HARDIK
Back to overviewSystems / Networking / Applied ML

MPLS Predictive Copilot

Air-Gapped Autonomous NOC System

A 7-module air-gapped NOC pipeline combining Containerlab MPLS simulation, Prometheus telemetry, LightGBM impact prediction, NetworkX blast-radius analysis, and a local LLM copilot — zero outbound dependency.

ContainerlabPrometheusLightGBMNetworkXLocal LLMFastAPIStreamlit
7Pipeline modulesfully air-gapped
8Prediction featuresLightGBM time-to-impact model
01MPLS Network
02Telemetry
03LightGBM Prediction
04Blast Radius Analysis
05Local LLM Copilot
06Operator

OVERVIEW

An autonomous network-operations-center copilot that runs entirely air-gapped: a simulated MPLS network generates real telemetry, a gradient-boosted model predicts time-to-impact for developing faults, a graph analysis finds the blast radius and backup paths, and a local LLM turns that into operator-facing guidance — with zero outbound network dependency.

ARCHITECTURE

Containerlab simulates a 4-node MPLS topology (Branch-A, PE-1, PE-2, Branch-B). Telegraf/Prometheus collect multi-signal telemetry (utilization, latency, jitter, packet loss, BGP flaps, OSPF changes). An 8-feature LightGBM model predicts time-to-impact with confidence scoring; NetworkX performs blast-radius and backup-path analysis; a locally-hosted LLM (via Ollama) grounds its answers in runbooks through local TF-IDF retrieval — no cloud API calls anywhere in the loop.

IMPLEMENTATION

FastAPI serves the prediction/analysis backend; a Streamlit dashboard provides real-time gauges, a multi-signal panel, a copilot chat interface, and live fault-injection controls for demoing failure scenarios (progressive congestion, packet loss + latency spikes, BGP route flapping).

RESULTS

Delivers confidence-scored time-to-impact predictions and automatic backup-path discovery entirely within the air-gapped environment, demonstrated across multiple live fault-injection scenarios.

CHALLENGES

Keeping the entire pipeline — telemetry, ML inference, retrieval, and language generation — running with strictly zero outbound dependency, which ruled out cloud LLM APIs and vector database services in favor of a local LLM and local TF-IDF retrieval.