# OSINT-Based LPC-MTD and HS-Decoy for Organizational Defensive Deception
## 3 Proposed Deception Models with Organizational OSINT, LPC-MTD and HS-Decoy
### Organizational Social Engineering Deception in the Proposed Model
#### 3.1.2 LPC-MTD
* Interaction between LSM and DSF: independent mapping is performed for each LSM based on OSINT after performing both the creation and update of deception servers in DSF by constructing all of the flow and rule tables of LSM according to the conversion rules and mutation periodicity defined in IMM and DSM. * Adaptive deception server farm module-based HS-Decoy (DSF): this is an adaptive deception server that is involved in selective evasion, induction, isolation, and common vulnerabilities and exposures (CVE)-based non-cooperative simulation through LPC-MTD, and it induces and isolates illegitimate users or attackers into sandboxes. It operates based on the LPC-MTD-based decision strategy and HS-Decoy properties. It standardizes the sandbox by applying all of the available OSINTs after minimizing the discrimination between LSMs in the initial reconnaissance of the attacker and determining the similarity weight to ensure consistency for deception. * Interaction between DSF, DSM, HMM: when managing the group of DSF deception servers under the control of the IMM, the decoy management process in HMM improves the management efficiency of the HS-Decoy environment while complying with both the DSM's conversion rules and mutation periodicity. * Interaction between DSF and OOM: the exposed OOM is adaptively updated based on the main CVE simulation to express and de-inform the artificial attack contact points related to sophisticated attackers in a deception server belonging to the DSF group according to the supervisor's intention. * Deception server module controller (DSM): this is a deception active controller module that controls multiple DSFs mapped to a specific LSM, tracks and manages the current state of sandboxes and emulators within the DSF, and it monitors the current inferiority of attackers against defenders. It constructs conversion rules according to the attack-defense strategy and mutation periodicity established in IMM and OOM and performs modification and deletion of containers focusing on a single kernel of a docker-based server pool or farm corresponding to DSF, and additional mapping. * Automatic HS-Decoy Management Module based on OSINT (HMM): this is a decoy strategy management module that creates, distributes, and updates HS-Decoy, as well as the direction of the OSINT information group and CVE vulnerability for deception servers belonging to DSF. The decoy management process operates around the main attributes of the HS-Decoy. After selecting organizational OSINT in OOM according to the LPC-MTD mutation strategy, it passes environmental parameters to the DSF to characterize the HS-Decoy and related sandboxes by organizational traits. * Threat detection and monitoring module (TDM): this is a simulation module for extracting, processing, and continuously tracking features, such as social engineering attacker type or related attack patterns. This main module standardizes intelligence for each attack-defense scenario, and it specifies and manages all of the reverse connections, drive-by-download-based internal threats, information gathering and remote code execution-based external threats, deliberate or misuse-based insider threats, automatic scanning, and custom shellcode-based human and machine factorswith rule tables between IMMs. In addition, as a policy to identify random deception patterns, and to interfere with bypass attacks that attempt reverse disturbance, it performs fingerprint jamming separately, which is meaningful for the analysis of defender traits, mass production of false traffic, and insertion and modification of arbitrary dummy headers based on proxy between DSFs. * Organizational OSINT graphDB module (OOM): this is a social engineering OSINT information group management module based on manual enumeration and hierarchical DNS, which collects and standardizes public archive data.