Operational RAN Intelligence & Optimization Network

An autonomous AI-powered Network Operations Center (NOC) for 5G/6G infrastructure — built on a digital twin simulation engine and a multi-agent LangGraph AI pipeline that closes the loop from anomaly detection to verified remediation.

• Digital Twin — SimPy-based 5G RAN simulator generating realistic KPIs (PRB, SINR, latency, throughput) driven by real Milan traffic data
• Multi-Agent AI — Seven specialized agents (Triage → Root Cause → Planner → Safety → Human Approval → Executor → Verifier) running a closed-loop Detect → Decide → Act → Verify cycle
• LLM-Driven Decisions — LLM actively selects remediation actions, adjusts root-cause hypothesis confidence, provides contextual safety review, and generates full post-incident reports
• Anomaly Detection — Background loop scans KPI trends every 30 s and fires early-warning events before thresholds breach
• Human-in-the-Loop — Safety gate interrupts pipeline for operator approval when required; resumes autonomously after decision
• Autonomous NOC — Detects incidents, diagnoses root causes, proposes and executes remediations, rolls back if things get worse, and writes a structured post-incident report
• Web Dashboard — React + Tailwind UI with per-cell multi-line KPI sparklines, live pending-approval panel (polls Redis every 5 s), dark mode, fault injection trigger, and memory store inspector

START → Triage → Root Cause → Planner → Safety ──(ALLOW)──────────────→ Executor → Verifier → END
                                                └─(ALLOW_WITH_APPROVAL)→ Human Approval ──(approved)→ Executor → Verifier → END
                                                └─(DENY / halted)──────→ END

All decisions that affect the network are backed by deterministic guardrails — LLM enriches and decides, rules enforce hard limits.

• M1 — Digital Twin + Telemetry ✅
• M2 — Triage & Root Cause Agents ✅
• M3 — Planner + First Closed Loop ✅
• M4 — Safety Guardrails + Human Approval + Full Autonomy ✅
• M4.5 — LLM-Driven Decisions + Anomaly Detection + Post-Incident Reports ✅
• M5 — 6G Extensions + Reinforcement Learning

git clone https://github.com/L-N-X-1/ORION.git
cd ORION
docker compose up -d

Ollama must be running on the host with a model pulled (default: llama3.2). Override with OLLAMA_MODEL=llama3.2:3b in .env for faster inference.

Services:

Open http://localhost:3000 after docker compose up -d.

Grafana dashboards: http://localhost:3001

Injects a synthetic congestion fault directly into the KPI synthesis layer, fires an event to the agent pipeline, and clears automatically when the agent applies the remediation:

# 1. Inject fault — note the event_id returned
Invoke-WebRequest -Uri http://localhost:8001/fault/inject-agent `
  -Method POST -ContentType "application/json" `
  -Body '{"scenario":"evening_congestion"}' | Select-Object -Expand Content

# 2. Pipeline will return 202 + approve_url if human approval required
#    Approve it:
Invoke-WebRequest -Uri http://localhost:8004/approvals/<incident_id>/decision `
  -Method POST -ContentType "application/json" `
  -Body '{"decision":"approved","approver":"ops@example.com"}' | Select-Object -Expand Content

# 3. Check PRB restored after executor runs
Invoke-WebRequest -Uri http://localhost:8001/metrics | Select-Object -Expand Content

# 4. Restore fault manually if needed (skips agent)
Invoke-WebRequest -Uri http://localhost:8001/fault/restore-agent `
  -Method POST -ContentType "application/json" `
  -Body '{"scenario":"evening_congestion"}' | Select-Object -Expand Content

Invoke-WebRequest -Uri http://localhost:8004/run `
  -Method POST -ContentType "application/json" `
  -Body '{
    "event_id": "test-001",
    "correlation_id": "test-001",
    "event_type": "CONGESTION",
    "entity_id": "C00",
    "severity_hint": "high",
    "sim_time_s": 0,
    "timestamp": "2026-01-01T12:00:00Z"
  }' | Select-Object -Expand Content

A 202 awaiting_approval response means the pipeline paused at the human approval gate. Use the approve_url from the response body to resume.

Download the Milan mobile phone activity dataset from Kaggle and place the CSV files under /data/csv/:

https://www.kaggle.com/datasets/marcodena/mobile-phone-activity

Expected directory structure:

orion/
└── data/
    └── csv/
    └── telecom/

The twin natively supports the Italian Telecom 2013 dataset and any compatible CSV sharing the same schema:

Any CSV that follows this column structure is accepted — the loader is not hardcoded to the Italian Telecom source.

Each entry: CellID:filepath:FilterColumn:FilterValue:DataType, pipe-separated:

DATASET_SOURCES=C00:/data/telecom.csv:CellID:4455:internet|C01:/data/telecom.csv:CellID:4456:internet|C10:/data/telecom.csv:CellID:5055:internet|C11:/data/telecom.csv:CellID:5056:internet

The digital twin produces the following KPIs per cell, every ~5 seconds:

After every completed pipeline run the Verifier generates a structured LLM report containing:

• Incident summary — type, severity, affected cells, detection time
• Root cause — dominant hypothesis, confidence score, supporting KPIs
• Action taken — action type, parameters, planner rationale, approval source
• KPI comparison — before → after table (PRB, latency, throughput, SLA, HO fail rate)
• Outcome — SUCCESS / REGRESSION + rollback note if applicable
• Lessons learned — LLM-generated takeaways

Report is stored in VerificationReport.postmortem and printed to agent logs at INFO level.

Follow along on LinkedIn as I build this milestone by milestone.

Built as a home lab project exploring 5G network automation and agentic AI.