AIOps: AI for Network Operations Complete Guide 2026

# Anomaly detection with Prophet
from prophet import Prophet
import pandas as pd

# Network traffic data
df = pd.DataFrame({
    'ds': pd.to_datetime(timestamps),
    'y': network_traffic_values
})

model = Prophet(
    changepoint_prior_scale=0.05,
    seasonality_mode='multiplicative'
)
model.fit(df)

# Predict and detect anomalies
forecast = model.predict(df)
anomalies = df[abs(df['y'] - forecast['yhat']) > 2 * forecast['yhat_upper']]

# K-means clustering for alert grouping
from sklearn.cluster import KMeans
from sklearn.preprocessing import StandardScaler

# Feature extraction from alerts
features = extract_features(alerts)
scaler = StandardScaler()
features_scaled = scaler.fit_transform(features)

# Cluster similar alerts
kmeans = KMeans(n_clusters=10)
clusters = kmeans.fit_predict(features_scaled)

# Log anomaly detection with NLP
from transformers import AutoTokenizer, AutoModelForSequenceClassification

tokenizer = AutoTokenizer.from_pretrained('log-anomaly-detector')
model = AutoModelForSequenceClassification.from_pretrained('log-anomaly-detector')

def detect_log_anomaly(log_message):
    inputs = tokenizer(log_message, return_tensors='pt')
    outputs = model(**inputs)
    is_anomaly = outputs.logits[0][1] > 0.5
    return is_anomaly

# Collecting network telemetry
from prometheus_client import start_http_server, CollectorRegistry
from snmp_library import SNMPEngine

class NetworkMetricsCollector:
    def __init__(self, targets):
        self.targets = targets
        self.snmp = SNMPEngine(targets)
    
    def collect_metrics(self):
        metrics = {}
        for target in self.targets:
            # Collect interface statistics
            ifStats = self.snmp.get_bulk(
                '1.3.6.1.2.1.2.2.1'  # IF-MIB
            )
            metrics[target] = ifStats
        
        return metrics
    
    def analyze_traffic_patterns(self, metrics):
        # Detect anomalies
        return self.ml_model.detect_anomalies(metrics)

# Prometheus configuration for network metrics
global:
  scrape_interval: 15s

scrape_configs:
  - job_name: 'network-devices'
    static_configs:
      - targets: ['router1:9100', 'switch1:9100', 'switch2:9100']
    metrics_path: '/snmp'
    
  - job_name: 'network-flows'
    static_configs:
      - targets: ['flow-collector:2055']
    relabel_configs:
      - source_labels: [__meta_netbios_name]
        target_label: device

# Network anomaly detection model
import numpy as np
from sklearn.ensemble import IsolationForest
from sklearn.preprocessing import StandardScaler

class NetworkAnomalyDetector:
    def __init__(self):
        self.scaler = StandardScaler()
        self.model = IsolationForest(
            contamination=0.01,
            n_estimators=100
        )
    
    def train(self, historical_data):
        # Normalize features
        X = self.scaler.fit_transform(historical_data)
        
        # Train anomaly detector
        self.model.fit(X)
        
        # Determine normal baseline
        self.baseline = X.mean(axis=0)
    
    def detect(self, current_metrics):
        X = self.scaler.transform([current_metrics])
        prediction = self.model.predict(X)
        anomaly_score = self.model.score_samples(X)
        
        return {
            'is_anomaly': prediction[0] == -1,
            'score': anomaly_score[0],
            'deviation': np.abs(X[0] - self.baseline).max()
        }

# Intelligent alert correlation
class AlertCorrelator:
    def __init__(self):
        self.knowledge_base = self.load_knowledge_base()
        self.ml_model = self.load_correlation_model()
    
    def correlate(self, alerts):
        # Group by time window
        time_groups = self.group_by_time(alerts, window='5m')
        
        correlated = []
        for group in time_groups:
            # Find related alerts
            related = self.find_related(group)
            
            if len(related) > 1:
                # Create incident from related alerts
                incident = self.create_incident(related)
                correlated.append(incident)
        
        return correlated
    
    def find_related(self, alerts):
        # Use ML to find related alerts
        features = self.extract_features(alerts)
        clusters = self.ml_model.predict(features)
        
