<?xml version="1.0" encoding="UTF-8" standalone="no" ?>
<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">

  <anomaly type="notice" value="0.691112,1.45655,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="tcp" src_ip="77.24.149.22" src_port="1025"/>
      <filter dst_port="137" proto="udp" src_ip="77.24.149.22" src_port="1025"/>
      <filter dst_port="53" proto="tcp" src_ip="77.24.149.22" src_port="1025"/>
      <filter dst_port="53" proto="udp" src_ip="77.24.149.22" src_port="1025"/>
      <from sec="1086498174" usec="0"/>
      <to sec="1086498194" usec="0"/>
    </slice>
    <from sec="1086498174" usec="0"/>
    <to sec="1086498194" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.691112,1.45655,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="199.143.65.49" src_port="1027"/>
      <from sec="1086498454" usec="0"/>
      <to sec="1086498464" usec="0"/>
    </slice>
    <from sec="1086498454" usec="0"/>
    <to sec="1086498464" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.691112,1.45655,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_2{
style=filled;
color=gray75;
49[label="2.194.69.72s;255pkt 255fpkt", shape=rectangle, color=red];
stat2[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.194.69.72:1065, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1065: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
49--1528[label="0.00392157;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="2.194.69.72" src_port="1065"/>
    </slice>
    <from sec="1086498464" usec="0"/>
    <to sec="1086498494" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.691112,1.45655,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="214.148.236.93" src_port="1028"/>
      <from sec="1086498671" usec="0"/>
      <to sec="1086498677" usec="0"/>
    </slice>
    <from sec="1086498671" usec="0"/>
    <to sec="1086498677" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.691112,1.45655,504,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="193.52.235.143" dst_port="137" proto="tcp" src_ip="3.160.98.99" src_port="1028"/>
      <filter dst_ip="193.52.235.143" dst_port="137" proto="udp" src_ip="3.160.98.99" src_port="1028"/>
      <filter dst_ip="193.52.235.143" dst_port="443" proto="tcp" src_ip="3.160.98.99" src_port="1028"/>
      <filter dst_ip="193.52.235.143" dst_port="443" proto="udp" src_ip="3.160.98.99" src_port="1028"/>
      <filter dst_ip="193.52.235.143" dst_port="137" proto="tcp" src_ip="3.160.98.99" src_port="1060"/>
      <filter dst_ip="193.52.235.143" dst_port="137" proto="udp" src_ip="3.160.98.99" src_port="1060"/>
      <filter dst_ip="193.52.235.143" dst_port="443" proto="tcp" src_ip="3.160.98.99" src_port="1060"/>
      <filter dst_ip="193.52.235.143" dst_port="443" proto="udp" src_ip="3.160.98.99" src_port="1060"/>
      <from sec="1086498869" usec="0"/>
      <to sec="1086498879" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="193.52.235.143" dst_port="137" proto="tcp" src_ip="153.130.112.251" src_port="1028"/>
      <filter dst_ip="193.52.235.143" dst_port="137" proto="udp" src_ip="153.130.112.251" src_port="1028"/>
      <filter dst_ip="193.52.235.143" dst_port="443" proto="tcp" src_ip="153.130.112.251" src_port="1028"/>
      <filter dst_ip="193.52.235.143" dst_port="443" proto="udp" src_ip="153.130.112.251" src_port="1028"/>
      <filter dst_ip="193.52.235.143" dst_port="137" proto="tcp" src_ip="153.130.112.251" src_port="1060"/>
      <filter dst_ip="193.52.235.143" dst_port="137" proto="udp" src_ip="153.130.112.251" src_port="1060"/>
      <filter dst_ip="193.52.235.143" dst_port="443" proto="tcp" src_ip="153.130.112.251" src_port="1060"/>
      <filter dst_ip="193.52.235.143" dst_port="443" proto="udp" src_ip="153.130.112.251" src_port="1060"/>
      <from sec="1086498869" usec="0"/>
      <to sec="1086498874" usec="0"/>
    </slice>
    <from sec="1086498869" usec="0"/>
    <to sec="1086498879" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.691112,1.45655,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="212.208.1.207" src_port="63846"/>
      <from sec="1086498882" usec="0"/>
      <to sec="1086498896" usec="0"/>
    </slice>
    <from sec="1086498882" usec="0"/>
    <to sec="1086498896" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.691112,1.45655,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="tcp" src_ip="77.141.40.226" src_port="1031"/>
      <filter dst_port="137" proto="udp" src_ip="77.141.40.226" src_port="1031"/>
      <filter dst_port="53" proto="tcp" src_ip="77.141.40.226" src_port="1031"/>
      <filter dst_port="53" proto="udp" src_ip="77.141.40.226" src_port="1031"/>
      <filter dst_port="137" proto="tcp" src_ip="77.141.40.226" src_port="1026"/>
      <filter dst_port="137" proto="udp" src_ip="77.141.40.226" src_port="1026"/>
      <filter dst_port="53" proto="tcp" src_ip="77.141.40.226" src_port="1026"/>
      <filter dst_port="53" proto="udp" src_ip="77.141.40.226" src_port="1026"/>
      <from sec="1086498297" usec="0"/>
      <to sec="1086498319" usec="0"/>
    </slice>
    <from sec="1086498297" usec="0"/>
    <to sec="1086498319" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.691112,1.45655,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="213.171.50.14" src_port="80"/>
      <filter dst_port="5554" proto="tcp" src_ip="213.171.50.14" src_port="80"/>
      <from sec="1086498474" usec="0"/>
      <to sec="1086498476" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="212.3.122.14" src_port="80"/>
      <filter dst_port="5554" proto="tcp" src_ip="212.3.122.14" src_port="80"/>
      <from sec="1086498472" usec="0"/>
      <to sec="1086498477" usec="0"/>
    </slice>
    <from sec="1086498472" usec="0"/>
    <to sec="1086498478" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.691112,1.45655,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="167.210.83.22" src_port="53"/>
      <filter dst_port="9898" proto="udp" src_ip="167.210.83.22" src_port="53"/>
      <filter dst_port="3127" proto="tcp" src_ip="167.210.83.22" src_port="53"/>
      <filter dst_port="3127" proto="udp" src_ip="167.210.83.22" src_port="53"/>
      <from sec="1086498330" usec="0"/>
      <to sec="1086498334" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="196.58.183.22" src_port="53"/>
      <filter dst_port="9898" proto="udp" src_ip="196.58.183.22" src_port="53"/>
      <filter dst_port="3127" proto="tcp" src_ip="196.58.183.22" src_port="53"/>
      <filter dst_port="3127" proto="udp" src_ip="196.58.183.22" src_port="53"/>
      <from sec="1086498330" usec="0"/>
      <to sec="1086498335" usec="0"/>
    </slice>
    <from sec="1086498330" usec="0"/>
    <to sec="1086498335" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.691112,1.45655,001,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="77.159.4.94"/>
      <filter dst_port="5554" proto="tcp" src_ip="77.159.4.94"/>
      <from sec="1086498852" usec="0"/>
      <to sec="1086498880" usec="0"/>
    </slice>
    <from sec="1086498852" usec="0"/>
    <to sec="1086498880" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.691112,1.45655,503,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="208.166.155.150" dst_port="80" proto="tcp" src_ip="196.48.141.136" src_port="1824"/>
      <filter dst_ip="208.166.155.150" dst_port="80" proto="udp" src_ip="196.48.141.136" src_port="1824"/>
      <filter dst_ip="208.166.155.150" dst_port="445" proto="tcp" src_ip="196.48.141.136" src_port="1824"/>
      <filter dst_ip="208.166.155.150" dst_port="445" proto="udp" src_ip="196.48.141.136" src_port="1824"/>
      <filter dst_ip="208.166.155.150" dst_port="9898" proto="tcp" src_ip="196.48.141.136" src_port="1824"/>
      <filter dst_ip="208.166.155.150" dst_port="9898" proto="udp" src_ip="196.48.141.136" src_port="1824"/>
      <filter dst_ip="208.166.155.150" dst_port="135" proto="tcp" src_ip="196.48.141.136" src_port="1824"/>
      <filter dst_ip="208.166.155.150" dst_port="135" proto="udp" src_ip="196.48.141.136" src_port="1824"/>
      <filter dst_ip="208.166.155.150" dst_port="80" proto="tcp" src_ip="196.48.141.136" src_port="1822"/>
      <filter dst_ip="208.166.155.150" dst_port="80" proto="udp" src_ip="196.48.141.136" src_port="1822"/>
      <filter dst_ip="208.166.155.150" dst_port="445" proto="tcp" src_ip="196.48.141.136" src_port="1822"/>
      <filter dst_ip="208.166.155.150" dst_port="445" proto="udp" src_ip="196.48.141.136" src_port="1822"/>
      <filter dst_ip="208.166.155.150" dst_port="9898" proto="tcp" src_ip="196.48.141.136" src_port="1822"/>
      <filter dst_ip="208.166.155.150" dst_port="9898" proto="udp" src_ip="196.48.141.136" src_port="1822"/>
      <filter dst_ip="208.166.155.150" dst_port="135" proto="tcp" src_ip="196.48.141.136" src_port="1822"/>
      <filter dst_ip="208.166.155.150" dst_port="135" proto="udp" src_ip="196.48.141.136" src_port="1822"/>
      <from sec="1086498890" usec="0"/>
      <to sec="1086498894" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="208.166.155.150" dst_port="80" proto="tcp" src_ip="214.149.104.125" src_port="1824"/>
      <filter dst_ip="208.166.155.150" dst_port="80" proto="udp" src_ip="214.149.104.125" src_port="1824"/>
      <filter dst_ip="208.166.155.150" dst_port="445" proto="tcp" src_ip="214.149.104.125" src_port="1824"/>
      <filter dst_ip="208.166.155.150" dst_port="445" proto="udp" src_ip="214.149.104.125" src_port="1824"/>
      <filter dst_ip="208.166.155.150" dst_port="9898" proto="tcp" src_ip="214.149.104.125" src_port="1824"/>
      <filter dst_ip="208.166.155.150" dst_port="9898" proto="udp" src_ip="214.149.104.125" src_port="1824"/>
      <filter dst_ip="208.166.155.150" dst_port="135" proto="tcp" src_ip="214.149.104.125" src_port="1824"/>
      <filter dst_ip="208.166.155.150" dst_port="135" proto="udp" src_ip="214.149.104.125" src_port="1824"/>
      <filter dst_ip="208.166.155.150" dst_port="80" proto="tcp" src_ip="214.149.104.125" src_port="1822"/>
      <filter dst_ip="208.166.155.150" dst_port="80" proto="udp" src_ip="214.149.104.125" src_port="1822"/>
      <filter dst_ip="208.166.155.150" dst_port="445" proto="tcp" src_ip="214.149.104.125" src_port="1822"/>
      <filter dst_ip="208.166.155.150" dst_port="445" proto="udp" src_ip="214.149.104.125" src_port="1822"/>
      <filter dst_ip="208.166.155.150" dst_port="9898" proto="tcp" src_ip="214.149.104.125" src_port="1822"/>
      <filter dst_ip="208.166.155.150" dst_port="9898" proto="udp" src_ip="214.149.104.125" src_port="1822"/>
      <filter dst_ip="208.166.155.150" dst_port="135" proto="tcp" src_ip="214.149.104.125" src_port="1822"/>
      <filter dst_ip="208.166.155.150" dst_port="135" proto="udp" src_ip="214.149.104.125" src_port="1822"/>
      <from sec="1086498893" usec="0"/>
      <to sec="1086498895" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="208.166.155.150" dst_port="80" proto="tcp" src_ip="10.141.20.120" src_port="1824"/>
      <filter dst_ip="208.166.155.150" dst_port="80" proto="udp" src_ip="10.141.20.120" src_port="1824"/>
      <filter dst_ip="208.166.155.150" dst_port="445" proto="tcp" src_ip="10.141.20.120" src_port="1824"/>
      <filter dst_ip="208.166.155.150" dst_port="445" proto="udp" src_ip="10.141.20.120" src_port="1824"/>
      <filter dst_ip="208.166.155.150" dst_port="9898" proto="tcp" src_ip="10.141.20.120" src_port="1824"/>
      <filter dst_ip="208.166.155.150" dst_port="9898" proto="udp" src_ip="10.141.20.120" src_port="1824"/>
      <filter dst_ip="208.166.155.150" dst_port="135" proto="tcp" src_ip="10.141.20.120" src_port="1824"/>
      <filter dst_ip="208.166.155.150" dst_port="135" proto="udp" src_ip="10.141.20.120" src_port="1824"/>
      <filter dst_ip="208.166.155.150" dst_port="80" proto="tcp" src_ip="10.141.20.120" src_port="1822"/>
      <filter dst_ip="208.166.155.150" dst_port="80" proto="udp" src_ip="10.141.20.120" src_port="1822"/>
      <filter dst_ip="208.166.155.150" dst_port="445" proto="tcp" src_ip="10.141.20.120" src_port="1822"/>
      <filter dst_ip="208.166.155.150" dst_port="445" proto="udp" src_ip="10.141.20.120" src_port="1822"/>
      <filter dst_ip="208.166.155.150" dst_port="9898" proto="tcp" src_ip="10.141.20.120" src_port="1822"/>
      <filter dst_ip="208.166.155.150" dst_port="9898" proto="udp" src_ip="10.141.20.120" src_port="1822"/>
      <filter dst_ip="208.166.155.150" dst_port="135" proto="tcp" src_ip="10.141.20.120" src_port="1822"/>
      <filter dst_ip="208.166.155.150" dst_port="135" proto="udp" src_ip="10.141.20.120" src_port="1822"/>
      <from sec="1086498892" usec="0"/>
      <to sec="1086498894" usec="0"/>
    </slice>
    <from sec="1086498890" usec="0"/>
    <to sec="1086498895" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.691112,1.45655,001,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="77.128.97.90" proto="tcp" src_port="5554"/>
      <filter dst_ip="77.128.97.90" proto="tcp" src_port="5554"/>
      <filter dst_ip="77.128.97.90" proto="tcp" src_port="5554"/>
      <filter dst_ip="77.128.97.90" proto="tcp" src_port="5554"/>
      <filter dst_ip="77.128.97.90" proto="tcp" src_port="9898"/>
      <filter dst_ip="77.128.97.90" proto="tcp" src_port="9898"/>
      <filter dst_ip="77.128.97.90" proto="tcp" src_port="9898"/>
      <filter dst_ip="77.128.97.90" proto="tcp" src_port="9898"/>
      <from sec="1086498326" usec="0"/>
      <to sec="1086498328" usec="0"/>
    </slice>
    <from sec="1086498326" usec="0"/>
    <to sec="1086498329" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.691112,1.45655,001,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="210.185.209.250" proto="tcp" src_port="5554"/>
      <filter dst_ip="210.185.209.250" proto="tcp" src_port="5554"/>
      <filter dst_ip="210.185.209.250" proto="tcp" src_port="5554"/>
      <filter dst_ip="210.185.209.250" proto="tcp" src_port="5554"/>
      <from sec="1086498649" usec="0"/>
      <to sec="1086498650" usec="0"/>
    </slice>
    <from sec="1086498647" usec="0"/>
    <to sec="1086498650" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.691112,1.45655,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="210.74.132.76" proto="tcp"/>
      <filter dst_ip="210.74.132.76" proto="icmp"/>
      <filter dst_ip="210.74.132.76" proto="tcp"/>
      <filter dst_ip="210.74.132.76" proto="icmp"/>
      <filter dst_ip="210.74.132.76" proto="tcp"/>
      <filter dst_ip="210.74.132.76" proto="icmp"/>
      <filter dst_ip="210.74.132.76" proto="tcp"/>
      <filter dst_ip="210.74.132.76" proto="icmp"/>
      <from sec="1086498694" usec="0"/>
      <to sec="1086498714" usec="0"/>
    </slice>
    <from sec="1086498694" usec="0"/>
    <to sec="1086498714" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.691112,1.45655,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="200.103.70.84" proto="icmp"/>
      <filter dst_ip="200.103.70.84" proto="icmp"/>
      <filter dst_ip="200.103.70.84" proto="icmp"/>
      <filter dst_ip="200.103.70.84" proto="icmp"/>
      <from sec="1086498543" usec="0"/>
      <to sec="1086498549" usec="0"/>
    </slice>
    <from sec="1086498543" usec="0"/>
    <to sec="1086498549" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.819481,1.42776,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_20{
style=filled;
color=gray75;
34[label="196.198.45.7s;256pkt 256fpkt", shape=rectangle, color=red];
372[label="196.198.45.7s;187pkt 187fpkt", shape=ellipse, color=green];
stat20[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.198.45.7:1031, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1031: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
34--372[label="1;187pkt 187fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="196.198.45.7" src_port="1031"/>
    </slice>
    <from sec="1086498387" usec="0"/>
    <to sec="1086498402" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.720944,1.46812,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="173.76.151.181" dst_port="5554" proto="tcp" src_ip="208.79.32.42" src_port="80"/>
      <filter dst_ip="173.76.151.181" dst_port="9898" proto="tcp" src_ip="208.79.32.42" src_port="80"/>
      <from sec="1086498421" usec="0"/>
      <to sec="1086498425" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="173.76.151.181" dst_port="5554" proto="tcp" src_ip="196.176.68.42" src_port="80"/>
      <filter dst_ip="173.76.151.181" dst_port="9898" proto="tcp" src_ip="196.176.68.42" src_port="80"/>
      <from sec="1086498418" usec="0"/>
      <to sec="1086498420" usec="0"/>
    </slice>
    <from sec="1086498418" usec="0"/>
    <to sec="1086498427" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.720944,1.46812,002,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="3.160.98.99" src_port="1028"/>
      <from sec="1086498869" usec="0"/>
      <to sec="1086498875" usec="0"/>
    </slice>
    <from sec="1086498869" usec="0"/>
    <to sec="1086498875" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.781287,1.37819,002,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_32{
style=filled;
color=gray75;
60[label="77.143.166.120s;224pkt 224fpkt", shape=rectangle, color=red];
388[label="77.143.166.120s;212pkt 212fpkt", shape=ellipse, color=green];
2830[label="77.143.166.120;254pkt 254fpkt", shape=pentagon, color=darkviolet];
stat32[shape=component, label=&lt;Rules:&lt;BR/&gt;{77.143.166.120:11281, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 11281: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
60--388[label="1;212pkt 212fpkt"];
60--2830[label="1;224pkt 224fpkt"];
388--2830[label="1;212pkt 212fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="77.143.166.120" src_port="11281"/>
    </slice>
    <from sec="1086498491" usec="0"/>
    <to sec="1086498507" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.819481,1.42776,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_34{
style=filled;
color=gray75;
63[label="208.100.61.130s;171pkt 171fpkt", shape=rectangle, color=red];
391[label="208.100.61.130s;74pkt 74fpkt", shape=ellipse, color=green];
stat34[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.100.61.130:1039, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1039: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
63--391[label="1;74pkt 74fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="208.100.61.130" src_port="1039"/>
    </slice>
    <from sec="1086498069" usec="0"/>
    <to sec="1086498084" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.781287,1.37819,002,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_35{
style=filled;
color=gray75;
66[label="215.86.34.151s;256pkt 256fpkt", shape=rectangle, color=red];
393[label="215.86.34.151s;193pkt 193fpkt", shape=ellipse, color=green];
2917[label="215.86.34.151;256pkt 256fpkt", shape=pentagon, color=darkviolet];
stat35[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.86.34.151:1024, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1024: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
66--393[label="1;193pkt 193fpkt"];
66--1221[label="0.008;1pkt 1fpkt"];
66--2169[label="0.00819672;1pkt 1fpkt"];
66--2917[label="1;256pkt 256fpkt"];
393--1221[label="0.008;1pkt 1fpkt"];
393--2169[label="0.00819672;1pkt 1fpkt"];
393--2917[label="1;193pkt 193fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="215.86.34.151" src_port="1024"/>
    </slice>
    <from sec="1086498345" usec="0"/>
    <to sec="1086498359" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.720944,1.46812,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="196.58.181.202" dst_port="9898" proto="tcp" src_ip="213.171.50.14" src_port="80"/>
      <filter dst_ip="196.58.181.202" dst_port="5554" proto="tcp" src_ip="213.171.50.14" src_port="80"/>
      <from sec="1086498474" usec="0"/>
      <to sec="1086498476" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="196.58.181.202" dst_port="9898" proto="tcp" src_ip="212.3.122.14" src_port="80"/>
      <filter dst_ip="196.58.181.202" dst_port="5554" proto="tcp" src_ip="212.3.122.14" src_port="80"/>
      <from sec="1086498472" usec="0"/>
      <to sec="1086498477" usec="0"/>
    </slice>
    <from sec="1086498472" usec="0"/>
    <to sec="1086498477" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.720944,1.46812,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="167.210.83.22" src_port="53"/>
      <filter dst_port="9898" proto="udp" src_ip="167.210.83.22" src_port="53"/>
      <filter dst_port="3127" proto="tcp" src_ip="167.210.83.22" src_port="53"/>
      <filter dst_port="3127" proto="udp" src_ip="167.210.83.22" src_port="53"/>
      <from sec="1086498330" usec="0"/>
      <to sec="1086498334" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="196.58.183.22" src_port="53"/>
      <filter dst_port="9898" proto="udp" src_ip="196.58.183.22" src_port="53"/>
      <filter dst_port="3127" proto="tcp" src_ip="196.58.183.22" src_port="53"/>
      <filter dst_port="3127" proto="udp" src_ip="196.58.183.22" src_port="53"/>
      <from sec="1086498330" usec="0"/>
      <to sec="1086498335" usec="0"/>
    </slice>
    <from sec="1086498330" usec="0"/>
    <to sec="1086498335" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.819481,1.42776,001,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_106{
style=filled;
color=gray75;
176[label="77.186.80.72s;91pkt 91fpkt", shape=rectangle, color=red];
489[label="77.186.80.72s;91pkt 91fpkt", shape=ellipse, color=green];
stat106[shape=component, label=&lt;Rules:&lt;BR/&gt;{77.186.80.72:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 3822: (0.549451%)&lt;BR/&gt; 3755: (0.549451%)&lt;BR/&gt; 3753: (0.549451%)&lt;BR/&gt; 3740: (0.549451%)&gt;];
}
176--489[label="1;91pkt 91fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="77.186.80.72"/>
    </slice>
    <from sec="1086498016" usec="0"/>
    <to sec="1086498020" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.781287,1.37819,001,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_116{
style=filled;
color=gray75;
193[label="214.66.210.94s;191pkt 191fpkt", shape=rectangle, color=red];
504[label="214.66.210.94s;191pkt 191fpkt", shape=ellipse, color=green];
2759[label="214.66.210.94;314pkt 314fpkt", shape=pentagon, color=darkviolet];
stat116[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.66.210.94:*, *:5554}[53.5032%]&lt;BR/&gt;{214.66.210.94:*, *:9898}[46.4968%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (30.1724%)&lt;BR/&gt; 9898: (19.8276%)&lt;BR/&gt; 3809: (0.215517%)&lt;BR/&gt; 3808: (0.215517%)&lt;BR/&gt; 3807: (0.215517%)&gt;];
}
193--504[label="1;191pkt 191fpkt"];
193--2759[label="1;191pkt 191fpkt"];
504--2759[label="1;191pkt 191fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="214.66.210.94"/>
      <filter dst_port="9898" src_ip="214.66.210.94"/>
    </slice>
    <from sec="1086498873" usec="0"/>
    <to sec="1086498887" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.819481,1.42776,001,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_120{
style=filled;
color=gray75;
198[label="208.133.22.103s;237pkt 237fpkt", shape=rectangle, color=red];
509[label="208.133.22.103s;237pkt 237fpkt", shape=ellipse, color=green];
stat120[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.133.22.103:*, *:5554}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (50%)&lt;BR/&gt; 2032: (0.21097%)&lt;BR/&gt; 2031: (0.21097%)&lt;BR/&gt; 2029: (0.21097%)&lt;BR/&gt; 2024: (0.21097%)&gt;];
}
198--509[label="1;237pkt 237fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="208.133.22.103"/>
    </slice>
    <from sec="1086498354" usec="0"/>
    <to sec="1086498358" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.855191,1.36538,001,1 1 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_127{
style=filled;
color=gray75;
208[label="214.208.0.115s;252pkt 252fpkt", shape=rectangle, color=red];
518[label="214.208.0.115s;252pkt 252fpkt", shape=ellipse, color=green];
2813[label="214.208.0.115;252pkt 252fpkt", shape=pentagon, color=darkviolet];
3422[label="214.208.0.115;251pkt 251fpkt", shape=invtriangle, color=brown];
stat127[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.208.0.115:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 1715: (0.19861%)&lt;BR/&gt; 1714: (0.19861%)&lt;BR/&gt; 1701: (0.19861%)&lt;BR/&gt; 1700: (0.19861%)&gt;];
}
208--518[label="1;252pkt 252fpkt"];
208--2813[label="1;252pkt 252fpkt"];
208--3422[label="1;251pkt 251fpkt"];
518--2813[label="1;252pkt 252fpkt"];
518--3422[label="1;251pkt 251fpkt"];
2813--3422[label="1;251pkt 251fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="214.208.0.115"/>
    </slice>
    <from sec="1086498120" usec="0"/>
    <to sec="1086498124" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.720944,1.46812,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="215.64.71.115" src_port="53"/>
      <filter dst_port="9898" proto="udp" src_ip="215.64.71.115" src_port="53"/>
      <filter dst_port="53" proto="tcp" src_ip="215.64.71.115" src_port="53"/>
      <filter dst_port="53" proto="udp" src_ip="215.64.71.115" src_port="53"/>
      <from sec="1086498215" usec="0"/>
      <to sec="1086498217" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="101.84.108.73" src_port="53"/>
      <filter dst_port="9898" proto="udp" src_ip="101.84.108.73" src_port="53"/>
      <filter dst_port="53" proto="tcp" src_ip="101.84.108.73" src_port="53"/>
      <filter dst_port="53" proto="udp" src_ip="101.84.108.73" src_port="53"/>
      <from sec="1086498212" usec="0"/>
      <to sec="1086498219" usec="0"/>
    </slice>
    <from sec="1086498212" usec="0"/>
    <to sec="1086498219" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.819481,1.42776,001,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_144{
style=filled;
color=gray75;
233[label="77.176.45.146s;372pkt 372fpkt", shape=rectangle, color=red];
542[label="77.176.45.146s;372pkt 372fpkt", shape=ellipse, color=green];
stat144[shape=component, label=&lt;Rules:&lt;BR/&gt;{77.176.45.146:*, *:5554}[50.2688%]&lt;BR/&gt;{77.176.45.146:*, *:9898}[49.7312%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (25.1344%)&lt;BR/&gt; 9898: (24.8656%)&lt;BR/&gt; 1976: (0.134409%)&lt;BR/&gt; 1932: (0.134409%)&lt;BR/&gt; 1931: (0.134409%)&gt;];
}
233--542[label="1;372pkt 372fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="77.176.45.146"/>
      <filter dst_port="9898" src_ip="77.176.45.146"/>
    </slice>
    <from sec="1086498230" usec="0"/>
    <to sec="1086498232" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.855191,1.36538,001,1 1 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_183{
style=filled;
color=gray75;
283[label="77.158.34.201s;186pkt 186fpkt", shape=rectangle, color=red];
588[label="77.158.34.201s;186pkt 186fpkt", shape=ellipse, color=green];
3051[label="77.158.34.201;186pkt 186fpkt", shape=pentagon, color=darkviolet];
3546[label="77.158.34.201;186pkt 186fpkt", shape=invtriangle, color=brown];
stat183[shape=component, label=&lt;Rules:&lt;BR/&gt;{77.158.34.201:*, *:5554}[59.6774%]&lt;BR/&gt;{77.158.34.201:*, *:9898}[40.3226%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (29.8387%)&lt;BR/&gt; 9898: (20.1613%)&lt;BR/&gt; 4988: (0.268817%)&lt;BR/&gt; 4987: (0.268817%)&lt;BR/&gt; 4983: (0.268817%)&gt;];
}
283--588[label="1;186pkt 186fpkt"];
283--3051[label="1;186pkt 186fpkt"];
283--3546[label="1;186pkt 186fpkt"];
588--3051[label="1;186pkt 186fpkt"];
588--3546[label="1;186pkt 186fpkt"];
3051--3546[label="1;186pkt 186fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="77.158.34.201"/>
      <filter dst_port="9898" src_ip="77.158.34.201"/>
    </slice>
    <from sec="1086498447" usec="0"/>
    <to sec="1086498450" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.855191,1.36538,001,1 1 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_187{
style=filled;
color=gray75;
287[label="77.176.234.207s;383pkt 383fpkt", shape=rectangle, color=red];
592[label="77.176.234.207s;383pkt 383fpkt", shape=ellipse, color=green];
3071[label="77.176.234.207;383pkt 383fpkt", shape=pentagon, color=darkviolet];
3556[label="77.176.234.207;383pkt 383fpkt", shape=invtriangle, color=brown];
stat187[shape=component, label=&lt;Rules:&lt;BR/&gt;{77.176.234.207:*, *:9898}[57.4413%]&lt;BR/&gt;{77.176.234.207:*, *:5554}[42.5587%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (28.7206%)&lt;BR/&gt; 5554: (21.2794%)&lt;BR/&gt; 3658: (0.130548%)&lt;BR/&gt; 3636: (0.130548%)&lt;BR/&gt; 3633: (0.130548%)&gt;];
}
287--592[label="1;383pkt 383fpkt"];
287--3071[label="1;383pkt 383fpkt"];
287--3556[label="1;383pkt 383fpkt"];
592--3071[label="1;383pkt 383fpkt"];
592--3556[label="1;383pkt 383fpkt"];
3071--3556[label="1;383pkt 383fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="77.176.234.207"/>
      <filter dst_port="5554" src_ip="77.176.234.207"/>
    </slice>
    <from sec="1086498680" usec="0"/>
    <to sec="1086498685" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.853401,1.39157,010,1 1 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_188{
style=filled;
color=gray75;
288[label="4.82.152.210s;9817pkt 9817fpkt", shape=rectangle, color=red];
593[label="4.82.152.210s;9717pkt 9717fpkt", shape=ellipse, color=green];
1075[label="4.82.152.210;s;9117pkt 9117fpkt", shape=diamond, color=yellow];
stat188[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.82.152.210:*, *:135}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 3145: (0.0296674%)&lt;BR/&gt; 3077: (0.0296674%)&lt;BR/&gt; 3009: (0.0296674%)&lt;BR/&gt; 3008: (0.0296674%)&gt;];
}
288--593[label="1;9717pkt 9717fpkt"];
288--1075[label="0.995613;9077pkt 9077fpkt"];
288--1524[label="0.00236407;1pkt 1fpkt"];
288--2276[label="0.00262467;1pkt 1fpkt"];
593--1075[label="0.984644;8977pkt 8977fpkt"];
593--1524[label="0.00236407;1pkt 1fpkt"];
593--2276[label="0.00262467;1pkt 1fpkt"];
1075--1524[label="0.00236407;1pkt 1fpkt"];
1075--2276[label="0.00262467;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="4.82.152.210"/>
    </slice>
    <from sec="1086498001" usec="0"/>
    <to sec="1086498896" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.819481,1.42776,001,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_220{
style=filled;
color=gray75;
328[label="214.217.5.29d;375pkt 375fpkt", shape=rectangle, color=red];
633[label="214.217.5.29d;375pkt 375fpkt", shape=ellipse, color=green];
stat220[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:9898, 214.217.5.29:*}[52.5333%]&lt;BR/&gt;{*:5554, 214.217.5.29:*}[47.4667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (26.2667%)&lt;BR/&gt; 5554: (23.7333%)&lt;BR/&gt; 4687: (0.133333%)&lt;BR/&gt; 4682: (0.133333%)&lt;BR/&gt; 4680: (0.133333%)&gt;];
}
328--633[label="1;375pkt 375fpkt"];
</description>
    <slice>
      <filter dst_ip="214.217.5.29" src_port="9898"/>
      <filter dst_ip="214.217.5.29" src_port="5554"/>
    </slice>
    <from sec="1086498230" usec="0"/>
    <to sec="1086498235" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.819481,1.42776,001,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_223{
style=filled;
color=gray75;
331[label="208.69.111.76d;446pkt 446fpkt", shape=rectangle, color=red];
636[label="208.69.111.76d;446pkt 446fpkt", shape=ellipse, color=green];
stat223[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:5554, 208.69.111.76:*}[53.5874%]&lt;BR/&gt;{*:9898, 208.69.111.76:*}[46.4126%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (26.7937%)&lt;BR/&gt; 9898: (23.2063%)&lt;BR/&gt; 4877: (0.112108%)&lt;BR/&gt; 4876: (0.112108%)&lt;BR/&gt; 4864: (0.112108%)&gt;];
}
331--636[label="1;446pkt 446fpkt"];
</description>
    <slice>
      <filter dst_ip="208.69.111.76" src_port="5554"/>
      <filter dst_ip="208.69.111.76" src_port="9898"/>
    </slice>
    <from sec="1086498363" usec="0"/>
    <to sec="1086498372" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.819481,1.42776,001,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_225{
style=filled;
color=gray75;
334[label="77.87.70.94d;208pkt 208fpkt", shape=rectangle, color=red];
638[label="77.87.70.94d;208pkt 208fpkt", shape=ellipse, color=green];
stat225[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:9898, 77.87.70.94:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 3166: (0.240385%)&lt;BR/&gt; 3165: (0.240385%)&lt;BR/&gt; 3164: (0.240385%)&lt;BR/&gt; 3163: (0.240385%)&gt;];
}
334--638[label="1;208pkt 208fpkt"];
</description>
    <slice>
      <filter dst_ip="77.87.70.94" src_port="9898"/>
    </slice>
    <from sec="1086498594" usec="0"/>
    <to sec="1086498599" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.819481,1.42776,999,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_231{
style=filled;
color=gray75;
341[label="208.90.6.48d;13pkt 13fpkt", shape=rectangle, color=red];
644[label="208.90.6.48d;13pkt 13fpkt", shape=ellipse, color=green];
stat231[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.83.224.198:*, 196.48.138.48:53}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (50%)&lt;BR/&gt; 60401: (3.84615%)&lt;BR/&gt; 55666: (3.84615%)&lt;BR/&gt; 50837: (3.84615%)&lt;BR/&gt; 49759: (3.84615%)&gt;];
}
341--644[label="1;13pkt 13fpkt"];
</description>
    <slice>
      <filter dst_ip="196.48.138.48" dst_port="53" src_ip="217.83.224.198"/>
    </slice>
    <from sec="1086498339" usec="0"/>
    <to sec="1086498345" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.819481,1.42776,020,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_232{
style=filled;
color=gray75;
343[label="208.100.61.130d;171pkt 171fpkt", shape=rectangle, color=red];
645[label="208.100.61.130d;74pkt 74fpkt", shape=ellipse, color=green];
stat232[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 208.100.61.130:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
343--645[label="1;74pkt 74fpkt"];
</description>
    <slice>
      <filter dst_ip="208.100.61.130"/>
    </slice>
    <from sec="1086498069" usec="0"/>
    <to sec="1086498084" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.819481,1.42776,020,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_235{
style=filled;
color=gray75;
347[label="116.182.17.135d;234pkt 234fpkt", shape=rectangle, color=red];
648[label="116.182.17.135d;234pkt 234fpkt", shape=ellipse, color=green];
stat235[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 116.182.17.135:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
347--648[label="1;234pkt 234fpkt"];
</description>
    <slice>
      <filter dst_ip="116.182.17.135"/>
    </slice>
    <from sec="1086498262" usec="0"/>
    <to sec="1086498275" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.746822,1.47618,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="200.33.147.201" dst_port="137" proto="tcp" src_ip="196.198.45.7" src_port="1031"/>
      <filter dst_ip="200.33.147.201" dst_port="137" proto="udp" src_ip="196.198.45.7" src_port="1031"/>
      <from sec="1086498387" usec="0"/>
      <to sec="1086498392" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="200.33.147.201" dst_port="137" proto="tcp" src_ip="214.199.45.7" src_port="1031"/>
      <filter dst_ip="200.33.147.201" dst_port="137" proto="udp" src_ip="214.199.45.7" src_port="1031"/>
      <from sec="1086498387" usec="0"/>
      <to sec="1086498391" usec="0"/>
    </slice>
    <from sec="1086498387" usec="0"/>
    <to sec="1086498392" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.746822,1.47618,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="173.76.151.181" dst_port="5554" proto="tcp" src_ip="208.79.32.42" src_port="80"/>
      <filter dst_ip="173.76.151.181" dst_port="9898" proto="tcp" src_ip="208.79.32.42" src_port="80"/>
      <from sec="1086498421" usec="0"/>
      <to sec="1086498424" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="173.76.151.181" dst_port="5554" proto="tcp" src_ip="196.176.68.42" src_port="80"/>
      <filter dst_ip="173.76.151.181" dst_port="9898" proto="tcp" src_ip="196.176.68.42" src_port="80"/>
      <from sec="1086498418" usec="0"/>
      <to sec="1086498420" usec="0"/>
    </slice>
    <from sec="1086498418" usec="0"/>
    <to sec="1086498424" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.746822,1.47618,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="167.210.83.22" src_port="53"/>
      <filter dst_port="9898" proto="udp" src_ip="167.210.83.22" src_port="53"/>
      <filter dst_port="3127" proto="tcp" src_ip="167.210.83.22" src_port="53"/>
      <filter dst_port="3127" proto="udp" src_ip="167.210.83.22" src_port="53"/>
      <from sec="1086498330" usec="0"/>
      <to sec="1086498334" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="196.58.183.22" src_port="53"/>
      <filter dst_port="9898" proto="udp" src_ip="196.58.183.22" src_port="53"/>
      <filter dst_port="3127" proto="tcp" src_ip="196.58.183.22" src_port="53"/>
      <filter dst_port="3127" proto="udp" src_ip="196.58.183.22" src_port="53"/>
      <from sec="1086498330" usec="0"/>
      <to sec="1086498335" usec="0"/>
    </slice>
    <from sec="1086498330" usec="0"/>
    <to sec="1086498335" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.746822,1.47618,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="5554" proto="tcp" src_ip="208.90.6.48" src_port="53"/>
      <filter dst_port="5554" proto="udp" src_ip="208.90.6.48" src_port="53"/>
      <filter dst_port="9898" proto="tcp" src_ip="208.90.6.48" src_port="53"/>
      <filter dst_port="9898" proto="udp" src_ip="208.90.6.48" src_port="53"/>
      <from sec="1086498342" usec="0"/>
      <to sec="1086498344" usec="0"/>
    </slice>
    <from sec="1086498339" usec="0"/>
    <to sec="1086498345" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.746822,1.47618,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="215.64.71.115" src_port="53"/>
      <filter dst_port="9898" proto="udp" src_ip="215.64.71.115" src_port="53"/>
      <filter dst_port="53" proto="tcp" src_ip="215.64.71.115" src_port="53"/>
      <filter dst_port="53" proto="udp" src_ip="215.64.71.115" src_port="53"/>
      <from sec="1086498215" usec="0"/>
      <to sec="1086498217" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="101.84.108.73" src_port="53"/>
      <filter dst_port="9898" proto="udp" src_ip="101.84.108.73" src_port="53"/>
      <filter dst_port="53" proto="tcp" src_ip="101.84.108.73" src_port="53"/>
      <filter dst_port="53" proto="udp" src_ip="101.84.108.73" src_port="53"/>
      <from sec="1086498212" usec="0"/>
      <to sec="1086498219" usec="0"/>
    </slice>
    <from sec="1086498212" usec="0"/>
    <to sec="1086498219" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_252{
style=filled;
color=gray75;
928[label="192.54.140.250;d;203pkt 203fpkt", shape=diamond, color=yellow];
931[label="176.77.31.214;s;203pkt 203fpkt", shape=diamond, color=yellow];
2044[label="176.77.31.214;s;192pkt 192fpkt", shape=hexagon, color=black];
stat252[shape=component, label=&lt;Rules:&lt;BR/&gt;{176.77.31.214:*, 192.54.140.250:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4750: (0.250836%)&lt;BR/&gt; 4617: (0.250836%)&lt;BR/&gt; 2494: (0.250836%)&lt;BR/&gt; 2493: (0.250836%)&gt;];
}
928--931[label="1;203pkt 203fpkt"];
928--2044[label="1;192pkt 192fpkt"];
931--2044[label="1;192pkt 192fpkt"];
</description>
    <slice>
      <filter dst_ip="192.54.140.250" dst_port="80" src_ip="176.77.31.214"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687923,1.37127,503,1 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_253{
style=filled;
color=gray75;
8[label="197.30.208.57s;1pkt 1fpkt", shape=rectangle, color=red];
936[label="197.30.208.57;s;2pkt 2fpkt", shape=diamond, color=yellow];
1407[label="192.219.24.172;d;1pkt 1fpkt", shape=diamond, color=yellow];
2635[label="197.30.208.57;41pkt 41fpkt", shape=pentagon, color=darkviolet];
stat253[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.30.208.57:*, 216.232.38.226:80}[41.4634%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.7778%)&lt;BR/&gt; 4818: (4.44444%)&lt;BR/&gt; 123: (4.44444%)&lt;BR/&gt; 1400: (1.11111%)&lt;BR/&gt; 1399: (1.11111%)&gt;];
}
8--936[label="1;1pkt 1fpkt"];
8--1407[label="1;1pkt 1fpkt"];
8--2635[label="1;1pkt 1fpkt"];
936--1407[label="1;1pkt 1fpkt"];
936--2635[label="1;2pkt 2fpkt"];
1407--2635[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="216.232.38.226" dst_port="80" src_ip="197.30.208.57"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.836585,1.41293,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_254{
style=filled;
color=gray75;
938[label="202.0.201.118;d;1pkt 1fpkt", shape=diamond, color=yellow];
941[label="153.130.4.138;s;21pkt 21fpkt", shape=diamond, color=yellow];
1884[label="213.52.66.200;d;1pkt 1fpkt", shape=diamond, color=yellow];
2885[label="153.130.4.138;21pkt 21fpkt", shape=pentagon, color=darkviolet];
3457[label="153.130.4.138;20pkt 20fpkt", shape=invtriangle, color=brown];
3790[label="153.130.4.138;21pkt 21fpkt", shape=invhouse, color=bisque];
stat254[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.130.4.138:39303, *:*}[76.1905%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 39303: (37.6471%)&lt;BR/&gt; 60931: (4.70588%)&lt;BR/&gt; 32563: (4.70588%)&lt;BR/&gt; 12420: (4.70588%)&lt;BR/&gt; 10336: (4.70588%)&gt;];
}
938--941[label="1;1pkt 1fpkt"];
938--2885[label="1;1pkt 1fpkt"];
938--3457[label="1;1pkt 1fpkt"];
938--3790[label="1;1pkt 1fpkt"];
941--1884[label="1;1pkt 1fpkt"];
941--2885[label="1;21pkt 21fpkt"];
941--3457[label="1;20pkt 20fpkt"];
941--3790[label="1;21pkt 21fpkt"];
1884--2885[label="1;1pkt 1fpkt"];
1884--3457[label="1;1pkt 1fpkt"];
1884--3790[label="1;1pkt 1fpkt"];
2885--3457[label="1;20pkt 20fpkt"];
2885--3790[label="1;21pkt 21fpkt"];
3457--3790[label="1;20pkt 20fpkt"];
</description>
    <slice>
      <filter src_ip="153.130.4.138" src_port="39303"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_256{
style=filled;
color=gray75;
947[label="6.16.150.156;d;1pkt 1fpkt", shape=diamond, color=yellow];
948[label="173.76.150.10;s;4pkt 4fpkt", shape=diamond, color=yellow];
2134[label="6.16.150.156;d;1pkt 1fpkt", shape=hexagon, color=black];
stat256[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.76.150.10:4469, 193.52.3.118:1863}[25%]&lt;BR/&gt;{173.76.150.10:3914, 6.16.150.156:8372}[25%]&lt;BR/&gt;{173.76.150.10:4696, 193.52.3.181:1863}[25%]&lt;BR/&gt;{173.76.150.10:3937, 7.105.236.241:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8372: (25%)&lt;BR/&gt; 3914: (25%)&lt;BR/&gt; 1863: (16.6667%)&lt;BR/&gt; 4696: (8.33333%)&lt;BR/&gt; 4469: (8.33333%)&gt;];
}
947--948[label="1;1pkt 1fpkt"];
947--2134[label="1;1pkt 1fpkt"];
948--2134[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="7.105.236.241" dst_port="80" src_ip="173.76.150.10" src_port="3937"/>
