{"id":3564,"date":"2025-12-24T10:00:08","date_gmt":"2025-12-24T15:00:08","guid":{"rendered":"https:\/\/www.mymiller.name\/wordpress\/?p=3564"},"modified":"2025-12-24T10:00:08","modified_gmt":"2025-12-24T15:00:08","slug":"anomaly-detection-in-spring-boot-gateway-with-ai-and-dl4j-unsupervised-learning-approach","status":"publish","type":"post","link":"https:\/\/www.mymiller.name\/wordpress\/spring_ai\/anomaly-detection-in-spring-boot-gateway-with-ai-and-dl4j-unsupervised-learning-approach\/","title":{"rendered":"Anomaly Detection in Spring Boot Gateway with AI and DL4J: Unsupervised Learning Approach"},"content":{"rendered":"\n<div class=\"wp-block-jetpack-markdown\"><p>In this article, we\u2019ll focus on using unsupervised learning with DL4J to detect anomalies in data traffic passing through your Spring Boot Gateway. This is especially useful when you don\u2019t have labeled data on what constitutes \u201cnormal\u201d vs. \u201canomalous\u201d traffic.<\/p>\n<p><strong>Potential Features for Anomaly Detection in API Gateway Traffic<\/strong>\nThe features you choose to extract will depend on the specific nature of your API and the types of anomalies you\u2019re trying to detect. Here\u2019s a list of potential features to consider:<\/p>\n<p><strong>Request-Related Features<\/strong><\/p>\n<ul>\n<li><strong>Request Frequency:<\/strong>\n<ul>\n<li>Requests per second (RPS)<\/li>\n<li>Requests per minute (RPM)<\/li>\n<li>Requests per hour (RPH)<\/li>\n<li>Requests per client\/IP address<\/li>\n<\/ul>\n<\/li>\n<li><strong>Payload Size:<\/strong>\n<ul>\n<li>Request payload size (bytes)<\/li>\n<li>Response payload size (bytes)<\/li>\n<\/ul>\n<\/li>\n<li><strong>Request Method:<\/strong>\n<ul>\n<li>GET, POST, PUT, DELETE, etc. (categorical or one-hot encoded)<\/li>\n<\/ul>\n<\/li>\n<li><strong>Request Path:<\/strong>\n<ul>\n<li>Specific endpoint targeted (string or encoded)<\/li>\n<\/ul>\n<\/li>\n<li><strong>Request Headers:<\/strong>\n<ul>\n<li>User-Agent (string or encoded)<\/li>\n<li>Referer (string or encoded)<\/li>\n<li>Content-Type (string or encoded)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><strong>Response-Related Features<\/strong><\/p>\n<ul>\n<li><strong>Response Time:<\/strong>\n<ul>\n<li>Time to first byte (TTFB)<\/li>\n<li>Total response time<\/li>\n<\/ul>\n<\/li>\n<li><strong>Status Codes:<\/strong>\n<ul>\n<li>Success (2xx)<\/li>\n<li>Client errors (4xx)<\/li>\n<li>Server errors (5xx)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><strong>Client-Related Features<\/strong><\/p>\n<ul>\n<li><strong>IP Address:<\/strong>\n<ul>\n<li>Geolocation (country, region)<\/li>\n<li>IP reputation (blacklist\/whitelist)<\/li>\n<\/ul>\n<\/li>\n<li><strong>User Agent:<\/strong>\n<ul>\n<li>Browser type<\/li>\n<li>Operating system<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><strong>Additional Features<\/strong><\/p>\n<ul>\n<li><strong>Time-Based Features:<\/strong>\n<ul>\n<li>Time of day<\/li>\n<li>Day of week<\/li>\n<li>Month of year<\/li>\n<\/ul>\n<\/li>\n<li><strong>Error Rates:<\/strong>\n<ul>\n<li>Percentage of error responses<\/li>\n<\/ul>\n<\/li>\n<li><strong>Session-Based Features:<\/strong>\n<ul>\n<li>Number of requests in a session<\/li>\n<li>Session duration<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><strong>Feature Engineering<\/strong><\/p>\n<p>You can also create new features by combining or transforming existing ones. For example:<\/p>\n<ul>\n<li><strong>Average Request Size per Client:<\/strong> Calculate the average payload size of requests from a particular client.<\/li>\n<li><strong>Peak Request Times:<\/strong> Identify the times of day when request frequency is highest.<\/li>\n<li><strong>Error Rate per Endpoint:<\/strong> Calculate the error rate for specific API endpoints.<\/li>\n<\/ul>\n<p><strong>Remember:<\/strong><\/p>\n<ul>\n<li>Start with a smaller set of features and gradually add more as needed.