<?xml version="1.0" encoding="UTF-8" standalone="no" ?>
<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">

  <anomaly type="notice" value="0.529702,1.32911,901,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_3{
style=filled;
color=gray75;
39[label="91.215.249.190;d;1pkt 1fpkt", shape=diamond, color=yellow];
40[label="142.132.41.74;s;18pkt 18fpkt", shape=diamond, color=yellow];
stat3[shape=component, label=&lt;Rules:&lt;BR/&gt;{142.132.41.74:*, 165.107.81.82:80}[22.2222%]&lt;BR/&gt;{142.132.41.74:*, 91.215.249.190:80}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 46804: (5.26316%)&lt;BR/&gt; 52127: (2.63158%)&lt;BR/&gt; 46943: (2.63158%)&lt;BR/&gt; 46938: (2.63158%)&gt;];
}
39--40[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="91.215.249.190" dst_port="80" src_ip="142.132.41.74"/>
      <filter dst_ip="165.107.81.82" dst_port="80" src_ip="142.132.41.74"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861477" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.529702,1.32911,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="147.53.143.31"/>
      <from sec="1009861200" usec="0"/>
      <to sec="1009861462" usec="0"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861462" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.529702,1.32911,901,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_6{
style=filled;
color=gray75;
55[label="160.63.2.20;s;3pkt 3fpkt", shape=diamond, color=yellow];
56[label="219.45.74.8;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat6[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.63.2.20:2950, 219.45.74.8:6699}[33.3333%]&lt;BR/&gt;{160.63.2.20:3016, 14.194.27.39:6699}[33.3333%]&lt;BR/&gt;{160.63.2.20:3026, 25.39.32.206:1214}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (37.5%)&lt;BR/&gt; 2950: (25%)&lt;BR/&gt; 3026: (12.5%)&lt;BR/&gt; 3016: (12.5%)&lt;BR/&gt; 1214: (12.5%)&gt;];
}
55--56[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="25.39.32.206" dst_port="1214" src_ip="160.63.2.20" src_port="3026"/>
      <filter dst_ip="14.194.27.39" dst_port="6699" src_ip="160.63.2.20" src_port="3016"/>
      <filter dst_ip="219.45.74.8" dst_port="6699" src_ip="160.63.2.20" src_port="2950"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861488" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.529702,1.32911,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_8{
style=filled;
color=gray75;
95[label="142.132.9.21;s;23pkt 23fpkt", shape=diamond, color=yellow];
96[label="201.202.208.155;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat8[shape=component, label=&lt;Rules:&lt;BR/&gt;{142.132.9.21:*, *:8888}[47.8261%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8888: (22.9167%)&lt;BR/&gt; 6666: (8.33333%)&lt;BR/&gt; 6699: (6.25%)&lt;BR/&gt; 5555: (6.25%)&lt;BR/&gt; 7777: (4.16667%)&gt;];
}
95--96[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="8888" src_ip="142.132.9.21"/>
    </slice>
    <from sec="1009861218" usec="0"/>
    <to sec="1009861488" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.719847,1.32886,999,0 0 0 1 0 0 0 0 0 0 0 1 ">
    <description>subgraph cluster_10{
style=filled;
color=gray75;
109[label="142.132.8.12;d;1pkt 1fpkt", shape=diamond, color=yellow];
110[label="214.169.249.127;s;1pkt 1fpkt", shape=diamond, color=yellow];
398[label="214.169.249.127;1pkt 1fpkt", shape=invhouse, color=bisque];
stat10[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.169.249.127:5001, 142.132.8.12:1248}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5001: (50%)&lt;BR/&gt; 1248: (50%)&gt;];
}
109--110[label="1;1pkt 1fpkt"];
109--398[label="1;1pkt 1fpkt"];
110--398[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="142.132.8.12" dst_port="1248" src_ip="214.169.249.127" src_port="5001"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861563" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.529702,1.32911,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_11{
style=filled;
color=gray75;
129[label="160.63.2.20;d;2pkt 2fpkt", shape=diamond, color=yellow];
130[label="219.45.74.8;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat11[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.45.74.8:6699, 160.63.2.20:2950}[50%]&lt;BR/&gt;{14.194.27.39:6699, 160.63.2.20:3016}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 2950: (33.3333%)&lt;BR/&gt; 3016: (16.6667%)&gt;];
}
129--130[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="160.63.2.20" dst_port="3016" src_ip="14.194.27.39" src_port="6699"/>
      <filter dst_ip="160.63.2.20" dst_port="2950" src_ip="219.45.74.8" src_port="6699"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861488" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.529702,1.32911,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_12{
style=filled;
color=gray75;
57[label="201.130.61.103;s;2pkt 2fpkt", shape=diamond, color=yellow];
132[label="219.87.150.246;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat12[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.130.61.103:1122, 14.42.191.187:8888}[50%]&lt;BR/&gt;{201.130.61.103:1379, 219.87.150.246:6699}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (33.3333%)&lt;BR/&gt; 1379: (33.3333%)&lt;BR/&gt; 8888: (16.6667%)&lt;BR/&gt; 1122: (16.6667%)&gt;];
}
57--132[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="219.87.150.246" dst_port="6699" src_ip="201.130.61.103" src_port="1379"/>
      <filter dst_ip="14.42.191.187" dst_port="8888" src_ip="201.130.61.103" src_port="1122"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861488" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.529702,1.32911,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_13{
style=filled;
color=gray75;
131[label="201.130.61.103;d;1pkt 1fpkt", shape=diamond, color=yellow];
133[label="219.87.150.246;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat13[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.87.150.246:6699, 201.130.61.103:1379}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 1379: (50%)&gt;];
}
131--133[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="201.130.61.103" dst_port="1379" src_ip="219.87.150.246" src_port="6699"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861488" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.529702,1.32911,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_14{
style=filled;
color=gray75;
138[label="166.59.238.54;d;2pkt 2fpkt", shape=diamond, color=yellow];
139[label="14.17.47.108;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat14[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.188.67.95:1863, 166.59.238.54:1038}[50%]&lt;BR/&gt;{14.17.47.108:41098, 166.59.238.54:2199}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 41098: (33.3333%)&lt;BR/&gt; 2199: (33.3333%)&lt;BR/&gt; 1863: (16.6667%)&lt;BR/&gt; 1038: (16.6667%)&gt;];
}
138--139[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="166.59.238.54" dst_port="2199" src_ip="14.17.47.108" src_port="41098"/>