      <filter dst_ip="193.52.3.181" dst_port="1863" src_ip="173.76.150.10" src_port="4696"/>
      <filter dst_ip="6.16.150.156" dst_port="8372" src_ip="173.76.150.10" src_port="3914"/>
      <filter dst_ip="193.52.3.118" dst_port="1863" src_ip="173.76.150.10" src_port="4469"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.91153,1.43007,999,0 0 0 1 1 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_257{
style=filled;
color=gray75;
952[label="196.204.234.72;s;1pkt 1fpkt", shape=diamond, color=yellow];
953[label="173.76.13.159;d;6pkt 6fpkt", shape=diamond, color=yellow];
2136[label="173.76.13.159;d;6pkt 6fpkt", shape=hexagon, color=black];
2701[label="196.204.234.72;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3735[label="193.52.4.79;1pkt 1fpkt", shape=invhouse, color=bisque];
stat257[shape=component, label=&lt;Rules:&lt;BR/&gt;{78.73.60.43:80, 173.76.13.159:*}[33.3333%]&lt;BR/&gt;{*:1863, 173.76.13.159:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1863: (16.6667%)&lt;BR/&gt; 1995: (13.3333%)&lt;BR/&gt; 1273: (13.3333%)&lt;BR/&gt; 80: (13.3333%)&lt;BR/&gt; 1201: (10%)&gt;];
}
952--953[label="1;1pkt 1fpkt"];
952--2136[label="1;1pkt 1fpkt"];
952--2701[label="1;1pkt 1fpkt"];
953--2136[label="1;6pkt 6fpkt"];
953--2701[label="1;1pkt 1fpkt"];
953--3735[label="1;1pkt 1fpkt"];
2136--2701[label="1;1pkt 1fpkt"];
2136--3735[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="173.76.13.159" src_port="1863"/>
      <filter dst_ip="173.76.13.159" src_ip="78.73.60.43" src_port="80"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498818" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.566965,1.41324,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_258{
style=filled;
color=gray75;
951[label="196.204.234.72;d;1pkt 1fpkt", shape=diamond, color=yellow];
954[label="173.76.13.159;s;6pkt 6fpkt", shape=diamond, color=yellow];
2936[label="173.76.13.159;7pkt 7fpkt", shape=pentagon, color=darkviolet];
stat258[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.76.13.159:*, 78.73.60.43:80}[28.5714%]&lt;BR/&gt;{173.76.13.159:*, 5.166.28.108:443}[28.5714%]&lt;BR/&gt;{173.76.13.159:*, *:1863}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1863: (14.2857%)&lt;BR/&gt; 80: (14.2857%)&lt;BR/&gt; 1995: (10.7143%)&lt;BR/&gt; 1273: (10.7143%)&lt;BR/&gt; 443: (10.7143%)&gt;];
}
951--954[label="1;1pkt 1fpkt"];
951--2936[label="1;1pkt 1fpkt"];
954--2936[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_port="1863" src_ip="173.76.13.159"/>
      <filter dst_ip="5.166.28.108" dst_port="443" src_ip="173.76.13.159"/>
      <filter dst_ip="78.73.60.43" dst_port="80" src_ip="173.76.13.159"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498861" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_259{
style=filled;
color=gray75;
977[label="213.73.142.52;d;1pkt 1fpkt", shape=diamond, color=yellow];
978[label="153.130.4.206;s;2pkt 2fpkt", shape=diamond, color=yellow];
stat259[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.130.4.206:1532, 193.52.2.10:1863}[50%]&lt;BR/&gt;{153.130.4.206:1727, 213.73.142.52:1755}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1755: (33.3333%)&lt;BR/&gt; 1727: (33.3333%)&lt;BR/&gt; 1863: (16.6667%)&lt;BR/&gt; 1532: (16.6667%)&gt;];
}
977--978[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="213.73.142.52" dst_port="1755" src_ip="153.130.4.206" src_port="1727"/>
      <filter dst_ip="193.52.2.10" dst_port="1863" src_ip="153.130.4.206" src_port="1532"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_260{
style=filled;
color=gray75;
982[label="212.81.60.118;d;1pkt 1fpkt", shape=diamond, color=yellow];
984[label="176.77.246.115;s;1pkt 1fpkt", shape=diamond, color=yellow];
2207[label="212.81.60.118;d;1pkt 1fpkt", shape=hexagon, color=black];
stat260[shape=component, label=&lt;Rules:&lt;BR/&gt;{176.77.246.115:4614, 212.81.60.118:20106}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 20106: (50%)&lt;BR/&gt; 4614: (50%)&gt;];
}
982--984[label="1;1pkt 1fpkt"];
982--2207[label="1;1pkt 1fpkt"];
984--2207[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="212.81.60.118" dst_port="20106" src_ip="176.77.246.115" src_port="4614"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498796" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757235,1.41804,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_261{
style=filled;
color=gray75;
991[label="214.128.216.197;s;1pkt 1fpkt", shape=diamond, color=yellow];
992[label="197.30.197.92;d;23pkt 23fpkt", shape=diamond, color=yellow];
1009[label="165.218.144.20;s;11pkt 11fpkt", shape=diamond, color=yellow];
1978[label="214.128.216.197;s;1pkt 1fpkt", shape=hexagon, color=black];
2794[label="218.218.146.107;5pkt 5fpkt", shape=pentagon, color=darkviolet];
stat261[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.218.144.20:*, 197.30.197.92:80}[45.8333%]&lt;BR/&gt;{*:*, 197.30.197.92:1755}[29.1667%]&lt;BR/&gt;{*:*, 197.30.197.92:554}[20.8333%]&lt;BR/&gt;{218.218.146.107:*, 197.30.197.92:*}[20.8333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (25.6098%)&lt;BR/&gt; 1755: (13.4146%)&lt;BR/&gt; 554: (8.53659%)&lt;BR/&gt; 0: (4.87805%)&lt;BR/&gt; 1175: (3.65854%)&gt;];
}
991--992[label="1;1pkt 1fpkt"];
991--1978[label="1;1pkt 1fpkt"];
992--1009[label="0.909091;10pkt 10fpkt"];
992--1978[label="1;1pkt 1fpkt"];
992--2794[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="197.30.197.92" src_ip="218.218.146.107"/>
      <filter dst_ip="197.30.197.92" dst_port="1755"/>
      <filter dst_ip="197.30.197.92" dst_port="554"/>
      <filter dst_ip="197.30.197.92" dst_port="80" src_ip="165.218.144.20"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.566965,1.41324,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_262{
style=filled;
color=gray75;
990[label="214.128.216.197;d;1pkt 1fpkt", shape=diamond, color=yellow];
993[label="197.30.197.92;s;1846pkt 1846fpkt", shape=diamond, color=yellow];
1008[label="165.218.144.20;d;11pkt 11fpkt", shape=diamond, color=yellow];
1252[label="218.218.146.107;d;469pkt 469fpkt", shape=diamond, color=yellow];
1596[label="209.209.65.150;d;1357pkt 1357fpkt", shape=diamond, color=yellow];
1928[label="101.133.223.254;d;362pkt 362fpkt", shape=diamond, color=yellow];
2755[label="197.30.197.92;3073pkt 3073fpkt", shape=pentagon, color=darkviolet];
stat262[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.30.197.92:*, 209.209.65.150:*}[44.1588%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (16.3225%)&lt;BR/&gt; 445: (8.28768%)&lt;BR/&gt; 53: (2.45821%)&lt;BR/&gt; 25: (1.95954%)&lt;BR/&gt; 1027: (1.92443%)&gt;];
}
990--993[label="1;1pkt 1fpkt"];
990--2755[label="1;1pkt 1fpkt"];
993--1008[label="1;11pkt 11fpkt"];
993--1252[label="1;469pkt 469fpkt"];
993--1581[label="0.00136986;1pkt 1fpkt"];
993--1596[label="1;1357pkt 1357fpkt"];
993--2402[label="0.000820345;1pkt 1fpkt"];
993--2403[label="0.000541712;1pkt 1fpkt"];
993--2404[label="0.00199601;2pkt 2fpkt"];
993--2405[label="0.00308166;2pkt 2fpkt"];
993--2406[label="0.00108342;2pkt 2fpkt"];
993--2407[label="0.00092081;1pkt 1fpkt"];
993--2408[label="0.00308166;2pkt 2fpkt"];
993--2755[label="1;1846pkt 1846fpkt"];
1008--2755[label="1;11pkt 11fpkt"];
1252--2755[label="1;469pkt 469fpkt"];
1596--2402[label="0.000820345;1pkt 1fpkt"];
1596--2403[label="0.00073692;1pkt 1fpkt"];
1596--2404[label="0.00199601;2pkt 2fpkt"];
1596--2405[label="0.00308166;2pkt 2fpkt"];
1596--2406[label="0.00147384;2pkt 2fpkt"];
1596--2407[label="0.00092081;1pkt 1fpkt"];
1596--2408[label="0.00308166;2pkt 2fpkt"];
1596--2755[label="1;1357pkt 1357fpkt"];
1928--2755[label="1;362pkt 362fpkt"];
</description>
    <slice>
      <filter dst_ip="209.209.65.150" src_ip="197.30.197.92"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="214.213.117.14"/>
      <from sec="1086498000" usec="0"/>
      <to sec="1086498468" usec="0"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498468" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,002,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_264{
style=filled;
color=gray75;
998[label="197.30.201.69;d;806pkt 806fpkt", shape=diamond, color=yellow];
1000[label="199.109.127.37;s;729pkt 729fpkt", shape=diamond, color=yellow];
1712[label="198.96.29.241;s;75pkt 75fpkt", shape=diamond, color=yellow];
stat264[shape=component, label=&lt;Rules:&lt;BR/&gt;{199.109.127.37:*, 197.30.201.69:445}[45.4094%]&lt;BR/&gt;{199.109.127.37:*, 197.30.201.69:139}[45.0372%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (27.4224%)&lt;BR/&gt; 139: (22.5466%)&lt;BR/&gt; 4440: (0.124224%)&lt;BR/&gt; 4407: (0.124224%)&lt;BR/&gt; 4358: (0.124224%)&gt;];
}
998--1000[label="1;729pkt 729fpkt"];
998--1712[label="1;75pkt 75fpkt"];
998--1783[label="0.00124069;1pkt 1fpkt"];
998--2258[label="0.00124069;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="197.30.201.69" dst_port="445" src_ip="199.109.127.37"/>
      <filter dst_ip="197.30.201.69" dst_port="139" src_ip="199.109.127.37"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498822" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_265{
style=filled;
color=gray75;
1003[label="173.76.16.130;s;4pkt 4fpkt", shape=diamond, color=yellow];
1004[label="217.76.250.175;d;4pkt 4fpkt", shape=diamond, color=yellow];
stat265[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.76.16.130:1032, 217.76.250.175:60010}[25%]&lt;BR/&gt;{173.76.16.130:20005, 217.76.250.175:60058}[25%]&lt;BR/&gt;{173.76.16.130:20006, 217.76.250.175:60060}[25%]&lt;BR/&gt;{173.76.16.130:20007, 217.76.250.175:60059}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 60060: (12.5%)&lt;BR/&gt; 60059: (12.5%)&lt;BR/&gt; 60058: (12.5%)&lt;BR/&gt; 60010: (12.5%)&lt;BR/&gt; 20007: (12.5%)&gt;];
}
1003--1004[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="217.76.250.175" dst_port="60059" src_ip="173.76.16.130" src_port="20007"/>
      <filter dst_ip="217.76.250.175" dst_port="60060" src_ip="173.76.16.130" src_port="20006"/>
      <filter dst_ip="217.76.250.175" dst_port="60058" src_ip="173.76.16.130" src_port="20005"/>
      <filter dst_ip="217.76.250.175" dst_port="60010" src_ip="173.76.16.130" src_port="1032"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757235,1.41804,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_266{
style=filled;
color=gray75;
1002[label="173.76.16.130;d;4pkt 4fpkt", shape=diamond, color=yellow];
1005[label="217.76.250.175;s;4pkt 4fpkt", shape=diamond, color=yellow];
2143[label="173.76.16.130;d;4pkt 4fpkt", shape=hexagon, color=black];
2986[label="217.76.250.175;3pkt 3fpkt", shape=pentagon, color=darkviolet];
stat266[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.76.250.175:60010, 173.76.16.130:1032}[25%]&lt;BR/&gt;{217.76.250.175:60058, 173.76.16.130:20005}[25%]&lt;BR/&gt;{217.76.250.175:60059, 173.76.16.130:20007}[25%]&lt;BR/&gt;{217.76.250.175:60060, 173.76.16.130:20006}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 60060: (13.3333%)&lt;BR/&gt; 60058: (13.3333%)&lt;BR/&gt; 60010: (13.3333%)&lt;BR/&gt; 20006: (13.3333%)&lt;BR/&gt; 20005: (13.3333%)&gt;];
}
1002--1005[label="1;4pkt 4fpkt"];
1002--2143[label="1;4pkt 4fpkt"];
1002--2986[label="1;3pkt 3fpkt"];
1005--2143[label="1;4pkt 4fpkt"];
1005--2986[label="1;3pkt 3fpkt"];
2143--2986[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="173.76.16.130" dst_port="20006" src_ip="217.76.250.175" src_port="60060"/>
      <filter dst_ip="173.76.16.130" dst_port="20007" src_ip="217.76.250.175" src_port="60059"/>
      <filter dst_ip="173.76.16.130" dst_port="20005" src_ip="217.76.250.175" src_port="60058"/>
      <filter dst_ip="173.76.16.130" dst_port="1032" src_ip="217.76.250.175" src_port="60010"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_267{
style=filled;
color=gray75;
1013[label="66.65.242.49;d;137pkt 137fpkt", shape=diamond, color=yellow];
1014[label="66.65.242.49;s;153pkt 153fpkt", shape=diamond, color=yellow];
stat267[shape=component, label=&lt;Rules:&lt;BR/&gt;{66.65.242.49:13364, 66.65.242.49:*}[95.4248%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 13364: (47.931%)&lt;BR/&gt; 0: (2.75862%)&lt;BR/&gt; 13392: (1.03448%)&lt;BR/&gt; 80: (1.03448%)&lt;BR/&gt; 60637: (0.689655%)&gt;];
}
1013--1014[label="1;137pkt 137fpkt"];
</description>
    <slice>
      <filter dst_ip="66.65.242.49" src_ip="66.65.242.49" src_port="13364"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498738" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_268{
style=filled;
color=gray75;
1021[label="146.196.55.160;d;1pkt 1fpkt", shape=diamond, color=yellow];
1022[label="173.76.149.1;s;2pkt 2fpkt", shape=diamond, color=yellow];
2011[label="173.76.149.1;s;2pkt 2fpkt", shape=hexagon, color=black];
stat268[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.76.149.1:1441, 146.196.55.160:8002}[50%]&lt;BR/&gt;{173.76.149.1:1357, 193.52.2.168:1863}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8002: (30%)&lt;BR/&gt; 1441: (30%)&lt;BR/&gt; 1863: (20%)&lt;BR/&gt; 1357: (20%)&gt;];
}
1021--1022[label="1;1pkt 1fpkt"];
1021--2011[label="1;1pkt 1fpkt"];
1022--2011[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="193.52.2.168" dst_port="1863" src_ip="173.76.149.1" src_port="1357"/>
      <filter dst_ip="146.196.55.160" dst_port="8002" src_ip="173.76.149.1" src_port="1441"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_269{
style=filled;
color=gray75;
1027[label="197.11.36.171;d;1pkt 1fpkt", shape=diamond, color=yellow];
1028[label="173.76.27.108;s;31pkt 31fpkt", shape=diamond, color=yellow];
stat269[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.76.27.108:*, 77.168.162.241:6668}[77.4194%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6668: (37.5%)&lt;BR/&gt; 27015: (3.125%)&lt;BR/&gt; 27010: (3.125%)&lt;BR/&gt; 4786: (3.125%)&lt;BR/&gt; 1962: (3.125%)&gt;];
}
1027--1028[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="77.168.162.241" dst_port="6668" src_ip="173.76.27.108"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498738" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_270{
style=filled;
color=gray75;
1029[label="212.111.153.129;d;1pkt 1fpkt", shape=diamond, color=yellow];
1030[label="181.133.20.154;s;1pkt 1fpkt", shape=diamond, color=yellow];
2153[label="212.111.153.129;d;1pkt 1fpkt", shape=hexagon, color=black];
stat270[shape=component, label=&lt;Rules:&lt;BR/&gt;{181.133.20.154:49228, 212.111.153.129:8055}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 49228: (50%)&lt;BR/&gt; 8055: (50%)&gt;];
}
1029--1030[label="1;1pkt 1fpkt"];
1029--2153[label="1;1pkt 1fpkt"];
1030--2153[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="212.111.153.129" dst_port="8055" src_ip="181.133.20.154" src_port="49228"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498738" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_271{
style=filled;
color=gray75;
1032[label="77.185.2.80;d;6pkt 6fpkt", shape=diamond, color=yellow];
1033[label="196.52.84.45;s;7pkt 7fpkt", shape=diamond, color=yellow];
1946[label="196.52.84.45;s;7pkt 7fpkt", shape=hexagon, color=black];
2155[label="77.185.2.80;d;6pkt 6fpkt", shape=hexagon, color=black];
stat271[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.52.84.45:21, 77.185.2.80:*}[42.8571%]&lt;BR/&gt;{196.52.84.45:20, 77.185.2.80:*}[42.8571%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 20: (26.9231%)&lt;BR/&gt; 21: (23.0769%)&lt;BR/&gt; 3402: (7.69231%)&lt;BR/&gt; 3400: (7.69231%)&lt;BR/&gt; 3378: (7.69231%)&gt;];
}
1032--1033[label="1;6pkt 6fpkt"];
1032--1946[label="1;6pkt 6fpkt"];
1032--2155[label="1;6pkt 6fpkt"];
1033--1946[label="1;7pkt 7fpkt"];
1033--2155[label="1;6pkt 6fpkt"];
1946--2155[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="77.185.2.80" src_ip="196.52.84.45" src_port="20"/>
      <filter dst_ip="77.185.2.80" src_ip="196.52.84.45" src_port="21"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_272{
style=filled;
color=gray75;
1054[label="153.130.6.81;d;2pkt 2fpkt", shape=diamond, color=yellow];
1055[label="3.212.189.41;s;1pkt 1fpkt", shape=diamond, color=yellow];
2281[label="153.130.6.81;d;2pkt 2fpkt", shape=hexagon, color=black];
stat272[shape=component, label=&lt;Rules:&lt;BR/&gt;{3.212.189.41:12510, 153.130.6.81:1121}[50%]&lt;BR/&gt;{193.52.3.107:1863, 153.130.6.81:1357}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 12510: (30%)&lt;BR/&gt; 1121: (30%)&lt;BR/&gt; 1863: (20%)&lt;BR/&gt; 1357: (20%)&gt;];
}
1054--1055[label="1;1pkt 1fpkt"];
1054--2281[label="1;2pkt 2fpkt"];
1055--2281[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="153.130.6.81" dst_port="1357" src_ip="193.52.3.107" src_port="1863"/>
      <filter dst_ip="153.130.6.81" dst_port="1121" src_ip="3.212.189.41" src_port="12510"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498791" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.566965,1.41324,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_273{
style=filled;
color=gray75;
1063[label="197.41.67.202;d;4pkt 4fpkt", shape=diamond, color=yellow];
1064[label="173.76.144.164;s;4pkt 4fpkt", shape=diamond, color=yellow];
2956[label="173.76.144.164;3pkt 3fpkt", shape=pentagon, color=darkviolet];
stat273[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.76.144.164:49968, 197.41.67.202:80}[25%]&lt;BR/&gt;{173.76.144.164:49969, 197.41.67.202:80}[25%]&lt;BR/&gt;{173.76.144.164:49970, 197.41.67.202:80}[25%]&lt;BR/&gt;{173.76.144.164:49971, 197.41.67.202:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 49971: (13.6364%)&lt;BR/&gt; 49970: (13.6364%)&lt;BR/&gt; 49968: (13.6364%)&lt;BR/&gt; 49969: (9.09091%)&gt;];
}
1063--1064[label="1;4pkt 4fpkt"];
1063--2956[label="1;3pkt 3fpkt"];
1064--2956[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="197.41.67.202" dst_port="80" src_ip="173.76.144.164" src_port="49971"/>
      <filter dst_ip="197.41.67.202" dst_port="80" src_ip="173.76.144.164" src_port="49970"/>
      <filter dst_ip="197.41.67.202" dst_port="80" src_ip="173.76.144.164" src_port="49969"/>
      <filter dst_ip="197.41.67.202" dst_port="80" src_ip="173.76.144.164" src_port="49968"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498186" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_274{
style=filled;
color=gray75;
1069[label="197.17.34.191;d;187pkt 187fpkt", shape=diamond, color=yellow];
1070[label="173.76.148.84;s;189pkt 189fpkt", shape=diamond, color=yellow];
2094[label="173.76.148.84;s;170pkt 170fpkt", shape=hexagon, color=black];
stat274[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.76.148.84:*, 197.17.34.191:80}[98.9418%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.6337%)&lt;BR/&gt; 4309: (0.274725%)&lt;BR/&gt; 4308: (0.274725%)&lt;BR/&gt; 4307: (0.274725%)&lt;BR/&gt; 4306: (0.274725%)&gt;];
}
1069--1070[label="1;187pkt 187fpkt"];
1069--2094[label="0.988235;168pkt 168fpkt"];
1070--2094[label="1;170pkt 170fpkt"];
</description>
    <slice>
      <filter dst_ip="197.17.34.191" dst_port="80" src_ip="173.76.148.84"/>
    </slice>
    <from sec="1086498001" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.833275,1.40558,999,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_275{
style=filled;
color=gray75;
1078[label="215.94.191.22;s;1pkt 1fpkt", shape=diamond, color=yellow];
1079[label="173.76.157.49;d;4pkt 4fpkt", shape=diamond, color=yellow];
2099[label="173.76.157.49;d;4pkt 4fpkt", shape=hexagon, color=black];
2516[label="215.94.191.22;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3251[label="215.94.191.22;1pkt 1fpkt", shape=invtriangle, color=brown];
stat275[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.106.156.20:4916, 173.76.157.49:19337}[25%]&lt;BR/&gt;{215.94.191.22:52895, 173.76.157.49:19337}[25%]&lt;BR/&gt;{5.129.135.110:1541, 173.76.157.49:3618}[25%]&lt;BR/&gt;{5.129.135.110:33074, 173.76.157.49:19337}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 19337: (40.9091%)&lt;BR/&gt; 52895: (22.7273%)&lt;BR/&gt; 33074: (9.09091%)&lt;BR/&gt; 4916: (9.09091%)&lt;BR/&gt; 3618: (9.09091%)&gt;];
}
1078--1079[label="1;1pkt 1fpkt"];
1078--2099[label="1;1pkt 1fpkt"];
1078--2516[label="1;1pkt 1fpkt"];
1078--3251[label="1;1pkt 1fpkt"];
1079--2099[label="1;4pkt 4fpkt"];
1079--2516[label="1;1pkt 1fpkt"];
1079--3251[label="1;1pkt 1fpkt"];
2099--2516[label="1;1pkt 1fpkt"];
2099--3251[label="1;1pkt 1fpkt"];
2516--3251[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="173.76.157.49" dst_port="19337" src_ip="5.129.135.110" src_port="33074"/>
      <filter dst_ip="173.76.157.49" dst_port="3618" src_ip="5.129.135.110" src_port="1541"/>
      <filter dst_ip="173.76.157.49" dst_port="19337" src_ip="215.94.191.22" src_port="52895"/>
      <filter dst_ip="173.76.157.49" dst_port="19337" src_ip="208.106.156.20" src_port="4916"/>
    </slice>
    <from sec="1086498004" usec="0"/>
    <to sec="1086498309" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.836585,1.41293,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_276{
style=filled;
color=gray75;
1077[label="215.94.191.22;d;1pkt 1fpkt", shape=diamond, color=yellow];
1080[label="173.76.157.49;s;6pkt 6fpkt", shape=diamond, color=yellow];
2604[label="173.76.157.49;12pkt 12fpkt", shape=pentagon, color=darkviolet];
3304[label="173.76.157.49;11pkt 11fpkt", shape=invtriangle, color=brown];
3698[label="173.76.157.49;12pkt 12fpkt", shape=invhouse, color=bisque];
stat276[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.76.157.49:19337, 5.129.135.110:*}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 19337: (40.4762%)&lt;BR/&gt; 52895: (5.95238%)&lt;BR/&gt; 17087: (4.7619%)&lt;BR/&gt; 4916: (4.7619%)&lt;BR/&gt; 3656: (4.7619%)&gt;];
}
1077--1080[label="1;1pkt 1fpkt"];
1077--2604[label="1;1pkt 1fpkt"];
1077--3304[label="1;1pkt 1fpkt"];
1077--3698[label="1;1pkt 1fpkt"];
1080--2604[label="1;6pkt 6fpkt"];
1080--3304[label="0.833333;5pkt 5fpkt"];
1080--3698[label="1;6pkt 6fpkt"];
2604--3304[label="1;11pkt 11fpkt"];
2604--3698[label="1;12pkt 12fpkt"];
3304--3698[label="1;11pkt 11fpkt"];
</description>
    <slice>
      <filter dst_ip="5.129.135.110" src_ip="173.76.157.49" src_port="19337"/>
    </slice>
    <from sec="1086498004" usec="0"/>
    <to sec="1086498799" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_277{
style=filled;
color=gray75;
1084[label="153.130.6.85;d;20pkt 20fpkt", shape=diamond, color=yellow];
1087[label="77.225.31.91;s;1pkt 1fpkt", shape=diamond, color=yellow];
2168[label="153.130.6.85;d;19pkt 19fpkt", shape=hexagon, color=black];
stat277[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.143.2.19:80, 153.130.6.85:*}[80%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.5%)&lt;BR/&gt; 4551: (3.75%)&lt;BR/&gt; 4568: (2.5%)&lt;BR/&gt; 4567: (2.5%)&lt;BR/&gt; 4566: (2.5%)&gt;];
}
1084--1087[label="1;1pkt 1fpkt"];
1084--2168[label="1;19pkt 19fpkt"];
1087--2168[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="153.130.6.85" src_ip="218.143.2.19" src_port="80"/>
    </slice>
    <from sec="1086498005" usec="0"/>
    <to sec="1086498818" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="5.228.133.192"/>
      <from sec="1086498023" usec="0"/>
      <to sec="1086498110" usec="0"/>
    </slice>
    <from sec="1086498023" usec="0"/>
    <to sec="1086498110" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.833275,1.40558,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_280{
style=filled;
color=gray75;
1102[label="181.133.88.72;s;128pkt 128fpkt", shape=diamond, color=yellow];
1115[label="220.249.114.208;d;97pkt 97fpkt", shape=diamond, color=yellow];
2306[label="181.133.88.72;s;128pkt 128fpkt", shape=hexagon, color=black];
2697[label="181.133.88.72;128pkt 128fpkt", shape=pentagon, color=darkviolet];
3354[label="181.133.88.72;128pkt 128fpkt", shape=invtriangle, color=brown];
stat280[shape=component, label=&lt;Rules:&lt;BR/&gt;{181.133.88.72:*, 220.249.114.208:80}[75.7812%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (45.0739%)&lt;BR/&gt; 443: (4.92611%)&lt;BR/&gt; 4498: (0.410509%)&lt;BR/&gt; 4497: (0.410509%)&lt;BR/&gt; 4496: (0.410509%)&gt;];
}
1102--1115[label="1;97pkt 97fpkt"];
1102--2306[label="1;128pkt 128fpkt"];
1102--2697[label="1;128pkt 128fpkt"];
1102--3354[label="1;128pkt 128fpkt"];
1115--2306[label="1;97pkt 97fpkt"];
1115--2697[label="1;97pkt 97fpkt"];
1115--3354[label="1;97pkt 97fpkt"];
2306--2697[label="1;128pkt 128fpkt"];
2306--3354[label="1;128pkt 128fpkt"];
2697--3354[label="1;128pkt 128fpkt"];
</description>
    <slice>
      <filter dst_ip="220.249.114.208" dst_port="80" src_ip="181.133.88.72"/>
    </slice>
    <from sec="1086498018" usec="0"/>
    <to sec="1086498588" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="215.75.244.255"/>
      <from sec="1086498000" usec="0"/>
      <to sec="1086498828" usec="0"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_284{
style=filled;
color=gray75;
970[label="159.33.151.61;d;12pkt 12fpkt", shape=diamond, color=yellow];
1140[label="197.32.16.3;s;8pkt 8fpkt", shape=diamond, color=yellow];
1975[label="159.33.151.61;d;12pkt 12fpkt", shape=hexagon, color=black];
1976[label="197.32.16.3;s;8pkt 8fpkt", shape=hexagon, color=black];
stat284[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.32.16.3:*, 159.33.151.61:80}[66.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (40%)&lt;BR/&gt; 3468: (5%)&lt;BR/&gt; 3467: (5%)&lt;BR/&gt; 3466: (5%)&lt;BR/&gt; 3465: (5%)&gt;];
}
970--1140[label="1;8pkt 8fpkt"];
970--1975[label="1;12pkt 12fpkt"];
970--1976[label="1;8pkt 8fpkt"];
1140--1975[label="1;8pkt 8fpkt"];
1140--1976[label="1;8pkt 8fpkt"];
1975--1976[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="159.33.151.61" dst_port="80" src_ip="197.32.16.3"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,011,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="77.198.92.231"/>
      <from sec="1086498000" usec="0"/>
      <to sec="1086498828" usec="0"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_286{
style=filled;
color=gray75;
983[label="176.77.246.115;d;1pkt 1fpkt", shape=diamond, color=yellow];
1145[label="212.81.60.118;s;1pkt 1fpkt", shape=diamond, color=yellow];
2058[label="176.77.246.115;d;1pkt 1fpkt", shape=hexagon, color=black];
stat286[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.81.60.118:20106, 176.77.246.115:4614}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 20106: (50%)&lt;BR/&gt; 4614: (50%)&gt;];
}
983--1145[label="1;1pkt 1fpkt"];
983--2058[label="1;1pkt 1fpkt"];
1145--2058[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="176.77.246.115" dst_port="4614" src_ip="212.81.60.118" src_port="20106"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498796" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="77.180.132.166"/>
      <from sec="1086498000" usec="0"/>
      <to sec="1086498828" usec="0"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_289{
style=filled;
color=gray75;
1196[label="219.70.219.194;s;2440pkt 2440fpkt", shape=diamond, color=yellow];
stat289[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.70.219.194:3277, *:1434}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3277: (50%)&lt;BR/&gt; 1434: (50%)&gt;];
}
1196--1359[label="0.00909091;1pkt 1fpkt"];
1196--2101[label="0.00909091;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="1434" src_ip="219.70.219.194" src_port="3277"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_290{
style=filled;
color=gray75;
1227[label="203.99.83.219;d;4pkt 4fpkt", shape=diamond, color=yellow];
1228[label="181.133.50.196;s;4pkt 4fpkt", shape=diamond, color=yellow];
stat290[shape=component, label=&lt;Rules:&lt;BR/&gt;{181.133.50.196:33783, 203.99.83.219:80}[25%]&lt;BR/&gt;{181.133.50.196:33784, 203.99.83.219:80}[25%]&lt;BR/&gt;{181.133.50.196:33785, 203.99.83.219:80}[25%]&lt;BR/&gt;{181.133.50.196:33786, 203.99.83.219:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 33786: (12.5%)&lt;BR/&gt; 33785: (12.5%)&lt;BR/&gt; 33784: (12.5%)&lt;BR/&gt; 33783: (12.5%)&gt;];
}
1227--1228[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="203.99.83.219" dst_port="80" src_ip="181.133.50.196" src_port="33786"/>
      <filter dst_ip="203.99.83.219" dst_port="80" src_ip="181.133.50.196" src_port="33785"/>
      <filter dst_ip="203.99.83.219" dst_port="80" src_ip="181.133.50.196" src_port="33784"/>
      <filter dst_ip="203.99.83.219" dst_port="80" src_ip="181.133.50.196" src_port="33783"/>
    </slice>
    <from sec="1086498014" usec="0"/>
    <to sec="1086498211" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_292{
style=filled;
color=gray75;
1239[label="196.48.141.136;s;57pkt 57fpkt", shape=diamond, color=yellow];
1240[label="208.166.155.150;d;57pkt 57fpkt", shape=diamond, color=yellow];
1967[label="208.166.155.150;d;42pkt 42fpkt", shape=hexagon, color=black];
stat292[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.48.141.136:*, 208.166.155.150:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1803: (0.961538%)&lt;BR/&gt; 1802: (0.961538%)&lt;BR/&gt; 1801: (0.961538%)&lt;BR/&gt; 1800: (0.961538%)&gt;];
}
1239--1240[label="1;57pkt 57fpkt"];
1239--1967[label="1;42pkt 42fpkt"];
1240--1967[label="1;42pkt 42fpkt"];
</description>
    <slice>
      <filter dst_ip="208.166.155.150" dst_port="80" src_ip="196.48.141.136"/>
    </slice>
    <from sec="1086498046" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_293{
style=filled;
color=gray75;
1254[label="197.30.203.64;s;11pkt 11fpkt", shape=diamond, color=yellow];
1255[label="193.50.186.100;d;8pkt 8fpkt", shape=diamond, color=yellow];
stat293[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.30.203.64:80, 193.50.186.100:*}[72.7273%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (42.1053%)&lt;BR/&gt; 3737: (5.26316%)&lt;BR/&gt; 3736: (5.26316%)&lt;BR/&gt; 3735: (5.26316%)&lt;BR/&gt; 3734: (5.26316%)&gt;];
}
1254--1255[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="193.50.186.100" src_ip="197.30.203.64" src_port="80"/>
    </slice>
    <from sec="1086498136" usec="0"/>
    <to sec="1086498265" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="197.16.41.105"/>
      <from sec="1086498000" usec="0"/>
      <to sec="1086498738" usec="0"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498738" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.869189,1.45422,503,0 0 0 1 1 0 0 0 0 0 1 0 ">
    <description>subgraph cluster_296{
style=filled;
color=gray75;
988[label="5.74.26.223;d;839pkt 839fpkt", shape=diamond, color=yellow];
1131[label="153.130.179.179;s;1055pkt 1055fpkt", shape=diamond, color=yellow];
1272[label="212.211.213.87;d;214pkt 214fpkt", shape=diamond, color=yellow];
2130[label="153.130.179.179;s;710pkt 710fpkt", shape=hexagon, color=black];
3518[label="153.130.179.179;1140pkt 1140fpkt", shape=invtriangle, color=brown];
stat296[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.130.179.179:*, 5.74.26.223:80}[79.458%]&lt;BR/&gt;{153.130.179.179:*, 212.211.213.87:80}[20.3671%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 36233: (0.0505306%)&lt;BR/&gt; 36232: (0.0505306%)&lt;BR/&gt; 36231: (0.0505306%)&lt;BR/&gt; 36230: (0.0505306%)&gt;];
}
988--1131[label="1;839pkt 839fpkt"];
988--2130[label="0.795775;565pkt 565fpkt"];
988--3518[label="0.996424;836pkt 836fpkt"];
1131--1272[label="1;214pkt 214fpkt"];
1131--2130[label="1;710pkt 710fpkt"];
1131--3518[label="0.996209;1051pkt 1051fpkt"];
1272--2130[label="0.672897;144pkt 144fpkt"];
1272--3518[label="0.995327;213pkt 213fpkt"];
2130--3518[label="0.994366;706pkt 706fpkt"];
</description>
    <slice>
      <filter dst_ip="5.74.26.223" dst_port="80" src_ip="153.130.179.179"/>
      <filter dst_ip="212.211.213.87" dst_port="80" src_ip="153.130.179.179"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_297{
style=filled;
color=gray75;
1281[label="196.38.118.39;s;148pkt 148fpkt", shape=diamond, color=yellow];
stat297[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.38.118.39:80, 6.46.124.10:*}[25.6757%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.3108%)&lt;BR/&gt; 25: (1.01351%)&lt;BR/&gt; 4312: (0.675676%)&lt;BR/&gt; 4307: (0.675676%)&lt;BR/&gt; 4305: (0.675676%)&gt;];
}
1281--1356[label="0.00990099;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="6.46.124.10" src_ip="196.38.118.39" src_port="80"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498827" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="214.144.91.116"/>
      <from sec="1086498000" usec="0"/>
      <to sec="1086498828" usec="0"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_299{
style=filled;
color=gray75;
1153[label="221.79.167.56;s;2pkt 2fpkt", shape=diamond, color=yellow];
1289[label="153.130.6.54;d;4pkt 4fpkt", shape=diamond, color=yellow];
stat299[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.3.121.108:23, 153.130.6.54:1089}[25%]&lt;BR/&gt;{196.205.84.241:28010, 153.130.6.54:80}[25%]&lt;BR/&gt;{221.79.167.56:7070, 153.130.6.54:1428}[25%]&lt;BR/&gt;{221.79.167.56:53522, 153.130.6.54:6970}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53522: (16.6667%)&lt;BR/&gt; 7070: (16.6667%)&lt;BR/&gt; 6970: (16.6667%)&lt;BR/&gt; 1428: (16.6667%)&lt;BR/&gt; 28010: (8.33333%)&gt;];
}
1153--1289[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="153.130.6.54" dst_port="6970" src_ip="221.79.167.56" src_port="53522"/>
      <filter dst_ip="153.130.6.54" dst_port="1428" src_ip="221.79.167.56" src_port="7070"/>
      <filter dst_ip="153.130.6.54" dst_port="80" src_ip="196.205.84.241" src_port="28010"/>
      <filter dst_ip="153.130.6.54" dst_port="1089" src_ip="212.3.121.108" src_port="23"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_302{
style=filled;
color=gray75;
1167[label="197.30.200.8;s;10pkt 10fpkt", shape=diamond, color=yellow];
1308[label="196.94.101.214;d;10pkt 10fpkt", shape=diamond, color=yellow];
stat302[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.30.200.8:80, 196.94.101.214:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4826: (5%)&lt;BR/&gt; 4824: (5%)&lt;BR/&gt; 4823: (5%)&lt;BR/&gt; 4821: (5%)&gt;];
}
1167--1308[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter dst_ip="196.94.101.214" src_ip="197.30.200.8" src_port="80"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="196.193.161.123"/>
      <from sec="1086498000" usec="0"/>
      <to sec="1086498738" usec="0"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498738" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="173.76.168.14"/>
      <from sec="1086498000" usec="0"/>
      <to sec="1086498828" usec="0"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_305{
style=filled;
color=gray75;
1322[label="77.148.98.64;s;662pkt 662fpkt", shape=diamond, color=yellow];
stat305[shape=component, label=&lt;Rules:&lt;BR/&gt;{77.148.98.64:0, *:0}[96.6767%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (96.6767%)&lt;BR/&gt; 137: (1.20846%)&lt;BR/&gt; 445: (0.528701%)&lt;BR/&gt; 139: (0.528701%)&lt;BR/&gt; 3729: (0.0755287%)&gt;];
}
1322--2406[label="0.00453172;3pkt 3fpkt"];
</description>
    <slice>
      <filter src_ip="77.148.98.64"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_306{
style=filled;
color=gray75;
1192[label="176.77.197.160;s;1pkt 1fpkt", shape=diamond, color=yellow];
1324[label="82.97.97.179;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat306[shape=component, label=&lt;Rules:&lt;BR/&gt;{176.77.197.160:3928, 82.97.97.179:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3928: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
1192--1324[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="82.97.97.179" dst_port="80" src_ip="176.77.197.160" src_port="3928"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498607" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_307{
style=filled;
color=gray75;
1194[label="153.130.6.81;s;2pkt 2fpkt", shape=diamond, color=yellow];
1325[label="3.212.189.41;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat307[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.130.6.81:1121, 3.212.189.41:12510}[50%]&lt;BR/&gt;{153.130.6.81:1357, 193.52.3.107:1863}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 12510: (33.3333%)&lt;BR/&gt; 1121: (33.3333%)&lt;BR/&gt; 1863: (16.6667%)&lt;BR/&gt; 1357: (16.6667%)&gt;];
}
1194--1325[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="193.52.3.107" dst_port="1863" src_ip="153.130.6.81" src_port="1357"/>
      <filter dst_ip="3.212.189.41" dst_port="12510" src_ip="153.130.6.81" src_port="1121"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498791" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_308{
style=filled;
color=gray75;
1061[label="181.133.223.225;d;96pkt 96fpkt", shape=diamond, color=yellow];
1330[label="201.160.34.44;s;1pkt 1fpkt", shape=diamond, color=yellow];
2287[label="181.133.223.225;d;92pkt 92fpkt", shape=hexagon, color=black];
stat308[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.160.34.15:80, 181.133.223.225:*}[41.6667%]&lt;BR/&gt;{6.46.98.113:80, 181.133.223.225:*}[22.9167%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.2063%)&lt;BR/&gt; 1204: (0.793651%)&lt;BR/&gt; 554: (0.793651%)&lt;BR/&gt; 3128: (0.529101%)&lt;BR/&gt; 3127: (0.529101%)&gt;];
}
1061--1330[label="1;1pkt 1fpkt"];
1061--2287[label="1;92pkt 92fpkt"];
1330--2287[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="181.133.223.225" src_ip="201.160.34.15" src_port="80"/>
      <filter dst_ip="181.133.223.225" src_ip="6.46.98.113" src_port="80"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_309{
style=filled;
color=gray75;
1202[label="202.187.25.221;d;1pkt 1fpkt", shape=diamond, color=yellow];
1334[label="159.33.149.0;s;1pkt 1fpkt", shape=diamond, color=yellow];
2292[label="159.33.149.0;s;1pkt 1fpkt", shape=hexagon, color=black];
stat309[shape=component, label=&lt;Rules:&lt;BR/&gt;{159.33.149.0:1114, 202.187.25.221:20}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1114: (50%)&lt;BR/&gt; 20: (50%)&gt;];
}
1202--1334[label="1;1pkt 1fpkt"];
1202--2292[label="1;1pkt 1fpkt"];
1334--2292[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="202.187.25.221" dst_port="20" src_ip="159.33.149.0" src_port="1114"/>
    </slice>
    <from sec="1086498001" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="196.52.82.153"/>
      <from sec="1086498004" usec="0"/>
      <to sec="1086498269" usec="0"/>
    </slice>
    <from sec="1086498004" usec="0"/>
    <to sec="1086498269" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_311{
style=filled;
color=gray75;
1036[label="176.77.106.234;s;73pkt 73fpkt", shape=diamond, color=yellow];
1375[label="6.53.91.217;d;4pkt 4fpkt", shape=diamond, color=yellow];
1574[label="153.130.4.170;s;179pkt 179fpkt", shape=diamond, color=yellow];
1648[label="217.65.143.193;d;125pkt 125fpkt", shape=diamond, color=yellow];
2079[label="176.77.106.234;s;73pkt 73fpkt", shape=hexagon, color=black];
stat311[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.130.4.170:*, 217.65.143.193:80}[23.4615%]&lt;BR/&gt;{176.77.106.234:*, 217.65.143.193:80}[21.5385%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.7797%)&lt;BR/&gt; 3109: (0.330396%)&lt;BR/&gt; 3108: (0.330396%)&lt;BR/&gt; 3103: (0.330396%)&lt;BR/&gt; 3102: (0.330396%)&gt;];
}
1036--1375[label="1;4pkt 4fpkt"];
1036--1648[label="0.767123;56pkt 56fpkt"];
1036--2079[label="1;73pkt 73fpkt"];
1375--2079[label="1;4pkt 4fpkt"];
1574--1648[label="0.488;61pkt 61fpkt"];
1648--2079[label="0.767123;56pkt 56fpkt"];
1648--2236[label="0.008;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="217.65.143.193" dst_port="80" src_ip="153.130.4.170"/>
      <filter dst_ip="217.65.143.193" dst_port="80" src_ip="176.77.106.234"/>
    </slice>
    <from sec="1086498028" usec="0"/>
    <to sec="1086498713" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,010,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_312{
style=filled;
color=gray75;
1360[label="173.76.116.35;d;344pkt 344fpkt", shape=diamond, color=yellow];
1377[label="215.134.182.54;s;334pkt 334fpkt", shape=diamond, color=yellow];
2031[label="215.134.182.54;s;334pkt 334fpkt", shape=hexagon, color=black];
stat312[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.134.182.54:*, 173.76.116.35:11273}[32.5581%]&lt;BR/&gt;{215.134.182.54:*, 173.76.116.35:80}[32.2674%]&lt;BR/&gt;{215.134.182.54:*, 173.76.116.35:443}[32.2674%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 11273: (17.0455%)&lt;BR/&gt; 443: (16.4526%)&lt;BR/&gt; 80: (16.4526%)&lt;BR/&gt; 4718: (0.148221%)&lt;BR/&gt; 4716: (0.148221%)&gt;];
}
1360--1377[label="1;334pkt 334fpkt"];
1360--2031[label="1;334pkt 334fpkt"];
1377--2031[label="1;334pkt 334fpkt"];
</description>
    <slice>
      <filter dst_ip="173.76.116.35" dst_port="11273" src_ip="215.134.182.54"/>
      <filter dst_ip="173.76.116.35" dst_port="443" src_ip="215.134.182.54"/>
      <filter dst_ip="173.76.116.35" dst_port="80" src_ip="215.134.182.54"/>
    </slice>
    <from sec="1086498007" usec="0"/>
    <to sec="1086498819" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.851583,1.37621,503,1 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_313{
style=filled;
color=gray75;
5[label="176.77.90.17s;3pkt 3fpkt", shape=rectangle, color=red];
1383[label="214.163.184.246;d;1pkt 1fpkt", shape=diamond, color=yellow];
1455[label="176.77.90.17;s;63pkt 63fpkt", shape=diamond, color=yellow];
2117[label="214.163.184.246;d;1pkt 1fpkt", shape=hexagon, color=black];
2302[label="176.77.90.17;s;56pkt 56fpkt", shape=hexagon, color=black];
2491[label="176.77.90.17;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat313[shape=component, label=&lt;Rules:&lt;BR/&gt;{176.77.90.17:*, *:80}[67.6923%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (32.4%)&lt;BR/&gt; 2982: (3.2%)&lt;BR/&gt; 1863: (3.2%)&lt;BR/&gt; 5038: (2.4%)&lt;BR/&gt; 3971: (2.4%)&gt;];
}
5--1383[label="1;1pkt 1fpkt"];
5--1455[label="0.333333;1pkt 1fpkt"];
5--2117[label="1;1pkt 1fpkt"];
5--2302[label="0.333333;1pkt 1fpkt"];
5--2491[label="1;1pkt 1fpkt"];
1383--1455[label="1;1pkt 1fpkt"];
1383--2117[label="1;1pkt 1fpkt"];
1383--2302[label="1;1pkt 1fpkt"];
1383--2491[label="1;1pkt 1fpkt"];
1455--1457[label="0.015873;1pkt 1fpkt"];
1455--1492[label="0.0634921;4pkt 4fpkt"];
1455--2103[label="0.015873;1pkt 1fpkt"];
1455--2117[label="1;1pkt 1fpkt"];
1455--2302[label="1;56pkt 56fpkt"];
1455--2491[label="1;1pkt 1fpkt"];
2117--2302[label="1;1pkt 1fpkt"];
2117--2491[label="1;1pkt 1fpkt"];
2302--2491[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="176.77.90.17"/>
    </slice>
    <from sec="1086498008" usec="0"/>
    <to sec="1086498901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_314{
style=filled;
color=gray75;
1238[label="173.76.148.82;s;23pkt 23fpkt", shape=diamond, color=yellow];
1385[label="5.51.24.17;d;1pkt 1fpkt", shape=diamond, color=yellow];
2033[label="5.51.24.17;d;1pkt 1fpkt", shape=hexagon, color=black];
2112[label="173.76.148.82;s;21pkt 21fpkt", shape=hexagon, color=black];
