# OSINT-Based LPC-MTD and HS-Decoy for Organizational Defensive Deception
## 3 Proposed Deception Models with Organizational OSINT, LPC-MTD and HS-Decoy
### Organizational Social Engineering Deception in the Proposed Model
#### 3.1.2 LPC-MTD
A batch pool size of 300 or more without considering the delay resulted in overhead due to frequent mutation cycle reset up to 200 s. Finally, if the HS-Decoy mutation stratification of LPC-MTD was performed with reference to (d) and the defense efficiency was improved with a single parameter by presenting randomness, related sampling-based parameters should be limited to less than 100 when the sampling was extended to a value between 100 and 200, while minimizing uncertainty. Figure 8e shows the attacker's payload that is related to the packet control issue in the SDN controller or transmission control overhead by the defender's dummy fingerprint size among potential overheads in a deception sequence, as shown in Figure 5.1 When customizing the maximum allowed packet size as the maximum segment size (MSS) according to the standard in which the protocol traits were fixed to TCP without exceeding the delay threshold within the SDN, an average of 118 ms was derived in the time span from 300 s to 450 s, except for the rapid increase in overhead due to rule table exception processing in the SDN controller when defining the payload size (or dummy fingerprint size) from 4096 bytes to 8192 bytes. The sudden change in overhead for payloads of 2048 and 16,384 bytes was low (the sudden change for 16,384 bytes is higher than that of 2048 bytes with a gradient), being recorded at 187 ms and 258 ms, respectively. This aspect was calculated while performing the LPC-MTD mutation policy, as it is based on the rule table in the SDN controller, regardless of the byte multiple difference. Finally, when the transmission control overhead in IODA was attenuated to a packet size with reference to (e), it should be limited to a range between 8192 and 2048 bytes. Conversely, when the sudden change in overhead is minimized, it should be calculated as 2048 bytes. Figure 8f shows the scale of attack effort, depending on the number of CVE vulnerabilities used as final compromise points in the defender's sandbox. This shows that, as the number of vulnerabilities increased, the attack time increased linearly by 10%. Next, after enhancing the organizational infrastructure that was replicated within IODA based on public OSINT traits related to US Armed Forces, US Unified Combatant Command, and US Intelligence Agencies, in Figure 9 we present a result set that calculated the operational security LPC-MTD and HS-Decoy mutations that were optimized for each organization by performing attack-defense simulation within a limited range. Figure 9a conceptually shows the attacker's inferiority based on time slot length optimized in relation to the US Military-based deception security environment by applying public OSINT information groups based on active military specifications that are related to US Army, US Air Force, US Navy, US Marine Corps, US Coast Guard, and US Space Force among eight detailed military organizations, including the Department of Defense,

Figure 5.2 Comparative results of public OSINT-based environments by US organizations. (**a**) US Armed Forces-based, (**b**) US Unified Combatant Command-based, and (**c**) US Intelligence Community-based. which make up the US Military. First, it is proved that the US Air Force produced the highest prophylactic deception efficiency and agility on average when compared to other organizations and obtained the highest defender superiority when the LPC-MTD mutation cycle was 7 s. It also shows that the most optimized trade-off was produced at 19 s based on a downward gradient when aiming for a high overhead reduction according to frequent mutations in the US Air Force-based environment while maintaining high proactive security. The US Army, US Marine Corps, and US Coast Guard show similar tendencies, but the US Army produced the lowest overhead for changes in the organizational environment due to mutation, while accepting attacker compromise most reliably, on average, as the mutation time slot length increased when compared to other organizations.