<?xml version="1.0" encoding="UTF-8" standalone="no" ?>
<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">

  <anomaly type="notice" value="0.690205,1.3717,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="219.38.197.161" proto="icmp" src_ip="141.158.236.66"/>
      <from sec="1091941347" usec="0"/>
      <to sec="1091942065" usec="0"/>
    </slice>
    <from sec="1091941347" usec="0"/>
    <to sec="1091942065" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.690205,1.3717,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="205.248.186.126" dst_port="5554" proto="tcp" src_ip="214.90.69.94" src_port="80"/>
      <filter dst_ip="205.248.186.126" dst_port="9898" proto="tcp" src_ip="214.90.69.94" src_port="80"/>
      <from sec="1091942072" usec="0"/>
      <to sec="1091942075" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="205.248.186.126" dst_port="5554" proto="tcp" src_ip="204.104.177.94" src_port="80"/>
      <filter dst_ip="205.248.186.126" dst_port="9898" proto="tcp" src_ip="204.104.177.94" src_port="80"/>
      <from sec="1091942070" usec="0"/>
      <to sec="1091942077" usec="0"/>
    </slice>
    <from sec="1091942070" usec="0"/>
    <to sec="1091942077" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.690205,1.3717,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="151.125.172.13" dst_port="22321" proto="udp" src_ip="151.125.172.13" src_port="22321"/>
      <filter dst_ip="151.125.172.13" dst_port="22321" proto="icmp" src_ip="151.125.172.13" src_port="22321"/>
      <filter dst_ip="151.125.172.13" dst_port="22321" proto="udp" src_ip="151.125.172.13" src_port="22321"/>
      <filter dst_ip="151.125.172.13" dst_port="22321" proto="icmp" src_ip="151.125.172.13" src_port="22321"/>
      <filter dst_ip="151.125.172.13" dst_port="22321" proto="udp" src_ip="151.125.172.13" src_port="22321"/>
      <filter dst_ip="151.125.172.13" dst_port="22321" proto="icmp" src_ip="151.125.172.13" src_port="22321"/>
      <filter dst_ip="151.125.172.13" dst_port="22321" proto="udp" src_ip="151.125.172.13" src_port="22321"/>
      <filter dst_ip="151.125.172.13" dst_port="22321" proto="icmp" src_ip="151.125.172.13" src_port="22321"/>
      <from sec="1091941662" usec="0"/>
      <to sec="1091941696" usec="0"/>
    </slice>
    <from sec="1091941662" usec="0"/>
    <to sec="1091941696" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.690205,1.3717,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="1.35.182.128" proto="icmp" src_ip="141.176.129.173"/>
      <filter dst_ip="1.35.182.128" proto="icmp" src_ip="141.176.129.173"/>
      <filter dst_ip="1.35.182.128" proto="icmp" src_ip="141.176.129.173"/>
      <filter dst_ip="1.35.182.128" proto="icmp" src_ip="141.176.129.173"/>
      <from sec="1091941863" usec="0"/>
      <to sec="1091941938" usec="0"/>
    </slice>
    <from sec="1091941863" usec="0"/>
    <to sec="1091941947" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.690205,1.3717,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="219.38.197.161" proto="icmp" src_ip="141.176.129.173"/>
      <filter dst_ip="219.38.197.161" proto="icmp" src_ip="141.176.129.173"/>
      <filter dst_ip="219.38.197.161" proto="icmp" src_ip="141.176.129.173"/>
      <filter dst_ip="219.38.197.161" proto="icmp" src_ip="141.176.129.173"/>
      <from sec="1091941201" usec="0"/>
      <to sec="1091941939" usec="0"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091941939" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.690205,1.3717,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="214.164.142.4" src_port="62773"/>
      <from sec="1091941673" usec="0"/>
      <to sec="1091941684" usec="0"/>
    </slice>
    <from sec="1091941673" usec="0"/>
    <to sec="1091941684" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.690205,1.3717,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="81.163.4.6" src_port="1026"/>
      <from sec="1091941691" usec="0"/>
      <to sec="1091941699" usec="0"/>
    </slice>
    <from sec="1091941691" usec="0"/>
    <to sec="1091941699" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.690205,1.3717,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="204.186.1.38" src_port="1030"/>
      <from sec="1091942056" usec="0"/>
      <to sec="1091942061" usec="0"/>
    </slice>
    <from sec="1091942056" usec="0"/>
    <to sec="1091942061" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.690205,1.3717,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="5554" proto="tcp" src_ip="3.189.171.116" src_port="53"/>
      <filter dst_port="5554" proto="udp" src_ip="3.189.171.116" src_port="53"/>
      <filter dst_port="9898" proto="tcp" src_ip="3.189.171.116" src_port="53"/>
      <filter dst_port="9898" proto="udp" src_ip="3.189.171.116" src_port="53"/>
      <from sec="1091941515" usec="0"/>
      <to sec="1091941518" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="5554" proto="tcp" src_ip="205.2.3.116" src_port="53"/>
      <filter dst_port="5554" proto="udp" src_ip="205.2.3.116" src_port="53"/>
      <filter dst_port="9898" proto="tcp" src_ip="205.2.3.116" src_port="53"/>
      <filter dst_port="9898" proto="udp" src_ip="205.2.3.116" src_port="53"/>
      <from sec="1091941515" usec="0"/>
      <to sec="1091941518" usec="0"/>
    </slice>
    <from sec="1091941515" usec="0"/>
    <to sec="1091941518" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.690205,1.3717,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="221.230.5.181" src_port="1027"/>
      <from sec="1091942084" usec="0"/>
      <to sec="1091942089" usec="0"/>
    </slice>
    <from sec="1091942084" usec="0"/>
    <to sec="1091942089" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.690205,1.3717,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="81.206.117.186" src_port="1026"/>
      <from sec="1091941809" usec="0"/>
      <to sec="1091941816" usec="0"/>
    </slice>
    <from sec="1091941809" usec="0"/>
    <to sec="1091941816" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.690205,1.3717,001,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="80.126.141.4"/>
      <from sec="1091941917" usec="0"/>
      <to sec="1091941919" usec="0"/>
    </slice>
    <from sec="1091941913" usec="0"/>
    <to sec="1091941920" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.690205,1.3717,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="81.18.73.39" src_port="53"/>
      <filter dst_port="9898" proto="udp" src_ip="81.18.73.39" src_port="53"/>
      <from sec="1091941582" usec="0"/>
      <to sec="1091941585" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="204.40.45.39" src_port="53"/>
      <filter dst_port="9898" proto="udp" src_ip="204.40.45.39" src_port="53"/>
      <from sec="1091941583" usec="0"/>
      <to sec="1091941587" usec="0"/>
    </slice>
    <from sec="1091941582" usec="0"/>
    <to sec="1091941587" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.690205,1.3717,001,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="5554" proto="tcp" src_ip="81.21.238.89"/>
      <filter dst_port="9898" proto="tcp" src_ip="81.21.238.89"/>
      <from sec="1091941845" usec="0"/>
      <to sec="1091941847" usec="0"/>
    </slice>
    <from sec="1091941842" usec="0"/>
    <to sec="1091941848" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.690205,1.3717,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="4.3.219.167"/>
      <from sec="1091941629" usec="0"/>
      <to sec="1091941635" usec="0"/>
    </slice>
    <from sec="1091941629" usec="0"/>
    <to sec="1091941635" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.690205,1.3717,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="204.40.44.83" dst_port="9898" proto="tcp" src_ip="215.201.115.232"/>
      <filter dst_ip="204.40.44.83" dst_port="5554" proto="tcp" src_ip="215.201.115.232"/>
      <from sec="1091941856" usec="0"/>
      <to sec="1091941858" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="204.40.44.83" dst_port="9898" proto="tcp" src_ip="154.64.99.232"/>
      <filter dst_ip="204.40.44.83" dst_port="5554" proto="tcp" src_ip="154.64.99.232"/>
      <from sec="1091941855" usec="0"/>
      <to sec="1091941859" usec="0"/>
    </slice>
    <from sec="1091941855" usec="0"/>
    <to sec="1091941859" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.690205,1.3717,001,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="210.161.168.247"/>
      <from sec="1091942066" usec="0"/>
      <to sec="1091942067" usec="0"/>
    </slice>
    <from sec="1091942066" usec="0"/>
    <to sec="1091942067" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.690205,1.3717,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="214.37.198.31" proto="icmp"/>
      <filter dst_ip="214.37.198.31" proto="icmp"/>
      <filter dst_ip="214.37.198.31" proto="icmp"/>
      <filter dst_ip="214.37.198.31" proto="icmp"/>
      <from sec="1091941288" usec="0"/>
      <to sec="1091941290" usec="0"/>
    </slice>
    <from sec="1091941288" usec="0"/>
    <to sec="1091941290" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.690205,1.3717,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="210.186.231.91" proto="icmp"/>
      <filter dst_ip="210.186.231.91" proto="icmp"/>
      <filter dst_ip="210.186.231.91" proto="icmp"/>
      <filter dst_ip="210.186.231.91" proto="icmp"/>
      <from sec="1091942021" usec="0"/>
      <to sec="1091942023" usec="0"/>
    </slice>
    <from sec="1091942019" usec="0"/>
    <to sec="1091942023" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.734545,1.38518,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="205.248.186.126" dst_port="5554" proto="tcp" src_ip="214.90.69.94" src_port="80"/>
      <filter dst_ip="205.248.186.126" dst_port="9898" proto="tcp" src_ip="214.90.69.94" src_port="80"/>
      <from sec="1091942072" usec="0"/>
      <to sec="1091942075" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="205.248.186.126" dst_port="5554" proto="tcp" src_ip="204.104.177.94" src_port="80"/>
      <filter dst_ip="205.248.186.126" dst_port="9898" proto="tcp" src_ip="204.104.177.94" src_port="80"/>
      <from sec="1091942070" usec="0"/>
      <to sec="1091942077" usec="0"/>
    </slice>
    <from sec="1091942070" usec="0"/>
    <to sec="1091942077" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.734545,1.38518,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="151.125.172.13" dst_port="22321" proto="udp" src_ip="151.125.172.13" src_port="22321"/>
      <filter dst_ip="151.125.172.13" dst_port="22321" proto="icmp" src_ip="151.125.172.13" src_port="22321"/>
      <filter dst_ip="151.125.172.13" dst_port="22321" proto="udp" src_ip="151.125.172.13" src_port="22321"/>
      <filter dst_ip="151.125.172.13" dst_port="22321" proto="icmp" src_ip="151.125.172.13" src_port="22321"/>
      <filter dst_ip="151.125.172.13" dst_port="22321" proto="udp" src_ip="151.125.172.13" src_port="22321"/>
      <filter dst_ip="151.125.172.13" dst_port="22321" proto="icmp" src_ip="151.125.172.13" src_port="22321"/>
      <filter dst_ip="151.125.172.13" dst_port="22321" proto="udp" src_ip="151.125.172.13" src_port="22321"/>
      <filter dst_ip="151.125.172.13" dst_port="22321" proto="icmp" src_ip="151.125.172.13" src_port="22321"/>
      <from sec="1091941662" usec="0"/>
      <to sec="1091941696" usec="0"/>
    </slice>
    <from sec="1091941662" usec="0"/>
    <to sec="1091941696" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.734545,1.38518,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="1.35.182.128" proto="icmp" src_ip="141.176.129.173"/>
      <filter dst_ip="1.35.182.128" proto="icmp" src_ip="141.176.129.173"/>
      <filter dst_ip="1.35.182.128" proto="icmp" src_ip="141.176.129.173"/>
      <filter dst_ip="1.35.182.128" proto="icmp" src_ip="141.176.129.173"/>
      <from sec="1091941871" usec="0"/>
      <to sec="1091941938" usec="0"/>
    </slice>
    <from sec="1091941871" usec="0"/>
    <to sec="1091941947" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.734545,1.38518,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="219.38.197.161" proto="icmp" src_ip="141.176.129.173"/>
      <filter dst_ip="219.38.197.161" proto="icmp" src_ip="141.176.129.173"/>
      <filter dst_ip="219.38.197.161" proto="icmp" src_ip="141.176.129.173"/>
      <filter dst_ip="219.38.197.161" proto="icmp" src_ip="141.176.129.173"/>
      <from sec="1091941201" usec="0"/>
      <to sec="1091941939" usec="0"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091941939" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.826546,1.28755,503,1 1 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_28{
style=filled;
color=gray75;
48[label="174.104.92.2s;1pkt 1fpkt", shape=rectangle, color=red];
503[label="174.104.92.2s;3pkt 3fpkt", shape=ellipse, color=green];
1794[label="2.197.118.220;d;21pkt 21fpkt", shape=diamond, color=yellow];
1795[label="174.104.92.2;s;111pkt 111fpkt", shape=diamond, color=yellow];
stat28[shape=component, label=&lt;Rules:&lt;BR/&gt;{174.104.92.2:*, 3.31.227.209:80}[44.1441%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.6324%)&lt;BR/&gt; 3164: (1.10294%)&lt;BR/&gt; 3109: (0.735294%)&lt;BR/&gt; 3106: (0.735294%)&lt;BR/&gt; 3085: (0.735294%)&gt;];
}
48--503[label="1;1pkt 1fpkt"];
48--1795[label="1;1pkt 1fpkt"];
503--1795[label="1;3pkt 3fpkt"];
1794--1795[label="1;21pkt 21fpkt"];
1795--2429[label="0.05;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="3.31.227.209" dst_port="80" src_ip="174.104.92.2"/>
    </slice>
    <from sec="1091941247" usec="0"/>
    <to sec="1091941852" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.811008,1.35864,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_29{
style=filled;
color=gray75;
55[label="81.20.45.9s;256pkt 256fpkt", shape=rectangle, color=red];
506[label="81.20.45.9s;118pkt 118fpkt", shape=ellipse, color=green];
stat29[shape=component, label=&lt;Rules:&lt;BR/&gt;{81.20.45.9:1032, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1032: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
55--506[label="1;118pkt 118fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="81.20.45.9" src_port="1032"/>
    </slice>
    <from sec="1091942018" usec="0"/>
    <to sec="1091942034" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.811008,1.35864,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_30{
style=filled;
color=gray75;
57[label="81.7.69.17s;201pkt 201fpkt", shape=rectangle, color=red];
508[label="81.7.69.17s;104pkt 104fpkt", shape=ellipse, color=green];
stat30[shape=component, label=&lt;Rules:&lt;BR/&gt;{81.7.69.17:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
57--508[label="1;104pkt 104fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="81.7.69.17" src_port="1029"/>
    </slice>
    <from sec="1091941746" usec="0"/>
    <to sec="1091941756" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.811008,1.35864,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_31{
style=filled;
color=gray75;
62[label="214.164.46.39s;255pkt 255fpkt", shape=rectangle, color=red];
511[label="214.164.46.39s;94pkt 94fpkt", shape=ellipse, color=green];
stat31[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.164.46.39:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
62--511[label="1;94pkt 94fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="214.164.46.39" src_port="1027"/>
    </slice>
    <from sec="1091941732" usec="0"/>
    <to sec="1091941747" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.782731,1.28227,002,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_32{
style=filled;
color=gray75;
63[label="215.207.177.51s;246pkt 246fpkt", shape=rectangle, color=red];
512[label="215.207.177.51s;107pkt 107fpkt", shape=ellipse, color=green];
3538[label="215.207.177.51;255pkt 255fpkt", shape=pentagon, color=darkviolet];
stat32[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.207.177.51:10246, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 10246: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
63--512[label="1;107pkt 107fpkt"];
63--3538[label="1;246pkt 246fpkt"];
512--3538[label="1;107pkt 107fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="215.207.177.51" src_port="10246"/>
    </slice>
    <from sec="1091941966" usec="0"/>
    <to sec="1091941980" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.811008,1.35864,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_33{
style=filled;
color=gray75;
64[label="214.87.132.65s;252pkt 252fpkt", shape=rectangle, color=red];
513[label="214.87.132.65s;72pkt 72fpkt", shape=ellipse, color=green];
stat33[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.87.132.65:59832, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 59832: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
64--513[label="1;72pkt 72fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="214.87.132.65" src_port="59832"/>
    </slice>
    <from sec="1091942033" usec="0"/>
    <to sec="1091942046" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.811008,1.35864,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_34{
style=filled;
color=gray75;
67[label="204.114.94.70s;202pkt 202fpkt", shape=rectangle, color=red];
515[label="204.114.94.70s;169pkt 169fpkt", shape=ellipse, color=green];
stat34[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.114.94.70:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
67--515[label="1;169pkt 169fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="204.114.94.70" src_port="1025"/>
    </slice>
    <from sec="1091941970" usec="0"/>
    <to sec="1091941982" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.811008,1.35864,901,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_35{
style=filled;
color=gray75;
68[label="204.64.217.83s;161pkt 161fpkt", shape=rectangle, color=red];
516[label="204.64.217.83s;83pkt 83fpkt", shape=ellipse, color=green];
stat35[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.64.217.83:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
68--516[label="1;83pkt 83fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="204.64.217.83" src_port="1026"/>
    </slice>
    <from sec="1091942010" usec="0"/>
    <to sec="1091942019" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.734545,1.38518,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="5554" proto="tcp" src_ip="3.189.171.116" src_port="53"/>
      <filter dst_port="5554" proto="udp" src_ip="3.189.171.116" src_port="53"/>
      <filter dst_port="9898" proto="tcp" src_ip="3.189.171.116" src_port="53"/>
      <filter dst_port="9898" proto="udp" src_ip="3.189.171.116" src_port="53"/>
      <from sec="1091941515" usec="0"/>
      <to sec="1091941518" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="5554" proto="tcp" src_ip="205.2.3.116" src_port="53"/>
      <filter dst_port="5554" proto="udp" src_ip="205.2.3.116" src_port="53"/>
      <filter dst_port="9898" proto="tcp" src_ip="205.2.3.116" src_port="53"/>
      <filter dst_port="9898" proto="udp" src_ip="205.2.3.116" src_port="53"/>
      <from sec="1091941515" usec="0"/>
      <to sec="1091941518" usec="0"/>
    </slice>
    <from sec="1091941515" usec="0"/>
    <to sec="1091941518" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.811008,1.35864,901,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_37{
style=filled;
color=gray75;
77[label="215.193.152.204s;256pkt 256fpkt", shape=rectangle, color=red];
519[label="215.193.152.204s;136pkt 136fpkt", shape=ellipse, color=green];
stat37[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.193.152.204:1030, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1030: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
77--519[label="1;136pkt 136fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="215.193.152.204" src_port="1030"/>
    </slice>
    <from sec="1091941731" usec="0"/>
    <to sec="1091941747" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.734545,1.38518,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="81.18.73.39" src_port="53"/>
      <filter dst_port="9898" proto="udp" src_ip="81.18.73.39" src_port="53"/>
      <from sec="1091941582" usec="0"/>
      <to sec="1091941585" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="204.40.45.39" src_port="53"/>
      <filter dst_port="9898" proto="udp" src_ip="204.40.45.39" src_port="53"/>
      <from sec="1091941583" usec="0"/>
      <to sec="1091941587" usec="0"/>
    </slice>
    <from sec="1091941582" usec="0"/>
    <to sec="1091941587" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.811008,1.35864,001,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_91{
style=filled;
color=gray75;
212[label="80.126.145.92s;210pkt 210fpkt", shape=rectangle, color=red];
631[label="80.126.145.92s;210pkt 210fpkt", shape=ellipse, color=green];
stat91[shape=component, label=&lt;Rules:&lt;BR/&gt;{80.126.145.92:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 3245: (0.238095%)&lt;BR/&gt; 3244: (0.238095%)&lt;BR/&gt; 3243: (0.238095%)&lt;BR/&gt; 3241: (0.238095%)&gt;];
}
212--631[label="1;210pkt 210fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="80.126.145.92"/>
    </slice>
    <from sec="1091942043" usec="0"/>
    <to sec="1091942047" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.811008,1.35864,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_104{
style=filled;
color=gray75;
240[label="4.162.8.106s;127pkt 127fpkt", shape=rectangle, color=red];
657[label="4.162.8.106s;127pkt 127fpkt", shape=ellipse, color=green];
stat104[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.162.8.106:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 60583: (0.393701%)&lt;BR/&gt; 60582: (0.393701%)&lt;BR/&gt; 60581: (0.393701%)&lt;BR/&gt; 60580: (0.393701%)&gt;];
}
240--657[label="1;127pkt 127fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.162.8.106"/>
    </slice>
    <from sec="1091941657" usec="0"/>
    <to sec="1091941663" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.811008,1.35864,001,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_113{
style=filled;
color=gray75;
273[label="211.161.149.121s;70pkt 70fpkt", shape=rectangle, color=red];
685[label="211.161.149.121s;70pkt 70fpkt", shape=ellipse, color=green];
stat113[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.161.149.121:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 1503: (0.714286%)&lt;BR/&gt; 1502: (0.714286%)&lt;BR/&gt; 1501: (0.714286%)&lt;BR/&gt; 1495: (0.714286%)&gt;];
}
273--685[label="1;70pkt 70fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="211.161.149.121"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091941203" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.782731,1.28227,001,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_146{
style=filled;
color=gray75;
362[label="212.34.166.182s;182pkt 182fpkt", shape=rectangle, color=red];
764[label="212.34.166.182s;182pkt 182fpkt", shape=ellipse, color=green];
4020[label="212.34.166.182;182pkt 182fpkt", shape=pentagon, color=darkviolet];
stat146[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.34.166.182:*, *:9898}[65.3846%]&lt;BR/&gt;{212.34.166.182:*, *:5554}[34.6154%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (32.6923%)&lt;BR/&gt; 5554: (17.3077%)&lt;BR/&gt; 4997: (0.274725%)&lt;BR/&gt; 4996: (0.274725%)&lt;BR/&gt; 4995: (0.274725%)&gt;];
}
362--764[label="1;182pkt 182fpkt"];
362--4020[label="1;182pkt 182fpkt"];
764--4020[label="1;182pkt 182fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="212.34.166.182"/>
      <filter dst_port="5554" src_ip="212.34.166.182"/>
    </slice>
    <from sec="1091941520" usec="0"/>
    <to sec="1091941522" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.782731,1.28227,001,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_157{
style=filled;
color=gray75;
388[label="214.58.14.197s;254pkt 254fpkt", shape=rectangle, color=red];
786[label="214.58.14.197s;254pkt 254fpkt", shape=ellipse, color=green];
4065[label="214.58.14.197;254pkt 254fpkt", shape=pentagon, color=darkviolet];
stat157[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.58.14.197:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 4060: (0.19685%)&lt;BR/&gt; 4056: (0.19685%)&lt;BR/&gt; 4055: (0.19685%)&lt;BR/&gt; 4052: (0.19685%)&gt;];
}
388--786[label="1;254pkt 254fpkt"];
388--4065[label="1;254pkt 254fpkt"];
786--4065[label="1;254pkt 254fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="214.58.14.197"/>
    </slice>
    <from sec="1091942059" usec="0"/>
    <to sec="1091942063" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.826546,1.28755,001,1 1 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_160{
style=filled;
color=gray75;
393[label="3.191.183.198s;508pkt 508fpkt", shape=rectangle, color=red];
790[label="3.191.183.198s;508pkt 508fpkt", shape=ellipse, color=green];
1882[label="3.191.183.198;s;508pkt 508fpkt", shape=diamond, color=yellow];
stat160[shape=component, label=&lt;Rules:&lt;BR/&gt;{3.191.183.198:*, *:5554}[50%]&lt;BR/&gt;{3.191.183.198:*, *:9898}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (25%)&lt;BR/&gt; 5554: (25%)&lt;BR/&gt; 4991: (0.0984252%)&lt;BR/&gt; 4988: (0.0984252%)&lt;BR/&gt; 4986: (0.0984252%)&gt;];
}
393--790[label="1;508pkt 508fpkt"];
393--1882[label="1;508pkt 508fpkt"];
790--1882[label="1;508pkt 508fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="3.191.183.198"/>
      <filter dst_port="5554" src_ip="3.191.183.198"/>
    </slice>
    <from sec="1091941485" usec="0"/>
    <to sec="1091941556" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.811008,1.35864,001,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_164{
style=filled;
color=gray75;
415[label="3.189.125.215s;399pkt 399fpkt", shape=rectangle, color=red];
811[label="3.189.125.215s;399pkt 399fpkt", shape=ellipse, color=green];
stat164[shape=component, label=&lt;Rules:&lt;BR/&gt;{3.189.125.215:*, *:9898}[53.6341%]&lt;BR/&gt;{3.189.125.215:*, *:5554}[46.3659%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (26.817%)&lt;BR/&gt; 5554: (23.183%)&lt;BR/&gt; 4124: (0.125313%)&lt;BR/&gt; 4115: (0.125313%)&lt;BR/&gt; 4104: (0.125313%)&gt;];
}
415--811[label="1;399pkt 399fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="3.189.125.215"/>
      <filter dst_port="5554" src_ip="3.189.125.215"/>
    </slice>
    <from sec="1091941932" usec="0"/>
    <to sec="1091941936" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.734545,1.38518,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="204.40.44.83" dst_port="9898" proto="tcp" src_ip="215.201.115.232"/>
      <filter dst_ip="204.40.44.83" dst_port="5554" proto="tcp" src_ip="215.201.115.232"/>
      <from sec="1091941856" usec="0"/>
      <to sec="1091941858" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="204.40.44.83" dst_port="9898" proto="tcp" src_ip="154.64.99.232"/>
      <filter dst_ip="204.40.44.83" dst_port="5554" proto="tcp" src_ip="154.64.99.232"/>
      <from sec="1091941855" usec="0"/>
      <to sec="1091941859" usec="0"/>
    </slice>
    <from sec="1091941855" usec="0"/>
    <to sec="1091941859" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.811008,1.35864,020,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_178{
style=filled;
color=gray75;
470[label="210.184.65.52d;225pkt 225fpkt", shape=rectangle, color=red];
856[label="210.184.65.52d;225pkt 225fpkt", shape=ellipse, color=green];
stat178[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 210.184.65.52:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
470--856[label="1;225pkt 225fpkt"];
</description>
    <slice>
      <filter dst_ip="210.184.65.52"/>
    </slice>
    <from sec="1091942096" usec="0"/>
    <to sec="1091942099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.811008,1.35864,020,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_179{
style=filled;
color=gray75;
472[label="118.174.21.226d;237pkt 237fpkt", shape=rectangle, color=red];
857[label="118.174.21.226d;237pkt 237fpkt", shape=ellipse, color=green];
stat179[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 118.174.21.226:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
472--857[label="1;237pkt 237fpkt"];
</description>
    <slice>
      <filter dst_ip="118.174.21.226"/>
    </slice>
    <from sec="1091941990" usec="0"/>
    <to sec="1091941995" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.774934,1.40273,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="205.248.186.126" dst_port="5554" proto="tcp" src_ip="214.90.69.94" src_port="80"/>
      <filter dst_ip="205.248.186.126" dst_port="9898" proto="tcp" src_ip="214.90.69.94" src_port="80"/>
      <from sec="1091942072" usec="0"/>
      <to sec="1091942075" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="205.248.186.126" dst_port="5554" proto="tcp" src_ip="204.104.177.94" src_port="80"/>
      <filter dst_ip="205.248.186.126" dst_port="9898" proto="tcp" src_ip="204.104.177.94" src_port="80"/>
      <from sec="1091942070" usec="0"/>
      <to sec="1091942077" usec="0"/>
    </slice>
    <from sec="1091942070" usec="0"/>
    <to sec="1091942077" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.774934,1.40273,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="141.26.128.82" dst_port="9898" proto="tcp" src_ip="210.230.0.212" src_port="20"/>
      <filter dst_ip="141.26.128.82" dst_port="5554" proto="tcp" src_ip="210.230.0.212" src_port="20"/>
      <filter dst_ip="141.26.128.82" dst_port="1023" proto="tcp" src_ip="210.230.0.212" src_port="20"/>
      <from sec="1091941201" usec="0"/>
      <to sec="1091941563" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="141.26.128.82" dst_port="9898" proto="tcp" src_ip="21.61.124.212" src_port="20"/>
      <filter dst_ip="141.26.128.82" dst_port="5554" proto="tcp" src_ip="21.61.124.212" src_port="20"/>
      <filter dst_ip="141.26.128.82" dst_port="1023" proto="tcp" src_ip="21.61.124.212" src_port="20"/>
