# OSINT-Based LPC-MTD and HS-Decoy for Organizational Defensive Deception
## 3 Proposed Deception Models with Organizational OSINT, LPC-MTD and HS-Decoy
### Organizational Social Engineering Deception in the Proposed Model
#### 3.1.2 LPC-MTD
In order to increase the operational reliability of the established HS-Decoy and LPC-MTD-based combined model and diversify it based on detailed organizational goals, we advanced it as a number of game strategies that were based on international US Military standards and security standards. Conceptualization, S.S. and D.K. ; methodology, S.S.; software, S.S.; validation, S.S. and D.K. ; formal analysis, S.S. and D.K. ; investigation, S.S.; resources, S.S.; data curation, S.S.; writing--original draft preparation, S.S. and D.K. ; writing--review and editing, S.S. and D.K. ; visualization, S.S.; supervision, D.K. ; project administration, S.S. and D.K; funding acquisition, D.K. All authors have read and agreed to the published version of the manuscript. This research received no external funding. Not applicable. This work was supported by a Kyonggi University Research Grant (2020). The authors declare no conflict of interest. Figure A2: GraphDB-based organizational OSINT module in Figure 5.4

Figure A3: Hierarchical compound metric tree based on attackers’ perspective. \begin{table}
\begin{tabular}{c c} \hline \hline
**OSINT Element in HS-Decoy** & **Description and Examples** \\ \hline DNS based on TLD and SLD & Hierarchical DNS-based organizational intelligence \\ Country & Country information by organization \\ ASN & Autonomous system number by organization \\  & (e.g., AS721, AS306, AS385, AS16509) \\ Network topology and infrastructure & Overall public network infrastructure by organization \\ Gateway and router-based network & Detailed network device identifier by organization \\ device & (e.g., CIGSCO’s branch, Jujner’s access point) \\ IPv4 and IPv6 address & Public or private IPv4/ IPv6 with prefix and subnet \\  & (e.g., 29.0.0.0/8, 143.140.0.0/14, 2605:3100:fffb;/48) \\ Multi-layered host system & Connected device-based information in infrastructure \\  & (e.g., application server, database, local file server, archive and backup server) \\ Port & Inbound/outbound port socket-based information \\  & (e.g., well-known, registered, and dynamic on 0–65535) \\ OS & OS fingerprint-based information by each host \\  & (e.g., HP-UX, RHEL 7, and Windows IIS 2016) \\ Protocol-based service and centabs & Service and related protocol-based corntab information \\  & (e.g., FTP, SSH, SMTP, DNS, HTTPS, RPC, NetBios) \\ E-mail & E-mail-based OSINT and HUMINT by employee \\ Organizational employee-based & (e.g., xxx@hotline.aa, [EMAIL_ADDRESS], [EMAIL_ADDRESS]) \\ HUMINT & Detailed HUMINT with Facebook and LinkedIn, Twitter \\ Virtual machine & Virtual host-based information in cloud or virtual nets \\ VPN & VPN and proxy channel-based information \\  & (e.g., vpn13.aaa.bbb, vpn\_mil.cc.dd) \\ Cloud environment & Single cloud or federated cloud-based information \\  & (e.g., cloud133.aa.bb, semi-isolated\_cloud.ccc.ddd) \\ DMZ & DMZ server, farm, and related limited network zone \\ NAC & NAC server, topology, and related access control policy \\ Hotline channel & Private hotline communication-based OSINT \\ Security solution & (e.g., hotline445.aaa.bbb, com.hotline.cc.dd) \\  & Firewall and sandbox-based security information \\  & (e.g., ipfire.xx.yyyy, sandbox.host114.aa.bb) \\ \hline \hline \end{tabular}
\end{table} 
Table 10: Overview of OSINT composition with DNS enumeration for LPC-MTD and HS-Decoy.