# OSINT-Based LPC-MTD and HS-Decoy for Organizational Defensive Deception
## 3 Proposed Deception Models with Organizational OSINT, LPC-MTD and HS-Decoy
### Organizational Social Engineering Deception in the Proposed Model
#### 3.1.2 LPC-MTD
\begin{table}
\begin{tabular}{c c c} \hline \hline
**Parameter** & **Value** & **Description** \\ \hline Number of organizational intelligences & 1–90 & Number of OSINT-based organizational intelligence \\ Number of network topologies and & 1–5 & Number of network topologies by organization \\ infrastructures & 10–100 & Number of participating servers or hosts in topology \\ Number of shutdown system nodes & 0–30 & Number of down nodes at a specific mutation time \\ Number live system nodes & 10–100 & Number of live nodes at a specific mutation time \\ Number of OS platforms & 1–5 & Number of operating systems by host \\ Number of services & 1–20 & Number of control or protocol-based services by OS \\ Number of vulnerabilities & 10–50 & Number of vulnerabilities based on CVE \\ Level of vulnerabilities & L-M-H-V-U-C & Rating level for vulnerabilities with CVSS score \\ Number of HUMINT intelligence & 0–20 & Number of personal intelligence-based HUMINTs \\ Number of virtual environments & 0–20 & Number of VM-based virtual environments \\ Number of multitenancy clusters & 0–5 & Number of cloud, DMZ, and hotline-based clusters \\ Number of security solutions & 0–3 & Number of firewall, NAC, sandbox-based solutions \\ Enabling enticingness of HS-Decoy & 0.3–1.0 & Enabling in-depth decoy process to attackers initially induced \\  & & through artificial disinformation behavior \\ Enabling conspicuousness of HS-Decoy & 0.7–1.0 & Enabling protrusion scheme of arbitrary defenders’ OSINT within the attack and exploration surfaces \\ Enabling variability of HS-Decoy & 0–1 & Enabling diversity of OSINT with batch sampling to reveal the characteristics of each organization \\ \hline \hline \end{tabular}
\end{table} 
Table 2: Examples of deceptive parameters of LPC-MTD. \begin{table}
\begin{tabular}{c c} \hline \hline
**Element** & **Value** \\ \hline Operating system & Ubuntu 20.04 LTS (VM) \\ CPU 1 and GPU 1 for simulation in SDN & INTEL I7-10700, NVIDIA GTX 2060 super \\ CPU 2 and GPU 2 for mathematical post-processing & INTEL I7-10875H, NVIDIA GTX 2060 \\ Type of communication nodes & Producer, controller, forwarder, interpreter, consumer, and filter \\ Enabling filter nodes for deception & True \\ Maximum number of re-transmissions count & 0–3 (Dynamic declaration according to the number of SDN switches) \\ Maximum number of re-synchronization count & 0–3 (Dynamic declaration according to LPC-MTD mutation) \\ SDN protocol & OpenFlow 1.4, OpenFlow 1.3 \\ SDN controller & ONOS Sparrow LTS 2.2.0, Ryu \\ OF-based SDN virtual switch & Open vSwitch LTS 2.10.1 \\ Attack scenario modeling for assessment in SDN & LM CKC and Mandiant APT with CVE and CAPEC \\ Number of IODA-based containers in SDN & 1–10 \\ Number of virtual switches in SDN & 3–8 \\ Number of VIP pairs with one rIP & 1–10 \\ Number of vPort pair with one rPort for service & 10–1023 \\ Maximum routing rule for mutation & 2–2\({}^{10}\) \\ Targeted protocol model applied within SDN & TCP/IP model \\ Integrated SDN environment referenced [60] & SDN Hub VM \\ Major open source software referenced [61; 62; 63; 64; 65] & T-Pot, DejaVU, Cuckoo Sandbox, VMCloak, OpenCTI, Amass, \\ theHarvester, OSINT Framework, Recon-ng, Social Engineer Toolkit & Declared according to OSINT-based open source software(e.g., Bing, Duckduckogo, HackerOne, RapidDNS, AlienVault, Censys, Cloudflane, BufferOver, VirusTotal, Facebook, Twitter, Shodan) \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Configuration of experimental elements in SDN-based testbeds and MATLAB-based post-processing.