Source-linked AI summary
APEX: A Network-Native Time-Series Foundation Model for Forecasting and Anomaly Detection for Wireless Edge Operations
Swadhin Pradhan, Niloo Bahadori, Peiman Amini
TL;DR
General-purpose time-series foundation models transfer poorly to bursty, zero-inflated, cross-layer wireless telemetry. APEX addresses this gap with a network-native decoder-only transformer trained on multivariate enterprise AP telemetry, achieving stronger DHCP forecasting and unified anomaly detection while supporting edge inference. The paper positions network-native pretraining and compact deployment as a practical basis for proactive wireless operations.
Problem
General-purpose time-series foundation models transfer poorly to wireless telemetry because its signals are bursty, zero-inflated, and coupled across protocol layers.
Method
APEX is a decoder-only transformer pretrained on 10-channel multivariate telemetry from ∼100K AP time series across ∼4,500 production networks.
Results
18% lower DHCP forecasting MAE versus Toto and 38% versus SARIMA, with anomaly-detection F1 = 0.93 from the same checkpoint.
Takeaways & Limitations
APEX provides network-native forecasting and uncertainty-based anomaly detection, with APEX-Edge running sub-second inference on AP-class hardware without cloud dependency.
Takeaways & Limitations
Evaluation is limited to DHCP degradation, anomaly labels use consensus pseudo-ground-truth rather than human annotation, and edge latency is measured on a Raspberry Pi 5 proxy.
Abstract
from arXiv · showhide
Generic time-series foundation models transfer poorly to wireless network telemetry whose signals are bursty, zero-inflated, and coupled across protocol layers. We present APEX, a network-native, decoder-only transformer for forecasting enterprise AP telemetry, and evaluate it on DHCP degradation as a representative network task. APEX is pre-trained on 10-channel multivariate telemetry from ~4,500 production wireless networks (~100K AP time series, 34 metrics per AP), and is available as APEX-Large (269M, cloud) and APEX-Edge (10.5M, edge). On a 192-step (4-day) DHCP degradation benchmark, APEX-Large reduces MAE by 18% over the strongest foundation-model baseline (Toto) and 38% over SARIMA, with anomaly-detection F1 = 0.93, while APEX-Edge enables sub-second, privacy-preserving inference on AP-class edge hardware. These results suggest network-native pre-training is a practical foundation for proactive wireless operations.
1. Introduction
APEX addresses the poor transfer of general-purpose time-series models to bursty, zero-inflated, cross-layer wireless telemetry with a network-native transformer designed for forecasting and edge deployment. On DHCP degradation, it improves forecasting accuracy, unifies anomaly detection, and supports compact AP-side inference.
- Motivation: Wireless AP failures are difficult to detect proactively because enterprise scale, multi-vendor infrastructure, and cross-layer dependencies complicate diagnosis.AP telemetry is already co-located and time-aligned across DHCP, RF, interface, and uplink layers, but exporting raw data adds bandwidth, privacy, and latency costs.
- Motivation: Network telemetry is zero-inflated, abrupt during incidents, and shaped by protocol-specific and topology-dependent dynamics absent from typical TSFM pretraining corpora.DHCP degradation is used as a representative cross-layer task because outcomes depend on server behavior and upstream wireless conditions.
- Approach: APEX is a decoder-only transformer trained on 10-channel telemetry from ∼100K AP time series across ∼4,500 production networks.The input combines five DHCP causal-chain targets with five exogenous topology and anomaly signals.
- Results: Anomaly-detection F1 = 0.93 comes from MC-dropout prediction intervals from the same checkpoint, avoiding a separate detection pipeline.The result is competitive with VAR-Mahalanobis at F1 = 0.94.
- Deployment: APEX-Edge has 10.5M parameters and runs in 202 ms on AP-class hardware while keeping raw telemetry on-device.This supports edge deployment alongside the model’s forecasting and anomaly-detection capabilities.
2. Methods
APEX uses a two-phase cloud-training and AP-inference pipeline built around aggregated multivariate telemetry, patched transformer modeling, and uncertainty-based anomaly detection. Its methods include two input modalities, two model sizes, and consensus pseudo-ground-truth for evaluation.
- System Overview: Phase 1 aggregates and preprocesses historical telemetry from ∼4,500 production networks for next-patch pretraining, while Phase 2 runs APEX-Edge locally on AP telemetry.Only compact alerts of ∼KB/day are transmitted, versus ∼130 MB/day for raw telemetry.
- Telemetry: Two-stage aggregation rolls server/VLAN observations into per-AP summaries using AVG, MAX / Min, and STDDEV across the server/VLAN dimension.The feature vector contains 34 metrics spanning DHCP protocol, RF, interface errors, and topology.
- Architecture: APEX is a decoder-only patched transformer that z-score normalizes inputs, forms P=16-step patches, mixes 10 channels, and predicts the next patch autoregressively.Learned positional embeddings and causal self-attention index and model patch sequences; SwiGLU replaces GELU.
