# OSINT-Based LPC-MTD and HS-Decoy for Organizational Defensive Deception
## 3 Proposed Deception Models with Organizational OSINT, LPC-MTD and HS-Decoy
### Organizational Social Engineering Deception in the Proposed Model
#### 3.1.2 LPC-MTD
Further, it can be used for persistent attacker inferiority triggering based on access event count, intrusion tolerance and restoration, and attacker initial cognitive skewness induction and isolation [54]. In summary, decoys have complex detailed properties, such as functional reliability and discrimination for deception, initial attack triggering and skewness possibility according to the defender's intention, constant exposure to trigger infringement attempts, dynamic diversity for induction, prevention of redundancy between other decoys and non-interference for abstraction, distinguishing between legitimate users and attackers, immediate early detection of invading attackers, and access control that is based on decoy-specific deceptive roles. The compound equation of OSINT-based HS-Decoy is shown in Figure 3 and it is based on Equations (3)-(9) in Table 3, with a focus on the related decoy principles [54; 55; 56; 57]. \begin{table}
\begin{tabular}{c c} \hline \hline
**Properties** & **Description of Related Decoy Equations** \\ \hline \multirow{2}{*}{Believability (B)} & Minimize the distinction between protected objects and decoys. \\  & \(Pr\big{[}Exp_{A,h,O}^{h}=1\big{]}=\frac{1}{2}\), (3) \\ \hline \multirow{2}{*}{Enticingness (E)} & Cause intentional compromise by attacker preferences. \\  & \(Pr[\rho\to O|\rho\in P]\)= \(Pr[h\to O|h\in H]\), (4) \\ \hline \multirow{2}{*}{Conspicuousness (C)} & Continuously exposes the attack and exploration surface artificially to the attacker to the defender’s advantage. \\  & \(\prod\limits_{i=0}^{n}Pr[V_{i}]\ >\ \delta\), (5) \\ \hline \multirow{2}{*}{Detectability (DE)} & Detect intrusive behavior of an attacker in decoys. \\  & \(Pr[h\to O:CD_{A,h}=1]\geq\epsilon\), (6) \\ \hline \multirow{2}{*}{Variability (V)} & Yield mutation traits and related decoys with organizational adaptability, performance, and persistence. \\  & \(Pr\big{[}h\to H:Exp_{A,h,O,V}^{h}=1\big{]}=\frac{1}{2}\), (7) \\ \hline \multirow{2}{*}{Non-Interference (NI)} & Responsible for detecting and preventing exceptions for legitimate users who refer to the decoys. \\  & \(Pr[C\bigcap_{D,\,\,h}=1]\)= \(Pr[C\bigcap_{D,\rho,h}=1|H]\), (8) \\ \hline \multirow{2}{*}{Differentiability (DI)} & Allow legitimate users to distinguish between target and lure, but make it indistinguishable to attackers. \\  & \(Pr\big{[}Exp_{D,H,O}^{h}=1\big{]}=1\), (9) \\ \hline \hline \end{tabular}
\end{table} 
Table 3: Configuration of organizational OSINT-based HS-Decoy properties and major equations. Figure 3: Lower-level overview of HS-Decoy with major features. Based on these properties, the concept of a hierarchical social engineering decoy (HS-Decoy) that is based on OSINT for each governmental organization disclosed on a third party basis can be standardized. HS-Decoy, along with LPC-MTD, is a sandbox container for standardizing artefacts that are specialized for each attacker targeting a specific organization. Because of the artificial active attack contact point composed of false organizational dummy information with OSINT, it can improve the attacker's likelihood of attempting an attack, and make cognitive skewness in extreme favor of the defender. In other words, the key is to sustain the attacker's chain attacks for as long as possible in the decoy isolation environment by minimizing the attacker's suspicion. This makes it possible to apply a disinformation-based vulnerability advertisement and intentional infringement allowance scheme according to LPC-MTD's loose attack avoidance in the upper layer, while applying HS-Decoy as a detailed deceptive environment for enticing, inducing, and isolating attackers in the lower layer. In the proposed model, hierarchical organizational OSINT groups were used to construct a decoy bed that was based on the basic properties of decoys [55; 56; 57].