      <from sec="1091941201" usec="0"/>
      <to sec="1091941562" usec="0"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091941563" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.774934,1.40273,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="151.125.172.13" dst_port="22321" proto="udp" src_ip="151.125.172.13" src_port="22321"/>
      <filter dst_ip="151.125.172.13" dst_port="22321" proto="icmp" src_ip="151.125.172.13" src_port="22321"/>
      <filter dst_ip="151.125.172.13" dst_port="22321" proto="udp" src_ip="151.125.172.13" src_port="22321"/>
      <filter dst_ip="151.125.172.13" dst_port="22321" proto="icmp" src_ip="151.125.172.13" src_port="22321"/>
      <filter dst_ip="151.125.172.13" dst_port="22321" proto="udp" src_ip="151.125.172.13" src_port="22321"/>
      <filter dst_ip="151.125.172.13" dst_port="22321" proto="icmp" src_ip="151.125.172.13" src_port="22321"/>
      <filter dst_ip="151.125.172.13" dst_port="22321" proto="udp" src_ip="151.125.172.13" src_port="22321"/>
      <filter dst_ip="151.125.172.13" dst_port="22321" proto="icmp" src_ip="151.125.172.13" src_port="22321"/>
      <from sec="1091941662" usec="0"/>
      <to sec="1091941692" usec="0"/>
    </slice>
    <from sec="1091941662" usec="0"/>
    <to sec="1091941692" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.774934,1.40273,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="1.35.182.128" proto="icmp" src_ip="141.176.129.173"/>
      <filter dst_ip="1.35.182.128" proto="icmp" src_ip="141.176.129.173"/>
      <filter dst_ip="1.35.182.128" proto="icmp" src_ip="141.176.129.173"/>
      <filter dst_ip="1.35.182.128" proto="icmp" src_ip="141.176.129.173"/>
      <from sec="1091941871" usec="0"/>
      <to sec="1091941938" usec="0"/>
    </slice>
    <from sec="1091941871" usec="0"/>
    <to sec="1091941947" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.774934,1.40273,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="219.38.197.161" proto="icmp" src_ip="141.176.129.173"/>
      <filter dst_ip="219.38.197.161" proto="icmp" src_ip="141.176.129.173"/>
      <filter dst_ip="219.38.197.161" proto="icmp" src_ip="141.176.129.173"/>
      <filter dst_ip="219.38.197.161" proto="icmp" src_ip="141.176.129.173"/>
      <from sec="1091941201" usec="0"/>
      <to sec="1091941939" usec="0"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091941939" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.774934,1.40273,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="5554" proto="tcp" src_ip="3.189.171.116" src_port="53"/>
      <filter dst_port="5554" proto="udp" src_ip="3.189.171.116" src_port="53"/>
      <filter dst_port="9898" proto="tcp" src_ip="3.189.171.116" src_port="53"/>
      <filter dst_port="9898" proto="udp" src_ip="3.189.171.116" src_port="53"/>
      <from sec="1091941515" usec="0"/>
      <to sec="1091941518" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="5554" proto="tcp" src_ip="205.2.3.116" src_port="53"/>
      <filter dst_port="5554" proto="udp" src_ip="205.2.3.116" src_port="53"/>
      <filter dst_port="9898" proto="tcp" src_ip="205.2.3.116" src_port="53"/>
      <filter dst_port="9898" proto="udp" src_ip="205.2.3.116" src_port="53"/>
      <from sec="1091941515" usec="0"/>
      <to sec="1091941518" usec="0"/>
    </slice>
    <from sec="1091941515" usec="0"/>
    <to sec="1091941518" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.774934,1.40273,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="81.18.73.39" src_port="53"/>
      <filter dst_port="9898" proto="udp" src_ip="81.18.73.39" src_port="53"/>
      <from sec="1091941582" usec="0"/>
      <to sec="1091941585" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="204.40.45.39" src_port="53"/>
      <filter dst_port="9898" proto="udp" src_ip="204.40.45.39" src_port="53"/>
      <from sec="1091941583" usec="0"/>
      <to sec="1091941587" usec="0"/>
    </slice>
    <from sec="1091941582" usec="0"/>
    <to sec="1091941587" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.774934,1.40273,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="204.40.44.83" dst_port="9898" proto="tcp" src_ip="215.201.115.232"/>
      <filter dst_ip="204.40.44.83" dst_port="5554" proto="tcp" src_ip="215.201.115.232"/>
      <from sec="1091941856" usec="0"/>
      <to sec="1091941858" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="204.40.44.83" dst_port="9898" proto="tcp" src_ip="154.64.99.232"/>
      <filter dst_ip="204.40.44.83" dst_port="5554" proto="tcp" src_ip="154.64.99.232"/>
      <from sec="1091941855" usec="0"/>
      <to sec="1091941859" usec="0"/>
    </slice>
    <from sec="1091941855" usec="0"/>
    <to sec="1091941859" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818035,1.27709,999,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_222{
style=filled;
color=gray75;
29[label="210.241.196.198s;2pkt 2fpkt", shape=rectangle, color=red];
1205[label="210.241.196.198;s;7pkt 7fpkt", shape=diamond, color=yellow];
1206[label="151.125.174.46;d;15pkt 15fpkt", shape=diamond, color=yellow];
2628[label="210.241.196.198;s;2pkt 2fpkt", shape=hexagon, color=black];
2936[label="151.125.174.46;d;15pkt 15fpkt", shape=hexagon, color=black];
stat222[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.241.196.198:*, 151.125.174.46:*}[46.6667%]&lt;BR/&gt;{*:3478, 151.125.174.46:45991}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (12.1951%)&lt;BR/&gt; 3478: (9.7561%)&lt;BR/&gt; 3252: (9.7561%)&lt;BR/&gt; 45991: (7.31707%)&lt;BR/&gt; 62815: (4.87805%)&gt;];
}
29--1205[label="1;2pkt 2fpkt"];
29--1206[label="1;2pkt 2fpkt"];
29--2936[label="1;2pkt 2fpkt"];
1205--1206[label="1;7pkt 7fpkt"];
1205--2628[label="1;2pkt 2fpkt"];
1205--2936[label="1;7pkt 7fpkt"];
1206--2628[label="1;2pkt 2fpkt"];
1206--2936[label="1;15pkt 15fpkt"];
2628--2936[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="151.125.174.46" src_ip="210.241.196.198"/>
      <filter dst_ip="151.125.174.46" dst_port="45991" src_port="3478"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942091" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801853,1.2762,503,0 0 0 1 1 0 0 0 0 0 1 0 ">
    <description>subgraph cluster_225{
style=filled;
color=gray75;
1212[label="83.70.42.117;d;2pkt 2fpkt", shape=diamond, color=yellow];
1213[label="174.104.181.236;s;186pkt 186fpkt", shape=diamond, color=yellow];
2937[label="174.104.181.236;s;138pkt 138fpkt", shape=hexagon, color=black];
4782[label="174.104.181.236;192pkt 192fpkt", shape=invtriangle, color=brown];
stat225[shape=component, label=&lt;Rules:&lt;BR/&gt;{174.104.181.236:*, 16.8.109.233:80}[45.8333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1725: (0.3861%)&lt;BR/&gt; 1209: (0.3861%)&lt;BR/&gt; 1839: (0.289575%)&lt;BR/&gt; 1838: (0.289575%)&gt;];
}
1212--1213[label="1;2pkt 2fpkt"];
1212--2937[label="1;2pkt 2fpkt"];
1212--4782[label="1;2pkt 2fpkt"];
1213--2937[label="1;138pkt 138fpkt"];
1213--4782[label="1;186pkt 186fpkt"];
2937--4782[label="1;138pkt 138fpkt"];
</description>
    <slice>
      <filter dst_ip="16.8.109.233" dst_port="80" src_ip="174.104.181.236"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091941943" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_233{
style=filled;
color=gray75;
1286[label="136.171.162.207;d;1pkt 1fpkt", shape=diamond, color=yellow];
1289[label="196.89.138.143;s;1pkt 1fpkt", shape=diamond, color=yellow];
2650[label="196.89.138.143;s;1pkt 1fpkt", shape=hexagon, color=black];
stat233[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.89.138.143:59577, 136.171.162.207:25}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 59577: (50%)&lt;BR/&gt; 25: (50%)&gt;];
}
1286--1289[label="1;1pkt 1fpkt"];
1286--2650[label="1;1pkt 1fpkt"];
1289--2650[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="136.171.162.207" dst_port="25" src_ip="196.89.138.143" src_port="59577"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091941313" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818035,1.27709,999,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_234{
style=filled;
color=gray75;
30[label="141.26.6.212s;1pkt 1fpkt", shape=rectangle, color=red];
1291[label="141.26.6.212;s;1pkt 1fpkt", shape=diamond, color=yellow];
1292[label="213.223.16.12;d;1pkt 1fpkt", shape=diamond, color=yellow];
2879[label="141.26.6.212;s;1pkt 1fpkt", shape=hexagon, color=black];
stat234[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.26.6.212:4149, 213.223.16.12:8128}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8128: (50%)&lt;BR/&gt; 4149: (50%)&gt;];
}
30--1291[label="1;1pkt 1fpkt"];
30--1292[label="1;1pkt 1fpkt"];
30--2879[label="1;1pkt 1fpkt"];
1291--1292[label="1;1pkt 1fpkt"];
1291--2879[label="1;1pkt 1fpkt"];
1292--2879[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="213.223.16.12" dst_port="8128" src_ip="141.26.6.212" src_port="4149"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942061" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.711294,1.2256,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_235{
style=filled;
color=gray75;
1290[label="141.26.6.212;d;1pkt 1fpkt", shape=diamond, color=yellow];
1293[label="213.223.16.12;s;1pkt 1fpkt", shape=diamond, color=yellow];
2764[label="213.223.16.12;s;1pkt 1fpkt", shape=hexagon, color=black];
3388[label="213.223.16.12;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat235[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.223.16.12:8128, 141.26.6.212:4149}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8128: (50%)&lt;BR/&gt; 4149: (50%)&gt;];
}
1290--1293[label="1;1pkt 1fpkt"];
1290--2764[label="1;1pkt 1fpkt"];
1290--3388[label="1;1pkt 1fpkt"];
1293--2764[label="1;1pkt 1fpkt"];
1293--3388[label="1;1pkt 1fpkt"];
2764--3388[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="141.26.6.212" dst_port="4149" src_ip="213.223.16.12" src_port="8128"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.773242,1.19457,999,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_236{
style=filled;
color=gray75;
1305[label="204.40.50.183;s;3pkt 3fpkt", shape=diamond, color=yellow];
1306[label="213.52.45.203;d;2pkt 2fpkt", shape=diamond, color=yellow];
2534[label="204.40.50.183;s;3pkt 3fpkt", shape=hexagon, color=black];
4023[label="204.40.50.183;3pkt 3fpkt", shape=pentagon, color=darkviolet];
4680[label="204.40.50.183;3pkt 3fpkt", shape=invtriangle, color=brown];
stat236[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.40.50.183:123, 122.33.32.48:123}[33.3333%]&lt;BR/&gt;{204.40.50.183:1155, 213.52.45.203:20776}[33.3333%]&lt;BR/&gt;{204.40.50.183:1162, 213.52.45.203:20776}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 20776: (35.7143%)&lt;BR/&gt; 123: (28.5714%)&lt;BR/&gt; 1162: (17.8571%)&lt;BR/&gt; 1155: (17.8571%)&gt;];
}
1305--1306[label="1;2pkt 2fpkt"];
1305--2534[label="1;3pkt 3fpkt"];
1305--4023[label="1;3pkt 3fpkt"];
1305--4680[label="1;3pkt 3fpkt"];
1306--2534[label="1;2pkt 2fpkt"];
1306--4023[label="1;2pkt 2fpkt"];
1306--4680[label="1;2pkt 2fpkt"];
2534--4023[label="1;3pkt 3fpkt"];
2534--4680[label="1;3pkt 3fpkt"];
4023--4680[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="213.52.45.203" dst_port="20776" src_ip="204.40.50.183" src_port="1162"/>
      <filter dst_ip="213.52.45.203" dst_port="20776" src_ip="204.40.50.183" src_port="1155"/>
      <filter dst_ip="122.33.32.48" dst_port="123" src_ip="204.40.50.183" src_port="123"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.773242,1.19457,999,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_237{
style=filled;
color=gray75;
1304[label="204.40.50.183;d;3pkt 3fpkt", shape=diamond, color=yellow];
1307[label="213.52.45.203;s;2pkt 2fpkt", shape=diamond, color=yellow];
2535[label="213.52.45.203;s;2pkt 2fpkt", shape=hexagon, color=black];
2655[label="204.40.50.183;d;2pkt 2fpkt", shape=hexagon, color=black];
4086[label="213.52.45.203;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4721[label="213.52.45.203;2pkt 2fpkt", shape=invtriangle, color=brown];
stat237[shape=component, label=&lt;Rules:&lt;BR/&gt;{122.33.32.48:123, 204.40.50.183:123}[33.3333%]&lt;BR/&gt;{213.52.45.203:20776, 204.40.50.183:1155}[33.3333%]&lt;BR/&gt;{213.52.45.203:20776, 204.40.50.183:1162}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 20776: (46.1538%)&lt;BR/&gt; 1162: (23.0769%)&lt;BR/&gt; 1155: (23.0769%)&lt;BR/&gt; 123: (7.69231%)&gt;];
}
1304--1307[label="1;2pkt 2fpkt"];
1304--2535[label="1;2pkt 2fpkt"];
1304--2655[label="1;2pkt 2fpkt"];
1304--4086[label="1;2pkt 2fpkt"];
1304--4721[label="1;2pkt 2fpkt"];
1307--2535[label="1;2pkt 2fpkt"];
1307--2655[label="1;2pkt 2fpkt"];
1307--4086[label="1;2pkt 2fpkt"];
1307--4721[label="1;2pkt 2fpkt"];
2535--2655[label="1;2pkt 2fpkt"];
2535--4086[label="1;2pkt 2fpkt"];
2535--4721[label="1;2pkt 2fpkt"];
2655--4086[label="1;2pkt 2fpkt"];
2655--4721[label="1;2pkt 2fpkt"];
4086--4721[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="204.40.50.183" dst_port="1162" src_ip="213.52.45.203" src_port="20776"/>
      <filter dst_ip="204.40.50.183" dst_port="1155" src_ip="213.52.45.203" src_port="20776"/>
      <filter dst_ip="204.40.50.183" dst_port="123" src_ip="122.33.32.48" src_port="123"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_240{
style=filled;
color=gray75;
1330[label="151.125.40.72;d;3pkt 3fpkt", shape=diamond, color=yellow];
1333[label="81.152.180.215;s;1pkt 1fpkt", shape=diamond, color=yellow];
2666[label="151.125.40.72;d;3pkt 3fpkt", shape=hexagon, color=black];
2780[label="81.152.180.215;s;1pkt 1fpkt", shape=hexagon, color=black];
stat240[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.211.81.21:62567, 151.125.40.72:137}[33.3333%]&lt;BR/&gt;{205.78.45.27:8000, 151.125.40.72:4000}[33.3333%]&lt;BR/&gt;{81.152.180.215:20, 151.125.40.72:3245}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3245: (25%)&lt;BR/&gt; 20: (25%)&lt;BR/&gt; 62567: (12.5%)&lt;BR/&gt; 8000: (12.5%)&lt;BR/&gt; 4000: (12.5%)&gt;];
}
1330--1333[label="1;1pkt 1fpkt"];
1330--2666[label="1;3pkt 3fpkt"];
1330--2780[label="1;1pkt 1fpkt"];
1333--2666[label="1;1pkt 1fpkt"];
1333--2780[label="1;1pkt 1fpkt"];
2666--2780[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="151.125.40.72" dst_port="3245" src_ip="81.152.180.215" src_port="20"/>
      <filter dst_ip="151.125.40.72" dst_port="4000" src_ip="205.78.45.27" src_port="8000"/>
      <filter dst_ip="151.125.40.72" dst_port="137" src_ip="216.211.81.21" src_port="62567"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_242{
style=filled;
color=gray75;
1346[label="3.42.211.138;d;1pkt 1fpkt", shape=diamond, color=yellow];
1347[label="174.104.123.141;s;1pkt 1fpkt", shape=diamond, color=yellow];
3020[label="174.104.123.141;s;1pkt 1fpkt", shape=hexagon, color=black];
stat242[shape=component, label=&lt;Rules:&lt;BR/&gt;{174.104.123.141:1752, 3.42.211.138:8060}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8060: (50%)&lt;BR/&gt; 1752: (50%)&gt;];
}
1346--1347[label="1;1pkt 1fpkt"];
1346--3020[label="1;1pkt 1fpkt"];
1347--3020[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="3.42.211.138" dst_port="8060" src_ip="174.104.123.141" src_port="1752"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_244{
style=filled;
color=gray75;
1357[label="151.125.174.55;s;2pkt 2fpkt", shape=diamond, color=yellow];
1358[label="202.70.188.21;d;1pkt 1fpkt", shape=diamond, color=yellow];
2797[label="151.125.174.55;s;2pkt 2fpkt", shape=hexagon, color=black];
stat244[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.125.174.55:2512, 202.70.188.21:1863}[50%]&lt;BR/&gt;{151.125.174.55:2504, 202.70.187.37:1863}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1863: (50%)&lt;BR/&gt; 2512: (30%)&lt;BR/&gt; 2504: (20%)&gt;];
}
1357--1358[label="1;1pkt 1fpkt"];
1357--2797[label="1;2pkt 2fpkt"];
1358--2797[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="202.70.187.37" dst_port="1863" src_ip="151.125.174.55" src_port="2504"/>
      <filter dst_ip="202.70.188.21" dst_port="1863" src_ip="151.125.174.55" src_port="2512"/>
    </slice>
    <from sec="1091941202" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="174.104.181.247"/>
      <from sec="1091941206" usec="0"/>
      <to sec="1091941292" usec="0"/>
    </slice>
    <from sec="1091941206" usec="0"/>
    <to sec="1091941292" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,001,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="219.96.151.185"/>
      <from sec="1091941218" usec="0"/>
      <to sec="1091941292" usec="0"/>
    </slice>
    <from sec="1091941218" usec="0"/>
    <to sec="1091941292" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_249{
style=filled;
color=gray75;
1385[label="174.104.236.193;d;21pkt 21fpkt", shape=diamond, color=yellow];
1386[label="2.41.99.108;s;22pkt 22fpkt", shape=diamond, color=yellow];
stat249[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.41.99.108:80, 174.104.236.193:*}[79.1667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4781: (2.32558%)&lt;BR/&gt; 4780: (2.32558%)&lt;BR/&gt; 4779: (2.32558%)&lt;BR/&gt; 4778: (2.32558%)&gt;];
}
1385--1386[label="0.904762;19pkt 19fpkt"];
1385--3622[label="0.047619;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="174.104.236.193" src_ip="2.41.99.108" src_port="80"/>
    </slice>
    <from sec="1091941745" usec="0"/>
    <to sec="1091941865" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818035,1.27709,503,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_251{
style=filled;
color=gray75;
7[label="168.115.206.62s;4pkt 4fpkt", shape=rectangle, color=red];
1483[label="0.19.219.109;d;2pkt 2fpkt", shape=diamond, color=yellow];
1622[label="196.18.16.239;d;1pkt 1fpkt", shape=diamond, color=yellow];
2606[label="196.18.16.239;d;1pkt 1fpkt", shape=hexagon, color=black];
2745[label="0.19.219.109;d;2pkt 2fpkt", shape=hexagon, color=black];
stat251[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.115.206.62:2129, 196.18.16.239:80}[25%]&lt;BR/&gt;{168.115.206.62:3633, 197.249.65.241:80}[25%]&lt;BR/&gt;{168.115.206.62:3916, 0.19.219.109:80}[25%]&lt;BR/&gt;{168.115.206.62:3918, 0.19.219.109:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3918: (15%)&lt;BR/&gt; 3916: (15%)&lt;BR/&gt; 2129: (15%)&lt;BR/&gt; 3633: (5%)&gt;];
}
7--1186[label="1;4pkt 4fpkt"];
7--1483[label="1;2pkt 2fpkt"];
7--1622[label="1;1pkt 1fpkt"];
7--2376[label="0.25;1pkt 1fpkt"];
7--2606[label="1;1pkt 1fpkt"];
7--2745[label="1;2pkt 2fpkt"];
1483--2745[label="1;2pkt 2fpkt"];
1622--2606[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="0.19.219.109" dst_port="80" src_ip="168.115.206.62" src_port="3918"/>
      <filter dst_ip="0.19.219.109" dst_port="80" src_ip="168.115.206.62" src_port="3916"/>
      <filter dst_ip="197.249.65.241" dst_port="80" src_ip="168.115.206.62" src_port="3633"/>
      <filter dst_ip="196.18.16.239" dst_port="80" src_ip="168.115.206.62" src_port="2129"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942071" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="206.17.19.199"/>
      <from sec="1091941201" usec="0"/>
      <to sec="1091941389" usec="0"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091941389" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_254{
style=filled;
color=gray75;
1498[label="151.125.128.173;s;7pkt 7fpkt", shape=diamond, color=yellow];
1499[label="192.48.225.99;d;1pkt 1fpkt", shape=diamond, color=yellow];
2388[label="216.206.133.144;d;1pkt 1fpkt", shape=diamond, color=yellow];
2651[label="192.48.225.99;d;1pkt 1fpkt", shape=hexagon, color=black];
3069[label="151.125.128.173;s;7pkt 7fpkt", shape=hexagon, color=black];
3170[label="216.206.133.144;d;1pkt 1fpkt", shape=hexagon, color=black];
stat254[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.125.128.173:*, *:554}[57.1429%]&lt;BR/&gt;{151.125.128.173:*, *:1755}[28.5714%]&lt;BR/&gt;{151.125.128.173:*, 216.206.133.135:*}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 554: (27.7778%)&lt;BR/&gt; 1755: (16.6667%)&lt;BR/&gt; 3001: (11.1111%)&lt;BR/&gt; 2583: (11.1111%)&lt;BR/&gt; 2980: (5.55556%)&gt;];
}
1498--1499[label="1;1pkt 1fpkt"];
1498--2388[label="1;1pkt 1fpkt"];
1498--2651[label="1;1pkt 1fpkt"];
1498--3069[label="1;7pkt 7fpkt"];
1498--3170[label="1;1pkt 1fpkt"];
1499--2651[label="1;1pkt 1fpkt"];
1499--3069[label="1;1pkt 1fpkt"];
2388--3069[label="1;1pkt 1fpkt"];
2388--3170[label="1;1pkt 1fpkt"];
2651--3069[label="1;1pkt 1fpkt"];
3069--3170[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="216.206.133.135" src_ip="151.125.128.173"/>
      <filter dst_port="554" src_ip="151.125.128.173"/>
      <filter dst_port="1755" src_ip="151.125.128.173"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091941957" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.773242,1.19457,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_255{
style=filled;
color=gray75;
1504[label="174.104.183.134;s;19pkt 19fpkt", shape=diamond, color=yellow];
1505[label="170.149.214.246;d;4pkt 4fpkt", shape=diamond, color=yellow];
2471[label="82.163.108.129;d;12pkt 12fpkt", shape=diamond, color=yellow];
3135[label="174.104.183.134;s;19pkt 19fpkt", shape=hexagon, color=black];
3842[label="174.104.183.134;24pkt 24fpkt", shape=pentagon, color=darkviolet];
4553[label="174.104.183.134;24pkt 24fpkt", shape=invtriangle, color=brown];
stat255[shape=component, label=&lt;Rules:&lt;BR/&gt;{174.104.183.134:*, 82.163.108.129:80}[70.8333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.0784%)&lt;BR/&gt; 0: (3.92157%)&lt;BR/&gt; 1368: (2.45098%)&lt;BR/&gt; 1366: (2.45098%)&lt;BR/&gt; 1364: (2.45098%)&gt;];
}
1504--1505[label="1;4pkt 4fpkt"];
1504--2471[label="1;12pkt 12fpkt"];
1504--3135[label="1;19pkt 19fpkt"];
1504--3842[label="1;19pkt 19fpkt"];
1504--4553[label="1;19pkt 19fpkt"];
1505--3135[label="1;4pkt 4fpkt"];
1505--3842[label="1;4pkt 4fpkt"];
1505--4553[label="1;4pkt 4fpkt"];
2471--3135[label="1;12pkt 12fpkt"];
2471--3842[label="1;12pkt 12fpkt"];
2471--4553[label="1;12pkt 12fpkt"];
3135--3842[label="1;19pkt 19fpkt"];
3135--4553[label="1;19pkt 19fpkt"];
3842--4553[label="1;24pkt 24fpkt"];
</description>
    <slice>
      <filter dst_ip="82.163.108.129" dst_port="80" src_ip="174.104.183.134"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="118.91.19.87"/>
      <from sec="1091941201" usec="0"/>
      <to sec="1091941391" usec="0"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091941391" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689649,1.30044,999,0 0 0 1 0 0 0 0 0 0 1 0 ">
    <description>subgraph cluster_257{
style=filled;
color=gray75;
1382[label="205.78.65.30;s;2pkt 2fpkt", shape=diamond, color=yellow];
1555[label="204.40.42.22;d;2pkt 2fpkt", shape=diamond, color=yellow];
4291[label="205.78.65.30;1pkt 1fpkt", shape=invtriangle, color=brown];
stat257[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.78.65.30:33325, 204.40.42.22:21}[50%]&lt;BR/&gt;{205.78.65.30:33326, 204.40.42.22:36268}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 36268: (30%)&lt;BR/&gt; 33326: (30%)&lt;BR/&gt; 33325: (20%)&lt;BR/&gt; 21: (20%)&gt;];
}
1382--1555[label="1;2pkt 2fpkt"];
1382--4291[label="1;1pkt 1fpkt"];
1555--4291[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="204.40.42.22" dst_port="36268" src_ip="205.78.65.30" src_port="33326"/>
      <filter dst_ip="204.40.42.22" dst_port="21" src_ip="205.78.65.30" src_port="33325"/>
    </slice>
    <from sec="1091941240" usec="0"/>
    <to sec="1091941269" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,504,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="3.31.209.127"/>
      <from sec="1091941277" usec="0"/>
      <to sec="1091941432" usec="0"/>
    </slice>
    <from sec="1091941277" usec="0"/>
    <to sec="1091941432" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.773242,1.19457,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_259{
style=filled;
color=gray75;
1411[label="174.104.183.68;s;458pkt 458fpkt", shape=diamond, color=yellow];
1561[label="0.19.218.64;d;163pkt 163fpkt", shape=diamond, color=yellow];
2556[label="174.104.183.68;s;73pkt 73fpkt", shape=hexagon, color=black];
2978[label="0.19.218.64;d;163pkt 163fpkt", shape=hexagon, color=black];
3602[label="174.104.183.68;461pkt 461fpkt", shape=pentagon, color=darkviolet];
4388[label="174.104.183.68;460pkt 460fpkt", shape=invtriangle, color=brown];
stat259[shape=component, label=&lt;Rules:&lt;BR/&gt;{174.104.183.68:*, 0.19.218.64:80}[35.3579%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3737: (0.168729%)&lt;BR/&gt; 3734: (0.168729%)&lt;BR/&gt; 3733: (0.168729%)&lt;BR/&gt; 3731: (0.168729%)&gt;];
}
1411--1561[label="1;163pkt 163fpkt"];
1411--2064[label="0.0454545;4pkt 4fpkt"];
1411--2556[label="1;73pkt 73fpkt"];
1411--2978[label="1;163pkt 163fpkt"];
1411--3602[label="1;458pkt 458fpkt"];
1411--4388[label="0.997817;457pkt 457fpkt"];
1561--2556[label="0.493151;36pkt 36fpkt"];
1561--2978[label="1;163pkt 163fpkt"];
1561--3602[label="1;163pkt 163fpkt"];
1561--4388[label="1;163pkt 163fpkt"];
2556--2978[label="0.493151;36pkt 36fpkt"];
2556--3602[label="1;73pkt 73fpkt"];
2556--4388[label="0.986301;72pkt 72fpkt"];
2978--3602[label="1;163pkt 163fpkt"];
2978--4388[label="1;163pkt 163fpkt"];
3602--4388[label="1;460pkt 460fpkt"];
</description>
    <slice>
      <filter dst_ip="0.19.218.64" dst_port="80" src_ip="174.104.183.68"/>
    </slice>
    <from sec="1091941282" usec="0"/>
    <to sec="1091942066" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.708398,1.30132,999,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_260{
style=filled;
color=gray75;
18[label="151.125.173.114s;1pkt 1fpkt", shape=rectangle, color=red];
1562[label="205.64.68.33;d;2pkt 2fpkt", shape=diamond, color=yellow];
1565[label="151.125.173.114;s;2pkt 2fpkt", shape=diamond, color=yellow];
stat260[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.125.173.114:2208, 205.64.68.33:21211}[50%]&lt;BR/&gt;{151.125.173.114:2209, 205.64.68.33:1484}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2209: (30%)&lt;BR/&gt; 1484: (30%)&lt;BR/&gt; 21211: (20%)&lt;BR/&gt; 2208: (20%)&gt;];
}
18--1562[label="1;1pkt 1fpkt"];
18--1565[label="1;1pkt 1fpkt"];
1562--1565[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="205.64.68.33" dst_port="1484" src_ip="151.125.173.114" src_port="2209"/>
      <filter dst_ip="205.64.68.33" dst_port="21211" src_ip="151.125.173.114" src_port="2208"/>
    </slice>
    <from sec="1091941285" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.74076,1.19023,999,1 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_261{
style=filled;
color=gray75;
3[label="205.64.68.33s;1pkt 1fpkt", shape=rectangle, color=red];
1563[label="205.64.68.33;s;2pkt 2fpkt", shape=diamond, color=yellow];
1564[label="151.125.173.114;d;2pkt 2fpkt", shape=diamond, color=yellow];
3472[label="205.64.68.33;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4305[label="205.64.68.33;1pkt 1fpkt", shape=invtriangle, color=brown];
stat261[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.64.68.33:1484, 151.125.173.114:2209}[50%]&lt;BR/&gt;{205.64.68.33:21211, 151.125.173.114:2208}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2209: (35.7143%)&lt;BR/&gt; 1484: (35.7143%)&lt;BR/&gt; 21211: (14.2857%)&lt;BR/&gt; 2208: (14.2857%)&gt;];
}
3--1563[label="1;1pkt 1fpkt"];
3--1564[label="1;1pkt 1fpkt"];
3--3472[label="1;1pkt 1fpkt"];
3--4305[label="1;1pkt 1fpkt"];
1563--1564[label="1;2pkt 2fpkt"];
1563--3472[label="1;1pkt 1fpkt"];
1563--4305[label="1;1pkt 1fpkt"];
1564--3472[label="1;1pkt 1fpkt"];
1564--4305[label="1;1pkt 1fpkt"];
3472--4305[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="151.125.173.114" dst_port="2208" src_ip="205.64.68.33" src_port="21211"/>
      <filter dst_ip="151.125.173.114" dst_port="2209" src_ip="205.64.68.33" src_port="1484"/>
    </slice>
    <from sec="1091941285" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.708398,1.30132,010,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_262{
style=filled;
color=gray75;
235[label="5.168.84.104s;3608pkt 3608fpkt", shape=rectangle, color=red];
1602[label="5.168.84.104;s;5838pkt 5838fpkt", shape=diamond, color=yellow];
stat262[shape=component, label=&lt;Rules:&lt;BR/&gt;{5.168.84.104:*, *:135}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 4970: (0.0264662%)&lt;BR/&gt; 4969: (0.0264662%)&lt;BR/&gt; 4968: (0.0264662%)&lt;BR/&gt; 4967: (0.0264662%)&gt;];
}
235--1602[label="0.87888;3171pkt 3171fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="5.168.84.104"/>
    </slice>
    <from sec="1091941319" usec="0"/>
    <to sec="1091942079" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.825684,1.24043,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_266{
style=filled;
color=gray75;
1270[label="136.171.247.1;s;167pkt 167fpkt", shape=diamond, color=yellow];
1712[label="213.22.174.146;d;163pkt 163fpkt", shape=diamond, color=yellow];
3356[label="136.171.247.1;181pkt 181fpkt", shape=pentagon, color=darkviolet];
4223[label="136.171.247.1;181pkt 181fpkt", shape=invtriangle, color=brown];
4814[label="136.171.247.1;181pkt 181fpkt", shape=invhouse, color=bisque];
stat266[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.171.247.1:25, 213.22.174.146:*}[97.2527%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (49.2554%)&lt;BR/&gt; 80: (0.515464%)&lt;BR/&gt; 64599: (0.286369%)&lt;BR/&gt; 36310: (0.286369%)&lt;BR/&gt; 36305: (0.286369%)&gt;];
}
1270--1326[label="0.00598802;1pkt 1fpkt"];
1270--1712[label="1;163pkt 163fpkt"];
1270--2584[label="0.00598802;1pkt 1fpkt"];
1270--3356[label="0.994012;166pkt 166fpkt"];
1270--4223[label="0.994012;166pkt 166fpkt"];
1270--4814[label="0.994012;166pkt 166fpkt"];
1712--3356[label="1;163pkt 163fpkt"];
1712--4223[label="1;163pkt 163fpkt"];
1712--4814[label="1;163pkt 163fpkt"];
3356--4223[label="1;181pkt 181fpkt"];
3356--4814[label="1;181pkt 181fpkt"];
4223--4814[label="1;181pkt 181fpkt"];
</description>
    <slice>
