NOCTOWL: Adaptive Tree-Based Model for Network Anomaly Detection Under Delayed and Sampled Label Availability
Sara Pederzoli, Matteo Paganelli, Michele Luca Contalbo, Riccardo Benassi, Donato Tiano, Stefano Iannucci, Francesco Guerra · IEEE Access · 2025
The paper introduces NOCTOWL, an online, interpretable network intrusion detection system designed for streaming environments subject to distributional shifts, with delayed and partial label availability. The method combines the inherently explainable structure of a decision tree with a clustering-based strategy to create interpretable data partitions and incrementally adjust them in response to distribution shifts. The model further incorporates selective sampling to adapt to evolving distributions while preventing unnecessary growth. Experiments on five benchmark datasets simulating realistic operating conditions demonstrate that NOCTOWL achieves competitive performance compared to black-box state-of-the-art systems, while maintaining robustness under constrained annotation budgets.