connectivity stability and reliability, and enhancing the user experience.

[0085] In one possible implementation, the pre-training goal of the state encoder is to learn an effective feature representation method that encodes the input network state information (including root cause localization results, real-time network environment, and configuration status) into a joint state feature vector with discriminative and expressive power. This feature vector should comprehensively represent the current problem and status quo, providing accurate foundational data for subsequent configuration optimization suggestions. To pre-train the state encoder, a large-scale network state information dataset is needed, containing various types of network anomaly scenarios and corresponding root cause localization results, real-time network environment, and configuration status information.

[0086] The model architecture of the state encoder mainly includes the following parts: (1) Input layer: responsible for receiving network state information data, including root cause localization results, real-time network environment and configuration status, etc. The input layer will preprocess this information, such as word segmentation and embedding, for subsequent model processing. (2) Encoder layer: composed of multiple Transformer encoder blocks stacked together, responsible for extracting deep features of the input data. Each encoder block contains components such as self-attention mechanism and feedforward neural network, which can effectively capture long-distance dependencies and local features in the input data. (3) Feature fusion layer: responsible for fusing multiple features extracted by the encoder layer to generate a joint state feature vector that comprehensively represents the current problem and status. Feature fusion can be performed by concatenation, weighted summation, etc.

[0087] The parameters of the state encoder are initialized, which can be done through random initialization or transfer learning based on an existing model. Network state information data is loaded from the network state information dataset and preprocessed, such as through word segmentation and embedding. The preprocessed data is then input into the state encoder, passing through the input layer, encoder layer, and feature fusion layer to generate a joint state feature vector. A loss function (such as cross-entropy loss) is set according to the pre-training objective, and the loss value of the current batch of data is calculated. Then, the loss value is backpropagated to the model using the backpropagation algorithm to update the model parameters and reduce the loss value. This forward and backward propagation operation is repeated until the model converges or reaches the preset number of training epochs. During training, strategies such as learning rate decay and early stopping can be used to improve the model's training effect and generalization ability.

[0088] Reference Figure 2 An embodiment of the present invention provides an intelligent diagnosis and optimization system 2 for network anomalies in iOS device apps, wherein the system 2 specifically includes: The network monitoring module 201 is used to monitor the network connection status of the target application. When a network anomaly is detected, it automatically collects the system logs and user operation event sequences of the iOS device. The event diagnosis module 202 is used to parse system logs using a natural language processing model based on the Transformer architecture to identify network error patterns, and to correlate the identified network error patterns with user operation event sequences in a time sequence to form a preliminary diagnostic event chain. The fault inference module 203 is used to extract features and understand semantics from the screenshots and voice descriptions uploaded by users in response to network anomalies, and match them with a preset fault knowledge base to obtain a preliminary fault inference. The root cause localization module 204 is used to model network entities, system configuration items and application modules as nodes and construct a relationship graph based on the preliminary diagnostic event chain and preliminary fault inference. It calculates the probability of each node as the root cause of network anomalies through graph propagation and aggregation algorithms and outputs the root cause localization results. The configuration optimization module 205 is used to generate a targeted and personalized configuration optimization suggestion sequence based on the root cause localization results, taking the current network configuration and environmental status of the device as the status input, the configuration modification action as the output, and the network connection recovery speed and stability as the reward function.

[0089] It is understandable that, such as Figure 1The content of the iOS device APP network anomaly intelligent diagnosis and optimization method embodiment shown is applicable to this iOS device APP network anomaly intelligent diagnosis and optimization system embodiment. The specific functions implemented by this iOS device APP network anomaly intelligent diagnosis and optimization system embodiment are as follows: Figure 1 The illustrated method for intelligent diagnosis and optimization of network anomalies in iOS device apps is the same as that shown in the example, and achieves the same beneficial effects. Figure 1 The beneficial effects achieved by the illustrated embodiment of the intelligent diagnosis and optimization method for network anomalies in iOS device apps are the same.

