Journey Towards Autonomous Network Operations with AI/ML and Dark NOC

bt · Telecommunications · year n/a · source Agentic: yes · promotional bias: med · source-backed · extracted with prompt 0.5.6 (schema v2)

Generated from extraction.json — do not edit by hand. Every claim cites verbatim source evidence; stated means the quote directly asserts the claim, implied means it supports it indirectly.

Problem

Domain: Telecommunications network operations and autonomous NOC transformation

BT wants to modernize mobile network operations from siloed, manual monitoring toward a DarkKnock vision where networks self-heal, self-optimize, and use AI/ML to analyze data, detect anomalies, perform root cause analysis, and predict failures. The immediate problem is not model choice but the scale, fragmentation, and quality of network data and the organizational shift from network engineering to software-driven operations.

Constraints:

Architecture

BT's approach with AWS starts by fixing network data: cleaning petabytes of element-manager output, creating sensible data architecture, opening access across silos, building a network/knowledge graph, and turning data into governed data products. On top of that foundation, BT plans an AI continuum where traditional ML and generative AI work together in an agentic AI framework. Target use cases include automated data analysis, root cause analysis, service impact analysis, anomaly detection, predictive maintenance, radio network optimization, and eventually application-aware networking. Machines may make immediate continuity decisions while humans investigate deeper design or failure causes.

Diagram confidence: reconstructed (reconstructed from prose).

flowchart LR
  Network_element_data_sources["Network element data sources"] --> Network_management_services["Network management services"]
  Network_management_services --> Bespoke_monitoring_tools["Bespoke monitoring tools"]
  Network_element_data_sources --> Data_cleaning_architecture["Data cleaning architecture"]
  Data_cleaning_architecture --> Knowledge_graph_topology["Knowledge graph topology"]
  Knowledge_graph_topology --> Governed_data_products["Governed data products"]
  Governed_data_products --> AI_continuum_models["AI continuum models"]
  AI_continuum_models --> Agentic_AI_framework["Agentic AI framework"]
  Bespoke_monitoring_tools --> Unified_monitoring_intelligence["Unified monitoring intelligence"]
  Agentic_AI_framework --> Unified_monitoring_intelligence
  Agentic_AI_framework --> Machine_continuity_decisions["Machine continuity decisions"]
  Machine_continuity_decisions --> Containerized_network["Containerized network"]
  Machine_continuity_decisions --> Human_network_experts["Human network experts"]
  Unified_monitoring_intelligence --> Human_network_experts
  Agentic_AI_framework --> Application_aware_networking["Application-aware networking"]
Drag to pan · scroll or use +/− to zoom · reconstructed from the source's described component topology

Components

Component Role Interacts with
Network element data sources Radio sites, gateways, IP network, distributed core, IMS, and element managers producing operational data. Network management services, Data cleaning architecture
Network management services Existing monitoring layer receiving element-manager data and supporting SNMP/syslog workflows. Network element data sources, Bespoke monitoring tools
Bespoke monitoring tools Hundreds of function-specific tools that BT wants to consolidate into broader intelligence. Network management services, Unified monitoring intelligence
Data cleaning architecture Foundational phase that cleans network data and makes it usable before prediction or AI/ML. Network element data sources, Knowledge graph topology
Knowledge graph topology Network graph/topology/discovery layer that connects previously siloed network data. Data cleaning architecture, Governed data products, AI continuum models
Governed data products Shared data assets governed across the organization instead of replicated across units. Knowledge graph topology, AI continuum models
AI continuum models Traditional ML and generative AI models selected by task and orchestrated together. Governed data products, Agentic AI framework
Agentic AI framework Coordinates ML and GenAI capabilities for RCA, service-impact analysis, anomaly detection, prediction, and automated analysis. AI continuum models, Unified monitoring intelligence, Machine continuity decisions
Unified monitoring intelligence Planned larger monitoring system that consolidates tool output and automates network data analysis. Bespoke monitoring tools, Agentic AI framework, Human network experts
Machine continuity decisions Automated decision path intended to keep service running, such as traffic movement away from faulty nodes. Agentic AI framework, Containerized network, Human network experts
Containerized network Modern network substrate where traffic can be shifted from faulty nodes to working nodes. Machine continuity decisions
Human network experts Radio, core, transmission, IMS, device, and software-skilled engineers who investigate failures, design issues, and process automation. Unified monitoring intelligence, Machine continuity decisions
Application-aware networking Future vision where the network adjusts itself for the applications customers use. Agentic AI framework, Machine continuity decisions

