ARRTECH Navigation Bar

AI Research

Patented AI algorithms fusing deep learning with graph neural networks to model high-level data abstractions and predict complex behavioral deviations.

Two decades of global research delivering market-leading maturity.  3000+ Businesses couldn't be wrong
ARRTECH — Research & Technology
The Foundation · Brain-Inspired AI

A detection engine modeled on the brain's predictive error-correction loop.

ARRTECH's threat detection engine is built on a class of brain-inspired machine learning called predictive error-compensated neural networks — a method that mirrors how the brain reduces uncertainty by forecasting its own errors and correcting in real time.

The PEC-WNN architecture was introduced in peer-reviewed research published in IEEE Access, 2020, by Prof. Dr. Burak Berk Üstündağ of Istanbul Technical University.1 The work was conducted under the named research project Development of Cyberdroid Based on Cognitive Intelligent System Applications, funded through ITUNOVA, ITU's official technology transfer office. The published model reduced prediction error by up to 95% against prior art across four independent benchmark problems.

In benchmark testing against twenty leading time-series prediction methods, PEC-WNN delivered the lowest error rates while using a fraction of the parameters of comparable deep learning approaches.1 This architecture is the academic foundation underneath CYBERDROID Neural Detection — ARRTECH's threat detection engine.

2020
Peer-reviewed in
IEEE Access
95%
RMSE reduction
vs. prior art
20+
Methods outperformed
in benchmarks
Cortical coding · sparse activation across L1–L6
Detection Coverage · 80+ Algorithms

180+ algorithms across 15 families — from classical statistics to frontier mathematics.

Each family targets a distinct class of adversary behavior. Findings from multiple families are fused into coherent attack-chain narratives via cross-instrument correlation. No single-method blind spots.

Adaptive Learning
01 / 15
EWMA Z-Score BaselinesRare Transition SequencesSeasonality-Aware BaselinesOnline Changepoint Detection
Deep Learning
02 / 15
AutoencodersVariational Autoencoders (VAE)Temporal Convolutional Networks (TCN)Sequence AutoencodersTransformer-Based Sequence Anomaly
Graph Intelligence
03 / 15
Graph Neural Networks (GNN)Link PredictionGraph Centrality ShiftCommunity Detection DriftGraph Embedding Outlier DetectionDynamic Graph Change-Point
Outlier & Anomaly Detection
04 / 15
Isolation ForestLocal Outlier FactorOne-Class SVMkNN Distance ScoringHBOSRobust Random Cut ForestHDBSCANk-Means / k-Medoids Clustering
Statistical Methods
05 / 15
Robust Covariance / MahalanobisPCA Subspace ResidualsRobust PCAGaussian Mixture ModelsKernel Density EstimationConformal Uncertainty Calibration
Drift & Shift Detection
06 / 15
KL-DivergenceCUSUMEWMA Control ChartsPage-HinkleyADWINWasserstein DistanceJensen-ShannonPopulation Stability IndexMMD
Sequence Analysis
07 / 15
Variable-Order Markov / n-GramHidden Markov Models (HMM / HSMM)Self-Supervised Sequence EmbeddingsGrammar-Based Automata
Causal & Bayesian
08 / 15
Causal Discovery (PC / FCI / NOTEARS)Granger CausalityBayesian Online Changepoint (BOCPD)Bayesian Model AveragingDempster-Shafer Evidence Fusion
Frontier Mathematics
09 / 15
Topological Data Analysis (Persistent Homology)Path Signatures (Rough Path Theory)Diffusion MapsInformation Geometry (Fisher-Rao)Hawkes Process ModelsNeural ODE
Advanced Theory
10 / 15
Optimal Transport BarycentersStein DiscrepancySheaf-Theoretic ConsistencySimplicial Complex (Hodge Laplacian)Symbolic RegressionTropical Geometry

Five additional proprietary algorithm families — covering identity drift, kernel-level data egress, and cross-product attack-chain reconstruction — are not enumerated publicly. Available under NDA during technical evaluation.

From Research to Product

The science, in production.

Cortical coding and the 80+ algorithm portfolio are not laboratory curiosities. Two production surfaces deliver them to working SOC teams every day.

CYBERDROID Neural Detection

The detection engine — cortical coding at line rate.

CYBERDROID is the production implementation of the cortical coding research. It ingests telemetry from firewall, SIEM, SOAR, EDR, NDR, IAM, DLP, WAF, IDS/IPS, email, and cloud workload protection — then fuses findings from across the 15 algorithm families into a single actor-centric reasoning graph.

  • Brain-inspired sparse activation — anomaly detection in seconds, not minutes
  • Cross-instrument correlation — 11 telemetry classes, one investigation narrative
  • Local AI inference via llama.cpp — zero cloud calls, full data sovereignty
  • Air-gap capable — zero external dependencies, classified-deployment ready
CYBERDROID Atlas — host risk graph and correlation view
CYBERDROID SOC Analyst

The analyst surface — investigations, not alert queues.

SOC Analyst is where the detection engine meets the human operator. Every significant event becomes a structured investigation with actor context, raw evidence chains, hypothesis-and-dissent reasoning, and recommended next actions — not a line in a queue waiting to be triaged.