      <filter dst_ip="213.22.174.146" src_ip="136.171.247.1" src_port="25"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_267{
style=filled;
color=gray75;
1500[label="192.48.225.99;s;1pkt 1fpkt", shape=diamond, color=yellow];
1717[label="151.125.128.173;d;2pkt 2fpkt", shape=diamond, color=yellow];
2878[label="192.48.225.99;s;1pkt 1fpkt", shape=hexagon, color=black];
3001[label="151.125.128.173;d;2pkt 2fpkt", shape=hexagon, color=black];
stat267[shape=component, label=&lt;Rules:&lt;BR/&gt;{5.210.157.27:554, 151.125.128.173:2890}[50%]&lt;BR/&gt;{192.48.225.99:554, 151.125.128.173:2583}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 554: (50%)&lt;BR/&gt; 2583: (33.3333%)&lt;BR/&gt; 2890: (16.6667%)&gt;];
}
1500--1717[label="1;1pkt 1fpkt"];
1500--2878[label="1;1pkt 1fpkt"];
1500--3001[label="1;1pkt 1fpkt"];
1717--2878[label="1;1pkt 1fpkt"];
1717--3001[label="1;2pkt 2fpkt"];
2878--3001[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="151.125.128.173" dst_port="2583" src_ip="192.48.225.99" src_port="554"/>
      <filter dst_ip="151.125.128.173" dst_port="2890" src_ip="5.210.157.27" src_port="554"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091941957" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="151.125.156.138"/>
      <from sec="1091941207" usec="0"/>
      <to sec="1091942029" usec="0"/>
    </slice>
    <from sec="1091941207" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_271{
style=filled;
color=gray75;
1215[label="204.40.34.122;s;32pkt 32fpkt", shape=diamond, color=yellow];
1813[label="204.40.34.123;s;48pkt 48fpkt", shape=diamond, color=yellow];
1823[label="4.254.231.189;d;6pkt 6fpkt", shape=diamond, color=yellow];
1861[label="118.54.214.218;d;8pkt 8fpkt", shape=diamond, color=yellow];
2194[label="0.77.67.84;d;4pkt 4fpkt", shape=diamond, color=yellow];
2212[label="118.108.74.153;d;4pkt 4fpkt", shape=diamond, color=yellow];
2389[label="203.148.171.224;d;4pkt 4fpkt", shape=diamond, color=yellow];
2391[label="118.170.193.79;d;4pkt 4fpkt", shape=diamond, color=yellow];
2474[label="4.210.95.52;d;1pkt 1fpkt", shape=diamond, color=yellow];
2491[label="211.140.16.53;d;380pkt 380fpkt", shape=diamond, color=yellow];
2719[label="4.254.231.189;d;6pkt 6fpkt", shape=hexagon, color=black];
2833[label="204.40.34.123;s;14pkt 14fpkt", shape=hexagon, color=black];
3171[label="203.148.171.224;d;4pkt 4fpkt", shape=hexagon, color=black];
stat271[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.40.34.123:*, 211.140.16.53:*}[83.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (13.3981%)&lt;BR/&gt; 1755: (5.43689%)&lt;BR/&gt; 53: (3.20388%)&lt;BR/&gt; 554: (3.1068%)&lt;BR/&gt; 6129: (2.42718%)&gt;];
}
1215--1823[label="0.333333;2pkt 2fpkt"];
1215--1861[label="0.5;4pkt 4fpkt"];
1215--2389[label="0.25;1pkt 1fpkt"];
1215--2391[label="0.5;2pkt 2fpkt"];
1215--2719[label="0.333333;2pkt 2fpkt"];
1215--3171[label="0.25;1pkt 1fpkt"];
1215--3264[label="0.0625;2pkt 2fpkt"];
1215--3319[label="0.0625;2pkt 2fpkt"];
1215--3344[label="0.0625;2pkt 2fpkt"];
1813--1823[label="0.666667;4pkt 4fpkt"];
1813--1861[label="0.5;4pkt 4fpkt"];
1813--2103[label="1;4pkt 4fpkt"];
1813--2194[label="1;4pkt 4fpkt"];
1813--2212[label="1;4pkt 4fpkt"];
1813--2389[label="0.75;3pkt 3fpkt"];
1813--2391[label="0.5;2pkt 2fpkt"];
1813--2474[label="1;1pkt 1fpkt"];
1813--2491[label="0.0833333;4pkt 4fpkt"];
1813--2719[label="0.666667;4pkt 4fpkt"];
1813--2833[label="1;14pkt 14fpkt"];
1813--2926[label="1;4pkt 4fpkt"];
1813--3171[label="0.75;3pkt 3fpkt"];
1813--3311[label="0.166667;8pkt 8fpkt"];
1813--3337[label="0.166667;8pkt 8fpkt"];
1813--3347[label="0.166667;8pkt 8fpkt"];
1823--2719[label="1;6pkt 6fpkt"];
1823--2833[label="0.666667;4pkt 4fpkt"];
1861--2833[label="0.5;4pkt 4fpkt"];
2389--3171[label="1;4pkt 4fpkt"];
2719--2833[label="0.666667;4pkt 4fpkt"];
2833--3311[label="0.0714286;1pkt 1fpkt"];
2833--3337[label="0.0714286;1pkt 1fpkt"];
2833--3347[label="0.0714286;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="211.140.16.53" src_ip="204.40.34.123"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.767978,1.27034,001,0 0 0 1 0 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_272{
style=filled;
color=gray75;
1834[label="210.193.146.187;d;201pkt 201fpkt", shape=diamond, color=yellow];
3721[label="141.26.177.102;3pkt 3fpkt", shape=pentagon, color=darkviolet];
4952[label="141.26.177.102;1pkt 1fpkt", shape=invhouse, color=bisque];
5014[label="141.26.45.134;7pkt 7fpkt", shape=invhouse, color=bisque];
stat272[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:1023, 210.193.146.187:*}[33.3333%]&lt;BR/&gt;{*:9898, 210.193.146.187:*}[30.4348%]&lt;BR/&gt;{*:5554, 210.193.146.187:*}[29.4686%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1023: (16.5094%)&lt;BR/&gt; 9898: (15.0943%)&lt;BR/&gt; 5554: (14.6226%)&lt;BR/&gt; 0: (3.30189%)&lt;BR/&gt; 8967: (1.17925%)&gt;];
}
1834--2247[label="0.0606061;2pkt 2fpkt"];
1834--2822[label="0.166667;1pkt 1fpkt"];
1834--3082[label="0.0606061;2pkt 2fpkt"];
1834--3721[label="0.333333;1pkt 1fpkt"];
1834--3839[label="0.3;3pkt 3fpkt"];
1834--4952[label="1;1pkt 1fpkt"];
1834--5014[label="0.428571;3pkt 3fpkt"];
3721--4952[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="210.193.146.187" src_port="1023"/>
      <filter dst_ip="210.193.146.187" src_port="9898"/>
      <filter dst_ip="210.193.146.187" src_port="5554"/>
    </slice>
    <from sec="1091941395" usec="0"/>
    <to sec="1091941877" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.711294,1.2256,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_274{
style=filled;
color=gray75;
1830[label="201.51.237.101;s;1pkt 1fpkt", shape=diamond, color=yellow];
1864[label="136.171.186.131;d;1pkt 1fpkt", shape=diamond, color=yellow];
2734[label="136.171.186.131;d;1pkt 1fpkt", shape=hexagon, color=black];
3054[label="201.51.237.101;s;1pkt 1fpkt", shape=hexagon, color=black];
3715[label="201.51.237.101;3pkt 3fpkt", shape=pentagon, color=darkviolet];
stat274[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.51.237.101:80, 141.26.45.164:3067}[33.3333%]&lt;BR/&gt;{201.51.237.101:80, 136.171.186.131:2922}[33.3333%]&lt;BR/&gt;{201.51.237.101:80, 136.171.186.131:2923}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2923: (35.7143%)&lt;BR/&gt; 3067: (7.14286%)&lt;BR/&gt; 2922: (7.14286%)&gt;];
}
1830--1864[label="1;1pkt 1fpkt"];
1830--2734[label="1;1pkt 1fpkt"];
1830--3054[label="1;1pkt 1fpkt"];
1830--3715[label="1;1pkt 1fpkt"];
1864--2734[label="1;1pkt 1fpkt"];
1864--3054[label="1;1pkt 1fpkt"];
1864--3715[label="1;1pkt 1fpkt"];
2734--3054[label="1;1pkt 1fpkt"];
2734--3715[label="1;1pkt 1fpkt"];
3054--3715[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="136.171.186.131" dst_port="2923" src_ip="201.51.237.101" src_port="80"/>
      <filter dst_ip="136.171.186.131" dst_port="2922" src_ip="201.51.237.101" src_port="80"/>
      <filter dst_ip="141.26.45.164" dst_port="3067" src_ip="201.51.237.101" src_port="80"/>
    </slice>
    <from sec="1091941386" usec="0"/>
    <to sec="1091941779" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_275{
style=filled;
color=gray75;
1829[label="201.51.237.101;d;1pkt 1fpkt", shape=diamond, color=yellow];
1865[label="136.171.186.131;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat275[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.171.186.131:2923, 201.51.237.101:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2923: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
1829--1865[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="201.51.237.101" dst_port="80" src_ip="136.171.186.131" src_port="2923"/>
    </slice>
    <from sec="1091941753" usec="0"/>
    <to sec="1091941779" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.675842,1.22137,001,1 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_276{
style=filled;
color=gray75;
114[label="209.53.107.21s;374pkt 374fpkt", shape=rectangle, color=red];
1869[label="209.53.107.21;s;703pkt 703fpkt", shape=diamond, color=yellow];
3429[label="209.53.107.21;703pkt 703fpkt", shape=pentagon, color=darkviolet];
stat276[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.53.107.21:*, *:5554}[65.2916%]&lt;BR/&gt;{209.53.107.21:*, *:1023}[25.1778%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (36.2921%)&lt;BR/&gt; 1023: (9.94382%)&lt;BR/&gt; 9898: (3.76404%)&lt;BR/&gt; 5000: (0.0842697%)&lt;BR/&gt; 4999: (0.0842697%)&gt;];
}
114--1869[label="1;374pkt 374fpkt"];
114--3429[label="1;374pkt 374fpkt"];
1869--3429[label="1;703pkt 703fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="209.53.107.21"/>
      <filter dst_port="1023" src_ip="209.53.107.21"/>
    </slice>
    <from sec="1091941458" usec="0"/>
    <to sec="1091941471" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_278{
style=filled;
color=gray75;
1903[label="136.171.83.173;d;174pkt 174fpkt", shape=diamond, color=yellow];
stat278[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:25, 136.171.83.173:*}[62.6437%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (38.5057%)&lt;BR/&gt; 113: (8.33333%)&lt;BR/&gt; 0: (4.02299%)&lt;BR/&gt; 55777: (0.287356%)&lt;BR/&gt; 53778: (0.287356%)&gt;];
}
1903--3437[label="0.0114943;2pkt 2fpkt"];
1903--4275[label="0.0114943;2pkt 2fpkt"];
1903--4845[label="0.0114943;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="136.171.83.173" src_port="25"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942026" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="136.171.203.125"/>
      <from sec="1091941202" usec="0"/>
      <to sec="1091942026" usec="0"/>
    </slice>
    <from sec="1091941202" usec="0"/>
    <to sec="1091942026" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="151.125.122.199"/>
      <from sec="1091941233" usec="0"/>
      <to sec="1091942029" usec="0"/>
    </slice>
    <from sec="1091941233" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="136.171.84.38"/>
      <from sec="1091941439" usec="0"/>
      <to sec="1091941992" usec="0"/>
    </slice>
    <from sec="1091941439" usec="0"/>
    <to sec="1091941992" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_286{
style=filled;
color=gray75;
2131[label="205.248.184.28;d;458pkt 458fpkt", shape=diamond, color=yellow];
stat286[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 205.248.184.28:53}[98.4716%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (54.2576%)&lt;BR/&gt; 32768: (2.18341%)&lt;BR/&gt; 0: (1.0917%)&lt;BR/&gt; 1024: (0.982533%)&lt;BR/&gt; 32772: (0.764192%)&gt;];
}
2131--2197[label="0.04;1pkt 1fpkt"];
2131--2437[label="0.0192308;1pkt 1fpkt"];
2131--2870[label="0.0434783;1pkt 1fpkt"];
2131--2951[label="1;399pkt 399fpkt"];
2131--3050[label="0.00655022;3pkt 3fpkt"];
2131--3263[label="0.00655022;3pkt 3fpkt"];
2131--3310[label="0.00873362;4pkt 4fpkt"];
2131--3313[label="0.010917;5pkt 5fpkt"];
2131--3318[label="0.00655022;3pkt 3fpkt"];
2131--3336[label="0.00873362;4pkt 4fpkt"];
2131--3339[label="0.010917;5pkt 5fpkt"];
2131--3343[label="0.00655022;3pkt 3fpkt"];
2131--3346[label="0.00873362;4pkt 4fpkt"];
2131--3349[label="0.010917;5pkt 5fpkt"];
2131--3419[label="0.0212766;1pkt 1fpkt"];
2131--3507[label="0.0344828;1pkt 1fpkt"];
2131--4169[label="0.25;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="205.248.184.28" dst_port="53"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="136.171.40.47"/>
      <from sec="1091941201" usec="0"/>
      <to sec="1091942018" usec="0"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942018" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="204.40.40.207"/>
      <from sec="1091941201" usec="0"/>
      <to sec="1091942029" usec="0"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="204.40.44.114"/>
      <from sec="1091941202" usec="0"/>
      <to sec="1091942028" usec="0"/>
    </slice>
    <from sec="1091941202" usec="0"/>
    <to sec="1091942028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_292{
style=filled;
color=gray75;
2038[label="136.171.149.36;s;831pkt 831fpkt", shape=diamond, color=yellow];
stat292[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.171.149.36:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2038--2892[label="0.00431034;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="136.171.149.36"/>
    </slice>
    <from sec="1091941202" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_294{
style=filled;
color=gray75;
2082[label="217.155.177.160;d;107pkt 107fpkt", shape=diamond, color=yellow];
2095[label="205.242.18.218;s;89pkt 89fpkt", shape=diamond, color=yellow];
2366[label="151.125.233.111;s;127pkt 127fpkt", shape=diamond, color=yellow];
2397[label="217.155.177.175;d;89pkt 89fpkt", shape=diamond, color=yellow];
2419[label="151.125.173.243;s;87pkt 87fpkt", shape=diamond, color=yellow];
2472[label="151.125.203.21;s;123pkt 123fpkt", shape=diamond, color=yellow];
2924[label="205.242.18.218;s;89pkt 89fpkt", shape=hexagon, color=black];
3123[label="217.155.177.175;d;89pkt 89fpkt", shape=hexagon, color=black];
stat294[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.125.233.111:*, *:80}[25.7669%]&lt;BR/&gt;{151.125.203.21:*, *:80}[24.9489%]&lt;BR/&gt;{*:*, 217.155.177.160:80}[21.8814%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.75%)&lt;BR/&gt; 3634: (0.1875%)&lt;BR/&gt; 3633: (0.1875%)&lt;BR/&gt; 3631: (0.1875%)&lt;BR/&gt; 3629: (0.1875%)&gt;];
}
2082--2095[label="0.382022;34pkt 34fpkt"];
2082--2239[label="0.0972222;7pkt 7fpkt"];
2082--2366[label="0.046729;5pkt 5fpkt"];
2082--2419[label="0.0229885;2pkt 2fpkt"];
2082--2446[label="0.00934579;1pkt 1fpkt"];
2082--2472[label="0.0280374;3pkt 3fpkt"];
2082--2924[label="0.382022;34pkt 34fpkt"];
2082--3010[label="0.0972222;7pkt 7fpkt"];
2082--3702[label="0.0972222;7pkt 7fpkt"];
2082--4455[label="0.0972222;7pkt 7fpkt"];
2095--2924[label="1;89pkt 89fpkt"];
2366--2397[label="1;89pkt 89fpkt"];
2366--3123[label="1;89pkt 89fpkt"];
2397--3123[label="1;89pkt 89fpkt"];
2419--3124[label="0.222222;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="151.125.233.111"/>
      <filter dst_port="80" src_ip="151.125.203.21"/>
      <filter dst_ip="217.155.177.160" dst_port="80"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.825684,1.24043,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_295{
style=filled;
color=gray75;
1338[label="205.248.186.2;d;757pkt 757fpkt", shape=diamond, color=yellow];
1388[label="0.197.39.153;s;101pkt 101fpkt", shape=diamond, color=yellow];
1770[label="213.49.217.15;s;50pkt 50fpkt", shape=diamond, color=yellow];
1807[label="205.248.186.127;d;26pkt 26fpkt", shape=diamond, color=yellow];
1992[label="213.139.34.148;s;18pkt 18fpkt", shape=diamond, color=yellow];
2087[label="174.104.183.36;d;87pkt 87fpkt", shape=diamond, color=yellow];
2192[label="68.63.144.155;s;32pkt 32fpkt", shape=diamond, color=yellow];
2311[label="213.116.19.45;s;10pkt 10fpkt", shape=diamond, color=yellow];
3366[label="218.151.63.4;8pkt 8fpkt", shape=pentagon, color=darkviolet];
3404[label="213.49.217.15;49pkt 49fpkt", shape=pentagon, color=darkviolet];
3410[label="213.154.132.16;11pkt 11fpkt", shape=pentagon, color=darkviolet];
3555[label="213.49.210.56;23pkt 23fpkt", shape=pentagon, color=darkviolet];
3615[label="213.98.185.73;10pkt 10fpkt", shape=pentagon, color=darkviolet];
3897[label="0.197.39.153;100pkt 100fpkt", shape=pentagon, color=darkviolet];
3907[label="68.63.144.155;31pkt 31fpkt", shape=pentagon, color=darkviolet];
4033[label="213.28.203.185;48pkt 48fpkt", shape=pentagon, color=darkviolet];
4146[label="0.245.176.226;20pkt 20fpkt", shape=pentagon, color=darkviolet];
4255[label="213.49.217.15;49pkt 49fpkt", shape=invtriangle, color=brown];
4258[label="213.154.132.16;11pkt 11fpkt", shape=invtriangle, color=brown];
4397[label="213.98.185.73;10pkt 10fpkt", shape=invtriangle, color=brown];
4589[label="0.197.39.153;100pkt 100fpkt", shape=invtriangle, color=brown];
4596[label="68.63.144.155;31pkt 31fpkt", shape=invtriangle, color=brown];
4684[label="213.28.203.185;48pkt 48fpkt", shape=invtriangle, color=brown];
4821[label="218.151.63.4;7pkt 7fpkt", shape=invhouse, color=bisque];
4833[label="213.49.217.15;49pkt 49fpkt", shape=invhouse, color=bisque];
5038[label="68.63.144.155;31pkt 31fpkt", shape=invhouse, color=bisque];
5097[label="213.28.203.185;48pkt 48fpkt", shape=invhouse, color=bisque];
stat295[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 205.248.186.2:*}[83.817%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.7734%)&lt;BR/&gt; 49749: (0.141643%)&lt;BR/&gt; 49748: (0.141643%)&lt;BR/&gt; 49747: (0.141643%)&lt;BR/&gt; 49746: (0.141643%)&gt;];
}
1338--1380[label="1;31pkt 31fpkt"];
1338--1388[label="1;101pkt 101fpkt"];
1338--1525[label="0.17782;93pkt 93fpkt"];
1338--1545[label="0.0581395;5pkt 5fpkt"];
1338--1770[label="0.24;12pkt 12fpkt"];
1338--1992[label="1;18pkt 18fpkt"];
1338--2041[label="0.00403226;1pkt 1fpkt"];
1338--2098[label="1;6pkt 6fpkt"];
1338--2101[label="1;2pkt 2fpkt"];
1338--2102[label="1;2pkt 2fpkt"];
1338--2192[label="1;32pkt 32fpkt"];
1338--2311[label="1;10pkt 10fpkt"];
1338--2358[label="0.0566038;3pkt 3fpkt"];
1338--2546[label="1;23pkt 23fpkt"];
1338--2588[label="0.188995;79pkt 79fpkt"];
1338--2678[label="0.106383;5pkt 5fpkt"];
1338--3046[label="1;6pkt 6fpkt"];
1338--3264[label="0.0951123;72pkt 72fpkt"];
1338--3311[label="0.0594452;45pkt 45fpkt"];
1338--3319[label="0.0951123;72pkt 72fpkt"];
1338--3337[label="0.0594452;45pkt 45fpkt"];
1338--3344[label="0.0951123;72pkt 72fpkt"];
1338--3347[label="0.0594452;45pkt 45fpkt"];
1338--3352[label="1;1pkt 1fpkt"];
1338--3404[label="0.22449;11pkt 11fpkt"];
1338--3410[label="0.909091;10pkt 10fpkt"];
1338--3555[label="0.173913;4pkt 4fpkt"];
1338--3615[label="0.8;8pkt 8fpkt"];
1338--3897[label="1;100pkt 100fpkt"];
1338--3907[label="1;31pkt 31fpkt"];
1338--4029[label="0.0537634;5pkt 5fpkt"];
1338--4033[label="1;48pkt 48fpkt"];
1338--4146[label="1;20pkt 20fpkt"];
1338--4220[label="1;1pkt 1fpkt"];
1338--4255[label="0.22449;11pkt 11fpkt"];
1338--4258[label="0.909091;10pkt 10fpkt"];
1338--4397[label="0.8;8pkt 8fpkt"];
1338--4589[label="1;100pkt 100fpkt"];
1338--4596[label="1;31pkt 31fpkt"];
1338--4684[label="1;48pkt 48fpkt"];
1338--4813[label="1;1pkt 1fpkt"];
1338--4833[label="0.22449;11pkt 11fpkt"];
1338--5038[label="1;31pkt 31fpkt"];
1338--5097[label="1;48pkt 48fpkt"];
1388--3897[label="1;100pkt 100fpkt"];
1388--4589[label="1;100pkt 100fpkt"];
1770--1807[label="0.961538;25pkt 25fpkt"];
1770--2087[label="0.18;9pkt 9fpkt"];
1770--3264[label="0.08;4pkt 4fpkt"];
1770--3311[label="0.14;7pkt 7fpkt"];
1770--3319[label="0.08;4pkt 4fpkt"];
1770--3337[label="0.14;7pkt 7fpkt"];
1770--3344[label="0.08;4pkt 4fpkt"];
1770--3347[label="0.14;7pkt 7fpkt"];
1770--3404[label="1;49pkt 49fpkt"];
1770--4255[label="1;49pkt 49fpkt"];
1770--4833[label="1;49pkt 49fpkt"];
1807--2358[label="0.0384615;1pkt 1fpkt"];
1807--3311[label="0.0384615;1pkt 1fpkt"];
1807--3337[label="0.0384615;1pkt 1fpkt"];
1807--3347[label="0.0384615;1pkt 1fpkt"];
1807--3404[label="0.961538;25pkt 25fpkt"];
1807--4255[label="0.961538;25pkt 25fpkt"];
1807--4833[label="0.961538;25pkt 25fpkt"];
2087--2178[label="0.448276;39pkt 39fpkt"];
2087--2274[label="0.135135;10pkt 10fpkt"];
2087--3111[label="0.448276;39pkt 39fpkt"];
2087--3311[label="0.103448;9pkt 9fpkt"];
2087--3337[label="0.103448;9pkt 9fpkt"];
2087--3347[label="0.103448;9pkt 9fpkt"];
2087--3366[label="1;8pkt 8fpkt"];
2087--3404[label="0.183673;9pkt 9fpkt"];
2087--3792[label="0.448276;39pkt 39fpkt"];
2087--4255[label="0.183673;9pkt 9fpkt"];
2087--4821[label="1;7pkt 7fpkt"];
2087--4833[label="0.183673;9pkt 9fpkt"];
2192--3311[label="0.0625;2pkt 2fpkt"];
2192--3337[label="0.0625;2pkt 2fpkt"];
2192--3347[label="0.0625;2pkt 2fpkt"];
2192--3907[label="1;31pkt 31fpkt"];
2192--4596[label="1;31pkt 31fpkt"];
2192--5038[label="1;31pkt 31fpkt"];
3366--4821[label="1;7pkt 7fpkt"];
3404--4255[label="1;49pkt 49fpkt"];
3404--4833[label="1;49pkt 49fpkt"];
3410--4258[label="1;11pkt 11fpkt"];
3615--4397[label="1;10pkt 10fpkt"];
3897--4589[label="1;100pkt 100fpkt"];
3907--4596[label="1;31pkt 31fpkt"];
3907--5038[label="1;31pkt 31fpkt"];
4033--4684[label="1;48pkt 48fpkt"];
4033--5097[label="1;48pkt 48fpkt"];
4255--4833[label="1;49pkt 49fpkt"];
4596--5038[label="1;31pkt 31fpkt"];
4684--5097[label="1;48pkt 48fpkt"];
</description>
    <slice>
      <filter dst_ip="205.248.186.2" src_port="80"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.825684,1.24043,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_297{
style=filled;
color=gray75;
1236[label="136.171.172.82;d;63pkt 63fpkt", shape=diamond, color=yellow];
2115[label="3.106.25.143;s;21pkt 21fpkt", shape=diamond, color=yellow];
3540[label="0.201.135.52;14pkt 14fpkt", shape=pentagon, color=darkviolet];
4348[label="0.201.135.52;13pkt 13fpkt", shape=invtriangle, color=brown];
4889[label="0.201.135.52;13pkt 13fpkt", shape=invhouse, color=bisque];
stat297[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 136.171.172.82:*}[36.1446%]&lt;BR/&gt;{3.106.25.143:*, *:80}[24.0964%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (37.9032%)&lt;BR/&gt; 0: (9.67742%)&lt;BR/&gt; 53: (6.04839%)&lt;BR/&gt; 32774: (3.22581%)&lt;BR/&gt; 57129: (2.01613%)&gt;];
}
1236--2115[label="0.047619;1pkt 1fpkt"];
1236--3049[label="0.05;1pkt 1fpkt"];
1236--3263[label="0.015873;1pkt 1fpkt"];
1236--3264[label="0.174603;11pkt 11fpkt"];
1236--3310[label="0.015873;1pkt 1fpkt"];
1236--3313[label="0.031746;2pkt 2fpkt"];
1236--3318[label="0.015873;1pkt 1fpkt"];
1236--3319[label="0.174603;11pkt 11fpkt"];
1236--3336[label="0.015873;1pkt 1fpkt"];
1236--3339[label="0.031746;2pkt 2fpkt"];
1236--3343[label="0.015873;1pkt 1fpkt"];
1236--3344[label="0.174603;11pkt 11fpkt"];
1236--3346[label="0.015873;1pkt 1fpkt"];
1236--3349[label="0.031746;2pkt 2fpkt"];
1236--3405[label="0.025;1pkt 1fpkt"];
1236--3540[label="1;14pkt 14fpkt"];
1236--4015[label="0.333333;1pkt 1fpkt"];
1236--4348[label="1;13pkt 13fpkt"];
1236--4889[label="1;13pkt 13fpkt"];
2115--3048[label="0.333333;2pkt 2fpkt"];
2115--3049[label="1;20pkt 20fpkt"];
3540--4348[label="1;13pkt 13fpkt"];
3540--4889[label="1;13pkt 13fpkt"];
4348--4889[label="1;13pkt 13fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="3.106.25.143"/>
      <filter dst_ip="136.171.172.82" src_port="80"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.581881,1.25082,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_298{
style=filled;
color=gray75;
2021[label="151.125.158.3;d;145pkt 145fpkt", shape=diamond, color=yellow];
2116[label="3.106.25.75;s;25pkt 25fpkt", shape=diamond, color=yellow];
4109[label="218.114.208.210;4pkt 4fpkt", shape=pentagon, color=darkviolet];
stat298[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 151.125.158.3:80}[85.119%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.4253%)&lt;BR/&gt; 64314: (0.574713%)&lt;BR/&gt; 63586: (0.574713%)&lt;BR/&gt; 61505: (0.574713%)&lt;BR/&gt; 59928: (0.574713%)&gt;];
}
2021--2116[label="0.2;5pkt 5fpkt"];
2021--2283[label="0.102941;7pkt 7fpkt"];
2021--2352[label="0.0625;3pkt 3fpkt"];
2021--2353[label="0.05;3pkt 3fpkt"];
2021--2356[label="0.046875;3pkt 3fpkt"];
2021--2359[label="0.0508475;3pkt 3fpkt"];
2021--2360[label="0.0588235;3pkt 3fpkt"];
2021--2368[label="0.0243902;1pkt 1fpkt"];
2021--2404[label="0.108108;8pkt 8fpkt"];
2021--2408[label="0.0441176;3pkt 3fpkt"];
2021--2428[label="0.0192308;1pkt 1fpkt"];
2021--2437[label="0.0576923;3pkt 3fpkt"];
2021--2445[label="0.0357143;2pkt 2fpkt"];
2021--3103[label="0.0666667;3pkt 3fpkt"];
2021--3133[label="0.108108;8pkt 8fpkt"];
2021--3137[label="0.0441176;3pkt 3fpkt"];
2021--3419[label="0.0212766;1pkt 1fpkt"];
2021--3638[label="0.0571429;4pkt 4fpkt"];
2021--3759[label="0.097561;8pkt 8fpkt"];
2021--3947[label="0.102941;7pkt 7fpkt"];
2021--3972[label="0.181818;2pkt 2fpkt"];
2021--4109[label="0.25;1pkt 1fpkt"];
2021--4159[label="0.333333;1pkt 1fpkt"];
2021--4411[label="0.0571429;4pkt 4fpkt"];
2116--3014[label="0.48;12pkt 12fpkt"];
</description>
    <slice>
      <filter dst_ip="151.125.158.3" dst_port="80"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="151.125.172.157"/>
      <from sec="1091941201" usec="0"/>
      <to sec="1091942028" usec="0"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_301{
style=filled;
color=gray75;
2124[label="174.104.82.63;s;90pkt 90fpkt", shape=diamond, color=yellow];
stat301[shape=component, label=&lt;Rules:&lt;BR/&gt;{174.104.82.63:25, 118.154.8.75:*}[28.8889%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (49.4444%)&lt;BR/&gt; 62608: (0.555556%)&lt;BR/&gt; 58270: (0.555556%)&lt;BR/&gt; 57345: (0.555556%)&lt;BR/&gt; 56970: (0.555556%)&gt;];
}
2124--3030[label="0.0111111;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="118.154.8.75" src_ip="174.104.82.63" src_port="25"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="209.3.32.58"/>
      <from sec="1091941201" usec="0"/>
      <to sec="1091941771" usec="0"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091941771" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.825684,1.24043,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_303{
style=filled;
color=gray75;
1755[label="151.125.37.143;s;6pkt 6fpkt", shape=diamond, color=yellow];
1940[label="214.93.191.44;d;1pkt 1fpkt", shape=diamond, color=yellow];
2138[label="82.0.110.223;d;2pkt 2fpkt", shape=diamond, color=yellow];
3870[label="151.125.37.143;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4570[label="151.125.37.143;2pkt 2fpkt", shape=invtriangle, color=brown];
5023[label="151.125.37.143;2pkt 2fpkt", shape=invhouse, color=bisque];
stat303[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.125.37.143:4000, *:8000}[33.3333%]&lt;BR/&gt;{151.125.37.143:*, 82.0.110.223:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 22506: (16.6667%)&lt;BR/&gt; 8020: (16.6667%)&lt;BR/&gt; 6970: (16.6667%)&lt;BR/&gt; 4293: (16.6667%)&lt;BR/&gt; 8000: (6.66667%)&gt;];
}
1755--1940[label="1;1pkt 1fpkt"];
1755--2138[label="1;2pkt 2fpkt"];
1755--3870[label="1;2pkt 2fpkt"];
1755--4570[label="1;2pkt 2fpkt"];
1755--5023[label="1;2pkt 2fpkt"];
1940--3870[label="1;1pkt 1fpkt"];
1940--4570[label="1;1pkt 1fpkt"];
1940--5023[label="1;1pkt 1fpkt"];
2138--3870[label="0.5;1pkt 1fpkt"];
2138--4570[label="0.5;1pkt 1fpkt"];
2138--5023[label="0.5;1pkt 1fpkt"];
3870--4570[label="1;2pkt 2fpkt"];
3870--5023[label="1;2pkt 2fpkt"];
4570--5023[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="82.0.110.223" src_ip="151.125.37.143"/>
      <filter dst_port="8000" src_ip="151.125.37.143" src_port="4000"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="141.7.83.44"/>
      <from sec="1091941201" usec="0"/>
      <to sec="1091942029" usec="0"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_305{
style=filled;
color=gray75;
2148[label="204.40.44.34;s;578pkt 578fpkt", shape=diamond, color=yellow];
stat305[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.40.44.34:0, *:0}[99.827%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.827%)&lt;BR/&gt; 3522: (0.0865052%)&lt;BR/&gt; 445: (0.0865052%)&gt;];
}
2148--2892[label="0.00431034;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="204.40.44.34"/>
    </slice>
    <from sec="1091941202" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="214.88.67.181"/>
      <from sec="1091941202" usec="0"/>
      <to sec="1091941964" usec="0"/>
    </slice>
    <from sec="1091941202" usec="0"/>
    <to sec="1091941964" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_308{
style=filled;
color=gray75;
2168[label="0.65.24.198;s;616pkt 616fpkt", shape=diamond, color=yellow];
stat308[shape=component, label=&lt;Rules:&lt;BR/&gt;{0.65.24.198:*, *:135}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 1939: (0.243506%)&lt;BR/&gt; 1582: (0.243506%)&lt;BR/&gt; 4843: (0.162338%)&lt;BR/&gt; 4504: (0.162338%)&gt;];
}
2168--3265[label="0.0113636;7pkt 7fpkt"];
2168--3320[label="0.0113636;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="0.65.24.198"/>
    </slice>
    <from sec="1091941215" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.74076,1.19023,503,1 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_309{
style=filled;
color=gray75;
4[label="211.103.66.40s;1pkt 1fpkt", shape=rectangle, color=red];
1966[label="141.26.174.188;s;177pkt 177fpkt", shape=diamond, color=yellow];
2080[label="192.193.35.10;d;135pkt 135fpkt", shape=diamond, color=yellow];
2177[label="136.171.162.40;s;182pkt 182fpkt", shape=diamond, color=yellow];
3498[label="136.171.162.40;189pkt 189fpkt", shape=pentagon, color=darkviolet];
4041[label="141.26.174.188;177pkt 177fpkt", shape=pentagon, color=darkviolet];
4322[label="136.171.162.40;189pkt 189fpkt", shape=invtriangle, color=brown];
stat309[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.26.174.188:444, *:*}[26.1845%]&lt;BR/&gt;{136.171.162.40:*, 192.193.35.10:80}[25.9352%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (38.381%)&lt;BR/&gt; 444: (10%)&lt;BR/&gt; 443: (0.571429%)&lt;BR/&gt; 1863: (0.428571%)&lt;BR/&gt; 15268: (0.285714%)&gt;];
}
4--2080[label="1;1pkt 1fpkt"];
4--2177[label="1;1pkt 1fpkt"];
4--3498[label="1;1pkt 1fpkt"];
4--4322[label="1;1pkt 1fpkt"];
1966--2080[label="0.0222222;3pkt 3fpkt"];
1966--4041[label="1;177pkt 177fpkt"];
2080--2177[label="0.718519;97pkt 97fpkt"];
2080--2918[label="0.972222;35pkt 35fpkt"];
2080--2919[label="1;29pkt 29fpkt"];
2080--3401[label="0.921053;35pkt 35fpkt"];
2080--3498[label="0.718519;97pkt 97fpkt"];
2080--4041[label="0.0222222;3pkt 3fpkt"];
2080--4254[label="0.921053;35pkt 35fpkt"];
2080--4322[label="0.718519;97pkt 97fpkt"];
2177--3498[label="1;182pkt 182fpkt"];
2177--4322[label="1;182pkt 182fpkt"];
3498--4322[label="1;189pkt 189fpkt"];
</description>
    <slice>
      <filter src_ip="141.26.174.188" src_port="444"/>
      <filter dst_ip="192.193.35.10" dst_port="80" src_ip="136.171.162.40"/>
    </slice>
    <from sec="1091941204" usec="0"/>
    <to sec="1091942090" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_312{
style=filled;
color=gray75;
2122[label="136.171.73.37;s;8pkt 8fpkt", shape=diamond, color=yellow];
