In this paper, we propose a flexible framework to accomplish workflow modeling from network traffic, the Access Profile Statistical Analysis Tool (APSAT). In APSAT, workflow modeling is decomposed into four layers: packet flows, Resource Access Actions (RAA), workflow periods, and workflow behavior. We develop a novel approach to compress packet flows into expressive human actions using our Behavior Description Grammar (BDG). We illustrate a new algorithm to detect workflow shifts, where human action streams statistically deviate from an observed pattern of usage. One can infer semantics from workflow periods, the intervals between workflow shifts, and identify these shifts as a possible indicator of group actions. For its evaluation, a prototype of APSAT monitors file access from a series of scripted workflow simulations. It is found that a strong relationship exists between workflows and workflow-driven file access patterns.