stat314[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.76.148.82:*, 192.54.142.129:80}[34.7826%]&lt;BR/&gt;{173.76.148.82:*, 195.21.208.84:80}[26.087%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (36.9565%)&lt;BR/&gt; 32850: (4.34783%)&lt;BR/&gt; 9012: (4.34783%)&lt;BR/&gt; 8070: (4.34783%)&lt;BR/&gt; 32865: (2.17391%)&gt;];
}
1238--1385[label="1;1pkt 1fpkt"];
1238--2033[label="1;1pkt 1fpkt"];
1238--2112[label="1;21pkt 21fpkt"];
1385--2033[label="1;1pkt 1fpkt"];
1385--2112[label="1;1pkt 1fpkt"];
2033--2112[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="192.54.142.129" dst_port="80" src_ip="173.76.148.82"/>
      <filter dst_ip="195.21.208.84" dst_port="80" src_ip="173.76.148.82"/>
    </slice>
    <from sec="1086498039" usec="0"/>
    <to sec="1086498625" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.836585,1.41293,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_316{
style=filled;
color=gray75;
1398[label="205.212.142.44;s;5pkt 5fpkt", shape=diamond, color=yellow];
1399[label="176.77.15.3;d;5pkt 5fpkt", shape=diamond, color=yellow];
2582[label="205.212.142.44;5pkt 5fpkt", shape=pentagon, color=darkviolet];
3292[label="205.212.142.44;5pkt 5fpkt", shape=invtriangle, color=brown];
3691[label="205.212.142.44;5pkt 5fpkt", shape=invhouse, color=bisque];
stat316[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.212.142.44:21, 176.77.15.3:18850}[20%]&lt;BR/&gt;{205.212.142.44:5340, 176.77.15.3:18852}[20%]&lt;BR/&gt;{205.212.142.44:9392, 176.77.15.3:18856}[20%]&lt;BR/&gt;{205.212.142.44:24101, 176.77.15.3:18854}[20%]&lt;BR/&gt;{205.212.142.44:28513, 176.77.15.3:18860}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 28513: (10%)&lt;BR/&gt; 24101: (10%)&lt;BR/&gt; 18860: (10%)&lt;BR/&gt; 18856: (10%)&lt;BR/&gt; 18854: (10%)&gt;];
}
1398--1399[label="1;5pkt 5fpkt"];
1398--2582[label="1;5pkt 5fpkt"];
1398--3292[label="1;5pkt 5fpkt"];
1398--3691[label="1;5pkt 5fpkt"];
1399--2582[label="1;5pkt 5fpkt"];
1399--3292[label="1;5pkt 5fpkt"];
1399--3691[label="1;5pkt 5fpkt"];
2582--3292[label="1;5pkt 5fpkt"];
2582--3691[label="1;5pkt 5fpkt"];
3292--3691[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="176.77.15.3" dst_port="18860" src_ip="205.212.142.44" src_port="28513"/>
      <filter dst_ip="176.77.15.3" dst_port="18854" src_ip="205.212.142.44" src_port="24101"/>
      <filter dst_ip="176.77.15.3" dst_port="18856" src_ip="205.212.142.44" src_port="9392"/>
      <filter dst_ip="176.77.15.3" dst_port="18852" src_ip="205.212.142.44" src_port="5340"/>
      <filter dst_ip="176.77.15.3" dst_port="18850" src_ip="205.212.142.44" src_port="21"/>
    </slice>
    <from sec="1086498233" usec="0"/>
    <to sec="1086498576" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_317{
style=filled;
color=gray75;
1397[label="205.212.142.44;d;5pkt 5fpkt", shape=diamond, color=yellow];
1400[label="176.77.15.3;s;5pkt 5fpkt", shape=diamond, color=yellow];
2000[label="176.77.15.3;s;5pkt 5fpkt", shape=hexagon, color=black];
stat317[shape=component, label=&lt;Rules:&lt;BR/&gt;{176.77.15.3:18850, 205.212.142.44:21}[20%]&lt;BR/&gt;{176.77.15.3:18852, 205.212.142.44:5340}[20%]&lt;BR/&gt;{176.77.15.3:18854, 205.212.142.44:24101}[20%]&lt;BR/&gt;{176.77.15.3:18856, 205.212.142.44:9392}[20%]&lt;BR/&gt;{176.77.15.3:18860, 205.212.142.44:28513}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 28513: (10%)&lt;BR/&gt; 24101: (10%)&lt;BR/&gt; 18860: (10%)&lt;BR/&gt; 18856: (10%)&lt;BR/&gt; 18854: (10%)&gt;];
}
1397--1400[label="1;5pkt 5fpkt"];
1397--2000[label="1;5pkt 5fpkt"];
1400--2000[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="205.212.142.44" dst_port="28513" src_ip="176.77.15.3" src_port="18860"/>
      <filter dst_ip="205.212.142.44" dst_port="9392" src_ip="176.77.15.3" src_port="18856"/>
      <filter dst_ip="205.212.142.44" dst_port="24101" src_ip="176.77.15.3" src_port="18854"/>
      <filter dst_ip="205.212.142.44" dst_port="5340" src_ip="176.77.15.3" src_port="18852"/>
      <filter dst_ip="205.212.142.44" dst_port="21" src_ip="176.77.15.3" src_port="18850"/>
    </slice>
    <from sec="1086498233" usec="0"/>
    <to sec="1086498275" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="196.193.67.219"/>
      <from sec="1086498000" usec="0"/>
      <to sec="1086498828" usec="0"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="215.91.145.135"/>
      <from sec="1086498000" usec="0"/>
      <to sec="1086498828" usec="0"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="214.145.73.216"/>
      <from sec="1086498000" usec="0"/>
      <to sec="1086498827" usec="0"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498827" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="2.82.175.201"/>
      <from sec="1086498000" usec="0"/>
      <to sec="1086498409" usec="0"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498409" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_322{
style=filled;
color=gray75;
1189[label="220.162.252.155;d;2pkt 2fpkt", shape=diamond, color=yellow];
1429[label="196.48.157.208;s;34pkt 34fpkt", shape=diamond, color=yellow];
2216[label="196.48.157.208;s;34pkt 34fpkt", shape=hexagon, color=black];
stat322[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.48.157.208:*, 23.250.192.178:7144}[44.1176%]&lt;BR/&gt;{196.48.157.208:*, 7.80.232.152:80}[35.2941%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7144: (25.7143%)&lt;BR/&gt; 80: (18.5714%)&lt;BR/&gt; 0: (5.71429%)&lt;BR/&gt; 1450: (2.14286%)&lt;BR/&gt; 1411: (2.14286%)&gt;];
}
1189--1429[label="1;2pkt 2fpkt"];
1189--2216[label="1;2pkt 2fpkt"];
1429--2216[label="1;34pkt 34fpkt"];
</description>
    <slice>
      <filter dst_ip="23.250.192.178" dst_port="7144" src_ip="196.48.157.208"/>
      <filter dst_ip="7.80.232.152" dst_port="80" src_ip="196.48.157.208"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498738" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_323{
style=filled;
color=gray75;
1197[label="181.133.223.225;s;178pkt 178fpkt", shape=diamond, color=yellow];
1436[label="201.160.34.44;d;1pkt 1fpkt", shape=diamond, color=yellow];
1679[label="220.235.80.240;d;1pkt 1fpkt", shape=diamond, color=yellow];
2087[label="181.133.223.225;s;169pkt 169fpkt", shape=hexagon, color=black];
2221[label="201.160.34.44;d;1pkt 1fpkt", shape=hexagon, color=black];
2248[label="220.235.80.240;d;1pkt 1fpkt", shape=hexagon, color=black];
stat323[shape=component, label=&lt;Rules:&lt;BR/&gt;{181.133.223.225:*, 201.160.34.15:80}[22.4719%]&lt;BR/&gt;{181.133.223.225:*, 213.224.20.182:80}[20.2247%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.8604%)&lt;BR/&gt; 554: (1.1396%)&lt;BR/&gt; 1949: (0.569801%)&lt;BR/&gt; 1204: (0.569801%)&lt;BR/&gt; 3128: (0.2849%)&gt;];
}
1197--1436[label="1;1pkt 1fpkt"];
1197--1679[label="1;1pkt 1fpkt"];
1197--2087[label="1;169pkt 169fpkt"];
1197--2221[label="1;1pkt 1fpkt"];
1197--2248[label="1;1pkt 1fpkt"];
1436--2087[label="1;1pkt 1fpkt"];
1436--2221[label="1;1pkt 1fpkt"];
1679--2087[label="1;1pkt 1fpkt"];
1679--2248[label="1;1pkt 1fpkt"];
2087--2221[label="1;1pkt 1fpkt"];
2087--2248[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="201.160.34.15" dst_port="80" src_ip="181.133.223.225"/>
      <filter dst_ip="213.224.20.182" dst_port="80" src_ip="181.133.223.225"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_324{
style=filled;
color=gray75;
1441[label="197.30.204.145;s;516pkt 516fpkt", shape=diamond, color=yellow];
stat324[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.30.204.145:0, *:0}[99.6124%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.6124%)&lt;BR/&gt; 445: (0.193798%)&lt;BR/&gt; 3448: (0.0968992%)&lt;BR/&gt; 3313: (0.0968992%)&gt;];
}
1441--1581[label="0.00387597;2pkt 2fpkt"];
1441--1917[label="0.00263852;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="197.30.204.145"/>
    </slice>
    <from sec="1086498001" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="77.171.243.33"/>
      <from sec="1086498001" usec="0"/>
      <to sec="1086498828" usec="0"/>
    </slice>
    <from sec="1086498001" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.770831,1.35839,001,1 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_326{
style=filled;
color=gray75;
278[label="208.69.3.190s;508pkt 508fpkt", shape=rectangle, color=red];
1475[label="208.69.3.190;s;508pkt 508fpkt", shape=diamond, color=yellow];
3029[label="208.69.3.190;508pkt 508fpkt", shape=pentagon, color=darkviolet];
3533[label="208.69.3.190;508pkt 508fpkt", shape=invtriangle, color=brown];
stat326[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.69.3.190:*, *:5554}[50%]&lt;BR/&gt;{208.69.3.190:*, *:9898}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (25%)&lt;BR/&gt; 5554: (25%)&lt;BR/&gt; 4999: (0.0984252%)&lt;BR/&gt; 4998: (0.0984252%)&lt;BR/&gt; 4997: (0.0984252%)&gt;];
}
278--1475[label="1;508pkt 508fpkt"];
278--3029[label="1;508pkt 508fpkt"];
278--3533[label="1;508pkt 508fpkt"];
1475--3029[label="1;508pkt 508fpkt"];
1475--3533[label="1;508pkt 508fpkt"];
3029--3533[label="1;508pkt 508fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="208.69.3.190"/>
      <filter dst_port="5554" src_ip="208.69.3.190"/>
    </slice>
    <from sec="1086498211" usec="0"/>
    <to sec="1086498217" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="77.171.248.206"/>
      <from sec="1086498000" usec="0"/>
      <to sec="1086498827" usec="0"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498827" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_329{
style=filled;
color=gray75;
1506[label="7.6.85.184;s;1pkt 1fpkt", shape=diamond, color=yellow];
1507[label="176.77.106.195;d;3pkt 3fpkt", shape=diamond, color=yellow];
1833[label="214.209.69.107;s;510pkt 510fpkt", shape=diamond, color=yellow];
stat329[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.209.69.107:*, *:1026}[49.9022%]&lt;BR/&gt;{214.209.69.107:*, *:1027}[49.9022%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (24.9027%)&lt;BR/&gt; 1026: (24.9027%)&lt;BR/&gt; 4321: (0.291829%)&lt;BR/&gt; 4320: (0.291829%)&lt;BR/&gt; 3967: (0.291829%)&gt;];
}
1506--1507[label="1;1pkt 1fpkt"];
1507--1833[label="0.666667;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="214.209.69.107"/>
      <filter dst_port="1026" src_ip="214.209.69.107"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_330{
style=filled;
color=gray75;
1514[label="192.68.25.168;d;2pkt 2fpkt", shape=diamond, color=yellow];
1515[label="173.76.129.43;s;3pkt 3fpkt", shape=diamond, color=yellow];
2270[label="173.76.129.43;s;3pkt 3fpkt", shape=hexagon, color=black];
stat330[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.76.129.43:1031, 212.3.121.117:5050}[33.3333%]&lt;BR/&gt;{173.76.129.43:1307, 192.68.25.168:554}[33.3333%]&lt;BR/&gt;{173.76.129.43:6970, 192.68.25.168:7404}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7404: (18.75%)&lt;BR/&gt; 6970: (18.75%)&lt;BR/&gt; 1307: (18.75%)&lt;BR/&gt; 554: (18.75%)&lt;BR/&gt; 5050: (12.5%)&gt;];
}
1514--1515[label="1;2pkt 2fpkt"];
1514--2270[label="1;2pkt 2fpkt"];
1515--2270[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="192.68.25.168" dst_port="7404" src_ip="173.76.129.43" src_port="6970"/>
      <filter dst_ip="192.68.25.168" dst_port="554" src_ip="173.76.129.43" src_port="1307"/>
      <filter dst_ip="212.3.121.117" dst_port="5050" src_ip="173.76.129.43" src_port="1031"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="214.216.205.3"/>
      <from sec="1086498000" usec="0"/>
      <to sec="1086498828" usec="0"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_332{
style=filled;
color=gray75;
1522[label="212.16.113.253;s;22pkt 22fpkt", shape=diamond, color=yellow];
1523[label="197.30.201.129;d;16pkt 16fpkt", shape=diamond, color=yellow];
2078[label="197.30.201.129;d;11pkt 11fpkt", shape=hexagon, color=black];
2157[label="212.16.113.253;s;16pkt 16fpkt", shape=hexagon, color=black];
stat332[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.16.113.253:80, 197.30.201.129:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3464: (3.07692%)&lt;BR/&gt; 3463: (3.07692%)&lt;BR/&gt; 3459: (3.07692%)&lt;BR/&gt; 3453: (3.07692%)&gt;];
}
1522--1523[label="1;16pkt 16fpkt"];
1522--2078[label="1;11pkt 11fpkt"];
1522--2157[label="1;16pkt 16fpkt"];
1523--2078[label="1;11pkt 11fpkt"];
1523--2157[label="1;16pkt 16fpkt"];
2078--2157[label="1;11pkt 11fpkt"];
</description>
    <slice>
      <filter dst_ip="197.30.201.129" src_ip="212.16.113.253" src_port="80"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498825" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="196.48.60.32"/>
      <from sec="1086498000" usec="0"/>
      <to sec="1086498828" usec="0"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="214.216.205.0"/>
      <from sec="1086498000" usec="0"/>
      <to sec="1086498828" usec="0"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_335{
style=filled;
color=gray75;
1544[label="181.133.133.183;d;423pkt 423fpkt", shape=diamond, color=yellow];
stat335[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 181.133.133.183:53}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (54.8463%)&lt;BR/&gt; 32768: (2.60047%)&lt;BR/&gt; 32774: (1.06383%)&lt;BR/&gt; 32769: (1.06383%)&lt;BR/&gt; 33701: (0.945626%)&gt;];
}
1544--2404[label="0.00236407;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="181.133.133.183" dst_port="53"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498558" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_336{
style=filled;
color=gray75;
1558[label="197.30.207.145;s;367pkt 367fpkt", shape=diamond, color=yellow];
stat336[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.30.207.145:53, *:*}[98.9101%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (56.267%)&lt;BR/&gt; 32768: (2.31608%)&lt;BR/&gt; 9253: (1.63488%)&lt;BR/&gt; 32769: (1.08992%)&lt;BR/&gt; 32770: (0.817439%)&gt;];
}
1558--1581[label="0.0027248;1pkt 1fpkt"];
1558--1816[label="0.0027248;1pkt 1fpkt"];
1558--1917[label="0.0027248;1pkt 1fpkt"];
1558--2295[label="0.0027248;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="197.30.207.145" src_port="53"/>
    </slice>
    <from sec="1086498008" usec="0"/>
    <to sec="1086498827" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_337{
style=filled;
color=gray75;
1547[label="176.77.228.101;s;4pkt 4fpkt", shape=diamond, color=yellow];
1570[label="212.133.23.210;d;2pkt 2fpkt", shape=diamond, color=yellow];
1812[label="3.220.199.186;d;1pkt 1fpkt", shape=diamond, color=yellow];
2095[label="176.77.228.101;s;4pkt 4fpkt", shape=hexagon, color=black];
stat337[shape=component, label=&lt;Rules:&lt;BR/&gt;{176.77.228.101:9898, 215.76.41.122:3342}[25%]&lt;BR/&gt;{176.77.228.101:2011, 3.220.199.186:6667}[25%]&lt;BR/&gt;{176.77.228.101:2032, 212.133.23.210:1024}[25%]&lt;BR/&gt;{176.77.228.101:2033, 212.133.23.210:1024}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1024: (27.2727%)&lt;BR/&gt; 6667: (13.6364%)&lt;BR/&gt; 2033: (13.6364%)&lt;BR/&gt; 2032: (13.6364%)&lt;BR/&gt; 2011: (13.6364%)&gt;];
}
1547--1570[label="1;2pkt 2fpkt"];
1547--1812[label="1;1pkt 1fpkt"];
1547--2095[label="1;4pkt 4fpkt"];
1570--2095[label="1;2pkt 2fpkt"];
1812--2095[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="212.133.23.210" dst_port="1024" src_ip="176.77.228.101" src_port="2033"/>
      <filter dst_ip="212.133.23.210" dst_port="1024" src_ip="176.77.228.101" src_port="2032"/>
      <filter dst_ip="3.220.199.186" dst_port="6667" src_ip="176.77.228.101" src_port="2011"/>
      <filter dst_ip="215.76.41.122" dst_port="3342" src_ip="176.77.228.101" src_port="9898"/>
    </slice>
    <from sec="1086498001" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="215.84.141.200"/>
      <from sec="1086498130" usec="0"/>
      <to sec="1086498472" usec="0"/>
    </slice>
    <from sec="1086498130" usec="0"/>
    <to sec="1086498472" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.566965,1.41324,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_339{
style=filled;
color=gray75;
1539[label="173.76.213.240;s;45pkt 45fpkt", shape=diamond, color=yellow];
1597[label="208.172.82.195;d;1pkt 1fpkt", shape=diamond, color=yellow];
1861[label="218.44.7.50;d;1pkt 1fpkt", shape=diamond, color=yellow];
3151[label="173.76.213.240;49pkt 49fpkt", shape=pentagon, color=darkviolet];
stat339[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.76.213.240:*, 208.172.80.15:80}[38%]&lt;BR/&gt;{173.76.213.240:*, 214.98.156.181:80}[28%]&lt;BR/&gt;{173.76.213.240:*, 208.172.80.45:80}[26%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.9583%)&lt;BR/&gt; 1284: (1.5625%)&lt;BR/&gt; 1270: (1.5625%)&lt;BR/&gt; 1863: (1.04167%)&lt;BR/&gt; 1291: (1.04167%)&gt;];
}
1539--1597[label="1;1pkt 1fpkt"];
1539--1861[label="1;1pkt 1fpkt"];
1539--3151[label="0.977778;44pkt 44fpkt"];
1597--3151[label="1;1pkt 1fpkt"];
1861--3151[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="208.172.80.15" dst_port="80" src_ip="173.76.213.240"/>
      <filter dst_ip="214.98.156.181" dst_port="80" src_ip="173.76.213.240"/>
      <filter dst_ip="208.172.80.45" dst_port="80" src_ip="173.76.213.240"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.833275,1.40558,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_340{
style=filled;
color=gray75;
1566[label="196.48.60.247;s;46pkt 46fpkt", shape=diamond, color=yellow];
1602[label="195.5.55.13;d;24pkt 24fpkt", shape=diamond, color=yellow];
2189[label="195.5.55.13;d;24pkt 24fpkt", shape=hexagon, color=black];
2342[label="196.48.60.247;s;46pkt 46fpkt", shape=hexagon, color=black];
3163[label="196.48.60.247;48pkt 48fpkt", shape=pentagon, color=darkviolet];
3608[label="196.48.60.247;48pkt 48fpkt", shape=invtriangle, color=brown];
stat340[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.48.60.247:80, 195.5.55.13:*}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.4576%)&lt;BR/&gt; 0: (3.38983%)&lt;BR/&gt; 41374: (1.27119%)&lt;BR/&gt; 41325: (1.27119%)&lt;BR/&gt; 41324: (1.27119%)&gt;];
}
1566--1602[label="1;24pkt 24fpkt"];
1566--2189[label="1;24pkt 24fpkt"];
1566--2342[label="1;46pkt 46fpkt"];
1566--3163[label="1;46pkt 46fpkt"];
1566--3608[label="1;46pkt 46fpkt"];
1602--2189[label="1;24pkt 24fpkt"];
1602--2342[label="1;24pkt 24fpkt"];
1602--3163[label="1;24pkt 24fpkt"];
1602--3608[label="1;24pkt 24fpkt"];
2189--2342[label="1;24pkt 24fpkt"];
2189--3163[label="1;24pkt 24fpkt"];
2189--3608[label="1;24pkt 24fpkt"];
2342--3163[label="1;46pkt 46fpkt"];
2342--3608[label="1;46pkt 46fpkt"];
3163--3608[label="1;48pkt 48fpkt"];
</description>
    <slice>
      <filter dst_ip="195.5.55.13" src_ip="196.48.60.247" src_port="80"/>
    </slice>
    <from sec="1086498014" usec="0"/>
    <to sec="1086498876" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687923,1.37127,001,1 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_341{
style=filled;
color=gray75;
136[label="208.79.32.42s;505pkt 505fpkt", shape=rectangle, color=red];
1606[label="208.79.32.42;s;505pkt 505fpkt", shape=diamond, color=yellow];
2575[label="208.79.32.42;505pkt 505fpkt", shape=pentagon, color=darkviolet];
stat341[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.79.32.42:*, *:5554}[50.099%]&lt;BR/&gt;{208.79.32.42:*, *:9898}[49.901%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (25.0495%)&lt;BR/&gt; 9898: (24.9505%)&lt;BR/&gt; 4466: (0.0990099%)&lt;BR/&gt; 4465: (0.0990099%)&lt;BR/&gt; 4464: (0.0990099%)&gt;];
}
136--1606[label="1;505pkt 505fpkt"];
136--2575[label="1;505pkt 505fpkt"];
1606--2575[label="1;505pkt 505fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="208.79.32.42"/>
      <filter dst_port="9898" src_ip="208.79.32.42"/>
    </slice>
    <from sec="1086498420" usec="0"/>
    <to sec="1086498427" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_342{
style=filled;
color=gray75;
1624[label="212.16.113.253;d;22pkt 22fpkt", shape=diamond, color=yellow];
1625[label="197.30.201.129;s;22pkt 22fpkt", shape=diamond, color=yellow];
2156[label="212.16.113.253;d;16pkt 16fpkt", shape=hexagon, color=black];
2214[label="197.30.201.129;s;16pkt 16fpkt", shape=hexagon, color=black];
stat342[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.30.201.129:*, 212.16.113.253:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3480: (2.63158%)&lt;BR/&gt; 3476: (2.63158%)&lt;BR/&gt; 3475: (2.63158%)&lt;BR/&gt; 3470: (2.63158%)&gt;];
}
1624--1625[label="1;22pkt 22fpkt"];
1624--2156[label="1;16pkt 16fpkt"];
1624--2214[label="1;16pkt 16fpkt"];
1625--2156[label="1;16pkt 16fpkt"];
1625--2214[label="1;16pkt 16fpkt"];
2156--2214[label="1;16pkt 16fpkt"];
</description>
    <slice>
      <filter dst_ip="212.16.113.253" dst_port="80" src_ip="197.30.201.129"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498738" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_343{
style=filled;
color=gray75;
1626[label="78.41.57.72;d;2pkt 2fpkt", shape=diamond, color=yellow];
1627[label="153.130.121.97;s;2pkt 2fpkt", shape=diamond, color=yellow];
2277[label="78.41.57.72;d;2pkt 2fpkt", shape=hexagon, color=black];
stat343[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.130.121.97:1615, 78.41.57.72:554}[50%]&lt;BR/&gt;{153.130.121.97:6970, 78.41.57.72:19335}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 19335: (25%)&lt;BR/&gt; 6970: (25%)&lt;BR/&gt; 1615: (25%)&lt;BR/&gt; 554: (25%)&gt;];
}
1626--1627[label="1;2pkt 2fpkt"];
1626--2277[label="1;2pkt 2fpkt"];
1627--2277[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="78.41.57.72" dst_port="19335" src_ip="153.130.121.97" src_port="6970"/>
      <filter dst_ip="78.41.57.72" dst_port="554" src_ip="153.130.121.97" src_port="1615"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_344{
style=filled;
color=gray75;
1631[label="192.168.128.255;d;1pkt 1fpkt", shape=diamond, color=yellow];
1632[label="176.77.92.184;s;1pkt 1fpkt", shape=diamond, color=yellow];
2159[label="192.168.128.255;d;1pkt 1fpkt", shape=hexagon, color=black];
stat344[shape=component, label=&lt;Rules:&lt;BR/&gt;{176.77.92.184:4445, 192.168.128.255:4445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4445: (100%)&gt;];
}
1631--1632[label="1;1pkt 1fpkt"];
1631--2159[label="1;1pkt 1fpkt"];
1632--2159[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="192.168.128.255" dst_port="4445" src_ip="176.77.92.184" src_port="4445"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_345{
style=filled;
color=gray75;
1636[label="153.130.7.14;s;86pkt 86fpkt", shape=diamond, color=yellow];
stat345[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.130.7.14:*, 171.161.13.160:80}[96.5116%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.2558%)&lt;BR/&gt; 9999: (1.16279%)&lt;BR/&gt; 1887: (0.581395%)&lt;BR/&gt; 1886: (0.581395%)&lt;BR/&gt; 1883: (0.581395%)&gt;];
}
1636--2404[label="0.0116279;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="171.161.13.160" dst_port="80" src_ip="153.130.7.14"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="77.180.167.131"/>
      <from sec="1086498001" usec="0"/>
      <to sec="1086498828" usec="0"/>
    </slice>
    <from sec="1086498001" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="153.130.6.105"/>
      <from sec="1086498053" usec="0"/>
      <to sec="1086498600" usec="0"/>
    </slice>
    <from sec="1086498053" usec="0"/>
    <to sec="1086498600" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_348{
style=filled;
color=gray75;
1684[label="181.133.58.138;s;6pkt 6fpkt", shape=diamond, color=yellow];
1690[label="101.139.8.189;d;1pkt 1fpkt", shape=diamond, color=yellow];
2193[label="101.139.8.189;d;1pkt 1fpkt", shape=hexagon, color=black];
stat348[shape=component, label=&lt;Rules:&lt;BR/&gt;{181.133.58.138:8000, 6.46.124.182:*}[50%]&lt;BR/&gt;{181.133.58.138:*, *:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8000: (37.5%)&lt;BR/&gt; 33437: (18.75%)&lt;BR/&gt; 80: (12.5%)&lt;BR/&gt; 58757: (6.25%)&lt;BR/&gt; 58755: (6.25%)&gt;];
}
1684--1690[label="1;1pkt 1fpkt"];
1684--2193[label="1;1pkt 1fpkt"];
1690--2193[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="181.133.58.138"/>
      <filter dst_ip="6.46.124.182" src_ip="181.133.58.138" src_port="8000"/>
    </slice>
    <from sec="1086498481" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_349{
style=filled;
color=gray75;
1683[label="181.133.58.138;d;4pkt 4fpkt", shape=diamond, color=yellow];
1691[label="101.139.8.189;s;1pkt 1fpkt", shape=diamond, color=yellow];
2194[label="101.139.8.189;s;1pkt 1fpkt", shape=hexagon, color=black];
stat349[shape=component, label=&lt;Rules:&lt;BR/&gt;{101.139.8.189:33437, 181.133.58.138:8000}[25%]&lt;BR/&gt;{6.46.124.182:11928, 181.133.58.138:8000}[25%]&lt;BR/&gt;{6.46.124.182:17204, 181.133.58.138:8000}[25%]&lt;BR/&gt;{6.46.124.182:19256, 181.133.58.138:8000}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8000: (50%)&lt;BR/&gt; 33437: (25%)&lt;BR/&gt; 19256: (8.33333%)&lt;BR/&gt; 17204: (8.33333%)&lt;BR/&gt; 11928: (8.33333%)&gt;];
}
1683--1691[label="1;1pkt 1fpkt"];
1683--2194[label="1;1pkt 1fpkt"];
1691--2194[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="181.133.58.138" dst_port="8000" src_ip="6.46.124.182" src_port="19256"/>
      <filter dst_ip="181.133.58.138" dst_port="8000" src_ip="6.46.124.182" src_port="17204"/>
      <filter dst_ip="181.133.58.138" dst_port="8000" src_ip="6.46.124.182" src_port="11928"/>
      <filter dst_ip="181.133.58.138" dst_port="8000" src_ip="101.139.8.189" src_port="33437"/>
    </slice>
    <from sec="1086498481" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_350{
style=filled;
color=gray75;
1707[label="205.212.142.36;s;1pkt 1fpkt", shape=diamond, color=yellow];
1708[label="176.77.105.9;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat350[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.212.142.36:80, 176.77.105.9:2588}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2588: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
1707--1708[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="176.77.105.9" dst_port="2588" src_ip="205.212.142.36" src_port="80"/>
    </slice>
    <from sec="1086498545" usec="0"/>
    <to sec="1086498818" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_351{
style=filled;
color=gray75;
1706[label="205.212.142.36;d;1pkt 1fpkt", shape=diamond, color=yellow];
1709[label="176.77.105.9;s;1pkt 1fpkt", shape=diamond, color=yellow];
2198[label="176.77.105.9;s;1pkt 1fpkt", shape=hexagon, color=black];
2325[label="205.212.142.36;d;1pkt 1fpkt", shape=hexagon, color=black];
stat351[shape=component, label=&lt;Rules:&lt;BR/&gt;{176.77.105.9:2588, 205.212.142.36:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2588: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
1706--1709[label="1;1pkt 1fpkt"];
1706--2198[label="1;1pkt 1fpkt"];
1706--2325[label="1;1pkt 1fpkt"];
1709--2198[label="1;1pkt 1fpkt"];
1709--2325[label="1;1pkt 1fpkt"];
2198--2325[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="205.212.142.36" dst_port="80" src_ip="176.77.105.9" src_port="2588"/>
    </slice>
    <from sec="1086498545" usec="0"/>
    <to sec="1086498818" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="194.45.222.134"/>
      <from sec="1086498000" usec="0"/>
      <to sec="1086498736" usec="0"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498736" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_353{
style=filled;
color=gray75;
1716[label="197.30.204.130;d;83pkt 83fpkt", shape=diamond, color=yellow];
stat353[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 197.30.204.130:0}[97.5904%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (97.5904%)&lt;BR/&gt; 1798: (0.60241%)&lt;BR/&gt; 1025: (0.60241%)&lt;BR/&gt; 137: (0.60241%)&lt;BR/&gt; 135: (0.60241%)&gt;];
}
1716--1783[label="0.0120482;1pkt 1fpkt"];
1716--2258[label="0.0120482;1pkt 1fpkt"];
1716--2406[label="0.0120482;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="197.30.204.130"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="214.134.48.68"/>
      <from sec="1086498000" usec="0"/>
      <to sec="1086498825" usec="0"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498825" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="214.221.74.125"/>
      <from sec="1086498000" usec="0"/>
      <to sec="1086498827" usec="0"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498827" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="77.137.46.35"/>
      <from sec="1086498004" usec="0"/>
      <to sec="1086498827" usec="0"/>
    </slice>
    <from sec="1086498004" usec="0"/>
    <to sec="1086498827" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="214.128.89.226"/>
      <from sec="1086498005" usec="0"/>
      <to sec="1086498828" usec="0"/>
    </slice>
    <from sec="1086498005" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="176.77.227.6"/>
      <from sec="1086498287" usec="0"/>
      <to sec="1086498814" usec="0"/>
    </slice>
    <from sec="1086498287" usec="0"/>
    <to sec="1086498814" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="23.247.9.250"/>
      <from sec="1086498000" usec="0"/>
      <to sec="1086498828" usec="0"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_361{
style=filled;
color=gray75;
1442[label="196.58.166.207;s;147pkt 147fpkt", shape=diamond, color=yellow];
1802[label="77.148.98.64;d;17pkt 17fpkt", shape=diamond, color=yellow];
1825[label="196.58.175.24;s;167pkt 167fpkt", shape=diamond, color=yellow];
stat361[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.58.175.24:0, *:0}[50.4615%]&lt;BR/&gt;{196.58.166.207:0, *:0}[44.3077%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (94.5619%)&lt;BR/&gt; 445: (1.51057%)&lt;BR/&gt; 139: (1.20846%)&lt;BR/&gt; 3729: (0.302115%)&lt;BR/&gt; 3727: (0.302115%)&gt;];
}
1442--1802[label="0.176471;3pkt 3fpkt"];
1802--1825[label="0.176471;3pkt 3fpkt"];
</description>
    <slice>
      <filter src_ip="196.58.175.24"/>
      <filter src_ip="196.58.166.207"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="20.5.89.168"/>
      <from sec="1086498000" usec="0"/>
      <to sec="1086498827" usec="0"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498827" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_363{
style=filled;
color=gray75;
1810[label="173.76.149.223;d;4pkt 4fpkt", shape=diamond, color=yellow];
1811[label="215.64.1.148;s;4pkt 4fpkt", shape=diamond, color=yellow];
2291[label="215.64.1.148;s;4pkt 4fpkt", shape=hexagon, color=black];
stat363[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.64.1.148:2002, 173.76.149.223:3024}[25%]&lt;BR/&gt;{215.64.1.148:2002, 173.76.149.223:3034}[25%]&lt;BR/&gt;{215.64.1.148:3003, 173.76.149.223:3023}[25%]&lt;BR/&gt;{215.64.1.148:3003, 173.76.149.223:3033}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3003: (25%)&lt;BR/&gt; 2002: (25%)&lt;BR/&gt; 3034: (12.5%)&lt;BR/&gt; 3033: (12.5%)&lt;BR/&gt; 3024: (12.5%)&gt;];
}
1810--1811[label="1;4pkt 4fpkt"];
1810--2291[label="1;4pkt 4fpkt"];
1811--2291[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="173.76.149.223" dst_port="3033" src_ip="215.64.1.148" src_port="3003"/>
      <filter dst_ip="173.76.149.223" dst_port="3023" src_ip="215.64.1.148" src_port="3003"/>
      <filter dst_ip="173.76.149.223" dst_port="3034" src_ip="215.64.1.148" src_port="2002"/>
      <filter dst_ip="173.76.149.223" dst_port="3024" src_ip="215.64.1.148" src_port="2002"/>
    </slice>
    <from sec="1086498001" usec="0"/>
    <to sec="1086498826" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="208.66.214.170"/>
      <from sec="1086498002" usec="0"/>
      <to sec="1086498821" usec="0"/>
    </slice>
    <from sec="1086498002" usec="0"/>
    <to sec="1086498821" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_365{
style=filled;
color=gray75;
1828[label="176.77.233.147;s;83pkt 83fpkt", shape=diamond, color=yellow];
stat365[shape=component, label=&lt;Rules:&lt;BR/&gt;{176.77.233.147:*, 124.205.169.3:80}[67.4699%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.7952%)&lt;BR/&gt; 9898: (0.60241%)&lt;BR/&gt; 5554: (0.60241%)&lt;BR/&gt; 2192: (0.60241%)&lt;BR/&gt; 1870: (0.60241%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="124.205.169.3" dst_port="80" src_ip="176.77.233.147"/>
    </slice>
    <from sec="1086498007" usec="0"/>
    <to sec="1086498807" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="209.130.52.172"/>
      <from sec="1086498090" usec="0"/>
      <to sec="1086498828" usec="0"/>
    </slice>
    <from sec="1086498090" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="214.198.56.34"/>
      <from sec="1086498424" usec="0"/>
      <to sec="1086498684" usec="0"/>
    </slice>
    <from sec="1086498424" usec="0"/>
    <to sec="1086498684" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="215.73.145.181"/>
      <from sec="1086498529" usec="0"/>
      <to sec="1086498828" usec="0"/>
    </slice>
    <from sec="1086498529" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_370{
style=filled;
color=gray75;
1854[label="212.16.41.31;d;1pkt 1fpkt", shape=diamond, color=yellow];
1856[label="159.33.233.105;s;1pkt 1fpkt", shape=diamond, color=yellow];
2329[label="159.33.233.105;s;1pkt 1fpkt", shape=hexagon, color=black];
stat370[shape=component, label=&lt;Rules:&lt;BR/&gt;{159.33.233.105:53951, 212.16.41.31:5999}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53951: (50%)&lt;BR/&gt; 5999: (50%)&gt;];
}
1854--1856[label="1;1pkt 1fpkt"];
1854--2329[label="1;1pkt 1fpkt"];
1856--2329[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="212.16.41.31" dst_port="5999" src_ip="159.33.233.105" src_port="53951"/>
    </slice>
    <from sec="1086498594" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_371{
style=filled;
color=gray75;
1746[label="181.133.39.72;s;71pkt 71fpkt", shape=diamond, color=yellow];
1874[label="214.106.145.20;d;5pkt 5fpkt", shape=diamond, color=yellow];
2335[label="214.106.145.20;d;5pkt 5fpkt", shape=hexagon, color=black];
stat371[shape=component, label=&lt;Rules:&lt;BR/&gt;{181.133.39.72:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 28837: (1.85185%)&lt;BR/&gt; 24997: (1.85185%)&lt;BR/&gt; 24928: (1.85185%)&lt;BR/&gt; 24925: (1.85185%)&gt;];
}
1746--1874[label="1;5pkt 5fpkt"];
1746--2335[label="1;5pkt 5fpkt"];
1874--2335[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter src_ip="181.133.39.72" src_port="80"/>
    </slice>
    <from sec="1086498026" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="77.199.148.71"/>
      <from sec="1086498000" usec="0"/>
      <to sec="1086498828" usec="0"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="159.33.236.34"/>
      <from sec="1086498000" usec="0"/>
      <to sec="1086498828" usec="0"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="77.188.235.186"/>
      <from sec="1086498002" usec="0"/>
      <to sec="1086498826" usec="0"/>
    </slice>
    <from sec="1086498002" usec="0"/>
    <to sec="1086498826" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="214.132.114.131"/>
      <from sec="1086498002" usec="0"/>
      <to sec="1086498826" usec="0"/>
    </slice>
    <from sec="1086498002" usec="0"/>
    <to sec="1086498826" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="196.38.118.160"/>
      <from sec="1086498002" usec="0"/>
      <to sec="1086498828" usec="0"/>
    </slice>
    <from sec="1086498002" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="197.212.231.159"/>
      <from sec="1086498002" usec="0"/>
      <to sec="1086498823" usec="0"/>
    </slice>
    <from sec="1086498002" usec="0"/>
    <to sec="1086498823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_378{
style=filled;
color=gray75;
1900[label="197.30.207.145;d;219pkt 219fpkt", shape=diamond, color=yellow];
stat378[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 197.30.207.145:53}[97.2603%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (54.7945%)&lt;BR/&gt; 32768: (2.73973%)&lt;BR/&gt; 33436: (0.913242%)&lt;BR/&gt; 32774: (0.684932%)&lt;BR/&gt; 32771: (0.684932%)&gt;];
}
1900--2406[label="0.00456621;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="197.30.207.145" dst_port="53"/>
    </slice>
    <from sec="1086498008" usec="0"/>
    <to sec="1086498827" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_379{
style=filled;
color=gray75;
1901[label="153.130.30.231;d;158pkt 158fpkt", shape=diamond, color=yellow];
stat379[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:53, 153.130.30.231:3644}[92.4051%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3644: (46.2025%)&lt;BR/&gt; 53: (46.2025%)&lt;BR/&gt; 0: (6.96203%)&lt;BR/&gt; 4942: (0.316456%)&lt;BR/&gt; 135: (0.316456%)&gt;];
}
1901--3027[label="0.00632911;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="153.130.30.231" dst_port="3644" src_port="53"/>
    </slice>
    <from sec="1086498009" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,010,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_380{
style=filled;
color=gray75;
1911[label="181.192.171.212;d;292pkt 292fpkt", shape=diamond, color=yellow];
1912[label="79.224.224.177;s;292pkt 292fpkt", shape=diamond, color=yellow];
2344[label="79.224.224.177;s;292pkt 292fpkt", shape=hexagon, color=black];
stat380[shape=component, label=&lt;Rules:&lt;BR/&gt;{79.224.224.177:*, 181.192.171.212:135}[50%]&lt;BR/&gt;{79.224.224.177:*, 181.192.171.212:445}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (25%)&lt;BR/&gt; 135: (25%)&lt;BR/&gt; 29819: (0.171233%)&lt;BR/&gt; 29664: (0.171233%)&lt;BR/&gt; 29655: (0.171233%)&gt;];
}
1911--1912[label="1;292pkt 292fpkt"];
1911--2344[label="1;292pkt 292fpkt"];
1912--2344[label="1;292pkt 292fpkt"];
</description>
    <slice>
      <filter dst_ip="181.192.171.212" dst_port="445" src_ip="79.224.224.177"/>
      <filter dst_ip="181.192.171.212" dst_port="135" src_ip="79.224.224.177"/>
    </slice>
    <from sec="1086498254" usec="0"/>
    <to sec="1086498825" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="77.169.75.38"/>
      <from sec="1086498503" usec="0"/>
      <to sec="1086498828" usec="0"/>
    </slice>
    <from sec="1086498503" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="197.148.15.228"/>
      <from sec="1086498612" usec="0"/>
      <to sec="1086498828" usec="0"/>
    </slice>
    <from sec="1086498612" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_383{
style=filled;
color=gray75;
1615[label="159.33.221.164;s;301pkt 301fpkt", shape=diamond, color=yellow];
1793[label="2.102.13.44;d;160pkt 160fpkt", shape=diamond, color=yellow];
1921[label="197.0.186.226;d;2pkt 2fpkt", shape=diamond, color=yellow];
2129[label="159.33.221.164;s;301pkt 301fpkt", shape=hexagon, color=black];
stat383[shape=component, label=&lt;Rules:&lt;BR/&gt;{159.33.221.164:80, 2.102.13.44:*}[65.5629%]&lt;BR/&gt;{159.33.221.164:80, 213.165.88.25:*}[28.8079%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.9346%)&lt;BR/&gt; 58374: (0.196335%)&lt;BR/&gt; 58282: (0.196335%)&lt;BR/&gt; 2181: (0.196335%)&lt;BR/&gt; 2180: (0.196335%)&gt;];
}
1615--1793[label="0.99375;159pkt 159fpkt"];
1615--1921[label="1;2pkt 2fpkt"];
1615--2129[label="1;301pkt 301fpkt"];
1793--2129[label="0.99375;159pkt 159fpkt"];
1921--2129[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="2.102.13.44" src_ip="159.33.221.164" src_port="80"/>
      <filter dst_ip="213.165.88.25" src_ip="159.33.221.164" src_port="80"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498827" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.618539,1.46163,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="77.196.160.190"/>
      <from sec="1086498766" usec="0"/>
      <to sec="1086498827" usec="0"/>
    </slice>
    <from sec="1086498766" usec="0"/>
    <to sec="1086498827" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757235,1.41804,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_387{
style=filled;
color=gray75;
1174[label="176.77.250.99;s;78pkt 78fpkt", shape=diamond, color=yellow];
1965[label="176.77.250.99;s;78pkt 78fpkt", shape=hexagon, color=black];
2772[label="176.77.250.99;79pkt 79fpkt", shape=pentagon, color=darkviolet];
stat387[shape=component, label=&lt;Rules:&lt;BR/&gt;{176.77.250.99:80, 218.70.105.136:*}[41.7722%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 46901: (0.638298%)&lt;BR/&gt; 45913: (0.638298%)&lt;BR/&gt; 35121: (0.638298%)&lt;BR/&gt; 34968: (0.638298%)&gt;];
}
1174--1965[label="1;78pkt 78fpkt"];
1174--2772[label="1;78pkt 78fpkt"];
1965--2772[label="1;78pkt 78fpkt"];
</description>
    <slice>
      <filter dst_ip="218.70.105.136" src_ip="176.77.250.99" src_port="80"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498897" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_388{
style=filled;
color=gray75;
1090[label="173.76.150.11;s;5pkt 5fpkt", shape=diamond, color=yellow];
1966[label="173.76.150.11;s;5pkt 5fpkt", shape=hexagon, color=black];
stat388[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.76.150.11:1914, 193.180.121.39:80}[20%]&lt;BR/&gt;{173.76.150.11:1032, 193.52.2.90:1863}[20%]&lt;BR/&gt;{173.76.150.11:1881, 214.221.40.127:80}[20%]&lt;BR/&gt;{173.76.150.11:1917, 6.153.139.186:80}[20%]&lt;BR/&gt;{173.76.150.11:1918, 6.153.139.186:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (40%)&lt;BR/&gt; 1918: (10%)&lt;BR/&gt; 1917: (10%)&lt;BR/&gt; 1914: (10%)&lt;BR/&gt; 1881: (10%)&gt;];
}
1090--1966[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="6.153.139.186" dst_port="80" src_ip="173.76.150.11" src_port="1918"/>
      <filter dst_ip="6.153.139.186" dst_port="80" src_ip="173.76.150.11" src_port="1917"/>
      <filter dst_ip="214.221.40.127" dst_port="80" src_ip="173.76.150.11" src_port="1881"/>
      <filter dst_ip="193.52.2.90" dst_port="1863" src_ip="173.76.150.11" src_port="1032"/>
      <filter dst_ip="193.180.121.39" dst_port="80" src_ip="173.76.150.11" src_port="1914"/>
    </slice>
    <from sec="1086498008" usec="0"/>
    <to sec="1086498827" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_389{
style=filled;
color=gray75;
929[label="192.54.140.250;s;95pkt 95fpkt", shape=diamond, color=yellow];
930[label="176.77.31.214;d;89pkt 89fpkt", shape=diamond, color=yellow];
1972[label="176.77.31.214;d;48pkt 48fpkt", shape=hexagon, color=black];
2261[label="192.54.140.250;s;88pkt 88fpkt", shape=hexagon, color=black];
stat389[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.54.140.250:80, 176.77.31.214:*}[98.9583%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.8438%)&lt;BR/&gt; 4750: (0.625%)&lt;BR/&gt; 4617: (0.625%)&lt;BR/&gt; 2263: (0.625%)&lt;BR/&gt; 2262: (0.625%)&gt;];
}
929--930[label="0.988764;88pkt 88fpkt"];
929--1972[label="1;48pkt 48fpkt"];
929--2261[label="1;88pkt 88fpkt"];
930--1972[label="1;48pkt 48fpkt"];
930--2261[label="1;88pkt 88fpkt"];
1972--2261[label="1;48pkt 48fpkt"];
</description>
    <slice>
