Stackelberg Game-Based Strategy Selection for CAPTCHA Defense Informed by Empirical Attack Studies

Completely Automated Public Turing tests to tell Computers and Humans Apart (CAPTCHAs) are widely used mechanisms for protecting websites against automated bot attacks. In this paper, we investigate the trade-off between usability and security in CAPTCHA design using a Stackelberg game-theoretic framework. Based on empirical evaluation data on CAPTCHA solving time and accuracy, we incorporate expected solving time into the defender's utility function to jointly capture usability and security. We propose two models: a discrete-strategy game, in which different CAPTCHA types and difficulty levels form the strategy space, and a continuous-strategy game, in which CAPTCHA hardness is represented as a continuous decision variable. For the discrete model, we derive a stepwise solution characterizing transitions in the defender's optimal strategy. For the continuous model, we analyze a threshold-based attacker response and obtain equilibrium solutions under deterrence and accommodation regimes. The proposed framework is adaptable to other CAPTCHA evaluation datasets.

ISSN: 2154-0373