With the rapid development of information technology, enterprise informatization is accelerating, but network security risks are also intensifying. Precise threat detection has thus become central to emergency response. Traceability graphs, by recording detailed system activities, offer advantages in attack detection and causal analysis, but existing methods have limitations: (1) Rule-based and supervised approaches rely heavily on prior knowledge and attack samples, making them ineffective against unknown attacks. (2) Anomaly detection methods are often too time-consuming to meet real-time requirements. To address these issues, this paper explores unsupervised anomaly detection on traceability graphs: (1) An autoencoder-based method is proposed, trained only on benign logs to learn normal behavior. A sampling mask graph learning mechanism with node and structural reconstruction captures entity and interaction features while reducing computation. Experiments show training time shortened by 50%, with precision and recall of 96% and 99%, surpassing baselines. (2) A two-stage detection strategy is designed: subgraph-level anomaly scoring with KNN for coarse filtering, followed by node-level KNN detection within suspicious subgraphs. Results indicate detection time reduced by 55% on average.