# OSINT-Based LPC-MTD and HS-Decoy for Organizational Defensive Deception
## 3 Proposed Deception Models with Organizational OSINT, LPC-MTD and HS-Decoy
### Organizational Social Engineering Deception in the Proposed Model
#### 3.1.2 LPC-MTD
Figure 10a defines the scale of deception efficiency as the step-by-step occupation probability by standardizing the optimized LPC-MTD and HS-Decoy-based deception sequences with CKC simulation, and beaconizing the final compromise points in the CKC phase. First, in the reconnaissance phase, an occupation success rate of 60% was derived from an execution time exceeding 201 s, and 100% was calculated from 271 s to achieve the initial infiltration and occupation. After that, while collecting lower layer information sequentially, such as hosts and services, based on the defender's random trait information used for the initial invasion up to 610 s, chain attacks continue to fail until the 770 s mark, because the validity of the defender trait that was utilized by the attacker had expired due to the mutation scheme after the immediate intervention of the defender, who identified that the final compromise point surfaced as a reconnaissance phase was occupied. At this time, the defender's response was late when occupying the reconnaissance phase, because it performed loose mutations in LPC-MTD and intentional HS-Decoy leakage. The invaded environment was a false beacon that was constructed by the defender, so no security issues existed. However, prior to the defender's late intervention and mutation, the attacker already collected and enumerated additional information to continue the new attack chain, enabling it to occupy quickly while drawing a sharp upward gradient. In other words, from 871 s, the attacker re-occupies the reconnaissance phase and completes invasion to the weaponization and exploitation phases at 936 and 976 s, respectively. Subsequently, based on the SDN controller's rule-based control that detected the attacker payload that continues from the exploitation phase, it shows that the attacker's asymmetric superiority relationship was completely resolved under the defender's intention. Accordingly, Figure 10b shows that the attacker's asymmetric superiority and the effectiveness of the defender's traits that were collected at a specific point in time declined and expired sequentially based on transfer entropy under the deceptive intention of the defender who had identified a random attacker pursuant to (a)'s result. ## 5 Discussion

This study proposed an organizational OSINT-based HS-Decoy and an LPC-MTD for artificial information exposure to improve and optimize the operational efficiency of cyber deception applied in an organizational operating environment. This made it possible to produce theoretical diversity that alleviates the operational limitations in the actual organizational environment created by existing MTD and decoys. Summarizing the results, when formulated the attack success probability, artificial information exposure

Figure 5.3 CKC-based compromise likelihood and multi-dimensional entropy-based results in the IODA simulation. (a) CKC phases based on reconnaissance, weaponization and exploitation, (b) transfer entropy-based operational surfaces. ratio, deceptive probability, and enticingness probability as major comparative metrics, and the total attack efficiency through LPC-MTD and OSINT-based HS-Decoy was reduced by 287%, on average. In addition, it was verified that the deception efficiency can also be improved by 382%, on average. Subsequently, as a result of detailed parameter-based sensitivity analysis for optimization of proposed deception concepts, the optimized periodic mutation time slot was calculated as 174s, the optimized mutation scope was 2048, mutation selective batch pool size was 169, and exploit or dummy packet size was 2048 bytes. Moreover, it was proved that the increase rate of deception overhead by an organization for U.S organizational environments simulated as standardized OSINT information groups based on third party archives and related services was also reduced by 174% on average, and the LPC-MTD-based each trade-off values was also calculated.