This paper discusses the problem of normal operation baselining for automatic detection of network anomalies. A traditional envelope baseline algorithm is presented and compared with an advanced version proposed in this paper. The capability that, the envelope should not only expand but also shrink, is supported during the baseline self-improving process. Online data based experiment shows various aspects of the results from the two algorithms, which proves the advantage of this algorithm.