<?xml version="1.0" encoding="UTF-8" standalone="no" ?>
<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">

  <anomaly type="notice" value="0.794255,1.46859,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="203.86.71.131" dst_port="137" proto="tcp" src_ip="200.98.25.59" src_port="1025"/>
      <filter dst_ip="203.86.71.131" dst_port="137" proto="udp" src_ip="200.98.25.59" src_port="1025"/>
      <filter dst_ip="203.86.71.131" dst_port="53" proto="tcp" src_ip="200.98.25.59" src_port="1025"/>
      <filter dst_ip="203.86.71.131" dst_port="53" proto="udp" src_ip="200.98.25.59" src_port="1025"/>
      <filter dst_ip="203.86.71.131" dst_port="80" proto="tcp" src_ip="200.98.25.59" src_port="1025"/>
      <filter dst_ip="203.86.71.131" dst_port="80" proto="udp" src_ip="200.98.25.59" src_port="1025"/>
      <from sec="1049433113" usec="0"/>
      <to sec="1049433128" usec="0"/>
    </slice>
    <from sec="1049433110" usec="0"/>
    <to sec="1049433134" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,504,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="205.105.175.126" dst_port="443" proto="tcp" src_ip="178.184.206.48" src_port="1165"/>
      <filter dst_ip="205.105.175.126" dst_port="411" proto="tcp" src_ip="178.184.206.48" src_port="1165"/>
      <filter dst_ip="205.215.135.76" dst_port="443" proto="tcp" src_ip="178.184.206.48" src_port="1165"/>
      <filter dst_ip="205.215.135.76" dst_port="411" proto="tcp" src_ip="178.184.206.48" src_port="1165"/>
      <from sec="1049432585" usec="0"/>
      <to sec="1049432594" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="205.105.175.126" dst_port="443" proto="tcp" src_ip="165.236.181.85" src_port="1165"/>
      <filter dst_ip="205.105.175.126" dst_port="411" proto="tcp" src_ip="165.236.181.85" src_port="1165"/>
      <filter dst_ip="205.215.135.76" dst_port="443" proto="tcp" src_ip="165.236.181.85" src_port="1165"/>
      <filter dst_ip="205.215.135.76" dst_port="411" proto="tcp" src_ip="165.236.181.85" src_port="1165"/>
      <from sec="1049432585" usec="0"/>
      <to sec="1049432597" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="205.105.175.126" dst_port="443" proto="tcp" src_ip="141.109.118.42" src_port="1165"/>
      <filter dst_ip="205.105.175.126" dst_port="411" proto="tcp" src_ip="141.109.118.42" src_port="1165"/>
      <filter dst_ip="205.215.135.76" dst_port="443" proto="tcp" src_ip="141.109.118.42" src_port="1165"/>
      <filter dst_ip="205.215.135.76" dst_port="411" proto="tcp" src_ip="141.109.118.42" src_port="1165"/>
      <from sec="1049432593" usec="0"/>
      <to sec="1049432597" usec="0"/>
    </slice>
    <from sec="1049432585" usec="0"/>
    <to sec="1049432597" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,504,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="205.215.135.224" dst_port="80" proto="tcp" src_ip="165.45.133.211" src_port="1040"/>
      <filter dst_ip="205.215.135.224" dst_port="80" proto="udp" src_ip="165.45.133.211" src_port="1040"/>
      <filter dst_ip="205.215.135.224" dst_port="53" proto="tcp" src_ip="165.45.133.211" src_port="1040"/>
      <filter dst_ip="205.215.135.224" dst_port="53" proto="udp" src_ip="165.45.133.211" src_port="1040"/>
      <filter dst_ip="205.215.135.224" dst_port="443" proto="tcp" src_ip="165.45.133.211" src_port="1040"/>
      <filter dst_ip="205.215.135.224" dst_port="443" proto="udp" src_ip="165.45.133.211" src_port="1040"/>
      <filter dst_ip="203.86.71.131" dst_port="80" proto="tcp" src_ip="165.45.133.211" src_port="1040"/>
      <filter dst_ip="203.86.71.131" dst_port="80" proto="udp" src_ip="165.45.133.211" src_port="1040"/>
      <filter dst_ip="203.86.71.131" dst_port="53" proto="tcp" src_ip="165.45.133.211" src_port="1040"/>
      <filter dst_ip="203.86.71.131" dst_port="53" proto="udp" src_ip="165.45.133.211" src_port="1040"/>
      <filter dst_ip="203.86.71.131" dst_port="443" proto="tcp" src_ip="165.45.133.211" src_port="1040"/>
      <filter dst_ip="203.86.71.131" dst_port="443" proto="udp" src_ip="165.45.133.211" src_port="1040"/>
      <filter dst_ip="205.215.135.11" dst_port="80" proto="tcp" src_ip="165.45.133.211" src_port="1040"/>
      <filter dst_ip="205.215.135.11" dst_port="80" proto="udp" src_ip="165.45.133.211" src_port="1040"/>
      <filter dst_ip="205.215.135.11" dst_port="53" proto="tcp" src_ip="165.45.133.211" src_port="1040"/>
      <filter dst_ip="205.215.135.11" dst_port="53" proto="udp" src_ip="165.45.133.211" src_port="1040"/>
      <filter dst_ip="205.215.135.11" dst_port="443" proto="tcp" src_ip="165.45.133.211" src_port="1040"/>
      <filter dst_ip="205.215.135.11" dst_port="443" proto="udp" src_ip="165.45.133.211" src_port="1040"/>
      <from sec="1049432986" usec="0"/>
      <to sec="1049432992" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="205.215.135.224" dst_port="80" proto="tcp" src_ip="160.225.209.244" src_port="1040"/>
      <filter dst_ip="205.215.135.224" dst_port="80" proto="udp" src_ip="160.225.209.244" src_port="1040"/>
      <filter dst_ip="205.215.135.224" dst_port="53" proto="tcp" src_ip="160.225.209.244" src_port="1040"/>
      <filter dst_ip="205.215.135.224" dst_port="53" proto="udp" src_ip="160.225.209.244" src_port="1040"/>
      <filter dst_ip="205.215.135.224" dst_port="443" proto="tcp" src_ip="160.225.209.244" src_port="1040"/>
      <filter dst_ip="205.215.135.224" dst_port="443" proto="udp" src_ip="160.225.209.244" src_port="1040"/>
      <filter dst_ip="203.86.71.131" dst_port="80" proto="tcp" src_ip="160.225.209.244" src_port="1040"/>
      <filter dst_ip="203.86.71.131" dst_port="80" proto="udp" src_ip="160.225.209.244" src_port="1040"/>
      <filter dst_ip="203.86.71.131" dst_port="53" proto="tcp" src_ip="160.225.209.244" src_port="1040"/>
      <filter dst_ip="203.86.71.131" dst_port="53" proto="udp" src_ip="160.225.209.244" src_port="1040"/>
      <filter dst_ip="203.86.71.131" dst_port="443" proto="tcp" src_ip="160.225.209.244" src_port="1040"/>
      <filter dst_ip="203.86.71.131" dst_port="443" proto="udp" src_ip="160.225.209.244" src_port="1040"/>
      <filter dst_ip="205.215.135.11" dst_port="80" proto="tcp" src_ip="160.225.209.244" src_port="1040"/>
      <filter dst_ip="205.215.135.11" dst_port="80" proto="udp" src_ip="160.225.209.244" src_port="1040"/>
      <filter dst_ip="205.215.135.11" dst_port="53" proto="tcp" src_ip="160.225.209.244" src_port="1040"/>
      <filter dst_ip="205.215.135.11" dst_port="53" proto="udp" src_ip="160.225.209.244" src_port="1040"/>
      <filter dst_ip="205.215.135.11" dst_port="443" proto="tcp" src_ip="160.225.209.244" src_port="1040"/>
      <filter dst_ip="205.215.135.11" dst_port="443" proto="udp" src_ip="160.225.209.244" src_port="1040"/>
      <from sec="1049432988" usec="0"/>
      <to sec="1049432991" usec="0"/>
    </slice>
    <from sec="1049432985" usec="0"/>
    <to sec="1049432998" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="4.28.176.18" src_port="9519"/>
      <filter dst_port="137" proto="icmp" src_ip="4.28.176.18" src_port="9519"/>
      <from sec="1049433062" usec="0"/>
      <to sec="1049433069" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="137" proto="udp" src_ip="203.86.68.18" src_port="9519"/>
      <filter dst_port="137" proto="icmp" src_ip="203.86.68.18" src_port="9519"/>
      <from sec="1049433062" usec="0"/>
      <to sec="1049433073" usec="0"/>
    </slice>
    <from sec="1049433062" usec="0"/>
    <to sec="1049433073" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="66.10.83.194" dst_port="137" proto="tcp" src_ip="4.91.93.35" src_port="1025"/>
      <filter dst_ip="66.10.83.194" dst_port="137" proto="udp" src_ip="4.91.93.35" src_port="1025"/>
      <filter dst_ip="66.10.83.194" dst_port="443" proto="tcp" src_ip="4.91.93.35" src_port="1025"/>
      <filter dst_ip="66.10.83.194" dst_port="443" proto="udp" src_ip="4.91.93.35" src_port="1025"/>
      <from sec="1049432608" usec="0"/>
      <to sec="1049432627" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="66.10.83.194" dst_port="137" proto="tcp" src_ip="136.210.209.35" src_port="1025"/>
      <filter dst_ip="66.10.83.194" dst_port="137" proto="udp" src_ip="136.210.209.35" src_port="1025"/>
      <filter dst_ip="66.10.83.194" dst_port="443" proto="tcp" src_ip="136.210.209.35" src_port="1025"/>
      <filter dst_ip="66.10.83.194" dst_port="443" proto="udp" src_ip="136.210.209.35" src_port="1025"/>
      <from sec="1049432616" usec="0"/>
      <to sec="1049432627" usec="0"/>
    </slice>
    <from sec="1049432608" usec="0"/>
    <to sec="1049432627" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="214.90.101.39" src_port="1029"/>
      <from sec="1049432790" usec="0"/>
      <to sec="1049432801" usec="0"/>
    </slice>
    <from sec="1049432790" usec="0"/>
    <to sec="1049432801" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="179.176.54.50" src_port="26509"/>
      <from sec="1049432753" usec="0"/>
      <to sec="1049432775" usec="0"/>
    </slice>
    <from sec="1049432753" usec="0"/>
    <to sec="1049432775" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="51.96.205.63" src_port="1028"/>
      <from sec="1049433182" usec="0"/>
      <to sec="1049433209" usec="0"/>
    </slice>
    <from sec="1049433182" usec="0"/>
    <to sec="1049433210" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="64.123.90.81" src_port="1026"/>
      <from sec="1049432400" usec="0"/>
      <to sec="1049432413" usec="0"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049432413" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="4.32.21.93" src_port="1027"/>
      <from sec="1049432985" usec="0"/>
      <to sec="1049433009" usec="0"/>
    </slice>
    <from sec="1049432985" usec="0"/>
    <to sec="1049433009" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="203.86.71.131" dst_port="53" proto="tcp" src_ip="200.173.179.128" src_port="1028"/>
      <filter dst_ip="203.86.71.131" dst_port="53" proto="udp" src_ip="200.173.179.128" src_port="1028"/>
      <filter dst_ip="203.86.71.131" dst_port="137" proto="tcp" src_ip="200.173.179.128" src_port="1028"/>
      <filter dst_ip="203.86.71.131" dst_port="137" proto="udp" src_ip="200.173.179.128" src_port="1028"/>
      <from sec="1049432617" usec="0"/>
      <to sec="1049432643" usec="0"/>
    </slice>
    <from sec="1049432617" usec="0"/>
    <to sec="1049432643" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="214.38.177.135" src_port="1027"/>
      <from sec="1049432851" usec="0"/>
      <to sec="1049432881" usec="0"/>
    </slice>
    <from sec="1049432851" usec="0"/>
    <to sec="1049432881" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="220.82.38.151" src_port="1035"/>
      <from sec="1049433284" usec="0"/>
      <to sec="1049433295" usec="0"/>
    </slice>
    <from sec="1049433284" usec="0"/>
    <to sec="1049433295" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="212.1.70.153" src_port="1028"/>
      <from sec="1049432880" usec="0"/>
      <to sec="1049432890" usec="0"/>
    </slice>
    <from sec="1049432880" usec="0"/>
    <to sec="1049432890" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="6.167.113.174" src_port="1028"/>
      <from sec="1049432541" usec="0"/>
      <to sec="1049432579" usec="0"/>
    </slice>
    <from sec="1049432541" usec="0"/>
    <to sec="1049432579" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="64.242.77.187" src_port="1025"/>
      <from sec="1049433041" usec="0"/>
      <to sec="1049433061" usec="0"/>
    </slice>
    <from sec="1049433041" usec="0"/>
    <to sec="1049433061" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="217.161.139.204" dst_port="137" proto="tcp" src_ip="217.74.109.207" src_port="1028"/>
      <filter dst_ip="217.161.139.204" dst_port="137" proto="udp" src_ip="217.74.109.207" src_port="1028"/>
      <filter dst_ip="217.161.139.204" dst_port="80" proto="tcp" src_ip="217.74.109.207" src_port="1028"/>
      <filter dst_ip="217.161.139.204" dst_port="80" proto="udp" src_ip="217.74.109.207" src_port="1028"/>
      <from sec="1049433010" usec="0"/>
      <to sec="1049433030" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="217.161.139.204" dst_port="137" proto="tcp" src_ip="165.45.89.207" src_port="1028"/>
      <filter dst_ip="217.161.139.204" dst_port="137" proto="udp" src_ip="165.45.89.207" src_port="1028"/>
      <filter dst_ip="217.161.139.204" dst_port="80" proto="tcp" src_ip="165.45.89.207" src_port="1028"/>
      <filter dst_ip="217.161.139.204" dst_port="80" proto="udp" src_ip="165.45.89.207" src_port="1028"/>
      <from sec="1049433016" usec="0"/>
      <to sec="1049433023" usec="0"/>
    </slice>
    <from sec="1049433010" usec="0"/>
    <to sec="1049433030" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="65.34.215.211" src_port="1039"/>
      <from sec="1049432559" usec="0"/>
      <to sec="1049432571" usec="0"/>
    </slice>
    <from sec="1049432559" usec="0"/>
    <to sec="1049432571" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="4.48.11.216" src_port="1027"/>
      <from sec="1049432891" usec="0"/>
      <to sec="1049432908" usec="0"/>
    </slice>
    <from sec="1049432891" usec="0"/>
    <to sec="1049432908" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="200.97.141.220" src_port="1038"/>
      <from sec="1049432578" usec="0"/>
      <to sec="1049432594" usec="0"/>
    </slice>
    <from sec="1049432578" usec="0"/>
    <to sec="1049432594" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,999,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="203.86.65.125" dst_port="137" proto="tcp" src_ip="214.107.5.232" src_port="1025"/>
      <filter dst_ip="203.86.65.125" dst_port="137" proto="udp" src_ip="214.107.5.232" src_port="1025"/>
      <filter dst_ip="203.86.65.125" dst_port="50440" proto="tcp" src_ip="214.107.5.232" src_port="1025"/>
      <filter dst_ip="203.86.65.125" dst_port="50440" proto="udp" src_ip="214.107.5.232" src_port="1025"/>
      <filter dst_ip="203.86.65.125" dst_port="137" proto="tcp" src_ip="214.107.5.232" src_port="25"/>
      <filter dst_ip="203.86.65.125" dst_port="137" proto="udp" src_ip="214.107.5.232" src_port="25"/>
      <filter dst_ip="203.86.65.125" dst_port="50440" proto="tcp" src_ip="214.107.5.232" src_port="25"/>
      <filter dst_ip="203.86.65.125" dst_port="50440" proto="udp" src_ip="214.107.5.232" src_port="25"/>
      <from sec="1049433273" usec="0"/>
      <to sec="1049433285" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="203.86.65.125" dst_port="137" proto="tcp" src_ip="202.24.129.232" src_port="1025"/>
      <filter dst_ip="203.86.65.125" dst_port="137" proto="udp" src_ip="202.24.129.232" src_port="1025"/>
      <filter dst_ip="203.86.65.125" dst_port="50440" proto="tcp" src_ip="202.24.129.232" src_port="1025"/>
      <filter dst_ip="203.86.65.125" dst_port="50440" proto="udp" src_ip="202.24.129.232" src_port="1025"/>
      <filter dst_ip="203.86.65.125" dst_port="137" proto="tcp" src_ip="202.24.129.232" src_port="25"/>
      <filter dst_ip="203.86.65.125" dst_port="137" proto="udp" src_ip="202.24.129.232" src_port="25"/>
      <filter dst_ip="203.86.65.125" dst_port="50440" proto="tcp" src_ip="202.24.129.232" src_port="25"/>
      <filter dst_ip="203.86.65.125" dst_port="50440" proto="udp" src_ip="202.24.129.232" src_port="25"/>
      <from sec="1049433280" usec="0"/>
      <to sec="1049433281" usec="0"/>
    </slice>
    <from sec="1049433273" usec="0"/>
    <to sec="1049433285" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="tcp" src_ip="165.45.54.145" src_port="2234"/>
      <filter dst_port="137" proto="udp" src_ip="165.45.54.145" src_port="2234"/>
      <filter dst_port="137" proto="tcp" src_ip="165.45.54.145" src_port="1046"/>
      <filter dst_port="137" proto="udp" src_ip="165.45.54.145" src_port="1046"/>
      <from sec="1049432536" usec="0"/>
      <to sec="1049432666" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="137" proto="tcp" src_ip="4.26.130.145" src_port="2234"/>
      <filter dst_port="137" proto="udp" src_ip="4.26.130.145" src_port="2234"/>
      <filter dst_port="137" proto="tcp" src_ip="4.26.130.145" src_port="1046"/>
      <filter dst_port="137" proto="udp" src_ip="4.26.130.145" src_port="1046"/>
      <from sec="1049432655" usec="0"/>
      <to sec="1049432665" usec="0"/>
    </slice>
    <from sec="1049432536" usec="0"/>
    <to sec="1049432666" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="221.69.152.50" proto="icmp"/>
      <filter dst_ip="221.69.152.50" proto="icmp"/>
      <filter dst_ip="221.69.152.50" proto="icmp"/>
      <filter dst_ip="221.69.152.50" proto="icmp"/>
      <from sec="1049433222" usec="0"/>
      <to sec="1049433232" usec="0"/>
    </slice>
    <from sec="1049433222" usec="0"/>
    <to sec="1049433232" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="200.128.165.147" proto="icmp"/>
      <filter dst_ip="200.128.165.147" proto="icmp"/>
      <filter dst_ip="200.128.165.147" proto="icmp"/>
      <filter dst_ip="200.128.165.147" proto="icmp"/>
      <from sec="1049432512" usec="0"/>
      <to sec="1049432532" usec="0"/>
    </slice>
    <from sec="1049432512" usec="0"/>
    <to sec="1049432532" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="6.150.190.153" proto="icmp"/>
      <filter dst_ip="6.150.190.153" proto="icmp"/>
      <filter dst_ip="6.150.190.153" proto="icmp"/>
      <filter dst_ip="6.150.190.153" proto="icmp"/>
      <from sec="1049432471" usec="0"/>
      <to sec="1049432492" usec="0"/>
    </slice>
    <from sec="1049432471" usec="0"/>
    <to sec="1049432492" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="202.205.109.154" proto="icmp"/>
      <filter dst_ip="202.205.109.154" proto="icmp"/>
      <filter dst_ip="202.205.109.154" proto="icmp"/>
      <filter dst_ip="202.205.109.154" proto="icmp"/>
      <from sec="1049432400" usec="0"/>
      <to sec="1049432409" usec="0"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049432409" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="215.134.130.204" proto="udp" src_ip="203.86.71.131" src_port="53"/>
      <filter dst_ip="215.134.130.204" proto="icmp" src_ip="203.86.71.131" src_port="53"/>
      <filter dst_ip="215.134.130.204" proto="udp" src_ip="203.86.71.131" src_port="53"/>
      <filter dst_ip="215.134.130.204" proto="icmp" src_ip="203.86.71.131" src_port="53"/>
      <filter dst_ip="215.134.130.204" proto="udp" src_ip="203.86.71.131" src_port="53"/>
      <filter dst_ip="215.134.130.204" proto="icmp" src_ip="203.86.71.131" src_port="53"/>
      <filter dst_ip="215.134.130.204" proto="udp" src_ip="203.86.71.131" src_port="53"/>
      <filter dst_ip="215.134.130.204" proto="icmp" src_ip="203.86.71.131" src_port="53"/>
      <from sec="1049432494" usec="0"/>
      <to sec="1049432502" usec="0"/>
    </slice>
    <from sec="1049432493" usec="0"/>
    <to sec="1049432502" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="203.151.97.220" proto="icmp"/>
      <filter dst_ip="203.151.97.220" proto="icmp"/>
      <filter dst_ip="203.151.97.220" proto="icmp"/>
      <filter dst_ip="203.151.97.220" proto="icmp"/>
      <from sec="1049432400" usec="0"/>
      <to sec="1049432411" usec="0"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049432411" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="83.229.151.123" proto="icmp"/>
      <filter dst_ip="83.229.151.123" proto="icmp"/>
      <filter dst_ip="83.229.151.123" proto="icmp"/>
      <filter dst_ip="83.229.151.123" proto="icmp"/>
      <from sec="1049432871" usec="0"/>
      <to sec="1049432889" usec="0"/>
    </slice>
    <from sec="1049432871" usec="0"/>
    <to sec="1049432889" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="221.68.38.8" dst_port="53" proto="tcp"/>
      <filter dst_ip="221.68.38.8" dst_port="53" proto="udp"/>
      <filter dst_ip="221.68.38.8" dst_port="53" proto="icmp"/>
      <filter dst_ip="221.68.38.8" dst_port="53" proto="tcp"/>
      <filter dst_ip="221.68.38.8" dst_port="53" proto="udp"/>
      <filter dst_ip="221.68.38.8" dst_port="53" proto="icmp"/>
      <filter dst_ip="221.68.38.8" dst_port="53" proto="tcp"/>
      <filter dst_ip="221.68.38.8" dst_port="53" proto="udp"/>
      <filter dst_ip="221.68.38.8" dst_port="53" proto="icmp"/>
      <filter dst_ip="221.68.38.8" dst_port="53" proto="tcp"/>
      <filter dst_ip="221.68.38.8" dst_port="53" proto="udp"/>
      <filter dst_ip="221.68.38.8" dst_port="53" proto="icmp"/>
      <from sec="1049432908" usec="0"/>
      <to sec="1049432946" usec="0"/>
    </slice>
    <from sec="1049432908" usec="0"/>
    <to sec="1049432946" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="214.47.10.166" proto="icmp"/>
      <filter dst_ip="214.47.10.166" proto="icmp"/>
      <filter dst_ip="214.47.10.166" proto="icmp"/>
      <filter dst_ip="214.47.10.166" proto="icmp"/>
      <from sec="1049432946" usec="0"/>
      <to sec="1049432978" usec="0"/>
    </slice>
    <from sec="1049432946" usec="0"/>
    <to sec="1049432978" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="66.115.160.84" proto="icmp"/>
      <filter dst_ip="66.115.160.84" proto="icmp"/>
      <filter dst_ip="66.115.160.84" proto="icmp"/>
      <filter dst_ip="66.115.160.84" proto="icmp"/>
      <from sec="1049432511" usec="0"/>
      <to sec="1049432522" usec="0"/>
    </slice>
    <from sec="1049432511" usec="0"/>
    <to sec="1049432522" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="217.17.1.96" proto="icmp"/>
      <filter dst_ip="217.17.1.96" proto="icmp"/>
      <filter dst_ip="217.17.1.96" proto="icmp"/>
      <filter dst_ip="217.17.1.96" proto="icmp"/>
      <from sec="1049433202" usec="0"/>
      <to sec="1049433212" usec="0"/>
    </slice>
    <from sec="1049433202" usec="0"/>
    <to sec="1049433212" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="221.45.209.153" proto="icmp"/>
      <filter dst_ip="221.45.209.153" proto="icmp"/>
      <filter dst_ip="221.45.209.153" proto="icmp"/>
      <filter dst_ip="221.45.209.153" proto="icmp"/>
      <from sec="1049432627" usec="0"/>
      <to sec="1049432637" usec="0"/>
    </slice>
    <from sec="1049432627" usec="0"/>
    <to sec="1049432637" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="214.45.19.172" proto="tcp"/>
      <filter dst_ip="214.45.19.172" proto="icmp"/>
      <filter dst_ip="214.45.19.172" proto="tcp"/>
      <filter dst_ip="214.45.19.172" proto="icmp"/>
      <filter dst_ip="214.45.19.172" proto="tcp"/>
      <filter dst_ip="214.45.19.172" proto="icmp"/>
      <filter dst_ip="214.45.19.172" proto="tcp"/>
      <filter dst_ip="214.45.19.172" proto="icmp"/>
      <from sec="1049432927" usec="0"/>
      <to sec="1049432956" usec="0"/>
    </slice>
    <from sec="1049432927" usec="0"/>
    <to sec="1049432956" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="215.134.50.180" proto="icmp"/>
      <filter dst_ip="215.134.50.180" proto="icmp"/>
      <filter dst_ip="215.134.50.180" proto="icmp"/>
      <filter dst_ip="215.134.50.180" proto="icmp"/>
      <from sec="1049432871" usec="0"/>
      <to sec="1049432881" usec="0"/>
    </slice>
    <from sec="1049432871" usec="0"/>
    <to sec="1049432881" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.794255,1.46859,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="217.28.102.252" proto="icmp"/>
      <filter dst_ip="217.28.102.252" proto="icmp"/>
      <filter dst_ip="217.28.102.252" proto="icmp"/>
      <filter dst_ip="217.28.102.252" proto="icmp"/>
      <from sec="1049432937" usec="0"/>
      <to sec="1049432945" usec="0"/>
    </slice>
    <from sec="1049432937" usec="0"/>
    <to sec="1049432946" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_64{
style=filled;
color=gray75;
216[label="51.207.125.197;d;4pkt 4fpkt", shape=diamond, color=yellow];
218[label="165.236.164.238;s;30pkt 30fpkt", shape=diamond, color=yellow];
2352[label="165.236.164.238;29pkt 29fpkt", shape=pentagon, color=darkviolet];
2799[label="165.236.164.238;29pkt 29fpkt", shape=invtriangle, color=brown];
3060[label="165.236.164.238;30pkt 30fpkt", shape=invhouse, color=bisque];
stat64[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.236.164.238:80, *:*}[90%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (45.082%)&lt;BR/&gt; 25: (4.91803%)&lt;BR/&gt; 3374: (2.04918%)&lt;BR/&gt; 3371: (2.04918%)&lt;BR/&gt; 3370: (2.04918%)&gt;];
}
216--218[label="1;4pkt 4fpkt"];
216--2352[label="0.75;3pkt 3fpkt"];
216--2799[label="0.75;3pkt 3fpkt"];
216--3060[label="1;4pkt 4fpkt"];
218--2352[label="1;29pkt 29fpkt"];
218--2799[label="1;29pkt 29fpkt"];
218--3060[label="1;30pkt 30fpkt"];
2352--2799[label="1;29pkt 29fpkt"];
2352--3060[label="1;29pkt 29fpkt"];
2799--3060[label="1;29pkt 29fpkt"];
</description>
    <slice>
      <filter src_ip="165.236.164.238" src_port="80"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433259" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_68{
style=filled;
color=gray75;
527[label="212.73.48.130;d;167pkt 167fpkt", shape=diamond, color=yellow];
1039[label="165.45.43.71;s;17pkt 17fpkt", shape=diamond, color=yellow];
1696[label="160.225.120.24;29pkt 29fpkt", shape=pentagon, color=darkviolet];
1773[label="160.225.214.45;21pkt 21fpkt", shape=pentagon, color=darkviolet];
1869[label="165.45.43.71;16pkt 16fpkt", shape=pentagon, color=darkviolet];
1882[label="141.109.73.76;42pkt 42fpkt", shape=pentagon, color=darkviolet];
2108[label="141.109.58.148;13pkt 13fpkt", shape=pentagon, color=darkviolet];
2188[label="165.236.130.175;11pkt 11fpkt", shape=pentagon, color=darkviolet];
2207[label="165.236.131.182;11pkt 11fpkt", shape=pentagon, color=darkviolet];
2272[label="165.45.43.209;4pkt 4fpkt", shape=pentagon, color=darkviolet];
2341[label="165.45.42.233;5pkt 5fpkt", shape=pentagon, color=darkviolet];
2434[label="160.225.120.24;30pkt 30fpkt", shape=invtriangle, color=brown];
2536[label="165.45.43.71;16pkt 16fpkt", shape=invtriangle, color=brown];
2546[label="141.109.73.76;42pkt 42fpkt", shape=invtriangle, color=brown];
2677[label="141.109.58.148;12pkt 12fpkt", shape=invtriangle, color=brown];
2716[label="165.236.130.175;12pkt 12fpkt", shape=invtriangle, color=brown];
2792[label="165.45.42.233;6pkt 6fpkt", shape=invtriangle, color=brown];
2857[label="160.225.120.24;30pkt 30fpkt", shape=invhouse, color=bisque];
2908[label="165.45.43.71;17pkt 17fpkt", shape=invhouse, color=bisque];
stat68[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 212.73.48.130:80}[55%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.4012%)&lt;BR/&gt; 2312: (0.499002%)&lt;BR/&gt; 2305: (0.499002%)&lt;BR/&gt; 2302: (0.499002%)&lt;BR/&gt; 2241: (0.499002%)&gt;];
}
527--583[label="0.106383;5pkt 5fpkt"];
527--587[label="0.0239521;4pkt 4fpkt"];
527--683[label="0.00884956;1pkt 1fpkt"];
527--685[label="0.011976;2pkt 2fpkt"];
527--1039[label="0.235294;4pkt 4fpkt"];
527--1211[label="0.113772;19pkt 19fpkt"];
527--1262[label="0.0526316;1pkt 1fpkt"];
527--1273[label="0.011976;2pkt 2fpkt"];
527--1373[label="0.0239521;4pkt 4fpkt"];
527--1608[label="0.0838323;14pkt 14fpkt"];
527--1644[label="0.0239521;4pkt 4fpkt"];
527--1696[label="0.172414;5pkt 5fpkt"];
527--1724[label="0.011976;2pkt 2fpkt"];
527--1773[label="0.047619;1pkt 1fpkt"];
527--1844[label="0.0299401;5pkt 5fpkt"];
527--1869[label="0.25;4pkt 4fpkt"];
527--1882[label="0.0952381;4pkt 4fpkt"];
527--1929[label="0.00598802;1pkt 1fpkt"];
527--1936[label="0.25;2pkt 2fpkt"];
527--2007[label="0.011976;2pkt 2fpkt"];
527--2095[label="0.0454545;1pkt 1fpkt"];
527--2108[label="0.153846;2pkt 2fpkt"];
527--2131[label="0.037037;2pkt 2fpkt"];
527--2188[label="0.181818;2pkt 2fpkt"];
527--2207[label="0.0909091;1pkt 1fpkt"];
527--2209[label="0.113772;19pkt 19fpkt"];
527--2213[label="0.155689;26pkt 26fpkt"];
527--2272[label="0.5;2pkt 2fpkt"];
527--2341[label="0.4;2pkt 2fpkt"];
527--2434[label="0.166667;5pkt 5fpkt"];
527--2520[label="0.0299401;5pkt 5fpkt"];
527--2536[label="0.25;4pkt 4fpkt"];
527--2546[label="0.0952381;4pkt 4fpkt"];
527--2574[label="0.00598802;1pkt 1fpkt"];
527--2578[label="0.285714;2pkt 2fpkt"];
527--2618[label="0.011976;2pkt 2fpkt"];
527--2668[label="0.0454545;1pkt 1fpkt"];
527--2677[label="0.166667;2pkt 2fpkt"];
527--2716[label="0.166667;2pkt 2fpkt"];
527--2792[label="0.333333;2pkt 2fpkt"];
527--2857[label="0.166667;5pkt 5fpkt"];
527--2908[label="0.235294;4pkt 4fpkt"];
527--2929[label="0.00598802;1pkt 1fpkt"];
527--2992[label="0.0454545;1pkt 1fpkt"];
1039--1608[label="0.0588235;1pkt 1fpkt"];
1039--1869[label="1;16pkt 16fpkt"];
1039--2536[label="1;16pkt 16fpkt"];
1039--2908[label="1;17pkt 17fpkt"];
1696--2434[label="1;29pkt 29fpkt"];
1696--2857[label="1;29pkt 29fpkt"];
1869--2536[label="1;16pkt 16fpkt"];
1869--2908[label="1;16pkt 16fpkt"];
1882--2546[label="1;42pkt 42fpkt"];
2108--2677[label="1;12pkt 12fpkt"];
2188--2716[label="1;11pkt 11fpkt"];
2341--2792[label="1;5pkt 5fpkt"];
2434--2857[label="1;30pkt 30fpkt"];
2536--2908[label="1;16pkt 16fpkt"];
</description>
    <slice>
      <filter dst_ip="212.73.48.130" dst_port="80"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433297" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.851449,1.42124,503,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_70{
style=filled;
color=gray75;
65[label="160.225.146.211s;372pkt 372fpkt", shape=rectangle, color=red];
253[label="4.22.150.239;d;470pkt 470fpkt", shape=diamond, color=yellow];
254[label="160.225.146.211;s;471pkt 471fpkt", shape=diamond, color=yellow];
646[label="202.149.20.93;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat70[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.146.211:*, 4.22.150.239:80}[99.7877%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.9239%)&lt;BR/&gt; 3827: (0.114155%)&lt;BR/&gt; 3825: (0.114155%)&lt;BR/&gt; 3824: (0.114155%)&lt;BR/&gt; 3822: (0.114155%)&gt;];
}
65--253[label="1;372pkt 372fpkt"];
65--254[label="1;372pkt 372fpkt"];
65--1608[label="0.153226;57pkt 57fpkt"];
253--254[label="1;470pkt 470fpkt"];
253--1608[label="0.185106;87pkt 87fpkt"];
254--646[label="1;1pkt 1fpkt"];
254--1608[label="0.184713;87pkt 87fpkt"];
</description>
    <slice>
      <filter dst_ip="4.22.150.239" dst_port="80" src_ip="160.225.146.211"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_71{
style=filled;
color=gray75;
236[label="165.236.181.85;d;5pkt 5fpkt", shape=diamond, color=yellow];
260[label="220.137.116.223;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat71[shape=component, label=&lt;Rules:&lt;BR/&gt;{51.118.9.5:412, 165.236.181.85:49160}[20%]&lt;BR/&gt;{220.88.71.92:8497, 165.236.181.85:50331}[20%]&lt;BR/&gt;{69.5.157.108:49228, 165.236.181.85:49160}[20%]&lt;BR/&gt;{213.112.144.129:412, 165.236.181.85:49160}[20%]&lt;BR/&gt;{220.137.116.223:412, 165.236.181.85:50279}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 412: (33.3333%)&lt;BR/&gt; 49160: (25%)&lt;BR/&gt; 50279: (16.6667%)&lt;BR/&gt; 50331: (8.33333%)&lt;BR/&gt; 49228: (8.33333%)&gt;];
}
236--260[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="165.236.181.85" dst_port="50279" src_ip="220.137.116.223" src_port="412"/>
      <filter dst_ip="165.236.181.85" dst_port="49160" src_ip="213.112.144.129" src_port="412"/>
      <filter dst_ip="165.236.181.85" dst_port="49160" src_ip="69.5.157.108" src_port="49228"/>
      <filter dst_ip="165.236.181.85" dst_port="50331" src_ip="220.88.71.92" src_port="8497"/>
      <filter dst_ip="165.236.181.85" dst_port="49160" src_ip="51.118.9.5" src_port="412"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.851449,1.42124,503,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_72{
style=filled;
color=gray75;
126[label="4.136.222.234d;1pkt 1fpkt", shape=rectangle, color=red];
267[label="198.11.158.234;d;1pkt 1fpkt", shape=diamond, color=yellow];
268[label="160.225.231.25;s;247pkt 247fpkt", shape=diamond, color=yellow];
stat72[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.231.25:*, 64.112.51.14:80}[29.9595%]&lt;BR/&gt;{160.225.231.25:*, 220.202.27.4:80}[23.0769%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (45.5823%)&lt;BR/&gt; 53: (2.20884%)&lt;BR/&gt; 443: (0.803213%)&lt;BR/&gt; 3413: (0.60241%)&lt;BR/&gt; 1863: (0.60241%)&gt;];
}
126--267[label="1;1pkt 1fpkt"];
126--268[label="1;1pkt 1fpkt"];
267--268[label="1;1pkt 1fpkt"];
268--445[label="0.00404858;1pkt 1fpkt"];
268--584[label="0.186813;34pkt 34fpkt"];
268--678[label="0.00653595;1pkt 1fpkt"];
268--956[label="0.151899;12pkt 12fpkt"];
268--957[label="0.0116279;1pkt 1fpkt"];
268--1608[label="0.00404858;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="64.112.51.14" dst_port="80" src_ip="160.225.231.25"/>
      <filter dst_ip="220.202.27.4" dst_port="80" src_ip="160.225.231.25"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.888219,1.4348,999,0 0 0 1 1 0 0 0 0 0 1 0 ">
    <description>subgraph cluster_77{
style=filled;
color=gray75;
301[label="3.166.41.159;d;49pkt 49fpkt", shape=diamond, color=yellow];
302[label="3.166.41.159;s;49pkt 49fpkt", shape=diamond, color=yellow];
1220[label="3.166.41.159;d;10pkt 10fpkt", shape=hexagon, color=black];
2688[label="3.166.41.159;1pkt 1fpkt", shape=invtriangle, color=brown];
stat77[shape=component, label=&lt;Rules:&lt;BR/&gt;{3.166.41.159:13364, 3.166.41.159:*}[91.8367%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 13364: (44.4954%)&lt;BR/&gt; 0: (11.0092%)&lt;BR/&gt; 13392: (2.75229%)&lt;BR/&gt; 13365: (1.83486%)&lt;BR/&gt; 80: (1.83486%)&gt;];
}
301--302[label="1;49pkt 49fpkt"];
301--1220[label="1;10pkt 10fpkt"];
301--2688[label="1;1pkt 1fpkt"];
302--1220[label="1;10pkt 10fpkt"];
302--2688[label="1;1pkt 1fpkt"];
1220--2688[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="3.166.41.159" src_ip="3.166.41.159" src_port="13364"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.905834,1.4159,503,1 0 0 1 0 0 0 0 0 0 1 0 ">
    <description>subgraph cluster_78{
style=filled;
color=gray75;
22[label="160.225.246.108s;1pkt 1fpkt", shape=rectangle, color=red];
307[label="160.225.246.108;s;117pkt 117fpkt", shape=diamond, color=yellow];
2601[label="160.225.246.108;137pkt 137fpkt", shape=invtriangle, color=brown];
stat78[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.246.108:*, 205.147.243.166:80}[38.4058%]&lt;BR/&gt;{160.225.246.108:*, 66.107.169.15:80}[21.0145%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.6078%)&lt;BR/&gt; 1134: (0.588235%)&lt;BR/&gt; 1259: (0.392157%)&lt;BR/&gt; 1258: (0.392157%)&lt;BR/&gt; 1257: (0.392157%)&gt;];
}
22--307[label="1;1pkt 1fpkt"];
22--1608[label="1;1pkt 1fpkt"];
22--2601[label="1;1pkt 1fpkt"];
307--424[label="0.113043;13pkt 13fpkt"];
307--637[label="0.010989;1pkt 1fpkt"];
307--690[label="0.230769;27pkt 27fpkt"];
307--691[label="0.034188;4pkt 4fpkt"];
307--790[label="0.0683761;8pkt 8fpkt"];
307--868[label="0.0105263;1pkt 1fpkt"];
307--1042[label="0.00854701;1pkt 1fpkt"];
307--1333[label="0.0131579;1pkt 1fpkt"];
307--1372[label="0.0149254;1pkt 1fpkt"];
307--1608[label="0.111111;13pkt 13fpkt"];
307--2601[label="0.991453;116pkt 116fpkt"];
</description>
    <slice>
      <filter dst_ip="205.147.243.166" dst_port="80" src_ip="160.225.246.108"/>
      <filter dst_ip="66.107.169.15" dst_port="80" src_ip="160.225.246.108"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049432787" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_79{
style=filled;
color=gray75;
885[label="219.234.209.198;d;30pkt 30fpkt", shape=diamond, color=yellow];
886[label="160.225.82.110;s;26pkt 26fpkt", shape=diamond, color=yellow];
1980[label="160.225.82.110;33pkt 33fpkt", shape=pentagon, color=darkviolet];
2604[label="160.225.82.110;33pkt 33fpkt", shape=invtriangle, color=brown];
2945[label="160.225.82.110;33pkt 33fpkt", shape=invhouse, color=bisque];
stat79[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.82.110:*, 219.234.209.198:80}[96.9697%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1973: (1.6129%)&lt;BR/&gt; 1972: (1.6129%)&lt;BR/&gt; 1971: (1.6129%)&lt;BR/&gt; 1970: (1.6129%)&gt;];
}
885--886[label="0.961538;25pkt 25fpkt"];
885--1980[label="1;30pkt 30fpkt"];
885--2604[label="1;30pkt 30fpkt"];
885--2945[label="1;30pkt 30fpkt"];
886--1980[label="1;26pkt 26fpkt"];
886--2604[label="1;26pkt 26fpkt"];
886--2945[label="1;26pkt 26fpkt"];
1980--2604[label="1;33pkt 33fpkt"];
1980--2945[label="1;33pkt 33fpkt"];
2604--2945[label="1;33pkt 33fpkt"];
</description>
    <slice>
      <filter dst_ip="219.234.209.198" dst_port="80" src_ip="160.225.82.110"/>
    </slice>
    <from sec="1049432598" usec="0"/>
    <to sec="1049433285" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_85{
style=filled;
color=gray75;
243[label="161.168.44.170;d;120pkt 120fpkt", shape=diamond, color=yellow];
348[label="160.225.89.34;s;121pkt 121fpkt", shape=diamond, color=yellow];
1734[label="160.225.89.34;153pkt 153fpkt", shape=pentagon, color=darkviolet];
2455[label="160.225.89.34;154pkt 154fpkt", shape=invtriangle, color=brown];
2866[label="160.225.89.34;153pkt 153fpkt", shape=invhouse, color=bisque];
stat85[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.89.34:*, 161.168.44.170:80}[94.1558%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.0014%)&lt;BR/&gt; 1863: (0.570613%)&lt;BR/&gt; 0: (0.42796%)&lt;BR/&gt; 61771: (0.356633%)&lt;BR/&gt; 61770: (0.356633%)&gt;];
}
243--348[label="1;120pkt 120fpkt"];
243--1734[label="1;120pkt 120fpkt"];
243--2455[label="1;120pkt 120fpkt"];
243--2866[label="1;120pkt 120fpkt"];
348--1734[label="0.991736;120pkt 120fpkt"];
348--2455[label="1;121pkt 121fpkt"];
348--2866[label="0.991736;120pkt 120fpkt"];
1734--2455[label="1;153pkt 153fpkt"];
1734--2866[label="1;153pkt 153fpkt"];
2455--2866[label="1;153pkt 153fpkt"];
</description>
    <slice>
      <filter dst_ip="161.168.44.170" dst_port="80" src_ip="160.225.89.34"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433277" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.851449,1.42124,999,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_86{
style=filled;
color=gray75;
29[label="141.109.40.145s;1pkt 1fpkt", shape=rectangle, color=red];
245[label="141.109.40.145;s;4pkt 4fpkt", shape=diamond, color=yellow];
350[label="217.62.9.172;d;2pkt 2fpkt", shape=diamond, color=yellow];
stat86[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.109.40.145:4675, 217.62.9.128:80}[25%]&lt;BR/&gt;{141.109.40.145:4695, 217.62.9.128:80}[25%]&lt;BR/&gt;{141.109.40.145:4679, 217.62.9.172:1755}[25%]&lt;BR/&gt;{141.109.40.145:4692, 217.62.9.172:1755}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1755: (35.7143%)&lt;BR/&gt; 4679: (21.4286%)&lt;BR/&gt; 4692: (14.2857%)&lt;BR/&gt; 80: (14.2857%)&lt;BR/&gt; 4695: (7.14286%)&gt;];
}
29--245[label="1;1pkt 1fpkt"];
29--350[label="1;1pkt 1fpkt"];
245--350[label="1;2pkt 2fpkt"];
245--1608[label="0.5;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="217.62.9.172" dst_port="1755" src_ip="141.109.40.145" src_port="4692"/>
      <filter dst_ip="217.62.9.172" dst_port="1755" src_ip="141.109.40.145" src_port="4679"/>
      <filter dst_ip="217.62.9.128" dst_port="80" src_ip="141.109.40.145" src_port="4695"/>
      <filter dst_ip="217.62.9.128" dst_port="80" src_ip="141.109.40.145" src_port="4675"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049432598" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.851449,1.42124,020,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_87{
style=filled;
color=gray75;
138[label="216.50.138.235d;1pkt 1fpkt", shape=rectangle, color=red];
209[label="165.236.167.116;s;852pkt 852fpkt", shape=diamond, color=yellow];
353[label="4.11.162.235;d;3pkt 3fpkt", shape=diamond, color=yellow];
635[label="202.235.235.184;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat87[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.236.167.116:0, *:0}[99.7658%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
138--209[label="1;1pkt 1fpkt"];
138--353[label="1;1pkt 1fpkt"];
209--353[label="0.333333;1pkt 1fpkt"];
209--635[label="1;1pkt 1fpkt"];
353--1195[label="0.333333;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="165.236.167.116"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="202.224.154.192"/>
      <from sec="1049432400" usec="0"/>
      <to sec="1049433228" usec="0"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_91{
style=filled;
color=gray75;
381[label="199.71.33.244;d;1pkt 1fpkt", shape=diamond, color=yellow];
382[label="165.236.199.238;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat91[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.236.199.238:3551, 199.71.33.244:1755}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3551: (50%)&lt;BR/&gt; 1755: (50%)&gt;];
}
381--382[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="199.71.33.244" dst_port="1755" src_ip="165.236.199.238" src_port="3551"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="219.170.247.48"/>
      <from sec="1049432400" usec="0"/>
      <to sec="1049433138" usec="0"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433138" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.843005,1.37529,010,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_93{
style=filled;
color=gray75;
398[label="4.16.89.243;d;580pkt 580fpkt", shape=diamond, color=yellow];
400[label="141.109.44.185;s;580pkt 580fpkt", shape=diamond, color=yellow];
1392[label="141.109.44.185;s;485pkt 485fpkt", shape=hexagon, color=black];
2217[label="141.109.44.185;6pkt 6fpkt", shape=pentagon, color=darkviolet];
2728[label="141.109.44.185;6pkt 6fpkt", shape=invtriangle, color=brown];
stat93[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.109.44.185:*, 4.16.89.243:1021}[50.4274%]&lt;BR/&gt;{141.109.44.185:*, 4.16.89.243:80}[49.4017%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1021: (25.3168%)&lt;BR/&gt; 80: (24.5926%)&lt;BR/&gt; 0: (0.18105%)&lt;BR/&gt; 3096: (0.150875%)&lt;BR/&gt; 4902: (0.090525%)&gt;];
}
398--400[label="1;580pkt 580fpkt"];
398--1392[label="1;485pkt 485fpkt"];
398--1608[label="0.0362069;21pkt 21fpkt"];
398--2217[label="0.166667;1pkt 1fpkt"];
398--2728[label="0.166667;1pkt 1fpkt"];
400--1392[label="1;485pkt 485fpkt"];
400--1608[label="0.0362069;21pkt 21fpkt"];
400--2217[label="0.166667;1pkt 1fpkt"];
400--2728[label="0.166667;1pkt 1fpkt"];
1392--1608[label="0.043299;21pkt 21fpkt"];
1392--2217[label="0.166667;1pkt 1fpkt"];
1392--2728[label="0.166667;1pkt 1fpkt"];
2217--2728[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="4.16.89.243" dst_port="1021" src_ip="141.109.44.185"/>
      <filter dst_ip="4.16.89.243" dst_port="80" src_ip="141.109.44.185"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_95{
style=filled;
color=gray75;
403[label="212.76.235.100;d;1pkt 1fpkt", shape=diamond, color=yellow];
404[label="165.45.244.78;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat95[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.45.244.78:49188, 212.76.235.100:20482}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 49188: (50%)&lt;BR/&gt; 20482: (50%)&gt;];
}
403--404[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="212.76.235.100" dst_port="20482" src_ip="165.45.244.78" src_port="49188"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_96{
style=filled;
color=gray75;
438[label="199.243.215.73;d;2pkt 2fpkt", shape=diamond, color=yellow];
439[label="178.184.85.10;s;4pkt 4fpkt", shape=diamond, color=yellow];
stat96[shape=component, label=&lt;Rules:&lt;BR/&gt;{178.184.85.10:1045, 212.40.104.83:5050}[25%]&lt;BR/&gt;{178.184.85.10:1043, 205.215.55.221:1863}[25%]&lt;BR/&gt;{178.184.85.10:1188, 199.243.215.73:7070}[25%]&lt;BR/&gt;{178.184.85.10:6970, 199.243.215.73:6770}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7070: (16.6667%)&lt;BR/&gt; 6970: (16.6667%)&lt;BR/&gt; 6770: (16.6667%)&lt;BR/&gt; 1188: (16.6667%)&lt;BR/&gt; 5050: (8.33333%)&gt;];
}
