Anthena — the network intelligence layer

A layer above the alarm plane that joins every signal by time and site, detects what alarms miss, explains incidents as cause → effect chains an operator reviews — and captures each confirmed explanation as a reusable, named detection.

JOIN

RAN, microwave, routers, TWAMP, power, planned works and tickets — aligned by time and site

EXPLAIN

root-cause chains proposed by the system, confirmed or corrected by operators

CAPTURE

confirmed explanations become named 'symptoms' with precision scores and an audit trail

The idea

Today’s NOC tooling answers “what is alarming?”. Anthena is built to answer the question behind it: “what is actually happening, and why?” It does four things, in order:

1. Join. Every signal — RAN KPIs, microwave links, router state, TWAMP latency, power telemetry, planned works, trouble tickets — is aligned on a common time-and-site backbone. Cross-layer correlation becomes a lookup, not an investigation.

2. Detect. Per-layer models (the production anomaly-detection engine is the first of them) flag departures from each element’s own normal — including the degradations that never trip an alarm threshold.

3. Explain. When something breaks or degrades, Anthena assembles the candidate cause→effect chain across layers — backhaul link degraded → cell starved → customers complaining — and presents it for an operator to confirm, correct or reject.

4. Capture. A confirmed explanation is saved as a symptom: a named, reusable detection with a measured precision score, an owner and an audit history. The next occurrence is recognised in seconds, not re-investigated for hours.

At a glance

Status: In Development

Deployed at: In build with CETIN SK (DarkNOCprogram)

Domain: Dark NOC

Built with: BitSwan pipelines · Cross-layer ontology · ML detectors

Why this design

Most “AI for NOC” pitches try to replace the alarm plane. Anthena deliberately sits above it: alarms keep doing what they’re good at (hard faults), while the intelligence layer covers what they structurally miss — slow degradations, cross-layer causality, and the operational memory that today lives in senior engineers’ heads. Symptom capture is the heart of it: every resolved incident permanently raises the floor, with governance modes controlling whether new symptoms auto-deploy, require review, or run in shadow.

Where it stands

The foundations are in production: the data backbone, the per-element detectors and the operator feedback loop run live at CETIN SK today. Anthena is the build-out of the explain-and-capture layers on top — part of the Dark NOC program, with a use-case catalog (capacity rebalancing, silent-degradation hunting, impact-ranked triage among them) defined and in development.