APEX: A Network-Native Time-Series Foundation Model for Forecasting and Anomaly Detection for Wireless Edge Operations

# APEX: A Network-Native Time-Series Foundation Model for Forecasting and Anomaly Detection for Wireless Edge Operations
Source: [https://arxiv.org/html/2606.11553](https://arxiv.org/html/2606.11553)
###### Abstract

Generic time\-series foundation models transfer poorly to wireless network telemetry whose signals are bursty, zero\-inflated, and coupled across protocol layers\. We presentAPEX, a network\-native, decoder\-only transformer for forecasting enterprise AP telemetry, and evaluate it on DHCP degradation as a representative network task\. APEX is pre\-trained on 10\-channel multivariate telemetry from∼\{\\sim\}4,500 production wireless networks \(∼\{\\sim\}100K AP time series, 34 metrics per AP\), and is available as APEX\-Large \(269M, cloud\) and APEX\-Edge \(10\.5M, edge\)\. On a 192\-step \(4\-day\) DHCP degradation benchmark, APEX\-Large reduces MAE by 18% over the strongest foundation\-model baseline \(Toto\) and 38% over SARIMA, with anomaly\-detection F1 = 0\.93, while APEX\-Edge enables sub\-second, privacy\-preserving inference on AP\-class edge hardware\. These results suggest network\-native pre\-training is a practical foundation for proactive wireless operations\.

Swadhin Pradhan Niloo Bahadori Peiman Amini

Cisco Systems, USA

## 1Introduction

Wireless access points \(AP\) failure that affect Wi\-Fi clients remain a persistent challenge, especially in enterprise environments where scale, multi\-vendor infrastructure, and cross\-layer protocol dependencies add complexity\. These failures are often detected only after users experience impact, such as DHCP timeouts or connectivity loss\. Yet APs already collect rich telemetry, spanning DHCP, RF, interfaces, and uplink state with signals co\-located and timestamp\-aligned across protocol layers\. Exporting raw telemetry off\-device incurs bandwidth, privacy, and latency costs, making the AP itself a natural place for proactive failure detection and remediation\.

Recent time\-series foundation models \(TSFMs\)\(Daset al\.,[2024](https://arxiv.org/html/2606.11553#bib.bib1); Ansariet al\.,[2024](https://arxiv.org/html/2606.11553#bib.bib2); Cohenet al\.,[2024](https://arxiv.org/html/2606.11553#bib.bib3)\)are a natural starting point, but their pretraining corpora contain no enterprise network telemetry\. Network signals differ from the public benchmarks on which TSFMs are typically evaluated: they are often zero\-inflated during normal operation, change abruptly during incidents, and exhibit cross\-layer dependencies\. They also exhibit protocol\-specific temporal structure and topology\-dependent dynamics that are uncommon in standard public corpora\. We study DHCP degradation as a representative cross\-layer task because DHCP outcomes depend on both server\-side behavior and upstream wireless conditions\. On a 192\-step \(4\-day\) benchmark, the strongest general\-purpose TSFM baseline \(Toto\-151M\) trails a network\-native pretrained model by 12–18% in MAE\.

These gaps call for a domain\-specific foundation modelthat encodes protocol\-level priors directly and is compact enough to run on the AP\. To this end, we introduceAPEX, a decoder\-only patched transformer trained on co\-collected wireless telemetry\. APEX consumes a 10\-channel multivariate input \(5 DHCP causal\-chain targets \+ 5 exogenous topology and anomaly signals\), drawn from a corpus of∼\{\\sim\}100K AP time series \(34 metrics each\) spanning∼\{\\sim\}4,500 production networks\. Our contributions are:

1. 1\.Network\-native pretraining\.APEX\-Large \(269M\) reduces DHCP forecasting MAE by 18% versus the best general\-purpose TSFM \(Toto\) and 38% versus SARIMA, showing the gap is a data effect, not an architecture one \(Table[2](https://arxiv.org/html/2606.11553#S3.T2)\)\.
2. 2\.Unified forecasting and anomaly detection\.MC\-dropout prediction intervals from the same checkpoint achieve anomaly\-detection F1 = 0\.93, competitive with VAR\-Mahalanobis \(0\.94\) while eliminating a separate detection pipeline \(§[3\.2](https://arxiv.org/html/2606.11553#S3.SS2)\)\.
3. 3\.Edge deployable model\.APEX\-Edge \(10\.5M, 26×\\timessmaller\) runs in 202 ms on AP\-class ARM hardware which keeps raw telemetry on\-device \(§[3\.3](https://arxiv.org/html/2606.11553#S3.SS3)\)\.