438--439[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="199.243.215.73" dst_port="6770" src_ip="178.184.85.10" src_port="6970"/>
      <filter dst_ip="199.243.215.73" dst_port="7070" src_ip="178.184.85.10" src_port="1188"/>
      <filter dst_ip="205.215.55.221" dst_port="1863" src_ip="178.184.85.10" src_port="1043"/>
      <filter dst_ip="212.40.104.83" dst_port="5050" src_ip="178.184.85.10" src_port="1045"/>
    </slice>
    <from sec="1049432402" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547021,1.37176,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_99{
style=filled;
color=gray75;
250[label="7.162.114.56;d;5pkt 5fpkt", shape=diamond, color=yellow];
362[label="160.225.130.219;s;158pkt 158fpkt", shape=diamond, color=yellow];
2303[label="160.225.130.219;167pkt 167fpkt", shape=pentagon, color=darkviolet];
stat99[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.130.219:*, *:80}[96.4072%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.1818%)&lt;BR/&gt; 443: (1.81818%)&lt;BR/&gt; 38888: (0.454545%)&lt;BR/&gt; 38865: (0.454545%)&lt;BR/&gt; 38864: (0.454545%)&gt;];
}
250--362[label="1;5pkt 5fpkt"];
250--1608[label="0.2;1pkt 1fpkt"];
250--2303[label="1;5pkt 5fpkt"];
362--441[label="0.0126582;2pkt 2fpkt"];
362--466[label="0.0915033;14pkt 14fpkt"];
362--561[label="0.0189873;3pkt 3fpkt"];
362--691[label="0.0126582;2pkt 2fpkt"];
362--694[label="0.0102041;1pkt 1fpkt"];
362--776[label="0.0126582;2pkt 2fpkt"];
362--790[label="0.00632911;1pkt 1fpkt"];
362--868[label="0.0105263;1pkt 1fpkt"];
362--923[label="0.0217391;1pkt 1fpkt"];
362--929[label="0.0075188;1pkt 1fpkt"];
362--1000[label="0.222222;6pkt 6fpkt"];
362--1129[label="0.0121951;1pkt 1fpkt"];
362--1305[label="0.0189873;3pkt 3fpkt"];
362--1438[label="0.0217391;1pkt 1fpkt"];
362--1519[label="0.0126582;2pkt 2fpkt"];
362--1608[label="0.0632911;10pkt 10fpkt"];
362--2303[label="1;158pkt 158fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="160.225.130.219"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.843005,1.37529,999,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_101{
style=filled;
color=gray75;
383[label="165.45.17.195;s;4pkt 4fpkt", shape=diamond, color=yellow];
505[label="51.113.212.124;d;1pkt 1fpkt", shape=diamond, color=yellow];
1289[label="51.113.212.124;d;1pkt 1fpkt", shape=hexagon, color=black];
2239[label="165.45.17.195;4pkt 4fpkt", shape=pentagon, color=darkviolet];
2740[label="165.45.17.195;3pkt 3fpkt", shape=invtriangle, color=brown];
stat101[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.45.17.195:21425, 4.243.50.3:4965}[25%]&lt;BR/&gt;{165.45.17.195:56722, 51.113.212.124:6699}[25%]&lt;BR/&gt;{165.45.17.195:57036, 83.139.27.197:6699}[25%]&lt;BR/&gt;{165.45.17.195:21425, 4.98.224.240:63264}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (26.9231%)&lt;BR/&gt; 21425: (23.0769%)&lt;BR/&gt; 56722: (19.2308%)&lt;BR/&gt; 63264: (11.5385%)&lt;BR/&gt; 4965: (11.5385%)&gt;];
}
383--505[label="1;1pkt 1fpkt"];
383--1289[label="1;1pkt 1fpkt"];
383--2239[label="1;4pkt 4fpkt"];
383--2740[label="1;3pkt 3fpkt"];
505--1289[label="1;1pkt 1fpkt"];
505--2239[label="1;1pkt 1fpkt"];
505--2740[label="1;1pkt 1fpkt"];
1289--2239[label="1;1pkt 1fpkt"];
1289--2740[label="1;1pkt 1fpkt"];
2239--2740[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="4.98.224.240" dst_port="63264" src_ip="165.45.17.195" src_port="21425"/>
      <filter dst_ip="83.139.27.197" dst_port="6699" src_ip="165.45.17.195" src_port="57036"/>
      <filter dst_ip="51.113.212.124" dst_port="6699" src_ip="165.45.17.195" src_port="56722"/>
      <filter dst_ip="4.243.50.3" dst_port="4965" src_ip="165.45.17.195" src_port="21425"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.888219,1.4348,999,0 0 0 1 1 0 0 0 0 0 1 0 ">
    <description>subgraph cluster_102{
style=filled;
color=gray75;
222[label="212.76.235.119;d;2pkt 2fpkt", shape=diamond, color=yellow];
343[label="160.225.0.245;s;1pkt 1fpkt", shape=diamond, color=yellow];
513[label="160.225.138.160;s;2pkt 2fpkt", shape=diamond, color=yellow];
1204[label="212.76.235.119;d;2pkt 2fpkt", shape=hexagon, color=black];
1227[label="160.225.0.245;s;1pkt 1fpkt", shape=hexagon, color=black];
2810[label="160.225.0.245;1pkt 1fpkt", shape=invtriangle, color=brown];
stat102[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.0.245:49172, 212.76.235.119:20808}[33.3333%]&lt;BR/&gt;{160.225.138.160:49523, 205.215.55.171:1863}[33.3333%]&lt;BR/&gt;{160.225.138.160:49159, 212.76.235.119:20980}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 49172: (27.7778%)&lt;BR/&gt; 20808: (27.7778%)&lt;BR/&gt; 49159: (16.6667%)&lt;BR/&gt; 20980: (16.6667%)&lt;BR/&gt; 49523: (5.55556%)&gt;];
}
222--343[label="1;1pkt 1fpkt"];
222--513[label="0.5;1pkt 1fpkt"];
222--1204[label="1;2pkt 2fpkt"];
222--1227[label="1;1pkt 1fpkt"];
222--2810[label="1;1pkt 1fpkt"];
343--1204[label="1;1pkt 1fpkt"];
343--1227[label="1;1pkt 1fpkt"];
343--2810[label="1;1pkt 1fpkt"];
513--1204[label="0.5;1pkt 1fpkt"];
1204--1227[label="1;1pkt 1fpkt"];
1204--2810[label="1;1pkt 1fpkt"];
1227--2810[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="212.76.235.119" dst_port="20980" src_ip="160.225.138.160" src_port="49159"/>
      <filter dst_ip="205.215.55.171" dst_port="1863" src_ip="160.225.138.160" src_port="49523"/>
      <filter dst_ip="212.76.235.119" dst_port="20808" src_ip="160.225.0.245" src_port="49172"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547021,1.37176,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_103{
style=filled;
color=gray75;
395[label="67.69.115.117;d;93pkt 93fpkt", shape=diamond, color=yellow];
516[label="160.225.209.25;s;102pkt 102fpkt", shape=diamond, color=yellow];
1698[label="160.225.209.25;102pkt 102fpkt", shape=pentagon, color=darkviolet];
stat103[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.209.25:*, 67.69.115.117:80}[91.1765%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2572: (0.505051%)&lt;BR/&gt; 2570: (0.505051%)&lt;BR/&gt; 2569: (0.505051%)&lt;BR/&gt; 2568: (0.505051%)&gt;];
}
395--516[label="1;93pkt 93fpkt"];
395--1608[label="0.0752688;7pkt 7fpkt"];
395--1698[label="1;93pkt 93fpkt"];
516--869[label="0.0882353;9pkt 9fpkt"];
516--1477[label="0.102273;9pkt 9fpkt"];
516--1608[label="0.0686275;7pkt 7fpkt"];
516--1698[label="1;102pkt 102fpkt"];
</description>
    <slice>
      <filter dst_ip="67.69.115.117" dst_port="80" src_ip="160.225.209.25"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049432732" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_104{
style=filled;
color=gray75;
521[label="214.79.29.241;s;1750pkt 1750fpkt", shape=diamond, color=yellow];
stat104[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.79.29.241:4139, *:1434}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4139: (50%)&lt;BR/&gt; 1434: (50%)&gt;];
}
521--682[label="0.00111732;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="1434" src_ip="214.79.29.241" src_port="4139"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_106{
style=filled;
color=gray75;
433[label="203.86.85.151;d;15pkt 15fpkt", shape=diamond, color=yellow];
1400[label="203.86.85.151;d;15pkt 15fpkt", shape=hexagon, color=black];
stat106[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.167.3.126:*, 203.86.85.151:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.6667%)&lt;BR/&gt; 62456: (3.33333%)&lt;BR/&gt; 54299: (3.33333%)&lt;BR/&gt; 53085: (3.33333%)&lt;BR/&gt; 49765: (3.33333%)&gt;];
}
433--559[label="1;1pkt 1fpkt"];
433--1400[label="1;15pkt 15fpkt"];
433--1608[label="0.133333;2pkt 2fpkt"];
433--1756[label="0.0666667;1pkt 1fpkt"];
1400--1608[label="0.133333;2pkt 2fpkt"];
1400--1756[label="0.0666667;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="203.86.85.151" dst_port="80" src_ip="212.167.3.126"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433224" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_107{
style=filled;
color=gray75;
808[label="4.18.27.239;d;17pkt 17fpkt", shape=diamond, color=yellow];
stat107[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.37.163:*, 4.18.27.239:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3776: (2.94118%)&lt;BR/&gt; 3775: (2.94118%)&lt;BR/&gt; 3774: (2.94118%)&lt;BR/&gt; 3773: (2.94118%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="4.18.27.239" dst_port="80" src_ip="160.225.37.163"/>
    </slice>
    <from sec="1049432656" usec="0"/>
    <to sec="1049432842" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.851449,1.42124,999,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_110{
style=filled;
color=gray75;
20[label="141.3.165.100s;1pkt 1fpkt", shape=rectangle, color=red];
594[label="204.122.106.97;d;36pkt 36fpkt", shape=diamond, color=yellow];
595[label="141.3.165.100;s;36pkt 36fpkt", shape=diamond, color=yellow];
stat110[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.3.165.100:*, 204.122.106.97:20}[86.1111%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 20: (43.1507%)&lt;BR/&gt; 21: (4.10959%)&lt;BR/&gt; 113: (2.73973%)&lt;BR/&gt; 1837: (2.05479%)&lt;BR/&gt; 3115: (1.36986%)&gt;];
}
20--594[label="1;1pkt 1fpkt"];
20--595[label="1;1pkt 1fpkt"];
594--595[label="1;36pkt 36fpkt"];
</description>
    <slice>
      <filter dst_ip="204.122.106.97" dst_port="20" src_ip="141.3.165.100"/>
    </slice>
    <from sec="1049432436" usec="0"/>
    <to sec="1049432899" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.784275,1.38078,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_111{
style=filled;
color=gray75;
625[label="130.173.17.186;d;3pkt 3fpkt", shape=diamond, color=yellow];
626[label="178.184.165.47;s;6pkt 6fpkt", shape=diamond, color=yellow];
1415[label="130.173.17.186;d;3pkt 3fpkt", shape=hexagon, color=black];
1779[label="178.184.165.47;7pkt 7fpkt", shape=pentagon, color=darkviolet];
stat111[shape=component, label=&lt;Rules:&lt;BR/&gt;{178.184.165.47:1626, 130.173.17.186:*}[42.8571%]&lt;BR/&gt;{178.184.165.47:*, 132.65.236.135:1626}[28.5714%]&lt;BR/&gt;{178.184.165.47:*, 213.144.107.251:6668}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1626: (42.1053%)&lt;BR/&gt; 1758: (10.5263%)&lt;BR/&gt; 1755: (10.5263%)&lt;BR/&gt; 1754: (10.5263%)&lt;BR/&gt; 6668: (7.89474%)&gt;];
}
625--626[label="1;3pkt 3fpkt"];
625--1415[label="1;3pkt 3fpkt"];
625--1779[label="1;3pkt 3fpkt"];
626--1415[label="1;3pkt 3fpkt"];
626--1779[label="1;6pkt 6fpkt"];
1415--1779[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="130.173.17.186" src_ip="178.184.165.47" src_port="1626"/>
      <filter dst_ip="213.144.107.251" dst_port="6668" src_ip="178.184.165.47"/>
      <filter dst_ip="132.65.236.135" dst_port="1626" src_ip="178.184.165.47"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433285" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_112{
style=filled;
color=gray75;
511[label="165.236.131.23;d;32pkt 32fpkt", shape=diamond, color=yellow];
640[label="203.168.43.208;s;3pkt 3fpkt", shape=diamond, color=yellow];
2271[label="203.168.43.208;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2356[label="67.185.133.241;24pkt 24fpkt", shape=pentagon, color=darkviolet];
2755[label="203.168.43.208;1pkt 1fpkt", shape=invtriangle, color=brown];
2802[label="67.185.133.241;24pkt 24fpkt", shape=invtriangle, color=brown];
3061[label="67.185.133.241;24pkt 24fpkt", shape=invhouse, color=bisque];
stat112[shape=component, label=&lt;Rules:&lt;BR/&gt;{67.185.133.241:80, 165.236.131.23:*}[64.8649%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (41.7431%)&lt;BR/&gt; 1061: (3.66972%)&lt;BR/&gt; 2229: (3.21101%)&lt;BR/&gt; 2234: (1.83486%)&lt;BR/&gt; 2228: (1.83486%)&gt;];
}
511--640[label="1;3pkt 3fpkt"];
511--2271[label="1;1pkt 1fpkt"];
511--2356[label="0.791667;19pkt 19fpkt"];
511--2755[label="1;1pkt 1fpkt"];
511--2802[label="0.791667;19pkt 19fpkt"];
511--3061[label="0.791667;19pkt 19fpkt"];
640--2271[label="1;1pkt 1fpkt"];
640--2755[label="1;1pkt 1fpkt"];
2271--2755[label="1;1pkt 1fpkt"];
2356--2802[label="1;24pkt 24fpkt"];
2356--3061[label="1;24pkt 24fpkt"];
2802--3061[label="1;24pkt 24fpkt"];
</description>
    <slice>
      <filter dst_ip="165.236.131.23" src_ip="67.185.133.241" src_port="80"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.888219,1.4348,999,0 0 0 1 1 0 0 0 0 0 1 0 ">
    <description>subgraph cluster_113{
style=filled;
color=gray75;
647[label="69.100.33.121;d;1pkt 1fpkt", shape=diamond, color=yellow];
1356[label="69.100.33.121;d;1pkt 1fpkt", shape=hexagon, color=black];
2569[label="141.109.111.89;1pkt 1fpkt", shape=invtriangle, color=brown];
stat113[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.109.111.89:1257, 69.100.33.121:6699}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 1257: (50%)&gt;];
}
647--648[label="1;1pkt 1fpkt"];
647--1356[label="1;1pkt 1fpkt"];
647--2569[label="1;1pkt 1fpkt"];
1356--2569[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="69.100.33.121" dst_port="6699" src_ip="141.109.111.89" src_port="1257"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="143.43.156.127"/>
      <from sec="1049432400" usec="0"/>
      <to sec="1049433225" usec="0"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433225" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_115{
style=filled;
color=gray75;
703[label="212.45.1.30;d;222pkt 222fpkt", shape=diamond, color=yellow];
1192[label="178.184.122.22;s;59pkt 59fpkt", shape=diamond, color=yellow];
1685[label="178.184.122.22;62pkt 62fpkt", shape=pentagon, color=darkviolet];
2427[label="178.184.122.22;61pkt 61fpkt", shape=invtriangle, color=brown];
2852[label="178.184.122.22;62pkt 62fpkt", shape=invhouse, color=bisque];
stat115[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.10.11:*, 212.45.1.30:80}[38.326%]&lt;BR/&gt;{178.184.122.22:*, 212.45.1.30:80}[26.4317%]&lt;BR/&gt;{160.225.23.214:*, 212.45.1.30:80}[23.348%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2649: (0.536481%)&lt;BR/&gt; 2647: (0.536481%)&lt;BR/&gt; 2646: (0.536481%)&lt;BR/&gt; 2645: (0.536481%)&gt;];
}
703--729[label="0.6;6pkt 6fpkt"];
703--777[label="0.0442478;5pkt 5fpkt"];
703--954[label="0.465241;87pkt 87fpkt"];
703--1192[label="0.966102;57pkt 57fpkt"];
703--1322[label="0.6;6pkt 6fpkt"];
703--1608[label="0.0045045;1pkt 1fpkt"];
703--1636[label="0.114286;4pkt 4fpkt"];
703--1685[label="0.919355;57pkt 57fpkt"];
703--2294[label="0.0420168;5pkt 5fpkt"];
703--2328[label="0.0652174;6pkt 6fpkt"];
703--2427[label="0.934426;57pkt 57fpkt"];
703--2852[label="0.919355;57pkt 57fpkt"];
1192--1685[label="1;59pkt 59fpkt"];
1192--2427[label="0.983051;58pkt 58fpkt"];
1192--2852[label="1;59pkt 59fpkt"];
1685--2427[label="1;61pkt 61fpkt"];
1685--2852[label="1;62pkt 62fpkt"];
2427--2852[label="1;61pkt 61fpkt"];
</description>
    <slice>
      <filter dst_ip="212.45.1.30" dst_port="80" src_ip="160.225.10.11"/>
      <filter dst_ip="212.45.1.30" dst_port="80" src_ip="178.184.122.22"/>
      <filter dst_ip="212.45.1.30" dst_port="80" src_ip="160.225.23.214"/>
    </slice>
    <from sec="1049432462" usec="0"/>
    <to sec="1049433295" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.851449,1.42124,999,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_116{
style=filled;
color=gray75;
49[label="178.184.122.22s;2pkt 2fpkt", shape=rectangle, color=red];
695[label="170.29.19.199;d;1pkt 1fpkt", shape=diamond, color=yellow];
696[label="160.225.101.130;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat116[shape=component, label=&lt;Rules:&lt;BR/&gt;{178.184.122.22:2631, 212.45.1.31:80}[50%]&lt;BR/&gt;{160.225.101.130:2718, 170.29.19.199:1082}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2718: (37.5%)&lt;BR/&gt; 1082: (37.5%)&lt;BR/&gt; 2631: (12.5%)&lt;BR/&gt; 80: (12.5%)&gt;];
}
49--695[label="1;1pkt 1fpkt"];
49--696[label="1;1pkt 1fpkt"];
49--1192[label="0.5;1pkt 1fpkt"];
49--1685[label="0.5;1pkt 1fpkt"];
49--2852[label="0.5;1pkt 1fpkt"];
695--696[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="170.29.19.199" dst_port="1082" src_ip="160.225.101.130" src_port="2718"/>
      <filter dst_ip="212.45.1.31" dst_port="80" src_ip="178.184.122.22" src_port="2631"/>
    </slice>
    <from sec="1049432414" usec="0"/>
    <to sec="1049433216" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_117{
style=filled;
color=gray75;
387[label="165.236.213.126;s;152pkt 152fpkt", shape=diamond, color=yellow];
699[label="219.60.141.12;d;3pkt 3fpkt", shape=diamond, color=yellow];
1341[label="219.60.141.12;d;1pkt 1fpkt", shape=hexagon, color=black];
stat117[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.236.213.126:*, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 60000: (6.41026%)&lt;BR/&gt; 31888: (4.80769%)&lt;BR/&gt; 13156: (4.80769%)&lt;BR/&gt; 5588: (4.80769%)&lt;BR/&gt; 7341: (4.48718%)&gt;];
}
387--699[label="1;3pkt 3fpkt"];
387--1341[label="1;1pkt 1fpkt"];
699--1341[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="165.236.213.126"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_118{
style=filled;
color=gray75;
711[label="165.236.131.213;d;8pkt 8fpkt", shape=diamond, color=yellow];
714[label="219.231.2.186;s;7pkt 7fpkt", shape=diamond, color=yellow];
stat118[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.231.2.186:80, 165.236.131.213:*}[87.5%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1115: (6.66667%)&lt;BR/&gt; 1110: (6.66667%)&lt;BR/&gt; 1109: (6.66667%)&lt;BR/&gt; 1108: (6.66667%)&gt;];
}
711--714[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="165.236.131.213" src_ip="219.231.2.186" src_port="80"/>
    </slice>
    <from sec="1049432537" usec="0"/>
    <to sec="1049432932" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_119{
style=filled;
color=gray75;
698[label="136.210.230.58;s;3pkt 3fpkt", shape=diamond, color=yellow];
717[label="215.150.26.213;d;2pkt 2fpkt", shape=diamond, color=yellow];
1830[label="136.210.230.58;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2513[label="136.210.230.58;3pkt 3fpkt", shape=invtriangle, color=brown];
2894[label="136.210.230.58;2pkt 2fpkt", shape=invhouse, color=bisque];
stat119[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.210.230.58:80, 202.74.180.69:1670}[33.3333%]&lt;BR/&gt;{136.210.230.58:80, 215.150.26.213:64238}[33.3333%]&lt;BR/&gt;{136.210.230.58:80, 215.150.26.213:64321}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 64321: (19.2308%)&lt;BR/&gt; 64238: (15.3846%)&lt;BR/&gt; 1670: (15.3846%)&gt;];
}
698--717[label="1;2pkt 2fpkt"];
698--1830[label="1;3pkt 3fpkt"];
698--2513[label="1;3pkt 3fpkt"];
698--2894[label="1;2pkt 2fpkt"];
717--1830[label="1;2pkt 2fpkt"];
717--2513[label="1;2pkt 2fpkt"];
717--2894[label="0.5;1pkt 1fpkt"];
1830--2513[label="1;3pkt 3fpkt"];
1830--2894[label="1;2pkt 2fpkt"];
2513--2894[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="215.150.26.213" dst_port="64321" src_ip="136.210.230.58" src_port="80"/>
      <filter dst_ip="215.150.26.213" dst_port="64238" src_ip="136.210.230.58" src_port="80"/>
      <filter dst_ip="202.74.180.69" dst_port="1670" src_ip="136.210.230.58" src_port="80"/>
    </slice>
    <from sec="1049432419" usec="0"/>
    <to sec="1049433135" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_120{
style=filled;
color=gray75;
721[label="7.162.114.57;d;1pkt 1fpkt", shape=diamond, color=yellow];
722[label="160.225.142.152;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat120[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.142.152:1323, 7.162.114.57:1755}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1755: (50%)&lt;BR/&gt; 1323: (50%)&gt;];
}
721--722[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="7.162.114.57" dst_port="1755" src_ip="160.225.142.152" src_port="1323"/>
    </slice>
    <from sec="1049432635" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_122{
style=filled;
color=gray75;
734[label="220.201.59.211;d;8pkt 8fpkt", shape=diamond, color=yellow];
735[label="202.26.42.238;s;8pkt 8fpkt", shape=diamond, color=yellow];
1378[label="202.26.42.238;s;3pkt 3fpkt", shape=hexagon, color=black];
stat122[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.26.42.238:*, 220.201.59.211:554}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 554: (50%)&lt;BR/&gt; 1177: (7.89474%)&lt;BR/&gt; 1160: (7.89474%)&lt;BR/&gt; 1153: (7.89474%)&lt;BR/&gt; 1221: (5.26316%)&gt;];
}
734--735[label="1;8pkt 8fpkt"];
734--1378[label="1;3pkt 3fpkt"];
735--1378[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="220.201.59.211" dst_port="554" src_ip="202.26.42.238"/>
    </slice>
    <from sec="1049432717" usec="0"/>
    <to sec="1049433179" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_123{
style=filled;
color=gray75;
739[label="202.224.154.192;d;102pkt 102fpkt", shape=diamond, color=yellow];
stat123[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 202.224.154.192:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
739--761[label="0.00980392;1pkt 1fpkt"];
739--2103[label="0.012987;1pkt 1fpkt"];
739--2193[label="0.00980392;1pkt 1fpkt"];
739--2719[label="0.00980392;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="202.224.154.192"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.628332,1.36623,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_124{
style=filled;
color=gray75;
262[label="165.236.208.146;s;244pkt 244fpkt", shape=diamond, color=yellow];
338[label="4.133.185.148;d;2pkt 2fpkt", shape=diamond, color=yellow];
746[label="69.87.236.142;d;1pkt 1fpkt", shape=diamond, color=yellow];
1110[label="215.149.137.250;d;4pkt 4fpkt", shape=diamond, color=yellow];
2102[label="165.236.208.146;259pkt 259fpkt", shape=pentagon, color=darkviolet];
2673[label="165.236.208.146;259pkt 259fpkt", shape=invtriangle, color=brown];
stat124[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.236.208.146:*, *:1214}[48.8462%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1214: (24.3823%)&lt;BR/&gt; 2369: (3.70611%)&lt;BR/&gt; 2834: (2.08062%)&lt;BR/&gt; 3805: (1.75553%)&lt;BR/&gt; 2591: (1.69051%)&gt;];
}
262--338[label="1;2pkt 2fpkt"];
262--746[label="1;1pkt 1fpkt"];
262--1110[label="0.75;3pkt 3fpkt"];
262--2102[label="1;244pkt 244fpkt"];
262--2673[label="1;244pkt 244fpkt"];
338--2102[label="1;2pkt 2fpkt"];
338--2673[label="1;2pkt 2fpkt"];
746--2102[label="1;1pkt 1fpkt"];
746--2673[label="1;1pkt 1fpkt"];
1110--2102[label="0.75;3pkt 3fpkt"];
1110--2673[label="0.75;3pkt 3fpkt"];
2102--2673[label="1;259pkt 259fpkt"];
</description>
    <slice>
      <filter dst_port="1214" src_ip="165.236.208.146"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.843005,1.37529,999,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_125{
style=filled;
color=gray75;
481[label="198.168.208.119;d;3pkt 3fpkt", shape=diamond, color=yellow];
829[label="136.210.214.64;s;2pkt 2fpkt", shape=diamond, color=yellow];
1131[label="136.210.219.153;s;3pkt 3fpkt", shape=diamond, color=yellow];
1278[label="198.168.208.119;d;3pkt 3fpkt", shape=hexagon, color=black];
1384[label="136.210.214.64;s;2pkt 2fpkt", shape=hexagon, color=black];
2127[label="136.210.219.153;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2684[label="136.210.219.153;3pkt 3fpkt", shape=invtriangle, color=brown];
stat125[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 198.168.208.119:6667}[50%]&lt;BR/&gt;{136.210.219.153:*, *:*}[50%]&lt;BR/&gt;{*:*, *:5190}[33.3333%]&lt;BR/&gt;{136.210.214.64:*, *:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (28.9474%)&lt;BR/&gt; 5190: (13.1579%)&lt;BR/&gt; 1170: (13.1579%)&lt;BR/&gt; 27024: (10.5263%)&lt;BR/&gt; 5050: (7.89474%)&gt;];
}
481--749[label="0.5;1pkt 1fpkt"];
481--829[label="0.5;1pkt 1fpkt"];
481--1131[label="0.333333;1pkt 1fpkt"];
481--1278[label="1;3pkt 3fpkt"];
481--1384[label="0.5;1pkt 1fpkt"];
481--2098[label="0.5;1pkt 1fpkt"];
481--2127[label="0.333333;1pkt 1fpkt"];
481--2684[label="0.333333;1pkt 1fpkt"];
829--1278[label="0.5;1pkt 1fpkt"];
829--1384[label="1;2pkt 2fpkt"];
1131--1278[label="0.333333;1pkt 1fpkt"];
1131--2127[label="1;3pkt 3fpkt"];
1131--2684[label="1;3pkt 3fpkt"];
1278--1384[label="0.5;1pkt 1fpkt"];
1278--2098[label="0.5;1pkt 1fpkt"];
1278--2127[label="0.333333;1pkt 1fpkt"];
1278--2684[label="0.333333;1pkt 1fpkt"];
2127--2684[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter src_ip="136.210.219.153"/>
      <filter src_ip="136.210.214.64"/>
      <filter dst_port="5190"/>
      <filter dst_ip="198.168.208.119" dst_port="6667"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.628332,1.36623,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_126{
style=filled;
color=gray75;
334[label="136.210.201.54;s;207pkt 207fpkt", shape=diamond, color=yellow];
1807[label="136.210.201.54;213pkt 213fpkt", shape=pentagon, color=darkviolet];
2499[label="136.210.201.54;214pkt 214fpkt", shape=invtriangle, color=brown];
stat126[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.210.201.54:*, *:25}[88.785%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (45.2681%)&lt;BR/&gt; 113: (4.73186%)&lt;BR/&gt; 2518: (0.473186%)&lt;BR/&gt; 2419: (0.473186%)&lt;BR/&gt; 57522: (0.236593%)&gt;];
}
334--753[label="0.0434783;3pkt 3fpkt"];
334--967[label="0.0227273;1pkt 1fpkt"];
334--1443[label="0.0810811;3pkt 3fpkt"];
334--1480[label="0.027027;1pkt 1fpkt"];
334--1807[label="0.995169;206pkt 206fpkt"];
334--2499[label="1;207pkt 207fpkt"];
1807--2499[label="1;213pkt 213fpkt"];
</description>
    <slice>
      <filter dst_port="25" src_ip="136.210.201.54"/>
    </slice>
    <from sec="1049432428" usec="0"/>
    <to sec="1049433295" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_127{
style=filled;
color=gray75;
767[label="165.236.218.196;d;1pkt 1fpkt", shape=diamond, color=yellow];
769[label="221.41.2.248;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat127[shape=component, label=&lt;Rules:&lt;BR/&gt;{221.41.2.248:411, 165.236.218.196:4102}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4102: (50%)&lt;BR/&gt; 411: (50%)&gt;];
}
767--769[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="165.236.218.196" dst_port="4102" src_ip="221.41.2.248" src_port="411"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="165.236.208.21"/>
      <from sec="1049432401" usec="0"/>
      <to sec="1049433206" usec="0"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433206" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.861544,1.35556,010,1 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_129{
style=filled;
color=gray75;
61[label="202.172.41.165s;4pkt 4fpkt", shape=rectangle, color=red];
772[label="202.172.41.165;s;139pkt 139fpkt", shape=diamond, color=yellow];
895[label="182.141.76.126;d;1362pkt 1362fpkt", shape=diamond, color=yellow];
2159[label="202.172.41.165;141pkt 141fpkt", shape=pentagon, color=darkviolet];
2699[label="202.172.41.165;141pkt 141fpkt", shape=invtriangle, color=brown];
stat129[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.22.162.10:*, 182.141.76.126:80}[66.5309%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.7202%)&lt;BR/&gt; 41732: (0.111919%)&lt;BR/&gt; 41731: (0.111919%)&lt;BR/&gt; 41730: (0.111919%)&lt;BR/&gt; 41729: (0.111919%)&gt;];
}
61--772[label="1;4pkt 4fpkt"];
61--2159[label="1;4pkt 4fpkt"];
61--2699[label="1;4pkt 4fpkt"];
772--776[label="0.00719424;1pkt 1fpkt"];
772--788[label="0.0105263;1pkt 1fpkt"];
772--868[label="0.0210526;2pkt 2fpkt"];
772--895[label="0.215827;30pkt 30fpkt"];
772--921[label="0.0434783;3pkt 3fpkt"];
772--929[label="0.0075188;1pkt 1fpkt"];
772--939[label="0.00970874;1pkt 1fpkt"];
772--956[label="0.0379747;3pkt 3fpkt"];
772--1012[label="0.015873;1pkt 1fpkt"];
772--1036[label="0.0806452;5pkt 5fpkt"];
772--1148[label="0.0144928;2pkt 2fpkt"];
772--1155[label="0.010101;1pkt 1fpkt"];
772--1255[label="0.0143885;2pkt 2fpkt"];
772--1368[label="0.0222222;1pkt 1fpkt"];
772--1372[label="0.0298507;2pkt 2fpkt"];
772--1403[label="1;84pkt 84fpkt"];
772--1437[label="0.00719424;1pkt 1fpkt"];
772--1458[label="0.010101;1pkt 1fpkt"];
772--1460[label="0.129496;18pkt 18fpkt"];
772--1520[label="0.00719424;1pkt 1fpkt"];
772--1552[label="0.010101;1pkt 1fpkt"];
772--1608[label="0.0215827;3pkt 3fpkt"];
772--2159[label="1;139pkt 139fpkt"];
772--2699[label="1;139pkt 139fpkt"];
895--1201[label="0.71953;980pkt 980fpkt"];
895--1211[label="0.0991189;135pkt 135fpkt"];
895--1578[label="0.71953;980pkt 980fpkt"];
895--2159[label="0.212766;30pkt 30fpkt"];
895--2209[label="0.0991189;135pkt 135fpkt"];
895--2213[label="0.15859;216pkt 216fpkt"];
895--2401[label="0.71953;980pkt 980fpkt"];
895--2699[label="0.212766;30pkt 30fpkt"];
895--2833[label="0.71953;980pkt 980fpkt"];
2159--2699[label="1;141pkt 141fpkt"];
</description>
    <slice>
      <filter dst_ip="182.141.76.126" dst_port="80" src_ip="202.22.162.10"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_130{
style=filled;
color=gray75;
629[label="202.212.68.92;d;9pkt 9fpkt", shape=diamond, color=yellow];
781[label="136.210.200.24;s;256pkt 256fpkt", shape=diamond, color=yellow];
1011[label="136.210.204.101;s;2pkt 2fpkt", shape=diamond, color=yellow];
stat130[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.210.200.24:*, 221.68.78.2:6667}[24.7104%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (35.0187%)&lt;BR/&gt; 113: (6.55431%)&lt;BR/&gt; 8081: (1.1236%)&lt;BR/&gt; 8080: (1.1236%)&lt;BR/&gt; 3128: (1.1236%)&gt;];
}
629--781[label="0.777778;7pkt 7fpkt"];
629--930[label="0.333333;1pkt 1fpkt"];
629--1011[label="0.5;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="221.68.78.2" dst_port="6667" src_ip="136.210.200.24"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433226" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547021,1.37176,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_131{
style=filled;
color=gray75;
736[label="160.225.235.89;s;86pkt 86fpkt", shape=diamond, color=yellow];
817[label="219.197.104.72;d;9pkt 9fpkt", shape=diamond, color=yellow];
1922[label="160.225.235.89;85pkt 85fpkt", shape=pentagon, color=darkviolet];
stat131[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.235.89:*, *:80}[81.3953%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (41.3889%)&lt;BR/&gt; 32769: (8.61111%)&lt;BR/&gt; 53: (8.61111%)&lt;BR/&gt; 33493: (0.833333%)&lt;BR/&gt; 33490: (0.833333%)&gt;];
}
736--817[label="1;9pkt 9fpkt"];
736--863[label="0.0181818;1pkt 1fpkt"];
736--1021[label="0.0232558;1pkt 1fpkt"];
736--1024[label="0.0172414;1pkt 1fpkt"];
736--1450[label="0.0243902;1pkt 1fpkt"];
736--1922[label="1;85pkt 85fpkt"];
817--1922[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="160.225.235.89"/>
    </slice>
    <from sec="1049432734" usec="0"/>
    <to sec="1049433068" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_132{
style=filled;
color=gray75;
331[label="203.86.86.88;d;31pkt 31fpkt", shape=diamond, color=yellow];
332[label="202.11.131.34;s;25pkt 25fpkt", shape=diamond, color=yellow];
823[label="202.11.131.37;s;2pkt 2fpkt", shape=diamond, color=yellow];
stat132[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.11.131.34:80, 203.86.86.88:*}[80.6452%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.5517%)&lt;BR/&gt; 64108: (1.72414%)&lt;BR/&gt; 1165: (1.72414%)&lt;BR/&gt; 1164: (1.72414%)&lt;BR/&gt; 1163: (1.72414%)&gt;];
}
331--332[label="1;25pkt 25fpkt"];
331--823[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="203.86.86.88" src_ip="202.11.131.34" src_port="80"/>
    </slice>
    <from sec="1049432413" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_133{
style=filled;
color=gray75;
825[label="160.225.210.110;s;156pkt 156fpkt", shape=diamond, color=yellow];
826[label="186.39.164.224;d;73pkt 73fpkt", shape=diamond, color=yellow];
1380[label="186.39.164.224;d;73pkt 73fpkt", shape=hexagon, color=black];
stat133[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.210.110:*, 186.39.164.224:80}[66.0256%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1836: (0.496689%)&lt;BR/&gt; 1835: (0.496689%)&lt;BR/&gt; 1834: (0.496689%)&lt;BR/&gt; 1833: (0.496689%)&gt;];
}
825--826[label="1;73pkt 73fpkt"];
825--1380[label="1;73pkt 73fpkt"];
826--1380[label="1;73pkt 73fpkt"];
</description>
    <slice>
      <filter dst_ip="186.39.164.224" dst_port="80" src_ip="160.225.210.110"/>
    </slice>
    <from sec="1049432787" usec="0"/>
    <to sec="1049433218" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547021,1.37176,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_134{
style=filled;
color=gray75;
827[label="32.65.138.11;d;4pkt 4fpkt", shape=diamond, color=yellow];
828[label="165.200.86.148;s;6pkt 6fpkt", shape=diamond, color=yellow];
2109[label="165.200.86.148;9pkt 9fpkt", shape=pentagon, color=darkviolet];
stat134[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.200.86.148:80, 32.65.138.11:*}[44.4444%]&lt;BR/&gt;{165.200.86.148:80, 64.97.165.206:*}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.3684%)&lt;BR/&gt; 1414: (7.89474%)&lt;BR/&gt; 1413: (7.89474%)&lt;BR/&gt; 1412: (7.89474%)&lt;BR/&gt; 1411: (7.89474%)&gt;];
}
827--828[label="1;4pkt 4fpkt"];
827--2109[label="1;4pkt 4fpkt"];
828--2109[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="32.65.138.11" src_ip="165.200.86.148" src_port="80"/>
      <filter dst_ip="64.97.165.206" src_ip="165.200.86.148" src_port="80"/>
    </slice>
    <from sec="1049432523" usec="0"/>
    <to sec="1049433293" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="202.22.163.187"/>
      <from sec="1049432400" usec="0"/>
      <to sec="1049433228" usec="0"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_136{
style=filled;
color=gray75;
847[label="141.109.163.101;s;1pkt 1fpkt", shape=diamond, color=yellow];
848[label="64.194.69.60;d;1pkt 1fpkt", shape=diamond, color=yellow];
1396[label="141.109.163.101;s;1pkt 1fpkt", shape=hexagon, color=black];
stat136[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.109.163.101:3173, 64.194.69.60:6699}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 3173: (50%)&gt;];
}
847--848[label="1;1pkt 1fpkt"];
847--1396[label="1;1pkt 1fpkt"];
848--1396[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="64.194.69.60" dst_port="6699" src_ip="141.109.163.101" src_port="3173"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433224" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="4.55.219.5"/>
      <from sec="1049432400" usec="0"/>
      <to sec="1049433227" usec="0"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="202.172.41.161"/>
      <from sec="1049432401" usec="0"/>
      <to sec="1049433227" usec="0"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_140{
style=filled;
color=gray75;
279[label="141.109.163.100;d;31pkt 31fpkt", shape=diamond, color=yellow];
499[label="51.108.24.129;s;1pkt 1fpkt", shape=diamond, color=yellow];
634[label="4.101.142.58;s;1pkt 1fpkt", shape=diamond, color=yellow];
680[label="141.109.154.40;d;115pkt 115fpkt", shape=diamond, color=yellow];
1427[label="141.109.163.100;d;31pkt 31fpkt", shape=hexagon, color=black];
1468[label="212.73.44.147;s;47pkt 47fpkt", shape=hexagon, color=black];
stat140[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.132.179.221:80, 141.109.154.40:*}[27.0115%]&lt;BR/&gt;{212.73.44.147:80, *:*}[27.0115%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.3451%)&lt;BR/&gt; 0: (0.884956%)&lt;BR/&gt; 29224: (0.663717%)&lt;BR/&gt; 4619: (0.663717%)&lt;BR/&gt; 4292: (0.663717%)&gt;];
}
279--499[label="1;1pkt 1fpkt"];
279--634[label="1;1pkt 1fpkt"];
279--860[label="0.0322581;1pkt 1fpkt"];
279--1427[label="1;31pkt 31fpkt"];
279--1468[label="0.0322581;1pkt 1fpkt"];
499--1427[label="1;1pkt 1fpkt"];
634--1427[label="1;1pkt 1fpkt"];
680--860[label="0.375;18pkt 18fpkt"];
680--1468[label="0.382979;18pkt 18fpkt"];
680--2304[label="0.0588235;1pkt 1fpkt"];
1427--1468[label="0.0322581;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="212.73.44.147" src_port="80"/>
      <filter dst_ip="141.109.154.40" src_ip="202.132.179.221" src_port="80"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_142{
style=filled;
color=gray75;
834[label="202.22.180.236;s;459pkt 459fpkt", shape=diamond, color=yellow];
2348[label="202.22.180.236;507pkt 507fpkt", shape=pentagon, color=darkviolet];
2797[label="202.22.180.236;506pkt 506fpkt", shape=invtriangle, color=brown];
3058[label="202.22.180.236;506pkt 506fpkt", shape=invhouse, color=bisque];
stat142[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.22.180.236:53, *:*}[92.1105%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (56.0162%)&lt;BR/&gt; 0: (3.23559%)&lt;BR/&gt; 60631: (2.02224%)&lt;BR/&gt; 32768: (1.44085%)&lt;BR/&gt; 1024: (1.08696%)&gt;];
}
834--872[label="0.02;1pkt 1fpkt"];
834--1123[label="0.016129;1pkt 1fpkt"];
834--1479[label="0.02;1pkt 1fpkt"];
834--1607[label="0.00653595;3pkt 3fpkt"];
834--1617[label="0.00653595;3pkt 3fpkt"];
834--2348[label="1;459pkt 459fpkt"];
834--2797[label="0.997821;458pkt 458fpkt"];
834--3058[label="0.997821;458pkt 458fpkt"];
2348--2797[label="1;506pkt 506fpkt"];
2348--3058[label="1;506pkt 506fpkt"];
2797--3058[label="1;506pkt 506fpkt"];
</description>
    <slice>
      <filter src_ip="202.22.180.236" src_port="53"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_143{
style=filled;
color=gray75;
879[label="141.109.65.150;s;113pkt 113fpkt", shape=diamond, color=yellow];
908[label="219.81.155.200;d;113pkt 113fpkt", shape=diamond, color=yellow];
1490[label="141.109.65.150;s;113pkt 113fpkt", shape=hexagon, color=black];
stat143[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.109.65.150:*, 219.81.155.200:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3149: (0.442478%)&lt;BR/&gt; 3148: (0.442478%)&lt;BR/&gt; 3147: (0.442478%)&lt;BR/&gt; 3146: (0.442478%)&gt;];
}
879--908[label="1;113pkt 113fpkt"];
879--1490[label="1;113pkt 113fpkt"];
908--1490[label="1;113pkt 113fpkt"];
</description>
    <slice>
      <filter dst_ip="219.81.155.200" dst_port="80" src_ip="141.109.65.150"/>
    </slice>
    <from sec="1049432517" usec="0"/>
    <to sec="1049433016" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="214.32.162.97"/>
      <from sec="1049432400" usec="0"/>
      <to sec="1049433228" usec="0"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_145{
style=filled;
color=gray75;
920[label="214.79.29.241;d;78pkt 78fpkt", shape=diamond, color=yellow];
stat145[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 214.79.29.241:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
920--1041[label="0.0128205;1pkt 1fpkt"];
920--1474[label="0.0128205;1pkt 1fpkt"];
920--2103[label="0.012987;1pkt 1fpkt"];
920--2199[label="0.0128205;1pkt 1fpkt"];
920--2722[label="0.0128205;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="214.79.29.241"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_147{
style=filled;
color=gray75;
768[label="165.236.218.196;s;7pkt 7fpkt", shape=diamond, color=yellow];
941[label="221.41.2.248;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat147[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.236.218.196:*, 67.58.190.72:50000}[71.4286%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 50000: (31.25%)&lt;BR/&gt; 4102: (12.5%)&lt;BR/&gt; 411: (12.5%)&lt;BR/&gt; 19145: (6.25%)&lt;BR/&gt; 4513: (6.25%)&gt;];
}
768--941[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="67.58.190.72" dst_port="50000" src_ip="165.236.218.196"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="203.86.68.233"/>
      <from sec="1049432402" usec="0"/>
      <to sec="1049433228" usec="0"/>
    </slice>
    <from sec="1049432402" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_150{
style=filled;
color=gray75;
221[label="165.45.246.59;s;24pkt 24fpkt", shape=diamond, color=yellow];
405[label="161.0.157.193;d;1pkt 1fpkt", shape=diamond, color=yellow];
963[label="67.122.95.5;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat150[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.45.246.59:*, *:6881}[79.1667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6881: (40.3846%)&lt;BR/&gt; 5945: (3.84615%)&lt;BR/&gt; 4655: (3.84615%)&lt;BR/&gt; 53: (3.84615%)&lt;BR/&gt; 8091: (1.92308%)&gt;];
}
221--275[label="0.0416667;1pkt 1fpkt"];
221--292[label="1;1pkt 1fpkt"];
221--405[label="1;1pkt 1fpkt"];
221--963[label="1;1pkt 1fpkt"];
221--1219[label="1;1pkt 1fpkt"];
221--1425[label="0.0416667;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="6881" src_ip="165.45.246.59"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_153{
style=filled;
color=gray75;
1157[label="160.225.85.146;s;50pkt 50fpkt", shape=diamond, color=yellow];
stat153[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.85.146:*, 67.185.129.128:80}[34%]&lt;BR/&gt;{160.225.85.146:*, 67.185.129.139:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (40%)&lt;BR/&gt; 7001: (4%)&lt;BR/&gt; 1863: (3%)&lt;BR/&gt; 64593: (1%)&lt;BR/&gt; 64592: (1%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="67.185.129.128" dst_port="80" src_ip="160.225.85.146"/>
      <filter dst_ip="67.185.129.139" dst_port="80" src_ip="160.225.85.146"/>
    </slice>
    <from sec="1049432479" usec="0"/>
    <to sec="1049433227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547021,1.37176,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_154{
style=filled;
color=gray75;
900[label="178.184.139.67;s;147pkt 147fpkt", shape=diamond, color=yellow];
993[label="67.184.180.40;d;75pkt 75fpkt", shape=diamond, color=yellow];
1857[label="178.184.139.67;180pkt 180fpkt", shape=pentagon, color=darkviolet];
stat154[shape=component, label=&lt;Rules:&lt;BR/&gt;{178.184.139.67:*, 67.184.180.40:80}[54.4444%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 49782: (0.373134%)&lt;BR/&gt; 49780: (0.373134%)&lt;BR/&gt; 49779: (0.373134%)&lt;BR/&gt; 49778: (0.373134%)&gt;];
}
900--993[label="1;75pkt 75fpkt"];
900--1857[label="1;147pkt 147fpkt"];
993--1857[label="1;75pkt 75fpkt"];
</description>
    <slice>
      <filter dst_ip="67.184.180.40" dst_port="80" src_ip="178.184.139.67"/>
    </slice>
    <from sec="1049432810" usec="0"/>
    <to sec="1049433289" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_155{
style=filled;
color=gray75;
562[label="178.184.100.163;s;74pkt 74fpkt", shape=diamond, color=yellow];
610[label="202.182.105.74;d;1pkt 1fpkt", shape=diamond, color=yellow];
1002[label="203.71.140.39;d;8pkt 8fpkt", shape=diamond, color=yellow];
1462[label="178.184.100.163;s;74pkt 74fpkt", shape=hexagon, color=black];
1508[label="203.71.140.39;d;8pkt 8fpkt", shape=hexagon, color=black];
stat155[shape=component, label=&lt;Rules:&lt;BR/&gt;{178.184.100.163:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 46533: (1.21212%)&lt;BR/&gt; 46518: (1.21212%)&lt;BR/&gt; 46513: (1.21212%)&lt;BR/&gt; 46459: (1.21212%)&gt;];
}
562--610[label="1;1pkt 1fpkt"];
562--1002[label="1;8pkt 8fpkt"];
562--1462[label="1;74pkt 74fpkt"];
562--1508[label="1;8pkt 8fpkt"];
610--1462[label="1;1pkt 1fpkt"];
1002--1462[label="1;8pkt 8fpkt"];
1002--1508[label="1;8pkt 8fpkt"];
1462--1508[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter src_ip="178.184.100.163" src_port="80"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_156{
style=filled;
color=gray75;
1104[label="165.236.210.59;s;72pkt 72fpkt", shape=diamond, color=yellow];
1107[label="82.138.19.166;d;49pkt 49fpkt", shape=diamond, color=yellow];
1565[label="82.138.19.166;d;49pkt 49fpkt", shape=hexagon, color=black];
stat156[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.236.210.59:*, 82.138.19.166:80}[65.7534%]&lt;BR/&gt;{165.236.210.59:*, 198.1.35.37:80}[20.5479%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.4118%)&lt;BR/&gt; 0: (1.17647%)&lt;BR/&gt; 1808: (0.882353%)&lt;BR/&gt; 1807: (0.882353%)&lt;BR/&gt; 1805: (0.882353%)&gt;];
}
1104--1107[label="0.979592;48pkt 48fpkt"];
1104--1565[label="0.979592;48pkt 48fpkt"];
1107--1565[label="1;49pkt 49fpkt"];
</description>
    <slice>
      <filter dst_ip="82.138.19.166" dst_port="80" src_ip="165.236.210.59"/>
      <filter dst_ip="198.1.35.37" dst_port="80" src_ip="165.236.210.59"/>
    </slice>
    <from sec="1049433059" usec="0"/>
