# OSINT-Based LPC-MTD and HS-Decoy for Organizational Defensive Deception
## 1 Introduction
### Research Goal and Major Contributions  
To optimize the existing MTD and decoy's operations for each organization and improve the deception efficiency based on OSINT in social engineering, this study first attempts to calculate a hierarchical social engineering decoy (HS-Decoy) that is based on actual OSINT characteristics. We also propose a loosely proactive control-based MTD (LPC-MTD), which deliberately exposes the attack points by reducing the skewness and noise of the existing MTD but reflecting the high-level attack in the sandbox as it is to construct high-quality artifacts for sophisticated attackers. We performed organization-specific simulations based on cyber kill chain and APT scenarios after combining the LPC-MTD's adaptive mutation cycle selection scheme and HS-Decoy's OSINT-based disinformation, derivation, and isolation scheme. Subsequently, deception sequences, complex experimental metrics, and the optimal trade-off value were calculated. The following are the major contributions of this study.  
* By applying social engineering OSINT and loose mutation concepts in MTD and decoys, it was possible to secure a reinforcement plan for the proactive prevention and post-response in an organizational environment, and also improve the optimized deception attack-defense efficiency for organizational disclosed OSINT's uniqueness.
* It was possible to construct an OSINT-based decoy that could improve both attraction and isolation due to the initial cognitive skewness of the attacker and the persistence efficiency of deception by layering and normalizing the organizational OSINT based on domain name system (DNS) enumeration into entity and link-based graph.
* By accepting attacker infringement attempts and attack continuation as a loose adaptive mutation rather than using a strong preliminary avoidance, it was possible to construct an operational security-based MTD deception methodology that could advance the defender's dominant deception behavior for MTD mutation cycle selection.
* Through the proposed HS-Decoy and LPC-MTD combined modeling, it was also possible to establish a trade-off-based deception optimization strategy that was specialized for each organization, and to enhance it for each organizational strategy.  
The remainder of this paper is organized, as follows. Section 2 analyzes previous studies related to MTD and decoys, which are the basic deception concepts in this study. Section 3 describes the OSINT-based HS-Decoy and LPC-MTD concepts and architectures. We provide metrics and equations that ease the limitations of existing MTD and decoys and characterize them by organization. In addition, we discuss the structure and process to combine the two deception concepts, the social engineering OSINT module and configuration of the specialized deception parameters. In Section 4, we compare, analyze, and verify the proposed model through simulation by configuring a software defined network (SDN)-based test bed based on the proposed LPC-MTD and HS-Decoy architectures. Section 5 discusses the findings of the study. Finally, Section 6 presents the conclusions.