Anomaly detection based on key performance indicator (KPI) is an important topic in the field of intelligent operation and maintenance. The problem of insufficient annotated samples is widespread in the industrial Internet, and it severely impairs the performance of data-driven anomaly detection. Previous methods tackled the problem mainly through unsupervised methods, which rely heavily on the ability of the algorithm to extract features. In this work, we propose an unsupervised hybrid model to address these issues. Technically, we capture the long-term dependencies of time series by stacked BiLSTM and use the self-attention mechanism to adaptively select the most noteworthy information in the time series data for global consideration. To effectively distinguish anomalies, we propose a dynamic threshold method that takes into account the context of the data being measured. By doing so, we aim to minimize false positives and missed positives, thus significantly enhancing the overall performance. Extensive experiments on various public benchmarks and real-world measured data demonstrate that our method offers advanced performance and practicality.