## 2Methods

### 2\.1System Overview

![Refer to caption](https://arxiv.org/html/2606.11553v1/figs/APEX_pipeline.jpg)Figure 1:APEX Pipeline\. Phase 1 trains on telemetry on cloud\. Phase 2 runs inference on AP, transmitting only compact alerts\.Figure[1](https://arxiv.org/html/2606.11553#S2.F1)shows the two\-phase APEX pipeline\.Phase 1 \(Offline, cloud\):Historical telemetry from∼\{\\sim\}4,500 production networks is hierarchically aggregated, preprocessed, and used to pretrain APEX via next\-patch prediction\. The trained APEX\-Edge checkpoint \(∼\{\\sim\}40 MB\) is deployed to the AP\.Phase 2 \(Online, edge\):The AP collects local telemetry, applies the same aggregation and preprocessing, and runs APEX\-Edge inference to produce forecasts and alerts\. Only compact alerts \(∼\{\\sim\}KB/day\) are transmitted, versus∼\{\\sim\}130 MB/day for raw telemetry\.

### 2\.2Data: Co\-Located Multivariate Telemetry

Telemetry is collected via a two\-stage aggregation: raw data arrives at per\-\(server IP, VLAN, AP, time bucket\)\. Stage 1 computes statistics per \(DHCP server, VLAN, AP, time bucket\); Stage 2 rolls up to per\-AP summaries with AVG \(baseline\), MAX / Min \(worst\-case\), and STDDEV \(heterogeneity\) across the server/VLAN dimension\. This preserves distributional information e\.g\., one healthy and one failing server yields low AVG but high MAX timeout rate\. The feature vector comprises 34 metrics \(22 DHCP protocol, 6 RF, 2 interface error, and 4 topology\)\. The default granularity is 30 minutes \(48 observations/day\)\.

### 2\.3APEX Architecture

APEX is a decoder\-only patched transformer \(Table[1](https://arxiv.org/html/2606.11553#S2.T1)\)\. Input time series are instance\-normalized \(z\-score\) and partitioned into non\-overlapping patches ofP=16P\{=\}16steps\. In multivariate mode, each patch is a vector inℝC×P\\mathbb\{R\}^\{C\\times P\}\(withC=10C\{=\}10channels\), linearly projected intodmodeld\_\{\\text\{model\}\}\. Learned positional embeddings index each patch position within the context window, and causal self\-attention enables auto\-regressive next\-patch prediction\. SwiGLU feed\-forward layers replace the standard GELU activation, improving representational efficiency at equivalent parameter count\.

Table 1:APEX architecture variants\. Both sizes are trained in 1D \(univariate\) and multi \(multivariate, 10\-channel\) modes\.The 10 channels encode a DHCP causal chain: 5 targets \(client count, offer rate, ACK ratio, success rate, latency\) and 5 exogenous signals \(server count, VLAN count, timeout rate MAX, latency MAX, latency STD\)\. The linear patch projection learns cross\-channel mixing, exposing the model to cross\-layer dependencies at training time\. Of the 34 metrics in the canonical feature vector, these 10 were selected to capture the end\-to\-end DHCP transaction path from client arrival through server response quality\.

Training\.MSE loss on predicted patches, AdamW \(β1=0\.9\\beta\_\{1\}\{=\}0\.9,β2=0\.95\\beta\_\{2\}\{=\}0\.95, weight decay 0\.05\), cosine LR with 5% warmup, gradient clipping at 1\.0, mixed\-precision \(AMP\), gradient checkpointing, and DDP across 4×\\timesA10G GPUs\. Depth\-scaled initialization \(1/2​L1/\\sqrt\{2L\}for residual projections\) stabilizes training\. Early stopping with patience 5 on validation loss\.