[0090] It should be noted that the information interaction and execution process between the above systems are based on the same concept as the method embodiments of the present invention. For details on their specific functions and technical effects, please refer to the method embodiments section, which will not be repeated here.

[0091] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the system can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0092] Reference Figure 3 The present invention also provides a computer device 3, including: a memory 302 and a processor 301, and a computer program 303 stored on the memory 302. When the computer program 303 is executed on the processor 301, it implements the iOS device APP network anomaly intelligent diagnosis and optimization method as described in any of the above methods.

[0093] The computer device 3 may be a desktop computer, laptop, handheld computer, or cloud server, etc. The computer device 3 may include, but is not limited to, a processor 301 and a memory 302. Those skilled in the art will understand that... Figure 3The computer device 3 is merely an example and does not constitute a limitation on the computer device 3. It may include more or fewer components than shown in the figure, or combine certain components, or different components, such as input / output devices, network access devices, etc.

[0094] The processor 301 can be a Central Processing Unit (CPU), but it can also be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor.

[0095] In some embodiments, the memory 302 may be an internal storage unit of the computer device 3, such as a hard disk or memory of the computer device 3. In other embodiments, the memory 302 may be an external storage device of the computer device 3, such as a plug-in hard disk, smart media card (SMC), secure digital (SD) card, flash card, etc., equipped on the computer device 3. Furthermore, the memory 302 may include both internal and external storage units of the computer device 3. The memory 302 is used to store the operating system, applications, boot loader, data, and other programs, such as the program code of the computer program. The memory 302 can also be used to temporarily store data that has been output or will be output.

[0096] This invention also provides a computer-readable storage medium storing a computer program thereon. When the computer program is run by a processor, it implements the iOS device APP network anomaly intelligent diagnosis and optimization method as described in any of the above methods.

[0097] In this embodiment, if the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include at least: any entity or device capable of carrying computer program code to a photographing device / terminal device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium. Examples include USB flash drives, portable hard drives, magnetic disks, or optical disks. In some jurisdictions, according to legislation and patent practice, computer-readable media cannot be electrical carrier signals or telecommunication signals.

[0098] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0099] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0100] In the embodiments disclosed in this application, it should be understood that the disclosed devices / terminal equipment and methods can be implemented in other ways. For example, the device / terminal equipment embodiments described above are merely illustrative. For instance, the division of modules or units is only a logical functional division, and in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the displayed or discussed mutual coupling or direct coupling or communication connection may be through some interfaces; the indirect coupling or communication connection between devices or units may be electrical, mechanical, or other forms.

[0101] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

Claims

1. An iOS device APP network anomaly intelligent diagnosis and optimization method, characterized in that, The method specifically comprises: Monitoring the network connection state of the target application program, and automatically collecting system logs and user operation event sequences of the iOS device when determining that the network is abnormal; Using a natural language processing model based on a Transformer architecture to analyze the system logs to identify network error patterns, and time-correlating the identified network error patterns with the user operation event sequences to form a preliminary diagnostic event chain; Extracting features and understanding semantics from the interface screenshots and voice descriptions uploaded by the user in response to the network anomaly, and matching them with a preset fault knowledge base to obtain a preliminary fault inference; Based on the preliminary diagnostic event chain and the preliminary fault inference, modeling network entities, system configuration items, and application program modules as nodes and constructing a relationship graph, calculating the probability of each node as the root cause of the network anomaly through graph propagation and aggregation algorithms, and outputting the root cause positioning result; Based on the root cause positioning result, taking the network configuration and environmental state of the current device as state input, taking configuration modification actions as output, and taking network connection recovery speed and stability as a reward function, generating a targeted and personalized configuration optimization suggestion sequence through interactive exploration.