Data flow

Network elements push data into network management services, where BT currently monitors with SNMP and syslog expertise across silos. The modernization path cleans and structures that data, opens access across disparate systems, builds topology/knowledge graphs and data products, then runs ML and GenAI models in an agentic AI framework. The framework supports analysis, RCA, service-impact analysis, anomaly detection, predictive maintenance, and optimization. For continuity events, machines are intended to keep the network running while humans investigate why the failure happened.

4 supporting quotes
“every element manager pushes data into network management services and from there, then we know how to either use basic SNMP to monitor the network and get loads of syslogs”transcript, stated
“take the data that comes out of network in petabytes and petabytes and try to clean that data and make sense out of that data that comes out.”transcript, stated
“creating that knowledge graph, as we call it, in order to power the AI and the Gen AI on top of that.”transcript, stated
“because there are ML models, and then there are Gen AI models, but they need to work in unison in an agentic AI framework”transcript, stated

Why this architecture

BT is deliberately sequencing data foundations before autonomy because the network is too large, siloed, and domain-specific for AI to succeed on dirty or inaccessible data. The architecture uses knowledge graphs and governed data products to make operational data usable, then applies the right AI tool for each task: rules for simple event decisions, ML for prediction/classification, and GenAI for more complex reasoning. Human experts remain responsible for deeper diagnosis and design judgments.

4 supporting quotes
“So first we have to fix data. We are in that journey with AWS at the moment to accelerate fixing data.”transcript, stated
“This is way before we predict anything. So where the ML or the AI stuff comes out.”transcript, stated
“you've got to use the right tool for the right job. And there are certain areas where ML models do a very good job versus somewhere, generative AI is proving its value as well.”transcript, stated
“So if the machines can make that, whilst then the humans go figure out why it failed, was it a design issue or not, is the key.”transcript, stated

Models used: traditional ML models · generative AI models · agentic AI framework · AI continuum · knowledge graph · predictive analysis models

Scale

Alternatives considered (roads not taken)

Apply AI before fixing network data

Rejected because: BT says data cleaning and architecture must happen before prediction or AI/ML.

“So first we have to fix data. We are in that journey with AWS at the moment to accelerate fixing data.”transcript, stated
“This is way before we predict anything. So where the ML or the AI stuff comes out.”transcript, stated

Keep many function-specific monitoring tools

Rejected because: BT wants a larger intelligence system that consolidates tools and automates analysis.

“move away from having hundreds and hundreds of tools that are very bespoke for a function”transcript, stated
“create a bigger network monitoring system, or whatever you wanna call it, we don't have a name for it yet, but that consolidate all these tools”transcript, stated

Use generative AI as the universal solution

Rejected because: AWS frames the system as an AI continuum where ML and GenAI are selected for the right job.

“there are ML models, and then there are Gen AI models, but they need to work in unison in an agentic AI framework”transcript, stated
“you've got to use the right tool for the right job.”transcript, stated

Fully replace human operators with machines

Rejected because: The described division is machines keeping service going while humans analyze why failures occurred.

“So if the machines can make that, whilst then the humans go figure out why it failed, was it a design issue or not, is the key.”transcript, stated

Patterns

data-quality-loop (data)

BT treats data cleaning, architecture, access, data products, and governance as the prerequisite for any AI/ML or autonomous operations work.

