<?xml version="1.0" encoding="UTF-8" standalone="no" ?>
<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="195.231.102.247" dst_port="80" proto="tcp" src_ip="151.144.78.32" src_port="80"/>
      <filter dst_ip="195.231.102.247" dst_port="80" proto="udp" src_ip="151.144.78.32" src_port="80"/>
      <filter dst_ip="195.231.102.247" dst_port="25" proto="tcp" src_ip="151.144.78.32" src_port="80"/>
      <filter dst_ip="195.231.102.247" dst_port="25" proto="udp" src_ip="151.144.78.32" src_port="80"/>
      <filter dst_ip="195.231.102.247" dst_port="53" proto="tcp" src_ip="151.144.78.32" src_port="80"/>
      <filter dst_ip="195.231.102.247" dst_port="53" proto="udp" src_ip="151.144.78.32" src_port="80"/>
      <from sec="991803600" usec="0"/>
      <to sec="991803743" usec="0"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991803743" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="216.204.162.252" dst_port="80" proto="tcp" src_ip="169.41.86.32" src_port="53"/>
      <filter dst_ip="216.204.162.252" dst_port="80" proto="udp" src_ip="169.41.86.32" src_port="53"/>
      <filter dst_ip="216.204.162.252" dst_port="53" proto="tcp" src_ip="169.41.86.32" src_port="53"/>
      <filter dst_ip="216.204.162.252" dst_port="53" proto="udp" src_ip="169.41.86.32" src_port="53"/>
      <filter dst_ip="216.204.162.252" dst_port="25" proto="tcp" src_ip="169.41.86.32" src_port="53"/>
      <filter dst_ip="216.204.162.252" dst_port="25" proto="udp" src_ip="169.41.86.32" src_port="53"/>
      <filter dst_ip="209.209.213.22" dst_port="80" proto="tcp" src_ip="169.41.86.32" src_port="53"/>
      <filter dst_ip="209.209.213.22" dst_port="80" proto="udp" src_ip="169.41.86.32" src_port="53"/>
      <filter dst_ip="209.209.213.22" dst_port="53" proto="tcp" src_ip="169.41.86.32" src_port="53"/>
      <filter dst_ip="209.209.213.22" dst_port="53" proto="udp" src_ip="169.41.86.32" src_port="53"/>
      <filter dst_ip="209.209.213.22" dst_port="25" proto="tcp" src_ip="169.41.86.32" src_port="53"/>
      <filter dst_ip="209.209.213.22" dst_port="25" proto="udp" src_ip="169.41.86.32" src_port="53"/>
      <from sec="991804187" usec="0"/>
      <to sec="991804221" usec="0"/>
    </slice>
    <from sec="991804187" usec="0"/>
    <to sec="991804221" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="202.171.73.10" dst_port="80" proto="tcp" src_ip="143.50.249.32" src_port="53"/>
      <filter dst_ip="202.171.73.10" dst_port="80" proto="udp" src_ip="143.50.249.32" src_port="53"/>
      <filter dst_ip="202.171.73.10" dst_port="53" proto="tcp" src_ip="143.50.249.32" src_port="53"/>
      <filter dst_ip="202.171.73.10" dst_port="53" proto="udp" src_ip="143.50.249.32" src_port="53"/>
      <from sec="991803632" usec="0"/>
      <to sec="991803681" usec="0"/>
    </slice>
    <from sec="991803632" usec="0"/>
    <to sec="991803687" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="207.133.43.178" dst_port="80" proto="tcp" src_ip="208.147.179.74" src_port="53"/>
      <filter dst_ip="207.133.43.178" dst_port="80" proto="udp" src_ip="208.147.179.74" src_port="53"/>
      <filter dst_ip="207.133.43.178" dst_port="53" proto="tcp" src_ip="208.147.179.74" src_port="53"/>
      <filter dst_ip="207.133.43.178" dst_port="53" proto="udp" src_ip="208.147.179.74" src_port="53"/>
      <filter dst_ip="207.133.43.178" dst_port="80" proto="tcp" src_ip="208.147.179.74" src_port="80"/>
      <filter dst_ip="207.133.43.178" dst_port="80" proto="udp" src_ip="208.147.179.74" src_port="80"/>
      <filter dst_ip="207.133.43.178" dst_port="53" proto="tcp" src_ip="208.147.179.74" src_port="80"/>
      <filter dst_ip="207.133.43.178" dst_port="53" proto="udp" src_ip="208.147.179.74" src_port="80"/>
      <filter dst_ip="207.133.43.178" dst_port="80" proto="tcp" src_ip="208.147.179.74" src_port="6346"/>
      <filter dst_ip="207.133.43.178" dst_port="80" proto="udp" src_ip="208.147.179.74" src_port="6346"/>
      <filter dst_ip="207.133.43.178" dst_port="53" proto="tcp" src_ip="208.147.179.74" src_port="6346"/>
      <filter dst_ip="207.133.43.178" dst_port="53" proto="udp" src_ip="208.147.179.74" src_port="6346"/>
      <from sec="991803794" usec="0"/>
      <to sec="991803809" usec="0"/>
    </slice>
    <from sec="991803775" usec="0"/>
    <to sec="991803809" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="195.254.175.192" dst_port="80" proto="tcp" src_ip="208.147.112.103" src_port="53"/>
      <filter dst_ip="195.254.175.192" dst_port="80" proto="udp" src_ip="208.147.112.103" src_port="53"/>
      <filter dst_ip="195.254.175.192" dst_port="53" proto="tcp" src_ip="208.147.112.103" src_port="53"/>
      <filter dst_ip="195.254.175.192" dst_port="53" proto="udp" src_ip="208.147.112.103" src_port="53"/>
      <filter dst_ip="209.209.213.22" dst_port="80" proto="tcp" src_ip="208.147.112.103" src_port="53"/>
      <filter dst_ip="209.209.213.22" dst_port="80" proto="udp" src_ip="208.147.112.103" src_port="53"/>
      <filter dst_ip="209.209.213.22" dst_port="53" proto="tcp" src_ip="208.147.112.103" src_port="53"/>
      <filter dst_ip="209.209.213.22" dst_port="53" proto="udp" src_ip="208.147.112.103" src_port="53"/>
      <from sec="991803715" usec="0"/>
      <to sec="991803842" usec="0"/>
    </slice>
    <from sec="991803715" usec="0"/>
    <to sec="991803842" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,999,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="209.250.235.39" dst_port="1059" proto="tcp" src_ip="143.50.72.132" src_port="5"/>
      <filter dst_ip="209.250.235.39" dst_port="1059" proto="udp" src_ip="143.50.72.132" src_port="5"/>
      <filter dst_ip="209.250.235.39" dst_port="80" proto="tcp" src_ip="143.50.72.132" src_port="5"/>
      <filter dst_ip="209.250.235.39" dst_port="80" proto="udp" src_ip="143.50.72.132" src_port="5"/>
      <filter dst_ip="209.250.235.39" dst_port="53" proto="tcp" src_ip="143.50.72.132" src_port="5"/>
      <filter dst_ip="209.250.235.39" dst_port="53" proto="udp" src_ip="143.50.72.132" src_port="5"/>
      <filter dst_ip="209.250.235.39" dst_port="1059" proto="tcp" src_ip="143.50.72.132" src_port="53"/>
      <filter dst_ip="209.250.235.39" dst_port="1059" proto="udp" src_ip="143.50.72.132" src_port="53"/>
      <filter dst_ip="209.250.235.39" dst_port="80" proto="tcp" src_ip="143.50.72.132" src_port="53"/>
      <filter dst_ip="209.250.235.39" dst_port="80" proto="udp" src_ip="143.50.72.132" src_port="53"/>
      <filter dst_ip="209.250.235.39" dst_port="53" proto="tcp" src_ip="143.50.72.132" src_port="53"/>
      <filter dst_ip="209.250.235.39" dst_port="53" proto="udp" src_ip="143.50.72.132" src_port="53"/>
      <from sec="991804161" usec="0"/>
      <to sec="991804221" usec="0"/>
    </slice>
    <from sec="991804161" usec="0"/>
    <to sec="991804221" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="207.86.26.33" dst_port="80" proto="tcp" src_ip="137.248.30.197" src_port="53"/>
      <filter dst_ip="207.86.26.33" dst_port="80" proto="udp" src_ip="137.248.30.197" src_port="53"/>
      <filter dst_ip="207.86.26.33" dst_port="53" proto="tcp" src_ip="137.248.30.197" src_port="53"/>
      <filter dst_ip="207.86.26.33" dst_port="53" proto="udp" src_ip="137.248.30.197" src_port="53"/>
      <filter dst_ip="204.197.230.38" dst_port="80" proto="tcp" src_ip="137.248.30.197" src_port="53"/>
      <filter dst_ip="204.197.230.38" dst_port="80" proto="udp" src_ip="137.248.30.197" src_port="53"/>
      <filter dst_ip="204.197.230.38" dst_port="53" proto="tcp" src_ip="137.248.30.197" src_port="53"/>
      <filter dst_ip="204.197.230.38" dst_port="53" proto="udp" src_ip="137.248.30.197" src_port="53"/>
      <from sec="991803632" usec="0"/>
      <to sec="991803743" usec="0"/>
    </slice>
    <from sec="991803632" usec="0"/>
    <to sec="991803743" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="17.196.234.33" dst_port="80" proto="tcp" src_ip="137.248.20.199" src_port="53"/>
      <filter dst_ip="17.196.234.33" dst_port="80" proto="udp" src_ip="137.248.20.199" src_port="53"/>
      <filter dst_ip="17.196.234.33" dst_port="53" proto="tcp" src_ip="137.248.20.199" src_port="53"/>
      <filter dst_ip="17.196.234.33" dst_port="53" proto="udp" src_ip="137.248.20.199" src_port="53"/>
      <from sec="991803638" usec="0"/>
      <to sec="991803647" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="17.196.234.33" dst_port="80" proto="tcp" src_ip="137.248.36.149" src_port="53"/>
      <filter dst_ip="17.196.234.33" dst_port="80" proto="udp" src_ip="137.248.36.149" src_port="53"/>
      <filter dst_ip="17.196.234.33" dst_port="53" proto="tcp" src_ip="137.248.36.149" src_port="53"/>
      <filter dst_ip="17.196.234.33" dst_port="53" proto="udp" src_ip="137.248.36.149" src_port="53"/>
      <from sec="991803632" usec="0"/>
      <to sec="991803658" usec="0"/>
    </slice>
    <from sec="991803628" usec="0"/>
    <to sec="991803658" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="209.209.213.22" dst_port="25" proto="tcp" src_ip="169.41.183.211" src_port="53"/>
      <filter dst_ip="209.209.213.22" dst_port="25" proto="udp" src_ip="169.41.183.211" src_port="53"/>
      <filter dst_ip="209.209.213.22" dst_port="53" proto="tcp" src_ip="169.41.183.211" src_port="53"/>
      <filter dst_ip="209.209.213.22" dst_port="53" proto="udp" src_ip="169.41.183.211" src_port="53"/>
      <from sec="991803841" usec="0"/>
      <to sec="991803944" usec="0"/>
    </slice>
    <from sec="991803841" usec="0"/>
    <to sec="991803944" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <from sec="991803601" usec="0"/>
      <to sec="991803747" usec="0"/>
    </slice>
    <from sec="991803601" usec="0"/>
    <to sec="991803748" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="91.59.22.143" dst_port="80" proto="tcp" src_ip="143.50.32.242" src_port="80"/>
      <filter dst_ip="137.248.36.149" dst_port="80" proto="tcp" src_ip="143.50.32.242" src_port="80"/>
      <from sec="991803841" usec="0"/>
      <to sec="991804006" usec="0"/>
    </slice>
    <from sec="991803841" usec="0"/>
    <to sec="991804012" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="137.248.52.5" dst_port="80" proto="tcp" src_port="80"/>
      <filter dst_ip="137.248.52.5" dst_port="80" proto="udp" src_port="80"/>
      <filter dst_ip="137.248.52.5" dst_port="80" proto="tcp" src_port="80"/>
      <filter dst_ip="137.248.52.5" dst_port="80" proto="udp" src_port="80"/>
      <filter dst_ip="137.248.52.5" dst_port="80" proto="tcp" src_port="80"/>
      <filter dst_ip="137.248.52.5" dst_port="80" proto="udp" src_port="80"/>
      <filter dst_ip="137.248.52.5" dst_port="80" proto="tcp" src_port="80"/>
      <filter dst_ip="137.248.52.5" dst_port="80" proto="udp" src_port="80"/>
      <filter dst_ip="137.248.52.5" dst_port="25" proto="tcp" src_port="80"/>
      <filter dst_ip="137.248.52.5" dst_port="25" proto="udp" src_port="80"/>
      <filter dst_ip="137.248.52.5" dst_port="25" proto="tcp" src_port="80"/>
      <filter dst_ip="137.248.52.5" dst_port="25" proto="udp" src_port="80"/>
      <filter dst_ip="137.248.52.5" dst_port="25" proto="tcp" src_port="80"/>
      <filter dst_ip="137.248.52.5" dst_port="25" proto="udp" src_port="80"/>
      <filter dst_ip="137.248.52.5" dst_port="25" proto="tcp" src_port="80"/>
      <filter dst_ip="137.248.52.5" dst_port="25" proto="udp" src_port="80"/>
      <filter dst_ip="137.248.52.5" dst_port="53" proto="tcp" src_port="80"/>
      <filter dst_ip="137.248.52.5" dst_port="53" proto="udp" src_port="80"/>
      <filter dst_ip="137.248.52.5" dst_port="53" proto="tcp" src_port="80"/>
      <filter dst_ip="137.248.52.5" dst_port="53" proto="udp" src_port="80"/>
      <filter dst_ip="137.248.52.5" dst_port="53" proto="tcp" src_port="80"/>
      <filter dst_ip="137.248.52.5" dst_port="53" proto="udp" src_port="80"/>
      <filter dst_ip="137.248.52.5" dst_port="53" proto="tcp" src_port="80"/>
      <filter dst_ip="137.248.52.5" dst_port="53" proto="udp" src_port="80"/>
      <filter dst_ip="137.248.52.5" dst_port="80" proto="tcp" src_port="53"/>
      <filter dst_ip="137.248.52.5" dst_port="80" proto="udp" src_port="53"/>
      <filter dst_ip="137.248.52.5" dst_port="80" proto="tcp" src_port="53"/>
      <filter dst_ip="137.248.52.5" dst_port="80" proto="udp" src_port="53"/>
      <filter dst_ip="137.248.52.5" dst_port="80" proto="tcp" src_port="53"/>
      <filter dst_ip="137.248.52.5" dst_port="80" proto="udp" src_port="53"/>
      <filter dst_ip="137.248.52.5" dst_port="80" proto="tcp" src_port="53"/>
      <filter dst_ip="137.248.52.5" dst_port="80" proto="udp" src_port="53"/>
      <filter dst_ip="137.248.52.5" dst_port="25" proto="tcp" src_port="53"/>
      <filter dst_ip="137.248.52.5" dst_port="25" proto="udp" src_port="53"/>
      <filter dst_ip="137.248.52.5" dst_port="25" proto="tcp" src_port="53"/>
      <filter dst_ip="137.248.52.5" dst_port="25" proto="udp" src_port="53"/>
      <filter dst_ip="137.248.52.5" dst_port="25" proto="tcp" src_port="53"/>
      <filter dst_ip="137.248.52.5" dst_port="25" proto="udp" src_port="53"/>
      <filter dst_ip="137.248.52.5" dst_port="25" proto="tcp" src_port="53"/>
      <filter dst_ip="137.248.52.5" dst_port="25" proto="udp" src_port="53"/>
      <filter dst_ip="137.248.52.5" dst_port="53" proto="tcp" src_port="53"/>
      <filter dst_ip="137.248.52.5" dst_port="53" proto="udp" src_port="53"/>
      <filter dst_ip="137.248.52.5" dst_port="53" proto="tcp" src_port="53"/>
      <filter dst_ip="137.248.52.5" dst_port="53" proto="udp" src_port="53"/>
      <filter dst_ip="137.248.52.5" dst_port="53" proto="tcp" src_port="53"/>
      <filter dst_ip="137.248.52.5" dst_port="53" proto="udp" src_port="53"/>
      <filter dst_ip="137.248.52.5" dst_port="53" proto="tcp" src_port="53"/>
      <filter dst_ip="137.248.52.5" dst_port="53" proto="udp" src_port="53"/>
      <from sec="991803756" usec="0"/>
      <to sec="991803775" usec="0"/>
    </slice>
    <from sec="991803742" usec="0"/>
    <to sec="991803776" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="137.248.187.23" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="80" proto="tcp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="80" proto="udp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="80" proto="tcp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="80" proto="udp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="80" proto="tcp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="80" proto="udp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="80" proto="tcp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="80" proto="udp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="53" proto="tcp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="53" proto="udp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="53" proto="tcp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="53" proto="udp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="53" proto="tcp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="53" proto="udp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="53" proto="tcp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="53" proto="udp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="25" proto="tcp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="25" proto="udp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="25" proto="tcp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="25" proto="udp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="25" proto="tcp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="25" proto="udp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="25" proto="tcp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="25" proto="udp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="80" proto="tcp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="80" proto="udp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="80" proto="tcp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="80" proto="udp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="80" proto="tcp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="80" proto="udp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="80" proto="tcp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="80" proto="udp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="53" proto="tcp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="53" proto="udp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="53" proto="tcp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="53" proto="udp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="53" proto="tcp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="53" proto="udp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="53" proto="tcp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="53" proto="udp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="25" proto="tcp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="25" proto="udp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="25" proto="tcp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="25" proto="udp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="25" proto="tcp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="25" proto="udp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="25" proto="tcp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="137.248.187.23" dst_port="25" proto="udp" src_ip="137.248.50.206" src_port="80"/>
      <from sec="991803709" usec="0"/>
      <to sec="991803715" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="214.199.200.128" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="80" proto="tcp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="80" proto="udp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="80" proto="tcp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="80" proto="udp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="80" proto="tcp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="80" proto="udp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="80" proto="tcp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="80" proto="udp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="53" proto="tcp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="53" proto="udp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="53" proto="tcp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="53" proto="udp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="53" proto="tcp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="53" proto="udp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="53" proto="tcp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="53" proto="udp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="25" proto="tcp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="25" proto="udp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="25" proto="tcp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="25" proto="udp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="25" proto="tcp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="25" proto="udp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="25" proto="tcp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="25" proto="udp" src_ip="195.80.89.233" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="80" proto="tcp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="80" proto="udp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="80" proto="tcp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="80" proto="udp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="80" proto="tcp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="80" proto="udp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="80" proto="tcp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="80" proto="udp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="53" proto="tcp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="53" proto="udp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="53" proto="tcp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="53" proto="udp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="53" proto="tcp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="53" proto="udp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="53" proto="tcp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="53" proto="udp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="25" proto="tcp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="25" proto="udp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="25" proto="tcp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="25" proto="udp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="25" proto="tcp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="25" proto="udp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="25" proto="tcp" src_ip="137.248.50.206" src_port="80"/>
      <filter dst_ip="214.199.200.128" dst_port="25" proto="udp" src_ip="137.248.50.206" src_port="80"/>
      <from sec="991803687" usec="0"/>
      <to sec="991803699" usec="0"/>
    </slice>
    <from sec="991803686" usec="0"/>
    <to sec="991803716" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="137.248.162.36" dst_port="30" proto="tcp" src_port="53"/>
      <filter dst_ip="137.248.162.36" dst_port="30" proto="udp" src_port="53"/>
      <filter dst_ip="137.248.162.36" dst_port="30" proto="tcp" src_port="53"/>
      <filter dst_ip="137.248.162.36" dst_port="30" proto="udp" src_port="53"/>
      <filter dst_ip="137.248.162.36" dst_port="30" proto="tcp" src_port="53"/>
      <filter dst_ip="137.248.162.36" dst_port="30" proto="udp" src_port="53"/>
      <filter dst_ip="137.248.162.36" dst_port="30" proto="tcp" src_port="53"/>
      <filter dst_ip="137.248.162.36" dst_port="30" proto="udp" src_port="53"/>
      <filter dst_ip="137.248.162.36" dst_port="80" proto="tcp" src_port="53"/>
      <filter dst_ip="137.248.162.36" dst_port="80" proto="udp" src_port="53"/>
      <filter dst_ip="137.248.162.36" dst_port="80" proto="tcp" src_port="53"/>
      <filter dst_ip="137.248.162.36" dst_port="80" proto="udp" src_port="53"/>
      <filter dst_ip="137.248.162.36" dst_port="80" proto="tcp" src_port="53"/>
      <filter dst_ip="137.248.162.36" dst_port="80" proto="udp" src_port="53"/>
      <filter dst_ip="137.248.162.36" dst_port="80" proto="tcp" src_port="53"/>
      <filter dst_ip="137.248.162.36" dst_port="80" proto="udp" src_port="53"/>
      <filter dst_ip="137.248.162.36" dst_port="53" proto="tcp" src_port="53"/>
      <filter dst_ip="137.248.162.36" dst_port="53" proto="udp" src_port="53"/>
      <filter dst_ip="137.248.162.36" dst_port="53" proto="tcp" src_port="53"/>
      <filter dst_ip="137.248.162.36" dst_port="53" proto="udp" src_port="53"/>
      <filter dst_ip="137.248.162.36" dst_port="53" proto="tcp" src_port="53"/>
      <filter dst_ip="137.248.162.36" dst_port="53" proto="udp" src_port="53"/>
      <filter dst_ip="137.248.162.36" dst_port="53" proto="tcp" src_port="53"/>
      <filter dst_ip="137.248.162.36" dst_port="53" proto="udp" src_port="53"/>
      <from sec="991803600" usec="0"/>
      <to sec="991803979" usec="0"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991803979" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="175.221.31.44" dst_port="53" proto="tcp" src_ip="175.221.31.44" src_port="53"/>
      <filter dst_ip="175.221.31.44" dst_port="53" proto="udp" src_ip="175.221.31.44" src_port="53"/>
      <filter dst_ip="175.221.31.44" dst_port="53" proto="tcp" src_ip="175.221.31.44" src_port="53"/>
      <filter dst_ip="175.221.31.44" dst_port="53" proto="udp" src_ip="175.221.31.44" src_port="53"/>
      <filter dst_ip="175.221.31.44" dst_port="53" proto="tcp" src_ip="175.221.31.44" src_port="53"/>
      <filter dst_ip="175.221.31.44" dst_port="53" proto="udp" src_ip="175.221.31.44" src_port="53"/>
      <filter dst_ip="175.221.31.44" dst_port="53" proto="tcp" src_ip="175.221.31.44" src_port="53"/>
      <filter dst_ip="175.221.31.44" dst_port="53" proto="udp" src_ip="175.221.31.44" src_port="53"/>
      <filter dst_ip="175.221.31.44" dst_port="25" proto="tcp" src_ip="175.221.31.44" src_port="53"/>
      <filter dst_ip="175.221.31.44" dst_port="25" proto="udp" src_ip="175.221.31.44" src_port="53"/>
      <filter dst_ip="175.221.31.44" dst_port="25" proto="tcp" src_ip="175.221.31.44" src_port="53"/>
      <filter dst_ip="175.221.31.44" dst_port="25" proto="udp" src_ip="175.221.31.44" src_port="53"/>
      <filter dst_ip="175.221.31.44" dst_port="25" proto="tcp" src_ip="175.221.31.44" src_port="53"/>
      <filter dst_ip="175.221.31.44" dst_port="25" proto="udp" src_ip="175.221.31.44" src_port="53"/>
      <filter dst_ip="175.221.31.44" dst_port="25" proto="tcp" src_ip="175.221.31.44" src_port="53"/>
      <filter dst_ip="175.221.31.44" dst_port="25" proto="udp" src_ip="175.221.31.44" src_port="53"/>
      <filter dst_ip="175.221.31.44" dst_port="80" proto="tcp" src_ip="175.221.31.44" src_port="53"/>
      <filter dst_ip="175.221.31.44" dst_port="80" proto="udp" src_ip="175.221.31.44" src_port="53"/>
      <filter dst_ip="175.221.31.44" dst_port="80" proto="tcp" src_ip="175.221.31.44" src_port="53"/>
      <filter dst_ip="175.221.31.44" dst_port="80" proto="udp" src_ip="175.221.31.44" src_port="53"/>
      <filter dst_ip="175.221.31.44" dst_port="80" proto="tcp" src_ip="175.221.31.44" src_port="53"/>
      <filter dst_ip="175.221.31.44" dst_port="80" proto="udp" src_ip="175.221.31.44" src_port="53"/>
      <filter dst_ip="175.221.31.44" dst_port="80" proto="tcp" src_ip="175.221.31.44" src_port="53"/>
      <filter dst_ip="175.221.31.44" dst_port="80" proto="udp" src_ip="175.221.31.44" src_port="53"/>
      <from sec="991803715" usec="0"/>
      <to sec="991803776" usec="0"/>
    </slice>
    <from sec="991803715" usec="0"/>
    <to sec="991803776" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="175.221.171.87" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="1034" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="1034" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="1034" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="1034" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="1034" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="1034" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="1034" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="1034" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="53" proto="tcp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="53" proto="udp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="53" proto="tcp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="53" proto="udp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="53" proto="tcp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="53" proto="udp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="53" proto="tcp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="53" proto="udp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="1034" proto="tcp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="1034" proto="udp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="1034" proto="tcp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="1034" proto="udp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="1034" proto="tcp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="1034" proto="udp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="1034" proto="tcp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="1034" proto="udp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="80" proto="tcp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="80" proto="udp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="80" proto="tcp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="80" proto="udp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="80" proto="tcp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="80" proto="udp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="80" proto="tcp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="80" proto="udp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="25" proto="tcp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="25" proto="udp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="25" proto="tcp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="25" proto="udp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="25" proto="tcp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="25" proto="udp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="25" proto="tcp" src_ip="175.221.171.87" src_port="53"/>
      <filter dst_ip="175.221.171.87" dst_port="25" proto="udp" src_ip="175.221.171.87" src_port="53"/>
      <from sec="991803628" usec="0"/>
      <to sec="991803687" usec="0"/>
    </slice>
    <from sec="991803628" usec="0"/>
    <to sec="991803687" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="tcp" src_ip="208.32.51.85" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="udp" src_ip="208.32.51.85" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="tcp" src_ip="208.32.51.85" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="udp" src_ip="208.32.51.85" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="tcp" src_ip="208.32.51.85" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="udp" src_ip="208.32.51.85" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="tcp" src_ip="208.32.51.85" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="udp" src_ip="208.32.51.85" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="tcp" src_ip="208.32.51.85" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="udp" src_ip="208.32.51.85" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="tcp" src_ip="208.32.51.85" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="udp" src_ip="208.32.51.85" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="tcp" src_ip="208.32.51.85" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="udp" src_ip="208.32.51.85" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="tcp" src_ip="208.32.51.85" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="udp" src_ip="208.32.51.85" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="tcp" src_ip="208.32.51.85" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="udp" src_ip="208.32.51.85" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="tcp" src_ip="208.32.51.85" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="udp" src_ip="208.32.51.85" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="tcp" src_ip="208.32.51.85" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="udp" src_ip="208.32.51.85" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="tcp" src_ip="208.32.51.85" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="udp" src_ip="208.32.51.85" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="tcp" src_ip="208.32.51.85" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="udp" src_ip="208.32.51.85" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="tcp" src_ip="208.32.51.85" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="udp" src_ip="208.32.51.85" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="tcp" src_ip="208.32.51.85" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="udp" src_ip="208.32.51.85" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="tcp" src_ip="208.32.51.85" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="udp" src_ip="208.32.51.85" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="tcp" src_ip="208.32.51.85" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="udp" src_ip="208.32.51.85" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="tcp" src_ip="208.32.51.85" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="udp" src_ip="208.32.51.85" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="tcp" src_ip="208.32.51.85" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="udp" src_ip="208.32.51.85" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="tcp" src_ip="208.32.51.85" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="udp" src_ip="208.32.51.85" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="tcp" src_ip="208.32.51.85" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="udp" src_ip="208.32.51.85" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="tcp" src_ip="208.32.51.85" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="udp" src_ip="208.32.51.85" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="tcp" src_ip="208.32.51.85" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="udp" src_ip="208.32.51.85" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="tcp" src_ip="208.32.51.85" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="udp" src_ip="208.32.51.85" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="tcp" src_ip="50.129.22.163" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="udp" src_ip="50.129.22.163" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="tcp" src_ip="50.129.22.163" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="udp" src_ip="50.129.22.163" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="tcp" src_ip="50.129.22.163" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="udp" src_ip="50.129.22.163" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="tcp" src_ip="50.129.22.163" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="udp" src_ip="50.129.22.163" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="tcp" src_ip="50.129.22.163" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="udp" src_ip="50.129.22.163" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="tcp" src_ip="50.129.22.163" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="udp" src_ip="50.129.22.163" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="tcp" src_ip="50.129.22.163" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="udp" src_ip="50.129.22.163" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="tcp" src_ip="50.129.22.163" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="udp" src_ip="50.129.22.163" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="tcp" src_ip="50.129.22.163" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="udp" src_ip="50.129.22.163" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="tcp" src_ip="50.129.22.163" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="udp" src_ip="50.129.22.163" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="tcp" src_ip="50.129.22.163" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="udp" src_ip="50.129.22.163" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="tcp" src_ip="50.129.22.163" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="udp" src_ip="50.129.22.163" src_port="80"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="tcp" src_ip="50.129.22.163" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="udp" src_ip="50.129.22.163" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="tcp" src_ip="50.129.22.163" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="udp" src_ip="50.129.22.163" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="tcp" src_ip="50.129.22.163" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="udp" src_ip="50.129.22.163" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="tcp" src_ip="50.129.22.163" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="53" proto="udp" src_ip="50.129.22.163" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="tcp" src_ip="50.129.22.163" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="udp" src_ip="50.129.22.163" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="tcp" src_ip="50.129.22.163" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="udp" src_ip="50.129.22.163" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="tcp" src_ip="50.129.22.163" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="udp" src_ip="50.129.22.163" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="tcp" src_ip="50.129.22.163" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="21" proto="udp" src_ip="50.129.22.163" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="tcp" src_ip="50.129.22.163" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="udp" src_ip="50.129.22.163" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="tcp" src_ip="50.129.22.163" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="udp" src_ip="50.129.22.163" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="tcp" src_ip="50.129.22.163" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="udp" src_ip="50.129.22.163" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="tcp" src_ip="50.129.22.163" src_port="53"/>
      <filter dst_ip="208.147.113.91" dst_port="80" proto="udp" src_ip="50.129.22.163" src_port="53"/>
      <from sec="991804115" usec="0"/>
      <to sec="991804151" usec="0"/>
    </slice>
    <from sec="991804113" usec="0"/>
    <to sec="991804152" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="175.221.31.127" dst_port="80" proto="tcp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="80" proto="udp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="80" proto="tcp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="80" proto="udp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="80" proto="tcp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="80" proto="udp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="80" proto="tcp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="80" proto="udp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="53" proto="tcp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="53" proto="udp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="53" proto="tcp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="53" proto="udp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="53" proto="tcp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="53" proto="udp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="53" proto="tcp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="53" proto="udp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="81" proto="tcp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="81" proto="udp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="81" proto="tcp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="81" proto="udp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="81" proto="tcp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="81" proto="udp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="81" proto="tcp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="81" proto="udp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="80" proto="tcp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="80" proto="udp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="80" proto="tcp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="80" proto="udp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="80" proto="tcp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="80" proto="udp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="80" proto="tcp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="80" proto="udp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="53" proto="tcp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="53" proto="udp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="53" proto="tcp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="53" proto="udp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="53" proto="tcp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="53" proto="udp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="53" proto="tcp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="53" proto="udp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="81" proto="tcp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="81" proto="udp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="81" proto="tcp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="81" proto="udp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="81" proto="tcp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="81" proto="udp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="81" proto="tcp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="175.221.31.127" dst_port="81" proto="udp" src_ip="137.248.227.229" src_port="80"/>
      <from sec="991803629" usec="0"/>
      <to sec="991804152" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="48.26.39.150" dst_port="80" proto="tcp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="80" proto="udp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="80" proto="tcp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="80" proto="udp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="80" proto="tcp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="80" proto="udp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="80" proto="tcp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="80" proto="udp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="53" proto="tcp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="53" proto="udp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="53" proto="tcp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="53" proto="udp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="53" proto="tcp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="53" proto="udp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="53" proto="tcp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="53" proto="udp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="81" proto="tcp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="81" proto="udp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="81" proto="tcp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="81" proto="udp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="81" proto="tcp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="81" proto="udp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="81" proto="tcp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="81" proto="udp" src_ip="214.69.76.242" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="80" proto="tcp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="80" proto="udp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="80" proto="tcp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="80" proto="udp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="80" proto="tcp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="80" proto="udp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="80" proto="tcp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="80" proto="udp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="53" proto="tcp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="53" proto="udp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="53" proto="tcp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="53" proto="udp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="53" proto="tcp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="53" proto="udp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="53" proto="tcp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="53" proto="udp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="81" proto="tcp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="81" proto="udp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="81" proto="tcp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="81" proto="udp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="81" proto="tcp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="81" proto="udp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="81" proto="tcp" src_ip="137.248.227.229" src_port="80"/>
      <filter dst_ip="48.26.39.150" dst_port="81" proto="udp" src_ip="137.248.227.229" src_port="80"/>
      <from sec="991803629" usec="0"/>
      <to sec="991804152" usec="0"/>
    </slice>
    <from sec="991803629" usec="0"/>
    <to sec="991804152" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="137.248.36.149" dst_port="80" proto="tcp" src_ip="137.248.36.149" src_port="80"/>
      <filter dst_ip="137.248.36.149" dst_port="80" proto="udp" src_ip="137.248.36.149" src_port="80"/>
      <filter dst_ip="137.248.36.149" dst_port="80" proto="tcp" src_ip="137.248.36.149" src_port="80"/>
      <filter dst_ip="137.248.36.149" dst_port="80" proto="udp" src_ip="137.248.36.149" src_port="80"/>
      <filter dst_ip="137.248.36.149" dst_port="80" proto="tcp" src_ip="137.248.36.149" src_port="80"/>
      <filter dst_ip="137.248.36.149" dst_port="80" proto="udp" src_ip="137.248.36.149" src_port="80"/>
      <filter dst_ip="137.248.36.149" dst_port="80" proto="tcp" src_ip="137.248.36.149" src_port="80"/>
      <filter dst_ip="137.248.36.149" dst_port="80" proto="udp" src_ip="137.248.36.149" src_port="80"/>
      <filter dst_ip="137.248.36.149" dst_port="53" proto="tcp" src_ip="137.248.36.149" src_port="80"/>
      <filter dst_ip="137.248.36.149" dst_port="53" proto="udp" src_ip="137.248.36.149" src_port="80"/>
      <filter dst_ip="137.248.36.149" dst_port="53" proto="tcp" src_ip="137.248.36.149" src_port="80"/>
      <filter dst_ip="137.248.36.149" dst_port="53" proto="udp" src_ip="137.248.36.149" src_port="80"/>
      <filter dst_ip="137.248.36.149" dst_port="53" proto="tcp" src_ip="137.248.36.149" src_port="80"/>
      <filter dst_ip="137.248.36.149" dst_port="53" proto="udp" src_ip="137.248.36.149" src_port="80"/>
      <filter dst_ip="137.248.36.149" dst_port="53" proto="tcp" src_ip="137.248.36.149" src_port="80"/>
      <filter dst_ip="137.248.36.149" dst_port="53" proto="udp" src_ip="137.248.36.149" src_port="80"/>
      <from sec="991803695" usec="0"/>
      <to sec="991803775" usec="0"/>
    </slice>
    <from sec="991803691" usec="0"/>
    <to sec="991803776" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="91.177.73.158" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="53" proto="tcp" src_ip="208.112.62.65" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="53" proto="udp" src_ip="208.112.62.65" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="53" proto="tcp" src_ip="208.112.62.65" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="53" proto="udp" src_ip="208.112.62.65" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="53" proto="tcp" src_ip="208.112.62.65" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="53" proto="udp" src_ip="208.112.62.65" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="53" proto="tcp" src_ip="208.112.62.65" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="53" proto="udp" src_ip="208.112.62.65" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="80" proto="tcp" src_ip="208.112.62.65" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="80" proto="udp" src_ip="208.112.62.65" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="80" proto="tcp" src_ip="208.112.62.65" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="80" proto="udp" src_ip="208.112.62.65" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="80" proto="tcp" src_ip="208.112.62.65" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="80" proto="udp" src_ip="208.112.62.65" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="80" proto="tcp" src_ip="208.112.62.65" src_port="53"/>
      <filter dst_ip="91.177.73.158" dst_port="80" proto="udp" src_ip="208.112.62.65" src_port="53"/>
      <from sec="991803657" usec="0"/>
      <to sec="991803680" usec="0"/>
    </slice>
    <from sec="991803657" usec="0"/>
    <to sec="991803687" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="137.248.192.160" dst_port="53" proto="tcp" src_ip="212.196.250.165" src_port="80"/>
      <filter dst_ip="137.248.192.160" dst_port="53" proto="udp" src_ip="212.196.250.165" src_port="80"/>
      <filter dst_ip="137.248.192.160" dst_port="53" proto="tcp" src_ip="212.196.250.165" src_port="80"/>