    <to sec="1049433218" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_157{
style=filled;
color=gray75;
549[label="202.154.206.94;s;186pkt 186fpkt", shape=diamond, color=yellow];
1019[label="162.3.102.174;d;2pkt 2fpkt", shape=diamond, color=yellow];
2215[label="202.154.205.184;100pkt 100fpkt", shape=pentagon, color=darkviolet];
2579[label="202.154.206.94;193pkt 193fpkt", shape=invtriangle, color=brown];
2930[label="202.154.206.94;193pkt 193fpkt", shape=invhouse, color=bisque];
stat157[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.154.206.94:53, *:*}[65.9864%]&lt;BR/&gt;{202.154.205.184:53, *:*}[34.0136%]&lt;BR/&gt;{*:53, *:53}[23.1293%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (61.8694%)&lt;BR/&gt; 1024: (1.55786%)&lt;BR/&gt; 32780: (0.74184%)&lt;BR/&gt; 32774: (0.667656%)&lt;BR/&gt; 32798: (0.593472%)&gt;];
}
549--1019[label="0.5;1pkt 1fpkt"];
549--1607[label="0.0430108;8pkt 8fpkt"];
549--1617[label="0.0430108;8pkt 8fpkt"];
549--2579[label="0.994624;185pkt 185fpkt"];
549--2930[label="0.994624;185pkt 185fpkt"];
1019--2215[label="0.5;1pkt 1fpkt"];
1019--2579[label="0.5;1pkt 1fpkt"];
1019--2930[label="0.5;1pkt 1fpkt"];
2579--2930[label="1;193pkt 193fpkt"];
</description>
    <slice>
      <filter src_ip="202.154.206.94" src_port="53"/>
      <filter src_ip="202.154.205.184" src_port="53"/>
      <filter dst_port="53" src_port="53"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_158{
style=filled;
color=gray75;
1025[label="216.3.25.161;d;7pkt 7fpkt", shape=diamond, color=yellow];
1026[label="178.184.197.192;s;8pkt 8fpkt", shape=diamond, color=yellow];
stat158[shape=component, label=&lt;Rules:&lt;BR/&gt;{178.184.197.192:*, 216.3.25.161:1755}[75%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1755: (40%)&lt;BR/&gt; 0: (13.3333%)&lt;BR/&gt; 1809: (6.66667%)&lt;BR/&gt; 1808: (6.66667%)&lt;BR/&gt; 1787: (6.66667%)&gt;];
}
1025--1026[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="216.3.25.161" dst_port="1755" src_ip="178.184.197.192"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="141.109.34.65"/>
      <from sec="1049432428" usec="0"/>
      <to sec="1049433053" usec="0"/>
    </slice>
    <from sec="1049432428" usec="0"/>
    <to sec="1049433053" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_160{
style=filled;
color=gray75;
937[label="136.210.222.150;s;15pkt 15fpkt", shape=diamond, color=yellow];
1051[label="198.168.208.116;d;5pkt 5fpkt", shape=diamond, color=yellow];
1697[label="136.210.204.24;7pkt 7fpkt", shape=pentagon, color=darkviolet];
2138[label="136.210.216.157;10pkt 10fpkt", shape=pentagon, color=darkviolet];
2435[label="136.210.204.24;8pkt 8fpkt", shape=invtriangle, color=brown];
2858[label="136.210.204.24;7pkt 7fpkt", shape=invhouse, color=bisque];
stat160[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.210.216.157:*, 196.43.194.78:*}[24.2424%]&lt;BR/&gt;{136.210.222.150:*, 196.43.194.78:*}[24.2424%]&lt;BR/&gt;{136.210.204.24:*, *:*}[24.2424%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5190: (12.5%)&lt;BR/&gt; 6667: (7.69231%)&lt;BR/&gt; 5050: (5.76923%)&lt;BR/&gt; 62155: (3.84615%)&lt;BR/&gt; 6664: (3.84615%)&gt;];
}
937--1051[label="0.4;2pkt 2fpkt"];
1051--1697[label="0.2;1pkt 1fpkt"];
1051--2138[label="0.4;2pkt 2fpkt"];
1051--2435[label="0.2;1pkt 1fpkt"];
1051--2858[label="0.2;1pkt 1fpkt"];
1697--2435[label="1;7pkt 7fpkt"];
1697--2858[label="1;7pkt 7fpkt"];
2435--2858[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter src_ip="136.210.204.24"/>
      <filter dst_ip="196.43.194.78" src_ip="136.210.222.150"/>
      <filter dst_ip="196.43.194.78" src_ip="136.210.216.157"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_161{
style=filled;
color=gray75;
786[label="165.236.138.185;s;96pkt 96fpkt", shape=diamond, color=yellow];
1056[label="220.1.79.17;d;55pkt 55fpkt", shape=diamond, color=yellow];
stat161[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.236.138.185:*, 220.1.79.17:80}[55.6701%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.6689%)&lt;BR/&gt; 1891: (0.662252%)&lt;BR/&gt; 1890: (0.662252%)&lt;BR/&gt; 1889: (0.662252%)&lt;BR/&gt; 1888: (0.662252%)&gt;];
}
786--1056[label="0.981818;54pkt 54fpkt"];
</description>
    <slice>
      <filter dst_ip="220.1.79.17" dst_port="80" src_ip="165.236.138.185"/>
    </slice>
    <from sec="1049432406" usec="0"/>
    <to sec="1049433224" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_162{
style=filled;
color=gray75;
978[label="141.109.42.214;d;97pkt 97fpkt", shape=diamond, color=yellow];
1057[label="4.22.162.254;s;84pkt 84fpkt", shape=diamond, color=yellow];
stat162[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.22.162.254:80, 141.109.42.214:*}[93.8144%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.7238%)&lt;BR/&gt; 50085: (0.552486%)&lt;BR/&gt; 50084: (0.552486%)&lt;BR/&gt; 50083: (0.552486%)&lt;BR/&gt; 50082: (0.552486%)&gt;];
}
978--1057[label="1;84pkt 84fpkt"];
</description>
    <slice>
      <filter dst_ip="141.109.42.214" src_ip="4.22.162.254" src_port="80"/>
    </slice>
    <from sec="1049432607" usec="0"/>
    <to sec="1049433190" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="66.35.4.6"/>
      <from sec="1049432778" usec="0"/>
      <to sec="1049433228" usec="0"/>
    </slice>
    <from sec="1049432778" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.851449,1.42124,503,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_164{
style=filled;
color=gray75;
52[label="160.225.246.42s;1pkt 1fpkt", shape=rectangle, color=red];
1076[label="160.225.246.42;s;144pkt 144fpkt", shape=diamond, color=yellow];
stat164[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.246.42:*, 221.217.78.176:80}[20.8333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.6207%)&lt;BR/&gt; 8046: (1.03448%)&lt;BR/&gt; 1745: (0.689655%)&lt;BR/&gt; 1868: (0.344828%)&lt;BR/&gt; 1867: (0.344828%)&gt;];
}
52--1076[label="1;1pkt 1fpkt"];
1076--1333[label="0.0131579;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="221.217.78.176" dst_port="80" src_ip="160.225.246.42"/>
    </slice>
    <from sec="1049432873" usec="0"/>
    <to sec="1049433226" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_165{
style=filled;
color=gray75;
1004[label="165.236.211.73;d;36pkt 36fpkt", shape=diamond, color=yellow];
1085[label="134.138.224.41;s;13pkt 13fpkt", shape=diamond, color=yellow];
1760[label="134.138.224.41;16pkt 16fpkt", shape=pentagon, color=darkviolet];
2058[label="134.138.228.135;25pkt 25fpkt", shape=pentagon, color=darkviolet];
2473[label="134.138.224.41;16pkt 16fpkt", shape=invtriangle, color=brown];
2647[label="134.138.228.135;26pkt 26fpkt", shape=invtriangle, color=brown];
2978[label="134.138.228.135;26pkt 26fpkt", shape=invhouse, color=bisque];
stat165[shape=component, label=&lt;Rules:&lt;BR/&gt;{134.138.228.135:80, 165.236.211.73:*}[58.1395%]&lt;BR/&gt;{134.138.224.41:80, 165.236.211.73:*}[39.5349%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.3671%)&lt;BR/&gt; 50136: (1.26582%)&lt;BR/&gt; 50135: (1.26582%)&lt;BR/&gt; 50134: (1.26582%)&lt;BR/&gt; 50132: (1.26582%)&gt;];
}
1004--1085[label="1;13pkt 13fpkt"];
1004--1760[label="0.75;12pkt 12fpkt"];
1004--2058[label="0.92;23pkt 23fpkt"];
1004--2473[label="0.75;12pkt 12fpkt"];
1004--2647[label="0.884615;23pkt 23fpkt"];
1004--2978[label="0.884615;23pkt 23fpkt"];
1085--1760[label="0.923077;12pkt 12fpkt"];
1085--2473[label="0.923077;12pkt 12fpkt"];
1760--2473[label="1;16pkt 16fpkt"];
2058--2647[label="1;25pkt 25fpkt"];
2058--2978[label="1;25pkt 25fpkt"];
2647--2978[label="1;26pkt 26fpkt"];
</description>
    <slice>
      <filter dst_ip="165.236.211.73" src_ip="134.138.228.135" src_port="80"/>
      <filter dst_ip="165.236.211.73" src_ip="134.138.224.41" src_port="80"/>
    </slice>
    <from sec="1049432960" usec="0"/>
    <to sec="1049433290" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.851449,1.42124,999,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_167{
style=filled;
color=gray75;
40[label="141.109.236.218s;2pkt 2fpkt", shape=rectangle, color=red];
1099[label="69.78.96.255;d;4pkt 4fpkt", shape=diamond, color=yellow];
1102[label="141.109.236.218;s;4pkt 4fpkt", shape=diamond, color=yellow];
stat167[shape=component, label=&lt;Rules:&lt;BR/&gt;{69.78.96.255:2903, 141.109.236.218:2921}[20%]&lt;BR/&gt;{141.109.236.218:2919, 69.78.96.255:2903}[20%]&lt;BR/&gt;{141.109.236.218:2920, 69.78.96.255:2903}[20%]&lt;BR/&gt;{141.109.236.218:2921, 69.78.96.255:2903}[20%]&lt;BR/&gt;{141.109.236.218:2922, 69.78.96.255:2903}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2903: (50%)&lt;BR/&gt; 2921: (20%)&lt;BR/&gt; 2922: (10%)&lt;BR/&gt; 2920: (10%)&lt;BR/&gt; 2919: (10%)&gt;];
}
40--1099[label="0.5;1pkt 1fpkt"];
40--1100[label="0.5;1pkt 1fpkt"];
40--1101[label="0.5;1pkt 1fpkt"];
40--1102[label="0.5;1pkt 1fpkt"];
1099--1102[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="69.78.96.255" dst_port="2903" src_ip="141.109.236.218" src_port="2922"/>
      <filter dst_ip="69.78.96.255" dst_port="2903" src_ip="141.109.236.218" src_port="2921"/>
      <filter dst_ip="69.78.96.255" dst_port="2903" src_ip="141.109.236.218" src_port="2920"/>
      <filter dst_ip="69.78.96.255" dst_port="2903" src_ip="141.109.236.218" src_port="2919"/>
      <filter dst_ip="141.109.236.218" dst_port="2921" src_ip="69.78.96.255" src_port="2903"/>
    </slice>
    <from sec="1049433040" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="212.73.56.40"/>
      <from sec="1049432403" usec="0"/>
      <to sec="1049433221" usec="0"/>
    </slice>
    <from sec="1049432403" usec="0"/>
    <to sec="1049433221" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_169{
style=filled;
color=gray75;
1137[label="203.86.71.46;s;158pkt 158fpkt", shape=diamond, color=yellow];
stat169[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.86.71.46:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1137--1437[label="0.00632911;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="203.86.71.46"/>
    </slice>
    <from sec="1049432404" usec="0"/>
    <to sec="1049433220" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_170{
style=filled;
color=gray75;
896[label="178.184.112.59;s;14pkt 14fpkt", shape=diamond, color=yellow];
903[label="194.142.45.62;d;6pkt 6fpkt", shape=diamond, color=yellow];
1834[label="178.184.112.59;14pkt 14fpkt", shape=pentagon, color=darkviolet];
2515[label="178.184.112.59;14pkt 14fpkt", shape=invtriangle, color=brown];
2895[label="178.184.112.59;14pkt 14fpkt", shape=invhouse, color=bisque];
stat170[shape=component, label=&lt;Rules:&lt;BR/&gt;{178.184.112.59:*, 194.142.45.62:80}[64.2857%]&lt;BR/&gt;{178.184.112.59:*, 192.168.200.33:*}[21.4286%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (33.871%)&lt;BR/&gt; 631: (6.45161%)&lt;BR/&gt; 3934: (4.03226%)&lt;BR/&gt; 3932: (4.03226%)&lt;BR/&gt; 3930: (4.03226%)&gt;];
}
896--903[label="1;6pkt 6fpkt"];
896--1139[label="0.0714286;1pkt 1fpkt"];
896--1834[label="1;14pkt 14fpkt"];
896--2515[label="1;14pkt 14fpkt"];
896--2895[label="1;14pkt 14fpkt"];
903--1834[label="1;6pkt 6fpkt"];
903--2515[label="1;6pkt 6fpkt"];
903--2895[label="1;6pkt 6fpkt"];
1834--2515[label="1;14pkt 14fpkt"];
1834--2895[label="1;14pkt 14fpkt"];
2515--2895[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter dst_ip="192.168.200.33" src_ip="178.184.112.59"/>
      <filter dst_ip="194.142.45.62" dst_port="80" src_ip="178.184.112.59"/>
    </slice>
    <from sec="1049432765" usec="0"/>
    <to sec="1049433252" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,011,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="160.225.130.195"/>
      <from sec="1049432429" usec="0"/>
      <to sec="1049433228" usec="0"/>
    </slice>
    <from sec="1049432429" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_172{
style=filled;
color=gray75;
1059[label="141.109.179.168;d;81pkt 81fpkt", shape=diamond, color=yellow];
1162[label="199.171.101.196;s;45pkt 45fpkt", shape=diamond, color=yellow];
2359[label="6.138.82.242;66pkt 66fpkt", shape=pentagon, color=darkviolet];
2805[label="6.138.82.242;65pkt 65fpkt", shape=invtriangle, color=brown];
3062[label="6.138.82.242;65pkt 65fpkt", shape=invhouse, color=bisque];
stat172[shape=component, label=&lt;Rules:&lt;BR/&gt;{6.138.82.242:80, 141.109.179.168:*}[56.8966%]&lt;BR/&gt;{199.171.101.196:80, 141.109.179.168:*}[38.7931%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 33241: (0.621118%)&lt;BR/&gt; 33240: (0.621118%)&lt;BR/&gt; 33238: (0.621118%)&lt;BR/&gt; 33235: (0.621118%)&gt;];
}
1059--1162[label="0.755556;34pkt 34fpkt"];
1059--2359[label="0.636364;42pkt 42fpkt"];
1059--2805[label="0.630769;41pkt 41fpkt"];
1059--3062[label="0.630769;41pkt 41fpkt"];
2359--2805[label="1;65pkt 65fpkt"];
2359--3062[label="1;65pkt 65fpkt"];
2805--3062[label="1;65pkt 65fpkt"];
</description>
    <slice>
      <filter dst_ip="141.109.179.168" src_ip="6.138.82.242" src_port="80"/>
      <filter dst_ip="141.109.179.168" src_ip="199.171.101.196" src_port="80"/>
    </slice>
    <from sec="1049432635" usec="0"/>
    <to sec="1049433297" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,504,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="66.107.133.52"/>
      <from sec="1049432661" usec="0"/>
      <to sec="1049433186" usec="0"/>
    </slice>
    <from sec="1049432661" usec="0"/>
    <to sec="1049433186" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_175{
style=filled;
color=gray75;
1075[label="165.45.199.187;s;9pkt 9fpkt", shape=diamond, color=yellow];
1087[label="51.237.132.114;d;1pkt 1fpkt", shape=diamond, color=yellow];
1175[label="4.211.90.202;d;1pkt 1fpkt", shape=diamond, color=yellow];
1506[label="165.45.199.187;s;9pkt 9fpkt", shape=hexagon, color=black];
stat175[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.45.199.187:*, 205.215.135.96:80}[33.3333%]&lt;BR/&gt;{165.45.199.187:*, *:1863}[22.2222%]&lt;BR/&gt;{165.45.199.187:6699, *:*}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (20%)&lt;BR/&gt; 80: (15%)&lt;BR/&gt; 1863: (10%)&lt;BR/&gt; 2913: (7.5%)&lt;BR/&gt; 2874: (7.5%)&gt;];
}
1075--1087[label="1;1pkt 1fpkt"];
1075--1175[label="1;1pkt 1fpkt"];
1075--1506[label="1;9pkt 9fpkt"];
1087--1506[label="1;1pkt 1fpkt"];
1175--1506[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="165.45.199.187" src_port="6699"/>
      <filter dst_port="1863" src_ip="165.45.199.187"/>
      <filter dst_ip="205.215.135.96" dst_port="80" src_ip="165.45.199.187"/>
    </slice>
    <from sec="1049432870" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_176{
style=filled;
color=gray75;
1033[label="136.210.167.19;s;75pkt 75fpkt", shape=diamond, color=yellow];
1674[label="136.210.167.19;4pkt 4fpkt", shape=pentagon, color=darkviolet];
2420[label="136.210.167.19;4pkt 4fpkt", shape=invtriangle, color=brown];
2847[label="136.210.167.19;4pkt 4fpkt", shape=invhouse, color=bisque];
stat176[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.210.167.19:*, *:25}[66.6667%]&lt;BR/&gt;{136.210.167.19:25, *:*}[26.9231%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (47.1264%)&lt;BR/&gt; 0: (5.74713%)&lt;BR/&gt; 1882: (2.29885%)&lt;BR/&gt; 2017: (1.72414%)&lt;BR/&gt; 2012: (1.72414%)&gt;];
}
1033--1178[label="0.5;1pkt 1fpkt"];
1033--1674[label="0.25;1pkt 1fpkt"];
1033--2420[label="0.25;1pkt 1fpkt"];
1033--2847[label="0.25;1pkt 1fpkt"];
1674--2420[label="1;4pkt 4fpkt"];
1674--2847[label="1;4pkt 4fpkt"];
2420--2847[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter src_ip="136.210.167.19" src_port="25"/>
      <filter dst_port="25" src_ip="136.210.167.19"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,501,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_179{
style=filled;
color=gray75;
263[label="142.89.152.221;d;24pkt 24fpkt", shape=diamond, color=yellow];
1212[label="142.89.152.221;d;24pkt 24fpkt", shape=hexagon, color=black];
stat179[shape=component, label=&lt;Rules:&lt;BR/&gt;{178.223.139.17:*, 142.89.152.221:21}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (25%)&lt;BR/&gt; 53823: (2.08333%)&lt;BR/&gt; 53822: (2.08333%)&lt;BR/&gt; 53277: (2.08333%)&lt;BR/&gt; 53274: (2.08333%)&gt;];
}
263--264[label="1;24pkt 24fpkt"];
263--1212[label="1;24pkt 24fpkt"];
</description>
    <slice>
      <filter dst_ip="142.89.152.221" dst_port="21" src_ip="178.223.139.17"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433145" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_180{
style=filled;
color=gray75;
292[label="32.103.188.113;d;1pkt 1fpkt", shape=diamond, color=yellow];
1219[label="32.103.188.113;d;1pkt 1fpkt", shape=hexagon, color=black];
stat180[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.45.246.59:7275, 32.103.188.113:6882}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7275: (50%)&lt;BR/&gt; 6882: (50%)&gt;];
}
292--1219[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="32.103.188.113" dst_port="6882" src_ip="165.45.246.59" src_port="7275"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_181{
style=filled;
color=gray75;
335[label="69.6.96.140;d;1pkt 1fpkt", shape=diamond, color=yellow];
434[label="138.100.128.158;d;4pkt 4fpkt", shape=diamond, color=yellow];
435[label="165.236.210.93;s;84pkt 84fpkt", shape=diamond, color=yellow];
731[label="51.16.4.111;d;2pkt 2fpkt", shape=diamond, color=yellow];
1224[label="69.6.96.140;d;1pkt 1fpkt", shape=hexagon, color=black];
1240[label="138.100.128.158;d;1pkt 1fpkt", shape=hexagon, color=black];
stat181[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.236.210.93:*, *:1214}[65.4762%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1214: (32.2581%)&lt;BR/&gt; 3687: (4.83871%)&lt;BR/&gt; 80: (3.76344%)&lt;BR/&gt; 1461: (3.22581%)&lt;BR/&gt; 3443: (2.15054%)&gt;];
}
335--435[label="1;1pkt 1fpkt"];
434--435[label="1;4pkt 4fpkt"];
434--1240[label="1;1pkt 1fpkt"];
435--731[label="1;2pkt 2fpkt"];
435--1224[label="1;1pkt 1fpkt"];
435--1240[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="1214" src_ip="165.236.210.93"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_182{
style=filled;
color=gray75;
465[label="165.45.54.145;s;586pkt 586fpkt", shape=diamond, color=yellow];
998[label="69.32.236.213;d;5pkt 5fpkt", shape=diamond, color=yellow];
2097[label="165.45.54.145;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2669[label="165.45.54.145;1pkt 1fpkt", shape=invtriangle, color=brown];
2993[label="165.45.54.145;1pkt 1fpkt", shape=invhouse, color=bisque];
stat182[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.45.54.145:2234, *:*}[77.4744%]&lt;BR/&gt;{165.45.54.145:*, *:2234}[20.6485%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2234: (49.0741%)&lt;BR/&gt; 2136: (0.420875%)&lt;BR/&gt; 5534: (0.3367%)&lt;BR/&gt; 1592: (0.252525%)&lt;BR/&gt; 80: (0.252525%)&gt;];
}
465--745[label="0.0103093;1pkt 1fpkt"];
465--998[label="1;5pkt 5fpkt"];
465--1242[label="1;548pkt 548fpkt"];
465--1352[label="0.0185185;1pkt 1fpkt"];
465--1608[label="0.00341297;2pkt 2fpkt"];
465--2097[label="1;1pkt 1fpkt"];
465--2669[label="1;1pkt 1fpkt"];
465--2993[label="1;1pkt 1fpkt"];
998--2097[label="1;1pkt 1fpkt"];
998--2669[label="1;1pkt 1fpkt"];
998--2993[label="1;1pkt 1fpkt"];
2097--2669[label="1;1pkt 1fpkt"];
2097--2993[label="1;1pkt 1fpkt"];
2669--2993[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="165.45.54.145" src_port="2234"/>
      <filter dst_port="2234" src_ip="165.45.54.145"/>
    </slice>
    <from sec="1049432449" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_185{
style=filled;
color=gray75;
442[label="212.200.23.12;d;6pkt 6fpkt", shape=diamond, color=yellow];
1256[label="212.200.23.12;d;6pkt 6fpkt", shape=hexagon, color=black];
stat185[shape=component, label=&lt;Rules:&lt;BR/&gt;{178.184.102.15:*, 212.200.23.12:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 45209: (8.33333%)&lt;BR/&gt; 45167: (8.33333%)&lt;BR/&gt; 45037: (8.33333%)&lt;BR/&gt; 45036: (8.33333%)&gt;];
}
442--1256[label="1;6pkt 6fpkt"];
442--1608[label="0.166667;1pkt 1fpkt"];
442--1656[label="1;6pkt 6fpkt"];
1256--1608[label="0.166667;1pkt 1fpkt"];
1256--1656[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="212.200.23.12" dst_port="80" src_ip="178.184.102.15"/>
    </slice>
    <from sec="1049432402" usec="0"/>
    <to sec="1049432516" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547021,1.37176,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_186{
style=filled;
color=gray75;
577[label="165.45.42.55;s;80pkt 80fpkt", shape=diamond, color=yellow];
1809[label="165.45.42.55;154pkt 154fpkt", shape=pentagon, color=darkviolet];
stat186[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.45.42.55:*, *:9701}[60%]&lt;BR/&gt;{165.45.42.55:*, *:9700}[39.3548%]&lt;BR/&gt;{165.45.42.55:*, 64.37.120.235:*}[21.9355%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9701: (30.3419%)&lt;BR/&gt; 9700: (19.4444%)&lt;BR/&gt; 2337: (0.42735%)&lt;BR/&gt; 2332: (0.42735%)&lt;BR/&gt; 2327: (0.42735%)&gt;];
}
577--1259[label="1;80pkt 80fpkt"];
577--1809[label="0.9875;79pkt 79fpkt"];
</description>
    <slice>
      <filter dst_ip="64.37.120.235" src_ip="165.45.42.55"/>
      <filter dst_port="9701" src_ip="165.45.42.55"/>
      <filter dst_port="9700" src_ip="165.45.42.55"/>
    </slice>
    <from sec="1049432404" usec="0"/>
    <to sec="1049433274" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_187{
style=filled;
color=gray75;
469[label="165.45.252.235;s;41pkt 41fpkt", shape=diamond, color=yellow];
470[label="138.67.248.166;d;3pkt 3fpkt", shape=diamond, color=yellow];
1269[label="138.67.248.166;d;3pkt 3fpkt", shape=hexagon, color=black];
stat187[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.45.252.235:*, 216.114.82.193:80}[31.7073%]&lt;BR/&gt;{165.45.252.235:*, 203.60.20.147:80}[24.3902%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (45.7447%)&lt;BR/&gt; 8080: (3.19149%)&lt;BR/&gt; 2137: (3.19149%)&lt;BR/&gt; 2135: (3.19149%)&lt;BR/&gt; 2131: (3.19149%)&gt;];
}
469--470[label="1;3pkt 3fpkt"];
469--1269[label="1;3pkt 3fpkt"];
469--1608[label="0.170732;7pkt 7fpkt"];
470--1269[label="1;3pkt 3fpkt"];
470--1608[label="0.666667;2pkt 2fpkt"];
1269--1608[label="0.666667;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="216.114.82.193" dst_port="80" src_ip="165.45.252.235"/>
      <filter dst_ip="203.60.20.147" dst_port="80" src_ip="165.45.252.235"/>
    </slice>
    <from sec="1049432469" usec="0"/>
    <to sec="1049432680" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_188{
style=filled;
color=gray75;
451[label="165.236.218.163;s;107pkt 107fpkt", shape=diamond, color=yellow];
605[label="196.43.15.5;d;80pkt 80fpkt", shape=diamond, color=yellow];
1270[label="196.43.15.5;d;80pkt 80fpkt", shape=hexagon, color=black];
stat188[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.236.218.163:*, 196.43.15.5:80}[73.1481%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.6255%)&lt;BR/&gt; 0: (0.749064%)&lt;BR/&gt; 2432: (0.561798%)&lt;BR/&gt; 2431: (0.561798%)&lt;BR/&gt; 2430: (0.561798%)&gt;];
}
451--605[label="0.9875;79pkt 79fpkt"];
451--1270[label="0.9875;79pkt 79fpkt"];
451--1608[label="0.523364;56pkt 56fpkt"];
605--1018[label="0.0125;1pkt 1fpkt"];
605--1270[label="1;80pkt 80fpkt"];
605--1608[label="0.4375;35pkt 35fpkt"];
1270--1608[label="0.4375;35pkt 35fpkt"];
</description>
    <slice>
      <filter dst_ip="196.43.15.5" dst_port="80" src_ip="165.236.218.163"/>
    </slice>
    <from sec="1049432411" usec="0"/>
    <to sec="1049432789" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_189{
style=filled;
color=gray75;
606[label="207.38.217.55;d;57pkt 57fpkt", shape=diamond, color=yellow];
1271[label="207.38.217.55;d;57pkt 57fpkt", shape=hexagon, color=black];
stat189[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.45.227.130:*, 207.38.217.55:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 59580: (0.877193%)&lt;BR/&gt; 59579: (0.877193%)&lt;BR/&gt; 59500: (0.877193%)&lt;BR/&gt; 59499: (0.877193%)&gt;];
}
606--1271[label="1;57pkt 57fpkt"];
606--1608[label="0.824561;47pkt 47fpkt"];
1271--1608[label="0.824561;47pkt 47fpkt"];
</description>
    <slice>
      <filter dst_ip="207.38.217.55" dst_port="80" src_ip="165.45.227.130"/>
    </slice>
    <from sec="1049432506" usec="0"/>
    <to sec="1049432611" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.843005,1.37529,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_192{
style=filled;
color=gray75;
621[label="160.225.200.58;s;65pkt 65fpkt", shape=diamond, color=yellow];
1005[label="203.60.102.137;d;11pkt 11fpkt", shape=diamond, color=yellow];
1275[label="203.60.102.141;d;28pkt 28fpkt", shape=hexagon, color=black];
1517[label="160.225.200.58;s;65pkt 65fpkt", shape=hexagon, color=black];
1829[label="160.225.200.58;65pkt 65fpkt", shape=pentagon, color=darkviolet];
2512[label="160.225.200.58;64pkt 64fpkt", shape=invtriangle, color=brown];
stat192[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.200.58:*, 203.60.102.141:80}[72.3077%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (45.302%)&lt;BR/&gt; 9903: (4.02685%)&lt;BR/&gt; 0: (1.34228%)&lt;BR/&gt; 1264: (0.838926%)&lt;BR/&gt; 1263: (0.838926%)&gt;];
}
621--1005[label="1;11pkt 11fpkt"];
621--1275[label="1;28pkt 28fpkt"];
621--1517[label="1;65pkt 65fpkt"];
621--1608[label="0.0615385;4pkt 4fpkt"];
621--1829[label="1;65pkt 65fpkt"];
621--2512[label="1;64pkt 64fpkt"];
1005--1517[label="1;11pkt 11fpkt"];
1005--1829[label="1;11pkt 11fpkt"];
1005--2512[label="0.909091;10pkt 10fpkt"];
1275--1517[label="1;28pkt 28fpkt"];
1275--1608[label="0.142857;4pkt 4fpkt"];
1275--1829[label="1;28pkt 28fpkt"];
1275--2512[label="1;28pkt 28fpkt"];
1517--1608[label="0.0615385;4pkt 4fpkt"];
1517--1829[label="1;65pkt 65fpkt"];
1517--2512[label="1;64pkt 64fpkt"];
1829--2512[label="1;64pkt 64fpkt"];
</description>
    <slice>
      <filter dst_ip="203.60.102.141" dst_port="80" src_ip="160.225.200.58"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433292" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_195{
style=filled;
color=gray75;
639[label="160.246.113.141;d;8pkt 8fpkt", shape=diamond, color=yellow];
727[label="165.45.248.105;s;1pkt 1fpkt", shape=diamond, color=yellow];
1290[label="160.246.113.141;d;8pkt 8fpkt", shape=hexagon, color=black];
stat195[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 160.246.113.141:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
639--727[label="1;1pkt 1fpkt"];
639--1290[label="1;8pkt 8fpkt"];
727--1290[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="160.246.113.141"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049432897" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,051,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_196{
style=filled;
color=gray75;
399[label="4.16.89.243;s;573pkt 573fpkt", shape=diamond, color=yellow];
421[label="202.224.211.95;s;1416pkt 1416fpkt", shape=diamond, color=yellow];
523[label="141.109.44.185;d;1991pkt 1991fpkt", shape=diamond, color=yellow];
1295[label="141.109.44.185;d;1925pkt 1925fpkt", shape=hexagon, color=black];
1451[label="202.224.211.95;s;1372pkt 1372fpkt", shape=hexagon, color=black];
1525[label="4.16.89.243;s;573pkt 573fpkt", shape=hexagon, color=black];
stat196[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.224.211.95:21, 141.109.44.185:*}[69.7137%]&lt;BR/&gt;{4.16.89.243:*, 141.109.44.185:*}[28.7795%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (34.828%)&lt;BR/&gt; 80: (7.28025%)&lt;BR/&gt; 1021: (7.17834%)&lt;BR/&gt; 0: (0.0509554%)&lt;BR/&gt; 4999: (0.0254777%)&gt;];
}
399--523[label="1;573pkt 573fpkt"];
399--1295[label="0.961606;551pkt 551fpkt"];
399--1525[label="1;573pkt 573fpkt"];
421--523[label="1;1416pkt 1416fpkt"];
421--1295[label="0.968927;1372pkt 1372fpkt"];
421--1451[label="1;1372pkt 1372fpkt"];
523--1295[label="1;1925pkt 1925fpkt"];
523--1451[label="1;1372pkt 1372fpkt"];
523--1525[label="1;573pkt 573fpkt"];
1295--1451[label="1;1372pkt 1372fpkt"];
1295--1525[label="0.961606;551pkt 551fpkt"];
</description>
    <slice>
      <filter dst_ip="141.109.44.185" src_ip="4.16.89.243"/>
      <filter dst_ip="141.109.44.185" src_ip="202.224.211.95" src_port="21"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_197{
style=filled;
color=gray75;
431[label="160.225.97.177;s;48pkt 48fpkt", shape=diamond, color=yellow];
670[label="205.215.151.133;d;1pkt 1fpkt", shape=diamond, color=yellow];
1239[label="160.225.97.177;s;13pkt 13fpkt", shape=hexagon, color=black];
1303[label="205.215.151.133;d;1pkt 1fpkt", shape=hexagon, color=black];
stat197[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.97.177:*, *:80}[83.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (40.4762%)&lt;BR/&gt; 1863: (3.96825%)&lt;BR/&gt; 3327: (3.1746%)&lt;BR/&gt; 1755: (3.1746%)&lt;BR/&gt; 123: (3.1746%)&gt;];
}
431--445[label="0.0416667;2pkt 2fpkt"];
431--670[label="1;1pkt 1fpkt"];
431--1239[label="1;13pkt 13fpkt"];
431--1303[label="1;1pkt 1fpkt"];
431--1608[label="0.0625;3pkt 3fpkt"];
670--1239[label="1;1pkt 1fpkt"];
670--1303[label="1;1pkt 1fpkt"];
1239--1303[label="1;1pkt 1fpkt"];
1239--1608[label="0.230769;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="160.225.97.177"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.843005,1.37529,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_199{
style=filled;
color=gray75;
474[label="203.86.81.27;d;79pkt 79fpkt", shape=diamond, color=yellow];
613[label="141.109.43.91;d;18pkt 18fpkt", shape=diamond, color=yellow];
617[label="207.5.95.18;s;2pkt 2fpkt", shape=diamond, color=yellow];
1244[label="203.86.81.27;d;79pkt 79fpkt", shape=hexagon, color=black];
1319[label="141.109.43.91;d;18pkt 18fpkt", shape=hexagon, color=black];
1670[label="207.5.95.18;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2322[label="205.215.135.224;31pkt 31fpkt", shape=pentagon, color=darkviolet];
2781[label="205.215.135.224;31pkt 31fpkt", shape=invtriangle, color=brown];
stat199[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.215.0.247:80, 203.86.81.27:*}[31.1321%]&lt;BR/&gt;{205.215.135.224:80, *:*}[29.2453%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (43.8462%)&lt;BR/&gt; 5353: (4.61538%)&lt;BR/&gt; 53: (4.61538%)&lt;BR/&gt; 12532: (0.769231%)&lt;BR/&gt; 6970: (0.769231%)&gt;];
}
474--1244[label="1;79pkt 79fpkt"];
474--2322[label="0.677419;21pkt 21fpkt"];
474--2781[label="0.677419;21pkt 21fpkt"];
613--617[label="1;2pkt 2fpkt"];
613--1319[label="1;18pkt 18fpkt"];
613--1670[label="1;2pkt 2fpkt"];
613--1979[label="0.222222;4pkt 4fpkt"];
613--2322[label="0.0555556;1pkt 1fpkt"];
613--2603[label="0.222222;4pkt 4fpkt"];
613--2781[label="0.0555556;1pkt 1fpkt"];
617--1319[label="1;2pkt 2fpkt"];
617--1670[label="1;2pkt 2fpkt"];
1244--2322[label="0.677419;21pkt 21fpkt"];
1244--2781[label="0.677419;21pkt 21fpkt"];
1319--1670[label="1;2pkt 2fpkt"];
1319--1979[label="0.222222;4pkt 4fpkt"];
1319--2322[label="0.0555556;1pkt 1fpkt"];
1319--2603[label="0.222222;4pkt 4fpkt"];
1319--2781[label="0.0555556;1pkt 1fpkt"];
2322--2781[label="1;31pkt 31fpkt"];
</description>
    <slice>
      <filter src_ip="205.215.135.224" src_port="80"/>
      <filter dst_ip="203.86.81.27" src_ip="205.215.0.247" src_port="80"/>
    </slice>
    <from sec="1049432496" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_200{
style=filled;
color=gray75;
713[label="219.231.2.186;d;9pkt 9fpkt", shape=diamond, color=yellow];
1320[label="219.231.2.186;d;9pkt 9fpkt", shape=hexagon, color=black];
stat200[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.236.131.213:*, 219.231.2.186:80}[77.7778%]&lt;BR/&gt;{160.225.82.56:*, 219.231.2.186:80}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1157: (5.55556%)&lt;BR/&gt; 1156: (5.55556%)&lt;BR/&gt; 1115: (5.55556%)&lt;BR/&gt; 1110: (5.55556%)&gt;];
}
713--1320[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="219.231.2.186" dst_port="80" src_ip="165.236.131.213"/>
      <filter dst_ip="219.231.2.186" dst_port="80" src_ip="160.225.82.56"/>
    </slice>
    <from sec="1049432591" usec="0"/>
    <to sec="1049432932" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_202{
style=filled;
color=gray75;
237[label="165.236.181.85;s;23pkt 23fpkt", shape=diamond, color=yellow];
259[label="220.137.116.223;d;1pkt 1fpkt", shape=diamond, color=yellow];
345[label="220.184.84.141;d;1pkt 1fpkt", shape=diamond, color=yellow];
482[label="220.118.126.248;d;1pkt 1fpkt", shape=diamond, color=yellow];
483[label="220.119.2.243;d;1pkt 1fpkt", shape=diamond, color=yellow];
514[label="220.117.11.109;d;1pkt 1fpkt", shape=diamond, color=yellow];
544[label="6.135.148.41;d;1pkt 1fpkt", shape=diamond, color=yellow];
833[label="220.116.12.153;d;1pkt 1fpkt", shape=diamond, color=yellow];
1280[label="220.184.84.141;d;1pkt 1fpkt", shape=hexagon, color=black];
1325[label="220.118.126.248;d;1pkt 1fpkt", shape=hexagon, color=black];
1326[label="165.236.181.85;s;21pkt 21fpkt", shape=hexagon, color=black];
1355[label="220.117.11.109;d;1pkt 1fpkt", shape=hexagon, color=black];
stat202[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.236.181.85:49160, *:412}[26.087%]&lt;BR/&gt;{165.236.181.85:*, *:411}[21.7391%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 49160: (25.9259%)&lt;BR/&gt; 411: (16.6667%)&lt;BR/&gt; 412: (12.963%)&lt;BR/&gt; 49746: (3.7037%)&lt;BR/&gt; 49743: (3.7037%)&gt;];
}
237--259[label="1;1pkt 1fpkt"];
237--345[label="1;1pkt 1fpkt"];
237--482[label="1;1pkt 1fpkt"];
237--483[label="1;1pkt 1fpkt"];
237--514[label="1;1pkt 1fpkt"];
237--544[label="1;1pkt 1fpkt"];
237--833[label="1;1pkt 1fpkt"];
237--1280[label="1;1pkt 1fpkt"];
237--1325[label="1;1pkt 1fpkt"];
237--1326[label="1;21pkt 21fpkt"];
237--1355[label="1;1pkt 1fpkt"];
259--1326[label="1;1pkt 1fpkt"];
345--1280[label="1;1pkt 1fpkt"];
345--1326[label="1;1pkt 1fpkt"];
482--1325[label="1;1pkt 1fpkt"];
482--1326[label="1;1pkt 1fpkt"];
483--1326[label="1;1pkt 1fpkt"];
514--1326[label="1;1pkt 1fpkt"];
514--1355[label="1;1pkt 1fpkt"];
544--1326[label="1;1pkt 1fpkt"];
833--1326[label="1;1pkt 1fpkt"];
1280--1326[label="1;1pkt 1fpkt"];
1325--1326[label="1;1pkt 1fpkt"];
1326--1355[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="411" src_ip="165.236.181.85"/>
      <filter dst_port="412" src_ip="165.236.181.85" src_port="49160"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_203{
style=filled;
color=gray75;
198[label="51.154.123.57;s;3pkt 3fpkt", shape=diamond, color=yellow];
199[label="141.109.34.70;d;6pkt 6fpkt", shape=diamond, color=yellow];
490[label="6.73.111.217;s;1pkt 1fpkt", shape=diamond, color=yellow];
949[label="213.25.19.157;s;1pkt 1fpkt", shape=diamond, color=yellow];
1329[label="6.73.111.217;s;1pkt 1fpkt", shape=hexagon, color=black];
1383[label="141.109.34.70;d;6pkt 6fpkt", shape=hexagon, color=black];
stat203[shape=component, label=&lt;Rules:&lt;BR/&gt;{51.154.123.57:6699, 141.109.34.70:*}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (44.4444%)&lt;BR/&gt; 1268: (11.1111%)&lt;BR/&gt; 1552: (8.33333%)&lt;BR/&gt; 1551: (8.33333%)&lt;BR/&gt; 1550: (8.33333%)&gt;];
}
198--199[label="1;3pkt 3fpkt"];
198--1383[label="1;3pkt 3fpkt"];
199--490[label="1;1pkt 1fpkt"];
199--949[label="1;1pkt 1fpkt"];
199--1329[label="1;1pkt 1fpkt"];
199--1383[label="1;6pkt 6fpkt"];
490--1329[label="1;1pkt 1fpkt"];
490--1383[label="1;1pkt 1fpkt"];
949--1383[label="1;1pkt 1fpkt"];
1329--1383[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="141.109.34.70" src_ip="51.154.123.57" src_port="6699"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_204{
style=filled;
color=gray75;
632[label="141.3.164.56;s;331pkt 331fpkt", shape=diamond, color=yellow];
1330[label="141.3.164.56;s;278pkt 278fpkt", shape=hexagon, color=black];
stat204[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.3.164.56:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
632--1330[label="0.996403;277pkt 277fpkt"];
</description>
    <slice>
      <filter src_ip="141.3.164.56"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_209{
style=filled;
color=gray75;
757[label="165.236.166.89;s;132pkt 132fpkt", shape=diamond, color=yellow];
1360[label="165.236.166.89;s;87pkt 87fpkt", shape=hexagon, color=black];
stat209[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.236.166.89:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
757--1360[label="1;87pkt 87fpkt"];
</description>
    <slice>
      <filter src_ip="165.236.166.89"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_212{
style=filled;
color=gray75;
408[label="136.210.200.221;s;10pkt 10fpkt", shape=diamond, color=yellow];
528[label="221.106.206.144;d;4pkt 4fpkt", shape=diamond, color=yellow];
542[label="199.100.201.75;d;4pkt 4fpkt", shape=diamond, color=yellow];
1395[label="199.100.201.75;d;4pkt 4fpkt", shape=hexagon, color=black];
stat212[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.210.200.221:*, 199.100.201.75:20}[20%]&lt;BR/&gt;{136.210.200.221:*, 199.100.201.75:21}[20%]&lt;BR/&gt;{136.210.200.221:*, 221.106.206.144:20}[20%]&lt;BR/&gt;{136.210.200.221:*, 221.106.206.144:21}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (22.7273%)&lt;BR/&gt; 20: (22.7273%)&lt;BR/&gt; 1420: (6.81818%)&lt;BR/&gt; 1419: (6.81818%)&lt;BR/&gt; 1417: (6.81818%)&gt;];
}
408--528[label="1;4pkt 4fpkt"];
408--542[label="1;4pkt 4fpkt"];
408--1395[label="1;4pkt 4fpkt"];
542--1395[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="221.106.206.144" dst_port="21" src_ip="136.210.200.221"/>
      <filter dst_ip="221.106.206.144" dst_port="20" src_ip="136.210.200.221"/>
      <filter dst_ip="199.100.201.75" dst_port="21" src_ip="136.210.200.221"/>
      <filter dst_ip="199.100.201.75" dst_port="20" src_ip="136.210.200.221"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_213{
style=filled;
color=gray75;
934[label="4.38.135.158;s;717pkt 717fpkt", shape=diamond, color=yellow];
1399[label="4.38.135.158;s;717pkt 717fpkt", shape=hexagon, color=black];
stat213[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.38.135.158:4506, *:1434}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4506: (50%)&lt;BR/&gt; 1434: (50%)&gt;];
}
934--1399[label="1;717pkt 717fpkt"];
</description>
    <slice>
      <filter dst_port="1434" src_ip="4.38.135.158" src_port="4506"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,502,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_214{
style=filled;
color=gray75;
559[label="202.24.167.150;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat214[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.24.167.150:32943, 203.86.85.151:22}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 32943: (50%)&lt;BR/&gt; 22: (50%)&gt;];
}
559--1400[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="203.86.85.151" dst_port="22" src_ip="202.24.167.150" src_port="32943"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433224" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.628332,1.36623,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_215{
style=filled;
color=gray75;
942[label="202.138.196.49;s;51pkt 51fpkt", shape=diamond, color=yellow];
1785[label="202.138.196.49;53pkt 53fpkt", shape=pentagon, color=darkviolet];
2487[label="202.138.196.49;54pkt 54fpkt", shape=invtriangle, color=brown];
stat215[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.138.196.49:25, *:*}[98.1481%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (49.3671%)&lt;BR/&gt; 1419: (1.89873%)&lt;BR/&gt; 0: (1.26582%)&lt;BR/&gt; 64317: (0.949367%)&lt;BR/&gt; 63866: (0.949367%)&gt;];
}
942--1402[label="1;51pkt 51fpkt"];
942--1785[label="0.980392;50pkt 50fpkt"];
942--2487[label="1;51pkt 51fpkt"];
1785--2487[label="1;53pkt 53fpkt"];
</description>
    <slice>
      <filter src_ip="202.138.196.49" src_port="25"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433293" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.628332,1.36623,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_216{
style=filled;
color=gray75;
466[label="212.161.227.90;d;153pkt 153fpkt", shape=diamond, color=yellow];
898[label="160.225.143.26;s;72pkt 72fpkt", shape=diamond, color=yellow];
946[label="160.225.136.220;s;36pkt 36fpkt", shape=diamond, color=yellow];
1629[label="141.109.45.5;27pkt 27fpkt", shape=pentagon, color=darkviolet];
1700[label="160.225.143.26;85pkt 85fpkt", shape=pentagon, color=darkviolet];
2394[label="141.109.45.5;27pkt 27fpkt", shape=invtriangle, color=brown];
stat216[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.143.26:*, 212.161.227.90:80}[29.4931%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 49688: (0.5%)&lt;BR/&gt; 49709: (0.375%)&lt;BR/&gt; 49708: (0.375%)&lt;BR/&gt; 49707: (0.375%)&gt;];
}
466--898[label="0.736111;53pkt 53fpkt"];
466--946[label="0.333333;12pkt 12fpkt"];
466--1201[label="0.0522876;8pkt 8fpkt"];
466--1267[label="1;58pkt 58fpkt"];
466--1404[label="0.342857;12pkt 12fpkt"];
466--1578[label="0.0522876;8pkt 8fpkt"];
466--1608[label="0.0980392;15pkt 15fpkt"];
466--1629[label="0.703704;19pkt 19fpkt"];
466--1683[label="0.685185;37pkt 37fpkt"];
466--1700[label="0.623529;53pkt 53fpkt"];
466--2023[label="0.0196078;3pkt 3fpkt"];
466--2213[label="0.00653595;1pkt 1fpkt"];
466--2303[label="0.0915033;14pkt 14fpkt"];
466--2306[label="0.272727;12pkt 12fpkt"];
466--2394[label="0.703704;19pkt 19fpkt"];
466--2401[label="0.0522876;8pkt 8fpkt"];
466--2425[label="0.685185;37pkt 37fpkt"];
466--2628[label="0.0196078;3pkt 3fpkt"];
466--2833[label="0.0522876;8pkt 8fpkt"];
466--2851[label="0.685185;37pkt 37fpkt"];
466--2964[label="0.0196078;3pkt 3fpkt"];
898--1700[label="1;72pkt 72fpkt"];
946--1172[label="0.9;9pkt 9fpkt"];
946--1368[label="0.138889;5pkt 5fpkt"];
946--1404[label="1;35pkt 35fpkt"];
946--1561[label="0.9;9pkt 9fpkt"];
946--2306[label="1;36pkt 36fpkt"];
1629--2394[label="1;27pkt 27fpkt"];
</description>
    <slice>
      <filter dst_ip="212.161.227.90" dst_port="80" src_ip="160.225.143.26"/>
    </slice>
    <from sec="1049432402" usec="0"/>
    <to sec="1049433235" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.784275,1.38078,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_217{
style=filled;
color=gray75;
977[label="4.22.162.254;d;96pkt 96fpkt", shape=diamond, color=yellow];
1058[label="141.109.42.214;s;96pkt 96fpkt", shape=diamond, color=yellow];
1409[label="4.22.162.254;d;83pkt 83fpkt", shape=hexagon, color=black];
2288[label="141.109.42.214;127pkt 127fpkt", shape=pentagon, color=darkviolet];
stat217[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.109.42.214:*, 4.22.162.254:80}[95.2756%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.7512%)&lt;BR/&gt; 50080: (0.497512%)&lt;BR/&gt; 50079: (0.497512%)&lt;BR/&gt; 50078: (0.497512%)&lt;BR/&gt; 50077: (0.497512%)&gt;];
}
977--1058[label="1;96pkt 96fpkt"];
977--1409[label="1;83pkt 83fpkt"];
977--2288[label="1;96pkt 96fpkt"];
1058--1409[label="1;83pkt 83fpkt"];
1058--2288[label="1;96pkt 96fpkt"];
1409--2288[label="1;83pkt 83fpkt"];
</description>
    <slice>
      <filter dst_ip="4.22.162.254" dst_port="80" src_ip="141.109.42.214"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_219{
style=filled;
color=gray75;
984[label="178.184.59.101;s;44pkt 44fpkt", shape=diamond, color=yellow];
1411[label="178.184.59.101;s;33pkt 33fpkt", shape=hexagon, color=black];
stat219[shape=component, label=&lt;Rules:&lt;BR/&gt;{178.184.59.101:*, 205.105.165.119:80}[81.8182%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.1039%)&lt;BR/&gt; 443: (3.8961%)&lt;BR/&gt; 55563: (1.2987%)&lt;BR/&gt; 55561: (1.2987%)&lt;BR/&gt; 55558: (1.2987%)&gt;];
}
984--1411[label="1;33pkt 33fpkt"];
</description>
    <slice>
      <filter dst_ip="205.105.165.119" dst_port="80" src_ip="178.184.59.101"/>
    </slice>
    <from sec="1049432674" usec="0"/>
    <to sec="1049433193" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_221{
style=filled;
color=gray75;
1008[label="218.84.148.149;d;211pkt 211fpkt", shape=diamond, color=yellow];
1414[label="218.84.148.149;d;169pkt 169fpkt", shape=hexagon, color=black];
