AI and Machine Learning in Network Operations

What it is

AI and machine learning help engineers handle the huge volume of data a network produces, which people cannot read in full.

Artificial intelligence (AI) is software that performs tasks which normally need human judgement, such as recognising patterns, making predictions or producing text. Machine learning (ML) is a part of AI in which a system learns from data instead of following only fixed rules written by a programmer.

Networks produce logs, counters, flow records, alerts and tickets. Software can read all of it. This topic explains the two kinds of AI that the objective names, predictive and generative, and where each is useful.

How it works

A model is trained on past data, and then either predicts what will happen or generates new content.

Machine learning basics

An ML system is trained on historical data. During training, it finds patterns in the data and builds a model.

Later, in inference, it applies the model to new data. The quality of the model depends heavily on the quality and quantity of the data it was trained on. Poor data produces poor results.

Common approaches include:

• Supervised learning: training on examples that are labelled with the right answer, such as past incidents marked as "link failure".
• Unsupervised learning: finding structure in data without labels, such as grouping similar behaviour together.
• Reinforcement learning: learning by trial and reward.

Predictive AI

Predictive AI uses models trained on past data to forecast what is likely to happen, or to spot what is unusual. It works with numbers and patterns. Examples in networking include:

• Anomaly detection: learning what normal traffic looks like for a site, and flagging deviations that could signal a fault or an attack.
• Failure prediction: noticing early signs, such as rising error counts, that a link or a device is about to fail.
• Capacity planning: forecasting when a link will fill up, so it can be upgraded in time.
• Baselining: building a picture of normal performance, so that alerts are triggered by real changes and not by fixed thresholds.
• Root cause analysis: correlating many alerts to find the one underlying problem.
• Wireless optimisation: adjusting channels and power based on observed conditions.

Controllers such as Cisco Catalyst Center include analytics of this kind to help with assurance.

Generative AI

Generative AI produces new content from a prompt. The best-known form is the large language model (LLM), which generates text, code and summaries in natural language. Examples in networking include:

• Natural-language assistants: an engineer asks "which access points had problems last night?" in plain words, and the assistant answers from network data.
• Summarising: turning a long log file or incident history into a short explanation.
• Drafting configuration and scripts: suggesting a template or an automation script from a description.
• Documentation: writing or updating network documentation and change descriptions.
• Troubleshooting guidance: proposing likely causes and next steps.

Comparing the two

Limits and risks

AI is useful, but it must be used with care.

• Wrong or invented answers. Generative models can produce confident answers that are wrong. These are sometimes called hallucinations. A generated configuration must be checked before it is applied.
• Data privacy. Logs and configurations can contain sensitive details. Sending them to an external AI service may expose them.
• Bias and quality of data. A model trained on limited or poor data gives limited or poor answers.
• False alarms and missed events. Predictive models are not perfect.
• Explainability. It may be hard to understand why a model reached its answer.
• Accountability. The engineer remains responsible for what is changed in the network.

For these reasons, AI is best treated as an assistant. It speeds up analysis and drafting, and a person reviews and approves actions, especially any change to a production network.