The inherent presence of self-similarity in network (LAN, Internet) traffic motivates the applicability of wavelets in the study of 'burstiness' features of them. Inspired by the methods that use the self-similarity property of a data network traffic as normal behaviour and any deviation from it as the anomalous behaviour, we propose a method for anomaly based network intrusion detection. Making use of the relations present among the wavelet coefficients of a self-similar function in a different way, our method determines the possible presence of not only an anomaly, but also its location in the data. We provide the empirical results on KDD data set to justify our approach. © Springer-Verlag 2004.