OSINT-Based LPC-MTD and HS-Decoy for Organizational Defensive Deception

Abstract

This study aimed to alleviate the theoretical limitations of existing moving target defense (MTD) and decoy concepts and improve the efficiency of defensive deception technology within an organization. We present the concept of an open-source intelligence (OSINT)-based hierarchical social engineering decoy (HS-Decoy) strategy while considering the actual fingerprint of each organization. In addition, we propose a loosely proactive control-based MTD strategy that is based on the intended competitive exposure of OSINT between defenders and attackers. Existing MTDs and decoys are biased toward proactive prevention, in that they only perform structural mutation-based attack avoidance or induce static traps. They also have practical limitations, e.g., they do not consider security characterization of each organizational social engineering attack and related utilization plans, no quantitative deception modeling is performed for the attenuation of the attack surface through exposure to OSINT, and there is no operational plan for optimal MTD and decoy application within the organization. Through the applied deception concepts proposed here, the total attack efficiency was reduced by 287% compared to the existing MTD and decoys, while the artificial deception efficiency dominated by defenders was improved by 382%. In addition, the increase rate of deception overhead was also reduced by 174%, and an optimized deceptive trade-off was also presented. In order to enable an organization to utilize the OSINT concept, statistical error reduction, and MTD mutation cycle-based deceptive selectivity, it was introduced as a loose adaptive mutation rather than a preferential avoidance strategy, and an organization-specific optimization direction was introduced through a combination of HS-Decoy and LPC-MTD. In the future, in order to improve the operational reliability of the HS-Decoy and LPC-MTD-based combined model and standardize threat information for each organization, we intend to advance it into an international standard-based complex architecture and characterize it as game theory.

Leveraging Computational Intelligence Techniques for Defensive Deception: A Review, Recent Advances, Open Problems and Future Directions

“…Deception-based defenses are potent weapons that have been proven to work in various domains. Their efficacy is based on the fact that they are programmed to exploit key biases to appear realistic but misleading substitutes to the hidden reality [ 79 , 80 , 81 , 82 , 83 , 84 , 85 , 86 , 87 , 88 , 89 , 90 , 91 , 92 , 93 , 94 , 95 , 96 , 97 , 98 , 99 , 100 , 101 , 102 , 103 , 104 , 105 , 106 , 107 , 108 ]. As a result, one will require a thorough understanding of both offensive and defensive trickery to implement a perfect Deception strategy.…”

IoDM: A Study on a IoT-Based Organizational Deception Modeling with Adaptive General-Sum Game Competition

“…As a follow-up study, Li et al [55] proposed a Markov Stackelberg game together with optimization formulas based on the average-cost semi-Markov decision process (SMDP) and the discrete time Markov decision process (DTMDP) to produce the defender's spatiotemporal MTD mutation decision-making process against advanced attackers. Seo et al [56,57] proposed an active cognitive disturbance function not influenced by the existing MTD concept and combined it with a social engineering decoy sandbox layered in the form of organizational open-source intelligence (OSINT) to form defensive deception concepts optimized for actual organizational operational goals. Based on these previous studies, a real-time attack-defense competition in an organizational environment with limited resources could be simulated and multi-staged deceptive decision-making processes could also be modeled depending on the scenario.…”

SOD2G: A Study on a Social-Engineering Organizational Defensive Deception Game Framework through Optimization of Spatiotemporal MTD and Decoy Conflict

“…It is mainly classified as a domain-based category consisting of information flow on the Internet, public datasets maintained by governments, and private open datasets. Organizational OSINT [61] is characterized as the use of an information group consisting of unique OSINTs and rough fingerprints of foreign government military organizations collected and composed based on open sub-party services. It involves performing all necessary stages to proactively establish an OSINT strategy based on security requirements related to an organization's legacy operating environment mainly by identifying information sources, including a stage in which open OSINTs are collected based on identified organizational information sources and strategies, a stage in which acquired data are normalized based on correlation graphs and then supplemented based on parent-child nodes followed by a reinforcing step based on parent-child nodes, and a stage in which the reinforced OSINT information group is refined into social engineering deceptive knowledge and concretized as cyber space intelligence (CYBINT) in sequence.…”

“…First, loosely proactive control-based MTD (LPC-MTD) [61] is an organizational MTD concept designed to alleviate both conceptual limitations and social engineering scalability problems of the existing MTD. It artificially adjusts the mutation strength based on the intention of the defender to intentionally expose false information or present disinformation whereby the defender dominantly forces the attacker to make a hasty judgment as if he/she has successfully bypassed the defender's MTD interface.…”

“…τ i is the temporospatial resource consumed in relation to the intervention of the defender until the completion of the mutation of the mutation time slot length of the surface information related to i, and m i is the surface information sampled and optimized based on i in the deceptive surface set M of the defender, which can be created through mutation. HS-Decoy (hierarchical social engineering decoy) [61] is also an OSINT-based organizational decoy concept that either statically induces attackers to continue to attack a false target that is not a target of protection to further improve the deception efficiency within an organization of the existing decoy or forces successive attack chains of attackers that have been isolated to remain in the sandbox while deceiving the attackers to stop them from attempting to escape. Since it mainly appears similar to normal service or important information while being more enticing based on OSINTs by organization, it looks valuable to attackers.…”