      <filter dst_ip="176.77.31.214" src_ip="192.54.140.250" src_port="80"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_390{
style=filled;
color=gray75;
1175[label="214.154.104.238;s;535pkt 535fpkt", shape=diamond, color=yellow];
1983[label="214.154.104.238;s;535pkt 535fpkt", shape=hexagon, color=black];
stat390[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.154.104.238:*, *:1026}[52.5234%]&lt;BR/&gt;{214.154.104.238:*, *:1027}[47.4766%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (26.2617%)&lt;BR/&gt; 1027: (23.7383%)&lt;BR/&gt; 4975: (0.280374%)&lt;BR/&gt; 4689: (0.186916%)&lt;BR/&gt; 4635: (0.186916%)&gt;];
}
1175--1983[label="1;535pkt 535fpkt"];
</description>
    <slice>
      <filter dst_port="1026" src_ip="214.154.104.238"/>
      <filter dst_port="1027" src_ip="214.154.104.238"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498189" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_391{
style=filled;
color=gray75;
1184[label="159.33.221.168;s;84pkt 84fpkt", shape=diamond, color=yellow];
1985[label="159.33.221.168;s;54pkt 54fpkt", shape=hexagon, color=black];
stat391[shape=component, label=&lt;Rules:&lt;BR/&gt;{159.33.221.168:80, 219.194.35.24:*}[22.619%]&lt;BR/&gt;{159.33.221.168:80, 5.2.10.102:*}[21.4286%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.5507%)&lt;BR/&gt; 25: (1.44928%)&lt;BR/&gt; 63245: (0.724638%)&lt;BR/&gt; 63040: (0.724638%)&lt;BR/&gt; 62832: (0.724638%)&gt;];
}
1184--1985[label="1;54pkt 54fpkt"];
</description>
    <slice>
      <filter dst_ip="219.194.35.24" src_ip="159.33.221.168" src_port="80"/>
      <filter dst_ip="5.2.10.102" src_ip="159.33.221.168" src_port="80"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498738" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_392{
style=filled;
color=gray75;
1336[label="200.129.210.149;s;634pkt 634fpkt", shape=diamond, color=yellow];
1986[label="200.129.210.149;s;634pkt 634fpkt", shape=hexagon, color=black];
stat392[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.129.210.149:53, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (50%)&lt;BR/&gt; 1074: (0.315457%)&lt;BR/&gt; 1055: (0.315457%)&lt;BR/&gt; 1337: (0.236593%)&lt;BR/&gt; 1178: (0.236593%)&gt;];
}
1336--1986[label="1;634pkt 634fpkt"];
</description>
    <slice>
      <filter src_ip="200.129.210.149" src_port="53"/>
    </slice>
    <from sec="1086498001" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.833275,1.40558,999,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_395{
style=filled;
color=gray75;
971[label="159.33.151.61;s;13pkt 13fpkt", shape=diamond, color=yellow];
972[label="197.32.16.3;d;8pkt 8fpkt", shape=diamond, color=yellow];
1195[label="159.33.224.133;s;122pkt 122fpkt", shape=diamond, color=yellow];
1395[label="201.248.160.23;d;26pkt 26fpkt", shape=diamond, color=yellow];
1396[label="153.130.33.134;s;20pkt 20fpkt", shape=diamond, color=yellow];
1424[label="159.33.224.130;s;211pkt 211fpkt", shape=diamond, color=yellow];
1649[label="178.2.58.166;d;146pkt 146fpkt", shape=diamond, color=yellow];
2008[label="197.32.16.3;d;8pkt 8fpkt", shape=hexagon, color=black];
2053[label="159.33.151.61;s;13pkt 13fpkt", shape=hexagon, color=black];
2309[label="178.2.58.166;d;136pkt 136fpkt", shape=hexagon, color=black];
2475[label="159.33.151.14;11pkt 11fpkt", shape=pentagon, color=darkviolet];
2654[label="159.33.151.61;18pkt 18fpkt", shape=pentagon, color=darkviolet];
2961[label="159.33.221.165;43pkt 43fpkt", shape=pentagon, color=darkviolet];
3221[label="159.33.151.14;10pkt 10fpkt", shape=invtriangle, color=brown];
stat395[shape=component, label=&lt;Rules:&lt;BR/&gt;{159.33.224.130:25, *:*}[42.5403%]&lt;BR/&gt;{*:25, 178.2.58.166:*}[30.2419%]&lt;BR/&gt;{159.33.224.133:*, *:*}[24.5968%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (43.758%)&lt;BR/&gt; 80: (5.03185%)&lt;BR/&gt; 3461: (0.509554%)&lt;BR/&gt; 113: (0.509554%)&lt;BR/&gt; 0: (0.509554%)&gt;];
}
971--972[label="1;8pkt 8fpkt"];
971--1395[label="0.0769231;1pkt 1fpkt"];
971--2008[label="1;8pkt 8fpkt"];
971--2053[label="1;13pkt 13fpkt"];
971--2654[label="1;13pkt 13fpkt"];
972--2008[label="1;8pkt 8fpkt"];
972--2053[label="1;8pkt 8fpkt"];
972--2654[label="1;8pkt 8fpkt"];
1195--1395[label="0.0384615;1pkt 1fpkt"];
1195--1637[label="0.00819672;1pkt 1fpkt"];
1195--1649[label="0.229508;28pkt 28fpkt"];
1195--2309[label="0.213115;26pkt 26fpkt"];
1395--1396[label="1;20pkt 20fpkt"];
1395--1424[label="0.0384615;1pkt 1fpkt"];
1395--2053[label="0.0769231;1pkt 1fpkt"];
1395--2475[label="0.0909091;1pkt 1fpkt"];
1395--2654[label="0.0555556;1pkt 1fpkt"];
1395--3221[label="0.1;1pkt 1fpkt"];
1424--1649[label="0.150685;22pkt 22fpkt"];
1424--2309[label="0.139706;19pkt 19fpkt"];
1649--2309[label="1;136pkt 136fpkt"];
1649--2961[label="0.627907;27pkt 27fpkt"];
2008--2053[label="1;8pkt 8fpkt"];
2008--2654[label="1;8pkt 8fpkt"];
2053--2654[label="1;13pkt 13fpkt"];
2309--2961[label="0.581395;25pkt 25fpkt"];
2475--3221[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter src_ip="159.33.224.133"/>
      <filter src_ip="159.33.224.130" src_port="25"/>
      <filter dst_ip="178.2.58.166" src_port="25"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498891" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757235,1.41804,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_396{
style=filled;
color=gray75;
1310[label="220.179.151.119;d;1pkt 1fpkt", shape=diamond, color=yellow];
1311[label="173.76.111.168;s;17pkt 17fpkt", shape=diamond, color=yellow];
2012[label="220.179.151.119;d;1pkt 1fpkt", shape=hexagon, color=black];
2272[label="173.76.111.168;s;17pkt 17fpkt", shape=hexagon, color=black];
2968[label="173.76.111.168;18pkt 18fpkt", shape=pentagon, color=darkviolet];
stat396[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.76.111.168:*, 193.162.78.218:80}[94.7368%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.2963%)&lt;BR/&gt; 2539: (3.7037%)&lt;BR/&gt; 2026: (3.7037%)&lt;BR/&gt; 2601: (2.77778%)&lt;BR/&gt; 2600: (2.77778%)&gt;];
}
1310--1311[label="1;1pkt 1fpkt"];
1310--2012[label="1;1pkt 1fpkt"];
1310--2272[label="1;1pkt 1fpkt"];
1311--2012[label="1;1pkt 1fpkt"];
1311--2272[label="1;17pkt 17fpkt"];
1311--2968[label="0.941176;16pkt 16fpkt"];
2012--2272[label="1;1pkt 1fpkt"];
2272--2968[label="0.941176;16pkt 16fpkt"];
</description>
    <slice>
      <filter dst_ip="193.162.78.218" dst_port="80" src_ip="173.76.111.168"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_397{
style=filled;
color=gray75;
1317[label="214.145.9.244;s;1651pkt 1651fpkt", shape=diamond, color=yellow];
2014[label="214.145.9.244;s;751pkt 751fpkt", shape=hexagon, color=black];
stat397[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.145.9.244:*, *:1027}[50.7571%]&lt;BR/&gt;{214.145.9.244:*, *:1026}[49.2429%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (25.3539%)&lt;BR/&gt; 1026: (24.6461%)&lt;BR/&gt; 4597: (0.124896%)&lt;BR/&gt; 2399: (0.124896%)&lt;BR/&gt; 4972: (0.10408%)&gt;];
}
1317--2014[label="1;751pkt 751fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="214.145.9.244"/>
      <filter dst_port="1026" src_ip="214.145.9.244"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,504,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_400{
style=filled;
color=gray75;
1365[label="7.80.200.110;s;15pkt 15fpkt", shape=diamond, color=yellow];
2026[label="7.80.200.110;s;15pkt 15fpkt", shape=hexagon, color=black];
stat400[shape=component, label=&lt;Rules:&lt;BR/&gt;{7.80.200.110:80, *:*}[53.3333%]&lt;BR/&gt;{7.80.200.110:443, *:*}[46.6667%]&lt;BR/&gt;{7.80.200.110:*, 176.77.116.15:*}[26.6667%]&lt;BR/&gt;{7.80.200.110:*, 173.76.131.17:*}[26.6667%]&lt;BR/&gt;{7.80.200.110:*, 181.133.33.153:*}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (26.6667%)&lt;BR/&gt; 443: (23.3333%)&lt;BR/&gt; 50996: (3.33333%)&lt;BR/&gt; 50991: (3.33333%)&lt;BR/&gt; 50989: (3.33333%)&gt;];
}
1365--2026[label="1;15pkt 15fpkt"];
</description>
    <slice>
      <filter dst_ip="173.76.131.17" src_ip="7.80.200.110"/>
      <filter dst_ip="176.77.116.15" src_ip="7.80.200.110"/>
      <filter dst_ip="181.133.33.153" src_ip="7.80.200.110"/>
      <filter src_ip="7.80.200.110" src_port="80"/>
      <filter src_ip="7.80.200.110" src_port="443"/>
    </slice>
    <from sec="1086498014" usec="0"/>
    <to sec="1086498530" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_404{
style=filled;
color=gray75;
1138[label="200.33.131.174;s;114pkt 114fpkt", shape=diamond, color=yellow];
2051[label="200.33.131.174;s;114pkt 114fpkt", shape=hexagon, color=black];
stat404[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.33.131.174:0, *:0}[99.1228%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.1228%)&lt;BR/&gt; 5554: (0.438596%)&lt;BR/&gt; 4001: (0.438596%)&gt;];
}
1138--2051[label="1;114pkt 114fpkt"];
</description>
    <slice>
      <filter src_ip="200.33.131.174"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498827" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_405{
style=filled;
color=gray75;
1500[label="196.58.183.68;d;437pkt 437fpkt", shape=diamond, color=yellow];
2052[label="196.58.183.68;d;310pkt 310fpkt", shape=hexagon, color=black];
stat405[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 196.58.183.68:53}[99.3135%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (55.0201%)&lt;BR/&gt; 32768: (2.27577%)&lt;BR/&gt; 32769: (1.47256%)&lt;BR/&gt; 1053: (1.33869%)&lt;BR/&gt; 0: (0.535475%)&gt;];
}
1500--2052[label="1;310pkt 310fpkt"];
1500--2107[label="0.00581395;1pkt 1fpkt"];
1500--2388[label="0.00581395;1pkt 1fpkt"];
1500--2530[label="0.00442478;1pkt 1fpkt"];
1500--2949[label="0.0052356;1pkt 1fpkt"];
1500--3382[label="0.0044843;1pkt 1fpkt"];
1500--3490[label="0.0052356;1pkt 1fpkt"];
1500--3535[label="0.00518135;1pkt 1fpkt"];
1500--3834[label="0.00518135;1pkt 1fpkt"];
2052--2530[label="0.00442478;1pkt 1fpkt"];
2052--3535[label="0.00518135;1pkt 1fpkt"];
2052--3834[label="0.00518135;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="196.58.183.68" dst_port="53"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498648" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_406{
style=filled;
color=gray75;
1412[label="176.77.79.174;s;799pkt 799fpkt", shape=diamond, color=yellow];
2056[label="176.77.79.174;s;799pkt 799fpkt", shape=hexagon, color=black];
stat406[shape=component, label=&lt;Rules:&lt;BR/&gt;{176.77.79.174:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1412--2056[label="1;799pkt 799fpkt"];
</description>
    <slice>
      <filter src_ip="176.77.79.174"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498827" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_407{
style=filled;
color=gray75;
1285[label="153.130.4.129;s;174pkt 174fpkt", shape=diamond, color=yellow];
2060[label="153.130.4.129;s;165pkt 165fpkt", shape=hexagon, color=black];
stat407[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.130.4.129:*, 221.116.112.180:80}[28.7356%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2489: (0.294985%)&lt;BR/&gt; 2454: (0.294985%)&lt;BR/&gt; 2451: (0.294985%)&lt;BR/&gt; 2446: (0.294985%)&gt;];
}
1285--2060[label="1;165pkt 165fpkt"];
</description>
    <slice>
      <filter dst_ip="221.116.112.180" dst_port="80" src_ip="153.130.4.129"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_408{
style=filled;
color=gray75;
1154[label="200.129.210.144;s;550pkt 550fpkt", shape=diamond, color=yellow];
2064[label="200.129.210.144;s;364pkt 364fpkt", shape=hexagon, color=black];
stat408[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.129.210.144:53, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (50%)&lt;BR/&gt; 1062: (0.328228%)&lt;BR/&gt; 1181: (0.273523%)&lt;BR/&gt; 1073: (0.273523%)&lt;BR/&gt; 4956: (0.218818%)&gt;];
}
1154--2064[label="1;364pkt 364fpkt"];
</description>
    <slice>
      <filter src_ip="200.129.210.144" src_port="53"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498738" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_409{
style=filled;
color=gray75;
1306[label="159.33.56.114;s;462pkt 462fpkt", shape=diamond, color=yellow];
2074[label="159.33.56.114;s;385pkt 385fpkt", shape=hexagon, color=black];
stat409[shape=component, label=&lt;Rules:&lt;BR/&gt;{159.33.56.114:53, *:*}[96.9697%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (51.1806%)&lt;BR/&gt; 9253: (2.95159%)&lt;BR/&gt; 25: (1.2987%)&lt;BR/&gt; 32768: (0.826446%)&lt;BR/&gt; 1024: (0.767414%)&gt;];
}
1306--2074[label="1;385pkt 385fpkt"];
1306--2406[label="0.0021645;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="159.33.56.114" src_port="53"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_411{
style=filled;
color=gray75;
1042[label="212.3.122.145;s;3pkt 3fpkt", shape=diamond, color=yellow];
1177[label="173.76.150.178;d;3pkt 3fpkt", shape=diamond, color=yellow];
1205[label="173.76.151.2;d;4pkt 4fpkt", shape=diamond, color=yellow];
1422[label="212.3.122.157;s;1pkt 1fpkt", shape=diamond, color=yellow];
1989[label="173.76.151.2;d;4pkt 4fpkt", shape=hexagon, color=black];
2080[label="212.3.122.145;s;3pkt 3fpkt", shape=hexagon, color=black];
stat411[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.3.122.145:5100, 173.76.151.2:*}[28.5714%]&lt;BR/&gt;{*:5100, 173.76.150.178:*}[28.5714%]&lt;BR/&gt;{*:5050, *:*}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5100: (41.6667%)&lt;BR/&gt; 3082: (11.1111%)&lt;BR/&gt; 3075: (11.1111%)&lt;BR/&gt; 5050: (8.33333%)&lt;BR/&gt; 1698: (8.33333%)&gt;];
}
1042--1177[label="0.333333;1pkt 1fpkt"];
1042--1205[label="0.666667;2pkt 2fpkt"];
1042--1989[label="0.666667;2pkt 2fpkt"];
1042--2080[label="1;3pkt 3fpkt"];
1177--1422[label="1;1pkt 1fpkt"];
1177--2080[label="0.333333;1pkt 1fpkt"];
1205--1989[label="1;4pkt 4fpkt"];
1205--2080[label="0.666667;2pkt 2fpkt"];
1989--2080[label="0.666667;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_port="5050"/>
      <filter dst_ip="173.76.150.178" src_port="5100"/>
      <filter dst_ip="173.76.151.2" src_ip="212.3.122.145" src_port="5100"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757235,1.41804,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_412{
style=filled;
color=gray75;
1433[label="77.137.50.211;s;1008pkt 1008fpkt", shape=diamond, color=yellow];
2086[label="77.137.50.211;s;764pkt 764fpkt", shape=hexagon, color=black];
3084[label="77.137.50.211;1101pkt 1101fpkt", shape=pentagon, color=darkviolet];
stat412[shape=component, label=&lt;Rules:&lt;BR/&gt;{77.137.50.211:*, *:1027}[50.3179%]&lt;BR/&gt;{77.137.50.211:*, *:1026}[49.6821%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (25.0261%)&lt;BR/&gt; 1027: (24.9739%)&lt;BR/&gt; 4014: (0.191438%)&lt;BR/&gt; 3869: (0.191438%)&lt;BR/&gt; 3113: (0.191438%)&gt;];
}
1433--2086[label="1;764pkt 764fpkt"];
1433--3084[label="1;1008pkt 1008fpkt"];
2086--3084[label="1;764pkt 764fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="77.137.50.211"/>
      <filter dst_port="1026" src_ip="77.137.50.211"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757235,1.41804,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_413{
style=filled;
color=gray75;
1198[label="77.178.49.65;s;1293pkt 1293fpkt", shape=diamond, color=yellow];
2088[label="77.178.49.65;s;1293pkt 1293fpkt", shape=hexagon, color=black];
2670[label="77.178.49.65;1292pkt 1292fpkt", shape=pentagon, color=darkviolet];
stat413[shape=component, label=&lt;Rules:&lt;BR/&gt;{77.178.49.65:*, *:1027}[50.9667%]&lt;BR/&gt;{77.178.49.65:*, *:1026}[49.0333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (25.4899%)&lt;BR/&gt; 1026: (24.5101%)&lt;BR/&gt; 4544: (0.116039%)&lt;BR/&gt; 4080: (0.116039%)&lt;BR/&gt; 3926: (0.116039%)&gt;];
}
1198--2088[label="1;1293pkt 1293fpkt"];
1198--2670[label="1;1292pkt 1292fpkt"];
2088--2670[label="1;1292pkt 1292fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="77.178.49.65"/>
      <filter dst_port="1026" src_ip="77.178.49.65"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498432" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_414{
style=filled;
color=gray75;
1545[label="200.48.220.37;s;388pkt 388fpkt", shape=diamond, color=yellow];
2090[label="200.48.220.37;s;253pkt 253fpkt", shape=hexagon, color=black];
stat414[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.48.220.37:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1545--2090[label="1;253pkt 253fpkt"];
</description>
    <slice>
      <filter src_ip="200.48.220.37"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498738" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_415{
style=filled;
color=gray75;
1440[label="77.138.140.79;s;651pkt 651fpkt", shape=diamond, color=yellow];
2093[label="77.138.140.79;s;651pkt 651fpkt", shape=hexagon, color=black];
stat415[shape=component, label=&lt;Rules:&lt;BR/&gt;{77.138.140.79:*, *:1027}[51.3057%]&lt;BR/&gt;{77.138.140.79:*, *:1026}[48.6943%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (25.6528%)&lt;BR/&gt; 1026: (24.3472%)&lt;BR/&gt; 2513: (0.230415%)&lt;BR/&gt; 1849: (0.230415%)&lt;BR/&gt; 1424: (0.230415%)&gt;];
}
1440--2093[label="1;651pkt 651fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="77.138.140.79"/>
      <filter dst_port="1026" src_ip="77.138.140.79"/>
    </slice>
    <from sec="1086498001" usec="0"/>
    <to sec="1086498449" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_416{
style=filled;
color=gray75;
1549[label="214.154.43.93;s;1038pkt 1038fpkt", shape=diamond, color=yellow];
2096[label="214.154.43.93;s;599pkt 599fpkt", shape=hexagon, color=black];
stat416[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.154.43.93:*, *:1027}[50%]&lt;BR/&gt;{214.154.43.93:*, *:1026}[49.9037%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (25.0153%)&lt;BR/&gt; 1026: (24.9236%)&lt;BR/&gt; 3382: (0.183262%)&lt;BR/&gt; 1145: (0.183262%)&lt;BR/&gt; 3515: (0.152718%)&gt;];
}
1549--2096[label="1;599pkt 599fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="214.154.43.93"/>
      <filter dst_port="1026" src_ip="214.154.43.93"/>
    </slice>
    <from sec="1086498001" usec="0"/>
    <to sec="1086498824" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_417{
style=filled;
color=gray75;
1204[label="77.142.47.34;s;2105pkt 2105fpkt", shape=diamond, color=yellow];
2097[label="77.142.47.34;s;1630pkt 1630fpkt", shape=hexagon, color=black];
stat417[shape=component, label=&lt;Rules:&lt;BR/&gt;{77.142.47.34:*, *:1026}[50.0238%]&lt;BR/&gt;{77.142.47.34:*, *:1027}[49.9762%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (25.0067%)&lt;BR/&gt; 1027: (24.9933%)&lt;BR/&gt; 1533: (0.120482%)&lt;BR/&gt; 3389: (0.107095%)&lt;BR/&gt; 2320: (0.107095%)&gt;];
}
1204--2097[label="1;1630pkt 1630fpkt"];
</description>
    <slice>
      <filter dst_port="1026" src_ip="77.142.47.34"/>
      <filter dst_port="1027" src_ip="77.142.47.34"/>
    </slice>
    <from sec="1086498001" usec="0"/>
    <to sec="1086498738" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_420{
style=filled;
color=gray75;
937[label="153.130.179.179;d;1056pkt 1056fpkt", shape=diamond, color=yellow];
1147[label="5.74.26.223;s;839pkt 839fpkt", shape=diamond, color=yellow];
1273[label="212.211.213.87;s;214pkt 214fpkt", shape=diamond, color=yellow];
2061[label="5.74.26.223;s;474pkt 474fpkt", shape=hexagon, color=black];
2131[label="212.211.213.87;s;144pkt 144fpkt", shape=hexagon, color=black];
stat420[shape=component, label=&lt;Rules:&lt;BR/&gt;{5.74.26.223:80, 153.130.179.179:*}[79.4508%]&lt;BR/&gt;{212.211.213.87:80, 153.130.179.179:*}[20.2652%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.9817%)&lt;BR/&gt; 36230: (0.0550055%)&lt;BR/&gt; 36225: (0.0550055%)&lt;BR/&gt; 36220: (0.0550055%)&lt;BR/&gt; 36215: (0.0550055%)&gt;];
}
937--1007[label="0.00094697;1pkt 1fpkt"];
937--1147[label="1;839pkt 839fpkt"];
937--1273[label="1;214pkt 214fpkt"];
937--2061[label="1;474pkt 474fpkt"];
937--2131[label="1;144pkt 144fpkt"];
1147--2061[label="1;474pkt 474fpkt"];
1273--2131[label="1;144pkt 144fpkt"];
</description>
    <slice>
      <filter dst_ip="153.130.179.179" src_ip="5.74.26.223" src_port="80"/>
      <filter dst_ip="153.130.179.179" src_ip="212.211.213.87" src_port="80"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757235,1.41804,020,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_422{
style=filled;
color=gray75;
1312[label="197.30.204.130;s;250pkt 250fpkt", shape=diamond, color=yellow];
2152[label="197.30.204.130;s;238pkt 238fpkt", shape=hexagon, color=black];
2863[label="197.30.204.130;251pkt 251fpkt", shape=pentagon, color=darkviolet];
stat422[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.30.204.130:0, *:0}[98.8048%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (98.7821%)&lt;BR/&gt; 445: (0.405954%)&lt;BR/&gt; 4710: (0.202977%)&lt;BR/&gt; 3365: (0.202977%)&lt;BR/&gt; 1798: (0.202977%)&gt;];
}
1312--1581[label="0.008;2pkt 2fpkt"];
1312--1917[label="0.004;1pkt 1fpkt"];
1312--2152[label="1;238pkt 238fpkt"];
1312--2863[label="1;250pkt 250fpkt"];
2152--2863[label="1;238pkt 238fpkt"];
</description>
    <slice>
      <filter src_ip="197.30.204.130"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_424{
style=filled;
color=gray75;
1527[label="214.198.98.138;s;994pkt 994fpkt", shape=diamond, color=yellow];
2158[label="214.198.98.138;s;665pkt 665fpkt", shape=hexagon, color=black];
stat424[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.198.98.138:*, *:1026}[51.2072%]&lt;BR/&gt;{214.198.98.138:*, *:1027}[48.7928%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (25.7083%)&lt;BR/&gt; 1027: (24.2917%)&lt;BR/&gt; 4311: (0.180832%)&lt;BR/&gt; 2630: (0.180832%)&lt;BR/&gt; 1553: (0.180832%)&gt;];
}
1527--2158[label="1;665pkt 665fpkt"];
</description>
    <slice>
      <filter dst_port="1026" src_ip="214.198.98.138"/>
      <filter dst_port="1027" src_ip="214.198.98.138"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498825" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_425{
style=filled;
color=gray75;
1193[label="77.171.243.189;s;2413pkt 2413fpkt", shape=diamond, color=yellow];
2161[label="77.171.243.189;s;2413pkt 2413fpkt", shape=hexagon, color=black];
stat425[shape=component, label=&lt;Rules:&lt;BR/&gt;{77.171.243.189:*, *:1027}[50.518%]&lt;BR/&gt;{77.171.243.189:*, *:1026}[49.482%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (25.2797%)&lt;BR/&gt; 1026: (24.741%)&lt;BR/&gt; 3418: (0.124327%)&lt;BR/&gt; 3840: (0.103605%)&lt;BR/&gt; 1929: (0.103605%)&gt;];
}
1193--2161[label="1;2413pkt 2413fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="77.171.243.189"/>
      <filter dst_port="1026" src_ip="77.171.243.189"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_428{
style=filled;
color=gray75;
1089[label="173.76.150.11;d;2pkt 2fpkt", shape=diamond, color=yellow];
2170[label="173.76.150.11;d;2pkt 2fpkt", shape=hexagon, color=black];
stat428[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.52.2.90:1863, 173.76.150.11:1032}[50%]&lt;BR/&gt;{214.221.40.127:80, 173.76.150.11:1881}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1881: (25%)&lt;BR/&gt; 1863: (25%)&lt;BR/&gt; 1032: (25%)&lt;BR/&gt; 80: (25%)&gt;];
}
1089--2170[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="173.76.150.11" dst_port="1881" src_ip="214.221.40.127" src_port="80"/>
      <filter dst_ip="173.76.150.11" dst_port="1032" src_ip="193.52.2.90" src_port="1863"/>
    </slice>
    <from sec="1086498008" usec="0"/>
    <to sec="1086498827" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757235,1.41804,504,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_430{
style=filled;
color=gray75;
1568[label="181.133.88.72;d;38pkt 38fpkt", shape=diamond, color=yellow];
2176[label="181.133.88.72;d;38pkt 38fpkt", shape=hexagon, color=black];
2626[label="152.100.56.55;10pkt 10fpkt", shape=pentagon, color=darkviolet];
2884[label="7.80.194.137;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat430[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.117.76.140:443, 181.133.88.72:*}[39.4737%]&lt;BR/&gt;{152.100.56.55:80, 181.133.88.72:*}[26.3158%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (32.7586%)&lt;BR/&gt; 443: (17.2414%)&lt;BR/&gt; 4541: (1.72414%)&lt;BR/&gt; 4540: (1.72414%)&lt;BR/&gt; 4524: (1.72414%)&gt;];
}
1568--2176[label="1;38pkt 38fpkt"];
1568--2626[label="1;10pkt 10fpkt"];
1568--2884[label="1;1pkt 1fpkt"];
2176--2626[label="1;10pkt 10fpkt"];
2176--2884[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="181.133.88.72" src_ip="172.117.76.140" src_port="443"/>
      <filter dst_ip="181.133.88.72" src_ip="152.100.56.55" src_port="80"/>
    </slice>
    <from sec="1086498018" usec="0"/>
    <to sec="1086498587" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_432{
style=filled;
color=gray75;
1620[label="200.33.131.6;s;126pkt 126fpkt", shape=diamond, color=yellow];
2208[label="200.33.131.6;s;113pkt 113fpkt", shape=hexagon, color=black];
stat432[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.33.131.6:0, *:0}[99.2063%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.1632%)&lt;BR/&gt; 5554: (0.41841%)&lt;BR/&gt; 3722: (0.41841%)&gt;];
}
1620--2208[label="1;113pkt 113fpkt"];
</description>
    <slice>
      <filter src_ip="200.33.131.6"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498826" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_433{
style=filled;
color=gray75;
1719[label="215.90.0.131;s;671pkt 671fpkt", shape=diamond, color=yellow];
2213[label="215.90.0.131;s;602pkt 602fpkt", shape=hexagon, color=black];
stat433[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.90.0.131:*, *:1026}[50.2235%]&lt;BR/&gt;{215.90.0.131:*, *:1027}[49.7765%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (25.1375%)&lt;BR/&gt; 1027: (24.8625%)&lt;BR/&gt; 3750: (0.235664%)&lt;BR/&gt; 4686: (0.196386%)&lt;BR/&gt; 1307: (0.196386%)&gt;];
}
1719--2213[label="1;602pkt 602fpkt"];
</description>
    <slice>
      <filter dst_port="1026" src_ip="215.90.0.131"/>
      <filter dst_port="1027" src_ip="215.90.0.131"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498826" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_434{
style=filled;
color=gray75;
1529[label="196.58.172.45;d;417pkt 417fpkt", shape=diamond, color=yellow];
2215[label="196.58.172.45;d;417pkt 417fpkt", shape=hexagon, color=black];
stat434[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 196.58.172.45:53}[96.1631%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (54.1966%)&lt;BR/&gt; 32768: (2.8777%)&lt;BR/&gt; 1024: (1.55875%)&lt;BR/&gt; 65534: (1.31894%)&lt;BR/&gt; 32769: (1.31894%)&gt;];
}
1529--2215[label="1;417pkt 417fpkt"];
1529--2530[label="0.00442478;1pkt 1fpkt"];
1529--3535[label="0.00518135;1pkt 1fpkt"];
1529--3834[label="0.00518135;1pkt 1fpkt"];
2215--2530[label="0.00442478;1pkt 1fpkt"];
2215--3535[label="0.00518135;1pkt 1fpkt"];
2215--3834[label="0.00518135;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="196.58.172.45" dst_port="53"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498738" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_435{
style=filled;
color=gray75;
1535[label="208.30.222.103;s;1608pkt 1608fpkt", shape=diamond, color=yellow];
2218[label="208.30.222.103;s;1608pkt 1608fpkt", shape=hexagon, color=black];
stat435[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.30.222.103:1051, *:1434}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1434: (50%)&lt;BR/&gt; 1051: (50%)&gt;];
}
1535--2218[label="1;1608pkt 1608fpkt"];
</description>
    <slice>
      <filter dst_port="1434" src_ip="208.30.222.103" src_port="1051"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498738" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_436{
style=filled;
color=gray75;
1728[label="197.30.204.138;s;148pkt 148fpkt", shape=diamond, color=yellow];
2224[label="197.30.204.138;s;143pkt 143fpkt", shape=hexagon, color=black];
stat436[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.30.204.138:0, *:0}[99.3243%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.3127%)&lt;BR/&gt; 3342: (0.343643%)&lt;BR/&gt; 445: (0.343643%)&gt;];
}
1728--1917[label="0.00675676;1pkt 1fpkt"];
1728--2224[label="1;143pkt 143fpkt"];
</description>
    <slice>
      <filter src_ip="197.30.204.138"/>
    </slice>
    <from sec="1086498001" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_437{
style=filled;
color=gray75;
1076[label="173.76.93.81;s;108pkt 108fpkt", shape=diamond, color=yellow];
2226[label="173.76.93.81;s;99pkt 99fpkt", shape=hexagon, color=black];
stat437[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.76.93.81:10000, *:10000}[60.1852%]&lt;BR/&gt;{173.76.93.81:*, 172.25.182.1:1199}[39.8148%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 10000: (62.8019%)&lt;BR/&gt; 1199: (18.599%)&lt;BR/&gt; 55687: (0.483092%)&lt;BR/&gt; 55685: (0.483092%)&lt;BR/&gt; 55684: (0.483092%)&gt;];
}
1076--2226[label="1;99pkt 99fpkt"];
</description>
    <slice>
      <filter dst_ip="172.25.182.1" dst_port="1199" src_ip="173.76.93.81"/>
      <filter dst_port="10000" src_ip="173.76.93.81" src_port="10000"/>
    </slice>
    <from sec="1086498001" usec="0"/>
    <to sec="1086498824" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757235,1.41804,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_438{
style=filled;
color=gray75;
1162[label="221.166.217.116;d;187pkt 187fpkt", shape=diamond, color=yellow];
1301[label="197.30.201.104;s;152pkt 152fpkt", shape=diamond, color=yellow];
1362[label="197.30.206.56;s;238pkt 238fpkt", shape=diamond, color=yellow];
1642[label="197.30.204.74;s;116pkt 116fpkt", shape=diamond, color=yellow];
2070[label="221.166.217.116;d;167pkt 167fpkt", shape=hexagon, color=black];
2171[label="197.30.206.56;s;162pkt 162fpkt", shape=hexagon, color=black];
2211[label="197.30.201.104;s;152pkt 152fpkt", shape=hexagon, color=black];
2228[label="197.30.204.74;s;107pkt 107fpkt", shape=hexagon, color=black];
2735[label="197.30.197.82;113pkt 113fpkt", shape=pentagon, color=darkviolet];
stat438[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.30.206.56:*, *:*}[36.7852%]&lt;BR/&gt;{*:80, *:*}[29.83%]&lt;BR/&gt;{197.30.201.104:*, 221.166.217.116:*}[22.4111%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (19.0818%)&lt;BR/&gt; 445: (12.0516%)&lt;BR/&gt; 25: (7.1736%)&lt;BR/&gt; 113: (6.52798%)&lt;BR/&gt; 7: (2.15208%)&gt;];
}
1162--1301[label="0.953947;145pkt 145fpkt"];
1162--1362[label="0.0213904;4pkt 4fpkt"];
1162--1642[label="0.0431034;5pkt 5fpkt"];
1162--2070[label="1;167pkt 167fpkt"];
1162--2171[label="0.0246914;4pkt 4fpkt"];
1162--2211[label="0.953947;145pkt 145fpkt"];
1162--2228[label="0.046729;5pkt 5fpkt"];
1162--2735[label="0.0442478;5pkt 5fpkt"];
1301--1581[label="0.00657895;1pkt 1fpkt"];
1301--2070[label="0.953947;145pkt 145fpkt"];
1301--2211[label="1;152pkt 152fpkt"];
1362--1581[label="0.00420168;1pkt 1fpkt"];
1362--2070[label="0.0239521;4pkt 4fpkt"];
1362--2171[label="1;162pkt 162fpkt"];
1642--1917[label="0.00862069;1pkt 1fpkt"];
1642--2070[label="0.0431034;5pkt 5fpkt"];
1642--2228[label="1;107pkt 107fpkt"];
2070--2171[label="0.0246914;4pkt 4fpkt"];
2070--2211[label="0.953947;145pkt 145fpkt"];
2070--2228[label="0.046729;5pkt 5fpkt"];
</description>
    <slice>
      <filter src_ip="197.30.206.56"/>
      <filter src_port="80"/>
      <filter dst_ip="221.166.217.116" src_ip="197.30.201.104"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498897" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,010,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_439{
style=filled;
color=gray75;
1737[label="153.130.6.85;s;40pkt 40fpkt", shape=diamond, color=yellow];
2230[label="153.130.6.85;s;40pkt 40fpkt", shape=hexagon, color=black];
stat439[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.130.6.85:*, 197.41.67.8:8000}[47.5%]&lt;BR/&gt;{153.130.6.85:*, 218.143.2.19:80}[40%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (25%)&lt;BR/&gt; 8000: (23.75%)&lt;BR/&gt; 4581: (1.25%)&lt;BR/&gt; 4580: (1.25%)&lt;BR/&gt; 4579: (1.25%)&gt;];
}
1737--2230[label="1;40pkt 40fpkt"];
</description>
    <slice>
      <filter dst_ip="197.41.67.8" dst_port="8000" src_ip="153.130.6.85"/>
      <filter dst_ip="218.143.2.19" dst_port="80" src_ip="153.130.6.85"/>
    </slice>
    <from sec="1086498005" usec="0"/>
    <to sec="1086498818" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_440{
style=filled;
color=gray75;
974[label="197.30.204.25;d;45pkt 45fpkt", shape=diamond, color=yellow];
1141[label="219.83.8.242;s;1pkt 1fpkt", shape=diamond, color=yellow];
1644[label="78.16.43.238;s;1pkt 1fpkt", shape=diamond, color=yellow];
2054[label="219.83.8.242;s;1pkt 1fpkt", shape=hexagon, color=black];
2231[label="78.16.43.238;s;1pkt 1fpkt", shape=hexagon, color=black];
stat440[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:6881, 197.30.204.25:*}[28.8889%]&lt;BR/&gt;{*:*, 197.30.204.25:6881}[24.4444%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6881: (28.5714%)&lt;BR/&gt; 80: (5.10204%)&lt;BR/&gt; 47784: (3.06122%)&lt;BR/&gt; 45867: (3.06122%)&lt;BR/&gt; 6882: (3.06122%)&gt;];
}
974--1141[label="1;1pkt 1fpkt"];
974--1363[label="0.0222222;1pkt 1fpkt"];
974--1644[label="1;1pkt 1fpkt"];
974--1902[label="0.0888889;4pkt 4fpkt"];
974--2054[label="1;1pkt 1fpkt"];
974--2231[label="1;1pkt 1fpkt"];
974--2233[label="0.0222222;1pkt 1fpkt"];
1141--2054[label="1;1pkt 1fpkt"];
1644--2231[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="197.30.204.25" src_port="6881"/>
      <filter dst_ip="197.30.204.25" dst_port="6881"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757235,1.41804,504,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_441{
style=filled;
color=gray75;
1755[label="193.52.234.57;s;19pkt 19fpkt", shape=diamond, color=yellow];
2242[label="193.52.234.57;s;19pkt 19fpkt", shape=hexagon, color=black];
2637[label="193.52.234.57;33pkt 33fpkt", shape=pentagon, color=darkviolet];
stat441[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.52.234.57:80, *:*}[57.5758%]&lt;BR/&gt;{193.52.234.57:443, *:*}[42.4242%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (28.8732%)&lt;BR/&gt; 443: (21.1268%)&lt;BR/&gt; 4726: (2.11268%)&lt;BR/&gt; 4366: (2.11268%)&lt;BR/&gt; 4362: (2.11268%)&gt;];
}
1755--2242[label="1;19pkt 19fpkt"];
1755--2637[label="1;19pkt 19fpkt"];
2242--2637[label="1;19pkt 19fpkt"];
</description>
    <slice>
      <filter src_ip="193.52.234.57" src_port="80"/>
      <filter src_ip="193.52.234.57" src_port="443"/>
    </slice>
    <from sec="1086498045" usec="0"/>
    <to sec="1086498892" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_445{
style=filled;
color=gray75;
1768[label="208.90.135.72;s;848pkt 848fpkt", shape=diamond, color=yellow];
2247[label="208.90.135.72;s;848pkt 848fpkt", shape=hexagon, color=black];
stat445[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.90.135.72:*, *:1027}[50.1179%]&lt;BR/&gt;{208.90.135.72:*, *:1026}[49.8821%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (25.059%)&lt;BR/&gt; 1026: (24.941%)&lt;BR/&gt; 3999: (0.235849%)&lt;BR/&gt; 4683: (0.176887%)&lt;BR/&gt; 2098: (0.176887%)&gt;];
}
1768--2247[label="1;848pkt 848fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="208.90.135.72"/>
      <filter dst_port="1026" src_ip="208.90.135.72"/>
    </slice>
    <from sec="1086498442" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_447{
style=filled;
color=gray75;
1795[label="77.138.190.21;s;645pkt 645fpkt", shape=diamond, color=yellow];
2266[label="77.138.190.21;s;587pkt 587fpkt", shape=hexagon, color=black];
stat447[shape=component, label=&lt;Rules:&lt;BR/&gt;{77.138.190.21:*, *:1026}[50.0775%]&lt;BR/&gt;{77.138.190.21:*, *:1027}[49.9225%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (25.0406%)&lt;BR/&gt; 1026: (25.0406%)&lt;BR/&gt; 4077: (0.243506%)&lt;BR/&gt; 3481: (0.243506%)&lt;BR/&gt; 3142: (0.202922%)&gt;];
}
1795--2266[label="1;587pkt 587fpkt"];
</description>
    <slice>
      <filter dst_port="1026" src_ip="77.138.190.21"/>
      <filter dst_port="1027" src_ip="77.138.190.21"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_448{
style=filled;
color=gray75;
1623[label="153.130.219.116;d;299pkt 299fpkt", shape=diamond, color=yellow];
2275[label="153.130.219.116;d;299pkt 299fpkt", shape=hexagon, color=black];
stat448[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:53, 153.130.219.116:2284}[56.8562%]&lt;BR/&gt;{*:*, 153.130.219.116:53}[38.796%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (49.6656%)&lt;BR/&gt; 2284: (28.4281%)&lt;BR/&gt; 0: (4.34783%)&lt;BR/&gt; 32768: (0.501672%)&lt;BR/&gt; 32769: (0.334448%)&gt;];
}
1623--1730[label="0.00334448;1pkt 1fpkt"];
1623--2233[label="0.0070922;1pkt 1fpkt"];
1623--2275[label="1;299pkt 299fpkt"];
1623--2530[label="0.00442478;1pkt 1fpkt"];
2275--2530[label="0.00442478;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="153.130.219.116" dst_port="53"/>
      <filter dst_ip="153.130.219.116" dst_port="2284" src_port="53"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498737" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,010,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_449{
style=filled;
color=gray75;
1524[label="181.34.230.188;d;423pkt 423fpkt", shape=diamond, color=yellow];
2276[label="181.34.230.188;d;381pkt 381fpkt", shape=hexagon, color=black];
stat449[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 181.34.230.188:4662}[99.5272%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4662: (49.7512%)&lt;BR/&gt; 3717: (0.373134%)&lt;BR/&gt; 3512: (0.373134%)&lt;BR/&gt; 4735: (0.248756%)&lt;BR/&gt; 4348: (0.248756%)&gt;];
}
1524--2276[label="1;381pkt 381fpkt"];
</description>
    <slice>
      <filter dst_ip="181.34.230.188" dst_port="4662"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,010,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_452{
style=filled;
color=gray75;
1532[label="77.189.98.110;s;889pkt 889fpkt", shape=diamond, color=yellow];
2280[label="77.189.98.110;s;889pkt 889fpkt", shape=hexagon, color=black];
stat452[shape=component, label=&lt;Rules:&lt;BR/&gt;{77.189.98.110:80, 181.73.93.174:*}[23.1721%]&lt;BR/&gt;{77.189.98.110:80, 181.33.30.202:*}[20.2475%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 56549: (0.168729%)&lt;BR/&gt; 65316: (0.112486%)&lt;BR/&gt; 65117: (0.112486%)&lt;BR/&gt; 63079: (0.112486%)&gt;];
}
1532--2280[label="1;889pkt 889fpkt"];
</description>
    <slice>
      <filter dst_ip="181.73.93.174" src_ip="77.189.98.110" src_port="80"/>
      <filter dst_ip="181.33.30.202" src_ip="77.189.98.110" src_port="80"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498738" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_453{
style=filled;
color=gray75;
1430[label="208.69.98.54;s;1133pkt 1133fpkt", shape=diamond, color=yellow];
2282[label="208.69.98.54;s;1133pkt 1133fpkt", shape=hexagon, color=black];
stat453[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.69.98.54:*, *:1026}[50.1324%]&lt;BR/&gt;{208.69.98.54:*, *:1027}[49.8676%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (25.0662%)&lt;BR/&gt; 1027: (24.9338%)&lt;BR/&gt; 2110: (0.176523%)&lt;BR/&gt; 1215: (0.176523%)&lt;BR/&gt; 4530: (0.132392%)&gt;];
}
1430--2282[label="1;1133pkt 1133fpkt"];
</description>
    <slice>
      <filter dst_port="1026" src_ip="208.69.98.54"/>
      <filter dst_port="1027" src_ip="208.69.98.54"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498737" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757235,1.41804,020,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_454{
style=filled;
color=gray75;
1537[label="154.33.89.126;s;673pkt 673fpkt", shape=diamond, color=yellow];
2283[label="154.33.89.126;s;589pkt 589fpkt", shape=hexagon, color=black];
2853[label="154.33.89.126;729pkt 729fpkt", shape=pentagon, color=darkviolet];
stat454[shape=component, label=&lt;Rules:&lt;BR/&gt;{154.33.89.126:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1537--2283[label="1;589pkt 589fpkt"];
1537--2853[label="1;673pkt 673fpkt"];
2283--2853[label="1;589pkt 589fpkt"];
</description>
    <slice>
      <filter src_ip="154.33.89.126"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_455{
style=filled;
color=gray75;
1805[label="197.30.218.20;d;14pkt 14fpkt", shape=diamond, color=yellow];
2285[label="197.30.218.20;d;14pkt 14fpkt", shape=hexagon, color=black];
stat455[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:53, 197.30.218.20:4039}[50%]&lt;BR/&gt;{215.64.1.130:*, 197.30.218.20:1026}[21.4286%]&lt;BR/&gt;{215.64.1.130:*, 197.30.218.20:1027}[21.4286%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (28.5714%)&lt;BR/&gt; 4039: (25%)&lt;BR/&gt; 1027: (10.7143%)&lt;BR/&gt; 1026: (10.7143%)&lt;BR/&gt; 33701: (3.57143%)&gt;];
}
1805--2285[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter dst_ip="197.30.218.20" dst_port="1027" src_ip="215.64.1.130"/>
      <filter dst_ip="197.30.218.20" dst_port="1026" src_ip="215.64.1.130"/>
      <filter dst_ip="197.30.218.20" dst_port="4039" src_port="53"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498827" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_457{
style=filled;
color=gray75;
1820[label="196.48.60.50;s;5pkt 5fpkt", shape=diamond, color=yellow];
2296[label="196.48.60.50;s;5pkt 5fpkt", shape=hexagon, color=black];
stat457[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.48.60.50:1290, 193.52.4.58:1863}[20%]&lt;BR/&gt;{196.48.60.50:1093, 193.52.2.85:1863}[20%]&lt;BR/&gt;{196.48.60.50:1900, 193.52.4.109:1863}[20%]&lt;BR/&gt;{196.48.60.50:1891, 193.52.4.114:1863}[20%]&lt;BR/&gt;{196.48.60.50:1885, 215.20.1.243:3307}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1863: (40%)&lt;BR/&gt; 3307: (10%)&lt;BR/&gt; 1900: (10%)&lt;BR/&gt; 1891: (10%)&lt;BR/&gt; 1885: (10%)&gt;];
}
1820--2296[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="215.20.1.243" dst_port="3307" src_ip="196.48.60.50" src_port="1885"/>
      <filter dst_ip="193.52.4.114" dst_port="1863" src_ip="196.48.60.50" src_port="1891"/>
      <filter dst_ip="193.52.4.109" dst_port="1863" src_ip="196.48.60.50" src_port="1900"/>
      <filter dst_ip="193.52.2.85" dst_port="1863" src_ip="196.48.60.50" src_port="1093"/>
      <filter dst_ip="193.52.4.58" dst_port="1863" src_ip="196.48.60.50" src_port="1290"/>
    </slice>
    <from sec="1086498002" usec="0"/>
    <to sec="1086498827" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_459{
style=filled;
color=gray75;
1735[label="214.198.139.146;s;855pkt 855fpkt", shape=diamond, color=yellow];
2299[label="214.198.139.146;s;710pkt 710fpkt", shape=hexagon, color=black];
stat459[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.198.139.146:*, *:1026}[50.9942%]&lt;BR/&gt;{214.198.139.146:*, *:1027}[49.0058%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (25.5272%)&lt;BR/&gt; 1027: (24.4728%)&lt;BR/&gt; 4217: (0.191693%)&lt;BR/&gt; 2432: (0.191693%)&lt;BR/&gt; 1771: (0.191693%)&gt;];
}
1735--2299[label="1;710pkt 710fpkt"];
</description>
    <slice>
