Real-time detection
Traffic is analysed as it streams, so detection happens while the attack is still in progress, not in tomorrow’s report.
// PRODUCTS 
TETİK
AI Network Intrusion Detection
Catches what signatures miss in real time.
TETİK watches your network as it runs, learns what normal looks like, and flags behaviour that doesn’t belong, including attacks no signature has seen yet.
Request a demo Signature-based defence isn’t enough
Signature-based systems can only stop what someone has already catalogued. New attacks appear every day before any signature covers them, and those are the ones that get through. TETİK takes the opposite approach: it learns what your network normally does, then flags what doesn’t fit.
How it works
- 01
Collect
Agents and network sensors gather traffic metrics and flow records from your hosts and virtual instances.
- 02
Process
Apache Spark processes and normalises the stream continuously, turning raw telemetry into model-ready features.
- 03
Detect
A deep reinforcement learning agent scores each record against learned normal behaviour, with an LSTM-RNN model as the supervised baseline.
- 04
Alert
Anomalies are raised with their context, ready for your SOC, SIEM or ticketing workflow.
What it gives you
Catches the unknown
Anomaly-based rather than signature-based: novel and zero-day behaviour is flagged because it deviates from your baseline, not because someone published a rule for it.
Self-improving agent
The reinforcement learning agent is rewarded for correct calls and keeps refining its policy as it sees more of your traffic.
Built for big data
Apache Spark stream processing handles high-volume network telemetry without becoming the bottleneck itself.
Cloud or on-premise
Designed for cloud and virtualised environments, and can also run entirely on your own infrastructure when data has to stay on site.
Tuned to your network
Models are trained on your own normal behaviour and retrained as it changes, keeping false positives manageable.
Technology & validation
The detection engine was evaluated against the standard public benchmark datasets used in intrusion detection research:
| Dataset | Model | Result |
|---|---|---|
| NSL-KDD | Deep RL | ~97% accuracy (best configuration) |
| UNSW-NB15 | Deep RL | ~3 points above the LSTM-RNN baseline (baseline peak 93.1%) |
| CICIDS2017 | LSTM-RNN | ~96% accuracy |
These figures come from controlled experiments on public benchmark datasets during the underlying research. Real-world results depend on network conditions, data quality and tuning.
Research foundation
The detection engine at the core of TETİK comes out of published academic research on deep reinforcement learning for intrusion detection, carried out at Middle East Technical University.
In the field
The same engine has already been delivered as custom projects for:
See it on your own traffic
Book a technical walkthrough with the engineers who built it.
Get in touch