False positive rates and their impacts have been a focal point for information security research. However, most of this research investigates false positives exclusively from the system defender's perspective, while in reality an attacker also faces the classification decision in identifying feasible targets and the consequences of false positive rates. In this paper, we present the first comprehensive analytical model that incorporates the false positives both from the perspective of the attacker as well as of the system defender. Our results show that such false positives from the attacker's perspective have a significant impact on the attacker's decision making for an attack, as well as the optimal protection strategy for the defender. Our results help to shed new light on a wide range of diverse information security phenomena such as spam emails, the Nigerian scams, and the design of Honeypot as a security mechanism. In addition, we show how an attacker's mis-estimation of certain parameter would affect the defender's strategy, and how the heterogeneity of the systems impacts the defender's strategy to manipulate the attacker's possible mis-estimation.