First, this paper puts forward an algorithm of two-level aggregate, which can be applied to the analysis of flow data collected from a remote on-line monitoring system. Then, with the result of the algorithm we can get the characteristics of students' network behavior, which will have a substantial influence on advancing the construction of campus network.