本研究透過區域網路的路由器（router），收集使用者的存取記錄（log）並找出他們的使用模式（access patterns）。我們使用屬性關連圖形（attributed relational graph）來表達網路使用者的使用模式，然後使用高頻圖形（large graph generalization），來歸納出使用者共同的連線模式。並且使用錯誤修正圖形比對（error correcting graph matching）、鋒面鑑別（frontier identification）和模式庫鑑別（pattern base recognition）的方法，來偵測異常的連線模式。本篇研究最主要的貢獻在：使用屬性關連圖形來表達網路連線狀況，並且提出資料探採（data mining）的技術，以找出網路主要的使用模式並偵測異常狀況。本研究結果將有助於區域網路的管理和提高使用區域網路服務之使用者滿意度。

This thesis focuses on mining user access patterns from netflow database collected from the core router of a regional network center. We use the attributed relational graph representation to formulate user access patterns on the Internet, and then propose a procedure to generalize common connection patterns and detect deviation patterns with such methods as large graph generalization, error correcting graph matching, frontier identification and pattern base recognition. The major contributions of this thesis are on represeting the network connection with attributed relational graph and developing data mining tehcniques for identifying access paterns and detecting deviation. The results can be used for better managing regional network in order to improve user satification in using regional netwrok netwrok services.

Chapter1 Introduction

Chapter2 Literature Review
2.1 Collecting and preprocessing user behavior history
2.2 Mining and discovering user behavior patterns
2.3 Structuring and analyzing user behavior information
2.4 Analyzing and detecting the deviation

Chapter3 Generalizing the Common Access Patterns
3.1 Transaction data segmentation
3.2 Transaction data filtering
3.3 Access pattern transformation
3.4 Common graph discovery
3.5 Large Graph Discovery Algorithm

Chapter4 Detecting the Deviation of Access Patterns
4.1 Graph distance measurement
4.2 Frontier identification

Chapter5 Empirical Studies and Results
5.1 The mechanism to build netflow database
5.2 Characteristics of netflow database
5.3 Generalizing the common access pattern
5.4 Detecting the deviated access pattern