      <filter dst_ip="137.248.192.160" dst_port="53" proto="udp" src_ip="212.196.250.165" src_port="80"/>
      <filter dst_ip="137.248.192.160" dst_port="53" proto="tcp" src_ip="212.196.250.165" src_port="80"/>
      <filter dst_ip="137.248.192.160" dst_port="53" proto="udp" src_ip="212.196.250.165" src_port="80"/>
      <filter dst_ip="137.248.192.160" dst_port="53" proto="tcp" src_ip="212.196.250.165" src_port="80"/>
      <filter dst_ip="137.248.192.160" dst_port="53" proto="udp" src_ip="212.196.250.165" src_port="80"/>
      <filter dst_ip="137.248.192.160" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.192.160" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.192.160" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.192.160" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.192.160" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.192.160" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.192.160" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.192.160" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <from sec="991803715" usec="0"/>
      <to sec="991803743" usec="0"/>
    </slice>
    <from sec="991803715" usec="0"/>
    <to sec="991803743" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="137.248.44.184" dst_port="80" proto="tcp" src_ip="214.199.146.182" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="80" proto="udp" src_ip="214.199.146.182" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="80" proto="tcp" src_ip="214.199.146.182" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="80" proto="udp" src_ip="214.199.146.182" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="80" proto="tcp" src_ip="214.199.146.182" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="80" proto="udp" src_ip="214.199.146.182" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="80" proto="tcp" src_ip="214.199.146.182" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="80" proto="udp" src_ip="214.199.146.182" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="53" proto="tcp" src_ip="214.199.146.182" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="53" proto="udp" src_ip="214.199.146.182" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="53" proto="tcp" src_ip="214.199.146.182" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="53" proto="udp" src_ip="214.199.146.182" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="53" proto="tcp" src_ip="214.199.146.182" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="53" proto="udp" src_ip="214.199.146.182" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="53" proto="tcp" src_ip="214.199.146.182" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="53" proto="udp" src_ip="214.199.146.182" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="80" proto="tcp" src_ip="151.144.185.122" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="80" proto="udp" src_ip="151.144.185.122" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="80" proto="tcp" src_ip="151.144.185.122" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="80" proto="udp" src_ip="151.144.185.122" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="80" proto="tcp" src_ip="151.144.185.122" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="80" proto="udp" src_ip="151.144.185.122" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="80" proto="tcp" src_ip="151.144.185.122" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="80" proto="udp" src_ip="151.144.185.122" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="53" proto="tcp" src_ip="151.144.185.122" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="53" proto="udp" src_ip="151.144.185.122" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="53" proto="tcp" src_ip="151.144.185.122" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="53" proto="udp" src_ip="151.144.185.122" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="53" proto="tcp" src_ip="151.144.185.122" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="53" proto="udp" src_ip="151.144.185.122" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="53" proto="tcp" src_ip="151.144.185.122" src_port="80"/>
      <filter dst_ip="137.248.44.184" dst_port="53" proto="udp" src_ip="151.144.185.122" src_port="80"/>
      <from sec="991803725" usec="0"/>
      <to sec="991803743" usec="0"/>
    </slice>
    <from sec="991803715" usec="0"/>
    <to sec="991803743" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="tcp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="udp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="tcp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="udp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="tcp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="udp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="tcp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="udp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="tcp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="udp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="tcp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="udp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="tcp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="udp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="tcp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="udp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="tcp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="udp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="tcp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="udp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="tcp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="udp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="tcp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="53" proto="udp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="tcp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="udp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="tcp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="udp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="tcp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="udp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="tcp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.30.197" dst_port="25" proto="udp" src_ip="219.203.231.32" src_port="443"/>
      <from sec="991803665" usec="0"/>
      <to sec="991803671" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="tcp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="udp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="tcp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="udp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="tcp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="udp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="tcp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="udp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="tcp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="udp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="tcp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="udp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="tcp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="udp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="tcp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="udp" src_ip="219.203.231.32" src_port="80"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="tcp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="udp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="tcp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="udp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="tcp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="udp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="tcp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="53" proto="udp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="tcp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="udp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="tcp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="udp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="tcp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="udp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="tcp" src_ip="219.203.231.32" src_port="443"/>
      <filter dst_ip="137.248.66.66" dst_port="25" proto="udp" src_ip="219.203.231.32" src_port="443"/>
      <from sec="991803663" usec="0"/>
      <to sec="991803677" usec="0"/>
    </slice>
    <from sec="991803657" usec="0"/>
    <to sec="991803687" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="137.248.227.229" dst_port="80" proto="tcp" src_ip="48.26.39.150" src_port="81"/>
      <filter dst_ip="137.248.227.229" dst_port="80" proto="udp" src_ip="48.26.39.150" src_port="81"/>
      <filter dst_ip="137.248.227.229" dst_port="80" proto="tcp" src_ip="48.26.39.150" src_port="81"/>
      <filter dst_ip="137.248.227.229" dst_port="80" proto="udp" src_ip="48.26.39.150" src_port="81"/>
      <filter dst_ip="137.248.227.229" dst_port="80" proto="tcp" src_ip="48.26.39.150" src_port="81"/>
      <filter dst_ip="137.248.227.229" dst_port="80" proto="udp" src_ip="48.26.39.150" src_port="81"/>
      <filter dst_ip="137.248.227.229" dst_port="80" proto="tcp" src_ip="48.26.39.150" src_port="81"/>
      <filter dst_ip="137.248.227.229" dst_port="80" proto="udp" src_ip="48.26.39.150" src_port="81"/>
      <filter dst_ip="137.248.227.229" dst_port="53" proto="tcp" src_ip="48.26.39.150" src_port="81"/>
      <filter dst_ip="137.248.227.229" dst_port="53" proto="udp" src_ip="48.26.39.150" src_port="81"/>
      <filter dst_ip="137.248.227.229" dst_port="53" proto="tcp" src_ip="48.26.39.150" src_port="81"/>
      <filter dst_ip="137.248.227.229" dst_port="53" proto="udp" src_ip="48.26.39.150" src_port="81"/>
      <filter dst_ip="137.248.227.229" dst_port="53" proto="tcp" src_ip="48.26.39.150" src_port="81"/>
      <filter dst_ip="137.248.227.229" dst_port="53" proto="udp" src_ip="48.26.39.150" src_port="81"/>
      <filter dst_ip="137.248.227.229" dst_port="53" proto="tcp" src_ip="48.26.39.150" src_port="81"/>
      <filter dst_ip="137.248.227.229" dst_port="53" proto="udp" src_ip="48.26.39.150" src_port="81"/>
      <filter dst_ip="137.248.227.229" dst_port="25" proto="tcp" src_ip="48.26.39.150" src_port="81"/>
      <filter dst_ip="137.248.227.229" dst_port="25" proto="udp" src_ip="48.26.39.150" src_port="81"/>
      <filter dst_ip="137.248.227.229" dst_port="25" proto="tcp" src_ip="48.26.39.150" src_port="81"/>
      <filter dst_ip="137.248.227.229" dst_port="25" proto="udp" src_ip="48.26.39.150" src_port="81"/>
      <filter dst_ip="137.248.227.229" dst_port="25" proto="tcp" src_ip="48.26.39.150" src_port="81"/>
      <filter dst_ip="137.248.227.229" dst_port="25" proto="udp" src_ip="48.26.39.150" src_port="81"/>
      <filter dst_ip="137.248.227.229" dst_port="25" proto="tcp" src_ip="48.26.39.150" src_port="81"/>
      <filter dst_ip="137.248.227.229" dst_port="25" proto="udp" src_ip="48.26.39.150" src_port="81"/>
      <filter dst_ip="137.248.227.229" dst_port="80" proto="tcp" src_ip="48.26.39.150" src_port="80"/>
      <filter dst_ip="137.248.227.229" dst_port="80" proto="udp" src_ip="48.26.39.150" src_port="80"/>
      <filter dst_ip="137.248.227.229" dst_port="80" proto="tcp" src_ip="48.26.39.150" src_port="80"/>
      <filter dst_ip="137.248.227.229" dst_port="80" proto="udp" src_ip="48.26.39.150" src_port="80"/>
      <filter dst_ip="137.248.227.229" dst_port="80" proto="tcp" src_ip="48.26.39.150" src_port="80"/>
      <filter dst_ip="137.248.227.229" dst_port="80" proto="udp" src_ip="48.26.39.150" src_port="80"/>
      <filter dst_ip="137.248.227.229" dst_port="80" proto="tcp" src_ip="48.26.39.150" src_port="80"/>
      <filter dst_ip="137.248.227.229" dst_port="80" proto="udp" src_ip="48.26.39.150" src_port="80"/>
      <filter dst_ip="137.248.227.229" dst_port="53" proto="tcp" src_ip="48.26.39.150" src_port="80"/>
      <filter dst_ip="137.248.227.229" dst_port="53" proto="udp" src_ip="48.26.39.150" src_port="80"/>
      <filter dst_ip="137.248.227.229" dst_port="53" proto="tcp" src_ip="48.26.39.150" src_port="80"/>
      <filter dst_ip="137.248.227.229" dst_port="53" proto="udp" src_ip="48.26.39.150" src_port="80"/>
      <filter dst_ip="137.248.227.229" dst_port="53" proto="tcp" src_ip="48.26.39.150" src_port="80"/>
      <filter dst_ip="137.248.227.229" dst_port="53" proto="udp" src_ip="48.26.39.150" src_port="80"/>
      <filter dst_ip="137.248.227.229" dst_port="53" proto="tcp" src_ip="48.26.39.150" src_port="80"/>
      <filter dst_ip="137.248.227.229" dst_port="53" proto="udp" src_ip="48.26.39.150" src_port="80"/>
      <filter dst_ip="137.248.227.229" dst_port="25" proto="tcp" src_ip="48.26.39.150" src_port="80"/>
      <filter dst_ip="137.248.227.229" dst_port="25" proto="udp" src_ip="48.26.39.150" src_port="80"/>
      <filter dst_ip="137.248.227.229" dst_port="25" proto="tcp" src_ip="48.26.39.150" src_port="80"/>
      <filter dst_ip="137.248.227.229" dst_port="25" proto="udp" src_ip="48.26.39.150" src_port="80"/>
      <filter dst_ip="137.248.227.229" dst_port="25" proto="tcp" src_ip="48.26.39.150" src_port="80"/>
      <filter dst_ip="137.248.227.229" dst_port="25" proto="udp" src_ip="48.26.39.150" src_port="80"/>
      <filter dst_ip="137.248.227.229" dst_port="25" proto="tcp" src_ip="48.26.39.150" src_port="80"/>
      <filter dst_ip="137.248.227.229" dst_port="25" proto="udp" src_ip="48.26.39.150" src_port="80"/>
      <from sec="991803659" usec="0"/>
      <to sec="991803686" usec="0"/>
    </slice>
    <from sec="991803657" usec="0"/>
    <to sec="991803687" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="208.147.96.246" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.96.246" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.96.246" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.96.246" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.96.246" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.96.246" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.96.246" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.96.246" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.96.246" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.96.246" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.96.246" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.96.246" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.96.246" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.96.246" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.96.246" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.96.246" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.96.246" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.96.246" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.96.246" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.96.246" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.96.246" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.96.246" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.96.246" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.96.246" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.96.246" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.96.246" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.96.246" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.96.246" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.96.246" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.96.246" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.96.246" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.96.246" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <from sec="991803628" usec="0"/>
      <to sec="991803654" usec="0"/>
    </slice>
    <from sec="991803628" usec="0"/>
    <to sec="991803658" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="4.117.226.10" dst_port="80" proto="tcp" src_ip="143.50.247.5" src_port="53"/>
      <filter dst_ip="4.117.226.10" dst_port="80" proto="udp" src_ip="143.50.247.5" src_port="53"/>
      <filter dst_ip="4.117.226.10" dst_port="53" proto="tcp" src_ip="143.50.247.5" src_port="53"/>
      <filter dst_ip="4.117.226.10" dst_port="53" proto="udp" src_ip="143.50.247.5" src_port="53"/>
      <filter dst_ip="4.117.226.10" dst_port="25" proto="tcp" src_ip="143.50.247.5" src_port="53"/>
      <filter dst_ip="4.117.226.10" dst_port="25" proto="udp" src_ip="143.50.247.5" src_port="53"/>
      <filter dst_ip="175.221.65.239" dst_port="80" proto="tcp" src_ip="143.50.247.5" src_port="53"/>
      <filter dst_ip="175.221.65.239" dst_port="80" proto="udp" src_ip="143.50.247.5" src_port="53"/>
      <filter dst_ip="175.221.65.239" dst_port="53" proto="tcp" src_ip="143.50.247.5" src_port="53"/>
      <filter dst_ip="175.221.65.239" dst_port="53" proto="udp" src_ip="143.50.247.5" src_port="53"/>
      <filter dst_ip="175.221.65.239" dst_port="25" proto="tcp" src_ip="143.50.247.5" src_port="53"/>
      <filter dst_ip="175.221.65.239" dst_port="25" proto="udp" src_ip="143.50.247.5" src_port="53"/>
      <from sec="991803629" usec="0"/>
      <to sec="991803658" usec="0"/>
    </slice>
    <from sec="991803628" usec="0"/>
    <to sec="991803658" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="195.177.62.29" dst_port="80" proto="tcp" src_ip="209.209.205.13" src_port="53"/>
      <filter dst_ip="195.177.62.29" dst_port="80" proto="udp" src_ip="209.209.205.13" src_port="53"/>
      <filter dst_ip="195.177.62.29" dst_port="53" proto="tcp" src_ip="209.209.205.13" src_port="53"/>
      <filter dst_ip="195.177.62.29" dst_port="53" proto="udp" src_ip="209.209.205.13" src_port="53"/>
      <filter dst_ip="204.197.230.39" dst_port="80" proto="tcp" src_ip="209.209.205.13" src_port="53"/>
      <filter dst_ip="204.197.230.39" dst_port="80" proto="udp" src_ip="209.209.205.13" src_port="53"/>
      <filter dst_ip="204.197.230.39" dst_port="53" proto="tcp" src_ip="209.209.205.13" src_port="53"/>
      <filter dst_ip="204.197.230.39" dst_port="53" proto="udp" src_ip="209.209.205.13" src_port="53"/>
      <from sec="991803718" usec="0"/>
      <to sec="991803741" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="195.177.62.29" dst_port="80" proto="tcp" src_ip="151.144.39.117" src_port="53"/>
      <filter dst_ip="195.177.62.29" dst_port="80" proto="udp" src_ip="151.144.39.117" src_port="53"/>
      <filter dst_ip="195.177.62.29" dst_port="53" proto="tcp" src_ip="151.144.39.117" src_port="53"/>
      <filter dst_ip="195.177.62.29" dst_port="53" proto="udp" src_ip="151.144.39.117" src_port="53"/>
      <filter dst_ip="204.197.230.39" dst_port="80" proto="tcp" src_ip="151.144.39.117" src_port="53"/>
      <filter dst_ip="204.197.230.39" dst_port="80" proto="udp" src_ip="151.144.39.117" src_port="53"/>
      <filter dst_ip="204.197.230.39" dst_port="53" proto="tcp" src_ip="151.144.39.117" src_port="53"/>
      <filter dst_ip="204.197.230.39" dst_port="53" proto="udp" src_ip="151.144.39.117" src_port="53"/>
      <from sec="991803715" usec="0"/>
      <to sec="991803741" usec="0"/>
    </slice>
    <from sec="991803715" usec="0"/>
    <to sec="991803743" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="143.50.228.6" dst_port="25" proto="tcp" src_ip="212.48.80.100" src_port="53"/>
      <filter dst_ip="143.50.228.6" dst_port="25" proto="udp" src_ip="212.48.80.100" src_port="53"/>
      <filter dst_ip="143.50.228.6" dst_port="53" proto="tcp" src_ip="212.48.80.100" src_port="53"/>
      <filter dst_ip="143.50.228.6" dst_port="53" proto="udp" src_ip="212.48.80.100" src_port="53"/>
      <from sec="991803600" usec="0"/>
      <to sec="991803658" usec="0"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991803658" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="143.50.249.168" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="143.50.249.168" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="143.50.249.168" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="143.50.249.168" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="143.50.249.168" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="143.50.249.168" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="143.50.249.168" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="143.50.249.168" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="143.50.249.168" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="143.50.249.168" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="143.50.249.168" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="143.50.249.168" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="143.50.249.168" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="143.50.249.168" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="143.50.249.168" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="143.50.249.168" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="143.50.249.168" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="143.50.249.168" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="143.50.249.168" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="143.50.249.168" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="143.50.249.168" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="143.50.249.168" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="143.50.249.168" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="143.50.249.168" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <from sec="991803658" usec="0"/>
      <to sec="991803682" usec="0"/>
    </slice>
    <from sec="991803657" usec="0"/>
    <to sec="991803687" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="tcp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="udp" src_ip="202.35.79.6" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="tcp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="udp" src_ip="202.35.79.6" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="21" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="137.248.43.57" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <from sec="991803641" usec="0"/>
      <to sec="991803650" usec="0"/>
    </slice>
    <from sec="991803628" usec="0"/>
    <to sec="991803658" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848458,1.72875,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="175.221.29.63" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="175.221.29.63" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="175.221.29.63" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="175.221.29.63" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="175.221.29.63" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="175.221.29.63" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="175.221.29.63" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="175.221.29.63" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="175.221.29.63" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="175.221.29.63" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="175.221.29.63" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="175.221.29.63" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="175.221.29.63" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="175.221.29.63" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="175.221.29.63" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="175.221.29.63" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="175.221.29.63" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="175.221.29.63" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="175.221.29.63" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="175.221.29.63" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="175.221.29.63" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="175.221.29.63" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="175.221.29.63" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="175.221.29.63" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="175.221.29.63" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.29.63" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.29.63" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.29.63" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.29.63" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.29.63" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.29.63" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.29.63" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.29.63" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.29.63" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.29.63" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.29.63" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.29.63" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.29.63" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.29.63" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.29.63" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.29.63" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.29.63" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.29.63" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.29.63" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.29.63" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.29.63" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.29.63" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="175.221.29.63" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <from sec="991803660" usec="0"/>
      <to sec="991803682" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="208.147.179.112" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.179.112" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.179.112" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.179.112" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.179.112" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.179.112" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.179.112" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.179.112" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.179.112" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.179.112" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.179.112" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.179.112" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.179.112" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.179.112" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.179.112" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.179.112" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.179.112" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.179.112" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.179.112" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.179.112" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.179.112" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.179.112" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.179.112" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.179.112" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="80"/>
      <filter dst_ip="208.147.179.112" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.179.112" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.179.112" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.179.112" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.179.112" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.179.112" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.179.112" dst_port="53" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.179.112" dst_port="53" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.179.112" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.179.112" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.179.112" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.179.112" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.179.112" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.179.112" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.179.112" dst_port="80" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.179.112" dst_port="80" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.179.112" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.179.112" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.179.112" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.179.112" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.179.112" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.179.112" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.179.112" dst_port="25" proto="tcp" src_ip="215.48.131.221" src_port="53"/>
      <filter dst_ip="208.147.179.112" dst_port="25" proto="udp" src_ip="215.48.131.221" src_port="53"/>
      <from sec="991803672" usec="0"/>
      <to sec="991803686" usec="0"/>
    </slice>
    <from sec="991803657" usec="0"/>
    <to sec="991803687" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.533239,1.64144,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_41{
style=filled;
color=gray75;
110[label="151.144.152.67;d;2pkt 2fpkt", shape=diamond, color=yellow];
111[label="203.148.237.212;s;2pkt 2fpkt", shape=diamond, color=yellow];
2546[label="203.148.237.212;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat41[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.148.237.212:554, 151.144.152.67:1177}[50%]&lt;BR/&gt;{203.148.237.212:9766, 151.144.152.67:6972}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1177: (30%)&lt;BR/&gt; 554: (30%)&lt;BR/&gt; 9766: (20%)&lt;BR/&gt; 6972: (20%)&gt;];
}
110--111[label="1;2pkt 2fpkt"];
110--2546[label="1;1pkt 1fpkt"];
111--2546[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="151.144.152.67" dst_port="6972" src_ip="203.148.237.212" src_port="9766"/>
      <filter dst_ip="151.144.152.67" dst_port="1177" src_ip="203.148.237.212" src_port="554"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677781,1.59484,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_42{
style=filled;
color=gray75;
118[label="212.48.80.100;d;1855pkt 1855fpkt", shape=diamond, color=yellow];
121[label="143.50.228.6;s;1856pkt 1856fpkt", shape=diamond, color=yellow];
1584[label="212.48.80.100;d;1565pkt 1565fpkt", shape=hexagon, color=black];
1878[label="143.50.228.6;2094pkt 2094fpkt", shape=pentagon, color=darkviolet];
stat42[shape=component, label=&lt;Rules:&lt;BR/&gt;{143.50.228.6:25, 212.48.80.100:*}[99.9522%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (49.9864%)&lt;BR/&gt; 39641: (0.027137%)&lt;BR/&gt; 39638: (0.027137%)&lt;BR/&gt; 39634: (0.027137%)&lt;BR/&gt; 39632: (0.027137%)&gt;];
}
118--121[label="1;1855pkt 1855fpkt"];
118--1584[label="1;1565pkt 1565fpkt"];
118--1878[label="1;1855pkt 1855fpkt"];
121--1584[label="1;1565pkt 1565fpkt"];
121--1878[label="1;1856pkt 1856fpkt"];
1584--1878[label="1;1565pkt 1565fpkt"];
</description>
    <slice>
      <filter dst_ip="212.48.80.100" src_ip="143.50.228.6" src_port="25"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677781,1.59484,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_43{
style=filled;
color=gray75;
132[label="151.144.78.32;d;735pkt 735fpkt", shape=diamond, color=yellow];
134[label="195.231.102.247;s;737pkt 737fpkt", shape=diamond, color=yellow];
1317[label="151.144.78.32;d;496pkt 496fpkt", shape=hexagon, color=black];
2613[label="195.231.102.247;800pkt 800fpkt", shape=pentagon, color=darkviolet];
stat43[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.231.102.247:80, 151.144.78.32:*}[99.7503%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2947: (0.108382%)&lt;BR/&gt; 2864: (0.108382%)&lt;BR/&gt; 3223: (0.0722543%)&lt;BR/&gt; 3222: (0.0722543%)&gt;];
}
132--134[label="1;735pkt 735fpkt"];
132--1317[label="1;496pkt 496fpkt"];
132--2613[label="0.998639;734pkt 734fpkt"];
134--239[label="0.0027137;2pkt 2fpkt"];
134--1282[label="0.0027137;2pkt 2fpkt"];
134--1317[label="1;496pkt 496fpkt"];
134--2613[label="0.998643;736pkt 736fpkt"];
1317--2613[label="0.997984;495pkt 495fpkt"];
</description>
    <slice>
      <filter dst_ip="151.144.78.32" src_ip="195.231.102.247" src_port="80"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804229" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_44{
style=filled;
color=gray75;
163[label="175.221.148.89;d;2pkt 2fpkt", shape=diamond, color=yellow];
164[label="17.13.164.3;s;1pkt 1fpkt", shape=diamond, color=yellow];
1324[label="175.221.148.89;d;2pkt 2fpkt", shape=hexagon, color=black];
stat44[shape=component, label=&lt;Rules:&lt;BR/&gt;{17.13.164.3:3410, 175.221.148.89:41001}[50%]&lt;BR/&gt;{91.81.128.174:21, 175.221.148.89:1029}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 41001: (30%)&lt;BR/&gt; 3410: (30%)&lt;BR/&gt; 1029: (20%)&lt;BR/&gt; 21: (20%)&gt;];
}
163--164[label="1;1pkt 1fpkt"];
163--1324[label="1;2pkt 2fpkt"];
164--1324[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="175.221.148.89" dst_port="1029" src_ip="91.81.128.174" src_port="21"/>
      <filter dst_ip="175.221.148.89" dst_port="41001" src_ip="17.13.164.3" src_port="3410"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804142" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_45{
style=filled;
color=gray75;
173[label="151.144.182.161;d;6pkt 6fpkt", shape=diamond, color=yellow];
174[label="221.73.244.46;s;3pkt 3fpkt", shape=diamond, color=yellow];
1326[label="151.144.182.161;d;4pkt 4fpkt", shape=hexagon, color=black];
stat45[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.6.141.136:8080, 151.144.182.161:*}[50%]&lt;BR/&gt;{221.73.244.46:*, 151.144.182.161:*}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8080: (23.0769%)&lt;BR/&gt; 3287: (11.5385%)&lt;BR/&gt; 3229: (11.5385%)&lt;BR/&gt; 3288: (7.69231%)&lt;BR/&gt; 3231: (7.69231%)&gt;];
}
173--174[label="1;3pkt 3fpkt"];
173--1326[label="1;4pkt 4fpkt"];
174--1326[label="0.333333;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="151.144.182.161" src_ip="221.73.244.46"/>
      <filter dst_ip="151.144.182.161" src_ip="147.6.141.136" src_port="8080"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.960966,1.60219,999,1 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_46{
style=filled;
color=gray75;
85[label="143.50.205.211d;1pkt 1fpkt", shape=rectangle, color=red];
179[label="143.50.205.211;d;50pkt 50fpkt", shape=diamond, color=yellow];
180[label="49.179.72.121;s;1pkt 1fpkt", shape=diamond, color=yellow];
264[label="17.203.30.26;s;1pkt 1fpkt", shape=diamond, color=yellow];
448[label="164.159.112.18;s;1pkt 1fpkt", shape=diamond, color=yellow];
683[label="90.61.81.100;s;1pkt 1fpkt", shape=diamond, color=yellow];
1269[label="143.50.205.211;d;50pkt 50fpkt", shape=hexagon, color=black];
1288[label="17.203.30.26;s;1pkt 1fpkt", shape=hexagon, color=black];
2219[label="90.61.81.100;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat46[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 143.50.205.211:6346}[94%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6346: (49.0654%)&lt;BR/&gt; 51032: (1.86916%)&lt;BR/&gt; 1149: (1.86916%)&lt;BR/&gt; 64555: (1.40187%)&lt;BR/&gt; 4239: (1.40187%)&gt;];
}
85--179[label="1;1pkt 1fpkt"];
85--1269[label="1;1pkt 1fpkt"];
179--180[label="1;1pkt 1fpkt"];
179--264[label="1;1pkt 1fpkt"];
179--448[label="1;1pkt 1fpkt"];
179--683[label="1;1pkt 1fpkt"];
179--1269[label="1;50pkt 50fpkt"];
179--1288[label="1;1pkt 1fpkt"];
179--2219[label="1;1pkt 1fpkt"];
180--1269[label="1;1pkt 1fpkt"];
264--1269[label="1;1pkt 1fpkt"];
264--1288[label="1;1pkt 1fpkt"];
448--1269[label="1;1pkt 1fpkt"];
683--1269[label="1;1pkt 1fpkt"];
683--2219[label="1;1pkt 1fpkt"];
1269--1288[label="1;1pkt 1fpkt"];
1269--2219[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="143.50.205.211" dst_port="6346"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991803971" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_47{
style=filled;
color=gray75;
202[label="151.144.80.21;d;1pkt 1fpkt", shape=diamond, color=yellow];
205[label="218.14.122.143;s;1pkt 1fpkt", shape=diamond, color=yellow];
1275[label="151.144.80.21;d;1pkt 1fpkt", shape=hexagon, color=black];
stat47[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.14.122.143:80, 151.144.80.21:1042}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1042: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
202--205[label="1;1pkt 1fpkt"];
202--1275[label="1;1pkt 1fpkt"];
205--1275[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="151.144.80.21" dst_port="1042" src_ip="218.14.122.143" src_port="80"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991803901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_48{
style=filled;
color=gray75;
206[label="169.38.65.193;d;12pkt 12fpkt", shape=diamond, color=yellow];
207[label="17.111.249.53;s;1pkt 1fpkt", shape=diamond, color=yellow];
1434[label="169.38.65.193;d;8pkt 8fpkt", shape=hexagon, color=black];
stat48[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 169.38.65.193:0}[66.6667%]&lt;BR/&gt;{*:6699, 169.38.65.193:*}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (61.9048%)&lt;BR/&gt; 6699: (14.2857%)&lt;BR/&gt; 3144: (7.14286%)&lt;BR/&gt; 8888: (4.7619%)&lt;BR/&gt; 3126: (4.7619%)&gt;];
}
206--207[label="1;1pkt 1fpkt"];
206--1434[label="1;8pkt 8fpkt"];
207--1434[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="169.38.65.193" src_port="6699"/>
      <filter dst_ip="169.38.65.193"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_50{
style=filled;
color=gray75;
223[label="56.200.158.78;d;149pkt 149fpkt", shape=diamond, color=yellow];
224[label="56.200.158.78;s;171pkt 171fpkt", shape=diamond, color=yellow];
1529[label="56.200.158.78;d;122pkt 122fpkt", shape=hexagon, color=black];
stat50[shape=component, label=&lt;Rules:&lt;BR/&gt;{56.200.158.78:13364, 56.200.158.78:*}[89.4737%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 13364: (45.4751%)&lt;BR/&gt; 0: (2.71493%)&lt;BR/&gt; 80: (1.92308%)&lt;BR/&gt; 13392: (1.58371%)&lt;BR/&gt; 13365: (1.0181%)&gt;];
}
223--224[label="1;149pkt 149fpkt"];
223--1529[label="1;122pkt 122fpkt"];
223--1827[label="0.00671141;1pkt 1fpkt"];
223--1833[label="0.0134228;2pkt 2fpkt"];
223--1834[label="0.00671141;1pkt 1fpkt"];
223--1838[label="0.00671141;1pkt 1fpkt"];
223--1846[label="0.00671141;1pkt 1fpkt"];
224--1529[label="1;122pkt 122fpkt"];
224--1827[label="0.00584795;1pkt 1fpkt"];
224--1833[label="0.0116959;2pkt 2fpkt"];
224--1834[label="0.00584795;1pkt 1fpkt"];
224--1838[label="0.00584795;1pkt 1fpkt"];
224--1846[label="0.00584795;1pkt 1fpkt"];
1529--1827[label="0.00819672;1pkt 1fpkt"];
1529--1833[label="0.0163934;2pkt 2fpkt"];
1529--1834[label="0.00819672;1pkt 1fpkt"];
1529--1838[label="0.00819672;1pkt 1fpkt"];
1529--1846[label="0.00819672;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="56.200.158.78" src_ip="56.200.158.78" src_port="13364"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_51{
style=filled;
color=gray75;
235[label="208.152.176.134;s;6pkt 6fpkt", shape=diamond, color=yellow];
236[label="138.204.173.87;d;4pkt 4fpkt", shape=diamond, color=yellow];
1281[label="208.152.176.134;s;1pkt 1fpkt", shape=hexagon, color=black];
stat51[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.152.176.134:20, 138.204.173.87:*}[50%]&lt;BR/&gt;{208.152.176.134:21, *:*}[33.3333%]&lt;BR/&gt;{208.152.176.134:*, 202.48.90.156:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 20: (36.3636%)&lt;BR/&gt; 4024: (13.6364%)&lt;BR/&gt; 21: (13.6364%)&lt;BR/&gt; 4207: (9.09091%)&lt;BR/&gt; 4025: (9.09091%)&gt;];
}
235--236[label="1;4pkt 4fpkt"];
235--1281[label="1;1pkt 1fpkt"];
236--1281[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="202.48.90.156" src_ip="208.152.176.134"/>
      <filter src_ip="208.152.176.134" src_port="21"/>
      <filter dst_ip="138.204.173.87" src_ip="208.152.176.134" src_port="20"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.900626,1.68101,503,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_52{
style=filled;
color=gray75;
25[label="91.183.95.127s;1pkt 1fpkt", shape=rectangle, color=red];
237[label="208.147.112.73;d;23pkt 23fpkt", shape=diamond, color=yellow];
418[label="91.183.95.127;s;23pkt 23fpkt", shape=diamond, color=yellow];
stat52[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.183.95.127:80, 208.147.112.73:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1118: (3.19149%)&lt;BR/&gt; 1162: (2.12766%)&lt;BR/&gt; 1161: (2.12766%)&lt;BR/&gt; 1158: (2.12766%)&gt;];
}
25--237[label="1;1pkt 1fpkt"];
25--418[label="1;1pkt 1fpkt"];
237--418[label="1;23pkt 23fpkt"];
</description>
    <slice>
      <filter dst_ip="208.147.112.73" src_ip="91.183.95.127" src_port="80"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.589116,1.67401,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="10.2.2.25"/>
      <from sec="991803932" usec="0"/>
      <to sec="991804126" usec="0"/>
    </slice>
    <from sec="991803932" usec="0"/>
    <to sec="991804126" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.589116,1.67401,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="10.1.2.25"/>
      <from sec="991803932" usec="0"/>
      <to sec="991804126" usec="0"/>
    </slice>
    <from sec="991803932" usec="0"/>
    <to sec="991804126" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.589116,1.67401,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_58{
style=filled;
color=gray75;
371[label="91.59.92.106;s;1pkt 1fpkt", shape=diamond, color=yellow];
372[label="151.144.1.186;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat58[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.59.92.106:16964, 151.144.1.186:2792}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 16964: (50%)&lt;BR/&gt; 2792: (50%)&gt;];
}
371--372[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="151.144.1.186" dst_port="2792" src_ip="91.59.92.106" src_port="16964"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_59{
style=filled;
color=gray75;
370[label="91.59.92.106;d;1pkt 1fpkt", shape=diamond, color=yellow];
373[label="151.144.1.186;s;1pkt 1fpkt", shape=diamond, color=yellow];
1585[label="91.59.92.106;d;1pkt 1fpkt", shape=hexagon, color=black];
stat59[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.144.1.186:2792, 91.59.92.106:16964}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 16964: (50%)&lt;BR/&gt; 2792: (50%)&gt;];
}
370--373[label="1;1pkt 1fpkt"];
370--1585[label="1;1pkt 1fpkt"];
373--1585[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="91.59.92.106" dst_port="16964" src_ip="151.144.1.186" src_port="2792"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.589116,1.67401,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_60{
style=filled;
color=gray75;
291[label="214.69.76.242;d;51pkt 51fpkt", shape=diamond, color=yellow];
390[label="175.221.31.127;s;209pkt 209fpkt", shape=diamond, color=yellow];
454[label="202.10.235.16;d;94pkt 94fpkt", shape=diamond, color=yellow];
stat60[shape=component, label=&lt;Rules:&lt;BR/&gt;{175.221.31.127:80, 202.10.235.16:*}[44.9761%]&lt;BR/&gt;{175.221.31.127:80, 214.69.76.242:*}[24.4019%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.7175%)&lt;BR/&gt; 63087: (0.282486%)&lt;BR/&gt; 62710: (0.282486%)&lt;BR/&gt; 61051: (0.282486%)&lt;BR/&gt; 61017: (0.282486%)&gt;];
}
291--390[label="1;51pkt 51fpkt"];
390--454[label="1;94pkt 94fpkt"];
</description>
    <slice>
      <filter dst_ip="202.10.235.16" src_ip="175.221.31.127" src_port="80"/>
      <filter dst_ip="214.69.76.242" src_ip="175.221.31.127" src_port="80"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.0697,1.62411,999,1 0 0 1 1 0 0 0 0 0 1 0 ">
    <description>subgraph cluster_61{
style=filled;
color=gray75;
33[label="143.50.20.163s;2pkt 2fpkt", shape=rectangle, color=red];
154[label="143.50.20.163;s;55pkt 55fpkt", shape=diamond, color=yellow];
226[label="39.178.23.190;d;1pkt 1fpkt", shape=diamond, color=yellow];
293[label="171.139.144.218;d;1pkt 1fpkt", shape=diamond, color=yellow];
426[label="17.21.32.239;d;1pkt 1fpkt", shape=diamond, color=yellow];
428[label="207.24.31.93;d;1pkt 1fpkt", shape=diamond, color=yellow];
459[label="49.149.248.59;d;1pkt 1fpkt", shape=diamond, color=yellow];
472[label="17.171.231.11;d;1pkt 1fpkt", shape=diamond, color=yellow];
525[label="17.160.101.236;d;1pkt 1fpkt", shape=diamond, color=yellow];
732[label="17.189.12.212;d;1pkt 1fpkt", shape=diamond, color=yellow];
1081[label="32.140.128.146;d;2pkt 2fpkt", shape=diamond, color=yellow];
1261[label="143.50.20.163;s;17pkt 17fpkt", shape=hexagon, color=black];
1440[label="39.178.23.190;d;1pkt 1fpkt", shape=hexagon, color=black];
1544[label="171.139.144.218;d;1pkt 1fpkt", shape=hexagon, color=black];
1551[label="17.160.101.236;d;1pkt 1fpkt", shape=hexagon, color=black];
2879[label="143.50.20.163;75pkt 75fpkt", shape=invtriangle, color=brown];
stat61[shape=component, label=&lt;Rules:&lt;BR/&gt;{143.50.20.163:*, *:6346}[62.8205%]&lt;BR/&gt;{143.50.20.163:6347, *:*}[26.9231%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6346: (33.9506%)&lt;BR/&gt; 6347: (12.3457%)&lt;BR/&gt; 3144: (1.54321%)&lt;BR/&gt; 3086: (1.54321%)&lt;BR/&gt; 3007: (1.54321%)&gt;];
}
33--154[label="1;2pkt 2fpkt"];
33--426[label="1;1pkt 1fpkt"];
33--472[label="1;1pkt 1fpkt"];
33--1261[label="1;2pkt 2fpkt"];
33--2879[label="1;2pkt 2fpkt"];
154--226[label="1;1pkt 1fpkt"];
154--293[label="1;1pkt 1fpkt"];
154--426[label="1;1pkt 1fpkt"];
154--428[label="1;1pkt 1fpkt"];
154--459[label="1;1pkt 1fpkt"];
154--472[label="1;1pkt 1fpkt"];
154--525[label="1;1pkt 1fpkt"];
154--732[label="1;1pkt 1fpkt"];
154--1081[label="0.5;1pkt 1fpkt"];
154--1261[label="1;17pkt 17fpkt"];
154--1440[label="1;1pkt 1fpkt"];
154--1544[label="1;1pkt 1fpkt"];
154--1551[label="1;1pkt 1fpkt"];
154--2879[label="0.963636;53pkt 53fpkt"];
226--1261[label="1;1pkt 1fpkt"];
226--1440[label="1;1pkt 1fpkt"];
226--2879[label="1;1pkt 1fpkt"];
293--1261[label="1;1pkt 1fpkt"];
293--1544[label="1;1pkt 1fpkt"];
293--2879[label="1;1pkt 1fpkt"];
426--1261[label="1;1pkt 1fpkt"];
426--2879[label="1;1pkt 1fpkt"];
428--1261[label="1;1pkt 1fpkt"];
428--2879[label="1;1pkt 1fpkt"];
459--1261[label="1;1pkt 1fpkt"];
459--2879[label="1;1pkt 1fpkt"];
472--1261[label="1;1pkt 1fpkt"];
472--2879[label="1;1pkt 1fpkt"];
525--1261[label="1;1pkt 1fpkt"];
525--1551[label="1;1pkt 1fpkt"];
732--1261[label="1;1pkt 1fpkt"];
732--2879[label="1;1pkt 1fpkt"];
1081--2879[label="0.5;1pkt 1fpkt"];
1261--1440[label="1;1pkt 1fpkt"];
1261--1544[label="1;1pkt 1fpkt"];
1261--1551[label="1;1pkt 1fpkt"];
1261--2879[label="0.882353;15pkt 15fpkt"];
1440--2879[label="1;1pkt 1fpkt"];
1544--2879[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="143.50.20.163" src_port="6347"/>
      <filter dst_port="6346" src_ip="143.50.20.163"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_63{
style=filled;
color=gray75;
253[label="151.144.77.180;d;2pkt 2fpkt", shape=diamond, color=yellow];
439[label="91.61.21.200;s;2pkt 2fpkt", shape=diamond, color=yellow];
1536[label="151.144.77.180;d;2pkt 2fpkt", shape=hexagon, color=black];
stat63[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.61.21.200:554, 151.144.77.180:1267}[50%]&lt;BR/&gt;{91.61.21.200:11442, 151.144.77.180:6970}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 11442: (25%)&lt;BR/&gt; 6970: (25%)&lt;BR/&gt; 1267: (25%)&lt;BR/&gt; 554: (25%)&gt;];
}
253--439[label="1;2pkt 2fpkt"];
253--1536[label="1;2pkt 2fpkt"];
439--1536[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="151.144.77.180" dst_port="6970" src_ip="91.61.21.200" src_port="11442"/>
      <filter dst_ip="151.144.77.180" dst_port="1267" src_ip="91.61.21.200" src_port="554"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_64{
style=filled;
color=gray75;
256[label="169.41.64.234;d;112pkt 112fpkt", shape=diamond, color=yellow];
442[label="208.32.235.73;s;111pkt 111fpkt", shape=diamond, color=yellow];
1597[label="169.41.64.234;d;86pkt 86fpkt", shape=hexagon, color=black];
