PaperlayerView exact revision on arXiv

Source-linked AI summary

APEX: A Network-Native Time-Series Foundation Model for Forecasting and Anomaly Detection for Wireless Edge Operations

Swadhin Pradhan, Niloo Bahadori, Peiman Amini

arXiv:2606.11553v1cs.LG

TL;DR

General-purpose time-series foundation models transfer poorly to bursty, zero-inflated, cross-layer wireless telemetry. APEX addresses this gap with a network-native decoder-only transformer trained on multivariate enterprise AP telemetry, achieving stronger DHCP forecasting and unified anomaly detection while supporting edge inference. The paper positions network-native pretraining and compact deployment as a practical basis for proactive wireless operations.

  • Problem

    General-purpose time-series foundation models transfer poorly to wireless telemetry because its signals are bursty, zero-inflated, and coupled across protocol layers.

    Source: §1 · p. 1

  • Method

    APEX is a decoder-only transformer pretrained on 10-channel multivariate telemetry from ∼100K AP time series across ∼4,500 production networks.

    Source: §1 · p. 1, §2.3 · p. 2

  • Results

    18% lower DHCP forecasting MAE versus Toto and 38% versus SARIMA, with anomaly-detection F1 = 0.93 from the same checkpoint.

    Source: §1 · p. 1

  • Takeaways & Limitations

    APEX provides network-native forecasting and uncertainty-based anomaly detection, with APEX-Edge running sub-second inference on AP-class hardware without cloud dependency.

    Source: §1 · p. 1, §5 · p. 4

    Evaluation is limited to DHCP degradation, anomaly labels use consensus pseudo-ground-truth rather than human annotation, and edge latency is measured on a Raspberry Pi 5 proxy.

    Source: §5 · p. 4

Abstract

from arXiv · show

Generic time-series foundation models transfer poorly to wireless network telemetry whose signals are bursty, zero-inflated, and coupled across protocol layers. We present APEX, a network-native, decoder-only transformer for forecasting enterprise AP telemetry, and evaluate it on DHCP degradation as a representative network task. APEX is pre-trained on 10-channel multivariate telemetry from ~4,500 production wireless networks (~100K AP time series, 34 metrics per AP), and is available as APEX-Large (269M, cloud) and APEX-Edge (10.5M, edge). On a 192-step (4-day) DHCP degradation benchmark, APEX-Large reduces MAE by 18% over the strongest foundation-model baseline (Toto) and 38% over SARIMA, with anomaly-detection F1 = 0.93, while APEX-Edge enables sub-second, privacy-preserving inference on AP-class edge hardware. These results suggest network-native pre-training is a practical foundation for proactive wireless operations.

1. Introduction

APEX addresses the poor transfer of general-purpose time-series models to bursty, zero-inflated, cross-layer wireless telemetry with a network-native transformer designed for forecasting and edge deployment. On DHCP degradation, it improves forecasting accuracy, unifies anomaly detection, and supports compact AP-side inference.

Motivation

  • Wireless AP failures are difficult to detect proactively because enterprise scale, multi-vendor infrastructure, and cross-layer dependencies complicate diagnosis.AP telemetry is already co-located and time-aligned across DHCP, RF, interface, and uplink layers, but exporting raw data adds bandwidth, privacy, and latency costs.Source: §1 · p. 1
  • Network telemetry is zero-inflated, abrupt during incidents, and shaped by protocol-specific and topology-dependent dynamics absent from typical TSFM pretraining corpora.DHCP degradation is used as a representative cross-layer task because outcomes depend on server behavior and upstream wireless conditions.Source: §1 · p. 1

Approach

  • APEX is a decoder-only transformer trained on 10-channel telemetry from ∼100K AP time series across ∼4,500 production networks.The input combines five DHCP causal-chain targets with five exogenous topology and anomaly signals.Source: §1 · p. 1

Results

  • Anomaly-detection F1 = 0.93 comes from MC-dropout prediction intervals from the same checkpoint, avoiding a separate detection pipeline.The result is competitive with VAR-Mahalanobis at F1 = 0.94.Source: §1 · p. 1

Deployment

  • APEX-Edge has 10.5M parameters and runs in 202 ms on AP-class hardware while keeping raw telemetry on-device.This supports edge deployment alongside the model’s forecasting and anomaly-detection capabilities.Source: §1 · p. 1

2. Methods

APEX uses a two-phase cloud-training and AP-inference pipeline built around aggregated multivariate telemetry, patched transformer modeling, and uncertainty-based anomaly detection. Its methods include two input modalities, two model sizes, and consensus pseudo-ground-truth for evaluation.

System Overview

  • Phase 1 aggregates and preprocesses historical telemetry from ∼4,500 production networks for next-patch pretraining, while Phase 2 runs APEX-Edge locally on AP telemetry.Only compact alerts of ∼KB/day are transmitted, versus ∼130 MB/day for raw telemetry.Source: §2.1 · pp. 1–2

Telemetry

  • Two-stage aggregation rolls server/VLAN observations into per-AP summaries using AVG, MAX / Min, and STDDEV across the server/VLAN dimension.The feature vector contains 34 metrics spanning DHCP protocol, RF, interface errors, and topology.Source: §2.2 · p. 2

Architecture

  • APEX is a decoder-only patched transformer that z-score normalizes inputs, forms P=16-step patches, mixes 10 channels, and predicts the next patch autoregressively.Learned positional embeddings and causal self-attention index and model patch sequences; SwiGLU replaces GELU.Source: §2.3 · p. 2

