# OSINT-Based LPC-MTD and HS-Decoy for Organizational Defensive Deception
## 3 Proposed Deception Models with Organizational OSINT, LPC-MTD and HS-Decoy
### Organizational Social Engineering Deception in the Proposed Model
#### 3.1.1 Organizational OSINT for MTD and Decoy  
OSINT is a public and reliable source of information from a government agency or other providers. It collectively refers to the process of collecting information from public sources, such as detailed organizational information and unique characteristics. OSINT is used in various fields, such as the military, security, law enforcement, business, and cyber security. In addition, it can be classified as an information flow category that is based on multiple domains, such as media, internet, and government data.  
Figure 2 shows the basic OSINT process in the proposed model that focus on the following detailed processes: the organizational planning process that identifies sources of information and establishes the OSINT strategy and security requirements that are related to the organization's legacy operating environment. The collection process during which information is actively or passively collected from public information groups according to the identified organizational information sources and OSINT strategy. The analysis and update process is when acquired data are normalized based on correlation and then reinforced and updated according to its purpose. Finally, the knowledge extraction process involves the organizational OSINT information being advanced through deception-related knowledge to LPC-MTD and HS-Decoy and simultaneously purifying it to create final organizational information. Further, the model is standardized for each organization for the layering and systematization of OSINT and implemented to be configured as an element of crowd operational security with deception and precision to organizational cyber space intelligence (CYBINT).  
Figure 1: Main overview of the proposed open-source intelligence (OSINT)-based deception model with organizational OSINT, loosely proactive control-based MTD (LPC-MTD), and hierarchical social engineering decoy (HS-Decoy).  
Organizational OSINT information is collected passively, focusing on the asynchronous chain-based OSINT process presented in Figure 2, and then normalized by element and standardized in graphDB to ensure higher speed, adaptability, and responsiveness when compared to existing sequential processes. Subsequently, the decoy feature is reinforced to standardize it, even as a cooperative deception process within a distributed multi-HS-Decoy, and updates are performed on a regular basis to reflect the real-time changes in OSINT trends. At this time, the OSINT group is created, distributed, and updated based on the organizational environment in which MTD and decoy-based deception are applied. To artificially induce the defender's asymmetric superiority relationship and extreme cognitive skewness, reputation is calculated based on the third party referenced during collection, and updated weights for each entity are then applied to attenuate the ambiguousness of the existing OSINT. Thus, the final standardized OSINT information group by major government organizations is constructed in detail, as shown in Table A1 and Figure A1 in Appendix A. The total number of OSINT elements was 26 million. To comply with the research ethics, we calculated and reconstructed the mutation weights hierarchically, using only published fingerprints.