      <filter dst_ip="166.59.238.54" dst_port="1038" src_ip="91.188.67.95" src_port="1863"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861488" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.529702,1.32911,901,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_15{
style=filled;
color=gray75;
148[label="166.59.216.187;d;1pkt 1fpkt", shape=diamond, color=yellow];
149[label="38.124.31.117;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat15[shape=component, label=&lt;Rules:&lt;BR/&gt;{38.124.31.117:41005, 166.59.216.187:64176}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 64176: (50%)&lt;BR/&gt; 41005: (50%)&gt;];
}
148--149[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="166.59.216.187" dst_port="64176" src_ip="38.124.31.117" src_port="41005"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861488" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.529702,1.32911,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_16{
style=filled;
color=gray75;
78[label="208.135.217.82;s;77pkt 77fpkt", shape=diamond, color=yellow];
150[label="201.140.144.204;d;201pkt 201fpkt", shape=diamond, color=yellow];
stat16[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.135.217.82:80, 201.140.144.204:*}[38.3085%]&lt;BR/&gt;{*:53, 201.140.144.204:1024}[31.3433%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (34.5324%)&lt;BR/&gt; 53: (14.5683%)&lt;BR/&gt; 1024: (11.3309%)&lt;BR/&gt; 0: (1.79856%)&lt;BR/&gt; 2661: (0.359712%)&gt;];
}
78--150[label="1;77pkt 77fpkt"];
</description>
    <slice>
      <filter dst_ip="201.140.144.204" src_ip="208.135.217.82" src_port="80"/>
      <filter dst_ip="201.140.144.204" dst_port="1024" src_port="53"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861488" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.529702,1.32911,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_17{
style=filled;
color=gray75;
154[label="166.59.216.129;d;16pkt 16fpkt", shape=diamond, color=yellow];
155[label="90.83.109.127;s;1pkt 1fpkt", shape=diamond, color=yellow];
157[label="90.97.75.108;s;1pkt 1fpkt", shape=diamond, color=yellow];
229[label="208.59.16.69;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat17[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:1214, 166.59.216.129:*}[87.5%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1214: (50%)&lt;BR/&gt; 2147: (5.26316%)&lt;BR/&gt; 2119: (5.26316%)&lt;BR/&gt; 2013: (5.26316%)&lt;BR/&gt; 21024: (2.63158%)&gt;];
}
154--155[label="1;1pkt 1fpkt"];
154--157[label="1;1pkt 1fpkt"];
154--229[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="166.59.216.129" src_port="1214"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861488" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.529702,1.32911,901,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_18{
style=filled;
color=gray75;
159[label="142.132.202.121;s;2pkt 2fpkt", shape=diamond, color=yellow];
160[label="39.14.187.20;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat18[shape=component, label=&lt;Rules:&lt;BR/&gt;{142.132.202.121:1122, 39.14.187.20:6699}[50%]&lt;BR/&gt;{142.132.202.121:1112, 14.182.21.102:6699}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 1122: (33.3333%)&lt;BR/&gt; 1112: (16.6667%)&gt;];
}
159--160[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="14.182.21.102" dst_port="6699" src_ip="142.132.202.121" src_port="1112"/>
      <filter dst_ip="39.14.187.20" dst_port="6699" src_ip="142.132.202.121" src_port="1122"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861488" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.529702,1.32911,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="166.59.213.19"/>
      <from sec="1009861200" usec="0"/>
      <to sec="1009861488" usec="0"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861488" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.529702,1.32911,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_20{
style=filled;
color=gray75;
83[label="88.182.252.137;s;1pkt 1fpkt", shape=diamond, color=yellow];
174[label="147.53.170.218;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat20[shape=component, label=&lt;Rules:&lt;BR/&gt;{88.182.252.137:21570, 147.53.170.218:54130}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 54130: (50%)&lt;BR/&gt; 21570: (50%)&gt;];
}
83--174[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="147.53.170.218" dst_port="54130" src_ip="88.182.252.137" src_port="21570"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861488" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.529702,1.32911,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_21{
style=filled;
color=gray75;
176[label="147.53.107.34;d;8pkt 8fpkt", shape=diamond, color=yellow];
177[label="205.142.146.135;s;7pkt 7fpkt", shape=diamond, color=yellow];
stat21[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.142.146.135:80, 147.53.107.34:*}[87.5%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1246: (6.66667%)&lt;BR/&gt; 1244: (6.66667%)&lt;BR/&gt; 1242: (6.66667%)&lt;BR/&gt; 1240: (6.66667%)&gt;];
}
176--177[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="147.53.107.34" src_ip="205.142.146.135" src_port="80"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861389" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.529702,1.32911,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_22{
style=filled;
color=gray75;
186[label="147.57.232.61;d;65pkt 65fpkt", shape=diamond, color=yellow];
187[label="88.11.102.115;s;9pkt 9fpkt", shape=diamond, color=yellow];
stat22[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 147.57.232.61:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1819: (1.35135%)&lt;BR/&gt; 1787: (1.35135%)&lt;BR/&gt; 1786: (1.35135%)&lt;BR/&gt; 1756: (1.35135%)&gt;];
}
186--187[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="147.57.232.61" src_port="80"/>
    </slice>
    <from sec="1009861217" usec="0"/>
    <to sec="1009861488" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.467245,1.2863,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_23{
style=filled;
color=gray75;
181[label="147.53.70.175;d;13pkt 13fpkt", shape=diamond, color=yellow];
190[label="150.149.116.35;s;2pkt 2fpkt", shape=diamond, color=yellow];
283[label="150.149.116.35;2pkt 2fpkt", shape=pentagon, color=darkviolet];
stat23[shape=component, label=&lt;Rules:&lt;BR/&gt;{150.149.116.35:*, 147.53.70.175:80}[21.4286%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.0588%)&lt;BR/&gt; 1435: (8.82353%)&lt;BR/&gt; 1434: (5.88235%)&lt;BR/&gt; 57412: (2.94118%)&lt;BR/&gt; 34522: (2.94118%)&gt;];
}
181--190[label="1;2pkt 2fpkt"];
181--283[label="0.5;1pkt 1fpkt"];
190--283[label="0.5;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="147.53.70.175" dst_port="80" src_ip="150.149.116.35"/>
    </slice>
    <from sec="1009861201" usec="0"/>
    <to sec="1009861553" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.529702,1.32911,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_24{
style=filled;
color=gray75;
37[label="212.225.196.17;s;48pkt 48fpkt", shape=diamond, color=yellow];
