CYBERFOLD · COMPLETED RESEARCH · INDUSTRIAL CYBERSECURITY

A clearer view of complex network traffic.

CyberFold explored how the geometry of data can help interpret anomalies and make security alerts more useful to human analysts.

A BigMed+ research project at Universidad Rey Juan Carlos · 2023–2025.

Conceptual folded surface showing how many network variables can be represented as a simpler structure. Illustrative drawing, not experimental data or evidence of a detected threat.

Inside the research →

Three ways to make complexity more useful.

From industrial traffic to power substations and noisy alert streams: specific questions, public evidence.

01 / INDUSTRIAL IOT

Which view of the data should we trust?

Comparing representations of network traffic reveals why one method cannot preserve every kind of structure. Local relationships, global geometry and class separation are different objectives.

02 / POWER SUBSTATIONS

Different anomalies need different explanations.

GOOSE network research separates message integrity from timing to help interpret unusual behaviour. Read the public manuscript ↗

03 / SECURITY OPERATIONS

Give the analyst a clearer starting point.

Communities of related alerts and language models help make false-positive-heavy outputs easier to investigate. Read the article ↗

Publications and public versions

Follow the evidence. Each contribution groups its journal article, earlier preprint and resources where available, without counting versions twice. Publications may appear after the project’s execution period. Shared-funding, cross-domain outputs are identified separately from the core cybersecurity cases.

Industrial IoT cybersecurity representations

Evaluating Manifold Learning Techniques for Dimensionality Reduction on Industrial IoT Cybersecurity Data. IEEE Access, 14, 25370–25387, 2026.
Published article ↗ · Institutional record ↗

Explainable anomalies in GOOSE networks

Explainable Autoencoder-Based Anomaly Detection in IEC 61850 GOOSE Networks. IEEE Access, 14, 71029–71042, 2026. Published 6 May 2026.
Published article ↗ · Earlier preprint (arXiv) ↗

Finding useful alerts in noisy IDS outputs

Highlighting true alerts in false-positive-heavy intrusion detection systems outputs through unsupervised community detection and large language models. Information Sciences, 757, article 123896, 2026. Available online; issue dated 5 December 2026.
Journal article ↗

PeBEx · Efficient perturbation-based explanations

Towards Explainable Artificial Intelligence in Machine Learning: A study on efficient Perturbation-Based Explanations. Engineering Applications of Artificial Intelligence, 155, article 110664, 2025.
Published article ↗ · Institutional version ↗

PPG · A shared methodological application

Manifold Learning Approaches for Characterizing Photoplethysmographic Signals. IEEE Transactions on Biomedical Engineering, 73(6), 2214–2226, June 2026. First published online 27 October 2025. A cross-domain methodological result, not an IIoT traffic dataset.
Published article ↗ · Institutional record ↗ · PPGfold code ↗

Reconstructive kernel embeddings

Learning Reconstructive Embeddings in Reproducing Kernel Hilbert Spaces via the Representer Theorem. IEEE Open Journal of the Computer Society, 7, 659–669, 2026. Published 9 April 2026.
Published article ↗ · Earlier preprint (arXiv) ↗ · Supplementary code ↗

MURHCAD · Cloud honeypot data descriptor

Descriptor: Multiregional Cloud Honeynet Dataset (MURHCAD). IEEE Data Descriptions, 3, 310–318, 2026. Published 27 April 2026.
Published article ↗ · Earlier preprint, under a different title ↗ · Dataset ↗

Interpretable behavioural clusters · A shared methodological output

Interpretable behavioral clusters of gamblers through unsupervised learning. Acta Psychologica, 267, article 106947, 2026.
Mana Azizsoltani · Ismael Gomez-Talal · José Luis Rojo Alvarez · Kasra Ghaharian.
A cross-domain application acknowledging CyberFold support alongside other funding; not an industrial cybersecurity study. No underlying participant data are redistributed here.
Published article ↗

Further research · Public preprints

Public manuscript versions on arXiv, not presented here as peer-reviewed journal articles. Follow each record for its version history and any linked journal publication.

Latent diffusion for IoT attack data

Latent Diffusion for Internet of Things Attack Data Generation in Intrusion Detection.
Estela Sánchez-Carballo · Francisco M. Melgarejo-Meseguer · José Luis Rojo-Álvarez.
arXiv:2601.16976 · 2026.
Read the preprint ↗

Interpreting manifolds and graph embeddings

Interpreting Manifolds and Graph Neural Embeddings from Internet of Things Traffic Flows.
Enrique Feito-Casares · Francisco M. Melgarejo-Meseguer · Elena Casiraghi · Giorgio Valentini · José-Luis Rojo-Álvarez.
arXiv:2602.05817 · v2 · 2026.
Read the preprint ↗

Open resources and outreach

MURHCAD

Multi-regional cloud honeypot telemetry. Open dataset and documentation, MIT licence.
Explore the dataset ↗

Cloud HoneyNet Tutorial

Cloud-native T-Pot honeypot infrastructure on Microsoft Azure. Open infrastructure and code, MIT licence; not a separate independent dataset.
Open the tutorial ↗

Code for reuse

Reconstructive kernel embeddings ↗
PPGfold supplementary code ↗ · GitHub ↗
PPGfold is a methodological application to physiological signals, not industrial traffic data. Reused clinical datasets retain their own access and licence conditions.

Beyond the laboratory

La forma de los datos

Summer course on artificial intelligence in cybersecurity and health. Valdevimbre · 25–27 June 2025.
Course programme ↗

European Researchers’ Night

Research outreach in Fuenlabrada · 27 September 2024.
Institutional event page ↗

Project research team

Principal investigator: José Luis Rojo-Álvarez · Universidad Rey Juan Carlos.

Alicia Guerrero
Sergio Muñoz
Juan R. Feijoo
Javier Gimeno
Luis Bote
Francisco Melgarejo
Margarita Rodríguez
Ismael Gómez
Andrea López
Estela Sánchez
Dafne Lozano
Enrique Feito

Research team during the project. Full author names and affiliations are available in the linked publications.

Funding

CyberFold was carried out at Universidad Rey Juan Carlos (URJC), within the BigMed+ research environment, under the collaboration agreement with the Instituto Nacional de Ciberseguridad de España (INCIBE) for strategic cybersecurity projects.

Funded by the European Union – NextGenerationEU, within Spain’s Recovery, Transformation and Resilience Plan (PRTR). Project reference: ETD202300129 · URJC internal reference: F1086.

Project period: 15 November 2023 – 31 December 2025.
Principal investigator: José Luis Rojo-Álvarez · Universidad Rey Juan Carlos.

Publications released after the project period may acknowledge the work supported by CyberFold.

Funded by the European Union – NextGenerationEU. Official logos of the European Union, Government of Spain, Recovery, Transformation and Resilience Plan, INCIBE and Universidad Rey Juan Carlos.