One of our company’s most significant success stories has been the development and deployment of InprOTech Guardian, an anomaly detection system based on behavior and process mining at the Takasago industrial plant.
This is a major R&D project funded by the CDTI (Spanish Centre for the Development of Industrial Technology), a public corporate entity under the Ministry of Science, Innovation and Universities, and supported by the Ministry of Science, Innovation and Universities, carried out between October 2021 and February 2024.
Takasago International Corporation is a chemical company originating from Japan, established in 1920. It specializes in the production of flavors and fragrances, ingredients for the food industry, as well as fine chemicals. Its activities span various sectors, including food and beverages, perfumery, cosmetics, and personal care products, among others.
It has a significant international presence, with operations and subsidiaries in numerous countries around the world, including the Americas, Europe, Asia, and Oceania, and is listed on the Tokyo Stock Exchange. In Spain, the industrial plant is located in El Palmar (Murcia).
THE CHALLENGE
Takasago has a high level of operational excellence and is constantly seeking improvements in the efficiency and effectiveness of industrial processes, aiming at aspects such as reducing anomalies and potential cyber-attacks.
These eventualities, whether at the level of safety or security, can potentially lead to plant shutdowns (with the associated economic cost), problems with information integrity or processes with potential impact on the health of staff or customers, and even losses of confidentiality through leaks of personal data or industrial property.
All these issues are critical from a strategic and business continuity perspective.
INPROTECH SOLUTION
In this situation, InprOTech proposed two measures:
- The deployment of the InprOTech Guardian asset inventory and anomaly detection solution in industrial environments, to cover some gaps in preventive controls and information security detection in Takasago’s industrial network defense-in-depth scheme.
- To conduct research, development, and implementation of an anomaly detection capability based on UEBA (User and Entity Behavior Analytics) and Process Mining, to detect potential security incidents based not only on traffic patterns but also on the behavior of variables involved in their critical processes (multivariable time series analysis).
This second component was developed over several months in collaboration with our technological partner Gradiant.
RESULTS
The implementation of the InprOTech Guardian service allows us to:
- Know all assets connected to the network, inventorying exhaustively, automatically, and non-intrusively all assets present in the infrastructure.
- Have real-time monitoring of cybersecurity status in the factory through a specific service for OT networks.
- Generate security alerts by detecting anomalies based on heuristics, an intrusion detection system, and patterns (AI/ML algorithms), exportable to a central event ingestion and correlation system (SIEM).
- Facilitate compliance with information security regulations by Takasago (ISO 27001, ISA IEC 62443, etc.).
The research, development, and integration into Guardian of the anomaly detection technique based on UEBA and Process Mining facilitated:
- The individual modeling of nodes and the analysis of process variables within the scope of Takasago’s industrial cybersecurity surveillance.
- The integration of this knowledge and new capability into InprOTech Guardian for use by the rest of the client portfolio.
TAKASAGO TESTIMONIAL
“From Takasago’s perspective, any systems that help detect anomalies in systems early are welcome. Thanks to the work developed, a new method for the early detection of intrusions in IT and OT systems has been proposed, avoiding possible interferences in the systems that could lead to dangerous situations, mainly in OT systems.” – Fernando Manuel Martínez Technical, EHS & IT Director of Takasago.