stat64[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.32.235.73:*, 169.41.64.234:*}[99.1071%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (0.970874%)&lt;BR/&gt; 4034: (0.485437%)&lt;BR/&gt; 4033: (0.485437%)&lt;BR/&gt; 4032: (0.485437%)&lt;BR/&gt; 4031: (0.485437%)&gt;];
}
256--442[label="1;111pkt 111fpkt"];
256--1597[label="1;86pkt 86fpkt"];
442--1597[label="0.988372;85pkt 85fpkt"];
</description>
    <slice>
      <filter dst_ip="169.41.64.234" src_ip="208.32.235.73"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_65{
style=filled;
color=gray75;
267[label="143.50.205.91;d;15pkt 15fpkt", shape=diamond, color=yellow];
447[label="209.206.89.249;s;1pkt 1fpkt", shape=diamond, color=yellow];
481[label="91.203.180.103;s;1pkt 1fpkt", shape=diamond, color=yellow];
1348[label="209.206.89.249;s;1pkt 1fpkt", shape=hexagon, color=black];
stat65[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 143.50.205.91:0}[66.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (55.5556%)&lt;BR/&gt; 6700: (8.33333%)&lt;BR/&gt; 6699: (8.33333%)&lt;BR/&gt; 1508: (8.33333%)&lt;BR/&gt; 1476: (5.55556%)&gt;];
}
267--447[label="1;1pkt 1fpkt"];
267--481[label="1;1pkt 1fpkt"];
267--1348[label="1;1pkt 1fpkt"];
447--1348[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="143.50.205.91"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804153" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_66{
style=filled;
color=gray75;
468[label="208.147.106.48;d;16pkt 16fpkt", shape=diamond, color=yellow];
469[label="174.55.87.231;s;1pkt 1fpkt", shape=diamond, color=yellow];
1601[label="208.147.106.48;d;16pkt 16fpkt", shape=hexagon, color=black];
stat66[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.59.92.31:80, 208.147.106.48:*}[25%]&lt;BR/&gt;{215.237.193.54:80, 208.147.106.48:*}[25%]&lt;BR/&gt;{206.140.13.212:80, 208.147.106.48:*}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (42.4242%)&lt;BR/&gt; 20188: (4.54545%)&lt;BR/&gt; 1880: (4.54545%)&lt;BR/&gt; 5190: (3.0303%)&lt;BR/&gt; 2051: (3.0303%)&gt;];
}
468--469[label="1;1pkt 1fpkt"];
468--1601[label="1;16pkt 16fpkt"];
469--1601[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="208.147.106.48" src_ip="206.140.13.212" src_port="80"/>
      <filter dst_ip="208.147.106.48" src_ip="215.237.193.54" src_port="80"/>
      <filter dst_ip="208.147.106.48" src_ip="91.59.92.31" src_port="80"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_67{
style=filled;
color=gray75;
270[label="143.50.204.56;s;16pkt 16fpkt", shape=diamond, color=yellow];
461[label="88.170.136.66;d;1pkt 1fpkt", shape=diamond, color=yellow];
475[label="17.25.143.228;d;1pkt 1fpkt", shape=diamond, color=yellow];
501[label="206.35.128.67;d;1pkt 1fpkt", shape=diamond, color=yellow];
693[label="195.81.204.249;d;1pkt 1fpkt", shape=diamond, color=yellow];
1350[label="143.50.204.56;s;12pkt 12fpkt", shape=hexagon, color=black];
1352[label="88.170.136.66;d;1pkt 1fpkt", shape=hexagon, color=black];
stat67[shape=component, label=&lt;Rules:&lt;BR/&gt;{143.50.204.56:6346, *:*}[87.5%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6346: (48.4848%)&lt;BR/&gt; 18629: (6.06061%)&lt;BR/&gt; 62555: (4.54545%)&lt;BR/&gt; 57155: (4.54545%)&lt;BR/&gt; 1234: (4.54545%)&gt;];
}
270--461[label="1;1pkt 1fpkt"];
270--475[label="1;1pkt 1fpkt"];
270--501[label="1;1pkt 1fpkt"];
270--693[label="1;1pkt 1fpkt"];
270--1350[label="1;12pkt 12fpkt"];
270--1352[label="1;1pkt 1fpkt"];
461--1350[label="1;1pkt 1fpkt"];
461--1352[label="1;1pkt 1fpkt"];
475--1350[label="1;1pkt 1fpkt"];
501--1350[label="1;1pkt 1fpkt"];
693--1350[label="1;1pkt 1fpkt"];
1350--1352[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="143.50.204.56" src_port="6346"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_68{
style=filled;
color=gray75;
284[label="169.41.3.108;d;2pkt 2fpkt", shape=diamond, color=yellow];
479[label="49.132.53.175;s;2pkt 2fpkt", shape=diamond, color=yellow];
1356[label="49.132.53.175;s;2pkt 2fpkt", shape=hexagon, color=black];
stat68[shape=component, label=&lt;Rules:&lt;BR/&gt;{49.132.53.175:1755, 169.41.3.108:1827}[50%]&lt;BR/&gt;{49.132.53.175:3639, 169.41.3.108:1829}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3639: (25%)&lt;BR/&gt; 1829: (25%)&lt;BR/&gt; 1827: (25%)&lt;BR/&gt; 1755: (25%)&gt;];
}
284--479[label="1;2pkt 2fpkt"];
284--1356[label="1;2pkt 2fpkt"];
479--1356[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="169.41.3.108" dst_port="1829" src_ip="49.132.53.175" src_port="3639"/>
      <filter dst_ip="169.41.3.108" dst_port="1827" src_ip="49.132.53.175" src_port="1755"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_69{
style=filled;
color=gray75;
493[label="137.248.38.138;d;3pkt 3fpkt", shape=diamond, color=yellow];
494[label="195.97.149.191;s;3pkt 3fpkt", shape=diamond, color=yellow];
1358[label="195.97.149.191;s;2pkt 2fpkt", shape=hexagon, color=black];
1611[label="137.248.38.138;d;3pkt 3fpkt", shape=hexagon, color=black];
stat69[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.97.149.191:1446, 137.248.38.138:6970}[33.3333%]&lt;BR/&gt;{195.97.149.191:7070, 137.248.38.138:2316}[33.3333%]&lt;BR/&gt;{195.97.149.191:7070, 137.248.38.138:2362}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7070: (31.8182%)&lt;BR/&gt; 6970: (18.1818%)&lt;BR/&gt; 2316: (18.1818%)&lt;BR/&gt; 1446: (18.1818%)&lt;BR/&gt; 2362: (13.6364%)&gt;];
}
493--494[label="1;3pkt 3fpkt"];
493--1358[label="1;2pkt 2fpkt"];
493--1611[label="1;3pkt 3fpkt"];
494--1358[label="1;2pkt 2fpkt"];
494--1611[label="1;3pkt 3fpkt"];
1358--1611[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.38.138" dst_port="2362" src_ip="195.97.149.191" src_port="7070"/>
      <filter dst_ip="137.248.38.138" dst_port="2316" src_ip="195.97.149.191" src_port="7070"/>
      <filter dst_ip="137.248.38.138" dst_port="6970" src_ip="195.97.149.191" src_port="1446"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_70{
style=filled;
color=gray75;
616[label="169.41.4.101;d;6pkt 6fpkt", shape=diamond, color=yellow];
617[label="155.168.64.152;s;4pkt 4fpkt", shape=diamond, color=yellow];
1660[label="169.41.4.101;d;6pkt 6fpkt", shape=hexagon, color=black];
1661[label="155.168.64.152;s;4pkt 4fpkt", shape=hexagon, color=black];
stat70[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.43.252.217:80, 169.41.4.101:*}[33.3333%]&lt;BR/&gt;{155.168.64.152:7070, 169.41.4.101:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7070: (20%)&lt;BR/&gt; 0: (20%)&lt;BR/&gt; 49314: (10%)&lt;BR/&gt; 49311: (10%)&lt;BR/&gt; 6970: (10%)&gt;];
}
616--617[label="1;4pkt 4fpkt"];
616--1660[label="1;6pkt 6fpkt"];
616--1661[label="1;4pkt 4fpkt"];
617--1660[label="1;4pkt 4fpkt"];
617--1661[label="1;4pkt 4fpkt"];
1660--1661[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="169.41.4.101" src_ip="155.168.64.152" src_port="7070"/>
      <filter dst_ip="169.41.4.101" src_ip="214.43.252.217" src_port="80"/>
    </slice>
    <from sec="991803619" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.589116,1.67401,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_71{
style=filled;
color=gray75;
382[label="151.144.182.161;s;6pkt 6fpkt", shape=diamond, color=yellow];
664[label="221.73.244.46;d;3pkt 3fpkt", shape=diamond, color=yellow];
stat71[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.144.182.161:*, 147.6.141.136:8080}[50%]&lt;BR/&gt;{151.144.182.161:*, 221.73.244.46:*}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8080: (16.6667%)&lt;BR/&gt; 3288: (11.1111%)&lt;BR/&gt; 3287: (11.1111%)&lt;BR/&gt; 3231: (11.1111%)&lt;BR/&gt; 3229: (11.1111%)&gt;];
}
382--664[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="221.73.244.46" src_ip="151.144.182.161"/>
      <filter dst_ip="147.6.141.136" dst_port="8080" src_ip="151.144.182.161"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_72{
style=filled;
color=gray75;
696[label="208.147.106.48;s;10pkt 10fpkt", shape=diamond, color=yellow];
697[label="174.55.87.231;d;1pkt 1fpkt", shape=diamond, color=yellow];
1450[label="174.55.87.231;d;1pkt 1fpkt", shape=hexagon, color=black];
1602[label="208.147.106.48;s;7pkt 7fpkt", shape=hexagon, color=black];
stat72[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.147.106.48:*, 91.59.92.31:80}[40%]&lt;BR/&gt;{208.147.106.48:*, 215.237.193.54:80}[40%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (39.4737%)&lt;BR/&gt; 20188: (10.5263%)&lt;BR/&gt; 1880: (10.5263%)&lt;BR/&gt; 2043: (5.26316%)&lt;BR/&gt; 2042: (5.26316%)&gt;];
}
696--697[label="1;1pkt 1fpkt"];
696--1450[label="1;1pkt 1fpkt"];
696--1602[label="1;7pkt 7fpkt"];
697--1450[label="1;1pkt 1fpkt"];
697--1602[label="1;1pkt 1fpkt"];
1450--1602[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="215.237.193.54" dst_port="80" src_ip="208.147.106.48"/>
      <filter dst_ip="91.59.92.31" dst_port="80" src_ip="208.147.106.48"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_73{
style=filled;
color=gray75;
510[label="209.57.170.251;s;2pkt 2fpkt", shape=diamond, color=yellow];
705[label="169.41.76.169;d;4pkt 4fpkt", shape=diamond, color=yellow];
1617[label="169.41.76.169;d;4pkt 4fpkt", shape=hexagon, color=black];
stat73[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.151.113.19:1863, 169.41.76.169:1027}[25%]&lt;BR/&gt;{91.152.151.28:5190, 169.41.76.169:1035}[25%]&lt;BR/&gt;{209.57.170.251:1755, 169.41.76.169:1364}[25%]&lt;BR/&gt;{209.57.170.251:2927, 169.41.76.169:1366}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2927: (15%)&lt;BR/&gt; 1755: (15%)&lt;BR/&gt; 1366: (15%)&lt;BR/&gt; 1364: (15%)&lt;BR/&gt; 5190: (10%)&gt;];
}
510--705[label="1;2pkt 2fpkt"];
510--1617[label="1;2pkt 2fpkt"];
705--1617[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="169.41.76.169" dst_port="1366" src_ip="209.57.170.251" src_port="2927"/>
      <filter dst_ip="169.41.76.169" dst_port="1364" src_ip="209.57.170.251" src_port="1755"/>
      <filter dst_ip="169.41.76.169" dst_port="1035" src_ip="91.152.151.28" src_port="5190"/>
      <filter dst_ip="169.41.76.169" dst_port="1027" src_ip="91.151.113.19" src_port="1863"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.589116,1.67401,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_74{
style=filled;
color=gray75;
523[label="203.4.224.144;s;2pkt 2fpkt", shape=diamond, color=yellow];
714[label="208.105.154.169;d;2pkt 2fpkt", shape=diamond, color=yellow];
stat74[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.4.224.144:1755, 208.105.154.169:1735}[50%]&lt;BR/&gt;{203.4.224.144:53566, 208.105.154.169:1737}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53566: (25%)&lt;BR/&gt; 1755: (25%)&lt;BR/&gt; 1737: (25%)&lt;BR/&gt; 1735: (25%)&gt;];
}
523--714[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="208.105.154.169" dst_port="1737" src_ip="203.4.224.144" src_port="53566"/>
      <filter dst_ip="208.105.154.169" dst_port="1735" src_ip="203.4.224.144" src_port="1755"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_75{
style=filled;
color=gray75;
689[label="143.50.72.130;s;1pkt 1fpkt", shape=diamond, color=yellow];
730[label="195.73.57.158;d;1pkt 1fpkt", shape=diamond, color=yellow];
1627[label="195.73.57.158;d;1pkt 1fpkt", shape=hexagon, color=black];
stat75[shape=component, label=&lt;Rules:&lt;BR/&gt;{143.50.72.130:1682, 195.73.57.158:11999}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 11999: (50%)&lt;BR/&gt; 1682: (50%)&gt;];
}
689--730[label="1;1pkt 1fpkt"];
689--1627[label="1;1pkt 1fpkt"];
730--1627[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="195.73.57.158" dst_port="11999" src_ip="143.50.72.130" src_port="1682"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.589116,1.67401,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="175.221.163.101"/>
      <from sec="991803601" usec="0"/>
      <to sec="991804068" usec="0"/>
    </slice>
    <from sec="991803601" usec="0"/>
    <to sec="991804068" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.533239,1.64144,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_77{
style=filled;
color=gray75;
746[label="137.248.45.83;d;2pkt 2fpkt", shape=diamond, color=yellow];
747[label="149.44.15.250;s;1pkt 1fpkt", shape=diamond, color=yellow];
2620[label="149.44.15.250;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat77[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.152.150.116:5190, 137.248.45.83:1255}[50%]&lt;BR/&gt;{149.44.15.250:80, 137.248.45.83:1263}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1263: (37.5%)&lt;BR/&gt; 80: (37.5%)&lt;BR/&gt; 5190: (12.5%)&lt;BR/&gt; 1255: (12.5%)&gt;];
}
746--747[label="1;1pkt 1fpkt"];
746--2620[label="1;1pkt 1fpkt"];
747--2620[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.45.83" dst_port="1263" src_ip="149.44.15.250" src_port="80"/>
      <filter dst_ip="137.248.45.83" dst_port="1255" src_ip="91.152.150.116" src_port="5190"/>
    </slice>
    <from sec="991803601" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677781,1.59484,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_78{
style=filled;
color=gray75;
780[label="208.147.98.58;d;2pkt 2fpkt", shape=diamond, color=yellow];
781[label="195.5.220.99;s;2pkt 2fpkt", shape=diamond, color=yellow];
1659[label="208.147.98.58;d;2pkt 2fpkt", shape=hexagon, color=black];
2215[label="195.5.220.99;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat78[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.5.220.99:7070, 208.147.98.58:49204}[50%]&lt;BR/&gt;{195.5.220.99:32801, 208.147.98.58:6970}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 32801: (28.5714%)&lt;BR/&gt; 6970: (28.5714%)&lt;BR/&gt; 49204: (21.4286%)&lt;BR/&gt; 7070: (21.4286%)&gt;];
}
780--781[label="1;2pkt 2fpkt"];
780--1659[label="1;2pkt 2fpkt"];
780--2215[label="1;1pkt 1fpkt"];
781--1659[label="1;2pkt 2fpkt"];
781--2215[label="1;1pkt 1fpkt"];
1659--2215[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="208.147.98.58" dst_port="6970" src_ip="195.5.220.99" src_port="32801"/>
      <filter dst_ip="208.147.98.58" dst_port="49204" src_ip="195.5.220.99" src_port="7070"/>
    </slice>
    <from sec="991803619" usec="0"/>
    <to sec="991804219" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.589116,1.67401,502,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_79{
style=filled;
color=gray75;
819[label="137.248.3.4;d;1pkt 1fpkt", shape=diamond, color=yellow];
820[label="221.187.0.189;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat79[shape=component, label=&lt;Rules:&lt;BR/&gt;{221.187.0.189:40318, 137.248.3.4:22}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 40318: (50%)&lt;BR/&gt; 22: (50%)&gt;];
}
819--820[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.3.4" dst_port="22" src_ip="221.187.0.189" src_port="40318"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_80{
style=filled;
color=gray75;
718[label="219.97.1.241;s;3pkt 3fpkt", shape=diamond, color=yellow];
843[label="143.50.21.178;d;3pkt 3fpkt", shape=diamond, color=yellow];
1472[label="219.97.1.241;s;3pkt 3fpkt", shape=hexagon, color=black];
stat80[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.97.1.241:80, 143.50.21.178:2458}[33.3333%]&lt;BR/&gt;{219.97.1.241:80, 143.50.21.178:2501}[33.3333%]&lt;BR/&gt;{219.97.1.241:80, 143.50.21.178:2503}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2503: (16.6667%)&lt;BR/&gt; 2501: (16.6667%)&lt;BR/&gt; 2458: (16.6667%)&gt;];
}
718--843[label="1;3pkt 3fpkt"];
718--1472[label="1;3pkt 3fpkt"];
843--1472[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="143.50.21.178" dst_port="2503" src_ip="219.97.1.241" src_port="80"/>
      <filter dst_ip="143.50.21.178" dst_port="2501" src_ip="219.97.1.241" src_port="80"/>
      <filter dst_ip="143.50.21.178" dst_port="2458" src_ip="219.97.1.241" src_port="80"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804118" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,501,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_81{
style=filled;
color=gray75;
850[label="207.90.154.158;s;42pkt 42fpkt", shape=diamond, color=yellow];
851[label="175.221.161.65;d;42pkt 42fpkt", shape=diamond, color=yellow];
1555[label="175.221.161.65;d;40pkt 40fpkt", shape=hexagon, color=black];
stat81[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.90.154.158:21, 175.221.161.65:*}[52.381%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (26.2097%)&lt;BR/&gt; 3398: (1.20968%)&lt;BR/&gt; 3397: (1.20968%)&lt;BR/&gt; 3396: (1.20968%)&lt;BR/&gt; 3395: (1.20968%)&gt;];
}
850--851[label="1;42pkt 42fpkt"];
850--1555[label="1;40pkt 40fpkt"];
851--1555[label="1;40pkt 40fpkt"];
</description>
    <slice>
      <filter dst_ip="175.221.161.65" src_ip="207.90.154.158" src_port="21"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677781,1.59484,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_82{
style=filled;
color=gray75;
329[label="209.209.193.2;d;27pkt 27fpkt", shape=diamond, color=yellow];
554[label="91.228.37.147;s;15pkt 15fpkt", shape=diamond, color=yellow];
856[label="91.228.37.207;s;9pkt 9fpkt", shape=diamond, color=yellow];
1380[label="91.228.37.147;s;8pkt 8fpkt", shape=hexagon, color=black];
1481[label="209.209.193.2;d;17pkt 17fpkt", shape=hexagon, color=black];
2531[label="91.228.37.207;11pkt 11fpkt", shape=pentagon, color=darkviolet];
stat82[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.228.37.147:80, 209.209.193.2:*}[55.5556%]&lt;BR/&gt;{91.228.37.207:80, 209.209.193.2:*}[44.4444%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2427: (2.29885%)&lt;BR/&gt; 2422: (2.29885%)&lt;BR/&gt; 2420: (2.29885%)&lt;BR/&gt; 2418: (2.29885%)&gt;];
}
329--554[label="1;15pkt 15fpkt"];
329--856[label="1;9pkt 9fpkt"];
329--1380[label="1;8pkt 8fpkt"];
329--1481[label="1;17pkt 17fpkt"];
329--2531[label="1;11pkt 11fpkt"];
554--1380[label="1;8pkt 8fpkt"];
554--1481[label="0.666667;10pkt 10fpkt"];
856--1481[label="0.777778;7pkt 7fpkt"];
856--2531[label="0.888889;8pkt 8fpkt"];
1380--1481[label="1;8pkt 8fpkt"];
1481--2531[label="0.545455;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="209.209.193.2" src_ip="91.228.37.147" src_port="80"/>
      <filter dst_ip="209.209.193.2" src_ip="91.228.37.207" src_port="80"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_83{
style=filled;
color=gray75;
749[label="169.38.74.177;d;1pkt 1fpkt", shape=diamond, color=yellow];
874[label="161.213.74.149;s;1pkt 1fpkt", shape=diamond, color=yellow];
1708[label="169.38.74.177;d;1pkt 1fpkt", shape=hexagon, color=black];
1709[label="161.213.74.149;s;1pkt 1fpkt", shape=hexagon, color=black];
stat83[shape=component, label=&lt;Rules:&lt;BR/&gt;{161.213.74.149:6699, 169.38.74.177:1173}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 1173: (50%)&gt;];
}
749--874[label="1;1pkt 1fpkt"];
749--1708[label="1;1pkt 1fpkt"];
749--1709[label="1;1pkt 1fpkt"];
874--1708[label="1;1pkt 1fpkt"];
874--1709[label="1;1pkt 1fpkt"];
1708--1709[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="169.38.74.177" dst_port="1173" src_ip="161.213.74.149" src_port="6699"/>
    </slice>
    <from sec="991803601" usec="0"/>
    <to sec="991804032" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.589116,1.67401,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_84{
style=filled;
color=gray75;
883[label="209.209.193.43;d;3pkt 3fpkt", shape=diamond, color=yellow];
884[label="50.68.8.180;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat84[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.140.146.123:8888, 209.209.193.43:1132}[33.3333%]&lt;BR/&gt;{50.68.8.180:6699, 209.209.193.43:3616}[33.3333%]&lt;BR/&gt;{134.6.137.220:8888, 209.209.193.43:1809}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8888: (25%)&lt;BR/&gt; 6699: (25%)&lt;BR/&gt; 3616: (25%)&lt;BR/&gt; 1809: (12.5%)&lt;BR/&gt; 1132: (12.5%)&gt;];
}
883--884[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="209.209.193.43" dst_port="1809" src_ip="134.6.137.220" src_port="8888"/>
      <filter dst_ip="209.209.193.43" dst_port="3616" src_ip="50.68.8.180" src_port="6699"/>
      <filter dst_ip="209.209.193.43" dst_port="1132" src_ip="206.140.146.123" src_port="8888"/>
    </slice>
    <from sec="991803601" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.533239,1.64144,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_85{
style=filled;
color=gray75;
894[label="208.147.100.17;d;12pkt 12fpkt", shape=diamond, color=yellow];
895[label="208.32.50.169;s;3pkt 3fpkt", shape=diamond, color=yellow];
2414[label="208.32.50.169;2pkt 2fpkt", shape=pentagon, color=darkviolet];
stat85[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.145.3.232:80, 208.147.100.17:*}[33.3333%]&lt;BR/&gt;{208.32.50.169:80, 208.147.100.17:*}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1433: (8.82353%)&lt;BR/&gt; 1430: (8.82353%)&lt;BR/&gt; 1432: (5.88235%)&lt;BR/&gt; 1454: (2.94118%)&gt;];
}
894--895[label="1;3pkt 3fpkt"];
894--2414[label="1;2pkt 2fpkt"];
895--2414[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="208.147.100.17" src_ip="204.145.3.232" src_port="80"/>
      <filter dst_ip="208.147.100.17" src_ip="208.32.50.169" src_port="80"/>
    </slice>
    <from sec="991803603" usec="0"/>
    <to sec="991804066" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.990447,1.59474,501,0 0 0 1 1 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_86{
style=filled;
color=gray75;
771[label="175.221.188.75;s;2pkt 2fpkt", shape=diamond, color=yellow];
915[label="208.217.129.206;d;1pkt 1fpkt", shape=diamond, color=yellow];
1502[label="175.221.188.75;s;2pkt 2fpkt", shape=hexagon, color=black];
2117[label="175.221.188.75;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2752[label="175.221.188.75;2pkt 2fpkt", shape=invtriangle, color=brown];
3037[label="175.221.188.75;2pkt 2fpkt", shape=invhouse, color=bisque];
stat86[shape=component, label=&lt;Rules:&lt;BR/&gt;{175.221.188.75:1411, 91.81.128.4:21}[50%]&lt;BR/&gt;{175.221.188.75:21, 208.217.129.206:64800}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (50%)&lt;BR/&gt; 64800: (27.2727%)&lt;BR/&gt; 1411: (22.7273%)&gt;];
}
771--915[label="1;1pkt 1fpkt"];
771--1502[label="1;2pkt 2fpkt"];
771--2117[label="1;2pkt 2fpkt"];
771--2752[label="1;2pkt 2fpkt"];
771--3037[label="1;2pkt 2fpkt"];
915--1502[label="1;1pkt 1fpkt"];
915--2117[label="1;1pkt 1fpkt"];
915--2752[label="1;1pkt 1fpkt"];
915--3037[label="1;1pkt 1fpkt"];
1502--2117[label="1;2pkt 2fpkt"];
1502--2752[label="1;2pkt 2fpkt"];
1502--3037[label="1;2pkt 2fpkt"];
2117--2752[label="1;2pkt 2fpkt"];
2117--3037[label="1;2pkt 2fpkt"];
2752--3037[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="208.217.129.206" dst_port="64800" src_ip="175.221.188.75" src_port="21"/>
      <filter dst_ip="91.81.128.4" dst_port="21" src_ip="175.221.188.75" src_port="1411"/>
    </slice>
    <from sec="991803612" usec="0"/>
    <to sec="991804229" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.589116,1.67401,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_87{
style=filled;
color=gray75;
919[label="137.248.20.199;s;278pkt 278fpkt", shape=diamond, color=yellow];
920[label="49.162.0.68;d;268pkt 268fpkt", shape=diamond, color=yellow];
stat87[shape=component, label=&lt;Rules:&lt;BR/&gt;{137.248.20.199:*, 49.162.0.68:80}[93.3566%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2153: (0.18315%)&lt;BR/&gt; 2152: (0.18315%)&lt;BR/&gt; 2151: (0.18315%)&lt;BR/&gt; 2150: (0.18315%)&gt;];
}
919--920[label="0.970149;260pkt 260fpkt"];
919--1827[label="0.0431655;12pkt 12fpkt"];
919--1838[label="0.0431655;12pkt 12fpkt"];
919--1846[label="0.0431655;12pkt 12fpkt"];
920--1827[label="0.00373134;1pkt 1fpkt"];
920--1838[label="0.00373134;1pkt 1fpkt"];
920--1846[label="0.00373134;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="49.162.0.68" dst_port="80" src_ip="137.248.20.199"/>
    </slice>
    <from sec="991803625" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_88{
style=filled;
color=gray75;
602[label="208.147.113.220;d;110pkt 110fpkt", shape=diamond, color=yellow];
927[label="208.37.225.51;s;45pkt 45fpkt", shape=diamond, color=yellow];
1655[label="208.147.113.220;d;110pkt 110fpkt", shape=hexagon, color=black];
stat88[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.37.225.51:80, 208.147.113.220:*}[40.9091%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1526: (0.754717%)&lt;BR/&gt; 1628: (0.566038%)&lt;BR/&gt; 1627: (0.566038%)&lt;BR/&gt; 1626: (0.566038%)&gt;];
}
602--927[label="1;45pkt 45fpkt"];
602--1655[label="1;110pkt 110fpkt"];
927--1655[label="1;45pkt 45fpkt"];
</description>
    <slice>
      <filter dst_ip="208.147.113.220" src_ip="208.37.225.51" src_port="80"/>
    </slice>
    <from sec="991803613" usec="0"/>
    <to sec="991804063" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.589116,1.67401,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_90{
style=filled;
color=gray75;
811[label="143.50.32.242;d;142pkt 142fpkt", shape=diamond, color=yellow];
954[label="91.59.22.143;s;110pkt 110fpkt", shape=diamond, color=yellow];
stat90[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.59.22.143:80, 143.50.32.242:*}[77.4648%]&lt;BR/&gt;{91.60.20.110:80, 143.50.32.242:*}[21.1268%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1418: (0.396825%)&lt;BR/&gt; 1417: (0.396825%)&lt;BR/&gt; 1416: (0.396825%)&lt;BR/&gt; 1415: (0.396825%)&gt;];
}
811--954[label="1;110pkt 110fpkt"];
</description>
    <slice>
      <filter dst_ip="143.50.32.242" src_ip="91.59.22.143" src_port="80"/>
      <filter dst_ip="143.50.32.242" src_ip="91.60.20.110" src_port="80"/>
    </slice>
    <from sec="991803840" usec="0"/>
    <to sec="991804157" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_91{
style=filled;
color=gray75;
940[label="137.248.52.5;s;18pkt 18fpkt", shape=diamond, color=yellow];
955[label="207.164.68.187;d;18pkt 18fpkt", shape=diamond, color=yellow];
1671[label="137.248.52.5;s;18pkt 18fpkt", shape=hexagon, color=black];
stat91[shape=component, label=&lt;Rules:&lt;BR/&gt;{137.248.52.5:*, 207.164.68.187:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1851: (2.77778%)&lt;BR/&gt; 1850: (2.77778%)&lt;BR/&gt; 1848: (2.77778%)&lt;BR/&gt; 1846: (2.77778%)&gt;];
}
940--955[label="1;18pkt 18fpkt"];
940--1671[label="1;18pkt 18fpkt"];
955--1671[label="1;18pkt 18fpkt"];
</description>
    <slice>
      <filter dst_ip="207.164.68.187" dst_port="80" src_ip="137.248.52.5"/>
    </slice>
    <from sec="991803755" usec="0"/>
    <to sec="991804153" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_92{
style=filled;
color=gray75;
964[label="214.138.54.161;s;4pkt 4fpkt", shape=diamond, color=yellow];
965[label="151.144.168.176;d;3pkt 3fpkt", shape=diamond, color=yellow];
1679[label="151.144.168.176;d;3pkt 3fpkt", shape=hexagon, color=black];
stat92[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.138.54.161:80, 151.144.168.176:1132}[25%]&lt;BR/&gt;{214.138.54.161:80, 151.144.168.176:1140}[25%]&lt;BR/&gt;{214.138.54.161:80, 151.144.168.176:1141}[25%]&lt;BR/&gt;{214.138.54.161:80, 151.144.168.176:1142}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1142: (15%)&lt;BR/&gt; 1141: (15%)&lt;BR/&gt; 1140: (15%)&lt;BR/&gt; 1132: (5%)&gt;];
}
964--965[label="1;3pkt 3fpkt"];
964--1679[label="1;3pkt 3fpkt"];
965--1679[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="151.144.168.176" dst_port="1142" src_ip="214.138.54.161" src_port="80"/>
      <filter dst_ip="151.144.168.176" dst_port="1141" src_ip="214.138.54.161" src_port="80"/>
      <filter dst_ip="151.144.168.176" dst_port="1140" src_ip="214.138.54.161" src_port="80"/>
      <filter dst_ip="151.144.168.176" dst_port="1132" src_ip="214.138.54.161" src_port="80"/>
    </slice>
    <from sec="991803921" usec="0"/>
    <to sec="991803967" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.589116,1.67401,502,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_93{
style=filled;
color=gray75;
968[label="137.248.3.4;s;1pkt 1fpkt", shape=diamond, color=yellow];
969[label="221.187.0.189;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat93[shape=component, label=&lt;Rules:&lt;BR/&gt;{137.248.3.4:22, 221.187.0.189:40318}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 40318: (50%)&lt;BR/&gt; 22: (50%)&gt;];
}
968--969[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="221.187.0.189" dst_port="40318" src_ip="137.248.3.4" src_port="22"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.589116,1.67401,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="143.167.242.181"/>
      <from sec="991803600" usec="0"/>
      <to sec="991804158" usec="0"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.589116,1.67401,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="143.39.16.212"/>
      <from sec="991803601" usec="0"/>
      <to sec="991804157" usec="0"/>
    </slice>
    <from sec="991803601" usec="0"/>
    <to sec="991804157" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.589116,1.67401,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="143.50.204.128"/>
      <from sec="991803926" usec="0"/>
      <to sec="991804079" usec="0"/>
    </slice>
    <from sec="991803926" usec="0"/>
    <to sec="991804079" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_98{
style=filled;
color=gray75;
1097[label="137.248.157.94;d;16pkt 16fpkt", shape=diamond, color=yellow];
1098[label="204.138.22.36;s;16pkt 16fpkt", shape=diamond, color=yellow];
1741[label="137.248.157.94;d;16pkt 16fpkt", shape=hexagon, color=black];
1742[label="204.138.22.36;s;16pkt 16fpkt", shape=hexagon, color=black];
stat98[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.138.22.36:*, 137.248.157.94:6970}[37.5%]&lt;BR/&gt;{204.138.22.36:554, 137.248.157.94:*}[37.5%]&lt;BR/&gt;{204.138.22.36:*, 137.248.157.94:6974}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6970: (18.75%)&lt;BR/&gt; 554: (18.75%)&lt;BR/&gt; 6974: (12.5%)&lt;BR/&gt; 31480: (3.125%)&lt;BR/&gt; 30434: (3.125%)&gt;];
}
1097--1098[label="1;16pkt 16fpkt"];
1097--1741[label="1;16pkt 16fpkt"];
1097--1742[label="1;16pkt 16fpkt"];
1098--1741[label="1;16pkt 16fpkt"];
1098--1742[label="1;16pkt 16fpkt"];
1741--1742[label="1;16pkt 16fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.157.94" src_ip="204.138.22.36" src_port="554"/>
      <filter dst_ip="137.248.157.94" dst_port="6970" src_ip="204.138.22.36"/>
      <filter dst_ip="137.248.157.94" dst_port="6974" src_ip="204.138.22.36"/>
    </slice>
    <from sec="991803947" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_99{
style=filled;
color=gray75;
663[label="137.248.198.169;s;12pkt 12fpkt", shape=diamond, color=yellow];
1114[label="172.192.221.199;d;1pkt 1fpkt", shape=diamond, color=yellow];
1424[label="137.248.198.169;s;7pkt 7fpkt", shape=hexagon, color=black];
stat99[shape=component, label=&lt;Rules:&lt;BR/&gt;{137.248.198.169:0, *:0}[50%]&lt;BR/&gt;{137.248.198.169:*, *:6699}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (50%)&lt;BR/&gt; 6699: (15%)&lt;BR/&gt; 8888: (5%)&lt;BR/&gt; 1595: (5%)&lt;BR/&gt; 1571: (5%)&gt;];
}
663--1114[label="1;1pkt 1fpkt"];
663--1424[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_port="6699" src_ip="137.248.198.169"/>
      <filter src_ip="137.248.198.169"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.665151,1.63004,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_100{
style=filled;
color=gray75;
1115[label="206.209.101.238;s;5pkt 5fpkt", shape=diamond, color=yellow];
1116[label="137.248.19.162;d;5pkt 5fpkt", shape=diamond, color=yellow];
2595[label="206.209.101.238;4pkt 4fpkt", shape=pentagon, color=darkviolet];
2968[label="206.209.101.238;5pkt 5fpkt", shape=invtriangle, color=brown];
stat100[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.209.101.238:80, 137.248.19.162:1129}[20%]&lt;BR/&gt;{206.209.101.238:80, 137.248.19.162:1130}[20%]&lt;BR/&gt;{206.209.101.238:80, 137.248.19.162:1131}[20%]&lt;BR/&gt;{206.209.101.238:80, 137.248.19.162:1132}[20%]&lt;BR/&gt;{206.209.101.238:80, 137.248.19.162:1133}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1133: (10.5263%)&lt;BR/&gt; 1132: (10.5263%)&lt;BR/&gt; 1131: (10.5263%)&lt;BR/&gt; 1130: (10.5263%)&gt;];
}
1115--1116[label="1;5pkt 5fpkt"];
1115--2595[label="1;4pkt 4fpkt"];
1115--2968[label="1;5pkt 5fpkt"];
1116--2595[label="1;4pkt 4fpkt"];
1116--2968[label="1;5pkt 5fpkt"];
2595--2968[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.19.162" dst_port="1133" src_ip="206.209.101.238" src_port="80"/>
      <filter dst_ip="137.248.19.162" dst_port="1132" src_ip="206.209.101.238" src_port="80"/>
      <filter dst_ip="137.248.19.162" dst_port="1131" src_ip="206.209.101.238" src_port="80"/>
      <filter dst_ip="137.248.19.162" dst_port="1130" src_ip="206.209.101.238" src_port="80"/>
      <filter dst_ip="137.248.19.162" dst_port="1129" src_ip="206.209.101.238" src_port="80"/>
    </slice>
    <from sec="991804017" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.589116,1.67401,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_101{
style=filled;
color=gray75;
1120[label="151.144.152.67;s;2pkt 2fpkt", shape=diamond, color=yellow];
1121[label="203.148.237.212;d;2pkt 2fpkt", shape=diamond, color=yellow];
stat101[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.144.152.67:1177, 203.148.237.212:554}[50%]&lt;BR/&gt;{151.144.152.67:6972, 203.148.237.212:9766}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9766: (25%)&lt;BR/&gt; 6972: (25%)&lt;BR/&gt; 1177: (25%)&lt;BR/&gt; 554: (25%)&gt;];
}
1120--1121[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="203.148.237.212" dst_port="9766" src_ip="151.144.152.67" src_port="6972"/>
      <filter dst_ip="203.148.237.212" dst_port="554" src_ip="151.144.152.67" src_port="1177"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.589116,1.67401,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_102{
style=filled;
color=gray75;
1124[label="151.144.77.180;s;2pkt 2fpkt", shape=diamond, color=yellow];
1125[label="91.61.21.200;d;2pkt 2fpkt", shape=diamond, color=yellow];
stat102[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.144.77.180:1267, 91.61.21.200:554}[50%]&lt;BR/&gt;{151.144.77.180:6970, 91.61.21.200:11442}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 11442: (25%)&lt;BR/&gt; 6970: (25%)&lt;BR/&gt; 1267: (25%)&lt;BR/&gt; 554: (25%)&gt;];
}
1124--1125[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="91.61.21.200" dst_port="11442" src_ip="151.144.77.180" src_port="6970"/>
      <filter dst_ip="91.61.21.200" dst_port="554" src_ip="151.144.77.180" src_port="1267"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677781,1.59484,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_103{
style=filled;
color=gray75;
993[label="17.33.246.165;d;33pkt 33fpkt", shape=diamond, color=yellow];
1130[label="151.144.79.72;s;38pkt 38fpkt", shape=diamond, color=yellow];
1701[label="17.33.246.165;d;33pkt 33fpkt", shape=hexagon, color=black];
2106[label="151.144.79.72;39pkt 39fpkt", shape=pentagon, color=darkviolet];
stat103[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.144.79.72:*, 17.33.246.165:3821}[85%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3821: (45.4545%)&lt;BR/&gt; 80: (3.14685%)&lt;BR/&gt; 2573: (1.3986%)&lt;BR/&gt; 2572: (1.3986%)&lt;BR/&gt; 2571: (1.3986%)&gt;];
}
993--1130[label="1;33pkt 33fpkt"];
993--1701[label="1;33pkt 33fpkt"];
993--2106[label="1;33pkt 33fpkt"];
1130--1701[label="1;33pkt 33fpkt"];
1130--2106[label="0.973684;37pkt 37fpkt"];
1701--2106[label="1;33pkt 33fpkt"];
</description>
    <slice>
      <filter dst_ip="17.33.246.165" dst_port="3821" src_ip="151.144.79.72"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.589116,1.67401,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="207.141.149.17"/>
      <from sec="991803600" usec="0"/>
      <to sec="991804157" usec="0"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804157" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.589116,1.67401,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="208.152.161.168"/>
      <from sec="991803600" usec="0"/>
      <to sec="991804158" usec="0"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.589116,1.67401,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_106{
style=filled;
color=gray75;
1015[label="208.152.138.177;s;10pkt 10fpkt", shape=diamond, color=yellow];
1140[label="91.104.23.241;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat106[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.152.138.177:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1015--1140[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="208.152.138.177"/>
    </slice>
    <from sec="991803601" usec="0"/>
    <to sec="991804157" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.589116,1.67401,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_107{
style=filled;
color=gray75;
1145[label="143.39.9.46;d;2pkt 2fpkt", shape=diamond, color=yellow];
1146[label="203.233.180.101;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat107[shape=component, label=&lt;Rules:&lt;BR/&gt;{137.224.108.76:1214, 143.39.9.46:2172}[50%]&lt;BR/&gt;{203.233.180.101:1214, 143.39.9.46:2200}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1214: (50%)&lt;BR/&gt; 2200: (33.3333%)&lt;BR/&gt; 2172: (16.6667%)&gt;];
}
1145--1146[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="143.39.9.46" dst_port="2200" src_ip="203.233.180.101" src_port="1214"/>
      <filter dst_ip="143.39.9.46" dst_port="2172" src_ip="137.224.108.76" src_port="1214"/>
    </slice>
    <from sec="991803601" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677781,1.59484,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_108{
style=filled;
color=gray75;
1027[label="169.38.16.133;d;4pkt 4fpkt", shape=diamond, color=yellow];
1150[label="207.174.2.114;s;1pkt 1fpkt", shape=diamond, color=yellow];
1714[label="169.38.16.133;d;4pkt 4fpkt", shape=hexagon, color=black];
2242[label="207.174.2.114;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat108[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.140.146.13:8888, 169.38.16.133:1038}[25%]&lt;BR/&gt;{207.174.2.114:6699, 169.38.16.133:1076}[25%]&lt;BR/&gt;{17.202.134.222:0, 169.38.16.133:0}[25%]&lt;BR/&gt;{211.44.160.227:0, 169.38.16.133:0}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (40%)&lt;BR/&gt; 6699: (20%)&lt;BR/&gt; 1076: (20%)&lt;BR/&gt; 8888: (10%)&lt;BR/&gt; 1038: (10%)&gt;];
}
1027--1150[label="1;1pkt 1fpkt"];
1027--1714[label="1;4pkt 4fpkt"];
1027--2242[label="1;1pkt 1fpkt"];
1150--1714[label="1;1pkt 1fpkt"];
1150--2242[label="1;1pkt 1fpkt"];
1714--2242[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="169.38.16.133" src_ip="211.44.160.227"/>
      <filter dst_ip="169.38.16.133" src_ip="17.202.134.222"/>
      <filter dst_ip="169.38.16.133" dst_port="1076" src_ip="207.174.2.114" src_port="6699"/>
      <filter dst_ip="169.38.16.133" dst_port="1038" src_ip="206.140.146.13" src_port="8888"/>
    </slice>
    <from sec="991803602" usec="0"/>
    <to sec="991804227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677781,1.59484,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_109{
style=filled;
color=gray75;
222[label="209.209.213.25;s;244pkt 244fpkt", shape=diamond, color=yellow];
406[label="209.209.213.24;s;307pkt 307fpkt", shape=diamond, color=yellow];
412[label="215.71.204.71;d;2pkt 2fpkt", shape=diamond, color=yellow];
684[label="209.209.213.70;s;12pkt 12fpkt", shape=diamond, color=yellow];
825[label="207.41.103.77;d;3pkt 3fpkt", shape=diamond, color=yellow];
1159[label="206.182.59.215;d;170pkt 170fpkt", shape=diamond, color=yellow];
1165[label="195.236.167.201;d;140pkt 140fpkt", shape=diamond, color=yellow];
1433[label="209.209.213.24;s;169pkt 169fpkt", shape=hexagon, color=black];
1948[label="209.209.213.24;7pkt 7fpkt", shape=pentagon, color=darkviolet];
stat109[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, *:113}[34.2756%]&lt;BR/&gt;{*:*, 206.182.59.215:*}[30.212%]&lt;BR/&gt;{209.209.213.24:*, 195.236.167.201:*}[24.735%]&lt;BR/&gt;{209.209.213.24:6667, *:*}[24.0283%]&lt;BR/&gt;{209.209.213.25:6667, *:*}[20.6714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (22.3435%)&lt;BR/&gt; 113: (16.0342%)&lt;BR/&gt; 1080: (9.34535%)&lt;BR/&gt; 0: (1.2334%)&lt;BR/&gt; 6663: (0.379507%)&gt;];
}
222--412[label="1;2pkt 2fpkt"];
222--825[label="0.666667;2pkt 2fpkt"];
222--1159[label="0.388235;66pkt 66fpkt"];
406--1159[label="0.611765;104pkt 104fpkt"];
406--1165[label="1;140pkt 140fpkt"];
406--1433[label="1;169pkt 169fpkt"];
406--1948[label="0.571429;4pkt 4fpkt"];
684--825[label="0.333333;1pkt 1fpkt"];
1159--1433[label="0.331361;56pkt 56fpkt"];
1165--1433[label="0.542857;76pkt 76fpkt"];
1433--1948[label="0.571429;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="206.182.59.215"/>
      <filter dst_port="113"/>
      <filter dst_ip="195.236.167.201" src_ip="209.209.213.24"/>
      <filter src_ip="209.209.213.24" src_port="6667"/>
      <filter src_ip="209.209.213.25" src_port="6667"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_110{
style=filled;
color=gray75;
1170[label="91.173.207.219;s;40pkt 40fpkt", shape=diamond, color=yellow];
1171[label="169.41.70.99;d;40pkt 40fpkt", shape=diamond, color=yellow];
1723[label="91.173.207.219;s;40pkt 40fpkt", shape=hexagon, color=black];
stat110[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.173.207.219:80, 169.41.70.99:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 49373: (1.25%)&lt;BR/&gt; 49372: (1.25%)&lt;BR/&gt; 49371: (1.25%)&lt;BR/&gt; 49370: (1.25%)&gt;];
}
1170--1171[label="1;40pkt 40fpkt"];
1170--1723[label="1;40pkt 40fpkt"];
1171--1723[label="1;40pkt 40fpkt"];
</description>
    <slice>
      <filter dst_ip="169.41.70.99" src_ip="91.173.207.219" src_port="80"/>
    </slice>
    <from sec="991803612" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.589116,1.67401,501,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_111{
style=filled;
color=gray75;
1169[label="175.221.188.75;d;2pkt 2fpkt", shape=diamond, color=yellow];
1181[label="208.217.129.206;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat111[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.81.128.4:21, 175.221.188.75:1411}[50%]&lt;BR/&gt;{208.217.129.206:64800, 175.221.188.75:21}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (50%)&lt;BR/&gt; 64800: (33.3333%)&lt;BR/&gt; 1411: (16.6667%)&gt;];
}
1169--1181[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="175.221.188.75" dst_port="21" src_ip="208.217.129.206" src_port="64800"/>
      <filter dst_ip="175.221.188.75" dst_port="1411" src_ip="91.81.128.4" src_port="21"/>
    </slice>
    <from sec="991803612" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.589116,1.67401,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="169.41.86.32"/>
      <from sec="991803881" usec="0"/>
      <to sec="991804158" usec="0"/>
    </slice>
    <from sec="991803881" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.665151,1.63004,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_113{
style=filled;
color=gray75;
1093[label="143.50.204.128;d;8pkt 8fpkt", shape=diamond, color=yellow];
1228[label="207.164.73.56;s;4pkt 4fpkt", shape=diamond, color=yellow];
2050[label="207.164.73.56;4pkt 4fpkt", shape=pentagon, color=darkviolet];
2719[label="207.164.73.56;4pkt 4fpkt", shape=invtriangle, color=brown];
stat113[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.164.73.56:80, 143.50.204.128:*}[50%]&lt;BR/&gt;{207.53.196.74:80, 143.50.204.128:*}[25%]&lt;BR/&gt;{204.104.60.111:110, 143.50.204.128:*}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (45%)&lt;BR/&gt; 1441: (10%)&lt;BR/&gt; 1440: (10%)&lt;BR/&gt; 1439: (10%)&lt;BR/&gt; 1438: (10%)&gt;];
}
1093--1228[label="1;4pkt 4fpkt"];
1093--2050[label="1;4pkt 4fpkt"];
1093--2719[label="1;4pkt 4fpkt"];
1228--2050[label="1;4pkt 4fpkt"];
1228--2719[label="1;4pkt 4fpkt"];
2050--2719[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="143.50.204.128" src_ip="207.164.73.56" src_port="80"/>
      <filter dst_ip="143.50.204.128" src_ip="204.104.60.111" src_port="110"/>
      <filter dst_ip="143.50.204.128" src_ip="207.53.196.74" src_port="80"/>
    </slice>
    <from sec="991803926" usec="0"/>
    <to sec="991804079" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.990447,1.59474,503,0 0 0 1 1 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_114{
style=filled;
color=gray75;
1232[label="206.209.101.238;d;5pkt 5fpkt", shape=diamond, color=yellow];
1233[label="137.248.19.162;s;5pkt 5fpkt", shape=diamond, color=yellow];
1747[label="206.209.101.238;d;5pkt 5fpkt", shape=hexagon, color=black];
2386[label="137.248.19.162;5pkt 5fpkt", shape=pentagon, color=darkviolet];
2877[label="137.248.19.162;4pkt 4fpkt", shape=invtriangle, color=brown];
3099[label="137.248.19.162;5pkt 5fpkt", shape=invhouse, color=bisque];
stat114[shape=component, label=&lt;Rules:&lt;BR/&gt;{137.248.19.162:1129, 206.209.101.238:80}[20%]&lt;BR/&gt;{137.248.19.162:1130, 206.209.101.238:80}[20%]&lt;BR/&gt;{137.248.19.162:1131, 206.209.101.238:80}[20%]&lt;BR/&gt;{137.248.19.162:1132, 206.209.101.238:80}[20%]&lt;BR/&gt;{137.248.19.162:1133, 206.209.101.238:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1133: (10.3448%)&lt;BR/&gt; 1132: (10.3448%)&lt;BR/&gt; 1131: (10.3448%)&lt;BR/&gt; 1130: (10.3448%)&gt;];
}
1232--1233[label="1;5pkt 5fpkt"];
1232--1747[label="1;5pkt 5fpkt"];
1232--2386[label="1;5pkt 5fpkt"];
1232--2877[label="1;4pkt 4fpkt"];
1232--3099[label="1;5pkt 5fpkt"];
1233--1747[label="1;5pkt 5fpkt"];
1233--2386[label="1;5pkt 5fpkt"];
1233--2877[label="1;4pkt 4fpkt"];
1233--3099[label="1;5pkt 5fpkt"];
1747--2386[label="1;5pkt 5fpkt"];
1747--2877[label="1;4pkt 4fpkt"];
1747--3099[label="1;5pkt 5fpkt"];
2386--2877[label="1;4pkt 4fpkt"];
2386--3099[label="1;5pkt 5fpkt"];
2877--3099[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="206.209.101.238" dst_port="80" src_ip="137.248.19.162" src_port="1133"/>
      <filter dst_ip="206.209.101.238" dst_port="80" src_ip="137.248.19.162" src_port="1132"/>
      <filter dst_ip="206.209.101.238" dst_port="80" src_ip="137.248.19.162" src_port="1131"/>
      <filter dst_ip="206.209.101.238" dst_port="80" src_ip="137.248.19.162" src_port="1130"/>
      <filter dst_ip="206.209.101.238" dst_port="80" src_ip="137.248.19.162" src_port="1129"/>
    </slice>
    <from sec="991804017" usec="0"/>
    <to sec="991804194" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.897743,1.64135,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_115{
style=filled;
color=gray75;
1217[label="169.38.52.80;d;59pkt 59fpkt", shape=diamond, color=yellow];
1239[label="148.247.184.205;s;2pkt 2fpkt", shape=diamond, color=yellow];
2524[label="148.247.184.205;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2937[label="148.247.184.205;1pkt 1fpkt", shape=invtriangle, color=brown];
3126[label="148.247.184.205;1pkt 1fpkt", shape=invhouse, color=bisque];
stat115[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 169.38.52.80:0}[93.2203%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (87.5%)&lt;BR/&gt; 6699: (4.6875%)&lt;BR/&gt; 1387: (3.90625%)&lt;BR/&gt; 8888: (0.78125%)&lt;BR/&gt; 8875: (0.78125%)&gt;];
}
1217--1239[label="1;2pkt 2fpkt"];
1217--2524[label="1;1pkt 1fpkt"];
1217--2937[label="1;1pkt 1fpkt"];
1217--3126[label="1;1pkt 1fpkt"];
1239--2524[label="1;1pkt 1fpkt"];
1239--2937[label="1;1pkt 1fpkt"];
1239--3126[label="1;1pkt 1fpkt"];
2524--2937[label="1;1pkt 1fpkt"];
2524--3126[label="1;1pkt 1fpkt"];
2937--3126[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="169.38.52.80"/>
    </slice>
    <from sec="991803943" usec="0"/>
    <to sec="991804159" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677781,1.59484,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_116{
style=filled;
color=gray75;
255[label="208.37.217.70;s;138pkt 138fpkt", shape=diamond, color=yellow];
441[label="208.147.100.138;d;149pkt 149fpkt", shape=diamond, color=yellow];
1287[label="208.37.217.70;s;119pkt 119fpkt", shape=hexagon, color=black];
1595[label="208.147.100.138;d;149pkt 149fpkt", shape=hexagon, color=black];
2099[label="208.37.217.70;147pkt 147fpkt", shape=pentagon, color=darkviolet];
