# OSINT-Based LPC-MTD and HS-Decoy for Organizational Defensive Deception
## 1 Introduction
### Background and Limitations of Existing Cyber Deception  
The detailed element technologies of cyber deception include moving target defense (MTD), Honey-X, and decoys. In particular, the most efficient of these is network-based MTD (N-MTD) [4] that functions by increasing the network attack and exploration surface [5] through actions, such as shuffling, diversity, and redundancy, which focus on the fluid properties of the network [6]. This defense is realized proactively by periodically or aperiodically mutating defender information that may be the target of cyberattack according to the intention of the defender. Further, this assists in avoiding attack attempts, mitigating the asymmetry dominated by attackers, and limiting the effectiveness and chainability of exploitation while using previously collected information. In addition, a decoy is a dynamic sandboxing element that performs partial induction and isolation by encouraging an attacker to attack a false target. Researchers have studied N-MTD in combination with various decision strategies and theories, including game theory [7; 8], Markov decision [9; 10], genetic algorithm [11], and machine learning [12], to gain certain advantages. These include formulating the deception threshold while reducing the initial invasion influence and surface in the cyber kill chain [13], diversifying the optimal mutation strategy, and even performing a mutual combination between Honey-X and decoys. However, these previous studies that are related to existing deception imply the following theoretical limitations. * The existing MTD only performs structural mutation-based avoidance or indirect induction to static traps, resulting in the limitation of focusing on securing only a proactive defense. In addition, functional defense for post-response was not considered as a major factor, leading to no countermeasures when sophisticated attackers, who identify MTD patterns or vulnerable attack points, bypass the system. * It is necessary to construct a dedicated deception model to apply MTD and decoys to each organization's operating environments and cater for organizational uniqueness. This is also related to seamless connection [14; 15] in the case of an MTD mutation. However, previous studies have reported partial mutation after opening a separate encrypted closed-communication channel and mapping random virtual network information with real information, which results in low actual operability. In addition, an attacker may be able to penetrate the defense when virtual information is randomly configured with characteristics disparate to that of the organization's. * It is necessary to alleviate detection in the organization, skewness, and outliers within the blocking system, and also consider the following: MTD mutation that is related to social engineering factors, such as open-source intelligence (OSINT) [16; 17] and human information (HUMINT) in organizations, decoy management, and dynamic diversification of the attack and exploration surface. * The deception efficiency of MTD and decoys against malvertising [18], spear phishing [19], and watering hole-based [20] social engineering attacks [21] should be considered. In other words, OSINT-based modeling for MTD and decoys should be quantified according to the organizational legacy environment. This may refer to the statistics subject to frequent social engineering infringements by APT, as the organizational information of major countries, including the United States and the United Kingdom, is disclosed through third party-based OSINT [22; 23]. * There are many approaches to reduce the statistical skewness and errors of threat information or to improve the response quality of the organizational platform by using a research model that integrates the existing MTD and decoys. However, these approaches are limited to the configuration of an experimental environment that is based on a specialized domain.