        # Group by cluster
        related_groups = {}
        for alert, cluster in zip(alerts, clusters):
            related_groups.setdefault(cluster, []).append(alert)
        
        return list(related_groups.values())

# AIOps automation playbook
apiVersion: actions.scheduler.net/v1
kind: Playbook
metadata:
  name: network-high-cpu-remediation
spec:
  trigger:
    condition: cpu_usage > 90 for 5 minutes
    source: network_metrics
  
  steps:
    - name: check_current_load
      action: network.get_device_metrics
      inputs:
        device: "{{ trigger.device }}"
      outputs:
        current_load: "{{ result.cpu_usage }}"
    
    - name: identify_heavy_flows
      action: network.get_top_talkers
      inputs:
        device: "{{ trigger.device }}"
      outputs:
        top_flows: "{{ result.flows }}"
    
    - name: apply_qos_policy
      when: "{{ steps.identify_heavy_flows.top_flows[0].bandwidth }} > 80%"
      action: network.apply_qos
      inputs:
        device: "{{ trigger.device }}"
        policy: |
          class-map match-any high-priority
            match dscp ef
          policy-map throttle
            class high-priority
              priority percent 30
    
    - name: notify_engineer
      action: notification.send
      inputs:
        channel: "#netops"
        message: |
          Auto-remediation applied to {{ trigger.device }}
          Cause: High CPU from {{ steps.identify_heavy_flows.top_flows[0].source }}
          Action: QoS policy applied

# Prometheus + AlertManager + Ansible
# A basic open-source AIOps pipeline

apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: network-anomaly-rules
spec:
  groups:
  - name: network_anomalies
    rules:
    - alert: HighNetworkLatencyAnomaly
      expr: |
        abs(network_latency - avg_over_time(network_latency[1h]))) 
        > 3 * stddev_over_time(network_latency[1h])
      for: 5m
      labels:
        severity: warning
      annotations:
        summary: "Network latency anomaly detected"
        description: "Latency deviation {{ $value }}ms from normal"

---
apiVersion: monitoring.coreos.com/v1alpha1
kind: AlertmanagerConfig
metadata:
  name: aiops-routing
spec:
  route:
    groupBy: ['alertname', 'severity']
    groupWait: 30s
    groupInterval: 5m
    repeatInterval: 4h
    receiver: 'aiops-automation'
  receivers:
  - name: 'aiops-automation'
    webhookConfigs:
    - url: 'http://automation-engine/ingest'

def calculate_aiops_roi(baseline_mttr, current_mttr, incidents_per_month, 
                       engineer_cost_per_hour, implementation_cost):
    # Time saved per incident
    time_saved_hours = (baseline_mttr - current_mttr) / 60
    
    # Monthly savings
    monthly_savings = incidents_per_month * time_saved_hours * engineer_cost_per_hour
    
    # Annual savings
    annual_savings = monthly_savings * 12
    
    # ROI
    roi = ((annual_savings - implementation_cost) / implementation_cost) * 100
    
    return {
        'monthly_savings': monthly_savings,
        'annual_savings': annual_savings,
        'roi_percent': roi,
        'payback_months': implementation_cost / monthly_savings
    }

# LLM-powered network assistant
from langchain_core.prompts import ChatPromptTemplate
from langchain_openai import ChatOpenAI

prompt = ChatPromptTemplate.from_template("""You are a network operations assistant.

Current network status:
{network_status}

Recent alerts:
{alerts}

The user asks: {question}

Provide a helpful response with specific actions if needed.""")

llm = ChatOpenAI(model="gpt-4o")
chain = prompt | llm

# Example interaction
response = chain.invoke({
    "network_status": "All systems operational. 3 minor alerts.",
    "alerts": "1. High latency on router-us-east-1 (resolved)\n2. Memory warning on switch-dc2 (monitoring)",
    "question": "Why did we have high latency in us-east-1?"
})