  • Living handoff — priority-ordered actions with full evidence provenance
  • Reasoning chains — hypotheses, agent positions, and tie-breaks made auditable
  • Escalation discipline — 99.3% machine-cleared at the Council's confidence bar
  • Proven from 5 EPS to 100,000+ EPS across nation-scale deployments
CYBERDROID SOC Analyst — living handoff and reasoning chain
The Team Behind the Science

Twenty years of research. One platform. Built by the people who wrote the papers.

ARRTECH is not assembled from acquired startups. The platform is the product of a single continuous research program — and the same people who designed it lead the company.

Alper Cem Yılmaz, Founder & CEO of ARRTECH
Founder & Chief Executive Officer
Alper Cem Yılmaz

Educated in computer engineering at Istanbul Technical University. Two decades building enterprise cybersecurity platforms now deployed across defense, telecom, government, and financial sectors globally. Work spans SIEM, SOAR, DLP, and AI-driven threat detection. Under his leadership the underlying platform has scaled to 3,000+ enterprise deployments across more than 25 large-scale organizations.

  • Computer Engineering — Istanbul Technical University
  • 20+ years building SIEM, SOAR, DLP, and AI detection platforms
  • Architect — full ARRTECH product suite (SIEM, SOAR, DLP, UEBA)
  • Inventor — CYBERDROID autonomous investigation architecture
  • Customers include 7 of the Fortune 50
Prof. Dr. Burak Berk Üstündağ, Scientific Advisor to ARRTECH
Scientific Advisor
Prof. Dr. Burak Berk Üstündağ

One of the foremost researchers globally in brain-inspired AI, neuromorphic computing, and signal processing applied to anomaly detection. Full Professor in the Faculty of Computer and Informatics Engineering at Istanbul Technical University; Director of the National Software Certification Research Center. Senior author of the foundational cortical coding research underlying CYBERDROID Neural Detection.

  • Professor, Faculty of Computer and Informatics Engineering — Istanbul Technical University
  • Director, National Software Certification Research Center, ITU
  • 100+ peer-reviewed publications · 1,250+ citations
  • ORCID 0000-0001-8143-9434
  • Senior author — Cortical Coding Method (Entropy, MDPI, 2022)
Track Record · By the Numbers

Deployed where the cost of being wrong is measured in nations, not quarters.

Numbers below are drawn from the underlying platform's deployment record across two decades. Each is independently verifiable on technical evaluation under NDA.

3,000+
Enterprise deployments globally
7
Of the Fortune 50 protected by the platform
241k+
Endpoints actively under protection
25+
Large-scale organizations across critical sectors
180+
Detection algorithms across 15 families
20yr
Of computational neuroscience and mathematical AI research
100k+ EPS
Throughput proven from 5 EPS to nation-scale
ISO 27001
Certified · SOC 2 Type II in progress
Research References · Peer-Reviewed

Every claim on this page is anchored in publicly verifiable research.

A continuous five-year research program in predictive error-compensated neural architectures — the academic foundation underneath CYBERDROID Neural Detection. The full bibliography, including unpublished proprietary algorithm research, is available under NDA during technical evaluation.

[ 01 ]

High-Performance Time Series Prediction With Predictive Error Compensated Wavelet Neural Networks.

Ustundag, B. B., & Kulaglic, A.

IEEE Access, 8, 210532–210541 — IEEE. Funded research project: "Development of Cyberdroid Based on Cognitive Intelligent System Applications" (ITUNOVA, 2019–2020).

[ 02 ]

Stock Price Prediction Using Predictive Error Compensation Wavelet Neural Networks.

Kulaglic, A., & Ustundag, B. B.

Computers, Materials & Continua, 68(3), 3577–3593. Demonstrates 33% RMSE improvement over LSTM in real-world financial time-series prediction.

[ 03 ]

Predictive Error Compensating Wavelet Neural Network Model for Multivariable Time Series Prediction.

Kulaglic, A., & Ustundag, B. B.

TEM Journal, 10(4), 1955–1963. Extends the PEC-WNN architecture to multivariable input — the configuration applicable to multi-source security telemetry.

2021 · Multivariatedoi.org/10.18421/TEM104-61
[ 04 ]

Improvement in Prediction Performance Using Predictive Error Compensated Neural Networks.

Kulaglic, A., & Ustundag, B. B.

Springer Lecture Notes in Networks and Systems. Continuing research extending the PEC-WNN architecture; demonstrates ongoing program investment through 2024.

Technical Evaluation

Request a technical deep dive.

A 60-minute working session with the engineers who built the platform. We walk you through the architecture, the algorithm portfolio, a live investigation on your own telemetry, and the full research bibliography under NDA.

Under mutual NDA · Engineer-led session · No sales overlay

ONE PLATFORM. EVERYTHING COVERED.
Demo
Black stylized text logo reading ARRTECH.
Today
Try for free black button.
ARRTECH provides monitoring, evidence, and controls to support audits (e.g., SOC 2, ISO 27001, HIPAA, GDPR). Certification outcomes depend on your full program (policies, processes, people, third-party tools).
Daily data-ingest caps are organization-wide (not per endpoint). If usage trends above the cap, we’ll notify you and recommend or a plan change.
Capabilities and limits vary by plan and may change as the platform evolves. Some features and pricing are in limited release.
ARRTECH — Footer