The fast improvement of Machine-Learning (ML) methods gives rise to new attacks in Information System (IS). Simultaneously, ML also creates new opportunities for network intrusion detection. Early network intrusion detection is a valuable asset for IS security, as it fosters early deployment of countermeasures and reduces the impact of attacks on system availability. This paper proposes and studies an anomaly-based Network Intrusion Detection System (NIDS) based on Tangled Program Graphs (TPGs) M%achine Learning (ML) and called Secure-Gegelati. Secure-Gegelati learns how to detect intrusions from IS-produced traces and is optimized to fit the requirements of intrusion detection. The study evaluates the capacity of Secure-Gegelati to act as a continuously learning, real-time, and low energy NIDS when executed in an embedded network probe. We show that a TPG is capable of switching between training and inference phases, new training phases enriching the probe knowledge with limited degradation of previous intrusion detection capabilities. The Secure-Gegelati software reaches 8x the energy efficiency of an optimized Random Forest (RF)-based Intrusion Detection System (IDS) on the same platform. It is capable of processing 13.2 kconnections/seconds with a peak power of less than 3.3Watts on an embedded platform, and is processing in real-time the CIC-IDS 2017 dataset while detecting 84% of intrusions and raising less than 0.2% of false alarms.