stat116[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.37.217.70:80, 208.147.100.138:*}[82.4859%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.359%)&lt;BR/&gt; 0: (0.712251%)&lt;BR/&gt; 2819: (0.356125%)&lt;BR/&gt; 2818: (0.356125%)&lt;BR/&gt; 2817: (0.356125%)&gt;];
}
255--441[label="0.862319;119pkt 119fpkt"];
255--1287[label="1;119pkt 119fpkt"];
255--1595[label="0.862319;119pkt 119fpkt"];
255--2099[label="1;138pkt 138fpkt"];
441--1287[label="1;119pkt 119fpkt"];
441--1595[label="1;149pkt 149fpkt"];
441--2099[label="0.809524;119pkt 119fpkt"];
1287--1595[label="1;119pkt 119fpkt"];
1287--2099[label="1;119pkt 119fpkt"];
1595--2099[label="0.809524;119pkt 119fpkt"];
</description>
    <slice>
      <filter dst_ip="208.147.100.138" src_ip="208.37.217.70" src_port="80"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.656395,1.67758,999,0 0 0 0 1 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="10.2.2.25"/>
      <from sec="991803932" usec="0"/>
      <to sec="991804126" usec="0"/>
    </slice>
    <from sec="991803932" usec="0"/>
    <to sec="991804126" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.656395,1.67758,999,0 0 0 0 1 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="10.1.2.25"/>
      <from sec="991803932" usec="0"/>
      <to sec="991804126" usec="0"/>
    </slice>
    <from sec="991803932" usec="0"/>
    <to sec="991804126" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677781,1.59484,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_121{
style=filled;
color=gray75;
196[label="151.144.111.46;s;18pkt 18fpkt", shape=diamond, color=yellow];
466[label="207.114.103.199;d;1pkt 1fpkt", shape=diamond, color=yellow];
668[label="17.73.221.159;d;1pkt 1fpkt", shape=diamond, color=yellow];
1354[label="207.114.103.199;d;1pkt 1fpkt", shape=hexagon, color=black];
2027[label="151.144.111.46;3pkt 3fpkt", shape=pentagon, color=darkviolet];
stat121[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.144.111.46:0, *:0}[33.3333%]&lt;BR/&gt;{151.144.111.46:21, *:*}[27.7778%]&lt;BR/&gt;{151.144.111.46:*, 209.27.10.234:*}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (25%)&lt;BR/&gt; 21: (10.4167%)&lt;BR/&gt; 49373: (8.33333%)&lt;BR/&gt; 20: (8.33333%)&lt;BR/&gt; 53803: (6.25%)&gt;];
}
196--466[label="1;1pkt 1fpkt"];
196--668[label="1;1pkt 1fpkt"];
196--1354[label="1;1pkt 1fpkt"];
196--2027[label="1;3pkt 3fpkt"];
466--1354[label="1;1pkt 1fpkt"];
466--2027[label="1;1pkt 1fpkt"];
668--2027[label="1;1pkt 1fpkt"];
1354--2027[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="209.27.10.234" src_ip="151.144.111.46"/>
      <filter src_ip="151.144.111.46" src_port="21"/>
      <filter src_ip="151.144.111.46"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677781,1.59484,501,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_122{
style=filled;
color=gray75;
567[label="175.221.162.160;d;87pkt 87fpkt", shape=diamond, color=yellow];
568[label="207.136.99.33;s;82pkt 82fpkt", shape=diamond, color=yellow];
1387[label="175.221.162.160;d;61pkt 61fpkt", shape=hexagon, color=black];
1980[label="207.136.99.33;84pkt 84fpkt", shape=pentagon, color=darkviolet];
stat122[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.136.99.33:21, 175.221.162.160:*}[94.2529%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (47.9299%)&lt;BR/&gt; 20: (2.07006%)&lt;BR/&gt; 1563: (0.636943%)&lt;BR/&gt; 1562: (0.636943%)&lt;BR/&gt; 1561: (0.636943%)&gt;];
}
567--568[label="1;82pkt 82fpkt"];
567--1387[label="1;61pkt 61fpkt"];
567--1980[label="1;84pkt 84fpkt"];
568--1387[label="1;61pkt 61fpkt"];
568--1980[label="0.987805;81pkt 81fpkt"];
1387--1980[label="0.983607;60pkt 60fpkt"];
</description>
    <slice>
      <filter dst_ip="175.221.162.160" src_ip="207.136.99.33" src_port="21"/>
    </slice>
    <from sec="991803602" usec="0"/>
    <to sec="991804161" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677781,1.59484,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_124{
style=filled;
color=gray75;
414[label="208.147.112.103;s;93pkt 93fpkt", shape=diamond, color=yellow];
646[label="195.254.175.192;d;80pkt 80fpkt", shape=diamond, color=yellow];
1342[label="208.147.112.103;s;92pkt 92fpkt", shape=hexagon, color=black];
1411[label="195.254.175.192;d;80pkt 80fpkt", shape=hexagon, color=black];
2226[label="208.147.112.103;93pkt 93fpkt", shape=pentagon, color=darkviolet];
stat124[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.147.112.103:*, 195.254.175.192:80}[86.0215%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2187: (0.570776%)&lt;BR/&gt; 2186: (0.570776%)&lt;BR/&gt; 2185: (0.570776%)&lt;BR/&gt; 2184: (0.570776%)&gt;];
}
414--646[label="1;80pkt 80fpkt"];
414--1342[label="1;92pkt 92fpkt"];
414--1411[label="1;80pkt 80fpkt"];
414--1827[label="0.0322581;3pkt 3fpkt"];
414--1838[label="0.0322581;3pkt 3fpkt"];
414--1846[label="0.0322581;3pkt 3fpkt"];
414--2226[label="1;93pkt 93fpkt"];
646--1342[label="1;80pkt 80fpkt"];
646--1411[label="1;80pkt 80fpkt"];
646--2226[label="1;80pkt 80fpkt"];
1342--1411[label="1;80pkt 80fpkt"];
1342--1827[label="0.0326087;3pkt 3fpkt"];
1342--1838[label="0.0326087;3pkt 3fpkt"];
1342--1846[label="0.0326087;3pkt 3fpkt"];
1342--2226[label="1;92pkt 92fpkt"];
1411--2226[label="1;80pkt 80fpkt"];
</description>
    <slice>
      <filter dst_ip="195.254.175.192" dst_port="80" src_ip="208.147.112.103"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804155" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_127{
style=filled;
color=gray75;
482[label="49.50.252.135;d;1pkt 1fpkt", shape=diamond, color=yellow];
700[label="137.248.192.56;s;19pkt 19fpkt", shape=diamond, color=yellow];
1454[label="49.50.252.135;d;1pkt 1fpkt", shape=hexagon, color=black];
1455[label="137.248.192.56;s;19pkt 19fpkt", shape=hexagon, color=black];
stat127[shape=component, label=&lt;Rules:&lt;BR/&gt;{137.248.192.56:*, 161.41.23.64:520}[42.1053%]&lt;BR/&gt;{137.248.192.56:520, *:520}[21.0526%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 520: (37.5%)&lt;BR/&gt; 80: (7.5%)&lt;BR/&gt; 6699: (5%)&lt;BR/&gt; 1248: (5%)&lt;BR/&gt; 525: (5%)&gt;];
}
482--700[label="1;1pkt 1fpkt"];
482--1454[label="1;1pkt 1fpkt"];
482--1455[label="1;1pkt 1fpkt"];
700--902[label="0.0526316;1pkt 1fpkt"];
700--1454[label="1;1pkt 1fpkt"];
700--1455[label="1;19pkt 19fpkt"];
1454--1455[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="161.41.23.64" dst_port="520" src_ip="137.248.192.56"/>
      <filter dst_port="520" src_ip="137.248.192.56" src_port="520"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677781,1.59484,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_128{
style=filled;
color=gray75;
302[label="137.248.19.19;d;27pkt 27fpkt", shape=diamond, color=yellow];
303[label="218.38.65.185;s;2pkt 2fpkt", shape=diamond, color=yellow];
1461[label="137.248.19.19;d;21pkt 21fpkt", shape=hexagon, color=black];
1462[label="218.38.65.185;s;2pkt 2fpkt", shape=hexagon, color=black];
2214[label="202.162.109.99;12pkt 12fpkt", shape=pentagon, color=darkviolet];
2461[label="218.38.65.185;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat128[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.162.109.99:80, 137.248.19.19:*}[44.4444%]&lt;BR/&gt;{219.136.35.47:80, 137.248.19.19:*}[29.6296%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (41.5385%)&lt;BR/&gt; 1755: (3.84615%)&lt;BR/&gt; 1167: (3.84615%)&lt;BR/&gt; 2910: (3.07692%)&lt;BR/&gt; 1171: (3.07692%)&gt;];
}
302--303[label="1;2pkt 2fpkt"];
302--1461[label="1;21pkt 21fpkt"];
302--1462[label="1;2pkt 2fpkt"];
302--2214[label="1;12pkt 12fpkt"];
302--2461[label="1;1pkt 1fpkt"];
303--1461[label="1;2pkt 2fpkt"];
303--1462[label="1;2pkt 2fpkt"];
303--2461[label="1;1pkt 1fpkt"];
1461--1462[label="1;2pkt 2fpkt"];
1461--2214[label="0.75;9pkt 9fpkt"];
1461--2461[label="1;1pkt 1fpkt"];
1462--2461[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.19.19" src_ip="202.162.109.99" src_port="80"/>
      <filter dst_ip="137.248.19.19" src_ip="219.136.35.47" src_port="80"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_129{
style=filled;
color=gray75;
722[label="151.144.79.72;d;32pkt 32fpkt", shape=diamond, color=yellow];
723[label="17.33.246.165;s;33pkt 33fpkt", shape=diamond, color=yellow];
1473[label="151.144.79.72;d;22pkt 22fpkt", shape=hexagon, color=black];
stat129[shape=component, label=&lt;Rules:&lt;BR/&gt;{17.33.246.165:3821, 151.144.79.72:*}[82.0513%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3821: (43.6782%)&lt;BR/&gt; 80: (4.5977%)&lt;BR/&gt; 2546: (1.72414%)&lt;BR/&gt; 2545: (1.72414%)&lt;BR/&gt; 2544: (1.72414%)&gt;];
}
722--723[label="0.8125;26pkt 26fpkt"];
722--1473[label="1;22pkt 22fpkt"];
723--1473[label="0.909091;20pkt 20fpkt"];
</description>
    <slice>
      <filter dst_ip="151.144.79.72" src_ip="17.33.246.165" src_port="3821"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,504,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_130{
style=filled;
color=gray75;
445[label="143.50.72.130;d;6pkt 6fpkt", shape=diamond, color=yellow];
731[label="195.73.57.158;s;1pkt 1fpkt", shape=diamond, color=yellow];
974[label="207.136.99.158;s;1pkt 1fpkt", shape=diamond, color=yellow];
1479[label="195.73.57.158;s;1pkt 1fpkt", shape=hexagon, color=black];
1538[label="143.50.72.130;d;4pkt 4fpkt", shape=hexagon, color=black];
stat130[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:443, 143.50.72.130:1814}[28.5714%]&lt;BR/&gt;{91.151.69.99:443, 143.50.72.130:*}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 11999: (15.3846%)&lt;BR/&gt; 1682: (15.3846%)&lt;BR/&gt; 5001: (11.5385%)&lt;BR/&gt; 1684: (11.5385%)&lt;BR/&gt; 443: (11.5385%)&gt;];
}
445--731[label="1;1pkt 1fpkt"];
445--974[label="1;1pkt 1fpkt"];
445--1479[label="1;1pkt 1fpkt"];
445--1538[label="0.75;3pkt 3fpkt"];
731--1479[label="1;1pkt 1fpkt"];
731--1538[label="1;1pkt 1fpkt"];
974--1538[label="1;1pkt 1fpkt"];
1479--1538[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="143.50.72.130" src_ip="91.151.69.99" src_port="443"/>
      <filter dst_ip="143.50.72.130" dst_port="1814" src_port="443"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677781,1.59484,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_132{
style=filled;
color=gray75;
623[label="137.248.94.242;s;107pkt 107fpkt", shape=diamond, color=yellow];
1509[label="137.248.94.242;s;101pkt 101fpkt", shape=hexagon, color=black];
2603[label="137.248.94.242;106pkt 106fpkt", shape=pentagon, color=darkviolet];
stat132[shape=component, label=&lt;Rules:&lt;BR/&gt;{137.248.94.242:*, 203.177.93.234:80}[24.2991%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.0446%)&lt;BR/&gt; 81: (0.955414%)&lt;BR/&gt; 2825: (0.477707%)&lt;BR/&gt; 2824: (0.477707%)&lt;BR/&gt; 2823: (0.477707%)&gt;];
}
623--1509[label="1;101pkt 101fpkt"];
623--1827[label="0.00934579;1pkt 1fpkt"];
623--1838[label="0.00934579;1pkt 1fpkt"];
623--1846[label="0.00934579;1pkt 1fpkt"];
623--2603[label="1;106pkt 106fpkt"];
1509--1827[label="0.00990099;1pkt 1fpkt"];
1509--1838[label="0.00990099;1pkt 1fpkt"];
1509--1846[label="0.00990099;1pkt 1fpkt"];
1509--2603[label="0.990099;100pkt 100fpkt"];
</description>
    <slice>
      <filter dst_ip="203.177.93.234" dst_port="80" src_ip="137.248.94.242"/>
    </slice>
    <from sec="991803630" usec="0"/>
    <to sec="991803909" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785791,1.58311,999,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_135{
style=filled;
color=gray75;
265[label="137.248.162.36;d;105pkt 105fpkt", shape=diamond, color=yellow];
266[label="209.51.152.195;s;7pkt 7fpkt", shape=diamond, color=yellow];
474[label="205.133.195.245;s;1pkt 1fpkt", shape=diamond, color=yellow];
551[label="143.50.20.64;d;17pkt 17fpkt", shape=diamond, color=yellow];
738[label="17.21.128.7;s;1pkt 1fpkt", shape=diamond, color=yellow];
743[label="161.243.34.109;s;1pkt 1fpkt", shape=diamond, color=yellow];
953[label="195.225.119.106;s;2pkt 2fpkt", shape=diamond, color=yellow];
957[label="204.138.249.181;s;1pkt 1fpkt", shape=diamond, color=yellow];
1005[label="161.200.231.209;s;1pkt 1fpkt", shape=diamond, color=yellow];
1187[label="17.188.40.133;s;2pkt 2fpkt", shape=diamond, color=yellow];
1539[label="209.51.152.195;s;7pkt 7fpkt", shape=hexagon, color=black];
1556[label="143.50.20.64;d;15pkt 15fpkt", shape=hexagon, color=black];
1704[label="17.21.128.7;s;1pkt 1fpkt", shape=hexagon, color=black];
1706[label="161.200.231.209;s;1pkt 1fpkt", shape=hexagon, color=black];
1735[label="195.225.119.106;s;2pkt 2fpkt", shape=hexagon, color=black];
2360[label="214.123.170.150;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2808[label="195.225.119.106;1pkt 1fpkt", shape=invtriangle, color=brown];
stat135[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 137.248.162.36:0}[69.6721%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (65.6627%)&lt;BR/&gt; 30: (9.03614%)&lt;BR/&gt; 80: (3.61446%)&lt;BR/&gt; 6699: (2.71084%)&lt;BR/&gt; 1271: (1.50602%)&gt;];
}
265--266[label="1;7pkt 7fpkt"];
265--474[label="1;1pkt 1fpkt"];
265--743[label="1;1pkt 1fpkt"];
265--957[label="1;1pkt 1fpkt"];
265--1005[label="1;1pkt 1fpkt"];
265--1167[label="0.00952381;1pkt 1fpkt"];
265--1187[label="0.5;1pkt 1fpkt"];
265--1539[label="1;7pkt 7fpkt"];
265--1706[label="1;1pkt 1fpkt"];
265--2318[label="0.0967742;3pkt 3fpkt"];
265--2360[label="1;1pkt 1fpkt"];
266--1539[label="1;7pkt 7fpkt"];
551--738[label="1;1pkt 1fpkt"];
551--953[label="1;2pkt 2fpkt"];
551--1187[label="0.5;1pkt 1fpkt"];
551--1556[label="1;15pkt 15fpkt"];
551--1704[label="1;1pkt 1fpkt"];
551--1735[label="1;2pkt 2fpkt"];
551--2808[label="1;1pkt 1fpkt"];
738--1556[label="1;1pkt 1fpkt"];
738--1704[label="1;1pkt 1fpkt"];
953--1556[label="1;2pkt 2fpkt"];
953--1735[label="1;2pkt 2fpkt"];
953--2808[label="1;1pkt 1fpkt"];
1005--1706[label="1;1pkt 1fpkt"];
1187--1556[label="0.5;1pkt 1fpkt"];
1556--1704[label="1;1pkt 1fpkt"];
1556--1735[label="1;2pkt 2fpkt"];
1556--2808[label="1;1pkt 1fpkt"];
1735--2808[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.162.36"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_136{
style=filled;
color=gray75;
268[label="143.50.205.91;s;10pkt 10fpkt", shape=diamond, color=yellow];
287[label="91.203.180.103;d;1pkt 1fpkt", shape=diamond, color=yellow];
446[label="209.206.89.249;d;1pkt 1fpkt", shape=diamond, color=yellow];
1540[label="209.206.89.249;d;1pkt 1fpkt", shape=hexagon, color=black];
stat136[shape=component, label=&lt;Rules:&lt;BR/&gt;{143.50.205.91:0, *:0}[70%]&lt;BR/&gt;{143.50.205.91:*, *:6699}[20%]&lt;BR/&gt;{143.50.205.91:*, 91.203.180.103:*}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (53.8462%)&lt;BR/&gt; 6700: (11.5385%)&lt;BR/&gt; 6699: (11.5385%)&lt;BR/&gt; 1508: (11.5385%)&lt;BR/&gt; 1476: (7.69231%)&gt;];
}
268--287[label="1;1pkt 1fpkt"];
268--446[label="1;1pkt 1fpkt"];
268--1540[label="1;1pkt 1fpkt"];
446--1540[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="91.203.180.103" src_ip="143.50.205.91"/>
      <filter dst_port="6699" src_ip="143.50.205.91"/>
      <filter src_ip="143.50.205.91"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804153" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_137{
style=filled;
color=gray75;
243[label="151.144.77.3;s;68pkt 68fpkt", shape=diamond, color=yellow];
273[label="17.203.146.59;d;1pkt 1fpkt", shape=diamond, color=yellow];
449[label="4.34.246.238;d;1pkt 1fpkt", shape=diamond, color=yellow];
1541[label="17.203.146.59;d;1pkt 1fpkt", shape=hexagon, color=black];
1690[label="151.144.77.3;s;68pkt 68fpkt", shape=hexagon, color=black];
stat137[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.144.77.3:*, *:6699}[38.2353%]&lt;BR/&gt;{151.144.77.3:6699, *:*}[35.2941%]&lt;BR/&gt;{151.144.77.3:6257, *:6257}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (37.0504%)&lt;BR/&gt; 6257: (25.1799%)&lt;BR/&gt; 3044: (1.43885%)&lt;BR/&gt; 2426: (1.43885%)&lt;BR/&gt; 3946: (1.07914%)&gt;];
}
243--273[label="1;1pkt 1fpkt"];
243--449[label="1;1pkt 1fpkt"];
243--1541[label="1;1pkt 1fpkt"];
243--1690[label="1;68pkt 68fpkt"];
273--1541[label="1;1pkt 1fpkt"];
273--1690[label="1;1pkt 1fpkt"];
449--1690[label="1;1pkt 1fpkt"];
1541--1690[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="151.144.77.3" src_port="6699"/>
      <filter dst_port="6699" src_ip="151.144.77.3"/>
      <filter dst_port="6257" src_ip="151.144.77.3" src_port="6257"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785791,1.58311,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_138{
style=filled;
color=gray75;
841[label="137.248.55.248;d;39pkt 39fpkt", shape=diamond, color=yellow];
1550[label="137.248.55.248;d;39pkt 39fpkt", shape=hexagon, color=black];
1888[label="214.224.187.8;22pkt 22fpkt", shape=pentagon, color=darkviolet];
2230[label="214.224.187.104;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2643[label="214.224.187.8;22pkt 22fpkt", shape=invtriangle, color=brown];
stat138[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.224.187.118:80, 137.248.55.248:*}[41.6667%]&lt;BR/&gt;{214.224.187.8:80, 137.248.55.248:*}[37.5%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1561: (1.6129%)&lt;BR/&gt; 1560: (1.6129%)&lt;BR/&gt; 1558: (1.6129%)&lt;BR/&gt; 1551: (1.6129%)&gt;];
}
841--1550[label="1;39pkt 39fpkt"];
841--1888[label="0.590909;13pkt 13fpkt"];
841--2230[label="1;2pkt 2fpkt"];
841--2643[label="0.590909;13pkt 13fpkt"];
1550--1888[label="0.590909;13pkt 13fpkt"];
1550--2230[label="1;2pkt 2fpkt"];
1550--2643[label="0.590909;13pkt 13fpkt"];
1888--2643[label="1;22pkt 22fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.55.248" src_ip="214.224.187.8" src_port="80"/>
      <filter dst_ip="137.248.55.248" src_ip="214.224.187.118" src_port="80"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.990447,1.59474,503,0 0 0 1 1 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_139{
style=filled;
color=gray75;
596[label="208.147.96.246;s;103pkt 103fpkt", shape=diamond, color=yellow];
897[label="137.248.209.107;s;51pkt 51fpkt", shape=diamond, color=yellow];
907[label="215.70.54.65;d;121pkt 121fpkt", shape=diamond, color=yellow];
1050[label="137.248.192.67;s;104pkt 104fpkt", shape=diamond, color=yellow];
1078[label="143.50.20.140;s;106pkt 106fpkt", shape=diamond, color=yellow];
1227[label="143.50.33.90;s;11pkt 11fpkt", shape=diamond, color=yellow];
1246[label="205.212.244.64;d;1pkt 1fpkt", shape=diamond, color=yellow];
1396[label="208.147.96.246;s;103pkt 103fpkt", shape=hexagon, color=black];
1566[label="215.70.54.65;d;104pkt 104fpkt", shape=hexagon, color=black];
1722[label="137.248.192.67;s;104pkt 104fpkt", shape=hexagon, color=black];
1868[label="151.144.253.2;22pkt 22fpkt", shape=pentagon, color=darkviolet];
2216[label="137.248.240.99;17pkt 17fpkt", shape=pentagon, color=darkviolet];
2234[label="137.248.209.107;50pkt 50fpkt", shape=pentagon, color=darkviolet];
2245[label="151.144.224.114;42pkt 42fpkt", shape=pentagon, color=darkviolet];
2612[label="208.147.96.246;102pkt 102fpkt", shape=pentagon, color=darkviolet];
2802[label="137.248.240.99;17pkt 17fpkt", shape=invtriangle, color=brown];
2809[label="137.248.209.107;51pkt 51fpkt", shape=invtriangle, color=brown];
2814[label="151.144.224.114;41pkt 41fpkt", shape=invtriangle, color=brown];
3061[label="137.248.240.99;16pkt 16fpkt", shape=invhouse, color=bisque];
3065[label="137.248.209.107;46pkt 46fpkt", shape=invhouse, color=bisque];
3067[label="151.144.224.114;42pkt 42fpkt", shape=invhouse, color=bisque];
stat139[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 215.70.54.65:80}[25.4737%]&lt;BR/&gt;{143.50.20.140:*, *:80}[22.3158%]&lt;BR/&gt;{208.147.96.246:*, *:80}[21.6842%]&lt;BR/&gt;{137.248.192.67:*, *:80}[21.6842%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.6013%)&lt;BR/&gt; 32778: (0.318979%)&lt;BR/&gt; 3725: (0.318979%)&lt;BR/&gt; 53: (0.318979%)&lt;BR/&gt; 1189: (0.279107%)&gt;];
}
596--907[label="0.368932;38pkt 38fpkt"];
596--1396[label="1;103pkt 103fpkt"];
596--1566[label="0.368932;38pkt 38fpkt"];
596--1827[label="0.203883;21pkt 21fpkt"];
596--1838[label="0.203883;21pkt 21fpkt"];
596--1846[label="0.203883;21pkt 21fpkt"];
596--2612[label="1;102pkt 102fpkt"];
897--907[label="0.215686;11pkt 11fpkt"];
897--1566[label="0.215686;11pkt 11fpkt"];
897--1827[label="0.196078;10pkt 10fpkt"];
897--1838[label="0.196078;10pkt 10fpkt"];
897--1846[label="0.196078;10pkt 10fpkt"];
897--2234[label="1;50pkt 50fpkt"];
897--2809[label="1;51pkt 51fpkt"];
897--3065[label="1;46pkt 46fpkt"];
907--1050[label="0.0288462;3pkt 3fpkt"];
907--1078[label="0.188679;20pkt 20fpkt"];
907--1227[label="0.363636;4pkt 4fpkt"];
907--1315[label="0.0165289;2pkt 2fpkt"];
907--1396[label="0.368932;38pkt 38fpkt"];
907--1566[label="1;104pkt 104fpkt"];
907--1647[label="0.00826446;1pkt 1fpkt"];
907--1722[label="0.0288462;3pkt 3fpkt"];
907--1827[label="0.132231;16pkt 16fpkt"];
907--1838[label="0.132231;16pkt 16fpkt"];
907--1846[label="0.132231;16pkt 16fpkt"];
907--1868[label="0.409091;9pkt 9fpkt"];
907--2005[label="0.00826446;1pkt 1fpkt"];
907--2216[label="0.176471;3pkt 3fpkt"];
907--2234[label="0.22;11pkt 11fpkt"];
907--2245[label="0.333333;14pkt 14fpkt"];
907--2612[label="0.372549;38pkt 38fpkt"];
907--2693[label="0.00826446;1pkt 1fpkt"];
907--2802[label="0.176471;3pkt 3fpkt"];
907--2809[label="0.215686;11pkt 11fpkt"];
907--2814[label="0.341463;14pkt 14fpkt"];
907--3018[label="0.00826446;1pkt 1fpkt"];
907--3061[label="0.1875;3pkt 3fpkt"];
907--3065[label="0.23913;11pkt 11fpkt"];
907--3067[label="0.333333;14pkt 14fpkt"];
1050--1566[label="0.0288462;3pkt 3fpkt"];
1050--1722[label="1;104pkt 104fpkt"];
1078--1566[label="0.192308;20pkt 20fpkt"];
1227--1246[label="1;1pkt 1fpkt"];
1227--1566[label="0.363636;4pkt 4fpkt"];
1396--1566[label="0.368932;38pkt 38fpkt"];
1396--1827[label="0.203883;21pkt 21fpkt"];
1396--1838[label="0.203883;21pkt 21fpkt"];
1396--1846[label="0.203883;21pkt 21fpkt"];
1396--2612[label="1;102pkt 102fpkt"];
1566--1722[label="0.0288462;3pkt 3fpkt"];
1566--1827[label="0.153846;16pkt 16fpkt"];
1566--1838[label="0.153846;16pkt 16fpkt"];
1566--1846[label="0.153846;16pkt 16fpkt"];
1566--2216[label="0.176471;3pkt 3fpkt"];
1566--2234[label="0.22;11pkt 11fpkt"];
1566--2245[label="0.333333;14pkt 14fpkt"];
1566--2612[label="0.372549;38pkt 38fpkt"];
1566--2802[label="0.176471;3pkt 3fpkt"];
1566--2809[label="0.215686;11pkt 11fpkt"];
1566--2814[label="0.341463;14pkt 14fpkt"];
1566--3061[label="0.1875;3pkt 3fpkt"];
1566--3065[label="0.23913;11pkt 11fpkt"];
1566--3067[label="0.333333;14pkt 14fpkt"];
2216--2802[label="1;17pkt 17fpkt"];
2216--3061[label="1;16pkt 16fpkt"];
2234--2809[label="1;50pkt 50fpkt"];
2234--3065[label="0.978261;45pkt 45fpkt"];
2245--2814[label="1;41pkt 41fpkt"];
2245--3067[label="1;42pkt 42fpkt"];
2802--3061[label="1;16pkt 16fpkt"];
2809--3065[label="1;46pkt 46fpkt"];
2814--3067[label="1;41pkt 41fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="143.50.20.140"/>
      <filter dst_port="80" src_ip="137.248.192.67"/>
      <filter dst_port="80" src_ip="208.147.96.246"/>
      <filter dst_ip="215.70.54.65" dst_port="80"/>
    </slice>
    <from sec="991803603" usec="0"/>
    <to sec="991804174" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03997,1.59051,503,1 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_140{
style=filled;
color=gray75;
31[label="50.142.211.151s;1pkt 1fpkt", shape=rectangle, color=red];
315[label="137.248.176.54;d;77pkt 77fpkt", shape=diamond, color=yellow];
316[label="50.142.211.151;s;8pkt 8fpkt", shape=diamond, color=yellow];
896[label="137.248.209.107;d;56pkt 56fpkt", shape=diamond, color=yellow];
1101[label="202.202.14.116;s;1pkt 1fpkt", shape=diamond, color=yellow];
1297[label="137.248.176.54;d;54pkt 54fpkt", shape=hexagon, color=black];
2247[label="202.202.14.116;5pkt 5fpkt", shape=pentagon, color=darkviolet];
2257[label="203.115.176.119;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2364[label="50.142.211.151;9pkt 9fpkt", shape=pentagon, color=darkviolet];
2816[label="202.202.14.116;6pkt 6fpkt", shape=invtriangle, color=brown];
2823[label="203.115.176.119;1pkt 1fpkt", shape=invtriangle, color=brown];
stat140[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 137.248.176.54:*}[50.3704%]&lt;BR/&gt;{*:80, 137.248.209.107:*}[39.2593%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (41.0959%)&lt;BR/&gt; 21: (5.70776%)&lt;BR/&gt; 52466: (0.913242%)&lt;BR/&gt; 3539: (0.913242%)&lt;BR/&gt; 1776: (0.913242%)&gt;];
}
31--315[label="1;1pkt 1fpkt"];
31--316[label="1;1pkt 1fpkt"];
31--1297[label="1;1pkt 1fpkt"];
315--316[label="1;8pkt 8fpkt"];
315--741[label="0.0649351;5pkt 5fpkt"];
315--1066[label="0.0384615;2pkt 2fpkt"];
315--1158[label="0.012987;1pkt 1fpkt"];
315--1164[label="0.0227273;1pkt 1fpkt"];
315--1297[label="1;54pkt 54fpkt"];
315--1486[label="0.038961;3pkt 3fpkt"];
315--2247[label="0.6;3pkt 3fpkt"];
315--2257[label="1;1pkt 1fpkt"];
315--2364[label="0.777778;7pkt 7fpkt"];
315--2468[label="0.0392157;2pkt 2fpkt"];
315--2816[label="0.666667;4pkt 4fpkt"];
315--2823[label="1;1pkt 1fpkt"];
315--2911[label="0.0392157;2pkt 2fpkt"];
316--1297[label="1;8pkt 8fpkt"];
316--2364[label="0.875;7pkt 7fpkt"];
896--908[label="0.196429;11pkt 11fpkt"];
896--1101[label="1;1pkt 1fpkt"];
896--1567[label="0.196429;11pkt 11fpkt"];
896--2077[label="0.196429;11pkt 11fpkt"];
896--2217[label="0.16129;5pkt 5fpkt"];
896--2247[label="0.4;2pkt 2fpkt"];
896--2816[label="0.333333;2pkt 2fpkt"];
1101--2247[label="1;1pkt 1fpkt"];
1101--2816[label="1;1pkt 1fpkt"];
1297--1486[label="0.0555556;3pkt 3fpkt"];
1297--2247[label="0.6;3pkt 3fpkt"];
1297--2364[label="0.777778;7pkt 7fpkt"];
1297--2468[label="0.0392157;2pkt 2fpkt"];
1297--2816[label="0.666667;4pkt 4fpkt"];
1297--2911[label="0.0392157;2pkt 2fpkt"];
2247--2816[label="1;5pkt 5fpkt"];
2257--2823[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.176.54" src_port="80"/>
      <filter dst_ip="137.248.209.107" src_port="80"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785791,1.58311,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_142{
style=filled;
color=gray75;
810[label="91.59.22.143;d;110pkt 110fpkt", shape=diamond, color=yellow];
812[label="143.50.32.242;s;142pkt 142fpkt", shape=diamond, color=yellow];
1524[label="143.50.32.242;s;70pkt 70fpkt", shape=hexagon, color=black];
1581[label="91.59.22.143;d;110pkt 110fpkt", shape=hexagon, color=black];
2602[label="143.50.32.242;148pkt 148fpkt", shape=pentagon, color=darkviolet];
2972[label="143.50.32.242;148pkt 148fpkt", shape=invtriangle, color=brown];
stat142[shape=component, label=&lt;Rules:&lt;BR/&gt;{143.50.32.242:*, 91.59.22.143:80}[74.3243%]&lt;BR/&gt;{143.50.32.242:*, 91.60.20.110:80}[24.3243%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1361: (0.412088%)&lt;BR/&gt; 1360: (0.412088%)&lt;BR/&gt; 1359: (0.412088%)&lt;BR/&gt; 1358: (0.412088%)&gt;];
}
810--812[label="1;110pkt 110fpkt"];
810--1524[label="0.9;63pkt 63fpkt"];
810--1581[label="1;110pkt 110fpkt"];
810--2602[label="1;110pkt 110fpkt"];
810--2972[label="1;110pkt 110fpkt"];
812--1524[label="1;70pkt 70fpkt"];
812--1581[label="1;110pkt 110fpkt"];
812--2602[label="1;142pkt 142fpkt"];
812--2972[label="1;142pkt 142fpkt"];
1524--1581[label="0.9;63pkt 63fpkt"];
1524--2602[label="1;70pkt 70fpkt"];
1524--2972[label="1;70pkt 70fpkt"];
1581--2602[label="1;110pkt 110fpkt"];
1581--2972[label="1;110pkt 110fpkt"];
2602--2972[label="1;148pkt 148fpkt"];
</description>
    <slice>
      <filter dst_ip="91.59.22.143" dst_port="80" src_ip="143.50.32.242"/>
      <filter dst_ip="91.60.20.110" dst_port="80" src_ip="143.50.32.242"/>
    </slice>
    <from sec="991803840" usec="0"/>
    <to sec="991804222" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_144{
style=filled;
color=gray75;
977[label="202.35.79.6;d;2pkt 2fpkt", shape=diamond, color=yellow];
1000[label="143.39.25.36;s;24pkt 24fpkt", shape=diamond, color=yellow];
1612[label="202.35.79.6;d;2pkt 2fpkt", shape=hexagon, color=black];
stat144[shape=component, label=&lt;Rules:&lt;BR/&gt;{143.39.25.36:0, *:0}[96%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
977--1000[label="0.5;1pkt 1fpkt"];
977--1612[label="1;2pkt 2fpkt"];
1000--1612[label="0.5;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="143.39.25.36"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677781,1.59484,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_145{
style=filled;
color=gray75;
531[label="151.144.176.170;d;288pkt 288fpkt", shape=diamond, color=yellow];
728[label="203.177.93.150;s;267pkt 267fpkt", shape=diamond, color=yellow];
1626[label="151.144.176.170;d;243pkt 243fpkt", shape=hexagon, color=black];
2359[label="203.177.93.150;300pkt 300fpkt", shape=pentagon, color=darkviolet];
stat145[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.177.93.150:80, 151.144.176.170:*}[93.4783%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 5000: (0.182149%)&lt;BR/&gt; 4999: (0.182149%)&lt;BR/&gt; 4998: (0.182149%)&lt;BR/&gt; 4997: (0.182149%)&gt;];
}
531--728[label="1;267pkt 267fpkt"];
531--1626[label="1;243pkt 243fpkt"];
531--2359[label="0.923611;266pkt 266fpkt"];
728--1626[label="0.921811;224pkt 224fpkt"];
728--2359[label="0.996255;266pkt 266fpkt"];
1626--2359[label="0.917695;223pkt 223fpkt"];
</description>
    <slice>
      <filter dst_ip="151.144.176.170" src_ip="203.177.93.150" src_port="80"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677781,1.59484,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_146{
style=filled;
color=gray75;
1020[label="151.144.186.129;d;50pkt 50fpkt", shape=diamond, color=yellow];
1143[label="219.225.14.151;s;43pkt 43fpkt", shape=diamond, color=yellow];
1636[label="151.144.186.129;d;44pkt 44fpkt", shape=hexagon, color=black];
2361[label="219.225.14.151;49pkt 49fpkt", shape=pentagon, color=darkviolet];
stat146[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.225.14.151:80, 151.144.186.129:*}[87.5%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.4624%)&lt;BR/&gt; 2622: (1.07527%)&lt;BR/&gt; 2621: (1.07527%)&lt;BR/&gt; 2619: (1.07527%)&lt;BR/&gt; 2618: (1.07527%)&gt;];
}
1020--1143[label="1;43pkt 43fpkt"];
1020--1636[label="1;44pkt 44fpkt"];
1020--2361[label="0.877551;43pkt 43fpkt"];
1143--1636[label="0.860465;37pkt 37fpkt"];
1143--2361[label="1;43pkt 43fpkt"];
1636--2361[label="0.840909;37pkt 37fpkt"];
</description>
    <slice>
      <filter dst_ip="151.144.186.129" src_ip="219.225.14.151" src_port="80"/>
    </slice>
    <from sec="991803601" usec="0"/>
    <to sec="991804229" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677781,1.59484,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_147{
style=filled;
color=gray75;
215[label="169.41.206.28;d;25pkt 25fpkt", shape=diamond, color=yellow];
216[label="195.2.227.162;s;4pkt 4fpkt", shape=diamond, color=yellow];
534[label="216.32.183.254;s;236pkt 236fpkt", shape=diamond, color=yellow];
535[label="175.221.170.216;d;203pkt 203fpkt", shape=diamond, color=yellow];
754[label="175.221.171.64;d;98pkt 98fpkt", shape=diamond, color=yellow];
877[label="128.200.5.10;s;19pkt 19fpkt", shape=diamond, color=yellow];
1372[label="175.221.170.216;d;136pkt 136fpkt", shape=hexagon, color=black];
1437[label="169.41.206.28;d;16pkt 16fpkt", shape=hexagon, color=black];
1476[label="216.32.183.254;s;119pkt 119fpkt", shape=hexagon, color=black];
1635[label="128.200.5.10;s;19pkt 19fpkt", shape=hexagon, color=black];
1642[label="175.221.171.64;d;98pkt 98fpkt", shape=hexagon, color=black];
1887[label="207.75.128.8;13pkt 13fpkt", shape=pentagon, color=darkviolet];
stat147[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.32.183.254:3128, 175.221.170.216:*}[43.6842%]&lt;BR/&gt;{*:80, *:*}[30.7895%]&lt;BR/&gt;{*:*, 175.221.171.64:*}[26.8421%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3128: (34.1785%)&lt;BR/&gt; 80: (12.7282%)&lt;BR/&gt; 3130: (1.21704%)&lt;BR/&gt; 25: (0.811359%)&lt;BR/&gt; 113: (0.709939%)&gt;];
}
215--216[label="1;4pkt 4fpkt"];
215--877[label="0.473684;9pkt 9fpkt"];
215--1069[label="0.04;1pkt 1fpkt"];
215--1437[label="1;16pkt 16fpkt"];
215--1635[label="0.473684;9pkt 9fpkt"];
215--1729[label="0.04;1pkt 1fpkt"];
215--1887[label="0.615385;8pkt 8fpkt"];
216--1437[label="1;4pkt 4fpkt"];
534--535[label="0.82266;167pkt 167fpkt"];
534--547[label="0.0127119;3pkt 3fpkt"];
534--729[label="0.16185;28pkt 28fpkt"];
534--754[label="0.27551;27pkt 27fpkt"];
534--1372[label="0.808824;110pkt 110fpkt"];
534--1476[label="1;119pkt 119fpkt"];
534--1478[label="0.122807;14pkt 14fpkt"];
534--1632[label="0.00847458;2pkt 2fpkt"];
534--1642[label="0.27551;27pkt 27fpkt"];
535--564[label="0.0112994;2pkt 2fpkt"];
535--572[label="0.0110497;2pkt 2fpkt"];
535--582[label="0.0114943;2pkt 2fpkt"];
535--589[label="0.0112994;2pkt 2fpkt"];
535--769[label="0.0105263;1pkt 1fpkt"];
535--912[label="0.0104167;1pkt 1fpkt"];
535--1372[label="1;136pkt 136fpkt"];
535--1386[label="0.0112994;2pkt 2fpkt"];
535--1476[label="0.747899;89pkt 89fpkt"];
535--1546[label="0.0104167;2pkt 2fpkt"];
535--1565[label="0.0118343;2pkt 2fpkt"];
535--1725[label="0.0104167;1pkt 1fpkt"];
535--1833[label="0.0344828;7pkt 7fpkt"];
535--2002[label="0.00492611;1pkt 1fpkt"];
535--2150[label="0.0106952;2pkt 2fpkt"];
535--2156[label="0.0105263;2pkt 2fpkt"];
535--2423[label="0.00943396;1pkt 1fpkt"];
535--2692[label="0.00492611;1pkt 1fpkt"];
754--877[label="0.157895;3pkt 3fpkt"];
754--912[label="0.0208333;2pkt 2fpkt"];
754--971[label="0.0816327;8pkt 8fpkt"];
754--1030[label="0.0178571;1pkt 1fpkt"];
754--1476[label="0.142857;14pkt 14fpkt"];
754--1497[label="0.025;1pkt 1fpkt"];
754--1635[label="0.157895;3pkt 3fpkt"];
754--1642[label="1;98pkt 98fpkt"];
754--1725[label="0.0208333;2pkt 2fpkt"];
754--2129[label="0.0102041;1pkt 1fpkt"];
754--2378[label="0.0175439;1pkt 1fpkt"];
754--2497[label="0.0246914;2pkt 2fpkt"];
877--1437[label="0.1875;3pkt 3fpkt"];
877--1491[label="0.0526316;1pkt 1fpkt"];
877--1635[label="1;19pkt 19fpkt"];
877--1642[label="0.157895;3pkt 3fpkt"];
1372--1386[label="0.0147059;2pkt 2fpkt"];
1372--1476[label="0.747899;89pkt 89fpkt"];
1372--1546[label="0.0147059;2pkt 2fpkt"];
1372--1565[label="0.0147059;2pkt 2fpkt"];
1372--1833[label="0.0514706;7pkt 7fpkt"];
1372--2150[label="0.0147059;2pkt 2fpkt"];
1372--2156[label="0.0147059;2pkt 2fpkt"];
1437--1635[label="0.1875;3pkt 3fpkt"];
1437--1887[label="0.615385;8pkt 8fpkt"];
1476--1478[label="0.122807;14pkt 14fpkt"];
1476--1632[label="0.0168067;2pkt 2fpkt"];
1476--1642[label="0.142857;14pkt 14fpkt"];
1635--1642[label="0.157895;3pkt 3fpkt"];
1642--1725[label="0.0208333;2pkt 2fpkt"];
1642--2129[label="0.0102041;1pkt 1fpkt"];
1642--2378[label="0.0175439;1pkt 1fpkt"];
1642--2497[label="0.0246914;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="175.221.171.64"/>
      <filter src_port="80"/>
      <filter dst_ip="175.221.170.216" src_ip="216.32.183.254" src_port="3128"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804197" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785791,1.58311,010,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_148{
style=filled;
color=gray75;
1009[label="175.221.160.66;s;26pkt 26fpkt", shape=diamond, color=yellow];
1056[label="175.221.149.17;s;3pkt 3fpkt", shape=diamond, color=yellow];
1161[label="208.220.236.65;d;3pkt 3fpkt", shape=diamond, color=yellow];
1195[label="209.70.3.121;d;3pkt 3fpkt", shape=diamond, color=yellow];
1656[label="175.221.149.17;s;3pkt 3fpkt", shape=hexagon, color=black];
1921[label="175.221.149.17;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2659[label="175.221.149.17;2pkt 2fpkt", shape=invtriangle, color=brown];
stat148[shape=component, label=&lt;Rules:&lt;BR/&gt;{175.221.160.66:*, 208.193.150.168:6667}[30%]&lt;BR/&gt;{175.221.160.66:*, 208.75.195.93:*}[26.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (15.4762%)&lt;BR/&gt; 6667: (10.7143%)&lt;BR/&gt; 41001: (5.95238%)&lt;BR/&gt; 1733: (5.95238%)&lt;BR/&gt; 1679: (5.95238%)&gt;];
}
1009--1161[label="0.666667;2pkt 2fpkt"];
1009--1195[label="0.333333;1pkt 1fpkt"];
1056--1195[label="0.666667;2pkt 2fpkt"];
1056--1656[label="1;3pkt 3fpkt"];
1056--1921[label="1;2pkt 2fpkt"];
1056--2659[label="1;2pkt 2fpkt"];
1195--1656[label="0.666667;2pkt 2fpkt"];
1195--1921[label="1;2pkt 2fpkt"];
1195--2659[label="1;2pkt 2fpkt"];
1656--1921[label="1;2pkt 2fpkt"];
1656--2659[label="1;2pkt 2fpkt"];
1921--2659[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="208.75.195.93" src_ip="175.221.160.66"/>
      <filter dst_ip="208.193.150.168" dst_port="6667" src_ip="175.221.160.66"/>
    </slice>
    <from sec="991803601" usec="0"/>
    <to sec="991804226" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785791,1.58311,999,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_149{
style=filled;
color=gray75;
579[label="219.41.120.205;s;4pkt 4fpkt", shape=diamond, color=yellow];
654[label="217.40.157.86;s;3pkt 3fpkt", shape=diamond, color=yellow];
753[label="169.41.183.211;d;271pkt 271fpkt", shape=diamond, color=yellow];
938[label="203.72.220.134;s;4pkt 4fpkt", shape=diamond, color=yellow];
1389[label="219.41.120.205;s;2pkt 2fpkt", shape=hexagon, color=black];
1670[label="217.40.157.86;s;3pkt 3fpkt", shape=hexagon, color=black];
2292[label="203.72.220.134;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2520[label="219.41.120.205;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2935[label="219.41.120.205;3pkt 3fpkt", shape=invtriangle, color=brown];
stat149[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:53, 169.41.183.211:*}[66.6667%]&lt;BR/&gt;{*:25, 169.41.183.211:*}[30.4029%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (31.0169%)&lt;BR/&gt; 25: (17.9661%)&lt;BR/&gt; 0: (1.35593%)&lt;BR/&gt; 39221: (0.847458%)&lt;BR/&gt; 39361: (0.677966%)&gt;];
}
579--753[label="0.75;3pkt 3fpkt"];
579--1389[label="1;2pkt 2fpkt"];
579--2520[label="1;3pkt 3fpkt"];
579--2935[label="1;3pkt 3fpkt"];
654--753[label="1;3pkt 3fpkt"];
654--1670[label="1;3pkt 3fpkt"];
753--938[label="0.75;3pkt 3fpkt"];
753--985[label="0.0384615;1pkt 1fpkt"];
753--1389[label="0.5;1pkt 1fpkt"];
753--1618[label="0.04;1pkt 1fpkt"];
753--1670[label="1;3pkt 3fpkt"];
753--1875[label="0.0740741;2pkt 2fpkt"];
753--2237[label="0.0185185;2pkt 2fpkt"];
753--2282[label="0.0434783;1pkt 1fpkt"];
753--2292[label="1;2pkt 2fpkt"];
753--2335[label="0.0298507;2pkt 2fpkt"];
753--2338[label="0.0487805;2pkt 2fpkt"];
753--2515[label="0.0555556;1pkt 1fpkt"];
753--2520[label="1;3pkt 3fpkt"];
753--2533[label="0.0754717;4pkt 4fpkt"];
753--2554[label="0.0526316;1pkt 1fpkt"];
753--2600[label="0.0615385;4pkt 4fpkt"];
753--2935[label="1;3pkt 3fpkt"];
753--2942[label="0.0754717;4pkt 4fpkt"];
753--2973[label="0.0555556;3pkt 3fpkt"];
938--1834[label="0.25;1pkt 1fpkt"];
938--2292[label="1;2pkt 2fpkt"];
1389--2520[label="0.5;1pkt 1fpkt"];
1389--2935[label="0.5;1pkt 1fpkt"];
2520--2935[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="169.41.183.211" src_port="53"/>
      <filter dst_ip="169.41.183.211" src_port="25"/>
    </slice>
    <from sec="991803602" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677781,1.59484,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_150{
style=filled;
color=gray75;
181[label="137.248.137.31;d;2pkt 2fpkt", shape=diamond, color=yellow];
182[label="209.149.140.174;s;14pkt 14fpkt", shape=diamond, color=yellow];
1088[label="143.50.236.210;d;94pkt 94fpkt", shape=diamond, color=yellow];
1270[label="137.248.137.31;d;2pkt 2fpkt", shape=hexagon, color=black];
1677[label="143.50.236.210;d;43pkt 43fpkt", shape=hexagon, color=black];
2379[label="205.164.16.160;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2452[label="205.65.81.183;23pkt 23fpkt", shape=pentagon, color=darkviolet];
stat150[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.65.81.183:80, 143.50.236.210:*}[23.9583%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3247: (1.39665%)&lt;BR/&gt; 3258: (0.837989%)&lt;BR/&gt; 3256: (0.837989%)&lt;BR/&gt; 3255: (0.837989%)&gt;];
}
181--182[label="1;2pkt 2fpkt"];
181--1270[label="1;2pkt 2fpkt"];
182--1088[label="0.857143;12pkt 12fpkt"];
182--1270[label="1;2pkt 2fpkt"];
182--1677[label="0.785714;11pkt 11fpkt"];
1088--1677[label="1;43pkt 43fpkt"];
1088--2379[label="1;1pkt 1fpkt"];
1088--2452[label="1;23pkt 23fpkt"];
1677--2379[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="143.50.236.210" src_ip="205.65.81.183" src_port="80"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804160" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_152{
style=filled;
color=gray75;
916[label="137.248.36.128;d;90pkt 90fpkt", shape=diamond, color=yellow];
1089[label="143.88.27.117;s;101pkt 101fpkt", shape=diamond, color=yellow];
1662[label="137.248.36.128;d;88pkt 88fpkt", shape=hexagon, color=black];
stat152[shape=component, label=&lt;Rules:&lt;BR/&gt;{143.88.27.117:*, 137.248.36.128:80}[60%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.4624%)&lt;BR/&gt; 16264: (0.537634%)&lt;BR/&gt; 16252: (0.537634%)&lt;BR/&gt; 16064: (0.537634%)&lt;BR/&gt; 15930: (0.537634%)&gt;];
}
916--918[label="0.178571;5pkt 5fpkt"];
916--1089[label="0.8;72pkt 72fpkt"];
916--1630[label="0.0111111;1pkt 1fpkt"];
916--1662[label="0.988636;87pkt 87fpkt"];
916--1827[label="0.0111111;1pkt 1fpkt"];
916--1838[label="0.0111111;1pkt 1fpkt"];
916--1846[label="0.0111111;1pkt 1fpkt"];
1089--1608[label="0.029703;3pkt 3fpkt"];
1089--1662[label="0.818182;72pkt 72fpkt"];
1662--1827[label="0.0113636;1pkt 1fpkt"];
1662--1838[label="0.0113636;1pkt 1fpkt"];
1662--1846[label="0.0113636;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.36.128" dst_port="80" src_ip="143.88.27.117"/>
    </slice>
    <from sec="991803622" usec="0"/>
    <to sec="991804154" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677781,1.59484,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_153{
style=filled;
color=gray75;
404[label="32.143.4.51;d;1pkt 1fpkt", shape=diamond, color=yellow];
405[label="216.192.10.75;s;10pkt 10fpkt", shape=diamond, color=yellow];
1430[label="32.143.4.51;d;1pkt 1fpkt", shape=hexagon, color=black];
1687[label="216.192.10.75;s;10pkt 10fpkt", shape=hexagon, color=black];
2116[label="216.192.10.75;17pkt 17fpkt", shape=pentagon, color=darkviolet];
stat153[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.192.10.75:*, *:80}[33.3333%]&lt;BR/&gt;{216.192.10.75:33566, *:53}[27.7778%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (29.4872%)&lt;BR/&gt; 33566: (11.5385%)&lt;BR/&gt; 80: (10.2564%)&lt;BR/&gt; 0: (7.69231%)&lt;BR/&gt; 1030: (6.41026%)&gt;];
}
404--405[label="1;1pkt 1fpkt"];
404--1430[label="1;1pkt 1fpkt"];
404--1687[label="1;1pkt 1fpkt"];
404--2116[label="1;1pkt 1fpkt"];
405--1430[label="1;1pkt 1fpkt"];
405--1687[label="1;10pkt 10fpkt"];
405--2116[label="0.9;9pkt 9fpkt"];
1430--1687[label="1;1pkt 1fpkt"];
1430--2116[label="1;1pkt 1fpkt"];
1687--2116[label="0.9;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="216.192.10.75"/>
      <filter dst_port="53" src_ip="216.192.10.75" src_port="33566"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804226" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677781,1.59484,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_154{
style=filled;
color=gray75;
153[label="143.50.20.163;d;89pkt 89fpkt", shape=diamond, color=yellow];
155[label="17.176.94.157;s;1pkt 1fpkt", shape=diamond, color=yellow];
294[label="171.139.144.218;s;1pkt 1fpkt", shape=diamond, color=yellow];
317[label="17.160.101.236;s;1pkt 1fpkt", shape=diamond, color=yellow];
409[label="39.178.23.190;s;1pkt 1fpkt", shape=diamond, color=yellow];
427[label="17.21.32.239;s;1pkt 1fpkt", shape=diamond, color=yellow];
429[label="207.24.31.93;s;2pkt 2fpkt", shape=diamond, color=yellow];
460[label="49.149.248.59;s;1pkt 1fpkt", shape=diamond, color=yellow];
465[label="48.190.66.38;s;1pkt 1fpkt", shape=diamond, color=yellow];
473[label="17.171.231.11;s;1pkt 1fpkt", shape=diamond, color=yellow];
512[label="91.205.205.137;s;1pkt 1fpkt", shape=diamond, color=yellow];
733[label="17.189.12.212;s;1pkt 1fpkt", shape=diamond, color=yellow];
1082[label="32.140.128.146;s;2pkt 2fpkt", shape=diamond, color=yellow];
1207[label="161.215.226.223;s;1pkt 1fpkt", shape=diamond, color=yellow];
1321[label="17.176.94.157;s;1pkt 1fpkt", shape=hexagon, color=black];
1341[label="39.178.23.190;s;1pkt 1fpkt", shape=hexagon, color=black];
1691[label="17.21.32.239;s;1pkt 1fpkt", shape=hexagon, color=black];
2185[label="207.24.31.93;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2598[label="17.21.32.239;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat154[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:6346, 143.50.20.163:*}[52.809%]&lt;BR/&gt;{*:*, 143.50.20.163:6347}[21.3483%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6346: (28.8991%)&lt;BR/&gt; 137: (12.844%)&lt;BR/&gt; 6347: (8.7156%)&lt;BR/&gt; 80: (3.66972%)&lt;BR/&gt; 3086: (1.83486%)&gt;];
}
153--155[label="1;1pkt 1fpkt"];
153--294[label="1;1pkt 1fpkt"];
153--317[label="1;1pkt 1fpkt"];
153--409[label="1;1pkt 1fpkt"];
153--427[label="1;1pkt 1fpkt"];
153--429[label="1;2pkt 2fpkt"];
153--460[label="1;1pkt 1fpkt"];
153--465[label="1;1pkt 1fpkt"];
153--473[label="1;1pkt 1fpkt"];
153--512[label="1;1pkt 1fpkt"];
153--733[label="1;1pkt 1fpkt"];
153--1082[label="1;2pkt 2fpkt"];
153--1207[label="1;1pkt 1fpkt"];
153--1321[label="1;1pkt 1fpkt"];
153--1341[label="1;1pkt 1fpkt"];
153--1691[label="1;1pkt 1fpkt"];
153--1869[label="0.0444444;2pkt 2fpkt"];
153--2185[label="1;1pkt 1fpkt"];
153--2240[label="0.0454545;2pkt 2fpkt"];
153--2598[label="1;1pkt 1fpkt"];
153--2637[label="0.0454545;2pkt 2fpkt"];
153--2987[label="0.0444444;2pkt 2fpkt"];
155--1321[label="1;1pkt 1fpkt"];
409--1341[label="1;1pkt 1fpkt"];
427--1691[label="1;1pkt 1fpkt"];
427--2598[label="1;1pkt 1fpkt"];
429--2185[label="1;1pkt 1fpkt"];
1691--2598[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="143.50.20.163" src_port="6346"/>
      <filter dst_ip="143.50.20.163" dst_port="6347"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.960966,1.60219,999,1 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_155{
style=filled;
color=gray75;
5[label="143.50.205.12s;1pkt 1fpkt", shape=rectangle, color=red];
289[label="202.128.79.6;d;1pkt 1fpkt", shape=diamond, color=yellow];
378[label="143.50.205.12;s;47pkt 47fpkt", shape=diamond, color=yellow];
379[label="207.208.124.191;d;1pkt 1fpkt", shape=diamond, color=yellow];
396[label="202.49.63.39;d;1pkt 1fpkt", shape=diamond, color=yellow];
400[label="49.145.128.58;d;1pkt 1fpkt", shape=diamond, color=yellow];
698[label="49.42.72.71;d;1pkt 1fpkt", shape=diamond, color=yellow];
1336[label="202.49.63.39;d;1pkt 1fpkt", shape=hexagon, color=black];
1337[label="49.145.128.58;d;1pkt 1fpkt", shape=hexagon, color=black];
1610[label="202.128.79.6;d;1pkt 1fpkt", shape=hexagon, color=black];
1696[label="49.42.72.71;d;1pkt 1fpkt", shape=hexagon, color=black];
1901[label="143.50.205.12;4pkt 4fpkt", shape=pentagon, color=darkviolet];
stat155[shape=component, label=&lt;Rules:&lt;BR/&gt;{143.50.205.12:6346, *:*}[80.8511%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6346: (50%)&lt;BR/&gt; 1609: (4.09836%)&lt;BR/&gt; 28297: (3.27869%)&lt;BR/&gt; 1272: (3.27869%)&lt;BR/&gt; 2789: (2.45902%)&gt;];
}
5--289[label="1;1pkt 1fpkt"];
5--378[label="1;1pkt 1fpkt"];
5--1610[label="1;1pkt 1fpkt"];
5--1901[label="1;1pkt 1fpkt"];
289--378[label="1;1pkt 1fpkt"];
289--1610[label="1;1pkt 1fpkt"];
289--1901[label="1;1pkt 1fpkt"];
378--379[label="1;1pkt 1fpkt"];
378--396[label="1;1pkt 1fpkt"];
378--400[label="1;1pkt 1fpkt"];
378--698[label="1;1pkt 1fpkt"];
378--1336[label="1;1pkt 1fpkt"];
378--1337[label="1;1pkt 1fpkt"];
378--1610[label="1;1pkt 1fpkt"];
378--1696[label="1;1pkt 1fpkt"];
378--1901[label="1;4pkt 4fpkt"];
379--1901[label="1;1pkt 1fpkt"];
396--1336[label="1;1pkt 1fpkt"];
396--1901[label="1;1pkt 1fpkt"];
400--1337[label="1;1pkt 1fpkt"];
400--1901[label="1;1pkt 1fpkt"];
698--1696[label="1;1pkt 1fpkt"];
1336--1901[label="1;1pkt 1fpkt"];
1337--1901[label="1;1pkt 1fpkt"];
1610--1901[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="143.50.205.12" src_port="6346"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785791,1.58311,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_156{
style=filled;
color=gray75;
624[label="143.57.7.222;d;164pkt 164fpkt", shape=diamond, color=yellow];
648[label="91.152.31.14;s;2pkt 2fpkt", shape=diamond, color=yellow];
