## 3 Relevant Definitions and Problem Descriptions  
**Definition 1**. : _(highway segment QD): Two adjacent gantries on a highway form a QD, with gantry Node\({}_{1}\) as the start node of the QD and Node\({}_{2}\) as the end node:_  
\[QD=\langle Node_{1},Node_{2}\rangle. \tag{1}\]  
**Definition 2**. : _(highway section LD): Highway segments consist of multiple adjacent QDs:_  
\[LD=\{QD_{1},\dots,QD_{n}\} \tag{2}\]  
_where the starting node of \(QD_{1}\) is called the starting point of the section, the terminating node of \(QD_{n}\) is called the end point of the section, and the end point of the previous QD is the starting point of the next QD._  
**Definition 3**. : _(Freeway Road Network LW): All segments of the LD within the freeway study area comprise the freeway road network:_  
\[LW=\{LD_{1},\cdots,LD_{n}\}. \tag{3}\]  
**Definition 4**. : _Effective transaction topology: In Figure 1, Figure 1a shows the local LW, and Figure 1b-d are the three sets of locally effective transaction topologies. In Figure 1b there are two ordered trading sections, <K, H, I> and <K, H, G, F, E>. As shown in Figure 1e, if the same license plate number appears in the transaction data of both gantry \(G\) and gantry \(E\) in the time series, but there is no same license plate number in gantry \(F\), this means that gantry \(F\) has a transaction failure._  
**Definition 5**. : _Gantry Anomaly: A pattern of trading in which the gantry exhibits significantly different trading behavior from normal trading behavior during a specific time window. Based on the continuity of anomaly occurrence, gantry anomalies can be subdivided into the following four categories._  
1. Burst Anomaly (BA): refers to multiple discrete transaction failures for different vehicle transactions on the gantry within a time window. Defined as more than \(B\) discrete transaction failures on the gantry within a time window \(T\), where \(B\) is a predetermined threshold. 2. Mild Continuous Anomaly (MCA): refers to a time window in which \(K_{1}\) consecutive different vehicles on the gantry have failed to trade, where \(K_{1}\) is a predetermined threshold. 3. Moderate Continuous Anomaly (MoCA): refers to a time window in which there are \(K_{2}\) consecutive different vehicles on the gantry that have failed to trade, where \(K_{2}>K_{1}\). 4. Severe Continuous Anomaly (SCA): refers to a time window in which \(K_{3}\) or more consecutively different vehicles on the gantry have failed to trade, where \(K_{3}>K_{2}\). In this paper, we distinguish the severity of anomalies by defining the thresholds \(B\), \(K_{1}\), \(K_{2}\), and \(K_{3}\) for the number of failed transactions, and capture the temporary or persistent nature of the anomaly based on the time window \(T\). Problem description:  
Combining the topology of the highway network, the gantry nodes are taken as the nodes of the graph, the gantry transactions are taken as the edges of the graph, the dynamic detection of the gantry anomalies is converted to the dynamic anomaly detection of the graph nodes, and based on the four types of anomalies defined above, the problem is finally transformed into the dynamic anomaly detection based on the node classification task. The set of n time slices \(T=\{t_{1},t_{2},t_{3},\cdots,t_{n}\}\) is divided according to the temporal characteristics of the transaction data and the zone travel time, the set of edges \(E\) of the subgraph is the transactions between the gantries, \(E\) is the set of edges of the subgraph, and the adjacency matrix of the graph \(G\) is denoted as \(\mathrm{A}=(A_{t_{1}},A_{t_{2}},\cdots,A_{t_{n}}),\ A\in R^{N\times N}\). Using the information of the transaction data as attribute features of the nodes, the feature  
Figure 1: Effective transaction topology diagram. (**a**) Schematic diagram of local road network, Where the yellow dots represent hubs, the blue dots represent gantry nodes, and the letters \(\mathrm{A},\ldots,\mathrm{K}\), denote the names of the portal frame gantry nodes.