2. The method of claim 1, wherein, The natural language processing model based on the Transformer architecture is specifically used to analyze the system logs to identify network error patterns, and time-correlate the identified network error patterns with the user operation event sequences to form a preliminary diagnostic event chain, which specifically comprises: Structuring the system logs and labeling key network entities to obtain standard log data; Input the standard log data into the natural language processing model based on the Transformer architecture to identify network error patterns and extract error event attributes including error types and timestamps; Time-correlate the error event attributes with the user operation event sequences, establish an association time window for each error event, and filter relevant user operation events within the association time window; Correlate and sort the filtered user operation events with the corresponding error events to generate a preliminary diagnostic event chain reflecting the abnormal triggering process and system response.

3. The method of claim 2, wherein, The pre-training step of the natural language processing model based on the Transformer architecture comprises: Constructing a domain-specific pre-training corpus according to the system logs of the iOS device, and constructing self-supervised training samples based on the pre-training corpus; Build and initialize the Transformer encoder model, input the self-supervised training samples into the Transformer encoder model, and perform multiple rounds of iterative training on the Transformer encoder model to jointly optimize the pre-training task, so that it learns the semantic features and context rules of the system logs, and obtains the natural language processing model based on the Transformer architecture. The pre-training tasks include an entity-aware masked language modeling task and a next log prediction task. The entity-aware masked language modeling task is used to train the Transformer encoder model to make predictions based on context by masking key technical entities in the logs. The next log prediction task is used to train the Transformer encoder model to understand the temporal correlation between logs by judging the continuity of log segments.

4. The method of claim 1, wherein, The process of extracting features and performing semantic understanding on user-uploaded screenshots and voice descriptions regarding network anomalies, and matching them with a pre-set fault knowledge base to obtain preliminary fault inferences, specifically includes: It receives screenshots and voice descriptions of network anomalies uploaded by users, performs standardized preprocessing on the screenshots, and converts the voice descriptions into descriptive text through speech recognition. The standardized preprocessed screenshots and descriptive text are input into a pre-trained multimodal encoder model to extract image feature vectors and text feature vectors, respectively. The image feature vector and the text feature vector are fused to generate the user feedback feature vector; In a pre-built fault knowledge base, the semantic similarity between the user feedback feature vector and the various standard fault feature vectors stored in the fault knowledge base is calculated. The fault mode corresponding to the standard fault feature vector with the highest semantic similarity is output as the initial fault inference for network anomalies.

5. The method of claim 4, wherein, The pre-training steps of the multimodal encoder model include: A multimodal pre-training corpus is constructed based on historical network anomaly interface screenshots and voice descriptions. The multimodal pre-training corpus includes multiple related interface screenshot and description text pairs. Construct and initialize a multimodal encoder model containing a visual encoder and a text encoder; A cross-modal contrastive learning task is designed based on a multimodal pre-training corpus. The cross-modal contrastive learning task is used to make correctly paired screenshots and descriptive texts have high similarity in the shared semantic space learned by the multimodal encoder model, and to make unpaired screenshots and texts have low similarity. Multimodal pre-training corpora are input into a multimodal encoder model to optimize the cross-modal contrastive learning task. The multimodal encoder model is iteratively trained so that it learns to map inputs from different modalities to an aligned semantic feature space.

6. The method of claim 1, wherein, Based on the preliminary diagnostic event chain and preliminary fault inference, network entities, system configuration items, and application modules are modeled as nodes and a relationship graph is constructed. The probability of each node being the root cause of the network anomaly is calculated using graph propagation and aggregation algorithms, and the root cause localization result is output, specifically including: A heterogeneous graph is constructed based on a predefined graph pattern. The nodes of the heterogeneous graph represent network entities, system configuration items, and application modules, and the edges of the heterogeneous graph represent dependency, configuration, or conflict relationships between nodes. Based on the preliminary diagnostic event chain and preliminary fault inference, the initial feature vectors of relevant nodes in the heterogeneous graph are assigned and enhanced to embed abnormal context information. The heterogeneous graph after feature injection is input into a pre-built multi-layer graph convolutional network. The multi-layer graph convolutional network performs message propagation and feature aggregation operations layer by layer, so that the feature representation of each node is fused with the association state information of its multi-hop neighborhood, and the final feature representation of each node is output. Based on the final feature representation of each node, a classifier is used to calculate the probability score of each node as the root cause of network anomalies. The nodes are sorted and filtered according to their probability scores, and one or more candidate root cause nodes and their confidence scores are output to obtain the root cause localization results.