      <filter dst_port="1026" src_ip="214.198.139.146"/>
      <filter dst_port="1027" src_ip="214.198.139.146"/>
    </slice>
    <from sec="1086498004" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757235,1.41804,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_460{
style=filled;
color=gray75;
1020[label="159.33.244.17;s;45pkt 45fpkt", shape=diamond, color=yellow];
1212[label="198.109.141.225;d;1pkt 1fpkt", shape=diamond, color=yellow];
1304[label="213.109.88.148;d;1pkt 1fpkt", shape=diamond, color=yellow];
2072[label="213.109.88.148;d;1pkt 1fpkt", shape=hexagon, color=black];
2300[label="198.109.141.225;d;1pkt 1fpkt", shape=hexagon, color=black];
2496[label="159.33.244.17;2pkt 2fpkt", shape=pentagon, color=darkviolet];
stat460[shape=component, label=&lt;Rules:&lt;BR/&gt;{159.33.244.17:*, *:6881}[35.5556%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6881: (17.6471%)&lt;BR/&gt; 6882: (6.86275%)&lt;BR/&gt; 53: (6.86275%)&lt;BR/&gt; 50000: (3.92157%)&lt;BR/&gt; 41278: (3.92157%)&gt;];
}
1020--1212[label="1;1pkt 1fpkt"];
1020--1304[label="1;1pkt 1fpkt"];
1020--2072[label="1;1pkt 1fpkt"];
1020--2300[label="1;1pkt 1fpkt"];
1020--2496[label="1;2pkt 2fpkt"];
1212--2300[label="1;1pkt 1fpkt"];
1304--2072[label="1;1pkt 1fpkt"];
1304--2496[label="1;1pkt 1fpkt"];
2072--2496[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="6881" src_ip="159.33.244.17"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_462{
style=filled;
color=gray75;
1835[label="208.85.78.223;s;529pkt 529fpkt", shape=diamond, color=yellow];
2308[label="208.85.78.223;s;502pkt 502fpkt", shape=hexagon, color=black];
stat462[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.85.78.223:*, *:1027}[50.2836%]&lt;BR/&gt;{208.85.78.223:*, *:1026}[49.7164%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (25.2182%)&lt;BR/&gt; 1026: (24.7818%)&lt;BR/&gt; 3804: (0.29098%)&lt;BR/&gt; 2998: (0.29098%)&lt;BR/&gt; 4275: (0.242483%)&gt;];
}
1835--2308[label="1;502pkt 502fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="208.85.78.223"/>
      <filter dst_port="1026" src_ip="208.85.78.223"/>
    </slice>
    <from sec="1086498031" usec="0"/>
    <to sec="1086498820" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_463{
style=filled;
color=gray75;
1180[label="116.216.246.6;d;1pkt 1fpkt", shape=diamond, color=yellow];
1181[label="159.33.151.11;s;15pkt 15fpkt", shape=diamond, color=yellow];
1379[label="2.174.163.180;d;1pkt 1fpkt", shape=diamond, color=yellow];
1465[label="6.46.124.48;d;72pkt 72fpkt", shape=diamond, color=yellow];
1748[label="159.33.228.209;s;67pkt 67fpkt", shape=diamond, color=yellow];
2016[label="116.216.246.6;d;1pkt 1fpkt", shape=hexagon, color=black];
2310[label="159.33.228.209;s;66pkt 66fpkt", shape=hexagon, color=black];
stat463[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 6.46.124.48:*}[49.6454%]&lt;BR/&gt;{159.33.228.209:50113, *:53}[28.3688%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (22.87%)&lt;BR/&gt; 53: (22.4215%)&lt;BR/&gt; 50113: (17.9372%)&lt;BR/&gt; 113: (1.34529%)&lt;BR/&gt; 21: (1.34529%)&gt;];
}
1180--1181[label="1;1pkt 1fpkt"];
1180--2016[label="1;1pkt 1fpkt"];
1181--1379[label="1;1pkt 1fpkt"];
1181--1465[label="0.4;6pkt 6fpkt"];
1181--2016[label="1;1pkt 1fpkt"];
1465--1748[label="0.104478;7pkt 7fpkt"];
1465--2310[label="0.106061;7pkt 7fpkt"];
1748--1898[label="0.0149254;1pkt 1fpkt"];
1748--2071[label="0.030303;1pkt 1fpkt"];
1748--2279[label="0.025;1pkt 1fpkt"];
1748--2310[label="1;66pkt 66fpkt"];
</description>
    <slice>
      <filter dst_ip="6.46.124.48" src_port="80"/>
      <filter dst_port="53" src_ip="159.33.228.209" src_port="50113"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.836585,1.41293,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_464{
style=filled;
color=gray75;
1086[label="176.77.120.161;d;118pkt 118fpkt", shape=diamond, color=yellow];
1219[label="5.139.174.107;s;37pkt 37fpkt", shape=diamond, color=yellow];
1449[label="197.30.205.159;d;93pkt 93fpkt", shape=diamond, color=yellow];
2722[label="5.228.151.77;64pkt 64fpkt", shape=pentagon, color=darkviolet];
3066[label="77.181.198.204;3pkt 3fpkt", shape=pentagon, color=darkviolet];
3369[label="5.228.151.77;63pkt 63fpkt", shape=invtriangle, color=brown];
3552[label="77.181.198.204;3pkt 3fpkt", shape=invtriangle, color=brown];
3842[label="77.181.198.204;3pkt 3fpkt", shape=invhouse, color=bisque];
stat464[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:53, 197.30.205.159:54810}[39.5349%]&lt;BR/&gt;{5.228.151.77:80, 176.77.120.161:*}[29.7674%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (34.5052%)&lt;BR/&gt; 53: (12.8906%)&lt;BR/&gt; 54810: (11.4583%)&lt;BR/&gt; 0: (3.90625%)&lt;BR/&gt; 52423: (0.390625%)&gt;];
}
1086--1219[label="1;37pkt 37fpkt"];
1086--2435[label="0.0169492;2pkt 2fpkt"];
1086--2722[label="0.96875;62pkt 62fpkt"];
1086--2997[label="0.0625;1pkt 1fpkt"];
1086--3196[label="0.0169492;2pkt 2fpkt"];
1086--3369[label="0.968254;61pkt 61fpkt"];
1086--3628[label="0.0169492;2pkt 2fpkt"];
1449--1499[label="0.0117647;1pkt 1fpkt"];
1449--1730[label="0.0107527;1pkt 1fpkt"];
1449--1783[label="0.0107527;1pkt 1fpkt"];
1449--2258[label="0.0107527;1pkt 1fpkt"];
1449--2562[label="0.03125;1pkt 1fpkt"];
1449--2964[label="0.025641;1pkt 1fpkt"];
1449--3066[label="0.333333;1pkt 1fpkt"];
1449--3552[label="0.333333;1pkt 1fpkt"];
1449--3842[label="0.333333;1pkt 1fpkt"];
2722--3369[label="1;63pkt 63fpkt"];
3066--3552[label="1;3pkt 3fpkt"];
3066--3842[label="1;3pkt 3fpkt"];
3552--3842[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="176.77.120.161" src_ip="5.228.151.77" src_port="80"/>
      <filter dst_ip="197.30.205.159" dst_port="54810" src_port="53"/>
    </slice>
    <from sec="1086498002" usec="0"/>
    <to sec="1086498836" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_465{
style=filled;
color=gray75;
1848[label="77.143.4.69;s;655pkt 655fpkt", shape=diamond, color=yellow];
2322[label="77.143.4.69;s;509pkt 509fpkt", shape=hexagon, color=black];
stat465[shape=component, label=&lt;Rules:&lt;BR/&gt;{77.143.4.69:*, *:1026}[50.5344%]&lt;BR/&gt;{77.143.4.69:*, *:1027}[49.4656%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (25.4296%)&lt;BR/&gt; 1027: (24.5704%)&lt;BR/&gt; 2642: (0.257732%)&lt;BR/&gt; 1638: (0.214777%)&lt;BR/&gt; 1557: (0.214777%)&gt;];
}
1848--2322[label="1;509pkt 509fpkt"];
</description>
    <slice>
      <filter dst_port="1026" src_ip="77.143.4.69"/>
      <filter dst_port="1027" src_ip="77.143.4.69"/>
    </slice>
    <from sec="1086498471" usec="0"/>
    <to sec="1086498827" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_466{
style=filled;
color=gray75;
1855[label="212.16.41.31;s;1pkt 1fpkt", shape=diamond, color=yellow];
2328[label="212.16.41.31;s;1pkt 1fpkt", shape=hexagon, color=black];
stat466[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.16.41.31:5999, 159.33.233.105:53951}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53951: (50%)&lt;BR/&gt; 5999: (50%)&gt;];
}
1855--2328[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="159.33.233.105" dst_port="53951" src_ip="212.16.41.31" src_port="5999"/>
    </slice>
    <from sec="1086498594" usec="0"/>
    <to sec="1086498828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796584,1.46626,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_468{
style=filled;
color=gray75;
1883[label="196.58.148.252;d;118pkt 118fpkt", shape=diamond, color=yellow];
2337[label="196.58.148.252;d;118pkt 118fpkt", shape=hexagon, color=black];
stat468[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:53, 196.58.148.252:49152}[33.0508%]&lt;BR/&gt;{*:*, 196.58.148.252:53}[33.0508%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (34.7458%)&lt;BR/&gt; 49152: (16.5254%)&lt;BR/&gt; 25: (9.32203%)&lt;BR/&gt; 113: (5.50847%)&lt;BR/&gt; 0: (1.69492%)&gt;];
}
1883--2337[label="1;118pkt 118fpkt"];
</description>
    <slice>
      <filter dst_ip="196.58.148.252" dst_port="53"/>
      <filter dst_ip="196.58.148.252" dst_port="49152" src_port="53"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498827" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757235,1.41804,002,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_469{
style=filled;
color=gray75;
1012[label="197.221.218.128;d;932pkt 932fpkt", shape=diamond, color=yellow];
1454[label="197.30.196.24;s;198pkt 198fpkt", shape=diamond, color=yellow];
1508[label="197.30.196.29;s;263pkt 263fpkt", shape=diamond, color=yellow];
1550[label="197.30.196.4;s;199pkt 199fpkt", shape=diamond, color=yellow];
1551[label="197.30.197.70;s;170pkt 170fpkt", shape=diamond, color=yellow];
1741[label="197.30.196.35;s;109pkt 109fpkt", shape=diamond, color=yellow];
1882[label="197.30.196.7;s;137pkt 137fpkt", shape=diamond, color=yellow];
2065[label="197.30.196.29;s;173pkt 173fpkt", shape=hexagon, color=black];
2339[label="197.30.196.4;s;199pkt 199fpkt", shape=hexagon, color=black];
2522[label="197.30.196.24;217pkt 217fpkt", shape=pentagon, color=darkviolet];
stat469[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:139, 197.221.218.128:*}[50.3636%]&lt;BR/&gt;{*:445, 197.221.218.128:*}[36.4545%]&lt;BR/&gt;{197.30.196.29:*, 197.221.218.128:*}[23.8182%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 139: (24.7593%)&lt;BR/&gt; 445: (19.2337%)&lt;BR/&gt; 80: (5.41009%)&lt;BR/&gt; 137: (0.38506%)&lt;BR/&gt; 0: (0.346554%)&gt;];
}
1012--1454[label="0.873737;173pkt 173fpkt"];
1012--1508[label="0.874525;230pkt 230fpkt"];
1012--1550[label="0.869347;173pkt 173fpkt"];
1012--1551[label="0.8;136pkt 136fpkt"];
1012--1741[label="0.880734;96pkt 96fpkt"];
1012--1882[label="0.868613;119pkt 119fpkt"];
1012--2065[label="0.99422;172pkt 172fpkt"];
1012--2339[label="0.869347;173pkt 173fpkt"];
1012--2406[label="0.00429185;4pkt 4fpkt"];
1012--2522[label="0.797235;173pkt 173fpkt"];
1454--1581[label="0.00505051;1pkt 1fpkt"];
1454--2406[label="0.00505051;1pkt 1fpkt"];
1454--2522[label="1;198pkt 198fpkt"];
1508--1581[label="0.00380228;1pkt 1fpkt"];
1508--2065[label="1;173pkt 173fpkt"];
1550--1581[label="0.00502513;1pkt 1fpkt"];
1550--2339[label="1;199pkt 199fpkt"];
1550--2406[label="0.00502513;1pkt 1fpkt"];
1551--1581[label="0.00588235;1pkt 1fpkt"];
1741--2406[label="0.00917431;1pkt 1fpkt"];
1882--2406[label="0.00729927;1pkt 1fpkt"];
2339--2406[label="0.00502513;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="197.221.218.128" src_ip="197.30.196.29"/>
      <filter dst_ip="197.221.218.128" src_port="139"/>
      <filter dst_ip="197.221.218.128" src_port="445"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757235,1.41804,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_472{
style=filled;
color=gray75;
1859[label="153.130.69.93;s;3pkt 3fpkt", shape=diamond, color=yellow];
2346[label="153.130.69.93;s;3pkt 3fpkt", shape=hexagon, color=black];
2756[label="153.130.69.93;3pkt 3fpkt", shape=pentagon, color=darkviolet];
stat472[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.130.69.93:1195, 78.13.67.107:80}[33.3333%]&lt;BR/&gt;{153.130.69.93:1193, 178.13.12.0:80}[33.3333%]&lt;BR/&gt;{153.130.69.93:1194, 178.13.12.0:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1195: (16.6667%)&lt;BR/&gt; 1194: (16.6667%)&lt;BR/&gt; 1193: (16.6667%)&gt;];
}
1859--2346[label="1;3pkt 3fpkt"];
1859--2756[label="1;3pkt 3fpkt"];
2346--2756[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="178.13.12.0" dst_port="80" src_ip="153.130.69.93" src_port="1194"/>
      <filter dst_ip="178.13.12.0" dst_port="80" src_ip="153.130.69.93" src_port="1193"/>
      <filter dst_ip="78.13.67.107" dst_port="80" src_ip="153.130.69.93" src_port="1195"/>
    </slice>
    <from sec="1086498609" usec="0"/>
    <to sec="1086498718" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="2.3.130.1"/>
    </slice>
    <from sec="1086498136" usec="0"/>
    <to sec="1086498847" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.239.180.1"/>
    </slice>
    <from sec="1086498216" usec="0"/>
    <to sec="1086498405" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.117.229.1"/>
    </slice>
    <from sec="1086498412" usec="0"/>
    <to sec="1086498817" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.89.61.4"/>
    </slice>
    <from sec="1086498623" usec="0"/>
    <to sec="1086498654" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.836585,1.41293,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_479{
style=filled;
color=gray75;
1107[label="181.133.93.5;s;109pkt 109fpkt", shape=diamond, color=yellow];
2434[label="181.133.93.5;127pkt 127fpkt", shape=pentagon, color=darkviolet];
3195[label="181.133.93.5;127pkt 127fpkt", shape=invtriangle, color=brown];
3627[label="181.133.93.5;126pkt 126fpkt", shape=invhouse, color=bisque];
stat479[shape=component, label=&lt;Rules:&lt;BR/&gt;{181.133.93.5:*, *:80}[99.2126%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.6933%)&lt;BR/&gt; 19095: (0.408998%)&lt;BR/&gt; 4361: (0.408998%)&lt;BR/&gt; 4346: (0.408998%)&lt;BR/&gt; 3780: (0.408998%)&gt;];
}
1107--2434[label="1;109pkt 109fpkt"];
1107--3195[label="1;109pkt 109fpkt"];
1107--3627[label="0.990826;108pkt 108fpkt"];
2434--3195[label="1;127pkt 127fpkt"];
2434--3627[label="1;126pkt 126fpkt"];
3195--3627[label="1;126pkt 126fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="181.133.93.5"/>
    </slice>
    <from sec="1086498027" usec="0"/>
    <to sec="1086498755" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,001,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="77.87.14.7"/>
    </slice>
    <from sec="1086498594" usec="0"/>
    <to sec="1086498596" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.73.80.7"/>
    </slice>
    <from sec="1086498113" usec="0"/>
    <to sec="1086498583" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891583,1.40768,002,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_482{
style=filled;
color=gray75;
35[label="198.133.28.10s;46pkt 46fpkt", shape=rectangle, color=red];
2452[label="198.133.28.10;198pkt 198fpkt", shape=pentagon, color=darkviolet];
3205[label="198.133.28.10;198pkt 198fpkt", shape=invtriangle, color=brown];
3632[label="198.133.28.10;199pkt 199fpkt", shape=invhouse, color=bisque];
stat482[shape=component, label=&lt;Rules:&lt;BR/&gt;{198.133.28.10:22504, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 22504: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
35--2452[label="1;46pkt 46fpkt"];
35--3205[label="1;46pkt 46fpkt"];
35--3632[label="1;46pkt 46fpkt"];
2452--3205[label="1;198pkt 198fpkt"];
2452--3632[label="1;198pkt 198fpkt"];
3205--3632[label="1;198pkt 198fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="198.133.28.10" src_port="22504"/>
    </slice>
    <from sec="1086498533" usec="0"/>
    <to sec="1086498563" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="193.52.3.11"/>
    </slice>
    <from sec="1086498017" usec="0"/>
    <to sec="1086498898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.73.220.11"/>
    </slice>
    <from sec="1086498097" usec="0"/>
    <to sec="1086498881" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.733101,1.39545,001,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_485{
style=filled;
color=gray75;
101[label="218.162.226.12s;232pkt 232fpkt", shape=rectangle, color=red];
2469[label="218.162.226.12;232pkt 232fpkt", shape=pentagon, color=darkviolet];
3217[label="218.162.226.12;232pkt 232fpkt", shape=invtriangle, color=brown];
stat485[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.162.226.12:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 3304: (0.215517%)&lt;BR/&gt; 3303: (0.215517%)&lt;BR/&gt; 3302: (0.215517%)&lt;BR/&gt; 3300: (0.215517%)&gt;];
}
101--2469[label="1;232pkt 232fpkt"];
101--3217[label="1;232pkt 232fpkt"];
2469--3217[label="1;232pkt 232fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="218.162.226.12"/>
    </slice>
    <from sec="1086498432" usec="0"/>
    <to sec="1086498434" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.836585,1.41293,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_486{
style=filled;
color=gray75;
1207[label="196.48.128.66;d;7pkt 7fpkt", shape=diamond, color=yellow];
1209[label="193.52.4.13;s;5pkt 5fpkt", shape=diamond, color=yellow];
2470[label="193.52.4.13;4pkt 4fpkt", shape=pentagon, color=darkviolet];
3218[label="193.52.4.13;4pkt 4fpkt", shape=invtriangle, color=brown];
3644[label="193.52.4.13;5pkt 5fpkt", shape=invhouse, color=bisque];
stat486[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.52.4.13:1863, *:*}[45.4545%]&lt;BR/&gt;{*:0, 196.48.128.66:0}[36.3636%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1863: (40%)&lt;BR/&gt; 0: (16%)&lt;BR/&gt; 1182: (10%)&lt;BR/&gt; 3214: (8%)&lt;BR/&gt; 1130: (8%)&gt;];
}
1207--1209[label="0.2;1pkt 1fpkt"];
1207--2470[label="0.25;1pkt 1fpkt"];
1207--3218[label="0.25;1pkt 1fpkt"];
1207--3644[label="0.2;1pkt 1fpkt"];
1209--2470[label="1;4pkt 4fpkt"];
1209--3218[label="1;4pkt 4fpkt"];
1209--3644[label="1;5pkt 5fpkt"];
2470--3218[label="1;4pkt 4fpkt"];
2470--3644[label="1;4pkt 4fpkt"];
3218--3644[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter src_ip="193.52.4.13" src_port="1863"/>
      <filter dst_ip="196.48.128.66"/>
    </slice>
    <from sec="1086498002" usec="0"/>
    <to sec="1086498900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="77.138.18.13"/>
    </slice>
    <from sec="1086498008" usec="0"/>
    <to sec="1086498539" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="77.170.201.14"/>
    </slice>
    <from sec="1086498343" usec="0"/>
    <to sec="1086498897" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="193.52.2.16"/>
    </slice>
    <from sec="1086498016" usec="0"/>
    <to sec="1086498900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.239.180.17"/>
    </slice>
    <from sec="1086498184" usec="0"/>
    <to sec="1086498226" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.836585,1.41293,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_492{
style=filled;
color=gray75;
1628[label="215.85.172.22;s;723pkt 723fpkt", shape=diamond, color=yellow];
2515[label="215.85.172.22;721pkt 721fpkt", shape=pentagon, color=darkviolet];
3250[label="215.85.172.22;721pkt 721fpkt", shape=invtriangle, color=brown];
3665[label="215.85.172.22;721pkt 721fpkt", shape=invhouse, color=bisque];
stat492[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.85.172.22:*, *:1027}[50.3458%]&lt;BR/&gt;{215.85.172.22:*, *:1026}[49.6542%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (25.1733%)&lt;BR/&gt; 1026: (24.8267%)&lt;BR/&gt; 1335: (0.4158%)&lt;BR/&gt; 1338: (0.3465%)&lt;BR/&gt; 1340: (0.2772%)&gt;];
}
1628--2515[label="1;721pkt 721fpkt"];
1628--3250[label="1;721pkt 721fpkt"];
1628--3665[label="1;721pkt 721fpkt"];
2515--3250[label="1;721pkt 721fpkt"];
2515--3665[label="1;721pkt 721fpkt"];
3250--3665[label="1;721pkt 721fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="215.85.172.22"/>
      <filter dst_port="1026" src_ip="215.85.172.22"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498690" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.566965,1.41324,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_493{
style=filled;
color=gray75;
1617[label="214.142.223.22;s;568pkt 568fpkt", shape=diamond, color=yellow];
2517[label="214.142.223.22;567pkt 567fpkt", shape=pentagon, color=darkviolet];
stat493[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.142.223.22:*, *:1027}[50.1761%]&lt;BR/&gt;{214.142.223.22:*, *:1026}[49.8239%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (25.1101%)&lt;BR/&gt; 1026: (24.8899%)&lt;BR/&gt; 2553: (0.264317%)&lt;BR/&gt; 4950: (0.176211%)&lt;BR/&gt; 4536: (0.176211%)&gt;];
}
1617--2517[label="1;567pkt 567fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="214.142.223.22"/>
      <filter dst_port="1026" src_ip="214.142.223.22"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498513" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.199.201.23"/>
    </slice>
    <from sec="1086498007" usec="0"/>
    <to sec="1086498886" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="193.52.6.28"/>
    </slice>
    <from sec="1086498177" usec="0"/>
    <to sec="1086498898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.645364,1.408,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_497{
style=filled;
color=gray75;
40[label="214.137.77.28s;92pkt 92fpkt", shape=rectangle, color=red];
2537[label="214.137.77.28;254pkt 254fpkt", shape=pentagon, color=darkviolet];
stat497[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.137.77.28:1034, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1034: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
40--2537[label="0.98913;91pkt 91fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="214.137.77.28" src_port="1034"/>
    </slice>
    <from sec="1086498526" usec="0"/>
    <to sec="1086498552" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.645364,1.408,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_498{
style=filled;
color=gray75;
42[label="77.164.7.31s;255pkt 255fpkt", shape=rectangle, color=red];
2544[label="77.164.7.31;254pkt 254fpkt", shape=pentagon, color=darkviolet];
stat498[shape=component, label=&lt;Rules:&lt;BR/&gt;{77.164.7.31:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
42--2544[label="1;254pkt 254fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="77.164.7.31" src_port="1028"/>
    </slice>
    <from sec="1086498793" usec="0"/>
    <to sec="1086498807" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.166.228.33"/>
    </slice>
    <from sec="1086498395" usec="0"/>
    <to sec="1086498720" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.222.144.34"/>
    </slice>
    <from sec="1086498009" usec="0"/>
    <to sec="1086498888" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="6.46.124.35"/>
    </slice>
    <from sec="1086498900" usec="0"/>
    <to sec="1086498901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="162.110.66.37"/>
    </slice>
    <from sec="1086498025" usec="0"/>
    <to sec="1086498364" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="219.16.110.38"/>
    </slice>
    <from sec="1086498445" usec="0"/>
    <to sec="1086498742" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891583,1.40768,001,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_504{
style=filled;
color=gray75;
133[label="215.16.110.39s;189pkt 189fpkt", shape=rectangle, color=red];
2568[label="215.16.110.39;189pkt 189fpkt", shape=pentagon, color=darkviolet];
3281[label="215.16.110.39;189pkt 189fpkt", shape=invtriangle, color=brown];
3686[label="215.16.110.39;189pkt 189fpkt", shape=invhouse, color=bisque];
stat504[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.16.110.39:*, *:5554}[68.7831%]&lt;BR/&gt;{215.16.110.39:*, *:9898}[31.2169%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (34.3915%)&lt;BR/&gt; 9898: (15.6085%)&lt;BR/&gt; 4993: (0.26455%)&lt;BR/&gt; 4992: (0.26455%)&lt;BR/&gt; 4991: (0.26455%)&gt;];
}
133--2568[label="1;189pkt 189fpkt"];
133--3281[label="1;189pkt 189fpkt"];
133--3686[label="1;189pkt 189fpkt"];
2568--3281[label="1;189pkt 189fpkt"];
2568--3686[label="1;189pkt 189fpkt"];
3281--3686[label="1;189pkt 189fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="215.16.110.39"/>
      <filter dst_port="9898" src_ip="215.16.110.39"/>
    </slice>
    <from sec="1086498010" usec="0"/>
    <to sec="1086498015" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.566965,1.41324,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_505{
style=filled;
color=gray75;
1426[label="214.128.192.40;s;1406pkt 1406fpkt", shape=diamond, color=yellow];
2572[label="214.128.192.40;1524pkt 1524fpkt", shape=pentagon, color=darkviolet];
stat505[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.128.192.40:*, *:1027}[51.8373%]&lt;BR/&gt;{214.128.192.40:*, *:1026}[48.1627%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (25.9044%)&lt;BR/&gt; 1026: (24.0956%)&lt;BR/&gt; 3036: (0.136519%)&lt;BR/&gt; 2826: (0.136519%)&lt;BR/&gt; 2493: (0.136519%)&gt;];
}
1426--2572[label="1;1406pkt 1406fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="214.128.192.40"/>
      <filter dst_port="1026" src_ip="214.128.192.40"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.733101,1.39545,001,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_506{
style=filled;
color=gray75;
134[label="218.162.234.40s;225pkt 225fpkt", shape=rectangle, color=red];
2573[label="218.162.234.40;225pkt 225fpkt", shape=pentagon, color=darkviolet];
3285[label="218.162.234.40;225pkt 225fpkt", shape=invtriangle, color=brown];
stat506[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.162.234.40:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 3108: (0.222222%)&lt;BR/&gt; 3107: (0.222222%)&lt;BR/&gt; 3093: (0.222222%)&lt;BR/&gt; 3084: (0.222222%)&gt;];
}
134--2573[label="1;225pkt 225fpkt"];
134--3285[label="1;225pkt 225fpkt"];
2573--3285[label="1;225pkt 225fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="218.162.234.40"/>
    </slice>
    <from sec="1086498349" usec="0"/>
    <to sec="1086498354" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="77.208.196.41"/>
    </slice>
    <from sec="1086498016" usec="0"/>
    <to sec="1086498897" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891583,1.40768,001,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_508{
style=filled;
color=gray75;
137[label="213.104.146.42s;147pkt 147fpkt", shape=rectangle, color=red];
2578[label="213.104.146.42;147pkt 147fpkt", shape=pentagon, color=darkviolet];
3288[label="213.104.146.42;146pkt 146fpkt", shape=invtriangle, color=brown];
3688[label="213.104.146.42;147pkt 147fpkt", shape=invhouse, color=bisque];
stat508[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.104.146.42:*, *:5554}[70.068%]&lt;BR/&gt;{213.104.146.42:*, *:9898}[29.932%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (35.0085%)&lt;BR/&gt; 9898: (14.9915%)&lt;BR/&gt; 4880: (0.340716%)&lt;BR/&gt; 4861: (0.340716%)&lt;BR/&gt; 4854: (0.340716%)&gt;];
}
137--2578[label="1;147pkt 147fpkt"];
137--3288[label="1;146pkt 146fpkt"];
137--3688[label="1;147pkt 147fpkt"];
2578--3288[label="1;146pkt 146fpkt"];
2578--3688[label="1;147pkt 147fpkt"];
3288--3688[label="1;146pkt 146fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="213.104.146.42"/>
      <filter dst_port="9898" src_ip="213.104.146.42"/>
    </slice>
    <from sec="1086498710" usec="0"/>
    <to sec="1086498714" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.198.98.47"/>
    </slice>
    <from sec="1086498029" usec="0"/>
    <to sec="1086498898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="217.225.176.47"/>
    </slice>
    <from sec="1086498008" usec="0"/>
    <to sec="1086498832" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757235,1.41804,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_512{
style=filled;
color=gray75;
980[label="197.30.203.78;d;532pkt 532fpkt", shape=diamond, color=yellow];
2057[label="197.30.203.78;d;336pkt 336fpkt", shape=hexagon, color=black];
2628[label="6.46.124.55;49pkt 49fpkt", shape=pentagon, color=darkviolet];
2904[label="5.125.67.147;9pkt 9fpkt", shape=pentagon, color=darkviolet];
2947[label="5.125.67.162;6pkt 6fpkt", shape=pentagon, color=darkviolet];
stat512[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:53, 197.30.203.78:1026}[44.2238%]&lt;BR/&gt;{*:*, 197.30.203.78:25}[28.3394%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (25%)&lt;BR/&gt; 1026: (21.7275%)&lt;BR/&gt; 25: (15.0215%)&lt;BR/&gt; 80: (8.69099%)&lt;BR/&gt; 0: (2.14592%)&gt;];
}
980--1217[label="0.00462963;1pkt 1fpkt"];
980--1266[label="0.00393701;2pkt 2fpkt"];
980--1363[label="0.0162162;3pkt 3fpkt"];
980--1499[label="0.0117647;1pkt 1fpkt"];
980--1730[label="0.00223714;1pkt 1fpkt"];
980--1783[label="0.0018797;1pkt 1fpkt"];
980--2057[label="1;336pkt 336fpkt"];
980--2233[label="0.0212766;3pkt 3fpkt"];
980--2258[label="0.0018797;1pkt 1fpkt"];
980--2406[label="0.0018797;1pkt 1fpkt"];
980--2628[label="0.673469;33pkt 33fpkt"];
980--2645[label="0.0037594;2pkt 2fpkt"];
980--2904[label="0.666667;6pkt 6fpkt"];
980--2947[label="0.5;3pkt 3fpkt"];
980--3321[label="0.0037594;2pkt 2fpkt"];
2057--2233[label="0.0212766;3pkt 3fpkt"];
2057--2628[label="0.265306;13pkt 13fpkt"];
2057--2645[label="0.00595238;2pkt 2fpkt"];
2057--2904[label="0.444444;4pkt 4fpkt"];
2057--2947[label="0.333333;2pkt 2fpkt"];
2057--3321[label="0.00595238;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="197.30.203.78" dst_port="25"/>
      <filter dst_ip="197.30.203.78" dst_port="1026" src_port="53"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498857" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.566965,1.41324,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_513{
style=filled;
color=gray75;
1619[label="77.137.45.51;s;815pkt 815fpkt", shape=diamond, color=yellow];
2609[label="77.137.45.51;871pkt 871fpkt", shape=pentagon, color=darkviolet];
stat513[shape=component, label=&lt;Rules:&lt;BR/&gt;{77.137.45.51:*, *:1026}[50.0574%]&lt;BR/&gt;{77.137.45.51:*, *:1027}[49.9426%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (25.0297%)&lt;BR/&gt; 1027: (24.9703%)&lt;BR/&gt; 3326: (0.237248%)&lt;BR/&gt; 4912: (0.177936%)&lt;BR/&gt; 4864: (0.177936%)&gt;];
}
1619--2609[label="1;815pkt 815fpkt"];
</description>
    <slice>
      <filter dst_port="1026" src_ip="77.137.45.51"/>
      <filter dst_port="1027" src_ip="77.137.45.51"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.86.134.51"/>
    </slice>
    <from sec="1086498002" usec="0"/>
    <to sec="1086498899" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.30.206.52"/>
    </slice>
    <from sec="1086498058" usec="0"/>
    <to sec="1086498714" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="193.52.2.53"/>
    </slice>
    <from sec="1086498037" usec="0"/>
    <to sec="1086498893" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="6.124.48.53"/>
    </slice>
    <from sec="1086498013" usec="0"/>
    <to sec="1086498899" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.130.1.54"/>
    </slice>
    <from sec="1086498367" usec="0"/>
    <to sec="1086498388" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.48.133.55"/>
    </slice>
    <from sec="1086498111" usec="0"/>
    <to sec="1086498443" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="173.76.144.55"/>
    </slice>
    <from sec="1086498004" usec="0"/>
    <to sec="1086498085" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.566965,1.41324,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_521{
style=filled;
color=gray75;
1839[label="153.130.224.57;s;32pkt 32fpkt", shape=diamond, color=yellow];
2636[label="153.130.224.57;32pkt 32fpkt", shape=pentagon, color=darkviolet];
stat521[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.130.224.57:80, 5.185.135.140:*}[87.5%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 36499: (1.5625%)&lt;BR/&gt; 36383: (1.5625%)&lt;BR/&gt; 36209: (1.5625%)&lt;BR/&gt; 35749: (1.5625%)&gt;];
}
1839--2636[label="1;32pkt 32fpkt"];
</description>
    <slice>
      <filter dst_ip="5.185.135.140" src_ip="153.130.224.57" src_port="80"/>
    </slice>
    <from sec="1086498071" usec="0"/>
    <to sec="1086498894" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.131.241.57"/>
    </slice>
    <from sec="1086498041" usec="0"/>
    <to sec="1086498673" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.44.7.59"/>
    </slice>
    <from sec="1086498842" usec="0"/>
    <to sec="1086498894" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.836585,1.41293,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_524{
style=filled;
color=gray75;
1878[label="214.197.150.60;s;517pkt 517fpkt", shape=diamond, color=yellow];
2648[label="214.197.150.60;560pkt 560fpkt", shape=pentagon, color=darkviolet];
3323[label="214.197.150.60;556pkt 556fpkt", shape=invtriangle, color=brown];
3706[label="214.197.150.60;556pkt 556fpkt", shape=invhouse, color=bisque];
stat524[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.197.150.60:*, *:1027}[53.75%]&lt;BR/&gt;{214.197.150.60:*, *:1026}[46.25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (26.9073%)&lt;BR/&gt; 1026: (23.0927%)&lt;BR/&gt; 4929: (0.182732%)&lt;BR/&gt; 4657: (0.182732%)&lt;BR/&gt; 4646: (0.182732%)&gt;];
}
1878--2648[label="1;517pkt 517fpkt"];
1878--3323[label="0.992263;513pkt 513fpkt"];
1878--3706[label="0.992263;513pkt 513fpkt"];
2648--3323[label="1;556pkt 556fpkt"];
2648--3706[label="1;556pkt 556fpkt"];
3323--3706[label="1;556pkt 556fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="214.197.150.60"/>
      <filter dst_port="1026" src_ip="214.197.150.60"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498897" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.100.134.61"/>
    </slice>
    <from sec="1086498003" usec="0"/>
    <to sec="1086498892" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="213.168.192.61"/>
    </slice>
    <from sec="1086498666" usec="0"/>
    <to sec="1086498894" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891583,1.40768,001,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_527{
style=filled;
color=gray75;
161[label="214.75.22.62s;328pkt 328fpkt", shape=rectangle, color=red];
2659[label="214.75.22.62;328pkt 328fpkt", shape=pentagon, color=darkviolet];
3329[label="214.75.22.62;328pkt 328fpkt", shape=invtriangle, color=brown];
3712[label="214.75.22.62;327pkt 327fpkt", shape=invhouse, color=bisque];
stat527[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.75.22.62:*, *:9898}[52.439%]&lt;BR/&gt;{214.75.22.62:*, *:5554}[47.561%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (26.2395%)&lt;BR/&gt; 5554: (23.7605%)&lt;BR/&gt; 4395: (0.152555%)&lt;BR/&gt; 4394: (0.152555%)&lt;BR/&gt; 4393: (0.152555%)&gt;];
}
161--2659[label="1;328pkt 328fpkt"];
161--3329[label="1;328pkt 328fpkt"];
161--3712[label="1;327pkt 327fpkt"];
2659--3329[label="1;328pkt 328fpkt"];
2659--3712[label="1;327pkt 327fpkt"];
3329--3712[label="1;327pkt 327fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="214.75.22.62"/>
      <filter dst_port="5554" src_ip="214.75.22.62"/>
    </slice>
    <from sec="1086498442" usec="0"/>
    <to sec="1086498444" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.30.201.64"/>
    </slice>
    <from sec="1086498900" usec="0"/>
    <to sec="1086498901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.98.231.66"/>
    </slice>
    <from sec="1086498030" usec="0"/>
    <to sec="1086498900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.566965,1.41324,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_530{
style=filled;
color=gray75;
1586[label="176.77.231.90;d;57pkt 57fpkt", shape=diamond, color=yellow];
2603[label="218.70.128.49;23pkt 23fpkt", shape=pentagon, color=darkviolet];
stat530[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.70.128.48:*, 176.77.231.90:80}[39.6552%]&lt;BR/&gt;{218.70.128.49:*, 176.77.231.90:80}[37.931%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 16364: (1.25%)&lt;BR/&gt; 16340: (1.25%)&lt;BR/&gt; 16306: (1.25%)&lt;BR/&gt; 16278: (1.25%)&gt;];
}
1586--2229[label="0.0175439;1pkt 1fpkt"];
1586--2233[label="0.0175439;1pkt 1fpkt"];
1586--2603[label="0.956522;22pkt 22fpkt"];
1586--2678[label="0.0175439;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="176.77.231.90" dst_port="80" src_ip="218.70.128.49"/>
      <filter dst_ip="176.77.231.90" dst_port="80" src_ip="218.70.128.48"/>
    </slice>
    <from sec="1086498081" usec="0"/>
    <to sec="1086498717" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.566965,1.41324,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_531{
style=filled;
color=gray75;
1241[label="202.243.118.232;d;61pkt 61fpkt", shape=diamond, color=yellow];
1652[label="196.52.175.69;s;18pkt 18fpkt", shape=diamond, color=yellow];
2684[label="196.52.175.69;18pkt 18fpkt", shape=pentagon, color=darkviolet];
stat531[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.30.203.45:*, 202.243.118.232:25}[71.4286%]&lt;BR/&gt;{196.52.175.69:25, 202.243.118.232:*}[25.3968%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (47.9381%)&lt;BR/&gt; 0: (2.06186%)&lt;BR/&gt; 4836: (1.54639%)&lt;BR/&gt; 4833: (1.54639%)&lt;BR/&gt; 4829: (1.54639%)&gt;];
}
1241--1652[label="0.888889;16pkt 16fpkt"];
1241--2684[label="0.888889;16pkt 16fpkt"];
1652--2684[label="1;18pkt 18fpkt"];
</description>
    <slice>
      <filter dst_ip="202.243.118.232" dst_port="25" src_ip="197.30.203.45"/>
      <filter dst_ip="202.243.118.232" src_ip="196.52.175.69" src_port="25"/>
    </slice>
    <from sec="1086498055" usec="0"/>
    <to sec="1086498547" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.184.65.70"/>
    </slice>
    <from sec="1086498204" usec="0"/>
    <to sec="1086498351" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.3.121.72"/>
    </slice>
    <from sec="1086498010" usec="0"/>
    <to sec="1086498899" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="176.77.118.73"/>
    </slice>
    <from sec="1086498014" usec="0"/>
    <to sec="1086498874" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.70.153.73"/>
    </slice>
    <from sec="1086498838" usec="0"/>
    <to sec="1086498882" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="77.208.79.74"/>
    </slice>
    <from sec="1086498177" usec="0"/>
    <to sec="1086498898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="20.62.101.75"/>
    </slice>
    <from sec="1086498020" usec="0"/>
    <to sec="1086498897" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="193.52.4.79"/>
    </slice>
    <from sec="1086498005" usec="0"/>
    <to sec="1086498816" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="173.76.224.80"/>
    </slice>
    <from sec="1086498005" usec="0"/>
    <to sec="1086498896" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.836585,1.41293,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_540{
style=filled;
color=gray75;
1168[label="203.5.96.216;d;12pkt 12fpkt", shape=diamond, color=yellow];
1630[label="159.33.236.144;s;3pkt 3fpkt", shape=diamond, color=yellow];
1634[label="159.33.228.220;s;2pkt 2fpkt", shape=diamond, color=yellow];
1714[label="159.33.153.83;s;34pkt 34fpkt", shape=diamond, color=yellow];
2736[label="159.33.153.83;37pkt 37fpkt", shape=pentagon, color=darkviolet];
3375[label="159.33.153.83;36pkt 36fpkt", shape=invtriangle, color=brown];
3738[label="159.33.153.83;37pkt 37fpkt", shape=invhouse, color=bisque];
stat540[shape=component, label=&lt;Rules:&lt;BR/&gt;{159.33.153.83:*, 5.76.39.133:6667}[70%]&lt;BR/&gt;{*:*, 203.5.96.216:*}[24%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (44.4099%)&lt;BR/&gt; 6664: (1.5528%)&lt;BR/&gt; 1472: (1.5528%)&lt;BR/&gt; 5000: (1.24224%)&lt;BR/&gt; 4517: (1.24224%)&gt;];
}
1168--1630[label="0.666667;2pkt 2fpkt"];
1168--1634[label="0.5;1pkt 1fpkt"];
1168--1714[label="0.0833333;1pkt 1fpkt"];
1168--2736[label="0.0833333;1pkt 1fpkt"];
1168--3375[label="0.0833333;1pkt 1fpkt"];
1168--3738[label="0.0833333;1pkt 1fpkt"];
1714--2736[label="1;34pkt 34fpkt"];
1714--3375[label="0.970588;33pkt 33fpkt"];
1714--3738[label="1;34pkt 34fpkt"];
2736--3375[label="1;36pkt 36fpkt"];
2736--3738[label="1;37pkt 37fpkt"];
3375--3738[label="1;36pkt 36fpkt"];
</description>
    <slice>
      <filter dst_ip="203.5.96.216"/>
      <filter dst_ip="5.76.39.133" dst_port="6667" src_ip="159.33.153.83"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498899" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.66.1.84"/>
    </slice>
    <from sec="1086498274" usec="0"/>
    <to sec="1086498897" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="159.33.210.90"/>
    </slice>
    <from sec="1086498048" usec="0"/>
    <to sec="1086498250" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.566965,1.41324,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_543{
style=filled;
color=gray75;
1587[label="176.77.231.90;s;53pkt 53fpkt", shape=diamond, color=yellow];
2752[label="176.77.231.90;55pkt 55fpkt", shape=pentagon, color=darkviolet];
stat543[shape=component, label=&lt;Rules:&lt;BR/&gt;{176.77.231.90:80, 218.70.128.48:*}[41.8182%]&lt;BR/&gt;{176.77.231.90:80, 218.70.128.49:*}[40%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 63065: (0.925926%)&lt;BR/&gt; 63029: (0.925926%)&lt;BR/&gt; 62763: (0.925926%)&lt;BR/&gt; 62267: (0.925926%)&gt;];
}
1587--2752[label="1;53pkt 53fpkt"];
</description>
    <slice>
      <filter dst_ip="218.70.128.48" src_ip="176.77.231.90" src_port="80"/>
      <filter dst_ip="218.70.128.49" src_ip="176.77.231.90" src_port="80"/>
    </slice>
    <from sec="1086498025" usec="0"/>
    <to sec="1086498898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.58.164.91"/>
    </slice>
    <from sec="1086498009" usec="0"/>
    <to sec="1086498894" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="159.33.245.94"/>
    </slice>
    <from sec="1086498900" usec="0"/>
    <to sec="1086498901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="159.33.246.94"/>
    </slice>
    <from sec="1086498005" usec="0"/>
    <to sec="1086498843" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="193.52.235.95"/>
    </slice>
    <from sec="1086498042" usec="0"/>
    <to sec="1086498564" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.130.121.96"/>
    </slice>
    <from sec="1086498487" usec="0"/>
    <to sec="1086498871" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.130.54.97"/>
    </slice>
    <from sec="1086498128" usec="0"/>
    <to sec="1086498889" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.218.102.102"/>
    </slice>
    <from sec="1086498007" usec="0"/>
    <to sec="1086498898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.77.151.103"/>
    </slice>
    <from sec="1086498008" usec="0"/>
    <to sec="1086498899" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="173.76.203.104"/>
    </slice>
    <from sec="1086498006" usec="0"/>
    <to sec="1086498895" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.130.7.105"/>
    </slice>
    <from sec="1086498169" usec="0"/>
    <to sec="1086498712" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.836585,1.41293,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_555{
style=filled;
color=gray75;
1564[label="153.130.219.106;s;18pkt 18fpkt", shape=diamond, color=yellow];
2791[label="153.130.219.106;20pkt 20fpkt", shape=pentagon, color=darkviolet];
3408[label="153.130.219.106;19pkt 19fpkt", shape=invtriangle, color=brown];
3760[label="153.130.219.106;20pkt 20fpkt", shape=invhouse, color=bisque];
stat555[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.130.219.106:80, 6.46.124.115:*}[55%]&lt;BR/&gt;{153.130.219.106:80, 6.46.124.123:*}[45%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 65295: (2.5974%)&lt;BR/&gt; 61355: (2.5974%)&lt;BR/&gt; 59006: (2.5974%)&lt;BR/&gt; 50401: (2.5974%)&gt;];
