# OSINT-Based LPC-MTD and HS-Decoy for Organizational Defensive Deception
## 3 Proposed Deception Models with Organizational OSINT, LPC-MTD and HS-Decoy
### Organizational Social Engineering Deception in the Proposed Model
#### 3.1.2 LPC-MTD  
Existing MTD and N-MTD have been studied to avoid invasion attempts proactively or to improve metrics and variables with a focus on the attenuation of the defender's diversified attack and exploration surface, and then apply it in applied domains, such as IoT [44], cloud [45], and cyber physical systems [46]. Our reason for selecting an MTD mutation cycle using LPC-MTD was to ease the operational deceptive limitations of existing MTD, and to enhance the lack of reactive responses. Further, the aim was to intentionally expose false information or disinform attackers who analyze social engineering APT or MTD mutation patterns by reducing the mutation intensity that is arbitrarily guided by the defender to weaken the avoidance itself, leading to a dynamic decoy bed, rather than being limited to unconditional avoidance of random attacks. In addition, this LPC-MTD mutation selection strategy can be realized based on the organizational mutation threshold as well as deep combination with organizational OSINT-based HS-Decoys, depending on the avoidance strength, attack surface exposure, and attenuation of the MTD mutation function. It will also be possible to advance defender deception for organizational MTD selection, calculate trade-offs, consider the OSINT influence on the network separation environment, and standardize OSINT-based resilience and agility. Thus, the compound equation of LPC-MTD was configured, as per Equations (1) and (2) in Table 2 based on perturbation and Bellman sampling because of the principles of MTD [5; 47; 48; 49; 50; 51; 52]. Figure 2: Lower-level overview of the asynchronous parallel chain-based organizational OSINT process. ```
Input: T, \(\overline{\tau}\), \(\underline{\gamma}\), C, \(\theta\) Output: M\({}^{\star}\) \(\forall x\in T\), t = 0, \(VS^{0}(x)=0\); while\(C\underline{VS}>\overline{VS}-\underline{VS}\):  t = t + 1; for\(x\in T\): \(v=\infty\); for\(\tau=\underline{t}\); \(\tau\leq\overline{\tau}\); \(\tau=\tau+\theta\): \(M^{\prime}=\operatorname*{argmin}VS^{t}(x,\,M,\,\tau)\); \(M\)  if\(v^{\prime}<v\): \(M^{\star}_{x}=M^{\prime}\), \(\tau^{\star}_{x}=\tau\), \(v=v^{\prime}\); \(VS^{t}(x)=\); \(\overline{VS}=\max\limits_{x\in T}\left|VS^{t}(x)-VS^{t-1}(x)\right|\); \(\underline{VS}=\min\limits_{x\in T}\left|VS^{t}(x)-VS^{t-1}(x)\right|\); returnM\({}^{\star}=\overline{VS}-\underline{VS}\);
```  
**Algorithm 1**Value iteration-based batch sampling in LPC-MTD. Algorithms 1 and 2 shows the pseudocode of the LPC-MTD equations in Table 2, and it is normalized with reference to the association and combination between HS-Decoys, and related mutation variables that will be updated. ```
Input: T, \(\overline{\tau}\), \(\underline{\gamma}\), C, \(\theta\) Output: M\({}^{\star}\) \(\forall x\in T\), t = 0, \(VS^{0}(x)=0\); while\(C\underline{VS}>\overline{VS}-\underline{VS}\):  t = t + 1; for\(x\in T\): \(v=\infty\); for\(\tau=\underline{t}\); \(\tau\leq\overline{\tau}\); \(\tau=\tau+\theta\): \(M^{\prime}=\operatorname*{argmin}VS^{t}(x,\,M,\,\tau)\), \(v^{\prime}=VS^{t}(x,\,M^{\prime},\,\tau)\); \(M\) if\(v^{\prime}<v\): \(M^{\star}_{x}=M^{\prime}\), \(\tau^{\star}_{x}=\tau\), \(v=v^{\prime}\); \(VS^{t}(x)=\); \(\overline{VS}=\max\limits_{x\in T}\left|VS^{t}(x)-VS^{t-1}(x)\right|\); \(\underline{VS}=\min\limits_{x\in T}\left|VS^{t}(x)-VS^{t-1}(x)\right|\); returnM\({}^{\star}=\overline{VS}-\underline{VS}\);
```  
**Algorithm 2**OSINT-based perturbation for artificial disclosure. ``` Input: \(\overline{l}\), \(\underline{l}\), s Output: P* t = 0, listavg = [], \(\mu(s)=\Pr[S=s]\); for\(l=\underline{l}\); \(l=\underline{l}\);  t = t + 1; \(\overline{P}=\max\limits_{s}\left|\mu(s)\right|\sum\limits_{l}P(l\left|s)LC\right.\); \(\underline{P}=\min\limits_{s}\left|\mu(s)\right|\sum\limits_{l}P(l\left|s)LC\right.\); if\(\overline{P}-\A decoy should allow legitimate users to distinguish it from actual information and operations, and attackers should not be able to distinguish it without prior knowledge of the target system.