The general basis for anomaly detection and fraud detection is pattern recognition. An effective online fraud detection system should be able to discover both known and new attacks as early as possible. The detection process should be self-adjustable to allow the system to deal with the constantly changing nature of online attacks. In this paper, we present an anomaly detection technique based on behavior mining and monitoring that work at both the individual and system level. Frequent pattern tree is utilized to profile the normal behavior adaptively. A novel tree-based pattern matching algorithm is designed to discover individual level anomalies. An algorithm for computing tree similarity is proposed to solve the system level problems. Empirical evaluations of our technique on both synthetic and real-world data show that we can accurately differentiate anomalous behaviors from the profiled normal behavior.