2222[label="220.243.255.188;d;1pkt 1fpkt", shape=diamond, color=yellow];
3061[label="136.171.73.37;s;8pkt 8fpkt", shape=hexagon, color=black];
stat312[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.171.73.37:*, 202.70.188.102:1863}[75%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1863: (41.1765%)&lt;BR/&gt; 62081: (8.82353%)&lt;BR/&gt; 80: (8.82353%)&lt;BR/&gt; 62299: (5.88235%)&lt;BR/&gt; 62290: (5.88235%)&gt;];
}
2122--2222[label="1;1pkt 1fpkt"];
2122--3061[label="1;8pkt 8fpkt"];
2222--3061[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="202.70.188.102" dst_port="1863" src_ip="136.171.73.37"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="204.40.45.43"/>
      <from sec="1091941201" usec="0"/>
      <to sec="1091942028" usec="0"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="204.40.43.85"/>
      <from sec="1091941203" usec="0"/>
      <to sec="1091942022" usec="0"/>
    </slice>
    <from sec="1091941203" usec="0"/>
    <to sec="1091942022" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,053,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="215.144.37.81"/>
      <from sec="1091941209" usec="0"/>
      <to sec="1091942029" usec="0"/>
    </slice>
    <from sec="1091941209" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="192.146.202.176"/>
      <from sec="1091941360" usec="0"/>
      <to sec="1091942028" usec="0"/>
    </slice>
    <from sec="1091941360" usec="0"/>
    <to sec="1091942028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_319{
style=filled;
color=gray75;
2234[label="168.115.155.89;d;4pkt 4fpkt", shape=diamond, color=yellow];
2310[label="118.245.147.90;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat319[shape=component, label=&lt;Rules:&lt;BR/&gt;{6.61.117.61:44706, 168.115.155.89:80}[25%]&lt;BR/&gt;{118.245.147.90:3467, 168.115.155.89:80}[25%]&lt;BR/&gt;{206.70.182.68:1271, 168.115.155.89:80}[25%]&lt;BR/&gt;{206.70.182.68:1283, 168.115.155.89:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3467: (20%)&lt;BR/&gt; 44706: (10%)&lt;BR/&gt; 1283: (10%)&lt;BR/&gt; 1271: (10%)&gt;];
}
2234--2310[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="168.115.155.89" dst_port="80" src_ip="206.70.182.68" src_port="1283"/>
      <filter dst_ip="168.115.155.89" dst_port="80" src_ip="206.70.182.68" src_port="1271"/>
      <filter dst_ip="168.115.155.89" dst_port="80" src_ip="118.245.147.90" src_port="3467"/>
      <filter dst_ip="168.115.155.89" dst_port="80" src_ip="6.61.117.61" src_port="44706"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="5.225.155.189"/>
      <from sec="1091941201" usec="0"/>
      <to sec="1091942029" usec="0"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="168.115.209.34"/>
      <from sec="1091941201" usec="0"/>
      <to sec="1091942029" usec="0"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="168.115.209.34"/>
      <from sec="1091941201" usec="0"/>
      <to sec="1091942029" usec="0"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_326{
style=filled;
color=gray75;
2296[label="168.115.200.149;s;93pkt 93fpkt", shape=diamond, color=yellow];
2365[label="5.249.131.93;d;84pkt 84fpkt", shape=diamond, color=yellow];
stat326[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.115.200.149:*, 5.249.131.93:6667}[90.3226%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (47.4576%)&lt;BR/&gt; 21: (2.25989%)&lt;BR/&gt; 1027: (0.847458%)&lt;BR/&gt; 1124: (0.564972%)&lt;BR/&gt; 1123: (0.564972%)&gt;];
}
2296--2365[label="1;84pkt 84fpkt"];
</description>
    <slice>
      <filter dst_ip="5.249.131.93" dst_port="6667" src_ip="168.115.200.149"/>
    </slice>
    <from sec="1091941415" usec="0"/>
    <to sec="1091942028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="17.151.169.235"/>
      <from sec="1091941508" usec="0"/>
      <to sec="1091942028" usec="0"/>
    </slice>
    <from sec="1091941508" usec="0"/>
    <to sec="1091942028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.825684,1.24043,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_328{
style=filled;
color=gray75;
1479[label="205.248.185.116;d;2116pkt 2116fpkt", shape=diamond, color=yellow];
2447[label="68.56.82.225;s;34pkt 34fpkt", shape=diamond, color=yellow];
2489[label="0.245.67.10;s;1pkt 1fpkt", shape=diamond, color=yellow];
3399[label="202.70.32.14;7pkt 7fpkt", shape=pentagon, color=darkviolet];
3562[label="2.85.40.60;12pkt 12fpkt", shape=pentagon, color=darkviolet];
3778[label="204.51.38.115;13pkt 13fpkt", shape=pentagon, color=darkviolet];
3826[label="216.92.216.129;4pkt 4fpkt", shape=pentagon, color=darkviolet];
3855[label="202.70.42.138;3pkt 3fpkt", shape=pentagon, color=darkviolet];
3864[label="203.24.34.141;5pkt 5fpkt", shape=pentagon, color=darkviolet];
3875[label="3.31.244.144;27pkt 27fpkt", shape=pentagon, color=darkviolet];
3904[label="202.70.35.154;4pkt 4fpkt", shape=pentagon, color=darkviolet];
3930[label="5.249.171.160;2pkt 2fpkt", shape=pentagon, color=darkviolet];
3976[label="0.162.155.172;29pkt 29fpkt", shape=pentagon, color=darkviolet];
4001[label="5.130.197.176;9pkt 9fpkt", shape=pentagon, color=darkviolet];
4068[label="204.51.33.198;20pkt 20fpkt", shape=pentagon, color=darkviolet];
4144[label="68.56.82.225;38pkt 38fpkt", shape=pentagon, color=darkviolet];
4189[label="0.130.150.240;18pkt 18fpkt", shape=pentagon, color=darkviolet];
4253[label="202.70.32.14;7pkt 7fpkt", shape=invtriangle, color=brown];
4362[label="2.85.40.60;13pkt 13fpkt", shape=invtriangle, color=brown];
4542[label="216.92.216.129;4pkt 4fpkt", shape=invtriangle, color=brown];
4561[label="202.70.42.138;3pkt 3fpkt", shape=invtriangle, color=brown];
4609[label="5.249.171.160;2pkt 2fpkt", shape=invtriangle, color=brown];
4760[label="68.56.82.225;38pkt 38fpkt", shape=invtriangle, color=brown];
5007[label="216.92.216.129;4pkt 4fpkt", shape=invhouse, color=bisque];
5017[label="202.70.42.138;3pkt 3fpkt", shape=invhouse, color=bisque];
5049[label="5.249.171.160;2pkt 2fpkt", shape=invhouse, color=bisque];
stat328[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 205.248.185.116:*}[97.2553%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.6898%)&lt;BR/&gt; 443: (0.165426%)&lt;BR/&gt; 0: (0.165426%)&lt;BR/&gt; 1129: (0.103391%)&lt;BR/&gt; 1128: (0.103391%)&gt;];
}
1479--1525[label="0.120459;63pkt 63fpkt"];
1479--1545[label="0.5;43pkt 43fpkt"];
1479--1770[label="0.06;3pkt 3fpkt"];
1479--1962[label="0.125;1pkt 1fpkt"];
1479--1984[label="0.25;1pkt 1fpkt"];
1479--2013[label="1;1pkt 1fpkt"];
1479--2083[label="0.0105263;1pkt 1fpkt"];
1479--2086[label="1;73pkt 73fpkt"];
1479--2090[label="1;2pkt 2fpkt"];
1479--2119[label="0.00141777;3pkt 3fpkt"];
1479--2178[label="0.00671141;1pkt 1fpkt"];
1479--2257[label="0.0169492;1pkt 1fpkt"];
1479--2274[label="0.027027;2pkt 2fpkt"];
1479--2276[label="0.0243902;1pkt 1fpkt"];
1479--2277[label="1;6pkt 6fpkt"];
1479--2302[label="1;21pkt 21fpkt"];
1479--2364[label="1;1pkt 1fpkt"];
1479--2375[label="0.823529;14pkt 14fpkt"];
1479--2439[label="0.0176991;2pkt 2fpkt"];
1479--2441[label="1;25pkt 25fpkt"];
1479--2447[label="0.764706;26pkt 26fpkt"];
1479--2454[label="1;13pkt 13fpkt"];
1479--2456[label="1;1pkt 1fpkt"];
1479--2489[label="1;1pkt 1fpkt"];
1479--2588[label="0.105263;44pkt 44fpkt"];
1479--2678[label="0.595745;28pkt 28fpkt"];
1479--2902[label="0.125;1pkt 1fpkt"];
1479--2979[label="0.0119048;1pkt 1fpkt"];
1479--3050[label="0.00141777;3pkt 3fpkt"];
1479--3111[label="0.00671141;1pkt 1fpkt"];
1479--3112[label="1;63pkt 63fpkt"];
1479--3113[label="1;1pkt 1fpkt"];
1479--3116[label="0.75;9pkt 9fpkt"];
1479--3264[label="0.0869565;184pkt 184fpkt"];
1479--3311[label="0.0628544;133pkt 133fpkt"];
1479--3319[label="0.0869565;184pkt 184fpkt"];
1479--3337[label="0.0628544;133pkt 133fpkt"];
1479--3344[label="0.0869565;184pkt 184fpkt"];
1479--3347[label="0.0628544;133pkt 133fpkt"];
1479--3380[label="1;2pkt 2fpkt"];
1479--3399[label="0.142857;1pkt 1fpkt"];
1479--3404[label="0.0612245;3pkt 3fpkt"];
1479--3467[label="1;2pkt 2fpkt"];
1479--3533[label="0.666667;4pkt 4fpkt"];
1479--3559[label="0.444444;4pkt 4fpkt"];
1479--3562[label="0.833333;10pkt 10fpkt"];
1479--3622[label="0.46;23pkt 23fpkt"];
1479--3642[label="0.0384615;1pkt 1fpkt"];
1479--3645[label="0.6;24pkt 24fpkt"];
1479--3681[label="1;18pkt 18fpkt"];
1479--3776[label="1;2pkt 2fpkt"];
1479--3778[label="0.384615;5pkt 5fpkt"];
1479--3785[label="0.0238095;1pkt 1fpkt"];
1479--3792[label="0.00666667;1pkt 1fpkt"];
1479--3821[label="1;1pkt 1fpkt"];
1479--3826[label="1;4pkt 4fpkt"];
1479--3855[label="0.333333;1pkt 1fpkt"];
1479--3864[label="0.2;1pkt 1fpkt"];
1479--3875[label="0.111111;3pkt 3fpkt"];
1479--3904[label="0.25;1pkt 1fpkt"];
1479--3930[label="1;2pkt 2fpkt"];
1479--3932[label="0.125;1pkt 1fpkt"];
1479--3943[label="1;4pkt 4fpkt"];
1479--3976[label="0.965517;28pkt 28fpkt"];
1479--3982[label="1;16pkt 16fpkt"];
1479--3996[label="1;4pkt 4fpkt"];
1479--4001[label="0.333333;3pkt 3fpkt"];
1479--4029[label="0.462366;43pkt 43fpkt"];
1479--4034[label="0.0169492;1pkt 1fpkt"];
1479--4068[label="0.9;18pkt 18fpkt"];
1479--4078[label="0.326531;16pkt 16fpkt"];
1479--4079[label="0.95;19pkt 19fpkt"];
1479--4089[label="0.0625;1pkt 1fpkt"];
1479--4131[label="0.0769231;1pkt 1fpkt"];
1479--4144[label="0.684211;26pkt 26fpkt"];
1479--4189[label="1;18pkt 18fpkt"];
1479--4253[label="0.142857;1pkt 1fpkt"];
1479--4255[label="0.0612245;3pkt 3fpkt"];
1479--4362[label="0.846154;11pkt 11fpkt"];
1479--4504[label="1;2pkt 2fpkt"];
1479--4537[label="1;1pkt 1fpkt"];
1479--4542[label="1;4pkt 4fpkt"];
1479--4561[label="0.333333;1pkt 1fpkt"];
1479--4609[label="1;2pkt 2fpkt"];
1479--4649[label="1;16pkt 16fpkt"];
1479--4715[label="0.326531;16pkt 16fpkt"];
1479--4760[label="0.684211;26pkt 26fpkt"];
1479--4833[label="0.0612245;3pkt 3fpkt"];
1479--5007[label="1;4pkt 4fpkt"];
1479--5017[label="0.333333;1pkt 1fpkt"];
1479--5049[label="1;2pkt 2fpkt"];
1479--5120[label="0.326531;16pkt 16fpkt"];
2447--3311[label="0.0294118;1pkt 1fpkt"];
2447--3337[label="0.0294118;1pkt 1fpkt"];
2447--3347[label="0.0294118;1pkt 1fpkt"];
2447--4144[label="1;34pkt 34fpkt"];
2447--4760[label="1;34pkt 34fpkt"];
3399--4253[label="1;7pkt 7fpkt"];
3562--4362[label="1;12pkt 12fpkt"];
3826--4542[label="1;4pkt 4fpkt"];
3826--5007[label="1;4pkt 4fpkt"];
3855--4561[label="1;3pkt 3fpkt"];
3855--5017[label="1;3pkt 3fpkt"];
3930--4609[label="1;2pkt 2fpkt"];
3930--5049[label="1;2pkt 2fpkt"];
4144--4760[label="1;38pkt 38fpkt"];
4542--5007[label="1;4pkt 4fpkt"];
4561--5017[label="1;3pkt 3fpkt"];
4609--5049[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="205.248.185.116" src_port="80"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.791181,1.33399,503,0 0 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_329{
style=filled;
color=gray75;
870[label="214.51.17.204s;38pkt 38fpkt", shape=triangle, color=blue];
2383[label="151.125.173.204;s;298pkt 298fpkt", shape=diamond, color=yellow];
2475[label="5.202.11.101;d;78pkt 78fpkt", shape=diamond, color=yellow];
2478[label="213.181.131.89;d;202pkt 202fpkt", shape=diamond, color=yellow];
stat329[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.125.173.204:*, 213.181.131.89:80}[67%]&lt;BR/&gt;{151.125.173.204:*, 5.202.11.101:80}[25.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.8377%)&lt;BR/&gt; 2082: (0.243506%)&lt;BR/&gt; 2081: (0.243506%)&lt;BR/&gt; 2080: (0.243506%)&lt;BR/&gt; 2079: (0.243506%)&gt;];
}
870--2383[label="1;38pkt 38fpkt"];
870--2475[label="1;38pkt 38fpkt"];
2383--2475[label="0.987179;77pkt 77fpkt"];
2383--2478[label="0.99505;201pkt 201fpkt"];
2475--3844[label="0.0128205;1pkt 1fpkt"];
2475--4555[label="0.0128205;1pkt 1fpkt"];
2478--3083[label="0.00588235;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="213.181.131.89" dst_port="80" src_ip="151.125.173.204"/>
      <filter dst_ip="5.202.11.101" dst_port="80" src_ip="151.125.173.204"/>
    </slice>
    <from sec="1091941806" usec="0"/>
    <to sec="1091942028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_330{
style=filled;
color=gray75;
2385[label="209.27.9.193;s;1pkt 1fpkt", shape=diamond, color=yellow];
2386[label="205.242.18.212;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat330[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.27.9.193:14411, 205.242.18.212:3641}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 14411: (50%)&lt;BR/&gt; 3641: (50%)&gt;];
}
2385--2386[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="205.242.18.212" dst_port="3641" src_ip="209.27.9.193" src_port="14411"/>
    </slice>
    <from sec="1091941810" usec="0"/>
    <to sec="1091941939" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="151.125.172.157"/>
      <from sec="1091941201" usec="0"/>
      <to sec="1091942028" usec="0"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="81.214.223.176"/>
      <from sec="1091941201" usec="0"/>
      <to sec="1091942027" usec="0"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="219.237.75.109"/>
      <from sec="1091941201" usec="0"/>
      <to sec="1091942029" usec="0"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_339{
style=filled;
color=gray75;
2431[label="139.72.138.146;d;77pkt 77fpkt", shape=diamond, color=yellow];
2432[label="151.125.61.32;s;77pkt 77fpkt", shape=diamond, color=yellow];
stat339[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.125.61.32:*, 139.72.138.146:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 42593: (0.649351%)&lt;BR/&gt; 42574: (0.649351%)&lt;BR/&gt; 42551: (0.649351%)&lt;BR/&gt; 42532: (0.649351%)&gt;];
}
2431--2432[label="1;77pkt 77fpkt"];
</description>
    <slice>
      <filter dst_ip="139.72.138.146" dst_port="80" src_ip="151.125.61.32"/>
    </slice>
    <from sec="1091941205" usec="0"/>
    <to sec="1091942021" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="206.80.100.34"/>
      <from sec="1091941551" usec="0"/>
      <to sec="1091942027" usec="0"/>
    </slice>
    <from sec="1091941551" usec="0"/>
    <to sec="1091942027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="206.71.68.59"/>
      <from sec="1091941614" usec="0"/>
      <to sec="1091942029" usec="0"/>
    </slice>
    <from sec="1091941614" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="136.171.33.88"/>
      <from sec="1091941812" usec="0"/>
      <to sec="1091942029" usec="0"/>
    </slice>
    <from sec="1091941812" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,504,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="216.119.102.229"/>
      <from sec="1091941950" usec="0"/>
      <to sec="1091942029" usec="0"/>
    </slice>
    <from sec="1091941950" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="214.8.200.248"/>
      <from sec="1091941982" usec="0"/>
      <to sec="1091942029" usec="0"/>
    </slice>
    <from sec="1091941982" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="204.89.70.206"/>
      <from sec="1091941989" usec="0"/>
      <to sec="1091942029" usec="0"/>
    </slice>
    <from sec="1091941989" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_346{
style=filled;
color=gray75;
2477[label="136.171.246.25;s;15pkt 15fpkt", shape=diamond, color=yellow];
2504[label="200.246.243.2;d;15pkt 15fpkt", shape=diamond, color=yellow];
stat346[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.171.246.25:*, 200.246.243.2:8081}[86.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8081: (43.3333%)&lt;BR/&gt; 80: (6.66667%)&lt;BR/&gt; 1168: (3.33333%)&lt;BR/&gt; 1167: (3.33333%)&lt;BR/&gt; 1166: (3.33333%)&gt;];
}
2477--2504[label="1;15pkt 15fpkt"];
</description>
    <slice>
      <filter dst_ip="200.246.243.2" dst_port="8081" src_ip="136.171.246.25"/>
    </slice>
    <from sec="1091941909" usec="0"/>
    <to sec="1091942021" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,001,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_347{
style=filled;
color=gray75;
1183[label="210.230.0.212;d;238pkt 238fpkt", shape=diamond, color=yellow];
2513[label="210.230.0.212;d;238pkt 238fpkt", shape=hexagon, color=black];
stat347[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:9898, 210.230.0.212:*}[41.1765%]&lt;BR/&gt;{*:1023, 210.230.0.212:*}[29.4118%]&lt;BR/&gt;{*:5554, 210.230.0.212:*}[23.1092%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (20.5882%)&lt;BR/&gt; 1023: (14.7059%)&lt;BR/&gt; 5554: (11.5546%)&lt;BR/&gt; 0: (4.62185%)&lt;BR/&gt; 8967: (0.840336%)&gt;];
}
1183--2003[label="0.00840336;1pkt 1fpkt"];
1183--2513[label="1;238pkt 238fpkt"];
</description>
    <slice>
      <filter dst_ip="210.230.0.212" src_port="9898"/>
      <filter dst_ip="210.230.0.212" src_port="1023"/>
      <filter dst_ip="210.230.0.212" src_port="5554"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091941275" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_350{
style=filled;
color=gray75;
1342[label="141.158.233.51;s;120pkt 120fpkt", shape=diamond, color=yellow];
stat350[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.158.233.51:80, 2.41.37.63:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4997: (0.416667%)&lt;BR/&gt; 4992: (0.416667%)&lt;BR/&gt; 4947: (0.416667%)&lt;BR/&gt; 4896: (0.416667%)&gt;];
}
1342--1343[label="1;120pkt 120fpkt"];
1342--2541[label="1;120pkt 120fpkt"];
1342--3264[label="0.416667;50pkt 50fpkt"];
1342--3319[label="0.416667;50pkt 50fpkt"];
1342--3344[label="0.416667;50pkt 50fpkt"];
</description>
    <slice>
      <filter dst_ip="2.41.37.63" src_ip="141.158.233.51" src_port="80"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091941389" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,010,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_354{
style=filled;
color=gray75;
1518[label="118.91.211.64;s;320pkt 320fpkt", shape=diamond, color=yellow];
2585[label="118.91.211.64;s;320pkt 320fpkt", shape=hexagon, color=black];
stat354[shape=component, label=&lt;Rules:&lt;BR/&gt;{118.91.211.64:*, *:445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (50%)&lt;BR/&gt; 4431: (0.3125%)&lt;BR/&gt; 4242: (0.3125%)&lt;BR/&gt; 3658: (0.3125%)&lt;BR/&gt; 3657: (0.3125%)&gt;];
}
1518--2585[label="1;320pkt 320fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="118.91.211.64"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091941390" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,010,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_355{
style=filled;
color=gray75;
1520[label="137.95.23.5;s;297pkt 297fpkt", shape=diamond, color=yellow];
2586[label="137.95.23.5;s;297pkt 297fpkt", shape=hexagon, color=black];
stat355[shape=component, label=&lt;Rules:&lt;BR/&gt;{137.95.23.5:*, *:445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (50%)&lt;BR/&gt; 1139: (0.505051%)&lt;BR/&gt; 4917: (0.3367%)&lt;BR/&gt; 3705: (0.3367%)&lt;BR/&gt; 3492: (0.3367%)&gt;];
}
1520--2586[label="1;297pkt 297fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="137.95.23.5"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091941380" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.711294,1.2256,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_356{
style=filled;
color=gray75;
1536[label="136.171.114.231;d;230pkt 230fpkt", shape=diamond, color=yellow];
2410[label="136.171.69.185;d;69pkt 69fpkt", shape=diamond, color=yellow];
2591[label="136.171.114.231;d;230pkt 230fpkt", shape=hexagon, color=black];
4104[label="1.88.168.207;16pkt 16fpkt", shape=pentagon, color=darkviolet];
stat356[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:25, 136.171.114.231:*}[37.0607%]&lt;BR/&gt;{*:*, 136.171.114.231:25}[34.1853%]&lt;BR/&gt;{*:*, 136.171.69.185:*}[22.0447%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (48.4404%)&lt;BR/&gt; 0: (1.10092%)&lt;BR/&gt; 113: (1.00917%)&lt;BR/&gt; 55397: (0.366972%)&lt;BR/&gt; 54828: (0.366972%)&gt;];
}
1536--2591[label="1;230pkt 230fpkt"];
1536--4104[label="0.0625;1pkt 1fpkt"];
2410--4104[label="0.0625;1pkt 1fpkt"];
2591--4104[label="0.0625;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="136.171.69.185"/>
      <filter dst_ip="136.171.114.231" src_port="25"/>
      <filter dst_ip="136.171.114.231" dst_port="25"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942077" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.711294,1.2256,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_357{
style=filled;
color=gray75;
1356[label="151.125.174.55;d;2pkt 2fpkt", shape=diamond, color=yellow];
1359[label="202.70.188.21;s;1pkt 1fpkt", shape=diamond, color=yellow];
2592[label="202.70.188.21;s;1pkt 1fpkt", shape=hexagon, color=black];
3430[label="202.70.188.21;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat357[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.70.188.21:1863, 151.125.174.55:2512}[50%]&lt;BR/&gt;{202.70.187.37:1863, 151.125.174.55:2504}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1863: (50%)&lt;BR/&gt; 2512: (40%)&lt;BR/&gt; 2504: (10%)&gt;];
}
1356--1359[label="1;1pkt 1fpkt"];
1356--2592[label="1;1pkt 1fpkt"];
1356--3430[label="1;1pkt 1fpkt"];
1359--2592[label="1;1pkt 1fpkt"];
1359--3430[label="1;1pkt 1fpkt"];
2592--3430[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="151.125.174.55" dst_port="2504" src_ip="202.70.187.37" src_port="1863"/>
      <filter dst_ip="151.125.174.55" dst_port="2512" src_ip="202.70.188.21" src_port="1863"/>
    </slice>
    <from sec="1091941202" usec="0"/>
    <to sec="1091942100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724955,1.37547,503,0 0 0 0 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_358{
style=filled;
color=gray75;
2548[label="2.41.99.108;s;21pkt 21fpkt", shape=hexagon, color=black];
2596[label="174.104.236.193;d;21pkt 21fpkt", shape=hexagon, color=black];
stat358[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.41.99.108:80, 174.104.236.193:*}[82.6087%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4726: (2.38095%)&lt;BR/&gt; 4725: (2.38095%)&lt;BR/&gt; 4724: (2.38095%)&lt;BR/&gt; 4723: (2.38095%)&gt;];
}
2548--2596[label="0.904762;19pkt 19fpkt"];
2596--3622[label="0.047619;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="174.104.236.193" src_ip="2.41.99.108" src_port="80"/>
    </slice>
    <from sec="1091941249" usec="0"/>
    <to sec="1091941289" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_363{
style=filled;
color=gray75;
1269[label="136.171.247.1;d;170pkt 170fpkt", shape=diamond, color=yellow];
1271[label="213.22.174.146;s;163pkt 163fpkt", shape=diamond, color=yellow];
2638[label="136.171.247.1;d;112pkt 112fpkt", shape=hexagon, color=black];
2639[label="213.22.174.146;s;84pkt 84fpkt", shape=hexagon, color=black];
stat363[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.22.174.146:*, 136.171.247.1:25}[95.2941%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (48.8658%)&lt;BR/&gt; 80: (0.94518%)&lt;BR/&gt; 64599: (0.378072%)&lt;BR/&gt; 35176: (0.378072%)&lt;BR/&gt; 35170: (0.378072%)&gt;];
}
1269--1271[label="1;163pkt 163fpkt"];
1269--1327[label="0.00588235;1pkt 1fpkt"];
1269--2638[label="1;112pkt 112fpkt"];
1269--2639[label="1;84pkt 84fpkt"];
1269--3077[label="0.00588235;1pkt 1fpkt"];
1271--2638[label="0.955357;107pkt 107fpkt"];
1271--2639[label="1;84pkt 84fpkt"];
2638--2639[label="1;84pkt 84fpkt"];
2638--3077[label="0.00892857;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="136.171.247.1" dst_port="25" src_ip="213.22.174.146"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_364{
style=filled;
color=gray75;
1277[label="204.40.40.133;s;802pkt 802fpkt", shape=diamond, color=yellow];
1784[label="2.229.65.22;d;136pkt 136fpkt", shape=diamond, color=yellow];
2412[label="220.166.200.168;d;1pkt 1fpkt", shape=diamond, color=yellow];
2417[label="220.242.115.164;d;1pkt 1fpkt", shape=diamond, color=yellow];
2642[label="204.40.40.133;s;298pkt 298fpkt", shape=hexagon, color=black];
2814[label="2.229.65.22;d;61pkt 61fpkt", shape=hexagon, color=black];
stat364[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.40.40.133:80, *:*}[30.2993%]&lt;BR/&gt;{204.40.40.133:2883, *:53}[30.1746%]&lt;BR/&gt;{204.40.40.133:25, *:*}[27.9302%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (19.6305%)&lt;BR/&gt; 53: (17.321%)&lt;BR/&gt; 2883: (13.087%)&lt;BR/&gt; 25: (12.5866%)&lt;BR/&gt; 0: (1.61663%)&gt;];
}
1277--1784[label="1;136pkt 136fpkt"];
1277--1964[label="0.0135135;1pkt 1fpkt"];
1277--2009[label="0.0140845;1pkt 1fpkt"];
1277--2152[label="0.0169492;1pkt 1fpkt"];
1277--2264[label="0.025;1pkt 1fpkt"];
1277--2412[label="1;1pkt 1fpkt"];
1277--2417[label="1;1pkt 1fpkt"];
1277--2424[label="0.0163934;1pkt 1fpkt"];
1277--2642[label="1;298pkt 298fpkt"];
1277--2814[label="1;61pkt 61fpkt"];
1277--2967[label="0.0181818;1pkt 1fpkt"];
1277--3099[label="0.027027;1pkt 1fpkt"];
1277--3263[label="0.00623441;5pkt 5fpkt"];
1277--3264[label="0.0162095;13pkt 13fpkt"];
1277--3310[label="0.00124688;1pkt 1fpkt"];
1277--3311[label="0.0199501;16pkt 16fpkt"];
1277--3313[label="0.00498753;4pkt 4fpkt"];
1277--3318[label="0.00623441;5pkt 5fpkt"];
1277--3319[label="0.0162095;13pkt 13fpkt"];
1277--3336[label="0.00124688;1pkt 1fpkt"];
1277--3337[label="0.0199501;16pkt 16fpkt"];
1277--3339[label="0.00498753;4pkt 4fpkt"];
1277--3343[label="0.00623441;5pkt 5fpkt"];
1277--3344[label="0.0162095;13pkt 13fpkt"];
1277--3346[label="0.00124688;1pkt 1fpkt"];
1277--3347[label="0.0199501;16pkt 16fpkt"];
1277--3349[label="0.00498753;4pkt 4fpkt"];
1784--2642[label="0.323529;44pkt 44fpkt"];
1784--2814[label="1;61pkt 61fpkt"];
1784--3264[label="0.0808824;11pkt 11fpkt"];
1784--3311[label="0.0514706;7pkt 7fpkt"];
1784--3319[label="0.0808824;11pkt 11fpkt"];
1784--3337[label="0.0514706;7pkt 7fpkt"];
1784--3344[label="0.0808824;11pkt 11fpkt"];
1784--3347[label="0.0514706;7pkt 7fpkt"];
2412--2642[label="1;1pkt 1fpkt"];
2417--2642[label="1;1pkt 1fpkt"];
2642--2814[label="0.721311;44pkt 44fpkt"];
2642--2967[label="0.0181818;1pkt 1fpkt"];
2642--3099[label="0.027027;1pkt 1fpkt"];
2642--3263[label="0.0167785;5pkt 5fpkt"];
2642--3264[label="0.0436242;13pkt 13fpkt"];
2642--3311[label="0.0033557;1pkt 1fpkt"];
2642--3318[label="0.0167785;5pkt 5fpkt"];
2642--3319[label="0.0436242;13pkt 13fpkt"];
2642--3337[label="0.0033557;1pkt 1fpkt"];
2642--3343[label="0.0167785;5pkt 5fpkt"];
2642--3344[label="0.0436242;13pkt 13fpkt"];
2642--3347[label="0.0033557;1pkt 1fpkt"];
2814--3264[label="0.180328;11pkt 11fpkt"];
2814--3311[label="0.0163934;1pkt 1fpkt"];
2814--3319[label="0.180328;11pkt 11fpkt"];
2814--3337[label="0.0163934;1pkt 1fpkt"];
2814--3344[label="0.180328;11pkt 11fpkt"];
2814--3347[label="0.0163934;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="204.40.40.133" src_port="80"/>
      <filter src_ip="204.40.40.133" src_port="25"/>
      <filter dst_port="53" src_ip="204.40.40.133" src_port="2883"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_366{
style=filled;
color=gray75;
1360[label="151.125.173.8;s;170pkt 170fpkt", shape=diamond, color=yellow];
1778[label="219.228.179.93;d;1pkt 1fpkt", shape=diamond, color=yellow];
2680[label="219.228.179.93;d;1pkt 1fpkt", shape=hexagon, color=black];
stat366[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.125.173.8:7065, *:*}[93.5294%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7065: (46.2209%)&lt;BR/&gt; 4662: (2.32558%)&lt;BR/&gt; 80: (1.16279%)&lt;BR/&gt; 1612: (0.872093%)&lt;BR/&gt; 10624: (0.581395%)&gt;];
}
1360--1778[label="1;1pkt 1fpkt"];
1360--2680[label="1;1pkt 1fpkt"];
1778--2680[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="151.125.173.8" src_port="7065"/>
    </slice>
    <from sec="1091941203" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.773242,1.19457,053,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_370{
style=filled;
color=gray75;
1182[label="174.104.46.121;s;33pkt 33fpkt", shape=diamond, color=yellow];
1480[label="193.158.194.88;d;1pkt 1fpkt", shape=diamond, color=yellow];
2741[label="193.158.194.88;d;1pkt 1fpkt", shape=hexagon, color=black];
3802[label="174.104.46.121;35pkt 35fpkt", shape=pentagon, color=darkviolet];
4522[label="174.104.46.121;35pkt 35fpkt", shape=invtriangle, color=brown];
stat370[shape=component, label=&lt;Rules:&lt;BR/&gt;{174.104.46.121:*, 198.161.214.25:80}[42.8571%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.1905%)&lt;BR/&gt; 4195: (2.38095%)&lt;BR/&gt; 1755: (2.38095%)&lt;BR/&gt; 5544: (1.42857%)&lt;BR/&gt; 1512: (1.42857%)&gt;];
}
1182--1480[label="1;1pkt 1fpkt"];
1182--2741[label="1;1pkt 1fpkt"];
1182--3802[label="1;33pkt 33fpkt"];
1182--4522[label="1;33pkt 33fpkt"];
1480--2741[label="1;1pkt 1fpkt"];
1480--3802[label="1;1pkt 1fpkt"];
1480--4522[label="1;1pkt 1fpkt"];
2741--3802[label="1;1pkt 1fpkt"];
2741--4522[label="1;1pkt 1fpkt"];
3802--4522[label="1;35pkt 35fpkt"];
</description>
    <slice>
      <filter dst_ip="198.161.214.25" dst_port="80" src_ip="174.104.46.121"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_372{
style=filled;
color=gray75;
1325[label="141.26.128.101;s;35pkt 35fpkt", shape=diamond, color=yellow];
stat372[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.26.128.101:*, 196.28.77.228:80}[42.8571%]&lt;BR/&gt;{141.26.128.101:*, 19.160.218.57:20}[22.8571%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (24.2857%)&lt;BR/&gt; 20: (14.2857%)&lt;BR/&gt; 21: (7.14286%)&lt;BR/&gt; 0: (2.85714%)&lt;BR/&gt; 17216: (1.42857%)&gt;];
}
1325--2948[label="0.666667;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="196.28.77.228" dst_port="80" src_ip="141.26.128.101"/>
      <filter dst_ip="19.160.218.57" dst_port="20" src_ip="141.26.128.101"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091941897" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_374{
style=filled;
color=gray75;
1707[label="136.171.172.82;s;79pkt 79fpkt", shape=diamond, color=yellow];
2753[label="136.171.172.82;s;64pkt 64fpkt", shape=hexagon, color=black];
stat374[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.171.172.82:*, *:80}[32.9114%]&lt;BR/&gt;{136.171.172.82:0, *:0}[31.6456%]&lt;BR/&gt;{136.171.172.82:*, *:53}[24.0506%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (29.3706%)&lt;BR/&gt; 80: (19.5804%)&lt;BR/&gt; 53: (14.3357%)&lt;BR/&gt; 57129: (5.94406%)&lt;BR/&gt; 32774: (5.94406%)&gt;];
