This thesis proposes an incremental algorithm to discover regional network access patterns from traffic data of a regional network. Because the size of network traffic database is very large, we need to develop a fast algorithm of association rules in order to efficiently generate user access patterns. Attributed relational graph is used to represent user access patterns on the network. The change of relational graph indicates the access pattern of a regional network is changed. In order to keep the network access pattern up to date without spending great computation costs, we propose an incremental procedure to generalize network access patterns from time to time. The results can be used for supporting network administrators to easily keep track of network usage patterns and better manage regional networks

This study adopts large access graph algorithm and case-base reasoning approach to generalize user access patterns and diagnose network events respectively for facilitating the network management. Large access graph (LAG) algorithm discovers the frequently inter-connections among hosts to provide an overview of network access relation. The case-based reasoning (CBR) system diagnoses the instant network events with the past experience. NetFlow log data collected from the router of the dormitory network of National Sun Yat-Sen University is used for demonstrating these two methods. The evaluation results measured by recall, precision, and accuracy show that these two mechanisms are useful to support the network administer to keep track of network access relations and diagnose the network events.