Uncertainty via MC\-dropout\.At inference, dropout remains active\.N=50N\{=\}50stochastic forward passes produce an ensemble; P5/P95 quantiles define prediction intervals\. MC\-dropout requires only a single checkpoint and adds no parameters, making it well suited for edge deployment\.

### 2\.4Ablation: Size×\\timesModality

We train both architecture sizes in two input modes, yielding four variants: \(a\)APEX\-Large \(multi\), 269M parameters with 10\-channel patches; \(b\)APEX\-Large \(1D\), 269M parameters treating each of the 34 metrics as an independent univariate series; \(c\)APEX\-Edge \(multi\), 10\.5M parameters with the same 10\-channel input; \(d\)APEX\-Edge \(1D\), 10\.5M parameters in univariate mode\. This2×22\{\\times\}2design isolates the contributions of cross\-channel structure and model capacity independently\.

### 2\.5Anomaly Detection

We employ dual\-mode anomaly detection:

Univariate\(per\-metric\): APEX MC\-dropout intervals, Z\-score on rolling statistics, Isolation Forest\(Liuet al\.,[2008](https://arxiv.org/html/2606.11553#bib.bib5)\)on sliding windows, SARIMA confidence intervals\.

Multivariate\(cross\-metric\): APEX joint prediction intervals, VAR residual with Mahalanobis distance\(Lütkepohl,[2005](https://arxiv.org/html/2606.11553#bib.bib6)\), SARIMAX confidence intervals, foundation model ensemble \(TimesFM, Toto, Chronos\-2\) predictions\.

Consensus ground truth\.A time step is labeled anomalous iff≥\\geq3 independent methods flag it\. This majority\-vote mechanism reduces false positives from any single method’s idiosyncrasies and provides robust pseudo\-ground\-truth without expensive manual annotation, a practical necessity for network telemetry where labeled anomaly datasets are prohibitively costly to create\.

## 3Experiments

Setup\.All models share the same train/test split: the last 192 steps \(4 days at 30\-min intervals\) are held out per AP\. Forecasting metrics: MAE, RMSE, MAPE\. Anomaly metrics: Precision, Recall, F1 against consensus labels\.

### 3\.1Forecasting Results

Table 2:CLIENT\_DHCP\_SUCCESS\_RATE forecasting accuracy \(192\-step horizon\)\. Lower is better for all metrics\. Best inbold, second\-bestunderlined\.APEX\-Large \(multi\) achieves the lowest error across all metrics \(Table[2](https://arxiv.org/html/2606.11553#S3.T2)\)\. The multivariate mode outperforms its univariate counterpart \(APEX\-Large 1D\), confirming that cross\-channel attention over the DHCP causal chain provides signal beyond what independent per\-metric forecasting captures\. The gap between APEX\-Large \(multi\) and the best general\-purpose model \(Toto\) is 12–18% in MAE, attributable to network\-native pretraining rather than architecture since both are decoder\-only transformers\.

General\-purpose foundation models \(TimesFM, Toto, Chronos\-2\) consistently outperform classical SARIMA, validating the foundation\-model paradigm for structured time\-series data\. However, all three general\-purpose foundation models underperform compared to APEX\-Large variants, which see the same data at training time\.

APEX\-Edge \(multi\) matches Toto\-class accuracy \(MAE 3\.87 vs 3\.64\) at 26×\\timesfewer parameters, while APEX\-Edge \(1D\) degrades to SARIMA\-level performance \(MAE 4\.78\)\. This confirms that multivariate structure—not just model capacity—is the key enabler: the 10\-channel causal chain compensates for the 96% parameter reduction\.

### 3\.2Anomaly Detection Results

Table 3:Results on multivariate anomaly detection\. Higher value denotes better performance\.VAR\-Mahalanobis achieves the highest F1 \(0\.94\) by exploiting linear cross\-metric covariance structure \(Table[3](https://arxiv.org/html/2606.11553#S3.T3)\)\. APEX\-Large MC\-dropout is a close second \(0\.93\) and captures non\-linear failure modes that VAR misses; the two methods are complementary\. General\-purpose foundation models lag behind both, with Toto \(0\.85\) the strongest\.