- Uncertainty: MC-dropout keeps dropout active for N=50 stochastic passes, using P5/P95 quantiles as prediction intervals without adding parameters.The method provides uncertainty from a single checkpoint for edge deployment.
- Architecture Variants: The architecture study crosses two sizes—269M-parameter APEX-Large and 10.5M-parameter APEX-Edge—with 1D and 10-channel multivariate modes.This 2×2 design isolates cross-channel structure from model capacity.
- Anomaly Detection: Anomaly detection combines univariate and multivariate methods, including APEX intervals, statistical baselines, Isolation Forest, VAR-Mahalanobis, SARIMAX, and foundation-model ensembles.The dual-mode design evaluates both per-metric and cross-metric anomaly signals.
- Anomaly Detection: A timestep is labeled anomalous when at least three independent methods flag it, producing consensus pseudo-ground-truth without manual annotation.The majority vote is intended to reduce false positives from individual methods’ idiosyncrasies.
3. Experiments
APEX achieves strong forecasting and anomaly-detection performance on DHCP degradation while preserving multivariate accuracy and edge feasibility. Its edge variant combines compact deployment with local, privacy-preserving operation.
- Forecasting: APEX-Large (multi) achieves the lowest error across all forecasting metrics.The evaluation holds out the last 192 steps, corresponding to four days at 30-minute intervals, per access point.
- Forecasting: 12–18% lower MAE separates APEX-Large (multi) from Toto, with the gap attributed to network-native pretraining rather than decoder-only architecture.Both models use decoder-only transformers.
- Forecasting: 26× fewer parameters let APEX-Edge (multi) match Toto-class accuracy, with MAE 3.87 versus 3.64.APEX-Edge (1D) instead reaches SARIMA-level performance with MAE 4.78, highlighting the role of multivariate structure.
- Anomaly detection: APEX-Large MC-dropout reaches anomaly-detection F1 = 0.93, close to VAR-Mahalanobis at 0.94.The shared forecasting checkpoint supports anomaly detection without a separate detection pipeline.
- Anomaly detection: APEX-Edge achieves anomaly-detection F1 = 0.89 despite 26× fewer parameters and outperforms all general-purpose foundation models.The same checkpoint provides forecasts and calibrated anomaly detection.
- Edge feasibility: 202 ms median single-inference latency and 428 MB peak memory support deployment on Raspberry Pi 5-class AP hardware.The measured latency is over 100 trials, with P95 latency of 205 ms.
- Edge feasibility: APEX-Edge continues forecasting and anomaly detection during WAN outages without sending raw telemetry off the AP.Only compressed anomaly events and summary statistics are optionally transmitted to the cloud.
4. Related Work
Prior time-series foundation models perform well on public benchmarks but lack network protocol telemetry in pretraining. APEX addresses this gap while unifying forecasting and anomaly detection for AP-class edge hardware.
- Time-series foundation models: TimesFM, Chronos, and Toto achieve strong zero-shot transfer on public finance, energy, and weather benchmarks.Their pretraining corpora do not include network protocol telemetry.
- Time-series foundation models: APEX uses a decoder-only, patch-based design in channel-dependent multivariate mode over a protocol-defined causal chain.It is pretrained exclusively on network telemetry.
- AIOps and network anomaly detection: AIOps anomaly systems such as Kitsune treat detection as a standalone task and require task-specific architectures.APEX instead unifies forecasting and anomaly detection in one pretrained checkpoint.
- Edge ML: APEX-Edge targets ARM Cortex-A76-class processors with 1–2 GB RAM, a higher compute tier than MCU-focused edge benchmarks.The paper identifies AP-class multivariate time-series forecasting as lacking an established edge-ML benchmark.
5. Conclusion
APEX combines network-native pretraining with a multivariate causal-chain input to support forecasting and uncertainty-based anomaly detection on AP-class hardware. Its reported benefits include sub-second, on-device inference, while evaluation remains limited to DHCP degradation and anomaly labels rely on consensus pseudo-ground truth.
- APEX uses a single checkpoint for forecasting and uncertainty-based anomaly detection, with the multivariate causal-chain input identified as the key enabler.The same design supports both tasks rather than requiring a separate detection pipeline.
- 26× fewer parameters allow APEX-Edge to match larger general-purpose models while retaining sub-second inference on AP-class hardware.The edge model keeps raw telemetry on-device and avoids cloud dependency.
- APEX is positioned for regulated environments because raw telemetry never leaves the device and data residency is treated as a prerequisite.This practical deployment scope follows from on-device inference and local telemetry processing.
- Evaluation is currently limited to DHCP degradation, while anomaly labels derive from consensus pseudo-ground truth rather than human annotation.The reported edge latency comes from a Raspberry Pi 5 proxy comparable to current AP SoCs, so production-hardware performance remains suggested rather than directly measured.