763[label="214.119.105.226;s;64pkt 64fpkt", shape=diamond, color=yellow];
785[label="137.248.184.54;d;14pkt 14fpkt", shape=diamond, color=yellow];
1413[label="91.152.31.14;s;2pkt 2fpkt", shape=hexagon, color=black];
1495[label="214.119.105.226;s;45pkt 45fpkt", shape=hexagon, color=black];
1572[label="143.57.7.222;d;164pkt 164fpkt", shape=hexagon, color=black];
2278[label="219.150.246.129;25pkt 25fpkt", shape=pentagon, color=darkviolet];
2324[label="216.49.128.141;54pkt 54fpkt", shape=pentagon, color=darkviolet];
2563[label="214.119.105.226;66pkt 66fpkt", shape=pentagon, color=darkviolet];
2834[label="219.150.246.129;25pkt 25fpkt", shape=invtriangle, color=brown];
2953[label="214.119.105.226;67pkt 67fpkt", shape=invtriangle, color=brown];
stat156[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.119.105.226:80, *:*}[27.8008%]&lt;BR/&gt;{216.49.128.141:80, 143.57.7.222:*}[22.8216%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.5665%)&lt;BR/&gt; 2711: (0.433526%)&lt;BR/&gt; 1276: (0.433526%)&lt;BR/&gt; 62087: (0.361272%)&lt;BR/&gt; 62086: (0.361272%)&gt;];
}
624--703[label="0.00609756;1pkt 1fpkt"];
624--762[label="0.00854701;1pkt 1fpkt"];
624--763[label="0.015625;1pkt 1fpkt"];
624--861[label="0.00609756;1pkt 1fpkt"];
624--864[label="0.00609756;1pkt 1fpkt"];
624--903[label="0.0121951;2pkt 2fpkt"];
624--910[label="0.00680272;1pkt 1fpkt"];
624--950[label="0.0428571;6pkt 6fpkt"];
624--1054[label="0.00769231;1pkt 1fpkt"];
624--1158[label="0.04;5pkt 5fpkt"];
624--1494[label="0.0126582;1pkt 1fpkt"];
624--1495[label="0.0222222;1pkt 1fpkt"];
624--1572[label="1;164pkt 164fpkt"];
624--1852[label="0.0121951;2pkt 2fpkt"];
624--1985[label="0.00680272;1pkt 1fpkt"];
624--2125[label="0.00609756;1pkt 1fpkt"];
624--2139[label="0.00609756;1pkt 1fpkt"];
624--2201[label="0.00671141;1pkt 1fpkt"];
624--2278[label="1;25pkt 25fpkt"];
624--2324[label="1;54pkt 54fpkt"];
624--2382[label="0.0133333;1pkt 1fpkt"];
624--2563[label="0.0151515;1pkt 1fpkt"];
624--2684[label="0.00680272;1pkt 1fpkt"];
624--2755[label="0.00609756;1pkt 1fpkt"];
624--2763[label="0.00609756;1pkt 1fpkt"];
624--2793[label="0.00671141;1pkt 1fpkt"];
624--2834[label="1;25pkt 25fpkt"];
624--2876[label="0.0133333;1pkt 1fpkt"];
624--2953[label="0.0149254;1pkt 1fpkt"];
624--3039[label="0.00609756;1pkt 1fpkt"];
624--3054[label="0.00671141;1pkt 1fpkt"];
648--785[label="1;2pkt 2fpkt"];
648--1413[label="1;2pkt 2fpkt"];
763--783[label="0.03125;2pkt 2fpkt"];
763--785[label="0.214286;3pkt 3fpkt"];
763--1251[label="0.015625;1pkt 1fpkt"];
763--1263[label="0.015625;1pkt 1fpkt"];
763--1374[label="0.015625;1pkt 1fpkt"];
763--1443[label="0.015625;1pkt 1fpkt"];
763--1489[label="0.015625;1pkt 1fpkt"];
763--1495[label="1;45pkt 45fpkt"];
763--1572[label="0.015625;1pkt 1fpkt"];
763--1616[label="0.03125;2pkt 2fpkt"];
763--1688[label="0.015625;1pkt 1fpkt"];
763--1700[label="0.0625;4pkt 4fpkt"];
763--1754[label="0.015625;1pkt 1fpkt"];
763--1773[label="0.015625;1pkt 1fpkt"];
763--1818[label="0.015625;1pkt 1fpkt"];
763--2563[label="0.984375;63pkt 63fpkt"];
763--2953[label="1;64pkt 64fpkt"];
785--1413[label="1;2pkt 2fpkt"];
785--1495[label="0.214286;3pkt 3fpkt"];
785--2563[label="0.214286;3pkt 3fpkt"];
785--2953[label="0.214286;3pkt 3fpkt"];
1495--1572[label="0.0222222;1pkt 1fpkt"];
1495--1616[label="0.0444444;2pkt 2fpkt"];
1495--1688[label="0.0222222;1pkt 1fpkt"];
1495--1700[label="0.0888889;4pkt 4fpkt"];
1495--1754[label="0.0222222;1pkt 1fpkt"];
1495--1773[label="0.0222222;1pkt 1fpkt"];
1495--1818[label="0.0222222;1pkt 1fpkt"];
1495--2563[label="1;45pkt 45fpkt"];
1495--2953[label="1;45pkt 45fpkt"];
1572--1852[label="0.0121951;2pkt 2fpkt"];
1572--1985[label="0.00680272;1pkt 1fpkt"];
1572--2125[label="0.00609756;1pkt 1fpkt"];
1572--2139[label="0.00609756;1pkt 1fpkt"];
1572--2201[label="0.00671141;1pkt 1fpkt"];
1572--2278[label="1;25pkt 25fpkt"];
1572--2324[label="1;54pkt 54fpkt"];
1572--2382[label="0.0133333;1pkt 1fpkt"];
1572--2563[label="0.0151515;1pkt 1fpkt"];
1572--2684[label="0.00680272;1pkt 1fpkt"];
1572--2755[label="0.00609756;1pkt 1fpkt"];
1572--2763[label="0.00609756;1pkt 1fpkt"];
1572--2793[label="0.00671141;1pkt 1fpkt"];
1572--2834[label="1;25pkt 25fpkt"];
1572--2876[label="0.0133333;1pkt 1fpkt"];
1572--2953[label="0.0149254;1pkt 1fpkt"];
1572--3039[label="0.00609756;1pkt 1fpkt"];
1572--3054[label="0.00671141;1pkt 1fpkt"];
2278--2834[label="1;25pkt 25fpkt"];
2563--2953[label="1;66pkt 66fpkt"];
</description>
    <slice>
      <filter src_ip="214.119.105.226" src_port="80"/>
      <filter dst_ip="143.57.7.222" src_ip="216.49.128.141" src_port="80"/>
    </slice>
    <from sec="991803604" usec="0"/>
    <to sec="991804215" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677781,1.59484,020,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_157{
style=filled;
color=gray75;
1151[label="137.248.160.200;s;3pkt 3fpkt", shape=diamond, color=yellow];
1715[label="137.248.160.200;s;3pkt 3fpkt", shape=hexagon, color=black];
2505[label="137.248.160.200;3pkt 3fpkt", shape=pentagon, color=darkviolet];
stat157[shape=component, label=&lt;Rules:&lt;BR/&gt;{137.248.160.200:0, 167.26.148.18:0}[33.3333%]&lt;BR/&gt;{137.248.160.200:0, 49.181.223.168:0}[33.3333%]&lt;BR/&gt;{137.248.160.200:0, 49.176.33.190:0}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1151--1715[label="1;3pkt 3fpkt"];
1151--2505[label="1;3pkt 3fpkt"];
1715--2505[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="49.176.33.190" src_ip="137.248.160.200"/>
      <filter dst_ip="49.181.223.168" src_ip="137.248.160.200"/>
      <filter dst_ip="167.26.148.18" src_ip="137.248.160.200"/>
    </slice>
    <from sec="991803602" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.990447,1.59474,503,0 0 0 1 1 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_158{
style=filled;
color=gray75;
555[label="137.248.50.206;d;173pkt 173fpkt", shape=diamond, color=yellow];
936[label="214.51.34.185;s;105pkt 105fpkt", shape=diamond, color=yellow];
1051[label="214.199.200.203;s;54pkt 54fpkt", shape=diamond, color=yellow];
1652[label="214.199.200.203;s;45pkt 45fpkt", shape=hexagon, color=black];
1710[label="137.248.50.206;d;172pkt 172fpkt", shape=hexagon, color=black];
2460[label="214.51.34.185;119pkt 119fpkt", shape=pentagon, color=darkviolet];
2907[label="214.51.34.185;119pkt 119fpkt", shape=invtriangle, color=brown];
3114[label="214.51.34.185;120pkt 120fpkt", shape=invhouse, color=bisque];
stat158[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.51.34.185:80, 137.248.50.206:*}[53.3333%]&lt;BR/&gt;{214.199.200.203:80, *:*}[24%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 7625: (0.330761%)&lt;BR/&gt; 7561: (0.330761%)&lt;BR/&gt; 7498: (0.330761%)&lt;BR/&gt; 7497: (0.330761%)&gt;];
}
555--936[label="1;105pkt 105fpkt"];
555--1038[label="0.163265;8pkt 8fpkt"];
555--1051[label="0.314815;17pkt 17fpkt"];
555--1283[label="0.00578035;1pkt 1fpkt"];
555--1652[label="0.377778;17pkt 17fpkt"];
555--1710[label="1;172pkt 172fpkt"];
555--1806[label="0.00578035;1pkt 1fpkt"];
555--1998[label="0.0769231;2pkt 2fpkt"];
555--2460[label="0.87395;104pkt 104fpkt"];
555--2907[label="0.87395;104pkt 104fpkt"];
555--3114[label="0.875;105pkt 105fpkt"];
936--1710[label="1;105pkt 105fpkt"];
936--2460[label="0.990476;104pkt 104fpkt"];
936--2907[label="0.990476;104pkt 104fpkt"];
936--3114[label="1;105pkt 105fpkt"];
1051--1205[label="0.151515;5pkt 5fpkt"];
1051--1251[label="0.0740741;4pkt 4fpkt"];
1051--1648[label="0.0185185;1pkt 1fpkt"];
1051--1652[label="1;45pkt 45fpkt"];
1051--1710[label="0.314815;17pkt 17fpkt"];
1051--1724[label="0.0185185;1pkt 1fpkt"];
1051--1734[label="0.151515;5pkt 5fpkt"];
1051--1754[label="0.037037;2pkt 2fpkt"];
1652--1710[label="0.377778;17pkt 17fpkt"];
1652--1724[label="0.0222222;1pkt 1fpkt"];
1652--1734[label="0.121212;4pkt 4fpkt"];
1652--1754[label="0.0444444;2pkt 2fpkt"];
1710--1806[label="0.00581395;1pkt 1fpkt"];
1710--1998[label="0.0769231;2pkt 2fpkt"];
1710--2460[label="0.87395;104pkt 104fpkt"];
1710--2907[label="0.87395;104pkt 104fpkt"];
1710--3114[label="0.875;105pkt 105fpkt"];
2460--2907[label="1;119pkt 119fpkt"];
2460--3114[label="1;119pkt 119fpkt"];
2907--3114[label="1;119pkt 119fpkt"];
</description>
    <slice>
      <filter src_ip="214.199.200.203" src_port="80"/>
      <filter dst_ip="137.248.50.206" src_ip="214.51.34.185" src_port="80"/>
    </slice>
    <from sec="991803601" usec="0"/>
    <to sec="991804204" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_159{
style=filled;
color=gray75;
1199[label="219.14.34.40;d;1pkt 1fpkt", shape=diamond, color=yellow];
1732[label="219.14.34.40;d;1pkt 1fpkt", shape=hexagon, color=black];
stat159[shape=component, label=&lt;Rules:&lt;BR/&gt;{143.50.200.219:80, 219.14.34.40:22091}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 22091: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
1199--1732[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="219.14.34.40" dst_port="22091" src_ip="143.50.200.219" src_port="80"/>
    </slice>
    <from sec="991803774" usec="0"/>
    <to sec="991804153" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_161{
style=filled;
color=gray75;
311[label="208.105.110.172;s;39pkt 39fpkt", shape=diamond, color=yellow];
312[label="217.66.176.167;d;11pkt 11fpkt", shape=diamond, color=yellow];
1212[label="208.230.5.108;d;1pkt 1fpkt", shape=diamond, color=yellow];
1294[label="208.105.110.172;s;33pkt 33fpkt", shape=hexagon, color=black];
1295[label="217.66.176.167;d;7pkt 7fpkt", shape=hexagon, color=black];
1738[label="208.230.5.108;d;1pkt 1fpkt", shape=hexagon, color=black];
stat161[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.105.110.172:80, 203.37.89.73:*}[33.3333%]&lt;BR/&gt;{208.105.110.172:80, 217.66.176.167:*}[28.2051%]&lt;BR/&gt;{208.105.110.172:80, 217.202.39.76:*}[25.641%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 55445: (2.17391%)&lt;BR/&gt; 55444: (2.17391%)&lt;BR/&gt; 55443: (2.17391%)&lt;BR/&gt; 55442: (2.17391%)&gt;];
}
311--312[label="1;11pkt 11fpkt"];
311--1212[label="1;1pkt 1fpkt"];
311--1294[label="1;33pkt 33fpkt"];
311--1295[label="1;7pkt 7fpkt"];
311--1738[label="1;1pkt 1fpkt"];
312--1294[label="0.636364;7pkt 7fpkt"];
312--1295[label="1;7pkt 7fpkt"];
1212--1738[label="1;1pkt 1fpkt"];
1294--1295[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="203.37.89.73" src_ip="208.105.110.172" src_port="80"/>
      <filter dst_ip="217.66.176.167" src_ip="208.105.110.172" src_port="80"/>
      <filter dst_ip="217.202.39.76" src_ip="208.105.110.172" src_port="80"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785791,1.58311,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_162{
style=filled;
color=gray75;
1090[label="143.50.237.90;d;68pkt 68fpkt", shape=diamond, color=yellow];
1739[label="143.50.237.90;d;68pkt 68fpkt", shape=hexagon, color=black];
2298[label="204.36.66.136;24pkt 24fpkt", shape=pentagon, color=darkviolet];
2551[label="205.194.161.217;32pkt 32fpkt", shape=pentagon, color=darkviolet];
2559[label="205.194.161.220;33pkt 33fpkt", shape=pentagon, color=darkviolet];
2715[label="173.96.167.54;1pkt 1fpkt", shape=invtriangle, color=brown];
stat162[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.194.161.220:80, 143.50.237.90:*}[31.1321%]&lt;BR/&gt;{205.194.161.217:80, 143.50.237.90:*}[30.1887%]&lt;BR/&gt;{204.36.66.136:80, 143.50.237.90:*}[22.6415%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1829: (0.663717%)&lt;BR/&gt; 1828: (0.663717%)&lt;BR/&gt; 1827: (0.663717%)&lt;BR/&gt; 1826: (0.663717%)&gt;];
}
1090--1739[label="1;68pkt 68fpkt"];
1090--2298[label="1;24pkt 24fpkt"];
1090--2551[label="0.4375;14pkt 14fpkt"];
1090--2559[label="0.393939;13pkt 13fpkt"];
1090--2715[label="1;1pkt 1fpkt"];
1739--2298[label="1;24pkt 24fpkt"];
1739--2551[label="0.4375;14pkt 14fpkt"];
1739--2559[label="0.393939;13pkt 13fpkt"];
1739--2715[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="143.50.237.90" src_ip="205.194.161.220" src_port="80"/>
      <filter dst_ip="143.50.237.90" src_ip="205.194.161.217" src_port="80"/>
      <filter dst_ip="143.50.237.90" src_ip="204.36.66.136" src_port="80"/>
    </slice>
    <from sec="991803741" usec="0"/>
    <to sec="991804217" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.07594,1.7887,999,0 0 0 0 0 1 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="10.1.2.25"/>
      <from sec="991803932" usec="0"/>
      <to sec="991804126" usec="0"/>
    </slice>
    <from sec="991803932" usec="0"/>
    <to sec="991804126" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_164{
style=filled;
color=gray75;
558[label="208.152.161.18;d;223pkt 223fpkt", shape=diamond, color=yellow];
774[label="48.137.93.226;s;15pkt 15fpkt", shape=diamond, color=yellow];
931[label="203.177.93.235;s;107pkt 107fpkt", shape=diamond, color=yellow];
1383[label="208.152.161.18;d;149pkt 149fpkt", shape=hexagon, color=black];
1667[label="203.177.93.235;s;107pkt 107fpkt", shape=hexagon, color=black];
stat164[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.177.93.235:80, 208.152.161.18:*}[51.1211%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (38.7687%)&lt;BR/&gt; 62439: (5.15807%)&lt;BR/&gt; 53: (5.15807%)&lt;BR/&gt; 0: (1.83028%)&lt;BR/&gt; 4401: (0.499168%)&gt;];
}
558--774[label="1;15pkt 15fpkt"];
558--931[label="1;107pkt 107fpkt"];
558--1383[label="1;149pkt 149fpkt"];
558--1667[label="1;107pkt 107fpkt"];
558--2121[label="0.0136986;1pkt 1fpkt"];
558--2335[label="0.0149254;1pkt 1fpkt"];
558--2422[label="0.030303;1pkt 1fpkt"];
558--2554[label="0.0526316;1pkt 1fpkt"];
558--2600[label="0.0153846;1pkt 1fpkt"];
558--2973[label="0.0185185;1pkt 1fpkt"];
774--1383[label="0.533333;8pkt 8fpkt"];
931--1383[label="0.831776;89pkt 89fpkt"];
931--1667[label="1;107pkt 107fpkt"];
1383--1667[label="0.831776;89pkt 89fpkt"];
1383--2422[label="0.030303;1pkt 1fpkt"];
1383--2554[label="0.0526316;1pkt 1fpkt"];
1383--2600[label="0.0153846;1pkt 1fpkt"];
1383--2973[label="0.0185185;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="208.152.161.18" src_ip="203.177.93.235" src_port="80"/>
    </slice>
    <from sec="991803601" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.07594,1.7887,999,0 0 0 0 0 1 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="10.2.2.25"/>
      <from sec="991803932" usec="0"/>
      <to sec="991803977" usec="0"/>
    </slice>
    <from sec="991803932" usec="0"/>
    <to sec="991803977" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.121.9.1"/>
    </slice>
    <from sec="991803995" usec="0"/>
    <to sec="991804060" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="206.0.31.1"/>
    </slice>
    <from sec="991803991" usec="0"/>
    <to sec="991804008" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.253.107.4"/>
    </slice>
    <from sec="991804149" usec="0"/>
    <to sec="991804223" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,011,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_173{
style=filled;
color=gray75;
277[label="137.248.192.160;d;515pkt 515fpkt", shape=diamond, color=yellow];
540[label="203.129.62.229;s;16pkt 16fpkt", shape=diamond, color=yellow];
638[label="212.196.250.165;s;450pkt 450fpkt", shape=diamond, color=yellow];
1514[label="212.196.250.165;s;450pkt 450fpkt", shape=hexagon, color=black];
stat173[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.196.250.165:80, 137.248.192.160:*}[87.3786%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.7205%)&lt;BR/&gt; 1066: (0.174703%)&lt;BR/&gt; 1065: (0.174703%)&lt;BR/&gt; 1064: (0.174703%)&lt;BR/&gt; 1063: (0.174703%)&gt;];
}
277--424[label="0.0135922;7pkt 7fpkt"];
277--540[label="1;16pkt 16fpkt"];
277--638[label="1;450pkt 450fpkt"];
277--741[label="0.00888889;2pkt 2fpkt"];
277--1155[label="0.0165289;2pkt 2fpkt"];
277--1445[label="0.011396;4pkt 4fpkt"];
277--1514[label="1;450pkt 450fpkt"];
277--1873[label="0.0162602;2pkt 2fpkt"];
277--2432[label="0.0135922;7pkt 7fpkt"];
638--1514[label="1;450pkt 450fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.192.160" src_ip="212.196.250.165" src_port="80"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.533239,1.64144,020,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_174{
style=filled;
color=gray75;
1011[label="208.112.62.7;s;39pkt 39fpkt", shape=diamond, color=yellow];
1880[label="208.112.62.7;44pkt 44fpkt", shape=pentagon, color=darkviolet];
stat174[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.112.62.7:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1011--1880[label="1;39pkt 39fpkt"];
</description>
    <slice>
      <filter src_ip="208.112.62.7"/>
    </slice>
    <from sec="991803601" usec="0"/>
    <to sec="991804229" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="17.21.128.7"/>
    </slice>
    <from sec="991803603" usec="0"/>
    <to sec="991803982" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="207.104.223.7"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="17.171.231.11"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="151.144.25.14"/>
    </slice>
    <from sec="991803739" usec="0"/>
    <to sec="991803749" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.133.200.14"/>
    </slice>
    <from sec="991803616" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="150.62.174.15"/>
    </slice>
    <from sec="991803765" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.235.244.16"/>
    </slice>
    <from sec="991803604" usec="0"/>
    <to sec="991804174" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.152.161.18"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="204.78.160.20"/>
    </slice>
    <from sec="991803601" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03997,1.59051,503,1 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_185{
style=filled;
color=gray75;
45[label="208.152.185.255s;1pkt 1fpkt", shape=rectangle, color=red];
51[label="169.38.145.24d;1pkt 1fpkt", shape=rectangle, color=red];
271[label="157.61.155.104;d;1pkt 1fpkt", shape=diamond, color=yellow];
368[label="208.152.185.255;s;871pkt 871fpkt", shape=diamond, color=yellow];
434[label="174.55.87.245;d;1pkt 1fpkt", shape=diamond, color=yellow];
767[label="206.210.136.89;d;169pkt 169fpkt", shape=diamond, color=yellow];
792[label="4.117.226.148;d;313pkt 313fpkt", shape=diamond, color=yellow];
1045[label="169.41.21.50;s;63pkt 63fpkt", shape=diamond, color=yellow];
1058[label="209.209.209.20;s;50pkt 50fpkt", shape=diamond, color=yellow];
1216[label="209.209.212.216;s;3pkt 3fpkt", shape=diamond, color=yellow];
1236[label="218.124.99.24;d;8pkt 8fpkt", shape=diamond, color=yellow];
1498[label="206.210.136.89;d;169pkt 169fpkt", shape=hexagon, color=black];
1516[label="4.117.226.148;d;313pkt 313fpkt", shape=hexagon, color=black];
1600[label="157.61.155.104;d;1pkt 1fpkt", shape=hexagon, color=black];
1750[label="218.124.99.24;d;8pkt 8fpkt", shape=hexagon, color=black];
1932[label="209.209.209.20;60pkt 60fpkt", shape=pentagon, color=darkviolet];
2037[label="169.41.21.50;87pkt 87fpkt", shape=pentagon, color=darkviolet];
2664[label="209.209.209.20;60pkt 60fpkt", shape=invtriangle, color=brown];
stat185[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.152.185.255:*, 4.117.226.148:80}[30.6262%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.3056%)&lt;BR/&gt; 53: (3.30427%)&lt;BR/&gt; 59780: (0.114732%)&lt;BR/&gt; 59686: (0.114732%)&lt;BR/&gt; 59680: (0.114732%)&gt;];
}
45--51[label="1;1pkt 1fpkt"];
45--271[label="1;1pkt 1fpkt"];
45--368[label="1;1pkt 1fpkt"];
45--1600[label="1;1pkt 1fpkt"];
51--271[label="1;1pkt 1fpkt"];
51--368[label="1;1pkt 1fpkt"];
51--1600[label="1;1pkt 1fpkt"];
271--368[label="1;1pkt 1fpkt"];
271--1600[label="1;1pkt 1fpkt"];
368--377[label="0.142857;1pkt 1fpkt"];
368--434[label="1;1pkt 1fpkt"];
368--767[label="0.431953;73pkt 73fpkt"];
368--792[label="1;313pkt 313fpkt"];
368--902[label="0.0645161;4pkt 4fpkt"];
368--1046[label="0.0952381;4pkt 4fpkt"];
368--1055[label="0.0217391;1pkt 1fpkt"];
368--1137[label="0.00641026;1pkt 1fpkt"];
368--1236[label="1;8pkt 8fpkt"];
368--1496[label="0.19;19pkt 19fpkt"];
368--1498[label="0.431953;73pkt 73fpkt"];
368--1516[label="1;313pkt 313fpkt"];
368--1600[label="1;1pkt 1fpkt"];
368--1649[label="0.0952381;4pkt 4fpkt"];
368--1653[label="0.0217391;1pkt 1fpkt"];
368--1750[label="1;8pkt 8fpkt"];
368--1781[label="0.306452;19pkt 19fpkt"];
368--1812[label="0.027027;1pkt 1fpkt"];
368--1827[label="0.00803674;7pkt 7fpkt"];
368--1834[label="0.0126292;11pkt 11fpkt"];
368--1838[label="0.00803674;7pkt 7fpkt"];
368--1846[label="0.00803674;7pkt 7fpkt"];
767--1045[label="1;63pkt 63fpkt"];
767--1058[label="0.58;29pkt 29fpkt"];
767--1216[label="1;3pkt 3fpkt"];
767--1315[label="0.00591716;1pkt 1fpkt"];
767--1498[label="1;169pkt 169fpkt"];
767--1786[label="0.00591716;1pkt 1fpkt"];
767--1827[label="0.100592;17pkt 17fpkt"];
767--1838[label="0.100592;17pkt 17fpkt"];
767--1846[label="0.100592;17pkt 17fpkt"];
767--1932[label="0.483333;29pkt 29fpkt"];
767--2037[label="0.724138;63pkt 63fpkt"];
767--2664[label="0.483333;29pkt 29fpkt"];
792--1516[label="1;313pkt 313fpkt"];
1045--1498[label="1;63pkt 63fpkt"];
1045--1827[label="0.253968;16pkt 16fpkt"];
1045--1838[label="0.253968;16pkt 16fpkt"];
1045--1846[label="0.253968;16pkt 16fpkt"];
1045--2037[label="1;63pkt 63fpkt"];
1058--1498[label="0.58;29pkt 29fpkt"];
1058--1827[label="0.04;2pkt 2fpkt"];
1058--1838[label="0.04;2pkt 2fpkt"];
1058--1846[label="0.04;2pkt 2fpkt"];
1058--1932[label="1;50pkt 50fpkt"];
1058--2664[label="1;50pkt 50fpkt"];
1216--1498[label="1;3pkt 3fpkt"];
1236--1750[label="1;8pkt 8fpkt"];
1498--1786[label="0.00591716;1pkt 1fpkt"];
1498--1827[label="0.100592;17pkt 17fpkt"];
1498--1838[label="0.100592;17pkt 17fpkt"];
1498--1846[label="0.100592;17pkt 17fpkt"];
1498--1932[label="0.483333;29pkt 29fpkt"];
1498--2037[label="0.724138;63pkt 63fpkt"];
1498--2664[label="0.483333;29pkt 29fpkt"];
1932--2664[label="1;60pkt 60fpkt"];
</description>
    <slice>
      <filter dst_ip="4.117.226.148" dst_port="80" src_ip="208.152.185.255"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="17.105.252.22"/>
    </slice>
    <from sec="991803632" usec="0"/>
    <to sec="991803652" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="161.237.238.23"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_188{
style=filled;
color=gray75;
1952[label="175.221.166.25;159pkt 159fpkt", shape=pentagon, color=darkviolet];
stat188[shape=component, label=&lt;Rules:&lt;BR/&gt;{175.221.166.25:*, 209.253.226.135:53}[39.6226%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (45.9119%)&lt;BR/&gt; 0: (3.77358%)&lt;BR/&gt; 6667: (0.943396%)&lt;BR/&gt; 113: (0.943396%)&lt;BR/&gt; 25152: (0.628931%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="209.253.226.135" dst_port="53" src_ip="175.221.166.25"/>
    </slice>
    <from sec="991803604" usec="0"/>
    <to sec="991804218" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="204.138.6.27"/>
    </slice>
    <from sec="991804209" usec="0"/>
    <to sec="991804227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.42.82.27"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.665151,1.63004,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_191{
style=filled;
color=gray75;
635[label="137.248.166.28;s;15pkt 15fpkt", shape=diamond, color=yellow];
1961[label="137.248.166.28;15pkt 15fpkt", shape=pentagon, color=darkviolet];
2674[label="137.248.166.28;15pkt 15fpkt", shape=invtriangle, color=brown];
stat191[shape=component, label=&lt;Rules:&lt;BR/&gt;{137.248.166.28:*, 221.84.23.77:80}[93.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1192: (3.33333%)&lt;BR/&gt; 1191: (3.33333%)&lt;BR/&gt; 1190: (3.33333%)&lt;BR/&gt; 1189: (3.33333%)&gt;];
}
635--1961[label="1;15pkt 15fpkt"];
635--2674[label="1;15pkt 15fpkt"];
1961--2674[label="1;15pkt 15fpkt"];
</description>
    <slice>
      <filter dst_ip="221.84.23.77" dst_port="80" src_ip="137.248.166.28"/>
    </slice>
    <from sec="991803672" usec="0"/>
    <to sec="991803818" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.49.39.29"/>
    </slice>
    <from sec="991803619" usec="0"/>
    <to sec="991803719" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.177.62.29"/>
    </slice>
    <from sec="991803622" usec="0"/>
    <to sec="991803850" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.105.155.29"/>
    </slice>
    <from sec="991803603" usec="0"/>
    <to sec="991804227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="49.133.17.32"/>
    </slice>
    <from sec="991803662" usec="0"/>
    <to sec="991804213" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="152.71.131.34"/>
    </slice>
    <from sec="991803917" usec="0"/>
    <to sec="991804121" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="171.35.166.35"/>
    </slice>
    <from sec="991804007" usec="0"/>
    <to sec="991804147" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677781,1.59484,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_198{
style=filled;
color=gray75;
552[label="143.50.20.64;s;10pkt 10fpkt", shape=diamond, color=yellow];
690[label="137.248.162.36;s;53pkt 53fpkt", shape=diamond, color=yellow];
737[label="17.21.128.7;d;1pkt 1fpkt", shape=diamond, color=yellow];
930[label="17.188.40.133;d;2pkt 2fpkt", shape=diamond, color=yellow];
952[label="195.225.119.106;d;2pkt 2fpkt", shape=diamond, color=yellow];
1580[label="195.225.119.106;d;2pkt 2fpkt", shape=hexagon, color=black];
1666[label="17.188.40.133;d;2pkt 2fpkt", shape=hexagon, color=black];
1995[label="137.248.162.36;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat198[shape=component, label=&lt;Rules:&lt;BR/&gt;{137.248.162.36:0, *:0}[80.9524%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (82.1918%)&lt;BR/&gt; 6699: (3.42466%)&lt;BR/&gt; 30: (3.42466%)&lt;BR/&gt; 1149: (2.73973%)&lt;BR/&gt; 1271: (2.05479%)&gt;];
}
552--737[label="1;1pkt 1fpkt"];
552--930[label="0.5;1pkt 1fpkt"];
552--952[label="1;2pkt 2fpkt"];
552--1580[label="1;2pkt 2fpkt"];
552--1666[label="0.5;1pkt 1fpkt"];
690--930[label="0.5;1pkt 1fpkt"];
690--1666[label="0.5;1pkt 1fpkt"];
690--1995[label="1;1pkt 1fpkt"];
930--1666[label="1;2pkt 2fpkt"];
930--1995[label="1;1pkt 1fpkt"];
952--1580[label="1;2pkt 2fpkt"];
1666--1995[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="137.248.162.36"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="137.80.151.38"/>
    </slice>
    <from sec="991803622" usec="0"/>
    <to sec="991804190" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="137.248.176.38"/>
    </slice>
    <from sec="991803696" usec="0"/>
    <to sec="991803929" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.990447,1.59474,999,0 0 0 1 1 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_201{
style=filled;
color=gray75;
285[label="208.152.161.129;d;312pkt 312fpkt", shape=diamond, color=yellow];
529[label="175.221.162.60;d;272pkt 272fpkt", shape=diamond, color=yellow];
676[label="175.221.170.222;d;964pkt 964fpkt", shape=diamond, color=yellow];
860[label="175.221.172.163;d;92pkt 92fpkt", shape=diamond, color=yellow];
985[label="91.151.80.238;s;26pkt 26fpkt", shape=diamond, color=yellow];
1021[label="175.221.170.23;d;82pkt 82fpkt", shape=diamond, color=yellow];
1033[label="195.135.202.38;s;49pkt 49fpkt", shape=diamond, color=yellow];
1141[label="195.135.202.41;s;48pkt 48fpkt", shape=diamond, color=yellow];
1542[label="208.152.161.129;d;229pkt 229fpkt", shape=hexagon, color=black];
1554[label="175.221.162.60;d;215pkt 215fpkt", shape=hexagon, color=black];
1618[label="91.151.80.238;s;25pkt 25fpkt", shape=hexagon, color=black];
1637[label="175.221.170.23;d;68pkt 68fpkt", shape=hexagon, color=black];
1875[label="91.151.82.5;27pkt 27fpkt", shape=pentagon, color=darkviolet];
1918[label="195.73.56.17;29pkt 29fpkt", shape=pentagon, color=darkviolet];
1944[label="204.188.104.24;9pkt 9fpkt", shape=pentagon, color=darkviolet];
2008[label="4.76.231.39;10pkt 10fpkt", shape=pentagon, color=darkviolet];
2088[label="207.104.220.68;5pkt 5fpkt", shape=pentagon, color=darkviolet];
2155[label="91.151.85.84;13pkt 13fpkt", shape=pentagon, color=darkviolet];
2182[label="208.219.124.91;24pkt 24fpkt", shape=pentagon, color=darkviolet];
2237[label="213.66.115.109;108pkt 108fpkt", shape=pentagon, color=darkviolet];
2282[label="91.151.80.131;23pkt 23fpkt", shape=pentagon, color=darkviolet];
2295[label="208.208.83.135;7pkt 7fpkt", shape=pentagon, color=darkviolet];
2312[label="208.217.214.138;35pkt 35fpkt", shape=pentagon, color=darkviolet];
2475[label="130.206.24.189;11pkt 11fpkt", shape=pentagon, color=darkviolet];
2509[label="208.217.221.201;24pkt 24fpkt", shape=pentagon, color=darkviolet];
2668[label="204.188.104.24;9pkt 9fpkt", shape=invtriangle, color=brown];
2695[label="4.76.231.39;11pkt 11fpkt", shape=invtriangle, color=brown];
2738[label="207.104.220.68;5pkt 5fpkt", shape=invtriangle, color=brown];
2771[label="91.151.85.84;14pkt 14fpkt", shape=invtriangle, color=brown];
2784[label="208.219.124.91;25pkt 25fpkt", shape=invtriangle, color=brown];
2853[label="208.217.214.138;35pkt 35fpkt", shape=invtriangle, color=brown];
2930[label="208.217.221.201;25pkt 25fpkt", shape=invtriangle, color=brown];
3004[label="204.188.104.24;10pkt 10fpkt", shape=invhouse, color=bisque];
3049[label="208.219.124.91;25pkt 25fpkt", shape=invhouse, color=bisque];
3082[label="208.217.214.138;35pkt 35fpkt", shape=invhouse, color=bisque];
stat201[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:25, 175.221.170.222:*}[40.8631%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (42.9162%)&lt;BR/&gt; 113: (4.0848%)&lt;BR/&gt; 80: (1.80972%)&lt;BR/&gt; 0: (0.689417%)&lt;BR/&gt; 53: (0.60324%)&gt;];
}
285--505[label="0.00520833;1pkt 1fpkt"];
285--528[label="0.0147059;2pkt 2fpkt"];
285--564[label="0.00564972;1pkt 1fpkt"];
285--582[label="0.00574713;1pkt 1fpkt"];
285--589[label="0.00564972;1pkt 1fpkt"];
285--854[label="0.03125;1pkt 1fpkt"];
285--1141[label="0.0208333;1pkt 1fpkt"];
285--1152[label="0.04;1pkt 1fpkt"];
285--1386[label="0.00564972;1pkt 1fpkt"];
285--1542[label="1;229pkt 229fpkt"];
285--1546[label="0.00520833;1pkt 1fpkt"];
285--1565[label="0.00591716;1pkt 1fpkt"];
285--1826[label="0.00961538;3pkt 3fpkt"];
285--1833[label="0.0320513;10pkt 10fpkt"];
285--1837[label="0.00961538;3pkt 3fpkt"];
285--1845[label="0.00961538;3pkt 3fpkt"];
285--2150[label="0.00534759;1pkt 1fpkt"];
285--2182[label="0.0416667;1pkt 1fpkt"];
285--2237[label="0.0833333;9pkt 9fpkt"];
285--2295[label="0.142857;1pkt 1fpkt"];
285--2784[label="0.04;1pkt 1fpkt"];
285--3049[label="0.04;1pkt 1fpkt"];
529--564[label="0.0112994;2pkt 2fpkt"];
529--572[label="0.0110497;2pkt 2fpkt"];
529--582[label="0.00574713;1pkt 1fpkt"];
529--589[label="0.0112994;2pkt 2fpkt"];
529--823[label="0.0232558;1pkt 1fpkt"];
529--837[label="0.0277778;1pkt 1fpkt"];
529--928[label="0.0188679;1pkt 1fpkt"];
529--985[label="0.0384615;1pkt 1fpkt"];
529--1033[label="0.142857;7pkt 7fpkt"];
529--1141[label="0.458333;22pkt 22fpkt"];
529--1152[label="0.04;1pkt 1fpkt"];
529--1386[label="0.0112994;2pkt 2fpkt"];
529--1546[label="0.00520833;1pkt 1fpkt"];
529--1554[label="1;215pkt 215fpkt"];
529--1565[label="0.00591716;1pkt 1fpkt"];
529--1618[label="0.04;1pkt 1fpkt"];
529--1689[label="0.0232558;1pkt 1fpkt"];
529--1827[label="0.00735294;2pkt 2fpkt"];
529--1832[label="0.00367647;1pkt 1fpkt"];
529--1833[label="0.0441176;12pkt 12fpkt"];
529--1838[label="0.00735294;2pkt 2fpkt"];
529--1843[label="0.00367647;1pkt 1fpkt"];
529--1846[label="0.00735294;2pkt 2fpkt"];
529--1851[label="0.00367647;1pkt 1fpkt"];
529--1875[label="0.037037;1pkt 1fpkt"];
529--2136[label="0.027027;1pkt 1fpkt"];
529--2150[label="0.00534759;1pkt 1fpkt"];
529--2156[label="0.0105263;2pkt 2fpkt"];
529--2175[label="0.117647;2pkt 2fpkt"];
529--2237[label="0.101852;11pkt 11fpkt"];
529--2771[label="0.0714286;1pkt 1fpkt"];
676--766[label="0.0103627;2pkt 2fpkt"];
676--852[label="0.00458716;1pkt 1fpkt"];
676--854[label="0.03125;1pkt 1fpkt"];
676--985[label="0.692308;18pkt 18fpkt"];
676--1033[label="0.387755;19pkt 19fpkt"];
676--1139[label="0.0338983;2pkt 2fpkt"];
676--1141[label="0.208333;10pkt 10fpkt"];
676--1386[label="0.0112994;2pkt 2fpkt"];
676--1546[label="0.0104167;2pkt 2fpkt"];
676--1618[label="0.72;18pkt 18fpkt"];
676--1630[label="0.0103627;2pkt 2fpkt"];
676--1826[label="0.00570776;5pkt 5fpkt"];
676--1827[label="0.00207469;2pkt 2fpkt"];
676--1833[label="0.026971;26pkt 26fpkt"];
676--1837[label="0.00570776;5pkt 5fpkt"];
676--1838[label="0.00207469;2pkt 2fpkt"];
676--1845[label="0.00570776;5pkt 5fpkt"];
676--1846[label="0.00207469;2pkt 2fpkt"];
676--1875[label="0.62963;17pkt 17fpkt"];
676--1918[label="0.275862;8pkt 8fpkt"];
676--1944[label="0.444444;4pkt 4fpkt"];
676--2008[label="1;10pkt 10fpkt"];
676--2088[label="0.8;4pkt 4fpkt"];
676--2155[label="0.692308;9pkt 9fpkt"];
676--2175[label="0.117647;2pkt 2fpkt"];
676--2182[label="0.833333;20pkt 20fpkt"];
676--2237[label="0.0648148;7pkt 7fpkt"];
676--2282[label="0.521739;12pkt 12fpkt"];
676--2295[label="0.571429;4pkt 4fpkt"];
676--2312[label="0.914286;32pkt 32fpkt"];
676--2475[label="1;11pkt 11fpkt"];
676--2509[label="0.833333;20pkt 20fpkt"];
676--2614[label="0.00431034;1pkt 1fpkt"];
676--2668[label="0.444444;4pkt 4fpkt"];
676--2695[label="1;11pkt 11fpkt"];
676--2738[label="0.8;4pkt 4fpkt"];
676--2771[label="0.642857;9pkt 9fpkt"];
676--2784[label="0.84;21pkt 21fpkt"];
676--2853[label="0.914286;32pkt 32fpkt"];
676--2930[label="0.8;20pkt 20fpkt"];
676--3004[label="0.5;5pkt 5fpkt"];
676--3049[label="0.84;21pkt 21fpkt"];
676--3082[label="0.914286;32pkt 32fpkt"];
860--881[label="0.0120482;1pkt 1fpkt"];
860--1033[label="0.204082;10pkt 10fpkt"];
860--1141[label="0.0208333;1pkt 1fpkt"];
860--1386[label="0.0108696;1pkt 1fpkt"];
860--1546[label="0.0108696;1pkt 1fpkt"];
860--1565[label="0.0108696;1pkt 1fpkt"];
860--1916[label="0.0108696;1pkt 1fpkt"];
860--1918[label="0.0689655;2pkt 2fpkt"];
860--2121[label="0.0136986;1pkt 1fpkt"];
860--2150[label="0.0108696;1pkt 1fpkt"];
860--2156[label="0.0108696;1pkt 1fpkt"];
860--2338[label="0.0243902;1pkt 1fpkt"];
860--2656[label="0.0108696;1pkt 1fpkt"];
860--2973[label="0.0185185;1pkt 1fpkt"];
985--1052[label="0.0384615;1pkt 1fpkt"];
985--1484[label="0.0384615;1pkt 1fpkt"];
985--1554[label="0.0384615;1pkt 1fpkt"];
985--1618[label="1;25pkt 25fpkt"];
1021--1033[label="0.0612245;3pkt 3fpkt"];
1021--1141[label="0.166667;8pkt 8fpkt"];
1021--1637[label="1;68pkt 68fpkt"];
1021--1875[label="0.0740741;2pkt 2fpkt"];
1021--1918[label="0.206897;6pkt 6fpkt"];
1021--2088[label="0.2;1pkt 1fpkt"];
1021--2155[label="0.0769231;1pkt 1fpkt"];
1021--2282[label="0.0434783;1pkt 1fpkt"];
1021--2738[label="0.2;1pkt 1fpkt"];
1021--2771[label="0.0714286;1pkt 1fpkt"];
1033--1464[label="0.0222222;1pkt 1fpkt"];
1033--1554[label="0.102041;5pkt 5fpkt"];
1033--1637[label="0.0612245;3pkt 3fpkt"];
1141--1542[label="0.0208333;1pkt 1fpkt"];
1141--1554[label="0.395833;19pkt 19fpkt"];
1141--1637[label="0.166667;8pkt 8fpkt"];
1542--1546[label="0.00520833;1pkt 1fpkt"];
1542--1565[label="0.00591716;1pkt 1fpkt"];
1542--1826[label="0.0131004;3pkt 3fpkt"];
1542--1833[label="0.0436681;10pkt 10fpkt"];
1542--1837[label="0.0131004;3pkt 3fpkt"];
1542--1845[label="0.0131004;3pkt 3fpkt"];
1542--2150[label="0.00534759;1pkt 1fpkt"];
1542--2182[label="0.0416667;1pkt 1fpkt"];
1542--2237[label="0.0833333;9pkt 9fpkt"];
1542--2295[label="0.142857;1pkt 1fpkt"];
1542--2784[label="0.04;1pkt 1fpkt"];
1542--3049[label="0.04;1pkt 1fpkt"];
1554--1565[label="0.00591716;1pkt 1fpkt"];
1554--1618[label="0.04;1pkt 1fpkt"];
1554--1689[label="0.0232558;1pkt 1fpkt"];
1554--1827[label="0.00930233;2pkt 2fpkt"];
1554--1832[label="0.00465116;1pkt 1fpkt"];
1554--1833[label="0.055814;12pkt 12fpkt"];
1554--1838[label="0.00930233;2pkt 2fpkt"];
1554--1843[label="0.00465116;1pkt 1fpkt"];
1554--1846[label="0.00930233;2pkt 2fpkt"];
1554--1851[label="0.00465116;1pkt 1fpkt"];
1554--1875[label="0.037037;1pkt 1fpkt"];
1554--2136[label="0.027027;1pkt 1fpkt"];
1554--2150[label="0.00534759;1pkt 1fpkt"];
1554--2156[label="0.0105263;2pkt 2fpkt"];
1554--2175[label="0.117647;2pkt 2fpkt"];
1554--2237[label="0.0740741;8pkt 8fpkt"];
1554--2771[label="0.0714286;1pkt 1fpkt"];
1637--1875[label="0.0740741;2pkt 2fpkt"];
1637--1918[label="0.206897;6pkt 6fpkt"];
1637--2088[label="0.2;1pkt 1fpkt"];
1637--2282[label="0.0434783;1pkt 1fpkt"];
1637--2738[label="0.2;1pkt 1fpkt"];
1944--2668[label="1;9pkt 9fpkt"];
1944--3004[label="1;9pkt 9fpkt"];
2008--2695[label="1;10pkt 10fpkt"];
2088--2738[label="1;5pkt 5fpkt"];
2155--2771[label="1;13pkt 13fpkt"];
2182--2784[label="1;24pkt 24fpkt"];
2182--3049[label="1;24pkt 24fpkt"];
2312--2853[label="1;35pkt 35fpkt"];
2312--3082[label="1;35pkt 35fpkt"];
2509--2930[label="1;24pkt 24fpkt"];
2668--3004[label="1;9pkt 9fpkt"];
2784--3049[label="1;25pkt 25fpkt"];
2853--3082[label="1;35pkt 35fpkt"];
</description>
    <slice>
      <filter dst_ip="175.221.170.222" src_port="25"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804229" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="219.14.34.40"/>
    </slice>
    <from sec="991803776" usec="0"/>
    <to sec="991804229" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.209.193.43"/>
    </slice>
    <from sec="991803607" usec="0"/>
    <to sec="991804219" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="25.155.126.44"/>
    </slice>
    <from sec="991803989" usec="0"/>
    <to sec="991804005" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="217.128.179.44"/>
    </slice>
    <from sec="991804194" usec="0"/>
    <to sec="991804227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="151.144.179.46"/>
    </slice>
    <from sec="991804188" usec="0"/>
    <to sec="991804204" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,502,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="32.143.4.51"/>
    </slice>
    <from sec="991803603" usec="0"/>
    <to sec="991803933" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="219.49.29.51"/>
    </slice>
    <from sec="991803829" usec="0"/>
    <to sec="991803869" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.990447,1.59474,503,0 0 0 1 1 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_210{
style=filled;
color=gray75;
784[label="137.248.94.242;d;136pkt 136fpkt", shape=diamond, color=yellow];
1508[label="137.248.94.242;d;130pkt 130fpkt", shape=hexagon, color=black];
1970[label="91.60.21.32;19pkt 19fpkt", shape=pentagon, color=darkviolet];
2043[label="195.170.68.51;5pkt 5fpkt", shape=pentagon, color=darkviolet];
2333[label="195.165.25.143;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2584[label="203.177.93.234;29pkt 29fpkt", shape=pentagon, color=darkviolet];
2713[label="195.170.68.51;4pkt 4fpkt", shape=invtriangle, color=brown];
2863[label="195.165.25.143;3pkt 3fpkt", shape=invtriangle, color=brown];
2962[label="203.177.93.234;30pkt 30fpkt", shape=invtriangle, color=brown];
3088[label="195.165.25.143;4pkt 4fpkt", shape=invhouse, color=bisque];
stat210[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 137.248.94.242:*}[95.7143%]&lt;BR/&gt;{203.177.93.234:80, *:*}[21.4286%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.449%)&lt;BR/&gt; 2780: (0.688705%)&lt;BR/&gt; 2779: (0.688705%)&lt;BR/&gt; 2778: (0.688705%)&lt;BR/&gt; 2824: (0.550964%)&gt;];
}
784--1508[label="1;130pkt 130fpkt"];
784--1970[label="1;19pkt 19fpkt"];
784--2043[label="1;5pkt 5fpkt"];
784--2333[label="1;3pkt 3fpkt"];
784--2392[label="0.04;1pkt 1fpkt"];
784--2584[label="0.896552;26pkt 26fpkt"];
784--2713[label="1;4pkt 4fpkt"];
784--2863[label="1;3pkt 3fpkt"];
784--2882[label="0.04;1pkt 1fpkt"];
784--2962[label="0.866667;26pkt 26fpkt"];
784--3088[label="1;4pkt 4fpkt"];
1508--1970[label="1;19pkt 19fpkt"];
1508--2043[label="1;5pkt 5fpkt"];
1508--2333[label="1;3pkt 3fpkt"];
1508--2392[label="0.04;1pkt 1fpkt"];
1508--2584[label="0.896552;26pkt 26fpkt"];
1508--2713[label="1;4pkt 4fpkt"];
1508--2863[label="1;3pkt 3fpkt"];
1508--2882[label="0.04;1pkt 1fpkt"];
1508--2962[label="0.866667;26pkt 26fpkt"];
1508--3088[label="1;4pkt 4fpkt"];
2043--2713[label="1;4pkt 4fpkt"];
2333--2863[label="1;3pkt 3fpkt"];
2333--3088[label="1;3pkt 3fpkt"];
2584--2962[label="1;29pkt 29fpkt"];
2863--3088[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter src_ip="203.177.93.234" src_port="80"/>
      <filter dst_ip="137.248.94.242" src_port="80"/>
    </slice>
    <from sec="991803630" usec="0"/>
    <to sec="991804012" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="173.96.167.54"/>
    </slice>
    <from sec="991804009" usec="0"/>
    <to sec="991804056" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.194.228.57"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.160.36.58"/>
    </slice>
    <from sec="991803601" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="49.145.128.58"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="17.203.146.59"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="204.89.20.64"/>
    </slice>
    <from sec="991803646" usec="0"/>
    <to sec="991804204" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.41.243.64"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.533239,1.64144,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_219{
style=filled;
color=gray75;
1008[label="175.221.160.66;d;20pkt 20fpkt", shape=diamond, color=yellow];
1162[label="208.220.236.65;s;3pkt 3fpkt", shape=diamond, color=yellow];
2080[label="208.220.236.65;2pkt 2fpkt", shape=pentagon, color=darkviolet];
stat219[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.75.195.93:*, 175.221.160.66:*}[33.3333%]&lt;BR/&gt;{161.226.21.125:*, 175.221.160.66:*}[23.8095%]&lt;BR/&gt;{214.88.117.235:*, 175.221.160.66:*}[23.8095%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (16%)&lt;BR/&gt; 64622: (6%)&lt;BR/&gt; 63594: (4%)&lt;BR/&gt; 61122: (4%)&lt;BR/&gt; 41066: (2%)&gt;];
}
1008--1162[label="0.666667;2pkt 2fpkt"];
1008--2080[label="0.5;1pkt 1fpkt"];
1162--2080[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="175.221.160.66" src_ip="208.75.195.93"/>
      <filter dst_ip="175.221.160.66" src_ip="214.88.117.235"/>
      <filter dst_ip="175.221.160.66" src_ip="161.226.21.125"/>
    </slice>
    <from sec="991803601" usec="0"/>
    <to sec="991804172" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.533239,1.64144,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_220{
style=filled;
color=gray75;
1004[label="169.38.72.94;d;28pkt 28fpkt", shape=diamond, color=yellow];
2085[label="203.4.1.68;22pkt 22fpkt", shape=pentagon, color=darkviolet];
stat220[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.4.1.68:8888, 169.38.72.94:*}[75.8621%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8888: (48%)&lt;BR/&gt; 3068: (2%)&lt;BR/&gt; 3061: (2%)&lt;BR/&gt; 3055: (2%)&lt;BR/&gt; 3047: (2%)&gt;];
}
1004--2085[label="0.954545;21pkt 21fpkt"];
</description>
    <slice>
      <filter dst_ip="169.38.72.94" src_ip="203.4.1.68" src_port="8888"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804208" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.665151,1.63004,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_221{
style=filled;
color=gray75;
432[label="4.75.255.11;s;10pkt 10fpkt", shape=diamond, color=yellow];
680[label="143.50.246.105;d;48pkt 48fpkt", shape=diamond, color=yellow];
939[label="91.194.73.69;s;18pkt 18fpkt", shape=diamond, color=yellow];
1898[label="4.75.255.11;9pkt 9fpkt", shape=pentagon, color=darkviolet];
2092[label="91.194.73.69;17pkt 17fpkt", shape=pentagon, color=darkviolet];
2739[label="91.194.73.69;18pkt 18fpkt", shape=invtriangle, color=brown];
stat221[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.194.73.69:80, 143.50.246.105:*}[37.5%]&lt;BR/&gt;{207.108.174.144:80, 143.50.246.105:*}[27.0833%]&lt;BR/&gt;{4.75.255.11:80, 143.50.246.105:*}[20.8333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2908: (1.66667%)&lt;BR/&gt; 2907: (1.66667%)&lt;BR/&gt; 2906: (1.66667%)&lt;BR/&gt; 2904: (1.66667%)&gt;];
}
432--680[label="1;10pkt 10fpkt"];
432--1898[label="1;9pkt 9fpkt"];
680--939[label="1;18pkt 18fpkt"];
680--1898[label="1;9pkt 9fpkt"];
680--2069[label="0.0851064;4pkt 4fpkt"];
680--2092[label="1;17pkt 17fpkt"];
680--2739[label="1;18pkt 18fpkt"];
939--2092[label="1;17pkt 17fpkt"];
939--2739[label="1;18pkt 18fpkt"];
2092--2739[label="1;17pkt 17fpkt"];
</description>
    <slice>
      <filter dst_ip="143.50.246.105" src_ip="91.194.73.69" src_port="80"/>
      <filter dst_ip="143.50.246.105" src_ip="207.108.174.144" src_port="80"/>
      <filter dst_ip="143.50.246.105" src_ip="4.75.255.11" src_port="80"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804199" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="88.161.213.69"/>
    </slice>
    <from sec="991803603" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.665151,1.63004,020,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_223{
style=filled;
color=gray75;
1202[label="208.105.146.70;s;3pkt 3fpkt", shape=diamond, color=yellow];
2097[label="208.105.146.70;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2741[label="208.105.146.70;2pkt 2fpkt", shape=invtriangle, color=brown];
stat223[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.105.146.70:0, 136.92.162.9:0}[33.3333%]&lt;BR/&gt;{208.105.146.70:0, 136.92.11.139:0}[33.3333%]&lt;BR/&gt;{208.105.146.70:0, 208.222.179.203:0}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1202--2097[label="1;2pkt 2fpkt"];
1202--2741[label="1;2pkt 2fpkt"];
2097--2741[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="208.222.179.203" src_ip="208.105.146.70"/>
      <filter dst_ip="136.92.11.139" src_ip="208.105.146.70"/>
      <filter dst_ip="136.92.162.9" src_ip="208.105.146.70"/>
    </slice>
    <from sec="991803807" usec="0"/>
    <to sec="991804123" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="175.167.42.71"/>
    </slice>
    <from sec="991803802" usec="0"/>
    <to sec="991803929" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="175.221.150.72"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.43.252.72"/>
    </slice>
    <from sec="991803716" usec="0"/>
    <to sec="991804225" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.897743,1.64135,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_227{
style=filled;
color=gray75;
144[label="151.144.202.76;s;23pkt 23fpkt", shape=diamond, color=yellow];
145[label="17.185.250.98;d;2pkt 2fpkt", shape=diamond, color=yellow];
398[label="17.167.138.93;d;1pkt 1fpkt", shape=diamond, color=yellow];
1223[label="17.193.129.137;d;1pkt 1fpkt", shape=diamond, color=yellow];
2122[label="151.144.202.76;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2754[label="151.144.202.76;2pkt 2fpkt", shape=invtriangle, color=brown];
3038[label="151.144.202.76;3pkt 3fpkt", shape=invhouse, color=bisque];
stat227[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.144.202.76:*, *:6346}[34.7826%]&lt;BR/&gt;{151.144.202.76:*, 10.0.0.2:99}[21.7391%]&lt;BR/&gt;{151.144.202.76:*, 172.25.0.6:99}[21.7391%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6346: (25%)&lt;BR/&gt; 99: (16.1765%)&lt;BR/&gt; 61738: (7.35294%)&lt;BR/&gt; 61745: (5.88235%)&lt;BR/&gt; 6347: (4.41176%)&gt;];
}
144--145[label="1;2pkt 2fpkt"];
144--398[label="1;1pkt 1fpkt"];
144--1223[label="1;1pkt 1fpkt"];
144--2122[label="1;2pkt 2fpkt"];
144--2754[label="1;2pkt 2fpkt"];
144--3038[label="1;3pkt 3fpkt"];
1223--2122[label="1;1pkt 1fpkt"];
1223--2754[label="1;1pkt 1fpkt"];
1223--3038[label="1;1pkt 1fpkt"];
2122--2754[label="1;2pkt 2fpkt"];
2122--3038[label="1;2pkt 2fpkt"];
2754--3038[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_port="6346" src_ip="151.144.202.76"/>
      <filter dst_ip="172.25.0.6" dst_port="99" src_ip="151.144.202.76"/>
      <filter dst_ip="10.0.0.2" dst_port="99" src_ip="151.144.202.76"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.990447,1.59474,503,0 0 0 1 1 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_228{
style=filled;
color=gray75;
156[label="208.152.176.168;d;179pkt 179fpkt", shape=diamond, color=yellow];
580[label="91.151.117.128;s;40pkt 40fpkt", shape=diamond, color=yellow];
1420[label="208.152.176.168;d;119pkt 119fpkt", shape=hexagon, color=black];