195[label="148.83.145.172;d;48pkt 48fpkt", shape=diamond, color=yellow];
stat24[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.225.196.17:80, 148.83.145.172:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1805: (1.04167%)&lt;BR/&gt; 1804: (1.04167%)&lt;BR/&gt; 1803: (1.04167%)&lt;BR/&gt; 1802: (1.04167%)&gt;];
}
37--195[label="1;48pkt 48fpkt"];
</description>
    <slice>
      <filter dst_ip="148.83.145.172" src_ip="212.225.196.17" src_port="80"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861488" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.529702,1.32911,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_25{
style=filled;
color=gray75;
108[label="200.192.15.163;d;320pkt 320fpkt", shape=diamond, color=yellow];
196[label="201.129.75.58;s;59pkt 59fpkt", shape=diamond, color=yellow];
199[label="200.192.15.165;d;49pkt 49fpkt", shape=diamond, color=yellow];
stat25[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 200.192.15.163:6667}[34.3243%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (19.5093%)&lt;BR/&gt; 6660: (4.90654%)&lt;BR/&gt; 6666: (4.08879%)&lt;BR/&gt; 6669: (3.97196%)&lt;BR/&gt; 6668: (3.73832%)&gt;];
}
108--196[label="0.779661;46pkt 46fpkt"];
196--199[label="0.244898;12pkt 12fpkt"];
</description>
    <slice>
      <filter dst_ip="200.192.15.163" dst_port="6667"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861488" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.529702,1.32911,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="147.53.214.164"/>
      <from sec="1009861200" usec="0"/>
      <to sec="1009861488" usec="0"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861488" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.529702,1.32911,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_27{
style=filled;
color=gray75;
210[label="38.68.177.150;d;1pkt 1fpkt", shape=diamond, color=yellow];
211[label="201.130.52.50;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat27[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.130.52.50:1360, 38.68.177.150:4000}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4000: (50%)&lt;BR/&gt; 1360: (50%)&gt;];
}
210--211[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="38.68.177.150" dst_port="4000" src_ip="201.130.52.50" src_port="1360"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861488" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.529702,1.32911,901,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_28{
style=filled;
color=gray75;
213[label="142.132.202.121;d;1pkt 1fpkt", shape=diamond, color=yellow];
214[label="39.14.187.20;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat28[shape=component, label=&lt;Rules:&lt;BR/&gt;{39.14.187.20:6699, 142.132.202.121:1122}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 1122: (50%)&gt;];
}
213--214[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="142.132.202.121" dst_port="1122" src_ip="39.14.187.20" src_port="6699"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861488" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.529702,1.32911,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_29{
style=filled;
color=gray75;
226[label="166.59.216.146;d;9pkt 9fpkt", shape=diamond, color=yellow];
227[label="152.101.139.25;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat29[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.69.193.17:1214, 166.59.216.146:*}[44.4444%]&lt;BR/&gt;{202.69.193.17:*, 166.59.216.146:1214}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1214: (50%)&lt;BR/&gt; 2519: (10%)&lt;BR/&gt; 3552: (5%)&lt;BR/&gt; 3548: (5%)&lt;BR/&gt; 3545: (5%)&gt;];
}
226--227[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="166.59.216.146" src_ip="202.69.193.17" src_port="1214"/>
      <filter dst_ip="166.59.216.146" dst_port="1214" src_ip="202.69.193.17"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861488" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.529702,1.32911,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="166.59.218.131"/>
      <from sec="1009861200" usec="0"/>
      <to sec="1009861487" usec="0"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861487" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.529702,1.32911,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_31{
style=filled;
color=gray75;
236[label="147.53.97.59;d;23pkt 23fpkt", shape=diamond, color=yellow];
237[label="55.223.85.18;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat31[shape=component, label=&lt;Rules:&lt;BR/&gt;{55.213.147.141:40512, 147.53.97.59:*}[91.3043%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 40512: (43.75%)&lt;BR/&gt; 1328: (4.16667%)&lt;BR/&gt; 22: (4.16667%)&lt;BR/&gt; 0: (4.16667%)&lt;BR/&gt; 33485: (2.08333%)&gt;];
}
236--237[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="147.53.97.59" src_ip="55.213.147.141" src_port="40512"/>
    </slice>
    <from sec="1009861206" usec="0"/>
    <to sec="1009861488" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.438289,1.36007,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="201.140.176.5"/>
    </slice>
    <from sec="1009861224" usec="0"/>
    <to sec="1009861555" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.438289,1.36007,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="14.193.37.15"/>
    </slice>
    <from sec="1009861202" usec="0"/>
    <to sec="1009861289" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.438289,1.36007,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="88.250.67.19"/>
    </slice>
    <from sec="1009861216" usec="0"/>
    <to sec="1009861463" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.438289,1.36007,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="55.220.8.24"/>
    </slice>
    <from sec="1009861467" usec="0"/>
    <to sec="1009861559" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.467245,1.2863,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_40{
style=filled;
color=gray75;
238[label="142.132.11.17;d;41pkt 41fpkt", shape=diamond, color=yellow];
281[label="201.14.12.31;29pkt 29fpkt", shape=pentagon, color=darkviolet];
stat40[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.14.12.31:80, 142.132.11.17:*}[65.9091%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1314: (1.42857%)&lt;BR/&gt; 1313: (1.42857%)&lt;BR/&gt; 1312: (1.42857%)&lt;BR/&gt; 1311: (1.42857%)&gt;];
}
238--281[label="0.896552;26pkt 26fpkt"];
</description>
    <slice>
      <filter dst_ip="142.132.11.17" src_ip="201.14.12.31" src_port="80"/>
    </slice>
    <from sec="1009861215" usec="0"/>
    <to sec="1009861541" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.438289,1.36007,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="91.188.82.40"/>
    </slice>
    <from sec="1009861308" usec="0"/>
    <to sec="1009861562" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.438289,1.36007,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="136.130.112.47"/>
    </slice>
    <from sec="1009861230" usec="0"/>
