SV ADS
Anomaly detection for IEC 61850 Sampled Values traffic
by PowerProfs
About
SV ADS captures SV Ethernet traffic with a C++/libpcap backend, parses Ethernet/VLAN/SV/PDU/ASDU evidence with bounds checks, and learns per-stream baselines. It does not block packets — a packet rejected from internal ADS state tracking may still reach real subscribers. Alerts are mapped to MITRE ATT&CK for ICS, evidence is stored in SQLite, and a React dashboard renders everything from backend-generated data.
What's New
v0.4.0 (Beta)- Per-stream baseline learning
- SQLite evidence store
- MITRE ATT&CK for ICS alert mapping
Updated 4d ago
Capabilities
Passive SV capture
C++/libpcap backend captures IEC 61850 Sampled Values traffic without touching the wire — no packets are blocked or delayed.
Deep protocol parsing
Bounds-checked parsing across Ethernet, VLAN, SV, PDU, and ASDU evidence layers.
Per-stream baselining
Learns per-stream baselines and flags deviations as they emerge.
MITRE ATT&CK for ICS mapping
Every alert is mapped to MITRE ATT&CK for ICS and stored as auditable evidence in SQLite.