# OSINT-Based LPC-MTD and HS-Decoy for Organizational Defensive Deception
## 3 Proposed Deception Models with Organizational OSINT, LPC-MTD and HS-Decoy
### Organizational Social Engineering Deception in the Proposed Model
#### 3.1.2 LPC-MTD
This module reinforces the traits and properties of HS-Decoy to configure multiple HS-Decoys in a distributed multi-tenant structure in detail into node- and edge-based information graphs, and it performs OSINT updates based on parallel pipelines to reflect organizational OSINT fluctuations. It also creates, distributes, and updates random OSINT based on organizational traits with HS-Decoy, and finally reflects the update gradient for each node by determining the reputation based on third party reliability and volatility to create attack-defense inferior relationships. Figure A2, in Appendix A, shows a detailed conceptual diagram that is related to the sub-modules, components, and processes in the OOM. The OOM management controller manages the detailed sub-modules, and communication for collecting organizational OSINT and HUMINT groups. The analysis module is used to process the collected OSINT information groups and calculate and normalize the weights for each property based on the calculation module. Subsequently, a decoy extraction module is used to distribute and de-inform the normalized OSINT information group based on HS-Decoy, which is finally standardized as a knowledge-based graphDB. * Sandbox or emulator: to disrupt the random attacker attempting to invade the OSINT-based deception server belonging to the DSF, this virtual execution container contains a statistically vulnerable network and host-based OSINT, such as IP, port, and service in the form of a rule table in order to artificially expose the initial attack contact points with HS-Decoy and CVE under the defender's intention. This container contributes to the creation of false fingerprints along with HMM in the presence of IMM to maximize the attacker's cognitive skewness and prevent bypass. Figure 4: Overview of software defined network (SDN)-based integrated OSINT-based deceptive architecture (IODA) structure and related deceptive modules with LPC-MTD and HS-Decoy. #### 3.2.2 Detailed Module-Specific Decision Process for LPC-MTD and HS-Decoy

The multi-layered decision process is configured in IODA, as shown in Figure 4.

- Primary decision process: attack avoidance and request approval

1. When receiving a request for a network and host-based OSINT that was not previously promised in the LPC-MTD cycle or intentionally projected for disinformation, IMM immediately directs the requestor to the deception server in the DSF and then isolates it. When the requestor is identified as an illegitimate user or attacker, defender dominant behavior is executed, including cognitive skewness, minimization of suspicion, continuation of attacks in the isolation space, and backtracking with the HS-Decoy-based sandbox, and the behavior is monitored with TDM. The change is immediately reflected in the applicational deception concepts and modules to secure an adaptive update according to external entropy changes. Until the administrator's aperiodic intervention, this active containment is realized by performing a gradual repetition of this step for each attacker with LPC-MTD's periodic mutation as default. 2. When an arbitrary user requests a pre-promised legitimate OSINT information group, seamless connection-based migration is performed to connect to the legitimate server in the LSM. Subsequently, after identifying the requestor as a potential legitimate user or normal user, it reflects entropy change in the policy and rule table, and configures the use of the service provided by the legitimate server. Continuous monitoring is performed at this time through the detailed modules, such as IMM, TDM, and OOM, to detect any malicious behavior and determine whether the user was altered or malicious from the beginning. 3. The OSINT based on the exposure of authorized or unauthorized information is dynamically configured to minimize the attacker's suspicion and secure adaptability to external entropy changes from third parties, depending on the spatiotemporal mutation points and viewpoint or aperiodic LPC-MTD.