# OSINT-Based LPC-MTD and HS-Decoy for Organizational Defensive Deception
## 3 Proposed Deception Models with Organizational OSINT, LPC-MTD and HS-Decoy
### Organizational Social Engineering Deception in the Proposed Model
#### 3.1.2 LPC-MTD
Through the ratio aspect that only increases from 1000 to 1400 s within the existing OF-RHM and maintains a 0.08 and 0.23 exposure ratio, it can be seen that it was raised by the attacker's sequential attacks, and it was not caused by artificial exposure and disinformation, as with LPC-MTD. The deceptive probability enticingness shown in Figure 7c,d are probabilistic metrics in which HS-Decoy or existing decoy-based sandbox normalizes the secondary deception efficiency property to maintain the attack attempt under the defender's control after the initial attack (e.g., reconnaissance, pre-weaponization) and it implies the maximum isolation probability within the sandbox. It is directly related to all properties, focusing on the enticingness shown in Figure 3. Based on these metrics, it can be seen in (c) that HS-Decoy has a 3.8 times higher deception efficiency when compared to existing decoys, and the improvement of gradient-based deception quality is also positive. Figure 7d shows that HS-Decoy's enticing efficiency quickly regenerates and distributes new decoys that are hardly related to the previous decoys and they have a connection with the referenced OSINT traits after the initial occupation and can be maintained at a probability of 1.0, where existing decoys exhibit a probability gradient. These results show that the extremes of the attacker's cognitive skewness and the maximum persistence of the attack chain in the sandbox are due to the uniqueness of the correlated entity and link-based hierarchical OSINT through HS-Decoy-based disinformation. In this experiment, the cognitive skewness was based on the OSINT-based false fingerprint that was initially assigned. In Figure 7c, it is shown that the difference in the efficiency of deception between existing decoys increases linearly over the execution time. In addition, the efficiency improvement that is related to the creation and distribution of false information is also demonstrated in Figure 7d in the standard that guarantees the highest possible enticingness. The increase in gradient shows that OSINT-based HS-Decoy is quickly reorganized after initial occupation. This shows that the efficiency of the OSINT-based LPC-MTD and HS-Decoy deception concept has improved on the existing OF-RHM-based MTD and naive decoy. Next, we discuss the comparisons and analysis that are presented in Figure 8, a set of sensitivity analysis results for IODA optimized based on organizational OSINT traits. Figure 8a shows the attack-defense efficiency related to the effectiveness of the defender's traits limited by the time slot length that determines the LPC-MTD mutation cycle in IODA. This shows that, when calculating the LPC-MTD mutation cycle, if the relative timestamp-based time slot is between 1 and 50 s, the highest spatiotemporal attack cost and effort can be given to the attacker in a defender dominant manner. However, the attack cost and effort of the attacker decreased by 158% when compared to the previous, as the defender's dominant relationship is greatly reversed when the time the range is expanded to 200 s. In this case, although frequent LPC-MTD mutations impose a major overhead factor in the defender and SDN controller central control groups, it also shows that a defender's sandbox that is subject to frequent final compromise by an attacker can impose an even higher overhead than loosening the mutation cycle to reduce the performance overhead. Because the effort-based attacker's superiority is improved by 10% in the 250 s range as compared to the previous, showing that in the final aspect (a), the minimum time interval for maintaining the defender's superiority from the perspective of proactive avoidance within the SDN-based IODA should be configured to less than 170-180 s. If the concept of robust avoidance is not considered, then there will be a few security issues that are related to practical deception defense, as the isolated sandbox exists, even if it is assigned a longer time interval period.