Not OP that you asked, but I've used ai before to examine netflow data at the head of a medium sized network and identify malicious traffic via netflow anomaly, rather than the signature based methods that are used by current network intrusion detection systems. It's effectiveness is contingent on having good data that contains labeled malicious packets to train on, but it was pretty dope in lab conditions to watch a graduate ethical hacking class try to compromise my testbed network and my best performing ai powered intrusion detection algorithms were able to accurately flag something like 90% of the malicious traffic.

If we had an organization dedicated to creating like a modern version of the NSL-KDD dataset every 6 months or so I think this type of network intrusion detection system would be extremely effective.