7. The method of claim 6, wherein, The construction of heterogeneous graphs based on predefined graph patterns specifically includes: A predefined static graph pattern is used to specify the classification system for node types and the semantic system for edge relationship types. For the target iOS device and target application to be diagnosed, dynamically collect current configuration information, target application composition information and hardware environment information; The current configuration information, target application composition information and hardware environment information collected are instantiated according to the static graph pattern. A corresponding node instance is created for each identified entity, and a corresponding edge instance is created for each pair of related entities. All created node instances and edge instances are integrated to form a complete heterogeneous graph.

8. The method of claim 1, wherein, Based on the root cause localization results, the current network configuration and environmental status of the device are used as input, configuration modification actions are used as output, and network connection recovery speed and stability are used as reward functions. Through interactive exploration, a targeted, personalized configuration optimization suggestion sequence is generated, specifically including: A reinforcement learning model framework is constructed, which encodes the device network configuration, environmental state and root cause localization results as state inputs, defines feasible configuration modification operations as action outputs, and quantifies network recovery speed and stability indicators as reward functions. A device network environment simulator is established. The device network environment simulator is used to receive action commands and simulate the execution of configuration changes. At the same time, it calculates the instant reward according to the reward function and generates a new state. By enabling the reinforcement learning model to interact with the simulator in multiple rounds, the interaction experience is collected to iteratively update the parameters of the reinforcement learning model framework, so that it learns the configuration modification strategy that maximizes long-term cumulative rewards. The root cause localization results are input into the trained reinforcement learning model framework, which outputs a personalized configuration optimization suggestion sequence with the highest expected return.

9. The method of claim 8, wherein, The process of inputting the root cause localization results into the trained reinforcement learning model framework and outputting the personalized configuration optimization suggestion sequence with the highest expected return specifically includes: Receive root cause analysis results and synchronously collect real-time network environment and configuration status of iOS devices; By using a pre-trained state encoder, joint feature extraction and fusion are performed on the root cause localization results and the real-time network environment and configuration state to generate a joint state feature vector that comprehensively represents the current problem and status quo. The joint state feature vector is input into the trained reinforcement learning model framework. Through internal simulated sequential reasoning, multiple candidate configuration modification action sequences are generated, and the expected total benefit of each candidate configuration modification action sequence is evaluated. Select the candidate configuration modification action sequence with the highest expected total benefit from the candidate configuration modification action sequence as the personalized configuration optimization suggestion sequence.

10. An iOS device APP network anomaly intelligent diagnosis and optimization system, characterized in that, The system specifically includes: The network monitoring module is used to monitor the network connection status of the target application. When a network anomaly is detected, it automatically collects the system logs and user operation event sequences of the iOS device. The event diagnosis module is used to parse system logs using a natural language processing model based on the Transformer architecture to identify network error patterns, and to correlate the identified network error patterns with user operation event sequences in a time sequence to form a preliminary diagnostic event chain. The fault inference module is used to extract features and understand semantics from the screenshots and voice descriptions uploaded by users regarding network anomalies, and match them with a preset fault knowledge base to obtain a preliminary fault inference. The root cause localization module is used to model network entities, system configuration items, and application modules as nodes and construct a relationship graph based on the preliminary diagnostic event chain and preliminary fault inference. It calculates the probability of each node as the root cause of network anomalies through graph propagation and aggregation algorithms and outputs the root cause localization results. The configuration optimization module is used to generate a targeted and personalized configuration optimization suggestion sequence based on the root cause localization results, taking the current network configuration and environmental status of the device as the status input, the configuration modification action as the output, and the network connection recovery speed and stability as the reward function.

Images