Running detection at the edge, and why your bill drops

Moving anomaly detection onto the node instead of the cloud cut one customer's uplink traffic by more than 100x. Here is the shape of that trade.

The instinct is to send everything to the cloud and sort it out there. It is simple to reason about and it is how most pilots are built. It also does not survive contact with a real fleet of battery-powered nodes on a constrained radio.

The cost of raw streaming

Streaming raw samples means paying three times: radio energy on the node, bandwidth on the network, and storage plus compute in the cloud. For a node that must live a decade on one cell, the radio cost alone is disqualifying. Every byte transmitted is a byte of battery you will not get back.

Detect first, transmit second

The alternative is to run the cheap part of detection on the device. The node watches its own signal, holds a small rolling model of normal, and stays quiet until something is genuinely off. When it speaks, it sends an event and a short window of context, not an endless stream.

On one deployment this took average uplink traffic from a steady firehose down by more than a hundredfold, with no loss of the events that mattered. The cloud bill followed the traffic down. Battery projections went from months to years.

What you give up

You lose the ability to retroactively analyse data you never sent. That sounds frightening until you price it. The honest answer is to keep a higher-rate buffer on the node and let the cloud pull it on demand when an event warrants a closer look. You get the forensics without paying to ship them continuously.