# OSINT-Based LPC-MTD and HS-Decoy for Organizational Defensive Deception
## 3 Proposed Deception Models with Organizational OSINT, LPC-MTD and HS-Decoy
### Organizational Social Engineering Deception in the Proposed Model
#### 3.1.2 LPC-MTD
However, the primary initial cognitive skewness in LPC-MTD, which can entice an attacker based on MTD, will not be performed significantly. Figure 8b shows the spatiotemporal attack efficiency of an attacker that is related to the calculation of the mutation range for OSINT and HUMINT in HS-Decoy in LPC-MTD to improve the disinformation efficiency of HS-Decoy. This shows that, when calculating the HS-Decoy mutation range, the effectiveness of the defender's attack and exploration surface improves linearly until the candidate area is defined as 4096 or less, and the defender's dominant relationship improves exponentially from 8192 and higher. It also shows that, as the uncertainty of the reconstructed HS-Decoy increased along with the mutation range, the attacker's inferiority increased, but the defender-control-based deception stability decreased. Finally, to improve the defender's superiority of OSINT and HUMINT-based HS-Decoy as a single parameter, the mutation range should be extended to 2048 or more in order to provide the concept of proactive avoidance and high randomness. Conversely, when controlling the reconstruction of HS-Decoy under the intervention of the defender, it should be limited to 1024 or less. Although similar to Figure 8b in terms of direction, Figure 8c shows the improvement in effectiveness of the defender related to whether to calculate the mutation for each element formed after weighting is added, focusing on port, protocol, and service elements

Figure 8: Comparative sensitivity analysis of organizational IODA with optimization of LPC-MTD and HS-Decoy. (**a**) Periodic mutation time slot, (**b**) mutation scope of OSINT and HUMINT, (**c**) mutation port and service scope of OSINT, (**d**) mutation selective batch pool size, (**e**) exploit or dummy packet size in SDN, and (**f**) number of CVE vulnerability. among OSINTs in HS-Decoy in order to improve virtual mapping efficiency based on the CVE vulnerabilities presented in Figure 5.0 This shows that, when estimating the mutation by socket port and protocol, the service-based variation element in LPC-MTD's HS-Decoy, the security node, and the host produced the highest defender superiority among the hierarchical elements in HS-Decoy. On the contrary, HUMINT based on human data, such as employees and e-mail, had no correlation. It also shows that all other elements were improved, except for HUMINT. Finally, Figure 8c shows that, when performing CVE-based attack-defense simulations using HS-Decoy, configuring separate sub-relationships as detailed elements, such as ports, protocols, and services in most OSINT classifications, except HUMINT, could degrade the attacker's inferiority under the defender's intention. In this case, when seamless connections and services are not considered, there will be a few availability issues that are related to the detailed elements. However, the purpose of minimizing the seamless problem caused by MTD is also included in the purpose of introducing LPC-MTD, so the performance overhead analysis that is related to the calculation of the corresponding mutation range in IODA should be preempted. Figure 8d shows the effectiveness of the defender's superiority related to the selective MTD mutation by pool after giving the MTD batch by configuring the Bellman-based batch sampling secondarily, rather than limiting the random mutation within the calculated range after pre-calculating the concept of scope to improve the efficiency of de-information of HS-Decoy as the defender efficiency enhancement that is suggested in Figure 8b. This shows that, when the HS-Decoy mutation range of LPC-MTD is stratified and selectivity is added, and the batch pool size was set to 100, which was based on not exceeding 5% of the maximum allowable delay threshold within the SDN, the lowest decoy mutation uncertainty and defense efficiency were achieved, on average. Conversely, when as the batch pool size was set to 200, the highest decoy mutation uncertainty and defense efficiency were achieved, on average.