# OSINT-Based LPC-MTD and HS-Decoy for Organizational Defensive Deception
## 3 Proposed Deception Models with Organizational OSINT, LPC-MTD and HS-Decoy
### Organizational Social Engineering Deception in the Proposed Model
#### 3.1.2 LPC-MTD
These are further subdivided into performance and overhead factors in the environment that simulate each organizational trait, LPC-MTD mutation factor, and OSINT and decoy property for the HS-Decoy component. Again, these are broken down into the final lower metrics. The attack surface from the attacker's perspective in the presented tree is the sum of multidimensional attack vectors that represent the potential attack paths, in which the exploitation of random vulnerabilities is available, while the exploration surface is the codomain of the attack surface acquired by a random attacker when performing various pre-attacks, such as reconnaissance, weaponization, and exploitation. Thus, the concepts will be used to verify and update the deception efficiency of LPC-MTD and HS-Decoy in relation to the performance, effort, and overhead of attackers and defenders in the attack-defense scenario. In addition, the possibility of maximizing cognitive skewness and minimizing suspicion, the possibility of a false attack for the attacker's deception, and the possibility of substantive simulation of the exploration surface can be additionally presented. For this experiment, the deception results were calculated based on the metrics in Figures 19 and 19. Further metrics include environmentally dependent variables in the test bed, and single or multiple attack-defense metrics that were the basis of analysis. In addition, in order to analyze the deception relevance and sequence based on OSINT, the \begin{table}
\begin{tabular}{c c c c} \hline \hline
**CVE ID** & **Vulnerability** & **Related Service and Protocol** & **CVSS 2.0** \\ \hline CVE-2020-1350 & _SigRed._ Heap overflow, Remote code execution & DNS, TCP/UDP 53 & 10 \\ CVE-2020-0796 & _SMBGhost._ Remote code execution & SMBv3, TCP 139, 445 & 7.5 \\ CVE-2019-0708 & _BlueKep._ Use-after-free, Remote code execution & RDP, TCP 3389 & 10 \\ CVE-2017-0144 & _EternalBlue._ Remote code execution & SMBv1, TCP 13,9 445 & 9.3 \\ CVE-2015-1635 & Remote code execution, Denial-of-service & HTTP, TCP 80, 443 & 10 \\ CVE-2019-6111 & Directory traversal & SSH, TCP 22 & 5.8 \\ CVE-2019-0232 & Remote code execution & HTTP, TCP 8080 & 9.3 \\ CVE-2018-15473 & Obtain information & SSH, TCP 22 & 5.0 \\ CVE-2017-7494 & _SambaCry._ Remote code execution & Samba-based SMB, TCP 139, 445 & 10 \\ CVE-2011-2523 & Remote shell, Backdoor & Vsftpd 2.3.4, TCP 6200 & 10 \\ \hline \hline \end{tabular}
\end{table} 
Table 4: CVE-based vulnerability table for disinformation and intended leakage with HS-Decoy. impracticality of SDN was attenuated as much as possible by adding dynamic weights to the execution time and scenarios for each metric. ### Configuration of Experimental IODA Testbeds and Deception Sequence

The test bed for the organizational OSINT-based deception experiment was configured in detail, as shown in Figure 5. Because it is possible to attenuate the skewness of results according to experimental change or dependency issues between variables when compared to legacy MTD according to manager intervention based on a fixed virtual environment, the configuration of the IODA and the CVE-based attack-defense simulation with OpenFlow-based SDN was chosen to control the loose mutation period of LPC-MTD in the deceptive environment to which organizational traits were applied with the SDN controller. The creation, distribution, update, and normalization of organizational OSINT-based HS-Decoy was also easier to implement within SDN. In addition, as a target for direct mutation of LPC-MTD in the test bed, direct mutation of the authorized network band group used for normal service supply may not be suitable for ongoing organizational service delivery and migration goals. Therefore, a virtual network communication channel was additionally expanded and defined as a mutation target of LPC-MTD based on the network fingerprint range in the OSINT-based HS-Decoy, which was previously promised in the random mutation time interval.