}
1707--2753[label="1;64pkt 64fpkt"];
1707--3263[label="0.0126582;1pkt 1fpkt"];
1707--3318[label="0.0126582;1pkt 1fpkt"];
1707--3343[label="0.0126582;1pkt 1fpkt"];
2753--3263[label="0.015625;1pkt 1fpkt"];
2753--3318[label="0.015625;1pkt 1fpkt"];
2753--3343[label="0.015625;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="136.171.172.82"/>
      <filter dst_port="53" src_ip="136.171.172.82"/>
      <filter src_ip="136.171.172.82"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.773242,1.19457,010,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_375{
style=filled;
color=gray75;
1905[label="207.153.230.177;s;673pkt 673fpkt", shape=diamond, color=yellow];
2762[label="207.153.230.177;s;610pkt 610fpkt", shape=hexagon, color=black];
4004[label="207.153.230.177;732pkt 732fpkt", shape=pentagon, color=darkviolet];
4665[label="207.153.230.177;732pkt 732fpkt", shape=invtriangle, color=brown];
stat375[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.153.230.177:*, *:135}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 4664: (0.273025%)&lt;BR/&gt; 3530: (0.21842%)&lt;BR/&gt; 4603: (0.145613%)&lt;BR/&gt; 4351: (0.145613%)&gt;];
}
1905--2762[label="1;610pkt 610fpkt"];
1905--3265[label="0.0609212;41pkt 41fpkt"];
1905--3320[label="0.0609212;41pkt 41fpkt"];
1905--4004[label="1;673pkt 673fpkt"];
1905--4665[label="1;673pkt 673fpkt"];
2762--3265[label="0.0672131;41pkt 41fpkt"];
2762--3320[label="0.0672131;41pkt 41fpkt"];
2762--4004[label="1;610pkt 610fpkt"];
2762--4665[label="1;610pkt 610fpkt"];
4004--4665[label="1;732pkt 732fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="207.153.230.177"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_376{
style=filled;
color=gray75;
1727[label="141.26.98.60;d;40pkt 40fpkt", shape=diamond, color=yellow];
1730[label="139.30.170.245;s;3pkt 3fpkt", shape=diamond, color=yellow];
3005[label="139.30.170.245;s;3pkt 3fpkt", shape=hexagon, color=black];
stat376[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:53, 141.26.98.60:*}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (22.8261%)&lt;BR/&gt; 80: (14.1304%)&lt;BR/&gt; 22: (6.52174%)&lt;BR/&gt; 25: (4.34783%)&lt;BR/&gt; 0: (4.34783%)&gt;];
}
1727--1730[label="1;3pkt 3fpkt"];
1727--2151[label="0.037037;1pkt 1fpkt"];
1727--2153[label="0.025;1pkt 1fpkt"];
1727--2770[label="1;32pkt 32fpkt"];
1727--3005[label="1;3pkt 3fpkt"];
1727--3310[label="0.075;3pkt 3fpkt"];
1727--3311[label="0.025;1pkt 1fpkt"];
1727--3313[label="0.1;4pkt 4fpkt"];
1727--3336[label="0.075;3pkt 3fpkt"];
1727--3337[label="0.025;1pkt 1fpkt"];
1727--3339[label="0.1;4pkt 4fpkt"];
1727--3346[label="0.075;3pkt 3fpkt"];
1727--3347[label="0.025;1pkt 1fpkt"];
1727--3349[label="0.1;4pkt 4fpkt"];
1730--2770[label="1;3pkt 3fpkt"];
1730--3005[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="141.26.98.60" src_port="53"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_378{
style=filled;
color=gray75;
1916[label="141.158.211.38;s;7pkt 7fpkt", shape=diamond, color=yellow];
2130[label="213.98.178.174;d;2pkt 2fpkt", shape=diamond, color=yellow];
2773[label="141.158.211.38;s;7pkt 7fpkt", shape=hexagon, color=black];
stat378[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.158.211.38:*, 213.132.226.108:80}[37.5%]&lt;BR/&gt;{*:*, 213.98.178.174:*}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (37.5%)&lt;BR/&gt; 5100: (9.375%)&lt;BR/&gt; 3044: (9.375%)&lt;BR/&gt; 3074: (6.25%)&lt;BR/&gt; 3073: (6.25%)&gt;];
}
1916--2130[label="0.5;1pkt 1fpkt"];
1916--2773[label="1;7pkt 7fpkt"];
2130--2773[label="0.5;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="213.98.178.174"/>
      <filter dst_ip="213.132.226.108" dst_port="80" src_ip="141.158.211.38"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942004" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_379{
style=filled;
color=gray75;
1938[label="151.125.37.143;d;4pkt 4fpkt", shape=diamond, color=yellow];
1941[label="214.93.191.44;s;1pkt 1fpkt", shape=diamond, color=yellow];
2791[label="151.125.37.143;d;3pkt 3fpkt", shape=hexagon, color=black];
2897[label="214.93.191.44;s;1pkt 1fpkt", shape=hexagon, color=black];
stat379[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.93.191.44:8020, 151.125.37.143:4293}[25%]&lt;BR/&gt;{202.70.186.128:1863, 151.125.37.143:1059}[25%]&lt;BR/&gt;{81.160.32.196:8000, 151.125.37.143:4000}[25%]&lt;BR/&gt;{81.160.32.198:0, 151.125.37.143:0}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8020: (22.2222%)&lt;BR/&gt; 4293: (22.2222%)&lt;BR/&gt; 8000: (11.1111%)&lt;BR/&gt; 4000: (11.1111%)&lt;BR/&gt; 1863: (11.1111%)&gt;];
}
1938--1941[label="1;1pkt 1fpkt"];
1938--2791[label="1;3pkt 3fpkt"];
1938--2897[label="1;1pkt 1fpkt"];
1941--2791[label="1;1pkt 1fpkt"];
1941--2897[label="1;1pkt 1fpkt"];
2791--2897[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="151.125.37.143" src_ip="81.160.32.198"/>
      <filter dst_ip="151.125.37.143" dst_port="4000" src_ip="81.160.32.196" src_port="8000"/>
      <filter dst_ip="151.125.37.143" dst_port="1059" src_ip="202.70.186.128" src_port="1863"/>
      <filter dst_ip="151.125.37.143" dst_port="4293" src_ip="214.93.191.44" src_port="8020"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_380{
style=filled;
color=gray75;
1974[label="151.125.175.177;s;11pkt 11fpkt", shape=diamond, color=yellow];
2817[label="151.125.175.177;s;11pkt 11fpkt", shape=hexagon, color=black];
stat380[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.125.175.177:*, 82.182.84.228:80}[63.6364%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (45.4545%)&lt;BR/&gt; 61847: (4.54545%)&lt;BR/&gt; 3907: (4.54545%)&lt;BR/&gt; 3906: (4.54545%)&lt;BR/&gt; 3806: (4.54545%)&gt;];
}
1974--2817[label="1;11pkt 11fpkt"];
</description>
    <slice>
      <filter dst_ip="82.182.84.228" dst_port="80" src_ip="151.125.175.177"/>
    </slice>
    <from sec="1091941214" usec="0"/>
    <to sec="1091942006" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,001,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_385{
style=filled;
color=gray75;
1996[label="3.188.0.228;s;508pkt 508fpkt", shape=diamond, color=yellow];
2863[label="3.188.0.228;s;508pkt 508fpkt", shape=hexagon, color=black];
stat385[shape=component, label=&lt;Rules:&lt;BR/&gt;{3.188.0.228:*, *:5554}[50%]&lt;BR/&gt;{3.188.0.228:*, *:9898}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (25%)&lt;BR/&gt; 5554: (25%)&lt;BR/&gt; 4943: (0.0984252%)&lt;BR/&gt; 4942: (0.0984252%)&lt;BR/&gt; 4941: (0.0984252%)&gt;];
}
1996--2863[label="1;508pkt 508fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="3.188.0.228"/>
      <filter dst_port="5554" src_ip="3.188.0.228"/>
    </slice>
    <from sec="1091941509" usec="0"/>
    <to sec="1091941531" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_386{
style=filled;
color=gray75;
1485[label="213.3.154.24;d;11pkt 11fpkt", shape=diamond, color=yellow];
1486[label="168.115.215.231;s;11pkt 11fpkt", shape=diamond, color=yellow];
2868[label="213.3.154.24;d;11pkt 11fpkt", shape=hexagon, color=black];
2869[label="168.115.215.231;s;11pkt 11fpkt", shape=hexagon, color=black];
stat386[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.115.215.231:*, 213.3.154.24:6661}[63.6364%]&lt;BR/&gt;{168.115.215.231:*, 213.3.154.24:22}[36.3636%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6661: (31.8182%)&lt;BR/&gt; 22: (18.1818%)&lt;BR/&gt; 2543: (4.54545%)&lt;BR/&gt; 2513: (4.54545%)&lt;BR/&gt; 2506: (4.54545%)&gt;];
}
1485--1486[label="1;11pkt 11fpkt"];
1485--2868[label="1;11pkt 11fpkt"];
1485--2869[label="1;11pkt 11fpkt"];
1486--2868[label="1;11pkt 11fpkt"];
1486--2869[label="1;11pkt 11fpkt"];
2868--2869[label="1;11pkt 11fpkt"];
</description>
    <slice>
      <filter dst_ip="213.3.154.24" dst_port="6661" src_ip="168.115.215.231"/>
      <filter dst_ip="213.3.154.24" dst_port="22" src_ip="168.115.215.231"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_387{
style=filled;
color=gray75;
2117[label="3.106.25.186;s;33pkt 33fpkt", shape=diamond, color=yellow];
2871[label="204.40.46.231;d;126pkt 126fpkt", shape=hexagon, color=black];
stat387[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.41.49.220:*, 204.40.46.231:80}[27.8571%]&lt;BR/&gt;{3.106.25.186:*, *:*}[23.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (44.0252%)&lt;BR/&gt; 8888: (3.14465%)&lt;BR/&gt; 554: (0.943396%)&lt;BR/&gt; 443: (0.943396%)&lt;BR/&gt; 50292: (0.628931%)&gt;];
}
2117--2871[label="0.575758;19pkt 19fpkt"];
2871--3060[label="0.190476;24pkt 24fpkt"];
2871--3774[label="0.125;1pkt 1fpkt"];
2871--4502[label="0.125;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="3.106.25.186"/>
      <filter dst_ip="204.40.46.231" dst_port="80" src_ip="2.41.49.220"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091941938" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_389{
style=filled;
color=gray75;
1710[label="141.158.151.53;s;71pkt 71fpkt", shape=diamond, color=yellow];
2875[label="141.158.151.53;s;71pkt 71fpkt", shape=hexagon, color=black];
stat389[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.158.151.53:*, 3.31.227.209:80}[39.4366%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.2958%)&lt;BR/&gt; 1863: (0.704225%)&lt;BR/&gt; 1240: (0.704225%)&lt;BR/&gt; 1239: (0.704225%)&lt;BR/&gt; 1237: (0.704225%)&gt;];
}
1710--1957[label="0.0140845;1pkt 1fpkt"];
1710--2429[label="0.075;3pkt 3fpkt"];
1710--2875[label="1;71pkt 71fpkt"];
</description>
    <slice>
      <filter dst_ip="3.31.227.209" dst_port="80" src_ip="141.158.151.53"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942025" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_392{
style=filled;
color=gray75;
1972[label="205.248.186.112;s;171pkt 171fpkt", shape=diamond, color=yellow];
2908[label="205.248.186.112;s;102pkt 102fpkt", shape=hexagon, color=black];
stat392[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.248.186.112:*, 213.98.178.11:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 23146: (0.3663%)&lt;BR/&gt; 23145: (0.3663%)&lt;BR/&gt; 23144: (0.3663%)&lt;BR/&gt; 23143: (0.3663%)&gt;];
}
1972--2908[label="1;102pkt 102fpkt"];
</description>
    <slice>
      <filter dst_ip="213.98.178.11" dst_port="80" src_ip="205.248.186.112"/>
    </slice>
    <from sec="1091941206" usec="0"/>
    <to sec="1091942028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_393{
style=filled;
color=gray75;
1988[label="82.41.13.141;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat393[shape=component, label=&lt;Rules:&lt;BR/&gt;{82.41.13.141:80, 174.104.249.56:1706}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1706: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
1988--2675[label="1;1pkt 1fpkt"];
1988--3863[label="1;1pkt 1fpkt"];
1988--4565[label="1;1pkt 1fpkt"];
1988--5020[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="174.104.249.56" dst_port="1706" src_ip="82.41.13.141" src_port="80"/>
    </slice>
    <from sec="1091941436" usec="0"/>
    <to sec="1091941630" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.773242,1.19457,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_394{
style=filled;
color=gray75;
2079[label="136.171.33.15;s;36pkt 36fpkt", shape=diamond, color=yellow];
2918[label="136.171.33.15;s;36pkt 36fpkt", shape=hexagon, color=black];
2919[label="192.193.35.10;d;29pkt 29fpkt", shape=hexagon, color=black];
3401[label="136.171.33.15;38pkt 38fpkt", shape=pentagon, color=darkviolet];
4254[label="136.171.33.15;38pkt 38fpkt", shape=invtriangle, color=brown];
stat394[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.171.33.15:*, 192.193.35.10:80}[92.1053%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.8701%)&lt;BR/&gt; 2370: (1.41243%)&lt;BR/&gt; 2369: (1.41243%)&lt;BR/&gt; 2368: (1.41243%)&lt;BR/&gt; 2367: (1.41243%)&gt;];
}
2079--2080[label="0.972222;35pkt 35fpkt"];
2079--2918[label="1;36pkt 36fpkt"];
2079--2919[label="1;29pkt 29fpkt"];
2079--3401[label="1;36pkt 36fpkt"];
2079--4254[label="1;36pkt 36fpkt"];
2918--2919[label="1;29pkt 29fpkt"];
2918--3401[label="1;36pkt 36fpkt"];
2918--4254[label="1;36pkt 36fpkt"];
2919--3401[label="1;29pkt 29fpkt"];
2919--4254[label="1;29pkt 29fpkt"];
3401--4254[label="1;38pkt 38fpkt"];
</description>
    <slice>
      <filter dst_ip="192.193.35.10" dst_port="80" src_ip="136.171.33.15"/>
    </slice>
    <from sec="1091941309" usec="0"/>
    <to sec="1091941988" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.690205,1.3717,503,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_397{
style=filled;
color=gray75;
49[label="151.125.175.9s;4pkt 4fpkt", shape=rectangle, color=red];
stat397[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.125.175.9:3150, 211.182.135.200:80}[25%]&lt;BR/&gt;{151.125.175.9:3089, 211.182.137.51:80}[25%]&lt;BR/&gt;{151.125.175.9:3099, 211.182.137.51:80}[25%]&lt;BR/&gt;{151.125.175.9:3222, 211.182.137.51:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3222: (12.5%)&lt;BR/&gt; 3150: (12.5%)&lt;BR/&gt; 3099: (12.5%)&lt;BR/&gt; 3089: (12.5%)&gt;];
}
49--1368[label="1;4pkt 4fpkt"];
49--1369[label="0.75;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="211.182.137.51" dst_port="80" src_ip="151.125.175.9" src_port="3222"/>
      <filter dst_ip="211.182.137.51" dst_port="80" src_ip="151.125.175.9" src_port="3099"/>
      <filter dst_ip="211.182.137.51" dst_port="80" src_ip="151.125.175.9" src_port="3089"/>
      <filter dst_ip="211.182.135.200" dst_port="80" src_ip="151.125.175.9" src_port="3150"/>
    </slice>
    <from sec="1091941772" usec="0"/>
    <to sec="1091942025" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_398{
style=filled;
color=gray75;
2111[label="3.106.25.152;s;56pkt 56fpkt", shape=diamond, color=yellow];
2931[label="3.106.25.152;s;56pkt 56fpkt", shape=hexagon, color=black];
stat398[shape=component, label=&lt;Rules:&lt;BR/&gt;{3.106.25.152:*, 136.171.118.21:80}[46.4286%]&lt;BR/&gt;{3.106.25.152:*, 141.26.185.194:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 52291: (0.892857%)&lt;BR/&gt; 52250: (0.892857%)&lt;BR/&gt; 51504: (0.892857%)&lt;BR/&gt; 51471: (0.892857%)&gt;];
}
2111--2931[label="1;56pkt 56fpkt"];
2111--2950[label="0.25;14pkt 14fpkt"];
2111--3039[label="0.464286;26pkt 26fpkt"];
2931--2950[label="0.25;14pkt 14fpkt"];
2931--3039[label="0.464286;26pkt 26fpkt"];
</description>
    <slice>
      <filter dst_ip="136.171.118.21" dst_port="80" src_ip="3.106.25.152"/>
      <filter dst_ip="141.26.185.194" dst_port="80" src_ip="3.106.25.152"/>
    </slice>
    <from sec="1091941627" usec="0"/>
    <to sec="1091941907" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_400{
style=filled;
color=gray75;
1747[label="199.191.39.125;s;2pkt 2fpkt", shape=diamond, color=yellow];
2955[label="199.191.39.125;s;2pkt 2fpkt", shape=hexagon, color=black];
stat400[shape=component, label=&lt;Rules:&lt;BR/&gt;{199.191.39.125:1755, 141.26.44.110:1069}[50%]&lt;BR/&gt;{199.191.39.125:2460, 141.26.44.110:1071}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2460: (25%)&lt;BR/&gt; 1755: (25%)&lt;BR/&gt; 1071: (25%)&lt;BR/&gt; 1069: (25%)&gt;];
}
1747--2955[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="141.26.44.110" dst_port="1071" src_ip="199.191.39.125" src_port="2460"/>
      <filter dst_ip="141.26.44.110" dst_port="1069" src_ip="199.191.39.125" src_port="1755"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_401{
style=filled;
color=gray75;
2139[label="192.168.128.255;d;1pkt 1fpkt", shape=diamond, color=yellow];
2140[label="136.171.129.52;s;1pkt 1fpkt", shape=diamond, color=yellow];
2958[label="192.168.128.255;d;1pkt 1fpkt", shape=hexagon, color=black];
2959[label="136.171.129.52;s;1pkt 1fpkt", shape=hexagon, color=black];
stat401[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.171.129.52:4445, 192.168.128.255:4445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4445: (100%)&gt;];
}
2139--2140[label="1;1pkt 1fpkt"];
2139--2958[label="1;1pkt 1fpkt"];
2139--2959[label="1;1pkt 1fpkt"];
2140--2958[label="1;1pkt 1fpkt"];
2140--2959[label="1;1pkt 1fpkt"];
2958--2959[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="192.168.128.255" dst_port="4445" src_ip="136.171.129.52" src_port="4445"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724955,1.37547,999,0 0 0 0 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_402{
style=filled;
color=gray75;
2658[label="168.115.206.34;s;502pkt 502fpkt", shape=hexagon, color=black];
stat402[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.115.206.34:1777, *:53}[62.5498%]&lt;BR/&gt;{168.115.206.34:53, *:*}[37.4502%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (50.5976%)&lt;BR/&gt; 1777: (31.2749%)&lt;BR/&gt; 32769: (0.59761%)&lt;BR/&gt; 32774: (0.398406%)&lt;BR/&gt; 32770: (0.298805%)&gt;];
}
2658--2967[label="0.0181818;1pkt 1fpkt"];
2658--3099[label="0.027027;1pkt 1fpkt"];
2658--3263[label="0.0458167;23pkt 23fpkt"];
2658--3310[label="0.0258964;13pkt 13fpkt"];
2658--3313[label="0.0239044;12pkt 12fpkt"];
2658--3318[label="0.0458167;23pkt 23fpkt"];
2658--3336[label="0.0258964;13pkt 13fpkt"];
2658--3339[label="0.0239044;12pkt 12fpkt"];
2658--3343[label="0.0458167;23pkt 23fpkt"];
2658--3346[label="0.0258964;13pkt 13fpkt"];
2658--3349[label="0.0239044;12pkt 12fpkt"];
2658--3477[label="1;502pkt 502fpkt"];
2658--4309[label="1;502pkt 502fpkt"];
2658--4864[label="1;502pkt 502fpkt"];
</description>
    <slice>
      <filter src_ip="168.115.206.34" src_port="53"/>
      <filter dst_port="53" src_ip="168.115.206.34" src_port="1777"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091941489" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_404{
style=filled;
color=gray75;
2167[label="136.171.225.154;s;930pkt 930fpkt", shape=diamond, color=yellow];
2208[label="68.59.82.3;d;688pkt 688fpkt", shape=diamond, color=yellow];
2972[label="136.171.225.154;s;182pkt 182fpkt", shape=hexagon, color=black];
2990[label="68.59.82.3;d;180pkt 180fpkt", shape=hexagon, color=black];
stat404[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.171.225.154:*, 68.59.82.3:80}[99.7849%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.9495%)&lt;BR/&gt; 63764: (0.10101%)&lt;BR/&gt; 63731: (0.10101%)&lt;BR/&gt; 63719: (0.10101%)&lt;BR/&gt; 63702: (0.10101%)&gt;];
}
2167--2208[label="1;688pkt 688fpkt"];
2167--2972[label="1;182pkt 182fpkt"];
2167--2990[label="1;180pkt 180fpkt"];
2208--2972[label="0.989011;180pkt 180fpkt"];
2208--2990[label="1;180pkt 180fpkt"];
2972--2990[label="1;180pkt 180fpkt"];
</description>
    <slice>
      <filter dst_ip="68.59.82.3" dst_port="80" src_ip="136.171.225.154"/>
    </slice>
    <from sec="1091941209" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.773242,1.19457,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_407{
style=filled;
color=gray75;
2106[label="201.122.50.152;s;5pkt 5fpkt", shape=diamond, color=yellow];
2986[label="201.122.50.152;s;5pkt 5fpkt", shape=hexagon, color=black];
3891[label="201.122.50.152;5pkt 5fpkt", shape=pentagon, color=darkviolet];
4584[label="201.122.50.152;5pkt 5fpkt", shape=invtriangle, color=brown];
stat407[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.122.50.152:80, 205.242.18.218:3561}[20%]&lt;BR/&gt;{201.122.50.152:80, 205.242.18.218:3562}[20%]&lt;BR/&gt;{201.122.50.152:80, 205.242.18.218:3572}[20%]&lt;BR/&gt;{201.122.50.152:80, 205.242.18.218:3573}[20%]&lt;BR/&gt;{201.122.50.152:80, 205.242.18.218:3574}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3574: (10%)&lt;BR/&gt; 3573: (10%)&lt;BR/&gt; 3572: (10%)&lt;BR/&gt; 3562: (10%)&gt;];
}
2106--2986[label="1;5pkt 5fpkt"];
2106--3891[label="1;5pkt 5fpkt"];
2106--4584[label="1;5pkt 5fpkt"];
2986--3891[label="1;5pkt 5fpkt"];
2986--4584[label="1;5pkt 5fpkt"];
3891--4584[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="205.242.18.218" dst_port="3574" src_ip="201.122.50.152" src_port="80"/>
      <filter dst_ip="205.242.18.218" dst_port="3573" src_ip="201.122.50.152" src_port="80"/>
      <filter dst_ip="205.242.18.218" dst_port="3572" src_ip="201.122.50.152" src_port="80"/>
      <filter dst_ip="205.242.18.218" dst_port="3562" src_ip="201.122.50.152" src_port="80"/>
      <filter dst_ip="205.242.18.218" dst_port="3561" src_ip="201.122.50.152" src_port="80"/>
    </slice>
    <from sec="1091941609" usec="0"/>
    <to sec="1091941629" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_408{
style=filled;
color=gray75;
2361[label="205.248.172.0;s;84pkt 84fpkt", shape=diamond, color=yellow];
2988[label="212.33.97.49;d;157pkt 157fpkt", shape=hexagon, color=black];
stat408[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:1080, 212.33.97.49:*}[34.728%]&lt;BR/&gt;{205.248.172.0:0, *:0}[34.3096%]&lt;BR/&gt;{*:0, 212.33.97.49:0}[31.3808%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (65.1452%)&lt;BR/&gt; 1080: (17.4274%)&lt;BR/&gt; 63939: (0.414938%)&lt;BR/&gt; 65431: (0.207469%)&lt;BR/&gt; 65427: (0.207469%)&gt;];
}
2361--2892[label="0.0119048;1pkt 1fpkt"];
2361--2988[label="0.0238095;2pkt 2fpkt"];
2988--3013[label="0.0191083;3pkt 3fpkt"];
2988--3091[label="0.0136986;1pkt 1fpkt"];
2988--4070[label="0.09375;3pkt 3fpkt"];
2988--4186[label="0.0566038;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="212.33.97.49" src_port="1080"/>
      <filter src_ip="205.248.172.0"/>
      <filter dst_ip="212.33.97.49"/>
    </slice>
    <from sec="1091941215" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,011,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_410{
style=filled;
color=gray75;
1243[label="81.180.148.92;s;6004pkt 6004fpkt", shape=diamond, color=yellow];
1708[label="141.221.9.85;d;1379pkt 1379fpkt", shape=diamond, color=yellow];
1743[label="141.221.105.86;d;1417pkt 1417fpkt", shape=diamond, color=yellow];
1913[label="141.84.84.241;d;1353pkt 1353fpkt", shape=diamond, color=yellow];
1914[label="141.176.35.57;d;1308pkt 1308fpkt", shape=diamond, color=yellow];
1929[label="174.3.211.2;d;1341pkt 1341fpkt", shape=diamond, color=yellow];
2414[label="81.169.221.41;s;569pkt 569fpkt", shape=diamond, color=yellow];
2772[label="141.176.35.57;d;614pkt 614fpkt", shape=hexagon, color=black];
2940[label="81.180.148.92;s;6004pkt 6004fpkt", shape=hexagon, color=black];
2997[label="141.221.9.85;d;1231pkt 1231fpkt", shape=hexagon, color=black];
stat410[shape=component, label=&lt;Rules:&lt;BR/&gt;{81.180.148.92:80, *:*}[88.3201%]&lt;BR/&gt;{*:*, 141.221.105.86:*}[20.8444%]&lt;BR/&gt;{*:*, 141.221.9.85:*}[20.2854%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.3926%)&lt;BR/&gt; 7000: (3.08907%)&lt;BR/&gt; 3389: (0.407634%)&lt;BR/&gt; 5554: (0.0400566%)&lt;BR/&gt; 1023: (0.0400566%)&gt;];
}
1243--1708[label="0.883249;1218pkt 1218fpkt"];
1243--1743[label="0.894143;1267pkt 1267fpkt"];
1243--1913[label="0.87731;1187pkt 1187fpkt"];
1243--1914[label="0.876147;1146pkt 1146fpkt"];
1243--1929[label="0.884415;1186pkt 1186fpkt"];
1243--2772[label="0.885993;544pkt 544fpkt"];
1243--2940[label="1;6004pkt 6004fpkt"];
1243--2997[label="0.883834;1088pkt 1088fpkt"];
1243--3264[label="0.145599;349pkt 349fpkt"];
1243--3311[label="0.173775;493pkt 493fpkt"];
1243--3319[label="0.145599;349pkt 349fpkt"];
1243--3337[label="0.173775;493pkt 493fpkt"];
1243--3344[label="0.145599;349pkt 349fpkt"];
1243--3347[label="0.173775;493pkt 493fpkt"];
1708--1866[label="0.000725163;1pkt 1fpkt"];
1708--1872[label="0.00217549;3pkt 3fpkt"];
1708--1881[label="0.00217549;3pkt 3fpkt"];
1708--2414[label="0.214411;122pkt 122fpkt"];
1708--2735[label="0.000725163;1pkt 1fpkt"];
1708--2862[label="0.00217549;3pkt 3fpkt"];
1708--2940[label="0.883249;1218pkt 1218fpkt"];
1708--2997[label="1;1231pkt 1231fpkt"];
1708--3219[label="0.000725163;1pkt 1fpkt"];
1708--3221[label="0.00217549;3pkt 3fpkt"];
1708--3264[label="0.0558376;77pkt 77fpkt"];
1708--3311[label="0.0703408;97pkt 97fpkt"];
1708--3319[label="0.0558376;77pkt 77fpkt"];
1708--3337[label="0.0703408;97pkt 97fpkt"];
1708--3344[label="0.0558376;77pkt 77fpkt"];
1708--3347[label="0.0703408;97pkt 97fpkt"];
1708--3769[label="0.00217549;3pkt 3fpkt"];
1708--4035[label="0.000725163;1pkt 1fpkt"];
1708--4685[label="0.000725163;1pkt 1fpkt"];
1743--2414[label="0.177504;101pkt 101fpkt"];
1743--2705[label="0.00211715;3pkt 3fpkt"];
1743--2940[label="0.894143;1267pkt 1267fpkt"];
1743--3264[label="0.0536344;76pkt 76fpkt"];
1743--3311[label="0.0712773;101pkt 101fpkt"];
1743--3319[label="0.0536344;76pkt 76fpkt"];
1743--3337[label="0.0712773;101pkt 101fpkt"];
1743--3344[label="0.0536344;76pkt 76fpkt"];
1743--3347[label="0.0712773;101pkt 101fpkt"];
1743--4126[label="0.00211715;3pkt 3fpkt"];
1743--4748[label="0.00211715;3pkt 3fpkt"];
1743--5147[label="0.00211715;3pkt 3fpkt"];
1913--2414[label="0.202109;115pkt 115fpkt"];
1913--2550[label="0.0014782;2pkt 2fpkt"];
1913--2828[label="0.0014782;2pkt 2fpkt"];
1913--2940[label="0.87731;1187pkt 1187fpkt"];
1913--3264[label="0.0436068;59pkt 59fpkt"];
1913--3311[label="0.0694752;94pkt 94fpkt"];
1913--3319[label="0.0436068;59pkt 59fpkt"];
1913--3337[label="0.0694752;94pkt 94fpkt"];
1913--3344[label="0.0436068;59pkt 59fpkt"];
1913--3347[label="0.0694752;94pkt 94fpkt"];
1913--3456[label="0.0014782;2pkt 2fpkt"];
1913--4293[label="0.0014782;2pkt 2fpkt"];
1914--2414[label="0.195079;111pkt 111fpkt"];
1914--2715[label="0.00229358;3pkt 3fpkt"];
1914--2772[label="1;614pkt 614fpkt"];
1914--2940[label="0.876147;1146pkt 1146fpkt"];
1914--3264[label="0.0512232;67pkt 67fpkt"];
1914--3311[label="0.0749235;98pkt 98fpkt"];
1914--3319[label="0.0512232;67pkt 67fpkt"];
1914--3337[label="0.0749235;98pkt 98fpkt"];
1914--3344[label="0.0512232;67pkt 67fpkt"];
1914--3347[label="0.0749235;98pkt 98fpkt"];
1914--3441[label="0.00152905;2pkt 2fpkt"];
1914--3633[label="0.00229358;3pkt 3fpkt"];
1914--3650[label="0.00189394;2pkt 2fpkt"];
1914--3866[label="0.00229358;3pkt 3fpkt"];
1914--4279[label="0.00152905;2pkt 2fpkt"];
1914--4408[label="0.00229358;3pkt 3fpkt"];
1914--4419[label="0.00189394;2pkt 2fpkt"];
1914--4568[label="0.00229358;3pkt 3fpkt"];
1914--4847[label="0.00152905;2pkt 2fpkt"];
1914--4920[label="0.00229358;3pkt 3fpkt"];
1914--4926[label="0.00189573;2pkt 2fpkt"];
1914--5022[label="0.00229358;3pkt 3fpkt"];
1929--2414[label="0.210896;120pkt 120fpkt"];
1929--2940[label="0.884415;1186pkt 1186fpkt"];
1929--3264[label="0.0529456;71pkt 71fpkt"];
1929--3311[label="0.0768084;103pkt 103fpkt"];
1929--3319[label="0.0529456;71pkt 71fpkt"];
1929--3337[label="0.0768084;103pkt 103fpkt"];
1929--3344[label="0.0529456;71pkt 71fpkt"];
1929--3347[label="0.0768084;103pkt 103fpkt"];
2414--2772[label="0.0966608;55pkt 55fpkt"];
2414--2997[label="0.200351;114pkt 114fpkt"];
2772--2940[label="0.885993;544pkt 544fpkt"];
2772--3264[label="0.109121;67pkt 67fpkt"];
2772--3311[label="0.0456026;28pkt 28fpkt"];
2772--3319[label="0.109121;67pkt 67fpkt"];
2772--3337[label="0.0456026;28pkt 28fpkt"];
2772--3344[label="0.109121;67pkt 67fpkt"];
2772--3347[label="0.0456026;28pkt 28fpkt"];
2772--3441[label="0.00325733;2pkt 2fpkt"];
2772--3633[label="0.00488599;3pkt 3fpkt"];
2772--3650[label="0.00325733;2pkt 2fpkt"];
2772--3866[label="0.00488599;3pkt 3fpkt"];
2772--4279[label="0.00325733;2pkt 2fpkt"];
2772--4408[label="0.00488599;3pkt 3fpkt"];
2772--4419[label="0.00325733;2pkt 2fpkt"];
2772--4568[label="0.00488599;3pkt 3fpkt"];
2772--4847[label="0.00325733;2pkt 2fpkt"];
2772--4920[label="0.00488599;3pkt 3fpkt"];
2772--4926[label="0.00325733;2pkt 2fpkt"];
2772--5022[label="0.00488599;3pkt 3fpkt"];
2940--2997[label="0.883834;1088pkt 1088fpkt"];
2940--3264[label="0.145599;349pkt 349fpkt"];
2940--3311[label="0.173775;493pkt 493fpkt"];
2940--3319[label="0.145599;349pkt 349fpkt"];
2940--3337[label="0.173775;493pkt 493fpkt"];
2940--3344[label="0.145599;349pkt 349fpkt"];
2940--3347[label="0.173775;493pkt 493fpkt"];
2997--3219[label="0.000812348;1pkt 1fpkt"];
2997--3221[label="0.00243704;3pkt 3fpkt"];
2997--3264[label="0.0625508;77pkt 77fpkt"];
2997--3311[label="0.0787977;97pkt 97fpkt"];
2997--3319[label="0.0625508;77pkt 77fpkt"];
2997--3337[label="0.0787977;97pkt 97fpkt"];
2997--3344[label="0.0625508;77pkt 77fpkt"];
2997--3347[label="0.0787977;97pkt 97fpkt"];
2997--3769[label="0.00243704;3pkt 3fpkt"];
2997--4035[label="0.000812348;1pkt 1fpkt"];
2997--4685[label="0.000812348;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="141.221.105.86"/>
      <filter dst_ip="141.221.9.85"/>
      <filter src_ip="81.180.148.92" src_port="80"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_411{
style=filled;
color=gray75;
1490[label="174.104.182.162;s;61pkt 61fpkt", shape=diamond, color=yellow];
2225[label="129.58.43.147;d;2pkt 2fpkt", shape=diamond, color=yellow];
2262[label="215.216.164.143;d;2pkt 2fpkt", shape=diamond, color=yellow];
2326[label="212.169.10.228;d;2pkt 2fpkt", shape=diamond, color=yellow];
2756[label="174.104.182.162;s;60pkt 60fpkt", shape=hexagon, color=black];
2998[label="129.58.43.147;d;2pkt 2fpkt", shape=hexagon, color=black];
3027[label="215.216.164.143;d;2pkt 2fpkt", shape=hexagon, color=black];
3071[label="212.169.10.228;d;2pkt 2fpkt", shape=hexagon, color=black];
stat411[shape=component, label=&lt;Rules:&lt;BR/&gt;{174.104.182.162:3461, *:*}[73.7705%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3461: (35.7143%)&lt;BR/&gt; 80: (3.7594%)&lt;BR/&gt; 61863: (3.00752%)&lt;BR/&gt; 58022: (3.00752%)&lt;BR/&gt; 32964: (3.00752%)&gt;];
}
1490--2225[label="1;2pkt 2fpkt"];
1490--2262[label="1;2pkt 2fpkt"];
1490--2326[label="1;2pkt 2fpkt"];
1490--2756[label="1;60pkt 60fpkt"];
1490--2998[label="1;2pkt 2fpkt"];
1490--3027[label="1;2pkt 2fpkt"];
1490--3071[label="1;2pkt 2fpkt"];
2225--2756[label="1;2pkt 2fpkt"];
2225--2998[label="1;2pkt 2fpkt"];
2262--2756[label="1;2pkt 2fpkt"];
2262--3027[label="1;2pkt 2fpkt"];
2326--2756[label="1;2pkt 2fpkt"];
2326--3071[label="1;2pkt 2fpkt"];
2756--2998[label="1;2pkt 2fpkt"];
2756--3027[label="1;2pkt 2fpkt"];
2756--3071[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_ip="174.104.182.162" src_port="3461"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,011,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_414{
