An Explainable Data-Driven Framework for Edge Anomaly Detection Using Neural Hawkes Transformers and Multivariate IoT Telemetry Streams

Abstract

Multivariate Internet of Things telemetry streams expose early indicators of device faults, malicious manipulation and unstable edge services, yet their irregular bursts, cross-channel dependencies and strict latency limits still weaken many deep anomaly detectors. This paper proposes a Neural Hawkes Transformer for edge anomaly explanation, in which continuous telemetry is converted into typed event increments, encoded with temporal and channel-aware attention, and scored through a conditional intensity layer suitable for gateway deployment. The model couple’s detection with explanation by decomposing each anomaly score into event-intensity, reconstruction residual and attention-mediated channel contribution terms. Experiments on a synthesized but physically constrained edge telemetry benchmark with 42 sensing and network variables, 1.28-million-time stamps and five anomaly families show that the proposed model reaches a macro-F1 of 0.934, an area under the precision-recall curve of 0.961 and a mean detection delay of 1.74 s. Against six baselines, it improves macro-F1 by 4.8-13.6 percentage points while reducing gateway memory use to 38.6 MB after structured pruning. Explanation evaluation further shows a top-three root-cause hit rate of 0.872 and a channel attribution stability score of 0.906 under 10% telemetry loss. These results indicate that Hawkes-style event intensity and Transformer context modeling can be jointly used for accurate, interpretable and resource-aware anomaly monitoring at the IoT edge.