stat221[shape=component, label=&lt;Rules:&lt;BR/&gt;{178.223.139.17:*, 218.84.148.149:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 54977: (0.263158%)&lt;BR/&gt; 54976: (0.263158%)&lt;BR/&gt; 54975: (0.263158%)&lt;BR/&gt; 54974: (0.263158%)&gt;];
}
1008--1414[label="1;169pkt 169fpkt"];
</description>
    <slice>
      <filter dst_ip="218.84.148.149" dst_port="80" src_ip="178.223.139.17"/>
    </slice>
    <from sec="1049433011" usec="0"/>
    <to sec="1049433156" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_222{
style=filled;
color=gray75;
915[label="218.134.222.220;d;1pkt 1fpkt", shape=diamond, color=yellow];
916[label="160.225.200.182;s;1pkt 1fpkt", shape=diamond, color=yellow];
1422[label="218.134.222.220;d;1pkt 1fpkt", shape=hexagon, color=black];
stat222[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.200.182:8284, 218.134.222.220:8292}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8292: (50%)&lt;BR/&gt; 8284: (50%)&gt;];
}
915--916[label="1;1pkt 1fpkt"];
915--1422[label="1;1pkt 1fpkt"];
916--1422[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="218.134.222.220" dst_port="8292" src_ip="160.225.200.182" src_port="8284"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_224{
style=filled;
color=gray75;
744[label="207.82.228.245;d;2pkt 2fpkt", shape=diamond, color=yellow];
1429[label="207.82.228.245;d;2pkt 2fpkt", shape=hexagon, color=black];
stat224[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.200.163:8277, 207.82.228.245:8292}[50%]&lt;BR/&gt;{160.225.200.180:1037, 207.82.228.245:8292}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8292: (50%)&lt;BR/&gt; 8277: (25%)&lt;BR/&gt; 1037: (25%)&gt;];
}
744--1429[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="207.82.228.245" dst_port="8292" src_ip="160.225.200.180" src_port="1037"/>
      <filter dst_ip="207.82.228.245" dst_port="8292" src_ip="160.225.200.163" src_port="8277"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_225{
style=filled;
color=gray75;
285[label="165.236.130.130;d;16pkt 16fpkt", shape=diamond, color=yellow];
288[label="214.42.211.127;s;7pkt 7fpkt", shape=diamond, color=yellow];
354[label="4.11.162.235;s;4589pkt 4589fpkt", shape=diamond, color=yellow];
933[label="203.113.19.195;s;1pkt 1fpkt", shape=diamond, color=yellow];
1419[label="4.11.162.235;s;4078pkt 4078fpkt", shape=hexagon, color=black];
1431[label="165.236.130.130;d;15pkt 15fpkt", shape=hexagon, color=black];
stat225[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.11.162.235:3773, *:1434}[99.6742%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3773: (49.7875%)&lt;BR/&gt; 1434: (49.7875%)&lt;BR/&gt; 3891: (0.0976338%)&lt;BR/&gt; 3032: (0.034459%)&lt;BR/&gt; 3946: (0.0287158%)&gt;];
}
285--288[label="1;7pkt 7fpkt"];
285--354[label="0.0625;1pkt 1fpkt"];
285--933[label="1;1pkt 1fpkt"];
285--1419[label="0.0625;1pkt 1fpkt"];
285--1431[label="1;15pkt 15fpkt"];
288--1431[label="0.857143;6pkt 6fpkt"];
354--638[label="0.012987;1pkt 1fpkt"];
354--873[label="0.00970874;1pkt 1fpkt"];
354--1419[label="1;4078pkt 4078fpkt"];
354--1431[label="0.0666667;1pkt 1fpkt"];
933--1431[label="1;1pkt 1fpkt"];
1419--1431[label="0.0666667;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="1434" src_ip="4.11.162.235" src_port="3773"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_226{
style=filled;
color=gray75;
503[label="202.235.235.184;s;1618pkt 1618fpkt", shape=diamond, color=yellow];
1432[label="202.235.235.184;s;1618pkt 1618fpkt", shape=hexagon, color=black];
stat226[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.235.235.184:1204, *:1434}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1434: (50%)&lt;BR/&gt; 1204: (50%)&gt;];
}
503--1432[label="1;1618pkt 1618fpkt"];
</description>
    <slice>
      <filter dst_port="1434" src_ip="202.235.235.184" src_port="1204"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_231{
style=filled;
color=gray75;
912[label="197.3.2.214;s;283pkt 283fpkt", shape=diamond, color=yellow];
1479[label="198.153.96.97;d;50pkt 50fpkt", shape=hexagon, color=black];
stat231[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.3.2.214:53, *:*}[85.4545%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (49.8498%)&lt;BR/&gt; 32768: (1.65165%)&lt;BR/&gt; 32769: (0.750751%)&lt;BR/&gt; 1024: (0.600601%)&lt;BR/&gt; 1053: (0.45045%)&gt;];
}
912--1123[label="0.0483871;3pkt 3fpkt"];
912--1416[label="1;247pkt 247fpkt"];
912--1479[label="0.06;3pkt 3fpkt"];
1479--1530[label="0.06;3pkt 3fpkt"];
1479--1571[label="0.06;3pkt 3fpkt"];
1479--1604[label="0.02;1pkt 1fpkt"];
1479--1931[label="0.04;2pkt 2fpkt"];
1479--2022[label="0.06;3pkt 3fpkt"];
1479--2030[label="0.02;1pkt 1fpkt"];
1479--2039[label="0.06;3pkt 3fpkt"];
1479--2117[label="0.08;4pkt 4fpkt"];
1479--2266[label="0.04;2pkt 2fpkt"];
1479--2311[label="0.02;1pkt 1fpkt"];
1479--2321[label="0.02;1pkt 1fpkt"];
1479--2325[label="0.02;1pkt 1fpkt"];
1479--2348[label="0.02;1pkt 1fpkt"];
1479--2631[label="0.02;1pkt 1fpkt"];
1479--2637[label="0.06;3pkt 3fpkt"];
1479--2681[label="0.08;4pkt 4fpkt"];
1479--2752[label="0.04;2pkt 2fpkt"];
1479--2773[label="0.02;1pkt 1fpkt"];
1479--2780[label="0.02;1pkt 1fpkt"];
1479--2782[label="0.02;1pkt 1fpkt"];
1479--2797[label="0.02;1pkt 1fpkt"];
1479--2967[label="0.02;1pkt 1fpkt"];
1479--2972[label="0.06;3pkt 3fpkt"];
1479--3031[label="0.04;2pkt 2fpkt"];
1479--3041[label="0.02;1pkt 1fpkt"];
1479--3047[label="0.02;1pkt 1fpkt"];
1479--3048[label="0.02;1pkt 1fpkt"];
1479--3058[label="0.02;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="197.3.2.214" src_port="53"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_234{
style=filled;
color=gray75;
560[label="165.236.210.93;d;46pkt 46fpkt", shape=diamond, color=yellow];
812[label="51.16.4.111;s;2pkt 2fpkt", shape=diamond, color=yellow];
1496[label="51.16.4.111;s;2pkt 2fpkt", shape=hexagon, color=black];
stat234[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:1214, 165.236.210.93:*}[36.9565%]&lt;BR/&gt;{69.3.12.3:*, 165.236.210.93:*}[26.087%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1214: (20%)&lt;BR/&gt; 3687: (9%)&lt;BR/&gt; 80: (7%)&lt;BR/&gt; 3443: (6%)&lt;BR/&gt; 0: (4%)&gt;];
}
560--812[label="1;2pkt 2fpkt"];
560--1496[label="1;2pkt 2fpkt"];
560--1556[label="1;1pkt 1fpkt"];
812--1496[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="165.236.210.93" src_ip="69.3.12.3"/>
      <filter dst_ip="165.236.210.93" src_port="1214"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.784275,1.38078,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_235{
style=filled;
color=gray75;
818[label="219.68.57.212;s;59pkt 59fpkt", shape=diamond, color=yellow];
1065[label="203.86.65.221;d;12pkt 12fpkt", shape=diamond, color=yellow];
1497[label="203.86.65.221;d;12pkt 12fpkt", shape=hexagon, color=black];
1500[label="219.68.57.212;s;59pkt 59fpkt", shape=hexagon, color=black];
2276[label="205.215.50.210;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2281[label="219.68.57.212;68pkt 68fpkt", shape=pentagon, color=darkviolet];
stat235[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.68.57.212:80, 141.109.110.52:*}[24.6575%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1204: (1.89573%)&lt;BR/&gt; 1203: (1.89573%)&lt;BR/&gt; 1200: (1.89573%)&lt;BR/&gt; 1190: (1.89573%)&gt;];
}
818--1065[label="0.583333;7pkt 7fpkt"];
818--1497[label="0.583333;7pkt 7fpkt"];
818--1500[label="1;59pkt 59fpkt"];
818--2281[label="1;59pkt 59fpkt"];
1065--1497[label="1;12pkt 12fpkt"];
1065--1500[label="0.583333;7pkt 7fpkt"];
1065--2276[label="1;1pkt 1fpkt"];
1065--2281[label="0.583333;7pkt 7fpkt"];
1497--1500[label="0.583333;7pkt 7fpkt"];
1497--2276[label="1;1pkt 1fpkt"];
1497--2281[label="0.583333;7pkt 7fpkt"];
1500--2281[label="1;59pkt 59fpkt"];
</description>
    <slice>
      <filter dst_ip="141.109.110.52" src_ip="219.68.57.212" src_port="80"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_236{
style=filled;
color=gray75;
1070[label="136.192.176.191;s;12pkt 12fpkt", shape=diamond, color=yellow];
1503[label="136.192.176.191;s;12pkt 12fpkt", shape=hexagon, color=black];
stat236[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.192.176.191:80, 165.236.188.11:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4871: (4.16667%)&lt;BR/&gt; 4869: (4.16667%)&lt;BR/&gt; 4866: (4.16667%)&lt;BR/&gt; 4865: (4.16667%)&gt;];
}
1070--1503[label="1;12pkt 12fpkt"];
</description>
    <slice>
      <filter dst_ip="165.236.188.11" src_ip="136.192.176.191" src_port="80"/>
    </slice>
    <from sec="1049432775" usec="0"/>
    <to sec="1049433141" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_239{
style=filled;
color=gray75;
1022[label="136.210.212.49;s;2pkt 2fpkt", shape=diamond, color=yellow];
1534[label="136.210.212.49;s;2pkt 2fpkt", shape=hexagon, color=black];
stat239[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.210.212.49:47389, 67.177.107.176:20}[50%]&lt;BR/&gt;{136.210.212.49:34475, 221.169.168.179:20}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 20: (50%)&lt;BR/&gt; 47389: (25%)&lt;BR/&gt; 34475: (25%)&gt;];
}
1022--1534[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="221.169.168.179" dst_port="20" src_ip="136.210.212.49" src_port="34475"/>
      <filter dst_ip="67.177.107.176" dst_port="20" src_ip="136.210.212.49" src_port="47389"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_242{
style=filled;
color=gray75;
589[label="202.22.135.145;s;158pkt 158fpkt", shape=diamond, color=yellow];
1547[label="202.22.135.145;s;158pkt 158fpkt", shape=hexagon, color=black];
stat242[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.22.135.145:80, 197.88.96.136:*}[26.5823%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 59523: (0.316456%)&lt;BR/&gt; 58564: (0.316456%)&lt;BR/&gt; 58563: (0.316456%)&lt;BR/&gt; 58273: (0.316456%)&gt;];
}
589--1547[label="1;158pkt 158fpkt"];
</description>
    <slice>
      <filter dst_ip="197.88.96.136" src_ip="202.22.135.145" src_port="80"/>
    </slice>
    <from sec="1049432414" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.80417,1.36113,999,1 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_243{
style=filled;
color=gray75;
98[label="4.32.20.178s;1pkt 1fpkt", shape=rectangle, color=red];
308[label="202.192.172.178;s;468pkt 468fpkt", shape=diamond, color=yellow];
1038[label="199.172.150.37;d;1pkt 1fpkt", shape=diamond, color=yellow];
2201[label="202.192.172.178;518pkt 518fpkt", shape=pentagon, color=darkviolet];
stat243[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.192.172.178:2183, *:53}[79.9615%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (40.3846%)&lt;BR/&gt; 2183: (40.1822%)&lt;BR/&gt; 80: (7.13563%)&lt;BR/&gt; 0: (4.95951%)&lt;BR/&gt; 1147: (0.202429%)&gt;];
}
98--308[label="1;1pkt 1fpkt"];
98--1038[label="1;1pkt 1fpkt"];
98--1608[label="1;1pkt 1fpkt"];
98--2201[label="1;1pkt 1fpkt"];
308--522[label="0.00238095;1pkt 1fpkt"];
308--536[label="0.00543478;1pkt 1fpkt"];
308--666[label="0.00613497;1pkt 1fpkt"];
308--669[label="0.015625;1pkt 1fpkt"];
308--677[label="0.00595238;1pkt 1fpkt"];
308--679[label="0.0294118;2pkt 2fpkt"];
308--762[label="0.0052356;1pkt 1fpkt"];
308--764[label="0.00558659;1pkt 1fpkt"];
308--775[label="0.00684932;1pkt 1fpkt"];
308--780[label="0.0147059;1pkt 1fpkt"];
308--788[label="0.0105263;1pkt 1fpkt"];
308--837[label="0.00740741;1pkt 1fpkt"];
308--840[label="0.315789;12pkt 12fpkt"];
308--855[label="0.0150376;2pkt 2fpkt"];
308--861[label="0.00689655;1pkt 1fpkt"];
308--871[label="0.0185185;1pkt 1fpkt"];
308--924[label="0.00724638;1pkt 1fpkt"];
308--947[label="0.00813008;1pkt 1fpkt"];
308--950[label="0.0169492;1pkt 1fpkt"];
308--1024[label="0.0172414;1pkt 1fpkt"];
308--1038[label="1;1pkt 1fpkt"];
308--1116[label="0.0217391;1pkt 1fpkt"];
308--1130[label="0.0238095;1pkt 1fpkt"];
308--1138[label="0.0204082;1pkt 1fpkt"];
308--1139[label="0.0147059;1pkt 1fpkt"];
308--1302[label="0.015625;1pkt 1fpkt"];
308--1339[label="0.0169492;1pkt 1fpkt"];
308--1364[label="0.00934579;1pkt 1fpkt"];
308--1368[label="0.0444444;2pkt 2fpkt"];
308--1401[label="0.0150376;2pkt 2fpkt"];
308--1437[label="0.00265957;1pkt 1fpkt"];
308--1454[label="0.00613497;1pkt 1fpkt"];
308--1455[label="0.00628931;1pkt 1fpkt"];
308--1466[label="0.0078125;1pkt 1fpkt"];
308--1532[label="0.0217391;1pkt 1fpkt"];
308--1539[label="0.0238095;1pkt 1fpkt"];
308--1589[label="0.00628931;1pkt 1fpkt"];
308--1590[label="0.0166667;2pkt 2fpkt"];
308--1607[label="0.136752;64pkt 64fpkt"];
308--1608[label="0.034188;16pkt 16fpkt"];
308--1617[label="0.136752;64pkt 64fpkt"];
308--2201[label="0.997863;467pkt 467fpkt"];
1038--1608[label="1;1pkt 1fpkt"];
1038--2201[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="53" src_ip="202.192.172.178" src_port="2183"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_244{
style=filled;
color=gray75;
336[label="69.6.96.140;s;1pkt 1fpkt", shape=diamond, color=yellow];
1556[label="69.6.96.140;s;1pkt 1fpkt", shape=hexagon, color=black];
stat244[shape=component, label=&lt;Rules:&lt;BR/&gt;{69.6.96.140:2431, 165.236.210.93:2346}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2431: (50%)&lt;BR/&gt; 2346: (50%)&gt;];
}
336--560[label="1;1pkt 1fpkt"];
336--1556[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="165.236.210.93" dst_port="2346" src_ip="69.6.96.140" src_port="2431"/>
    </slice>
    <from sec="1049432601" usec="0"/>
    <to sec="1049433130" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_245{
style=filled;
color=gray75;
996[label="219.130.50.122;d;1pkt 1fpkt", shape=diamond, color=yellow];
1560[label="219.130.50.122;d;1pkt 1fpkt", shape=hexagon, color=black];
stat245[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.109.163.100:4710, 219.130.50.122:29354}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 29354: (50%)&lt;BR/&gt; 4710: (50%)&gt;];
}
996--1560[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="219.130.50.122" dst_port="29354" src_ip="141.109.163.100" src_port="4710"/>
    </slice>
    <from sec="1049432866" usec="0"/>
    <to sec="1049433226" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.832685,1.44007,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_247{
style=filled;
color=gray75;
1194[label="219.76.192.43;d;104pkt 104fpkt", shape=diamond, color=yellow];
1569[label="219.76.192.43;d;104pkt 104fpkt", shape=hexagon, color=black];
stat247[shape=component, label=&lt;Rules:&lt;BR/&gt;{178.223.139.17:*, 219.76.192.43:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 55693: (0.480769%)&lt;BR/&gt; 55689: (0.480769%)&lt;BR/&gt; 55688: (0.480769%)&lt;BR/&gt; 55687: (0.480769%)&gt;];
}
1194--1569[label="1;104pkt 104fpkt"];
</description>
    <slice>
      <filter dst_ip="219.76.192.43" dst_port="80" src_ip="178.223.139.17"/>
    </slice>
    <from sec="1049433203" usec="0"/>
    <to sec="1049433220" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_252{
style=filled;
color=gray75;
964[label="203.86.68.130;d;39pkt 39fpkt", shape=diamond, color=yellow];
1895[label="82.143.172.80;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2326[label="166.96.43.227;7pkt 7fpkt", shape=pentagon, color=darkviolet];
2556[label="82.143.172.80;1pkt 1fpkt", shape=invtriangle, color=brown];
2918[label="82.143.172.80;1pkt 1fpkt", shape=invhouse, color=bisque];
stat252[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 203.86.68.130:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 41497: (4.08163%)&lt;BR/&gt; 4371: (2.04082%)&lt;BR/&gt; 4370: (2.04082%)&lt;BR/&gt; 4366: (2.04082%)&gt;];
}
964--1608[label="0.102564;4pkt 4fpkt"];
964--1895[label="1;1pkt 1fpkt"];
964--2326[label="1;7pkt 7fpkt"];
964--2556[label="1;1pkt 1fpkt"];
964--2918[label="1;1pkt 1fpkt"];
1895--2556[label="1;1pkt 1fpkt"];
1895--2918[label="1;1pkt 1fpkt"];
2556--2918[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="203.86.68.130" dst_port="80"/>
    </slice>
    <from sec="1049432411" usec="0"/>
    <to sec="1049433199" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="7.130.136.1"/>
    </slice>
    <from sec="1049432405" usec="0"/>
    <to sec="1049433297" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="136.210.229.2"/>
    </slice>
    <from sec="1049432601" usec="0"/>
    <to sec="1049433136" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.2.190.5"/>
    </slice>
    <from sec="1049432416" usec="0"/>
    <to sec="1049432790" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.108.161.8"/>
    </slice>
    <from sec="1049432468" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="178.184.85.10"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_259{
style=filled;
color=gray75;
981[label="141.109.54.112;d;79pkt 79fpkt", shape=diamond, color=yellow];
982[label="67.216.81.62;s;36pkt 36fpkt", shape=diamond, color=yellow];
1646[label="67.216.81.12;8pkt 8fpkt", shape=pentagon, color=darkviolet];
1842[label="67.216.81.62;46pkt 46fpkt", shape=pentagon, color=darkviolet];
2405[label="67.216.81.12;7pkt 7fpkt", shape=invtriangle, color=brown];
2519[label="67.216.81.62;45pkt 45fpkt", shape=invtriangle, color=brown];
2836[label="67.216.81.12;8pkt 8fpkt", shape=invhouse, color=bisque];
stat259[shape=component, label=&lt;Rules:&lt;BR/&gt;{67.216.81.62:80, 141.109.54.112:*}[51.6854%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3580: (0.873362%)&lt;BR/&gt; 3576: (0.873362%)&lt;BR/&gt; 3575: (0.873362%)&lt;BR/&gt; 3573: (0.873362%)&gt;];
}
981--982[label="1;36pkt 36fpkt"];
981--1646[label="1;8pkt 8fpkt"];
981--1842[label="0.782609;36pkt 36fpkt"];
981--2405[label="1;7pkt 7fpkt"];
981--2519[label="0.777778;35pkt 35fpkt"];
981--2836[label="1;8pkt 8fpkt"];
982--1842[label="1;36pkt 36fpkt"];
982--2519[label="0.972222;35pkt 35fpkt"];
1646--2405[label="1;7pkt 7fpkt"];
1646--2836[label="1;8pkt 8fpkt"];
1842--2519[label="1;45pkt 45fpkt"];
2405--2836[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="141.109.54.112" src_ip="67.216.81.62" src_port="80"/>
    </slice>
    <from sec="1049432670" usec="0"/>
    <to sec="1049433290" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="51.35.100.14"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433279" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.66.188.16"/>
    </slice>
    <from sec="1049432414" usec="0"/>
    <to sec="1049433299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.54.206.16"/>
    </slice>
    <from sec="1049432405" usec="0"/>
    <to sec="1049433299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.743346,1.41051,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_263{
style=filled;
color=gray75;
71[label="66.213.5.17s;46pkt 46fpkt", shape=rectangle, color=red];
1662[label="66.213.5.17;110pkt 110fpkt", shape=pentagon, color=darkviolet];
stat263[shape=component, label=&lt;Rules:&lt;BR/&gt;{66.213.5.17:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
71--1662[label="1;46pkt 46fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="66.213.5.17" src_port="1027"/>
    </slice>
    <from sec="1049432658" usec="0"/>
    <to sec="1049432677" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547021,1.37176,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_264{
style=filled;
color=gray75;
958[label="165.236.138.185;d;65pkt 65fpkt", shape=diamond, color=yellow];
1664[label="220.1.79.17;54pkt 54fpkt", shape=pentagon, color=darkviolet];
stat264[shape=component, label=&lt;Rules:&lt;BR/&gt;{220.1.79.17:80, 165.236.138.185:*}[83.0769%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1891: (0.840336%)&lt;BR/&gt; 1890: (0.840336%)&lt;BR/&gt; 1889: (0.840336%)&lt;BR/&gt; 1888: (0.840336%)&gt;];
}
958--1664[label="1;54pkt 54fpkt"];
</description>
    <slice>
      <filter dst_ip="165.236.138.185" src_ip="220.1.79.17" src_port="80"/>
    </slice>
    <from sec="1049432406" usec="0"/>
    <to sec="1049433224" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="136.210.204.17"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="165.45.54.20"/>
    </slice>
    <from sec="1049432430" usec="0"/>
    <to sec="1049433285" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.0.100.20"/>
    </slice>
    <from sec="1049432411" usec="0"/>
    <to sec="1049433292" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.945562,1.42602,002,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_269{
style=filled;
color=gray75;
74[label="203.118.97.21s;115pkt 115fpkt", shape=rectangle, color=red];
1680[label="203.118.97.21;115pkt 115fpkt", shape=pentagon, color=darkviolet];
2424[label="203.118.97.21;114pkt 114fpkt", shape=invtriangle, color=brown];
2850[label="203.118.97.21;114pkt 114fpkt", shape=invhouse, color=bisque];
stat269[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.118.97.21:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
74--1680[label="1;115pkt 115fpkt"];
74--2424[label="1;114pkt 114fpkt"];
74--2850[label="1;114pkt 114fpkt"];
1680--2424[label="1;114pkt 114fpkt"];
1680--2850[label="1;114pkt 114fpkt"];
2424--2850[label="1;114pkt 114fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="203.118.97.21" src_port="1027"/>
    </slice>
    <from sec="1049432430" usec="0"/>
    <to sec="1049432452" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.784275,1.38078,020,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_270{
style=filled;
color=gray75;
411[label="202.22.163.21;s;701pkt 701fpkt", shape=diamond, color=yellow];
1528[label="202.22.163.21;s;701pkt 701fpkt", shape=hexagon, color=black];
1681[label="202.22.163.21;739pkt 739fpkt", shape=pentagon, color=darkviolet];
stat270[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.22.163.21:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
411--980[label="0.2;1pkt 1fpkt"];
411--1528[label="1;701pkt 701fpkt"];
411--1681[label="1;701pkt 701fpkt"];
1528--1681[label="1;701pkt 701fpkt"];
</description>
    <slice>
      <filter src_ip="202.22.163.21"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="165.236.208.21"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.54.143.23"/>
    </slice>
    <from sec="1049432405" usec="0"/>
    <to sec="1049433299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_273{
style=filled;
color=gray75;
1813[label="160.225.10.56;19pkt 19fpkt", shape=pentagon, color=darkviolet];
2503[label="160.225.10.56;19pkt 19fpkt", shape=invtriangle, color=brown];
2888[label="160.225.10.56;20pkt 20fpkt", shape=invhouse, color=bisque];
stat273[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.10.56:*, 205.215.135.96:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 64965: (2.58621%)&lt;BR/&gt; 64964: (2.58621%)&lt;BR/&gt; 64963: (2.58621%)&lt;BR/&gt; 64962: (2.58621%)&gt;];
}
1813--2503[label="1;19pkt 19fpkt"];
1813--2888[label="1;19pkt 19fpkt"];
2503--2888[label="1;19pkt 19fpkt"];
</description>
    <slice>
      <filter dst_ip="205.215.135.96" dst_port="80" src_ip="160.225.10.56"/>
    </slice>
    <from sec="1049433032" usec="0"/>
    <to sec="1049433096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="187.197.229.25"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="67.32.128.28"/>
    </slice>
    <from sec="1049432571" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.743346,1.41051,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_276{
style=filled;
color=gray75;
75[label="64.58.81.29s;97pkt 97fpkt", shape=rectangle, color=red];
1711[label="64.58.81.29;110pkt 110fpkt", shape=pentagon, color=darkviolet];
stat276[shape=component, label=&lt;Rules:&lt;BR/&gt;{64.58.81.29:1034, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1034: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
75--1711[label="1;97pkt 97fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="64.58.81.29" src_port="1034"/>
    </slice>
    <from sec="1049432839" usec="0"/>
    <to sec="1049432861" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="219.178.138.30"/>
    </slice>
    <from sec="1049432415" usec="0"/>
    <to sec="1049433293" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="220.14.190.30"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433289" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.225.10.32"/>
    </slice>
    <from sec="1049432446" usec="0"/>
    <to sec="1049433281" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="82.223.235.32"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="178.184.105.33"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433279" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="141.109.177.33"/>
    </slice>
    <from sec="1049432429" usec="0"/>
    <to sec="1049433296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.843005,1.37529,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_283{
style=filled;
color=gray75;
574[label="203.86.82.48;d;78pkt 78fpkt", shape=diamond, color=yellow];
1470[label="203.86.82.48;d;78pkt 78fpkt", shape=hexagon, color=black];
1732[label="205.147.253.33;9pkt 9fpkt", shape=pentagon, color=darkviolet];
1918[label="205.147.246.88;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2152[label="66.107.160.162;20pkt 20fpkt", shape=pentagon, color=darkviolet];
2293[label="4.105.104.216;21pkt 21fpkt", shape=pentagon, color=darkviolet];
2767[label="4.105.104.216;20pkt 20fpkt", shape=invtriangle, color=brown];
stat283[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.105.104.216:80, 203.86.82.48:*}[23.3333%]&lt;BR/&gt;{66.107.160.162:80, *:*}[23.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.3684%)&lt;BR/&gt; 6667: (1.75439%)&lt;BR/&gt; 3383: (0.877193%)&lt;BR/&gt; 3379: (0.877193%)&lt;BR/&gt; 3372: (0.877193%)&gt;];
}
574--1470[label="1;78pkt 78fpkt"];
574--1732[label="0.555556;5pkt 5fpkt"];
574--1918[label="1;2pkt 2fpkt"];
574--2152[label="0.7;14pkt 14fpkt"];
574--2293[label="0.904762;19pkt 19fpkt"];
574--2767[label="0.9;18pkt 18fpkt"];
1470--1732[label="0.555556;5pkt 5fpkt"];
1470--1918[label="1;2pkt 2fpkt"];
1470--2152[label="0.7;14pkt 14fpkt"];
1470--2293[label="0.904762;19pkt 19fpkt"];
1470--2767[label="0.9;18pkt 18fpkt"];
2293--2767[label="1;20pkt 20fpkt"];
</description>
    <slice>
      <filter src_ip="66.107.160.162" src_port="80"/>
      <filter dst_ip="203.86.82.48" src_ip="4.105.104.216" src_port="80"/>
    </slice>
    <from sec="1049432403" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.225.131.34"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.40.75.39"/>
    </slice>
    <from sec="1049432867" usec="0"/>
    <to sec="1049432878" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.225.223.40"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,501,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="136.210.198.41"/>
    </slice>
    <from sec="1049432521" usec="0"/>
    <to sec="1049432712" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="141.109.48.42"/>
    </slice>
    <from sec="1049432436" usec="0"/>
    <to sec="1049433206" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547021,1.37176,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_289{
style=filled;
color=gray75;
1045[label="136.210.201.43;s;56pkt 56fpkt", shape=diamond, color=yellow];
1769[label="136.210.201.43;62pkt 62fpkt", shape=pentagon, color=darkviolet];
stat289[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.210.201.43:80, 67.85.10.189:*}[26.5625%]&lt;BR/&gt;{136.210.201.43:80, 216.242.10.64:*}[23.4375%]&lt;BR/&gt;{136.210.201.43:80, 202.74.187.97:*}[23.4375%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (44.4915%)&lt;BR/&gt; 53: (3.81356%)&lt;BR/&gt; 25: (1.69492%)&lt;BR/&gt; 63089: (0.847458%)&lt;BR/&gt; 60315: (0.847458%)&gt;];
}
1045--1769[label="0.964286;54pkt 54fpkt"];
</description>
    <slice>
      <filter dst_ip="67.85.10.189" src_ip="136.210.201.43" src_port="80"/>
      <filter dst_ip="202.74.187.97" src_ip="136.210.201.43" src_port="80"/>
      <filter dst_ip="216.242.10.64" src_ip="136.210.201.43" src_port="80"/>
    </slice>
    <from sec="1049432413" usec="0"/>
    <to sec="1049433299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.743346,1.41051,503,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_290{
style=filled;
color=gray75;
5[label="160.225.246.45s;1pkt 1fpkt", shape=rectangle, color=red];
1774[label="160.225.246.45;48pkt 48fpkt", shape=pentagon, color=darkviolet];
stat290[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.246.45:*, 163.132.54.216:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1085: (2.04082%)&lt;BR/&gt; 1103: (1.02041%)&lt;BR/&gt; 1102: (1.02041%)&lt;BR/&gt; 1101: (1.02041%)&gt;];
}
5--1774[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="163.132.54.216" dst_port="80" src_ip="160.225.246.45"/>
    </slice>
    <from sec="1049432801" usec="0"/>
    <to sec="1049432833" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="6.27.121.46"/>
    </slice>
    <from sec="1049432576" usec="0"/>
    <to sec="1049432765" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="165.45.200.48"/>
    </slice>
    <from sec="1049432406" usec="0"/>
    <to sec="1049433286" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.225.218.48"/>
    </slice>
    <from sec="1049432594" usec="0"/>
    <to sec="1049432634" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.774106,1.48682,999,0 0 0 0 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_294{
style=filled;
color=gray75;
1402[label="202.138.196.49;s;51pkt 51fpkt", shape=hexagon, color=black];
stat294[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.138.196.49:25, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 1419: (1.96078%)&lt;BR/&gt; 64317: (0.980392%)&lt;BR/&gt; 63866: (0.980392%)&lt;BR/&gt; 54791: (0.980392%)&gt;];
}
1402--1785[label="0.980392;50pkt 50fpkt"];
1402--2487[label="1;51pkt 51fpkt"];
</description>
    <slice>
      <filter src_ip="202.138.196.49" src_port="25"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.225.218.49"/>
    </slice>
    <from sec="1049432838" usec="0"/>
    <to sec="1049433211" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.225.10.52"/>
    </slice>
    <from sec="1049432610" usec="0"/>
    <to sec="1049433113" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="178.184.108.52"/>
    </slice>
    <from sec="1049432410" usec="0"/>
    <to sec="1049433296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="83.196.87.53"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="83.46.96.54"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.774106,1.48682,999,0 0 0 0 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_300{
style=filled;
color=gray75;
1259[label="165.45.42.55;s;80pkt 80fpkt", shape=hexagon, color=black];
stat300[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.45.42.55:*, *:9701}[61.25%]&lt;BR/&gt;{165.45.42.55:*, *:9700}[37.5%]&lt;BR/&gt;{165.45.42.55:*, 64.37.120.235:*}[22.5%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9701: (30.625%)&lt;BR/&gt; 9700: (18.75%)&lt;BR/&gt; 2337: (0.625%)&lt;BR/&gt; 2332: (0.625%)&lt;BR/&gt; 2327: (0.625%)&gt;];
}
1259--1809[label="0.9875;79pkt 79fpkt"];
</description>
    <slice>
      <filter dst_ip="64.37.120.235" src_ip="165.45.42.55"/>
      <filter dst_port="9701" src_ip="165.45.42.55"/>
      <filter dst_port="9700" src_ip="165.45.42.55"/>
    </slice>
    <from sec="1049432404" usec="0"/>
    <to sec="1049432672" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="136.210.209.55"/>
    </slice>
    <from sec="1049432404" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547021,1.37176,020,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_302{
style=filled;
color=gray75;
836[label="202.22.138.56;s;133pkt 133fpkt", shape=diamond, color=yellow];
1817[label="202.22.138.56;139pkt 139fpkt", shape=pentagon, color=darkviolet];
stat302[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.22.138.56:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
836--1437[label="0.0075188;1pkt 1fpkt"];
836--1817[label="0.992481;132pkt 132fpkt"];
</description>
    <slice>
      <filter src_ip="202.22.138.56"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433297" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_303{
style=filled;
color=gray75;
730[label="178.184.217.56;s;115pkt 115fpkt", shape=diamond, color=yellow];
814[label="66.107.232.188;d;36pkt 36fpkt", shape=diamond, color=yellow];
1821[label="178.184.217.56;115pkt 115fpkt", shape=pentagon, color=darkviolet];
2508[label="178.184.217.56;115pkt 115fpkt", shape=invtriangle, color=brown];
2891[label="178.184.217.56;115pkt 115fpkt", shape=invhouse, color=bisque];
stat303[shape=component, label=&lt;Rules:&lt;BR/&gt;{178.184.217.56:*, 66.107.232.188:80}[31.3043%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.7742%)&lt;BR/&gt; 7001: (0.806452%)&lt;BR/&gt; 5190: (0.806452%)&lt;BR/&gt; 1863: (0.806452%)&lt;BR/&gt; 443: (0.806452%)&gt;];
}
730--787[label="0.00869565;1pkt 1fpkt"];
730--814[label="1;36pkt 36fpkt"];
730--866[label="0.0384615;2pkt 2fpkt"];
730--929[label="0.130435;15pkt 15fpkt"];
730--1146[label="0.0192308;1pkt 1fpkt"];
730--1475[label="0.00869565;1pkt 1fpkt"];
730--1821[label="1;115pkt 115fpkt"];
730--2508[label="1;115pkt 115fpkt"];
730--2891[label="1;115pkt 115fpkt"];
814--1821[label="1;36pkt 36fpkt"];
814--2508[label="1;36pkt 36fpkt"];
814--2891[label="1;36pkt 36fpkt"];
1821--2508[label="1;115pkt 115fpkt"];
1821--2891[label="1;115pkt 115fpkt"];
2508--2891[label="1;115pkt 115fpkt"];
</description>
    <slice>
      <filter dst_ip="66.107.232.188" dst_port="80" src_ip="178.184.217.56"/>
    </slice>
    <from sec="1049432679" usec="0"/>
    <to sec="1049432974" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.784275,1.38078,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_304{
style=filled;
color=gray75;
971[label="215.88.219.57;s;663pkt 663fpkt", shape=diamond, color=yellow];
1406[label="215.88.219.57;s;517pkt 517fpkt", shape=hexagon, color=black];
1825[label="215.88.219.57;727pkt 727fpkt", shape=pentagon, color=darkviolet];
stat304[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.88.219.57:1037, *:1434}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1434: (50%)&lt;BR/&gt; 1037: (50%)&gt;];
}
971--1406[label="1;517pkt 517fpkt"];
971--1825[label="1;663pkt 663fpkt"];
1406--1825[label="1;517pkt 517fpkt"];
</description>
    <slice>
      <filter dst_port="1434" src_ip="215.88.219.57" src_port="1037"/>
    </slice>
    <from sec="1049432453" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547021,1.37176,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_305{
style=filled;
color=gray75;
953[label="203.174.79.27;d;2pkt 2fpkt", shape=diamond, color=yellow];
1826[label="136.210.230.57;4pkt 4fpkt", shape=pentagon, color=darkviolet];
stat305[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.210.209.57:2206, 203.174.79.27:6667}[20%]&lt;BR/&gt;{136.210.230.57:1394, 212.40.98.13:5050}[20%]&lt;BR/&gt;{136.210.230.57:25, 65.98.5.135:0}[20%]&lt;BR/&gt;{136.210.230.57:4043, 207.5.146.148:5190}[20%]&lt;BR/&gt;{136.210.230.57:4831, 203.174.79.27:6667}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (25%)&lt;BR/&gt; 4831: (16.6667%)&lt;BR/&gt; 5190: (8.33333%)&lt;BR/&gt; 5050: (8.33333%)&lt;BR/&gt; 4043: (8.33333%)&gt;];
}
953--1826[label="0.5;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="203.174.79.27" dst_port="6667" src_ip="136.210.230.57" src_port="4831"/>
      <filter dst_ip="207.5.146.148" dst_port="5190" src_ip="136.210.230.57" src_port="4043"/>
      <filter dst_ip="65.98.5.135" src_ip="136.210.230.57" src_port="25"/>
      <filter dst_ip="212.40.98.13" dst_port="5050" src_ip="136.210.230.57" src_port="1394"/>
      <filter dst_ip="203.174.79.27" dst_port="6667" src_ip="136.210.209.57" src_port="2206"/>
    </slice>
    <from sec="1049432404" usec="0"/>
    <to sec="1049433285" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="221.228.85.58"/>
    </slice>
    <from sec="1049433018" usec="0"/>
    <to sec="1049433257" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="10.10.40.59"/>
    </slice>
    <from sec="1049432412" usec="0"/>
    <to sec="1049433286" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547021,1.37176,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_308{
style=filled;
color=gray75;
759[label="141.109.163.101;d;1pkt 1fpkt", shape=diamond, color=yellow];
760[label="64.194.69.60;s;1pkt 1fpkt", shape=diamond, color=yellow];
1837[label="64.194.69.60;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat308[shape=component, label=&lt;Rules:&lt;BR/&gt;{64.194.69.60:6699, 141.109.163.101:3173}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 3173: (50%)&gt;];
}
759--760[label="1;1pkt 1fpkt"];
759--1837[label="1;1pkt 1fpkt"];
760--1837[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="141.109.163.101" dst_port="3173" src_ip="64.194.69.60" src_port="6699"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.74.211.61"/>
    </slice>
    <from sec="1049432762" usec="0"/>
    <to sec="1049432951" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="133.132.145.63"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="136.210.214.64"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.86.68.66"/>
    </slice>
    <from sec="1049432407" usec="0"/>
    <to sec="1049433299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_313{
style=filled;
color=gray75;
1180[label="165.236.196.38;d;70pkt 70fpkt", shape=diamond, color=yellow];
1864[label="4.24.96.69;5pkt 5fpkt", shape=pentagon, color=darkviolet];
2238[label="4.4.24.194;19pkt 19fpkt", shape=pentagon, color=darkviolet];
2532[label="4.24.96.69;5pkt 5fpkt", shape=invtriangle, color=brown];
2739[label="4.4.24.194;18pkt 18fpkt", shape=invtriangle, color=brown];
2906[label="4.24.96.69;5pkt 5fpkt", shape=invhouse, color=bisque];
3024[label="4.4.24.194;19pkt 19fpkt", shape=invhouse, color=bisque];
stat313[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.4.24.194:80, 165.236.196.38:*}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.2908%)&lt;BR/&gt; 1934: (1.41844%)&lt;BR/&gt; 1933: (1.41844%)&lt;BR/&gt; 1932: (1.41844%)&lt;BR/&gt; 1931: (1.41844%)&gt;];
}
1180--1864[label="0.8;4pkt 4fpkt"];
1180--2238[label="0.736842;14pkt 14fpkt"];
1180--2532[label="0.8;4pkt 4fpkt"];
1180--2739[label="0.722222;13pkt 13fpkt"];
1180--2906[label="0.8;4pkt 4fpkt"];
1180--3024[label="0.736842;14pkt 14fpkt"];
1864--2532[label="1;5pkt 5fpkt"];
1864--2906[label="1;5pkt 5fpkt"];
2238--2739[label="1;18pkt 18fpkt"];
2238--3024[label="1;19pkt 19fpkt"];
2532--2906[label="1;5pkt 5fpkt"];
2739--3024[label="1;18pkt 18fpkt"];
</description>
    <slice>
      <filter dst_ip="165.236.196.38" src_ip="4.4.24.194" src_port="80"/>
    </slice>
    <from sec="1049433053" usec="0"/>
    <to sec="1049433258" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.86.67.72"/>
    </slice>
    <from sec="1049432489" usec="0"/>
    <to sec="1049433294" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.628332,1.36623,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_315{
style=filled;
color=gray75;
1174[label="165.236.211.73;s;38pkt 38fpkt", shape=diamond, color=yellow];
1877[label="165.236.211.73;44pkt 44fpkt", shape=pentagon, color=darkviolet];
2541[label="165.236.211.73;44pkt 44fpkt", shape=invtriangle, color=brown];
stat315[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.236.211.73:*, 134.138.228.135:80}[56.8182%]&lt;BR/&gt;{165.236.211.73:*, 134.138.224.41:80}[38.6364%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 50137: (1.19048%)&lt;BR/&gt; 50136: (1.19048%)&lt;BR/&gt; 50135: (1.19048%)&lt;BR/&gt; 50134: (1.19048%)&gt;];
}
1174--1877[label="1;38pkt 38fpkt"];
1174--2541[label="1;38pkt 38fpkt"];
1877--2541[label="1;44pkt 44fpkt"];
</description>
    <slice>
      <filter dst_ip="134.138.228.135" dst_port="80" src_ip="165.236.211.73"/>
      <filter dst_ip="134.138.224.41" dst_port="80" src_ip="165.236.211.73"/>
    </slice>
    <from sec="1049432960" usec="0"/>
    <to sec="1049433290" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,020,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_316{
style=filled;
color=gray75;
545[label="197.25.118.74;s;618pkt 618fpkt", shape=diamond, color=yellow];
1878[label="197.25.118.74;665pkt 665fpkt", shape=pentagon, color=darkviolet];
2542[label="197.25.118.74;664pkt 664fpkt", shape=invtriangle, color=brown];
2911[label="197.25.118.74;665pkt 665fpkt", shape=invhouse, color=bisque];
stat316[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.25.118.74:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
545--1878[label="1;618pkt 618fpkt"];
545--2542[label="0.998382;617pkt 617fpkt"];
545--2911[label="1;618pkt 618fpkt"];
1878--2542[label="1;664pkt 664fpkt"];
1878--2911[label="1;665pkt 665fpkt"];
2542--2911[label="1;664pkt 664fpkt"];
</description>
    <slice>
      <filter src_ip="197.25.118.74"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.805067,1.40513,503,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_317{
style=filled;
color=gray75;
12[label="160.225.37.75s;1pkt 1fpkt", shape=rectangle, color=red];
1879[label="160.225.37.75;8pkt 8fpkt", shape=pentagon, color=darkviolet];
2543[label="160.225.37.75;8pkt 8fpkt", shape=invtriangle, color=brown];
stat317[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.37.75:*, 171.16.197.149:80}[62.5%]&lt;BR/&gt;{160.225.37.75:*, 171.16.197.40:80}[37.5%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2571: (8.82353%)&lt;BR/&gt; 2570: (5.88235%)&lt;BR/&gt; 2569: (5.88235%)&lt;BR/&gt; 2568: (5.88235%)&gt;];
}
12--1608[label="1;1pkt 1fpkt"];
12--1879[label="1;1pkt 1fpkt"];
12--2543[label="1;1pkt 1fpkt"];
1879--2543[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="171.16.197.149" dst_port="80" src_ip="160.225.37.75"/>
      <filter dst_ip="171.16.197.40" dst_port="80" src_ip="160.225.37.75"/>
    </slice>
    <from sec="1049432461" usec="0"/>
    <to sec="1049432576" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547021,1.37176,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_318{
style=filled;
color=gray75;
676[label="136.210.193.76;s;160pkt 160fpkt", shape=diamond, color=yellow];
987[label="202.66.133.141;d;77pkt 77fpkt", shape=diamond, color=yellow];
1884[label="136.210.193.76;180pkt 180fpkt", shape=pentagon, color=darkviolet];
stat318[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.210.193.76:80, 202.66.133.141:*}[53.3333%]&lt;BR/&gt;{136.210.193.76:80, 202.72.133.67:*}[26.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.7602%)&lt;BR/&gt; 1728: (0.359712%)&lt;BR/&gt; 1717: (0.359712%)&lt;BR/&gt; 1713: (0.359712%)&lt;BR/&gt; 1711: (0.359712%)&gt;];
}
676--987[label="1;77pkt 77fpkt"];
676--1884[label="1;160pkt 160fpkt"];
987--1884[label="1;77pkt 77fpkt"];
</description>
    <slice>
      <filter dst_ip="202.66.133.141" src_ip="136.210.193.76" src_port="80"/>
      <filter dst_ip="202.72.133.67" src_ip="136.210.193.76" src_port="80"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433289" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="165.45.244.78"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.628332,1.36623,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_320{
style=filled;
color=gray75;
710[label="178.184.162.79;s;90pkt 90fpkt", shape=diamond, color=yellow];
1892[label="178.184.162.79;90pkt 90fpkt", shape=pentagon, color=darkviolet];
2553[label="178.184.162.79;89pkt 89fpkt", shape=invtriangle, color=brown];
stat320[shape=component, label=&lt;Rules:&lt;BR/&gt;{178.184.162.79:*, *:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3822: (0.557621%)&lt;BR/&gt; 3821: (0.557621%)&lt;BR/&gt; 3820: (0.557621%)&lt;BR/&gt; 3819: (0.557621%)&gt;];
}
710--1608[label="0.0111111;1pkt 1fpkt"];
710--1892[label="1;90pkt 90fpkt"];
710--2553[label="1;89pkt 89fpkt"];
1892--2553[label="1;89pkt 89fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="178.184.162.79"/>
    </slice>
    <from sec="1049432520" usec="0"/>
    <to sec="1049432801" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.22.181.81"/>