    <to sec="1009861409" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.438289,1.36007,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.193.38.65"/>
    </slice>
    <from sec="1009861354" usec="0"/>
    <to sec="1009861558" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.438289,1.36007,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.242.113.68"/>
    </slice>
    <from sec="1009861473" usec="0"/>
    <to sec="1009861555" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.438289,1.36007,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="142.132.93.75"/>
    </slice>
    <from sec="1009861201" usec="0"/>
    <to sec="1009861563" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.438289,1.36007,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.153.72.76"/>
    </slice>
    <from sec="1009861390" usec="0"/>
    <to sec="1009861416" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.438289,1.36007,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.153.72.77"/>
    </slice>
    <from sec="1009861385" usec="0"/>
    <to sec="1009861411" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.438289,1.36007,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="156.213.190.90"/>
    </slice>
    <from sec="1009861206" usec="0"/>
    <to sec="1009861563" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.467245,1.2863,010,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_50{
style=filled;
color=gray75;
115[label="201.140.137.163;d;237pkt 237fpkt", shape=diamond, color=yellow];
305[label="205.52.34.96;24pkt 24fpkt", shape=pentagon, color=darkviolet];
stat50[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 201.140.137.163:25}[94.8617%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 4703: (0.383142%)&lt;BR/&gt; 4694: (0.383142%)&lt;BR/&gt; 4429: (0.383142%)&lt;BR/&gt; 4069: (0.383142%)&gt;];
}
115--305[label="0.333333;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="201.140.137.163" dst_port="25"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861563" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.438289,1.36007,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.169.32.120"/>
    </slice>
    <from sec="1009861206" usec="0"/>
    <to sec="1009861563" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.438289,1.36007,053,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.0.133.124"/>
    </slice>
    <from sec="1009861214" usec="0"/>
    <to sec="1009861546" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.438289,1.36007,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="207.12.185.125"/>
    </slice>
    <from sec="1009861503" usec="0"/>
    <to sec="1009861563" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.438289,1.36007,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.238.160.134"/>
    </slice>
    <from sec="1009861204" usec="0"/>
    <to sec="1009861287" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.438289,1.36007,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="39.15.60.159"/>
    </slice>
    <from sec="1009861206" usec="0"/>
    <to sec="1009861563" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.438289,1.36007,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.192.12.160"/>
    </slice>
    <from sec="1009861207" usec="0"/>
    <to sec="1009861562" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.438289,1.36007,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="39.54.35.173"/>
    </slice>
    <from sec="1009861201" usec="0"/>
    <to sec="1009861493" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.438289,1.36007,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="55.208.148.173"/>
    </slice>
    <from sec="1009861440" usec="0"/>
    <to sec="1009861563" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.438289,1.36007,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="55.194.70.188"/>
    </slice>
    <from sec="1009861201" usec="0"/>
    <to sec="1009861523" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.438289,1.36007,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.225.87.193"/>
    </slice>
    <from sec="1009861385" usec="0"/>
    <to sec="1009861495" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.438289,1.36007,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="14.23.232.199"/>
    </slice>
    <from sec="1009861201" usec="0"/>
    <to sec="1009861563" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.438289,1.36007,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.99.64.220"/>
    </slice>
    <from sec="1009861437" usec="0"/>
    <to sec="1009861563" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.467245,1.2863,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_63{
style=filled;
color=gray75;
233[label="201.130.32.87;d;5pkt 5fpkt", shape=diamond, color=yellow];
334[label="14.192.33.235;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat63[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.43.63.2:8888, 201.130.32.87:3595}[20%]&lt;BR/&gt;{91.188.67.14:1863, 201.130.32.87:3174}[20%]&lt;BR/&gt;{209.22.26.25:0, 201.130.32.87:0}[20%]&lt;BR/&gt;{14.215.187.42:4444, 201.130.32.87:4590}[20%]&lt;BR/&gt;{14.192.33.235:8888, 201.130.32.87:4086}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8888: (25%)&lt;BR/&gt; 4086: (16.6667%)&lt;BR/&gt; 0: (16.6667%)&lt;BR/&gt; 4590: (8.33333%)&lt;BR/&gt; 4444: (8.33333%)&gt;];
}
233--334[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="201.130.32.87" dst_port="4086" src_ip="14.192.33.235" src_port="8888"/>
      <filter dst_ip="201.130.32.87" dst_port="4590" src_ip="14.215.187.42" src_port="4444"/>
      <filter dst_ip="201.130.32.87" src_ip="209.22.26.25"/>
      <filter dst_ip="201.130.32.87" dst_port="3174" src_ip="91.188.67.14" src_port="1863"/>
      <filter dst_ip="201.130.32.87" dst_port="3595" src_ip="196.43.63.2" src_port="8888"/>
    </slice>
    <from sec="1009861201" usec="0"/>
    <to sec="1009861549" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.438289,1.36007,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="201.130.56.238"/>
    </slice>
    <from sec="1009861365" usec="0"/>
    <to sec="1009861507" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.438289,1.36007,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="55.222.172.239"/>
    </slice>
    <from sec="1009861203" usec="0"/>
    <to sec="1009861560" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.438289,1.36007,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="55.213.100.245"/>
    </slice>
    <from sec="1009861226" usec="0"/>
    <to sec="1009861529" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.768508,1.3453,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_67{
style=filled;
color=gray75;
271[label="212.44.16.0;54pkt 54fpkt", shape=pentagon, color=darkviolet];
340[label="212.44.16.0;55pkt 55fpkt", shape=invtriangle, color=brown];
378[label="212.44.16.0;55pkt 55fpkt", shape=invhouse, color=bisque];
