Wireless sensor network was widely used in many applications, and sensitive data was needed to collect, thus security was crucial. Once the sensor node was compromised, and did not take the appropriate measures, the node′s key information was easily leaked. The attacker could masquerade as these nodes to inject arbitrarily erroneous information the network, which led to a sharp decline in network security. An anomaly based intrusion detection algorithm for compromised nodes was proposed, which could effectively identify the compromised nodes in the wireless sensor networks. Algorithm abstracted the relationship between the sensor nodes, using Event driven to determine if the node sent data packets in a fixed time interval. According to the time difference,the base station confirmed if suspicious node was really a compromised one. Algorithm did not rely on any assumption how the compromised node acted and conspire to each other, and could identify the overwhelming majority of the compromised nodes which deviated from the normal behavior, without “false positives”.