Technical Summary: APEX – A Network-Native Time-Series Foundation Model

Problem Statement

Wireless access point (AP) failures in enterprise environments often go undetected until users experience connectivity loss or DHCP timeouts. While APs collect rich, cross-layer telemetry (spanning DHCP, RF, interfaces, and uplink state), exporting this raw data to the cloud incurs significant bandwidth, privacy, and latency costs.

Existing general-purpose time-series foundation models (TSFMs) fail to transfer effectively to this domain. Network telemetry exhibits distinct characteristics not found in public benchmarks (e.g., finance or weather data): signals are bursty, zero-inflated during normal operation, and exhibit complex cross-layer dependencies and protocol-specific temporal structures. Consequently, general-purpose models underperform on network-specific tasks like DHCP degradation forecasting. Furthermore, running large models on resource-constrained edge hardware or relying on cloud inference introduces latency and privacy concerns that hinder proactive remediation.

Methodology

APEX Architecture

APEX is a decoder-only patched transformer designed specifically for network telemetry. It utilizes a "network-native" pretraining strategy on a corpus of ~100,000 AP time series from ~4,500 production networks.

• Input: The model processes a 10-channel multivariate input. This includes 5 target metrics representing the DHCP causal chain (client count, offer rate, ACK ratio, success rate, latency) and 5 exogenous signals (server count, VLAN count, and statistical aggregates of timeout/latency).
• Tokenization: Input time series are instance-normalized and partitioned into non-overlapping patches of 16 steps.
• Mechanism: The model employs causal self-attention for autoregressive next-patch prediction. It uses SwiGLU feed-forward layers for representational efficiency and learned positional embeddings.
• Variants: Two model sizes are presented:
  • APEX-Large: 269M parameters, optimized for cloud environments.
  • APEX-Edge: 10.5M parameters (26× smaller), optimized for deployment on AP-class edge hardware (e.g., ARM Cortex-A76).

Training and Inference

• Pretraining: The model is trained via next-patch prediction using MSE loss. Training utilizes AdamW, cosine learning rate scheduling, and mixed-precision on 4×A10G GPUs.
• Uncertainty Estimation: Instead of training separate ensembles, APEX employs MC-dropout (Monte Carlo Dropout) at inference. By keeping dropout active and performing stochastic forward passes (e.g., N=50), the model generates prediction intervals (P5/P95) for both forecasting and anomaly detection without adding parameter overhead.
• Anomaly Detection Strategy: A consensus-based ground truth is established where a time step is labeled anomalous only if ≥3 independent methods (including statistical baselines like VAR-Mahalanobis and other foundation models) flag it. This reduces false positives and avoids the need for expensive manual annotation.

Key Contributions

1. Network-Native Pretraining: The paper demonstrates that pretraining on domain-specific network telemetry yields significant performance gains over general-purpose models. APEX-Large reduces Mean Absolute Error (MAE) by 18% compared to the strongest general-purpose baseline (Toto) and 38% compared to SARIMA on a 192-step (4-day) DHCP degradation benchmark.
2. Unified Forecasting and Anomaly Detection: A single checkpoint provides both point forecasts and calibrated uncertainty intervals via MC-dropout. This achieves an anomaly detection F1 score of 0.93, competitive with specialized statistical methods (VAR-Mahalanobis at 0.94) while eliminating the need for a separate detection pipeline.
3. Edge-Deployable Efficiency: APEX-Edge (10.5M parameters) achieves accuracy comparable to much larger general-purpose models (matching Toto's MAE of 3.64 with 3.87) while running in 202 ms on AP-class ARM hardware. This enables sub-second, privacy-preserving inference entirely on-device.

Experimental Results

• Forecasting Accuracy: On the 192-step horizon, APEX-Large (multivariate) achieved the lowest error across all metrics (MAE: 2.98, RMSE: 4.61). The multivariate mode significantly outperformed the univariate mode, confirming that modeling the cross-channel causal chain is critical.
• Anomaly Detection: APEX-Large (MC-dropout) achieved an F1 of 0.93, surpassing general-purpose foundation models (Toto: 0.85, Chronos-2: 0.83) and approaching the performance of the best statistical baseline (VAR-Mahalanobis: 0.94).
• Edge Performance: On a Raspberry Pi 5 (representative of production AP hardware), APEX-Edge completed a 96-step forecast in 202 ms with a peak memory usage of 428 MB. This confirms feasibility for deployment without cloud dependency.

Significance and Claims

The paper posits that network-native pretraining is a practical foundation for proactive wireless operations. The primary significance lies in bridging the gap between general-purpose foundation models and the specific, complex dynamics of network telemetry.

By encoding protocol-level priors directly into the model, APEX demonstrates that the performance gap between general TSFMs and network tasks is a data effect, not an architectural one. The work establishes that a compact, edge-deployable model can replace a complex stack of cloud-hosted forecasting services, separate anomaly detectors, and telemetry export pipelines. This enables:

• Zero Cloud Dependency: Operations continue during WAN outages.
• Data Privacy: Raw telemetry never leaves the device, satisfying regulatory requirements in healthcare, finance, and government.
• Sub-Second Action Latency: The detection-to-remediation loop (forecast → anomaly flag → local action) completes well within the telemetry interval, enabling real-time self-healing.

The authors conclude that while current evaluation is limited to DHCP degradation, the causal-chain input structure generalizes to other domains (RF, roaming), suggesting immediate potential for cross-domain extension.