stat67[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.44.16.0:*, 200.192.12.68:80}[74.5455%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 65174: (0.914634%)&lt;BR/&gt; 64859: (0.914634%)&lt;BR/&gt; 63880: (0.914634%)&lt;BR/&gt; 62952: (0.914634%)&gt;];
}
271--340[label="1;54pkt 54fpkt"];
271--378[label="1;54pkt 54fpkt"];
340--378[label="1;55pkt 55fpkt"];
</description>
    <slice>
      <filter dst_ip="200.192.12.68" dst_port="80" src_ip="212.44.16.0"/>
    </slice>
    <from sec="1009861206" usec="0"/>
    <to sec="1009861552" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644419,1.38653,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="14.193.37.15"/>
    </slice>
    <from sec="1009861202" usec="0"/>
    <to sec="1009861289" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.768508,1.3453,020,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_69{
style=filled;
color=gray75;
277[label="160.75.0.23;54pkt 54fpkt", shape=pentagon, color=darkviolet];
344[label="160.75.0.23;54pkt 54fpkt", shape=invtriangle, color=brown];
381[label="160.75.0.23;55pkt 55fpkt", shape=invhouse, color=bisque];
stat69[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.75.0.23:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
277--344[label="1;54pkt 54fpkt"];
277--381[label="1;54pkt 54fpkt"];
344--381[label="1;54pkt 54fpkt"];
</description>
    <slice>
      <filter src_ip="160.75.0.23"/>
    </slice>
    <from sec="1009861213" usec="0"/>
    <to sec="1009861562" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.594146,1.34554,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_70{
style=filled;
color=gray75;
279[label="205.142.155.25;5pkt 5fpkt", shape=pentagon, color=darkviolet];
345[label="205.142.155.25;4pkt 4fpkt", shape=invtriangle, color=brown];
stat70[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.142.155.25:80, 160.63.106.107:2093}[20%]&lt;BR/&gt;{205.142.155.25:80, 160.63.106.107:2094}[20%]&lt;BR/&gt;{205.142.155.25:80, 160.63.106.107:2103}[20%]&lt;BR/&gt;{205.142.155.25:80, 160.63.106.107:2106}[20%]&lt;BR/&gt;{205.142.155.25:80, 160.63.106.107:2109}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2109: (11.1111%)&lt;BR/&gt; 2106: (11.1111%)&lt;BR/&gt; 2103: (11.1111%)&lt;BR/&gt; 2094: (11.1111%)&gt;];
}
279--345[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="160.63.106.107" dst_port="2109" src_ip="205.142.155.25" src_port="80"/>
      <filter dst_ip="160.63.106.107" dst_port="2106" src_ip="205.142.155.25" src_port="80"/>
      <filter dst_ip="160.63.106.107" dst_port="2103" src_ip="205.142.155.25" src_port="80"/>
      <filter dst_ip="160.63.106.107" dst_port="2094" src_ip="205.142.155.25" src_port="80"/>
      <filter dst_ip="160.63.106.107" dst_port="2093" src_ip="205.142.155.25" src_port="80"/>
    </slice>
    <from sec="1009861315" usec="0"/>
    <to sec="1009861381" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.768508,1.3453,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_71{
style=filled;
color=gray75;
280[label="205.142.155.29;3pkt 3fpkt", shape=pentagon, color=darkviolet];
346[label="205.142.155.29;3pkt 3fpkt", shape=invtriangle, color=brown];
383[label="205.142.155.29;3pkt 3fpkt", shape=invhouse, color=bisque];
stat71[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.142.155.29:80, 148.83.145.133:1296}[33.3333%]&lt;BR/&gt;{205.142.155.29:80, 148.83.145.133:1297}[33.3333%]&lt;BR/&gt;{205.142.155.29:80, 148.83.145.133:1301}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1301: (16.6667%)&lt;BR/&gt; 1297: (16.6667%)&lt;BR/&gt; 1296: (16.6667%)&gt;];
}
280--346[label="1;3pkt 3fpkt"];
280--383[label="1;3pkt 3fpkt"];
346--383[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="148.83.145.133" dst_port="1301" src_ip="205.142.155.29" src_port="80"/>
      <filter dst_ip="148.83.145.133" dst_port="1297" src_ip="205.142.155.29" src_port="80"/>
      <filter dst_ip="148.83.145.133" dst_port="1296" src_ip="205.142.155.29" src_port="80"/>
    </slice>
    <from sec="1009861460" usec="0"/>
    <to sec="1009861492" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.768508,1.3453,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_72{
style=filled;
color=gray75;
288[label="197.25.83.62;1pkt 1fpkt", shape=pentagon, color=darkviolet];
350[label="197.25.83.62;1pkt 1fpkt", shape=invtriangle, color=brown];
387[label="197.25.83.62;1pkt 1fpkt", shape=invhouse, color=bisque];
stat72[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.25.83.62:1214, 166.59.238.78:1746}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1746: (50%)&lt;BR/&gt; 1214: (50%)&gt;];
}
288--350[label="1;1pkt 1fpkt"];
288--387[label="1;1pkt 1fpkt"];
350--387[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="166.59.238.78" dst_port="1746" src_ip="197.25.83.62" src_port="1214"/>
    </slice>
    <from sec="1009861205" usec="0"/>
    <to sec="1009861563" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.768508,1.3453,020,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_73{
style=filled;
color=gray75;
290[label="201.1.141.65;1pkt 1fpkt", shape=pentagon, color=darkviolet];
351[label="201.1.141.65;13pkt 13fpkt", shape=invtriangle, color=brown];
388[label="201.1.141.65;13pkt 13fpkt", shape=invhouse, color=bisque];
stat73[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.1.141.65:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
290--351[label="1;1pkt 1fpkt"];
290--388[label="1;1pkt 1fpkt"];
351--388[label="1;13pkt 13fpkt"];
</description>
    <slice>
      <filter src_ip="201.1.141.65"/>
    </slice>
    <from sec="1009861203" usec="0"/>
    <to sec="1009861564" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.768508,1.3453,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_74{
style=filled;
color=gray75;
291[label="214.159.102.66;1pkt 1fpkt", shape=pentagon, color=darkviolet];
352[label="214.159.102.66;1pkt 1fpkt", shape=invtriangle, color=brown];
389[label="214.159.102.66;1pkt 1fpkt", shape=invhouse, color=bisque];
stat74[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.159.102.66:33110, 148.83.70.140:51200}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 51200: (50%)&lt;BR/&gt; 33110: (50%)&gt;];
}
291--352[label="1;1pkt 1fpkt"];
291--389[label="1;1pkt 1fpkt"];
352--389[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="148.83.70.140" dst_port="51200" src_ip="214.159.102.66" src_port="33110"/>
    </slice>
    <from sec="1009861563" usec="0"/>
    <to sec="1009861564" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.594146,1.34554,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_75{
style=filled;
color=gray75;
293[label="55.194.216.68;41pkt 41fpkt", shape=pentagon, color=darkviolet];
353[label="55.194.216.68;40pkt 40fpkt", shape=invtriangle, color=brown];
stat75[shape=component, label=&lt;Rules:&lt;BR/&gt;{55.194.216.68:*, 147.53.174.116:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3196: (1.23457%)&lt;BR/&gt; 3195: (1.23457%)&lt;BR/&gt; 3194: (1.23457%)&lt;BR/&gt; 3193: (1.23457%)&gt;];
}
293--353[label="1;40pkt 40fpkt"];
</description>
    <slice>
      <filter dst_ip="147.53.174.116" dst_port="80" src_ip="55.194.216.68"/>
