AI-Driven Self-Healing Enterprise IT Infrastructure
Core enterprise infra craft; strong SRE/NOC storytelling; publishable if you measure blast radius and override behaviour.
Working shortlist shaped for an aviation-industry and enterprise IT infrastructure background. Pick one primary title; do not run ten theses at once. LLM Personalized Tutoring remains the lab’s current primary brief until you lock a replacement.
Core enterprise infra craft; strong SRE/NOC storytelling; publishable if you measure blast radius and override behaviour.
Natural for infra veterans; clear baseline (manual RCA / rules) and metrics (time-to-cause, false cause rate).
Enterprise resilience + aviation continuity culture; measurable against tabletop / failover drills.
Ranked for an aviation-industry and enterprise IT infrastructure background.
Aviation IT (airline ops systems, airport platforms, OT/IT boundaries) needs resilience policies that respect safety culture, change freezes, and escalation — not generic data-center CHAOS scripts.
Best unique fit: aviation industry + IT infra in one title examiners can situate.
A generic “AIOps for any enterprise” paper with an aviation sticker.
Pairs with ops-centre collaboration themes if you keep a HITL chapter.
DR is a planning and sequencing problem under RPO/RTO and dependency graphs. Prediction without recoverable runbooks is incomplete.
Enterprise resilience + aviation continuity culture; measurable against tabletop / failover drills.
Vendor DR feature comparison without a model or experiment.
A twin is a synchronized model used for what-if failure and recovery — power, cooling, network, and workload — not a 3D dashboard.
Strong infra story; needs access to DC telemetry or a high-fidelity lab twin. Touches earlier ODC/resilience interests.
Visual twin with no validated prediction of outage impact.
Self-healing is closed-loop remediation with authority bounds: detect → diagnose → propose/act → verify → learn — under change control and human veto.
Core enterprise infra craft; strong SRE/NOC storytelling; publishable if you measure blast radius and override behaviour.
Auto-remediation demos without audit, rollback, or failure taxonomy.
RCA quality is ranked causal explanation under partial observability — not log summarization. The thesis owns evidence graphs, counterfactuals, and operator trust.
Natural for infra veterans; clear baseline (manual RCA / rules) and metrics (time-to-cause, false cause rate).
ChatGPT-on-logs with thumbs-up evaluation only.
Predict refresh, failure, and licence risk from telemetry and inventory — with procurement and sustainability constraints.
Useful industry problem; harder to find a sharp research gap versus applied ML forecasting.
Asset CMDB reporting with a regression model as the whole contribution.
Identity is the modern perimeter: detect identity threats (token theft, privilege paths, anomalous auth) with analyst-actionable evidence.
Hot and fundable; needs security depth or a co-supervisor. Fits Windows/M365 enterprise programmes on the lab.
Generic IDS accuracy tables without identity-specific threat models.
M365 estates need continuous configuration, identity, and data-risk reasoning that admins can trust — beyond alert dumps.
Practical enterprise scope; risk of looking too vendor-specific unless framed as identity/SaaS security science.
A Microsoft product guide or Pure admin runbook as a thesis.
Placement under cost, latency, residency, and failure domains — with explainable recommendations operators can accept or reject.
Solid enterprise IT topic; crowded field — differentiation must be policy constraints + operator-in-the-loop, not another autoscaler.
Kubernetes autoscaling rebrand with no hybrid or policy novelty.
Enterprise KM is retrieval + governance + evaluation over private corpora — citations, access control, and drift — not a public chatbot.
Overlaps the lab’s RAG/LLM learning themes; crowded unless tied to ops runbooks or aviation manuals with governance.
Vanilla RAG demo on SharePoint with no evaluation harness.
Can support other topics (RCA, tutoring, M365) as a methods chapter — weaker as the sole PhD claim.