    </slice>
    <from sec="1049432416" usec="0"/>
    <to sec="1049433235" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.26.44.83"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="182.20.179.86"/>
    </slice>
    <from sec="1049432407" usec="0"/>
    <to sec="1049433288" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="136.210.208.86"/>
    </slice>
    <from sec="1049432403" usec="0"/>
    <to sec="1049433299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="141.109.111.89"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="141.109.53.90"/>
    </slice>
    <from sec="1049432735" usec="0"/>
    <to sec="1049432908" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.843005,1.37529,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_328{
style=filled;
color=gray75;
1081[label="141.109.42.56;d;70pkt 70fpkt", shape=diamond, color=yellow];
1509[label="141.109.42.56;d;70pkt 70fpkt", shape=hexagon, color=black];
1926[label="67.185.165.90;7pkt 7fpkt", shape=pentagon, color=darkviolet];
2220[label="67.185.165.185;61pkt 61fpkt", shape=pentagon, color=darkviolet];
2572[label="67.185.165.90;7pkt 7fpkt", shape=invtriangle, color=brown];
stat328[shape=component, label=&lt;Rules:&lt;BR/&gt;{67.185.165.185:80, 141.109.42.56:*}[48.3516%]&lt;BR/&gt;{*:80, 141.109.80.79:*}[23.0769%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.0698%)&lt;BR/&gt; 2086: (0.930233%)&lt;BR/&gt; 2074: (0.930233%)&lt;BR/&gt; 2050: (0.930233%)&lt;BR/&gt; 2049: (0.930233%)&gt;];
}
1081--1509[label="1;70pkt 70fpkt"];
1081--1926[label="0.571429;4pkt 4fpkt"];
1081--2220[label="0.704918;43pkt 43fpkt"];
1081--2572[label="0.571429;4pkt 4fpkt"];
1509--1926[label="0.571429;4pkt 4fpkt"];
1509--2220[label="0.704918;43pkt 43fpkt"];
1509--2572[label="0.571429;4pkt 4fpkt"];
1926--2572[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="141.109.80.79" src_port="80"/>
      <filter dst_ip="141.109.42.56" src_ip="67.185.165.185" src_port="80"/>
    </slice>
    <from sec="1049432425" usec="0"/>
    <to sec="1049433122" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="136.210.55.92"/>
    </slice>
    <from sec="1049432406" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.149.198.98"/>
    </slice>
    <from sec="1049432604" usec="0"/>
    <to sec="1049432635" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.24.120.99"/>
    </slice>
    <from sec="1049433079" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547021,1.37176,502,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_332{
style=filled;
color=gray75;
991[label="186.175.85.100;s;2pkt 2fpkt", shape=diamond, color=yellow];
1072[label="171.13.237.118;d;2pkt 2fpkt", shape=diamond, color=yellow];
1954[label="186.175.85.100;2pkt 2fpkt", shape=pentagon, color=darkviolet];
stat332[shape=component, label=&lt;Rules:&lt;BR/&gt;{186.175.85.100:22, 171.13.237.118:4497}[50%]&lt;BR/&gt;{186.175.85.100:44953, 171.13.237.118:113}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 44953: (25%)&lt;BR/&gt; 4497: (25%)&lt;BR/&gt; 113: (25%)&lt;BR/&gt; 22: (25%)&gt;];
}
991--1072[label="1;2pkt 2fpkt"];
991--1954[label="1;2pkt 2fpkt"];
1072--1954[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="171.13.237.118" dst_port="113" src_ip="186.175.85.100" src_port="44953"/>
      <filter dst_ip="171.13.237.118" dst_port="4497" src_ip="186.175.85.100" src_port="22"/>
    </slice>
    <from sec="1049432533" usec="0"/>
    <to sec="1049433241" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.225.35.101"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_334{
style=filled;
color=gray75;
461[label="141.109.56.169;d;59pkt 59fpkt", shape=diamond, color=yellow];
1960[label="217.45.16.103;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2593[label="217.45.16.103;4pkt 4fpkt", shape=invtriangle, color=brown];
2936[label="217.45.16.103;4pkt 4fpkt", shape=invhouse, color=bisque];
stat334[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.45.16.116:80, 141.109.56.169:*}[44.0678%]&lt;BR/&gt;{217.45.16.70:80, 141.109.56.169:*}[25.4237%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.2857%)&lt;BR/&gt; 3266: (2.85714%)&lt;BR/&gt; 3264: (2.85714%)&lt;BR/&gt; 3214: (2.85714%)&lt;BR/&gt; 3213: (2.14286%)&gt;];
}
461--1960[label="1;3pkt 3fpkt"];
461--2593[label="1;4pkt 4fpkt"];
461--2936[label="1;4pkt 4fpkt"];
1960--2593[label="1;3pkt 3fpkt"];
1960--2936[label="1;3pkt 3fpkt"];
2593--2936[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="141.109.56.169" src_ip="217.45.16.116" src_port="80"/>
      <filter dst_ip="141.109.56.169" src_ip="217.45.16.70" src_port="80"/>
    </slice>
    <from sec="1049432439" usec="0"/>
    <to sec="1049432843" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="67.178.209.105"/>
    </slice>
    <from sec="1049432722" usec="0"/>
    <to sec="1049432732" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.225.228.105"/>
    </slice>
    <from sec="1049433180" usec="0"/>
    <to sec="1049433217" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="141.109.54.106"/>
    </slice>
    <from sec="1049432827" usec="0"/>
    <to sec="1049432930" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.235.32.107"/>
    </slice>
    <from sec="1049432416" usec="0"/>
    <to sec="1049433298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="6.96.95.107"/>
    </slice>
    <from sec="1049432912" usec="0"/>
    <to sec="1049433157" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_340{
style=filled;
color=gray75;
366[label="165.236.218.186;d;25pkt 25fpkt", shape=diamond, color=yellow];
493[label="207.5.95.126;s;1pkt 1fpkt", shape=diamond, color=yellow];
720[label="207.5.95.155;s;8pkt 8fpkt", shape=diamond, color=yellow];
873[label="165.236.188.11;d;103pkt 103fpkt", shape=diamond, color=yellow];
1979[label="67.178.203.109;18pkt 18fpkt", shape=pentagon, color=darkviolet];
2130[label="207.5.95.155;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2603[label="67.178.203.109;18pkt 18fpkt", shape=invtriangle, color=brown];
2626[label="207.5.95.126;1pkt 1fpkt", shape=invtriangle, color=brown];
2962[label="207.5.95.126;1pkt 1fpkt", shape=invhouse, color=bisque];
stat340[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 165.236.188.11:*}[75.1825%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (43.75%)&lt;BR/&gt; 554: (4.82955%)&lt;BR/&gt; 6970: (1.13636%)&lt;BR/&gt; 2014: (1.13636%)&lt;BR/&gt; 4888: (0.852273%)&gt;];
}
366--493[label="1;1pkt 1fpkt"];
366--720[label="1;8pkt 8fpkt"];
366--1979[label="0.0555556;1pkt 1fpkt"];
366--2130[label="1;1pkt 1fpkt"];
366--2603[label="0.0555556;1pkt 1fpkt"];
366--2626[label="1;1pkt 1fpkt"];
366--2962[label="1;1pkt 1fpkt"];
493--2626[label="1;1pkt 1fpkt"];
493--2962[label="1;1pkt 1fpkt"];
720--2130[label="1;1pkt 1fpkt"];
873--1070[label="1;12pkt 12fpkt"];
873--1419[label="0.00970874;1pkt 1fpkt"];
873--1503[label="1;12pkt 12fpkt"];
873--1979[label="0.444444;8pkt 8fpkt"];
873--2603[label="0.444444;8pkt 8fpkt"];
1979--2603[label="1;18pkt 18fpkt"];
2626--2962[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="165.236.188.11" src_port="80"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547021,1.37176,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_341{
style=filled;
color=gray75;
1113[label="215.66.163.110;s;545pkt 545fpkt", shape=diamond, color=yellow];
1981[label="215.66.163.110;593pkt 593fpkt", shape=pentagon, color=darkviolet];
stat341[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.66.163.110:3049, *:1434}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3049: (50%)&lt;BR/&gt; 1434: (50%)&gt;];
}
1113--1981[label="0.998165;544pkt 544fpkt"];
</description>
    <slice>
      <filter dst_port="1434" src_ip="215.66.163.110" src_port="3049"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.225.246.110"/>
    </slice>
    <from sec="1049433163" usec="0"/>
    <to sec="1049433235" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.26.215.112"/>
    </slice>
    <from sec="1049432574" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="165.236.213.114"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547021,1.37176,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_345{
style=filled;
color=gray75;
633[label="215.66.189.115;s;1129pkt 1129fpkt", shape=diamond, color=yellow];
1994[label="215.66.189.115;1198pkt 1198fpkt", shape=pentagon, color=darkviolet];
stat345[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.66.189.115:3140, *:1434}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3140: (50%)&lt;BR/&gt; 1434: (50%)&gt;];
}
633--1994[label="0.998229;1127pkt 1127fpkt"];
</description>
    <slice>
      <filter dst_port="1434" src_ip="215.66.189.115" src_port="3140"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.843005,1.37529,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_346{
style=filled;
color=gray75;
1003[label="160.225.210.115;s;104pkt 104fpkt", shape=diamond, color=yellow];
1413[label="160.225.210.115;s;104pkt 104fpkt", shape=hexagon, color=black];
1996[label="160.225.210.115;103pkt 103fpkt", shape=pentagon, color=darkviolet];
2612[label="160.225.210.115;104pkt 104fpkt", shape=invtriangle, color=brown];
stat346[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.210.115:*, 32.24.159.90:80}[56.7308%]&lt;BR/&gt;{160.225.210.115:*, 7.145.158.142:80}[20.1923%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4126: (0.481928%)&lt;BR/&gt; 4125: (0.481928%)&lt;BR/&gt; 4124: (0.481928%)&lt;BR/&gt; 4123: (0.481928%)&gt;];
}
1003--1413[label="1;104pkt 104fpkt"];
1003--1996[label="1;103pkt 103fpkt"];
1003--2612[label="1;104pkt 104fpkt"];
1413--1996[label="1;103pkt 103fpkt"];
1413--2612[label="1;104pkt 104fpkt"];
1996--2612[label="1;103pkt 103fpkt"];
</description>
    <slice>
      <filter dst_ip="32.24.159.90" dst_port="80" src_ip="160.225.210.115"/>
      <filter dst_ip="7.145.158.142" dst_port="80" src_ip="160.225.210.115"/>
    </slice>
    <from sec="1049432928" usec="0"/>
    <to sec="1049433025" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.225.120.116"/>
    </slice>
    <from sec="1049432689" usec="0"/>
    <to sec="1049432729" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.225.143.116"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.225.207.117"/>
    </slice>
    <from sec="1049432570" usec="0"/>
    <to sec="1049433266" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.44.77.122"/>
    </slice>
    <from sec="1049432883" usec="0"/>
    <to sec="1049432905" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="207.5.95.126"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049432630" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.16.202.127"/>
    </slice>
    <from sec="1049432581" usec="0"/>
    <to sec="1049432607" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.173.179.128"/>
    </slice>
    <from sec="1049432612" usec="0"/>
    <to sec="1049432643" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.225.101.130"/>
    </slice>
    <from sec="1049432414" usec="0"/>
    <to sec="1049433298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,020,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_355{
style=filled;
color=gray75;
865[label="193.61.251.39;d;3pkt 3fpkt", shape=diamond, color=yellow];
1823[label="160.225.86.57;1pkt 1fpkt", shape=pentagon, color=darkviolet];
1906[label="160.225.86.85;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2045[label="160.225.37.133;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2642[label="160.225.37.133;1pkt 1fpkt", shape=invtriangle, color=brown];
2892[label="160.225.86.57;1pkt 1fpkt", shape=invhouse, color=bisque];
stat355[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.86.57:0, 193.61.251.39:0}[33.3333%]&lt;BR/&gt;{160.225.86.85:0, 193.61.251.39:0}[33.3333%]&lt;BR/&gt;{160.225.37.133:0, 193.61.251.39:0}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
865--1823[label="1;1pkt 1fpkt"];
865--1906[label="1;1pkt 1fpkt"];
865--2045[label="1;1pkt 1fpkt"];
865--2642[label="1;1pkt 1fpkt"];
865--2892[label="1;1pkt 1fpkt"];
1823--2892[label="1;1pkt 1fpkt"];
2045--2642[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="193.61.251.39" src_ip="160.225.37.133"/>
      <filter dst_ip="193.61.251.39" src_ip="160.225.86.85"/>
      <filter dst_ip="193.61.251.39" src_ip="160.225.86.57"/>
    </slice>
    <from sec="1049432405" usec="0"/>
    <to sec="1049433299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.784275,1.38078,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_356{
style=filled;
color=gray75;
689[label="160.225.238.133;s;32pkt 32fpkt", shape=diamond, color=yellow];
1309[label="160.225.238.133;s;32pkt 32fpkt", shape=hexagon, color=black];
2050[label="160.225.238.133;33pkt 33fpkt", shape=pentagon, color=darkviolet];
stat356[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.238.133:80, 51.224.142.59:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.9072%)&lt;BR/&gt; 0: (6.18557%)&lt;BR/&gt; 62832: (1.54639%)&lt;BR/&gt; 62831: (1.54639%)&lt;BR/&gt; 62830: (1.54639%)&gt;];
}
689--1309[label="1;32pkt 32fpkt"];
689--2050[label="1;32pkt 32fpkt"];
1309--2050[label="1;32pkt 32fpkt"];
</description>
    <slice>
      <filter dst_ip="51.224.142.59" src_ip="160.225.238.133" src_port="80"/>
    </slice>
    <from sec="1049432404" usec="0"/>
    <to sec="1049433214" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="178.184.25.134"/>
    </slice>
    <from sec="1049432402" usec="0"/>
    <to sec="1049433292" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="141.109.50.134"/>
    </slice>
    <from sec="1049432803" usec="0"/>
    <to sec="1049433190" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="165.56.167.134"/>
    </slice>
    <from sec="1049433081" usec="0"/>
    <to sec="1049433089" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.86.66.137"/>
    </slice>
    <from sec="1049432413" usec="0"/>
    <to sec="1049433298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="6.62.108.137"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="165.45.194.137"/>
    </slice>
    <from sec="1049432408" usec="0"/>
    <to sec="1049433285" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.106.54.138"/>
    </slice>
    <from sec="1049432551" usec="0"/>
    <to sec="1049433267" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="133.132.145.139"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="69.6.96.140"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.22.138.140"/>
    </slice>
    <from sec="1049432404" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="220.37.226.140"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049432928" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="165.45.43.144"/>
    </slice>
    <from sec="1049432488" usec="0"/>
    <to sec="1049433169" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.843005,1.37529,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_369{
style=filled;
color=gray75;
849[label="165.236.196.34;d;69pkt 69fpkt", shape=diamond, color=yellow];
1397[label="165.236.196.34;d;58pkt 58fpkt", shape=hexagon, color=black];
1687[label="202.225.12.23;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2428[label="202.225.12.23;2pkt 2fpkt", shape=invtriangle, color=brown];
stat369[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.225.12.80:80, 165.236.196.34:*}[37.6812%]&lt;BR/&gt;{4.55.211.144:80, 165.236.196.34:*}[31.8841%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.2366%)&lt;BR/&gt; 1678: (1.52672%)&lt;BR/&gt; 1677: (1.52672%)&lt;BR/&gt; 1863: (0.763359%)&lt;BR/&gt; 1696: (0.763359%)&gt;];
}
849--1397[label="1;58pkt 58fpkt"];
849--1687[label="1;2pkt 2fpkt"];
849--2096[label="0.578947;22pkt 22fpkt"];
849--2428[label="1;2pkt 2fpkt"];
1397--1687[label="1;2pkt 2fpkt"];
1397--2096[label="0.578947;22pkt 22fpkt"];
1397--2428[label="1;2pkt 2fpkt"];
1687--2428[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="165.236.196.34" src_ip="202.225.12.80" src_port="80"/>
      <filter dst_ip="165.236.196.34" src_ip="4.55.211.144" src_port="80"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433176" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.203.25.146"/>
    </slice>
    <from sec="1049432407" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.37.73.149"/>
    </slice>
    <from sec="1049433270" usec="0"/>
    <to sec="1049433287" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,502,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.24.167.150"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.225.209.150"/>
    </slice>
    <from sec="1049432414" usec="0"/>
    <to sec="1049432750" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.4.49.152"/>
    </slice>
    <from sec="1049432413" usec="0"/>
    <to sec="1049433294" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="136.210.204.153"/>
    </slice>
    <from sec="1049432417" usec="0"/>
    <to sec="1049433293" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547021,1.37176,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_376{
style=filled;
color=gray75;
835[label="4.38.213.153;s;846pkt 846fpkt", shape=diamond, color=yellow];
2124[label="4.38.213.153;916pkt 916fpkt", shape=pentagon, color=darkviolet];
stat376[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.38.213.153:1127, *:1434}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1434: (50%)&lt;BR/&gt; 1127: (50%)&gt;];
}
835--2124[label="1;846pkt 846fpkt"];
</description>
    <slice>
      <filter dst_port="1434" src_ip="4.38.213.153" src_port="1127"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="136.210.216.153"/>
    </slice>
    <from sec="1049432405" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="213.25.19.157"/>
    </slice>
    <from sec="1049432405" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="67.178.41.157"/>
    </slice>
    <from sec="1049432675" usec="0"/>
    <to sec="1049433198" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.628332,1.36623,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_380{
style=filled;
color=gray75;
1171[label="202.72.96.159;d;20pkt 20fpkt", shape=diamond, color=yellow];
2137[label="136.210.204.157;9pkt 9fpkt", shape=pentagon, color=darkviolet];
2687[label="136.210.204.157;9pkt 9fpkt", shape=invtriangle, color=brown];
stat380[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.210.204.201:80, 202.72.96.159:*}[37.5%]&lt;BR/&gt;{136.210.212.212:80, 202.72.96.159:*}[25%]&lt;BR/&gt;{136.210.204.157:80, 202.72.96.159:*}[20.8333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (39.4737%)&lt;BR/&gt; 25: (10.5263%)&lt;BR/&gt; 17605: (3.94737%)&lt;BR/&gt; 17603: (3.94737%)&lt;BR/&gt; 17502: (3.94737%)&gt;];
}
1171--2137[label="0.555556;5pkt 5fpkt"];
1171--2687[label="0.555556;5pkt 5fpkt"];
2137--2687[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="202.72.96.159" src_ip="136.210.204.201" src_port="80"/>
      <filter dst_ip="202.72.96.159" src_ip="136.210.204.157" src_port="80"/>
      <filter dst_ip="202.72.96.159" src_ip="136.210.212.212" src_port="80"/>
    </slice>
    <from sec="1049432602" usec="0"/>
    <to sec="1049433183" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.743346,1.41051,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_381{
style=filled;
color=gray75;
92[label="214.81.83.158s;109pkt 109fpkt", shape=rectangle, color=red];
2139[label="214.81.83.158;133pkt 133fpkt", shape=pentagon, color=darkviolet];
stat381[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.81.83.158:63413, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 63413: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
92--2139[label="1;109pkt 109fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="214.81.83.158" src_port="63413"/>
    </slice>
    <from sec="1049432867" usec="0"/>
    <to sec="1049432889" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="3.166.41.159"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.805067,1.40513,002,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_383{
style=filled;
color=gray75;
93[label="202.78.45.160s;252pkt 252fpkt", shape=rectangle, color=red];
2141[label="202.78.45.160;252pkt 252fpkt", shape=pentagon, color=darkviolet];
2689[label="202.78.45.160;251pkt 251fpkt", shape=invtriangle, color=brown];
stat383[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.78.45.160:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
93--2141[label="1;252pkt 252fpkt"];
93--2689[label="1;251pkt 251fpkt"];
2141--2689[label="1;251pkt 251fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="202.78.45.160" src_port="1029"/>
    </slice>
    <from sec="1049432801" usec="0"/>
    <to sec="1049432840" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="162.3.102.161"/>
    </slice>
    <from sec="1049432403" usec="0"/>
    <to sec="1049433299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="138.67.247.161"/>
    </slice>
    <from sec="1049432410" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547021,1.37176,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_386{
style=filled;
color=gray75;
930[label="136.210.204.162;s;3pkt 3fpkt", shape=diamond, color=yellow];
2153[label="136.210.204.162;2pkt 2fpkt", shape=pentagon, color=darkviolet];
stat386[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.210.204.162:2984, 207.5.147.41:5190}[33.3333%]&lt;BR/&gt;{136.210.204.162:3006, 202.212.68.92:6665}[33.3333%]&lt;BR/&gt;{136.210.204.162:2941, 212.40.98.245:5050}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5190: (20%)&lt;BR/&gt; 5050: (20%)&lt;BR/&gt; 2984: (20%)&lt;BR/&gt; 2941: (20%)&lt;BR/&gt; 6665: (10%)&gt;];
}
930--2153[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="212.40.98.245" dst_port="5050" src_ip="136.210.204.162" src_port="2941"/>
      <filter dst_ip="202.212.68.92" dst_port="6665" src_ip="136.210.204.162" src_port="3006"/>
      <filter dst_ip="207.5.147.41" dst_port="5190" src_ip="136.210.204.162" src_port="2984"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.843005,1.37529,999,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_387{
style=filled;
color=gray75;
295[label="66.16.187.214;d;1pkt 1fpkt", shape=diamond, color=yellow];
407[label="179.70.3.200;d;1pkt 1fpkt", shape=diamond, color=yellow];
419[label="212.18.117.137;d;2pkt 2fpkt", shape=diamond, color=yellow];
501[label="69.16.123.95;d;1pkt 1fpkt", shape=diamond, color=yellow];
502[label="160.225.85.163;s;17pkt 17fpkt", shape=diamond, color=yellow];
515[label="41.168.135.161;d;1pkt 1fpkt", shape=diamond, color=yellow];
533[label="66.113.105.170;d;1pkt 1fpkt", shape=diamond, color=yellow];
816[label="51.225.245.238;d;1pkt 1fpkt", shape=diamond, color=yellow];
1235[label="212.18.117.137;d;2pkt 2fpkt", shape=hexagon, color=black];
1297[label="179.70.3.200;d;1pkt 1fpkt", shape=hexagon, color=black];
1359[label="66.113.105.170;d;1pkt 1fpkt", shape=hexagon, color=black];
1523[label="160.225.85.163;s;17pkt 17fpkt", shape=hexagon, color=black];
2157[label="160.225.85.163;17pkt 17fpkt", shape=pentagon, color=darkviolet];
2698[label="160.225.85.163;17pkt 17fpkt", shape=invtriangle, color=brown];
stat387[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.85.163:*, *:6699}[73.6842%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (47.5%)&lt;BR/&gt; 63518: (3.75%)&lt;BR/&gt; 63307: (3.75%)&lt;BR/&gt; 62650: (3.75%)&lt;BR/&gt; 63486: (3.125%)&gt;];
}
295--502[label="1;1pkt 1fpkt"];
295--1523[label="1;1pkt 1fpkt"];
295--2157[label="1;1pkt 1fpkt"];
295--2698[label="1;1pkt 1fpkt"];
407--502[label="1;1pkt 1fpkt"];
407--1297[label="1;1pkt 1fpkt"];
407--1523[label="1;1pkt 1fpkt"];
407--2157[label="1;1pkt 1fpkt"];
407--2698[label="1;1pkt 1fpkt"];
419--502[label="0.5;1pkt 1fpkt"];
419--1235[label="1;2pkt 2fpkt"];
419--1523[label="0.5;1pkt 1fpkt"];
419--2157[label="0.5;1pkt 1fpkt"];
419--2698[label="0.5;1pkt 1fpkt"];
501--502[label="1;1pkt 1fpkt"];
501--1523[label="1;1pkt 1fpkt"];
501--2157[label="1;1pkt 1fpkt"];
501--2698[label="1;1pkt 1fpkt"];
502--515[label="1;1pkt 1fpkt"];
502--533[label="1;1pkt 1fpkt"];
502--816[label="1;1pkt 1fpkt"];
502--1235[label="0.5;1pkt 1fpkt"];
502--1297[label="1;1pkt 1fpkt"];
502--1359[label="1;1pkt 1fpkt"];
502--1523[label="1;17pkt 17fpkt"];
502--2157[label="0.941176;16pkt 16fpkt"];
502--2698[label="0.941176;16pkt 16fpkt"];
515--1523[label="1;1pkt 1fpkt"];
515--2157[label="1;1pkt 1fpkt"];
515--2698[label="1;1pkt 1fpkt"];
533--1359[label="1;1pkt 1fpkt"];
533--1523[label="1;1pkt 1fpkt"];
533--2157[label="1;1pkt 1fpkt"];
533--2698[label="1;1pkt 1fpkt"];
816--1523[label="1;1pkt 1fpkt"];
816--2157[label="1;1pkt 1fpkt"];
816--2698[label="1;1pkt 1fpkt"];
1235--1523[label="0.5;1pkt 1fpkt"];
1235--2157[label="0.5;1pkt 1fpkt"];
1235--2698[label="0.5;1pkt 1fpkt"];
1297--1523[label="1;1pkt 1fpkt"];
1297--2157[label="1;1pkt 1fpkt"];
1297--2698[label="1;1pkt 1fpkt"];
1359--1523[label="1;1pkt 1fpkt"];
1359--2157[label="1;1pkt 1fpkt"];
1359--2698[label="1;1pkt 1fpkt"];
1523--2157[label="0.941176;16pkt 16fpkt"];
1523--2698[label="0.941176;16pkt 16fpkt"];
2157--2698[label="1;17pkt 17fpkt"];
</description>
    <slice>
      <filter dst_port="6699" src_ip="160.225.85.163"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="138.67.247.165"/>
    </slice>
    <from sec="1049432402" usec="0"/>
    <to sec="1049433299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.128.38.166"/>
    </slice>
    <from sec="1049432591" usec="0"/>
    <to sec="1049432626" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="219.12.169.166"/>
    </slice>
    <from sec="1049432888" usec="0"/>
    <to sec="1049432892" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.805067,1.40513,002,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_391{
style=filled;
color=gray75;
96[label="214.95.66.168s;77pkt 77fpkt", shape=rectangle, color=red];
2170[label="214.95.66.168;172pkt 172fpkt", shape=pentagon, color=darkviolet];
2703[label="214.95.66.168;172pkt 172fpkt", shape=invtriangle, color=brown];
stat391[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.95.66.168:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
96--1615[label="1;77pkt 77fpkt"];
96--1618[label="1;77pkt 77fpkt"];
96--2170[label="1;77pkt 77fpkt"];
96--2703[label="1;77pkt 77fpkt"];
2170--2703[label="1;172pkt 172fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="214.95.66.168" src_port="1028"/>
    </slice>
    <from sec="1049433111" usec="0"/>
    <to sec="1049433144" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547021,1.37176,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_392{
style=filled;
color=gray75;
370[label="197.174.212.168;s;842pkt 842fpkt", shape=diamond, color=yellow];
2171[label="197.174.212.168;911pkt 911fpkt", shape=pentagon, color=darkviolet];
stat392[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.174.212.168:53, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (50.2282%)&lt;BR/&gt; 1414: (0.256703%)&lt;BR/&gt; 1082: (0.22818%)&lt;BR/&gt; 1339: (0.199658%)&lt;BR/&gt; 1265: (0.199658%)&gt;];
}
370--2171[label="1;842pkt 842fpkt"];
</description>
    <slice>
      <filter src_ip="197.174.212.168" src_port="53"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="138.67.247.168"/>
    </slice>
    <from sec="1049432411" usec="0"/>
    <to sec="1049433297" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.805067,1.40513,503,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_394{
style=filled;
color=gray75;
33[label="141.109.104.171s;2pkt 2fpkt", shape=rectangle, color=red];
2181[label="141.109.104.171;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2710[label="141.109.104.171;3pkt 3fpkt", shape=invtriangle, color=brown];
stat394[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.109.104.171:3280, 212.202.42.156:80}[25%]&lt;BR/&gt;{141.109.104.171:3282, 212.202.42.156:80}[25%]&lt;BR/&gt;{141.109.104.171:3284, 212.202.42.156:80}[25%]&lt;BR/&gt;{141.109.104.171:3286, 212.202.42.156:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3282: (18.75%)&lt;BR/&gt; 3286: (12.5%)&lt;BR/&gt; 3284: (12.5%)&lt;BR/&gt; 3280: (6.25%)&gt;];
}
33--2181[label="0.5;1pkt 1fpkt"];
33--2710[label="0.5;1pkt 1fpkt"];
2181--2710[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="212.202.42.156" dst_port="80" src_ip="141.109.104.171" src_port="3286"/>
      <filter dst_ip="212.202.42.156" dst_port="80" src_ip="141.109.104.171" src_port="3284"/>
      <filter dst_ip="212.202.42.156" dst_port="80" src_ip="141.109.104.171" src_port="3282"/>
      <filter dst_ip="212.202.42.156" dst_port="80" src_ip="141.109.104.171" src_port="3280"/>
    </slice>
    <from sec="1049432617" usec="0"/>
    <to sec="1049432663" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="141.109.153.172"/>
    </slice>
    <from sec="1049432440" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.628332,1.36623,020,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_397{
style=filled;
color=gray75;
857[label="202.154.205.176;s;337pkt 337fpkt", shape=diamond, color=yellow];
2196[label="202.154.205.176;356pkt 356fpkt", shape=pentagon, color=darkviolet];
2721[label="202.154.205.176;356pkt 356fpkt", shape=invtriangle, color=brown];
stat397[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.154.205.176:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
857--2196[label="0.997033;336pkt 336fpkt"];
857--2721[label="0.997033;336pkt 336fpkt"];
2196--2721[label="1;356pkt 356fpkt"];
</description>
    <slice>
      <filter src_ip="202.154.205.176"/>
    </slice>
    <from sec="1049432402" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547021,1.37176,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_398{
style=filled;
color=gray75;
230[label="165.45.17.177;s;718pkt 718fpkt", shape=diamond, color=yellow];
231[label="212.181.39.186;d;1pkt 1fpkt", shape=diamond, color=yellow];
257[label="51.34.20.75;d;1pkt 1fpkt", shape=diamond, color=yellow];
344[label="67.4.118.225;d;1pkt 1fpkt", shape=diamond, color=yellow];
363[label="51.83.8.14;d;1pkt 1fpkt", shape=diamond, color=yellow];
755[label="213.65.77.30;d;1pkt 1fpkt", shape=diamond, color=yellow];
2197[label="165.45.17.177;757pkt 757fpkt", shape=pentagon, color=darkviolet];
stat398[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.45.17.177:6257, *:6257}[96.3061%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6257: (97.027%)&lt;BR/&gt; 6699: (0.912162%)&lt;BR/&gt; 16257: (0.27027%)&lt;BR/&gt; 3845: (0.101351%)&lt;BR/&gt; 3441: (0.101351%)&gt;];
}
230--231[label="1;1pkt 1fpkt"];
230--257[label="1;1pkt 1fpkt"];
230--344[label="1;1pkt 1fpkt"];
230--363[label="1;1pkt 1fpkt"];
230--388[label="0.5;1pkt 1fpkt"];
230--402[label="1;1pkt 1fpkt"];
230--755[label="1;1pkt 1fpkt"];
230--1232[label="1;1pkt 1fpkt"];
230--1251[label="0.5;1pkt 1fpkt"];
230--2197[label="0.998607;717pkt 717fpkt"];
231--2197[label="1;1pkt 1fpkt"];
257--2197[label="1;1pkt 1fpkt"];
344--2197[label="1;1pkt 1fpkt"];
363--2197[label="1;1pkt 1fpkt"];
755--2197[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="6257" src_ip="165.45.17.177" src_port="6257"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.86.64.177"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.225.200.180"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.225.68.182"/>
    </slice>
    <from sec="1049433070" usec="0"/>
    <to sec="1049433194" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.743346,1.41051,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_402{
style=filled;
color=gray75;
99[label="165.14.81.183s;52pkt 52fpkt", shape=rectangle, color=red];
2211[label="165.14.81.183;103pkt 103fpkt", shape=pentagon, color=darkviolet];
stat402[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.14.81.183:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
99--2211[label="1;52pkt 52fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="165.14.81.183" src_port="1029"/>
    </slice>
    <from sec="1049432881" usec="0"/>
    <to sec="1049432898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.235.235.184"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.180.62.185"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433293" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.225.76.185"/>
    </slice>
    <from sec="1049432413" usec="0"/>
    <to sec="1049433292" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="67.116.54.186"/>
    </slice>
    <from sec="1049432619" usec="0"/>
    <to sec="1049432644" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="66.107.225.187"/>
    </slice>
    <from sec="1049432439" usec="0"/>
    <to sec="1049433275" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.131.183.188"/>
    </slice>
    <from sec="1049432497" usec="0"/>
    <to sec="1049432580" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.852297,1.46343,002,1 0 0 0 0 0 0 0 0 0 1 0 ">
    <description>subgraph cluster_409{
style=filled;
color=gray75;
102[label="214.35.87.189s;74pkt 74fpkt", shape=rectangle, color=red];
2734[label="214.35.87.189;129pkt 129fpkt", shape=invtriangle, color=brown];
stat409[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.35.87.189:1036, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1036: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
102--2231[label="1;74pkt 74fpkt"];
102--2734[label="0.986486;73pkt 73fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="214.35.87.189" src_port="1036"/>
    </slice>
    <from sec="1049432863" usec="0"/>
    <to sec="1049432903" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.113.19.195"/>
    </slice>
    <from sec="1049432402" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.215.229.195"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433293" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="136.210.217.196"/>
    </slice>
    <from sec="1049432493" usec="0"/>
    <to sec="1049433257" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="66.107.133.197"/>
    </slice>
    <from sec="1049432725" usec="0"/>
    <to sec="1049433020" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.37.163.197"/>
    </slice>
    <from sec="1049432421" usec="0"/>
    <to sec="1049433299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.226.222.197"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="64.11.200.201"/>
    </slice>
    <from sec="1049433025" usec="0"/>
    <to sec="1049433213" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.86.64.203"/>
    </slice>
    <from sec="1049432494" usec="0"/>
    <to sec="1049433285" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.225.133.203"/>
    </slice>
    <from sec="1049432455" usec="0"/>
    <to sec="1049433283" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="136.210.200.211"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.215.50.213"/>
    </slice>
    <from sec="1049432719" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.3.0.214"/>
    </slice>
    <from sec="1049432403" usec="0"/>
    <to sec="1049433298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="136.210.212.216"/>
    </slice>
    <from sec="1049432416" usec="0"/>
    <to sec="1049433277" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="6.73.111.217"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049432961" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="64.117.101.218"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049432521" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.37.163.220"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="165.45.209.220"/>
    </slice>
    <from sec="1049432409" usec="0"/>
    <to sec="1049433277" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.86.65.221"/>
    </slice>
    <from sec="1049432716" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="165.45.209.221"/>
    </slice>
    <from sec="1049432410" usec="0"/>
    <to sec="1049433287" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="178.184.152.222"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="165.236.210.222"/>
    </slice>
    <from sec="1049433022" usec="0"/>
    <to sec="1049433218" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,020,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_431{
style=filled;
color=gray75;
665[label="165.49.0.229;s;487pkt 487fpkt", shape=diamond, color=yellow];
2331[label="165.49.0.229;526pkt 526fpkt", shape=pentagon, color=darkviolet];
2786[label="165.49.0.229;526pkt 526fpkt", shape=invtriangle, color=brown];
3051[label="165.49.0.229;526pkt 526fpkt", shape=invhouse, color=bisque];
stat431[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.49.0.229:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
665--2331[label="1;487pkt 487fpkt"];
665--2786[label="1;487pkt 487fpkt"];
665--3051[label="1;487pkt 487fpkt"];
2331--2786[label="1;526pkt 526fpkt"];
2331--3051[label="1;526pkt 526fpkt"];
2786--3051[label="1;526pkt 526fpkt"];
</description>
    <slice>
      <filter src_ip="165.49.0.229"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.215.50.230"/>
    </slice>
    <from sec="1049432411" usec="0"/>
    <to sec="1049433291" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="136.210.241.232"/>
    </slice>
    <from sec="1049432565" usec="0"/>
    <to sec="1049433277" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.26.42.233"/>
    </slice>
    <from sec="1049432700" usec="0"/>
    <to sec="1049433207" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.225.6.234"/>
    </slice>
    <from sec="1049432406" usec="0"/>
    <to sec="1049433299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.628332,1.36623,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_436{
style=filled;
color=gray75;
1096[label="163.123.143.1;d;92pkt 92fpkt", shape=diamond, color=yellow];
1097[label="178.184.128.236;s;92pkt 92fpkt", shape=diamond, color=yellow];
2347[label="178.184.128.236;91pkt 91fpkt", shape=pentagon, color=darkviolet];
2796[label="178.184.128.236;92pkt 92fpkt", shape=invtriangle, color=brown];
stat436[shape=component, label=&lt;Rules:&lt;BR/&gt;{178.184.128.236:*, 163.123.143.1:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1249: (0.544959%)&lt;BR/&gt; 1248: (0.544959%)&lt;BR/&gt; 1247: (0.544959%)&lt;BR/&gt; 1246: (0.544959%)&gt;];
}
1096--1097[label="1;92pkt 92fpkt"];
1096--2347[label="1;91pkt 91fpkt"];
1096--2796[label="1;92pkt 92fpkt"];
1097--2347[label="1;91pkt 91fpkt"];
1097--2796[label="1;92pkt 92fpkt"];
2347--2796[label="1;91pkt 91fpkt"];
</description>
    <slice>
      <filter dst_ip="163.123.143.1" dst_port="80" src_ip="178.184.128.236"/>
    </slice>
    <from sec="1049433037" usec="0"/>
    <to sec="1049433148" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.225.146.238"/>
    </slice>
    <from sec="1049432411" usec="0"/>
    <to sec="1049433280" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="165.236.164.239"/>
    </slice>
    <from sec="1049432492" usec="0"/>
    <to sec="1049433105" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.547021,1.37176,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_439{
style=filled;
color=gray75;
444[label="160.225.204.240;s;23pkt 23fpkt", shape=diamond, color=yellow];
476[label="212.50.200.250;d;1pkt 1fpkt", shape=diamond, color=yellow];
2355[label="160.225.204.240;31pkt 31fpkt", shape=pentagon, color=darkviolet];
stat439[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.204.240:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4494: (2.72727%)&lt;BR/&gt; 59272: (1.81818%)&lt;BR/&gt; 58055: (1.81818%)&lt;BR/&gt; 45852: (1.81818%)&gt;];
}
444--476[label="1;1pkt 1fpkt"];
444--2355[label="1;23pkt 23fpkt"];
476--2355[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="160.225.204.240" src_port="80"/>
    </slice>
    <from sec="1049432402" usec="0"/>
    <to sec="1049433293" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.945562,1.42602,504,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_440{
style=filled;
color=gray75;
117[label="160.225.209.242s;1pkt 1fpkt", shape=rectangle, color=red];
2360[label="160.225.209.242;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2806[label="160.225.209.242;1pkt 1fpkt", shape=invtriangle, color=brown];
3063[label="160.225.209.242;1pkt 1fpkt", shape=invhouse, color=bisque];
stat440[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.209.242:4645, 66.11.89.85:80}[50%]&lt;BR/&gt;{160.225.209.242:4646, 66.11.89.86:443}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4645: (30%)&lt;BR/&gt; 80: (30%)&lt;BR/&gt; 4646: (20%)&lt;BR/&gt; 443: (20%)&gt;];
}
117--2360[label="1;1pkt 1fpkt"];
2360--2806[label="1;1pkt 1fpkt"];
2360--3063[label="1;1pkt 1fpkt"];
2806--3063[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="66.11.89.86" dst_port="443" src_ip="160.225.209.242" src_port="4646"/>
      <filter dst_ip="66.11.89.85" dst_port="80" src_ip="160.225.209.242" src_port="4645"/>
    </slice>
    <from sec="1049432512" usec="0"/>
    <to sec="1049432524" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.80.235.242"/>
    </slice>
    <from sec="1049432406" usec="0"/>
    <to sec="1049432898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.237.167.243"/>
    </slice>
    <from sec="1049432532" usec="0"/>
    <to sec="1049432959" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.33.76.244"/>
    </slice>
    <from sec="1049432410" usec="0"/>
    <to sec="1049433297" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="221.5.244.244"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433288" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.225.0.245"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.628332,1.36623,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_446{
style=filled;
color=gray75;
217[label="165.236.164.238;d;18pkt 18fpkt", shape=diamond, color=yellow];
1655[label="199.43.138.14;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2412[label="199.43.138.14;1pkt 1fpkt", shape=invtriangle, color=brown];
stat446[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.131.130.246:*, 165.236.164.238:80}[27.7778%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.5%)&lt;BR/&gt; 31205: (7.5%)&lt;BR/&gt; 65499: (2.5%)&lt;BR/&gt; 60093: (2.5%)&lt;BR/&gt; 42375: (2.5%)&gt;];
}
217--247[label="1;1pkt 1fpkt"];
217--1608[label="0.111111;2pkt 2fpkt"];
217--1655[label="1;1pkt 1fpkt"];
217--2370[label="0.8;4pkt 4fpkt"];
217--2412[label="1;1pkt 1fpkt"];
1655--2412[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="165.236.164.238" dst_port="80" src_ip="202.131.130.246"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.225.218.247"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="221.41.2.248"/>
    </slice>
    <from sec="1049432402" usec="0"/>
    <to sec="1049433297" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.628332,1.36623,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_450{
style=filled;
color=gray75;
1100[label="69.78.96.255;s;4pkt 4fpkt", shape=diamond, color=yellow];
1101[label="141.109.236.218;d;4pkt 4fpkt", shape=diamond, color=yellow];
2388[label="69.78.96.255;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2824[label="69.78.96.255;2pkt 2fpkt", shape=invtriangle, color=brown];
stat450[shape=component, label=&lt;Rules:&lt;BR/&gt;{69.78.96.255:2903, 141.109.236.218:2919}[25%]&lt;BR/&gt;{69.78.96.255:2903, 141.109.236.218:2920}[25%]&lt;BR/&gt;{69.78.96.255:2903, 141.109.236.218:2921}[25%]&lt;BR/&gt;{69.78.96.255:2903, 141.109.236.218:2922}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2903: (50%)&lt;BR/&gt; 2922: (18.1818%)&lt;BR/&gt; 2919: (13.6364%)&lt;BR/&gt; 2921: (9.09091%)&lt;BR/&gt; 2920: (9.09091%)&gt;];
}
1100--1101[label="1;4pkt 4fpkt"];
1100--2388[label="1;1pkt 1fpkt"];
1100--2824[label="1;2pkt 2fpkt"];
1101--2388[label="1;1pkt 1fpkt"];
1101--2824[label="1;2pkt 2fpkt"];