APEX\-Edge MC\-dropout \(F1 = 0\.89\) retains most of APEX\-Large’s detection quality despite 26×\\timesfewer parameters, and outperforms all general\-purpose foundation models\. The consensus framework benefits from this complementarity: combining VAR\-Mahalanobis \(strong on linear shifts\) with APEX\-Large \(strong on non\-linear, protocol\-specific anomalies\) and at least one general\-purpose model produces robust pseudo\-labels with low false\-positive rates\. Notably, APEX is the only method that provides both forecasts and calibrated anomaly detection from a single checkpoint, eliminating the need to deploy and maintain separate forecasting and monitoring pipelines on resource\-constrained hardware\.

### 3\.3Edge Deployment

Table 4:Model footprint and inference latency for a 96\-step forecast on 50 MC\-dropout samples\. Edge target: ARM Cortex\-A76 class \(Raspberry Pi 5\)\.Both APEX\-Edge variants \(10\.5M parameters; Table[1](https://arxiv.org/html/2606.11553#S2.T1)\) are 11–19×\\timessmaller than general\-purpose alternatives \(Table[4](https://arxiv.org/html/2606.11553#S3.T4)\)\. We validate edge feasibility on a Raspberry Pi 5\(Raspberry Pi Ltd,[2026](https://arxiv.org/html/2606.11553#bib.bib20)\), whose quad\-core Arm Cortex\-A76 comparable to the Arm cores currently shipping in production Wi\-Fi access points, including those based on Qualcomm’s Wi\-Fi 7 NPro platform\(Qualcomm Technologies, Inc\.,[2026a](https://arxiv.org/html/2606.11553#bib.bib21),[c](https://arxiv.org/html/2606.11553#bib.bib22),[b](https://arxiv.org/html/2606.11553#bib.bib23)\)\. Measured single\-inference latency is 202 ms \(median over 100 trials, P95==205 ms\), with peak memory of 428 MB—well within the 1–2 GB available on APs\. MC\-dropout uncertainty \(50 samples\) completes in 11\.4 s; reducing to 5 samples yields sub\-second uncertainty at minimal coverage loss\. This enables three properties critical for enterprise edge deployment:

Zero cloud dependency\.Forecasting and anomaly detection continue during WAN outages, precisely when network health monitoring is most needed\.

Data privacy\.Raw telemetry never leaves the AP\. Only compressed anomaly events and summary statistics are optionally transmitted to the cloud for fleet\-wide correlation\. This satisfies data\-residency requirements in regulated industries \(healthcare, finance, government\)\.

Sub\-second action latency\.A single 96\-step forecast \(48 hours ahead\) completes in 202 ms on CPU alone\. The detection\-to\-remediation loop \(forecast→\\toanomaly flag→\\tolocal action such as DHCP failover or channel switch\) completes well within the 30\-minute telemetry interval\. Integrated edge AI using neural engines in the AP will further reduce latency via INT8 quantized inference\. Together, these properties make APEX\-Edge a self\-contained prognostic agent: a single 40 MB checkpoint replaces what would otherwise require a cloud\-hosted forecasting service, a separate anomaly detector, and a telemetry export pipeline consuming∼\{\\sim\}130 MB/day of uplink bandwidth\.

## 4Related Work

Time\-series foundation models\.TimesFM\(Daset al\.,[2024](https://arxiv.org/html/2606.11553#bib.bib1)\), Chronos\(Ansariet al\.,[2024](https://arxiv.org/html/2606.11553#bib.bib2)\), and Toto\(Cohenet al\.,[2024](https://arxiv.org/html/2606.11553#bib.bib3)\)achieve strong zero\-shot transfer on public benchmarks spanning finance, energy, and weather, yet none include network protocol telemetry in their pretraining corpora\. APEX shares the decoder\-only, patch\-based design pioneered by PatchTST\(Nieet al\.,[2023](https://arxiv.org/html/2606.11553#bib.bib9)\)but operates in channel\-*dependent*multivariate mode over a protocol\-defined causal chain, and is pretrained exclusively on network telemetry\.

AIOps and network anomaly detection\.Dang et al\.\(Danget al\.,[2019](https://arxiv.org/html/2606.11553#bib.bib15)\)survey operational challenges at scale; Kitsune\(Mirskyet al\.,[2018](https://arxiv.org/html/2606.11553#bib.bib16)\)deploys autoencoder ensembles for packet\-level intrusion detection on constrained devices\. These systems treat detection as a standalone task and require task\-specific architectures that do not transfer across telemetry domains\. APEX unifies forecasting and anomaly detection in a single pretrained checkpoint, using MC\-dropout\(Gal and Ghahramani,[2016](https://arxiv.org/html/2606.11553#bib.bib4)\)prediction intervals rather than a separate detection model\.