<\/li>\n<li>Experiment with different feature combinations to see which ones work best for your specific anomaly detection task.<\/li>\n<li>Consider using dimensionality reduction techniques if you have a large number of features.<\/li>\n<\/ul>\n<p>Feel free to ask if you\u2019d like guidance on selecting or engineering specific features for your use case!<\/p>\n<p><strong>Feature Extraction: The Key to Effective Anomaly Detection<\/strong><\/p>\n<p>Before diving into unsupervised learning, it\u2019s crucial to understand feature extraction. Features are the measurable characteristics of your data that the model will use to learn patterns. In the context of API gateway traffic, relevant features might include:<\/p>\n<ul>\n<li><strong>Request Frequency:<\/strong> How often a particular client or IP address is making requests.<\/li>\n<li><strong>Payload Size:<\/strong> The size of the data being sent in the request or received in the response.<\/li>\n<li><strong>Response Time:<\/strong> How long it takes for your backend services to process a request.<\/li>\n<li><strong>Error Rates:<\/strong> The frequency of error responses (e.g., 500 Internal Server Errors).<\/li>\n<li><strong>Request Method:<\/strong> Whether it\u2019s a GET, POST, PUT, DELETE, etc.<\/li>\n<li><strong>Request Path:<\/strong> The specific endpoint being targeted.<\/li>\n<\/ul>\n<p><strong>Extracting Features in Spring Cloud Gateway<\/strong><\/p>\n<p>You can extract these features using a custom <code>GlobalFilter<\/code> in Spring Cloud Gateway. Here\u2019s an example snippet:<\/p>\n<pre><code class=\"language-java\">@Component\npublic class FeatureExtractionFilter implements GlobalFilter {\n\n    @Override\n    public Mono&lt;Void&gt; filter(ServerWebExchange exchange, GatewayFilterChain chain) {\n        \/\/ ... (Access request\/response objects to extract features)\n\n        Map&lt;String, Object&gt; features = new HashMap&lt;&gt;();\n        features.put(&quot;requestFrequency&quot;, \/* ... calculate ... *\/);\n        features.put(&quot;payloadSize&quot;, \/* ... calculate ... *\/);\n        \/\/ ... (Extract other features)\n\n        exchange.getAttributes().put(&quot;extractedFeatures&quot;, features);\n        return chain.filter(exchange);\n    }\n}\n<\/code><\/pre>\n<p><strong>Unsupervised Anomaly Detection with DL4J (with Feature Extraction)<\/strong><\/p>\n<ol>\n<li>\n<p><strong>Choose Your Unsupervised DL4J Model:<\/strong> Autoencoders or Self-Organizing Maps (SOMs).<\/p>\n<\/li>\n<li>\n<p><strong>Preprocess and Transform Features:<\/strong> Normalize or standardize your extracted features to ensure they have similar scales. This is important for many machine learning algorithms, including those in DL4J.<\/p>\n<\/li>\n<li>\n<p><strong>Train the Model on Normal Data with Extracted Features:<\/strong> Feed the preprocessed features from normal traffic data to your chosen DL4J model.<\/p>\n<\/li>\n<li>\n<p><strong>Integrate with Spring Cloud Gateway Filter:<\/strong><\/p>\n<ul>\n<li>The filter first calls the <code>FeatureExtractionFilter<\/code> to extract features.<\/li>\n<li>Then it preprocesses the features and feeds them to the trained DL4J model.<\/li>\n<li>Get a prediction (reconstruction error or distance to cluster center) and compare it to your anomaly threshold.<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p><strong>Example Code Snippet (Autoencoder)<\/strong><\/p>\n<pre><code class=\"language-java\">@Component\npublic class AnomalyDetectionFilter implements GlobalFilter {\n\n    \/\/ ... (Autowire FeatureExtractionFilter and the loaded DL4J autoencoder model)\n\n    @Override\n    public Mono&lt;Void&gt; filter(ServerWebExchange exchange, GatewayFilterChain chain) {\n\n        \/\/ ... (Call FeatureExtractionFilter to get extracted features)\n        Map&lt;String, Object&gt; features = exchange.getAttribute(&quot;extractedFeatures&quot;);\n\n        \/\/ ... (Preprocess features)\n        INDArray input = Nd4j.create(preprocessedFeatures);\n\n        \/\/ ... (rest of the filter logic for model prediction and anomaly handling)\n\n        return chain.filter(exchange);\n    }\n}\n<\/code><\/pre>\n<p><strong>Key Considerations:<\/strong><\/p>\n<ul>\n<li>Feature Selection: Choose features that are most likely to distinguish normal from anomalous traffic.