Bitstream OT-IDS Intrusion Detection System for OT-ICS Networks in Substations and Critical Infrastructure Plants

The Bitstream OT-IDS is the intrusion detection system designed specifically for operational technology (OT) networks in critical infrastructure — where conventional IT IDS systems cannot be applied because injecting test packets into a network controlling high-voltage circuit breakers or chemical plant valves can cause equipment trips or physical safety incidents rather than simply detecting the attack.

The OT-IDS sensor connects in completely passive mode via a SPAN port on the IEC 61850-3 switch of the substation or plant — it captures and analyzes all control network traffic without transmitting any packets to the network — and builds a baseline behavior model of the OT network during the first 72 hours of operation: it learns which IEDs send GOOSE messages to which other IEDs, at what frequency, what parameter values are normal for each Modbus register, and what DNP3 traffic patterns correspond to normal SCADA operations. Once the baseline is built, the system generates real-time alerts when deviations are detected: an IED that has never sent circuit breaker control GOOSE messages now sends a circuit breaker opening command (possible lateral movement by an attacker who has compromised that IED), a new device appears on the network that was not in the original inventory (possible unauthorized device), or the SCADA server issues Modbus commands with values outside the historical operating range (possible HMI or SCADA manipulation).

Air-gapped deployment without internet is a design requirement — the OT-IDS needs no external connectivity to update signatures or function, and its management and alert interface operates exclusively on the plant's internal management network via TLS 1.3 without cloud service dependency. Alerts are exported in real time to the organization's SIEM via syslog or to the OT asset management system via REST API, with automatic categorization according to NERC-CIP CIP-007 and CIP-010 incident categories to facilitate regulatory compliance documentation.