2388--2824[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="141.109.236.218" dst_port="2922" src_ip="69.78.96.255" src_port="2903"/>
      <filter dst_ip="141.109.236.218" dst_port="2921" src_ip="69.78.96.255" src_port="2903"/>
      <filter dst_ip="141.109.236.218" dst_port="2920" src_ip="69.78.96.255" src_port="2903"/>
      <filter dst_ip="141.109.236.218" dst_port="2919" src_ip="69.78.96.255" src_port="2903"/>
    </slice>
    <from sec="1049433040" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.628332,1.36623,020,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_451{
style=filled;
color=gray75;
656[label="203.86.68.0;s;327pkt 327fpkt", shape=diamond, color=yellow];
1619[label="203.86.68.0;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2389[label="203.86.68.0;1pkt 1fpkt", shape=invtriangle, color=brown];
stat451[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.86.68.0:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
656--1619[label="1;1pkt 1fpkt"];
656--2389[label="1;1pkt 1fpkt"];
1619--2389[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="203.86.68.0"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_452{
style=filled;
color=gray75;
1620[label="67.246.36.1;5pkt 5fpkt", shape=pentagon, color=darkviolet];
2390[label="67.246.36.1;5pkt 5fpkt", shape=invtriangle, color=brown];
stat452[shape=component, label=&lt;Rules:&lt;BR/&gt;{67.246.36.1:7210, 203.86.71.131:53}[20%]&lt;BR/&gt;{67.246.36.1:24140, 203.86.71.131:53}[20%]&lt;BR/&gt;{67.246.36.1:30929, 203.86.71.131:53}[20%]&lt;BR/&gt;{67.246.36.1:40316, 203.86.71.131:53}[20%]&lt;BR/&gt;{67.246.36.1:65518, 203.86.71.131:53}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (50%)&lt;BR/&gt; 65518: (10%)&lt;BR/&gt; 40316: (10%)&lt;BR/&gt; 30929: (10%)&lt;BR/&gt; 24140: (10%)&gt;];
}
1620--2390[label="1;5pkt 5fpkt"];
1620--2825[label="1;5pkt 5fpkt"];
2390--2825[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="203.86.71.131" dst_port="53" src_ip="67.246.36.1" src_port="65518"/>
      <filter dst_ip="203.86.71.131" dst_port="53" src_ip="67.246.36.1" src_port="40316"/>
      <filter dst_ip="203.86.71.131" dst_port="53" src_ip="67.246.36.1" src_port="30929"/>
      <filter dst_ip="203.86.71.131" dst_port="53" src_ip="67.246.36.1" src_port="24140"/>
      <filter dst_ip="203.86.71.131" dst_port="53" src_ip="67.246.36.1" src_port="7210"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="7.130.136.1"/>
    </slice>
    <from sec="1049432405" usec="0"/>
    <to sec="1049433297" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,020,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_454{
style=filled;
color=gray75;
1624[label="203.86.71.2;67pkt 67fpkt", shape=pentagon, color=darkviolet];
2393[label="203.86.71.2;67pkt 67fpkt", shape=invtriangle, color=brown];
stat454[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.86.71.2:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1624--2393[label="1;67pkt 67fpkt"];
</description>
    <slice>
      <filter src_ip="203.86.71.2"/>
    </slice>
    <from sec="1049432453" usec="0"/>
    <to sec="1049433296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,504,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_455{
style=filled;
color=gray75;
1639[label="67.169.78.9;12pkt 12fpkt", shape=pentagon, color=darkviolet];
2399[label="67.169.78.9;11pkt 11fpkt", shape=invtriangle, color=brown];
2831[label="67.169.78.9;11pkt 11fpkt", shape=invhouse, color=bisque];
stat455[shape=component, label=&lt;Rules:&lt;BR/&gt;{67.169.78.9:443, 141.109.66.147:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (50%)&lt;BR/&gt; 2643: (4.41176%)&lt;BR/&gt; 2642: (4.41176%)&lt;BR/&gt; 2641: (4.41176%)&lt;BR/&gt; 2640: (4.41176%)&gt;];
}
1639--2399[label="1;11pkt 11fpkt"];
1639--2831[label="1;11pkt 11fpkt"];
2399--2831[label="1;11pkt 11fpkt"];
</description>
    <slice>
      <filter dst_ip="141.109.66.147" src_ip="67.169.78.9" src_port="443"/>
    </slice>
    <from sec="1049432442" usec="0"/>
    <to sec="1049433284" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="178.184.85.10"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.945562,1.42602,503,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_457{
style=filled;
color=gray75;
2[label="165.45.44.12s;8pkt 8fpkt", shape=rectangle, color=red];
1645[label="165.45.44.12;25pkt 25fpkt", shape=pentagon, color=darkviolet];
2404[label="165.45.44.12;25pkt 25fpkt", shape=invtriangle, color=brown];
2835[label="165.45.44.12;25pkt 25fpkt", shape=invhouse, color=bisque];
stat457[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.45.44.12:*, 212.73.47.58:80}[32%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (37.3494%)&lt;BR/&gt; 1863: (5.42169%)&lt;BR/&gt; 7001: (3.61446%)&lt;BR/&gt; 1127: (2.40964%)&lt;BR/&gt; 1126: (2.40964%)&gt;];
}
2--1645[label="1;8pkt 8fpkt"];
2--2404[label="1;8pkt 8fpkt"];
2--2835[label="1;8pkt 8fpkt"];
1645--2404[label="1;25pkt 25fpkt"];
1645--2835[label="1;25pkt 25fpkt"];
2404--2835[label="1;25pkt 25fpkt"];
</description>
    <slice>
      <filter dst_ip="212.73.47.58" dst_port="80" src_ip="165.45.44.12"/>
    </slice>
    <from sec="1049432489" usec="0"/>
    <to sec="1049433291" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_458{
style=filled;
color=gray75;
1652[label="160.225.220.13;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2409[label="160.225.220.13;1pkt 1fpkt", shape=invtriangle, color=brown];
2839[label="160.225.220.13;1pkt 1fpkt", shape=invhouse, color=bisque];
stat458[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.220.13:2663, 67.185.177.82:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2663: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
1652--2409[label="1;1pkt 1fpkt"];
1652--2839[label="1;1pkt 1fpkt"];
2409--2839[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="67.185.177.82" dst_port="80" src_ip="160.225.220.13" src_port="2663"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_459{
style=filled;
color=gray75;
247[label="199.43.138.14;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat459[shape=component, label=&lt;Rules:&lt;BR/&gt;{199.43.138.14:31205, 165.236.164.238:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 31205: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
247--1608[label="1;1pkt 1fpkt"];
247--1655[label="1;1pkt 1fpkt"];
247--2412[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="165.236.164.238" dst_port="80" src_ip="199.43.138.14" src_port="31205"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049432586" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_460{
style=filled;
color=gray75;
1659[label="165.54.50.16;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2415[label="165.54.50.16;2pkt 2fpkt", shape=invtriangle, color=brown];
2843[label="165.54.50.16;3pkt 3fpkt", shape=invhouse, color=bisque];
stat460[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.54.50.16:1210, 171.13.194.158:80}[33.3333%]&lt;BR/&gt;{165.54.50.16:1211, 171.13.194.158:80}[33.3333%]&lt;BR/&gt;{165.54.50.16:1212, 171.13.194.158:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1212: (18.75%)&lt;BR/&gt; 1211: (18.75%)&lt;BR/&gt; 1210: (12.5%)&gt;];
}
1659--2415[label="1;2pkt 2fpkt"];
1659--2843[label="1;3pkt 3fpkt"];
2415--2843[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="171.13.194.158" dst_port="80" src_ip="165.54.50.16" src_port="1212"/>
      <filter dst_ip="171.13.194.158" dst_port="80" src_ip="165.54.50.16" src_port="1211"/>
      <filter dst_ip="171.13.194.158" dst_port="80" src_ip="165.54.50.16" src_port="1210"/>
    </slice>
    <from sec="1049432591" usec="0"/>
    <to sec="1049432684" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.945562,1.42602,002,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_461{
style=filled;
color=gray75;
72[label="4.30.4.18s;96pkt 96fpkt", shape=rectangle, color=red];
1667[label="4.30.4.18;193pkt 193fpkt", shape=pentagon, color=darkviolet];
2418[label="4.30.4.18;192pkt 192fpkt", shape=invtriangle, color=brown];
2845[label="4.30.4.18;193pkt 193fpkt", shape=invhouse, color=bisque];
stat461[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.30.4.18:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
72--1667[label="1;96pkt 96fpkt"];
72--2418[label="0.989583;95pkt 95fpkt"];
72--2845[label="1;96pkt 96fpkt"];
1667--2418[label="1;192pkt 192fpkt"];
1667--2845[label="1;193pkt 193fpkt"];
2418--2845[label="1;192pkt 192fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.30.4.18" src_port="1026"/>
    </slice>
    <from sec="1049432446" usec="0"/>
    <to sec="1049432476" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="203.0.100.20"/>
    </slice>
    <from sec="1049432411" usec="0"/>
    <to sec="1049433292" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_463{
style=filled;
color=gray75;
420[label="141.109.56.22;s;50pkt 50fpkt", shape=diamond, color=yellow];
1683[label="141.109.56.22;54pkt 54fpkt", shape=pentagon, color=darkviolet];
2425[label="141.109.56.22;54pkt 54fpkt", shape=invtriangle, color=brown];
2851[label="141.109.56.22;54pkt 54fpkt", shape=invhouse, color=bisque];
stat463[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.109.56.22:*, 212.161.227.90:80}[76.3636%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 49526: (0.943396%)&lt;BR/&gt; 49525: (0.943396%)&lt;BR/&gt; 49524: (0.943396%)&lt;BR/&gt; 49523: (0.943396%)&gt;];
}
420--466[label="0.74;37pkt 37fpkt"];
420--1021[label="0.139535;6pkt 6fpkt"];
420--1267[label="0.74;37pkt 37fpkt"];
420--1450[label="0.146341;6pkt 6fpkt"];
420--1608[label="0.18;9pkt 9fpkt"];
420--1683[label="0.98;49pkt 49fpkt"];
420--2425[label="0.98;49pkt 49fpkt"];
420--2851[label="0.98;49pkt 49fpkt"];
1683--2425[label="1;54pkt 54fpkt"];
1683--2851[label="1;54pkt 54fpkt"];
2425--2851[label="1;54pkt 54fpkt"];
</description>
    <slice>
      <filter dst_ip="212.161.227.90" dst_port="80" src_ip="141.109.56.22"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433235" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_464{
style=filled;
color=gray75;
1691[label="160.225.142.23;20pkt 20fpkt", shape=pentagon, color=darkviolet];
2432[label="160.225.142.23;19pkt 19fpkt", shape=invtriangle, color=brown];
2855[label="160.225.142.23;19pkt 19fpkt", shape=invhouse, color=bisque];
stat464[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.142.23:*, 195.48.28.231:80}[65%]&lt;BR/&gt;{160.225.142.23:*, 195.48.28.129:80}[30%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.4138%)&lt;BR/&gt; 1863: (2.58621%)&lt;BR/&gt; 1451: (2.58621%)&lt;BR/&gt; 1450: (2.58621%)&lt;BR/&gt; 1449: (2.58621%)&gt;];
}
1691--2432[label="1;19pkt 19fpkt"];
1691--2855[label="1;19pkt 19fpkt"];
2432--2855[label="1;19pkt 19fpkt"];
</description>
    <slice>
      <filter dst_ip="195.48.28.231" dst_port="80" src_ip="160.225.142.23"/>
      <filter dst_ip="195.48.28.129" dst_port="80" src_ip="160.225.142.23"/>
    </slice>
    <from sec="1049432471" usec="0"/>
    <to sec="1049433263" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.628332,1.36623,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_465{
style=filled;
color=gray75;
704[label="212.45.1.30;s;10pkt 10fpkt", shape=diamond, color=yellow];
728[label="141.109.56.9;d;8pkt 8fpkt", shape=diamond, color=yellow];
1713[label="212.45.1.30;10pkt 10fpkt", shape=pentagon, color=darkviolet];
1716[label="212.45.1.31;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2443[label="212.45.1.30;9pkt 9fpkt", shape=invtriangle, color=brown];
stat465[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.45.1.30:80, 141.109.56.9:*}[50%]&lt;BR/&gt;{212.45.1.30:80, 141.109.51.6:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2489: (5.26316%)&lt;BR/&gt; 2488: (5.26316%)&lt;BR/&gt; 2487: (5.26316%)&lt;BR/&gt; 2485: (5.26316%)&gt;];
}
704--728[label="0.75;6pkt 6fpkt"];
704--1713[label="1;10pkt 10fpkt"];
704--2443[label="1;9pkt 9fpkt"];
728--1713[label="0.75;6pkt 6fpkt"];
728--1716[label="1;1pkt 1fpkt"];
728--2443[label="0.75;6pkt 6fpkt"];
1713--2443[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="141.109.56.9" src_ip="212.45.1.30" src_port="80"/>
      <filter dst_ip="141.109.51.6" src_ip="212.45.1.30" src_port="80"/>
    </slice>
    <from sec="1049432462" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="220.14.190.30"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433289" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="212.45.1.31"/>
    </slice>
    <from sec="1049432712" usec="0"/>
    <to sec="1049432721" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_468{
style=filled;
color=gray75;
1717[label="4.47.64.31;193pkt 193fpkt", shape=pentagon, color=darkviolet];
2446[label="4.47.64.31;193pkt 193fpkt", shape=invtriangle, color=brown];
stat468[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.47.64.31:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
1717--2446[label="1;193pkt 193fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.47.64.31" src_port="1025"/>
    </slice>
    <from sec="1049432911" usec="0"/>
    <to sec="1049432949" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,501,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_469{
style=filled;
color=gray75;
1729[label="136.210.194.33;8pkt 8fpkt", shape=pentagon, color=darkviolet];
2451[label="136.210.194.33;9pkt 9fpkt", shape=invtriangle, color=brown];
2863[label="136.210.194.33;8pkt 8fpkt", shape=invhouse, color=bisque];
stat469[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.210.194.33:*, 67.177.107.181:21}[88.8889%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (44%)&lt;BR/&gt; 5190: (6%)&lt;BR/&gt; 4569: (6%)&lt;BR/&gt; 4567: (6%)&lt;BR/&gt; 4565: (6%)&gt;];
}
1729--2451[label="1;8pkt 8fpkt"];
1729--2863[label="1;8pkt 8fpkt"];
2451--2863[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="67.177.107.181" dst_port="21" src_ip="136.210.194.33"/>
    </slice>
    <from sec="1049432536" usec="0"/>
    <to sec="1049433178" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_470{
style=filled;
color=gray75;
1738[label="202.26.208.34;4pkt 4fpkt", shape=pentagon, color=darkviolet];
2459[label="202.26.208.34;5pkt 5fpkt", shape=invtriangle, color=brown];
stat470[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.26.208.34:2641, 205.147.247.149:80}[20%]&lt;BR/&gt;{202.26.208.34:2642, 205.147.247.149:80}[20%]&lt;BR/&gt;{202.26.208.34:2644, 205.147.247.149:80}[20%]&lt;BR/&gt;{202.26.208.34:2645, 205.147.247.149:80}[20%]&lt;BR/&gt;{202.26.208.34:2646, 205.147.247.149:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2646: (11.1111%)&lt;BR/&gt; 2645: (11.1111%)&lt;BR/&gt; 2644: (11.1111%)&lt;BR/&gt; 2642: (11.1111%)&gt;];
}
1738--2459[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="205.147.247.149" dst_port="80" src_ip="202.26.208.34" src_port="2646"/>
      <filter dst_ip="205.147.247.149" dst_port="80" src_ip="202.26.208.34" src_port="2645"/>
      <filter dst_ip="205.147.247.149" dst_port="80" src_ip="202.26.208.34" src_port="2644"/>
      <filter dst_ip="205.147.247.149" dst_port="80" src_ip="202.26.208.34" src_port="2642"/>
      <filter dst_ip="205.147.247.149" dst_port="80" src_ip="202.26.208.34" src_port="2641"/>
    </slice>
    <from sec="1049432722" usec="0"/>
    <to sec="1049433279" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_471{
style=filled;
color=gray75;
1739[label="165.236.17.35;12pkt 12fpkt", shape=pentagon, color=darkviolet];
2460[label="165.236.17.35;13pkt 13fpkt", shape=invtriangle, color=brown];
2869[label="165.236.17.35;13pkt 13fpkt", shape=invhouse, color=bisque];
stat471[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.236.17.35:*, 205.105.172.115:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2803: (3.94737%)&lt;BR/&gt; 2794: (3.94737%)&lt;BR/&gt; 2791: (3.94737%)&lt;BR/&gt; 2787: (3.94737%)&gt;];
}
1739--2460[label="1;12pkt 12fpkt"];
1739--2869[label="1;12pkt 12fpkt"];
2460--2869[label="1;13pkt 13fpkt"];
</description>
    <slice>
      <filter dst_ip="205.105.172.115" dst_port="80" src_ip="165.236.17.35"/>
    </slice>
    <from sec="1049432711" usec="0"/>
    <to sec="1049432992" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_472{
style=filled;
color=gray75;
1744[label="141.109.246.35;6pkt 6fpkt", shape=pentagon, color=darkviolet];
2463[label="141.109.246.35;7pkt 7fpkt", shape=invtriangle, color=brown];
stat472[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.109.246.35:*, 4.62.137.242:80}[42.8571%]&lt;BR/&gt;{141.109.246.35:*, 67.64.131.50:80}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3899: (7.69231%)&lt;BR/&gt; 3898: (7.69231%)&lt;BR/&gt; 3891: (7.69231%)&lt;BR/&gt; 3890: (7.69231%)&gt;];
}
1744--2463[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="4.62.137.242" dst_port="80" src_ip="141.109.246.35"/>
      <filter dst_ip="67.64.131.50" dst_port="80" src_ip="141.109.246.35"/>
    </slice>
    <from sec="1049433079" usec="0"/>
    <to sec="1049433229" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_473{
style=filled;
color=gray75;
1747[label="165.45.250.36;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2465[label="165.45.250.36;1pkt 1fpkt", shape=invtriangle, color=brown];
2871[label="165.45.250.36;1pkt 1fpkt", shape=invhouse, color=bisque];
stat473[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.45.250.36:2234, 69.144.81.186:4689}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4689: (50%)&lt;BR/&gt; 2234: (50%)&gt;];
}
1747--2465[label="1;1pkt 1fpkt"];
1747--2871[label="1;1pkt 1fpkt"];
2465--2871[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="69.144.81.186" dst_port="4689" src_ip="165.45.250.36" src_port="2234"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="212.40.75.39"/>
    </slice>
    <from sec="1049432867" usec="0"/>
    <to sec="1049432878" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_475{
style=filled;
color=gray75;
1755[label="141.109.154.40;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2472[label="141.109.154.40;3pkt 3fpkt", shape=invtriangle, color=brown];
2875[label="141.109.154.40;3pkt 3fpkt", shape=invhouse, color=bisque];
stat475[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.109.154.40:27110, 67.185.174.181:80}[33.3333%]&lt;BR/&gt;{141.109.154.40:27108, 67.185.154.138:80}[33.3333%]&lt;BR/&gt;{141.109.154.40:27109, 67.185.154.138:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 27110: (16.6667%)&lt;BR/&gt; 27109: (16.6667%)&lt;BR/&gt; 27108: (16.6667%)&gt;];
}
1755--2472[label="1;3pkt 3fpkt"];
1755--2875[label="1;3pkt 3fpkt"];
2472--2875[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="67.185.154.138" dst_port="80" src_ip="141.109.154.40" src_port="27109"/>
      <filter dst_ip="67.185.154.138" dst_port="80" src_ip="141.109.154.40" src_port="27108"/>
      <filter dst_ip="67.185.174.181" dst_port="80" src_ip="141.109.154.40" src_port="27110"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_476{
style=filled;
color=gray75;
1763[label="203.86.64.42;23pkt 23fpkt", shape=pentagon, color=darkviolet];
2475[label="203.86.64.42;23pkt 23fpkt", shape=invtriangle, color=brown];
stat476[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.86.64.42:*, 130.187.168.133:80}[21.7391%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (19.5652%)&lt;BR/&gt; 53: (6.52174%)&lt;BR/&gt; 26220: (4.34783%)&lt;BR/&gt; 4662: (4.34783%)&lt;BR/&gt; 1957: (4.34783%)&gt;];
}
1763--2475[label="1;23pkt 23fpkt"];
</description>
    <slice>
      <filter dst_ip="130.187.168.133" dst_port="80" src_ip="203.86.64.42"/>
    </slice>
    <from sec="1049432674" usec="0"/>
    <to sec="1049433155" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_477{
style=filled;
color=gray75;
1764[label="67.169.78.42;12pkt 12fpkt", shape=pentagon, color=darkviolet];
2476[label="67.169.78.42;11pkt 11fpkt", shape=invtriangle, color=brown];
stat477[shape=component, label=&lt;Rules:&lt;BR/&gt;{67.169.78.42:80, 141.109.44.69:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1168: (4.34783%)&lt;BR/&gt; 1166: (4.34783%)&lt;BR/&gt; 1164: (4.34783%)&lt;BR/&gt; 1150: (4.34783%)&gt;];
}
1764--2476[label="1;11pkt 11fpkt"];
</description>
    <slice>
      <filter dst_ip="141.109.44.69" src_ip="67.169.78.42" src_port="80"/>
    </slice>
    <from sec="1049432863" usec="0"/>
    <to sec="1049433131" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_478{
style=filled;
color=gray75;
1772[label="4.3.202.45;168pkt 168fpkt", shape=pentagon, color=darkviolet];
2480[label="4.3.202.45;167pkt 167fpkt", shape=invtriangle, color=brown];
2879[label="4.3.202.45;168pkt 168fpkt", shape=invhouse, color=bisque];
stat478[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.3.202.45:1032, *:1434}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1434: (50%)&lt;BR/&gt; 1032: (50%)&gt;];
}
1772--2480[label="1;167pkt 167fpkt"];
1772--2879[label="1;168pkt 168fpkt"];
2480--2879[label="1;167pkt 167fpkt"];
</description>
    <slice>
      <filter dst_port="1434" src_ip="4.3.202.45" src_port="1032"/>
    </slice>
    <from sec="1049432404" usec="0"/>
    <to sec="1049433032" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.628332,1.36623,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_479{
style=filled;
color=gray75;
479[label="136.210.195.46;s;7pkt 7fpkt", shape=diamond, color=yellow];
1778[label="136.210.195.46;9pkt 9fpkt", shape=pentagon, color=darkviolet];
2482[label="136.210.195.46;9pkt 9fpkt", shape=invtriangle, color=brown];
stat479[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.210.195.46:25, 64.69.76.205:*}[33.3333%]&lt;BR/&gt;{136.210.195.46:*, 219.187.163.171:*}[33.3333%]&lt;BR/&gt;{136.210.195.46:80, *:*}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (32%)&lt;BR/&gt; 80: (12%)&lt;BR/&gt; 58517: (6%)&lt;BR/&gt; 41391: (6%)&lt;BR/&gt; 34595: (6%)&gt;];
}
479--601[label="0.142857;1pkt 1fpkt"];
479--1375[label="0.142857;1pkt 1fpkt"];
479--1778[label="1;7pkt 7fpkt"];
479--2482[label="1;7pkt 7fpkt"];
1778--2482[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="219.187.163.171" src_ip="136.210.195.46"/>
      <filter src_ip="136.210.195.46" src_port="80"/>
      <filter dst_ip="64.69.76.205" src_ip="136.210.195.46" src_port="25"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433291" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="165.45.200.48"/>
    </slice>
    <from sec="1049432406" usec="0"/>
    <to sec="1049433286" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.628332,1.36623,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_481{
style=filled;
color=gray75;
1013[label="165.45.145.50;s;125pkt 125fpkt", shape=diamond, color=yellow];
1787[label="165.45.145.50;134pkt 134fpkt", shape=pentagon, color=darkviolet];
2488[label="165.45.145.50;133pkt 133fpkt", shape=invtriangle, color=brown];
stat481[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.45.145.50:8000, 69.101.82.84:*}[29.1045%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8000: (49.2347%)&lt;BR/&gt; 3746: (0.765306%)&lt;BR/&gt; 2368: (0.765306%)&lt;BR/&gt; 80: (0.765306%)&lt;BR/&gt; 3731: (0.637755%)&gt;];
}
1013--1787[label="1;125pkt 125fpkt"];
1013--2488[label="0.992;124pkt 124fpkt"];
1787--2488[label="1;133pkt 133fpkt"];
</description>
    <slice>
      <filter dst_ip="69.101.82.84" src_ip="165.45.145.50" src_port="8000"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433284" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_482{
style=filled;
color=gray75;
1794[label="202.22.162.52;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2491[label="202.22.162.52;1pkt 1fpkt", shape=invtriangle, color=brown];
stat482[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.22.162.52:1242, 212.40.3.7:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1242: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
1794--2491[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="212.40.3.7" dst_port="80" src_ip="202.22.162.52" src_port="1242"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="83.196.87.53"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,020,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_484{
style=filled;
color=gray75;
1800[label="136.210.201.53;106pkt 106fpkt", shape=pentagon, color=darkviolet];
2494[label="136.210.201.53;106pkt 106fpkt", shape=invtriangle, color=brown];
2883[label="136.210.201.53;105pkt 105fpkt", shape=invhouse, color=bisque];
stat484[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.210.201.53:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1800--2494[label="1;106pkt 106fpkt"];
1800--2883[label="1;105pkt 105fpkt"];
2494--2883[label="1;105pkt 105fpkt"];
</description>
    <slice>
      <filter src_ip="136.210.201.53"/>
    </slice>
    <from sec="1049432414" usec="0"/>
    <to sec="1049433296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.861544,1.35556,503,1 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_485{
style=filled;
color=gray75;
54[label="160.225.82.54s;49pkt 49fpkt", shape=rectangle, color=red];
473[label="180.141.29.61;d;86pkt 86fpkt", shape=diamond, color=yellow];
576[label="160.225.82.54;s;364pkt 364fpkt", shape=diamond, color=yellow];
1193[label="66.160.33.0;d;106pkt 106fpkt", shape=diamond, color=yellow];
1801[label="160.225.82.54;421pkt 421fpkt", shape=pentagon, color=darkviolet];
2495[label="160.225.82.54;421pkt 421fpkt", shape=invtriangle, color=brown];
stat485[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.82.54:*, 66.160.33.0:80}[33.2542%]&lt;BR/&gt;{160.225.82.54:*, 180.141.29.61:80}[20.4276%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.4105%)&lt;BR/&gt; 3416: (1.24395%)&lt;BR/&gt; 53: (1.24395%)&lt;BR/&gt; 1863: (0.276434%)&lt;BR/&gt; 1798: (0.24188%)&gt;];
}
54--576[label="0.387755;19pkt 19fpkt"];
54--1193[label="0.387755;19pkt 19fpkt"];
54--1801[label="1;49pkt 49fpkt"];
54--2495[label="1;49pkt 49fpkt"];
473--576[label="1;86pkt 86fpkt"];
473--1608[label="0.372093;32pkt 32fpkt"];
473--1801[label="1;86pkt 86fpkt"];
473--2495[label="1;86pkt 86fpkt"];
576--637[label="0.010989;1pkt 1fpkt"];
576--863[label="0.0181818;1pkt 1fpkt"];
576--1139[label="0.0147059;1pkt 1fpkt"];
576--1193[label="1;106pkt 106fpkt"];
576--1608[label="0.159341;58pkt 58fpkt"];
576--1801[label="1;364pkt 364fpkt"];
576--2495[label="1;364pkt 364fpkt"];
1193--1801[label="1;106pkt 106fpkt"];
1193--2495[label="1;106pkt 106fpkt"];
1801--2495[label="1;421pkt 421fpkt"];
</description>
    <slice>
      <filter dst_ip="66.160.33.0" dst_port="80" src_ip="160.225.82.54"/>
      <filter dst_ip="180.141.29.61" dst_port="80" src_ip="160.225.82.54"/>
    </slice>
    <from sec="1049432403" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_486{
style=filled;
color=gray75;
1805[label="165.45.173.54;4pkt 4fpkt", shape=pentagon, color=darkviolet];
2497[label="165.45.173.54;3pkt 3fpkt", shape=invtriangle, color=brown];
stat486[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.45.173.54:2338, 205.215.48.240:1863}[25%]&lt;BR/&gt;{165.45.173.54:2396, 4.198.141.81:80}[25%]&lt;BR/&gt;{165.45.173.54:2397, 4.198.141.81:80}[25%]&lt;BR/&gt;{165.45.173.54:2398, 4.198.141.81:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (42.8571%)&lt;BR/&gt; 2398: (14.2857%)&lt;BR/&gt; 2397: (14.2857%)&lt;BR/&gt; 2396: (14.2857%)&lt;BR/&gt; 2338: (7.14286%)&gt;];
}
1805--2497[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="4.198.141.81" dst_port="80" src_ip="165.45.173.54" src_port="2398"/>
      <filter dst_ip="4.198.141.81" dst_port="80" src_ip="165.45.173.54" src_port="2397"/>
      <filter dst_ip="4.198.141.81" dst_port="80" src_ip="165.45.173.54" src_port="2396"/>
      <filter dst_ip="205.215.48.240" dst_port="1863" src_ip="165.45.173.54" src_port="2338"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.945562,1.42602,002,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_487{
style=filled;
color=gray75;
80[label="64.58.184.54s;240pkt 240fpkt", shape=rectangle, color=red];
1806[label="64.58.184.54;239pkt 239fpkt", shape=pentagon, color=darkviolet];
2498[label="64.58.184.54;239pkt 239fpkt", shape=invtriangle, color=brown];
2885[label="64.58.184.54;240pkt 240fpkt", shape=invhouse, color=bisque];
stat487[shape=component, label=&lt;Rules:&lt;BR/&gt;{64.58.184.54:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
80--1806[label="1;239pkt 239fpkt"];
80--2498[label="1;239pkt 239fpkt"];
80--2885[label="1;240pkt 240fpkt"];
1806--2498[label="1;239pkt 239fpkt"];
1806--2885[label="1;239pkt 239fpkt"];
2498--2885[label="1;239pkt 239fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="64.58.184.54" src_port="1029"/>
    </slice>
    <from sec="1049432967" usec="0"/>
    <to sec="1049433005" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_488{
style=filled;
color=gray75;
1811[label="202.235.200.55;202pkt 202fpkt", shape=pentagon, color=darkviolet];
2501[label="202.235.200.55;202pkt 202fpkt", shape=invtriangle, color=brown];
2886[label="202.235.200.55;203pkt 203fpkt", shape=invhouse, color=bisque];
stat488[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.235.200.55:1791, *:1434}[99.5074%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1791: (49.7529%)&lt;BR/&gt; 1434: (49.7529%)&lt;BR/&gt; 0: (0.494234%)&gt;];
}
1811--2501[label="1;202pkt 202fpkt"];
1811--2886[label="1;202pkt 202fpkt"];
2501--2886[label="1;202pkt 202fpkt"];
</description>
    <slice>
      <filter dst_port="1434" src_ip="202.235.200.55" src_port="1791"/>
    </slice>
    <from sec="1049432411" usec="0"/>
    <to sec="1049433295" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="136.210.209.55"/>
    </slice>
    <from sec="1049432404" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_490{
style=filled;
color=gray75;
1814[label="219.30.33.56;157pkt 157fpkt", shape=pentagon, color=darkviolet];
2504[label="219.30.33.56;156pkt 156fpkt", shape=invtriangle, color=brown];
stat490[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.30.33.56:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
1814--2504[label="1;156pkt 156fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="219.30.33.56" src_port="1026"/>
    </slice>
    <from sec="1049432785" usec="0"/>
    <to sec="1049432812" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,020,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="160.225.86.57"/>
    </slice>
    <from sec="1049432407" usec="0"/>
    <to sec="1049433288" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="221.41.34.59"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049432721" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_493{
style=filled;
color=gray75;
1836[label="4.96.65.60;130pkt 130fpkt", shape=pentagon, color=darkviolet];
2516[label="4.96.65.60;129pkt 129fpkt", shape=invtriangle, color=brown];
2896[label="4.96.65.60;130pkt 130fpkt", shape=invhouse, color=bisque];
stat493[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.96.65.60:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
1836--2516[label="1;129pkt 129fpkt"];
1836--2896[label="1;130pkt 130fpkt"];
2516--2896[label="1;129pkt 129fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.96.65.60" src_port="1025"/>
    </slice>
    <from sec="1049433220" usec="0"/>
    <to sec="1049433242" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.628332,1.36623,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_494{
style=filled;
color=gray75;
1126[label="141.109.34.64;s;2pkt 2fpkt", shape=diamond, color=yellow];
1846[label="141.109.34.64;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2521[label="141.109.34.64;2pkt 2fpkt", shape=invtriangle, color=brown];
stat494[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.109.34.64:4873, 130.140.171.17:6699}[50%]&lt;BR/&gt;{141.109.34.64:4858, 69.23.106.24:6699}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 4873: (25%)&lt;BR/&gt; 4858: (25%)&gt;];
}
1126--1846[label="1;2pkt 2fpkt"];
1126--2521[label="1;2pkt 2fpkt"];
1846--2521[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="69.23.106.24" dst_port="6699" src_ip="141.109.34.64" src_port="4858"/>
      <filter dst_ip="130.140.171.17" dst_port="6699" src_ip="141.109.34.64" src_port="4873"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433293" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="136.210.214.64"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_496{
style=filled;
color=gray75;
1858[label="136.210.194.67;22pkt 22fpkt", shape=pentagon, color=darkviolet];
2527[label="136.210.194.67;21pkt 21fpkt", shape=invtriangle, color=brown];
2903[label="136.210.194.67;22pkt 22fpkt", shape=invhouse, color=bisque];
stat496[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.210.194.67:*, *:5190}[50%]&lt;BR/&gt;{136.210.194.67:*, *:5050}[27.2727%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5190: (25.3846%)&lt;BR/&gt; 5050: (13.8462%)&lt;BR/&gt; 123: (9.23077%)&lt;BR/&gt; 1052: (4.61538%)&lt;BR/&gt; 1049: (4.61538%)&gt;];
}
1858--2527[label="1;21pkt 21fpkt"];
1858--2903[label="1;22pkt 22fpkt"];
2527--2903[label="1;21pkt 21fpkt"];
</description>
    <slice>
      <filter dst_port="5190" src_ip="136.210.194.67"/>
      <filter dst_port="5050" src_ip="136.210.194.67"/>
    </slice>
    <from sec="1049432408" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_497{
style=filled;
color=gray75;
1860[label="136.210.228.68;12pkt 12fpkt", shape=pentagon, color=darkviolet];
2528[label="136.210.228.68;13pkt 13fpkt", shape=invtriangle, color=brown];
stat497[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.210.228.68:*, 202.176.86.140:*}[38.4615%]&lt;BR/&gt;{136.210.228.68:25, 67.23.109.1:*}[30.7692%]&lt;BR/&gt;{136.210.228.68:21, *:*}[23.0769%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (22%)&lt;BR/&gt; 21: (12%)&lt;BR/&gt; 22396: (8%)&lt;BR/&gt; 20: (8%)&lt;BR/&gt; 61447: (4%)&gt;];
}
1860--2528[label="1;12pkt 12fpkt"];
</description>
    <slice>
      <filter dst_ip="202.176.86.140" src_ip="136.210.228.68"/>
      <filter src_ip="136.210.228.68" src_port="21"/>
      <filter dst_ip="67.23.109.1" src_ip="136.210.228.68" src_port="25"/>
    </slice>
    <from sec="1049432895" usec="0"/>
    <to sec="1049433295" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_498{
style=filled;
color=gray75;
1862[label="160.225.0.69;48pkt 48fpkt", shape=pentagon, color=darkviolet];
2530[label="160.225.0.69;48pkt 48fpkt", shape=invtriangle, color=brown];
stat498[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.0.69:*, 162.224.97.49:80}[37.5%]&lt;BR/&gt;{160.225.0.69:*, 162.224.99.105:80}[31.25%]&lt;BR/&gt;{160.225.0.69:*, 162.224.110.167:80}[27.0833%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 49857: (2.08333%)&lt;BR/&gt; 50044: (1.04167%)&lt;BR/&gt; 50043: (1.04167%)&lt;BR/&gt; 50031: (1.04167%)&gt;];
}
1862--2530[label="1;48pkt 48fpkt"];
</description>
    <slice>
      <filter dst_ip="162.224.97.49" dst_port="80" src_ip="160.225.0.69"/>
      <filter dst_ip="162.224.99.105" dst_port="80" src_ip="160.225.0.69"/>
      <filter dst_ip="162.224.110.167" dst_port="80" src_ip="160.225.0.69"/>
    </slice>
    <from sec="1049432546" usec="0"/>
    <to sec="1049433281" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_499{
style=filled;
color=gray75;
1863[label="165.45.55.69;24pkt 24fpkt", shape=pentagon, color=darkviolet];
2531[label="165.45.55.69;24pkt 24fpkt", shape=invtriangle, color=brown];
2905[label="165.45.55.69;25pkt 25fpkt", shape=invhouse, color=bisque];
stat499[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.45.55.69:*, 206.76.9.202:110}[36%]&lt;BR/&gt;{165.45.55.69:*, 198.177.155.64:110}[32%]&lt;BR/&gt;{165.45.55.69:*, 212.77.50.71:110}[32%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 110: (50%)&lt;BR/&gt; 3034: (2.05479%)&lt;BR/&gt; 3032: (2.05479%)&lt;BR/&gt; 3031: (2.05479%)&lt;BR/&gt; 3029: (2.05479%)&gt;];
}
1863--2531[label="1;24pkt 24fpkt"];
1863--2905[label="1;24pkt 24fpkt"];
2531--2905[label="1;24pkt 24fpkt"];
</description>
    <slice>
      <filter dst_ip="206.76.9.202" dst_port="110" src_ip="165.45.55.69"/>
      <filter dst_ip="212.77.50.71" dst_port="110" src_ip="165.45.55.69"/>
      <filter dst_ip="198.177.155.64" dst_port="110" src_ip="165.45.55.69"/>
    </slice>
    <from sec="1049432594" usec="0"/>
    <to sec="1049432871" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_500{
style=filled;
color=gray75;
1866[label="10.151.70.70;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2534[label="10.151.70.70;1pkt 1fpkt", shape=invtriangle, color=brown];
stat500[shape=component, label=&lt;Rules:&lt;BR/&gt;{10.151.70.70:51447, 10.0.1.1:192}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 51447: (50%)&lt;BR/&gt; 192: (50%)&gt;];
}
1866--2534[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="10.0.1.1" dst_port="192" src_ip="10.151.70.70" src_port="51447"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_501{
style=filled;
color=gray75;
1870[label="4.223.58.71;23pkt 23fpkt", shape=pentagon, color=darkviolet];
2537[label="4.223.58.71;23pkt 23fpkt", shape=invtriangle, color=brown];
stat501[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.223.58.71:*, 141.109.107.54:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2135: (2.17391%)&lt;BR/&gt; 2133: (2.17391%)&lt;BR/&gt; 2128: (2.17391%)&lt;BR/&gt; 2125: (2.17391%)&gt;];
}
1870--2537[label="1;23pkt 23fpkt"];
</description>
    <slice>
      <filter dst_ip="141.109.107.54" dst_port="80" src_ip="4.223.58.71"/>
    </slice>
    <from sec="1049432542" usec="0"/>
    <to sec="1049432727" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_502{
style=filled;
color=gray75;
1873[label="160.225.148.71;12pkt 12fpkt", shape=pentagon, color=darkviolet];
2539[label="160.225.148.71;12pkt 12fpkt", shape=invtriangle, color=brown];
2910[label="160.225.148.71;12pkt 12fpkt", shape=invhouse, color=bisque];
stat502[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.148.71:80, 212.40.208.78:*}[66.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 34901: (4.16667%)&lt;BR/&gt; 11733: (4.16667%)&lt;BR/&gt; 10473: (4.16667%)&lt;BR/&gt; 10472: (4.16667%)&gt;];
}
1873--2539[label="1;12pkt 12fpkt"];
1873--2910[label="1;12pkt 12fpkt"];
2539--2910[label="1;12pkt 12fpkt"];
</description>
    <slice>
      <filter dst_ip="212.40.208.78" src_ip="160.225.148.71" src_port="80"/>
    </slice>
    <from sec="1049432688" usec="0"/>
    <to sec="1049433298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_503{
style=filled;
color=gray75;
1881[label="202.26.221.75;37pkt 37fpkt", shape=pentagon, color=darkviolet];
2545[label="202.26.221.75;38pkt 38fpkt", shape=invtriangle, color=brown];
stat503[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.26.221.75:*, 4.43.164.219:80}[42.1053%]&lt;BR/&gt;{202.26.221.75:*, 202.235.57.179:80}[39.4737%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1197: (1.33333%)&lt;BR/&gt; 1196: (1.33333%)&lt;BR/&gt; 1191: (1.33333%)&lt;BR/&gt; 1190: (1.33333%)&gt;];
}
1881--2545[label="1;37pkt 37fpkt"];
</description>
    <slice>
      <filter dst_ip="4.43.164.219" dst_port="80" src_ip="202.26.221.75"/>
      <filter dst_ip="202.235.57.179" dst_port="80" src_ip="202.26.221.75"/>
    </slice>
    <from sec="1049432690" usec="0"/>
    <to sec="1049433290" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_504{
style=filled;
color=gray75;
1885[label="160.225.214.76;10pkt 10fpkt", shape=pentagon, color=darkviolet];
2547[label="160.225.214.76;10pkt 10fpkt", shape=invtriangle, color=brown];
2912[label="160.225.214.76;9pkt 9fpkt", shape=invhouse, color=bisque];
stat504[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.214.76:*, 205.215.182.43:80}[30%]&lt;BR/&gt;{160.225.214.76:*, 212.167.67.96:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1155: (5.17241%)&lt;BR/&gt; 1154: (5.17241%)&lt;BR/&gt; 1153: (5.17241%)&lt;BR/&gt; 1151: (5.17241%)&gt;];
}
1885--2547[label="1;10pkt 10fpkt"];
1885--2912[label="1;9pkt 9fpkt"];
2547--2912[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="205.215.182.43" dst_port="80" src_ip="160.225.214.76"/>
      <filter dst_ip="212.167.67.96" dst_port="80" src_ip="160.225.214.76"/>
    </slice>
    <from sec="1049433279" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_505{
style=filled;
color=gray75;
1887[label="202.22.170.77;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2549[label="202.22.170.77;3pkt 3fpkt", shape=invtriangle, color=brown];
2913[label="202.22.170.77;3pkt 3fpkt", shape=invhouse, color=bisque];
stat505[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.22.170.77:32768, 162.108.137.144:53}[33.3333%]&lt;BR/&gt;{202.22.170.77:32768, 199.101.82.172:53}[33.3333%]&lt;BR/&gt;{202.22.170.77:32768, 198.206.3.226:53}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 32768: (50%)&lt;BR/&gt; 53: (50%)&gt;];
}
1887--2549[label="1;3pkt 3fpkt"];
1887--2913[label="1;3pkt 3fpkt"];
2549--2913[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="198.206.3.226" dst_port="53" src_ip="202.22.170.77" src_port="32768"/>
      <filter dst_ip="199.101.82.172" dst_port="53" src_ip="202.22.170.77" src_port="32768"/>
      <filter dst_ip="162.108.137.144" dst_port="53" src_ip="202.22.170.77" src_port="32768"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="165.45.244.78"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_507{
style=filled;
color=gray75;
1901[label="160.225.209.83;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2558[label="160.225.209.83;1pkt 1fpkt", shape=invtriangle, color=brown];
stat507[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.209.83:2101, 205.147.224.232:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2101: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
1901--2558[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="205.147.224.232" dst_port="80" src_ip="160.225.209.83" src_port="2101"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="165.54.37.86"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_509{
style=filled;
color=gray75;
1914[label="202.149.17.87;29pkt 29fpkt", shape=pentagon, color=darkviolet];
2565[label="202.149.17.87;28pkt 28fpkt", shape=invtriangle, color=brown];
2922[label="202.149.17.87;28pkt 28fpkt", shape=invhouse, color=bisque];
stat509[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.149.17.87:80, 165.236.198.112:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4170: (1.76471%)&lt;BR/&gt; 4169: (1.76471%)&lt;BR/&gt; 4168: (1.76471%)&lt;BR/&gt; 4167: (1.76471%)&gt;];
}
1914--2565[label="1;28pkt 28fpkt"];
1914--2922[label="1;28pkt 28fpkt"];
2565--2922[label="1;28pkt 28fpkt"];
</description>
    <slice>
      <filter dst_ip="165.236.198.112" src_ip="202.149.17.87" src_port="80"/>
    </slice>
    <from sec="1049433003" usec="0"/>
    <to sec="1049433040" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_510{
style=filled;
color=gray75;
1917[label="160.225.218.88;17pkt 17fpkt", shape=pentagon, color=darkviolet];
2567[label="160.225.218.88;18pkt 18fpkt", shape=invtriangle, color=brown];
2923[label="160.225.218.88;18pkt 18fpkt", shape=invhouse, color=bisque];
stat510[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.218.88:*, 139.36.161.235:80}[61.1111%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1066: (2.83019%)&lt;BR/&gt; 1065: (2.83019%)&lt;BR/&gt; 1064: (2.83019%)&lt;BR/&gt; 1062: (2.83019%)&gt;];
}
1917--2567[label="1;17pkt 17fpkt"];
1917--2923[label="1;17pkt 17fpkt"];
2567--2923[label="1;18pkt 18fpkt"];
</description>
    <slice>
      <filter dst_ip="139.36.161.235" dst_port="80" src_ip="160.225.218.88"/>
    </slice>
    <from sec="1049433048" usec="0"/>
    <to sec="1049433284" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,020,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_511{
style=filled;
color=gray75;
1919[label="165.200.87.89;11pkt 11fpkt", shape=pentagon, color=darkviolet];
2568[label="165.200.87.89;10pkt 10fpkt", shape=invtriangle, color=brown];
2924[label="165.200.87.89;10pkt 10fpkt", shape=invhouse, color=bisque];
