Dynamic Threshold-based Two-layer Online Unsupervised Anomaly Detector