Chapter6 Conclusions and Future work

References

Appendix

Agrawal, R., and T. Imielinske, and A. Swami. Mining Association Rules between Sets of Items in Large Databases, Proceedings of the ACM SIGMOD Conference on Management of Data, May 1993, pp. 207-216.
Agrawal, R., and R. Srikant, Fast Algorithms for Mining Association Rules in Large Databases, Proceedings of the 20th International Conference on Very Large Databases, June 1994, pp. 487-499
Bayardo, R.J., “Efficiently mining long patterns from databases,” Proceedings of ACM SIGMOD International Conference on Management of data, June 1998, pp. 85 - 93
Bunke, H. and K. Shearer, “A graph distance metric based on the maximal common subgraph,” Pattern Recognition Letters, Vol. 19, Issue: 3-4, March 1998 pp. 227-384
Bunke, H., “Error correcting graph matching: on the influence of the underlying cost function,” IEEE Transactions on Pattern Analysis and Machine Intelligence, Vol. 21, issue 9, Sept. 1999, pp. 917 - 922
Chartrand, G., G. Kubicki and M. Schultz, “Graph similarity and distance in graphs,” Aequationes Mathematicae, 55(1-2), 1998, pp. 129-145
Chen, M.S., J. S. Park and P. S. Yu, “Efficient Data Mining for Path Traversal Patterns in Distributed Systems,” Proceedings of the 16th IEEE Intern'l Conf. on Distributed Computing Systems, 27-30 May. 1996, pp. 385-392.
Cooley, R., B. Mobasher and J. Srivastava, “Web mining: information and pattern discovery on the World Wide Web,” Proceedings of Ninth IEEE International Conference on Tools with Artificial Intelligence, 1997, pp. 558 – 567
Dunkel, B. and N. Soparkar, “Data Organization and Access for Efficient Data Mining,” Proceedings of 15th International Conference on Data Engineering, Mar. 1999, pp. 522 – 529
Holt, J.D. and S.M. Chung, “Efficient mining of association rules in text databases,” Proceedings of the eighth international conference on Information knowledge management, 1999, pp. 234 – 242
Hood, C.S., Chuanyi Ji, ” Proactive network fault detection,” Proceedings of IEEE Sixteenth Annual Joint Conference of the IEEE Computer and Communications Societies (INFOCOM '97), Vol. 3, April 1997, pp. 1147 – 1155
Jarrett, E.B., “Edge Rotation and Edge Slide Distance Graphs,” Computers and Mathematics With Applications, Vol.: 34, Issue: 11, Dec. 1997, pp. 1-128
Jensch, J., R. Luling and N. Sensen, “Optimising the file allocation of parallel Web server online using access patterns,” Proceedings of the 1998 ICPP Workshops on Architectural and OS Support for Multimedia Applications/Flexible Communication Systems/Wireless Networks and Mobile Computing, 14 Aug. 1998, pp. 66 – 74
Kubicka, E., G. Kubicki and I. Vakalis, “Using graph distance in object recognition,” Proceedings of the 1990 ACM eighteenth annual Computer Science Conference on Cooperation, 20-22 Feb. 1990, pp. 43-48
Lazar, S., D. Sidhu, S. Kodeswaran and R. Varadharaj, “ATM network discovery using mobile agents,” Conference on Local Computer Networks 1999 (LCN '99), Oct. 1999, pp. 98 – 105
Major, J. A., and D. R. Riendinger, “EFD: A Hybird Knowledge/Stastical-Based System for the Detection of Fraud,” International Journal of Intelligent Systems, vol. 7, 1992, pp.687-703
Lin, D. and Z.M. Kederm, “Pincer-Search: A New Algorithm for Discovering the Maximum Frequent Set,” Proceedings of 7th international Conference on Extending Database Technology, 1998.
Lin, I. Y., X. M. Huang and M. S. Chen, “Capturing user access patterns in the Web for data mining,” Proceedings of 11th IEEE International Conference on Tools with Artificial Intelligence, 9-11 Nov. 1999, pp. 345 – 348
Lin, X., X. Zhou and Y. Lin, “Efficiently mining tree traversal patterns in a web environment,” 1998 IEEE Region 10 International Conference on Global Connectivity in Energy, Computer, Communication and Control, 17-19 Dec. 1998, pp. 115 – 117
Messmer, B. T. and H. Bunke, “New Algorithm for Error-Tolerant Subgraph Isomorphism Detection,” IEEE Transactions on Pattern Analysis and Machine Intelligence, Vol. 20, No. 5, May 1998, pp. 493-504
Papadopoulos, A.N. and Y. Manolopoulos, “Structure-based similarity search with graph histograms,” Proceedings of Tenth International Workshop on Database and Expert Systems Applications, 1-3 Sept. 1999, pp. 174 – 178
Pei, J., J. Han, B. Mortazavi-Asl, and H. Zhu, “Mining Access Pattern efficiently from Web logs,” Proc. 2000 Pacific-Asia Conf. on Knowledge Discovery and Data Mining (PAKDD'00), Apr. 2000
Ronald, G., Graph Theory, Menlo Park, Calif, Benjamin/Cummings Pub. Co., 1988.
Townsend, R. L., SNMP application developer's guide, New York : Van Nostrand Reinhold, 1995.
Sanfeliu A. and K.S. Fu, “A Distance Measure between Attributed Relational Graphs for Pattern Recognition,“ IEEE Transactions on System, Man, and Cybernetics, Vol. 13, 1983, pp. 353-362
Taniguchi, M., M. Haft, J. Hollmen and V. Tresp, “Fraud detection in communication networks using neural and probabilistic methods,” Proceedings of the 1998 IEEE International Conference on Acoustics, Speech and Signal Processing, Vol.2, May. 1998, pp. 1241 - 1244
Tsai, W.H and K.S. Fu, “Error-correcting isomorphism of attributed relational graphs for pattern recognition,“ IEEE Transactions on System, Man, and Cybernetics, Vol. 9, 1979, pp. 757-768
Yang, D.L. and J.C. Wang, “A Study on Mining Association Rules with Long Itemset Patterns,” International National Conference on Information Management”, Nsysu Taiwan, Mar. 2000, pp. pp.32
Zaiane, O.R., M. Xin and J. Han, “Discovering Web access patterns and trends by applying OLAP and data mining technology on Web logs,” Proceedings of IEEE International Forum on Research and Technology Advances in Digital Libraries (ADL 98), 2-24 Apr. 1998, pp. 9 – 29
Shoubridge, P., M. Kraetzl, D. Ray, “Detection of abnormal change in dynamic networks,” Proceedings of Information, Decision and Control, 1999 (IDC 99), 8-10 Feb. 1999, pp. 557 – 562.