Explain AI (generative and predictive) and machine learning in network operations

This objective is new in CCNA v1.1 (the 2024 blueprint revision). It does not expect you to build models; it expects you to know the vocabulary and to recognize what each kind of AI is good for in a network operations (NetOps) context.

Machine learning basics

Artificial intelligence (AI) is the broad field of making computers do things that normally require human intelligence. Machine learning (ML) is the most practical branch of AI today: instead of a programmer writing explicit rules, the computer is fed large amounts of data (training data) and finds the patterns itself, producing a model that can then make predictions or decisions about new data.

There are three classic learning styles you should recognize:

Some key points about ML in general: the quality of the model depends on the quality and quantity of the training data; a model trained on one network may not be accurate on a different one; and models must be retrained as conditions change. Cisco’s cloud-based analytics get their strength from having anonymized telemetry from many customer networks to train on.

Predictive AI

Predictive AI uses ML models to look at historical and real-time data and forecast what will happen or detect that something unusual is happening. In NetOps this is the older, more established use of AI, and it is the engine behind what the industry calls AIOps (AI for IT operations).

Typical predictive AI capabilities:

• Baselining: the system learns what “normal” looks like for each device, link, and site (for example, normal CPU at 2 p.m. on a Tuesday, normal wireless client counts, normal latency to the data center). Baselines are learned per network rather than set as fixed thresholds by a human.
• Anomaly detection: alerting when current behavior deviates significantly from the baseline, such as a sudden jump in DHCP failures or a link whose error rate is creeping up. This catches problems that fixed thresholds miss.
• Failure prediction: forecasting that a component is likely to fail, for example an optical transceiver whose power levels are trending downward, or a switch whose memory usage is rising toward exhaustion.
• Capacity forecasting: projecting when a WAN link, a wireless cell, or an uplink will run out of capacity so it can be upgraded before users complain.
• Root-cause correlation: correlating many symptoms (hundreds of syslog messages, dozens of alerts) into a single probable cause and suggesting a fix.
• Trend comparison: comparing your network’s performance to anonymized peer networks to answer “is this normal?”

In Cisco’s portfolio, Catalyst Center Assurance and AI Network Analytics provide these functions for the campus. Cisco’s wireless products use ML-based Radio Resource Management (RRM) to select channels and power. Cisco ThousandEyes and Meraki dashboards also apply predictive analytics to path and application performance.

Generative AI

Generative AI (GenAI) is the newer category. Instead of predicting a number or a label, a generative model creates new content: text, code, images, or configuration. The most familiar examples are large language models (LLMs), which are trained on enormous amounts of text and can understand and produce natural language.

Typical generative AI uses in NetOps:

• Natural-language queries: asking a controller in plain English, “which access points in Building 3 have had the most client disconnects this week?”, and getting an answer or a generated report instead of navigating menus.
• Configuration generation: describing what you want (“create an ACL that permits only HTTPS and DNS from VLAN 20 to the server subnet”) and receiving candidate CLI, Ansible, or Terraform code.
• Summarization: condensing long trouble tickets, syslog bursts, or change histories into a readable summary.
• Documentation and explanation: explaining what an existing configuration does, or drafting a change request.
• Conversational troubleshooting assistants: chat-style help that walks an engineer through diagnosing a problem, drawing on the vendor’s documentation and the network’s live data.

Cisco’s example is the AI Assistant in Catalyst Center and in Cisco’s security and collaboration products, along with the broader Cisco AI Assistant for Networking.

The main risk of generative AI: hallucination

Generative models produce output that is plausible, not necessarily correct. When a language model confidently invents a command that does not exist, cites a nonexistent RFC, or produces a configuration that looks right but has a wrong subnet mask, this is called a hallucination. Because network changes can cause outages, the rule is simple: AI-generated configuration must always be validated by a human and tested before being deployed. Other concerns include data privacy (what network data is being sent to a cloud model), the fact that a model’s knowledge may be out of date, and the possibility of subtle security weaknesses in generated code.

Predictive versus generative at a glance