<\/li>\n<li>Feature Engineering: Create new features by combining or transforming existing ones to capture more complex patterns.<\/li>\n<li>Dimensionality Reduction: If you have a large number of features, consider techniques like Principal Component Analysis (PCA) to reduce the dimensionality while preserving important information.<\/li>\n<\/ul>\n<p>Let me know if you\u2019d like a deeper dive into any of these aspects, such as specific feature engineering techniques or dimensionality reduction with DL4J!<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"","protected":false},"author":1,"featured_media":3566,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_coblocks_attr":"","_coblocks_dimensions":"","_coblocks_responsive_height":"","_coblocks_accordion_ie_support":"","jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":false,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[443],"tags":[319],"series":[423,397],"class_list":["post-3564","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-spring_ai","tag-spring","series-java","series-spring"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"https:\/\/i0.wp.com\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2024\/06\/Gemini_Generated_Image_rzr70rzr70rzr70r.jpg?fit=1536%2C1536&ssl=1","jetpack-related-posts":[{"id":3935,"url":"https:\/\/www.mymiller.name\/wordpress\/spring_ai\/%f0%9f%9a%80-dl4j-and-spring-boot-real-time-anomaly-detection-in-time-series-data\/","url_meta":{"origin":3564,"position":0},"title":"\ud83d\ude80 DL4J and Spring Boot: Real-Time Anomaly Detection in Time-Series Data","author":"Jeffery Miller","date":"November 25, 2025","format":false,"excerpt":"As a Software Architect, you understand that an excellent solution requires not just a powerful model, but a robust, scalable, and performant architecture for deployment. The combination of DL4J (Deeplearning4j) and Spring Boot is perfectly suited for building real-time, high-performance services, especially for a critical task like time-series anomaly detection.\u2026","rel":"","context":"In &quot;Spring AI&quot;","block_context":{"text":"Spring AI","link":"https:\/\/www.mymiller.name\/wordpress\/category\/spring_ai\/"},"img":{"alt_text":"","src":"https:\/\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2025\/11\/Gemini_Generated_Image_ek9cohek9cohek9c.avif","width":350,"height":200,"srcset":"https:\/\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2025\/11\/Gemini_Generated_Image_ek9cohek9cohek9c.avif 1x, https:\/\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2025\/11\/Gemini_Generated_Image_ek9cohek9cohek9c.avif 1.5x, https:\/\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2025\/11\/Gemini_Generated_Image_ek9cohek9cohek9c.avif 2x"},"classes":[]},{"id":3574,"url":"https:\/\/www.mymiller.name\/wordpress\/spring_ai\/deeplearning4j-and-spring-boot-a-powerful-duo-for-ai-powered-applications\/","url_meta":{"origin":3564,"position":1},"title":"Deeplearning4J and Spring Boot: A Powerful Duo for AI-Powered Applications","author":"Jeffery Miller","date":"April 20, 2026","format":false,"excerpt":"Deeplearning4J (DL4J) offers a comprehensive Java framework for deep learning, while Spring Boot streamlines the development of production-ready applications. By combining these two technologies, you unlock a flexible platform for building intelligent services that can handle various types of data. In