style=filled;
color=gray75;
1519[label="81.180.22.232;s;2758pkt 2758fpkt", shape=diamond, color=yellow];
3015[label="81.180.22.232;s;2443pkt 2443fpkt", shape=hexagon, color=black];
stat414[shape=component, label=&lt;Rules:&lt;BR/&gt;{81.180.22.232:7000, *:*}[50.8702%]&lt;BR/&gt;{81.180.22.232:7100, *:*}[49.1298%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7000: (25.3701%)&lt;BR/&gt; 7100: (24.6299%)&lt;BR/&gt; 29597: (0.0576812%)&lt;BR/&gt; 20492: (0.0480677%)&lt;BR/&gt; 58070: (0.0384541%)&gt;];
}
1519--3015[label="1;2443pkt 2443fpkt"];
</description>
    <slice>
      <filter src_ip="81.180.22.232" src_port="7000"/>
      <filter src_ip="81.180.22.232" src_port="7100"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_415{
style=filled;
color=gray75;
2252[label="204.40.44.16;s;425pkt 425fpkt", shape=diamond, color=yellow];
3019[label="204.40.44.16;s;343pkt 343fpkt", shape=hexagon, color=black];
stat415[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.40.44.16:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2252--3019[label="1;343pkt 343fpkt"];
</description>
    <slice>
      <filter src_ip="204.40.44.16"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_416{
style=filled;
color=gray75;
1354[label="136.171.114.231;s;520pkt 520fpkt", shape=diamond, color=yellow];
1947[label="151.125.158.150;s;246pkt 246fpkt", shape=diamond, color=yellow];
2005[label="136.171.104.248;s;174pkt 174fpkt", shape=diamond, color=yellow];
2050[label="197.73.96.238;d;139pkt 139fpkt", shape=diamond, color=yellow];
2154[label="136.171.50.17;s;138pkt 138fpkt", shape=diamond, color=yellow];
2165[label="141.26.177.27;s;181pkt 181fpkt", shape=diamond, color=yellow];
2171[label="168.115.209.37;s;121pkt 121fpkt", shape=diamond, color=yellow];
2279[label="136.171.216.131;s;135pkt 135fpkt", shape=diamond, color=yellow];
2303[label="205.248.184.76;s;112pkt 112fpkt", shape=diamond, color=yellow];
2971[label="141.26.177.27;s;118pkt 118fpkt", shape=hexagon, color=black];
3023[label="151.125.158.150;s;223pkt 223fpkt", shape=hexagon, color=black];
3030[label="197.73.96.238;d;107pkt 107fpkt", shape=hexagon, color=black];
3031[label="136.171.50.17;s;138pkt 138fpkt", shape=hexagon, color=black];
3041[label="168.115.209.37;s;121pkt 121fpkt", shape=hexagon, color=black];
3062[label="136.171.104.248;s;154pkt 154fpkt", shape=hexagon, color=black];
3101[label="136.171.218.21;s;90pkt 90fpkt", shape=hexagon, color=black];
stat416[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, *:25}[76.8841%]&lt;BR/&gt;{136.171.114.231:*, *:*}[29.2463%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (45.3809%)&lt;BR/&gt; 113: (2.61318%)&lt;BR/&gt; 53: (1.14096%)&lt;BR/&gt; 80: (0.828119%)&lt;BR/&gt; 47468: (0.184026%)&gt;];
}
1354--2050[label="0.0935252;13pkt 13fpkt"];
1947--2050[label="0.0431655;6pkt 6fpkt"];
1947--3023[label="1;223pkt 223fpkt"];
1947--3030[label="0.046729;5pkt 5fpkt"];
2005--2050[label="0.028777;4pkt 4fpkt"];
2005--3030[label="0.0373832;4pkt 4fpkt"];
2005--3062[label="1;154pkt 154fpkt"];
2005--3313[label="0.00574713;1pkt 1fpkt"];
2005--3339[label="0.00574713;1pkt 1fpkt"];
2005--3349[label="0.00574713;1pkt 1fpkt"];
2050--2124[label="0.0111111;1pkt 1fpkt"];
2050--2154[label="0.0289855;4pkt 4fpkt"];
2050--2165[label="0.0863309;12pkt 12fpkt"];
2050--2171[label="0.0909091;11pkt 11fpkt"];
2050--2279[label="0.0444444;6pkt 6fpkt"];
2050--2280[label="0.00763359;1pkt 1fpkt"];
2050--2303[label="0.178571;20pkt 20fpkt"];
2050--2349[label="0.0222222;2pkt 2fpkt"];
2050--2971[label="0.0762712;9pkt 9fpkt"];
2050--3023[label="0.0431655;6pkt 6fpkt"];
2050--3030[label="1;107pkt 107fpkt"];
2050--3031[label="0.0289855;4pkt 4fpkt"];
2050--3041[label="0.0909091;11pkt 11fpkt"];
2050--3062[label="0.028777;4pkt 4fpkt"];
2050--3063[label="0.158273;22pkt 22fpkt"];
2050--3101[label="0.0222222;2pkt 2fpkt"];
2050--3565[label="0.194245;27pkt 27fpkt"];
2050--3938[label="0.0588235;1pkt 1fpkt"];
2050--3984[label="0.129496;18pkt 18fpkt"];
2050--4365[label="0.194245;27pkt 27fpkt"];
2050--4615[label="0.0588235;1pkt 1fpkt"];
2050--4651[label="0.129496;18pkt 18fpkt"];
2050--5054[label="0.0588235;1pkt 1fpkt"];
2050--5076[label="0.129496;18pkt 18fpkt"];
2154--3030[label="0.0280374;3pkt 3fpkt"];
2154--3031[label="1;138pkt 138fpkt"];
2154--3263[label="0.00724638;1pkt 1fpkt"];
2154--3318[label="0.00724638;1pkt 1fpkt"];
2154--3343[label="0.00724638;1pkt 1fpkt"];
2165--2971[label="1;118pkt 118fpkt"];
2165--3030[label="0.0934579;10pkt 10fpkt"];
2171--3030[label="0.102804;11pkt 11fpkt"];
2171--3041[label="1;121pkt 121fpkt"];
2279--3030[label="0.046729;5pkt 5fpkt"];
2303--3030[label="0.186916;20pkt 20fpkt"];
2971--3030[label="0.0841121;9pkt 9fpkt"];
3023--3030[label="0.046729;5pkt 5fpkt"];
3030--3031[label="0.0280374;3pkt 3fpkt"];
3030--3041[label="0.102804;11pkt 11fpkt"];
3030--3062[label="0.0373832;4pkt 4fpkt"];
3030--3063[label="0.17757;19pkt 19fpkt"];
3030--3101[label="0.0222222;2pkt 2fpkt"];
3030--3565[label="0.17757;19pkt 19fpkt"];
3030--3938[label="0.0588235;1pkt 1fpkt"];
3030--3984[label="0.149533;16pkt 16fpkt"];
3030--4365[label="0.17757;19pkt 19fpkt"];
3030--4615[label="0.0588235;1pkt 1fpkt"];
3030--4651[label="0.149533;16pkt 16fpkt"];
3030--5054[label="0.0588235;1pkt 1fpkt"];
3030--5076[label="0.149533;16pkt 16fpkt"];
3031--3263[label="0.00724638;1pkt 1fpkt"];
3031--3318[label="0.00724638;1pkt 1fpkt"];
3031--3343[label="0.00724638;1pkt 1fpkt"];
3062--3313[label="0.00649351;1pkt 1fpkt"];
3062--3339[label="0.00649351;1pkt 1fpkt"];
3062--3349[label="0.00649351;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="136.171.114.231"/>
      <filter dst_port="25"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_417{
style=filled;
color=gray75;
2160[label="219.6.7.129;d;17pkt 17fpkt", shape=diamond, color=yellow];
2161[label="168.115.165.67;s;17pkt 17fpkt", shape=diamond, color=yellow];
3033[label="219.6.7.129;d;17pkt 17fpkt", shape=hexagon, color=black];
stat417[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.115.165.67:25, 219.6.7.129:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 4946: (2.94118%)&lt;BR/&gt; 4918: (2.94118%)&lt;BR/&gt; 4879: (2.94118%)&lt;BR/&gt; 4853: (2.94118%)&gt;];
}
2160--2161[label="1;17pkt 17fpkt"];
2160--3033[label="1;17pkt 17fpkt"];
2161--3033[label="1;17pkt 17fpkt"];
</description>
    <slice>
      <filter dst_ip="219.6.7.129" src_ip="168.115.165.67" src_port="25"/>
    </slice>
    <from sec="1091941205" usec="0"/>
    <to sec="1091941760" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_419{
style=filled;
color=gray75;
2164[label="151.125.156.138;d;68pkt 68fpkt", shape=diamond, color=yellow];
3038[label="151.125.156.138;d;52pkt 52fpkt", shape=hexagon, color=black];
stat419[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 151.125.156.138:25}[97.0588%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (48.3333%)&lt;BR/&gt; 0: (3.33333%)&lt;BR/&gt; 60420: (0.833333%)&lt;BR/&gt; 60078: (0.833333%)&lt;BR/&gt; 59194: (0.833333%)&gt;];
}
2164--3038[label="1;52pkt 52fpkt"];
</description>
    <slice>
      <filter dst_ip="151.125.156.138" dst_port="25"/>
    </slice>
    <from sec="1091941207" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_420{
style=filled;
color=gray75;
2098[label="213.116.10.228;s;6pkt 6fpkt", shape=diamond, color=yellow];
3046[label="213.116.10.228;s;6pkt 6fpkt", shape=hexagon, color=black];
stat420[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.116.10.228:80, 205.248.186.2:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 43176: (8.33333%)&lt;BR/&gt; 42935: (8.33333%)&lt;BR/&gt; 42933: (8.33333%)&lt;BR/&gt; 42929: (8.33333%)&gt;];
}
2098--3046[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="205.248.186.2" src_ip="213.116.10.228" src_port="80"/>
    </slice>
    <from sec="1091941547" usec="0"/>
    <to sec="1091941747" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818035,1.27709,001,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_424{
style=filled;
color=gray75;
127[label="214.56.204.29s;555pkt 555fpkt", shape=rectangle, color=red];
2320[label="214.56.204.29;s;564pkt 564fpkt", shape=diamond, color=yellow];
3058[label="214.56.204.29;s;564pkt 564fpkt", shape=hexagon, color=black];
stat424[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.56.204.29:*, *:5554}[41.3121%]&lt;BR/&gt;{214.56.204.29:*, *:1023}[31.9149%]&lt;BR/&gt;{214.56.204.29:*, *:9898}[26.773%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (20.4991%)&lt;BR/&gt; 1023: (16.0428%)&lt;BR/&gt; 9898: (13.4581%)&lt;BR/&gt; 4891: (0.0891266%)&lt;BR/&gt; 4836: (0.0891266%)&gt;];
}
127--670[label="0.596396;331pkt 331fpkt"];
127--2320[label="1;555pkt 555fpkt"];
127--3058[label="1;555pkt 555fpkt"];
2320--3058[label="1;564pkt 564fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="214.56.204.29"/>
      <filter dst_port="1023" src_ip="214.56.204.29"/>
      <filter dst_port="9898" src_ip="214.56.204.29"/>
    </slice>
    <from sec="1091941818" usec="0"/>
    <to sec="1091941825" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.711294,1.2256,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_425{
style=filled;
color=gray75;
1883[label="174.104.10.172;d;148pkt 148fpkt", shape=diamond, color=yellow];
1886[label="2.41.37.209;s;179pkt 179fpkt", shape=diamond, color=yellow];
2004[label="204.40.46.231;d;127pkt 127fpkt", shape=diamond, color=yellow];
2007[label="204.40.42.15;d;42pkt 42fpkt", shape=diamond, color=yellow];
2113[label="3.106.25.169;s;17pkt 17fpkt", shape=diamond, color=yellow];
2742[label="174.104.10.172;d;35pkt 35fpkt", shape=hexagon, color=black];
3060[label="2.41.37.209;s;146pkt 146fpkt", shape=hexagon, color=black];
3065[label="204.40.42.15;d;42pkt 42fpkt", shape=hexagon, color=black];
3972[label="0.20.47.171;11pkt 11fpkt", shape=pentagon, color=darkviolet];
stat425[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.41.37.209:*, 174.104.10.172:80}[32.3864%]&lt;BR/&gt;{*:*, 204.40.46.231:80}[32.3864%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.996%)&lt;BR/&gt; 8888: (0.334672%)&lt;BR/&gt; 58512: (0.267738%)&lt;BR/&gt; 56105: (0.267738%)&lt;BR/&gt; 54185: (0.267738%)&gt;];
}
1883--1886[label="0.77027;114pkt 114fpkt"];
1883--2354[label="0.541667;26pkt 26fpkt"];
1883--2742[label="1;35pkt 35fpkt"];
1883--3060[label="0.589041;86pkt 86fpkt"];
1883--4187[label="0.030303;1pkt 1fpkt"];
1883--4789[label="0.030303;1pkt 1fpkt"];
1886--2004[label="0.19685;25pkt 25fpkt"];
1886--2007[label="0.52381;22pkt 22fpkt"];
1886--2742[label="0.514286;18pkt 18fpkt"];
1886--2871[label="0.190476;24pkt 24fpkt"];
1886--3060[label="1;146pkt 146fpkt"];
1886--3065[label="0.52381;22pkt 22fpkt"];
2004--2117[label="0.575758;19pkt 19fpkt"];
2004--2871[label="1;126pkt 126fpkt"];
2004--3060[label="0.188976;24pkt 24fpkt"];
2004--3774[label="0.125;1pkt 1fpkt"];
2004--4502[label="0.125;1pkt 1fpkt"];
2007--2113[label="0.470588;8pkt 8fpkt"];
2007--2359[label="0.0238095;1pkt 1fpkt"];
2007--3060[label="0.5;21pkt 21fpkt"];
2007--3065[label="1;42pkt 42fpkt"];
2007--3419[label="0.0238095;1pkt 1fpkt"];
2007--3972[label="0.272727;3pkt 3fpkt"];
2113--3065[label="0.470588;8pkt 8fpkt"];
2742--3060[label="0.514286;18pkt 18fpkt"];
3060--3065[label="0.5;21pkt 21fpkt"];
3065--3419[label="0.0238095;1pkt 1fpkt"];
3065--3972[label="0.272727;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="204.40.46.231" dst_port="80"/>
      <filter dst_ip="174.104.10.172" dst_port="80" src_ip="2.41.37.209"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_426{
style=filled;
color=gray75;
1491[label="136.170.51.197;s;196pkt 196fpkt", shape=diamond, color=yellow];
3066[label="136.170.51.197;s;180pkt 180fpkt", shape=hexagon, color=black];
stat426[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.170.51.197:*, *:25}[56.6327%]&lt;BR/&gt;{136.170.51.197:25, *:*}[43.3673%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 4204: (0.531915%)&lt;BR/&gt; 1533: (0.531915%)&lt;BR/&gt; 63581: (0.265957%)&lt;BR/&gt; 61730: (0.265957%)&gt;];
}
1491--3066[label="1;180pkt 180fpkt"];
</description>
    <slice>
      <filter src_ip="136.170.51.197" src_port="25"/>
      <filter dst_port="25" src_ip="136.170.51.197"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,010,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_427{
style=filled;
color=gray75;
2325[label="83.183.215.33;s;326pkt 326fpkt", shape=diamond, color=yellow];
3070[label="83.183.215.33;s;287pkt 287fpkt", shape=hexagon, color=black];
stat427[shape=component, label=&lt;Rules:&lt;BR/&gt;{83.183.215.33:*, *:445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (50%)&lt;BR/&gt; 4454: (0.326264%)&lt;BR/&gt; 4444: (0.326264%)&lt;BR/&gt; 3457: (0.326264%)&lt;BR/&gt; 2468: (0.326264%)&gt;];
}
2325--3070[label="1;287pkt 287fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="83.183.215.33"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_429{
style=filled;
color=gray75;
2083[label="217.155.177.160;s;95pkt 95fpkt", shape=diamond, color=yellow];
2094[label="205.242.18.218;d;95pkt 95fpkt", shape=diamond, color=yellow];
2979[label="217.155.177.160;s;84pkt 84fpkt", shape=hexagon, color=black];
3078[label="205.248.129.98;d;41pkt 41fpkt", shape=hexagon, color=black];
stat429[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 205.242.18.218:*}[49.4737%]&lt;BR/&gt;{*:*, 205.248.129.98:*}[21.5789%]&lt;BR/&gt;{217.155.177.160:80, 136.171.72.196:*}[20.5263%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.3492%)&lt;BR/&gt; 0: (3.80952%)&lt;BR/&gt; 53: (1.74603%)&lt;BR/&gt; 18267: (0.47619%)&lt;BR/&gt; 18266: (0.47619%)&gt;];
}
2083--2094[label="0.357895;34pkt 34fpkt"];
2083--2238[label="0.162791;7pkt 7fpkt"];
2083--2363[label="0.0116279;1pkt 1fpkt"];
2083--2979[label="1;84pkt 84fpkt"];
2083--3078[label="0.170732;7pkt 7fpkt"];
2083--3311[label="0.0842105;8pkt 8fpkt"];
2083--3337[label="0.0842105;8pkt 8fpkt"];
2083--3347[label="0.0842105;8pkt 8fpkt"];
2094--2106[label="1;5pkt 5fpkt"];
2094--2979[label="0.404762;34pkt 34fpkt"];
2094--2986[label="1;5pkt 5fpkt"];
2094--3555[label="0.0434783;1pkt 1fpkt"];
2094--3891[label="1;5pkt 5fpkt"];
2094--4584[label="1;5pkt 5fpkt"];
2979--3078[label="0.170732;7pkt 7fpkt"];
2979--3311[label="0.0952381;8pkt 8fpkt"];
2979--3337[label="0.0952381;8pkt 8fpkt"];
2979--3347[label="0.0952381;8pkt 8fpkt"];
3078--3264[label="0.0243902;1pkt 1fpkt"];
3078--3311[label="0.0243902;1pkt 1fpkt"];
3078--3319[label="0.0243902;1pkt 1fpkt"];
3078--3337[label="0.0243902;1pkt 1fpkt"];
3078--3344[label="0.0243902;1pkt 1fpkt"];
3078--3347[label="0.0243902;1pkt 1fpkt"];
3078--3405[label="0.025;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="205.248.129.98"/>
      <filter dst_ip="205.242.18.218" src_port="80"/>
      <filter dst_ip="136.171.72.196" src_ip="217.155.177.160" src_port="80"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942021" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_430{
style=filled;
color=gray75;
1316[label="204.40.41.9;s;1593pkt 1593fpkt", shape=diamond, color=yellow];
2328[label="5.225.155.189;d;1pkt 1fpkt", shape=diamond, color=yellow];
3079[label="5.225.155.189;d;1pkt 1fpkt", shape=hexagon, color=black];
stat430[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.40.41.9:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1316--2328[label="1;1pkt 1fpkt"];
1316--3079[label="1;1pkt 1fpkt"];
2328--3079[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="204.40.41.9"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.773242,1.19457,001,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_431{
style=filled;
color=gray75;
1241[label="211.167.180.1;d;215pkt 215fpkt", shape=diamond, color=yellow];
1364[label="141.26.177.70;s;5pkt 5fpkt", shape=diamond, color=yellow];
2247[label="141.26.44.110;s;33pkt 33fpkt", shape=diamond, color=yellow];
2526[label="211.167.180.1;d;215pkt 215fpkt", shape=hexagon, color=black];
3082[label="141.26.44.110;s;33pkt 33fpkt", shape=hexagon, color=black];
3697[label="141.26.177.97;9pkt 9fpkt", shape=pentagon, color=darkviolet];
3839[label="141.26.45.134;10pkt 10fpkt", shape=pentagon, color=darkviolet];
4452[label="141.26.177.97;9pkt 9fpkt", shape=invtriangle, color=brown];
stat431[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:1023, 211.167.180.1:*}[28.7879%]&lt;BR/&gt;{*:5554, 211.167.180.1:*}[24.6212%]&lt;BR/&gt;{*:9898, 211.167.180.1:*}[24.6212%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1023: (14.9338%)&lt;BR/&gt; 9898: (12.8544%)&lt;BR/&gt; 5554: (12.6654%)&lt;BR/&gt; 0: (5.48204%)&lt;BR/&gt; 80: (4.82042%)&gt;];
}
1241--1364[label="0.2;1pkt 1fpkt"];
1241--2247[label="0.0909091;3pkt 3fpkt"];
1241--2526[label="1;215pkt 215fpkt"];
1241--3082[label="0.0909091;3pkt 3fpkt"];
1241--3697[label="0.111111;1pkt 1fpkt"];
1241--3839[label="0.3;3pkt 3fpkt"];
1241--4452[label="0.111111;1pkt 1fpkt"];
1364--2526[label="0.2;1pkt 1fpkt"];
2247--2526[label="0.0909091;3pkt 3fpkt"];
2247--3082[label="1;33pkt 33fpkt"];
2526--3082[label="0.0909091;3pkt 3fpkt"];
2526--3697[label="0.111111;1pkt 1fpkt"];
2526--3839[label="0.3;3pkt 3fpkt"];
2526--4452[label="0.111111;1pkt 1fpkt"];
3697--4452[label="1;9pkt 9fpkt"];
3839--5014[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="211.167.180.1" src_port="1023"/>
      <filter dst_ip="211.167.180.1" src_port="9898"/>
      <filter dst_ip="211.167.180.1" src_port="5554"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942075" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_432{
style=filled;
color=gray75;
1763[label="136.170.51.193;s;159pkt 159fpkt", shape=diamond, color=yellow];
3088[label="136.170.51.193;s;143pkt 143fpkt", shape=hexagon, color=black];
stat432[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.170.51.193:25, *:*}[79.8742%]&lt;BR/&gt;{136.170.51.193:*, *:25}[20.1258%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 4425: (0.662252%)&lt;BR/&gt; 4300: (0.662252%)&lt;BR/&gt; 3460: (0.662252%)&lt;BR/&gt; 64097: (0.331126%)&gt;];
}
1763--3088[label="1;143pkt 143fpkt"];
</description>
    <slice>
      <filter src_ip="136.170.51.193" src_port="25"/>
      <filter dst_port="25" src_ip="136.170.51.193"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_433{
style=filled;
color=gray75;
2337[label="168.115.244.194;d;62pkt 62fpkt", shape=diamond, color=yellow];
3089[label="168.115.244.194;d;54pkt 54fpkt", shape=hexagon, color=black];
stat433[shape=component, label=&lt;Rules:&lt;BR/&gt;{221.38.42.175:*, 168.115.244.194:80}[35.4839%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.2759%)&lt;BR/&gt; 25: (1.72414%)&lt;BR/&gt; 63183: (0.862069%)&lt;BR/&gt; 60392: (0.862069%)&lt;BR/&gt; 59355: (0.862069%)&gt;];
}
2337--3089[label="1;54pkt 54fpkt"];
</description>
    <slice>
      <filter dst_ip="168.115.244.194" dst_port="80" src_ip="221.38.42.175"/>
    </slice>
    <from sec="1091941202" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_435{
style=filled;
color=gray75;
2040[label="0.2.63.161;d;13pkt 13fpkt", shape=diamond, color=yellow];
3093[label="0.2.63.161;d;11pkt 11fpkt", shape=hexagon, color=black];
stat435[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.125.86.58:*, 0.2.63.161:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1124: (4.16667%)&lt;BR/&gt; 1122: (4.16667%)&lt;BR/&gt; 1120: (4.16667%)&lt;BR/&gt; 1118: (4.16667%)&gt;];
}
2040--3093[label="1;11pkt 11fpkt"];
</description>
    <slice>
      <filter dst_ip="0.2.63.161" dst_port="80" src_ip="151.125.86.58"/>
    </slice>
    <from sec="1091941202" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.711294,1.2256,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_437{
style=filled;
color=gray75;
1982[label="2.41.49.161;s;79pkt 79fpkt", shape=diamond, color=yellow];
2340[label="168.115.207.64;d;80pkt 80fpkt", shape=diamond, color=yellow];
2423[label="2.41.37.231;s;58pkt 58fpkt", shape=diamond, color=yellow];
2917[label="2.41.49.161;s;79pkt 79fpkt", shape=hexagon, color=black];
3096[label="168.115.207.64;d;71pkt 71fpkt", shape=hexagon, color=black];
3934[label="2.41.49.161;79pkt 79fpkt", shape=pentagon, color=darkviolet];
3947[label="3.106.24.164;68pkt 68fpkt", shape=pentagon, color=darkviolet];
stat437[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.41.49.161:*, *:80}[35.5856%]&lt;BR/&gt;{3.106.24.164:*, *:80}[29.2793%]&lt;BR/&gt;{2.41.37.231:*, 168.115.207.64:80}[26.1261%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.5136%)&lt;BR/&gt; 52725: (0.486381%)&lt;BR/&gt; 45467: (0.486381%)&lt;BR/&gt; 45220: (0.486381%)&lt;BR/&gt; 44875: (0.486381%)&gt;];
}
1982--2340[label="0.0506329;4pkt 4fpkt"];
1982--2917[label="1;79pkt 79fpkt"];
1982--3096[label="0.056338;4pkt 4fpkt"];
1982--3934[label="1;79pkt 79fpkt"];
2340--2423[label="1;58pkt 58fpkt"];
2340--2917[label="0.0506329;4pkt 4fpkt"];
2340--3096[label="1;71pkt 71fpkt"];
2340--3406[label="0.037037;1pkt 1fpkt"];
2340--3417[label="0.0625;1pkt 1fpkt"];
2340--3564[label="0.05;1pkt 1fpkt"];
2340--3570[label="0.0384615;1pkt 1fpkt"];
2340--3573[label="0.0555556;1pkt 1fpkt"];
2340--3934[label="0.0506329;4pkt 4fpkt"];
2340--3947[label="0.0147059;1pkt 1fpkt"];
2340--4187[label="0.0909091;3pkt 3fpkt"];
2340--4364[label="0.0526316;1pkt 1fpkt"];
2340--4367[label="0.0384615;1pkt 1fpkt"];
2340--4368[label="0.0555556;1pkt 1fpkt"];
2340--4789[label="0.0909091;3pkt 3fpkt"];
2423--3096[label="0.87931;51pkt 51fpkt"];
2917--3096[label="0.056338;4pkt 4fpkt"];
2917--3934[label="1;79pkt 79fpkt"];
3096--3406[label="0.037037;1pkt 1fpkt"];
3096--3417[label="0.0625;1pkt 1fpkt"];
3096--3564[label="0.05;1pkt 1fpkt"];
3096--3570[label="0.0384615;1pkt 1fpkt"];
3096--3573[label="0.0555556;1pkt 1fpkt"];
3096--3934[label="0.056338;4pkt 4fpkt"];
3096--3947[label="0.0147059;1pkt 1fpkt"];
3096--4187[label="0.0909091;3pkt 3fpkt"];
3096--4364[label="0.0526316;1pkt 1fpkt"];
3096--4367[label="0.0384615;1pkt 1fpkt"];
3096--4368[label="0.0555556;1pkt 1fpkt"];
3096--4789[label="0.0909091;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="2.41.49.161"/>
      <filter dst_port="80" src_ip="3.106.24.164"/>
      <filter dst_ip="168.115.207.64" dst_port="80" src_ip="2.41.37.231"/>
    </slice>
    <from sec="1091941202" usec="0"/>
    <to sec="1091942070" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_438{
style=filled;
color=gray75;
2176[label="168.115.207.81;s;19pkt 19fpkt", shape=diamond, color=yellow];
2298[label="217.156.53.52;d;14pkt 14fpkt", shape=diamond, color=yellow];
3109[label="168.115.207.81;s;19pkt 19fpkt", shape=hexagon, color=black];
3161[label="217.156.53.52;d;14pkt 14fpkt", shape=hexagon, color=black];
stat438[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.115.207.81:*, 217.156.53.52:80}[73.6842%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 49792: (3.0303%)&lt;BR/&gt; 49791: (3.0303%)&lt;BR/&gt; 49789: (3.0303%)&lt;BR/&gt; 49788: (3.0303%)&gt;];
}
2176--2298[label="1;14pkt 14fpkt"];
2176--3109[label="1;19pkt 19fpkt"];
2176--3161[label="1;14pkt 14fpkt"];
2298--3109[label="1;14pkt 14fpkt"];
2298--3161[label="1;14pkt 14fpkt"];
3109--3161[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter dst_ip="217.156.53.52" dst_port="80" src_ip="168.115.207.81"/>
    </slice>
    <from sec="1091941272" usec="0"/>
    <to sec="1091941893" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_439{
style=filled;
color=gray75;
2375[label="213.128.55.67;s;17pkt 17fpkt", shape=diamond, color=yellow];
3116[label="213.128.55.67;s;12pkt 12fpkt", shape=hexagon, color=black];
stat439[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.128.55.67:80, 205.248.185.116:*}[82.3529%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 64550: (3.44828%)&lt;BR/&gt; 58440: (3.44828%)&lt;BR/&gt; 52512: (3.44828%)&lt;BR/&gt; 2027: (3.44828%)&gt;];
}
2375--3116[label="1;12pkt 12fpkt"];
</description>
    <slice>
      <filter dst_ip="205.248.185.116" src_ip="213.128.55.67" src_port="80"/>
    </slice>
    <from sec="1091941708" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.711294,1.2256,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_440{
style=filled;
color=gray75;
2384[label="209.27.9.193;d;1pkt 1fpkt", shape=diamond, color=yellow];
2387[label="205.242.18.212;s;1pkt 1fpkt", shape=diamond, color=yellow];
3119[label="205.242.18.212;s;1pkt 1fpkt", shape=hexagon, color=black];
4110[label="205.242.18.212;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat440[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.242.18.212:3641, 209.27.9.193:14411}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 14411: (50%)&lt;BR/&gt; 3641: (50%)&gt;];
}
2384--2387[label="1;1pkt 1fpkt"];
2384--3119[label="1;1pkt 1fpkt"];
2384--4110[label="1;1pkt 1fpkt"];
2387--3119[label="1;1pkt 1fpkt"];
2387--4110[label="1;1pkt 1fpkt"];
3119--4110[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="209.27.9.193" dst_port="14411" src_ip="205.242.18.212" src_port="3641"/>
    </slice>
    <from sec="1091941810" usec="0"/>
    <to sec="1091941939" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_441{
style=filled;
color=gray75;
2324[label="141.26.31.139;d;85pkt 85fpkt", shape=diamond, color=yellow];
3129[label="141.26.31.139;d;85pkt 85fpkt", shape=hexagon, color=black];
stat441[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 141.26.31.139:0}[30.5882%]&lt;BR/&gt;{202.70.184.174:1863, 141.26.31.139:*}[25.8824%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (30.5882%)&lt;BR/&gt; 1863: (25.8824%)&lt;BR/&gt; 1039: (8.23529%)&lt;BR/&gt; 50199: (0.588235%)&lt;BR/&gt; 33187: (0.588235%)&gt;];
}
2324--3129[label="1;85pkt 85fpkt"];
2324--3282[label="0.0117647;1pkt 1fpkt"];
2324--3328[label="0.0117647;1pkt 1fpkt"];
2324--4736[label="0.0117647;1pkt 1fpkt"];
2324--5137[label="0.0117647;1pkt 1fpkt"];
3129--3282[label="0.0117647;1pkt 1fpkt"];
3129--3328[label="0.0117647;1pkt 1fpkt"];
3129--4736[label="0.0117647;1pkt 1fpkt"];
3129--5137[label="0.0117647;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="141.26.31.139" src_ip="202.70.184.174" src_port="1863"/>
      <filter dst_ip="141.26.31.139"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_442{
style=filled;
color=gray75;
1257[label="17.136.12.230;d;1936pkt 1936fpkt", shape=diamond, color=yellow];
3132[label="17.136.12.230;d;1936pkt 1936fpkt", shape=hexagon, color=black];
stat442[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 17.136.12.230:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1257--3132[label="1;1936pkt 1936fpkt"];
</description>
    <slice>
      <filter dst_ip="17.136.12.230"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_444{
style=filled;
color=gray75;
2046[label="141.26.2.144;d;419pkt 419fpkt", shape=diamond, color=yellow];
3143[label="141.26.2.144;d;419pkt 419fpkt", shape=hexagon, color=black];
stat444[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:25, 141.26.2.144:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 33631: (0.119332%)&lt;BR/&gt; 33630: (0.119332%)&lt;BR/&gt; 33629: (0.119332%)&lt;BR/&gt; 33628: (0.119332%)&gt;];
}
2046--3143[label="1;419pkt 419fpkt"];
</description>
    <slice>
      <filter dst_ip="141.26.2.144" src_port="25"/>
    </slice>
    <from sec="1091941202" usec="0"/>
    <to sec="1091941988" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_447{
style=filled;
color=gray75;
1775[label="151.125.61.18;d;79pkt 79fpkt", shape=diamond, color=yellow];
1776[label="218.174.176.225;s;79pkt 79fpkt", shape=diamond, color=yellow];
2808[label="218.174.176.225;s;79pkt 79fpkt", shape=hexagon, color=black];
3147[label="151.125.61.18;d;79pkt 79fpkt", shape=hexagon, color=black];
stat447[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.174.176.225:80, 151.125.61.18:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 42445: (0.632911%)&lt;BR/&gt; 42419: (0.632911%)&lt;BR/&gt; 42393: (0.632911%)&lt;BR/&gt; 42366: (0.632911%)&gt;];
}
1775--1776[label="1;79pkt 79fpkt"];
1775--2808[label="1;79pkt 79fpkt"];
1775--3147[label="1;79pkt 79fpkt"];
1775--3264[label="0.0632911;5pkt 5fpkt"];
1775--3311[label="0.0506329;4pkt 4fpkt"];
1775--3319[label="0.0632911;5pkt 5fpkt"];
1775--3337[label="0.0506329;4pkt 4fpkt"];
1775--3344[label="0.0632911;5pkt 5fpkt"];
1775--3347[label="0.0506329;4pkt 4fpkt"];
1776--2808[label="1;79pkt 79fpkt"];
1776--3147[label="1;79pkt 79fpkt"];
1776--3264[label="0.0632911;5pkt 5fpkt"];
1776--3311[label="0.0506329;4pkt 4fpkt"];
1776--3319[label="0.0632911;5pkt 5fpkt"];
1776--3337[label="0.0506329;4pkt 4fpkt"];
1776--3344[label="0.0632911;5pkt 5fpkt"];
1776--3347[label="0.0506329;4pkt 4fpkt"];
2808--3147[label="1;79pkt 79fpkt"];
2808--3264[label="0.0632911;5pkt 5fpkt"];
2808--3311[label="0.0506329;4pkt 4fpkt"];
2808--3319[label="0.0632911;5pkt 5fpkt"];
2808--3337[label="0.0506329;4pkt 4fpkt"];
2808--3344[label="0.0632911;5pkt 5fpkt"];
2808--3347[label="0.0506329;4pkt 4fpkt"];
3147--3264[label="0.0632911;5pkt 5fpkt"];
3147--3311[label="0.0506329;4pkt 4fpkt"];
3147--3319[label="0.0632911;5pkt 5fpkt"];
3147--3337[label="0.0506329;4pkt 4fpkt"];
3147--3344[label="0.0632911;5pkt 5fpkt"];
3147--3347[label="0.0506329;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="151.125.61.18" src_ip="218.174.176.225" src_port="80"/>
    </slice>
    <from sec="1091941203" usec="0"/>
    <to sec="1091942024" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_448{
style=filled;
color=gray75;
2070[label="151.125.182.156;s;72pkt 72fpkt", shape=diamond, color=yellow];
3153[label="151.125.182.156;s;72pkt 72fpkt", shape=hexagon, color=black];
stat448[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.125.182.156:*, 1.68.204.7:80}[22.2222%]&lt;BR/&gt;{151.125.182.156:*, 1.68.204.6:80}[20.8333%]&lt;BR/&gt;{151.125.182.156:*, 201.42.151.13:80}[20.8333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.6111%)&lt;BR/&gt; 5050: (0.694444%)&lt;BR/&gt; 4865: (0.694444%)&lt;BR/&gt; 4864: (0.694444%)&lt;BR/&gt; 4863: (0.694444%)&gt;];
}
2070--3153[label="1;72pkt 72fpkt"];
</description>
    <slice>
      <filter dst_ip="1.68.204.7" dst_port="80" src_ip="151.125.182.156"/>