    </slice>
    <from sec="1009861276" usec="0"/>
    <to sec="1009861529" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785382,1.27067,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_76{
style=filled;
color=gray75;
60[label="147.53.196.211;d;253pkt 253fpkt", shape=diamond, color=yellow];
61[label="48.82.71.58;s;214pkt 214fpkt", shape=diamond, color=yellow];
297[label="36.242.220.84;1pkt 1fpkt", shape=pentagon, color=darkviolet];
355[label="36.242.220.84;1pkt 1fpkt", shape=invtriangle, color=brown];
390[label="36.242.220.84;1pkt 1fpkt", shape=invhouse, color=bisque];
stat76[shape=component, label=&lt;Rules:&lt;BR/&gt;{48.82.71.58:*, 147.53.196.211:80}[84.585%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.8936%)&lt;BR/&gt; 3655: (0.425532%)&lt;BR/&gt; 1894: (0.212766%)&lt;BR/&gt; 1893: (0.212766%)&lt;BR/&gt; 1892: (0.212766%)&gt;];
}
60--61[label="1;214pkt 214fpkt"];
60--297[label="1;1pkt 1fpkt"];
60--355[label="1;1pkt 1fpkt"];
60--390[label="1;1pkt 1fpkt"];
297--355[label="1;1pkt 1fpkt"];
297--390[label="1;1pkt 1fpkt"];
355--390[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="147.53.196.211" dst_port="80" src_ip="48.82.71.58"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861488" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615817,1.27093,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_77{
style=filled;
color=gray75;
93[label="160.63.133.95;d;210pkt 210fpkt", shape=diamond, color=yellow];
192[label="215.82.37.131;s;54pkt 54fpkt", shape=diamond, color=yellow];
298[label="205.221.44.88;35pkt 35fpkt", shape=pentagon, color=darkviolet];
314[label="215.82.37.131;54pkt 54fpkt", shape=pentagon, color=darkviolet];
356[label="205.221.44.88;36pkt 36fpkt", shape=invtriangle, color=brown];
366[label="215.82.37.131;54pkt 54fpkt", shape=invtriangle, color=brown];
stat77[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.82.37.128:80, 160.63.133.95:*}[27.3148%]&lt;BR/&gt;{215.82.37.131:80, 160.63.133.95:*}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.8871%)&lt;BR/&gt; 16560: (0.451467%)&lt;BR/&gt; 16558: (0.451467%)&lt;BR/&gt; 16555: (0.451467%)&lt;BR/&gt; 16554: (0.451467%)&gt;];
}
93--192[label="1;54pkt 54fpkt"];
93--298[label="0.857143;30pkt 30fpkt"];
93--314[label="1;54pkt 54fpkt"];
93--356[label="0.833333;30pkt 30fpkt"];
93--366[label="1;54pkt 54fpkt"];
192--314[label="1;54pkt 54fpkt"];
192--366[label="1;54pkt 54fpkt"];
298--356[label="1;35pkt 35fpkt"];
314--366[label="1;54pkt 54fpkt"];
</description>
    <slice>
      <filter dst_ip="160.63.133.95" src_ip="215.82.37.128" src_port="80"/>
      <filter dst_ip="160.63.133.95" src_ip="215.82.37.131" src_port="80"/>
    </slice>
    <from sec="1009861204" usec="0"/>
    <to sec="1009861552" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.768508,1.3453,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_78{
style=filled;
color=gray75;
300[label="205.221.213.89;1pkt 1fpkt", shape=pentagon, color=darkviolet];
358[label="205.221.213.89;2pkt 2fpkt", shape=invtriangle, color=brown];
393[label="205.221.213.89;1pkt 1fpkt", shape=invhouse, color=bisque];
stat78[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.221.213.89:80, 148.83.145.163:1148}[50%]&lt;BR/&gt;{205.221.213.89:80, 148.83.145.163:1149}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1149: (37.5%)&lt;BR/&gt; 1148: (12.5%)&gt;];
}
300--358[label="1;1pkt 1fpkt"];
300--393[label="1;1pkt 1fpkt"];
358--393[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="148.83.145.163" dst_port="1149" src_ip="205.221.213.89" src_port="80"/>
      <filter dst_ip="148.83.145.163" dst_port="1148" src_ip="205.221.213.89" src_port="80"/>
    </slice>
    <from sec="1009861305" usec="0"/>
    <to sec="1009861425" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785382,1.27067,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_79{
style=filled;
color=gray75;
66[label="142.132.213.160;d;238pkt 238fpkt", shape=diamond, color=yellow];
92[label="212.44.66.94;s;10pkt 10fpkt", shape=diamond, color=yellow];
188[label="200.210.210.117;s;178pkt 178fpkt", shape=diamond, color=yellow];
309[label="200.210.210.117;188pkt 188fpkt", shape=pentagon, color=darkviolet];
359[label="212.44.66.94;9pkt 9fpkt", shape=invtriangle, color=brown];
364[label="200.210.210.117;187pkt 187fpkt", shape=invtriangle, color=brown];
394[label="212.44.66.94;9pkt 9fpkt", shape=invhouse, color=bisque];
stat79[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.210.210.117:80, 142.132.213.160:*}[75.8065%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.8168%)&lt;BR/&gt; 1622: (0.2442%)&lt;BR/&gt; 1621: (0.2442%)&lt;BR/&gt; 1620: (0.2442%)&lt;BR/&gt; 1619: (0.2442%)&gt;];
}
66--92[label="1;10pkt 10fpkt"];
66--188[label="1;178pkt 178fpkt"];
66--309[label="0.946809;178pkt 178fpkt"];
66--359[label="1;9pkt 9fpkt"];
66--364[label="0.946524;177pkt 177fpkt"];
66--394[label="1;9pkt 9fpkt"];
92--359[label="1;9pkt 9fpkt"];
92--394[label="1;9pkt 9fpkt"];
188--309[label="1;178pkt 178fpkt"];
188--364[label="0.994382;177pkt 177fpkt"];
309--364[label="1;187pkt 187fpkt"];
359--394[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="142.132.213.160" src_ip="200.210.210.117" src_port="80"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861562" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644419,1.38653,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="215.22.153.94"/>
    </slice>
    <from sec="1009861201" usec="0"/>
    <to sec="1009861563" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.768508,1.3453,020,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_81{
style=filled;
color=gray75;
306[label="142.132.41.97;45pkt 45fpkt", shape=pentagon, color=darkviolet];
361[label="142.132.41.97;45pkt 45fpkt", shape=invtriangle, color=brown];
395[label="142.132.41.97;45pkt 45fpkt", shape=invhouse, color=bisque];
stat81[shape=component, label=&lt;Rules:&lt;BR/&gt;{142.132.41.97:0, *:0}[91.1111%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (91.1111%)&lt;BR/&gt; 25: (4.44444%)&lt;BR/&gt; 55079: (1.11111%)&lt;BR/&gt; 3772: (1.11111%)&lt;BR/&gt; 2703: (1.11111%)&gt;];
}
306--361[label="1;45pkt 45fpkt"];
306--395[label="1;45pkt 45fpkt"];
361--395[label="1;45pkt 45fpkt"];
</description>
    <slice>
      <filter src_ip="142.132.41.97"/>
    </slice>
    <from sec="1009861209" usec="0"/>
    <to sec="1009861439" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.768508,1.3453,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_82{
style=filled;
color=gray75;
307[label="200.193.38.113;19pkt 19fpkt", shape=pentagon, color=darkviolet];
362[label="200.193.38.113;19pkt 19fpkt", shape=invtriangle, color=brown];
396[label="200.193.38.113;19pkt 19fpkt", shape=invhouse, color=bisque];
stat82[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.193.38.113:80, 148.83.107.89:*}[57.8947%]&lt;BR/&gt;{200.193.38.113:80, 147.57.148.70:*}[31.5789%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 54633: (2.63158%)&lt;BR/&gt; 54632: (2.63158%)&lt;BR/&gt; 4438: (2.63158%)&lt;BR/&gt; 4437: (2.63158%)&gt;];
