## 4 Methodology
### Graph Convolutional Neural Network Module
* XGBoost: a gradient boosting ensemble algorithm that leverages a collection of decision trees as its base learners, employing sophisticated optimization techniques to enhance predictive accuracy and handle a wide range of machine learning tasks. * SVM: a support vector machine with the Radial Basis Function (RBF) kernel. * GCN: a graph convolutional network using the first-order approximation of localized spectral filters on graphs. * GAT: a graph attention network that employs the attention mechanism for neighbor aggregation. * GraphSAGE: a GNN model based on a fixed sample number of the neighbor nodes. * GCN-LSTM: a hybrid deep learning architecture that combines the power of graph convolutional networks (GCNs) with the sequential modeling abilities of Long Short-Term Memory networks (LSTMs). The results of the comparison of different models are shown in Table 2 and Figure 12. The figure visualizes that this paper's model GCN-GRU-Attention achieves the best performance in all evaluation metrics, which can be seen in the table with values above 99%, and in the generalized GNN model, GAT performs poorly in most cases, with values around 70%, except for the accuracy. MLP, XGBoost, and SVM also achieve a comparable performance when graph structure is ignored, with metrics values of around 80% for each series, the models GraphSAGE and the combined model GCN-LSTM achieve relatively better results, with metrics values of around 95% for each series, and our model achieves a better performance in terms of accuracy, precision, recall, and F1 values compared to the GCN-LSTM, by 0.99%, 1.69%, 1.89%, and 1.93%, respectively. This also shows that ETC transaction data have graph structure characteristics as well as temporal characteristics, and the model chosen in this paper is very suitable for gantry anomaly detection based on ETC transaction data. #### 5.3.3 Ablation Experiment

For the different model components (GCN, GRU, Attention), this paper uses ablation experiments to quantitatively assess the importance of each component in the model. As shown in Table 3, each row represents a different model configuration, where the GCN updates the representation of each node through the propagation of information from neighboring nodes, is able to take into account the relationship between a node and its neighbors, and is to be used to process static graph data. The GRU is dedicated to sequence data and is suitable for processing dynamic graph data, with the ability to model temporal information. The attention mechanism allows for the model to assign different attention weights according to different parts of the input sequence, and the model can more effectively select information that is relevant to the current task, thus improving its performance. The gantry node transaction data studied in this paper are temporal and spatial in nature; therefore, the experimental results show that the performance of the model using only a single technique is not as good as the model integrating multiple techniques. The metrics of precision, accuracy and F1 score show that the model that uses GCN, GRU and Attention at the same time has the best results, with accuracy and F1 scores reaching over 99%, which is significantly better than the other three models. This indicates that the combination of GCN, GRU and Attention has a significant, positive impact on improving model performance in this experiment. The combination of GCN and GRU significantly improves the performance compared to the use of GCN or GRU alone, indicating that the combination of the two can extract more effective features and enhance the performance of the model. In addition, the introduction of the Attention mechanism can further improve the performance of the model, because the Attention mechanism makes the model better able to handle long-distance dependencies in sequences.