2. The method of claim 1 , wherein the aggregating further includes: assigning a session identifier to a network event in a particular identified subset; identifying an aggregation entry in a particular aggregation result table, associated with the particular identified subset, in accordance with the network event's value for the at least one of the event attributes, the aggregation entry including a set of session identifiers; inserting the network event's session identifier into the set of session identifiers if the network event's session identifier is not included in the set of session identifiers; and changing a position of the aggregation entry in the particular aggregation result table if a predefined condition is met.
4. The method of claim 2 , wherein the aggregation entry includes a session count and the predefined condition is met if the aggregation entry's session count is higher than or equal to the session count of a preceding entry in the particular aggregation result table.