}
307--362[label="1;19pkt 19fpkt"];
307--396[label="1;19pkt 19fpkt"];
362--396[label="1;19pkt 19fpkt"];
</description>
    <slice>
      <filter dst_ip="148.83.107.89" src_ip="200.193.38.113" src_port="80"/>
      <filter dst_ip="147.57.148.70" src_ip="200.193.38.113" src_port="80"/>
    </slice>
    <from sec="1009861218" usec="0"/>
    <to sec="1009861545" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.768508,1.3453,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_83{
style=filled;
color=gray75;
308[label="200.193.38.117;7pkt 7fpkt", shape=pentagon, color=darkviolet];
363[label="200.193.38.117;6pkt 6fpkt", shape=invtriangle, color=brown];
397[label="200.193.38.117;6pkt 6fpkt", shape=invhouse, color=bisque];
stat83[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.193.38.117:80, 200.192.10.192:*}[85.7143%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 17065: (7.89474%)&lt;BR/&gt; 1259: (7.89474%)&lt;BR/&gt; 1258: (7.89474%)&lt;BR/&gt; 1257: (7.89474%)&gt;];
}
308--363[label="1;6pkt 6fpkt"];
308--397[label="1;6pkt 6fpkt"];
363--397[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="200.192.10.192" src_ip="200.193.38.117" src_port="80"/>
    </slice>
    <from sec="1009861457" usec="0"/>
    <to sec="1009861559" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785382,1.27067,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_84{
style=filled;
color=gray75;
162[label="166.59.210.32;d;106pkt 106fpkt", shape=diamond, color=yellow];
313[label="91.188.108.130;8pkt 8fpkt", shape=pentagon, color=darkviolet];
365[label="91.188.108.130;8pkt 8fpkt", shape=invtriangle, color=brown];
399[label="91.188.108.130;8pkt 8fpkt", shape=invhouse, color=bisque];
stat84[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:25, 166.59.210.32:*}[92.7273%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (48.4615%)&lt;BR/&gt; 1713: (1.92308%)&lt;BR/&gt; 1806: (1.53846%)&lt;BR/&gt; 1782: (1.53846%)&lt;BR/&gt; 1749: (1.53846%)&gt;];
}
162--313[label="0.5;4pkt 4fpkt"];
162--365[label="0.5;4pkt 4fpkt"];
162--399[label="0.5;4pkt 4fpkt"];
313--365[label="1;8pkt 8fpkt"];
313--399[label="1;8pkt 8fpkt"];
365--399[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="166.59.210.32" src_port="25"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861562" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.594146,1.34554,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_85{
style=filled;
color=gray75;
318[label="201.10.129.157;4pkt 4fpkt", shape=pentagon, color=darkviolet];
368[label="201.10.129.157;4pkt 4fpkt", shape=invtriangle, color=brown];
stat85[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.10.129.157:80, 148.83.107.110:2938}[25%]&lt;BR/&gt;{201.10.129.157:80, 148.83.107.110:2939}[25%]&lt;BR/&gt;{201.10.129.157:80, 148.83.107.110:2940}[25%]&lt;BR/&gt;{201.10.129.157:80, 148.83.107.110:2941}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2941: (12.5%)&lt;BR/&gt; 2940: (12.5%)&lt;BR/&gt; 2939: (12.5%)&lt;BR/&gt; 2938: (12.5%)&gt;];
}
318--368[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="148.83.107.110" dst_port="2941" src_ip="201.10.129.157" src_port="80"/>
      <filter dst_ip="148.83.107.110" dst_port="2940" src_ip="201.10.129.157" src_port="80"/>
      <filter dst_ip="148.83.107.110" dst_port="2939" src_ip="201.10.129.157" src_port="80"/>
      <filter dst_ip="148.83.107.110" dst_port="2938" src_ip="201.10.129.157" src_port="80"/>
    </slice>
    <from sec="1009861303" usec="0"/>
    <to sec="1009861346" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.594146,1.34554,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_86{
style=filled;
color=gray75;
321[label="200.192.15.163;15pkt 15fpkt", shape=pentagon, color=darkviolet];
369[label="200.192.15.163;15pkt 15fpkt", shape=invtriangle, color=brown];
stat86[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.192.15.163:6667, *:*}[46.6667%]&lt;BR/&gt;{200.192.15.163:*, *:113}[26.6667%]&lt;BR/&gt;{200.192.15.163:*, 219.64.211.50:*}[20%]&lt;BR/&gt;{200.192.15.163:*, 14.144.105.213:*}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (23.3333%)&lt;BR/&gt; 113: (13.3333%)&lt;BR/&gt; 10275: (3.33333%)&lt;BR/&gt; 6666: (3.33333%)&lt;BR/&gt; 6665: (3.33333%)&gt;];
}
321--369[label="1;15pkt 15fpkt"];
</description>
    <slice>
      <filter dst_ip="14.144.105.213" src_ip="200.192.15.163"/>
      <filter dst_ip="219.64.211.50" src_ip="200.192.15.163"/>
      <filter src_ip="200.192.15.163" src_port="6667"/>
      <filter dst_port="113" src_ip="200.192.15.163"/>
    </slice>
    <from sec="1009861211" usec="0"/>
    <to sec="1009861560" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.594146,1.34554,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_87{
style=filled;
color=gray75;
324[label="91.188.68.177;2pkt 2fpkt", shape=pentagon, color=darkviolet];
371[label="91.188.68.177;2pkt 2fpkt", shape=invtriangle, color=brown];
stat87[shape=component, label=&lt;Rules:&lt;BR/&gt;{91.188.68.177:80, 147.53.106.6:1138}[50%]&lt;BR/&gt;{91.188.68.177:80, 147.53.106.6:1169}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1169: (25%)&lt;BR/&gt; 1138: (25%)&gt;];
}
324--371[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="147.53.106.6" dst_port="1169" src_ip="91.188.68.177" src_port="80"/>
      <filter dst_ip="147.53.106.6" dst_port="1138" src_ip="91.188.68.177" src_port="80"/>
    </slice>
    <from sec="1009861492" usec="0"/>
    <to sec="1009861534" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644419,1.38653,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="14.23.232.199"/>
    </slice>
    <from sec="1009861201" usec="0"/>
    <to sec="1009861563" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.768508,1.3453,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_89{
style=filled;
color=gray75;
329[label="216.106.147.204;3pkt 3fpkt", shape=pentagon, color=darkviolet];
373[label="216.106.147.204;3pkt 3fpkt", shape=invtriangle, color=brown];
403[label="216.106.147.204;3pkt 3fpkt", shape=invhouse, color=bisque];
stat89[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.106.147.204:59006, 147.53.97.206:110}[33.3333%]&lt;BR/&gt;{216.106.147.204:59005, 147.53.188.133:110}[33.3333%]&lt;BR/&gt;{216.106.147.204:59008, 147.53.188.133:110}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 110: (50%)&lt;BR/&gt; 59008: (16.6667%)&lt;BR/&gt; 59006: (16.6667%)&lt;BR/&gt; 59005: (16.6667%)&gt;];
}
329--373[label="1;3pkt 3fpkt"];
329--403[label="1;3pkt 3fpkt"];
373--403[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="147.53.188.133" dst_port="110" src_ip="216.106.147.204" src_port="59008"/>
      <filter dst_ip="147.53.188.133" dst_port="110" src_ip="216.106.147.204" src_port="59005"/>
      <filter dst_ip="147.53.97.206" dst_port="110" src_ip="216.106.147.204" src_port="59006"/>
    </slice>
    <from sec="1009861269" usec="0"/>
    <to sec="1009861453" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.768508,1.3453,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_91{
style=filled;