“take the data that comes out of network in petabytes and petabytes and try to clean that data and make sense out of that data that comes out.”transcript, stated
“creating data products, that's a huge thing, around governing data across organization to make sure that these, the data as an asset, can be shared”transcript, stated

model-routing (architecture)

The AI continuum chooses between traditional ML, GenAI, and simpler rules based on the job rather than forcing one model family onto every network problem.

“there are ML models, and then there are Gen AI models, but they need to work in unison in an agentic AI framework”transcript, stated
“some of our problems, we have very basic wall-do statements that can make a decision on an event that happened.”transcript, stated

tool-use-orchestration (operations)

The target system consolidates many bespoke network tools, topology/discovery services, data products, analytics, ML, and GenAI into a unified operations intelligence layer.

“create a bigger network monitoring system, or whatever you wanna call it, we don't have a name for it yet, but that consolidate all these tools”transcript, stated
“we are helping with all of the services around the network graph that we provide, the topology that we create, the discovery that we can provide, and then on top of that, the analytics”transcript, stated

observability-tracing (operations)

The transformation is built around making network telemetry, syslogs, topology, anomalies, and service-impact signals accessible for automated analysis.

“every element manager pushes data into network management services and from there, then we know how to either use basic SNMP to monitor the network and get loads of syslogs”transcript, stated
“root cause analysis, and the service impact analysis, anomaly detection we have talked about, and then using all of this to start forecasting and doing predictive maintenance”transcript, stated

human-in-the-loop-gate (governance)

The autonomous-operations vision still assigns humans to investigate failures and design issues after machines act to preserve service continuity.

“So if the machines can make that, whilst then the humans go figure out why it failed, was it a design issue or not, is the key.”transcript, stated

Tradeoffs

Start with data foundations before autonomous AI.

Chose data cleaning, architecture, graph, governance, and upskilling over jumping directly to predictive or GenAI automation.

Rationale: BT says prediction and AI come after the data is cleaned and made sensible.

“So build the foundations, and the foundations for me, two pillars, upskilling your team and really work with partners such as AWS to build the data, clean the data.”transcript, stated
“once we have a clean data, then we can introduce software engineering techniques, and machine learning is part of that”transcript, stated

Consolidate monitoring intelligence instead of maintaining specialized tool silos.

Chose a broader network monitoring/intelligence system over hundreds of bespoke function-specific tools.

Rationale: Consolidation should make data analysis more automated and reduce tool demand.

“move away from having hundreds and hundreds of tools that are very bespoke for a function”transcript, stated
“really have this big intelligence system that can help, you know, getting the data out of the network and reduce our demand for having so many tools”transcript, stated

Use a mix of rules, ML, and GenAI.

Chose AI continuum with the right tool for the job over forcing every event into a generative AI workflow.

Rationale: Some event decisions can be simple rules, some are better ML predictions, and some may benefit from GenAI reasoning.

“some of our problems, we have very basic wall-do statements that can make a decision on an event that happened.”transcript, stated
“there are certain areas where ML models do a very good job versus somewhere, generative AI is proving its value as well.”transcript, stated

Let machines handle immediate continuity while humans diagnose root causes.

Chose machine action for keeping the network running plus human investigation over fully autonomous diagnosis and remediation with no expert follow-up.

Rationale: BT wants machines to protect service availability, but humans still need to understand whether failures reflect design issues or other root causes.

“bring the people's expertise to make a decision to keep the network going.”transcript, stated
“whilst then the humans go figure out why it failed, was it a design issue or not, is the key.”transcript, stated

Gotchas (what bit them)

AI automation cannot compensate for dirty or inaccessible network data.

Root cause: The network produces petabytes of data across element managers, silos, and management systems, but it must be cleaned and structured first.

Resolution: BT and AWS start with data cleaning, sensible architecture, topology, discovery, and knowledge graphs before prediction.

