# OSINT-Based LPC-MTD and HS-Decoy for Organizational Defensive Deception
## 3 Proposed Deception Models with Organizational OSINT, LPC-MTD and HS-Decoy
### Organizational Social Engineering Deception in the Proposed Model
#### 3.1.2 LPC-MTD
Figure 10 shows the results of the calculation of CKC-based attack-defense effectiveness and defender superiority according to the degree of deceptive surfaceization for each attacker and defender within IODA, focusing on multidimensional entropy-based standardization related to changes in the internal and external environment for each CKC scenario along with compromise likelihood visualized by reconnaissance, weaponization, and exploitation stages. Figure 6: Examples of deceptive sequences with LPC-MTD in HS-Decoy-based sandboxes. (**a**) Mutation sequence of network-based OSINT elements, (**b**) mutation sequence of platform and host-based OSINT elements. The attack success probability that is shown in Figure 7a is a probabilistic comparison metric that atomically normalizes the spatiotemporal attack cost that is consumed before the attacker occupies the final compromise point within the organizational topology surfaced based on the CVE vulnerability or decoy beacon within the test bed where the LPC-MTD or existing OF-RHM was applied in a defender dominant manner. This is related to detectability and believability, as shown in Figure 3. It shows that the primary deception efficiency for progressive attacker isolation is twice as high, as attackers occupy the final compromise point earlier than with OF-RHM-based conventional MTD. This shows that when isolating the attacker in the defender's isolated sandbox, the LPC-MTD-based mutation does not simply perform unconditional evasion against the attack, but it artificially lowers the mutation strength under the criteria that guarantees the defender's superiority to lower the evasion strength, leading to the prompt initial occupation of the decoy environment with intentionally exposed false information. In addition, after the defender dominates the compromise point, the attacker reconfigures the attack chain according to the LPC-MTD shuffling, which is immediately re-performed under the defender's intervention. It can also be seen that the efficiency of the reconstructed attack chain decreased 2.8 times on a probabilistic gradient basis when compared to the previous one. This shows that LPC-MTD mutated based on Bellman-based sampling according to intrusion. The artificial exposure ratio shown within Figure 7b is a comparative metric that conveys the degree to which IODA's attack and the traits of the exploration surface created based on the uniqueness of OSINT of a specific organization can cause attack attempts by attackers according to the attack-defense correlation. This is related to conspicuousness and variability, as shown in Figure 3. It can be seen that the LPC-MTD contains an intentional information disclosure ratio that is eight times higher on average than conventional OF-RHM. Even after identifying the primary initial compromise by the attacker, it can be seen that the exposure ratio that is based on OSINT traits of the same organization is also

Figure 7: Comparison of results of the existing deception concept and the proposed models. (**a**) Attack success probability between OF-RHM [59]-based naïve MTD and LPC-MTD, (**b**) artificial organizational exposure ratio, (**c**) deceptive probability between naïve decoy and HS-Decoy, and (**d**) efficiency of enticingness probability. improved 11 times higher based on the gradient, and it is quickly restored and reconstructed as a separate deceptive surface that is less related to the previous surface as a measure to ensure the gradual compromise behavior quickly in a defender dominant manner while limiting the effectiveness of the previous defender trait possessed by the attacker to an extreme degree. As in Figure 7a, this shows that the LPC-MTD, unlike the existing MTD, deliberately supplies the OSINT-based false information to entice the attacker while reactively attenuating the evasion intensity to isolate the enticed attacker.