Edge ML\.MCUNet\(Linet al\.,[2020](https://arxiv.org/html/2606.11553#bib.bib18)\)and MLPerf Tiny\(Banburyet al\.,[2021](https://arxiv.org/html/2606.11553#bib.bib19)\)target vision and keyword tasks on MCU\-class devices \(<<1 MB RAM\)\. APEX\-Edge operates at a higher compute tier \(ARM Cortex\-A76, 1–2 GB RAM\) representative of AP\-class processor—a setting with no established edge\-ML benchmark for multivariate time\-series forecasting\. MC\-dropout\(Gal and Ghahramani,[2016](https://arxiv.org/html/2606.11553#bib.bib4)\)provides calibrated uncertainty from a single checkpoint, avoiding theN×N\{\\times\}storage cost of deep ensembles\(Lakshminarayananet al\.,[2017](https://arxiv.org/html/2606.11553#bib.bib7)\)that is prohibitive on such a resource\-constrained hardware\.

## 5Conclusion

APEX shows that network\-native pretraining closes a gap zero\-shot transfer from general\-purpose foundation models cannot\. A single checkpoint provides both forecasting and uncertainty\-based anomaly detection\. The multivariate causal\-chain input is the key enabler: it lets APEX\-Edge match larger general\-purpose models at 26×\\timesfewer parameters\. On AP\-class hardware, inference runs in sub\-second time with no cloud dependency, and raw telemetry never leaves the device\. This makes APEX deployable in regulated environments where data residency is not optional but a prerequisite\.

Limitations\.Anomaly labels are derived from consensus pseudo\-ground\-truth rather than human annotation, and edge latency is measured on a Raspberry Pi 5 proxy whose quad\-core Cortex\-A76 is comparable to current AP SoCs, suggesting sub\-second inference will hold on production hardware\. Evaluation is currently limited to DHCP degradation\. However, the causal\-chain input structure generalizes directly to RF and roaming telemetry, making cross\-domain extension immediate future work\.

