NOCTOWL: Adaptive Tree-Based Model for Network Anomaly Detection Under Delayed and Sampled Label Availability

The paper introduces NOCTOWL, an online, interpretable network intrusion detection system designed for streaming environments subject to distributional shifts, with delayed and partial label availability. The method combines the inherently explainable structure of a decision tree with a clustering-based strategy to create interpretable data partitions and incrementally adjust them in response to distribution shifts. The model further incorporates selective sampling to adapt to evolving distributions while preventing unnecessary growth. Experiments on five benchmark datasets simulating realistic operating conditions demonstrate that NOCTOWL achieves competitive performance compared to state-of-the-art systems, while maintaining robustness under constrained annotation budgets.