  Identifying the actual adversarial threat against a system vulnerability has
been a long-standing challenge for cybersecurity research. To determine an
optimal strategy for the defender, game-theoretic based decision models have
been widely used to simulate the real-world attacker-defender scenarios while
taking the defender's constraints into consideration. In this work, we focus on
understanding human attacker behaviors in order to optimize the defender's
strategy. To achieve this goal, we model attacker-defender engagements as
Markov Games and search for their Bayesian Stackelberg Equilibrium. We validate
our modeling approach and report our empirical findings using a
Capture-The-Flag (CTF) setup, and we conduct user studies on adversaries with
varying skill-levels. Our studies show that application-level deceptions are an
optimal mitigation strategy against targeted attacks -- outperforming classic
cyber-defensive maneuvers, such as patching or blocking network requests. We
use this result to further hypothesize over the attacker's behaviors when
trapped in an embedded honeypot environment and present a detailed analysis of
the same.
