Wireless　sensor　networks(WSN)　are　facing　potential　threats　of　various　attacks,　among　which　wormhole　attack　is　one　of　the　most　harmful　attacks.　Wormhole　attack　is　hard　to　detect,　and　once　they　occur,　a　series　of　other　attacks　will　be　carried　out　to　discard,　steal,　and　tamper　with　messages　on　the　network.　Due　to　the　limited　resources　and　computing　power　of　WSN　nodes,　it　has　higher　requirements　for　defense　algorithms.　However,　existing　solutions　either　require　additional　hardware,　or　require　higher　communication　overhead,　or　perform　badly　in　the　wormholes　with　short　hops.　This　paper　proposes　an　anomaly　detection　algorithm　based　on　mean-shift　and　median　absolute　deviation(MSAMAD),　which　detects　wormhole　attacks　by　detecting　the　abnormal　number　of　forwarding　and　the　abnormal　single-hop　time　between　nodes.　MSAMAD　does　not　require　special　hardware　and　strict　time　synchronization,　and　the　communication　overhead　is　small.　The　simulation　results　show　that　this　method　has　a　high　detection　rate,　especially　in　short-range　wormhole　attacks　more　than　other　methods.　©　2022　IEEE.