1493[label="91.151.117.128;s;21pkt 21fpkt", shape=hexagon, color=black];
1927[label="195.135.231.19;22pkt 22fpkt", shape=pentagon, color=darkviolet];
2135[label="216.65.70.80;33pkt 33fpkt", shape=pentagon, color=darkviolet];
2164[label="91.151.114.86;24pkt 24fpkt", shape=pentagon, color=darkviolet];
2761[label="216.65.70.80;34pkt 34fpkt", shape=invtriangle, color=brown];
3042[label="216.65.70.80;34pkt 34fpkt", shape=invhouse, color=bisque];
stat228[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 208.152.176.168:*}[60.9865%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (39.6245%)&lt;BR/&gt; 1863: (4.74308%)&lt;BR/&gt; 110: (3.75494%)&lt;BR/&gt; 5190: (1.67984%)&lt;BR/&gt; 14496: (0.494071%)&gt;];
}
156--157[label="0.142857;1pkt 1fpkt"];
156--571[label="0.0111732;2pkt 2fpkt"];
156--580[label="0.4;16pkt 16fpkt"];
156--1043[label="0.0333333;2pkt 2fpkt"];
156--1051[label="0.0185185;1pkt 1fpkt"];
156--1054[label="0.00769231;1pkt 1fpkt"];
156--1420[label="1;119pkt 119fpkt"];
156--1493[label="0.380952;8pkt 8fpkt"];
156--1652[label="0.0222222;1pkt 1fpkt"];
156--1879[label="0.037037;1pkt 1fpkt"];
156--1927[label="0.454545;10pkt 10fpkt"];
156--1985[label="0.00680272;1pkt 1fpkt"];
156--2001[label="0.037037;1pkt 1fpkt"];
156--2135[label="1;33pkt 33fpkt"];
156--2164[label="0.666667;16pkt 16fpkt"];
156--2684[label="0.00680272;1pkt 1fpkt"];
156--2691[label="0.037037;1pkt 1fpkt"];
156--2761[label="1;34pkt 34fpkt"];
156--3017[label="0.0357143;1pkt 1fpkt"];
156--3042[label="1;34pkt 34fpkt"];
580--889[label="0.075;3pkt 3fpkt"];
580--1420[label="0.2;8pkt 8fpkt"];
580--1493[label="1;21pkt 21fpkt"];
1420--1493[label="0.380952;8pkt 8fpkt"];
1420--1927[label="0.272727;6pkt 6fpkt"];
1420--2001[label="0.037037;1pkt 1fpkt"];
1420--2135[label="1;33pkt 33fpkt"];
1420--2164[label="0.333333;8pkt 8fpkt"];
1420--2691[label="0.037037;1pkt 1fpkt"];
1420--2761[label="1;34pkt 34fpkt"];
1420--3017[label="0.0357143;1pkt 1fpkt"];
1420--3042[label="1;34pkt 34fpkt"];
2135--2761[label="1;33pkt 33fpkt"];
2135--3042[label="1;33pkt 33fpkt"];
2761--3042[label="1;34pkt 34fpkt"];
</description>
    <slice>
      <filter dst_ip="208.152.176.168" src_port="80"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="151.144.202.82"/>
    </slice>
    <from sec="991803995" usec="0"/>
    <to sec="991804205" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722565,1.62834,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_231{
style=filled;
color=gray75;
221[label="209.209.213.25;d;3354pkt 3354fpkt", shape=diamond, color=yellow];
437[label="207.41.103.77;s;3754pkt 3754fpkt", shape=diamond, color=yellow];
1692[label="207.41.103.77;s;3754pkt 3754fpkt", shape=hexagon, color=black];
stat231[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.41.103.77:*, 209.209.213.25:*}[95.255%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 113: (0.667465%)&lt;BR/&gt; 4: (0.556988%)&lt;BR/&gt; 57: (0.492543%)&lt;BR/&gt; 6: (0.483336%)&lt;BR/&gt; 18: (0.478733%)&gt;];
}
221--437[label="0.944246;3167pkt 3167fpkt"];
221--1039[label="0.0666667;1pkt 1fpkt"];
221--1692[label="0.944246;3167pkt 3167fpkt"];
221--1826[label="0.00228311;2pkt 2fpkt"];
221--1827[label="0.000896861;2pkt 2fpkt"];
221--1833[label="0.00117855;2pkt 2fpkt"];
221--1834[label="0.000596303;2pkt 2fpkt"];
221--1837[label="0.00228311;2pkt 2fpkt"];
221--1838[label="0.000896861;2pkt 2fpkt"];
221--1845[label="0.00228311;2pkt 2fpkt"];
221--1846[label="0.000896861;2pkt 2fpkt"];
221--2151[label="0.0714286;1pkt 1fpkt"];
437--1692[label="1;3754pkt 3754fpkt"];
437--1826[label="0.00228311;2pkt 2fpkt"];
437--1827[label="0.000896861;2pkt 2fpkt"];
437--1833[label="0.00117855;2pkt 2fpkt"];
437--1834[label="0.000532765;2pkt 2fpkt"];
437--1837[label="0.00228311;2pkt 2fpkt"];
437--1838[label="0.000896861;2pkt 2fpkt"];
437--1845[label="0.00228311;2pkt 2fpkt"];
437--1846[label="0.000896861;2pkt 2fpkt"];
1692--1826[label="0.00228311;2pkt 2fpkt"];
1692--1827[label="0.000896861;2pkt 2fpkt"];
1692--1833[label="0.00117855;2pkt 2fpkt"];
1692--1834[label="0.000532765;2pkt 2fpkt"];
1692--1837[label="0.00228311;2pkt 2fpkt"];
1692--1838[label="0.000896861;2pkt 2fpkt"];
1692--1845[label="0.00228311;2pkt 2fpkt"];
1692--1846[label="0.000896861;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="209.209.213.25" src_ip="207.41.103.77"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="206.40.213.85"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="140.105.45.86"/>
    </slice>
    <from sec="991803810" usec="0"/>
    <to sec="991803878" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="17.195.138.86"/>
    </slice>
    <from sec="991803667" usec="0"/>
    <to sec="991803765" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.44.42.87"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991803892" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="204.117.202.87"/>
    </slice>
    <from sec="991803847" usec="0"/>
    <to sec="991803888" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="50.145.68.90"/>
    </slice>
    <from sec="991804113" usec="0"/>
    <to sec="991804150" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="17.167.138.93"/>
    </slice>
    <from sec="991803603" usec="0"/>
    <to sec="991804161" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="204.138.235.94"/>
    </slice>
    <from sec="991803678" usec="0"/>
    <to sec="991804075" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="137.248.16.97"/>
    </slice>
    <from sec="991803609" usec="0"/>
    <to sec="991804225" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.44.185.98"/>
    </slice>
    <from sec="991803983" usec="0"/>
    <to sec="991804173" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.135.224.98"/>
    </slice>
    <from sec="991804048" usec="0"/>
    <to sec="991804111" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.44.130.102"/>
    </slice>
    <from sec="991803630" usec="0"/>
    <to sec="991804048" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.990447,1.59474,503,0 0 0 1 1 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_246{
style=filled;
color=gray75;
456[label="209.209.218.141;d;177pkt 177fpkt", shape=diamond, color=yellow];
642[label="204.104.36.62;s;4pkt 4fpkt", shape=diamond, color=yellow];
905[label="91.151.65.187;s;48pkt 48fpkt", shape=diamond, color=yellow];
1053[label="204.197.230.23;s;12pkt 12fpkt", shape=diamond, color=yellow];
1091[label="137.248.80.33;d;11pkt 11fpkt", shape=diamond, color=yellow];
1104[label="204.22.202.84;s;10pkt 10fpkt", shape=diamond, color=yellow];
1351[label="209.209.218.141;d;59pkt 59fpkt", shape=hexagon, color=black];
1678[label="137.248.80.33;d;11pkt 11fpkt", shape=hexagon, color=black];
1744[label="204.22.202.84;s;10pkt 10fpkt", shape=hexagon, color=black];
1881[label="215.189.99.7;13pkt 13fpkt", shape=pentagon, color=darkviolet];
1939[label="204.197.230.23;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2061[label="206.141.218.58;7pkt 7fpkt", shape=pentagon, color=darkviolet];
2068[label="204.104.36.62;8pkt 8fpkt", shape=pentagon, color=darkviolet];
2299[label="91.151.98.136;17pkt 17fpkt", shape=pentagon, color=darkviolet];
2605[label="205.137.220.243;9pkt 9fpkt", shape=pentagon, color=darkviolet];
2642[label="215.189.99.7;13pkt 13fpkt", shape=invtriangle, color=brown];
2727[label="204.104.36.62;8pkt 8fpkt", shape=invtriangle, color=brown];
2841[label="91.151.98.136;18pkt 18fpkt", shape=invtriangle, color=brown];
3031[label="204.104.36.62;8pkt 8fpkt", shape=invhouse, color=bisque];
stat246[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 209.209.218.141:*}[66.9145%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.3964%)&lt;BR/&gt; 443: (3.49099%)&lt;BR/&gt; 14647: (0.675676%)&lt;BR/&gt; 14646: (0.675676%)&lt;BR/&gt; 14643: (0.675676%)&gt;];
}
456--593[label="0.0169492;3pkt 3fpkt"];
456--613[label="0.0789474;3pkt 3fpkt"];
456--618[label="0.04;1pkt 1fpkt"];
456--642[label="0.75;3pkt 3fpkt"];
456--859[label="0.0416667;1pkt 1fpkt"];
456--905[label="0.1875;9pkt 9fpkt"];
456--967[label="0.0645161;2pkt 2fpkt"];
456--1018[label="0.0183486;2pkt 2fpkt"];
456--1036[label="0.047619;1pkt 1fpkt"];
456--1053[label="0.166667;2pkt 2fpkt"];
456--1104[label="0.2;2pkt 2fpkt"];
456--1136[label="0.0526316;3pkt 3fpkt"];
456--1155[label="0.00826446;1pkt 1fpkt"];
456--1351[label="1;59pkt 59fpkt"];
456--1402[label="0.09375;3pkt 3fpkt"];
456--1499[label="0.020979;3pkt 3fpkt"];
456--1744[label="0.2;2pkt 2fpkt"];
456--1873[label="0.00813008;1pkt 1fpkt"];
456--1881[label="0.461538;6pkt 6fpkt"];
456--1939[label="1;1pkt 1fpkt"];
456--2061[label="0.428571;3pkt 3fpkt"];
456--2068[label="1;8pkt 8fpkt"];
456--2223[label="0.0333333;1pkt 1fpkt"];
456--2225[label="0.0384615;1pkt 1fpkt"];
456--2249[label="0.0714286;2pkt 2fpkt"];
456--2299[label="0.235294;4pkt 4fpkt"];
456--2581[label="0.0131579;1pkt 1fpkt"];
456--2605[label="0.333333;3pkt 3fpkt"];
456--2642[label="0.461538;6pkt 6fpkt"];
456--2727[label="1;8pkt 8fpkt"];
456--2773[label="0.0535714;3pkt 3fpkt"];
456--2805[label="0.0344828;1pkt 1fpkt"];
456--2841[label="0.222222;4pkt 4fpkt"];
456--3031[label="1;8pkt 8fpkt"];
456--3064[label="0.0333333;1pkt 1fpkt"];
642--1351[label="0.75;3pkt 3fpkt"];
642--2068[label="0.75;3pkt 3fpkt"];
642--2727[label="0.75;3pkt 3fpkt"];
642--3031[label="0.75;3pkt 3fpkt"];
905--1238[label="0.0333333;1pkt 1fpkt"];
905--1282[label="0.104167;5pkt 5fpkt"];
905--1351[label="0.0416667;2pkt 2fpkt"];
905--1478[label="0.0208333;1pkt 1fpkt"];
905--1616[label="0.0833333;4pkt 4fpkt"];
1053--1282[label="0.0833333;1pkt 1fpkt"];
1053--1939[label="1;1pkt 1fpkt"];
1091--1104[label="0.8;8pkt 8fpkt"];
1091--1678[label="1;11pkt 11fpkt"];
1091--1744[label="0.8;8pkt 8fpkt"];
1104--1678[label="0.8;8pkt 8fpkt"];
1104--1744[label="1;10pkt 10fpkt"];
1351--1402[label="0.0625;2pkt 2fpkt"];
1351--1499[label="0.0338983;2pkt 2fpkt"];
1351--1873[label="0.0169492;1pkt 1fpkt"];
1351--2061[label="0.142857;1pkt 1fpkt"];
1351--2068[label="0.375;3pkt 3fpkt"];
1351--2223[label="0.0333333;1pkt 1fpkt"];
1351--2249[label="0.0357143;1pkt 1fpkt"];
1351--2727[label="0.375;3pkt 3fpkt"];
1351--2805[label="0.0344828;1pkt 1fpkt"];
1351--3031[label="0.375;3pkt 3fpkt"];
1351--3064[label="0.0333333;1pkt 1fpkt"];
1678--1744[label="0.8;8pkt 8fpkt"];
1881--2642[label="1;13pkt 13fpkt"];
2068--2727[label="1;8pkt 8fpkt"];
2068--3031[label="1;8pkt 8fpkt"];
2299--2841[label="1;17pkt 17fpkt"];
2727--3031[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="209.209.218.141" src_port="80"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.192.69.103"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="91.70.139.104"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="175.221.160.105"/>
    </slice>
    <from sec="991803604" usec="0"/>
    <to sec="991804205" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.135.215.108"/>
    </slice>
    <from sec="991803757" usec="0"/>
    <to sec="991803907" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="219.175.33.121"/>
    </slice>
    <from sec="991803795" usec="0"/>
    <to sec="991804025" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="206.140.146.123"/>
    </slice>
    <from sec="991803605" usec="0"/>
    <to sec="991804213" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="91.132.96.125"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="204.112.146.128"/>
    </slice>
    <from sec="991803742" usec="0"/>
    <to sec="991803745" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="137.248.38.129"/>
    </slice>
    <from sec="991804049" usec="0"/>
    <to sec="991804198" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="143.50.85.129"/>
    </slice>
    <from sec="991803751" usec="0"/>
    <to sec="991803853" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.533239,1.64144,501,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_258{
style=filled;
color=gray75;
885[label="143.39.179.101;d;122pkt 122fpkt", shape=diamond, color=yellow];
2281[label="214.199.232.130;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat258[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:21, 143.39.179.101:*}[36.8852%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (18.2927%)&lt;BR/&gt; 1863: (6.09756%)&lt;BR/&gt; 12001: (3.65854%)&lt;BR/&gt; 5190: (3.65854%)&lt;BR/&gt; 4285: (3.25203%)&gt;];
}
885--2281[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="143.39.179.101" src_port="21"/>
    </slice>
    <from sec="991803602" usec="0"/>
    <to sec="991804227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.13.91.132"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.41.183.135"/>
    </slice>
    <from sec="991803725" usec="0"/>
    <to sec="991804149" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.665151,1.63004,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_261{
style=filled;
color=gray75;
1147[label="208.147.114.22;d;48pkt 48fpkt", shape=diamond, color=yellow];
2302[label="204.12.162.136;10pkt 10fpkt", shape=pentagon, color=darkviolet];
2844[label="204.12.162.136;10pkt 10fpkt", shape=invtriangle, color=brown];
stat261[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.205.10.24:80, 208.147.114.22:*}[50%]&lt;BR/&gt;{204.12.162.136:80, 208.147.114.22:*}[20.8333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.7941%)&lt;BR/&gt; 2052: (2.20588%)&lt;BR/&gt; 2051: (2.20588%)&lt;BR/&gt; 2049: (2.20588%)&lt;BR/&gt; 2048: (2.20588%)&gt;];
}
1147--2302[label="1;10pkt 10fpkt"];
1147--2844[label="1;10pkt 10fpkt"];
2302--2844[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter dst_ip="208.147.114.22" src_ip="209.205.10.24" src_port="80"/>
      <filter dst_ip="208.147.114.22" src_ip="204.12.162.136" src_port="80"/>
    </slice>
    <from sec="991803601" usec="0"/>
    <to sec="991804074" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="17.200.18.142"/>
    </slice>
    <from sec="991803705" usec="0"/>
    <to sec="991803933" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.110.213.143"/>
    </slice>
    <from sec="991804027" usec="0"/>
    <to sec="991804188" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.90.230.143"/>
    </slice>
    <from sec="991803603" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.109.138.145"/>
    </slice>
    <from sec="991803609" usec="0"/>
    <to sec="991803914" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.897743,1.64135,002,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_267{
style=filled;
color=gray75;
879[label="143.179.56.4;d;47pkt 47fpkt", shape=diamond, color=yellow];
2345[label="143.179.56.146;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2866[label="143.179.56.146;1pkt 1fpkt", shape=invtriangle, color=brown];
3091[label="143.179.56.146;2pkt 2fpkt", shape=invhouse, color=bisque];
stat267[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:138, 143.179.56.4:138}[59.5745%]&lt;BR/&gt;{*:137, 143.179.56.4:137}[36.1702%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 138: (59.6154%)&lt;BR/&gt; 137: (36.5385%)&lt;BR/&gt; 135: (1.92308%)&lt;BR/&gt; 1070: (0.961538%)&lt;BR/&gt; 1053: (0.961538%)&gt;];
}
879--2345[label="1;2pkt 2fpkt"];
879--2866[label="1;1pkt 1fpkt"];
879--3091[label="1;2pkt 2fpkt"];
2345--2866[label="1;1pkt 1fpkt"];
2345--3091[label="1;2pkt 2fpkt"];
2866--3091[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="143.179.56.4" dst_port="138" src_port="138"/>
      <filter dst_ip="143.179.56.4" dst_port="137" src_port="137"/>
    </slice>
    <from sec="991803601" usec="0"/>
    <to sec="991804174" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="91.228.37.149"/>
    </slice>
    <from sec="991803997" usec="0"/>
    <to sec="991804039" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="161.213.74.149"/>
    </slice>
    <from sec="991803606" usec="0"/>
    <to sec="991804212" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.50.81.149"/>
    </slice>
    <from sec="991803935" usec="0"/>
    <to sec="991803966" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="175.221.181.149"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="17.188.188.149"/>
    </slice>
    <from sec="991803603" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.191.97.151"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.197.227.155"/>
    </slice>
    <from sec="991803871" usec="0"/>
    <to sec="991803893" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="17.176.94.157"/>
    </slice>
    <from sec="991803603" usec="0"/>
    <to sec="991803634" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.73.57.158"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.50.155.160"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991803784" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="137.248.227.161"/>
    </slice>
    <from sec="991803651" usec="0"/>
    <to sec="991803680" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="219.136.35.163"/>
    </slice>
    <from sec="991803603" usec="0"/>
    <to sec="991804221" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,011,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.105.110.164"/>
    </slice>
    <from sec="991804031" usec="0"/>
    <to sec="991804118" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.32.50.166"/>
    </slice>
    <from sec="991803605" usec="0"/>
    <to sec="991804114" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.168.148.166"/>
    </slice>
    <from sec="991803946" usec="0"/>
    <to sec="991804090" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="219.205.166.168"/>
    </slice>
    <from sec="991804115" usec="0"/>
    <to sec="991804187" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.990447,1.59474,503,0 0 0 1 1 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_284{
style=filled;
color=gray75;
1113[label="151.144.180.236;d;79pkt 79fpkt", shape=diamond, color=yellow];
1118[label="205.162.49.89;s;2pkt 2fpkt", shape=diamond, color=yellow];
1230[label="205.162.49.169;s;63pkt 63fpkt", shape=diamond, color=yellow];
1746[label="205.162.49.169;s;63pkt 63fpkt", shape=hexagon, color=black];
2173[label="205.162.49.89;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2413[label="205.162.49.169;76pkt 76fpkt", shape=pentagon, color=darkviolet];
2780[label="205.162.49.89;1pkt 1fpkt", shape=invtriangle, color=brown];
2892[label="205.162.49.169;75pkt 75fpkt", shape=invtriangle, color=brown];
3047[label="205.162.49.89;1pkt 1fpkt", shape=invhouse, color=bisque];
3108[label="205.162.49.169;75pkt 75fpkt", shape=invhouse, color=bisque];
stat284[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.162.49.169:80, 151.144.180.236:*}[82.6087%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.1972%)&lt;BR/&gt; 1112: (0.688073%)&lt;BR/&gt; 1110: (0.688073%)&lt;BR/&gt; 1109: (0.688073%)&lt;BR/&gt; 1108: (0.688073%)&gt;];
}
1113--1118[label="1;2pkt 2fpkt"];
1113--1230[label="1;63pkt 63fpkt"];
1113--1746[label="1;63pkt 63fpkt"];
1113--2173[label="1;1pkt 1fpkt"];
1113--2413[label="0.828947;63pkt 63fpkt"];
1113--2780[label="1;1pkt 1fpkt"];
1113--2892[label="0.826667;62pkt 62fpkt"];
1113--3047[label="1;1pkt 1fpkt"];
1113--3108[label="0.826667;62pkt 62fpkt"];
1118--2173[label="1;1pkt 1fpkt"];
1118--2780[label="1;1pkt 1fpkt"];
1118--3047[label="1;1pkt 1fpkt"];
1230--1746[label="1;63pkt 63fpkt"];
1230--2413[label="1;63pkt 63fpkt"];
1230--2892[label="0.984127;62pkt 62fpkt"];
1230--3108[label="0.984127;62pkt 62fpkt"];
1746--2413[label="1;63pkt 63fpkt"];
1746--2892[label="0.984127;62pkt 62fpkt"];
1746--3108[label="0.984127;62pkt 62fpkt"];
2173--2780[label="1;1pkt 1fpkt"];
2173--3047[label="1;1pkt 1fpkt"];
2413--2892[label="1;75pkt 75fpkt"];
2413--3108[label="1;75pkt 75fpkt"];
2780--3047[label="1;1pkt 1fpkt"];
2892--3108[label="1;75pkt 75fpkt"];
</description>
    <slice>
      <filter dst_ip="151.144.180.236" src_ip="205.162.49.169" src_port="80"/>
    </slice>
    <from sec="991804015" usec="0"/>
    <to sec="991804222" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="91.228.53.170"/>
    </slice>
    <from sec="991804007" usec="0"/>
    <to sec="991804059" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="91.61.79.176"/>
    </slice>
    <from sec="991803603" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677781,1.59484,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_287{
style=filled;
color=gray75;
334[label="175.221.132.232;d;15pkt 15fpkt", shape=diamond, color=yellow];
349[label="208.217.211.135;s;8pkt 8fpkt", shape=diamond, color=yellow];
1235[label="208.217.206.180;s;5pkt 5fpkt", shape=diamond, color=yellow];
1562[label="175.221.132.232;d;4pkt 4fpkt", shape=hexagon, color=black];
1650[label="208.217.211.135;s;3pkt 3fpkt", shape=hexagon, color=black];
2445[label="208.217.206.180;4pkt 4fpkt", shape=pentagon, color=darkviolet];
stat287[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.217.211.135:7070, 175.221.132.232:*}[33.3333%]&lt;BR/&gt;{208.217.206.180:7070, 175.221.132.232:*}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7070: (28.2051%)&lt;BR/&gt; 7014: (5.12821%)&lt;BR/&gt; 2095: (5.12821%)&lt;BR/&gt; 1071: (5.12821%)&lt;BR/&gt; 1070: (5.12821%)&gt;];
}
334--349[label="1;8pkt 8fpkt"];
334--1235[label="1;5pkt 5fpkt"];
334--1562[label="1;4pkt 4fpkt"];
334--1650[label="1;3pkt 3fpkt"];
334--2445[label="1;4pkt 4fpkt"];
349--1562[label="0.75;3pkt 3fpkt"];
349--1650[label="1;3pkt 3fpkt"];
1235--2445[label="1;4pkt 4fpkt"];
1562--1650[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="175.221.132.232" src_ip="208.217.211.135" src_port="7070"/>
      <filter dst_ip="175.221.132.232" src_ip="208.217.206.180" src_port="7070"/>
    </slice>
    <from sec="991803602" usec="0"/>
    <to sec="991804222" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="17.112.183.183"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="161.249.74.184"/>
    </slice>
    <from sec="991803604" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.202.82.184"/>
    </slice>
    <from sec="991803603" usec="0"/>
    <to sec="991804213" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.209.216.184"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.232.228.184"/>
    </slice>
    <from sec="991803611" usec="0"/>
    <to sec="991803998" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,501,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.134.151.185"/>
    </slice>
    <from sec="991803625" usec="0"/>
    <to sec="991803962" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785791,1.58311,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_294{
style=filled;
color=gray75;
114[label="208.147.113.156;d;19pkt 19fpkt", shape=diamond, color=yellow];
115[label="205.62.224.126;s;4pkt 4fpkt", shape=diamond, color=yellow];
297[label="169.41.0.53;d;953pkt 953fpkt", shape=diamond, color=yellow];
470[label="137.248.132.137;d;27pkt 27fpkt", shape=diamond, color=yellow];
471[label="205.194.181.255;s;3pkt 3fpkt", shape=diamond, color=yellow];
497[label="205.65.70.109;s;917pkt 917fpkt", shape=diamond, color=yellow];
1106[label="151.144.77.216;d;205pkt 205fpkt", shape=diamond, color=yellow];
1107[label="204.34.12.88;s;45pkt 45fpkt", shape=diamond, color=yellow];
1110[label="204.34.12.223;s;75pkt 75fpkt", shape=diamond, color=yellow];
1208[label="205.65.70.186;s;66pkt 66fpkt", shape=diamond, color=yellow];
1359[label="169.41.0.53;d;510pkt 510fpkt", shape=hexagon, color=black];
1451[label="137.248.132.137;d;27pkt 27fpkt", shape=hexagon, color=black];
1613[label="205.65.70.109;s;788pkt 788fpkt", shape=hexagon, color=black];
1745[label="204.34.12.223;s;75pkt 75fpkt", shape=hexagon, color=black];
2306[label="205.65.70.137;20pkt 20fpkt", shape=pentagon, color=darkviolet];
2331[label="195.5.12.143;30pkt 30fpkt", shape=pentagon, color=darkviolet];
2465[label="205.65.70.186;68pkt 68fpkt", shape=pentagon, color=darkviolet];
2846[label="205.65.70.137;19pkt 19fpkt", shape=invtriangle, color=brown];
stat294[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.65.70.109:80, 169.41.0.53:*}[30.5487%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (31.8099%)&lt;BR/&gt; 6346: (3.59647%)&lt;BR/&gt; 25: (3.29784%)&lt;BR/&gt; 53: (2.76552%)&lt;BR/&gt; 6699: (0.753051%)&gt;];
}
114--115[label="1;4pkt 4fpkt"];
114--1208[label="0.631579;12pkt 12fpkt"];
114--2465[label="0.684211;13pkt 13fpkt"];
297--497[label="1;917pkt 917fpkt"];
297--1208[label="0.0909091;6pkt 6fpkt"];
297--1359[label="1;510pkt 510fpkt"];
297--1613[label="1;788pkt 788fpkt"];
297--1826[label="0.00684932;6pkt 6fpkt"];
297--1827[label="0.00839454;8pkt 8fpkt"];
297--1832[label="0.00104932;1pkt 1fpkt"];
297--1833[label="0.00524659;5pkt 5fpkt"];
297--1834[label="0.00419727;4pkt 4fpkt"];
297--1837[label="0.00684932;6pkt 6fpkt"];
297--1838[label="0.00839454;8pkt 8fpkt"];
297--1843[label="0.00104932;1pkt 1fpkt"];
297--1845[label="0.00684932;6pkt 6fpkt"];
297--1846[label="0.00839454;8pkt 8fpkt"];
297--1851[label="0.00104932;1pkt 1fpkt"];
297--2331[label="0.766667;23pkt 23fpkt"];
297--2465[label="0.0882353;6pkt 6fpkt"];
470--471[label="1;3pkt 3fpkt"];
470--1208[label="0.222222;6pkt 6fpkt"];
470--1451[label="1;27pkt 27fpkt"];
470--1879[label="0.037037;1pkt 1fpkt"];
470--2465[label="0.222222;6pkt 6fpkt"];
471--1451[label="1;3pkt 3fpkt"];
497--1359[label="0.980392;500pkt 500fpkt"];
497--1613[label="1;788pkt 788fpkt"];
497--1826[label="0.00684932;6pkt 6fpkt"];
497--1827[label="0.0087241;8pkt 8fpkt"];
497--1832[label="0.00109051;1pkt 1fpkt"];
497--1833[label="0.00545256;5pkt 5fpkt"];
497--1834[label="0.00436205;4pkt 4fpkt"];
497--1837[label="0.00684932;6pkt 6fpkt"];
497--1838[label="0.0087241;8pkt 8fpkt"];
497--1843[label="0.00109051;1pkt 1fpkt"];
497--1845[label="0.00684932;6pkt 6fpkt"];
497--1846[label="0.0087241;8pkt 8fpkt"];
497--1851[label="0.00109051;1pkt 1fpkt"];
1106--1107[label="1;45pkt 45fpkt"];
1106--1110[label="1;75pkt 75fpkt"];
1106--1208[label="0.636364;42pkt 42fpkt"];
1106--1745[label="1;75pkt 75fpkt"];
1106--2306[label="0.55;11pkt 11fpkt"];
1106--2465[label="0.617647;42pkt 42fpkt"];
1106--2846[label="0.526316;10pkt 10fpkt"];
1110--1745[label="1;75pkt 75fpkt"];
1208--1451[label="0.222222;6pkt 6fpkt"];
1208--2465[label="1;66pkt 66fpkt"];
1359--1613[label="0.980392;500pkt 500fpkt"];
1359--1826[label="0.0117647;6pkt 6fpkt"];
1359--1827[label="0.0156863;8pkt 8fpkt"];
1359--1832[label="0.00196078;1pkt 1fpkt"];
1359--1833[label="0.00980392;5pkt 5fpkt"];
1359--1834[label="0.00784314;4pkt 4fpkt"];
1359--1837[label="0.0117647;6pkt 6fpkt"];
1359--1838[label="0.0156863;8pkt 8fpkt"];
1359--1843[label="0.00196078;1pkt 1fpkt"];
1359--1845[label="0.0117647;6pkt 6fpkt"];
1359--1846[label="0.0156863;8pkt 8fpkt"];
1359--1851[label="0.00196078;1pkt 1fpkt"];
1359--2331[label="0.2;6pkt 6fpkt"];
1451--1879[label="0.037037;1pkt 1fpkt"];
1451--2465[label="0.222222;6pkt 6fpkt"];
1613--1826[label="0.00761421;6pkt 6fpkt"];
1613--1827[label="0.0101523;8pkt 8fpkt"];
1613--1832[label="0.00126904;1pkt 1fpkt"];
1613--1833[label="0.00634518;5pkt 5fpkt"];
1613--1834[label="0.00507614;4pkt 4fpkt"];
1613--1837[label="0.00761421;6pkt 6fpkt"];
1613--1838[label="0.0101523;8pkt 8fpkt"];
1613--1843[label="0.00126904;1pkt 1fpkt"];
1613--1845[label="0.00761421;6pkt 6fpkt"];
1613--1846[label="0.0101523;8pkt 8fpkt"];
1613--1851[label="0.00126904;1pkt 1fpkt"];
2306--2846[label="1;19pkt 19fpkt"];
</description>
    <slice>
      <filter dst_ip="169.41.0.53" src_ip="205.65.70.109" src_port="80"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804208" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,502,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="221.187.0.189"/>
    </slice>
    <from sec="991803601" usec="0"/>
    <to sec="991804226" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="39.178.23.190"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.990447,1.59474,999,0 0 0 1 1 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_298{
style=filled;
color=gray75;
258[label="175.221.31.44;s;302pkt 302fpkt", shape=diamond, color=yellow];
443[label="91.133.171.121;d;148pkt 148fpkt", shape=diamond, color=yellow];
719[label="195.73.49.114;d;164pkt 164fpkt", shape=diamond, color=yellow];
980[label="175.221.160.110;s;38pkt 38fpkt", shape=diamond, color=yellow];
1002[label="143.50.249.168;s;64pkt 64fpkt", shape=diamond, color=yellow];
1598[label="175.221.31.44;s;274pkt 274fpkt", shape=hexagon, color=black];
1698[label="175.221.160.110;s;38pkt 38fpkt", shape=hexagon, color=black];
2127[label="175.221.149.78;39pkt 39fpkt", shape=pentagon, color=darkviolet];
2235[label="175.221.160.108;54pkt 54fpkt", shape=pentagon, color=darkviolet];
2239[label="175.221.160.110;40pkt 40fpkt", shape=pentagon, color=darkviolet];
2500[label="175.221.170.199;22pkt 22fpkt", shape=pentagon, color=darkviolet];
2506[label="175.221.170.200;46pkt 46fpkt", shape=pentagon, color=darkviolet];
2800[label="175.221.30.99;109pkt 109fpkt", shape=invtriangle, color=brown];
2811[label="175.221.160.110;41pkt 41fpkt", shape=invtriangle, color=brown];
2928[label="175.221.170.200;46pkt 46fpkt", shape=invtriangle, color=brown];
3123[label="175.221.170.200;47pkt 47fpkt", shape=invhouse, color=bisque];
stat298[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:25, *:*}[32.417%]&lt;BR/&gt;{175.221.31.44:4626, *:53}[21.5349%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (15.8288%)&lt;BR/&gt; 25: (15.7269%)&lt;BR/&gt; 4626: (12.1264%)&lt;BR/&gt; 0: (10.5299%)&lt;BR/&gt; 113: (8.15217%)&gt;];
}
258--443[label="0.52027;77pkt 77fpkt"];
258--726[label="0.00980392;1pkt 1fpkt"];
258--880[label="0.0119048;1pkt 1fpkt"];
258--989[label="0.25;1pkt 1fpkt"];
258--1598[label="1;274pkt 274fpkt"];
258--1713[label="0.0119048;1pkt 1fpkt"];
258--1833[label="0.00331126;1pkt 1fpkt"];
258--1834[label="0.142384;43pkt 43fpkt"];
443--548[label="0.00675676;1pkt 1fpkt"];
443--1598[label="0.52027;77pkt 77fpkt"];
443--2127[label="0.102564;4pkt 4fpkt"];
443--2235[label="0.166667;9pkt 9fpkt"];
443--2500[label="0.227273;5pkt 5fpkt"];
443--2506[label="0.0217391;1pkt 1fpkt"];
443--2800[label="0.0733945;8pkt 8fpkt"];
443--2928[label="0.0217391;1pkt 1fpkt"];
443--3123[label="0.0212766;1pkt 1fpkt"];
719--849[label="0.0125;2pkt 2fpkt"];
719--980[label="0.0263158;1pkt 1fpkt"];
719--1002[label="0.03125;2pkt 2fpkt"];
719--1280[label="0.00609756;1pkt 1fpkt"];
719--1477[label="0.0163934;2pkt 2fpkt"];
719--1697[label="0.0121951;2pkt 2fpkt"];
719--1698[label="0.0263158;1pkt 1fpkt"];
719--1952[label="0.0125786;2pkt 2fpkt"];
719--2033[label="0.142857;2pkt 2fpkt"];
719--2235[label="0.037037;2pkt 2fpkt"];
719--2239[label="0.025;1pkt 1fpkt"];
719--2277[label="0.0121951;2pkt 2fpkt"];
719--2500[label="0.272727;6pkt 6fpkt"];
719--2506[label="0.0217391;1pkt 1fpkt"];
719--2800[label="0.00917431;1pkt 1fpkt"];
719--2811[label="0.0243902;1pkt 1fpkt"];
719--2928[label="0.0217391;1pkt 1fpkt"];
719--3123[label="0.0212766;1pkt 1fpkt"];
980--1698[label="1;38pkt 38fpkt"];
980--2239[label="0.973684;37pkt 37fpkt"];
980--2811[label="1;38pkt 38fpkt"];
1002--1833[label="0.015625;1pkt 1fpkt"];
1598--1713[label="0.0119048;1pkt 1fpkt"];
1598--1833[label="0.00364964;1pkt 1fpkt"];
1598--1834[label="0.156934;43pkt 43fpkt"];
1698--2239[label="0.973684;37pkt 37fpkt"];
1698--2811[label="1;38pkt 38fpkt"];
2239--2811[label="1;40pkt 40fpkt"];
2506--2928[label="1;46pkt 46fpkt"];
2506--3123[label="1;46pkt 46fpkt"];
2928--3123[label="1;46pkt 46fpkt"];
</description>
    <slice>
      <filter src_port="25"/>
      <filter dst_port="53" src_ip="175.221.31.44" src_port="4626"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804229" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.192.221.199"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="151.229.149.204"/>
    </slice>
    <from sec="991803603" usec="0"/>
    <to sec="991804226" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="17.196.153.205"/>
    </slice>
    <from sec="991803628" usec="0"/>
    <to sec="991803722" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="137.248.4.206"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.147.176.206"/>
    </slice>
    <from sec="991803646" usec="0"/>
    <to sec="991803670" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.131.200.207"/>
    </slice>
    <from sec="991803698" usec="0"/>
    <to sec="991804011" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,501,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="91.81.128.209"/>
    </slice>
    <from sec="991803605" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="17.189.12.212"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="221.100.138.212"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="139.244.26.218"/>
    </slice>
    <from sec="991803792" usec="0"/>
    <to sec="991803806" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.152.178.220"/>
    </slice>
    <from sec="991804013" usec="0"/>
    <to sec="991804090" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="143.50.32.224"/>
    </slice>
    <from sec="991803676" usec="0"/>
    <to sec="991804223" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.533239,1.64144,020,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_313{
style=filled;
color=gray75;
755[label="175.221.132.232;s;14pkt 14fpkt", shape=diamond, color=yellow];
770[label="208.217.211.135;d;8pkt 8fpkt", shape=diamond, color=yellow];
2578[label="175.221.132.232;14pkt 14fpkt", shape=pentagon, color=darkviolet];
stat313[shape=component, label=&lt;Rules:&lt;BR/&gt;{175.221.132.232:*, 208.217.211.135:7070}[29.4118%]&lt;BR/&gt;{175.221.132.232:26448, 50.52.219.142:*}[23.5294%]&lt;BR/&gt;{*:0, *:0}[23.5294%]&lt;BR/&gt;{175.221.132.232:*, 208.217.206.180:*}[23.5294%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7070: (29.1667%)&lt;BR/&gt; 0: (19.4444%)&lt;BR/&gt; 26448: (11.1111%)&lt;BR/&gt; 1093: (4.16667%)&lt;BR/&gt; 1092: (4.16667%)&gt;];
}
755--770[label="0.75;6pkt 6fpkt"];
755--2578[label="0.928571;13pkt 13fpkt"];
770--2578[label="0.75;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="208.217.206.180" src_ip="175.221.132.232"/>
      <filter dst_ip="208.217.211.135" dst_port="7070" src_ip="175.221.132.232"/>
      <filter dst_ip="50.52.219.142" src_ip="175.221.132.232" src_port="26448"/>
    </slice>
    <from sec="991803602" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="17.160.101.236"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677781,1.59484,020,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_315{
style=filled;
color=gray75;
660[label="169.41.227.236;s;17pkt 17fpkt", shape=diamond, color=yellow];
1583[label="169.41.227.236;s;16pkt 16fpkt", shape=hexagon, color=black];
2591[label="169.41.227.236;22pkt 22fpkt", shape=pentagon, color=darkviolet];
stat315[shape=component, label=&lt;Rules:&lt;BR/&gt;{169.41.227.236:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
660--1583[label="0.9375;15pkt 15fpkt"];
660--2591[label="1;17pkt 17fpkt"];
1583--2591[label="1;16pkt 16fpkt"];
</description>
    <slice>
      <filter src_ip="169.41.227.236"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="17.41.105.237"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.34.246.238"/>
    </slice>
    <from sec="991803603" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="17.161.154.240"/>
    </slice>
    <from sec="991803603" usec="0"/>
    <to sec="991804228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.533239,1.64144,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_319{
style=filled;
color=gray75;
143[label="151.144.202.76;d;26pkt 26fpkt", shape=diamond, color=yellow];
146[label="17.185.250.98;s;2pkt 2fpkt", shape=diamond, color=yellow];
341[label="207.120.160.244;s;240pkt 240fpkt", shape=diamond, color=yellow];
399[label="17.167.138.93;s;1pkt 1fpkt", shape=diamond, color=yellow];
1224[label="17.193.129.137;s;1pkt 1fpkt", shape=diamond, color=yellow];
2607[label="207.120.160.244;275pkt 275fpkt", shape=pentagon, color=darkviolet];
stat319[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.120.160.244:80, *:*}[95.8188%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.6239%)&lt;BR/&gt; 6346: (0.825688%)&lt;BR/&gt; 61551: (0.366972%)&lt;BR/&gt; 5634: (0.366972%)&lt;BR/&gt; 1179: (0.366972%)&gt;];
}
143--146[label="1;2pkt 2fpkt"];
143--341[label="0.538462;14pkt 14fpkt"];
143--399[label="1;1pkt 1fpkt"];
143--1224[label="1;1pkt 1fpkt"];
143--2607[label="0.538462;14pkt 14fpkt"];
341--899[label="0.0232558;2pkt 2fpkt"];
341--1263[label="0.05;12pkt 12fpkt"];
341--1688[label="0.0125;3pkt 3fpkt"];
341--1773[label="0.05;12pkt 12fpkt"];
341--1818[label="0.0125;3pkt 3fpkt"];
341--2607[label="1;240pkt 240fpkt"];
</description>
    <slice>
      <filter src_ip="207.120.160.244" src_port="80"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804229" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_321{
style=filled;
color=gray75;
2616[label="137.248.55.248;49pkt 49fpkt", shape=pentagon, color=darkviolet];
stat321[shape=component, label=&lt;Rules:&lt;BR/&gt;{137.248.55.248:*, 214.224.187.118:80}[61.2245%]&lt;BR/&gt;{137.248.55.248:*, 214.224.187.8:80}[34.6939%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1580: (1.02041%)&lt;BR/&gt; 1579: (1.02041%)&lt;BR/&gt; 1577: (1.02041%)&lt;BR/&gt; 1576: (1.02041%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="214.224.187.118" dst_port="80" src_ip="137.248.55.248"/>
      <filter dst_ip="214.224.187.8" dst_port="80" src_ip="137.248.55.248"/>
    </slice>
    <from sec="991803601" usec="0"/>
    <to sec="991804224" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="161.249.99.248"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="91.19.128.252"/>
    </slice>
    <from sec="991803617" usec="0"/>
    <to sec="991803675" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="204.89.10.253"/>
    </slice>
    <from sec="991803732" usec="0"/>
    <to sec="991804222" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.439429,1.69029,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.41.22.254"/>
    </slice>
    <from sec="991803615" usec="0"/>
    <to sec="991804228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.592604,1.67923,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_326{
style=filled;
color=gray75;
1855[label="195.110.19.0;11pkt 11fpkt", shape=pentagon, color=darkviolet];
2632[label="195.110.19.0;11pkt 11fpkt", shape=invtriangle, color=brown];
stat326[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.110.19.0:80, 137.248.176.42:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1829: (4.54545%)&lt;BR/&gt; 1828: (4.54545%)&lt;BR/&gt; 1827: (4.54545%)&lt;BR/&gt; 1826: (4.54545%)&gt;];
}
1855--2632[label="1;11pkt 11fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.176.42" src_ip="195.110.19.0" src_port="80"/>
    </slice>
    <from sec="991804210" usec="0"/>
    <to sec="991804229" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643346,1.71108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="206.0.31.1"/>
    </slice>
    <from sec="991803991" usec="0"/>
    <to sec="991804008" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.990447,1.59474,503,0 0 0 1 1 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_328{
style=filled;
color=gray75;
214[label="208.152.161.1;d;539pkt 539fpkt", shape=diamond, color=yellow];
966[label="91.167.15.181;s;7pkt 7fpkt", shape=diamond, color=yellow];
1100[label="91.167.15.44;s;1pkt 1fpkt", shape=diamond, color=yellow];
1234[label="169.41.68.171;d;50pkt 50fpkt", shape=diamond, color=yellow];
1249[label="138.247.58.201;s;6pkt 6fpkt", shape=diamond, color=yellow];
1681[label="91.167.15.44;s;1pkt 1fpkt", shape=hexagon, color=black];
1749[label="169.41.68.171;d;50pkt 50fpkt", shape=hexagon, color=black];
1869[label="91.151.64.3;45pkt 45fpkt", shape=pentagon, color=darkviolet];
2340[label="213.120.114.145;8pkt 8fpkt", shape=pentagon, color=darkviolet];
2348[label="213.120.114.148;28pkt 28fpkt", shape=pentagon, color=darkviolet];
2507[label="138.247.58.201;4pkt 4fpkt", shape=pentagon, color=darkviolet];
2573[label="214.20.32.230;22pkt 22fpkt", shape=pentagon, color=darkviolet];
2637[label="91.151.64.3;44pkt 44fpkt", shape=invtriangle, color=brown];
2929[label="138.247.58.201;7pkt 7fpkt", shape=invtriangle, color=brown];
2944[label="91.180.74.209;36pkt 36fpkt", shape=invtriangle, color=brown];
2958[label="214.20.32.230;21pkt 21fpkt", shape=invtriangle, color=brown];
2987[label="91.151.64.3;45pkt 45fpkt", shape=invhouse, color=bisque];
3124[label="138.247.58.201;7pkt 7fpkt", shape=invhouse, color=bisque];
3133[label="214.20.32.230;21pkt 21fpkt", shape=invhouse, color=bisque];
stat328[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 208.152.161.1:*}[61.3905%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (41.0297%)&lt;BR/&gt; 53: (7.00637%)&lt;BR/&gt; 1024: (4.40552%)&lt;BR/&gt; 443: (2.07006%)&lt;BR/&gt; 0: (0.424628%)&gt;];
}
214--603[label="0.210526;24pkt 24fpkt"];
214--966[label="1;7pkt 7fpkt"];
214--1100[label="1;1pkt 1fpkt"];
214--1156[label="0.212121;28pkt 28fpkt"];
214--1249[label="1;6pkt 6fpkt"];
214--1681[label="1;1pkt 1fpkt"];
214--1832[label="0.00185529;1pkt 1fpkt"];
214--1834[label="0.00556586;3pkt 3fpkt"];
214--1843[label="0.00185529;1pkt 1fpkt"];
214--1851[label="0.00185529;1pkt 1fpkt"];
214--1869[label="0.0888889;4pkt 4fpkt"];
214--1904[label="0.181818;24pkt 24fpkt"];
214--1922[label="0.235294;4pkt 4fpkt"];
214--1934[label="0.0535714;3pkt 3fpkt"];
214--1989[label="0.0625;1pkt 1fpkt"];
214--2019[label="0.05;1pkt 1fpkt"];
214--2112[label="0.0333333;1pkt 1fpkt"];
214--2121[label="0.0136986;1pkt 1fpkt"];
214--2172[label="0.191781;28pkt 28fpkt"];
214--2238[label="0.0833333;1pkt 1fpkt"];
214--2335[label="0.0149254;1pkt 1fpkt"];
214--2338[label="0.0243902;1pkt 1fpkt"];
214--2340[label="0.375;3pkt 3fpkt"];
214--2348[label="0.392857;11pkt 11fpkt"];
214--2397[label="0.125;1pkt 1fpkt"];
214--2417[label="0.037037;1pkt 1fpkt"];
214--2422[label="0.030303;1pkt 1fpkt"];
214--2495[label="0.0217391;1pkt 1fpkt"];
214--2507[label="0.75;3pkt 3fpkt"];
214--2525[label="0.0322581;1pkt 1fpkt"];
214--2533[label="0.0188679;1pkt 1fpkt"];
214--2573[label="0.0454545;1pkt 1fpkt"];
214--2600[label="0.0153846;1pkt 1fpkt"];
214--2604[label="0.0434783;1pkt 1fpkt"];
214--2637[label="0.0909091;4pkt 4fpkt"];
214--2748[label="0.0333333;1pkt 1fpkt"];
214--2810[label="0.0833333;1pkt 1fpkt"];
214--2885[label="0.142857;1pkt 1fpkt"];
214--2925[label="0.0212766;1pkt 1fpkt"];
214--2929[label="0.714286;5pkt 5fpkt"];
214--2938[label="0.03125;1pkt 1fpkt"];
214--2942[label="0.0188679;1pkt 1fpkt"];
214--2944[label="0.888889;32pkt 32fpkt"];
214--2958[label="0.047619;1pkt 1fpkt"];
214--2987[label="0.0888889;4pkt 4fpkt"];
214--3036[label="0.0333333;1pkt 1fpkt"];
214--3124[label="0.714286;5pkt 5fpkt"];
214--3133[label="0.047619;1pkt 1fpkt"];
1100--1681[label="1;1pkt 1fpkt"];
1234--1749[label="1;50pkt 50fpkt"];
1234--1869[label="0.0666667;3pkt 3fpkt"];
1234--2176[label="0.02;1pkt 1fpkt"];
1234--2495[label="0.0217391;1pkt 1fpkt"];
1234--2637[label="0.0681818;3pkt 3fpkt"];
1234--2925[label="0.0212766;1pkt 1fpkt"];
1234--2987[label="0.0666667;3pkt 3fpkt"];
1249--2507[label="0.75;3pkt 3fpkt"];
1249--2929[label="0.833333;5pkt 5fpkt"];
1249--3124[label="0.833333;5pkt 5fpkt"];
1749--1869[label="0.0666667;3pkt 3fpkt"];
1749--2176[label="0.02;1pkt 1fpkt"];
1749--2495[label="0.0217391;1pkt 1fpkt"];
1749--2637[label="0.0681818;3pkt 3fpkt"];
1749--2925[label="0.0212766;1pkt 1fpkt"];
1749--2987[label="0.0666667;3pkt 3fpkt"];
1869--2637[label="1;44pkt 44fpkt"];
1869--2987[label="1;45pkt 45fpkt"];
2507--2929[label="0.75;3pkt 3fpkt"];
2507--3124[label="0.75;3pkt 3fpkt"];
2573--2958[label="1;21pkt 21fpkt"];
2573--3133[label="1;21pkt 21fpkt"];
2637--2987[label="1;44pkt 44fpkt"];
2929--3124[label="1;7pkt 7fpkt"];
2958--3133[label="1;21pkt 21fpkt"];
</description>
    <slice>
      <filter dst_ip="208.152.161.1" src_port="80"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.845397,1.6902,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_330{
style=filled;
color=gray75;
1902[label="208.254.218.12;6pkt 6fpkt", shape=pentagon, color=darkviolet];
2647[label="208.254.218.12;6pkt 6fpkt", shape=invtriangle, color=brown];
2992[label="208.254.218.12;6pkt 6fpkt", shape=invhouse, color=bisque];
stat330[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.254.218.12:80, 137.248.49.129:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1464: (8.33333%)&lt;BR/&gt; 1463: (8.33333%)&lt;BR/&gt; 1462: (8.33333%)&lt;BR/&gt; 1461: (8.33333%)&gt;];
}
1902--2647[label="1;6pkt 6fpkt"];
1902--2992[label="1;6pkt 6fpkt"];
2647--2992[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.49.129" src_ip="208.254.218.12" src_port="80"/>
    </slice>
    <from sec="991804205" usec="0"/>
    <to sec="991804228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.845397,1.6902,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_331{
style=filled;
color=gray75;
1903[label="216.64.234.12;14pkt 14fpkt", shape=pentagon, color=darkviolet];
2648[label="216.64.234.12;14pkt 14fpkt", shape=invtriangle, color=brown];
2993[label="216.64.234.12;13pkt 13fpkt", shape=invhouse, color=bisque];
stat331[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.64.234.12:80, 137.248.20.140:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1153: (3.65854%)&lt;BR/&gt; 1152: (3.65854%)&lt;BR/&gt; 1151: (3.65854%)&lt;BR/&gt; 1150: (3.65854%)&gt;];
}
1903--2648[label="1;14pkt 14fpkt"];
1903--2993[label="1;13pkt 13fpkt"];
2648--2993[label="1;13pkt 13fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.20.140" src_ip="216.64.234.12" src_port="80"/>
    </slice>
    <from sec="991804205" usec="0"/>
    <to sec="991804211" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.845397,1.6902,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_332{
style=filled;
color=gray75;
1907[label="221.138.131.14;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2651[label="221.138.131.14;1pkt 1fpkt", shape=invtriangle, color=brown];
2996[label="221.138.131.14;1pkt 1fpkt", shape=invhouse, color=bisque];
stat332[shape=component, label=&lt;Rules:&lt;BR/&gt;{221.138.131.14:80, 143.50.244.133:1036}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1036: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
1907--2651[label="1;1pkt 1fpkt"];
1907--2996[label="1;1pkt 1fpkt"];
2651--2996[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="143.50.244.133" dst_port="1036" src_ip="221.138.131.14" src_port="80"/>
    </slice>
    <from sec="991804180" usec="0"/>
    <to sec="991804209" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03997,1.59051,503,1 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_333{
style=filled;
color=gray75;
81[label="4.117.226.0d;39pkt 39fpkt", shape=rectangle, color=red];
381[label="137.248.34.226;s;254pkt 254fpkt", shape=diamond, color=yellow];
599[label="4.117.226.0;d;180pkt 180fpkt", shape=diamond, color=yellow];
816[label="49.165.216.176;d;24pkt 24fpkt", shape=diamond, color=yellow];
1221[label="4.117.224.178;d;45pkt 45fpkt", shape=diamond, color=yellow];
1423[label="137.248.34.226;s;132pkt 132fpkt", shape=hexagon, color=black];
1504[label="4.117.226.0;d;180pkt 180fpkt", shape=hexagon, color=black];
1911[label="143.50.205.14;20pkt 20fpkt", shape=pentagon, color=darkviolet];
2120[label="208.147.120.76;40pkt 40fpkt", shape=pentagon, color=darkviolet];
2653[label="143.50.205.14;21pkt 21fpkt", shape=invtriangle, color=brown];
stat333[shape=component, label=&lt;Rules:&lt;BR/&gt;{137.248.34.226:*, 4.117.226.0:80}[45.5385%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2236: (0.374332%)&lt;BR/&gt; 2235: (0.374332%)&lt;BR/&gt; 2234: (0.374332%)&lt;BR/&gt; 2233: (0.374332%)&gt;];
}
81--381[label="1;39pkt 39fpkt"];
81--599[label="1;39pkt 39fpkt"];
81--1423[label="1;39pkt 39fpkt"];
81--1504[label="1;39pkt 39fpkt"];
381--599[label="0.822222;148pkt 148fpkt"];
381--816[label="0.25;6pkt 6fpkt"];
381--1221[label="1;45pkt 45fpkt"];
381--1423[label="1;132pkt 132fpkt"];
381--1504[label="0.822222;148pkt 148fpkt"];
381--1827[label="0.0354331;9pkt 9fpkt"];
381--1838[label="0.0354331;9pkt 9fpkt"];
381--1846[label="0.0354331;9pkt 9fpkt"];
599--1423[label="0.69697;92pkt 92fpkt"];
