An episode mining method that includes the steps outlined below is provided. Real-time operation parameters are retrieved. At least one incremental candidate pattern in every incremental time period is generated, wherein the incremental candidate pattern is an incremental episode including a set of events of the real-time operation parameters and having an incremental occurrence frequency larger than an incremental threshold. At least one batch candidate pattern in every batch time period is generated, wherein the batch candidate pattern is a batch episode including a set of events of the real-time operation parameters within the batch time period and having a batch occurrence frequency larger than a batch threshold. At least one newly-add candidate episode is determined from the incremental candidate pattern and the batch candidate pattern having an occurrence frequency larger than a determine threshold. At least one detection rule is generated based on the newly-add candidate episode.