Incremental Anomaly Detection Using Two-Layer Cluster-based Structure