# OSINT-Based LPC-MTD and HS-Decoy for Organizational Defensive Deception
## 2 Related Studies and Taxonomy of Proposed Deception Models
### Game Theory MTD Research  
Studies on N-MTD based on game theory focus on modeling the mutation of the defender on a competitive strategy toward the attacker and optimizing the MTD variables for each scenario. The main goal is to maximize the gains of defenders and minimize the gains of attackers by advancing the deception strategy. They are mainly classified into general game theory-based research, Bayesian Stackelberg game theory-based research, and stochastic game theory-based research [5; 25; 26]. First, in general game theory-based research, [PERSON] et al. [27] calculated a quantitative MTD trade-off between the security of the defender enhanced by MTD and degraded performance (e.g., service unavailability and increased system reconfiguration cost) with a focus on the correlations and trade-offs specialized for each scenario by applying common game theory equations and metrics to the MTD mutation concept. This was the first time a specialized game theory was established to calculate an MTD applicational strategy for threat backtracking and threat hunting system construction. To ensure high network visibility and throughput and improve cyber agility [28], [PERSON] et al. [29] proposed an incentive-compatible MTD game theory based on a server's migration and communication mapping mechanism between normal users. This introduced the concept of cyber agility in the construct of N-MTD. [PERSON] et al. [30; 31] applied game theory as an optimal migration strategy to avoid suspicion of induced and isolated attackers and ensure seamless connection for each legitimate user. This made it possible for them to quantitatively verify that the diversity of cloned platforms for the application of H-MTD at a lower level is more effective for some continuous attacks than pure random selection mutations. However, it was inefficient in performing rapid local attack-related mutations. It was also found that ensuring high hierarchical diversity for each dummy platform led to higher proactive advantages than purely possessing a large number of dummy platforms. Second, in Bayesian Stackelberg game theory-based research, [PERSON] et al. [32] proposed CAMP, a Nash equilibrium-based game model to minimize the influence of internal and external threats that are caused by the infringed co-virtual machine (co-VM) while detecting a co-resident attack, a side-channel attack within a virtual environment that shares the same temporal/spatial resources. Through this, it was proved that the proposed Monte Carlo-based CAMP could immediately provide an active attacker induction and isolation tactic related to the optimal MTD defense strategy in a virtual environment by cloning a normal server. [PERSON] et al. [33] proposed an artificial information disclosure model that was based on Bayesian Stackelberg to improve proactive prevention in defender MTD. Based on a signaling game, which is an interactive decision strategy, the defender's intentional disclosure of information would perturb and skew the attacker's initial decision making, proving that it is a promising methodology that could not only reduce attack persistence, but also improve the overall agility of the defender. To apply the concept of artificial information exposure in practical environments, [PERSON] et al. [34] proposed a Stackelberg game solution that generated and disclosed false packets that aimed at the reconnaissance stage of internal and external attackers, making it possible to improve the efficiency of indeterminate attacker induction and isolation mechanisms in multi-routing networks, and it also improved the practical applicability of the deception concept. Third, in stochastic game theory-based research, [PERSON] et al. [35] proposed an optimal MTD game model based on a mechanical surface by mathematically calculating the strategies for each MTD mutation state reflecting the diversity of the attack-defense dynamics based on probabilistic conversion as an extension of the previous attack surface quantification research [36].