# OSINT-Based LPC-MTD and HS-Decoy for Organizational Defensive Deception
## 3 Proposed Deception Models with Organizational OSINT, LPC-MTD and HS-Decoy
### Organizational Social Engineering Deception in the Proposed Model
#### 3.1.2 LPC-MTD
Subsequently, to reflect real-time change in OSINT trends, reputations of third parties, LPC-MTD mutation cycle selection weight, and gradient in the HS-Decoy-based decoy bed, we multiplexed them on an independent distributed multi-tenant basis. We also considered a scheme for enforcing the defender superiority in an asymmetric attack-defense relationship by defining connectivity, dependence, and ripple power within HS-Decoy as a graph because of the entropy correlation of each OSINT. ### Design Principles of Proposed Deception Model

#### 3.2.1 IODA, Integrated OSINT-Based Deceptive Architecture

We present the integrated OSINT-based deceptive architecture (IODA) based on SDN using multiple decptions, like Honey-X, embedded decoy, and social engineering tool, in this section in order to apply and verify LPC-MTD and HS-Decoy. The LPC-MTD concept was introduced in the upper layer with a focus on the MTD function based on the DRHM [43] strategy, while the OSINT-based HS-Decoy was multiplexed into a single kernel-based distributed sandbox container in the lower layer. Along with LPC-MTD based multi-layered induction, isolation, and monitoring, it was conceptualized, as shown in Figure 4, to apply the activeness and adaptability in decision making of HS-Decoy based on DDD [57] strategy. Next, we describe each component of the SDN-based IODA. 1. Integrated management module for LPC-MTD mutation (IMM): this is a central management module that controls and manages all of the sub-modules in IODA using periodic control packet-based identification, authentication, authorization for each module, and comprehensively performs OSINT-based mutation. The module collectively performs the following: LPC-MTD-based structural mutation for docker-based sandbox, such as a legitimate server pool and deceptive server pool, TDM-based attacker detection and monitoring, artificial disinformation projection through OSINT-based HS-Decoy, deception of attack surface form, and migration-based induction. * Interactions between IMM and LSM, DSF: in order to utilize all of the LPC-MTD concepts to project and expose organizational OSINT-based HS-Decoy-related disinformation, there is a process to distinguish an illegitimate user using IMM. This will attract the illegitimate user to DSF, and legitimate users will be routed to LSM. An illegitimate user could either be a legitimate user who is abusing their access or a malicious attacker, so the classification is supplemented based on the flow and rule table that were already configured in the deceptive server, and the update of the corresponding tables is determined based on the periodicity of proxy channels between IMMs and OSINT characteristics. * Regarding the adaptive management of HS-Decoy in DSM and HMM, TDM is used as a trait extraction and processing module for attack detection and fingerprint scrubbing in IMM to calculate the effective information group. * Interaction between IMM and OOM: unlike other sub-modules, OOM is directly managed by a supervisor connected as proxy, and not by IMM. This secures independence for OSINT and performing access control-based encapsulation. * Legitimate server module (LSM): in the LPC-MTD concept, this is a legitimate server pool with limited mapping based on a flow table or a vulnerability table, and only users who request a network and host-based OSINT information group can use it legally at an arbitrary time in the organization for a predetermined length of time. If the detected user is a legitimate user, then the module provides organizational services within IODA and performs OSINT-based connection migration between legitimate users according to the LPC-MTD mutation, while performing the process of specifying and managing induction and isolation to deceptive servers within a specific DSF group based on network control packets in the case of attackers.