599--1504[label="1;180pkt 180fpkt"];
599--1827[label="0.0166667;3pkt 3fpkt"];
599--1838[label="0.0166667;3pkt 3fpkt"];
599--1846[label="0.0166667;3pkt 3fpkt"];
599--2120[label="0.775;31pkt 31fpkt"];
816--1423[label="0.208333;5pkt 5fpkt"];
816--1827[label="0.166667;4pkt 4fpkt"];
816--1838[label="0.166667;4pkt 4fpkt"];
816--1846[label="0.166667;4pkt 4fpkt"];
816--1911[label="0.4;8pkt 8fpkt"];
816--2653[label="0.428571;9pkt 9fpkt"];
1423--1504[label="0.69697;92pkt 92fpkt"];
1423--1827[label="0.0681818;9pkt 9fpkt"];
1423--1838[label="0.0681818;9pkt 9fpkt"];
1423--1846[label="0.0681818;9pkt 9fpkt"];
1504--1827[label="0.0166667;3pkt 3fpkt"];
1504--1838[label="0.0166667;3pkt 3fpkt"];
1504--1846[label="0.0166667;3pkt 3fpkt"];
1504--2120[label="0.775;31pkt 31fpkt"];
1911--2653[label="1;20pkt 20fpkt"];
</description>
    <slice>
      <filter dst_ip="4.117.226.0" dst_port="80" src_ip="137.248.34.226"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804172" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643346,1.71108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="208.235.244.16"/>
    </slice>
    <from sec="991803604" usec="0"/>
    <to sec="991804174" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.845397,1.6902,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_335{
style=filled;
color=gray75;
1919[label="208.147.100.17;15pkt 15fpkt", shape=pentagon, color=darkviolet];
2658[label="208.147.100.17;15pkt 15fpkt", shape=invtriangle, color=brown];
2997[label="208.147.100.17;15pkt 15fpkt", shape=invhouse, color=bisque];
stat335[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.147.100.17:*, 204.145.3.232:80}[26.6667%]&lt;BR/&gt;{208.147.100.17:*, 204.145.3.237:80}[26.6667%]&lt;BR/&gt;{208.147.100.17:*, 204.145.3.219:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1463: (3.33333%)&lt;BR/&gt; 1462: (3.33333%)&lt;BR/&gt; 1461: (3.33333%)&lt;BR/&gt; 1460: (3.33333%)&gt;];
}
1919--2658[label="1;15pkt 15fpkt"];
1919--2997[label="1;15pkt 15fpkt"];
2658--2997[label="1;15pkt 15fpkt"];
</description>
    <slice>
      <filter dst_ip="204.145.3.237" dst_port="80" src_ip="208.147.100.17"/>
      <filter dst_ip="204.145.3.232" dst_port="80" src_ip="208.147.100.17"/>
      <filter dst_ip="204.145.3.219" dst_port="80" src_ip="208.147.100.17"/>
    </slice>
    <from sec="991804051" usec="0"/>
    <to sec="991804223" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.990447,1.59474,503,0 0 0 1 1 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_336{
style=filled;
color=gray75;
556[label="203.148.242.23;s;2pkt 2fpkt", shape=diamond, color=yellow];
557[label="137.248.30.238;d;4pkt 4fpkt", shape=diamond, color=yellow];
1381[label="203.148.242.23;s;2pkt 2fpkt", shape=hexagon, color=black];
1382[label="137.248.30.238;d;3pkt 3fpkt", shape=hexagon, color=black];
1925[label="209.205.10.19;18pkt 18fpkt", shape=pentagon, color=darkviolet];
1942[label="203.148.242.23;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2661[label="209.205.10.19;18pkt 18fpkt", shape=invtriangle, color=brown];
2999[label="209.205.10.19;18pkt 18fpkt", shape=invhouse, color=bisque];
stat336[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.205.10.19:80, 137.248.30.197:*}[23.8095%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1732: (3.78788%)&lt;BR/&gt; 1241: (3.78788%)&lt;BR/&gt; 1242: (3.0303%)&lt;BR/&gt; 51786: (2.27273%)&gt;];
}
556--557[label="1;2pkt 2fpkt"];
556--1381[label="1;2pkt 2fpkt"];
556--1382[label="1;2pkt 2fpkt"];
556--1942[label="1;1pkt 1fpkt"];
557--1381[label="1;2pkt 2fpkt"];
557--1382[label="1;3pkt 3fpkt"];
557--1925[label="0.25;1pkt 1fpkt"];
557--1942[label="1;1pkt 1fpkt"];
557--2495[label="0.25;1pkt 1fpkt"];
557--2661[label="0.25;1pkt 1fpkt"];
557--2925[label="0.25;1pkt 1fpkt"];
557--2999[label="0.25;1pkt 1fpkt"];
1381--1382[label="1;2pkt 2fpkt"];
1381--1942[label="1;1pkt 1fpkt"];
1382--1925[label="0.333333;1pkt 1fpkt"];
1382--1942[label="1;1pkt 1fpkt"];
1382--2661[label="0.333333;1pkt 1fpkt"];
1382--2999[label="0.333333;1pkt 1fpkt"];
1925--2661[label="1;18pkt 18fpkt"];
1925--2999[label="1;18pkt 18fpkt"];
2661--2999[label="1;18pkt 18fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.30.197" src_ip="209.205.10.19" src_port="80"/>
    </slice>
    <from sec="991803601" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785791,1.58311,999,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_337{
style=filled;
color=gray75;
547[label="175.221.170.196;d;488pkt 488fpkt", shape=diamond, color=yellow];
727[label="215.164.165.16;s;100pkt 100fpkt", shape=diamond, color=yellow];
858[label="138.33.21.250;s;4pkt 4fpkt", shape=diamond, color=yellow];
881[label="215.164.165.2;s;83pkt 83fpkt", shape=diamond, color=yellow];
1632[label="175.221.170.196;d;449pkt 449fpkt", shape=hexagon, color=black];
1916[label="215.164.165.16;100pkt 100fpkt", shape=pentagon, color=darkviolet];
1926[label="216.204.184.19;55pkt 55fpkt", shape=pentagon, color=darkviolet];
2335[label="216.196.213.143;67pkt 67fpkt", shape=pentagon, color=darkviolet];
2656[label="215.164.165.16;101pkt 101fpkt", shape=invtriangle, color=brown];
2662[label="216.204.184.19;55pkt 55fpkt", shape=invtriangle, color=brown];
2973[label="202.178.230.243;54pkt 54fpkt", shape=invtriangle, color=brown];
stat337[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:53, 175.221.170.196:*}[60.6509%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (45.919%)&lt;BR/&gt; 80: (4.82005%)&lt;BR/&gt; 1024: (1.09254%)&lt;BR/&gt; 0: (0.835476%)&lt;BR/&gt; 4651: (0.289203%)&gt;];
}
547--574[label="0.0208333;2pkt 2fpkt"];
547--703[label="0.00294985;1pkt 1fpkt"];
547--727[label="0.87;87pkt 87fpkt"];
547--769[label="0.0315789;3pkt 3fpkt"];
547--858[label="0.75;3pkt 3fpkt"];
547--881[label="0.843373;70pkt 70fpkt"];
547--910[label="0.00680272;1pkt 1fpkt"];
547--912[label="0.0104167;1pkt 1fpkt"];
547--1031[label="0.025;2pkt 2fpkt"];
547--1476[label="0.0168067;2pkt 2fpkt"];
547--1545[label="0.00478469;1pkt 1fpkt"];
547--1568[label="0.00793651;1pkt 1fpkt"];
547--1632[label="1;449pkt 449fpkt"];
547--1718[label="0.0208333;2pkt 2fpkt"];
547--1725[label="0.0104167;1pkt 1fpkt"];
547--1795[label="0.00793651;1pkt 1fpkt"];
547--1916[label="0.86;86pkt 86fpkt"];
547--1926[label="0.109091;6pkt 6fpkt"];
547--2076[label="0.0246914;2pkt 2fpkt"];
547--2121[label="0.0410959;3pkt 3fpkt"];
547--2139[label="0.00265957;1pkt 1fpkt"];
547--2201[label="0.00671141;1pkt 1fpkt"];
547--2335[label="0.104478;7pkt 7fpkt"];
547--2423[label="0.0283019;3pkt 3fpkt"];
547--2497[label="0.0246914;2pkt 2fpkt"];
547--2515[label="0.0555556;1pkt 1fpkt"];
547--2549[label="0.047619;2pkt 2fpkt"];
547--2600[label="0.0615385;4pkt 4fpkt"];
547--2656[label="0.851485;86pkt 86fpkt"];
547--2662[label="0.109091;6pkt 6fpkt"];
547--2731[label="0.0246914;2pkt 2fpkt"];
547--2763[label="0.00265252;1pkt 1fpkt"];
547--2793[label="0.00671141;1pkt 1fpkt"];
547--2948[label="0.0487805;2pkt 2fpkt"];
547--2973[label="0.0740741;4pkt 4fpkt"];
547--3054[label="0.00671141;1pkt 1fpkt"];
547--3129[label="0.047619;2pkt 2fpkt"];
727--748[label="0.01;1pkt 1fpkt"];
727--853[label="0.01;1pkt 1fpkt"];
727--860[label="0.0108696;1pkt 1fpkt"];
727--872[label="0.01;1pkt 1fpkt"];
727--1346[label="0.01;1pkt 1fpkt"];
727--1369[label="0.01;1pkt 1fpkt"];
727--1475[label="0.01;1pkt 1fpkt"];
727--1632[label="0.81;81pkt 81fpkt"];
727--1792[label="0.01;1pkt 1fpkt"];
727--1916[label="0.98;98pkt 98fpkt"];
727--2656[label="0.99;99pkt 99fpkt"];
858--1632[label="0.75;3pkt 3fpkt"];
881--1346[label="0.0120482;1pkt 1fpkt"];
881--1369[label="0.0120482;1pkt 1fpkt"];
881--1475[label="0.0120482;1pkt 1fpkt"];
881--1487[label="0.0120482;1pkt 1fpkt"];
881--1632[label="0.771084;64pkt 64fpkt"];
881--1792[label="0.0120482;1pkt 1fpkt"];
881--1834[label="0.0120482;1pkt 1fpkt"];
1632--1718[label="0.0208333;2pkt 2fpkt"];
1632--1725[label="0.0104167;1pkt 1fpkt"];
1632--1795[label="0.00793651;1pkt 1fpkt"];
1632--1916[label="0.8;80pkt 80fpkt"];
1632--1926[label="0.109091;6pkt 6fpkt"];
1632--2076[label="0.0123457;1pkt 1fpkt"];
1632--2121[label="0.0410959;3pkt 3fpkt"];
1632--2139[label="0.00265957;1pkt 1fpkt"];
1632--2201[label="0.00671141;1pkt 1fpkt"];
1632--2335[label="0.0895522;6pkt 6fpkt"];
1632--2423[label="0.0283019;3pkt 3fpkt"];
1632--2497[label="0.0246914;2pkt 2fpkt"];
1632--2515[label="0.0555556;1pkt 1fpkt"];
1632--2549[label="0.047619;2pkt 2fpkt"];
1632--2600[label="0.0615385;4pkt 4fpkt"];
1632--2656[label="0.792079;80pkt 80fpkt"];
1632--2662[label="0.109091;6pkt 6fpkt"];
1632--2731[label="0.0123457;1pkt 1fpkt"];
1632--2763[label="0.00265252;1pkt 1fpkt"];
1632--2793[label="0.00671141;1pkt 1fpkt"];
1632--2948[label="0.0487805;2pkt 2fpkt"];
1632--2973[label="0.0740741;4pkt 4fpkt"];
1632--3054[label="0.00671141;1pkt 1fpkt"];
1632--3129[label="0.047619;2pkt 2fpkt"];
1916--2656[label="1;100pkt 100fpkt"];
1926--2662[label="1;55pkt 55fpkt"];
</description>
    <slice>
      <filter dst_ip="175.221.170.196" src_port="53"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643346,1.71108,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="161.237.238.23"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.845397,1.6902,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_339{
style=filled;
color=gray75;
1947[label="143.50.208.24;7pkt 7fpkt", shape=pentagon, color=darkviolet];
2670[label="143.50.208.24;8pkt 8fpkt", shape=invtriangle, color=brown];
3006[label="143.50.208.24;8pkt 8fpkt", shape=invhouse, color=bisque];
stat339[shape=component, label=&lt;Rules:&lt;BR/&gt;{143.50.208.24:80, 91.9.104.162:*}[37.5%]&lt;BR/&gt;{143.50.208.24:80, 90.119.140.153:*}[25%]&lt;BR/&gt;{143.50.208.24:80, 4.25.177.222:*}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 15575: (6.52174%)&lt;BR/&gt; 2031: (6.52174%)&lt;BR/&gt; 1277: (6.52174%)&lt;BR/&gt; 1267: (6.52174%)&gt;];
}
1947--2670[label="1;7pkt 7fpkt"];
1947--3006[label="1;7pkt 7fpkt"];
2670--3006[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="91.9.104.162" src_ip="143.50.208.24" src_port="80"/>
      <filter dst_ip="4.25.177.222" src_ip="143.50.208.24" src_port="80"/>
      <filter dst_ip="90.119.140.153" src_ip="143.50.208.24" src_port="80"/>
    </slice>
    <from sec="991803720" usec="0"/>
    <to sec="991804186" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.990447,1.59474,503,0 0 0 1 1 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_340{
style=filled;
color=gray75;
183[label="143.50.229.4;d;80pkt 80fpkt", shape=diamond, color=yellow];
186[label="205.69.220.44;s;3pkt 3fpkt", shape=diamond, color=yellow];
1426[label="143.50.229.4;d;58pkt 58fpkt", shape=hexagon, color=black];
1949[label="212.70.98.25;18pkt 18fpkt", shape=pentagon, color=darkviolet];
2022[label="205.69.220.44;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2289[label="194.2.159.133;20pkt 20fpkt", shape=pentagon, color=darkviolet];
2671[label="212.70.98.25;18pkt 18fpkt", shape=invtriangle, color=brown];
2700[label="205.69.220.44;3pkt 3fpkt", shape=invtriangle, color=brown];
2838[label="194.2.159.133;21pkt 21fpkt", shape=invtriangle, color=brown];
3007[label="212.70.98.25;17pkt 17fpkt", shape=invhouse, color=bisque];
stat340[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.2.159.133:80, 143.50.229.4:*}[26.25%]&lt;BR/&gt;{212.70.98.25:80, 143.50.229.4:*}[22.5%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (45.2282%)&lt;BR/&gt; 4013: (2.07469%)&lt;BR/&gt; 5127: (1.03734%)&lt;BR/&gt; 5125: (1.03734%)&lt;BR/&gt; 5124: (1.03734%)&gt;];
}
183--186[label="1;3pkt 3fpkt"];
183--424[label="0.075;6pkt 6fpkt"];
183--741[label="0.1;8pkt 8fpkt"];
183--1426[label="1;58pkt 58fpkt"];
183--1445[label="0.0375;3pkt 3fpkt"];
183--1486[label="0.1;8pkt 8fpkt"];
183--1826[label="0.0125;1pkt 1fpkt"];
183--1837[label="0.0125;1pkt 1fpkt"];
183--1845[label="0.0125;1pkt 1fpkt"];
183--1949[label="1;18pkt 18fpkt"];
183--2022[label="1;3pkt 3fpkt"];
183--2289[label="1;20pkt 20fpkt"];
183--2432[label="0.075;6pkt 6fpkt"];
183--2671[label="1;18pkt 18fpkt"];
183--2700[label="1;3pkt 3fpkt"];
183--2838[label="1;21pkt 21fpkt"];
183--3007[label="1;17pkt 17fpkt"];
186--1426[label="1;3pkt 3fpkt"];
186--2022[label="1;3pkt 3fpkt"];
186--2700[label="1;3pkt 3fpkt"];
1426--1445[label="0.0517241;3pkt 3fpkt"];
1426--1486[label="0.137931;8pkt 8fpkt"];
1426--1826[label="0.0172414;1pkt 1fpkt"];
1426--1837[label="0.0172414;1pkt 1fpkt"];
1426--1845[label="0.0172414;1pkt 1fpkt"];
1426--1949[label="0.0555556;1pkt 1fpkt"];
1426--2022[label="1;3pkt 3fpkt"];
1426--2289[label="1;20pkt 20fpkt"];
1426--2432[label="0.0517241;3pkt 3fpkt"];
1426--2671[label="0.0555556;1pkt 1fpkt"];
1426--2700[label="1;3pkt 3fpkt"];
1426--2838[label="1;21pkt 21fpkt"];
1949--2671[label="1;18pkt 18fpkt"];
1949--3007[label="1;17pkt 17fpkt"];
2022--2700[label="1;3pkt 3fpkt"];
2289--2838[label="1;20pkt 20fpkt"];
2671--3007[label="1;17pkt 17fpkt"];
</description>
    <slice>
      <filter dst_ip="143.50.229.4" src_ip="194.2.159.133" src_port="80"/>
      <filter dst_ip="143.50.229.4" src_ip="212.70.98.25" src_port="80"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677781,1.59484,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_341{
style=filled;
color=gray75;
776[label="137.248.54.2;d;145pkt 145fpkt", shape=diamond, color=yellow];
947[label="195.5.168.15;s;365pkt 365fpkt", shape=diamond, color=yellow];
1068[label="91.20.24.155;s;34pkt 34fpkt", shape=diamond, color=yellow];
1201[label="151.144.85.193;d;136pkt 136fpkt", shape=diamond, color=yellow];
1203[label="137.248.174.80;d;144pkt 144fpkt", shape=diamond, color=yellow];
1213[label="151.144.46.119;d;75pkt 75fpkt", shape=diamond, color=yellow];
1668[label="91.20.24.155;s;34pkt 34fpkt", shape=hexagon, color=black];
1724[label="137.248.54.2;d;145pkt 145fpkt", shape=hexagon, color=black];
2152[label="144.107.250.83;29pkt 29fpkt", shape=pentagon, color=darkviolet];
2304[label="25.1.229.136;25pkt 25fpkt", shape=pentagon, color=darkviolet];
2502[label="214.119.105.200;88pkt 88fpkt", shape=pentagon, color=darkviolet];
2503[label="50.77.128.200;7pkt 7fpkt", shape=pentagon, color=darkviolet];
stat341[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.5.168.15:80, *:*}[51.5537%]&lt;BR/&gt;{*:*, 137.248.54.2:*}[21.4689%]&lt;BR/&gt;{*:80, 137.248.174.80:*}[20.339%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.859%)&lt;BR/&gt; 32824: (1.14099%)&lt;BR/&gt; 53: (1.14099%)&lt;BR/&gt; 47841: (0.162999%)&lt;BR/&gt; 47829: (0.162999%)&gt;];
}
776--947[label="0.0413793;6pkt 6fpkt"];
776--1047[label="0.0512821;2pkt 2fpkt"];
776--1051[label="0.0185185;1pkt 1fpkt"];
776--1068[label="1;34pkt 34fpkt"];
776--1172[label="0.025;1pkt 1fpkt"];
776--1652[label="0.0222222;1pkt 1fpkt"];
776--1668[label="1;34pkt 34fpkt"];
776--1724[label="1;145pkt 145fpkt"];
776--1987[label="0.0526316;1pkt 1fpkt"];
776--2152[label="0.758621;22pkt 22fpkt"];
776--2304[label="0.08;2pkt 2fpkt"];
776--2503[label="1;7pkt 7fpkt"];
947--1201[label="0.955882;130pkt 130fpkt"];
947--1203[label="0.25;36pkt 36fpkt"];
947--1213[label="0.773333;58pkt 58fpkt"];
947--1724[label="0.0413793;6pkt 6fpkt"];
1068--1668[label="1;34pkt 34fpkt"];
1068--1724[label="1;34pkt 34fpkt"];
1201--1486[label="0.047619;4pkt 4fpkt"];
1203--1486[label="0.047619;4pkt 4fpkt"];
1203--1960[label="0.0833333;1pkt 1fpkt"];
1203--2502[label="0.511364;45pkt 45fpkt"];
1203--2615[label="0.037037;5pkt 5fpkt"];
1213--2432[label="0.04;3pkt 3fpkt"];
1213--2495[label="0.0217391;1pkt 1fpkt"];
1213--2925[label="0.0212766;1pkt 1fpkt"];
1668--1724[label="1;34pkt 34fpkt"];
1724--1987[label="0.0526316;1pkt 1fpkt"];
1724--2152[label="0.758621;22pkt 22fpkt"];
1724--2304[label="0.08;2pkt 2fpkt"];
1724--2503[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.54.2"/>
      <filter src_ip="195.5.168.15" src_port="80"/>
      <filter dst_ip="137.248.174.80" src_port="80"/>
    </slice>
    <from sec="991803614" usec="0"/>
    <to sec="991804222" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.592604,1.67923,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_342{
style=filled;
color=gray75;
1964[label="136.53.41.29;5pkt 5fpkt", shape=pentagon, color=darkviolet];
2676[label="136.53.41.29;6pkt 6fpkt", shape=invtriangle, color=brown];
stat342[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.53.41.29:80, 137.248.176.84:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1299: (9.09091%)&lt;BR/&gt; 1295: (9.09091%)&lt;BR/&gt; 1291: (9.09091%)&lt;BR/&gt; 1290: (9.09091%)&gt;];
}
1964--2676[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.176.84" src_ip="136.53.41.29" src_port="80"/>
    </slice>
    <from sec="991803961" usec="0"/>
    <to sec="991804037" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643346,1.71108,002,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="208.105.155.29"/>
    </slice>
    <from sec="991803603" usec="0"/>
    <to sec="991804227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.592604,1.67923,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_345{
style=filled;
color=gray75;
1996[label="214.224.187.36;8pkt 8fpkt", shape=pentagon, color=darkviolet];
2687[label="214.224.187.36;8pkt 8fpkt", shape=invtriangle, color=brown];
stat345[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.224.187.36:80, 151.144.183.76:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1356: (6.25%)&lt;BR/&gt; 1353: (6.25%)&lt;BR/&gt; 1352: (6.25%)&lt;BR/&gt; 1351: (6.25%)&gt;];
}
1996--2687[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="151.144.183.76" src_ip="214.224.187.36" src_port="80"/>
    </slice>
    <from sec="991803928" usec="0"/>
    <to sec="991804186" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.845397,1.6902,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_347{
style=filled;
color=gray75;
2000[label="137.248.45.38;9pkt 9fpkt", shape=pentagon, color=darkviolet];
2690[label="137.248.45.38;9pkt 9fpkt", shape=invtriangle, color=brown];
3016[label="137.248.45.38;10pkt 10fpkt", shape=invhouse, color=bisque];
stat347[shape=component, label=&lt;Rules:&lt;BR/&gt;{137.248.45.38:80, 214.20.32.230:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4839: (5.35714%)&lt;BR/&gt; 4333: (5.35714%)&lt;BR/&gt; 4089: (5.35714%)&lt;BR/&gt; 3999: (5.35714%)&gt;];
}
2000--2690[label="1;9pkt 9fpkt"];
2000--3016[label="1;9pkt 9fpkt"];
2690--3016[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="214.20.32.230" src_ip="137.248.45.38" src_port="80"/>
    </slice>
    <from sec="991803868" usec="0"/>
    <to sec="991804023" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.592604,1.67923,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_348{
style=filled;
color=gray75;
2038[label="209.40.133.50;7pkt 7fpkt", shape=pentagon, color=darkviolet];
2710[label="209.40.133.50;6pkt 6fpkt", shape=invtriangle, color=brown];
stat348[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.40.133.50:*, 208.152.136.196:80}[85.7143%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1273: (7.69231%)&lt;BR/&gt; 1267: (7.69231%)&lt;BR/&gt; 1265: (7.69231%)&lt;BR/&gt; 1249: (7.69231%)&gt;];
}
2038--2710[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="208.152.136.196" dst_port="80" src_ip="209.40.133.50"/>
    </slice>
    <from sec="991803727" usec="0"/>
    <to sec="991804210" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643346,1.71108,502,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="32.143.4.51"/>
    </slice>
    <from sec="991803609" usec="0"/>
    <to sec="991803933" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.845397,1.6902,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_350{
style=filled;
color=gray75;
2048[label="204.55.122.55;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2718[label="204.55.122.55;1pkt 1fpkt", shape=invtriangle, color=brown];
3027[label="204.55.122.55;1pkt 1fpkt", shape=invhouse, color=bisque];
stat350[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.55.122.55:1295, 208.152.136.193:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1295: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
2048--2718[label="1;1pkt 1fpkt"];
2048--3027[label="1;1pkt 1fpkt"];
2718--3027[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="208.152.136.193" dst_port="80" src_ip="204.55.122.55" src_port="1295"/>
    </slice>
    <from sec="991804188" usec="0"/>
    <to sec="991804220" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643346,1.71108,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="17.203.146.59"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.592604,1.67923,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_352{
style=filled;
color=gray75;
2070[label="219.246.94.63;27pkt 27fpkt", shape=pentagon, color=darkviolet];
2728[label="219.246.94.63;28pkt 28fpkt", shape=invtriangle, color=brown];
stat352[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.246.94.63:80, 137.248.10.32:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 49226: (1.81818%)&lt;BR/&gt; 49225: (1.81818%)&lt;BR/&gt; 49219: (1.81818%)&lt;BR/&gt; 49218: (1.81818%)&gt;];
}
2070--2728[label="1;27pkt 27fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.10.32" src_ip="219.246.94.63" src_port="80"/>
    </slice>
    <from sec="991804073" usec="0"/>
    <to sec="991804137" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.592604,1.67923,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_353{
style=filled;
color=gray75;
2081[label="175.221.150.66;7pkt 7fpkt", shape=pentagon, color=darkviolet];
2733[label="175.221.150.66;8pkt 8fpkt", shape=invtriangle, color=brown];
stat353[shape=component, label=&lt;Rules:&lt;BR/&gt;{175.221.150.66:41002, 206.128.225.150:*}[25%]&lt;BR/&gt;{175.221.150.66:*, 17.161.170.158:*}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 41002: (13.3333%)&lt;BR/&gt; 41008: (6.66667%)&lt;BR/&gt; 41007: (6.66667%)&lt;BR/&gt; 41004: (6.66667%)&lt;BR/&gt; 41003: (6.66667%)&gt;];
}
2081--2733[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="17.161.170.158" src_ip="175.221.150.66"/>
      <filter dst_ip="206.128.225.150" src_ip="175.221.150.66" src_port="41002"/>
    </slice>
    <from sec="991803614" usec="0"/>
    <to sec="991804224" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643346,1.71108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="214.43.252.72"/>
    </slice>
    <from sec="991803716" usec="0"/>
    <to sec="991804225" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.845397,1.6902,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_355{
style=filled;
color=gray75;
2110[label="206.161.115.73;25pkt 25fpkt", shape=pentagon, color=darkviolet];
2747[label="206.161.115.73;24pkt 24fpkt", shape=invtriangle, color=brown];
3035[label="206.161.115.73;25pkt 25fpkt", shape=invhouse, color=bisque];
stat355[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.161.115.73:8080, 137.248.227.161:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8080: (50%)&lt;BR/&gt; 63186: (2.02703%)&lt;BR/&gt; 63185: (2.02703%)&lt;BR/&gt; 63184: (2.02703%)&lt;BR/&gt; 63183: (2.02703%)&gt;];
}
2110--2747[label="1;24pkt 24fpkt"];
2110--3035[label="1;25pkt 25fpkt"];
2747--3035[label="1;24pkt 24fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.227.161" src_ip="206.161.115.73" src_port="8080"/>
    </slice>
    <from sec="991803651" usec="0"/>
    <to sec="991803681" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.592604,1.67923,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_357{
style=filled;
color=gray75;
2115[label="137.248.235.74;6pkt 6fpkt", shape=pentagon, color=darkviolet];
2750[label="137.248.235.74;5pkt 5fpkt", shape=invtriangle, color=brown];
stat357[shape=component, label=&lt;Rules:&lt;BR/&gt;{137.248.235.74:*, 195.92.147.3:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 33529: (9.09091%)&lt;BR/&gt; 33528: (9.09091%)&lt;BR/&gt; 33527: (9.09091%)&lt;BR/&gt; 33525: (9.09091%)&gt;];
}
2115--2750[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="195.92.147.3" dst_port="80" src_ip="137.248.235.74"/>
    </slice>
    <from sec="991803744" usec="0"/>
    <to sec="991803805" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.592604,1.67923,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_358{
style=filled;
color=gray75;
2118[label="207.112.208.75;61pkt 61fpkt", shape=pentagon, color=darkviolet];
2753[label="207.112.208.75;62pkt 62fpkt", shape=invtriangle, color=brown];
stat358[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.112.208.75:80, 137.248.132.136:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 54793: (0.813008%)&lt;BR/&gt; 54792: (0.813008%)&lt;BR/&gt; 54791: (0.813008%)&lt;BR/&gt; 54790: (0.813008%)&gt;];
}
2118--2753[label="1;61pkt 61fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.132.136" src_ip="207.112.208.75" src_port="80"/>
    </slice>
    <from sec="991804171" usec="0"/>
    <to sec="991804224" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.592604,1.67923,020,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_359{
style=filled;
color=gray75;
2131[label="209.209.212.79;22pkt 22fpkt", shape=pentagon, color=darkviolet];
2759[label="209.209.212.79;23pkt 23fpkt", shape=invtriangle, color=brown];
stat359[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.209.212.79:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2131--2759[label="1;22pkt 22fpkt"];
</description>
    <slice>
      <filter src_ip="209.209.212.79"/>
    </slice>
    <from sec="991803601" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.592604,1.67923,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_360{
style=filled;
color=gray75;
2142[label="137.248.176.81;36pkt 36fpkt", shape=pentagon, color=darkviolet];
2764[label="137.248.176.81;37pkt 37fpkt", shape=invtriangle, color=brown];
stat360[shape=component, label=&lt;Rules:&lt;BR/&gt;{137.248.176.81:*, 206.220.153.220:80}[37.8378%]&lt;BR/&gt;{137.248.176.81:*, 214.53.123.32:80}[21.6216%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (43.8356%)&lt;BR/&gt; 0: (12.3288%)&lt;BR/&gt; 1883: (1.36986%)&lt;BR/&gt; 1882: (1.36986%)&lt;BR/&gt; 1881: (1.36986%)&gt;];
}
2142--2764[label="1;36pkt 36fpkt"];
</description>
    <slice>
      <filter dst_ip="206.220.153.220" dst_port="80" src_ip="137.248.176.81"/>
      <filter dst_ip="214.53.123.32" dst_port="80" src_ip="137.248.176.81"/>
    </slice>
    <from sec="991803813" usec="0"/>
    <to sec="991804225" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.592604,1.67923,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_361{
style=filled;
color=gray75;
2157[label="208.32.51.85;42pkt 42fpkt", shape=pentagon, color=darkviolet];
2772[label="208.32.51.85;42pkt 42fpkt", shape=invtriangle, color=brown];
stat361[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.32.51.85:80, 208.147.113.91:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1436: (1.19048%)&lt;BR/&gt; 1435: (1.19048%)&lt;BR/&gt; 1434: (1.19048%)&lt;BR/&gt; 1433: (1.19048%)&gt;];
}
2157--2772[label="1;42pkt 42fpkt"];
</description>
    <slice>
      <filter dst_ip="208.147.113.91" src_ip="208.32.51.85" src_port="80"/>
    </slice>
    <from sec="991804110" usec="0"/>
    <to sec="991804182" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.845397,1.6902,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_362{
style=filled;
color=gray75;
2166[label="218.238.193.86;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2776[label="218.238.193.86;4pkt 4fpkt", shape=invtriangle, color=brown];
3046[label="218.238.193.86;4pkt 4fpkt", shape=invhouse, color=bisque];
stat362[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.238.193.86:80, 137.248.36.149:3562}[25%]&lt;BR/&gt;{218.238.193.86:80, 137.248.36.149:3595}[25%]&lt;BR/&gt;{218.238.193.86:80, 137.248.36.149:3602}[25%]&lt;BR/&gt;{218.238.193.86:80, 137.248.36.149:3603}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3603: (13.6364%)&lt;BR/&gt; 3602: (13.6364%)&lt;BR/&gt; 3595: (13.6364%)&lt;BR/&gt; 3562: (9.09091%)&gt;];
}
2166--2776[label="1;3pkt 3fpkt"];
2166--3046[label="1;3pkt 3fpkt"];
2776--3046[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.36.149" dst_port="3603" src_ip="218.238.193.86" src_port="80"/>
      <filter dst_ip="137.248.36.149" dst_port="3602" src_ip="218.238.193.86" src_port="80"/>
      <filter dst_ip="137.248.36.149" dst_port="3595" src_ip="218.238.193.86" src_port="80"/>
      <filter dst_ip="137.248.36.149" dst_port="3562" src_ip="218.238.193.86" src_port="80"/>
    </slice>
    <from sec="991804169" usec="0"/>
    <to sec="991804192" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.845397,1.6902,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_363{
style=filled;
color=gray75;
2179[label="175.221.130.90;18pkt 18fpkt", shape=pentagon, color=darkviolet];
2782[label="175.221.130.90;19pkt 19fpkt", shape=invtriangle, color=brown];
3048[label="175.221.130.90;19pkt 19fpkt", shape=invhouse, color=bisque];
stat363[shape=component, label=&lt;Rules:&lt;BR/&gt;{175.221.130.90:*, *:6667}[57.8947%]&lt;BR/&gt;{175.221.130.90:113, *:*}[36.8421%]&lt;BR/&gt;{175.221.130.90:*, 214.152.73.181:*}[21.0526%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (28.5714%)&lt;BR/&gt; 113: (18.75%)&lt;BR/&gt; 43019: (2.67857%)&lt;BR/&gt; 4913: (2.67857%)&lt;BR/&gt; 4015: (2.67857%)&gt;];
}
2179--2782[label="1;18pkt 18fpkt"];
2179--3048[label="1;18pkt 18fpkt"];
2782--3048[label="1;19pkt 19fpkt"];
</description>
    <slice>
      <filter dst_ip="214.152.73.181" src_ip="175.221.130.90"/>
      <filter src_ip="175.221.130.90" src_port="113"/>
      <filter dst_port="6667" src_ip="175.221.130.90"/>
    </slice>
    <from sec="991803698" usec="0"/>
    <to sec="991804203" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.845397,1.6902,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_364{
style=filled;
color=gray75;
2186[label="49.16.82.93;18pkt 18fpkt", shape=pentagon, color=darkviolet];
2786[label="49.16.82.93;17pkt 17fpkt", shape=invtriangle, color=brown];
3050[label="49.16.82.93;18pkt 18fpkt", shape=invhouse, color=bisque];
stat364[shape=component, label=&lt;Rules:&lt;BR/&gt;{49.16.82.93:*, 137.248.40.222:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1172: (2.83019%)&lt;BR/&gt; 1171: (2.83019%)&lt;BR/&gt; 1169: (2.83019%)&lt;BR/&gt; 1168: (2.83019%)&gt;];
}
2186--2786[label="1;17pkt 17fpkt"];
2186--3050[label="1;18pkt 18fpkt"];
2786--3050[label="1;17pkt 17fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.40.222" dst_port="80" src_ip="49.16.82.93"/>
    </slice>
    <from sec="991804028" usec="0"/>
    <to sec="991804203" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.845397,1.6902,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_365{
style=filled;
color=gray75;
2191[label="207.228.193.93;5pkt 5fpkt", shape=pentagon, color=darkviolet];
2788[label="207.228.193.93;4pkt 4fpkt", shape=invtriangle, color=brown];
3051[label="207.228.193.93;4pkt 4fpkt", shape=invhouse, color=bisque];
stat365[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.228.193.93:80, 137.248.176.106:1989}[20%]&lt;BR/&gt;{207.228.193.93:80, 137.248.176.106:1990}[20%]&lt;BR/&gt;{207.228.193.93:80, 137.248.176.106:1991}[20%]&lt;BR/&gt;{207.228.193.93:80, 137.248.176.106:1992}[20%]&lt;BR/&gt;{207.228.193.93:80, 137.248.176.106:1993}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1993: (11.5385%)&lt;BR/&gt; 1992: (11.5385%)&lt;BR/&gt; 1991: (11.5385%)&lt;BR/&gt; 1990: (11.5385%)&gt;];
}
2191--2788[label="1;4pkt 4fpkt"];
2191--3051[label="1;4pkt 4fpkt"];
2788--3051[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.176.106" dst_port="1993" src_ip="207.228.193.93" src_port="80"/>
      <filter dst_ip="137.248.176.106" dst_port="1992" src_ip="207.228.193.93" src_port="80"/>
      <filter dst_ip="137.248.176.106" dst_port="1991" src_ip="207.228.193.93" src_port="80"/>
      <filter dst_ip="137.248.176.106" dst_port="1990" src_ip="207.228.193.93" src_port="80"/>
      <filter dst_ip="137.248.176.106" dst_port="1989" src_ip="207.228.193.93" src_port="80"/>
    </slice>
    <from sec="991804165" usec="0"/>
    <to sec="991804228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.845397,1.6902,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_366{
style=filled;
color=gray75;
2192[label="151.144.28.94;18pkt 18fpkt", shape=pentagon, color=darkviolet];
2789[label="151.144.28.94;18pkt 18fpkt", shape=invtriangle, color=brown];
3052[label="151.144.28.94;19pkt 19fpkt", shape=invhouse, color=bisque];
stat366[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.144.28.94:*, 220.250.255.177:80}[94.7368%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.2727%)&lt;BR/&gt; 4579: (2.72727%)&lt;BR/&gt; 4578: (2.72727%)&lt;BR/&gt; 4577: (2.72727%)&lt;BR/&gt; 4576: (2.72727%)&gt;];
}
2192--2789[label="1;18pkt 18fpkt"];
2192--3052[label="1;18pkt 18fpkt"];
2789--3052[label="1;18pkt 18fpkt"];
</description>
    <slice>
      <filter dst_ip="220.250.255.177" dst_port="80" src_ip="151.144.28.94"/>
    </slice>
    <from sec="991803644" usec="0"/>
    <to sec="991804226" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643346,1.71108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="213.112.32.95"/>
    </slice>
    <from sec="991803633" usec="0"/>
    <to sec="991803676" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.592604,1.67923,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_368{
style=filled;
color=gray75;
2198[label="195.254.121.95;15pkt 15fpkt", shape=pentagon, color=darkviolet];
2792[label="195.254.121.95;14pkt 14fpkt", shape=invtriangle, color=brown];
stat368[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.254.121.95:80, 137.248.157.58:*}[80%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.2759%)&lt;BR/&gt; 50228: (3.44828%)&lt;BR/&gt; 1278: (3.44828%)&lt;BR/&gt; 1277: (3.44828%)&lt;BR/&gt; 1276: (3.44828%)&gt;];
}
2198--2792[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.157.58" src_ip="195.254.121.95" src_port="80"/>
    </slice>
    <from sec="991803629" usec="0"/>
    <to sec="991804157" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643346,1.71108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="137.248.16.97"/>
    </slice>
    <from sec="991803609" usec="0"/>
    <to sec="991804225" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643346,1.71108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="195.135.224.98"/>
    </slice>
    <from sec="991804048" usec="0"/>
    <to sec="991804111" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.845397,1.6902,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_372{
style=filled;
color=gray75;
2213[label="91.151.69.99;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2801[label="91.151.69.99;2pkt 2fpkt", shape=invtriangle, color=brown];
3060[label="91.151.69.99;1pkt 1fpkt", shape=invhouse, color=bisque];
stat372[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.151.69.99:443, 137.248.2.70:1155}[50%]&lt;BR/&gt;{91.151.69.99:443, 151.144.77.198:1163}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (50%)&lt;BR/&gt; 1163: (37.5%)&lt;BR/&gt; 1155: (12.5%)&gt;];
}
2213--2801[label="1;1pkt 1fpkt"];
2213--3060[label="1;1pkt 1fpkt"];
2801--3060[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="151.144.77.198" dst_port="1163" src_ip="91.151.69.99" src_port="443"/>
      <filter dst_ip="137.248.2.70" dst_port="1155" src_ip="91.151.69.99" src_port="443"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.845397,1.6902,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_374{
style=filled;
color=gray75;
2252[label="133.32.49.117;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2819[label="133.32.49.117;2pkt 2fpkt", shape=invtriangle, color=brown];
3070[label="133.32.49.117;1pkt 1fpkt", shape=invhouse, color=bisque];
stat374[shape=component, label=&lt;Rules:&lt;BR/&gt;{133.32.49.117:0, 169.38.94.150:0}[50%]&lt;BR/&gt;{133.32.49.117:6688, 169.38.94.150:1144}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6688: (37.5%)&lt;BR/&gt; 1144: (37.5%)&lt;BR/&gt; 0: (25%)&gt;];
}
2252--2819[label="1;1pkt 1fpkt"];
2252--3070[label="1;1pkt 1fpkt"];
2819--3070[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="169.38.94.150" dst_port="1144" src_ip="133.32.49.117" src_port="6688"/>
      <filter dst_ip="169.38.94.150" src_ip="133.32.49.117"/>
    </slice>
    <from sec="991804224" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.592604,1.67923,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_375{
style=filled;
color=gray75;
2263[label="212.193.21.125;20pkt 20fpkt", shape=pentagon, color=darkviolet];
2826[label="212.193.21.125;20pkt 20fpkt", shape=invtriangle, color=brown];
stat375[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.193.21.125:80, 208.147.182.143:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4402: (2.5%)&lt;BR/&gt; 4401: (2.5%)&lt;BR/&gt; 4400: (2.5%)&lt;BR/&gt; 4399: (2.5%)&gt;];
}
2263--2826[label="1;20pkt 20fpkt"];
</description>
    <slice>
      <filter dst_ip="208.147.182.143" src_ip="212.193.21.125" src_port="80"/>
    </slice>
    <from sec="991804165" usec="0"/>
    <to sec="991804187" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.845397,1.6902,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_376{
style=filled;
color=gray75;
2266[label="151.144.58.127;34pkt 34fpkt", shape=pentagon, color=darkviolet];
2827[label="151.144.58.127;35pkt 35fpkt", shape=invtriangle, color=brown];
3073[label="151.144.58.127;35pkt 35fpkt", shape=invhouse, color=bisque];
stat376[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.144.58.127:*, 207.244.118.195:80}[94.2857%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1788: (1.44231%)&lt;BR/&gt; 1785: (1.44231%)&lt;BR/&gt; 1782: (1.44231%)&lt;BR/&gt; 1781: (1.44231%)&gt;];
}
2266--2827[label="1;34pkt 34fpkt"];
2266--3073[label="1;34pkt 34fpkt"];
2827--3073[label="1;35pkt 35fpkt"];
</description>
    <slice>
      <filter dst_ip="207.244.118.195" dst_port="80" src_ip="151.144.58.127"/>
    </slice>
    <from sec="991803676" usec="0"/>
    <to sec="991804223" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.990447,1.59474,999,0 0 0 1 1 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_377{
style=filled;
color=gray75;
113[label="169.38.94.188;d;149pkt 149fpkt", shape=diamond, color=yellow];
286[label="17.203.32.216;s;1pkt 1fpkt", shape=diamond, color=yellow];
369[label="218.90.230.143;s;1pkt 1fpkt", shape=diamond, color=yellow];
451[label="17.192.52.15;s;1pkt 1fpkt", shape=diamond, color=yellow];
498[label="91.12.2.39;s;1pkt 1fpkt", shape=diamond, color=yellow];
513[label="202.49.81.28;s;1pkt 1fpkt", shape=diamond, color=yellow];
550[label="195.194.228.57;s;1pkt 1fpkt", shape=diamond, color=yellow];
735[label="161.249.74.184;s;1pkt 1fpkt", shape=diamond, color=yellow];
1092[label="91.114.192.54;s;2pkt 2fpkt", shape=diamond, color=yellow];
1365[label="202.49.81.28;s;1pkt 1fpkt", shape=hexagon, color=black];
1376[label="195.194.228.57;s;1pkt 1fpkt", shape=hexagon, color=black];
1416[label="169.38.94.188;d;87pkt 87fpkt", shape=hexagon, color=black];
1449[label="17.192.52.15;s;1pkt 1fpkt", shape=hexagon, color=black];
1453[label="17.203.32.216;s;1pkt 1fpkt", shape=hexagon, color=black];
1631[label="161.249.74.184;s;1pkt 1fpkt", shape=hexagon, color=black];
2267[label="137.74.80.127;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2541[label="91.42.209.211;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2828[label="137.74.80.127;1pkt 1fpkt", shape=invtriangle, color=brown];
3074[label="137.74.80.127;1pkt 1fpkt", shape=invhouse, color=bisque];
stat377[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:6346, 169.38.94.188:*}[47.651%]&lt;BR/&gt;{*:137, 169.38.94.188:137}[23.4899%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6346: (33.6614%)&lt;BR/&gt; 137: (23.622%)&lt;BR/&gt; 6347: (1.9685%)&lt;BR/&gt; 6345: (0.787402%)&lt;BR/&gt; 1936: (0.787402%)&gt;];
}
113--286[label="1;1pkt 1fpkt"];
113--369[label="1;1pkt 1fpkt"];
113--451[label="1;1pkt 1fpkt"];
113--498[label="1;1pkt 1fpkt"];
113--513[label="1;1pkt 1fpkt"];
113--550[label="1;1pkt 1fpkt"];
113--735[label="1;1pkt 1fpkt"];
113--1092[label="1;2pkt 2fpkt"];
113--1365[label="1;1pkt 1fpkt"];
113--1376[label="1;1pkt 1fpkt"];
113--1416[label="1;87pkt 87fpkt"];
113--1449[label="1;1pkt 1fpkt"];
113--1453[label="1;1pkt 1fpkt"];
113--1631[label="1;1pkt 1fpkt"];
113--2267[label="1;1pkt 1fpkt"];
113--2541[label="1;1pkt 1fpkt"];
113--2828[label="1;1pkt 1fpkt"];
113--3074[label="1;1pkt 1fpkt"];
286--1416[label="1;1pkt 1fpkt"];
286--1453[label="1;1pkt 1fpkt"];
369--1416[label="1;1pkt 1fpkt"];
451--1416[label="1;1pkt 1fpkt"];
451--1449[label="1;1pkt 1fpkt"];
498--1416[label="1;1pkt 1fpkt"];
513--1365[label="1;1pkt 1fpkt"];
513--1416[label="1;1pkt 1fpkt"];
550--1376[label="1;1pkt 1fpkt"];
550--1416[label="1;1pkt 1fpkt"];
735--1416[label="1;1pkt 1fpkt"];
735--1631[label="1;1pkt 1fpkt"];
1365--1416[label="1;1pkt 1fpkt"];
1376--1416[label="1;1pkt 1fpkt"];
1416--1449[label="1;1pkt 1fpkt"];
1416--1453[label="1;1pkt 1fpkt"];
1416--1631[label="1;1pkt 1fpkt"];
1416--2267[label="1;1pkt 1fpkt"];
1416--2541[label="1;1pkt 1fpkt"];
1416--2828[label="1;1pkt 1fpkt"];
1416--3074[label="1;1pkt 1fpkt"];
2267--2828[label="1;1pkt 1fpkt"];
2267--3074[label="1;1pkt 1fpkt"];
2828--3074[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="169.38.94.188" src_port="6346"/>
      <filter dst_ip="169.38.94.188" dst_port="137" src_port="137"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804158" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785791,1.58311,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_378{
style=filled;
color=gray75;
607[label="195.225.216.74;s;74pkt 74fpkt", shape=diamond, color=yellow];
608[label="208.147.117.220;d;149pkt 149fpkt", shape=diamond, color=yellow];
1399[label="208.147.117.220;d;74pkt 74fpkt", shape=hexagon, color=black];
2114[label="195.225.216.74;74pkt 74fpkt", shape=pentagon, color=darkviolet];
2268[label="206.229.216.127;19pkt 19fpkt", shape=pentagon, color=darkviolet];
2610[label="91.169.56.245;13pkt 13fpkt", shape=pentagon, color=darkviolet];
2829[label="206.229.216.127;19pkt 19fpkt", shape=invtriangle, color=brown];
stat378[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.225.216.74:80, 208.147.117.220:*}[48.366%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.8815%)&lt;BR/&gt; 2180: (0.473934%)&lt;BR/&gt; 2179: (0.473934%)&lt;BR/&gt; 2178: (0.473934%)&lt;BR/&gt; 2177: (0.473934%)&gt;];
}
607--608[label="1;74pkt 74fpkt"];
607--1399[label="1;74pkt 74fpkt"];
607--2114[label="1;74pkt 74fpkt"];
608--1399[label="1;74pkt 74fpkt"];
608--2114[label="1;74pkt 74fpkt"];
608--2268[label="0.789474;15pkt 15fpkt"];
608--2610[label="1;13pkt 13fpkt"];
608--2829[label="0.789474;15pkt 15fpkt"];
1399--2114[label="1;74pkt 74fpkt"];
2268--2829[label="1;19pkt 19fpkt"];
</description>
    <slice>
      <filter dst_ip="208.147.117.220" src_ip="195.225.216.74" src_port="80"/>
    </slice>
    <from sec="991803615" usec="0"/>
    <to sec="991804218" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643346,1.71108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="204.112.146.128"/>
    </slice>
    <from sec="991803742" usec="0"/>
    <to sec="991803745" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643346,1.71108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="214.199.232.130"/>
    </slice>
    <from sec="991803667" usec="0"/>
    <to sec="991804227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.845397,1.6902,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_382{
style=filled;
color=gray75;
2297[label="204.104.51.136;17pkt 17fpkt", shape=pentagon, color=darkviolet];
2840[label="204.104.51.136;18pkt 18fpkt", shape=invtriangle, color=brown];
3079[label="204.104.51.136;17pkt 17fpkt", shape=invhouse, color=bisque];
stat382[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.104.51.136:80, 208.147.110.162:*}[61.1111%]&lt;BR/&gt;{204.104.51.136:80, 208.147.110.128:*}[38.8889%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1131: (2.88462%)&lt;BR/&gt; 1126: (2.88462%)&lt;BR/&gt; 1125: (2.88462%)&lt;BR/&gt; 1124: (2.88462%)&gt;];
}
2297--2840[label="1;17pkt 17fpkt"];
2297--3079[label="1;17pkt 17fpkt"];
2840--3079[label="1;17pkt 17fpkt"];
</description>
    <slice>
      <filter dst_ip="208.147.110.162" src_ip="204.104.51.136" src_port="80"/>
      <filter dst_ip="208.147.110.128" src_ip="204.104.51.136" src_port="80"/>
    </slice>
    <from sec="991803611" usec="0"/>
    <to sec="991804219" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643346,1.71108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="17.193.129.137"/>
    </slice>
    <from sec="991803989" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.592604,1.67923,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_384{
style=filled;
color=gray75;
2308[label="137.248.132.137;20pkt 20fpkt", shape=pentagon, color=darkviolet];
2849[label="137.248.132.137;20pkt 20fpkt", shape=invtriangle, color=brown];
stat384[shape=component, label=&lt;Rules:&lt;BR/&gt;{137.248.132.137:*, 214.43.252.140:80}[30%]&lt;BR/&gt;{137.248.132.137:*, 195.53.19.95:80}[25%]&lt;BR/&gt;{137.248.132.137:*, 205.70.225.60:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 20160: (2.5%)&lt;BR/&gt; 20158: (2.5%)&lt;BR/&gt; 20157: (2.5%)&lt;BR/&gt; 20100: (2.5%)&gt;];
}
2308--2849[label="1;20pkt 20fpkt"];
</description>
    <slice>
      <filter dst_ip="214.43.252.140" dst_port="80" src_ip="137.248.132.137"/>
      <filter dst_ip="195.53.19.95" dst_port="80" src_ip="137.248.132.137"/>
      <filter dst_ip="205.70.225.60" dst_port="80" src_ip="137.248.132.137"/>
    </slice>
    <from sec="991803892" usec="0"/>
    <to sec="991804227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643346,1.71108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="91.205.205.137"/>
    </slice>
    <from sec="991803603" usec="0"/>
    <to sec="991804219" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.845397,1.6902,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_386{
style=filled;
color=gray75;
2316[label="137.248.20.140;14pkt 14fpkt", shape=pentagon, color=darkviolet];
2854[label="137.248.20.140;13pkt 13fpkt", shape=invtriangle, color=brown];
3083[label="137.248.20.140;13pkt 13fpkt", shape=invhouse, color=bisque];
stat386[shape=component, label=&lt;Rules:&lt;BR/&gt;{137.248.20.140:*, 216.64.234.12:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1153: (3.75%)&lt;BR/&gt; 1152: (3.75%)&lt;BR/&gt; 1151: (3.75%)&lt;BR/&gt; 1150: (3.75%)&gt;];
}
2316--2854[label="1;13pkt 13fpkt"];
2316--3083[label="1;13pkt 13fpkt"];
2854--3083[label="1;13pkt 13fpkt"];
</description>
    <slice>
      <filter dst_ip="216.64.234.12" dst_port="80" src_ip="137.248.20.140"/>
    </slice>
    <from sec="991804205" usec="0"/>
    <to sec="991804211" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643346,1.71108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="17.188.188.149"/>
    </slice>
    <from sec="991803609" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643346,1.71108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="130.129.189.149"/>
    </slice>
    <from sec="991803854" usec="0"/>
    <to sec="991803881" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643346,1.71108,020,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="214.123.170.150"/>
    </slice>
    <from sec="991803834" usec="0"/>
    <to sec="991803839" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.990447,1.59474,503,0 0 0 1 1 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_394{
style=filled;
color=gray75;
160[label="169.41.2.129;d;203pkt 203fpkt", shape=diamond, color=yellow];
161[label="205.143.226.65;s;382pkt 382fpkt", shape=diamond, color=yellow];
188[label="208.70.69.168;d;522pkt 522fpkt", shape=diamond, color=yellow];
561[label="205.137.222.77;s;130pkt 130fpkt", shape=diamond, color=yellow];
610[label="205.143.226.64;s;211pkt 211fpkt", shape=diamond, color=yellow];
628[label="137.248.160.182;d;103pkt 103fpkt", shape=diamond, color=yellow];
899[label="137.248.198.14;d;86pkt 86fpkt", shape=diamond, color=yellow];
