CYBERFOLD / CASE 01 · INDUSTRIAL IOT

The best map depends on the question.

Compressing network traffic into a readable view is useful. Knowing what that view preserves — and what it loses — is essential.

Comparative research, not a deployed detector.
Five heterogeneous cybersecurity datasets · IEEE Access · 2026

The challenge

Industrial network traffic contains many variables. Reducing them to a few dimensions can help reveal patterns, but a convincing picture can hide distortions. CyberFold compared methods against complementary criteria, rather than treating an attractive embedding as sufficient evidence.

THE CENTRAL FINDING

There is no universal winner.

In this benchmark, different methods preserved different properties. The choice has to follow the question being asked.

Who stays close?

t-SNE and UMAP were strongest at preserving local neighbourhoods.

What shape survives?

MDS better preserved global geometry under the study’s stress criterion.

Is a simpler view enough?

PCA remained competitive for class separation, with low computational cost.