. Anomaly detection in time series data is essential in fields like traffic analysis and financial monitoring. For system stability, fault prevention, and risk reduction, online multivariate time series anomaly detection is a key need. To solve the complex problem of detecting anomalies in multivariate time series data, this paper presents TAMAD, a two - layer adaptive model. TAMAD uses a sliding window to update statistical features in real - time, adapting to data distribution changes. It uses the KDE model for spotting univariate local anomalies, and combines JS divergence and Z - score thresholds to identify imbalances in multivariate sequences. This enables the recognition of both local and global anomalies. To suit data changes, TAMAD uses EVT - based dynamic threshold adjustment. TAMAD can locate anomalies and analyze their types. We run many experiments on real - world and synthetic data, choosing current main methods as baselines for comparison. Results show TAMAD is the best in overall performance, balancing high precision and strong recall, fitting for high - reliability scenarios. The synthetic data results show TAMAD can accurately locate anomalies and give reasonable explanations.