Uncertainty

  • MC-dropout keeps dropout active for N=50 stochastic passes, using P5/P95 quantiles as prediction intervals without adding parameters.The method provides uncertainty from a single checkpoint for edge deployment.Source: §2.3 · p. 2

Architecture Variants

  • The architecture study crosses two sizes—269M-parameter APEX-Large and 10.5M-parameter APEX-Edge—with 1D and 10-channel multivariate modes.This 2×2 design isolates cross-channel structure from model capacity.Source: §2.4 · pp. 2–3

Anomaly Detection

  • Anomaly detection combines univariate and multivariate methods, including APEX intervals, statistical baselines, Isolation Forest, VAR-Mahalanobis, SARIMAX, and foundation-model ensembles.The dual-mode design evaluates both per-metric and cross-metric anomaly signals.Source: §2.5 · p. 3
  • A timestep is labeled anomalous when at least three independent methods flag it, producing consensus pseudo-ground-truth without manual annotation.The majority vote is intended to reduce false positives from individual methods’ idiosyncrasies.Source: §2.5 · p. 3

3. Experiments

APEX achieves strong forecasting and anomaly-detection performance on DHCP degradation while preserving multivariate accuracy and edge feasibility. Its edge variant combines compact deployment with local, privacy-preserving operation.

Forecasting

  • APEX-Large (multi) achieves the lowest error across all forecasting metrics.The evaluation holds out the last 192 steps, corresponding to four days at 30-minute intervals, per access point.Source: §3.1 · p. 3, §3 · p. 3
  • 12–18% lower MAE separates APEX-Large (multi) from Toto, with the gap attributed to network-native pretraining rather than decoder-only architecture.Both models use decoder-only transformers.Source: §3.1 · p. 3
  • 26× fewer parameters let APEX-Edge (multi) match Toto-class accuracy, with MAE 3.87 versus 3.64.APEX-Edge (1D) instead reaches SARIMA-level performance with MAE 4.78, highlighting the role of multivariate structure.Source: §3.1 · p. 3

Anomaly detection

  • APEX-Large MC-dropout reaches anomaly-detection F1 = 0.93, close to VAR-Mahalanobis at 0.94.The shared forecasting checkpoint supports anomaly detection without a separate detection pipeline.Source: §3.2 · p. 3
  • APEX-Edge achieves anomaly-detection F1 = 0.89 despite 26× fewer parameters and outperforms all general-purpose foundation models.The same checkpoint provides forecasts and calibrated anomaly detection.Source: §3.2 · p. 3

Edge feasibility

  • 202 ms median single-inference latency and 428 MB peak memory support deployment on Raspberry Pi 5-class AP hardware.The measured latency is over 100 trials, with P95 latency of 205 ms.Source: §3.3 · p. 4, Table 4 · p. 4
  • APEX-Edge continues forecasting and anomaly detection during WAN outages without sending raw telemetry off the AP.Only compressed anomaly events and summary statistics are optionally transmitted to the cloud.Source: §3.3 · p. 4

4. Related Work

Prior time-series foundation models perform well on public benchmarks but lack network protocol telemetry in pretraining. APEX addresses this gap while unifying forecasting and anomaly detection for AP-class edge hardware.

Time-series foundation models

  • TimesFM, Chronos, and Toto achieve strong zero-shot transfer on public finance, energy, and weather benchmarks.Their pretraining corpora do not include network protocol telemetry.Source: §4 · p. 4
  • APEX uses a decoder-only, patch-based design in channel-dependent multivariate mode over a protocol-defined causal chain.It is pretrained exclusively on network telemetry.Source: §4 · p. 4

AIOps and network anomaly detection

  • AIOps anomaly systems such as Kitsune treat detection as a standalone task and require task-specific architectures.APEX instead unifies forecasting and anomaly detection in one pretrained checkpoint.Source: §4 · p. 4

Edge ML

  • APEX-Edge targets ARM Cortex-A76-class processors with 1–2 GB RAM, a higher compute tier than MCU-focused edge benchmarks.The paper identifies AP-class multivariate time-series forecasting as lacking an established edge-ML benchmark.Source: §4 · p. 4

5. Conclusion

APEX combines network-native pretraining with a multivariate causal-chain input to support forecasting and uncertainty-based anomaly detection on AP-class hardware. Its reported benefits include sub-second, on-device inference, while evaluation remains limited to DHCP degradation and anomaly labels rely on consensus pseudo-ground truth.

  • APEX uses a single checkpoint for forecasting and uncertainty-based anomaly detection, with the multivariate causal-chain input identified as the key enabler.The same design supports both tasks rather than requiring a separate detection pipeline.Source: §5 · p. 4
  • 26× fewer parameters allow APEX-Edge to match larger general-purpose models while retaining sub-second inference on AP-class hardware.The edge model keeps raw telemetry on-device and avoids cloud dependency.Source: §5 · p. 4
  • APEX is positioned for regulated environments because raw telemetry never leaves the device and data residency is treated as a prerequisite.This practical deployment scope follows from on-device inference and local telemetry processing.Source: §5 · p. 4
  • Evaluation is currently limited to DHCP degradation, while anomaly labels derive from consensus pseudo-ground truth rather than human annotation.The reported edge latency comes from a Raspberry Pi 5 proxy comparable to current AP SoCs, so production-hardware performance remains suggested rather than directly measured.Source: §5 · p. 4

Related papers

Loading 2606.11553v1…