A blockchain characterized by a distributed, decentralized, and public computer system rapidly grows and realizes the Internet of Value. The fundamental idea is to replicate its state database to every node computer with protocol-specific restrictions to keep consistency and integrity. Transferring controls from a central entity to each individual sounds compelling, but a protocol designer should carefully design an incentive scheme to encourage anonymous participants to do the desired actions.

In this dissertation, we analyze the reward policy on block creation in a proof-of-work blockchain. The reward policy consists of a block reward and transaction fees. A protocol designer intends to incentivize block miners to process transactions until the designed capacity. However, we observe that the hidden costs may distort the reward policy; block miners do not have incentives if processing and network delays are not negligible. We model a transaction fee market, the block mining process with the delays, and the decision-making of block miners under the reward policy. We express the expected mining revenue as a function of the number of transactions in a block. We then identify the operating region of a block reward to mitigate the effect of the hidden costs. We propose a dynamic block reward of a proportional subsidy for processing transactions as a revised incentive scheme. Thus, blockchain users experience reduced waiting time and less expensive transaction fees.

In addition, we further expand queueing theory, especially for a head-of-line bulk service priority queue with an arbitrary service time distribution. We provide analytical expressions (exact solutions) for critical numbers in a transaction fee market: average waiting time, minimum transaction fee, and average total transaction fee.

Modern network research focuses on optimizing performance through congestion control, quality of service, and fairness. With the rapid expansion of networks and increasing traffic, balancing throughput and response time has become critical. This thesis explores this tradeoff and introduces the Power metric as a tool for optimizing network performance and expands its investigation to achieving optimized performance with optimum fairness.

The Power metric, defined as the ratio of normalized throughput to normalized mean response time, serves as our performance optimization goal. Previous research primarily focused on single-flow systems, but contemporary networks involve multiple flows with more complex scenarios. This work extends Power analysis in performance optimization to modern network environments, developing a model that also accommodates multiple flows. We further examine different queueing disciplines that implement various levels of flow discrimination. In addition, we examine fairness metrics coupled with performance optimization.

Our research focuses on three aspects: performance, flow priority discrimination, and fairness. We introduce performance metrics, including individual power, sum of power, and average power, and optimize these metrics using an M/M/1 system model with multiple flows under different queueing disciplines. We also explore fairness metrics such as throughput, delay, and power, and investigate scenarios where optimum performance and equal fairness can be achieved simultaneously.

Additionally, we study generalized power, which allows specifying the relative preference for throughput versus delay, providing a flexible approach to optimizing network performance based on specific requirements.

In summary, this research represents a first step in incorporating performance, fairness, and priority flow discrimination into the Power metric analysis for modern multi-flow network environments. Our goal is to provide insights, guidance, and "rules of thumb" for system designers to create more efficient and equitable network systems.

Ever since the earliest days of the Internet, malware has been a problem for computers. Since then, this problem’s severity has only increased, with important organizations like universities and hospitals suffering major security breaches due to malware. As detection techniques get more advanced, so do attackers' evasion attempts. One such method, called the mimicry attack, introduces benign behavior to malware to produce a benign classification in detectors even while retaining its malicious behaviors. In this document, I will describe the work we did on developing malware detection methods that remain effective in the presence of such evasion attacks. Using Windows APIs, our detection pipeline generates a summary of program behavior, vectorizes it in a way that's robust to modifications, and constrains features to reduce the impact of added benign behaviors. We use two methods of constraining features, enforcing monotonicity on them and removing them from the feature vector. To evaluate this detection pipeline and other methods, we use hooking and injection techniques to generate mimicry attacks that can insert benign behavior in more locations than prior work, and are thus produce stronger attacks than prior work. Our results show that our methods can effectively and consistently detect malware that use both mimicry attacks and adversarial attacks with minimal accuracy loss in vanilla data.

Currently, every packet sent on the Internet goes through numerous routers and intermediaries until it gets to the intended receiver. While routing the traffic, these intermediaries (referred to as middleboxes) are potentially capable of making significant changes to what happens to a traffic stream on the network. During the past decade, a wide variety of middleboxes have been proposed, implemented and deployed. Examples include traffic shapers, proxies, firewalls, and WAN optimizers. These middleboxes are becoming a common element of various types of networks, making their detection by end-hosts beneficial and in some cases crucial.

One class of intermediaries, defined as "payload-preserving middleboxes", makes no changes to the content of the traffic, giving the appearance that nothing has been done to the stream other than routing it to the destination. This transparency property can make end-to-end detection of such intermediaries very challenging in most cases. The main contribution of this dissertation is to investigate the detectability of such middleboxes by seeking answers to this question: "If they pay attention, can the sender or receiver (or both if they cooperate) determine that something of this kind has been done?''

Another contribution of this dissertation is to view and analyze the universal set of all middlebox interferences on network traffic as a whole. We partition this set of middlebox interferences into detectable and undetectable middleboxes. Within the detectable partition, we introduce the notion of normally detectable middleboxes, denoting that a certain type of middlebox is detectable under normal Internet conditions, with a specific degree of certainty. In this research we developed a general framework to detect network discriminators, which we have defined as middleboxes that delay and/or drop packets in a discriminatory fashion. We achieved this by modeling their interference on the network and proposing a unified solution to the detectability problem, rather than ad hoc approaches that are only applicable to a specific type of middlebox.

To illustrate the implementation feasibility of our generalization idea, we then used our results to detect a number of prevalent and important middleboxes: network compression, traffic prioritization, and traffic shaping/policing. In addition to the analytical approach that we took to solve our detection problem, our results are also supported by extensive network simulations and live Internet experiments using a real middlebox.