}
1564--2791[label="1;18pkt 18fpkt"];
1564--3408[label="0.944444;17pkt 17fpkt"];
1564--3760[label="1;18pkt 18fpkt"];
2791--3408[label="1;19pkt 19fpkt"];
2791--3760[label="1;20pkt 20fpkt"];
3408--3760[label="1;19pkt 19fpkt"];
</description>
    <slice>
      <filter dst_ip="6.46.124.115" src_ip="153.130.219.106" src_port="80"/>
      <filter dst_ip="6.46.124.123" src_ip="153.130.219.106" src_port="80"/>
    </slice>
    <from sec="1086498012" usec="0"/>
    <to sec="1086498892" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.52.90.107"/>
    </slice>
    <from sec="1086498141" usec="0"/>
    <to sec="1086498348" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="221.236.247.108"/>
    </slice>
    <from sec="1086498548" usec="0"/>
    <to sec="1086498569" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.665125,1.40075,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_558{
style=filled;
color=gray75;
1819[label="196.48.60.50;d;6pkt 6fpkt", shape=diamond, color=yellow];
2800[label="193.52.4.109;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3410[label="193.52.4.109;1pkt 1fpkt", shape=invtriangle, color=brown];
stat558[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:1863, 196.48.60.50:*}[66.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1863: (37.5%)&lt;BR/&gt; 1900: (18.75%)&lt;BR/&gt; 8596: (6.25%)&lt;BR/&gt; 3307: (6.25%)&lt;BR/&gt; 1891: (6.25%)&gt;];
}
1819--2800[label="1;1pkt 1fpkt"];
1819--3410[label="1;1pkt 1fpkt"];
2800--3410[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="196.48.60.50" src_port="1863"/>
    </slice>
    <from sec="1086498002" usec="0"/>
    <to sec="1086498887" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.836585,1.41293,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_560{
style=filled;
color=gray75;
1906[label="176.77.96.110;s;60pkt 60fpkt", shape=diamond, color=yellow];
2803[label="176.77.96.110;67pkt 67fpkt", shape=pentagon, color=darkviolet];
3413[label="176.77.96.110;67pkt 67fpkt", shape=invtriangle, color=brown];
3764[label="176.77.96.110;67pkt 67fpkt", shape=invhouse, color=bisque];
stat560[shape=component, label=&lt;Rules:&lt;BR/&gt;{176.77.96.110:25, *:*}[82.0896%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (41.1877%)&lt;BR/&gt; 53: (9.38697%)&lt;BR/&gt; 80: (2.29885%)&lt;BR/&gt; 64015: (0.766284%)&lt;BR/&gt; 62955: (0.766284%)&gt;];
}
1906--2803[label="1;60pkt 60fpkt"];
1906--3413[label="1;60pkt 60fpkt"];
1906--3764[label="1;60pkt 60fpkt"];
2803--3413[label="1;67pkt 67fpkt"];
2803--3764[label="1;67pkt 67fpkt"];
3413--3764[label="1;67pkt 67fpkt"];
</description>
    <slice>
      <filter src_ip="176.77.96.110" src_port="25"/>
    </slice>
    <from sec="1086498038" usec="0"/>
    <to sec="1086498894" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="82.96.35.111"/>
    </slice>
    <from sec="1086498116" usec="0"/>
    <to sec="1086498126" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.733101,1.39545,001,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_562{
style=filled;
color=gray75;
207[label="215.68.228.112s;254pkt 254fpkt", shape=rectangle, color=red];
2808[label="215.68.228.112;254pkt 254fpkt", shape=pentagon, color=darkviolet];
3418[label="215.68.228.112;254pkt 254fpkt", shape=invtriangle, color=brown];
stat562[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.68.228.112:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 3844: (0.19685%)&lt;BR/&gt; 3843: (0.19685%)&lt;BR/&gt; 3842: (0.19685%)&lt;BR/&gt; 3841: (0.19685%)&gt;];
}
207--2808[label="1;254pkt 254fpkt"];
207--3418[label="1;254pkt 254fpkt"];
2808--3418[label="1;254pkt 254fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="215.68.228.112"/>
    </slice>
    <from sec="1086498635" usec="0"/>
    <to sec="1086498639" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="5.81.49.118"/>
    </slice>
    <from sec="1086498313" usec="0"/>
    <to sec="1086498367" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.81.60.118"/>
    </slice>
    <from sec="1086498003" usec="0"/>
    <to sec="1086498797" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.91.84.118"/>
    </slice>
    <from sec="1086498900" usec="0"/>
    <to sec="1086498901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,001,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="213.174.162.118"/>
    </slice>
    <from sec="1086498326" usec="0"/>
    <to sec="1086498328" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.0.201.118"/>
    </slice>
    <from sec="1086498900" usec="0"/>
    <to sec="1086498901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="181.33.160.120"/>
    </slice>
    <from sec="1086498900" usec="0"/>
    <to sec="1086498901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.3.121.121"/>
    </slice>
    <from sec="1086498061" usec="0"/>
    <to sec="1086498886" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="159.33.250.121"/>
    </slice>
    <from sec="1086498011" usec="0"/>
    <to sec="1086498900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.891583,1.40768,001,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_573{
style=filled;
color=gray75;
216[label="214.148.199.124s;251pkt 251fpkt", shape=rectangle, color=red];
2845[label="214.148.199.124;251pkt 251fpkt", shape=pentagon, color=darkviolet];
3440[label="214.148.199.124;250pkt 250fpkt", shape=invtriangle, color=brown];
3779[label="214.148.199.124;251pkt 251fpkt", shape=invhouse, color=bisque];
stat573[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.148.199.124:*, *:5554}[52.1912%]&lt;BR/&gt;{214.148.199.124:*, *:9898}[47.8088%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (26.1216%)&lt;BR/&gt; 9898: (23.8784%)&lt;BR/&gt; 4479: (0.199402%)&lt;BR/&gt; 4406: (0.199402%)&lt;BR/&gt; 4401: (0.199402%)&gt;];
}
216--2845[label="1;251pkt 251fpkt"];
216--3440[label="1;250pkt 250fpkt"];
216--3779[label="1;251pkt 251fpkt"];
2845--3440[label="1;250pkt 250fpkt"];
2845--3779[label="1;251pkt 251fpkt"];
3440--3779[label="1;250pkt 250fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="214.148.199.124"/>
      <filter dst_port="9898" src_ip="214.148.199.124"/>
    </slice>
    <from sec="1086498230" usec="0"/>
    <to sec="1086498234" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.65.11.125"/>
    </slice>
    <from sec="1086498058" usec="0"/>
    <to sec="1086498792" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="159.33.150.125"/>
    </slice>
    <from sec="1086498003" usec="0"/>
    <to sec="1086498887" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="193.52.4.126"/>
    </slice>
    <from sec="1086498556" usec="0"/>
    <to sec="1086498801" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="198.114.77.130"/>
    </slice>
    <from sec="1086498013" usec="0"/>
    <to sec="1086498898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.58.182.134"/>
    </slice>
    <from sec="1086498900" usec="0"/>
    <to sec="1086498901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="176.77.137.135"/>
    </slice>
    <from sec="1086498037" usec="0"/>
    <to sec="1086498834" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.733101,1.39545,002,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_582{
style=filled;
color=gray75;
64[label="199.22.84.136s;78pkt 78fpkt", shape=rectangle, color=red];
2876[label="199.22.84.136;193pkt 193fpkt", shape=pentagon, color=darkviolet];
3452[label="199.22.84.136;192pkt 192fpkt", shape=invtriangle, color=brown];
stat582[shape=component, label=&lt;Rules:&lt;BR/&gt;{199.22.84.136:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
64--2876[label="1;78pkt 78fpkt"];
64--3452[label="0.987179;77pkt 77fpkt"];
2876--3452[label="1;192pkt 192fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="199.22.84.136" src_port="1027"/>
    </slice>
    <from sec="1086498666" usec="0"/>
    <to sec="1086498696" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.90.104.136"/>
    </slice>
    <from sec="1086498315" usec="0"/>
    <to sec="1086498673" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="7.80.221.136"/>
    </slice>
    <from sec="1086498818" usec="0"/>
    <to sec="1086498859" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="193.52.2.137"/>
    </slice>
    <from sec="1086498010" usec="0"/>
    <to sec="1086498896" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.65.137.137"/>
    </slice>
    <from sec="1086498007" usec="0"/>
    <to sec="1086498899" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="5.21.7.139"/>
    </slice>
    <from sec="1086498834" usec="0"/>
    <to sec="1086498873" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.81.81.139"/>
    </slice>
    <from sec="1086498003" usec="0"/>
    <to sec="1086498900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.107.131.140"/>
    </slice>
    <from sec="1086498900" usec="0"/>
    <to sec="1086498901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="173.76.173.140"/>
    </slice>
    <from sec="1086498900" usec="0"/>
    <to sec="1086498901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.74.71.144"/>
    </slice>
    <from sec="1086498726" usec="0"/>
    <to sec="1086498840" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.153.229.148"/>
    </slice>
    <from sec="1086498036" usec="0"/>
    <to sec="1086498898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="176.77.150.149"/>
    </slice>
    <from sec="1086498004" usec="0"/>
    <to sec="1086498499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.197.161.154"/>
    </slice>
    <from sec="1086498005" usec="0"/>
    <to sec="1086498575" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.30.216.156"/>
    </slice>
    <from sec="1086498042" usec="0"/>
    <to sec="1086498888" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.96.24.157"/>
    </slice>
    <from sec="1086498490" usec="0"/>
    <to sec="1086498542" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.645364,1.408,001,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_598{
style=filled;
color=gray75;
247[label="214.215.84.159s;115pkt 115fpkt", shape=rectangle, color=red];
2937[label="214.215.84.159;246pkt 246fpkt", shape=pentagon, color=darkviolet];
stat598[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.215.84.159:*, *:9898}[51.2195%]&lt;BR/&gt;{214.215.84.159:*, *:5554}[48.7805%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (32.5485%)&lt;BR/&gt; 9898: (17.4515%)&lt;BR/&gt; 4504: (0.277008%)&lt;BR/&gt; 4501: (0.277008%)&lt;BR/&gt; 4458: (0.277008%)&gt;];
}
247--2937[label="1;115pkt 115fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="214.215.84.159"/>
      <filter dst_port="5554" src_ip="214.215.84.159"/>
    </slice>
    <from sec="1086498082" usec="0"/>
    <to sec="1086498094" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.85.97.161"/>
    </slice>
    <from sec="1086498005" usec="0"/>
    <to sec="1086498897" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="181.133.246.163"/>
    </slice>
    <from sec="1086498323" usec="0"/>
    <to sec="1086498527" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="181.133.223.164"/>
    </slice>
    <from sec="1086498034" usec="0"/>
    <to sec="1086498897" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.38.118.165"/>
    </slice>
    <from sec="1086498019" usec="0"/>
    <to sec="1086498898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.247.56.167"/>
    </slice>
    <from sec="1086498033" usec="0"/>
    <to sec="1086498784" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="77.227.84.167"/>
    </slice>
    <from sec="1086498453" usec="0"/>
    <to sec="1086498485" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.83.99.169"/>
    </slice>
    <from sec="1086498009" usec="0"/>
    <to sec="1086498898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.82.44.171"/>
    </slice>
    <from sec="1086498037" usec="0"/>
    <to sec="1086498570" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.28.83.172"/>
    </slice>
    <from sec="1086498026" usec="0"/>
    <to sec="1086498594" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="173.76.144.173"/>
    </slice>
    <from sec="1086498347" usec="0"/>
    <to sec="1086498782" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.130.34.174"/>
    </slice>
    <from sec="1086498039" usec="0"/>
    <to sec="1086498612" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="77.166.61.176"/>
    </slice>
    <from sec="1086498007" usec="0"/>
    <to sec="1086498891" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="5.112.19.178"/>
    </slice>
    <from sec="1086498451" usec="0"/>
    <to sec="1086498533" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.66.89.179"/>
    </slice>
    <from sec="1086498382" usec="0"/>
    <to sec="1086498898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687923,1.37127,010,1 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_614{
style=filled;
color=gray75;
268[label="4.97.209.179s;9540pkt 9540fpkt", shape=rectangle, color=red];
1072[label="4.97.209.179;s;8059pkt 8059fpkt", shape=diamond, color=yellow];
3005[label="4.97.209.179;9817pkt 9817fpkt", shape=pentagon, color=darkviolet];
stat614[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.97.209.179:*, *:135}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 9548: (0.0164138%)&lt;BR/&gt; 9547: (0.0164138%)&lt;BR/&gt; 9546: (0.0164138%)&lt;BR/&gt; 9509: (0.0164138%)&gt;];
}
268--1072[label="0.970468;7821pkt 7821fpkt"];
268--3005[label="1;9540pkt 9540fpkt"];
1072--3005[label="1;8059pkt 8059fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="4.97.209.179"/>
    </slice>
    <from sec="1086498001" usec="0"/>
    <to sec="1086498900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="2.174.163.180"/>
    </slice>
    <from sec="1086498136" usec="0"/>
    <to sec="1086498407" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.130.89.184"/>
    </slice>
    <from sec="1086498161" usec="0"/>
    <to sec="1086498770" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.233.25.186"/>
    </slice>
    <from sec="1086498097" usec="0"/>
    <to sec="1086498827" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="77.178.36.186"/>
    </slice>
    <from sec="1086498002" usec="0"/>
    <to sec="1086498899" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.72.128.191"/>
    </slice>
    <from sec="1086498019" usec="0"/>
    <to sec="1086498892" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="176.77.99.195"/>
    </slice>
    <from sec="1086498054" usec="0"/>
    <to sec="1086498835" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="176.77.110.198"/>
    </slice>
    <from sec="1086498633" usec="0"/>
    <to sec="1086498661" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.566965,1.41324,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_624{
style=filled;
color=gray75;
1784[label="173.76.151.150;d;49pkt 49fpkt", shape=diamond, color=yellow];
1796[label="193.52.0.199;s;67pkt 67fpkt", shape=diamond, color=yellow];
2932[label="7.80.232.156;8pkt 8fpkt", shape=pentagon, color=darkviolet];
3046[label="193.52.0.199;72pkt 72fpkt", shape=pentagon, color=darkviolet];
stat624[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.52.0.199:1863, *:*}[54.1667%]&lt;BR/&gt;{*:80, 173.76.151.150:*}[38.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1863: (31.8878%)&lt;BR/&gt; 80: (17.3469%)&lt;BR/&gt; 1040: (1.02041%)&lt;BR/&gt; 1028: (1.02041%)&lt;BR/&gt; 4941: (0.765306%)&gt;];
}
1784--1796[label="0.0204082;1pkt 1fpkt"];
1784--2932[label="1;8pkt 8fpkt"];
1784--3046[label="0.0204082;1pkt 1fpkt"];
1796--1938[label="0.0149254;1pkt 1fpkt"];
1796--2353[label="0.0149254;1pkt 1fpkt"];
1796--3046[label="1;67pkt 67fpkt"];
</description>
    <slice>
      <filter src_ip="193.52.0.199" src_port="1863"/>
      <filter dst_ip="173.76.151.150" src_port="80"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498896" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="6.46.117.200"/>
    </slice>
    <from sec="1086498771" usec="0"/>
    <to sec="1086498859" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.645364,1.408,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_626{
style=filled;
color=gray75;
70[label="77.214.238.200s;89pkt 89fpkt", shape=rectangle, color=red];
3049[label="77.214.238.200;162pkt 162fpkt", shape=pentagon, color=darkviolet];
stat626[shape=component, label=&lt;Rules:&lt;BR/&gt;{77.214.238.200:1033, *:137}[98.7654%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50.3984%)&lt;BR/&gt; 1033: (49.6016%)&gt;];
}
70--3049[label="1;89pkt 89fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="77.214.238.200" src_port="1033"/>
    </slice>
    <from sec="1086498335" usec="0"/>
    <to sec="1086498730" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_627{
style=filled;
color=gray75;
3050[label="197.55.23.201;208pkt 208fpkt", shape=pentagon, color=darkviolet];
stat627[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.55.23.201:*, *:1026}[50.9615%]&lt;BR/&gt;{197.55.23.201:*, *:1027}[49.0385%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (25.4808%)&lt;BR/&gt; 1027: (24.5192%)&lt;BR/&gt; 4359: (0.480769%)&lt;BR/&gt; 4240: (0.480769%)&lt;BR/&gt; 3536: (0.480769%)&gt;];
}
</description>
    <slice>
      <filter dst_port="1026" src_ip="197.55.23.201"/>
      <filter dst_port="1027" src_ip="197.55.23.201"/>
    </slice>
    <from sec="1086498001" usec="0"/>
    <to sec="1086498892" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="176.77.48.201"/>
    </slice>
    <from sec="1086498900" usec="0"/>
    <to sec="1086498901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="181.133.223.201"/>
    </slice>
    <from sec="1086498301" usec="0"/>
    <to sec="1086498467" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.236.8.202"/>
    </slice>
    <from sec="1086498005" usec="0"/>
    <to sec="1086498884" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.208.199.202"/>
    </slice>
    <from sec="1086498001" usec="0"/>
    <to sec="1086498899" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.69.102.204"/>
    </slice>
    <from sec="1086498173" usec="0"/>
    <to sec="1086498603" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="159.33.228.208"/>
    </slice>
    <from sec="1086498006" usec="0"/>
    <to sec="1086498814" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.174.131.209"/>
    </slice>
    <from sec="1086498010" usec="0"/>
    <to sec="1086498900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.84.205.209"/>
    </slice>
    <from sec="1086498507" usec="0"/>
    <to sec="1086498561" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.733101,1.39545,002,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_636{
style=filled;
color=gray75;
72[label="208.79.36.213s;233pkt 233fpkt", shape=rectangle, color=red];
3088[label="208.79.36.213;255pkt 255fpkt", shape=pentagon, color=darkviolet];
3564[label="208.79.36.213;255pkt 255fpkt", shape=invtriangle, color=brown];
stat636[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.79.36.213:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
72--3088[label="1;233pkt 233fpkt"];
72--3564[label="1;233pkt 233fpkt"];
3088--3564[label="1;255pkt 255fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="208.79.36.213" src_port="1028"/>
    </slice>
    <from sec="1086498019" usec="0"/>
    <to sec="1086498044" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="7.80.201.216"/>
    </slice>
    <from sec="1086498304" usec="0"/>
    <to sec="1086498688" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.91153,1.43007,503,0 0 0 1 1 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_639{
style=filled;
color=gray75;
1035[label="176.77.106.234;d;66pkt 66fpkt", shape=diamond, color=yellow];
1129[label="6.53.91.217;s;4pkt 4fpkt", shape=diamond, color=yellow];
1466[label="153.130.4.170;d;164pkt 164fpkt", shape=diamond, color=yellow];
1572[label="217.65.143.193;s;125pkt 125fpkt", shape=diamond, color=yellow];
1947[label="176.77.106.234;d;66pkt 66fpkt", shape=hexagon, color=black];
2181[label="153.130.4.170;d;164pkt 164fpkt", shape=hexagon, color=black];
3073[label="6.53.91.208;12pkt 12fpkt", shape=pentagon, color=darkviolet];
3099[label="6.53.91.217;9pkt 9fpkt", shape=pentagon, color=darkviolet];
3848[label="6.53.91.217;8pkt 8fpkt", shape=invhouse, color=bisque];
stat639[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.65.143.193:80, 153.130.4.170:*}[24.3028%]&lt;BR/&gt;{217.65.143.193:80, 176.77.106.234:*}[22.3108%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.3528%)&lt;BR/&gt; 3109: (0.404531%)&lt;BR/&gt; 3108: (0.404531%)&lt;BR/&gt; 3050: (0.404531%)&lt;BR/&gt; 3049: (0.404531%)&gt;];
}
1035--1129[label="1;4pkt 4fpkt"];
1035--1572[label="0.848485;56pkt 56fpkt"];
1035--1947[label="1;66pkt 66fpkt"];
1035--3073[label="0.333333;4pkt 4fpkt"];
1035--3099[label="0.444444;4pkt 4fpkt"];
1035--3848[label="0.5;4pkt 4fpkt"];
1129--1947[label="1;4pkt 4fpkt"];
1129--3099[label="1;4pkt 4fpkt"];
1129--3848[label="1;4pkt 4fpkt"];
1466--1489[label="0.0121951;2pkt 2fpkt"];
1466--1493[label="0.0147059;1pkt 1fpkt"];
1466--1572[label="0.488;61pkt 61fpkt"];
1466--2039[label="0.0121951;2pkt 2fpkt"];
1466--2181[label="1;164pkt 164fpkt"];
1466--2199[label="0.0147059;1pkt 1fpkt"];
1466--2991[label="0.0121951;2pkt 2fpkt"];
1466--3159[label="0.010989;1pkt 1fpkt"];
1466--3510[label="0.0121951;2pkt 2fpkt"];
1572--1947[label="0.848485;56pkt 56fpkt"];
1572--2181[label="0.488;61pkt 61fpkt"];
1572--2235[label="0.008;1pkt 1fpkt"];
1947--3073[label="0.333333;4pkt 4fpkt"];
1947--3099[label="0.444444;4pkt 4fpkt"];
1947--3848[label="0.5;4pkt 4fpkt"];
2181--2199[label="0.0147059;1pkt 1fpkt"];
2181--2991[label="0.0121951;2pkt 2fpkt"];
2181--3159[label="0.010989;1pkt 1fpkt"];
2181--3510[label="0.0121951;2pkt 2fpkt"];
3099--3848[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="153.130.4.170" src_ip="217.65.143.193" src_port="80"/>
      <filter dst_ip="176.77.106.234" src_ip="217.65.143.193" src_port="80"/>
    </slice>
    <from sec="1086498028" usec="0"/>
    <to sec="1086498713" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.218.29.221"/>
    </slice>
    <from sec="1086498005" usec="0"/>
    <to sec="1086498898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="181.133.44.221"/>
    </slice>
    <from sec="1086498037" usec="0"/>
    <to sec="1086498878" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.836585,1.41293,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_642{
style=filled;
color=gray75;
1837[label="153.130.6.225;s;65pkt 65fpkt", shape=diamond, color=yellow];
3115[label="153.130.6.225;69pkt 69fpkt", shape=pentagon, color=darkviolet];
3577[label="153.130.6.225;69pkt 69fpkt", shape=invtriangle, color=brown];
3855[label="153.130.6.225;69pkt 69fpkt", shape=invhouse, color=bisque];
stat642[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.130.6.225:*, 6.46.97.51:80}[53.6232%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.7941%)&lt;BR/&gt; 443: (1.47059%)&lt;BR/&gt; 2285: (0.735294%)&lt;BR/&gt; 2284: (0.735294%)&lt;BR/&gt; 2281: (0.735294%)&gt;];
}
1837--3115[label="1;65pkt 65fpkt"];
1837--3577[label="1;65pkt 65fpkt"];
1837--3855[label="1;65pkt 65fpkt"];
3115--3577[label="1;69pkt 69fpkt"];
3115--3855[label="1;69pkt 69fpkt"];
3577--3855[label="1;69pkt 69fpkt"];
</description>
    <slice>
      <filter dst_ip="6.46.97.51" dst_port="80" src_ip="153.130.6.225"/>
    </slice>
    <from sec="1086498032" usec="0"/>
    <to sec="1086498874" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.137.60.225"/>
    </slice>
    <from sec="1086498002" usec="0"/>
    <to sec="1086498897" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="198.162.210.227"/>
    </slice>
    <from sec="1086498016" usec="0"/>
    <to sec="1086498896" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="176.77.5.229"/>
    </slice>
    <from sec="1086498022" usec="0"/>
    <to sec="1086498899" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="176.77.97.232"/>
    </slice>
    <from sec="1086498005" usec="0"/>
    <to sec="1086498899" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="213.24.160.238"/>
    </slice>
    <from sec="1086498015" usec="0"/>
    <to sec="1086498900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="176.77.254.238"/>
    </slice>
    <from sec="1086498014" usec="0"/>
    <to sec="1086498888" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.89.204.240"/>
    </slice>
    <from sec="1086498010" usec="0"/>
    <to sec="1086498751" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="5.50.100.242"/>
    </slice>
    <from sec="1086498784" usec="0"/>
    <to sec="1086498797" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.68.8.244"/>
    </slice>
    <from sec="1086498001" usec="0"/>
    <to sec="1086498885" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="213.161.37.247"/>
    </slice>
    <from sec="1086498607" usec="0"/>
    <to sec="1086498624" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.566965,1.41324,010,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_653{
style=filled;
color=gray75;
1315[label="218.80.232.250;s;1575pkt 1575fpkt", shape=diamond, color=yellow];
3170[label="218.80.232.250;1740pkt 1740fpkt", shape=pentagon, color=darkviolet];
stat653[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.80.232.250:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 51418: (0.0603318%)&lt;BR/&gt; 42583: (0.0603318%)&lt;BR/&gt; 41566: (0.0603318%)&lt;BR/&gt; 39664: (0.0603318%)&gt;];
}
1315--3170[label="1;1575pkt 1575fpkt"];
</description>
    <slice>
      <filter src_ip="218.80.232.250" src_port="80"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,001,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="176.77.98.252"/>
    </slice>
    <from sec="1086498147" usec="0"/>
    <to sec="1086498148" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.514496,1.4489,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.85.144.253"/>
    </slice>
    <from sec="1086498018" usec="0"/>
    <to sec="1086498893" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_656{
style=filled;
color=gray75;
2419[label="213.182.64.2;93pkt 93fpkt", shape=pentagon, color=darkviolet];
3183[label="213.182.64.2;93pkt 93fpkt", shape=invtriangle, color=brown];
3620[label="213.182.64.2;93pkt 93fpkt", shape=invhouse, color=bisque];
stat656[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.182.64.2:*, *:3127}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3127: (50%)&lt;BR/&gt; 4498: (1.07527%)&lt;BR/&gt; 4968: (0.537634%)&lt;BR/&gt; 4843: (0.537634%)&lt;BR/&gt; 4821: (0.537634%)&gt;];
}
2419--3183[label="1;93pkt 93fpkt"];
2419--3620[label="1;93pkt 93fpkt"];
3183--3620[label="1;93pkt 93fpkt"];
</description>
    <slice>
      <filter dst_port="3127" src_ip="213.182.64.2"/>
    </slice>
    <from sec="1086498007" usec="0"/>
    <to sec="1086498895" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_658{
style=filled;
color=gray75;
2425[label="219.93.140.3;156pkt 156fpkt", shape=pentagon, color=darkviolet];
3188[label="219.93.140.3;155pkt 155fpkt", shape=invtriangle, color=brown];
stat658[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.93.140.3:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
2425--3188[label="1;155pkt 155fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="219.93.140.3" src_port="1027"/>
    </slice>
    <from sec="1086498345" usec="0"/>
    <to sec="1086498372" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,504,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_659{
style=filled;
color=gray75;
2433[label="7.80.49.5;12pkt 12fpkt", shape=pentagon, color=darkviolet];
3194[label="7.80.49.5;12pkt 12fpkt", shape=invtriangle, color=brown];
3626[label="7.80.49.5;11pkt 11fpkt", shape=invhouse, color=bisque];
stat659[shape=component, label=&lt;Rules:&lt;BR/&gt;{7.80.49.5:443, 176.77.52.149:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (50%)&lt;BR/&gt; 30841: (4.28571%)&lt;BR/&gt; 29411: (4.28571%)&lt;BR/&gt; 29123: (4.28571%)&lt;BR/&gt; 10294: (4.28571%)&gt;];
}
2433--3194[label="1;12pkt 12fpkt"];
2433--3626[label="1;11pkt 11fpkt"];
3194--3626[label="1;11pkt 11fpkt"];
</description>
    <slice>
      <filter dst_ip="176.77.52.149" src_ip="7.80.49.5" src_port="443"/>
    </slice>
    <from sec="1086498359" usec="0"/>
    <to sec="1086498368" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_660{
style=filled;
color=gray75;
2438[label="221.236.39.6;118pkt 118fpkt", shape=pentagon, color=darkviolet];
3197[label="221.236.39.6;118pkt 118fpkt", shape=invtriangle, color=brown];
stat660[shape=component, label=&lt;Rules:&lt;BR/&gt;{221.236.39.6:*, *:1027}[50.8475%]&lt;BR/&gt;{221.236.39.6:*, *:1026}[49.1525%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (25.4237%)&lt;BR/&gt; 1026: (24.5763%)&lt;BR/&gt; 3869: (0.847458%)&lt;BR/&gt; 4982: (0.423729%)&lt;BR/&gt; 4889: (0.423729%)&gt;];
}
2438--3197[label="1;118pkt 118fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="221.236.39.6"/>
      <filter dst_port="1026" src_ip="221.236.39.6"/>
    </slice>
    <from sec="1086498013" usec="0"/>
    <to sec="1086498900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,001,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_661{
style=filled;
color=gray75;
2441[label="175.98.173.6;107pkt 107fpkt", shape=pentagon, color=darkviolet];
3199[label="175.98.173.6;107pkt 107fpkt", shape=invtriangle, color=brown];
stat661[shape=component, label=&lt;Rules:&lt;BR/&gt;{175.98.173.6:*, *:9898}[70.0935%]&lt;BR/&gt;{175.98.173.6:*, *:5554}[29.9065%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (35.0467%)&lt;BR/&gt; 5554: (14.9533%)&lt;BR/&gt; 4502: (0.46729%)&lt;BR/&gt; 4501: (0.46729%)&lt;BR/&gt; 4500: (0.46729%)&gt;];
}
2441--3199[label="1;107pkt 107fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="175.98.173.6"/>
      <filter dst_port="5554" src_ip="175.98.173.6"/>
    </slice>
    <from sec="1086498421" usec="0"/>
    <to sec="1086498424" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,020,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_662{
style=filled;
color=gray75;
2447[label="196.58.172.8;85pkt 85fpkt", shape=pentagon, color=darkviolet];
3201[label="196.58.172.8;85pkt 85fpkt", shape=invtriangle, color=brown];
3629[label="196.58.172.8;84pkt 84fpkt", shape=invhouse, color=bisque];
stat662[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.58.172.8:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2447--3201[label="1;85pkt 85fpkt"];
2447--3629[label="1;84pkt 84fpkt"];
3201--3629[label="1;84pkt 84fpkt"];
</description>
    <slice>
      <filter src_ip="196.58.172.8"/>
    </slice>
    <from sec="1086498017" usec="0"/>
    <to sec="1086498896" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_663{
style=filled;
color=gray75;
2465[label="6.46.124.12;17pkt 17fpkt", shape=pentagon, color=darkviolet];
3213[label="6.46.124.12;16pkt 16fpkt", shape=invtriangle, color=brown];
3640[label="6.46.124.12;17pkt 17fpkt", shape=invhouse, color=bisque];
stat663[shape=component, label=&lt;Rules:&lt;BR/&gt;{6.46.124.12:*, 181.133.50.240:80}[52.9412%]&lt;BR/&gt;{6.46.124.12:*, 197.30.203.35:80}[47.0588%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 63702: (3%)&lt;BR/&gt; 53783: (3%)&lt;BR/&gt; 52899: (3%)&lt;BR/&gt; 47738: (3%)&gt;];
}
2465--3213[label="1;16pkt 16fpkt"];
2465--3640[label="1;17pkt 17fpkt"];
3213--3640[label="1;16pkt 16fpkt"];
</description>
    <slice>
      <filter dst_ip="181.133.50.240" dst_port="80" src_ip="6.46.124.12"/>
      <filter dst_ip="197.30.203.35" dst_port="80" src_ip="6.46.124.12"/>
    </slice>
    <from sec="1086498092" usec="0"/>
    <to sec="1086498765" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_665{
style=filled;
color=gray75;
2478[label="214.203.53.15;208pkt 208fpkt", shape=pentagon, color=darkviolet];
3222[label="214.203.53.15;207pkt 207fpkt", shape=invtriangle, color=brown];
stat665[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.203.53.15:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 16960: (0.240964%)&lt;BR/&gt; 16958: (0.240964%)&lt;BR/&gt; 16955: (0.240964%)&lt;BR/&gt; 16953: (0.240964%)&gt;];
}
2478--3222[label="1;207pkt 207fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="214.203.53.15"/>
    </slice>
    <from sec="1086498682" usec="0"/>
    <to sec="1086498699" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_666{
style=filled;
color=gray75;
2481[label="218.221.218.15;6pkt 6fpkt", shape=pentagon, color=darkviolet];
3224[label="218.221.218.15;5pkt 5fpkt", shape=invtriangle, color=brown];
stat666[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.221.218.15:80, 181.133.50.107:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4505: (9.09091%)&lt;BR/&gt; 4504: (9.09091%)&lt;BR/&gt; 4503: (9.09091%)&lt;BR/&gt; 4502: (9.09091%)&gt;];
}
2481--3224[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="181.133.50.107" src_ip="218.221.218.15" src_port="80"/>
    </slice>
    <from sec="1086498550" usec="0"/>
    <to sec="1086498570" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_667{
style=filled;
color=gray75;
2485[label="196.58.183.16;17pkt 17fpkt", shape=pentagon, color=darkviolet];
3228[label="196.58.183.16;17pkt 17fpkt", shape=invtriangle, color=brown];
3650[label="196.58.183.16;17pkt 17fpkt", shape=invhouse, color=bisque];
stat667[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.58.183.16:25, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 58626: (2.94118%)&lt;BR/&gt; 29148: (2.94118%)&lt;BR/&gt; 4534: (2.94118%)&lt;BR/&gt; 4180: (2.94118%)&gt;];
}
2485--3228[label="1;17pkt 17fpkt"];
2485--3650[label="1;17pkt 17fpkt"];
3228--3650[label="1;17pkt 17fpkt"];
</description>
    <slice>
      <filter src_ip="196.58.183.16" src_port="25"/>
    </slice>
    <from sec="1086498073" usec="0"/>
    <to sec="1086498854" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_668{
style=filled;
color=gray75;
2492[label="197.239.142.17;48pkt 48fpkt", shape=pentagon, color=darkviolet];
3232[label="197.239.142.17;48pkt 48fpkt", shape=invtriangle, color=brown];
3654[label="197.239.142.17;47pkt 47fpkt", shape=invhouse, color=bisque];
stat668[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.239.142.17:*, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6129: (6.29371%)&lt;BR/&gt; 3127: (6.29371%)&lt;BR/&gt; 1025: (6.29371%)&lt;BR/&gt; 445: (6.29371%)&lt;BR/&gt; 139: (6.29371%)&gt;];
}
2492--3232[label="1;48pkt 48fpkt"];
2492--3654[label="1;47pkt 47fpkt"];
3232--3654[label="1;47pkt 47fpkt"];
</description>
    <slice>
      <filter src_ip="197.239.142.17"/>
    </slice>
    <from sec="1086498005" usec="0"/>
    <to sec="1086498892" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.668423,1.48433,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="197.239.180.17"/>
    </slice>
    <from sec="1086498184" usec="0"/>
    <to sec="1086498226" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_670{
style=filled;
color=gray75;
2497[label="193.52.6.18;40pkt 40fpkt", shape=pentagon, color=darkviolet];
3236[label="193.52.6.18;40pkt 40fpkt", shape=invtriangle, color=brown];
3657[label="193.52.6.18;40pkt 40fpkt", shape=invhouse, color=bisque];
stat670[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.52.6.18:80, 153.130.48.119:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2167: (1.25%)&lt;BR/&gt; 2166: (1.25%)&lt;BR/&gt; 2165: (1.25%)&lt;BR/&gt; 2164: (1.25%)&gt;];
}
2497--3236[label="1;40pkt 40fpkt"];
2497--3657[label="1;40pkt 40fpkt"];
3236--3657[label="1;40pkt 40fpkt"];
</description>
    <slice>
      <filter dst_ip="153.130.48.119" src_ip="193.52.6.18" src_port="80"/>
    </slice>
    <from sec="1086498002" usec="0"/>
    <to sec="1086498804" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,001,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_671{
style=filled;
color=gray75;
2504[label="22.28.192.19;119pkt 119fpkt", shape=pentagon, color=darkviolet];
3241[label="22.28.192.19;118pkt 118fpkt", shape=invtriangle, color=brown];
stat671[shape=component, label=&lt;Rules:&lt;BR/&gt;{22.28.192.19:*, *:9898}[53.7815%]&lt;BR/&gt;{22.28.192.19:*, *:5554}[46.2185%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (27.0042%)&lt;BR/&gt; 5554: (22.9958%)&lt;BR/&gt; 4838: (0.421941%)&lt;BR/&gt; 4755: (0.421941%)&lt;BR/&gt; 4736: (0.421941%)&gt;];
}
2504--3241[label="1;118pkt 118fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="22.28.192.19"/>
      <filter dst_port="5554" src_ip="22.28.192.19"/>
    </slice>
    <from sec="1086498547" usec="0"/>
    <to sec="1086498550" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_672{
style=filled;
color=gray75;
2506[label="176.77.243.19;22pkt 22fpkt", shape=pentagon, color=darkviolet];
3243[label="176.77.243.19;23pkt 23fpkt", shape=invtriangle, color=brown];
3661[label="176.77.243.19;23pkt 23fpkt", shape=invhouse, color=bisque];
stat672[shape=component, label=&lt;Rules:&lt;BR/&gt;{176.77.243.19:80, 218.70.105.136:*}[82.6087%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (44.1176%)&lt;BR/&gt; 9898: (4.41176%)&lt;BR/&gt; 13419: (2.20588%)&lt;BR/&gt; 13403: (2.20588%)&lt;BR/&gt; 13399: (2.20588%)&gt;];
}
2506--3243[label="1;22pkt 22fpkt"];
2506--3661[label="1;22pkt 22fpkt"];
3243--3661[label="1;23pkt 23fpkt"];
</description>
    <slice>
      <filter dst_ip="218.70.105.136" src_ip="176.77.243.19" src_port="80"/>
    </slice>
    <from sec="1086498596" usec="0"/>
    <to sec="1086498891" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_674{
style=filled;
color=gray75;
2512[label="193.52.4.22;3pkt 3fpkt", shape=pentagon, color=darkviolet];
3247[label="193.52.4.22;3pkt 3fpkt", shape=invtriangle, color=brown];
stat674[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.52.4.22:1863, 173.76.149.8:1759}[33.3333%]&lt;BR/&gt;{193.52.4.22:1863, 153.130.1.53:4788}[33.3333%]&lt;BR/&gt;{193.52.4.22:1863, 173.76.149.88:4629}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1863: (50%)&lt;BR/&gt; 4788: (16.6667%)&lt;BR/&gt; 4629: (16.6667%)&lt;BR/&gt; 1759: (16.6667%)&gt;];
}
2512--3247[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="173.76.149.88" dst_port="4629" src_ip="193.52.4.22" src_port="1863"/>
      <filter dst_ip="153.130.1.53" dst_port="4788" src_ip="193.52.4.22" src_port="1863"/>
      <filter dst_ip="173.76.149.8" dst_port="1759" src_ip="193.52.4.22" src_port="1863"/>
    </slice>
    <from sec="1086498003" usec="0"/>
    <to sec="1086498694" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_675{
style=filled;
color=gray75;
2513[label="167.210.83.22;356pkt 356fpkt", shape=pentagon, color=darkviolet];
3248[label="167.210.83.22;356pkt 356fpkt", shape=invtriangle, color=brown];
3664[label="167.210.83.22;356pkt 356fpkt", shape=invhouse, color=bisque];
stat675[shape=component, label=&lt;Rules:&lt;BR/&gt;{167.210.83.22:*, *:9898}[57.5843%]&lt;BR/&gt;{167.210.83.22:*, *:3127}[42.4157%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (28.7921%)&lt;BR/&gt; 3127: (21.2079%)&lt;BR/&gt; 2055: (0.140449%)&lt;BR/&gt; 2052: (0.140449%)&lt;BR/&gt; 2051: (0.140449%)&gt;];
}
2513--3248[label="1;356pkt 356fpkt"];
2513--3664[label="1;356pkt 356fpkt"];
3248--3664[label="1;356pkt 356fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="167.210.83.22"/>
      <filter dst_port="3127" src_ip="167.210.83.22"/>
    </slice>
    <from sec="1086498329" usec="0"/>
    <to sec="1086498334" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.836585,1.41293,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_676{
style=filled;
color=gray75;
1267[label="159.33.221.164;d;333pkt 333fpkt", shape=diamond, color=yellow];
1616[label="2.102.13.44;s;214pkt 214fpkt", shape=diamond, color=yellow];
2525[label="213.165.88.25;99pkt 99fpkt", shape=pentagon, color=darkviolet];
3255[label="213.165.88.25;98pkt 98fpkt", shape=invtriangle, color=brown];
3669[label="213.165.88.25;98pkt 98fpkt", shape=invhouse, color=bisque];
stat676[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.102.13.44:*, 159.33.221.164:80}[64.2643%]&lt;BR/&gt;{213.165.88.25:*, 159.33.221.164:80}[29.7297%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 28308: (0.23753%)&lt;BR/&gt; 28302: (0.23753%)&lt;BR/&gt; 28295: (0.23753%)&lt;BR/&gt; 28287: (0.23753%)&gt;];
}
1267--1337[label="0.00478469;1pkt 1fpkt"];
1267--1351[label="0.00564972;1pkt 1fpkt"];
1267--1355[label="0.00549451;1pkt 1fpkt"];
1267--1451[label="0.0144231;3pkt 3fpkt"];
1267--1616[label="1;214pkt 214fpkt"];
1267--2229[label="0.00714286;1pkt 1fpkt"];
1267--2525[label="1;99pkt 99fpkt"];
1267--2530[label="0.00442478;1pkt 1fpkt"];
1267--2678[label="0.004329;1pkt 1fpkt"];
1267--2949[label="0.0052356;1pkt 1fpkt"];
1267--3255[label="1;98pkt 98fpkt"];
1267--3382[label="0.0044843;1pkt 1fpkt"];
1267--3490[label="0.0052356;1pkt 1fpkt"];
1267--3669[label="1;98pkt 98fpkt"];
2525--3255[label="1;98pkt 98fpkt"];
2525--3669[label="1;98pkt 98fpkt"];
3255--3669[label="1;98pkt 98fpkt"];
</description>
    <slice>
      <filter dst_ip="159.33.221.164" dst_port="80" src_ip="2.102.13.44"/>
      <filter dst_ip="159.33.221.164" dst_port="80" src_ip="213.165.88.25"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498827" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_677{
style=filled;
color=gray75;
2527[label="193.52.3.26;2pkt 2fpkt", shape=pentagon, color=darkviolet];
3257[label="193.52.3.26;2pkt 2fpkt", shape=invtriangle, color=brown];
stat677[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.52.3.26:1863, 173.76.201.46:4740}[50%]&lt;BR/&gt;{193.52.3.26:1863, 173.76.224.80:1454}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1863: (50%)&lt;BR/&gt; 4740: (25%)&lt;BR/&gt; 1454: (25%)&gt;];
}
2527--3257[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="173.76.224.80" dst_port="1454" src_ip="193.52.3.26" src_port="1863"/>
      <filter dst_ip="173.76.201.46" dst_port="4740" src_ip="193.52.3.26" src_port="1863"/>
    </slice>
    <from sec="1086498005" usec="0"/>
    <to sec="1086498896" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_678{
style=filled;
color=gray75;
2536[label="208.90.70.28;4pkt 4fpkt", shape=pentagon, color=darkviolet];
3261[label="208.90.70.28;4pkt 4fpkt", shape=invtriangle, color=brown];
stat678[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.90.70.28:1367, 176.77.99.195:80}[25%]&lt;BR/&gt;{208.90.70.28:1369, 176.77.99.195:80}[25%]&lt;BR/&gt;{208.90.70.28:1375, 176.77.99.195:80}[25%]&lt;BR/&gt;{208.90.70.28:1377, 176.77.99.195:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1377: (12.5%)&lt;BR/&gt; 1375: (12.5%)&lt;BR/&gt; 1369: (12.5%)&lt;BR/&gt; 1367: (12.5%)&gt;];
}
2536--3261[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="176.77.99.195" dst_port="80" src_ip="208.90.70.28" src_port="1377"/>
