In recent years, with more and more people shopping, chatting and video online, the Internet is playing a more and more important role in human's daily life. Since the Internet is so close to our lives, it contains so much personal information that will cause a lot of troubles or even losses when divulged. So it's necessary and urgent to find a efficient way to detect the abnormal network behavior. In this paper, we present a new detection method based on compound session. In contrast to previous methods, our approach is based on the cloud computing platform and the cluster system, using Hadoop Distributed File System (HDFS) to analysis and using Twitter Storm to make real-time network anomaly detection come true.