      <filter dst_ip="201.42.151.13" dst_port="80" src_ip="151.125.182.156"/>
      <filter dst_ip="1.68.204.6" dst_port="80" src_ip="151.125.182.156"/>
    </slice>
    <from sec="1091941217" usec="0"/>
    <to sec="1091942013" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_449{
style=filled;
color=gray75;
1769[label="204.40.43.85;s;109pkt 109fpkt", shape=diamond, color=yellow];
1980[label="213.43.142.159;d;46pkt 46fpkt", shape=diamond, color=yellow];
2289[label="141.26.185.172;s;43pkt 43fpkt", shape=diamond, color=yellow];
2824[label="213.43.142.159;d;20pkt 20fpkt", shape=hexagon, color=black];
3154[label="141.26.185.172;s;43pkt 43fpkt", shape=hexagon, color=black];
stat449[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.40.43.85:25, *:*}[46.7105%]&lt;BR/&gt;{*:*, 213.43.142.159:443}[30.2632%]&lt;BR/&gt;{141.26.185.172:*, *:*}[28.2895%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (25.0958%)&lt;BR/&gt; 25: (24.5211%)&lt;BR/&gt; 23100: (0.766284%)&lt;BR/&gt; 23095: (0.766284%)&lt;BR/&gt; 23092: (0.766284%)&gt;];
}
1769--1928[label="0.00917431;1pkt 1fpkt"];
1769--1980[label="0.586957;27pkt 27fpkt"];
1769--2824[label="0.6;12pkt 12fpkt"];
1980--2289[label="0.44186;19pkt 19fpkt"];
1980--2824[label="1;20pkt 20fpkt"];
1980--3154[label="0.44186;19pkt 19fpkt"];
2289--2824[label="0.4;8pkt 8fpkt"];
2289--3154[label="1;43pkt 43fpkt"];
2824--3154[label="0.4;8pkt 8fpkt"];
</description>
    <slice>
      <filter src_ip="141.26.185.172"/>
      <filter src_ip="204.40.43.85" src_port="25"/>
      <filter dst_ip="213.43.142.159" dst_port="443"/>
    </slice>
    <from sec="1091941203" usec="0"/>
    <to sec="1091942022" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,010,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_450{
style=filled;
color=gray75;
2078[label="206.126.29.200;s;452pkt 452fpkt", shape=diamond, color=yellow];
3156[label="206.126.29.200;s;452pkt 452fpkt", shape=hexagon, color=black];
stat450[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.126.29.200:*, *:135}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 3738: (0.331858%)&lt;BR/&gt; 3733: (0.331858%)&lt;BR/&gt; 3324: (0.331858%)&lt;BR/&gt; 4646: (0.221239%)&gt;];
}
2078--3156[label="1;452pkt 452fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="206.126.29.200"/>
    </slice>
    <from sec="1091941301" usec="0"/>
    <to sec="1091941866" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.773242,1.19457,999,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_451{
style=filled;
color=gray75;
2450[label="5.249.131.93;s;83pkt 83fpkt", shape=diamond, color=yellow];
2451[label="168.115.200.149;d;84pkt 84fpkt", shape=diamond, color=yellow];
3158[label="5.249.131.93;s;83pkt 83fpkt", shape=hexagon, color=black];
3159[label="168.115.200.149;d;84pkt 84fpkt", shape=hexagon, color=black];
3682[label="5.249.131.93;95pkt 95fpkt", shape=pentagon, color=darkviolet];
4442[label="5.249.131.93;95pkt 95fpkt", shape=invtriangle, color=brown];
stat451[shape=component, label=&lt;Rules:&lt;BR/&gt;{5.249.131.93:6667, 168.115.200.149:*}[98.9583%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (49.8092%)&lt;BR/&gt; 1027: (0.763359%)&lt;BR/&gt; 1124: (0.572519%)&lt;BR/&gt; 1123: (0.572519%)&lt;BR/&gt; 1122: (0.572519%)&gt;];
}
2450--2451[label="1;83pkt 83fpkt"];
2450--3158[label="1;83pkt 83fpkt"];
2450--3159[label="1;83pkt 83fpkt"];
2450--3682[label="1;83pkt 83fpkt"];
2450--4442[label="1;83pkt 83fpkt"];
2451--3158[label="1;83pkt 83fpkt"];
2451--3159[label="1;84pkt 84fpkt"];
2451--3682[label="0.988095;83pkt 83fpkt"];
2451--4442[label="0.988095;83pkt 83fpkt"];
3158--3159[label="1;83pkt 83fpkt"];
3158--3682[label="1;83pkt 83fpkt"];
3158--4442[label="1;83pkt 83fpkt"];
3159--3682[label="0.988095;83pkt 83fpkt"];
3159--4442[label="0.988095;83pkt 83fpkt"];
3682--4442[label="1;95pkt 95fpkt"];
</description>
    <slice>
      <filter dst_ip="168.115.200.149" src_ip="5.249.131.93" src_port="6667"/>
    </slice>
    <from sec="1091941415" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,010,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_452{
style=filled;
color=gray75;
2184[label="164.245.211.27;s;533pkt 533fpkt", shape=diamond, color=yellow];
3160[label="164.245.211.27;s;533pkt 533fpkt", shape=hexagon, color=black];
stat452[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.245.211.27:*, *:135}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 3271: (0.281426%)&lt;BR/&gt; 1984: (0.281426%)&lt;BR/&gt; 4831: (0.187617%)&lt;BR/&gt; 4784: (0.187617%)&gt;];
}
2184--3160[label="1;533pkt 533fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="164.245.211.27"/>
    </slice>
    <from sec="1091941430" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_453{
style=filled;
color=gray75;
2373[label="82.41.13.8;d;1pkt 1fpkt", shape=diamond, color=yellow];
3166[label="82.41.13.8;d;1pkt 1fpkt", shape=hexagon, color=black];
stat453[shape=component, label=&lt;Rules:&lt;BR/&gt;{174.104.249.56:1724, 82.41.13.8:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1724: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
2373--3166[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="82.41.13.8" dst_port="80" src_ip="174.104.249.56" src_port="1724"/>
    </slice>
    <from sec="1091941665" usec="0"/>
    <to sec="1091941945" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_454{
style=filled;
color=gray75;
2485[label="136.171.66.84;d;2pkt 2fpkt", shape=diamond, color=yellow];
3177[label="136.171.66.84;d;2pkt 2fpkt", shape=hexagon, color=black];
stat454[shape=component, label=&lt;Rules:&lt;BR/&gt;{0.20.46.15:58446, 136.171.66.84:80}[50%]&lt;BR/&gt;{0.20.47.32:50460, 136.171.66.84:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 58446: (25%)&lt;BR/&gt; 50460: (25%)&gt;];
}
2485--3177[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="136.171.66.84" dst_port="80" src_ip="0.20.47.32" src_port="50460"/>
      <filter dst_ip="136.171.66.84" dst_port="80" src_ip="0.20.46.15" src_port="58446"/>
    </slice>
    <from sec="1091941928" usec="0"/>
    <to sec="1091942006" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.773242,1.19457,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_467{
style=filled;
color=gray75;
1549[label="205.242.0.200;s;44pkt 44fpkt", shape=diamond, color=yellow];
1736[label="151.125.158.3;s;99pkt 99fpkt", shape=diamond, color=yellow];
1780[label="2.229.65.137;d;84pkt 84fpkt", shape=diamond, color=yellow];
2594[label="205.242.0.200;s;44pkt 44fpkt", shape=hexagon, color=black];
2810[label="2.229.65.137;d;45pkt 45fpkt", shape=hexagon, color=black];
3659[label="141.158.236.86;46pkt 46fpkt", shape=pentagon, color=darkviolet];
3841[label="205.242.155.134;13pkt 13fpkt", shape=pentagon, color=darkviolet];
4426[label="141.158.236.86;46pkt 46fpkt", shape=invtriangle, color=brown];
4552[label="205.242.155.134;13pkt 13fpkt", shape=invtriangle, color=brown];
stat467[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.125.158.3:80, *:*}[42.4242%]&lt;BR/&gt;{*:80, 2.229.65.137:*}[36.7965%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.8479%)&lt;BR/&gt; 0: (2.07373%)&lt;BR/&gt; 60813: (0.460829%)&lt;BR/&gt; 60513: (0.460829%)&lt;BR/&gt; 60340: (0.460829%)&gt;];
}
1549--1553[label="1;10pkt 10fpkt"];
1549--1780[label="0.386364;17pkt 17fpkt"];
1549--2594[label="1;44pkt 44fpkt"];
1549--2810[label="0.204545;9pkt 9fpkt"];
1549--3264[label="0.136364;6pkt 6fpkt"];
1549--3311[label="0.0227273;1pkt 1fpkt"];
1549--3319[label="0.136364;6pkt 6fpkt"];
1549--3337[label="0.0227273;1pkt 1fpkt"];
1549--3344[label="0.136364;6pkt 6fpkt"];
1549--3347[label="0.0227273;1pkt 1fpkt"];
1736--1780[label="0.190476;16pkt 16fpkt"];
1736--2020[label="0.666667;2pkt 2fpkt"];
1736--2810[label="0.133333;6pkt 6fpkt"];
1736--3264[label="0.0606061;6pkt 6fpkt"];
1736--3311[label="0.0909091;9pkt 9fpkt"];
1736--3319[label="0.0606061;6pkt 6fpkt"];
1736--3337[label="0.0909091;9pkt 9fpkt"];
1736--3344[label="0.0606061;6pkt 6fpkt"];
1736--3347[label="0.0909091;9pkt 9fpkt"];
1780--1917[label="0.0119048;1pkt 1fpkt"];
1780--2594[label="0.386364;17pkt 17fpkt"];
1780--2810[label="1;45pkt 45fpkt"];
1780--3264[label="0.107143;9pkt 9fpkt"];
1780--3311[label="0.0833333;7pkt 7fpkt"];
1780--3319[label="0.107143;9pkt 9fpkt"];
1780--3337[label="0.0833333;7pkt 7fpkt"];
1780--3344[label="0.107143;9pkt 9fpkt"];
1780--3347[label="0.0833333;7pkt 7fpkt"];
1780--3659[label="0.304348;14pkt 14fpkt"];
1780--3841[label="0.615385;8pkt 8fpkt"];
1780--4426[label="0.304348;14pkt 14fpkt"];
1780--4552[label="0.615385;8pkt 8fpkt"];
2594--2810[label="0.204545;9pkt 9fpkt"];
2594--3264[label="0.136364;6pkt 6fpkt"];
2594--3311[label="0.0227273;1pkt 1fpkt"];
2594--3319[label="0.136364;6pkt 6fpkt"];
2594--3337[label="0.0227273;1pkt 1fpkt"];
2594--3344[label="0.136364;6pkt 6fpkt"];
2594--3347[label="0.0227273;1pkt 1fpkt"];
2810--3264[label="0.2;9pkt 9fpkt"];
2810--3319[label="0.2;9pkt 9fpkt"];
2810--3344[label="0.2;9pkt 9fpkt"];
2810--3659[label="0.155556;7pkt 7fpkt"];
2810--3841[label="0.307692;4pkt 4fpkt"];
2810--4426[label="0.155556;7pkt 7fpkt"];
2810--4552[label="0.307692;4pkt 4fpkt"];
3659--4426[label="1;46pkt 46fpkt"];
3841--4552[label="1;13pkt 13fpkt"];
</description>
    <slice>
      <filter src_ip="151.125.158.3" src_port="80"/>
      <filter dst_ip="2.229.65.137" src_port="80"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="204.244.111.5"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.179.206.6"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="2.72.97.16"/>
    </slice>
    <from sec="1091941397" usec="0"/>
    <to sec="1091941678" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="81.129.128.16"/>
    </slice>
    <from sec="1091941475" usec="0"/>
    <to sec="1091942083" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="3.106.25.17"/>
    </slice>
    <from sec="1091941410" usec="0"/>
    <to sec="1091942077" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="0.108.111.19"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.581881,1.25082,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_490{
style=filled;
color=gray75;
1381[label="204.40.42.22;s;2pkt 2fpkt", shape=diamond, color=yellow];
3431[label="204.40.42.22;3pkt 3fpkt", shape=pentagon, color=darkviolet];
stat490[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.40.42.22:0, 215.210.68.188:0}[33.3333%]&lt;BR/&gt;{204.40.42.22:21, 205.78.65.30:33325}[33.3333%]&lt;BR/&gt;{204.40.42.22:36268, 205.78.65.30:33326}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 36268: (20%)&lt;BR/&gt; 33326: (20%)&lt;BR/&gt; 33325: (20%)&lt;BR/&gt; 21: (20%)&lt;BR/&gt; 0: (20%)&gt;];
}
1381--3431[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="205.78.65.30" dst_port="33326" src_ip="204.40.42.22" src_port="36268"/>
      <filter dst_ip="205.78.65.30" dst_port="33325" src_ip="204.40.42.22" src_port="21"/>
      <filter dst_ip="215.210.68.188" src_ip="204.40.42.22"/>
    </slice>
    <from sec="1091941240" usec="0"/>
    <to sec="1091941577" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.656163,1.22043,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_492{
style=filled;
color=gray75;
1415[label="193.197.82.25;s;1pkt 1fpkt", shape=diamond, color=yellow];
3442[label="193.197.82.25;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4280[label="193.197.82.25;1pkt 1fpkt", shape=invtriangle, color=brown];
stat492[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.197.82.25:80, 151.125.156.172:27513}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 27513: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
1415--2531[label="1;1pkt 1fpkt"];
1415--3442[label="1;1pkt 1fpkt"];
1415--4280[label="1;1pkt 1fpkt"];
3442--4280[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="151.125.156.172" dst_port="27513" src_ip="193.197.82.25" src_port="80"/>
    </slice>
    <from sec="1091941283" usec="0"/>
    <to sec="1091941637" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="204.51.22.26"/>
    </slice>
    <from sec="1091941237" usec="0"/>
    <to sec="1091941442" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="5.128.191.28"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="0.157.154.31"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.581881,1.25082,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_496{
style=filled;
color=gray75;
2300[label="141.26.28.154;d;5pkt 5fpkt", shape=diamond, color=yellow];
3465[label="0.20.9.32;2pkt 2fpkt", shape=pentagon, color=darkviolet];
stat496[shape=component, label=&lt;Rules:&lt;BR/&gt;{3.106.25.69:*, 141.26.28.154:80}[33.3333%]&lt;BR/&gt;{0.20.9.32:*, *:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 55645: (14.2857%)&lt;BR/&gt; 59596: (7.14286%)&lt;BR/&gt; 57485: (7.14286%)&lt;BR/&gt; 49455: (7.14286%)&gt;];
}
2300--3465[label="0.5;1pkt 1fpkt"];
2300--3545[label="0.2;1pkt 1fpkt"];
2300--3603[label="0.4;2pkt 2fpkt"];
2300--4301[label="0.333333;1pkt 1fpkt"];
3465--4301[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="0.20.9.32"/>
      <filter dst_ip="141.26.28.154" dst_port="80" src_ip="3.106.25.69"/>
    </slice>
    <from sec="1091941493" usec="0"/>
    <to sec="1091942006" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="151.125.174.33"/>
    </slice>
    <from sec="1091941230" usec="0"/>
    <to sec="1091942069" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="206.55.129.35"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="174.104.182.35"/>
    </slice>
    <from sec="1091941352" usec="0"/>
    <to sec="1091941555" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.711294,1.2256,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_501{
style=filled;
color=gray75;
1543[label="205.242.18.234;s;200pkt 200fpkt", shape=diamond, color=yellow];
1985[label="5.128.191.119;d;217pkt 217fpkt", shape=diamond, color=yellow];
2128[label="141.26.45.219;s;203pkt 203fpkt", shape=diamond, color=yellow];
2293[label="174.104.183.36;s;103pkt 103fpkt", shape=diamond, color=yellow];
2381[label="0.194.151.238;d;24pkt 24fpkt", shape=diamond, color=yellow];
2398[label="137.212.5.89;d;18pkt 18fpkt", shape=diamond, color=yellow];
3110[label="5.128.191.119;d;196pkt 196fpkt", shape=hexagon, color=black];
3124[label="137.212.5.89;d;18pkt 18fpkt", shape=hexagon, color=black];
3486[label="174.104.183.36;110pkt 110fpkt", shape=pentagon, color=darkviolet];
stat501[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.242.18.234:*, *:80}[34.9237%]&lt;BR/&gt;{174.104.183.36:*, *:80}[20.9924%]&lt;BR/&gt;{141.26.45.219:*, 5.128.191.119:80}[20.4198%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.0817%)&lt;BR/&gt; 5555: (0.642792%)&lt;BR/&gt; 2511: (0.229568%)&lt;BR/&gt; 2507: (0.229568%)&lt;BR/&gt; 2140: (0.229568%)&gt;];
}
1543--1985[label="0.335;67pkt 67fpkt"];
1543--2381[label="1;24pkt 24fpkt"];
1543--3110[label="0.341837;67pkt 67fpkt"];
1985--2128[label="0.527094;107pkt 107fpkt"];
1985--2293[label="0.378641;39pkt 39fpkt"];
1985--2446[label="0.00518135;1pkt 1fpkt"];
1985--3110[label="1;196pkt 196fpkt"];
1985--3486[label="0.354545;39pkt 39fpkt"];
2128--2398[label="0.666667;12pkt 12fpkt"];
2128--3110[label="0.545918;107pkt 107fpkt"];
2128--3124[label="0.666667;12pkt 12fpkt"];
2293--3110[label="0.194175;20pkt 20fpkt"];
2293--3486[label="0.990291;102pkt 102fpkt"];
2398--2419[label="0.222222;4pkt 4fpkt"];
2398--3124[label="1;18pkt 18fpkt"];
3110--3486[label="0.181818;20pkt 20fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="205.242.18.234"/>
      <filter dst_port="80" src_ip="174.104.183.36"/>
      <filter dst_ip="5.128.191.119" dst_port="80" src_ip="141.26.45.219"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,001,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="81.18.73.39"/>
    </slice>
    <from sec="1091941582" usec="0"/>
    <to sec="1091941585" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.782731,1.28227,001,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_503{
style=filled;
color=gray75;
364[label="214.42.236.183s;342pkt 342fpkt", shape=rectangle, color=red];
766[label="214.42.236.183s;342pkt 342fpkt", shape=ellipse, color=green];
4024[label="214.42.236.183;254pkt 254fpkt", shape=pentagon, color=darkviolet];
stat503[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.42.236.183:*, *:9898}[74.269%]&lt;BR/&gt;{211.96.143.41:*, *:9898}[25.731%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 4340: (0.159915%)&lt;BR/&gt; 4335: (0.159915%)&lt;BR/&gt; 4334: (0.159915%)&lt;BR/&gt; 4333: (0.159915%)&gt;];
}
364--766[label="1;342pkt 342fpkt"];
364--1093[label="1;342pkt 342fpkt"];
364--3500[label="0.25731;88pkt 88fpkt"];
364--4024[label="1;254pkt 254fpkt"];
766--1093[label="1;342pkt 342fpkt"];
766--3500[label="0.25731;88pkt 88fpkt"];
766--4024[label="1;254pkt 254fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="214.42.236.183"/>
      <filter dst_port="9898" src_ip="211.96.143.41"/>
    </slice>
    <from sec="1091941796" usec="0"/>
    <to sec="1091941800" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.66.148.42"/>
    </slice>
    <from sec="1091941364" usec="0"/>
    <to sec="1091941444" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="0.111.213.42"/>
    </slice>
    <from sec="1091941455" usec="0"/>
    <to sec="1091941944" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.773242,1.19457,999,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_506{
style=filled;
color=gray75;
2008[label="204.40.45.43;s;169pkt 169fpkt", shape=diamond, color=yellow];
2949[label="204.40.45.43;s;121pkt 121fpkt", shape=hexagon, color=black];
3503[label="204.40.45.43;184pkt 184fpkt", shape=pentagon, color=darkviolet];
4324[label="204.40.45.43;184pkt 184fpkt", shape=invtriangle, color=brown];
stat506[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.40.45.43:25, *:*}[51.3514%]&lt;BR/&gt;{204.40.45.43:*, *:113}[48.6486%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (25.6839%)&lt;BR/&gt; 113: (24.3161%)&lt;BR/&gt; 61521: (0.303951%)&lt;BR/&gt; 60844: (0.303951%)&lt;BR/&gt; 60061: (0.303951%)&gt;];
}
2008--2949[label="1;121pkt 121fpkt"];
2008--3503[label="0.994083;168pkt 168fpkt"];
2008--4324[label="0.994083;168pkt 168fpkt"];
2949--3503[label="1;121pkt 121fpkt"];
2949--4324[label="1;121pkt 121fpkt"];
3503--4324[label="1;184pkt 184fpkt"];
</description>
    <slice>
      <filter src_ip="204.40.45.43" src_port="25"/>
      <filter dst_port="113" src_ip="204.40.45.43"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,001,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.70.164.43"/>
    </slice>
    <from sec="1091942057" usec="0"/>
    <to sec="1091942059" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="213.116.19.45"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.723381,1.26679,001,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_509{
style=filled;
color=gray75;
148[label="5.59.41.46s;366pkt 366fpkt", shape=rectangle, color=red];
3517[label="5.59.41.46;207pkt 207fpkt", shape=pentagon, color=darkviolet];
3698[label="215.216.10.98;159pkt 159fpkt", shape=pentagon, color=darkviolet];
4333[label="5.59.41.46;206pkt 206fpkt", shape=invtriangle, color=brown];
stat509[shape=component, label=&lt;Rules:&lt;BR/&gt;{5.59.41.46:*, *:9898}[29.7814%]&lt;BR/&gt;{5.59.41.46:*, *:5554}[26.776%]&lt;BR/&gt;{215.216.10.98:*, *:9898}[22.6776%]&lt;BR/&gt;{215.216.10.98:*, *:5554}[20.765%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (26.226%)&lt;BR/&gt; 5554: (23.774%)&lt;BR/&gt; 61543: (0.159915%)&lt;BR/&gt; 61542: (0.159915%)&lt;BR/&gt; 61541: (0.159915%)&gt;];
}
148--3517[label="1;207pkt 207fpkt"];
148--3698[label="1;159pkt 159fpkt"];
148--4333[label="1;206pkt 206fpkt"];
3517--4333[label="1;206pkt 206fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="5.59.41.46"/>
      <filter dst_port="5554" src_ip="5.59.41.46"/>
      <filter dst_port="9898" src_ip="215.216.10.98"/>
      <filter dst_port="5554" src_ip="215.216.10.98"/>
    </slice>
    <from sec="1091941723" usec="0"/>
    <to sec="1091941727" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.64.214.50"/>
    </slice>
    <from sec="1091941217" usec="0"/>
    <to sec="1091942043" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="18.219.161.52"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_513{
style=filled;
color=gray75;
3567[label="206.69.180.61;272pkt 272fpkt", shape=pentagon, color=darkviolet];
stat513[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.69.180.61:*, *:445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (50%)&lt;BR/&gt; 1092: (0.551471%)&lt;BR/&gt; 3603: (0.367647%)&lt;BR/&gt; 3150: (0.367647%)&lt;BR/&gt; 2997: (0.367647%)&gt;];
}
</description>
    <slice>
      <filter dst_port="445" src_ip="206.69.180.61"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091941383" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="81.212.9.63"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,011,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="204.40.40.63"/>
    </slice>
    <from sec="1091941203" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.656747,1.2961,001,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_516{
style=filled;
color=gray75;
175[label="215.207.232.63s;130pkt 130fpkt", shape=rectangle, color=red];
3578[label="215.207.232.63;130pkt 130fpkt", shape=pentagon, color=darkviolet];
stat516[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.207.232.63:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 4862: (0.384615%)&lt;BR/&gt; 4858: (0.384615%)&lt;BR/&gt; 4856: (0.384615%)&lt;BR/&gt; 4855: (0.384615%)&gt;];
}
175--3578[label="1;130pkt 130fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="215.207.232.63"/>
    </slice>
    <from sec="1091941690" usec="0"/>
    <to sec="1091941691" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="136.171.144.67"/>
    </slice>
    <from sec="1091941357" usec="0"/>
    <to sec="1091941979" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="168.115.206.67"/>
    </slice>
    <from sec="1091941228" usec="0"/>
    <to sec="1091942100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.723381,1.26679,002,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_520{
style=filled;
color=gray75;
65[label="215.197.98.68s;124pkt 124fpkt", shape=rectangle, color=red];
3601[label="215.197.98.68;255pkt 255fpkt", shape=pentagon, color=darkviolet];
4387[label="215.197.98.68;255pkt 255fpkt", shape=invtriangle, color=brown];
stat520[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.197.98.68:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
65--3601[label="1;124pkt 124fpkt"];
65--4387[label="1;124pkt 124fpkt"];
3601--4387[label="1;255pkt 255fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="215.197.98.68" src_port="1029"/>
    </slice>
    <from sec="1091941804" usec="0"/>
    <to sec="1091941819" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.73.64.72"/>
    </slice>
    <from sec="1091941311" usec="0"/>
    <to sec="1091941548" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="118.70.36.73"/>
    </slice>
    <from sec="1091941723" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="193.197.82.78"/>
    </slice>
    <from sec="1091942039" usec="0"/>
    <to sec="1091942095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.54.151.78"/>
    </slice>
    <from sec="1091941835" usec="0"/>
    <to sec="1091942027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.711294,1.2256,504,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_525{
style=filled;
color=gray75;
2182[label="202.70.42.163;d;10pkt 10fpkt", shape=diamond, color=yellow];
3044[label="202.70.42.163;d;10pkt 10fpkt", shape=hexagon, color=black];
3634[label="136.171.176.79;6pkt 6fpkt", shape=pentagon, color=darkviolet];
stat525[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 202.70.42.163:443}[46.1538%]&lt;BR/&gt;{*:*, 202.70.42.163:80}[30.7692%]&lt;BR/&gt;{136.171.176.79:*, *:80}[30.7692%]&lt;BR/&gt;{141.26.29.210:*, 202.70.42.163:*}[23.0769%]&lt;BR/&gt;{136.171.176.79:*, 202.70.42.163:*}[23.0769%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (26.9231%)&lt;BR/&gt; 80: (23.0769%)&lt;BR/&gt; 3037: (5.76923%)&lt;BR/&gt; 3032: (5.76923%)&lt;BR/&gt; 3028: (5.76923%)&gt;];
}
2182--3044[label="1;10pkt 10fpkt"];
2182--3634[label="0.5;3pkt 3fpkt"];
3044--3634[label="0.5;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="202.70.42.163" src_ip="136.171.176.79"/>
      <filter dst_port="80" src_ip="136.171.176.79"/>
      <filter dst_ip="202.70.42.163" src_ip="141.26.29.210"/>
      <filter dst_ip="202.70.42.163" dst_port="80"/>
      <filter dst_ip="202.70.42.163" dst_port="443"/>
    </slice>
    <from sec="1091941363" usec="0"/>
    <to sec="1091941752" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="174.104.231.79"/>
    </slice>
    <from sec="1091941357" usec="0"/>
    <to sec="1091942092" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="204.40.47.84"/>
    </slice>
    <from sec="1091941321" usec="0"/>
    <to sec="1091941600" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="151.125.183.85"/>
    </slice>
    <from sec="1091941223" usec="0"/>
    <to sec="1091942082" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.58.187.86"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="18.75.193.87"/>
    </slice>
    <from sec="1091941507" usec="0"/>
    <to sec="1091941531" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="220.138.237.87"/>
    </slice>
    <from sec="1091941203" usec="0"/>
    <to sec="1091942076" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="213.98.176.89"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="118.245.147.90"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.656747,1.2961,001,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_534{
style=filled;
color=gray75;
208[label="1.33.217.90s;274pkt 274fpkt", shape=rectangle, color=red];
3672[label="1.33.217.90;274pkt 274fpkt", shape=pentagon, color=darkviolet];
stat534[shape=component, label=&lt;Rules:&lt;BR/&gt;{1.33.217.90:*, *:9898}[50.365%]&lt;BR/&gt;{1.33.217.90:*, *:5554}[49.635%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (25.1825%)&lt;BR/&gt; 5554: (24.8175%)&lt;BR/&gt; 4000: (0.182482%)&lt;BR/&gt; 3995: (0.182482%)&lt;BR/&gt; 3989: (0.182482%)&gt;];
}
208--3672[label="1;274pkt 274fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="1.33.217.90"/>
      <filter dst_port="5554" src_ip="1.33.217.90"/>
    </slice>
    <from sec="1091941222" usec="0"/>
    <to sec="1091941225" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.711294,1.2256,010,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_536{
style=filled;
color=gray75;
2163[label="136.171.175.109;d;207pkt 207fpkt", shape=diamond, color=yellow];
3105[label="136.171.175.109;d;181pkt 181fpkt", shape=hexagon, color=black];
3689[label="0.5.132.94;4pkt 4fpkt", shape=pentagon, color=darkviolet];
stat536[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 136.171.175.109:25}[81.9048%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (41.4541%)&lt;BR/&gt; 53: (8.29082%)&lt;BR/&gt; 33701: (0.765306%)&lt;BR/&gt; 1053: (0.765306%)&lt;BR/&gt; 9898: (0.510204%)&gt;];
}
2163--2834[label="0.00966184;2pkt 2fpkt"];
2163--2925[label="0.00966184;2pkt 2fpkt"];
2163--3105[label="1;181pkt 181fpkt"];
2163--3263[label="0.00483092;1pkt 1fpkt"];
2163--3318[label="0.00483092;1pkt 1fpkt"];
2163--3343[label="0.00483092;1pkt 1fpkt"];
2163--3689[label="0.25;1pkt 1fpkt"];
2163--3810[label="0.00966184;2pkt 2fpkt"];
2163--4091[label="0.00966184;2pkt 2fpkt"];
2163--4187[label="0.030303;1pkt 1fpkt"];
2163--4527[label="0.00966184;2pkt 2fpkt"];
2163--4789[label="0.030303;1pkt 1fpkt"];
3105--3263[label="0.00552486;1pkt 1fpkt"];
3105--3318[label="0.00552486;1pkt 1fpkt"];
3105--3343[label="0.00552486;1pkt 1fpkt"];
3105--3689[label="0.25;1pkt 1fpkt"];
3105--3810[label="0.0110497;2pkt 2fpkt"];
3105--4091[label="0.0110497;2pkt 2fpkt"];
3105--4187[label="0.030303;1pkt 1fpkt"];
3105--4527[label="0.0110497;2pkt 2fpkt"];
3105--4789[label="0.030303;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="136.171.175.109" dst_port="25"/>
    </slice>
    <from sec="1091941207" usec="0"/>
    <to sec="1091942027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="19.96.190.94"/>
    </slice>
    <from sec="1091941235" usec="0"/>
    <to sec="1091941249" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="206.68.128.98"/>
    </slice>
    <from sec="1091941871" usec="0"/>
    <to sec="1091942001" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_539{
style=filled;
color=gray75;
2174[label="205.248.129.1;s;75pkt 75fpkt", shape=diamond, color=yellow];
stat539[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.248.129.1:*, *:25}[70.6667%]&lt;BR/&gt;{205.248.129.1:25, *:*}[28%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (49.3333%)&lt;BR/&gt; 0: (1.33333%)&lt;BR/&gt; 64717: (0.666667%)&lt;BR/&gt; 58678: (0.666667%)&lt;BR/&gt; 56537: (0.666667%)&gt;];
}
2174--2201[label="0.0133333;1pkt 1fpkt"];
2174--2233[label="0.25;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="205.248.129.1" src_port="25"/>
      <filter dst_port="25" src_ip="205.248.129.1"/>
    </slice>
    <from sec="1091941234" usec="0"/>
    <to sec="1091942024" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.3.134.98"/>
    </slice>
    <from sec="1091941268" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="136.171.197.98"/>
    </slice>
    <from sec="1091941450" usec="0"/>
    <to sec="1091941473" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.70.83.101"/>
    </slice>
    <from sec="1091941939" usec="0"/>
    <to sec="1091942078" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="3.45.155.102"/>
    </slice>
    <from sec="1091941262" usec="0"/>
    <to sec="1091941327" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.163.164.105"/>
    </slice>
    <from sec="1091941356" usec="0"/>