922[label="151.144.178.3;d;127pkt 127fpkt", shape=diamond, color=yellow];
946[label="169.41.16.98;d;86pkt 86fpkt", shape=diamond, color=yellow];
983[label="203.171.25.69;s;22pkt 22fpkt", shape=diamond, color=yellow];
1168[label="204.138.23.75;s;60pkt 60fpkt", shape=diamond, color=yellow];
1262[label="169.41.2.129;d;154pkt 154fpkt", shape=hexagon, color=black];
1323[label="205.143.226.65;s;273pkt 273fpkt", shape=hexagon, color=black];
1329[label="208.70.69.168;d;157pkt 157fpkt", shape=hexagon, color=black];
1384[label="205.137.222.77;s;119pkt 119fpkt", shape=hexagon, color=black];
1401[label="205.143.226.64;s;182pkt 182fpkt", shape=hexagon, color=black];
1578[label="169.41.16.98;d;86pkt 86fpkt", shape=hexagon, color=black];
1920[label="214.53.122.17;17pkt 17fpkt", shape=pentagon, color=darkviolet];
2032[label="91.228.48.48;6pkt 6fpkt", shape=pentagon, color=darkviolet];
2079[label="205.143.226.65;538pkt 538fpkt", shape=pentagon, color=darkviolet];
2090[label="203.171.25.69;24pkt 24fpkt", shape=pentagon, color=darkviolet];
2103[label="50.128.128.71;16pkt 16fpkt", shape=pentagon, color=darkviolet];
2109[label="204.138.23.73;54pkt 54fpkt", shape=pentagon, color=darkviolet];
2241[label="207.180.207.112;8pkt 8fpkt", shape=pentagon, color=darkviolet];
2248[label="204.138.23.116;36pkt 36fpkt", shape=pentagon, color=darkviolet];
2255[label="204.138.23.119;28pkt 28fpkt", shape=pentagon, color=darkviolet];
2323[label="205.176.77.141;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2346[label="195.135.201.146;9pkt 9fpkt", shape=pentagon, color=darkviolet];
2371[label="138.170.0.155;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2732[label="205.143.226.65;537pkt 537fpkt", shape=invtriangle, color=brown];
2751[label="204.138.23.75;76pkt 76fpkt", shape=invtriangle, color=brown];
2812[label="207.180.207.112;9pkt 9fpkt", shape=invtriangle, color=brown];
2821[label="204.138.23.119;28pkt 28fpkt", shape=invtriangle, color=brown];
2873[label="138.170.0.155;2pkt 2fpkt", shape=invtriangle, color=brown];
3095[label="138.170.0.155;3pkt 3fpkt", shape=invhouse, color=bisque];
stat394[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 208.70.69.168:*}[34.4486%]&lt;BR/&gt;{205.143.226.65:80, *:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.8255%)&lt;BR/&gt; 1897: (0.162829%)&lt;BR/&gt; 1896: (0.162829%)&lt;BR/&gt; 1895: (0.162829%)&lt;BR/&gt; 1894: (0.162829%)&gt;];
}
160--161[label="0.773399;157pkt 157fpkt"];
160--610[label="0.226601;46pkt 46fpkt"];
160--1262[label="1;154pkt 154fpkt"];
160--1323[label="0.596059;121pkt 121fpkt"];
160--1401[label="0.252747;46pkt 46fpkt"];
160--2079[label="0.773399;157pkt 157fpkt"];
160--2732[label="0.773399;157pkt 157fpkt"];
161--628[label="0.747573;77pkt 77fpkt"];
161--922[label="0.637795;81pkt 81fpkt"];
161--946[label="0.77907;67pkt 67fpkt"];
161--1262[label="0.785714;121pkt 121fpkt"];
161--1323[label="1;273pkt 273fpkt"];
161--1578[label="0.77907;67pkt 67fpkt"];
161--2079[label="1;382pkt 382fpkt"];
161--2732[label="1;382pkt 382fpkt"];
188--241[label="0.0115607;4pkt 4fpkt"];
188--335[label="0.0384615;1pkt 1fpkt"];
188--340[label="0.040404;4pkt 4fpkt"];
188--561[label="0.369231;48pkt 48fpkt"];
188--566[label="0.0724638;5pkt 5fpkt"];
188--571[label="0.00803213;4pkt 4fpkt"];
188--593[label="0.0277778;6pkt 6fpkt"];
188--594[label="0.032;4pkt 4fpkt"];
188--595[label="0.181818;2pkt 2fpkt"];
188--610[label="0.14218;30pkt 30fpkt"];
188--703[label="0.0117994;4pkt 4fpkt"];
188--762[label="0.017094;2pkt 2fpkt"];
188--861[label="0.0189573;4pkt 4fpkt"];
188--864[label="0.0229885;4pkt 4fpkt"];
188--903[label="0.0243902;4pkt 4fpkt"];
188--905[label="0.0625;3pkt 3fpkt"];
188--910[label="0.0272109;4pkt 4fpkt"];
188--983[label="0.454545;10pkt 10fpkt"];
188--1018[label="0.0183486;2pkt 2fpkt"];
188--1038[label="0.0408163;2pkt 2fpkt"];
188--1043[label="0.0166667;1pkt 1fpkt"];
188--1047[label="0.102564;4pkt 4fpkt"];
188--1051[label="0.0555556;3pkt 3fpkt"];
188--1054[label="0.0307692;4pkt 4fpkt"];
188--1164[label="0.0909091;4pkt 4fpkt"];
188--1166[label="0.0235294;2pkt 2fpkt"];
188--1168[label="0.116667;7pkt 7fpkt"];
188--1172[label="0.1;4pkt 4fpkt"];
188--1186[label="0.0350877;2pkt 2fpkt"];
188--1283[label="0.0115607;4pkt 4fpkt"];
188--1302[label="0.0526316;1pkt 1fpkt"];
188--1329[label="1;157pkt 157fpkt"];
188--1384[label="0.386555;46pkt 46fpkt"];
188--1401[label="0.142857;26pkt 26fpkt"];
188--1494[label="0.0126582;1pkt 1fpkt"];
188--1499[label="0.041958;6pkt 6fpkt"];
188--1526[label="0.0107527;1pkt 1fpkt"];
188--1545[label="0.00956938;2pkt 2fpkt"];
188--1568[label="0.015873;2pkt 2fpkt"];
188--1652[label="0.0222222;1pkt 1fpkt"];
188--1719[label="0.040404;4pkt 4fpkt"];
188--1795[label="0.015873;2pkt 2fpkt"];
188--1806[label="0.0133779;4pkt 4fpkt"];
188--1820[label="0.040404;4pkt 4fpkt"];
188--1852[label="0.0207254;4pkt 4fpkt"];
188--1920[label="0.823529;14pkt 14fpkt"];
188--1934[label="0.0357143;2pkt 2fpkt"];
188--1967[label="0.181818;4pkt 4fpkt"];
188--1985[label="0.0272109;4pkt 4fpkt"];
188--1992[label="0.0416667;1pkt 1fpkt"];
188--1994[label="0.266667;8pkt 8fpkt"];
188--1998[label="0.0384615;1pkt 1fpkt"];
188--2032[label="1;6pkt 6fpkt"];
188--2047[label="0.0909091;2pkt 2fpkt"];
188--2090[label="0.416667;10pkt 10fpkt"];
188--2103[label="0.0625;1pkt 1fpkt"];
188--2104[label="0.181818;8pkt 8fpkt"];
188--2109[label="0.166667;9pkt 9fpkt"];
188--2125[label="0.0222222;4pkt 4fpkt"];
188--2133[label="0.0217391;1pkt 1fpkt"];
188--2134[label="0.0714286;1pkt 1fpkt"];
188--2139[label="0.0106383;4pkt 4fpkt"];
188--2147[label="0.05;1pkt 1fpkt"];
188--2153[label="0.0454545;2pkt 2fpkt"];
188--2183[label="0.047619;1pkt 1fpkt"];
188--2184[label="0.0294118;1pkt 1fpkt"];
188--2201[label="0.0268456;4pkt 4fpkt"];
188--2228[label="0.0454545;3pkt 3fpkt"];
188--2241[label="0.25;2pkt 2fpkt"];
188--2248[label="0.25;9pkt 9fpkt"];
188--2255[label="0.357143;10pkt 10fpkt"];
188--2320[label="0.02;1pkt 1fpkt"];
188--2323[label="0.666667;2pkt 2fpkt"];
188--2346[label="0.555556;5pkt 5fpkt"];
188--2382[label="0.0533333;4pkt 4fpkt"];
188--2405[label="0.0384615;1pkt 1fpkt"];
188--2450[label="0.037037;4pkt 4fpkt"];
188--2495[label="0.0434783;2pkt 2fpkt"];
188--2508[label="0.037037;1pkt 1fpkt"];
188--2518[label="0.111111;1pkt 1fpkt"];
188--2581[label="0.0657895;5pkt 5fpkt"];
188--2604[label="0.0869565;2pkt 2fpkt"];
188--2684[label="0.0272109;4pkt 4fpkt"];
188--2717[label="0.0952381;2pkt 2fpkt"];
188--2720[label="0.0212766;2pkt 2fpkt"];
188--2751[label="0.0921053;7pkt 7fpkt"];
188--2755[label="0.0224719;4pkt 4fpkt"];
188--2760[label="0.0212766;1pkt 1fpkt"];
188--2763[label="0.0106101;4pkt 4fpkt"];
188--2766[label="0.047619;1pkt 1fpkt"];
188--2769[label="0.0444444;2pkt 2fpkt"];
188--2785[label="0.0294118;1pkt 1fpkt"];
188--2793[label="0.0268456;4pkt 4fpkt"];
188--2806[label="0.0447761;3pkt 3fpkt"];
188--2812[label="0.222222;2pkt 2fpkt"];
188--2821[label="0.357143;10pkt 10fpkt"];
188--2857[label="0.0204082;1pkt 1fpkt"];
188--2876[label="0.0533333;4pkt 4fpkt"];
188--2925[label="0.0425532;2pkt 2fpkt"];
188--3028[label="0.0215054;2pkt 2fpkt"];
188--3039[label="0.0224719;4pkt 4fpkt"];
188--3041[label="0.0212766;1pkt 1fpkt"];
188--3054[label="0.0268456;4pkt 4fpkt"];
561--889[label="0.0153846;2pkt 2fpkt"];
561--1263[label="0.0307692;4pkt 4fpkt"];
561--1282[label="0.1;13pkt 13fpkt"];
561--1329[label="0.230769;30pkt 30fpkt"];
561--1374[label="0.0307692;4pkt 4fpkt"];
561--1384[label="1;119pkt 119fpkt"];
561--1489[label="0.107692;14pkt 14fpkt"];
561--1773[label="0.0307692;4pkt 4fpkt"];
610--628[label="0.213592;22pkt 22fpkt"];
610--922[label="0.204724;26pkt 26fpkt"];
610--946[label="0.186047;16pkt 16fpkt"];
610--1262[label="0.214286;33pkt 33fpkt"];
610--1282[label="0.113744;24pkt 24fpkt"];
610--1329[label="0.089172;14pkt 14fpkt"];
610--1401[label="1;182pkt 182fpkt"];
610--1578[label="0.186047;16pkt 16fpkt"];
628--1323[label="0.747573;77pkt 77fpkt"];
628--1401[label="0.213592;22pkt 22fpkt"];
628--2079[label="0.747573;77pkt 77fpkt"];
628--2732[label="0.747573;77pkt 77fpkt"];
899--1176[label="0.12;9pkt 9fpkt"];
899--1192[label="0.104651;9pkt 9fpkt"];
899--2241[label="0.75;6pkt 6fpkt"];
899--2371[label="1;2pkt 2fpkt"];
899--2474[label="0.0483871;3pkt 3fpkt"];
899--2607[label="0.0232558;2pkt 2fpkt"];
899--2688[label="0.0930233;8pkt 8fpkt"];
899--2812[label="0.777778;7pkt 7fpkt"];
899--2873[label="1;2pkt 2fpkt"];
899--2914[label="0.0483871;3pkt 3fpkt"];
899--3095[label="0.666667;2pkt 2fpkt"];
922--1323[label="0.590551;75pkt 75fpkt"];
922--1401[label="0.15748;20pkt 20fpkt"];
922--2079[label="0.787402;100pkt 100fpkt"];
922--2732[label="0.787402;100pkt 100fpkt"];
946--1401[label="0.186047;16pkt 16fpkt"];
946--1578[label="1;86pkt 86fpkt"];
946--2046[label="0.0344828;2pkt 2fpkt"];
946--2079[label="0.77907;67pkt 67fpkt"];
946--2716[label="0.0344828;2pkt 2fpkt"];
946--2732[label="0.77907;67pkt 67fpkt"];
983--1329[label="0.272727;6pkt 6fpkt"];
983--2090[label="1;22pkt 22fpkt"];
1168--1282[label="0.0333333;2pkt 2fpkt"];
1168--2751[label="1;60pkt 60fpkt"];
1262--1323[label="0.785714;121pkt 121fpkt"];
1262--1401[label="0.214286;33pkt 33fpkt"];
1262--2079[label="0.785714;121pkt 121fpkt"];
1262--2732[label="0.785714;121pkt 121fpkt"];
1323--2079[label="1;273pkt 273fpkt"];
1323--2732[label="1;273pkt 273fpkt"];
1329--1384[label="0.252101;30pkt 30fpkt"];
1329--1401[label="0.089172;14pkt 14fpkt"];
1329--1806[label="0.0191083;3pkt 3fpkt"];
1329--1920[label="0.235294;4pkt 4fpkt"];
1329--2032[label="1;6pkt 6fpkt"];
1329--2090[label="0.25;6pkt 6fpkt"];
1329--2133[label="0.0217391;1pkt 1fpkt"];
1329--2153[label="0.0227273;1pkt 1fpkt"];
1329--2228[label="0.030303;2pkt 2fpkt"];
1329--2241[label="0.25;2pkt 2fpkt"];
1329--2255[label="0.0714286;2pkt 2fpkt"];
1329--2405[label="0.0384615;1pkt 1fpkt"];
1329--2581[label="0.0394737;3pkt 3fpkt"];
1329--2760[label="0.0212766;1pkt 1fpkt"];
1329--2769[label="0.0222222;1pkt 1fpkt"];
1329--2806[label="0.0298507;2pkt 2fpkt"];
1329--2812[label="0.222222;2pkt 2fpkt"];
1329--2821[label="0.0714286;2pkt 2fpkt"];
1329--3041[label="0.0212766;1pkt 1fpkt"];
1384--1489[label="0.117647;14pkt 14fpkt"];
1384--1773[label="0.0336134;4pkt 4fpkt"];
1401--1578[label="0.186047;16pkt 16fpkt"];
1578--2046[label="0.0344828;2pkt 2fpkt"];
1578--2079[label="0.77907;67pkt 67fpkt"];
1578--2716[label="0.0344828;2pkt 2fpkt"];
1578--2732[label="0.77907;67pkt 67fpkt"];
2079--2732[label="1;537pkt 537fpkt"];
2241--2812[label="1;8pkt 8fpkt"];
2255--2821[label="1;28pkt 28fpkt"];
2371--2873[label="1;2pkt 2fpkt"];
2371--3095[label="1;2pkt 2fpkt"];
2873--3095[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_ip="205.143.226.65" src_port="80"/>
      <filter dst_ip="208.70.69.168" src_port="80"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.845397,1.6902,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_395{
style=filled;
color=gray75;
2375[label="137.248.75.156;5pkt 5fpkt", shape=pentagon, color=darkviolet];
2874[label="137.248.75.156;33pkt 33fpkt", shape=invtriangle, color=brown];
3097[label="137.248.75.156;34pkt 34fpkt", shape=invhouse, color=bisque];
stat395[shape=component, label=&lt;Rules:&lt;BR/&gt;{137.248.75.156:*, 214.224.187.192:80}[55.8824%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2171: (2.08333%)&lt;BR/&gt; 2170: (2.08333%)&lt;BR/&gt; 2168: (2.08333%)&lt;BR/&gt; 2163: (2.08333%)&gt;];
}
2375--2874[label="1;5pkt 5fpkt"];
2375--3097[label="1;5pkt 5fpkt"];
2874--3097[label="1;33pkt 33fpkt"];
</description>
    <slice>
      <filter dst_ip="214.224.187.192" dst_port="80" src_ip="137.248.75.156"/>
    </slice>
    <from sec="991804114" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.845397,1.6902,020,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_396{
style=filled;
color=gray75;
2381[label="208.35.167.161;168pkt 168fpkt", shape=pentagon, color=darkviolet];
2875[label="208.35.167.161;168pkt 168fpkt", shape=invtriangle, color=brown];
3098[label="208.35.167.161;168pkt 168fpkt", shape=invhouse, color=bisque];
stat396[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.35.167.161:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2381--2875[label="1;168pkt 168fpkt"];
2381--3098[label="1;168pkt 168fpkt"];
2875--3098[label="1;168pkt 168fpkt"];
</description>
    <slice>
      <filter src_ip="208.35.167.161"/>
    </slice>
    <from sec="991803651" usec="0"/>
    <to sec="991803660" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.897743,1.64135,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_397{
style=filled;
color=gray75;
1108[label="143.50.230.215;d;183pkt 183fpkt", shape=diamond, color=yellow];
1109[label="204.78.158.167;s;98pkt 98fpkt", shape=diamond, color=yellow];
2391[label="204.78.158.164;31pkt 31fpkt", shape=pentagon, color=darkviolet];
2406[label="204.78.158.167;120pkt 120fpkt", shape=pentagon, color=darkviolet];
2881[label="204.78.158.164;31pkt 31fpkt", shape=invtriangle, color=brown];
2889[label="204.78.158.167;119pkt 119fpkt", shape=invtriangle, color=brown];
3102[label="204.78.158.164;31pkt 31fpkt", shape=invhouse, color=bisque];
3107[label="204.78.158.167;119pkt 119fpkt", shape=invhouse, color=bisque];
stat397[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.78.158.167:80, 143.50.230.215:*}[65.5738%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.9317%)&lt;BR/&gt; 1195: (0.34153%)&lt;BR/&gt; 1194: (0.34153%)&lt;BR/&gt; 1193: (0.34153%)&lt;BR/&gt; 1192: (0.34153%)&gt;];
}
1108--1109[label="1;98pkt 98fpkt"];
1108--1186[label="0.0350877;2pkt 2fpkt"];
1108--2391[label="1;31pkt 31fpkt"];
1108--2406[label="1;120pkt 120fpkt"];
1108--2881[label="1;31pkt 31fpkt"];
1108--2889[label="1;119pkt 119fpkt"];
1108--3102[label="1;31pkt 31fpkt"];
1108--3107[label="1;119pkt 119fpkt"];
1109--2406[label="1;98pkt 98fpkt"];
1109--2889[label="0.989796;97pkt 97fpkt"];
1109--3107[label="0.989796;97pkt 97fpkt"];
2391--2881[label="1;31pkt 31fpkt"];
2391--3102[label="1;31pkt 31fpkt"];
2406--2889[label="1;119pkt 119fpkt"];
2406--3107[label="1;119pkt 119fpkt"];
2881--3102[label="1;31pkt 31fpkt"];
2889--3107[label="1;119pkt 119fpkt"];
</description>
    <slice>
      <filter dst_ip="143.50.230.215" src_ip="204.78.158.167" src_port="80"/>
    </slice>
    <from sec="991804008" usec="0"/>
    <to sec="991804136" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.592604,1.67923,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_399{
style=filled;
color=gray75;
2395[label="214.199.197.165;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2884[label="214.199.197.165;3pkt 3fpkt", shape=invtriangle, color=brown];
stat399[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.199.197.165:80, 137.248.75.156:2116}[33.3333%]&lt;BR/&gt;{214.199.197.165:80, 137.248.75.156:2119}[33.3333%]&lt;BR/&gt;{214.199.197.165:80, 137.248.75.156:2120}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2120: (16.6667%)&lt;BR/&gt; 2119: (16.6667%)&lt;BR/&gt; 2116: (16.6667%)&gt;];
}
2395--2884[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.75.156" dst_port="2120" src_ip="214.199.197.165" src_port="80"/>
      <filter dst_ip="137.248.75.156" dst_port="2119" src_ip="214.199.197.165" src_port="80"/>
      <filter dst_ip="137.248.75.156" dst_port="2116" src_ip="214.199.197.165" src_port="80"/>
    </slice>
    <from sec="991804115" usec="0"/>
    <to sec="991804123" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.845397,1.6902,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_400{
style=filled;
color=gray75;
2399[label="138.229.72.166;13pkt 13fpkt", shape=pentagon, color=darkviolet];
2886[label="138.229.72.166;12pkt 12fpkt", shape=invtriangle, color=brown];
3105[label="138.229.72.166;12pkt 12fpkt", shape=invhouse, color=bisque];
stat400[shape=component, label=&lt;Rules:&lt;BR/&gt;{138.229.72.166:80, 137.248.44.36:*}[23.0769%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1142: (4.05405%)&lt;BR/&gt; 1141: (4.05405%)&lt;BR/&gt; 1140: (4.05405%)&lt;BR/&gt; 1129: (4.05405%)&gt;];
}
2399--2886[label="1;12pkt 12fpkt"];
2399--3105[label="1;12pkt 12fpkt"];
2886--3105[label="1;12pkt 12fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.44.36" src_ip="138.229.72.166" src_port="80"/>
    </slice>
    <from sec="991803620" usec="0"/>
    <to sec="991804198" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.592604,1.67923,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_401{
style=filled;
color=gray75;
2410[label="143.50.48.168;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2891[label="143.50.48.168;1pkt 1fpkt", shape=invtriangle, color=brown];
stat401[shape=component, label=&lt;Rules:&lt;BR/&gt;{143.50.48.168:4250, 213.20.23.2:6699}[50%]&lt;BR/&gt;{143.50.48.168:4252, 202.132.114.163:8888}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (33.3333%)&lt;BR/&gt; 4250: (33.3333%)&lt;BR/&gt; 8888: (16.6667%)&lt;BR/&gt; 4252: (16.6667%)&gt;];
}
2410--2891[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="202.132.114.163" dst_port="8888" src_ip="143.50.48.168" src_port="4252"/>
      <filter dst_ip="213.20.23.2" dst_port="6699" src_ip="143.50.48.168" src_port="4250"/>
    </slice>
    <from sec="991803607" usec="0"/>
    <to sec="991804209" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643346,1.71108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="138.162.240.176"/>
    </slice>
    <from sec="991803996" usec="0"/>
    <to sec="991803999" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.592604,1.67923,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_403{
style=filled;
color=gray75;
2439[label="206.227.61.177;15pkt 15fpkt", shape=pentagon, color=darkviolet];
2899[label="206.227.61.177;15pkt 15fpkt", shape=invtriangle, color=brown];
stat403[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.227.61.177:80, 137.248.93.123:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 49543: (3.33333%)&lt;BR/&gt; 49542: (3.33333%)&lt;BR/&gt; 49541: (3.33333%)&lt;BR/&gt; 49540: (3.33333%)&gt;];
}
2439--2899[label="1;15pkt 15fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.93.123" src_ip="206.227.61.177" src_port="80"/>
    </slice>
    <from sec="991803638" usec="0"/>
    <to sec="991803847" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643346,1.71108,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="17.112.183.183"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.845397,1.6902,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_405{
style=filled;
color=gray75;
2457[label="91.21.131.184;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2906[label="91.21.131.184;2pkt 2fpkt", shape=invtriangle, color=brown];
3113[label="91.21.131.184;2pkt 2fpkt", shape=invhouse, color=bisque];
stat405[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.21.131.184:80, 143.50.249.32:46630}[50%]&lt;BR/&gt;{91.21.131.184:80, 143.50.249.32:46631}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 46631: (25%)&lt;BR/&gt; 46630: (25%)&gt;];
}
2457--2906[label="1;2pkt 2fpkt"];
2457--3113[label="1;2pkt 2fpkt"];
2906--3113[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="143.50.249.32" dst_port="46631" src_ip="91.21.131.184" src_port="80"/>
      <filter dst_ip="143.50.249.32" dst_port="46630" src_ip="91.21.131.184" src_port="80"/>
    </slice>
    <from sec="991804204" usec="0"/>
    <to sec="991804207" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.592604,1.67923,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_406{
style=filled;
color=gray75;
2463[label="175.221.162.185;86pkt 86fpkt", shape=pentagon, color=darkviolet];
2908[label="175.221.162.185;86pkt 86fpkt", shape=invtriangle, color=brown];
stat406[shape=component, label=&lt;Rules:&lt;BR/&gt;{175.221.162.185:*, 208.221.65.243:6667}[39.5349%]&lt;BR/&gt;{175.221.162.185:*, 207.100.8.112:*}[33.7209%]&lt;BR/&gt;{175.221.162.185:*, 4.125.115.92:*}[20.9302%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (19.7674%)&lt;BR/&gt; 9010: (4.65116%)&lt;BR/&gt; 9012: (4.06977%)&lt;BR/&gt; 9011: (4.06977%)&lt;BR/&gt; 9009: (4.06977%)&gt;];
}
2463--2908[label="1;86pkt 86fpkt"];
</description>
    <slice>
      <filter dst_ip="207.100.8.112" src_ip="175.221.162.185"/>
      <filter dst_ip="4.125.115.92" src_ip="175.221.162.185"/>
      <filter dst_ip="208.221.65.243" dst_port="6667" src_ip="175.221.162.185"/>
    </slice>
    <from sec="991803602" usec="0"/>
    <to sec="991804224" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.845397,1.6902,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_407{
style=filled;
color=gray75;
2482[label="214.224.187.192;21pkt 21fpkt", shape=pentagon, color=darkviolet];
2918[label="214.224.187.192;21pkt 21fpkt", shape=invtriangle, color=brown];
3118[label="214.224.187.192;20pkt 20fpkt", shape=invhouse, color=bisque];
stat407[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.224.187.192:80, 137.248.75.156:*}[90.4762%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 41072: (2.41935%)&lt;BR/&gt; 2147: (2.41935%)&lt;BR/&gt; 2142: (2.41935%)&lt;BR/&gt; 2141: (2.41935%)&gt;];
}
2482--2918[label="1;21pkt 21fpkt"];
2482--3118[label="1;20pkt 20fpkt"];
2918--3118[label="1;20pkt 20fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.75.156" src_ip="214.224.187.192" src_port="80"/>
    </slice>
    <from sec="991804143" usec="0"/>
    <to sec="991804224" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.845397,1.6902,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_408{
style=filled;
color=gray75;
2488[label="207.244.118.195;33pkt 33fpkt", shape=pentagon, color=darkviolet];
2921[label="207.244.118.195;32pkt 32fpkt", shape=invtriangle, color=brown];
3119[label="207.244.118.195;33pkt 33fpkt", shape=invhouse, color=bisque];
stat408[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.244.118.195:80, 151.144.58.127:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1788: (1.53061%)&lt;BR/&gt; 1785: (1.53061%)&lt;BR/&gt; 1782: (1.53061%)&lt;BR/&gt; 1781: (1.53061%)&gt;];
}
2488--2921[label="1;32pkt 32fpkt"];
2488--3119[label="1;33pkt 33fpkt"];
2921--3119[label="1;32pkt 32fpkt"];
</description>
    <slice>
      <filter dst_ip="151.144.58.127" src_ip="207.244.118.195" src_port="80"/>
    </slice>
    <from sec="991803676" usec="0"/>
    <to sec="991804223" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.592604,1.67923,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_409{
style=filled;
color=gray75;
2489[label="175.221.170.195;53pkt 53fpkt", shape=pentagon, color=darkviolet];
2922[label="175.221.170.195;52pkt 52fpkt", shape=invtriangle, color=brown];
stat409[shape=component, label=&lt;Rules:&lt;BR/&gt;{175.221.170.195:*, 209.253.224.168:25}[47.1698%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 3405: (0.952381%)&lt;BR/&gt; 3404: (0.952381%)&lt;BR/&gt; 3403: (0.952381%)&lt;BR/&gt; 3402: (0.952381%)&gt;];
}
2489--2922[label="1;52pkt 52fpkt"];
</description>
    <slice>
      <filter dst_ip="209.253.224.168" dst_port="25" src_ip="175.221.170.195"/>
    </slice>
    <from sec="991803928" usec="0"/>
    <to sec="991804182" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643346,1.71108,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="91.70.61.197"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.592604,1.67923,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_411{
style=filled;
color=gray75;
2494[label="209.209.210.197;5pkt 5fpkt", shape=pentagon, color=darkviolet];
2924[label="209.209.210.197;5pkt 5fpkt", shape=invtriangle, color=brown];
stat411[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.209.210.197:80, 220.17.155.9:59459}[20%]&lt;BR/&gt;{209.209.210.197:80, 17.184.65.202:1284}[20%]&lt;BR/&gt;{209.209.210.197:80, 203.58.141.251:57582}[20%]&lt;BR/&gt;{209.209.210.197:80, 17.28.4.36:1047}[20%]&lt;BR/&gt;{209.209.210.197:80, 17.28.4.36:1048}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 59459: (10%)&lt;BR/&gt; 57582: (10%)&lt;BR/&gt; 1284: (10%)&lt;BR/&gt; 1048: (10%)&gt;];
}
2494--2924[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="17.28.4.36" dst_port="1048" src_ip="209.209.210.197" src_port="80"/>
      <filter dst_ip="17.28.4.36" dst_port="1047" src_ip="209.209.210.197" src_port="80"/>
      <filter dst_ip="203.58.141.251" dst_port="57582" src_ip="209.209.210.197" src_port="80"/>
      <filter dst_ip="17.184.65.202" dst_port="1284" src_ip="209.209.210.197" src_port="80"/>
      <filter dst_ip="220.17.155.9" dst_port="59459" src_ip="209.209.210.197" src_port="80"/>
    </slice>
    <from sec="991803699" usec="0"/>
    <to sec="991804161" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.592604,1.67923,501,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_412{
style=filled;
color=gray75;
2496[label="90.84.30.198;4pkt 4fpkt", shape=pentagon, color=darkviolet];
2926[label="90.84.30.198;3pkt 3fpkt", shape=invtriangle, color=brown];
stat412[shape=component, label=&lt;Rules:&lt;BR/&gt;{90.84.30.198:4194, 175.221.128.40:21}[25%]&lt;BR/&gt;{90.84.30.198:4195, 175.221.128.40:21}[25%]&lt;BR/&gt;{90.84.30.198:4196, 175.221.128.40:21}[25%]&lt;BR/&gt;{90.84.30.198:4197, 175.221.128.40:21}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (50%)&lt;BR/&gt; 4197: (14.2857%)&lt;BR/&gt; 4196: (14.2857%)&lt;BR/&gt; 4195: (14.2857%)&lt;BR/&gt; 4194: (7.14286%)&gt;];
}
2496--2926[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="175.221.128.40" dst_port="21" src_ip="90.84.30.198" src_port="4197"/>
      <filter dst_ip="175.221.128.40" dst_port="21" src_ip="90.84.30.198" src_port="4196"/>
      <filter dst_ip="175.221.128.40" dst_port="21" src_ip="90.84.30.198" src_port="4195"/>
      <filter dst_ip="175.221.128.40" dst_port="21" src_ip="90.84.30.198" src_port="4194"/>
    </slice>
    <from sec="991804062" usec="0"/>
    <to sec="991804228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.592604,1.67923,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_413{
style=filled;
color=gray75;
2510[label="212.24.36.202;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2931[label="212.24.36.202;4pkt 4fpkt", shape=invtriangle, color=brown];
stat413[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.24.36.202:80, 137.248.30.197:1386}[25%]&lt;BR/&gt;{212.24.36.202:80, 137.248.30.197:1410}[25%]&lt;BR/&gt;{212.24.36.202:80, 137.248.30.197:1437}[25%]&lt;BR/&gt;{212.24.36.202:80, 137.248.30.197:1463}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1463: (14.2857%)&lt;BR/&gt; 1437: (14.2857%)&lt;BR/&gt; 1410: (14.2857%)&lt;BR/&gt; 1386: (7.14286%)&gt;];
}
2510--2931[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.30.197" dst_port="1463" src_ip="212.24.36.202" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="1437" src_ip="212.24.36.202" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="1410" src_ip="212.24.36.202" src_port="80"/>
      <filter dst_ip="137.248.30.197" dst_port="1386" src_ip="212.24.36.202" src_port="80"/>
    </slice>
    <from sec="991804196" usec="0"/>
    <to sec="991804207" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643346,1.71108,501,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="91.81.128.209"/>
    </slice>
    <from sec="991803605" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.897743,1.64135,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_416{
style=filled;
color=gray75;
1063[label="209.209.217.32;d;296pkt 296fpkt", shape=diamond, color=yellow];
1943[label="207.48.49.24;22pkt 22fpkt", shape=pentagon, color=darkviolet];
2343[label="204.112.156.145;72pkt 72fpkt", shape=pentagon, color=darkviolet];
2443[label="174.61.8.179;20pkt 20fpkt", shape=pentagon, color=darkviolet];
2504[label="205.143.133.200;8pkt 8fpkt", shape=pentagon, color=darkviolet];
2556[label="91.59.20.219;27pkt 27fpkt", shape=pentagon, color=darkviolet];
2667[label="207.48.49.24;21pkt 21fpkt", shape=invtriangle, color=brown];
2865[label="204.112.156.145;72pkt 72fpkt", shape=invtriangle, color=brown];
2900[label="174.61.8.179;20pkt 20fpkt", shape=invtriangle, color=brown];
2927[label="205.143.133.200;9pkt 9fpkt", shape=invtriangle, color=brown];
2951[label="91.59.20.219;27pkt 27fpkt", shape=invtriangle, color=brown];
3003[label="207.48.49.24;22pkt 22fpkt", shape=invhouse, color=bisque];
3130[label="91.59.20.219;27pkt 27fpkt", shape=invhouse, color=bisque];
stat416[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.4.51.153:80, 209.209.217.32:*}[35.5263%]&lt;BR/&gt;{204.112.156.145:80, 209.209.217.32:*}[24.0132%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 46120: (0.311042%)&lt;BR/&gt; 46110: (0.311042%)&lt;BR/&gt; 46107: (0.311042%)&lt;BR/&gt; 46104: (0.311042%)&gt;];
}
1063--1943[label="1;22pkt 22fpkt"];
1063--2343[label="0.930556;67pkt 67fpkt"];
1063--2443[label="1;20pkt 20fpkt"];
1063--2504[label="0.75;6pkt 6fpkt"];
1063--2556[label="1;27pkt 27fpkt"];
1063--2667[label="1;21pkt 21fpkt"];
1063--2865[label="0.930556;67pkt 67fpkt"];
1063--2900[label="1;20pkt 20fpkt"];
1063--2927[label="0.666667;6pkt 6fpkt"];
1063--2951[label="1;27pkt 27fpkt"];
1063--3003[label="1;22pkt 22fpkt"];
1063--3130[label="1;27pkt 27fpkt"];
1943--2667[label="1;21pkt 21fpkt"];
1943--3003[label="1;22pkt 22fpkt"];
2343--2865[label="1;72pkt 72fpkt"];
2443--2900[label="1;20pkt 20fpkt"];
2504--2927[label="1;8pkt 8fpkt"];
2556--2951[label="1;27pkt 27fpkt"];
2556--3130[label="1;27pkt 27fpkt"];
2667--3003[label="1;21pkt 21fpkt"];
2951--3130[label="1;27pkt 27fpkt"];
</description>
    <slice>
      <filter dst_ip="209.209.217.32" src_ip="205.4.51.153" src_port="80"/>
      <filter dst_ip="209.209.217.32" src_ip="204.112.156.145" src_port="80"/>
    </slice>
    <from sec="991803647" usec="0"/>
    <to sec="991804193" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.845397,1.6902,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_417{
style=filled;
color=gray75;
2558[label="205.65.70.220;22pkt 22fpkt", shape=pentagon, color=darkviolet];
2952[label="205.65.70.220;21pkt 21fpkt", shape=invtriangle, color=brown];
3131[label="205.65.70.220;22pkt 22fpkt", shape=invhouse, color=bisque];
stat417[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.65.70.220:80, 151.144.77.216:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1777: (2.30769%)&lt;BR/&gt; 1776: (2.30769%)&lt;BR/&gt; 1775: (2.30769%)&lt;BR/&gt; 1774: (2.30769%)&gt;];
}
2558--2952[label="1;21pkt 21fpkt"];
2558--3131[label="1;22pkt 22fpkt"];
2952--3131[label="1;21pkt 21fpkt"];
</description>
    <slice>
      <filter dst_ip="151.144.77.216" src_ip="205.65.70.220" src_port="80"/>
    </slice>
    <from sec="991804205" usec="0"/>
    <to sec="991804209" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643346,1.71108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="88.136.69.231"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.845397,1.6902,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_419{
style=filled;
color=gray75;
2582[label="209.29.140.233;43pkt 43fpkt", shape=pentagon, color=darkviolet];
2961[label="209.29.140.233;42pkt 42fpkt", shape=invtriangle, color=brown];
3135[label="209.29.140.233;43pkt 43fpkt", shape=invhouse, color=bisque];
stat419[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.29.140.233:*, 143.39.4.24:80}[51.1628%]&lt;BR/&gt;{209.29.140.233:*, 143.39.0.155:80}[48.8372%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 42851: (1.17188%)&lt;BR/&gt; 42717: (1.17188%)&lt;BR/&gt; 42706: (1.17188%)&lt;BR/&gt; 42586: (1.17188%)&gt;];
}
2582--2961[label="1;42pkt 42fpkt"];
2582--3135[label="1;43pkt 43fpkt"];
2961--3135[label="1;42pkt 42fpkt"];
</description>
    <slice>
      <filter dst_ip="143.39.4.24" dst_port="80" src_ip="209.29.140.233"/>
      <filter dst_ip="143.39.0.155" dst_port="80" src_ip="209.29.140.233"/>
    </slice>
    <from sec="991804098" usec="0"/>
    <to sec="991804110" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.592604,1.67923,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_420{
style=filled;
color=gray75;
2588[label="203.177.93.235;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2964[label="203.177.93.235;2pkt 2fpkt", shape=invtriangle, color=brown];
stat420[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.177.93.235:80, 208.152.161.18:61223}[50%]&lt;BR/&gt;{203.177.93.235:80, 208.152.161.18:61226}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 61226: (25%)&lt;BR/&gt; 61223: (25%)&gt;];
}
2588--2964[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="208.152.161.18" dst_port="61226" src_ip="203.177.93.235" src_port="80"/>
      <filter dst_ip="208.152.161.18" dst_port="61223" src_ip="203.177.93.235" src_port="80"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643346,1.71108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="17.160.101.236"/>
    </slice>
    <from sec="991803603" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643346,1.71108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="90.74.206.237"/>
    </slice>
    <from sec="991803827" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.845397,1.6902,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_423{
style=filled;
color=gray75;
2596[label="207.48.110.238;6pkt 6fpkt", shape=pentagon, color=darkviolet];
2969[label="207.48.110.238;6pkt 6fpkt", shape=invtriangle, color=brown];
3139[label="207.48.110.238;6pkt 6fpkt", shape=invhouse, color=bisque];
stat423[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.48.110.238:80, 137.248.36.149:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3926: (8.33333%)&lt;BR/&gt; 3899: (8.33333%)&lt;BR/&gt; 3876: (8.33333%)&lt;BR/&gt; 3875: (8.33333%)&gt;];
}
2596--2969[label="1;6pkt 6fpkt"];
2596--3139[label="1;6pkt 6fpkt"];
2969--3139[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.36.149" src_ip="207.48.110.238" src_port="80"/>
    </slice>
    <from sec="991804185" usec="0"/>
    <to sec="991804208" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643346,1.71108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="17.21.32.239"/>
    </slice>
    <from sec="991803609" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.990447,1.59474,503,0 0 0 1 1 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_425{
style=filled;
color=gray75;
904[label="137.248.183.39;s;174pkt 174fpkt", shape=diamond, color=yellow];
1175[label="214.43.252.233;d;75pkt 75fpkt", shape=diamond, color=yellow];
1191[label="214.43.252.37;d;110pkt 110fpkt", shape=diamond, color=yellow];
1214[label="212.19.175.83;d;73pkt 73fpkt", shape=diamond, color=yellow];
1647[label="137.248.183.39;s;174pkt 174fpkt", shape=hexagon, color=black];
1909[label="137.248.198.14;39pkt 39fpkt", shape=pentagon, color=darkviolet];
2005[label="137.248.183.39;190pkt 190fpkt", shape=pentagon, color=darkviolet];
2606[label="169.41.22.244;80pkt 80fpkt", shape=pentagon, color=darkviolet];
2652[label="137.248.198.14;39pkt 39fpkt", shape=invtriangle, color=brown];
2693[label="137.248.183.39;190pkt 190fpkt", shape=invtriangle, color=brown];
2974[label="169.41.22.244;80pkt 80fpkt", shape=invtriangle, color=brown];
3018[label="137.248.183.39;191pkt 191fpkt", shape=invhouse, color=bisque];
3142[label="169.41.22.244;81pkt 81fpkt", shape=invhouse, color=bisque];
stat425[shape=component, label=&lt;Rules:&lt;BR/&gt;{137.248.183.39:*, *:80}[46.8421%]&lt;BR/&gt;{*:*, 214.43.252.37:80}[28.9474%]&lt;BR/&gt;{169.41.22.244:*, *:*}[21.3158%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (43.4492%)&lt;BR/&gt; 53: (3.50936%)&lt;BR/&gt; 443: (3.04144%)&lt;BR/&gt; 10522: (0.200535%)&lt;BR/&gt; 10521: (0.200535%)&gt;];
}
904--907[label="0.00826446;1pkt 1fpkt"];
904--1175[label="0.36;27pkt 27fpkt"];
904--1191[label="0.381818;42pkt 42fpkt"];
904--1214[label="0.931507;68pkt 68fpkt"];
904--1647[label="1;174pkt 174fpkt"];
904--1827[label="0.00574713;1pkt 1fpkt"];
904--1838[label="0.00574713;1pkt 1fpkt"];
904--1846[label="0.00574713;1pkt 1fpkt"];
904--2005[label="0.994253;173pkt 173fpkt"];
904--2693[label="0.994253;173pkt 173fpkt"];
904--3018[label="1;174pkt 174fpkt"];
1175--1315[label="0.12;9pkt 9fpkt"];
1175--1363[label="0.0933333;7pkt 7fpkt"];
1175--1647[label="0.36;27pkt 27fpkt"];
1175--1786[label="0.12;9pkt 9fpkt"];
1175--1827[label="0.0133333;1pkt 1fpkt"];
1175--1838[label="0.0133333;1pkt 1fpkt"];
1175--1846[label="0.0133333;1pkt 1fpkt"];
1175--1909[label="0.230769;9pkt 9fpkt"];
1175--2005[label="0.36;27pkt 27fpkt"];
1175--2416[label="0.0133333;1pkt 1fpkt"];
1175--2606[label="0.106667;8pkt 8fpkt"];
1175--2652[label="0.230769;9pkt 9fpkt"];
1175--2693[label="0.36;27pkt 27fpkt"];
1175--2974[label="0.106667;8pkt 8fpkt"];
1175--3018[label="0.36;27pkt 27fpkt"];
1175--3142[label="0.106667;8pkt 8fpkt"];
1191--1315[label="0.118182;13pkt 13fpkt"];
1191--1363[label="0.0272727;3pkt 3fpkt"];
1191--1647[label="0.381818;42pkt 42fpkt"];
1191--1786[label="0.118182;13pkt 13fpkt"];
1191--1909[label="0.230769;9pkt 9fpkt"];
1191--2005[label="0.381818;42pkt 42fpkt"];
1191--2606[label="0.325;26pkt 26fpkt"];
1191--2652[label="0.230769;9pkt 9fpkt"];
1191--2693[label="0.381818;42pkt 42fpkt"];
1191--2974[label="0.325;26pkt 26fpkt"];
1191--3018[label="0.381818;42pkt 42fpkt"];
1191--3142[label="0.320988;26pkt 26fpkt"];
1214--1647[label="0.931507;68pkt 68fpkt"];
1214--2005[label="0.931507;68pkt 68fpkt"];
1214--2693[label="0.931507;68pkt 68fpkt"];
1214--3018[label="0.931507;68pkt 68fpkt"];
1647--1827[label="0.00574713;1pkt 1fpkt"];
1647--1838[label="0.00574713;1pkt 1fpkt"];
1647--1846[label="0.00574713;1pkt 1fpkt"];
1647--2005[label="0.994253;173pkt 173fpkt"];
1647--2693[label="0.994253;173pkt 173fpkt"];
1647--3018[label="1;174pkt 174fpkt"];
1909--2652[label="1;39pkt 39fpkt"];
2005--2693[label="1;190pkt 190fpkt"];
2005--3018[label="1;190pkt 190fpkt"];
2606--2974[label="1;80pkt 80fpkt"];
2606--3142[label="1;80pkt 80fpkt"];
2693--3018[label="1;190pkt 190fpkt"];
2974--3142[label="1;80pkt 80fpkt"];
</description>
    <slice>
      <filter src_ip="169.41.22.244"/>
      <filter dst_port="80" src_ip="137.248.183.39"/>
      <filter dst_ip="214.43.252.37" dst_port="80"/>
    </slice>
    <from sec="991803606" usec="0"/>
    <to sec="991804216" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.592604,1.67923,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_426{
style=filled;
color=gray75;
2621[label="49.16.86.251;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2977[label="49.16.86.251;2pkt 2fpkt", shape=invtriangle, color=brown];
stat426[shape=component, label=&lt;Rules:&lt;BR/&gt;{49.16.86.251:3202, 143.50.200.219:80}[50%]&lt;BR/&gt;{49.16.86.251:3203, 143.50.200.219:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3203: (25%)&lt;BR/&gt; 3202: (25%)&gt;];
}
2621--2977[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="143.50.200.219" dst_port="80" src_ip="49.16.86.251" src_port="3203"/>
      <filter dst_ip="143.50.200.219" dst_port="80" src_ip="49.16.86.251" src_port="3202"/>
    </slice>
    <from sec="991804161" usec="0"/>
    <to sec="991804198" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643346,1.71108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="91.19.128.252"/>
    </slice>
    <from sec="991803617" usec="0"/>
    <to sec="991803675" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643346,1.71108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="169.41.22.254"/>
    </slice>
    <from sec="991803615" usec="0"/>
    <to sec="991804228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.592604,1.67923,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_429{
style=filled;
color=gray75;
2629[label="219.209.123.254;45pkt 45fpkt", shape=pentagon, color=darkviolet];
2981[label="219.209.123.254;45pkt 45fpkt", shape=invtriangle, color=brown];
stat429[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.209.123.254:53, 169.41.210.207:*}[35.5556%]&lt;BR/&gt;{219.209.123.254:53, 169.41.210.234:*}[24.4444%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (50%)&lt;BR/&gt; 15703: (1.11111%)&lt;BR/&gt; 4477: (1.11111%)&lt;BR/&gt; 3946: (1.11111%)&lt;BR/&gt; 3944: (1.11111%)&gt;];
}
2629--2981[label="1;45pkt 45fpkt"];
</description>
    <slice>
      <filter dst_ip="169.41.210.207" src_ip="219.209.123.254" src_port="53"/>
      <filter dst_ip="169.41.210.234" src_ip="219.209.123.254" src_port="53"/>
    </slice>
    <from sec="991803628" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.897743,1.64135,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_430{
style=filled;
color=gray75;
842[label="208.105.146.86;d;298pkt 298fpkt", shape=diamond, color=yellow];
1889[label="136.92.162.9;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2083[label="205.137.222.67;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2735[label="205.137.222.67;1pkt 1fpkt", shape=invtriangle, color=brown];
2990[label="136.92.162.9;1pkt 1fpkt", shape=invhouse, color=bisque];
3033[label="205.137.222.67;1pkt 1fpkt", shape=invhouse, color=bisque];
stat430[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:53, 208.105.146.86:53}[44.6309%]&lt;BR/&gt;{209.205.5.29:*, 208.105.146.86:53}[22.8188%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (71.4521%)&lt;BR/&gt; 0: (1.9802%)&lt;BR/&gt; 58025: (0.49505%)&lt;BR/&gt; 1024: (0.330033%)&lt;BR/&gt; 64722: (0.165017%)&gt;];
}
842--1832[label="0.0973154;29pkt 29fpkt"];
842--1834[label="0.208054;62pkt 62fpkt"];
842--1843[label="0.0973154;29pkt 29fpkt"];
842--1851[label="0.0973154;29pkt 29fpkt"];
842--1889[label="1;1pkt 1fpkt"];
842--1926[label="0.0181818;1pkt 1fpkt"];
842--2051[label="0.125;1pkt 1fpkt"];
842--2083[label="1;1pkt 1fpkt"];
842--2112[label="0.0333333;1pkt 1fpkt"];
842--2335[label="0.0149254;1pkt 1fpkt"];
842--2370[label="0.0144928;1pkt 1fpkt"];
842--2525[label="0.0322581;1pkt 1fpkt"];
842--2533[label="0.0188679;1pkt 1fpkt"];
842--2600[label="0.0153846;1pkt 1fpkt"];
842--2662[label="0.0181818;1pkt 1fpkt"];
842--2735[label="1;1pkt 1fpkt"];
842--2748[label="0.0333333;1pkt 1fpkt"];
842--2938[label="0.03125;1pkt 1fpkt"];
842--2942[label="0.0188679;1pkt 1fpkt"];
842--2990[label="1;1pkt 1fpkt"];
842--3033[label="1;1pkt 1fpkt"];
842--3036[label="0.0333333;1pkt 1fpkt"];
1889--2990[label="1;1pkt 1fpkt"];
2083--2735[label="1;1pkt 1fpkt"];
2083--3033[label="1;1pkt 1fpkt"];
2735--3033[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="208.105.146.86" dst_port="53" src_ip="209.205.5.29"/>
      <filter dst_ip="208.105.146.86" dst_port="53" src_port="53"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.786974,1.73264,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="161.237.238.23"/>
    </slice>
    <from sec="991804229" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.786974,1.73264,502,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="32.143.4.51"/>
    </slice>
    <from sec="991803609" usec="0"/>
    <to sec="991803933" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.786974,1.73264,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="173.96.167.54"/>
    </slice>
    <from sec="991804009" usec="0"/>
    <to sec="991804056" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.786974,1.73264,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="17.203.146.59"/>
    </slice>
    <from sec="991803603" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.881709,1.72185,503,0 0 0 0 0 0 0 0 0 0 1 1 ">
    <description>subgraph cluster_435{
style=filled;
color=gray75;
2864[label="208.147.182.143;42pkt 42fpkt", shape=invtriangle, color=brown];
3089[label="208.147.182.143;43pkt 43fpkt", shape=invhouse, color=bisque];
stat435[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.147.182.143:*, 212.193.21.125:80}[48.8372%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4454: (1.17647%)&lt;BR/&gt; 4453: (1.17647%)&lt;BR/&gt; 4449: (1.17647%)&lt;BR/&gt; 4448: (1.17647%)&gt;];
}
2864--3089[label="1;42pkt 42fpkt"];
</description>
    <slice>
      <filter dst_ip="212.193.21.125" dst_port="80" src_ip="208.147.182.143"/>
    </slice>
    <from sec="991804035" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.90714,1.60638,020,0 0 0 1 1 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_436{
style=filled;
color=gray75;
752[label="48.89.145.174;d;11pkt 11fpkt", shape=diamond, color=yellow];
760[label="194.84.42.161;d;11pkt 11fpkt", shape=diamond, color=yellow];
1490[label="48.89.145.174;d;11pkt 11fpkt", shape=hexagon, color=black];
1563[label="194.84.42.161;d;11pkt 11fpkt", shape=hexagon, color=black];
2126[label="208.147.112.77;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2310[label="208.147.112.138;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2337[label="208.147.112.144;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2339[label="208.147.112.145;3pkt 3fpkt", shape=pentagon, color=darkviolet];
3090[label="208.147.112.145;2pkt 2fpkt", shape=invhouse, color=bisque];
stat436[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 194.84.42.161:0}[42.3077%]&lt;BR/&gt;{*:0, 48.89.145.174:0}[42.3077%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
752--1490[label="1;11pkt 11fpkt"];
752--2126[label="0.333333;1pkt 1fpkt"];
752--2310[label="0.5;1pkt 1fpkt"];
752--2337[label="0.333333;1pkt 1fpkt"];
752--2339[label="0.333333;1pkt 1fpkt"];
752--3090[label="0.5;1pkt 1fpkt"];
760--1563[label="1;11pkt 11fpkt"];
760--2126[label="0.333333;1pkt 1fpkt"];
760--2337[label="0.333333;1pkt 1fpkt"];
760--2339[label="0.333333;1pkt 1fpkt"];
1490--2126[label="0.333333;1pkt 1fpkt"];
1490--2310[label="0.5;1pkt 1fpkt"];
1490--2337[label="0.333333;1pkt 1fpkt"];
1490--2339[label="0.333333;1pkt 1fpkt"];
1490--3090[label="0.5;1pkt 1fpkt"];
1563--2126[label="0.333333;1pkt 1fpkt"];
1563--2337[label="0.333333;1pkt 1fpkt"];
1563--2339[label="0.333333;1pkt 1fpkt"];
2339--3090[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="48.89.145.174"/>
      <filter dst_ip="194.84.42.161"/>
    </slice>
    <from sec="991803602" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.786974,1.73264,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="17.188.188.149"/>
    </slice>
    <from sec="991803609" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.786974,1.73264,020,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="214.123.170.150"/>
    </slice>
    <from sec="991803834" usec="0"/>
    <to sec="991803839" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.786974,1.73264,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="138.162.200.166"/>
    </slice>
    <from sec="991804005" usec="0"/>
    <to sec="991804011" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.90714,1.60638,999,0 0 0 1 1 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_441{
style=filled;
color=gray75;
172[label="137.248.198.169;d;15pkt 15fpkt", shape=diamond, color=yellow];
499[label="209.160.36.58;s;1pkt 1fpkt", shape=diamond, color=yellow];
662[label="195.67.181.203;s;1pkt 1fpkt", shape=diamond, color=yellow];
1231[label="172.192.221.199;s;1pkt 1fpkt", shape=diamond, color=yellow];
1360[label="209.160.36.58;s;1pkt 1fpkt", shape=hexagon, color=black];
2067[label="206.140.146.61;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3122[label="172.192.221.199;1pkt 1fpkt", shape=invhouse, color=bisque];
stat441[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 137.248.198.169:0}[40%]&lt;BR/&gt;{*:6699, 137.248.198.169:*}[26.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (28.5714%)&lt;BR/&gt; 6699: (21.4286%)&lt;BR/&gt; 8888: (7.14286%)&lt;BR/&gt; 1595: (7.14286%)&lt;BR/&gt; 1461: (7.14286%)&gt;];
}
172--499[label="1;1pkt 1fpkt"];
172--662[label="1;1pkt 1fpkt"];
172--1231[label="1;1pkt 1fpkt"];
172--1360[label="1;1pkt 1fpkt"];
172--2067[label="1;1pkt 1fpkt"];
172--3122[label="1;1pkt 1fpkt"];
499--1360[label="1;1pkt 1fpkt"];
1231--3122[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="137.248.198.169" src_port="6699"/>
      <filter dst_ip="137.248.198.169"/>
    </slice>
    <from sec="991803600" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.786974,1.73264,501,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="91.81.128.209"/>
    </slice>
    <from sec="991803606" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.786974,1.73264,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="90.74.206.237"/>
    </slice>
    <from sec="991803827" usec="0"/>
    <to sec="991804230" usec="0"/>
  </anomaly>

</admd:annotation>
