Real-time network and telecommunication systems often generate tremendous volume of streaming data. Effective modeling of such streaming data and detecting the bursts with single-scan algorithms pose great challenges. The aim of detecting bursts in data streams is to find anomalous aggregation in stream subsequences. We introduce Lasting Factor and Abrupt Factor in the general definition of burst, in order to characterize how a burst grows in real applications. A novel two-layered wavelet tree structure is designed to detect lasting bursts and abrupt bursts in linear time. Our algorithm reports appearance time range and average aggregate value for lasting bursts, break point position and peak value for abrupt bursts. Theoretical analysis and comparison experiments on the Internet Traffic Archive dataset verify the superiority of our approach over other burst detection algorithms in burst characterization and computation efficiency.