      <filter dst_ip="176.77.99.195" dst_port="80" src_ip="208.90.70.28" src_port="1375"/>
      <filter dst_ip="176.77.99.195" dst_port="80" src_ip="208.90.70.28" src_port="1369"/>
      <filter dst_ip="176.77.99.195" dst_port="80" src_ip="208.90.70.28" src_port="1367"/>
    </slice>
    <from sec="1086498196" usec="0"/>
    <to sec="1086498248" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_679{
style=filled;
color=gray75;
2541[label="202.41.160.30;4pkt 4fpkt", shape=pentagon, color=darkviolet];
3265[label="202.41.160.30;5pkt 5fpkt", shape=invtriangle, color=brown];
stat679[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.41.160.30:80, 176.77.52.149:8635}[20%]&lt;BR/&gt;{202.41.160.30:80, 176.77.52.149:10202}[20%]&lt;BR/&gt;{202.41.160.30:80, 176.77.52.149:10224}[20%]&lt;BR/&gt;{202.41.160.30:80, 176.77.52.149:10262}[20%]&lt;BR/&gt;{202.41.160.30:80, 176.77.52.149:10336}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 10336: (11.1111%)&lt;BR/&gt; 10262: (11.1111%)&lt;BR/&gt; 10202: (11.1111%)&lt;BR/&gt; 8635: (11.1111%)&gt;];
}
2541--3265[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="176.77.52.149" dst_port="10336" src_ip="202.41.160.30" src_port="80"/>
      <filter dst_ip="176.77.52.149" dst_port="10262" src_ip="202.41.160.30" src_port="80"/>
      <filter dst_ip="176.77.52.149" dst_port="10224" src_ip="202.41.160.30" src_port="80"/>
      <filter dst_ip="176.77.52.149" dst_port="10202" src_ip="202.41.160.30" src_port="80"/>
      <filter dst_ip="176.77.52.149" dst_port="8635" src_ip="202.41.160.30" src_port="80"/>
    </slice>
    <from sec="1086498867" usec="0"/>
    <to sec="1086498881" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_681{
style=filled;
color=gray75;
2545[label="212.16.122.31;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3268[label="212.16.122.31;2pkt 2fpkt", shape=invtriangle, color=brown];
stat681[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.16.122.31:110, 159.33.211.227:4407}[50%]&lt;BR/&gt;{212.16.122.31:110, 159.33.211.227:4422}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 110: (50%)&lt;BR/&gt; 4422: (33.3333%)&lt;BR/&gt; 4407: (16.6667%)&gt;];
}
2545--3268[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="159.33.211.227" dst_port="4422" src_ip="212.16.122.31" src_port="110"/>
      <filter dst_ip="159.33.211.227" dst_port="4407" src_ip="212.16.122.31" src_port="110"/>
    </slice>
    <from sec="1086498098" usec="0"/>
    <to sec="1086498772" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_682{
style=filled;
color=gray75;
2550[label="214.150.164.33;121pkt 121fpkt", shape=pentagon, color=darkviolet];
3271[label="214.150.164.33;121pkt 121fpkt", shape=invtriangle, color=brown];
stat682[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.150.164.33:*, *:1027}[51.2397%]&lt;BR/&gt;{214.150.164.33:*, *:1026}[48.7603%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (25.6198%)&lt;BR/&gt; 1026: (24.3802%)&lt;BR/&gt; 4468: (0.826446%)&lt;BR/&gt; 4061: (0.826446%)&lt;BR/&gt; 3546: (0.826446%)&gt;];
}
2550--3271[label="1;121pkt 121fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="214.150.164.33"/>
      <filter dst_port="1026" src_ip="214.150.164.33"/>
    </slice>
    <from sec="1086498035" usec="0"/>
    <to sec="1086498880" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_683{
style=filled;
color=gray75;
2554[label="193.52.3.34;3pkt 3fpkt", shape=pentagon, color=darkviolet];
3272[label="193.52.3.34;3pkt 3fpkt", shape=invtriangle, color=brown];
3679[label="193.52.3.34;3pkt 3fpkt", shape=invhouse, color=bisque];
stat683[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.52.3.34:1863, 181.133.43.5:3015}[33.3333%]&lt;BR/&gt;{193.52.3.34:1863, 153.130.54.26:1073}[33.3333%]&lt;BR/&gt;{193.52.3.34:1863, 181.133.43.176:1040}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1863: (50%)&lt;BR/&gt; 3015: (16.6667%)&lt;BR/&gt; 1073: (16.6667%)&lt;BR/&gt; 1040: (16.6667%)&gt;];
}
2554--3272[label="1;3pkt 3fpkt"];
2554--3679[label="1;3pkt 3fpkt"];
3272--3679[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="181.133.43.176" dst_port="1040" src_ip="193.52.3.34" src_port="1863"/>
      <filter dst_ip="153.130.54.26" dst_port="1073" src_ip="193.52.3.34" src_port="1863"/>
      <filter dst_ip="181.133.43.5" dst_port="3015" src_ip="193.52.3.34" src_port="1863"/>
    </slice>
    <from sec="1086498165" usec="0"/>
    <to sec="1086498897" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.668423,1.48433,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="173.76.148.35"/>
    </slice>
    <from sec="1086498005" usec="0"/>
    <to sec="1086498836" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_685{
style=filled;
color=gray75;
2561[label="77.181.81.37;299pkt 299fpkt", shape=pentagon, color=darkviolet];
3276[label="77.181.81.37;298pkt 298fpkt", shape=invtriangle, color=brown];
3681[label="77.181.81.37;297pkt 297fpkt", shape=invhouse, color=bisque];
stat685[shape=component, label=&lt;Rules:&lt;BR/&gt;{77.181.81.37:*, *:1027}[51.505%]&lt;BR/&gt;{77.181.81.37:*, *:1026}[48.495%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (25.8389%)&lt;BR/&gt; 1026: (24.1611%)&lt;BR/&gt; 2498: (0.503356%)&lt;BR/&gt; 4973: (0.33557%)&lt;BR/&gt; 4743: (0.33557%)&gt;];
}
2561--3276[label="1;298pkt 298fpkt"];
2561--3681[label="1;297pkt 297fpkt"];
3276--3681[label="1;297pkt 297fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="77.181.81.37"/>
      <filter dst_port="1026" src_ip="77.181.81.37"/>
    </slice>
    <from sec="1086498007" usec="0"/>
    <to sec="1086498897" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_688{
style=filled;
color=gray75;
2569[label="78.5.228.39;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3282[label="78.5.228.39;1pkt 1fpkt", shape=invtriangle, color=brown];
stat688[shape=component, label=&lt;Rules:&lt;BR/&gt;{78.5.228.39:3702, 196.48.138.48:53}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3702: (50%)&lt;BR/&gt; 53: (50%)&gt;];
}
2569--3282[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="196.48.138.48" dst_port="53" src_ip="78.5.228.39" src_port="3702"/>
    </slice>
    <from sec="1086498735" usec="0"/>
    <to sec="1086498900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.668423,1.48433,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="3.212.189.41"/>
    </slice>
    <from sec="1086498003" usec="0"/>
    <to sec="1086498792" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.668423,1.48433,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="193.52.4.42"/>
    </slice>
    <from sec="1086498466" usec="0"/>
    <to sec="1086498837" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_691{
style=filled;
color=gray75;
2579[label="173.76.8.43;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3289[label="173.76.8.43;2pkt 2fpkt", shape=invtriangle, color=brown];
3689[label="173.76.8.43;2pkt 2fpkt", shape=invhouse, color=bisque];
stat691[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.76.8.43:33760, 5.228.103.188:80}[50%]&lt;BR/&gt;{173.76.8.43:33761, 5.228.103.188:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 33761: (30%)&lt;BR/&gt; 33760: (20%)&gt;];
}
2579--3289[label="1;1pkt 1fpkt"];
2579--3689[label="1;1pkt 1fpkt"];
3289--3689[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="5.228.103.188" dst_port="80" src_ip="173.76.8.43" src_port="33761"/>
      <filter dst_ip="5.228.103.188" dst_port="80" src_ip="173.76.8.43" src_port="33760"/>
    </slice>
    <from sec="1086498865" usec="0"/>
    <to sec="1086498876" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_692{
style=filled;
color=gray75;
2580[label="77.208.34.43;202pkt 202fpkt", shape=pentagon, color=darkviolet];
3290[label="77.208.34.43;198pkt 198fpkt", shape=invtriangle, color=brown];
stat692[shape=component, label=&lt;Rules:&lt;BR/&gt;{77.208.34.43:*, *:1026}[50.495%]&lt;BR/&gt;{77.208.34.43:*, *:1027}[49.505%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (25.25%)&lt;BR/&gt; 1027: (24.75%)&lt;BR/&gt; 3028: (0.5%)&lt;BR/&gt; 1269: (0.5%)&lt;BR/&gt; 4968: (0.25%)&gt;];
}
2580--3290[label="1;198pkt 198fpkt"];
</description>
    <slice>
      <filter dst_port="1026" src_ip="77.208.34.43"/>
      <filter dst_port="1027" src_ip="77.208.34.43"/>
    </slice>
    <from sec="1086498001" usec="0"/>
    <to sec="1086498888" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,020,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_693{
style=filled;
color=gray75;
2598[label="176.77.77.48;70pkt 70fpkt", shape=pentagon, color=darkviolet];
3300[label="176.77.77.48;70pkt 70fpkt", shape=invtriangle, color=brown];
stat693[shape=component, label=&lt;Rules:&lt;BR/&gt;{176.77.77.48:0, *:0}[95.7143%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (95.7143%)&lt;BR/&gt; 9898: (1.42857%)&lt;BR/&gt; 5554: (0.714286%)&lt;BR/&gt; 1744: (0.714286%)&lt;BR/&gt; 1606: (0.714286%)&gt;];
}
2598--3300[label="1;70pkt 70fpkt"];
</description>
    <slice>
      <filter src_ip="176.77.77.48"/>
    </slice>
    <from sec="1086498041" usec="0"/>
    <to sec="1086498872" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_695{
style=filled;
color=gray75;
2615[label="23.2.1.52;136pkt 136fpkt", shape=pentagon, color=darkviolet];
3309[label="23.2.1.52;135pkt 135fpkt", shape=invtriangle, color=brown];
stat695[shape=component, label=&lt;Rules:&lt;BR/&gt;{23.2.1.52:*, *:1027}[53.6765%]&lt;BR/&gt;{23.2.1.52:*, *:1026}[46.3235%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (26.9373%)&lt;BR/&gt; 1026: (23.0627%)&lt;BR/&gt; 4940: (0.369004%)&lt;BR/&gt; 4847: (0.369004%)&lt;BR/&gt; 4774: (0.369004%)&gt;];
}
2615--3309[label="1;135pkt 135fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="23.2.1.52"/>
      <filter dst_port="1026" src_ip="23.2.1.52"/>
    </slice>
    <from sec="1086498011" usec="0"/>
    <to sec="1086498890" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_696{
style=filled;
color=gray75;
2616[label="22.130.49.52;120pkt 120fpkt", shape=pentagon, color=darkviolet];
3310[label="22.130.49.52;120pkt 120fpkt", shape=invtriangle, color=brown];
stat696[shape=component, label=&lt;Rules:&lt;BR/&gt;{22.130.49.52:*, *:1026}[55%]&lt;BR/&gt;{22.130.49.52:*, *:1027}[45%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (27.5%)&lt;BR/&gt; 1027: (22.5%)&lt;BR/&gt; 4632: (0.833333%)&lt;BR/&gt; 3123: (0.833333%)&lt;BR/&gt; 1765: (0.833333%)&gt;];
}
2616--3310[label="1;120pkt 120fpkt"];
</description>
    <slice>
      <filter dst_port="1026" src_ip="22.130.49.52"/>
      <filter dst_port="1027" src_ip="22.130.49.52"/>
    </slice>
    <from sec="1086498011" usec="0"/>
    <to sec="1086498900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_697{
style=filled;
color=gray75;
2640[label="214.198.56.58;158pkt 158fpkt", shape=pentagon, color=darkviolet];
3318[label="214.198.56.58;158pkt 158fpkt", shape=invtriangle, color=brown];
stat697[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.198.56.58:*, *:1026}[50%]&lt;BR/&gt;{214.198.56.58:*, *:1027}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (25.3165%)&lt;BR/&gt; 1027: (25%)&lt;BR/&gt; 3370: (0.632911%)&lt;BR/&gt; 4975: (0.316456%)&lt;BR/&gt; 4908: (0.316456%)&gt;];
}
2640--3318[label="1;158pkt 158fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="214.198.56.58"/>
      <filter dst_port="1026" src_ip="214.198.56.58"/>
    </slice>
    <from sec="1086498334" usec="0"/>
    <to sec="1086498399" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.836585,1.41293,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_698{
style=filled;
color=gray75;
1100[label="196.48.146.138;d;149pkt 149fpkt", shape=diamond, color=yellow];
1106[label="181.133.93.5;d;107pkt 107fpkt", shape=diamond, color=yellow];
2459[label="218.221.129.11;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2646[label="208.172.27.60;4pkt 4fpkt", shape=pentagon, color=darkviolet];
3010[label="218.35.106.182;18pkt 18fpkt", shape=pentagon, color=darkviolet];
3013[label="218.35.106.183;8pkt 8fpkt", shape=pentagon, color=darkviolet];
3047[label="218.35.104.200;56pkt 56fpkt", shape=pentagon, color=darkviolet];
3210[label="218.221.129.11;1pkt 1fpkt", shape=invtriangle, color=brown];
3322[label="208.172.27.60;4pkt 4fpkt", shape=invtriangle, color=brown];
3521[label="218.35.106.182;18pkt 18fpkt", shape=invtriangle, color=brown];
3522[label="218.35.106.183;8pkt 8fpkt", shape=invtriangle, color=brown];
3826[label="218.35.106.183;8pkt 8fpkt", shape=invhouse, color=bisque];
stat698[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 181.133.93.5:*}[41.7969%]&lt;BR/&gt;{218.35.104.200:80, 196.48.146.138:*}[21.875%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.6084%)&lt;BR/&gt; 3469: (0.522193%)&lt;BR/&gt; 3459: (0.522193%)&lt;BR/&gt; 3458: (0.522193%)&lt;BR/&gt; 3444: (0.522193%)&gt;];
}
1100--3010[label="0.444444;8pkt 8fpkt"];
1100--3013[label="1;8pkt 8fpkt"];
1100--3047[label="1;56pkt 56fpkt"];
1100--3521[label="0.444444;8pkt 8fpkt"];
1100--3522[label="1;8pkt 8fpkt"];
1100--3826[label="1;8pkt 8fpkt"];
1106--2459[label="1;2pkt 2fpkt"];
1106--2646[label="1;4pkt 4fpkt"];
1106--3010[label="0.555556;10pkt 10fpkt"];
1106--3210[label="1;1pkt 1fpkt"];
1106--3322[label="1;4pkt 4fpkt"];
1106--3521[label="0.555556;10pkt 10fpkt"];
2459--3210[label="1;1pkt 1fpkt"];
2646--3322[label="1;4pkt 4fpkt"];
3010--3521[label="1;18pkt 18fpkt"];
3013--3522[label="1;8pkt 8fpkt"];
3013--3826[label="1;8pkt 8fpkt"];
3522--3826[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="181.133.93.5" src_port="80"/>
      <filter dst_ip="196.48.146.138" src_ip="218.35.104.200" src_port="80"/>
    </slice>
    <from sec="1086498015" usec="0"/>
    <to sec="1086498819" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_699{
style=filled;
color=gray75;
2651[label="215.91.14.61;201pkt 201fpkt", shape=pentagon, color=darkviolet];
3325[label="215.91.14.61;201pkt 201fpkt", shape=invtriangle, color=brown];
3708[label="215.91.14.61;200pkt 200fpkt", shape=invhouse, color=bisque];
stat699[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.91.14.61:*, *:1026}[56.2189%]&lt;BR/&gt;{215.91.14.61:*, *:1027}[43.7811%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (28.0731%)&lt;BR/&gt; 1027: (21.9269%)&lt;BR/&gt; 4742: (0.498339%)&lt;BR/&gt; 4364: (0.498339%)&lt;BR/&gt; 4352: (0.498339%)&gt;];
}
2651--3325[label="1;201pkt 201fpkt"];
2651--3708[label="1;200pkt 200fpkt"];
3325--3708[label="1;200pkt 200fpkt"];
</description>
    <slice>
      <filter dst_port="1026" src_ip="215.91.14.61"/>
      <filter dst_port="1027" src_ip="215.91.14.61"/>
    </slice>
    <from sec="1086498004" usec="0"/>
    <to sec="1086498670" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.668423,1.48433,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="213.168.192.61"/>
    </slice>
    <from sec="1086498666" usec="0"/>
    <to sec="1086498894" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_701{
style=filled;
color=gray75;
2657[label="173.76.225.61;2pkt 2fpkt", shape=pentagon, color=darkviolet];
3327[label="173.76.225.61;2pkt 2fpkt", shape=invtriangle, color=brown];
3710[label="173.76.225.61;2pkt 2fpkt", shape=invhouse, color=bisque];
stat701[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.76.225.61:1054, 193.52.4.1:1863}[50%]&lt;BR/&gt;{173.76.225.61:1039, 193.52.2.149:1863}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1863: (50%)&lt;BR/&gt; 1054: (25%)&lt;BR/&gt; 1039: (25%)&gt;];
}
2657--3327[label="1;2pkt 2fpkt"];
2657--3710[label="1;2pkt 2fpkt"];
3327--3710[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="193.52.2.149" dst_port="1863" src_ip="173.76.225.61" src_port="1039"/>
      <filter dst_ip="193.52.4.1" dst_port="1863" src_ip="173.76.225.61" src_port="1054"/>
    </slice>
    <from sec="1086498008" usec="0"/>
    <to sec="1086498900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_702{
style=filled;
color=gray75;
2661[label="197.120.229.63;52pkt 52fpkt", shape=pentagon, color=darkviolet];
3331[label="197.120.229.63;52pkt 52fpkt", shape=invtriangle, color=brown];
stat702[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.120.229.63:*, *:2745}[36.5385%]&lt;BR/&gt;{197.120.229.63:*, *:80}[21.1538%]&lt;BR/&gt;{197.120.229.63:*, *:1025}[21.1538%]&lt;BR/&gt;{197.120.229.63:*, *:6129}[21.1538%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2745: (18.2692%)&lt;BR/&gt; 6129: (10.5769%)&lt;BR/&gt; 1025: (10.5769%)&lt;BR/&gt; 80: (10.5769%)&lt;BR/&gt; 3036: (1.92308%)&gt;];
}
2661--3331[label="1;52pkt 52fpkt"];
</description>
    <slice>
      <filter dst_port="2745" src_ip="197.120.229.63"/>
      <filter dst_port="6129" src_ip="197.120.229.63"/>
      <filter dst_port="1025" src_ip="197.120.229.63"/>
      <filter dst_port="80" src_ip="197.120.229.63"/>
    </slice>
    <from sec="1086498096" usec="0"/>
    <to sec="1086498899" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_703{
style=filled;
color=gray75;
2664[label="173.76.26.64;2pkt 2fpkt", shape=pentagon, color=darkviolet];
3333[label="173.76.26.64;2pkt 2fpkt", shape=invtriangle, color=brown];
3714[label="173.76.26.64;2pkt 2fpkt", shape=invhouse, color=bisque];
stat703[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.76.26.64:3150, 5.228.103.188:80}[50%]&lt;BR/&gt;{173.76.26.64:3151, 5.228.103.188:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3151: (25%)&lt;BR/&gt; 3150: (25%)&gt;];
}
2664--3333[label="1;2pkt 2fpkt"];
2664--3714[label="1;2pkt 2fpkt"];
3333--3714[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="5.228.103.188" dst_port="80" src_ip="173.76.26.64" src_port="3151"/>
      <filter dst_ip="5.228.103.188" dst_port="80" src_ip="173.76.26.64" src_port="3150"/>
    </slice>
    <from sec="1086498287" usec="0"/>
    <to sec="1086498302" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_704{
style=filled;
color=gray75;
2666[label="153.130.51.64;10pkt 10fpkt", shape=pentagon, color=darkviolet];
3335[label="153.130.51.64;10pkt 10fpkt", shape=invtriangle, color=brown];
3716[label="153.130.51.64;9pkt 9fpkt", shape=invhouse, color=bisque];
stat704[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.130.51.64:*, 193.52.200.3:80}[20%]&lt;BR/&gt;{153.130.51.64:*, 193.52.227.19:80}[20%]&lt;BR/&gt;{153.130.51.64:*, 6.46.18.141:80}[20%]&lt;BR/&gt;{153.130.51.64:*, 193.52.234.57:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (44.8276%)&lt;BR/&gt; 2899: (5.17241%)&lt;BR/&gt; 2897: (5.17241%)&lt;BR/&gt; 2890: (5.17241%)&lt;BR/&gt; 2889: (5.17241%)&gt;];
}
2666--3335[label="1;10pkt 10fpkt"];
2666--3716[label="1;9pkt 9fpkt"];
3335--3716[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="193.52.234.57" dst_port="80" src_ip="153.130.51.64"/>
      <filter dst_ip="6.46.18.141" dst_port="80" src_ip="153.130.51.64"/>
      <filter dst_ip="193.52.227.19" dst_port="80" src_ip="153.130.51.64"/>
      <filter dst_ip="193.52.200.3" dst_port="80" src_ip="153.130.51.64"/>
    </slice>
    <from sec="1086498443" usec="0"/>
    <to sec="1086498612" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_706{
style=filled;
color=gray75;
2677[label="154.33.185.67;14pkt 14fpkt", shape=pentagon, color=darkviolet];
3341[label="154.33.185.67;14pkt 14fpkt", shape=invtriangle, color=brown];
3718[label="154.33.185.67;14pkt 14fpkt", shape=invhouse, color=bisque];
stat706[shape=component, label=&lt;Rules:&lt;BR/&gt;{154.33.185.67:80, 7.144.155.13:*}[50%]&lt;BR/&gt;{154.33.185.67:80, 7.144.155.11:*}[35.7143%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 60777: (3.57143%)&lt;BR/&gt; 59276: (3.57143%)&lt;BR/&gt; 58119: (3.57143%)&lt;BR/&gt; 54999: (3.57143%)&gt;];
}
2677--3341[label="1;14pkt 14fpkt"];
2677--3718[label="1;14pkt 14fpkt"];
3341--3718[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter dst_ip="7.144.155.13" src_ip="154.33.185.67" src_port="80"/>
      <filter dst_ip="7.144.155.11" src_ip="154.33.185.67" src_port="80"/>
    </slice>
    <from sec="1086498063" usec="0"/>
    <to sec="1086498880" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_707{
style=filled;
color=gray75;
2679[label="197.112.205.68;56pkt 56fpkt", shape=pentagon, color=darkviolet];
3342[label="197.112.205.68;56pkt 56fpkt", shape=invtriangle, color=brown];
stat707[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.112.205.68:*, *:2745}[26.7857%]&lt;BR/&gt;{197.112.205.68:*, *:1025}[25%]&lt;BR/&gt;{197.112.205.68:*, *:6129}[25%]&lt;BR/&gt;{197.112.205.68:*, *:80}[23.2143%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2745: (13.3929%)&lt;BR/&gt; 6129: (12.5%)&lt;BR/&gt; 1025: (12.5%)&lt;BR/&gt; 80: (11.6071%)&lt;BR/&gt; 4536: (0.892857%)&gt;];
}
2679--3342[label="1;56pkt 56fpkt"];
</description>
    <slice>
      <filter dst_port="2745" src_ip="197.112.205.68"/>
      <filter dst_port="6129" src_ip="197.112.205.68"/>
      <filter dst_port="1025" src_ip="197.112.205.68"/>
      <filter dst_port="80" src_ip="197.112.205.68"/>
    </slice>
    <from sec="1086498006" usec="0"/>
    <to sec="1086498811" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_709{
style=filled;
color=gray75;
2699[label="154.33.185.72;77pkt 77fpkt", shape=pentagon, color=darkviolet];
3355[label="154.33.185.72;77pkt 77fpkt", shape=invtriangle, color=brown];
3729[label="154.33.185.72;76pkt 76fpkt", shape=invhouse, color=bisque];
stat709[shape=component, label=&lt;Rules:&lt;BR/&gt;{154.33.185.72:53, *:*}[90.9091%]&lt;BR/&gt;{154.33.185.72:*, *:53}[25.974%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (58.4783%)&lt;BR/&gt; 49413: (3.26087%)&lt;BR/&gt; 9253: (2.6087%)&lt;BR/&gt; 0: (2.6087%)&lt;BR/&gt; 1024: (1.30435%)&gt;];
}
2699--3355[label="1;77pkt 77fpkt"];
2699--3729[label="1;76pkt 76fpkt"];
3355--3729[label="1;76pkt 76fpkt"];
</description>
    <slice>
      <filter src_ip="154.33.185.72" src_port="53"/>
      <filter dst_port="53" src_ip="154.33.185.72"/>
    </slice>
    <from sec="1086498009" usec="0"/>
    <to sec="1086498861" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.668423,1.48433,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="196.204.234.72"/>
    </slice>
    <from sec="1086498003" usec="0"/>
    <to sec="1086498296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_711{
style=filled;
color=gray75;
2705[label="193.200.122.73;139pkt 139fpkt", shape=pentagon, color=darkviolet];
3359[label="193.200.122.73;139pkt 139fpkt", shape=invtriangle, color=brown];
stat711[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.200.122.73:*, *:3127}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3127: (50%)&lt;BR/&gt; 4833: (0.719424%)&lt;BR/&gt; 4576: (0.719424%)&lt;BR/&gt; 4564: (0.719424%)&lt;BR/&gt; 4328: (0.719424%)&gt;];
}
2705--3359[label="1;139pkt 139fpkt"];
</description>
    <slice>
      <filter dst_port="3127" src_ip="193.200.122.73"/>
    </slice>
    <from sec="1086498004" usec="0"/>
    <to sec="1086498744" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_713{
style=filled;
color=gray75;
2720[label="210.74.132.76;255pkt 255fpkt", shape=pentagon, color=darkviolet];
3367[label="210.74.132.76;254pkt 254fpkt", shape=invtriangle, color=brown];
stat713[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.74.132.76:10276, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 10276: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
2720--3367[label="1;254pkt 254fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="210.74.132.76" src_port="10276"/>
    </slice>
    <from sec="1086498694" usec="0"/>
    <to sec="1086498714" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.668423,1.48433,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="78.19.37.78"/>
    </slice>
    <from sec="1086498475" usec="0"/>
    <to sec="1086498507" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.668423,1.48433,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="193.52.4.79"/>
    </slice>
    <from sec="1086498010" usec="0"/>
    <to sec="1086498816" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_716{
style=filled;
color=gray75;
2726[label="218.116.63.80;499pkt 499fpkt", shape=pentagon, color=darkviolet];
3372[label="218.116.63.80;497pkt 497fpkt", shape=invtriangle, color=brown];
3736[label="218.116.63.80;498pkt 498fpkt", shape=invhouse, color=bisque];
stat716[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.116.63.80:1039, *:1434}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1434: (50%)&lt;BR/&gt; 1039: (50%)&gt;];
}
2726--3372[label="1;497pkt 497fpkt"];
2726--3736[label="1;498pkt 498fpkt"];
3372--3736[label="1;497pkt 497fpkt"];
</description>
    <slice>
      <filter dst_port="1434" src_ip="218.116.63.80" src_port="1039"/>
    </slice>
    <from sec="1086498002" usec="0"/>
    <to sec="1086498899" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_717{
style=filled;
color=gray75;
2732[label="77.172.104.81;120pkt 120fpkt", shape=pentagon, color=darkviolet];
3373[label="77.172.104.81;119pkt 119fpkt", shape=invtriangle, color=brown];
stat717[shape=component, label=&lt;Rules:&lt;BR/&gt;{77.172.104.81:*, *:1026}[50%]&lt;BR/&gt;{77.172.104.81:*, *:1027}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (25.1046%)&lt;BR/&gt; 1026: (24.8954%)&lt;BR/&gt; 3627: (0.83682%)&lt;BR/&gt; 3521: (0.83682%)&lt;BR/&gt; 3211: (0.83682%)&gt;];
}
2732--3373[label="1;119pkt 119fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="77.172.104.81"/>
      <filter dst_port="1026" src_ip="77.172.104.81"/>
    </slice>
    <from sec="1086498256" usec="0"/>
    <to sec="1086498626" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_718{
style=filled;
color=gray75;
2737[label="218.70.153.83;35pkt 35fpkt", shape=pentagon, color=darkviolet];
3376[label="218.70.153.83;34pkt 34fpkt", shape=invtriangle, color=brown];
3739[label="218.70.153.83;35pkt 35fpkt", shape=invhouse, color=bisque];
stat718[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.70.153.83:80, 176.77.227.6:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1868: (1.44231%)&lt;BR/&gt; 1867: (1.44231%)&lt;BR/&gt; 1866: (1.44231%)&lt;BR/&gt; 1865: (1.44231%)&gt;];
}
2737--3376[label="1;34pkt 34fpkt"];
2737--3739[label="1;35pkt 35fpkt"];
3376--3739[label="1;34pkt 34fpkt"];
</description>
    <slice>
      <filter dst_ip="176.77.227.6" src_ip="218.70.153.83" src_port="80"/>
    </slice>
    <from sec="1086498838" usec="0"/>
    <to sec="1086498882" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_719{
style=filled;
color=gray75;
2738[label="159.33.222.83;6pkt 6fpkt", shape=pentagon, color=darkviolet];
3377[label="159.33.222.83;6pkt 6fpkt", shape=invtriangle, color=brown];
3740[label="159.33.222.83;6pkt 6fpkt", shape=invhouse, color=bisque];
stat719[shape=component, label=&lt;Rules:&lt;BR/&gt;{159.33.222.83:*, 212.16.66.3:*}[50%]&lt;BR/&gt;{159.33.222.83:*, 212.24.74.98:5190}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5190: (16.6667%)&lt;BR/&gt; 5050: (8.33333%)&lt;BR/&gt; 1086: (8.33333%)&lt;BR/&gt; 1083: (8.33333%)&lt;BR/&gt; 1077: (8.33333%)&gt;];
}
2738--3377[label="1;6pkt 6fpkt"];
2738--3740[label="1;6pkt 6fpkt"];
3377--3740[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="212.16.66.3" src_ip="159.33.222.83"/>
      <filter dst_ip="212.24.74.98" dst_port="5190" src_ip="159.33.222.83"/>
    </slice>
    <from sec="1086498013" usec="0"/>
    <to sec="1086498899" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,020,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_720{
style=filled;
color=gray75;
2740[label="176.77.6.84;28pkt 28fpkt", shape=pentagon, color=darkviolet];
3378[label="176.77.6.84;28pkt 28fpkt", shape=invtriangle, color=brown];
3741[label="176.77.6.84;28pkt 28fpkt", shape=invhouse, color=bisque];
stat720[shape=component, label=&lt;Rules:&lt;BR/&gt;{176.77.6.84:0, *:0}[92.8571%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (92.8571%)&lt;BR/&gt; 9898: (1.78571%)&lt;BR/&gt; 5554: (1.78571%)&lt;BR/&gt; 3751: (1.78571%)&lt;BR/&gt; 3394: (1.78571%)&gt;];
}
2740--3378[label="1;28pkt 28fpkt"];
2740--3741[label="1;28pkt 28fpkt"];
3378--3741[label="1;28pkt 28fpkt"];
</description>
    <slice>
      <filter src_ip="176.77.6.84"/>
    </slice>
    <from sec="1086498011" usec="0"/>
    <to sec="1086498880" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_722{
style=filled;
color=gray75;
2744[label="208.88.199.85;196pkt 196fpkt", shape=pentagon, color=darkviolet];
3381[label="208.88.199.85;194pkt 194fpkt", shape=invtriangle, color=brown];
3743[label="208.88.199.85;194pkt 194fpkt", shape=invhouse, color=bisque];
stat722[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.88.199.85:*, *:1026}[54.0816%]&lt;BR/&gt;{208.88.199.85:*, *:1027}[45.9184%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (27.0548%)&lt;BR/&gt; 1027: (22.9452%)&lt;BR/&gt; 4745: (0.513699%)&lt;BR/&gt; 4412: (0.513699%)&lt;BR/&gt; 4246: (0.513699%)&gt;];
}
2744--3381[label="1;194pkt 194fpkt"];
2744--3743[label="1;194pkt 194fpkt"];
3381--3743[label="1;194pkt 194fpkt"];
</description>
    <slice>
      <filter dst_port="1026" src_ip="208.88.199.85"/>
      <filter dst_port="1027" src_ip="208.88.199.85"/>
    </slice>
    <from sec="1086498002" usec="0"/>
    <to sec="1086498899" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_723{
style=filled;
color=gray75;
2749[label="153.130.70.90;53pkt 53fpkt", shape=pentagon, color=darkviolet];
3386[label="153.130.70.90;52pkt 52fpkt", shape=invtriangle, color=brown];
stat723[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.130.70.90:*, 7.80.221.136:80}[81.1321%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.0952%)&lt;BR/&gt; 3252: (0.952381%)&lt;BR/&gt; 3251: (0.952381%)&lt;BR/&gt; 3248: (0.952381%)&lt;BR/&gt; 3247: (0.952381%)&gt;];
}
2749--3386[label="1;52pkt 52fpkt"];
</description>
    <slice>
      <filter dst_ip="7.80.221.136" dst_port="80" src_ip="153.130.70.90"/>
    </slice>
    <from sec="1086498095" usec="0"/>
    <to sec="1086498887" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_724{
style=filled;
color=gray75;
2763[label="193.52.2.96;3pkt 3fpkt", shape=pentagon, color=darkviolet];
3390[label="193.52.2.96;2pkt 2fpkt", shape=invtriangle, color=brown];
stat724[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.52.2.96:1863, 153.130.6.52:1224}[33.3333%]&lt;BR/&gt;{193.52.2.96:1863, 176.77.13.227:59779}[33.3333%]&lt;BR/&gt;{193.52.2.96:1863, 153.130.4.237:1032}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1863: (50%)&lt;BR/&gt; 59779: (20%)&lt;BR/&gt; 1032: (20%)&lt;BR/&gt; 1224: (10%)&gt;];
}
2763--3390[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="153.130.4.237" dst_port="1032" src_ip="193.52.2.96" src_port="1863"/>
      <filter dst_ip="176.77.13.227" dst_port="59779" src_ip="193.52.2.96" src_port="1863"/>
      <filter dst_ip="153.130.6.52" dst_port="1224" src_ip="193.52.2.96" src_port="1863"/>
    </slice>
    <from sec="1086498010" usec="0"/>
    <to sec="1086498862" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_725{
style=filled;
color=gray75;
2769[label="153.130.219.98;39pkt 39fpkt", shape=pentagon, color=darkviolet];
3393[label="153.130.219.98;39pkt 39fpkt", shape=invtriangle, color=brown];
3748[label="153.130.219.98;39pkt 39fpkt", shape=invhouse, color=bisque];
stat725[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.130.219.98:25, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 54269: (1.28205%)&lt;BR/&gt; 54267: (1.28205%)&lt;BR/&gt; 48321: (1.28205%)&lt;BR/&gt; 46551: (1.28205%)&gt;];
}
2769--3393[label="1;39pkt 39fpkt"];
2769--3748[label="1;39pkt 39fpkt"];
3393--3748[label="1;39pkt 39fpkt"];
</description>
    <slice>
      <filter src_ip="153.130.219.98" src_port="25"/>
    </slice>
    <from sec="1086498003" usec="0"/>
    <to sec="1086498875" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_726{
style=filled;
color=gray75;
2770[label="23.104.7.99;88pkt 88fpkt", shape=pentagon, color=darkviolet];
3394[label="23.104.7.99;88pkt 88fpkt", shape=invtriangle, color=brown];
stat726[shape=component, label=&lt;Rules:&lt;BR/&gt;{23.104.7.99:*, *:3127}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3127: (50%)&lt;BR/&gt; 3180: (1.70455%)&lt;BR/&gt; 3358: (1.13636%)&lt;BR/&gt; 3190: (1.13636%)&lt;BR/&gt; 4972: (0.568182%)&gt;];
}
2770--3394[label="1;88pkt 88fpkt"];
</description>
    <slice>
      <filter dst_port="3127" src_ip="23.104.7.99"/>
    </slice>
    <from sec="1086498004" usec="0"/>
    <to sec="1086498789" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_727{
style=filled;
color=gray75;
2771[label="2.83.13.99;4pkt 4fpkt", shape=pentagon, color=darkviolet];
3395[label="2.83.13.99;244pkt 244fpkt", shape=invtriangle, color=brown];
3749[label="2.83.13.99;244pkt 244fpkt", shape=invhouse, color=bisque];
stat727[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.83.13.99:*, *:445}[51.2295%]&lt;BR/&gt;{2.83.13.99:*, *:135}[48.7705%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (25.813%)&lt;BR/&gt; 135: (24.187%)&lt;BR/&gt; 3753: (0.50813%)&lt;BR/&gt; 2457: (0.406504%)&lt;BR/&gt; 2157: (0.406504%)&gt;];
}
2771--3395[label="1;4pkt 4fpkt"];
2771--3749[label="1;4pkt 4fpkt"];
3395--3749[label="1;244pkt 244fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="2.83.13.99"/>
      <filter dst_port="135" src_ip="2.83.13.99"/>
    </slice>
    <from sec="1086498005" usec="0"/>
    <to sec="1086498901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_728{
style=filled;
color=gray75;
2775[label="208.137.239.100;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3397[label="208.137.239.100;2pkt 2fpkt", shape=invtriangle, color=brown];
3751[label="208.137.239.100;1pkt 1fpkt", shape=invhouse, color=bisque];
stat728[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.137.239.100:3214, 181.33.160.33:25}[50%]&lt;BR/&gt;{208.137.239.100:4597, 181.133.7.116:25}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 3214: (37.5%)&lt;BR/&gt; 4597: (12.5%)&gt;];
}
2775--3397[label="1;1pkt 1fpkt"];
2775--3751[label="1;1pkt 1fpkt"];
3397--3751[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="181.133.7.116" dst_port="25" src_ip="208.137.239.100" src_port="4597"/>
      <filter dst_ip="181.33.160.33" dst_port="25" src_ip="208.137.239.100" src_port="3214"/>
    </slice>
    <from sec="1086498757" usec="0"/>
    <to sec="1086498867" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_729{
style=filled;
color=gray75;
2801[label="218.70.113.109;3pkt 3fpkt", shape=pentagon, color=darkviolet];
3411[label="218.70.113.109;3pkt 3fpkt", shape=invtriangle, color=brown];
3762[label="218.70.113.109;3pkt 3fpkt", shape=invhouse, color=bisque];
stat729[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.70.113.109:40314, 153.130.21.128:80}[33.3333%]&lt;BR/&gt;{218.70.113.109:40322, 153.130.21.128:80}[33.3333%]&lt;BR/&gt;{218.70.113.109:40336, 153.130.21.128:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 40336: (16.6667%)&lt;BR/&gt; 40322: (16.6667%)&lt;BR/&gt; 40314: (16.6667%)&gt;];
}
2801--3411[label="1;3pkt 3fpkt"];
2801--3762[label="1;3pkt 3fpkt"];
3411--3762[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="153.130.21.128" dst_port="80" src_ip="218.70.113.109" src_port="40336"/>
      <filter dst_ip="153.130.21.128" dst_port="80" src_ip="218.70.113.109" src_port="40322"/>
      <filter dst_ip="153.130.21.128" dst_port="80" src_ip="218.70.113.109" src_port="40314"/>
    </slice>
    <from sec="1086498626" usec="0"/>
    <to sec="1086498665" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.668423,1.48433,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="82.96.35.111"/>
    </slice>
    <from sec="1086498117" usec="0"/>
    <to sec="1086498126" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_731{
style=filled;
color=gray75;
2805[label="20.33.110.111;112pkt 112fpkt", shape=pentagon, color=darkviolet];
3415[label="20.33.110.111;112pkt 112fpkt", shape=invtriangle, color=brown];
3765[label="20.33.110.111;112pkt 112fpkt", shape=invhouse, color=bisque];
stat731[shape=component, label=&lt;Rules:&lt;BR/&gt;{20.33.110.111:*, *:3127}[33.9286%]&lt;BR/&gt;{20.33.110.111:*, *:1080}[33.0357%]&lt;BR/&gt;{20.33.110.111:*, *:3128}[33.0357%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3127: (16.9643%)&lt;BR/&gt; 3128: (16.5179%)&lt;BR/&gt; 1080: (16.5179%)&lt;BR/&gt; 4953: (0.446429%)&lt;BR/&gt; 4874: (0.446429%)&gt;];
}
2805--3415[label="1;112pkt 112fpkt"];
2805--3765[label="1;112pkt 112fpkt"];
3415--3765[label="1;112pkt 112fpkt"];
</description>
    <slice>
      <filter dst_port="3127" src_ip="20.33.110.111"/>
      <filter dst_port="3128" src_ip="20.33.110.111"/>
      <filter dst_port="1080" src_ip="20.33.110.111"/>
    </slice>
    <from sec="1086498007" usec="0"/>
    <to sec="1086498899" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.668423,1.48433,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="5.228.144.114"/>
    </slice>
    <from sec="1086498393" usec="0"/>
    <to sec="1086498429" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_733{
style=filled;
color=gray75;
2820[label="212.49.32.118;90pkt 90fpkt", shape=pentagon, color=darkviolet];
3426[label="212.49.32.118;90pkt 90fpkt", shape=invtriangle, color=brown];
3770[label="212.49.32.118;89pkt 89fpkt", shape=invhouse, color=bisque];
stat733[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.49.32.118:*, *:135}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 4996: (0.557621%)&lt;BR/&gt; 4986: (0.557621%)&lt;BR/&gt; 4803: (0.557621%)&lt;BR/&gt; 4800: (0.557621%)&gt;];
}
2820--3426[label="1;90pkt 90fpkt"];
2820--3770[label="1;89pkt 89fpkt"];
3426--3770[label="1;89pkt 89fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="212.49.32.118"/>
    </slice>
    <from sec="1086498014" usec="0"/>
    <to sec="1086498862" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_734{
style=filled;
color=gray75;
2824[label="212.3.121.118;9pkt 9fpkt", shape=pentagon, color=darkviolet];
3427[label="212.3.121.118;9pkt 9fpkt", shape=invtriangle, color=brown];
stat734[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.3.121.118:5050, 159.33.212.176:*}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5050: (38.8889%)&lt;BR/&gt; 3498: (5.55556%)&lt;BR/&gt; 3480: (5.55556%)&lt;BR/&gt; 3324: (5.55556%)&lt;BR/&gt; 3299: (5.55556%)&gt;];
}
2824--3427[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="159.33.212.176" src_ip="212.3.121.118" src_port="5050"/>
    </slice>
    <from sec="1086498049" usec="0"/>
    <to sec="1086498899" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.668423,1.48433,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="159.33.237.120"/>
    </slice>
    <from sec="1086498004" usec="0"/>
    <to sec="1086498896" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_736{
style=filled;
color=gray75;
2836[label="153.130.6.122;7pkt 7fpkt", shape=pentagon, color=darkviolet];
3432[label="153.130.6.122;7pkt 7fpkt", shape=invtriangle, color=brown];
stat736[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.130.6.122:*, 192.54.139.16:80}[71.4286%]&lt;BR/&gt;{153.130.6.122:*, 82.101.131.18:80}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1770: (7.14286%)&lt;BR/&gt; 1769: (7.14286%)&lt;BR/&gt; 1768: (7.14286%)&lt;BR/&gt; 1767: (7.14286%)&gt;];
}
2836--3432[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="192.54.139.16" dst_port="80" src_ip="153.130.6.122"/>
      <filter dst_ip="82.101.131.18" dst_port="80" src_ip="153.130.6.122"/>
    </slice>
    <from sec="1086498266" usec="0"/>
    <to sec="1086498309" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.665125,1.40075,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_737{
style=filled;
color=gray75;
1799[label="215.88.49.122;s;604pkt 604fpkt", shape=diamond, color=yellow];
2839[label="215.88.49.122;637pkt 637fpkt", shape=pentagon, color=darkviolet];
3435[label="215.88.49.122;637pkt 637fpkt", shape=invtriangle, color=brown];
stat737[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.88.49.122:*, *:1026}[50.4658%]&lt;BR/&gt;{215.88.49.122:*, *:1027}[48.913%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (25.3461%)&lt;BR/&gt; 1027: (24.4143%)&lt;BR/&gt; 445: (0.292865%)&lt;BR/&gt; 4056: (0.239617%)&lt;BR/&gt; 2324: (0.239617%)&gt;];
}
1799--2839[label="0.988411;597pkt 597fpkt"];
1799--3435[label="0.988411;597pkt 597fpkt"];
2839--3435[label="1;637pkt 637fpkt"];
</description>
    <slice>
      <filter dst_port="1026" src_ip="215.88.49.122"/>
      <filter dst_port="1027" src_ip="215.88.49.122"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498895" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.668423,1.48433,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="198.114.77.130"/>
    </slice>
    <from sec="1086498013" usec="0"/>
    <to sec="1086498898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_741{
style=filled;
color=gray75;
2864[label="218.162.232.130;212pkt 212fpkt", shape=pentagon, color=darkviolet];
3446[label="218.162.232.130;211pkt 211fpkt", shape=invtriangle, color=brown];
3785[label="218.162.232.130;212pkt 212fpkt", shape=invhouse, color=bisque];
stat741[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.162.232.130:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 2044: (0.23622%)&lt;BR/&gt; 2043: (0.23622%)&lt;BR/&gt; 2042: (0.23622%)&lt;BR/&gt; 2041: (0.23622%)&gt;];
}
2864--3446[label="1;211pkt 211fpkt"];
2864--3785[label="1;212pkt 212fpkt"];
3446--3785[label="1;211pkt 211fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="218.162.232.130"/>
    </slice>
    <from sec="1086498435" usec="0"/>
    <to sec="1086498437" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_742{
style=filled;
color=gray75;
2865[label="77.75.134.131;145pkt 145fpkt", shape=pentagon, color=darkviolet];
3447[label="77.75.134.131;144pkt 144fpkt", shape=invtriangle, color=brown];
stat742[shape=component, label=&lt;Rules:&lt;BR/&gt;{77.75.134.131:*, *:1026}[53.1034%]&lt;BR/&gt;{77.75.134.131:*, *:1027}[46.8966%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (26.4706%)&lt;BR/&gt; 1027: (23.5294%)&lt;BR/&gt; 3697: (0.692042%)&lt;BR/&gt; 3679: (0.692042%)&lt;BR/&gt; 3635: (0.692042%)&gt;];
}
2865--3447[label="1;144pkt 144fpkt"];
</description>
    <slice>
      <filter dst_port="1026" src_ip="77.75.134.131"/>
      <filter dst_port="1027" src_ip="77.75.134.131"/>
    </slice>
    <from sec="1086498044" usec="0"/>
    <to sec="1086498900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_743{
style=filled;
color=gray75;
2866[label="214.203.246.132;240pkt 240fpkt", shape=pentagon, color=darkviolet];
3448[label="214.203.246.132;239pkt 239fpkt", shape=invtriangle, color=brown];
stat743[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.203.246.132:63729, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 63729: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
2866--3448[label="1;239pkt 239fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="214.203.246.132" src_port="63729"/>
