This thesis focuses on mining user access patterns from netflow database collected from the core router of a regional network center. We use the attributed relational graph representation to formulate user access patterns on the Internet, and then propose a procedure to generalize common connection patterns and detect deviation patterns with such methods as large graph generalization, error correcting graph matching, frontier identification and pattern base recognition. The major contributions of this thesis are on represeting the network connection with attributed relational graph and developing data mining tehcniques for identifying access paterns and detecting deviation. The results can be used for better managing regional network in order to improve user satification in using regional netwrok netwrok services.