## 2 Literature Review
[20] proposed a multidimensional count min sketch (CM-Sketch) approach to maintain the count of edges, which mainly focuses on the detection of anomalies on the edge flow, modeling the dynamic network as edges arriving over time and detecting the anomalous edges on this basis. However, empirical metrics are used, making the method less able to generalize. [PERSON] et al. [21] considered edges connecting sparsely connected regions occurring in emergency situations as anomalous edges and compared the connectivity between nodes around the edges before and after the addition of edges, such that edges with increased connectivity have higher anomaly values. However, this method requires extra space to maintain the sample and does not detect exceptions in the general case. Dynamic graph anomaly population detection requires consideration of the time dimension, and different areas of concern for the type of anomalous groups are different, such as those that can be analyzed in traffic or used to analyze anomalous groups in a social network. [PERSON] et al. [22] proposed the FGN detection method based on graph neural network to resolve the problem of abnormal user detection in social networks. The article proposes HNR, a graph node representation learning method incorporating hyperbolic geometry, which reduces the training complexity and improves the information transfer process, preserving higher-order neighbor information. However, the HNR in the article only utilizes the node's own attributes and does not make full use of the neighbors' attribute information, meaning that it has a limited characterization learning ability. Event anomaly detection is a method of anomaly detection that looks for points in time series data that are different from most other points in time, and then delves deeper by using static graphs of network structure data for the points in time. Neural network anomalous event detection is widely used, especially the graph neural network, which is developed for deep learning on data with a graph structure, which play an important role in many directions [23; 24; 25]. [PERSON] et al. [26] proposed the TADDY framework to represent a dynamic graph as a series of discrete graph snapshots, and defined the anomaly detection problem as one that provides an anomaly score for each edge at each timestamp. However, the overall training efficiency of the method is low, and it is not friendly to large-scale dynamic graphs. [PERSON] et al. [27] proposed AnoGLA, a network anomaly detection framework based on graph neural networks and long- and short-term memory networks. The framework views network traffic as a subgraph, extracts graph structural features using GCN, learns traffic variation patterns over time using long- and short-term memory networks, and finally generates anomaly scores for each traffic flow through end-to-end training using a negative sampling training framework. However, the paper only considered a small number of attributes for node coding, did not fully explore the node information, and was not effective for attribute-rich datasets. In summary, the current research related to the abnormal detection of ETC gantry equipment is still relatively shallow; most of the research is more focused on engineering technology, and there is still a lot of room for academic research. Graph-based dynamic anomaly detection has shown great advantages in the field of big data, is capable of dealing with heterogeneous structures and time dependencies in dynamic networks, and is now widely used in such fields as finance, Internet security, social relationship mining, and telemarketing fraud detection. However, no scholars have applied the method to the dynamic detection of gantry equipment to date.