A method for monitoring a computer network used to transfer data includes measuring (112) the amount of data transferred across the network during each of a plurality of time periods. The method also includes determining (118) an actual level of network usage by a user for each of the time periods and comparing (120) the actual level of network usage generated for each time period with an authorized level of usage. The method further includes generating (122) a flag for each of the time periods in which the actual level of network usage exceeds the authorized level of usage,