When Hackers Err: The Impacts of False Positives on Information Security Games

Abstract

False positive rates and their impacts have been a focal point for information security research. However, most of this research investigates false positives exclusively from the system defender’s perspective, while in reality an attacker also faces the classification decision in identifying feasible targets and the consequences of false positive rates. In this paper, we present the first comprehensive analytical model that incorporates the false positives from both the perspective of the attacker and that of the system defender. Our results show that such false positives from the attacker’s perspective have a significant impact on the attacker’s decision making for an attack, as well as the optimal protection strategy for the defender. Our results help to shed new light on a wide range of diverse information security phenomena such as spam emails, the Nigerian scams, and the design of the honeypot as a security mechanism. In addition, we show how an attacker’s misestimation of a certain parameter would affect the defender’s strategy and how the heterogeneity of the systems impacts the defender’s strategy to manipulate the attacker’s possible misestimation.