this guide, we\u2019ll explore how to integrate DL4J into\u2026","rel":"","context":"In &quot;Spring AI&quot;","block_context":{"text":"Spring AI","link":"https:\/\/www.mymiller.name\/wordpress\/category\/spring_ai\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2024\/04\/ai-generated-8453379_1280.jpg?fit=800%2C1200&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2024\/04\/ai-generated-8453379_1280.jpg?fit=800%2C1200&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2024\/04\/ai-generated-8453379_1280.jpg?fit=800%2C1200&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2024\/04\/ai-generated-8453379_1280.jpg?fit=800%2C1200&ssl=1&resize=700%2C400 2x"},"classes":[]},{"id":3951,"url":"https:\/\/www.mymiller.name\/wordpress\/java\/scaling-streams-mastering-virtual-threads-in-spring-boot-4-and-java-25\/","url_meta":{"origin":3564,"position":2},"title":"Scaling Streams: Mastering Virtual Threads in Spring Boot 4 and Java 25","author":"Jeffery Miller","date":"December 22, 2025","format":false,"excerpt":"As a software architect, I\u2019ve seen the industry shift from heavy platform threads to reactive streams, and finally to the \"best of both worlds\": Virtual Threads. With the recent release of Spring Boot 4.0 and Java 25 (LTS), Project Loom's innovations have officially become the bedrock of high-concurrency enterprise Java.\u2026","rel":"","context":"In &quot;JAVA&quot;","block_context":{"text":"JAVA","link":"https:\/\/www.mymiller.name\/wordpress\/category\/java\/"},"img":{"alt_text":"","src":"https:\/\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2025\/12\/Gemini_Generated_Image_wqijejwqijejwqij-scaled.avif","width":350,"height":200,"srcset":"https:\/\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2025\/12\/Gemini_Generated_Image_wqijejwqijejwqij-scaled.avif 1x, https:\/\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2025\/12\/Gemini_Generated_Image_wqijejwqijejwqij-scaled.avif 1.5x, https:\/\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2025\/12\/Gemini_Generated_Image_wqijejwqijejwqij-scaled.avif 2x, https:\/\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2025\/12\/Gemini_Generated_Image_wqijejwqijejwqij-scaled.avif 3x"},"classes":[]},{"id":3582,"url":"https:\/\/www.mymiller.name\/wordpress\/spring\/leveraging-dicom-in-spring-boot-applications\/","url_meta":{"origin":3564,"position":3},"title":"Leveraging DICOM in Spring Boot Applications","author":"Jeffery Miller","date":"April 20, 2026","format":false,"excerpt":"Leveraging DICOM in Spring Boot Applications DICOM, the cornerstone of medical imaging, is a specialized format for storing and transmitting medical images and related information. Integrating it into your Spring Boot project opens up a world of possibilities for medical applications. Let\u2019s explore how to achieve this. Understanding DICOM DICOM\u2026","rel":"","context":"In &quot;Spring&quot;","block_context":{"text":"Spring","link":"https:\/\/www.mymiller.name\/wordpress\/category\/spring\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2024\/06\/x-ray-6841384_1280.jpg?fit=1200%2C800&ssl=1&resize=350%2C200","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2024\/06\/x-ray-6841384_1280.jpg?fit=1200%2C800&ssl=1&resize=350%2C200 1x, https:\/\/i0.wp.com\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2024\/06\/x-ray-6841384_1280.jpg?fit=1200%2C800&ssl=1&resize=525%2C300 1.5x, https:\/\/i0.wp.com\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2024\/06\/x-ray-6841384_1280.jpg?fit=1200%2C800&ssl=1&resize=700%2C400 2x, https:\/\/i0.wp.com\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2024\/06\/x-ray-6841384_1280.jpg?fit=1200%2C800&ssl=1&resize=1050%2C600 3x"},"classes":[]},{"id":3893,"url":"https:\/\/www.mymiller.name\/wordpress\/spring_ai\/building-intelligent-apps-with-spring-ai\/","url_meta":{"origin":3564,"position":4},"title":"Building