本篇論文藉由分析路由器上的流量記錄資料以協助網管人員監控並維護網路正常運作，我們利用高頻存取圖形演算法來找出網路上各種存取狀況的模式，網管人員可以由這些結果，對整個網路環境的存取特性有概括性的瞭解，我們並應用案例式推理方法，將過去網管人員的經驗儲存於案例庫裡面，如果再有類似的狀況發生，馬上可以得到過去判斷的結果。此外，我們利用中山大學學生宿舍網路的流量資料（NetFlow），來驗證我們的方法。透過這兩個機制，網管人員可以更容易地控管網路，以提高網路連線品質。

This study adopts large access graph algorithm and case-base reasoning approach to generalize user access patterns and diagnose network events respectively for facilitating the network management. Large access graph (LAG) algorithm discovers the frequently inter-connections among hosts to provide an overview of network access relation. The case-based reasoning (CBR) system diagnoses the instant network events with the past experience. NetFlow log data collected from the router of the dormitory network of National Sun Yat-Sen University is used for demonstrating these two methods. The evaluation results measured by recall, precision, and accuracy show that these two mechanisms are useful to support the network administer to keep track of network access relations and diagnose the network events.

CHAPTER 1 INTRODUCTION 1
1.1 Background 1
1.2 Research Objectives 4
1.3 Research Framework 6
CHAPTER 2 LITERATURE REVIEW 9
2.1 NetFlow and cflowd 9
2.2 Access Pattern in The Network 11
2.3 Case-Based Reasoning (CBR) 14
CHAPTER 3 DISCOVERING NETWORK ACCESS PATTERNS WITH LARGE ACCESS GRAPH 18
3.1 NSYSU Dormitory Network 18
3.2 Data Collection 19
3.3 Data Pre-processing 20
3.4 LAG Mining 22
3.5 Pattern generation 24
CHAPTER 4 DIAGNOSING INSTANT NETWORKS EVENTS WITH CASE-BASED REASONING 33
4.1 Problem Statement 33
4.2 Data Processing 34
4.3 Case Representation 36
4.4 Case Retrieval 39
4.5 Case Repair and Case Retain 40
CHAPTER 5 EVALUATION AND RESULTS 41
CHAPTER 6 CONCLUSIONS AND FEATURE RESEARCH 46
REFERENCES 48
APPENDIX 51

Aamodt, A., Plaza, E., Case-Based Reasoning: Foundational Issues, Methodological Variations, and System Approaches, Artificial Intelligence Communications, IOS Press, vol. 7: 1, pp. 39-59, 1994.
Agrawal, R., Srikant, R., Fast Algorithm for Mining Association Rules in Large Databases, In Proc. 1994 Int’l Conf. VLDB, pp. 487-499, 1994.
Agrawal, R., Imilienski, T., and Swami, A., Mining Association Rules between Sets of Items in Large Databases, Proc. Of the ACM SIGMOD Int’l Conf. On Management of Data, pp. 207-216, 1993.
Bonissone, P. P, and Ayub, S. Similarity Measures for Case-based Reasoning Systems, Proceedings of the IPMU-92 Conference, pp. 483-487, 1992.
Bunke, H., Recent Developments in Graph Matching, Proceedings of 15th International Conference on Pattern Recognition, vol.2, pp. 117 -124, 2000.
Bunke, H. K. Shearer, A Graph Distance Metric Base on The Maximal Common Subgraph, Pattern Recognition Letters, vol. 19, Issue: 3-4, pp. 227-384, 1998.
CAIDA, cflowd: Traffic Flow Analysis Tool, http://www.caida.org/tools/measurement/cflowd/, 2001.
Chang, S. T., Mining User Access Patterns from Network Flow on the Internet, Master thesis, National Sun Yat-Sen University, 2000.
Cheung, D. W. L., Lee, S. D., and Kao, B., A General Incremental Technique for Maintaining Discovered Association Rules, Proceedings of the Fifth International Conference on Database Systems for Advanced Applications, Melbourne, Australia, pp. 185-194, 1997.
Chwastek, R., Network Management in Wired and Wireless Networks: Book Review IEEE Communications Magazine, vol. 40, Issue: 5 , pp. 30-32, 2002.
CISCO System, Inc., NetFlow Services and Applications, White paper, 1999.
Dunkel, B. and Soparkar, N., Data Organization and Access for Efficient Data Mining, ICDE, Sydney, Australia, 1999.
Fayyad, U., G. Piatesky-Shapiro, and P. Smyth, From Data Mining to Knowledge Discovery: an Overview, in Advances in Knowledge Discovery and Data Mining Chapter 1, AAAI/ The MIT Press, 1996.
Kolodner, J., Case-Based Reasoning, Morgan Kaufmann Publishers, pp.145-160, 1993.
Liao T. W., Zhang Z., Mount, C. R., Similarity Measures for Retrieval in Case-based Reasoning Systems, Applied Artificial Intelligence, vol. 12, pp. 267-288, 1998.
McRobb, D. W., cflowd design, http://www.caida.org/tools/measurement/cflowd/design/design.html, 1998.
Park, J. S., Chen, M. S., and Yu, P. S., An Effective Hash Based Algorithm for Mining Association Rules, Proc. ACM SIGMOD, pp. 175-186, 1995.
Piatesky-Shapiro, G. and W. J. Frawley, Knowledge Discovery in Databases, The AAA/MIT Press, pp. 1-27, 1991.
Seifried, K., Ports Report for Applications, http://seifried.org/security/ports/index.html, 2002.
Shoubrigde, P., M. Kraetzl, and D. Ray, Detection of Abnormal Change in Dymanic Networks, Proceedings of Information, Decision and Control, 1999 (IDC 99), 8-10, pp. 557-562, 1999.
Sugarboard, I., An OSI-Based Interoperability Architecture for Managing Hybrid Networks, IEEE Communications Magazine, pp. 61-69, 1990.
Tang, Jian, Using Incremental Pruning to Increase the Efficiency of Dynamic Itemset Counting for Mining Association Rules, Proceedings of the 1998 ACM 7th international conference on Information and knowledge management, pp. 273 – 280, 1998
Thottan, M., Ji, C., Adaptive Thresholding for Proactive Network Problem Detection, Proceeding of IEEE Int. Workshop on Systems Management, Newport, RI, 1998.
Tzeng, Y. S., An Incremental Approach to Discovering Regional Network Access Pattern, Master thesis, National Sun Yat-Sen University, 2001.
Watson, I., Applying Case-Based Reasoning Techniques for Enterprise Systems, Morgan Kaufmann Publishers, pp.15-38, 1997.
Williams, T., Port Used by Computer Game, http://www.u.arizona.edu/~trw/games/ports.htm, 2001.