## References

- A\. F\. Ansari, L\. Stella, C\. Turkmen, X\. Zhang, P\. Mercado, H\. Shen, O\. Shchur, S\. S\. Rangapuram, S\. P\. Arango, S\. Kapoor, J\. Zschiegner, D\. C\. Maddix, H\. Wang, M\. W\. Mahoney, K\. Torber, A\. G\. Wilson, M\. Bohlke\-Schneider, and Y\. Wang \(2024\)Chronos: learning the language of time series\.Transactions on Machine Learning Research \(TMLR\)\.Cited by:[§1](https://arxiv.org/html/2606.11553#S1.p2.1),[§4](https://arxiv.org/html/2606.11553#S4.p1.1)\.
- C\. Banbury, V\. J\. Reddi, P\. Torelli, J\. Holleman, N\. Jeffries, C\. Kiraly, P\. Montino, D\. Kanter,et al\.\(2021\)MLPerf tiny benchmark\.InAdvances in Neural Information Processing Systems \(NeurIPS\), Datasets and Benchmarks Track,Cited by:[§4](https://arxiv.org/html/2606.11553#S4.p3.2)\.
- Toto: time series optimized transformer for observability\.arXiv preprint arXiv:2407\.07874\.Cited by:[§1](https://arxiv.org/html/2606.11553#S1.p2.1),[§4](https://arxiv.org/html/2606.11553#S4.p1.1)\.
- Y\. Dang, Q\. Lin, and P\. Huang \(2019\)AIOps: real\-world challenges and research innovations\.InProceedings of the 41st International Conference on Software Engineering: Companion \(ICSE\-Companion\),Cited by:[§4](https://arxiv.org/html/2606.11553#S4.p2.1)\.
- A\. Das, W\. Kong, R\. Sen, and Y\. Zhou \(2024\)A decoder\-only foundation model for time\-series forecasting\.InProceedings of the 41st International Conference on Machine Learning \(ICML\),Cited by:[§1](https://arxiv.org/html/2606.11553#S1.p2.1),[§4](https://arxiv.org/html/2606.11553#S4.p1.1)\.
- Y\. Gal and Z\. Ghahramani \(2016\)Dropout as a Bayesian approximation: representing model uncertainty in deep learning\.InProceedings of the 33rd International Conference on Machine Learning \(ICML\),Cited by:[§4](https://arxiv.org/html/2606.11553#S4.p2.1),[§4](https://arxiv.org/html/2606.11553#S4.p3.2)\.
- B\. Lakshminarayanan, A\. Pritzel, and C\. Blundell \(2017\)Simple and scalable predictive uncertainty estimation using deep ensembles\.InAdvances in Neural Information Processing Systems \(NeurIPS\),Cited by:[§4](https://arxiv.org/html/2606.11553#S4.p3.2)\.
- J\. Lin, W\. Chen, Y\. Lin, J\. Cohn, C\. Gan, and S\. Han \(2020\)MCUnet: tiny deep learning on IoT devices\.InAdvances in Neural Information Processing Systems \(NeurIPS\),Cited by:[§4](https://arxiv.org/html/2606.11553#S4.p3.2)\.
- F\. T\. Liu, K\. M\. Ting, and Z\. Zhou \(2008\)Isolation forest\.InProceedings of the 8th IEEE International Conference on Data Mining \(ICDM\),Cited by:[§2\.5](https://arxiv.org/html/2606.11553#S2.SS5.p2.1)\.
- H\. Lütkepohl \(2005\)New introduction to multiple time series analysis\.Springer\.Cited by:[§2\.5](https://arxiv.org/html/2606.11553#S2.SS5.p3.1)\.
- Y\. Mirsky, T\. Doitshman, Y\. Elovici, and A\. Shabtai \(2018\)Kitsune: an ensemble of autoencoders for online network intrusion detection\.InProceedings of the Network and Distributed System Security Symposium \(NDSS\),Cited by:[§4](https://arxiv.org/html/2606.11553#S4.p2.1)\.
- Y\. Nie, N\. H\. Nguyen, P\. Sinthong, and J\. Kalagnanam \(2023\)A time series is worth 64 words: long\-term forecasting with transformers\.InProceedings of the 11th International Conference on Learning Representations \(ICLR\),Cited by:[§4](https://arxiv.org/html/2606.11553#S4.p1.1)\.
- Qualcomm Technologies, Inc\. \(2026a\)Qualcomm dragonwing npro 7 platform\.Note:[https://www\.qualcomm\.com/networking\-infrastructure/products/npro\-series/npro\-7\-platform](https://www.qualcomm.com/networking-infrastructure/products/npro-series/npro-7-platform)Accessed: 2026\-05\-05Cited by:[§3\.3](https://arxiv.org/html/2606.11553#S3.SS3.p1.2)\.
- Qualcomm Technologies, Inc\. \(2026b\)Qualcomm dragonwing npro a7 elite platform\.Note:[https://www\.qualcomm\.com/networking\-infrastructure/products/npro\-series/npro\-a7\-elite\-platform](https://www.qualcomm.com/networking-infrastructure/products/npro-series/npro-a7-elite-platform)Accessed: 2026\-05\-05Cited by:[§3\.3](https://arxiv.org/html/2606.11553#S3.SS3.p1.2)\.
- Qualcomm Technologies, Inc\. \(2026c\)Qualcomm dragonwing npro a7 platform\.Note:[https://www\.qualcomm\.com/networking\-infrastructure/products/npro\-series/npro\-a7\-platform](https://www.qualcomm.com/networking-infrastructure/products/npro-series/npro-a7-platform)Accessed: 2026\-05\-05Cited by:[§3\.3](https://arxiv.org/html/2606.11553#S3.SS3.p1.2)\.
- Raspberry Pi Ltd \(2026\)Raspberry pi 5\.Note:[https://www\.raspberrypi\.com/products/raspberry\-pi\-5/](https://www.raspberrypi.com/products/raspberry-pi-5/)Accessed: 2026\-05\-05Cited by:[§3\.3](https://arxiv.org/html/2606.11553#S3.SS3.p1.2)\.