stat511[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.200.87.89:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1919--2568[label="1;10pkt 10fpkt"];
1919--2924[label="1;10pkt 10fpkt"];
2568--2924[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter src_ip="165.200.87.89"/>
    </slice>
    <from sec="1049432553" usec="0"/>
    <to sec="1049433293" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614418,1.43142,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_512{
style=filled;
color=gray75;
648[label="141.109.111.89;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat512[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.109.111.89:1257, 69.100.33.121:6699}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (50%)&lt;BR/&gt; 1257: (50%)&gt;];
}
648--1356[label="1;1pkt 1fpkt"];
648--2569[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="69.100.33.121" dst_port="6699" src_ip="141.109.111.89" src_port="1257"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_513{
style=filled;
color=gray75;
1921[label="165.236.166.89;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2570[label="165.236.166.89;1pkt 1fpkt", shape=invtriangle, color=brown];
2926[label="165.236.166.89;1pkt 1fpkt", shape=invhouse, color=bisque];
stat513[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.236.166.89:0, 220.82.38.151:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1921--2570[label="1;1pkt 1fpkt"];
1921--2926[label="1;1pkt 1fpkt"];
2570--2926[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="220.82.38.151" src_ip="165.236.166.89"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,020,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_514{
style=filled;
color=gray75;
1934[label="136.210.55.93;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2576[label="136.210.55.93;3pkt 3fpkt", shape=invtriangle, color=brown];
stat514[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.210.55.93:2087, 219.116.171.48:25}[33.3333%]&lt;BR/&gt;{136.210.55.93:0, 10.10.10.86:0}[33.3333%]&lt;BR/&gt;{136.210.55.93:0, 10.10.10.146:0}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (80%)&lt;BR/&gt; 2087: (10%)&lt;BR/&gt; 25: (10%)&gt;];
}
1934--2576[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="10.10.10.146" src_ip="136.210.55.93"/>
      <filter dst_ip="10.10.10.86" src_ip="136.210.55.93"/>
      <filter dst_ip="219.116.171.48" dst_port="25" src_ip="136.210.55.93" src_port="2087"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433292" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,020,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_515{
style=filled;
color=gray75;
1935[label="203.86.70.93;107pkt 107fpkt", shape=pentagon, color=darkviolet];
2577[label="203.86.70.93;106pkt 106fpkt", shape=invtriangle, color=brown];
stat515[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.86.70.93:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1935--2577[label="1;106pkt 106fpkt"];
</description>
    <slice>
      <filter src_ip="203.86.70.93"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,020,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_516{
style=filled;
color=gray75;
1939[label="160.225.78.96;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2581[label="160.225.78.96;2pkt 2fpkt", shape=invtriangle, color=brown];
stat516[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.78.96:0, 215.92.38.94:0}[50%]&lt;BR/&gt;{160.225.78.96:0, 160.64.110.252:0}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1939--2581[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="160.64.110.252" src_ip="160.225.78.96"/>
      <filter dst_ip="215.92.38.94" src_ip="160.225.78.96"/>
    </slice>
    <from sec="1049432691" usec="0"/>
    <to sec="1049433299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_517{
style=filled;
color=gray75;
1943[label="221.118.241.97;20pkt 20fpkt", shape=pentagon, color=darkviolet];
2582[label="221.118.241.97;20pkt 20fpkt", shape=invtriangle, color=brown];
2932[label="221.118.241.97;20pkt 20fpkt", shape=invhouse, color=bisque];
stat517[shape=component, label=&lt;Rules:&lt;BR/&gt;{221.118.241.97:80, 141.109.139.187:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1630: (2.5%)&lt;BR/&gt; 1629: (2.5%)&lt;BR/&gt; 1627: (2.5%)&lt;BR/&gt; 1626: (2.5%)&gt;];
}
1943--2582[label="1;20pkt 20fpkt"];
1943--2932[label="1;20pkt 20fpkt"];
2582--2932[label="1;20pkt 20fpkt"];
</description>
    <slice>
      <filter dst_ip="141.109.139.187" src_ip="221.118.241.97" src_port="80"/>
    </slice>
    <from sec="1049432514" usec="0"/>
    <to sec="1049432536" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.628332,1.36623,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_518{
style=filled;
color=gray75;
638[label="165.236.213.126;d;77pkt 77fpkt", shape=diamond, color=yellow];
1945[label="68.46.204.98;16pkt 16fpkt", shape=pentagon, color=darkviolet];
2274[label="199.249.215.209;24pkt 24fpkt", shape=pentagon, color=darkviolet];
2583[label="68.46.204.98;16pkt 16fpkt", shape=invtriangle, color=brown];
2757[label="199.249.215.209;24pkt 24fpkt", shape=invtriangle, color=brown];
stat518[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 165.236.213.126:29084}[28.9157%]&lt;BR/&gt;{199.249.215.209:60000, 165.236.213.126:*}[27.7108%]&lt;BR/&gt;{68.46.204.98:7341, 165.236.213.126:*}[20.4819%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 60000: (21.0191%)&lt;BR/&gt; 7341: (14.6497%)&lt;BR/&gt; 29084: (8.28025%)&lt;BR/&gt; 2622: (1.91083%)&lt;BR/&gt; 16068: (0.955414%)&gt;];
}
638--1419[label="0.012987;1pkt 1fpkt"];
638--1945[label="0.8125;13pkt 13fpkt"];
638--2274[label="0.875;21pkt 21fpkt"];
638--2583[label="0.8125;13pkt 13fpkt"];
638--2757[label="0.875;21pkt 21fpkt"];
1945--2583[label="1;16pkt 16fpkt"];
2274--2757[label="1;24pkt 24fpkt"];
</description>
    <slice>
      <filter dst_ip="165.236.213.126" dst_port="29084"/>
      <filter dst_ip="165.236.213.126" src_ip="199.249.215.209" src_port="60000"/>
      <filter dst_ip="165.236.213.126" src_ip="68.46.204.98" src_port="7341"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_519{
style=filled;
color=gray75;
1946[label="212.162.40.99;7pkt 7fpkt", shape=pentagon, color=darkviolet];
2585[label="212.162.40.99;7pkt 7fpkt", shape=invtriangle, color=brown];
2933[label="212.162.40.99;7pkt 7fpkt", shape=invhouse, color=bisque];
stat519[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.162.40.99:80, 141.109.154.40:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 26909: (7.14286%)&lt;BR/&gt; 26900: (7.14286%)&lt;BR/&gt; 26804: (7.14286%)&lt;BR/&gt; 26795: (7.14286%)&gt;];
}
1946--2585[label="1;7pkt 7fpkt"];
1946--2933[label="1;7pkt 7fpkt"];
2585--2933[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="141.109.154.40" src_ip="212.162.40.99" src_port="80"/>
    </slice>
    <from sec="1049433081" usec="0"/>
    <to sec="1049433177" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_520{
style=filled;
color=gray75;
1949[label="136.210.193.99;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2587[label="136.210.193.99;4pkt 4fpkt", shape=invtriangle, color=brown];
stat520[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.210.193.99:35585, 64.211.179.25:25}[25%]&lt;BR/&gt;{136.210.193.99:80, 202.174.215.56:4896}[25%]&lt;BR/&gt;{136.210.193.99:25, 64.114.45.81:22138}[25%]&lt;BR/&gt;{136.210.193.99:35583, 202.74.242.178:25}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (35.7143%)&lt;BR/&gt; 35583: (14.2857%)&lt;BR/&gt; 22138: (14.2857%)&lt;BR/&gt; 4896: (14.2857%)&lt;BR/&gt; 80: (14.2857%)&gt;];
}
1949--2587[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="202.74.242.178" dst_port="25" src_ip="136.210.193.99" src_port="35583"/>
      <filter dst_ip="64.114.45.81" dst_port="22138" src_ip="136.210.193.99" src_port="25"/>
      <filter dst_ip="202.174.215.56" dst_port="4896" src_ip="136.210.193.99" src_port="80"/>
      <filter dst_ip="64.211.179.25" dst_port="25" src_ip="136.210.193.99" src_port="35585"/>
    </slice>
    <from sec="1049432635" usec="0"/>
    <to sec="1049433206" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_521{
style=filled;
color=gray75;
1953[label="141.109.32.100;18pkt 18fpkt", shape=pentagon, color=darkviolet];
2589[label="141.109.32.100;18pkt 18fpkt", shape=invtriangle, color=brown];
stat521[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.109.32.100:*, 220.75.3.230:80}[55.5556%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2238: (2.77778%)&lt;BR/&gt; 2237: (2.77778%)&lt;BR/&gt; 2236: (2.77778%)&lt;BR/&gt; 2235: (2.77778%)&gt;];
}
1953--2589[label="1;18pkt 18fpkt"];
</description>
    <slice>
      <filter dst_ip="220.75.3.230" dst_port="80" src_ip="141.109.32.100"/>
    </slice>
    <from sec="1049432712" usec="0"/>
    <to sec="1049432791" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_522{
style=filled;
color=gray75;
1964[label="218.182.80.104;221pkt 221fpkt", shape=pentagon, color=darkviolet];
2595[label="218.182.80.104;221pkt 221fpkt", shape=invtriangle, color=brown];
2939[label="218.182.80.104;221pkt 221fpkt", shape=invhouse, color=bisque];
stat522[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.182.80.104:1240, *:1434}[99.5475%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1434: (49.7738%)&lt;BR/&gt; 1240: (49.7738%)&lt;BR/&gt; 0: (0.452489%)&gt;];
}
1964--2595[label="1;221pkt 221fpkt"];
1964--2939[label="1;221pkt 221fpkt"];
2595--2939[label="1;221pkt 221fpkt"];
</description>
    <slice>
      <filter dst_port="1434" src_ip="218.182.80.104" src_port="1240"/>
    </slice>
    <from sec="1049432409" usec="0"/>
    <to sec="1049433298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_523{
style=filled;
color=gray75;
1972[label="160.225.210.106;56pkt 56fpkt", shape=pentagon, color=darkviolet];
2599[label="160.225.210.106;56pkt 56fpkt", shape=invtriangle, color=brown];
2942[label="160.225.210.106;56pkt 56fpkt", shape=invhouse, color=bisque];
stat523[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.210.106:*, 67.185.177.148:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.1071%)&lt;BR/&gt; 1802: (0.892857%)&lt;BR/&gt; 1801: (0.892857%)&lt;BR/&gt; 1800: (0.892857%)&lt;BR/&gt; 1798: (0.892857%)&gt;];
}
1972--2599[label="1;56pkt 56fpkt"];
1972--2942[label="1;56pkt 56fpkt"];
2599--2942[label="1;56pkt 56fpkt"];
</description>
    <slice>
      <filter dst_ip="67.185.177.148" dst_port="80" src_ip="160.225.210.106"/>
    </slice>
    <from sec="1049433260" usec="0"/>
    <to sec="1049433299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_524{
style=filled;
color=gray75;
1974[label="160.225.91.107;33pkt 33fpkt", shape=pentagon, color=darkviolet];
2600[label="160.225.91.107;33pkt 33fpkt", shape=invtriangle, color=brown];
2943[label="160.225.91.107;33pkt 33fpkt", shape=invhouse, color=bisque];
stat524[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.91.107:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 62547: (1.51515%)&lt;BR/&gt; 62542: (1.51515%)&lt;BR/&gt; 60621: (1.51515%)&lt;BR/&gt; 60610: (1.51515%)&gt;];
}
1974--2600[label="1;33pkt 33fpkt"];
1974--2943[label="1;33pkt 33fpkt"];
2600--2943[label="1;33pkt 33fpkt"];
</description>
    <slice>
      <filter src_ip="160.225.91.107" src_port="80"/>
    </slice>
    <from sec="1049432644" usec="0"/>
    <to sec="1049433255" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="160.225.246.110"/>
    </slice>
    <from sec="1049433163" usec="0"/>
    <to sec="1049433235" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_527{
style=filled;
color=gray75;
1986[label="202.26.215.111;32pkt 32fpkt", shape=pentagon, color=darkviolet];
2607[label="202.26.215.111;32pkt 32fpkt", shape=invtriangle, color=brown];
2948[label="202.26.215.111;33pkt 33fpkt", shape=invhouse, color=bisque];
stat527[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.26.215.111:80, 202.173.201.234:*}[30.303%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 64130: (1.54639%)&lt;BR/&gt; 62761: (1.54639%)&lt;BR/&gt; 62360: (1.54639%)&lt;BR/&gt; 60867: (1.54639%)&gt;];
}
1986--2607[label="1;32pkt 32fpkt"];
1986--2948[label="1;32pkt 32fpkt"];
2607--2948[label="1;32pkt 32fpkt"];
</description>
    <slice>
      <filter dst_ip="202.173.201.234" src_ip="202.26.215.111" src_port="80"/>
    </slice>
    <from sec="1049432498" usec="0"/>
    <to sec="1049433291" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_529{
style=filled;
color=gray75;
1992[label="165.236.138.114;36pkt 36fpkt", shape=pentagon, color=darkviolet];
2610[label="165.236.138.114;36pkt 36fpkt", shape=invtriangle, color=brown];
stat529[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.236.138.114:*, 205.105.165.114:80}[33.3333%]&lt;BR/&gt;{165.236.138.114:*, 204.66.79.104:80}[30.5556%]&lt;BR/&gt;{165.236.138.114:*, 205.105.165.114:443}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (34.7222%)&lt;BR/&gt; 443: (15.2778%)&lt;BR/&gt; 2207: (1.38889%)&lt;BR/&gt; 2206: (1.38889%)&lt;BR/&gt; 2205: (1.38889%)&gt;];
}
1992--2610[label="1;36pkt 36fpkt"];
</description>
    <slice>
      <filter dst_ip="205.105.165.114" dst_port="80" src_ip="165.236.138.114"/>
      <filter dst_ip="205.105.165.114" dst_port="443" src_ip="165.236.138.114"/>
      <filter dst_ip="204.66.79.104" dst_port="80" src_ip="165.236.138.114"/>
    </slice>
    <from sec="1049432569" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_530{
style=filled;
color=gray75;
1998[label="64.173.86.116;19pkt 19fpkt", shape=pentagon, color=darkviolet];
2613[label="64.173.86.116;19pkt 19fpkt", shape=invtriangle, color=brown];
2952[label="64.173.86.116;18pkt 18fpkt", shape=invhouse, color=bisque];
stat530[shape=component, label=&lt;Rules:&lt;BR/&gt;{64.173.86.116:80, 141.109.110.104:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3324: (2.67857%)&lt;BR/&gt; 3322: (2.67857%)&lt;BR/&gt; 3320: (2.67857%)&lt;BR/&gt; 3318: (2.67857%)&gt;];
}
1998--2613[label="1;19pkt 19fpkt"];
1998--2952[label="1;18pkt 18fpkt"];
2613--2952[label="1;18pkt 18fpkt"];
</description>
    <slice>
      <filter dst_ip="141.109.110.104" src_ip="64.173.86.116" src_port="80"/>
    </slice>
    <from sec="1049432809" usec="0"/>
    <to sec="1049432815" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_531{
style=filled;
color=gray75;
2000[label="213.165.135.116;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2614[label="213.165.135.116;1pkt 1fpkt", shape=invtriangle, color=brown];
2953[label="213.165.135.116;1pkt 1fpkt", shape=invhouse, color=bisque];
stat531[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.165.135.116:4662, 141.109.179.137:2879}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4662: (50%)&lt;BR/&gt; 2879: (50%)&gt;];
}
2000--2614[label="1;1pkt 1fpkt"];
2000--2953[label="1;1pkt 1fpkt"];
2614--2953[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="141.109.179.137" dst_port="2879" src_ip="213.165.135.116" src_port="4662"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_532{
style=filled;
color=gray75;
2008[label="165.45.237.120;24pkt 24fpkt", shape=pentagon, color=darkviolet];
2619[label="165.45.237.120;23pkt 23fpkt", shape=invtriangle, color=brown];
2956[label="165.45.237.120;24pkt 24fpkt", shape=invhouse, color=bisque];
stat532[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.45.237.120:*, 67.137.112.66:80}[37.5%]&lt;BR/&gt;{165.45.237.120:*, 83.106.113.142:80}[37.5%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 53747: (2.11268%)&lt;BR/&gt; 53745: (2.11268%)&lt;BR/&gt; 53744: (2.11268%)&lt;BR/&gt; 53743: (2.11268%)&gt;];
}
2008--2619[label="1;23pkt 23fpkt"];
2008--2956[label="1;24pkt 24fpkt"];
2619--2956[label="1;23pkt 23fpkt"];
</description>
    <slice>
      <filter dst_ip="83.106.113.142" dst_port="80" src_ip="165.45.237.120"/>
      <filter dst_ip="67.137.112.66" dst_port="80" src_ip="165.45.237.120"/>
    </slice>
    <from sec="1049432453" usec="0"/>
    <to sec="1049433285" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.628332,1.36623,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_533{
style=filled;
color=gray75;
472[label="160.225.246.120;s;72pkt 72fpkt", shape=diamond, color=yellow];
2009[label="160.225.246.120;98pkt 98fpkt", shape=pentagon, color=darkviolet];
2620[label="160.225.246.120;98pkt 98fpkt", shape=invtriangle, color=brown];
stat533[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.246.120:*, 67.185.166.34:80}[67.3469%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.8806%)&lt;BR/&gt; 443: (1.1194%)&lt;BR/&gt; 1283: (0.559701%)&lt;BR/&gt; 1282: (0.559701%)&lt;BR/&gt; 1281: (0.559701%)&gt;];
}
472--868[label="0.0277778;2pkt 2fpkt"];
472--929[label="0.0416667;3pkt 3fpkt"];
472--1042[label="0.0138889;1pkt 1fpkt"];
472--1148[label="0.0555556;4pkt 4fpkt"];
472--1152[label="0.0377358;2pkt 2fpkt"];
472--1266[label="0.361111;26pkt 26fpkt"];
472--1371[label="0.0972222;7pkt 7fpkt"];
472--1372[label="0.0298507;2pkt 2fpkt"];
472--1608[label="0.180556;13pkt 13fpkt"];
472--2009[label="1;72pkt 72fpkt"];
472--2620[label="1;72pkt 72fpkt"];
2009--2620[label="1;98pkt 98fpkt"];
</description>
    <slice>
      <filter dst_ip="67.185.166.34" dst_port="80" src_ip="160.225.246.120"/>
    </slice>
    <from sec="1049432517" usec="0"/>
    <to sec="1049433216" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_534{
style=filled;
color=gray75;
718[label="178.184.138.123;s;69pkt 69fpkt", shape=diamond, color=yellow];
2016[label="178.184.138.123;69pkt 69fpkt", shape=pentagon, color=darkviolet];
2623[label="178.184.138.123;69pkt 69fpkt", shape=invtriangle, color=brown];
2959[label="178.184.138.123;69pkt 69fpkt", shape=invhouse, color=bisque];
stat534[shape=component, label=&lt;Rules:&lt;BR/&gt;{178.184.138.123:*, 64.32.154.4:80}[36.2319%]&lt;BR/&gt;{178.184.138.123:*, 205.220.13.158:80}[36.2319%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 49418: (0.724638%)&lt;BR/&gt; 49416: (0.724638%)&lt;BR/&gt; 49415: (0.724638%)&lt;BR/&gt; 49414: (0.724638%)&gt;];
}
718--968[label="0.0144928;1pkt 1fpkt"];
718--1482[label="0.0144928;1pkt 1fpkt"];
718--2016[label="1;69pkt 69fpkt"];
718--2623[label="1;69pkt 69fpkt"];
718--2959[label="1;69pkt 69fpkt"];
2016--2623[label="1;69pkt 69fpkt"];
2016--2959[label="1;69pkt 69fpkt"];
2623--2959[label="1;69pkt 69fpkt"];
</description>
    <slice>
      <filter dst_ip="205.220.13.158" dst_port="80" src_ip="178.184.138.123"/>
      <filter dst_ip="64.32.154.4" dst_port="80" src_ip="178.184.138.123"/>
    </slice>
    <from sec="1049432605" usec="0"/>
    <to sec="1049432742" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_535{
style=filled;
color=gray75;
2018[label="165.236.138.125;13pkt 13fpkt", shape=pentagon, color=darkviolet];
2625[label="165.236.138.125;13pkt 13fpkt", shape=invtriangle, color=brown];
2961[label="165.236.138.125;13pkt 13fpkt", shape=invhouse, color=bisque];
stat535[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.236.138.125:*, 207.8.62.108:80}[61.5385%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1449: (3.84615%)&lt;BR/&gt; 1448: (3.84615%)&lt;BR/&gt; 1431: (3.84615%)&lt;BR/&gt; 1381: (3.84615%)&gt;];
}
2018--2625[label="1;13pkt 13fpkt"];
2018--2961[label="1;13pkt 13fpkt"];
2625--2961[label="1;13pkt 13fpkt"];
</description>
    <slice>
      <filter dst_ip="207.8.62.108" dst_port="80" src_ip="165.236.138.125"/>
    </slice>
    <from sec="1049432537" usec="0"/>
    <to sec="1049433103" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_536{
style=filled;
color=gray75;
2020[label="165.236.213.126;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2627[label="165.236.213.126;1pkt 1fpkt", shape=invtriangle, color=brown];
2963[label="165.236.213.126;1pkt 1fpkt", shape=invhouse, color=bisque];
stat536[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.236.213.126:1565, 66.167.62.33:19616}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 19616: (50%)&lt;BR/&gt; 1565: (50%)&gt;];
}
2020--2627[label="1;1pkt 1fpkt"];
2020--2963[label="1;1pkt 1fpkt"];
2627--2963[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="66.167.62.33" dst_port="19616" src_ip="165.236.213.126" src_port="1565"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_538{
style=filled;
color=gray75;
2036[label="165.236.193.130;61pkt 61fpkt", shape=pentagon, color=darkviolet];
2635[label="165.236.193.130;61pkt 61fpkt", shape=invtriangle, color=brown];
stat538[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.236.193.130:*, 203.155.32.90:80}[88.5246%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.1803%)&lt;BR/&gt; 3344: (0.819672%)&lt;BR/&gt; 3343: (0.819672%)&lt;BR/&gt; 3342: (0.819672%)&lt;BR/&gt; 3341: (0.819672%)&gt;];
}
2036--2635[label="1;61pkt 61fpkt"];
</description>
    <slice>
      <filter dst_ip="203.155.32.90" dst_port="80" src_ip="165.236.193.130"/>
    </slice>
    <from sec="1049432695" usec="0"/>
    <to sec="1049433255" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_539{
style=filled;
color=gray75;
2040[label="221.228.85.131;67pkt 67fpkt", shape=pentagon, color=darkviolet];
2638[label="221.228.85.131;68pkt 68fpkt", shape=invtriangle, color=brown];
2973[label="221.228.85.131;68pkt 68fpkt", shape=invhouse, color=bisque];
stat539[shape=component, label=&lt;Rules:&lt;BR/&gt;{221.228.85.131:80, 141.109.48.42:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1258: (0.738916%)&lt;BR/&gt; 1257: (0.738916%)&lt;BR/&gt; 1256: (0.738916%)&lt;BR/&gt; 1255: (0.738916%)&gt;];
}
2040--2638[label="1;67pkt 67fpkt"];
2040--2973[label="1;67pkt 67fpkt"];
2638--2973[label="1;68pkt 68fpkt"];
</description>
    <slice>
      <filter dst_ip="141.109.48.42" src_ip="221.228.85.131" src_port="80"/>
    </slice>
    <from sec="1049432436" usec="0"/>
    <to sec="1049433206" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_540{
style=filled;
color=gray75;
2043[label="221.228.85.132;8pkt 8fpkt", shape=pentagon, color=darkviolet];
2640[label="221.228.85.132;9pkt 9fpkt", shape=invtriangle, color=brown];
2975[label="221.228.85.132;8pkt 8fpkt", shape=invhouse, color=bisque];
stat540[shape=component, label=&lt;Rules:&lt;BR/&gt;{221.228.85.132:80, 141.109.252.162:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1074: (6%)&lt;BR/&gt; 1070: (6%)&lt;BR/&gt; 1060: (6%)&lt;BR/&gt; 1052: (6%)&gt;];
}
2043--2640[label="1;8pkt 8fpkt"];
2043--2975[label="1;8pkt 8fpkt"];
2640--2975[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="141.109.252.162" src_ip="221.228.85.132" src_port="80"/>
    </slice>
    <from sec="1049433008" usec="0"/>
    <to sec="1049433254" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_541{
style=filled;
color=gray75;
2047[label="181.154.168.133;4pkt 4fpkt", shape=pentagon, color=darkviolet];
2643[label="181.154.168.133;4pkt 4fpkt", shape=invtriangle, color=brown];
2976[label="181.154.168.133;4pkt 4fpkt", shape=invhouse, color=bisque];
stat541[shape=component, label=&lt;Rules:&lt;BR/&gt;{181.154.168.133:80, 165.236.193.224:1432}[25%]&lt;BR/&gt;{181.154.168.133:80, 165.236.193.146:1435}[25%]&lt;BR/&gt;{181.154.168.133:80, 165.236.193.146:1502}[25%]&lt;BR/&gt;{181.154.168.133:80, 165.236.193.146:1503}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1503: (12.5%)&lt;BR/&gt; 1502: (12.5%)&lt;BR/&gt; 1435: (12.5%)&lt;BR/&gt; 1432: (12.5%)&gt;];
}
2047--2643[label="1;4pkt 4fpkt"];
2047--2976[label="1;4pkt 4fpkt"];
2643--2976[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="165.236.193.146" dst_port="1503" src_ip="181.154.168.133" src_port="80"/>
      <filter dst_ip="165.236.193.146" dst_port="1502" src_ip="181.154.168.133" src_port="80"/>
      <filter dst_ip="165.236.193.146" dst_port="1435" src_ip="181.154.168.133" src_port="80"/>
      <filter dst_ip="165.236.193.224" dst_port="1432" src_ip="181.154.168.133" src_port="80"/>
    </slice>
    <from sec="1049432637" usec="0"/>
    <to sec="1049433005" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_542{
style=filled;
color=gray75;
2056[label="203.86.71.135;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2645[label="203.86.71.135;3pkt 3fpkt", shape=invtriangle, color=brown];
stat542[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.86.71.135:80, 64.97.165.235:27356}[33.3333%]&lt;BR/&gt;{203.86.71.135:80, 67.231.130.31:1415}[33.3333%]&lt;BR/&gt;{203.86.71.135:80, 67.231.130.31:1416}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1416: (20%)&lt;BR/&gt; 1415: (20%)&lt;BR/&gt; 27356: (10%)&gt;];
}
2056--2645[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="67.231.130.31" dst_port="1416" src_ip="203.86.71.135" src_port="80"/>
      <filter dst_ip="67.231.130.31" dst_port="1415" src_ip="203.86.71.135" src_port="80"/>
      <filter dst_ip="64.97.165.235" dst_port="27356" src_ip="203.86.71.135" src_port="80"/>
    </slice>
    <from sec="1049432564" usec="0"/>
    <to sec="1049433008" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_543{
style=filled;
color=gray75;
2059[label="4.106.54.136;16pkt 16fpkt", shape=pentagon, color=darkviolet];
2648[label="4.106.54.136;16pkt 16fpkt", shape=invtriangle, color=brown];
2979[label="4.106.54.136;15pkt 15fpkt", shape=invhouse, color=bisque];
stat543[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.106.54.136:80, 141.109.111.208:*}[75%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2240: (3.19149%)&lt;BR/&gt; 2239: (3.19149%)&lt;BR/&gt; 2237: (3.19149%)&lt;BR/&gt; 2236: (3.19149%)&gt;];
}
2059--2648[label="1;16pkt 16fpkt"];
2059--2979[label="1;15pkt 15fpkt"];
2648--2979[label="1;15pkt 15fpkt"];
</description>
    <slice>
      <filter dst_ip="141.109.111.208" src_ip="4.106.54.136" src_port="80"/>
    </slice>
    <from sec="1049432556" usec="0"/>
    <to sec="1049433278" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="165.45.194.137"/>
    </slice>
    <from sec="1049432408" usec="0"/>
    <to sec="1049433285" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_545{
style=filled;
color=gray75;
2067[label="216.148.207.137;23pkt 23fpkt", shape=pentagon, color=darkviolet];
2653[label="216.148.207.137;23pkt 23fpkt", shape=invtriangle, color=brown];
stat545[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.148.207.137:113, 203.86.85.202:*}[47.8261%]&lt;BR/&gt;{216.148.207.137:*, 203.86.85.202:25}[43.4783%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 113: (23.913%)&lt;BR/&gt; 25: (21.7391%)&lt;BR/&gt; 53: (4.34783%)&lt;BR/&gt; 63993: (2.17391%)&lt;BR/&gt; 61540: (2.17391%)&gt;];
}
2067--2653[label="1;23pkt 23fpkt"];
</description>
    <slice>
      <filter dst_ip="203.86.85.202" src_ip="216.148.207.137" src_port="113"/>
      <filter dst_ip="203.86.85.202" dst_port="25" src_ip="216.148.207.137"/>
    </slice>
    <from sec="1049432494" usec="0"/>
    <to sec="1049433299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_546{
style=filled;
color=gray75;
2072[label="7.185.133.138;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2656[label="7.185.133.138;2pkt 2fpkt", shape=invtriangle, color=brown];
2985[label="7.185.133.138;2pkt 2fpkt", shape=invhouse, color=bisque];
stat546[shape=component, label=&lt;Rules:&lt;BR/&gt;{7.185.133.138:80, 165.236.197.222:36535}[50%]&lt;BR/&gt;{7.185.133.138:80, 165.236.197.222:36537}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 36537: (25%)&lt;BR/&gt; 36535: (25%)&gt;];
}
2072--2656[label="1;2pkt 2fpkt"];
2072--2985[label="1;2pkt 2fpkt"];
2656--2985[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="165.236.197.222" dst_port="36537" src_ip="7.185.133.138" src_port="80"/>
      <filter dst_ip="165.236.197.222" dst_port="36535" src_ip="7.185.133.138" src_port="80"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_547{
style=filled;
color=gray75;
2076[label="197.174.212.139;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2657[label="197.174.212.139;3pkt 3fpkt", shape=invtriangle, color=brown];
stat547[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.174.212.139:53, 192.168.17.5:1676}[33.3333%]&lt;BR/&gt;{197.174.212.139:53, 192.168.40.129:2213}[33.3333%]&lt;BR/&gt;{197.174.212.139:53, 10.200.76.194:1068}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (50%)&lt;BR/&gt; 2213: (16.6667%)&lt;BR/&gt; 1676: (16.6667%)&lt;BR/&gt; 1068: (16.6667%)&gt;];
}
2076--2657[label="1;3pkt 3fpkt"];
2076--2986[label="1;3pkt 3fpkt"];
2657--2986[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="10.200.76.194" dst_port="1068" src_ip="197.174.212.139" src_port="53"/>
      <filter dst_ip="192.168.40.129" dst_port="2213" src_ip="197.174.212.139" src_port="53"/>
      <filter dst_ip="192.168.17.5" dst_port="1676" src_ip="197.174.212.139" src_port="53"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_548{
style=filled;
color=gray75;
2083[label="165.236.164.140;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2660[label="165.236.164.140;2pkt 2fpkt", shape=invtriangle, color=brown];
stat548[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.236.164.140:35305, 163.20.77.81:53}[50%]&lt;BR/&gt;{165.236.164.140:35305, 66.230.234.172:53}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 35305: (50%)&lt;BR/&gt; 53: (50%)&gt;];
}
2083--2660[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="66.230.234.172" dst_port="53" src_ip="165.236.164.140" src_port="35305"/>
      <filter dst_ip="163.20.77.81" dst_port="53" src_ip="165.236.164.140" src_port="35305"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="220.37.226.140"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049432928" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_550{
style=filled;
color=gray75;
2085[label="160.225.101.141;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2662[label="160.225.101.141;1pkt 1fpkt", shape=invtriangle, color=brown];
2988[label="160.225.101.141;1pkt 1fpkt", shape=invhouse, color=bisque];
stat550[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.101.141:49223, 59.53.220.19:143}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 49223: (50%)&lt;BR/&gt; 143: (50%)&gt;];
}
2085--2662[label="1;1pkt 1fpkt"];
2085--2988[label="1;1pkt 1fpkt"];
2662--2988[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="59.53.220.19" dst_port="143" src_ip="160.225.101.141" src_port="49223"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="216.203.25.146"/>
    </slice>
    <from sec="1049432407" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,053,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_552{
style=filled;
color=gray75;
2101[label="165.236.193.146;52pkt 52fpkt", shape=pentagon, color=darkviolet];
2672[label="165.236.193.146;52pkt 52fpkt", shape=invtriangle, color=brown];
2996[label="165.236.193.146;52pkt 52fpkt", shape=invhouse, color=bisque];
stat552[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.236.193.146:*, 181.154.168.24:80}[92.3077%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1504: (0.961538%)&lt;BR/&gt; 1503: (0.961538%)&lt;BR/&gt; 1502: (0.961538%)&lt;BR/&gt; 1501: (0.961538%)&gt;];
}
2101--2672[label="1;52pkt 52fpkt"];
2101--2996[label="1;52pkt 52fpkt"];
2672--2996[label="1;52pkt 52fpkt"];
</description>
    <slice>
      <filter dst_ip="181.154.168.24" dst_port="80" src_ip="165.236.193.146"/>
    </slice>
    <from sec="1049432673" usec="0"/>
    <to sec="1049433006" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_553{
style=filled;
color=gray75;
2105[label="165.236.164.147;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2674[label="165.236.164.147;1pkt 1fpkt", shape=invtriangle, color=brown];
2997[label="165.236.164.147;1pkt 1fpkt", shape=invhouse, color=bisque];
stat553[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.236.164.147:80, 51.178.122.255:1420}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1420: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
2105--2674[label="1;1pkt 1fpkt"];
2105--2997[label="1;1pkt 1fpkt"];
2674--2997[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="51.178.122.255" dst_port="1420" src_ip="165.236.164.147" src_port="80"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_554{
style=filled;
color=gray75;
2106[label="160.225.225.147;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2675[label="160.225.225.147;1pkt 1fpkt", shape=invtriangle, color=brown];
2998[label="160.225.225.147;1pkt 1fpkt", shape=invhouse, color=bisque];
stat554[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.225.147:53, 212.73.47.11:53}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (100%)&gt;];
}
2106--2675[label="1;1pkt 1fpkt"];
2106--2998[label="1;1pkt 1fpkt"];
2675--2998[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="212.73.47.11" dst_port="53" src_ip="160.225.225.147" src_port="53"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.628332,1.36623,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_555{
style=filled;
color=gray75;
682[label="203.86.88.23;d;895pkt 895fpkt", shape=diamond, color=yellow];
2107[label="4.224.45.148;14pkt 14fpkt", shape=pentagon, color=darkviolet];
2676[label="4.224.45.148;14pkt 14fpkt", shape=invtriangle, color=brown];
stat555[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.224.45.154:*, 203.86.88.23:53}[41.8502%]&lt;BR/&gt;{4.224.45.155:*, 203.86.88.23:53}[41.7401%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (48.5374%)&lt;BR/&gt; 80: (1.40845%)&lt;BR/&gt; 1030: (1.30011%)&lt;BR/&gt; 9768: (0.162514%)&lt;BR/&gt; 1434: (0.162514%)&gt;];
}
682--1448[label="0.00111732;1pkt 1fpkt"];
682--1607[label="0.00670391;6pkt 6fpkt"];
682--1617[label="0.00670391;6pkt 6fpkt"];
682--1982[label="0.00111732;1pkt 1fpkt"];
682--2107[label="0.0714286;1pkt 1fpkt"];
682--2605[label="0.00111732;1pkt 1fpkt"];
682--2676[label="0.0714286;1pkt 1fpkt"];
682--2946[label="0.00111732;1pkt 1fpkt"];
2107--2676[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter dst_ip="203.86.88.23" dst_port="53" src_ip="4.224.45.154"/>
      <filter dst_ip="203.86.88.23" dst_port="53" src_ip="4.224.45.155"/>
    </slice>
    <from sec="1049432402" usec="0"/>
    <to sec="1049433217" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_556{
style=filled;
color=gray75;
2112[label="160.225.120.150;16pkt 16fpkt", shape=pentagon, color=darkviolet];
2678[label="160.225.120.150;16pkt 16fpkt", shape=invtriangle, color=brown];
stat556[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.120.150:*, 219.81.221.85:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1512: (3.125%)&lt;BR/&gt; 1511: (3.125%)&lt;BR/&gt; 1510: (3.125%)&lt;BR/&gt; 1509: (3.125%)&gt;];
}
2112--2678[label="1;16pkt 16fpkt"];
</description>
    <slice>
      <filter dst_ip="219.81.221.85" dst_port="80" src_ip="160.225.120.150"/>
    </slice>
    <from sec="1049432943" usec="0"/>
    <to sec="1049432947" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,502,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="202.24.167.150"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_558{
style=filled;
color=gray75;
2119[label="67.185.182.152;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2682[label="67.185.182.152;2pkt 2fpkt", shape=invtriangle, color=brown];
stat558[shape=component, label=&lt;Rules:&lt;BR/&gt;{67.185.182.152:80, 141.109.34.215:4084}[50%]&lt;BR/&gt;{67.185.182.152:80, 141.109.34.215:4085}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4085: (25%)&lt;BR/&gt; 4084: (25%)&gt;];
}
2119--2682[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="141.109.34.215" dst_port="4085" src_ip="67.185.182.152" src_port="80"/>
      <filter dst_ip="141.109.34.215" dst_port="4084" src_ip="67.185.182.152" src_port="80"/>
    </slice>
    <from sec="1049432873" usec="0"/>
    <to sec="1049432876" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_559{
style=filled;
color=gray75;
763[label="202.230.0.153;s;916pkt 916fpkt", shape=diamond, color=yellow];
2120[label="202.230.0.153;994pkt 994fpkt", shape=pentagon, color=darkviolet];
2683[label="202.230.0.153;994pkt 994fpkt", shape=invtriangle, color=brown];
2999[label="202.230.0.153;995pkt 995fpkt", shape=invhouse, color=bisque];
stat559[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.230.0.153:1234, *:1434}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1434: (50%)&lt;BR/&gt; 1234: (50%)&gt;];
}
763--2120[label="0.998908;915pkt 915fpkt"];
763--2683[label="0.998908;915pkt 915fpkt"];
763--2999[label="1;916pkt 916fpkt"];
2120--2683[label="1;994pkt 994fpkt"];
2120--2999[label="1;994pkt 994fpkt"];
2683--2999[label="1;994pkt 994fpkt"];
</description>
    <slice>
      <filter dst_port="1434" src_ip="202.230.0.153" src_port="1234"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_560{
style=filled;
color=gray75;
2142[label="216.208.55.160;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2690[label="216.208.55.160;4pkt 4fpkt", shape=invtriangle, color=brown];
stat560[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.208.55.160:0, 204.37.142.88:0}[25%]&lt;BR/&gt;{216.208.55.160:0, 206.250.132.146:0}[25%]&lt;BR/&gt;{216.208.55.160:179, 216.208.55.162:11004}[25%]&lt;BR/&gt;{216.208.55.160:0, 51.14.148.165:0}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (71.4286%)&lt;BR/&gt; 11004: (14.2857%)&lt;BR/&gt; 179: (14.2857%)&gt;];
}
2142--2690[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="51.14.148.165" src_ip="216.208.55.160"/>
      <filter dst_ip="216.208.55.162" dst_port="11004" src_ip="216.208.55.160" src_port="179"/>
      <filter dst_ip="206.250.132.146" src_ip="216.208.55.160"/>
      <filter dst_ip="204.37.142.88" src_ip="216.208.55.160"/>
    </slice>
    <from sec="1049432402" usec="0"/>
    <to sec="1049433296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_561{
style=filled;
color=gray75;
2143[label="160.225.196.160;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2691[label="160.225.196.160;3pkt 3fpkt", shape=invtriangle, color=brown];
stat561[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.196.160:4908, 59.53.220.68:80}[33.3333%]&lt;BR/&gt;{160.225.196.160:4905, 59.53.220.18:80}[33.3333%]&lt;BR/&gt;{160.225.196.160:4906, 59.53.220.18:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4908: (16.6667%)&lt;BR/&gt; 4906: (16.6667%)&lt;BR/&gt; 4905: (16.6667%)&gt;];
}
2143--2691[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="59.53.220.18" dst_port="80" src_ip="160.225.196.160" src_port="4906"/>
      <filter dst_ip="59.53.220.18" dst_port="80" src_ip="160.225.196.160" src_port="4905"/>
      <filter dst_ip="59.53.220.68" dst_port="80" src_ip="160.225.196.160" src_port="4908"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_562{
style=filled;
color=gray75;
2155[label="221.57.11.163;14pkt 14fpkt", shape=pentagon, color=darkviolet];
2696[label="221.57.11.163;13pkt 13fpkt", shape=invtriangle, color=brown];
3005[label="221.57.11.163;14pkt 14fpkt", shape=invhouse, color=bisque];
stat562[shape=component, label=&lt;Rules:&lt;BR/&gt;{221.57.11.163:80, 165.236.95.170:*}[57.1429%]&lt;BR/&gt;{221.57.11.163:80, 165.236.95.171:*}[42.8571%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 45876: (3.65854%)&lt;BR/&gt; 45875: (3.65854%)&lt;BR/&gt; 45860: (3.65854%)&lt;BR/&gt; 45850: (3.65854%)&gt;];
}
2155--2696[label="1;13pkt 13fpkt"];
2155--3005[label="1;14pkt 14fpkt"];
2696--3005[label="1;13pkt 13fpkt"];
</description>
    <slice>
      <filter dst_ip="165.236.95.170" src_ip="221.57.11.163" src_port="80"/>
      <filter dst_ip="165.236.95.171" src_ip="221.57.11.163" src_port="80"/>
    </slice>
    <from sec="1049432830" usec="0"/>
    <to sec="1049432918" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_563{
style=filled;
color=gray75;
2168[label="165.45.17.167;13pkt 13fpkt", shape=pentagon, color=darkviolet];
2702[label="165.45.17.167;13pkt 13fpkt", shape=invtriangle, color=brown];
stat563[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.45.17.167:*, 212.186.181.193:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3117: (3.84615%)&lt;BR/&gt; 3116: (3.84615%)&lt;BR/&gt; 3115: (3.84615%)&lt;BR/&gt; 3114: (3.84615%)&gt;];
}
2168--2702[label="1;13pkt 13fpkt"];
</description>
    <slice>
      <filter dst_ip="212.186.181.193" dst_port="80" src_ip="165.45.17.167"/>
    </slice>
    <from sec="1049432542" usec="0"/>
    <to sec="1049432892" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_564{
style=filled;
color=gray75;
2174[label="219.179.145.169;10pkt 10fpkt", shape=pentagon, color=darkviolet];
2705[label="219.179.145.169;11pkt 11fpkt", shape=invtriangle, color=brown];
stat564[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.179.145.169:80, 165.236.210.152:*}[63.6364%]&lt;BR/&gt;{219.179.145.169:80, 165.236.210.222:*}[36.3636%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 52656: (4.7619%)&lt;BR/&gt; 52655: (4.7619%)&lt;BR/&gt; 52644: (4.7619%)&lt;BR/&gt; 52642: (4.7619%)&gt;];
}
2174--2705[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter dst_ip="165.236.210.152" src_ip="219.179.145.169" src_port="80"/>
      <filter dst_ip="165.236.210.222" src_ip="219.179.145.169" src_port="80"/>
    </slice>
    <from sec="1049432705" usec="0"/>
    <to sec="1049433218" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_565{
style=filled;
color=gray75;
2177[label="165.236.95.170;15pkt 15fpkt", shape=pentagon, color=darkviolet];
2706[label="165.236.95.170;15pkt 15fpkt", shape=invtriangle, color=brown];
3009[label="165.236.95.170;16pkt 16fpkt", shape=invhouse, color=bisque];
stat565[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.236.95.170:*, 221.57.11.163:80}[50%]&lt;BR/&gt;{165.236.95.170:*, 202.96.79.87:80}[25%]&lt;BR/&gt;{165.236.95.170:*, 205.35.218.87:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 45976: (3.26087%)&lt;BR/&gt; 45876: (3.26087%)&lt;BR/&gt; 45875: (3.26087%)&lt;BR/&gt; 45860: (3.26087%)&gt;];
}
2177--2706[label="1;15pkt 15fpkt"];
2177--3009[label="1;15pkt 15fpkt"];
2706--3009[label="1;15pkt 15fpkt"];
</description>
    <slice>
      <filter dst_ip="221.57.11.163" dst_port="80" src_ip="165.236.95.170"/>
      <filter dst_ip="205.35.218.87" dst_port="80" src_ip="165.236.95.170"/>
      <filter dst_ip="202.96.79.87" dst_port="80" src_ip="165.236.95.170"/>
    </slice>
    <from sec="1049432658" usec="0"/>
    <to sec="1049433169" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_566{
style=filled;
color=gray75;
2178[label="136.210.201.170;28pkt 28fpkt", shape=pentagon, color=darkviolet];
2707[label="136.210.201.170;28pkt 28fpkt", shape=invtriangle, color=brown];
3010[label="136.210.201.170;29pkt 29fpkt", shape=invhouse, color=bisque];
stat566[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.210.201.170:25, 202.74.153.237:*}[31.0345%]&lt;BR/&gt;{136.210.201.170:0, *:0}[27.5862%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (37.0588%)&lt;BR/&gt; 0: (27.6471%)&lt;BR/&gt; 53467: (1.76471%)&lt;BR/&gt; 37150: (1.76471%)&lt;BR/&gt; 36319: (1.76471%)&gt;];
}
2178--2707[label="1;28pkt 28fpkt"];
2178--3010[label="1;28pkt 28fpkt"];
2707--3010[label="1;28pkt 28fpkt"];
</description>
    <slice>
      <filter dst_ip="202.74.153.237" src_ip="136.210.201.170" src_port="25"/>
      <filter src_ip="136.210.201.170"/>
    </slice>
    <from sec="1049432417" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_567{
style=filled;
color=gray75;
2180[label="202.135.89.171;46pkt 46fpkt", shape=pentagon, color=darkviolet];
2709[label="202.135.89.171;46pkt 46fpkt", shape=invtriangle, color=brown];
stat567[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.135.89.171:*, *:25}[97.8261%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (48.913%)&lt;BR/&gt; 4739: (1.08696%)&lt;BR/&gt; 2464: (1.08696%)&lt;BR/&gt; 2458: (1.08696%)&lt;BR/&gt; 2452: (1.08696%)&gt;];
}
2180--2709[label="1;46pkt 46fpkt"];
</description>
    <slice>
      <filter dst_port="25" src_ip="202.135.89.171"/>
    </slice>
    <from sec="1049432416" usec="0"/>
    <to sec="1049433281" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_568{
style=filled;
color=gray75;
2185[label="214.68.151.173;109pkt 109fpkt", shape=pentagon, color=darkviolet];