color=gray75;
332[label="214.82.211.221;34pkt 34fpkt", shape=pentagon, color=darkviolet];
375[label="214.82.211.221;34pkt 34fpkt", shape=invtriangle, color=brown];
406[label="214.82.211.221;33pkt 33fpkt", shape=invhouse, color=bisque];
stat91[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.82.211.221:*, *:25}[52.9412%]&lt;BR/&gt;{214.82.211.221:113, *:*}[47.0588%]&lt;BR/&gt;{214.82.211.221:*, 201.130.155.132:*}[35.2941%]&lt;BR/&gt;{214.82.211.221:*, 147.36.69.165:*}[35.2941%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (26.2376%)&lt;BR/&gt; 113: (23.7624%)&lt;BR/&gt; 60309: (1.48515%)&lt;BR/&gt; 60308: (1.48515%)&lt;BR/&gt; 60307: (1.48515%)&gt;];
}
332--375[label="1;34pkt 34fpkt"];
332--406[label="1;33pkt 33fpkt"];
375--406[label="1;33pkt 33fpkt"];
</description>
    <slice>
      <filter dst_ip="147.36.69.165" src_ip="214.82.211.221"/>
      <filter dst_ip="201.130.155.132" src_ip="214.82.211.221"/>
      <filter src_ip="214.82.211.221" src_port="113"/>
      <filter dst_port="25" src_ip="214.82.211.221"/>
    </slice>
    <from sec="1009861249" usec="0"/>
    <to sec="1009861397" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.768508,1.3453,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_92{
style=filled;
color=gray75;
333[label="160.63.22.234;39pkt 39fpkt", shape=pentagon, color=darkviolet];
376[label="160.63.22.234;39pkt 39fpkt", shape=invtriangle, color=brown];
407[label="160.63.22.234;39pkt 39fpkt", shape=invhouse, color=bisque];
stat92[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.63.22.234:*, 14.234.100.4:6667}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (50%)&lt;BR/&gt; 3538: (1.28205%)&lt;BR/&gt; 3537: (1.28205%)&lt;BR/&gt; 3536: (1.28205%)&lt;BR/&gt; 3535: (1.28205%)&gt;];
}
333--376[label="1;39pkt 39fpkt"];
333--407[label="1;39pkt 39fpkt"];
376--407[label="1;39pkt 39fpkt"];
</description>
    <slice>
      <filter dst_ip="14.234.100.4" dst_port="6667" src_ip="160.63.22.234"/>
    </slice>
    <from sec="1009861204" usec="0"/>
    <to sec="1009861558" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.594146,1.34554,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_93{
style=filled;
color=gray75;
339[label="142.132.115.252;1pkt 1fpkt", shape=pentagon, color=darkviolet];
377[label="142.132.115.252;1pkt 1fpkt", shape=invtriangle, color=brown];
stat93[shape=component, label=&lt;Rules:&lt;BR/&gt;{142.132.115.252:2634, 88.8.56.53:6699}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 2634: (50%)&gt;];
}
339--377[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="88.8.56.53" dst_port="6699" src_ip="142.132.115.252" src_port="2634"/>
    </slice>
    <from sec="1009861208" usec="0"/>
    <to sec="1009861553" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785382,1.27067,020,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_94{
style=filled;
color=gray75;
67[label="66.54.113.223;d;15pkt 15fpkt", shape=diamond, color=yellow];
100[label="140.77.2.25;d;15pkt 15fpkt", shape=diamond, color=yellow];
183[label="209.152.130.241;d;15pkt 15fpkt", shape=diamond, color=yellow];
185[label="143.128.30.229;d;15pkt 15fpkt", shape=diamond, color=yellow];
272[label="201.1.140.2;4pkt 4fpkt", shape=pentagon, color=darkviolet];
343[label="201.1.140.17;4pkt 4fpkt", shape=invtriangle, color=brown];
380[label="201.1.140.17;5pkt 5fpkt", shape=invhouse, color=bisque];
382[label="201.1.140.28;5pkt 5fpkt", shape=invhouse, color=bisque];
stat94[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 140.77.2.25:0}[23.8095%]&lt;BR/&gt;{*:0, 66.54.113.223:0}[23.8095%]&lt;BR/&gt;{*:0, 143.128.30.229:0}[23.8095%]&lt;BR/&gt;{*:0, 209.152.130.241:0}[23.8095%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
67--272[label="0.25;1pkt 1fpkt"];
67--343[label="0.25;1pkt 1fpkt"];
67--380[label="0.2;1pkt 1fpkt"];
67--382[label="0.2;1pkt 1fpkt"];
100--380[label="0.2;1pkt 1fpkt"];
100--382[label="0.2;1pkt 1fpkt"];
183--272[label="0.25;1pkt 1fpkt"];
183--343[label="0.25;1pkt 1fpkt"];
183--380[label="0.2;1pkt 1fpkt"];
183--382[label="0.2;1pkt 1fpkt"];
185--272[label="0.25;1pkt 1fpkt"];
185--343[label="0.25;1pkt 1fpkt"];
185--380[label="0.2;1pkt 1fpkt"];
185--382[label="0.2;1pkt 1fpkt"];
343--380[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="209.152.130.241"/>
      <filter dst_ip="143.128.30.229"/>
      <filter dst_ip="66.54.113.223"/>
      <filter dst_ip="140.77.2.25"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861563" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.701398,1.40039,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="201.35.119.88"/>
    </slice>
    <from sec="1009861203" usec="0"/>
    <to sec="1009861563" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.701398,1.40039,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="204.91.105.133"/>
    </slice>
    <from sec="1009861203" usec="0"/>
    <to sec="1009861563" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785382,1.27067,901,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_97{
style=filled;
color=gray75;
54[label="218.140.121.191;s;154pkt 154fpkt", shape=diamond, color=yellow];
87[label="166.59.211.200;d;124pkt 124fpkt", shape=diamond, color=yellow];
127[label="166.59.211.209;d;98pkt 98fpkt", shape=diamond, color=yellow];
136[label="166.59.211.208;d;131pkt 131fpkt", shape=diamond, color=yellow];
137[label="212.129.27.184;s;20pkt 20fpkt", shape=diamond, color=yellow];
325[label="212.129.27.184;43pkt 43fpkt", shape=pentagon, color=darkviolet];
370[label="88.11.107.163;19pkt 19fpkt", shape=invtriangle, color=brown];
402[label="88.11.107.163;19pkt 19fpkt", shape=invhouse, color=bisque];
stat97[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.140.121.191:80, *:*}[38.8889%]&lt;BR/&gt;{*:80, 166.59.211.208:*}[34.596%]&lt;BR/&gt;{*:80, 166.59.211.209:*}[33.0808%]&lt;BR/&gt;{*:80, 166.59.211.200:*}[32.0707%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.9178%)&lt;BR/&gt; 4129: (0.246711%)&lt;BR/&gt; 4083: (0.246711%)&lt;BR/&gt; 4044: (0.246711%)&lt;BR/&gt; 3997: (0.246711%)&gt;];
}
54--87[label="0.403226;50pkt 50fpkt"];
54--127[label="0.367347;36pkt 36fpkt"];
54--136[label="0.389313;51pkt 51fpkt"];
87--137[label="0.25;5pkt 5fpkt"];
87--325[label="0.162791;7pkt 7fpkt"];
87--370[label="0.315789;6pkt 6fpkt"];
87--402[label="0.315789;6pkt 6fpkt"];
127--137[label="0.15;3pkt 3fpkt"];
127--325[label="0.0697674;3pkt 3fpkt"];
127--370[label="0.0526316;1pkt 1fpkt"];
127--402[label="0.0526316;1pkt 1fpkt"];
136--137[label="0.6;12pkt 12fpkt"];
136--325[label="0.372093;16pkt 16fpkt"];
136--370[label="0.157895;3pkt 3fpkt"];
136--402[label="0.157895;3pkt 3fpkt"];
137--325[label="1;20pkt 20fpkt"];
370--402[label="1;19pkt 19fpkt"];
</description>
    <slice>
      <filter src_ip="218.140.121.191" src_port="80"/>
      <filter dst_ip="166.59.211.208" src_port="80"/>
      <filter dst_ip="166.59.211.209" src_port="80"/>
      <filter dst_ip="166.59.211.200" src_port="80"/>
    </slice>
    <from sec="1009861200" usec="0"/>
    <to sec="1009861563" usec="0"/>
  </anomaly>

</admd:annotation>