    </slice>
    <from sec="1086498636" usec="0"/>
    <to sec="1086498650" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_744{
style=filled;
color=gray75;
2867[label="77.154.19.133;13pkt 13fpkt", shape=pentagon, color=darkviolet];
3449[label="77.154.19.133;12pkt 12fpkt", shape=invtriangle, color=brown];
stat744[shape=component, label=&lt;Rules:&lt;BR/&gt;{77.154.19.133:*, 176.77.248.79:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1874: (4%)&lt;BR/&gt; 1873: (4%)&lt;BR/&gt; 1872: (4%)&lt;BR/&gt; 1871: (4%)&gt;];
}
2867--3449[label="1;12pkt 12fpkt"];
</description>
    <slice>
      <filter dst_ip="176.77.248.79" dst_port="80" src_ip="77.154.19.133"/>
    </slice>
    <from sec="1086498677" usec="0"/>
    <to sec="1086498729" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_745{
style=filled;
color=gray75;
2874[label="197.104.223.135;88pkt 88fpkt", shape=pentagon, color=darkviolet];
3451[label="197.104.223.135;87pkt 87fpkt", shape=invtriangle, color=brown];
3787[label="197.104.223.135;88pkt 88fpkt", shape=invhouse, color=bisque];
stat745[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.104.223.135:*, *:2745}[31.8182%]&lt;BR/&gt;{197.104.223.135:*, *:1025}[26.1364%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2745: (15.7795%)&lt;BR/&gt; 1025: (13.1179%)&lt;BR/&gt; 6129: (9.12548%)&lt;BR/&gt; 1433: (6.84411%)&lt;BR/&gt; 5000: (5.13308%)&gt;];
}
2874--3451[label="1;87pkt 87fpkt"];
2874--3787[label="1;88pkt 88fpkt"];
3451--3787[label="1;87pkt 87fpkt"];
</description>
    <slice>
      <filter dst_port="2745" src_ip="197.104.223.135"/>
      <filter dst_port="1025" src_ip="197.104.223.135"/>
    </slice>
    <from sec="1086498010" usec="0"/>
    <to sec="1086498849" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_746{
style=filled;
color=gray75;
2878[label="77.128.141.136;72pkt 72fpkt", shape=pentagon, color=darkviolet];
3453[label="77.128.141.136;71pkt 71fpkt", shape=invtriangle, color=brown];
3788[label="77.128.141.136;72pkt 72fpkt", shape=invhouse, color=bisque];
stat746[shape=component, label=&lt;Rules:&lt;BR/&gt;{77.128.141.136:*, *:445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (50%)&lt;BR/&gt; 60972: (0.697674%)&lt;BR/&gt; 60948: (0.697674%)&lt;BR/&gt; 60922: (0.697674%)&lt;BR/&gt; 60769: (0.697674%)&gt;];
}
2878--3453[label="1;71pkt 71fpkt"];
2878--3788[label="1;72pkt 72fpkt"];
3453--3788[label="1;71pkt 71fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="77.128.141.136"/>
    </slice>
    <from sec="1086498007" usec="0"/>
    <to sec="1086498880" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.668423,1.48433,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="7.80.194.137"/>
    </slice>
    <from sec="1086498464" usec="0"/>
    <to sec="1086498466" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_748{
style=filled;
color=gray75;
2887[label="213.43.85.138;116pkt 116fpkt", shape=pentagon, color=darkviolet];
3458[label="213.43.85.138;115pkt 115fpkt", shape=invtriangle, color=brown];
3791[label="213.43.85.138;116pkt 116fpkt", shape=invhouse, color=bisque];
stat748[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.43.85.138:*, *:9898}[50.8621%]&lt;BR/&gt;{213.43.85.138:*, *:5554}[49.1379%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (25.5043%)&lt;BR/&gt; 5554: (24.4957%)&lt;BR/&gt; 4883: (0.432277%)&lt;BR/&gt; 4882: (0.432277%)&lt;BR/&gt; 4852: (0.432277%)&gt;];
}
2887--3458[label="1;115pkt 115fpkt"];
2887--3791[label="1;116pkt 116fpkt"];
3458--3791[label="1;115pkt 115fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="213.43.85.138"/>
      <filter dst_port="5554" src_ip="213.43.85.138"/>
    </slice>
    <from sec="1086498205" usec="0"/>
    <to sec="1086498207" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_749{
style=filled;
color=gray75;
2888[label="214.217.186.138;399pkt 399fpkt", shape=pentagon, color=darkviolet];
3459[label="214.217.186.138;398pkt 398fpkt", shape=invtriangle, color=brown];
3792[label="214.217.186.138;399pkt 399fpkt", shape=invhouse, color=bisque];
stat749[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.217.186.138:*, *:9898}[51.1278%]&lt;BR/&gt;{214.217.186.138:*, *:5554}[48.8722%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (25.5435%)&lt;BR/&gt; 5554: (24.4565%)&lt;BR/&gt; 4996: (0.125418%)&lt;BR/&gt; 4980: (0.125418%)&lt;BR/&gt; 4964: (0.125418%)&gt;];
}
2888--3459[label="1;398pkt 398fpkt"];
2888--3792[label="1;399pkt 399fpkt"];
3459--3792[label="1;398pkt 398fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="214.217.186.138"/>
      <filter dst_port="5554" src_ip="214.217.186.138"/>
    </slice>
    <from sec="1086498073" usec="0"/>
    <to sec="1086498075" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.833275,1.40558,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_752{
style=filled;
color=gray75;
1760[label="153.130.1.49;d;107pkt 107fpkt", shape=diamond, color=yellow];
1775[label="3.146.70.217;s;16pkt 16fpkt", shape=diamond, color=yellow];
1842[label="173.76.151.193;d;117pkt 117fpkt", shape=diamond, color=yellow];
1858[label="5.112.34.110;s;77pkt 77fpkt", shape=diamond, color=yellow];
2245[label="153.130.1.49;d;78pkt 78fpkt", shape=hexagon, color=black];
2254[label="3.146.70.217;s;15pkt 15fpkt", shape=hexagon, color=black];
2316[label="173.76.151.193;d;58pkt 58fpkt", shape=hexagon, color=black];
2896[label="3.146.70.142;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2905[label="216.157.68.147;38pkt 38fpkt", shape=pentagon, color=darkviolet];
3081[label="3.146.70.210;5pkt 5fpkt", shape=pentagon, color=darkviolet];
3098[label="3.146.70.217;16pkt 16fpkt", shape=pentagon, color=darkviolet];
3392[label="5.112.40.98;31pkt 31fpkt", shape=invtriangle, color=brown];
3464[label="3.146.70.142;2pkt 2fpkt", shape=invtriangle, color=brown];
stat752[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 173.76.151.193:*}[49.3562%]&lt;BR/&gt;{*:80, 153.130.1.49:*}[48.0687%]&lt;BR/&gt;{5.112.34.110:80, *:*}[33.0472%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.6448%)&lt;BR/&gt; 1863: (0.62167%)&lt;BR/&gt; 1874: (0.44405%)&lt;BR/&gt; 1868: (0.44405%)&lt;BR/&gt; 1858: (0.44405%)&gt;];
}
1760--1775[label="0.8125;13pkt 13fpkt"];
1760--1858[label="0.545455;42pkt 42fpkt"];
1760--2245[label="1;78pkt 78fpkt"];
1760--2254[label="0.866667;13pkt 13fpkt"];
1760--2905[label="0.815789;31pkt 31fpkt"];
1760--3098[label="0.8125;13pkt 13fpkt"];
1775--1842[label="0.1875;3pkt 3fpkt"];
1775--2245[label="0.8125;13pkt 13fpkt"];
1775--2254[label="1;15pkt 15fpkt"];
1775--2316[label="0.1875;3pkt 3fpkt"];
1775--3098[label="1;16pkt 16fpkt"];
1842--1858[label="0.428571;33pkt 33fpkt"];
1842--2254[label="0.133333;2pkt 2fpkt"];
1842--2316[label="1;58pkt 58fpkt"];
1842--2338[label="0.017094;2pkt 2fpkt"];
1842--2896[label="1;3pkt 3fpkt"];
1842--3081[label="1;5pkt 5fpkt"];
1842--3098[label="0.1875;3pkt 3fpkt"];
1842--3392[label="1;31pkt 31fpkt"];
1842--3464[label="1;2pkt 2fpkt"];
1858--2245[label="0.168831;13pkt 13fpkt"];
1858--2316[label="0.568966;33pkt 33fpkt"];
2245--2254[label="0.866667;13pkt 13fpkt"];
2245--2905[label="0.815789;31pkt 31fpkt"];
2245--3098[label="0.8125;13pkt 13fpkt"];
2254--2316[label="0.133333;2pkt 2fpkt"];
2254--3098[label="1;15pkt 15fpkt"];
2316--2338[label="0.0344828;2pkt 2fpkt"];
2316--3098[label="0.1875;3pkt 3fpkt"];
2896--3464[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_ip="5.112.34.110" src_port="80"/>
      <filter dst_ip="173.76.151.193" src_port="80"/>
      <filter dst_ip="153.130.1.49" src_port="80"/>
    </slice>
    <from sec="1086498400" usec="0"/>
    <to sec="1086498827" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_753{
style=filled;
color=gray75;
2901[label="196.58.182.144;37pkt 37fpkt", shape=pentagon, color=darkviolet];
3467[label="196.58.182.144;37pkt 37fpkt", shape=invtriangle, color=brown];
stat753[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.58.182.144:*, 213.133.245.245:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2466: (1.35135%)&lt;BR/&gt; 2465: (1.35135%)&lt;BR/&gt; 2464: (1.35135%)&lt;BR/&gt; 2463: (1.35135%)&gt;];
}
2901--3467[label="1;37pkt 37fpkt"];
</description>
    <slice>
      <filter dst_ip="213.133.245.245" dst_port="80" src_ip="196.58.182.144"/>
    </slice>
    <from sec="1086498036" usec="0"/>
    <to sec="1086498881" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,001,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_754{
style=filled;
color=gray75;
2903[label="77.85.49.145;253pkt 253fpkt", shape=pentagon, color=darkviolet];
3468[label="77.85.49.145;252pkt 252fpkt", shape=invtriangle, color=brown];
stat754[shape=component, label=&lt;Rules:&lt;BR/&gt;{77.85.49.145:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 3356: (0.19802%)&lt;BR/&gt; 3355: (0.19802%)&lt;BR/&gt; 3344: (0.19802%)&lt;BR/&gt; 3330: (0.19802%)&gt;];
}
2903--3468[label="1;252pkt 252fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="77.85.49.145"/>
    </slice>
    <from sec="1086498453" usec="0"/>
    <to sec="1086498455" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_756{
style=filled;
color=gray75;
2919[label="5.81.49.152;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3475[label="5.81.49.152;1pkt 1fpkt", shape=invtriangle, color=brown];
stat756[shape=component, label=&lt;Rules:&lt;BR/&gt;{5.81.49.152:45810, 153.130.51.60:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 45810: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
2919--3475[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="153.130.51.60" dst_port="80" src_ip="5.81.49.152" src_port="45810"/>
    </slice>
    <from sec="1086498817" usec="0"/>
    <to sec="1086498833" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_757{
style=filled;
color=gray75;
2921[label="215.68.81.153;253pkt 253fpkt", shape=pentagon, color=darkviolet];
3476[label="215.68.81.153;253pkt 253fpkt", shape=invtriangle, color=brown];
3801[label="215.68.81.153;252pkt 252fpkt", shape=invhouse, color=bisque];
stat757[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.68.81.153:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 1919: (0.197889%)&lt;BR/&gt; 1918: (0.197889%)&lt;BR/&gt; 1916: (0.197889%)&lt;BR/&gt; 1915: (0.197889%)&gt;];
}
2921--3476[label="1;253pkt 253fpkt"];
2921--3801[label="1;252pkt 252fpkt"];
3476--3801[label="1;252pkt 252fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="215.68.81.153"/>
    </slice>
    <from sec="1086498768" usec="0"/>
    <to sec="1086498770" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.665125,1.40075,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_758{
style=filled;
color=gray75;
1015[label="181.33.161.152;d;1460pkt 1460fpkt", shape=diamond, color=yellow];
1018[label="180.46.127.123;s;1644pkt 1644fpkt", shape=diamond, color=yellow];
2952[label="208.140.15.164;63pkt 63fpkt", shape=pentagon, color=darkviolet];
3491[label="208.140.15.164;63pkt 63fpkt", shape=invtriangle, color=brown];
stat758[shape=component, label=&lt;Rules:&lt;BR/&gt;{180.46.127.123:80, 181.33.161.152:*}[94.6429%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.5542%)&lt;BR/&gt; 3128: (1.00619%)&lt;BR/&gt; 1080: (0.975232%)&lt;BR/&gt; 65534: (0.464396%)&lt;BR/&gt; 53: (0.464396%)&gt;];
}
1015--1018[label="0.978767;1429pkt 1429fpkt"];
1015--1499[label="0.0117647;1pkt 1fpkt"];
1015--2952[label="0.031746;2pkt 2fpkt"];
1015--3491[label="0.031746;2pkt 2fpkt"];
2952--3491[label="1;63pkt 63fpkt"];
</description>
    <slice>
      <filter dst_ip="181.33.161.152" src_ip="180.46.127.123" src_port="80"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_759{
style=filled;
color=gray75;
2958[label="214.198.24.165;294pkt 294fpkt", shape=pentagon, color=darkviolet];
3494[label="214.198.24.165;292pkt 292fpkt", shape=invtriangle, color=brown];
stat759[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.198.24.165:*, *:1027}[53.0612%]&lt;BR/&gt;{214.198.24.165:*, *:1026}[46.9388%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (26.5358%)&lt;BR/&gt; 1026: (23.4642%)&lt;BR/&gt; 3440: (0.341297%)&lt;BR/&gt; 3067: (0.341297%)&lt;BR/&gt; 2770: (0.341297%)&gt;];
}
2958--3494[label="1;292pkt 292fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="214.198.24.165"/>
      <filter dst_port="1026" src_ip="214.198.24.165"/>
    </slice>
    <from sec="1086498003" usec="0"/>
    <to sec="1086498896" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_761{
style=filled;
color=gray75;
2970[label="198.40.3.169;283pkt 283fpkt", shape=pentagon, color=darkviolet];
3499[label="198.40.3.169;270pkt 270fpkt", shape=invtriangle, color=brown];
stat761[shape=component, label=&lt;Rules:&lt;BR/&gt;{198.40.3.169:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
2970--3499[label="1;270pkt 270fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="198.40.3.169" src_port="1025"/>
    </slice>
    <from sec="1086498001" usec="0"/>
    <to sec="1086498432" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,504,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_762{
style=filled;
color=gray75;
2984[label="7.80.201.174;7pkt 7fpkt", shape=pentagon, color=darkviolet];
3505[label="7.80.201.174;7pkt 7fpkt", shape=invtriangle, color=brown];
stat762[shape=component, label=&lt;Rules:&lt;BR/&gt;{7.80.201.174:443, *:*}[42.8571%]&lt;BR/&gt;{7.80.201.174:80, 176.77.152.140:*}[28.5714%]&lt;BR/&gt;{7.80.201.174:*, 153.130.130.96:*}[28.5714%]&lt;BR/&gt;{7.80.201.174:*, 153.130.69.114:*}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (28.5714%)&lt;BR/&gt; 443: (21.4286%)&lt;BR/&gt; 31602: (7.14286%)&lt;BR/&gt; 2963: (7.14286%)&lt;BR/&gt; 2961: (7.14286%)&gt;];
}
2984--3505[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="153.130.69.114" src_ip="7.80.201.174"/>
      <filter dst_ip="153.130.130.96" src_ip="7.80.201.174"/>
      <filter src_ip="7.80.201.174" src_port="443"/>
      <filter dst_ip="176.77.152.140" src_ip="7.80.201.174" src_port="80"/>
    </slice>
    <from sec="1086498014" usec="0"/>
    <to sec="1086498565" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,504,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_763{
style=filled;
color=gray75;
2988[label="181.133.78.176;7pkt 7fpkt", shape=pentagon, color=darkviolet];
3507[label="181.133.78.176;7pkt 7fpkt", shape=invtriangle, color=brown];
stat763[shape=component, label=&lt;Rules:&lt;BR/&gt;{181.133.78.176:*, 193.52.129.162:80}[28.5714%]&lt;BR/&gt;{181.133.78.176:*, 193.52.235.95:443}[28.5714%]&lt;BR/&gt;{181.133.78.176:*, 193.52.235.95:80}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (35.7143%)&lt;BR/&gt; 443: (14.2857%)&lt;BR/&gt; 1530: (7.14286%)&lt;BR/&gt; 1526: (7.14286%)&lt;BR/&gt; 1524: (7.14286%)&gt;];
}
2988--3507[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="193.52.235.95" dst_port="80" src_ip="181.133.78.176"/>
      <filter dst_ip="193.52.235.95" dst_port="443" src_ip="181.133.78.176"/>
      <filter dst_ip="193.52.129.162" dst_port="80" src_ip="181.133.78.176"/>
    </slice>
    <from sec="1086498371" usec="0"/>
    <to sec="1086498379" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.7096,1.44955,010,0 0 0 1 0 0 0 0 0 0 1 0 ">
    <description>subgraph cluster_764{
style=filled;
color=gray75;
1502[label="219.90.21.177;s;1198pkt 1198fpkt", shape=diamond, color=yellow];
3511[label="219.90.21.177;1370pkt 1370fpkt", shape=invtriangle, color=brown];
stat764[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.90.21.177:0, *:1080}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1080: (50%)&lt;BR/&gt; 0: (50%)&gt;];
}
1502--3511[label="0.996661;1194pkt 1194fpkt"];
</description>
    <slice>
      <filter dst_port="1080" src_ip="219.90.21.177"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.668423,1.48433,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="82.97.97.179"/>
    </slice>
    <from sec="1086498003" usec="0"/>
    <to sec="1086498608" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.668423,1.48433,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="2.174.163.180"/>
    </slice>
    <from sec="1086498136" usec="0"/>
    <to sec="1086498407" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,001,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_767{
style=filled;
color=gray75;
3008[label="215.93.36.182;123pkt 123fpkt", shape=pentagon, color=darkviolet];
3520[label="215.93.36.182;123pkt 123fpkt", shape=invtriangle, color=brown];
stat767[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.93.36.182:*, *:9898}[61.7886%]&lt;BR/&gt;{215.93.36.182:*, *:5554}[38.2114%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (30.8943%)&lt;BR/&gt; 5554: (19.1057%)&lt;BR/&gt; 2665: (0.406504%)&lt;BR/&gt; 2664: (0.406504%)&lt;BR/&gt; 2650: (0.406504%)&gt;];
}
3008--3520[label="1;123pkt 123fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="215.93.36.182"/>
      <filter dst_port="5554" src_ip="215.93.36.182"/>
    </slice>
    <from sec="1086498860" usec="0"/>
    <to sec="1086498862" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_768{
style=filled;
color=gray75;
3016[label="173.76.112.184;22pkt 22fpkt", shape=pentagon, color=darkviolet];
3523[label="173.76.112.184;22pkt 22fpkt", shape=invtriangle, color=brown];
stat768[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.76.112.184:*, 200.162.194.191:80}[63.6364%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (43.1818%)&lt;BR/&gt; 443: (4.54545%)&lt;BR/&gt; 4409: (2.27273%)&lt;BR/&gt; 2351: (2.27273%)&lt;BR/&gt; 2349: (2.27273%)&gt;];
}
3016--3523[label="1;22pkt 22fpkt"];
</description>
    <slice>
      <filter dst_ip="200.162.194.191" dst_port="80" src_ip="173.76.112.184"/>
    </slice>
    <from sec="1086498009" usec="0"/>
    <to sec="1086498887" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.668423,1.48433,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="153.130.89.186"/>
    </slice>
    <from sec="1086498020" usec="0"/>
    <to sec="1086498837" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_771{
style=filled;
color=gray75;
3024[label="214.109.207.187;137pkt 137fpkt", shape=pentagon, color=darkviolet];
3529[label="214.109.207.187;137pkt 137fpkt", shape=invtriangle, color=brown];
3829[label="214.109.207.187;137pkt 137fpkt", shape=invhouse, color=bisque];
stat771[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.109.207.187:*, *:1027}[51.8248%]&lt;BR/&gt;{214.109.207.187:*, *:1026}[48.1752%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (25.9124%)&lt;BR/&gt; 1026: (24.0876%)&lt;BR/&gt; 2595: (0.729927%)&lt;BR/&gt; 2166: (0.729927%)&lt;BR/&gt; 1834: (0.729927%)&gt;];
}
3024--3529[label="1;137pkt 137fpkt"];
3024--3829[label="1;137pkt 137fpkt"];
3529--3829[label="1;137pkt 137fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="214.109.207.187"/>
      <filter dst_port="1026" src_ip="214.109.207.187"/>
    </slice>
    <from sec="1086498006" usec="0"/>
    <to sec="1086498594" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,020,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_772{
style=filled;
color=gray75;
3035[label="176.77.40.192;23pkt 23fpkt", shape=pentagon, color=darkviolet];
3537[label="176.77.40.192;23pkt 23fpkt", shape=invtriangle, color=brown];
stat772[shape=component, label=&lt;Rules:&lt;BR/&gt;{176.77.40.192:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
3035--3537[label="1;23pkt 23fpkt"];
</description>
    <slice>
      <filter src_ip="176.77.40.192"/>
    </slice>
    <from sec="1086498069" usec="0"/>
    <to sec="1086498795" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_773{
style=filled;
color=gray75;
3041[label="196.206.96.196;166pkt 166fpkt", shape=pentagon, color=darkviolet];
3544[label="196.206.96.196;166pkt 166fpkt", shape=invtriangle, color=brown];
3840[label="196.206.96.196;166pkt 166fpkt", shape=invhouse, color=bisque];
stat773[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.206.96.196:*, *:1026}[45.7831%]&lt;BR/&gt;{196.206.96.196:*, *:1027}[44.5783%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (22.8916%)&lt;BR/&gt; 1027: (22.2892%)&lt;BR/&gt; 0: (7.22892%)&lt;BR/&gt; 445: (1.20482%)&lt;BR/&gt; 4759: (0.60241%)&gt;];
}
3041--3544[label="1;166pkt 166fpkt"];
3041--3840[label="1;166pkt 166fpkt"];
3544--3840[label="1;166pkt 166fpkt"];
</description>
    <slice>
      <filter dst_port="1026" src_ip="196.206.96.196"/>
      <filter dst_port="1027" src_ip="196.206.96.196"/>
    </slice>
    <from sec="1086498140" usec="0"/>
    <to sec="1086498898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_774{
style=filled;
color=gray75;
3057[label="196.48.56.202;9pkt 9fpkt", shape=pentagon, color=darkviolet];
3549[label="196.48.56.202;9pkt 9fpkt", shape=invtriangle, color=brown];
stat774[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.48.56.202:80, 6.46.124.123:*}[77.7778%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 62854: (5.55556%)&lt;BR/&gt; 54256: (5.55556%)&lt;BR/&gt; 47442: (5.55556%)&lt;BR/&gt; 35482: (5.55556%)&gt;];
}
3057--3549[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="6.46.124.123" src_ip="196.48.56.202" src_port="80"/>
    </slice>
    <from sec="1086498230" usec="0"/>
    <to sec="1086498889" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_775{
style=filled;
color=gray75;
3065[label="153.130.139.204;58pkt 58fpkt", shape=pentagon, color=darkviolet];
3551[label="153.130.139.204;57pkt 57fpkt", shape=invtriangle, color=brown];
stat775[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.130.139.204:*, 204.128.73.131:80}[22.4138%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 33248: (0.869565%)&lt;BR/&gt; 33233: (0.869565%)&lt;BR/&gt; 33219: (0.869565%)&lt;BR/&gt; 33217: (0.869565%)&gt;];
}
3065--3551[label="1;57pkt 57fpkt"];
</description>
    <slice>
      <filter dst_ip="204.128.73.131" dst_port="80" src_ip="153.130.139.204"/>
    </slice>
    <from sec="1086498001" usec="0"/>
    <to sec="1086498899" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.833275,1.40558,999,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_776{
style=filled;
color=gray75;
1518[label="193.52.0.199;d;65pkt 65fpkt", shape=diamond, color=yellow];
1519[label="196.52.81.203;s;30pkt 30fpkt", shape=diamond, color=yellow];
1569[label="176.77.40.84;s;77pkt 77fpkt", shape=diamond, color=yellow];
1593[label="193.52.6.13;d;1pkt 1fpkt", shape=diamond, color=yellow];
1860[label="173.76.151.150;s;49pkt 49fpkt", shape=diamond, color=yellow];
2147[label="193.52.0.199;d;48pkt 48fpkt", shape=hexagon, color=black];
2148[label="196.52.81.203;s;28pkt 28fpkt", shape=hexagon, color=black];
2343[label="176.77.40.84;s;77pkt 77fpkt", shape=hexagon, color=black];
2444[label="181.133.8.8;21pkt 21fpkt", shape=pentagon, color=darkviolet];
2667[label="176.77.98.64;8pkt 8fpkt", shape=pentagon, color=darkviolet];
2741[label="176.77.40.84;81pkt 81fpkt", shape=pentagon, color=darkviolet];
2809[label="173.76.148.113;34pkt 34fpkt", shape=pentagon, color=darkviolet];
3072[label="181.133.42.208;11pkt 11fpkt", shape=pentagon, color=darkviolet];
3172[label="173.76.148.251;20pkt 20fpkt", shape=pentagon, color=darkviolet];
3557[label="181.133.42.208;11pkt 11fpkt", shape=invtriangle, color=brown];
stat776[shape=component, label=&lt;Rules:&lt;BR/&gt;{176.77.40.84:*, *:80}[22.6537%]&lt;BR/&gt;{*:*, 193.52.0.199:*}[21.0356%]&lt;BR/&gt;{*:*, *:1863}[20.712%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (32.1747%)&lt;BR/&gt; 1863: (10.6061%)&lt;BR/&gt; 7001: (2.40642%)&lt;BR/&gt; 443: (1.78253%)&lt;BR/&gt; 8080: (1.24777%)&gt;];
}
1518--1519[label="0.0666667;2pkt 2fpkt"];
1518--1569[label="0.0153846;1pkt 1fpkt"];
1518--1611[label="0.0153846;1pkt 1fpkt"];
1518--1860[label="0.0204082;1pkt 1fpkt"];
1518--1939[label="0.0153846;1pkt 1fpkt"];
1518--2091[label="0.0153846;1pkt 1fpkt"];
1518--2147[label="1;48pkt 48fpkt"];
1518--2148[label="0.0714286;2pkt 2fpkt"];
1518--2343[label="0.0153846;1pkt 1fpkt"];
1518--2354[label="0.0153846;1pkt 1fpkt"];
1518--2444[label="0.047619;1pkt 1fpkt"];
1518--2667[label="0.25;2pkt 2fpkt"];
1518--2741[label="0.0153846;1pkt 1fpkt"];
1518--2809[label="0.0294118;1pkt 1fpkt"];
1518--3060[label="0.0153846;1pkt 1fpkt"];
1518--3072[label="0.0909091;1pkt 1fpkt"];
1518--3172[label="0.05;1pkt 1fpkt"];
1518--3557[label="0.0909091;1pkt 1fpkt"];
1519--1593[label="1;1pkt 1fpkt"];
1519--2147[label="0.0666667;2pkt 2fpkt"];
1519--2148[label="1;28pkt 28fpkt"];
1569--2147[label="0.0208333;1pkt 1fpkt"];
1569--2343[label="1;77pkt 77fpkt"];
1569--2741[label="1;77pkt 77fpkt"];
1593--2148[label="1;1pkt 1fpkt"];
2147--2148[label="0.0714286;2pkt 2fpkt"];
2147--2343[label="0.0208333;1pkt 1fpkt"];
2147--2354[label="0.0208333;1pkt 1fpkt"];
2147--2667[label="0.25;2pkt 2fpkt"];
2147--2741[label="0.0208333;1pkt 1fpkt"];
2147--3060[label="0.0208333;1pkt 1fpkt"];
2147--3072[label="0.0909091;1pkt 1fpkt"];
2147--3557[label="0.0909091;1pkt 1fpkt"];
2343--2741[label="1;77pkt 77fpkt"];
3072--3557[label="1;11pkt 11fpkt"];
</description>
    <slice>
      <filter dst_ip="193.52.0.199"/>
      <filter dst_port="1863"/>
      <filter dst_port="80" src_ip="176.77.40.84"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498899" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.833275,1.40558,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_777{
style=filled;
color=gray75;
1841[label="176.77.227.6;d;64pkt 64fpkt", shape=diamond, color=yellow];
2313[label="176.77.227.6;d;60pkt 60fpkt", shape=hexagon, color=black];
3074[label="219.61.223.208;20pkt 20fpkt", shape=pentagon, color=darkviolet];
3558[label="219.61.223.208;20pkt 20fpkt", shape=invtriangle, color=brown];
stat777[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.93.137.212:80, 176.77.227.6:*}[53.012%]&lt;BR/&gt;{219.61.223.208:80, 176.77.227.6:*}[24.0964%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1800: (0.914634%)&lt;BR/&gt; 1860: (0.609756%)&lt;BR/&gt; 1857: (0.609756%)&lt;BR/&gt; 1850: (0.609756%)&gt;];
}
1841--2313[label="1;60pkt 60fpkt"];
1841--3074[label="0.05;1pkt 1fpkt"];
1841--3558[label="0.05;1pkt 1fpkt"];
3074--3558[label="1;20pkt 20fpkt"];
</description>
    <slice>
      <filter dst_ip="176.77.227.6" src_ip="156.93.137.212" src_port="80"/>
      <filter dst_ip="176.77.227.6" src_ip="219.61.223.208" src_port="80"/>
    </slice>
    <from sec="1086498287" usec="0"/>
    <to sec="1086498882" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_778{
style=filled;
color=gray75;
3082[label="2.89.76.210;57pkt 57fpkt", shape=pentagon, color=darkviolet];
3561[label="2.89.76.210;57pkt 57fpkt", shape=invtriangle, color=brown];
stat778[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.89.76.210:*, *:3127}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3127: (50%)&lt;BR/&gt; 4999: (0.877193%)&lt;BR/&gt; 4959: (0.877193%)&lt;BR/&gt; 4910: (0.877193%)&lt;BR/&gt; 4893: (0.877193%)&gt;];
}
3082--3561[label="1;57pkt 57fpkt"];
</description>
    <slice>
      <filter dst_port="3127" src_ip="2.89.76.210"/>
    </slice>
    <from sec="1086498007" usec="0"/>
    <to sec="1086498549" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_779{
style=filled;
color=gray75;
3087[label="213.109.16.213;146pkt 146fpkt", shape=pentagon, color=darkviolet];
3563[label="213.109.16.213;146pkt 146fpkt", shape=invtriangle, color=brown];
3846[label="213.109.16.213;146pkt 146fpkt", shape=invhouse, color=bisque];
stat779[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.109.16.213:*, *:5554}[63.6986%]&lt;BR/&gt;{213.109.16.213:*, *:9898}[36.3014%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (31.8493%)&lt;BR/&gt; 9898: (18.1507%)&lt;BR/&gt; 4991: (0.342466%)&lt;BR/&gt; 4989: (0.342466%)&lt;BR/&gt; 4988: (0.342466%)&gt;];
}
3087--3563[label="1;146pkt 146fpkt"];
3087--3846[label="1;146pkt 146fpkt"];
3563--3846[label="1;146pkt 146fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="213.109.16.213"/>
      <filter dst_port="9898" src_ip="213.109.16.213"/>
    </slice>
    <from sec="1086498711" usec="0"/>
    <to sec="1086498713" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_780{
style=filled;
color=gray75;
3104[label="77.176.227.220;100pkt 100fpkt", shape=pentagon, color=darkviolet];
3571[label="77.176.227.220;100pkt 100fpkt", shape=invtriangle, color=brown];
stat780[shape=component, label=&lt;Rules:&lt;BR/&gt;{77.176.227.220:*, *:3127}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3127: (50%)&lt;BR/&gt; 4489: (1%)&lt;BR/&gt; 4301: (1%)&lt;BR/&gt; 4987: (0.5%)&lt;BR/&gt; 4948: (0.5%)&gt;];
}
3104--3571[label="1;100pkt 100fpkt"];
</description>
    <slice>
      <filter dst_port="3127" src_ip="77.176.227.220"/>
    </slice>
    <from sec="1086498009" usec="0"/>
    <to sec="1086498900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_781{
style=filled;
color=gray75;
3107[label="220.195.66.222;90pkt 90fpkt", shape=pentagon, color=darkviolet];
3572[label="220.195.66.222;89pkt 89fpkt", shape=invtriangle, color=brown];
stat781[shape=component, label=&lt;Rules:&lt;BR/&gt;{220.195.66.222:*, *:445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (50%)&lt;BR/&gt; 4718: (1.11732%)&lt;BR/&gt; 3962: (1.11732%)&lt;BR/&gt; 3809: (1.11732%)&lt;BR/&gt; 3451: (1.11732%)&gt;];
}
3107--3572[label="1;89pkt 89fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="220.195.66.222"/>
    </slice>
    <from sec="1086498008" usec="0"/>
    <to sec="1086498894" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_782{
style=filled;
color=gray75;
3113[label="7.80.250.224;21pkt 21fpkt", shape=pentagon, color=darkviolet];
3575[label="7.80.250.224;21pkt 21fpkt", shape=invtriangle, color=brown];
3854[label="7.80.250.224;21pkt 21fpkt", shape=invhouse, color=bisque];
stat782[shape=component, label=&lt;Rules:&lt;BR/&gt;{7.80.250.224:80, 173.76.202.139:*}[80.9524%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4493: (2.38095%)&lt;BR/&gt; 4487: (2.38095%)&lt;BR/&gt; 4479: (2.38095%)&lt;BR/&gt; 4475: (2.38095%)&gt;];
}
3113--3575[label="1;21pkt 21fpkt"];
3113--3854[label="1;21pkt 21fpkt"];
3575--3854[label="1;21pkt 21fpkt"];
</description>
    <slice>
      <filter dst_ip="173.76.202.139" src_ip="7.80.250.224" src_port="80"/>
    </slice>
    <from sec="1086498022" usec="0"/>
    <to sec="1086498882" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,504,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_783{
style=filled;
color=gray75;
3121[label="190.49.227.226;2pkt 2fpkt", shape=pentagon, color=darkviolet];
3580[label="190.49.227.226;2pkt 2fpkt", shape=invtriangle, color=brown];
3857[label="190.49.227.226;3pkt 3fpkt", shape=invhouse, color=bisque];
stat783[shape=component, label=&lt;Rules:&lt;BR/&gt;{190.49.227.226:443, 176.77.105.20:60627}[33.3333%]&lt;BR/&gt;{190.49.227.226:443, 176.77.105.20:60629}[33.3333%]&lt;BR/&gt;{190.49.227.226:443, 176.77.105.20:60631}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (50%)&lt;BR/&gt; 60631: (21.4286%)&lt;BR/&gt; 60629: (21.4286%)&lt;BR/&gt; 60627: (7.14286%)&gt;];
}
3121--3580[label="1;2pkt 2fpkt"];
3121--3857[label="1;2pkt 2fpkt"];
3580--3857[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="176.77.105.20" dst_port="60631" src_ip="190.49.227.226" src_port="443"/>
      <filter dst_ip="176.77.105.20" dst_port="60629" src_ip="190.49.227.226" src_port="443"/>
      <filter dst_ip="176.77.105.20" dst_port="60627" src_ip="190.49.227.226" src_port="443"/>
    </slice>
    <from sec="1086498038" usec="0"/>
    <to sec="1086498128" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_784{
style=filled;
color=gray75;
3123[label="190.49.227.227;5pkt 5fpkt", shape=pentagon, color=darkviolet];
3581[label="190.49.227.227;5pkt 5fpkt", shape=invtriangle, color=brown];
stat784[shape=component, label=&lt;Rules:&lt;BR/&gt;{190.49.227.227:443, 176.77.105.20:60635}[20%]&lt;BR/&gt;{190.49.227.227:443, 176.77.105.20:60637}[20%]&lt;BR/&gt;{190.49.227.227:80, 176.77.105.20:60609}[20%]&lt;BR/&gt;{190.49.227.227:80, 176.77.105.20:60641}[20%]&lt;BR/&gt;{190.49.227.227:80, 176.77.105.20:60643}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (30%)&lt;BR/&gt; 443: (20%)&lt;BR/&gt; 60643: (10%)&lt;BR/&gt; 60641: (10%)&lt;BR/&gt; 60637: (10%)&gt;];
}
3123--3581[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="176.77.105.20" dst_port="60643" src_ip="190.49.227.227" src_port="80"/>
      <filter dst_ip="176.77.105.20" dst_port="60641" src_ip="190.49.227.227" src_port="80"/>
      <filter dst_ip="176.77.105.20" dst_port="60609" src_ip="190.49.227.227" src_port="80"/>
      <filter dst_ip="176.77.105.20" dst_port="60637" src_ip="190.49.227.227" src_port="443"/>
      <filter dst_ip="176.77.105.20" dst_port="60635" src_ip="190.49.227.227" src_port="443"/>
    </slice>
    <from sec="1086498014" usec="0"/>
    <to sec="1086498198" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,001,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_785{
style=filled;
color=gray75;
3124[label="214.201.86.228;201pkt 201fpkt", shape=pentagon, color=darkviolet];
3582[label="214.201.86.228;201pkt 201fpkt", shape=invtriangle, color=brown];
stat785[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.201.86.228:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 65435: (0.248756%)&lt;BR/&gt; 65433: (0.248756%)&lt;BR/&gt; 65411: (0.248756%)&lt;BR/&gt; 65377: (0.248756%)&gt;];
}
3124--3582[label="1;201pkt 201fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="214.201.86.228"/>
    </slice>
    <from sec="1086498738" usec="0"/>
    <to sec="1086498740" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_786{
style=filled;
color=gray75;
3126[label="153.130.89.229;21pkt 21fpkt", shape=pentagon, color=darkviolet];
3583[label="153.130.89.229;21pkt 21fpkt", shape=invtriangle, color=brown];
stat786[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.130.89.229:*, 212.163.209.65:80}[85.7143%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1708: (2.38095%)&lt;BR/&gt; 1707: (2.38095%)&lt;BR/&gt; 1706: (2.38095%)&lt;BR/&gt; 1705: (2.38095%)&gt;];
}
3126--3583[label="1;21pkt 21fpkt"];
</description>
    <slice>
      <filter dst_ip="212.163.209.65" dst_port="80" src_ip="153.130.89.229"/>
    </slice>
    <from sec="1086498173" usec="0"/>
    <to sec="1086498778" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_787{
style=filled;
color=gray75;
3127[label="214.152.172.229;319pkt 319fpkt", shape=pentagon, color=darkviolet];
3584[label="214.152.172.229;319pkt 319fpkt", shape=invtriangle, color=brown];
3858[label="214.152.172.229;319pkt 319fpkt", shape=invhouse, color=bisque];
stat787[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.152.172.229:*, *:1026}[50.1567%]&lt;BR/&gt;{214.152.172.229:*, *:1027}[49.8433%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (25.2351%)&lt;BR/&gt; 1027: (24.9216%)&lt;BR/&gt; 4146: (0.31348%)&lt;BR/&gt; 4145: (0.31348%)&lt;BR/&gt; 3930: (0.31348%)&gt;];
}
3127--3584[label="1;319pkt 319fpkt"];
3127--3858[label="1;319pkt 319fpkt"];
3584--3858[label="1;319pkt 319fpkt"];
</description>
    <slice>
      <filter dst_port="1026" src_ip="214.152.172.229"/>
      <filter dst_port="1027" src_ip="214.152.172.229"/>
    </slice>
    <from sec="1086498613" usec="0"/>
    <to sec="1086498899" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.668423,1.48433,504,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="193.52.129.230"/>
    </slice>
    <from sec="1086498624" usec="0"/>
    <to sec="1086498705" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801954,1.44859,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_789{
style=filled;
color=gray75;
3133[label="214.151.100.232;517pkt 517fpkt", shape=pentagon, color=darkviolet];
3589[label="214.151.100.232;517pkt 517fpkt", shape=invtriangle, color=brown];
3861[label="214.151.100.232;517pkt 517fpkt", shape=invhouse, color=bisque];
stat789[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.151.100.232:*, *:1026}[50.677%]&lt;BR/&gt;{214.151.100.232:*, *:1027}[48.9362%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (25.3385%)&lt;BR/&gt; 1027: (24.4681%)&lt;BR/&gt; 2641: (0.290135%)&lt;BR/&gt; 2609: (0.290135%)&lt;BR/&gt; 1574: (0.290135%)&gt;];
}
3133--3589[label="1;517pkt 517fpkt"];
3133--3861[label="1;517pkt 517fpkt"];
3589--3861[label="1;517pkt 517fpkt"];
</description>
    <slice>
      <filter dst_port="1026" src_ip="214.151.100.232"/>
      <filter dst_port="1027" src_ip="214.151.100.232"/>
    </slice>
    <from sec="1086498004" usec="0"/>
    <to sec="1086498899" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_790{
style=filled;
color=gray75;
3157[label="173.76.150.244;6pkt 6fpkt", shape=pentagon, color=darkviolet];
3604[label="173.76.150.244;6pkt 6fpkt", shape=invtriangle, color=brown];
stat790[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.76.150.244:*, *:1863}[50%]&lt;BR/&gt;{173.76.150.244:*, 193.67.143.3:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1863: (25%)&lt;BR/&gt; 80: (16.6667%)&lt;BR/&gt; 2546: (8.33333%)&lt;BR/&gt; 2545: (8.33333%)&lt;BR/&gt; 2544: (8.33333%)&gt;];
}
3157--3604[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_port="1863" src_ip="173.76.150.244"/>
      <filter dst_ip="193.67.143.3" dst_port="80" src_ip="173.76.150.244"/>
    </slice>
    <from sec="1086498024" usec="0"/>
    <to sec="1086498523" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_791{
style=filled;
color=gray75;
3161[label="5.2.37.247;39pkt 39fpkt", shape=pentagon, color=darkviolet];
3607[label="5.2.37.247;39pkt 39fpkt", shape=invtriangle, color=brown];
stat791[shape=component, label=&lt;Rules:&lt;BR/&gt;{5.2.37.247:2703, 197.30.197.82:*}[30.7692%]&lt;BR/&gt;{5.2.37.247:7, 197.30.197.82:*}[28.2051%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2703: (33.3333%)&lt;BR/&gt; 7: (16.6667%)&lt;BR/&gt; 55487: (1.28205%)&lt;BR/&gt; 55485: (1.28205%)&lt;BR/&gt; 48990: (1.28205%)&gt;];
}
3161--3607[label="1;39pkt 39fpkt"];
</description>
    <slice>
      <filter dst_ip="197.30.197.82" src_ip="5.2.37.247" src_port="2703"/>
      <filter dst_ip="197.30.197.82" src_ip="5.2.37.247" src_port="7"/>
    </slice>
    <from sec="1086498032" usec="0"/>
    <to sec="1086498858" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.621006,1.43672,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_792{
style=filled;
color=gray75;
3173[label="181.133.14.252;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3614[label="181.133.14.252;1pkt 1fpkt", shape=invtriangle, color=brown];
stat792[shape=component, label=&lt;Rules:&lt;BR/&gt;{181.133.14.252:80, 184.67.160.132:61289}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 61289: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
3173--3614[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="184.67.160.132" dst_port="61289" src_ip="181.133.14.252" src_port="80"/>
    </slice>
    <from sec="1086498900" usec="0"/>
    <to sec="1086498901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.668423,1.48433,010,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="77.87.12.253"/>
    </slice>
    <from sec="1086498003" usec="0"/>
    <to sec="1086498430" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.76376,1.50754,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="197.239.180.17"/>
    </slice>
    <from sec="1086498184" usec="0"/>
    <to sec="1086498226" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.839209,1.49583,503,0 0 0 0 0 0 0 0 0 0 1 1 ">
    <description>subgraph cluster_795{
style=filled;
color=gray75;
3274[label="196.38.118.36;30pkt 30fpkt", shape=invtriangle, color=brown];
3680[label="196.38.118.36;30pkt 30fpkt", shape=invhouse, color=bisque];
stat795[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.38.118.36:*, 217.69.146.50:80}[86.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1153: (1.66667%)&lt;BR/&gt; 1152: (1.66667%)&lt;BR/&gt; 1151: (1.66667%)&lt;BR/&gt; 1150: (1.66667%)&gt;];
}
3274--3680[label="1;30pkt 30fpkt"];
</description>
    <slice>
      <filter dst_ip="217.69.146.50" dst_port="80" src_ip="196.38.118.36"/>
    </slice>
    <from sec="1086498508" usec="0"/>
    <to sec="1086498543" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.76376,1.50754,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="213.168.192.61"/>
    </slice>
    <from sec="1086498666" usec="0"/>
    <to sec="1086498894" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.76376,1.50754,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="193.52.4.109"/>
    </slice>
    <from sec="1086498638" usec="0"/>
    <to sec="1086498887" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.722626,1.46068,002,0 0 0 0 0 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_798{
style=filled;
color=gray75;
2855[label="21.251.105.127;197pkt 197fpkt", shape=pentagon, color=darkviolet];
3782[label="21.251.105.127;197pkt 197fpkt", shape=invhouse, color=bisque];
stat798[shape=component, label=&lt;Rules:&lt;BR/&gt;{21.251.105.127:10272, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 10272: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
2855--3782[label="1;197pkt 197fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="21.251.105.127" src_port="10272"/>
    </slice>
    <from sec="1086498793" usec="0"/>
    <to sec="1086498826" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.76376,1.50754,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="214.70.32.154"/>
    </slice>
    <from sec="1086498007" usec="0"/>
    <to sec="1086498423" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.872362,1.46132,999,0 0 0 1 0 0 0 0 0 0 1 1 ">
    <description>subgraph cluster_800{
style=filled;
color=gray75;
1182[label="200.129.210.172;s;610pkt 610fpkt", shape=diamond, color=yellow];
3503[label="200.129.210.172;656pkt 656fpkt", shape=invtriangle, color=brown];
3814[label="200.129.210.172;655pkt 655fpkt", shape=invhouse, color=bisque];
stat800[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.129.210.172:53, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (50%)&lt;BR/&gt; 1079: (0.390422%)&lt;BR/&gt; 1078: (0.312337%)&lt;BR/&gt; 1063: (0.312337%)&lt;BR/&gt; 1075: (0.234253%)&gt;];
}
1182--3503[label="0.995082;607pkt 607fpkt"];
1182--3814[label="0.993443;606pkt 606fpkt"];
3503--3814[label="1;655pkt 655fpkt"];
</description>
    <slice>
      <filter src_ip="200.129.210.172" src_port="53"/>
    </slice>
    <from sec="1086498000" usec="0"/>
    <to sec="1086498900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.76376,1.50754,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="82.97.97.179"/>
    </slice>
    <from sec="1086498003" usec="0"/>
    <to sec="1086498595" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.76376,1.50754,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="2.174.163.180"/>
    </slice>
    <from sec="1086498136" usec="0"/>
    <to sec="1086498407" usec="0"/>
  </anomaly>

</admd:annotation>