Intelligent Apps with Spring AI","author":"Jeffery Miller","date":"December 24, 2025","format":false,"excerpt":"In today's fast-paced world of software development, integrating artificial intelligence into applications is no longer just a trend\u2014it's a necessity. At the heart of this revolution is Generative AI, a type of artificial intelligence that can create new content, such as text, images, and code, in response to prompts. It's\u2026","rel":"","context":"In &quot;Spring AI&quot;","block_context":{"text":"Spring AI","link":"https:\/\/www.mymiller.name\/wordpress\/category\/spring_ai\/"},"img":{"alt_text":"","src":"https:\/\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2025\/08\/ai-generated-8273796_1280.avif","width":350,"height":200,"srcset":"https:\/\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2025\/08\/ai-generated-8273796_1280.avif 1x, https:\/\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2025\/08\/ai-generated-8273796_1280.avif 1.5x, https:\/\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2025\/08\/ai-generated-8273796_1280.avif 2x, https:\/\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2025\/08\/ai-generated-8273796_1280.avif 3x"},"classes":[]},{"id":3912,"url":"https:\/\/www.mymiller.name\/wordpress\/uncategorized\/spring-boot-4-0-whats-next-for-the-modern-java-architect\/","url_meta":{"origin":3564,"position":5},"title":"Spring Boot 4.0: What&#8217;s Next for the Modern Java Architect?","author":"Jeffery Miller","date":"September 24, 2025","format":false,"excerpt":"A Forward-Looking Comparison of Spring Boot 3.x and 4.0 Staying on top of the rapidly evolving Java ecosystem is paramount for any software architect. The shift from Spring Boot 2.x to 3.x brought significant changes, notably the move to Jakarta EE. Now, with the horizon of Spring Boot 4.0 and\u2026","rel":"","context":"Similar post","block_context":{"text":"Similar post","link":""},"img":{"alt_text":"","src":"https:\/\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2025\/09\/per-2056740_1280.avif","width":350,"height":200,"srcset":"https:\/\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2025\/09\/per-2056740_1280.avif 1x, https:\/\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2025\/09\/per-2056740_1280.avif 1.5x, https:\/\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2025\/09\/per-2056740_1280.avif 2x, https:\/\/www.mymiller.name\/wordpress\/wp-content\/uploads\/2025\/09\/per-2056740_1280.avif 3x"},"classes":[]}],"jetpack_sharing_enabled":true,"jetpack_likes_enabled":true,"_links":{"self":[{"href":"https:\/\/www.mymiller.name\/wordpress\/wp-json\/wp\/v2\/posts\/3564","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.mymiller.name\/wordpress\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.mymiller.name\/wordpress\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.mymiller.name\/wordpress\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.mymiller.name\/wordpress\/wp-json\/wp\/v2\/comments?post=3564"}],"version-history":[{"count":2,"href":"https:\/\/www.mymiller.name\/wordpress\/wp-json\/wp\/v2\/posts\/3564\/revisions"}],"predecessor-version":[{"id":3567,"href":"https:\/\/www.mymiller.name\/wordpress\/wp-json\/wp\/v2\/posts\/3564\/revisions\/3567"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.mymiller.name\/wordpress\/wp-json\/wp\/v2\/media\/3566"}],"wp:attachment":[{"href":"https:\/\/www.mymiller.name\/wordpress\/wp-json\/wp\/v2\/media?parent=3564"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.mymiller.name\/wordpress\/wp-json\/wp\/v2\/categories?post=3564"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.mymiller.name\/wordpress\/wp-json\/wp\/v2\/tags?post=3564"},{"taxonomy":"series","embeddable":true,"href":"https:\/\/www.mymiller.name\/wordpress\/wp-json\/wp\/v2\/series?post=3564"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}