AI and machine learning in networking: concepts, real uses and safe adoption

The words, untangled

Artificial intelligence (AI) is the broad idea of computers doing things that normally need human intelligence. Machine learning (ML) is the main way this is done today: instead of writing every rule, you give a program data and it learns the patterns. Deep learning is ML with large neural networks, and generative AI, including large language models (LLMs), uses deep learning to produce new text, code or images.

• Supervised learning uses labelled examples, such as flows marked "normal" or "malware", to classify new data.
• Unsupervised learning has no labels; it groups similar things and spots outliers, which suits network data where nobody has labelled every event.
• Reinforcement learning tries actions and learns from the results, for example tuning a setting to improve a measure.

The general theory is covered in AI and machine learning basics; here we focus on network operations.

Why networks are a good fit

A medium-sized network produces millions of data points a day: interface counters, flow records, syslog messages, Wi-Fi client events and application response times. People cannot watch all of it, and fixed thresholds ("alert at 80 percent") either miss real problems or create floods of false alarms. ML is good at learning what is normal for each link, each hour and each day of the week, and pointing at what is not.

Real uses today

• Dynamic baselines and anomaly detection: the system learns that the library Wi-Fi is busy at 10:00 on Mondays and alerts only when behaviour is unusual for that time.
• Event correlation and root cause: one failed core link can trigger hundreds of alarms; ML groups them and suggests the likely cause. This is part of what is called AIOps.
• Predictive maintenance: rising error counts or optic power drifting out of range can warn of a failure before users notice.
• Wireless optimisation: radio resource management uses learned patterns to choose channels and power levels.
• Security: network detection tools model normal traffic and flag unusual connections, such as a printer suddenly talking to an unknown internet address.
• Assistants: vendors now build LLM-based assistants into management platforms, so you can ask "which access points had the most client failures yesterday?" or get a draft configuration.

Limits and safe adoption

• Garbage in, garbage out: models need clean, complete telemetry and accurate time stamps. Fix monitoring first.
• False positives: anomalies are not always problems. Tune alerts and give feedback so the system improves.
• Hallucinations: LLMs can produce commands that look right but are wrong for your platform or dangerous. Treat every generated configuration as a draft, test it in a lab, and apply it through normal change control.
• Data protection: configurations and logs contain addresses, names and sometimes secrets. Check where an AI service stores and processes data before you paste anything in, and follow your organisation's policy.
• Accountability: automation can act on AI suggestions, but start with "recommend" mode and keep a human approving changes until trust is earned.

Real-world example: fewer alarms at a school trust

A fictional trust running twelve schools had a two-person network team receiving several hundred monitoring alerts a week, most of them harmless. They turned on the ML-based baselining in their management platform and left it in learning mode for a month. After that, alerts based on fixed thresholds were replaced with "unusual for this time" alerts, and related alarms were grouped into single incidents. Weekly alerts dropped to a few dozen, and the first genuine catch was a school's internet link whose latency crept up every afternoon, traced to a faulty provider router. The team also tried an AI assistant for drafting switch configurations, but only after agreeing a rule that every draft is reviewed and tested before use.