# OSINT-Based LPC-MTD and HS-Decoy for Organizational Defensive Deception
## 3 Proposed Deception Models with Organizational OSINT, LPC-MTD and HS-Decoy
### Organizational Social Engineering Deception in the Proposed Model
#### 3.1.2 LPC-MTD
At this time, the randomness of the mutation is created by a probability distribution with Bellman sampling - Secondary decision process: attack detection, inducement, and isolation. 1. A legitimate server in the LSM is vulnerable to possible attack attempts and invasion from users who normally accesses the legitimate server and is a substantially malicious and prudent insider or a sophisticated external attacker. 2. When a primary legitimate user, who has passed the primary judgment, attempts malicious actions present in the policy table and vulnerability database, such as internal reconnaissance, theft, elevation of privilege, and remote code execution, the user is designated as an attacker, and it is immediately induced to the deception server and sandbox in the DSF, where active isolation is performed. Next, the attacker is monitored for repeated performance based on item (1) of the primary decision process. In other words, a previously assumed legitimate user is actually an attacker. 3. In addition, the lateral scanning of an attacker in the internal network located in a deception server farm is calculated as a deep reconnaissance activity for lateral movement and pivoting, and it is maintained based on cyber kill chain (CKC). Further, additional deception is performed by providing large amounts of false response traffic or disturbed fingerprints based on previously disinformed organizational OSINT. The additionally applied vulnerability DB is constructed as a CVE table when configuring all of these organizational OSINT-based deception concepts, integrated architecture, major modules, cooperative processes, and decision strategies, as shown in Table 4. Each vulnerability was selected from the CVE lists with a focus on the ease of application and simulation implementation in the SDN-based HS-Decoy based on CAPEC [58] standard, and high CVSS focusing on Windows and Linux. Additionally, the attack contact points were formulated in detail based on port-based vulnerable services and protocols. ## 4 Experiments for Organizational Deception with LPC-MTD and HS-Decoy

In this section, the structure map and parameters of the proposed model with LPC-MTD and HS-Decoy are formalized based on normalization while using a true random generation-based Monte Carlo model and the flexible probability distribution that is based on the attack-defense scenario, and the comparative analysis with LPC-MTD and HS-Decoy deception experiments based on organizational traits is performed as a whole. ### Definition of Experimental Metrics in the Testbed

In the experiments, to focus on LPC-MTD and HS-Decoy in IODA, OSINT-based attack-defense metrics were calculated based on the hierarchical tree from the perspectives of attackers and defenders, as shown in Figures 19 and 19 in Appendix A. Each tree was classified, in detail, based on the surfaces of the attacker and defender from the atomic point of view, the surface concept was subdivided into spatiotemporal performance, effort, cost, CKC, and APT, and an interface for variable estimation was also presented. Figure 19 shows the metrics from the attacker perspective and, on the highest level, is categorized into the spatiotemporal OSINT specifications, and the effort and type of attacker. Further subdivisions were made for spatiotemporal intelligence, attack attempt, mutation cycle frequency, CKC, APT-based initial intrusion contact point, and attack chain continuity. These were then broken down into final lower attack-defense metrics. During the organizational OSINT-based experiment, the attack attempt, mutation cycle frequency, and CKC metrics were calculated as manipulation variables for producing the results for LPC-MTD and HS-Decoy. Figure 19 shows the metrics from the defender's perspective and, on the highest level, is categorized into organizational communication traits, LPC-MTD, and HS-Decoy.