## 4 Methodology
### Graph Convolutional Neural Network Module
At each time step \(t\), the similarity between the query vector \(q_{t}\) and the key vector \(k_{t}\) is usually computed using the dot product, and additive attention (using fully connected layers) method. After the similarity is calculated, it is normalized by softmax function to obtain the attention weight \(\alpha_{t}\); these weights indicate the most relevant position to the query \(q_{t}\) at the current position \(t\). Weighted summation of a sequence of value vectors \(v_{t}\) using attention weights yields the context vector \(c_{t}\). \(c_{t}\) contains information about the query vector \(q_{t}\) at the current time step \(t\), which is used as a feature representation of the current time step to capture information about the dynamics of the transaction graph during a locally proximate time window. Based on the above framework principle of the attention mechanism, \(Q_{h}\) corresponds to Query in the graph, which is used to map the approaching time window state to the feature of attention at the current location. \(C_{h,i}^{t}\) corresponds to _Key_ in the graph denoting the approaching time window state of the current node i at time step \(t\), which is used to compute the relevance degree. The result Value processed by the mapping function represents the approaching time window state of the current node i at time step t. The feature representation obtained after processing through the mapping function \(Q_{h}\) is used to generate the context representation. The specific calculation process is as follows:

\[C_{h,i}^{t}=\left[h_{i}^{t-\omega};\ldots;h_{i}^{t-1}\right]\qquad\qquad C_{h,i}^{t}\in R^{\omega\times n} \tag{9}\]

\[e_{h,i}^{t}=r^{T}tanh(Q_{h}(C_{h,i}^{t})^{T})\qquad\quad e_{h,i}^{t}\in R^{ \omega} \tag{10}\]

\[a_{h,i}^{t}=softmax\left(e_{h,i}^{t}\right)\qquad\qquad a_{h,i}^{t}\in R^{ \omega} \tag{11}\]

Figure 4: Schematic framework of the attention mechanism. \[h^{l}_{i}=\sigma(\sum_{j\in N(i)}\frac{1}{c_{ij}}h^{l-1}_{i}W^{(l-1)}) \tag{6}\]0

where \(h_{i}^{t}\) denotes the hidden state of the i-th node. \(\omega\) is the size of the window for capturing the proximity time-slice, which determines how many hidden states from the previous time-steps are to be considered to construct the proximity state of the current node. \(e_{h,i}^{t}\) is the hidden state of multiple time-slice of the i-th node that is mapped to a new vector by a mapping operation for the subsequent attentional weight computation. \(Q_{h}\) and r denote the parameters that are used to optimize the context-based attention mechanism parameters of the optimization based contextual attention mechanism. \(a_{h,i}^{t}\) is a vector of attentional weights computed by softmax function in vector \(e_{h,i}^{t}\). This attentional weight is used to represent the importance of the hidden states of different time slices. \[h^{l}_{i}=\sigma(\sum_{j\in N(i)}\frac{1}{c_{ij}}h^{l-1}_{i}W^{(l-1)}) \tag{6}\]1

### Dynamic Update Mechanism Based on GRU

In order to realize the dynamic detection of gantry anomalies, we need to capture the transaction characteristics of the gantry topology in different time slices, and the anomalies of the gantry will also change over time. GRU is a kind of Recurrent Neural Network (RNN) that solves the problems of Long Short Term Memory (LSTM) dependence and gradient vanishing in the back-propagation, and is similar to replacing the forgetting gates in LSTM. The input gates in LSTM are replaced by update gates, which makes the GRU network have fewer parameters and improves the training efficiency to a large extent. Therefore, in this paper, we use GRU to model the sequence changes, and capture the node information of the neighboring time slices to the current time slice, as well as the node long-term dependence information.