2713[label="214.68.151.173;109pkt 109fpkt", shape=invtriangle, color=brown];
stat568[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.68.151.173:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
2185--2713[label="1;109pkt 109fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="214.68.151.173" src_port="1026"/>
    </slice>
    <from sec="1049433218" usec="0"/>
    <to sec="1049433237" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="162.3.102.174"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.945562,1.42602,503,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_570{
style=filled;
color=gray75;
34[label="160.224.182.175s;2pkt 2fpkt", shape=rectangle, color=red];
2189[label="160.224.182.175;25pkt 25fpkt", shape=pentagon, color=darkviolet];
2717[label="160.224.182.175;24pkt 24fpkt", shape=invtriangle, color=brown];
3013[label="160.224.182.175;24pkt 24fpkt", shape=invhouse, color=bisque];
stat570[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.224.182.175:*, 171.13.194.158:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 42912: (2.66667%)&lt;BR/&gt; 42911: (2.66667%)&lt;BR/&gt; 42963: (2%)&lt;BR/&gt; 42962: (2%)&gt;];
}
34--2189[label="1;2pkt 2fpkt"];
34--2717[label="1;2pkt 2fpkt"];
34--3013[label="1;2pkt 2fpkt"];
2189--2717[label="1;24pkt 24fpkt"];
2189--3013[label="1;24pkt 24fpkt"];
2717--3013[label="0.958333;23pkt 23fpkt"];
</description>
    <slice>
      <filter dst_ip="171.13.194.158" dst_port="80" src_ip="160.224.182.175"/>
    </slice>
    <from sec="1049432543" usec="0"/>
    <to sec="1049432863" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.671611,1.44143,503,0 0 0 0 0 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_571{
style=filled;
color=gray75;
2192[label="141.109.34.176;66pkt 66fpkt", shape=pentagon, color=darkviolet];
3014[label="141.109.34.176;66pkt 66fpkt", shape=invhouse, color=bisque];
stat571[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.109.34.176:80, *:*}[98.4848%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.2424%)&lt;BR/&gt; 0: (1.51515%)&lt;BR/&gt; 65117: (0.757576%)&lt;BR/&gt; 64637: (0.757576%)&lt;BR/&gt; 63440: (0.757576%)&gt;];
}
2192--2718[label="1;66pkt 66fpkt"];
2192--3014[label="1;66pkt 66fpkt"];
</description>
    <slice>
      <filter src_ip="141.109.34.176" src_port="80"/>
    </slice>
    <from sec="1049432406" usec="0"/>
    <to sec="1049433296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.843005,1.37529,020,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_572{
style=filled;
color=gray75;
304[label="203.86.66.176;s;686pkt 686fpkt", shape=diamond, color=yellow];
761[label="202.22.138.58;s;289pkt 289fpkt", shape=diamond, color=yellow];
1115[label="214.32.207.110;d;61pkt 61fpkt", shape=diamond, color=yellow];
1531[label="214.32.207.110;d;61pkt 61fpkt", shape=hexagon, color=black];
2103[label="203.86.66.147;77pkt 77fpkt", shape=pentagon, color=darkviolet];
2193[label="203.86.66.176;722pkt 722fpkt", shape=pentagon, color=darkviolet];
2719[label="203.86.66.176;722pkt 722fpkt", shape=invtriangle, color=brown];
stat572[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.86.66.176:0, *:0}[63.034%]&lt;BR/&gt;{202.22.138.58:0, *:0}[25.109%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.9618%)&lt;BR/&gt; 1259: (0.0190985%)&lt;BR/&gt; 80: (0.0190985%)&gt;];
}
304--739[label="0.00980392;1pkt 1fpkt"];
304--1115[label="0.0163934;1pkt 1fpkt"];
304--1531[label="0.0163934;1pkt 1fpkt"];
304--2193[label="0.998542;685pkt 685fpkt"];
304--2719[label="0.998542;685pkt 685fpkt"];
761--917[label="0.0114943;1pkt 1fpkt"];
761--920[label="0.0128205;1pkt 1fpkt"];
761--1115[label="0.0163934;1pkt 1fpkt"];
761--1430[label="0.0138889;1pkt 1fpkt"];
761--1437[label="0.00346021;1pkt 1fpkt"];
761--1531[label="0.0163934;1pkt 1fpkt"];
1115--1531[label="1;61pkt 61fpkt"];
1115--2103[label="0.0163934;1pkt 1fpkt"];
1115--2193[label="0.0163934;1pkt 1fpkt"];
1115--2719[label="0.0163934;1pkt 1fpkt"];
1531--2103[label="0.0163934;1pkt 1fpkt"];
1531--2193[label="0.0163934;1pkt 1fpkt"];
1531--2719[label="0.0163934;1pkt 1fpkt"];
2193--2719[label="1;722pkt 722fpkt"];
</description>
    <slice>
      <filter src_ip="203.86.66.176"/>
      <filter src_ip="202.22.138.58"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.843005,1.37529,020,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_573{
style=filled;
color=gray75;
269[label="203.86.66.177;s;666pkt 666fpkt", shape=diamond, color=yellow];
917[label="202.224.154.31;d;87pkt 87fpkt", shape=diamond, color=yellow];
1430[label="202.224.154.31;d;72pkt 72fpkt", shape=hexagon, color=black];
2199[label="203.86.66.177;706pkt 706fpkt", shape=pentagon, color=darkviolet];
2722[label="203.86.66.177;707pkt 707fpkt", shape=invtriangle, color=brown];
stat573[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.86.66.177:0, *:0}[89.1551%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
269--917[label="0.0114943;1pkt 1fpkt"];
269--920[label="0.0128205;1pkt 1fpkt"];
269--1430[label="0.0138889;1pkt 1fpkt"];
269--2199[label="0.998498;665pkt 665fpkt"];
269--2722[label="1;666pkt 666fpkt"];
917--1430[label="1;72pkt 72fpkt"];
917--2103[label="0.012987;1pkt 1fpkt"];
917--2199[label="0.0114943;1pkt 1fpkt"];
917--2722[label="0.0114943;1pkt 1fpkt"];
1430--2103[label="0.0138889;1pkt 1fpkt"];
1430--2199[label="0.0138889;1pkt 1fpkt"];
1430--2722[label="0.0138889;1pkt 1fpkt"];
2199--2722[label="1;706pkt 706fpkt"];
</description>
    <slice>
      <filter src_ip="203.86.66.177"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_574{
style=filled;
color=gray75;
2200[label="160.225.97.177;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2723[label="160.225.97.177;1pkt 1fpkt", shape=invtriangle, color=brown];
3016[label="160.225.97.177;1pkt 1fpkt", shape=invhouse, color=bisque];
stat574[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.97.177:1388, 162.224.110.167:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1388: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
2200--2723[label="1;1pkt 1fpkt"];
2200--3016[label="1;1pkt 1fpkt"];
2723--3016[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="162.224.110.167" dst_port="80" src_ip="160.225.97.177" src_port="1388"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="160.225.200.180"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_576{
style=filled;
color=gray75;
2210[label="203.86.64.183;24pkt 24fpkt", shape=pentagon, color=darkviolet];
2726[label="203.86.64.183;25pkt 25fpkt", shape=invtriangle, color=brown];
stat576[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.86.64.183:80, 202.69.58.17:*}[32%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 63516: (2.04082%)&lt;BR/&gt; 55055: (2.04082%)&lt;BR/&gt; 52070: (2.04082%)&lt;BR/&gt; 51487: (2.04082%)&gt;];
}
2210--2726[label="1;24pkt 24fpkt"];
</description>
    <slice>
      <filter dst_ip="202.69.58.17" src_ip="203.86.64.183" src_port="80"/>
    </slice>
    <from sec="1049432404" usec="0"/>
    <to sec="1049433284" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_577{
style=filled;
color=gray75;
2221[label="165.14.246.185;10pkt 10fpkt", shape=pentagon, color=darkviolet];
2729[label="165.14.246.185;9pkt 9fpkt", shape=invtriangle, color=brown];
3018[label="165.14.246.185;10pkt 10fpkt", shape=invhouse, color=bisque];
stat577[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.14.246.185:44798, *:53}[50%]&lt;BR/&gt;{165.14.246.185:53, *:53}[20%]&lt;BR/&gt;{165.14.246.185:*, 164.99.174.218:53}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (60.3448%)&lt;BR/&gt; 44798: (24.1379%)&lt;BR/&gt; 48761: (5.17241%)&lt;BR/&gt; 33652: (5.17241%)&lt;BR/&gt; 1176: (5.17241%)&gt;];
}
2221--2729[label="1;9pkt 9fpkt"];
2221--3018[label="1;10pkt 10fpkt"];
2729--3018[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="164.99.174.218" dst_port="53" src_ip="165.14.246.185"/>
      <filter dst_port="53" src_ip="165.14.246.185" src_port="44798"/>
      <filter dst_port="53" src_ip="165.14.246.185" src_port="53"/>
    </slice>
    <from sec="1049432505" usec="0"/>
    <to sec="1049433199" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.800472,1.3877,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_578{
style=filled;
color=gray75;
303[label="212.73.44.155;d;215pkt 215fpkt", shape=diamond, color=yellow];
672[label="178.184.182.62;s;43pkt 43fpkt", shape=diamond, color=yellow];
712[label="165.236.131.213;s;8pkt 8fpkt", shape=diamond, color=yellow];
719[label="160.225.82.99;s;16pkt 16fpkt", shape=diamond, color=yellow];
749[label="136.210.204.145;s;2pkt 2fpkt", shape=diamond, color=yellow];
1637[label="160.225.120.8;13pkt 13fpkt", shape=pentagon, color=darkviolet];
1668[label="165.45.55.18;12pkt 12fpkt", shape=pentagon, color=darkviolet];
1688[label="160.225.32.23;36pkt 36fpkt", shape=pentagon, color=darkviolet];
1733[label="178.184.37.34;33pkt 33fpkt", shape=pentagon, color=darkviolet];
1745[label="165.45.181.36;22pkt 22fpkt", shape=pentagon, color=darkviolet];
1749[label="136.210.201.37;17pkt 17fpkt", shape=pentagon, color=darkviolet];
1849[label="165.45.244.64;16pkt 16fpkt", shape=pentagon, color=darkviolet];
1886[label="165.236.131.77;3pkt 3fpkt", shape=pentagon, color=darkviolet];
1936[label="160.225.120.93;8pkt 8fpkt", shape=pentagon, color=darkviolet];
1937[label="160.225.68.95;12pkt 12fpkt", shape=pentagon, color=darkviolet];
1940[label="178.184.188.97;26pkt 26fpkt", shape=pentagon, color=darkviolet];
1961[label="160.225.37.103;30pkt 30fpkt", shape=pentagon, color=darkviolet];
2044[label="160.225.32.133;13pkt 13fpkt", shape=pentagon, color=darkviolet];
2098[label="136.210.204.145;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2256[label="160.225.193.200;64pkt 64fpkt", shape=pentagon, color=darkviolet];
2258[label="160.225.85.201;40pkt 40fpkt", shape=pentagon, color=darkviolet];
2323[label="178.184.161.224;9pkt 9fpkt", shape=pentagon, color=darkviolet];
2429[label="160.225.32.23;36pkt 36fpkt", shape=invtriangle, color=brown];
2454[label="178.184.37.34;34pkt 34fpkt", shape=invtriangle, color=brown];
2464[label="165.45.181.36;22pkt 22fpkt", shape=invtriangle, color=brown];
2466[label="136.210.201.37;18pkt 18fpkt", shape=invtriangle, color=brown];
2523[label="165.45.244.64;16pkt 16fpkt", shape=invtriangle, color=brown];
2548[label="165.236.131.77;3pkt 3fpkt", shape=invtriangle, color=brown];
2594[label="160.225.37.103;31pkt 31fpkt", shape=invtriangle, color=brown];
2641[label="160.225.32.133;13pkt 13fpkt", shape=invtriangle, color=brown];
2670[label="136.210.204.145;1pkt 1fpkt", shape=invtriangle, color=brown];
2750[label="160.225.85.201;39pkt 39fpkt", shape=invtriangle, color=brown];
2900[label="165.45.244.64;16pkt 16fpkt", shape=invhouse, color=bisque];
2937[label="160.225.37.103;31pkt 31fpkt", shape=invhouse, color=bisque];
2994[label="136.210.204.145;1pkt 1fpkt", shape=invhouse, color=bisque];
stat578[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 212.73.44.155:80}[36.9676%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.5594%)&lt;BR/&gt; 1863: (0.887902%)&lt;BR/&gt; 25: (0.887902%)&lt;BR/&gt; 0: (0.887902%)&lt;BR/&gt; 113: (0.499445%)&gt;];
}
303--367[label="0.04;1pkt 1fpkt"];
303--672[label="0.0465116;2pkt 2fpkt"];
303--712[label="0.125;1pkt 1fpkt"];
303--719[label="0.375;6pkt 6fpkt"];
303--749[label="0.5;1pkt 1fpkt"];
303--786[label="0.0104167;1pkt 1fpkt"];
303--1201[label="0.00930233;2pkt 2fpkt"];
303--1211[label="0.0139535;3pkt 3fpkt"];
303--1284[label="0.04;1pkt 1fpkt"];
303--1578[label="0.00930233;2pkt 2fpkt"];
303--1608[label="0.125581;27pkt 27fpkt"];
303--1637[label="0.307692;4pkt 4fpkt"];
303--1656[label="0.0186047;4pkt 4fpkt"];
303--1668[label="0.583333;7pkt 7fpkt"];
303--1688[label="0.0555556;2pkt 2fpkt"];
303--1733[label="0.030303;1pkt 1fpkt"];
303--1745[label="0.0909091;2pkt 2fpkt"];
303--1749[label="0.235294;4pkt 4fpkt"];
303--1849[label="0.25;4pkt 4fpkt"];
303--1886[label="0.333333;1pkt 1fpkt"];
303--1929[label="0.00465116;1pkt 1fpkt"];
303--1936[label="0.125;1pkt 1fpkt"];
303--1937[label="0.333333;4pkt 4fpkt"];
303--1940[label="0.153846;4pkt 4fpkt"];
303--1961[label="0.0333333;1pkt 1fpkt"];
303--2044[label="0.153846;2pkt 2fpkt"];
303--2098[label="0.5;1pkt 1fpkt"];
303--2209[label="0.0139535;3pkt 3fpkt"];
303--2213[label="0.0604651;13pkt 13fpkt"];
303--2224[label="0.0384615;1pkt 1fpkt"];
303--2253[label="0.0843373;7pkt 7fpkt"];
303--2256[label="0.078125;5pkt 5fpkt"];
303--2258[label="0.025;1pkt 1fpkt"];
303--2323[label="0.111111;1pkt 1fpkt"];
303--2328[label="0.0108696;1pkt 1fpkt"];
303--2401[label="0.00930233;2pkt 2fpkt"];
303--2429[label="0.0555556;2pkt 2fpkt"];
303--2454[label="0.0294118;1pkt 1fpkt"];
303--2464[label="0.0909091;2pkt 2fpkt"];
303--2466[label="0.222222;4pkt 4fpkt"];
303--2523[label="0.25;4pkt 4fpkt"];
303--2548[label="0.333333;1pkt 1fpkt"];
303--2574[label="0.00465116;1pkt 1fpkt"];
303--2594[label="0.0322581;1pkt 1fpkt"];
303--2641[label="0.153846;2pkt 2fpkt"];
303--2670[label="1;1pkt 1fpkt"];
303--2730[label="0.0384615;1pkt 1fpkt"];
303--2746[label="0.0853659;7pkt 7fpkt"];
303--2750[label="0.025641;1pkt 1fpkt"];
303--2833[label="0.00930233;2pkt 2fpkt"];
303--2900[label="0.25;4pkt 4fpkt"];
303--2929[label="0.00465116;1pkt 1fpkt"];
303--2937[label="0.0322581;1pkt 1fpkt"];
303--2994[label="1;1pkt 1fpkt"];
303--3019[label="0.037037;1pkt 1fpkt"];
672--678[label="0.0465116;2pkt 2fpkt"];
672--706[label="0.465116;20pkt 20fpkt"];
672--1608[label="0.418605;18pkt 18fpkt"];
712--713[label="0.875;7pkt 7fpkt"];
712--1320[label="0.875;7pkt 7fpkt"];
749--1278[label="0.5;1pkt 1fpkt"];
749--2098[label="1;2pkt 2fpkt"];
749--2670[label="1;1pkt 1fpkt"];
749--2994[label="1;1pkt 1fpkt"];
1688--2429[label="1;36pkt 36fpkt"];
1733--2454[label="1;33pkt 33fpkt"];
1745--2464[label="1;22pkt 22fpkt"];
1749--2466[label="1;17pkt 17fpkt"];
1849--2523[label="1;16pkt 16fpkt"];
1849--2900[label="1;16pkt 16fpkt"];
1886--2548[label="1;3pkt 3fpkt"];
1936--2578[label="1;7pkt 7fpkt"];
1961--2594[label="1;30pkt 30fpkt"];
1961--2937[label="1;30pkt 30fpkt"];
2044--2641[label="1;13pkt 13fpkt"];
2098--2670[label="1;1pkt 1fpkt"];
2098--2994[label="1;1pkt 1fpkt"];
2258--2750[label="1;39pkt 39fpkt"];
2523--2900[label="1;16pkt 16fpkt"];
2594--2937[label="1;31pkt 31fpkt"];
2670--2994[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="212.73.44.155" dst_port="80"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_579{
style=filled;
color=gray75;
2226[label="219.146.162.187;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2731[label="219.146.162.187;1pkt 1fpkt", shape=invtriangle, color=brown];
stat579[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.146.162.187:80, 141.109.179.78:52141}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 52141: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
2226--2731[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="141.109.179.78" dst_port="52141" src_ip="219.146.162.187" src_port="80"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_580{
style=filled;
color=gray75;
2228[label="160.225.93.188;20pkt 20fpkt", shape=pentagon, color=darkviolet];
2732[label="160.225.93.188;19pkt 19fpkt", shape=invtriangle, color=brown];
3020[label="160.225.93.188;20pkt 20fpkt", shape=invhouse, color=bisque];
stat580[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.93.188:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 60649: (2.54237%)&lt;BR/&gt; 19708: (2.54237%)&lt;BR/&gt; 18378: (2.54237%)&lt;BR/&gt; 4598: (2.54237%)&gt;];
}
2228--2732[label="1;19pkt 19fpkt"];
2228--3020[label="1;20pkt 20fpkt"];
2732--3020[label="1;19pkt 19fpkt"];
</description>
    <slice>
      <filter src_ip="160.225.93.188" src_port="80"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049432622" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.452887,1.42077,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_581{
style=filled;
color=gray75;
2231[label="214.35.87.189;130pkt 130fpkt", shape=pentagon, color=darkviolet];
stat581[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.35.87.189:1036, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1036: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
2231--2734[label="1;129pkt 129fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="214.35.87.189" src_port="1036"/>
    </slice>
    <from sec="1049432863" usec="0"/>
    <to sec="1049432903" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="203.113.19.195"/>
    </slice>
    <from sec="1049432402" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="83.229.164.196"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433295" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_584{
style=filled;
color=gray75;
2247[label="197.225.3.197;59pkt 59fpkt", shape=pentagon, color=darkviolet];
2744[label="197.225.3.197;58pkt 58fpkt", shape=invtriangle, color=brown];
3026[label="197.225.3.197;59pkt 59fpkt", shape=invhouse, color=bisque];
stat584[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.225.3.197:*, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 113: (9.375%)&lt;BR/&gt; 6667: (9.09091%)&lt;BR/&gt; 1080: (7.67045%)&lt;BR/&gt; 10080: (5.96591%)&lt;BR/&gt; 8080: (5.96591%)&gt;];
}
2247--2744[label="1;58pkt 58fpkt"];
2247--3026[label="1;59pkt 59fpkt"];
2744--3026[label="1;58pkt 58fpkt"];
</description>
    <slice>
      <filter src_ip="197.225.3.197"/>
    </slice>
    <from sec="1049432411" usec="0"/>
    <to sec="1049433299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_585{
style=filled;
color=gray75;
2249[label="66.107.142.197;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2745[label="66.107.142.197;1pkt 1fpkt", shape=invtriangle, color=brown];
3027[label="66.107.142.197;2pkt 2fpkt", shape=invhouse, color=bisque];
stat585[shape=component, label=&lt;Rules:&lt;BR/&gt;{66.107.142.197:80, 141.109.118.163:38769}[50%]&lt;BR/&gt;{66.107.142.197:80, 141.109.118.163:38776}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 38776: (37.5%)&lt;BR/&gt; 38769: (12.5%)&gt;];
}
2249--2745[label="1;1pkt 1fpkt"];
2249--3027[label="1;1pkt 1fpkt"];
2745--3027[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="141.109.118.163" dst_port="38776" src_ip="66.107.142.197" src_port="80"/>
      <filter dst_ip="141.109.118.163" dst_port="38769" src_ip="66.107.142.197" src_port="80"/>
    </slice>
    <from sec="1049432753" usec="0"/>
    <to sec="1049432758" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.805067,1.40513,503,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_586{
style=filled;
color=gray75;
36[label="160.225.238.198s;1pkt 1fpkt", shape=rectangle, color=red];
2253[label="160.225.238.198;83pkt 83fpkt", shape=pentagon, color=darkviolet];
2746[label="160.225.238.198;82pkt 82fpkt", shape=invtriangle, color=brown];
stat586[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.238.198:*, 67.185.165.185:80}[32.5301%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.3976%)&lt;BR/&gt; 3452: (0.903614%)&lt;BR/&gt; 23656: (0.60241%)&lt;BR/&gt; 3514: (0.60241%)&lt;BR/&gt; 3510: (0.60241%)&gt;];
}
36--2253[label="1;1pkt 1fpkt"];
36--2746[label="1;1pkt 1fpkt"];
2253--2746[label="1;82pkt 82fpkt"];
</description>
    <slice>
      <filter dst_ip="67.185.165.185" dst_port="80" src_ip="160.225.238.198"/>
    </slice>
    <from sec="1049432408" usec="0"/>
    <to sec="1049433299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_587{
style=filled;
color=gray75;
2254[label="202.22.140.199;30pkt 30fpkt", shape=pentagon, color=darkviolet];
2747[label="202.22.140.199;30pkt 30fpkt", shape=invtriangle, color=brown];
3028[label="202.22.140.199;31pkt 31fpkt", shape=invhouse, color=bisque];
stat587[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.22.140.199:53, *:*}[45.1613%]&lt;BR/&gt;{202.22.140.199:1027, *:53}[41.9355%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (48.3516%)&lt;BR/&gt; 1027: (20.3297%)&lt;BR/&gt; 25: (4.94505%)&lt;BR/&gt; 9253: (3.2967%)&lt;BR/&gt; 58048: (1.64835%)&gt;];
}
2254--2747[label="1;30pkt 30fpkt"];
2254--3028[label="1;30pkt 30fpkt"];
2747--3028[label="1;30pkt 30fpkt"];
</description>
    <slice>
      <filter src_ip="202.22.140.199" src_port="53"/>
      <filter dst_port="53" src_ip="202.22.140.199" src_port="1027"/>
    </slice>
    <from sec="1049432456" usec="0"/>
    <to sec="1049433252" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_588{
style=filled;
color=gray75;
2262[label="136.210.216.202;16pkt 16fpkt", shape=pentagon, color=darkviolet];
2751[label="136.210.216.202;16pkt 16fpkt", shape=invtriangle, color=brown];
3030[label="136.210.216.202;16pkt 16fpkt", shape=invhouse, color=bisque];
stat588[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.210.216.202:80, 202.71.150.228:*}[68.75%]&lt;BR/&gt;{136.210.216.202:80, 202.74.187.97:*}[31.25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 48885: (3.125%)&lt;BR/&gt; 48833: (3.125%)&lt;BR/&gt; 48830: (3.125%)&lt;BR/&gt; 48828: (3.125%)&gt;];
}
2262--2751[label="1;16pkt 16fpkt"];
2262--3030[label="1;16pkt 16fpkt"];
2751--3030[label="1;16pkt 16fpkt"];
</description>
    <slice>
      <filter dst_ip="202.71.150.228" src_ip="136.210.216.202" src_port="80"/>
      <filter dst_ip="202.74.187.97" src_ip="136.210.216.202" src_port="80"/>
    </slice>
    <from sec="1049432978" usec="0"/>
    <to sec="1049433278" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_589{
style=filled;
color=gray75;
2273[label="196.115.208.209;35pkt 35fpkt", shape=pentagon, color=darkviolet];
2756[label="196.115.208.209;34pkt 34fpkt", shape=invtriangle, color=brown];
3032[label="196.115.208.209;34pkt 34fpkt", shape=invhouse, color=bisque];
stat589[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.115.208.209:*, 203.86.67.72:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2416: (1.45631%)&lt;BR/&gt; 2414: (1.45631%)&lt;BR/&gt; 2409: (1.45631%)&lt;BR/&gt; 2408: (1.45631%)&gt;];
}
2273--2756[label="1;34pkt 34fpkt"];
2273--3032[label="1;34pkt 34fpkt"];
2756--3032[label="1;34pkt 34fpkt"];
</description>
    <slice>
      <filter dst_ip="203.86.67.72" dst_port="80" src_ip="196.115.208.209"/>
    </slice>
    <from sec="1049432413" usec="0"/>
    <to sec="1049433231" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_590{
style=filled;
color=gray75;
2278[label="202.225.21.211;21pkt 21fpkt", shape=pentagon, color=darkviolet];
2759[label="202.225.21.211;20pkt 20fpkt", shape=invtriangle, color=brown];
stat590[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.225.21.211:80, 165.236.199.229:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1369: (2.43902%)&lt;BR/&gt; 1368: (2.43902%)&lt;BR/&gt; 1367: (2.43902%)&lt;BR/&gt; 1366: (2.43902%)&gt;];
}
2278--2759[label="1;20pkt 20fpkt"];
</description>
    <slice>
      <filter dst_ip="165.236.199.229" src_ip="202.225.21.211" src_port="80"/>
    </slice>
    <from sec="1049432906" usec="0"/>
    <to sec="1049432913" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_591{
style=filled;
color=gray75;
2282[label="197.2.120.212;5pkt 5fpkt", shape=pentagon, color=darkviolet];
2760[label="197.2.120.212;5pkt 5fpkt", shape=invtriangle, color=brown];
3033[label="197.2.120.212;6pkt 6fpkt", shape=invhouse, color=bisque];
stat591[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.2.120.212:80, *:*}[66.6667%]&lt;BR/&gt;{197.2.120.212:0, *:0}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (37.5%)&lt;BR/&gt; 80: (31.25%)&lt;BR/&gt; 63082: (9.375%)&lt;BR/&gt; 41759: (9.375%)&lt;BR/&gt; 3193: (9.375%)&gt;];
}
2282--2760[label="1;5pkt 5fpkt"];
2282--3033[label="1;5pkt 5fpkt"];
2760--3033[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter src_ip="197.2.120.212" src_port="80"/>
      <filter src_ip="197.2.120.212"/>
    </slice>
    <from sec="1049432404" usec="0"/>
    <to sec="1049433296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_592{
style=filled;
color=gray75;
2284[label="7.185.200.212;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2762[label="7.185.200.212;1pkt 1fpkt", shape=invtriangle, color=brown];
stat592[shape=component, label=&lt;Rules:&lt;BR/&gt;{7.185.200.212:80, 165.236.197.222:36536}[50%]&lt;BR/&gt;{7.185.200.212:80, 165.236.197.222:36538}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 36538: (33.3333%)&lt;BR/&gt; 36536: (16.6667%)&gt;];
}
2284--2762[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="165.236.197.222" dst_port="36538" src_ip="7.185.200.212" src_port="80"/>
      <filter dst_ip="165.236.197.222" dst_port="36536" src_ip="7.185.200.212" src_port="80"/>
    </slice>
    <from sec="1049433283" usec="0"/>
    <to sec="1049433290" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="205.215.50.213"/>
    </slice>
    <from sec="1049432719" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_594{
style=filled;
color=gray75;
2290[label="7.228.136.215;10pkt 10fpkt", shape=pentagon, color=darkviolet];
2764[label="7.228.136.215;10pkt 10fpkt", shape=invtriangle, color=brown];
3034[label="7.228.136.215;10pkt 10fpkt", shape=invhouse, color=bisque];
stat594[shape=component, label=&lt;Rules:&lt;BR/&gt;{7.228.136.215:80, 165.236.131.73:*}[80%]&lt;BR/&gt;{7.228.136.215:80, 165.236.197.222:*}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 36477: (5%)&lt;BR/&gt; 36476: (5%)&lt;BR/&gt; 1154: (5%)&lt;BR/&gt; 1153: (5%)&gt;];
}
2290--2764[label="1;10pkt 10fpkt"];
2290--3034[label="1;10pkt 10fpkt"];
2764--3034[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter dst_ip="165.236.131.73" src_ip="7.228.136.215" src_port="80"/>
      <filter dst_ip="165.236.197.222" src_ip="7.228.136.215" src_port="80"/>
    </slice>
    <from sec="1049432826" usec="0"/>
    <to sec="1049433162" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_595{
style=filled;
color=gray75;
2291[label="160.225.223.215;8pkt 8fpkt", shape=pentagon, color=darkviolet];
2765[label="160.225.223.215;7pkt 7fpkt", shape=invtriangle, color=brown];
3035[label="160.225.223.215;7pkt 7fpkt", shape=invhouse, color=bisque];
stat595[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.223.215:*, 197.192.130.140:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2270: (6.81818%)&lt;BR/&gt; 2269: (6.81818%)&lt;BR/&gt; 2268: (6.81818%)&lt;BR/&gt; 2267: (6.81818%)&gt;];
}
2291--2765[label="1;7pkt 7fpkt"];
2291--3035[label="1;7pkt 7fpkt"];
2765--3035[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="197.192.130.140" dst_port="80" src_ip="160.225.223.215"/>
    </slice>
    <from sec="1049432921" usec="0"/>
    <to sec="1049432992" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_596{
style=filled;
color=gray75;
2292[label="160.225.81.216;17pkt 17fpkt", shape=pentagon, color=darkviolet];
2766[label="160.225.81.216;16pkt 16fpkt", shape=invtriangle, color=brown];
3036[label="160.225.81.216;16pkt 16fpkt", shape=invhouse, color=bisque];
stat596[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.81.216:80, 214.106.164.102:*}[23.5294%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 63457: (3.06122%)&lt;BR/&gt; 61040: (3.06122%)&lt;BR/&gt; 59955: (3.06122%)&lt;BR/&gt; 44194: (3.06122%)&gt;];
}
2292--2766[label="1;16pkt 16fpkt"];
2292--3036[label="1;16pkt 16fpkt"];
2766--3036[label="1;16pkt 16fpkt"];
</description>
    <slice>
      <filter dst_ip="214.106.164.102" src_ip="160.225.81.216" src_port="80"/>
    </slice>
    <from sec="1049432434" usec="0"/>
    <to sec="1049433252" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_597{
style=filled;
color=gray75;
2295[label="165.45.194.216;13pkt 13fpkt", shape=pentagon, color=darkviolet];
2768[label="165.45.194.216;13pkt 13fpkt", shape=invtriangle, color=brown];
3037[label="165.45.194.216;13pkt 13fpkt", shape=invhouse, color=bisque];
stat597[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.45.194.216:*, 7.55.21.92:80}[92.3077%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.1538%)&lt;BR/&gt; 49369: (3.84615%)&lt;BR/&gt; 49368: (3.84615%)&lt;BR/&gt; 49367: (3.84615%)&lt;BR/&gt; 49365: (3.84615%)&gt;];
}
2295--2768[label="1;13pkt 13fpkt"];
2295--3037[label="1;13pkt 13fpkt"];
2768--3037[label="1;13pkt 13fpkt"];
</description>
    <slice>
      <filter dst_ip="7.55.21.92" dst_port="80" src_ip="165.45.194.216"/>
    </slice>
    <from sec="1049432429" usec="0"/>
    <to sec="1049433244" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_598{
style=filled;
color=gray75;
2300[label="69.15.121.218;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2769[label="69.15.121.218;1pkt 1fpkt", shape=invtriangle, color=brown];
3038[label="69.15.121.218;1pkt 1fpkt", shape=invhouse, color=bisque];
stat598[shape=component, label=&lt;Rules:&lt;BR/&gt;{69.15.121.218:4662, 141.109.179.137:2864}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4662: (50%)&lt;BR/&gt; 2864: (50%)&gt;];
}
2300--2769[label="1;1pkt 1fpkt"];
2300--3038[label="1;1pkt 1fpkt"];
2769--3038[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="141.109.179.137" dst_port="2864" src_ip="69.15.121.218" src_port="4662"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_599{
style=filled;
color=gray75;
2305[label="165.45.193.219;18pkt 18fpkt", shape=pentagon, color=darkviolet];
2772[label="165.45.193.219;18pkt 18fpkt", shape=invtriangle, color=brown];
stat599[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.45.193.219:*, 66.107.232.186:80}[66.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.2222%)&lt;BR/&gt; 2367: (2.77778%)&lt;BR/&gt; 2366: (2.77778%)&lt;BR/&gt; 2259: (2.77778%)&lt;BR/&gt; 2257: (2.77778%)&gt;];
}
2305--2772[label="1;18pkt 18fpkt"];
</description>
    <slice>
      <filter dst_ip="66.107.232.186" dst_port="80" src_ip="165.45.193.219"/>
    </slice>
    <from sec="1049432511" usec="0"/>
    <to sec="1049433272" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="178.184.152.222"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="205.215.50.230"/>
    </slice>
    <from sec="1049432411" usec="0"/>
    <to sec="1049433291" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_603{
style=filled;
color=gray75;
2336[label="214.107.5.232;151pkt 151fpkt", shape=pentagon, color=darkviolet];
2790[label="214.107.5.232;151pkt 151fpkt", shape=invtriangle, color=brown];
3054[label="214.107.5.232;152pkt 152fpkt", shape=invhouse, color=bisque];
stat603[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.107.5.232:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
2336--2790[label="1;151pkt 151fpkt"];
2336--3054[label="1;151pkt 151fpkt"];
2790--3054[label="1;151pkt 151fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="214.107.5.232" src_port="1025"/>
    </slice>
    <from sec="1049433273" usec="0"/>
    <to sec="1049433299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="6.153.96.236"/>
    </slice>
    <from sec="1049432639" usec="0"/>
    <to sec="1049433253" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,020,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_605{
style=filled;
color=gray75;
2353[label="216.146.52.239;62pkt 62fpkt", shape=pentagon, color=darkviolet];
2800[label="216.146.52.239;63pkt 63fpkt", shape=invtriangle, color=brown];
stat605[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.146.52.239:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2353--2800[label="1;62pkt 62fpkt"];
</description>
    <slice>
      <filter src_ip="216.146.52.239"/>
    </slice>
    <from sec="1049432421" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="165.236.164.239"/>
    </slice>
    <from sec="1049432492" usec="0"/>
    <to sec="1049433105" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_607{
style=filled;
color=gray75;
2358[label="203.56.19.242;35pkt 35fpkt", shape=pentagon, color=darkviolet];
2804[label="203.56.19.242;35pkt 35fpkt", shape=invtriangle, color=brown];
stat607[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.56.19.242:*, *:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4999: (1.42857%)&lt;BR/&gt; 4809: (1.42857%)&lt;BR/&gt; 4792: (1.42857%)&lt;BR/&gt; 4710: (1.42857%)&gt;];
}
2358--2804[label="1;35pkt 35fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="203.56.19.242"/>
    </slice>
    <from sec="1049432457" usec="0"/>
    <to sec="1049433280" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_608{
style=filled;
color=gray75;
2362[label="4.16.89.243;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2807[label="4.16.89.243;3pkt 3fpkt", shape=invtriangle, color=brown];
3064[label="4.16.89.243;3pkt 3fpkt", shape=invhouse, color=bisque];
stat608[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.16.89.243:1021, 141.109.44.185:1326}[33.3333%]&lt;BR/&gt;{4.16.89.243:1021, 141.109.44.185:1327}[33.3333%]&lt;BR/&gt;{4.16.89.243:1021, 141.109.44.185:1330}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1021: (50%)&lt;BR/&gt; 1330: (16.6667%)&lt;BR/&gt; 1327: (16.6667%)&lt;BR/&gt; 1326: (16.6667%)&gt;];
}
2362--2807[label="1;3pkt 3fpkt"];
2362--3064[label="1;3pkt 3fpkt"];
2807--3064[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="141.109.44.185" dst_port="1330" src_ip="4.16.89.243" src_port="1021"/>
      <filter dst_ip="141.109.44.185" dst_port="1327" src_ip="4.16.89.243" src_port="1021"/>
      <filter dst_ip="141.109.44.185" dst_port="1326" src_ip="4.16.89.243" src_port="1021"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="212.237.167.243"/>
    </slice>
    <from sec="1049432532" usec="0"/>
    <to sec="1049432959" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_610{
style=filled;
color=gray75;
2366[label="141.109.207.244;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2809[label="141.109.207.244;1pkt 1fpkt", shape=invtriangle, color=brown];
3066[label="141.109.207.244;1pkt 1fpkt", shape=invhouse, color=bisque];
stat610[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.109.207.244:25, 212.167.70.22:3668}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3668: (50%)&lt;BR/&gt; 25: (50%)&gt;];
}
2366--2809[label="1;1pkt 1fpkt"];
2366--3066[label="1;1pkt 1fpkt"];
2809--3066[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="212.167.70.22" dst_port="3668" src_ip="141.109.207.244" src_port="25"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="221.41.2.248"/>
    </slice>
    <from sec="1049432402" usec="0"/>
    <to sec="1049433297" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_612{
style=filled;
color=gray75;
2374[label="165.45.204.248;21pkt 21fpkt", shape=pentagon, color=darkviolet];
2814[label="165.45.204.248;21pkt 21fpkt", shape=invtriangle, color=brown];
3068[label="165.45.204.248;21pkt 21fpkt", shape=invhouse, color=bisque];
stat612[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.45.204.248:80, 4.162.35.191:*}[61.9048%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.619%)&lt;BR/&gt; 0: (4.7619%)&lt;BR/&gt; 56393: (2.38095%)&lt;BR/&gt; 46192: (2.38095%)&lt;BR/&gt; 41240: (2.38095%)&gt;];
}
2374--2814[label="1;21pkt 21fpkt"];
2374--3068[label="1;21pkt 21fpkt"];
2814--3068[label="1;21pkt 21fpkt"];
</description>
    <slice>
      <filter dst_ip="4.162.35.191" src_ip="165.45.204.248" src_port="80"/>
    </slice>
    <from sec="1049432414" usec="0"/>
    <to sec="1049433280" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.945562,1.42602,002,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_613{
style=filled;
color=gray75;
113[label="4.99.7.251s;107pkt 107fpkt", shape=rectangle, color=red];
2380[label="4.99.7.251;121pkt 121fpkt", shape=pentagon, color=darkviolet];
2818[label="4.99.7.251;121pkt 121fpkt", shape=invtriangle, color=brown];
3071[label="4.99.7.251;121pkt 121fpkt", shape=invhouse, color=bisque];
stat613[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.99.7.251:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
113--2380[label="1;107pkt 107fpkt"];
113--2818[label="1;107pkt 107fpkt"];
113--3071[label="1;107pkt 107fpkt"];
2380--2818[label="1;121pkt 121fpkt"];
2380--3071[label="1;121pkt 121fpkt"];
2818--3071[label="1;121pkt 121fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.99.7.251" src_port="1027"/>
    </slice>
    <from sec="1049432932" usec="0"/>
    <to sec="1049432954" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.739345,1.43617,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_614{
style=filled;
color=gray75;
2384[label="217.170.196.252;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2820[label="217.170.196.252;3pkt 3fpkt", shape=invtriangle, color=brown];
3073[label="217.170.196.252;3pkt 3fpkt", shape=invhouse, color=bisque];
stat614[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.170.196.252:1458, 165.236.164.147:80}[33.3333%]&lt;BR/&gt;{217.170.196.252:1459, 165.236.164.147:80}[33.3333%]&lt;BR/&gt;{217.170.196.252:1460, 165.236.164.147:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1460: (16.6667%)&lt;BR/&gt; 1459: (16.6667%)&lt;BR/&gt; 1458: (16.6667%)&gt;];
}
2384--2820[label="1;3pkt 3fpkt"];
2384--3073[label="1;3pkt 3fpkt"];
2820--3073[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="165.236.164.147" dst_port="80" src_ip="217.170.196.252" src_port="1460"/>
      <filter dst_ip="165.236.164.147" dst_port="80" src_ip="217.170.196.252" src_port="1459"/>
      <filter dst_ip="165.236.164.147" dst_port="80" src_ip="217.170.196.252" src_port="1458"/>
    </slice>
    <from sec="1049433092" usec="0"/>
    <to sec="1049433139" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_615{
style=filled;
color=gray75;
2385[label="160.225.204.252;22pkt 22fpkt", shape=pentagon, color=darkviolet];
2821[label="160.225.204.252;23pkt 23fpkt", shape=invtriangle, color=brown];
stat615[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.225.204.252:80, 194.176.238.40:*}[21.7391%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 64713: (2.22222%)&lt;BR/&gt; 60929: (2.22222%)&lt;BR/&gt; 60803: (2.22222%)&lt;BR/&gt; 60802: (2.22222%)&gt;];
}
2385--2821[label="1;22pkt 22fpkt"];
</description>
    <slice>
      <filter dst_ip="194.176.238.40" src_ip="160.225.204.252" src_port="80"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548339,1.41543,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_616{
style=filled;
color=gray75;
2387[label="217.64.189.254;13pkt 13fpkt", shape=pentagon, color=darkviolet];
2823[label="217.64.189.254;14pkt 14fpkt", shape=invtriangle, color=brown];
stat616[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.64.189.254:80, 141.109.73.76:*}[85.7143%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 34169: (3.7037%)&lt;BR/&gt; 34168: (3.7037%)&lt;BR/&gt; 34167: (3.7037%)&lt;BR/&gt; 34122: (3.7037%)&gt;];
}
2387--2823[label="1;13pkt 13fpkt"];
</description>
    <slice>
      <filter dst_ip="141.109.73.76" src_ip="217.64.189.254" src_port="80"/>
    </slice>
    <from sec="1049432641" usec="0"/>
    <to sec="1049433172" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.727557,1.49831,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="7.130.136.1"/>
    </slice>
    <from sec="1049432405" usec="0"/>
    <to sec="1049433297" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.727557,1.49831,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="178.184.85.10"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.727557,1.49831,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="203.0.100.20"/>
    </slice>
    <from sec="1049432411" usec="0"/>
    <to sec="1049433292" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.727557,1.49831,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="160.225.131.34"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.727557,1.49831,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="83.196.87.53"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.727557,1.49831,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="136.210.209.55"/>
    </slice>
    <from sec="1049432404" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.727557,1.49831,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="136.210.214.64"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.727557,1.49831,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="141.109.111.89"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.727557,1.49831,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="165.45.16.104"/>
    </slice>
    <from sec="1049433072" usec="0"/>
    <to sec="1049433080" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.727557,1.49831,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="160.225.246.110"/>
    </slice>
    <from sec="1049433163" usec="0"/>
    <to sec="1049433235" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.727557,1.49831,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="165.45.194.137"/>
    </slice>
    <from sec="1049432408" usec="0"/>
    <to sec="1049433285" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.789597,1.45192,999,0 0 0 1 0 0 0 0 0 0 0 1 ">
    <description>subgraph cluster_628{
style=filled;
color=gray75;
556[label="197.174.212.139;s;843pkt 843fpkt", shape=diamond, color=yellow];
2986[label="197.174.212.139;4pkt 4fpkt", shape=invhouse, color=bisque];
stat628[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.174.212.139:53, *:*}[99.8818%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (50.1181%)&lt;BR/&gt; 1359: (0.236128%)&lt;BR/&gt; 1083: (0.236128%)&lt;BR/&gt; 4945: (0.177096%)&lt;BR/&gt; 3148: (0.177096%)&gt;];
}
556--2986[label="0.25;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="197.174.212.139" src_port="53"/>
    </slice>
    <from sec="1049432401" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.727557,1.49831,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="216.203.25.146"/>
    </slice>
    <from sec="1049432407" usec="0"/>
    <to sec="1049433300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.727557,1.49831,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="3.166.41.159"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.671611,1.44143,999,0 0 0 0 0 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_631{
style=filled;
color=gray75;
2149[label="203.86.70.162;45pkt 45fpkt", shape=pentagon, color=darkviolet];
3002[label="203.86.70.162;45pkt 45fpkt", shape=invhouse, color=bisque];
stat631[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.86.70.162:*, *:113}[35.5556%]&lt;BR/&gt;{203.86.70.162:25, *:*}[35.5556%]&lt;BR/&gt;{203.86.70.162:0, *:0}[24.4444%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (24.4444%)&lt;BR/&gt; 25: (18.8889%)&lt;BR/&gt; 113: (17.7778%)&lt;BR/&gt; 63922: (1.11111%)&lt;BR/&gt; 63609: (1.11111%)&gt;];
}
2149--3002[label="1;45pkt 45fpkt"];
</description>
    <slice>
      <filter src_ip="203.86.70.162" src_port="25"/>
      <filter dst_port="113" src_ip="203.86.70.162"/>
      <filter src_ip="203.86.70.162"/>
    </slice>
    <from sec="1049432429" usec="0"/>
    <to sec="1049433291" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.727557,1.49831,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="162.3.102.174"/>
    </slice>
    <from sec="1049433300" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.615591,1.47332,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <description>subgraph cluster_633{
style=filled;
color=gray75;
2718[label="141.109.34.176;66pkt 66fpkt", shape=invtriangle, color=brown];
stat633[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.109.34.176:80, *:*}[98.4848%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.2424%)&lt;BR/&gt; 0: (1.51515%)&lt;BR/&gt; 65117: (0.757576%)&lt;BR/&gt; 64637: (0.757576%)&lt;BR/&gt; 63440: (0.757576%)&gt;];
}
2718--3014[label="1;66pkt 66fpkt"];
</description>
    <slice>
      <filter src_ip="141.109.34.176" src_port="80"/>
    </slice>
    <from sec="1049432406" usec="0"/>
    <to sec="1049433296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.727557,1.49831,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="178.184.152.222"/>
    </slice>
    <from sec="1049432400" usec="0"/>
    <to sec="1049433301" usec="0"/>
  </anomaly>

</admd:annotation>
