## 2 Literature Review  
ETC gantry is a system of multiple hardware devices integration, which mainly contains front-end devices, such as industrial controllers, power adapters, RSU antennas, license plate recognition devices, and back-end devices, such as servers and switches. Current research on hardware device anomaly detection is broadly categorized into three main groups: signal processing methods, multivariate statistics-based methods, and machine-learning-based methods. Among the methods of signal processing, time-frequency analysis and sparse filtering can improve the performance of fault diagnosis models [11; 12; 13; 14]. [PERSON] [15] analyzed the spectrum of the signal by applying dimensionality reduction to the spectral image obtained by fast Fourier transform for fault diagnosis. The proposed wavelet transform overcomesthe problem of localized characteristics and is used in fault diagnosis at a non-smooth multiscale, but cannot further decompose signals in high-frequency bands. Among the multivariate statistical analysis methods, Principal Component Analysis (PCA) has an excellent advantage for data dimensionality reduction processing. [PERSON] et al. [16] proposed an anomaly detection method based on generalized mutual entropy principal element analysis and applied it to the Tennyson-Eastman process for anomaly detection; the method shows good performance in handling non-Gaussian anomaly detection, with low false-alarm and miss rates. Machine learning methods have received more and more attention in anomaly detection and diagnosis techniques due to their good self-learning, recognition, and classification capabilities. [PERSON] et al. [17] proposed an AM-Relief feature selection using an integration (support vector machine (SVM)) diagnostic algorithm; the proposed method increases the fault diagnosis accuracy from 83.0% to 98.9%, providing a new idea for research on the mechanical fault diagnosis of high-voltage circuit breakers. [PERSON] et al. [18] proposed a bearing fault diagnosis model based on multi-sensor information fusion for aero-engine bearings; the accuracy of this method is improved by 36.92% compared to the classification and identification of faults using SVM. [PERSON] et al. [19] proposed a train speed anomaly detection method that combines extreme gradient boosting and anomaly verification methods; the method has high performance and meets the requirements of the real-time detection of train operations. However, the use of the XGboost model in the research methodology may have some limitations, such as a strong dependence on parameter settings, which may require more tuning and validation. The equipment anomaly detection methods mentioned above are mainly applied to industrial processes, machinery and equipment. They have not been fully applied in the anomaly detection of ETC gantry systems and are limited by the limitations of each system device, which can only be detected individually through the design of specific algorithms for each device. The transaction data generated by the ETC gantry system contain time-series properties, and the topology consisting of vehicle trajectories extracted from the transaction data has graph network structure properties. Gantry anomalies can cause missing transaction data, which manifest as point anomalies in time series anomalies and structural anomalies in topological road networks, so gantry anomalies can be investigated using dynamic graph anomaly detection methods based on time series and the structural properties of road network structural characteristics graph network structure characteristics. Dynamic graph anomaly detection is mainly categorized into isolated individual anomaly detection, anomaly group detection and event anomaly detection. The main types of dynamic graph-oriented anomalous individual detection are node anomalies, anomalous edges, and anomalous moments. [PERSON] et al.