“So first we have to fix data. We are in that journey with AWS at the moment to accelerate fixing data.”transcript, stated
“This is way before we predict anything. So where the ML or the AI stuff comes out.”transcript, stated

Domain expertise has to be translated into data and models.

Root cause: Network problems span radio, core, transmission, IMS, and devices, and expert reasoning is distributed across specialized teams.

Resolution: BT plans upskilling plus data/model representations that encode domain knowledge for automated decisions.

“to understand how the radio network works, to understand how the core, how the transmission network, how the IMS, how the devices work”transcript, stated
“you need a radio engineer, you need a core engineer who understands this technology, and understand how to make sense out of data.”transcript, stated

Tool sprawl prevents holistic root-cause analysis.

Root cause: Hundreds of bespoke tools observe functions or modules independently, making cross-domain correlation hard.

Resolution: BT wants a bigger monitoring/intelligence system that consolidates tools and automates data analysis.

“hundreds and hundreds of tools that are very bespoke for a function, right? So you have number of tools that are really look after a module or a function in the network”transcript, stated
“Consolidating tools, and really make data analysis as automated as possible.”transcript, stated

Autonomy is a journey, not a one-time system launch.

Root cause: DarkKnock requires data foundations, upskilling, process cleanup, AI/ML, prediction, and ongoing optimization.

Resolution: The speaker frames DarkKnock as a vision and continuous improvement program with foundations currently being built.

“It's a vision, dark knock is a vision. People have written books about it. Automation is a vision. And I think it's something that is never ending.”transcript, stated
“together we're building the foundations at the moment.”transcript, stated

Predictive maintenance must serve both service continuity and security.

Root cause: Network anomalies may be operational failures or security events such as unexpected container access.

Resolution: BT includes anomaly detection and predictive analysis in the DarkKnock roadmap.

“Can I predict that something's about to fail? And cannot prevent it. And this is not only good for continuity of service, but it's also very good for cyber.”transcript, stated
“Is an anomaly happening in this network? Did a container just got access through something that maybe a basic ARBACs could stop it?”transcript, stated

Evaluation

The transcript does not describe a deployed evaluation harness or production metrics for the DarkKnock system. The evaluation stance is roadmap-oriented: first build data foundations and upskill teams, then use analytics, RCA, service-impact analysis, anomaly detection, predictive maintenance, and optimization to measure operational value. Success is framed around service continuity, lower operations cost, better monetization, and more automated data analysis.

Metrics: data cleanliness and accessibility · network graph/topology completeness · automated data analysis coverage · root cause analysis support · service impact analysis support · anomaly detection · predictive maintenance · cost of operations · continuous service availability · radio network optimization

4 supporting quotes
“root cause analysis, and the service impact analysis, anomaly detection we have talked about, and then using all of this to start forecasting and doing predictive maintenance”transcript, stated
“using all of this to start forecasting and doing predictive maintenance, and ultimately reducing the cost of operations”transcript, stated
“we want for everybody to be connected in the most safest manner for the applications that they're using, right? So that continuous service availability is very important for us.”transcript, stated
“optimization of network is another major key which comes through prediction, predictive analysis of the radio network.”transcript, stated

Outcomes

BT describes one of the largest UK mobile networks, with thousands of radio sites, thousands of gateways, a huge IP network, massive distributed core and IMS networks, petabytes of network data, hundreds of bespoke tools, and a next-two-years roadmap focused on data foundations and upskilling before deeper AI/ML automation.

4 supporting quotes
“we have one of the largest networks in UK and we have thousands of radio sites, we have thousands of gateways, a huge IP network”transcript, stated
“It's a vision, dark knock is a vision. People have written books about it. Automation is a vision.”transcript, stated
“The second one is upskilling the team, having the team to understand how all these new technology works”transcript, stated
“we have this vision of application aware networking that the network adjusts itself for the applications that you use.”transcript, stated