    <to sec="1091942050" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="221.90.184.105"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.581881,1.25082,504,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_546{
style=filled;
color=gray75;
2462[label="202.70.43.106;s;7pkt 7fpkt", shape=diamond, color=yellow];
3735[label="202.70.43.106;7pkt 7fpkt", shape=pentagon, color=darkviolet];
stat546[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.70.43.106:80, *:*}[42.8571%]&lt;BR/&gt;{202.70.43.106:443, 174.104.239.170:*}[28.5714%]&lt;BR/&gt;{202.70.43.106:*, 136.171.197.68:*}[28.5714%]&lt;BR/&gt;{202.70.43.106:*, 136.171.86.117:*}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (28.5714%)&lt;BR/&gt; 80: (21.4286%)&lt;BR/&gt; 30830: (7.14286%)&lt;BR/&gt; 30814: (7.14286%)&lt;BR/&gt; 4257: (7.14286%)&gt;];
}
2462--3735[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="136.171.86.117" src_ip="202.70.43.106"/>
      <filter dst_ip="136.171.197.68" src_ip="202.70.43.106"/>
      <filter src_ip="202.70.43.106" src_port="80"/>
      <filter dst_ip="174.104.239.170" src_ip="202.70.43.106" src_port="443"/>
    </slice>
    <from sec="1091941709" usec="0"/>
    <to sec="1091942084" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,001,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.167.223.110"/>
    </slice>
    <from sec="1091941249" usec="0"/>
    <to sec="1091941250" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,001,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.172.100.111"/>
    </slice>
    <from sec="1091941280" usec="0"/>
    <to sec="1091941284" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.70.186.114"/>
    </slice>
    <from sec="1091941209" usec="0"/>
    <to sec="1091942098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.30.12.116"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.4.99.117"/>
    </slice>
    <from sec="1091941212" usec="0"/>
    <to sec="1091942093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="199.191.39.125"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="118.69.244.133"/>
    </slice>
    <from sec="1091941203" usec="0"/>
    <to sec="1091942100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.581881,1.25082,010,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_558{
style=filled;
color=gray75;
2370[label="0.89.206.136;s;334pkt 334fpkt", shape=diamond, color=yellow];
3849[label="0.89.206.136;453pkt 453fpkt", shape=pentagon, color=darkviolet];
stat558[shape=component, label=&lt;Rules:&lt;BR/&gt;{0.89.206.136:*, *:135}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 3725: (0.317662%)&lt;BR/&gt; 3474: (0.317662%)&lt;BR/&gt; 4776: (0.25413%)&lt;BR/&gt; 4736: (0.25413%)&gt;];
}
2370--3849[label="1;334pkt 334fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="0.89.206.136"/>
    </slice>
    <from sec="1091941292" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="1.78.65.137"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="136.170.171.137"/>
    </slice>
    <from sec="1091941904" usec="0"/>
    <to sec="1091941940" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.581881,1.25082,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_561{
style=filled;
color=gray75;
2003[label="141.26.31.139;s;119pkt 119fpkt", shape=diamond, color=yellow];
3859[label="141.26.31.139;2pkt 2fpkt", shape=pentagon, color=darkviolet];
stat561[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.26.31.139:*, *:1863}[36.9748%]&lt;BR/&gt;{141.26.31.139:0, *:0}[36.1345%]&lt;BR/&gt;{141.26.31.139:1039, *:*}[26.0504%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (35.5372%)&lt;BR/&gt; 1863: (18.1818%)&lt;BR/&gt; 1039: (13.6364%)&lt;BR/&gt; 3544: (2.06612%)&lt;BR/&gt; 4604: (0.826446%)&gt;];
}
2003--2513[label="0.00840336;1pkt 1fpkt"];
2003--3859[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_ip="141.26.31.139" src_port="1039"/>
      <filter dst_port="1863" src_ip="141.26.31.139"/>
      <filter src_ip="141.26.31.139"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="220.187.220.139"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.70.83.142"/>
    </slice>
    <from sec="1091941269" usec="0"/>
    <to sec="1091941738" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="136.171.128.145"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.70.82.150"/>
    </slice>
    <from sec="1091941751" usec="0"/>
    <to sec="1091941915" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.1.146.152"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091941236" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.656747,1.2961,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_568{
style=filled;
color=gray75;
72[label="207.157.66.153s;139pkt 139fpkt", shape=rectangle, color=red];
3898[label="207.157.66.153;180pkt 180fpkt", shape=pentagon, color=darkviolet];
stat568[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.157.66.153:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
72--3898[label="1;139pkt 139fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="207.157.66.153" src_port="1027"/>
    </slice>
    <from sec="1091941686" usec="0"/>
    <to sec="1091941700" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.825684,1.24043,010,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_569{
style=filled;
color=gray75;
1335[label="217.91.11.154;s;579pkt 579fpkt", shape=diamond, color=yellow];
3902[label="217.91.11.154;579pkt 579fpkt", shape=pentagon, color=darkviolet];
4592[label="217.91.11.154;579pkt 579fpkt", shape=invtriangle, color=brown];
5037[label="217.91.11.154;579pkt 579fpkt", shape=invhouse, color=bisque];
stat569[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.91.11.154:*, *:445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (50%)&lt;BR/&gt; 65189: (0.259067%)&lt;BR/&gt; 8944: (0.259067%)&lt;BR/&gt; 5027: (0.259067%)&lt;BR/&gt; 4544: (0.259067%)&gt;];
}
1335--3902[label="1;579pkt 579fpkt"];
1335--4592[label="1;579pkt 579fpkt"];
1335--5037[label="1;579pkt 579fpkt"];
3902--4592[label="1;579pkt 579fpkt"];
3902--5037[label="1;579pkt 579fpkt"];
4592--5037[label="1;579pkt 579fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="217.91.11.154"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091941380" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.656163,1.22043,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_570{
style=filled;
color=gray75;
2301[label="141.26.28.154;s;5pkt 5fpkt", shape=diamond, color=yellow];
2476[label="82.3.18.59;d;1pkt 1fpkt", shape=diamond, color=yellow];
3903[label="141.26.28.154;6pkt 6fpkt", shape=pentagon, color=darkviolet];
4593[label="141.26.28.154;6pkt 6fpkt", shape=invtriangle, color=brown];
stat570[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.26.28.154:80, 2.229.65.132:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 37990: (11.1111%)&lt;BR/&gt; 59596: (8.33333%)&lt;BR/&gt; 58330: (8.33333%)&lt;BR/&gt; 55645: (8.33333%)&gt;];
}
2301--2476[label="1;1pkt 1fpkt"];
2301--3903[label="1;5pkt 5fpkt"];
2301--4593[label="1;5pkt 5fpkt"];
2476--3903[label="1;1pkt 1fpkt"];
2476--4593[label="1;1pkt 1fpkt"];
3903--4593[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="2.229.65.132" src_ip="141.26.28.154" src_port="80"/>
    </slice>
    <from sec="1091941344" usec="0"/>
    <to sec="1091942006" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="199.38.0.156"/>
    </slice>
    <from sec="1091941622" usec="0"/>
    <to sec="1091941644" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.170.171.156"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091941235" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.656747,1.2961,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_574{
style=filled;
color=gray75;
73[label="214.58.92.157s;247pkt 247fpkt", shape=rectangle, color=red];
3916[label="214.58.92.157;256pkt 256fpkt", shape=pentagon, color=darkviolet];
stat574[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.58.92.157:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
73--3916[label="1;247pkt 247fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="214.58.92.157" src_port="1025"/>
    </slice>
    <from sec="1091942005" usec="0"/>
    <to sec="1091942020" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="168.115.206.159"/>
    </slice>
    <from sec="1091941205" usec="0"/>
    <to sec="1091942009" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.581881,1.25082,010,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_577{
style=filled;
color=gray75;
1432[label="1.140.86.160;s;255pkt 255fpkt", shape=diamond, color=yellow];
3927[label="1.140.86.160;257pkt 257fpkt", shape=pentagon, color=darkviolet];
stat577[shape=component, label=&lt;Rules:&lt;BR/&gt;{1.140.86.160:*, *:135}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 60933: (0.195312%)&lt;BR/&gt; 60932: (0.195312%)&lt;BR/&gt; 60929: (0.195312%)&lt;BR/&gt; 60928: (0.195312%)&gt;];
}
1432--3927[label="1;255pkt 255fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="1.140.86.160"/>
    </slice>
    <from sec="1091941289" usec="0"/>
    <to sec="1091941726" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="118.129.194.162"/>
    </slice>
    <from sec="1091941268" usec="0"/>
    <to sec="1091941349" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="220.242.115.164"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="192.132.22.169"/>
    </slice>
    <from sec="1091941207" usec="0"/>
    <to sec="1091942099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="2.89.107.174"/>
    </slice>
    <from sec="1091941303" usec="0"/>
    <to sec="1091942022" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="213.98.178.174"/>
    </slice>
    <from sec="1091941202" usec="0"/>
    <to sec="1091942063" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,001,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.237.90.175"/>
    </slice>
    <from sec="1091941273" usec="0"/>
    <to sec="1091941277" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.825684,1.24043,010,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_584{
style=filled;
color=gray75;
1481[label="18.234.188.177;s;329pkt 329fpkt", shape=diamond, color=yellow];
4003[label="18.234.188.177;329pkt 329fpkt", shape=pentagon, color=darkviolet];
4664[label="18.234.188.177;329pkt 329fpkt", shape=invtriangle, color=brown];
5086[label="18.234.188.177;329pkt 329fpkt", shape=invhouse, color=bisque];
stat584[shape=component, label=&lt;Rules:&lt;BR/&gt;{18.234.188.177:*, *:445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (50%)&lt;BR/&gt; 2796: (0.455927%)&lt;BR/&gt; 2133: (0.455927%)&lt;BR/&gt; 1356: (0.455927%)&lt;BR/&gt; 4225: (0.303951%)&gt;];
}
1481--4003[label="1;329pkt 329fpkt"];
1481--4664[label="1;329pkt 329fpkt"];
1481--5086[label="1;329pkt 329fpkt"];
4003--4664[label="1;329pkt 329fpkt"];
4003--5086[label="1;329pkt 329fpkt"];
4664--5086[label="1;329pkt 329fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="18.234.188.177"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091941390" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.581881,1.25082,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_587{
style=filled;
color=gray75;
2236[label="136.171.69.185;s;208pkt 208fpkt", shape=diamond, color=yellow];
4031[label="136.171.69.185;235pkt 235fpkt", shape=pentagon, color=darkviolet];
stat587[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.171.69.185:*, *:25}[94.4681%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (49.7743%)&lt;BR/&gt; 35235: (0.451467%)&lt;BR/&gt; 57296: (0.225734%)&lt;BR/&gt; 35421: (0.225734%)&lt;BR/&gt; 35420: (0.225734%)&gt;];
}
2236--4031[label="1;208pkt 208fpkt"];
</description>
    <slice>
      <filter dst_port="25" src_ip="136.171.69.185"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="206.137.238.195"/>
    </slice>
    <from sec="1091941603" usec="0"/>
    <to sec="1091941627" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.53.44.196"/>
    </slice>
    <from sec="1091941774" usec="0"/>
    <to sec="1091941798" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.656747,1.2961,001,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_590{
style=filled;
color=gray75;
390[label="215.207.178.197s;227pkt 227fpkt", shape=rectangle, color=red];
4067[label="215.207.178.197;227pkt 227fpkt", shape=pentagon, color=darkviolet];
stat590[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.207.178.197:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 3898: (0.220264%)&lt;BR/&gt; 3897: (0.220264%)&lt;BR/&gt; 3896: (0.220264%)&lt;BR/&gt; 3895: (0.220264%)&gt;];
}
390--4067[label="1;227pkt 227fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="215.207.178.197"/>
    </slice>
    <from sec="1091941736" usec="0"/>
    <to sec="1091941738" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="204.235.156.202"/>
    </slice>
    <from sec="1091941230" usec="0"/>
    <to sec="1091942089" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742297,1.30529,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_592{
style=filled;
color=gray75;
1714[label="198.39.110.228;d;437pkt 437fpkt", shape=diamond, color=yellow];
2645[label="198.39.110.228;d;318pkt 318fpkt", shape=hexagon, color=black];
stat592[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 198.39.110.228:53}[94.7368%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (52.3841%)&lt;BR/&gt; 25: (1.8543%)&lt;BR/&gt; 32768: (1.39073%)&lt;BR/&gt; 32769: (1.0596%)&lt;BR/&gt; 0: (0.794702%)&gt;];
}
1714--1888[label="0.0357143;1pkt 1fpkt"];
1714--2356[label="0.03125;2pkt 2fpkt"];
1714--2359[label="0.0338983;2pkt 2fpkt"];
1714--2645[label="1;318pkt 318fpkt"];
1714--2870[label="0.0434783;1pkt 1fpkt"];
1714--3263[label="0.01373;6pkt 6fpkt"];
1714--3310[label="0.0114416;5pkt 5fpkt"];
1714--3313[label="0.0114416;5pkt 5fpkt"];
1714--3318[label="0.01373;6pkt 6fpkt"];
1714--3336[label="0.0114416;5pkt 5fpkt"];
1714--3339[label="0.0114416;5pkt 5fpkt"];
1714--3343[label="0.01373;6pkt 6fpkt"];
1714--3346[label="0.0114416;5pkt 5fpkt"];
1714--3349[label="0.0114416;5pkt 5fpkt"];
2645--2870[label="0.0434783;1pkt 1fpkt"];
2645--3263[label="0.0188679;6pkt 6fpkt"];
2645--3310[label="0.0157233;5pkt 5fpkt"];
2645--3313[label="0.0157233;5pkt 5fpkt"];
2645--3318[label="0.0188679;6pkt 6fpkt"];
2645--3336[label="0.0157233;5pkt 5fpkt"];
2645--3339[label="0.0157233;5pkt 5fpkt"];
2645--3343[label="0.0188679;6pkt 6fpkt"];
2645--3346[label="0.0157233;5pkt 5fpkt"];
2645--3349[label="0.0157233;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="198.39.110.228" dst_port="53"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,001,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="80.124.164.204"/>
    </slice>
    <from sec="1091941511" usec="0"/>
    <to sec="1091941513" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,011,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="151.125.173.204"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="168.115.195.205"/>
    </slice>
    <from sec="1091941389" usec="0"/>
    <to sec="1091942058" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.711294,1.2256,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_598{
style=filled;
color=gray75;
1754[label="141.26.185.170;d;266pkt 266fpkt", shape=diamond, color=yellow];
2255[label="151.125.158.150;d;69pkt 69fpkt", shape=diamond, color=yellow];
2957[label="141.26.185.170;d;266pkt 266fpkt", shape=hexagon, color=black];
4128[label="2.41.50.220;12pkt 12fpkt", shape=pentagon, color=darkviolet];
stat598[shape=component, label=&lt;Rules:&lt;BR/&gt;{81.164.16.36:25, 141.26.185.170:*}[30.9038%]&lt;BR/&gt;{*:*, 141.26.185.170:25}[28.863%]&lt;BR/&gt;{*:*, 151.125.158.150:*}[20.1166%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (48.9396%)&lt;BR/&gt; 113: (0.734095%)&lt;BR/&gt; 0: (0.652529%)&lt;BR/&gt; 3552: (0.326264%)&lt;BR/&gt; 54448: (0.244698%)&gt;];
}
1754--2957[label="1;266pkt 266fpkt"];
1754--4104[label="0.0625;1pkt 1fpkt"];
1754--4128[label="0.25;3pkt 3fpkt"];
2255--4104[label="0.125;2pkt 2fpkt"];
2255--4128[label="0.0833333;1pkt 1fpkt"];
2957--4104[label="0.0625;1pkt 1fpkt"];
2957--4128[label="0.25;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="151.125.158.150"/>
      <filter dst_ip="141.26.185.170" dst_port="25"/>
      <filter dst_ip="141.26.185.170" src_ip="81.164.16.36" src_port="25"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942060" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,001,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="81.158.216.217"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.711294,1.2256,010,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_601{
style=filled;
color=gray75;
1502[label="137.95.39.222;s;312pkt 312fpkt", shape=diamond, color=yellow];
2580[label="137.95.39.222;s;312pkt 312fpkt", shape=hexagon, color=black];
4138[label="137.95.39.222;312pkt 312fpkt", shape=pentagon, color=darkviolet];
stat601[shape=component, label=&lt;Rules:&lt;BR/&gt;{137.95.39.222:*, *:445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (50%)&lt;BR/&gt; 3507: (0.480769%)&lt;BR/&gt; 4451: (0.320513%)&lt;BR/&gt; 4254: (0.320513%)&lt;BR/&gt; 3823: (0.320513%)&gt;];
}
1502--2580[label="1;312pkt 312fpkt"];
1502--4138[label="1;312pkt 312fpkt"];
2580--4138[label="1;312pkt 312fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="137.95.39.222"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091941389" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.148.171.224"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,001,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="80.64.139.229"/>
    </slice>
    <from sec="1091941250" usec="0"/>
    <to sec="1091941251" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,011,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="81.137.10.231"/>
    </slice>
    <from sec="1091941214" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.70.35.238"/>
    </slice>
    <from sec="1091941986" usec="0"/>
    <to sec="1091942084" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.711294,1.2256,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_609{
style=filled;
color=gray75;
1559[label="174.104.183.68;d;339pkt 339fpkt", shape=diamond, color=yellow];
1804[label="0.19.218.64;s;163pkt 163fpkt", shape=diamond, color=yellow];
2692[label="174.104.183.68;d;273pkt 273fpkt", shape=hexagon, color=black];
3584[label="0.19.218.64;163pkt 163fpkt", shape=pentagon, color=darkviolet];
3714[label="202.139.136.101;32pkt 32fpkt", shape=pentagon, color=darkviolet];
3850[label="203.106.42.137;3pkt 3fpkt", shape=pentagon, color=darkviolet];
4195[label="205.102.191.242;69pkt 69fpkt", shape=pentagon, color=darkviolet];
stat609[shape=component, label=&lt;Rules:&lt;BR/&gt;{0.19.218.64:80, 174.104.183.68:*}[44.6575%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4010: (0.191939%)&lt;BR/&gt; 4008: (0.191939%)&lt;BR/&gt; 4006: (0.191939%)&lt;BR/&gt; 4004: (0.191939%)&gt;];
}
1559--1804[label="1;163pkt 163fpkt"];
1559--2065[label="0.0487805;4pkt 4fpkt"];
1559--2692[label="1;273pkt 273fpkt"];
1559--3106[label="0.0533333;4pkt 4fpkt"];
1559--3311[label="0.0707965;24pkt 24fpkt"];
1559--3337[label="0.0707965;24pkt 24fpkt"];
1559--3347[label="0.0707965;24pkt 24fpkt"];
1559--3584[label="1;163pkt 163fpkt"];
1559--3714[label="0.1875;6pkt 6fpkt"];
1559--3850[label="1;3pkt 3fpkt"];
1559--4195[label="1;69pkt 69fpkt"];
1804--2692[label="1;163pkt 163fpkt"];
1804--3311[label="0.0306748;5pkt 5fpkt"];
1804--3337[label="0.0306748;5pkt 5fpkt"];
1804--3347[label="0.0306748;5pkt 5fpkt"];
1804--3584[label="1;163pkt 163fpkt"];
2692--3106[label="0.0533333;4pkt 4fpkt"];
2692--3311[label="0.0879121;24pkt 24fpkt"];
2692--3337[label="0.0879121;24pkt 24fpkt"];
2692--3347[label="0.0879121;24pkt 24fpkt"];
2692--3584[label="1;163pkt 163fpkt"];
2692--3714[label="0.1875;6pkt 6fpkt"];
2692--3850[label="1;3pkt 3fpkt"];
2692--4195[label="0.333333;23pkt 23fpkt"];
</description>
    <slice>
      <filter dst_ip="174.104.183.68" src_ip="0.19.218.64" src_port="80"/>
    </slice>
    <from sec="1091941282" usec="0"/>
    <to sec="1091941989" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="139.30.170.245"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.135.3.247"/>
    </slice>
    <from sec="1091941208" usec="0"/>
    <to sec="1091942100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="17.5.108.249"/>
    </slice>
    <from sec="1091941206" usec="0"/>
    <to sec="1091942100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55959,1.32389,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.65.65.251"/>
    </slice>
    <from sec="1091941207" usec="0"/>
    <to sec="1091942096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.773242,1.19457,010,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_617{
style=filled;
color=gray75;
2299[label="203.207.139.254;s;840pkt 840fpkt", shape=diamond, color=yellow];
3045[label="203.207.139.254;s;840pkt 840fpkt", shape=hexagon, color=black];
4218[label="203.207.139.254;946pkt 946fpkt", shape=pentagon, color=darkviolet];
4811[label="203.207.139.254;946pkt 946fpkt", shape=invtriangle, color=brown];
stat617[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.207.139.254:*, *:135}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 50869: (0.25196%)&lt;BR/&gt; 50430: (0.25196%)&lt;BR/&gt; 50976: (0.223964%)&lt;BR/&gt; 50901: (0.223964%)&gt;];
}
2299--3045[label="1;840pkt 840fpkt"];
2299--4218[label="1;840pkt 840fpkt"];
2299--4811[label="1;840pkt 840fpkt"];
3045--4218[label="1;840pkt 840fpkt"];
3045--4811[label="1;840pkt 840fpkt"];
4218--4811[label="1;946pkt 946fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="203.207.139.254"/>
    </slice>
    <from sec="1091941464" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_618{
style=filled;
color=gray75;
3353[label="0.193.53.1;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4221[label="0.193.53.1;1pkt 1fpkt", shape=invtriangle, color=brown];
stat618[shape=component, label=&lt;Rules:&lt;BR/&gt;{0.193.53.1:3745, 141.164.182.233:135}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3745: (50%)&lt;BR/&gt; 135: (50%)&gt;];
}
3353--4221[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="141.164.182.233" dst_port="135" src_ip="0.193.53.1" src_port="3745"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,504,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_620{
style=filled;
color=gray75;
3357[label="141.26.29.2;5pkt 5fpkt", shape=pentagon, color=darkviolet];
4224[label="141.26.29.2;4pkt 4fpkt", shape=invtriangle, color=brown];
4815[label="141.26.29.2;4pkt 4fpkt", shape=invhouse, color=bisque];
stat620[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.26.29.2:4214, 202.70.36.20:80}[20%]&lt;BR/&gt;{141.26.29.2:3714, 202.70.35.90:80}[20%]&lt;BR/&gt;{141.26.29.2:4210, 202.70.77.221:80}[20%]&lt;BR/&gt;{141.26.29.2:4212, 3.31.208.189:80}[20%]&lt;BR/&gt;{141.26.29.2:4216, 3.31.208.189:443}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (38.4615%)&lt;BR/&gt; 4216: (11.5385%)&lt;BR/&gt; 4214: (11.5385%)&lt;BR/&gt; 4212: (11.5385%)&lt;BR/&gt; 3714: (11.5385%)&gt;];
}
3357--4224[label="1;4pkt 4fpkt"];
3357--4815[label="1;4pkt 4fpkt"];
4224--4815[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="3.31.208.189" dst_port="443" src_ip="141.26.29.2" src_port="4216"/>
      <filter dst_ip="3.31.208.189" dst_port="80" src_ip="141.26.29.2" src_port="4212"/>
      <filter dst_ip="202.70.77.221" dst_port="80" src_ip="141.26.29.2" src_port="4210"/>
      <filter dst_ip="202.70.35.90" dst_port="80" src_ip="141.26.29.2" src_port="3714"/>
      <filter dst_ip="202.70.36.20" dst_port="80" src_ip="141.26.29.2" src_port="4214"/>
    </slice>
    <from sec="1091941272" usec="0"/>
    <to sec="1091941473" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,504,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_621{
style=filled;
color=gray75;
3361[label="141.26.3.3;5pkt 5fpkt", shape=pentagon, color=darkviolet];
4228[label="141.26.3.3;3pkt 3fpkt", shape=invtriangle, color=brown];
stat621[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.26.3.3:0, 17.4.60.13:0}[20%]&lt;BR/&gt;{141.26.3.3:4228, 202.70.15.67:80}[20%]&lt;BR/&gt;{141.26.3.3:4224, 202.70.35.91:80}[20%]&lt;BR/&gt;{141.26.3.3:4226, 202.70.83.68:80}[20%]&lt;BR/&gt;{141.26.3.3:4230, 202.70.83.68:443}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (31.25%)&lt;BR/&gt; 4230: (12.5%)&lt;BR/&gt; 4226: (12.5%)&lt;BR/&gt; 4224: (12.5%)&lt;BR/&gt; 443: (12.5%)&gt;];
}
3361--4228[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="202.70.83.68" dst_port="443" src_ip="141.26.3.3" src_port="4230"/>
      <filter dst_ip="202.70.83.68" dst_port="80" src_ip="141.26.3.3" src_port="4226"/>
      <filter dst_ip="202.70.35.91" dst_port="80" src_ip="141.26.3.3" src_port="4224"/>
      <filter dst_ip="202.70.15.67" dst_port="80" src_ip="141.26.3.3" src_port="4228"/>
      <filter dst_ip="17.4.60.13" src_ip="141.26.3.3"/>
    </slice>
    <from sec="1091941514" usec="0"/>
    <to sec="1091941915" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_622{
style=filled;
color=gray75;
3364[label="68.59.82.3;4pkt 4fpkt", shape=pentagon, color=darkviolet];
4230[label="68.59.82.3;4pkt 4fpkt", shape=invtriangle, color=brown];
4819[label="68.59.82.3;4pkt 4fpkt", shape=invhouse, color=bisque];
stat622[shape=component, label=&lt;Rules:&lt;BR/&gt;{68.59.82.3:80, 136.171.225.154:60122}[25%]&lt;BR/&gt;{68.59.82.3:80, 136.171.225.154:60270}[25%]&lt;BR/&gt;{68.59.82.3:80, 136.171.225.154:60487}[25%]&lt;BR/&gt;{68.59.82.3:80, 136.171.225.154:63592}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 63592: (12.5%)&lt;BR/&gt; 60487: (12.5%)&lt;BR/&gt; 60270: (12.5%)&lt;BR/&gt; 60122: (12.5%)&gt;];
}
3364--4230[label="1;4pkt 4fpkt"];
3364--4819[label="1;4pkt 4fpkt"];
4230--4819[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="136.171.225.154" dst_port="63592" src_ip="68.59.82.3" src_port="80"/>
      <filter dst_ip="136.171.225.154" dst_port="60487" src_ip="68.59.82.3" src_port="80"/>
      <filter dst_ip="136.171.225.154" dst_port="60270" src_ip="68.59.82.3" src_port="80"/>
      <filter dst_ip="136.171.225.154" dst_port="60122" src_ip="68.59.82.3" src_port="80"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.670948,1.37086,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="204.244.111.5"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.825684,1.24043,011,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_625{
style=filled;
color=gray75;
1345[label="81.180.24.8;s;1567pkt 1567fpkt", shape=diamond, color=yellow];
3376[label="81.180.24.8;1698pkt 1698fpkt", shape=pentagon, color=darkviolet];
4237[label="81.180.24.8;1697pkt 1697fpkt", shape=invtriangle, color=brown];
4826[label="81.180.24.8;1698pkt 1698fpkt", shape=invhouse, color=bisque];
stat625[shape=component, label=&lt;Rules:&lt;BR/&gt;{81.180.24.8:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 32582: (0.0900901%)&lt;BR/&gt; 64843: (0.0600601%)&lt;BR/&gt; 64841: (0.0600601%)&lt;BR/&gt; 64346: (0.0600601%)&gt;];
}
1345--3264[label="0.0842374;132pkt 132fpkt"];
1345--3311[label="0.0887045;139pkt 139fpkt"];
1345--3319[label="0.0842374;132pkt 132fpkt"];
1345--3337[label="0.0887045;139pkt 139fpkt"];
1345--3344[label="0.0842374;132pkt 132fpkt"];
1345--3347[label="0.0887045;139pkt 139fpkt"];
1345--3376[label="1;1567pkt 1567fpkt"];
1345--4237[label="0.999362;1566pkt 1566fpkt"];
1345--4826[label="1;1567pkt 1567fpkt"];
3376--4237[label="1;1697pkt 1697fpkt"];
3376--4826[label="1;1698pkt 1698fpkt"];
4237--4826[label="1;1697pkt 1697fpkt"];
</description>
    <slice>
      <filter src_ip="81.180.24.8" src_port="80"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.656163,1.22043,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_626{
style=filled;
color=gray75;
1731[label="141.26.185.195;d;479pkt 479fpkt", shape=diamond, color=yellow];
2112[label="3.106.25.146;s;96pkt 96fpkt", shape=diamond, color=yellow];
3417[label="3.106.26.18;16pkt 16fpkt", shape=pentagon, color=darkviolet];
3570[label="3.106.26.62;26pkt 26fpkt", shape=pentagon, color=darkviolet];
3774[label="0.20.47.114;8pkt 8fpkt", shape=pentagon, color=darkviolet];
4367[label="3.106.26.62;26pkt 26fpkt", shape=invtriangle, color=brown];
4431[label="0.20.47.89;4pkt 4fpkt", shape=invtriangle, color=brown];
4502[label="0.20.47.114;8pkt 8fpkt", shape=invtriangle, color=brown];
stat626[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 141.26.185.195:80}[86.3555%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 57565: (0.226244%)&lt;BR/&gt; 56155: (0.226244%)&lt;BR/&gt; 52434: (0.226244%)&lt;BR/&gt; 45642: (0.226244%)&gt;];
}
1731--2112[label="0.677083;65pkt 65fpkt"];
1731--2283[label="0.0441176;3pkt 3fpkt"];
1731--2352[label="0.0416667;2pkt 2fpkt"];
1731--2353[label="0.1;6pkt 6fpkt"];
1731--2356[label="0.140625;9pkt 9fpkt"];
1731--2359[label="0.186441;11pkt 11fpkt"];
1731--2360[label="0.0392157;2pkt 2fpkt"];
1731--2368[label="0.097561;4pkt 4fpkt"];
1731--2404[label="0.135135;10pkt 10fpkt"];
1731--2408[label="0.0588235;4pkt 4fpkt"];
1731--2428[label="0.0769231;4pkt 4fpkt"];
1731--2437[label="0.0384615;2pkt 2fpkt"];
1731--2449[label="0.214286;3pkt 3fpkt"];
1731--3077[label="0.0664962;26pkt 26fpkt"];
1731--3103[label="0.0444444;2pkt 2fpkt"];
1731--3133[label="0.135135;10pkt 10fpkt"];
1731--3137[label="0.0588235;4pkt 4fpkt"];
1731--3379[label="0.0357143;1pkt 1fpkt"];
1731--3417[label="0.0625;1pkt 1fpkt"];
1731--3419[label="0.0638298;3pkt 3fpkt"];
1731--3507[label="0.103448;3pkt 3fpkt"];
1731--3570[label="0.0384615;1pkt 1fpkt"];
1731--3638[label="0.0714286;5pkt 5fpkt"];
1731--3759[label="0.121951;10pkt 10fpkt"];
1731--3774[label="0.25;2pkt 2fpkt"];
1731--3947[label="0.0441176;3pkt 3fpkt"];
1731--4130[label="1;4pkt 4fpkt"];
1731--4240[label="0.0357143;1pkt 1fpkt"];
1731--4367[label="0.0384615;1pkt 1fpkt"];
1731--4411[label="0.0714286;5pkt 5fpkt"];
1731--4431[label="0.75;3pkt 3fpkt"];
1731--4502[label="0.25;2pkt 2fpkt"];
1731--4750[label="1;4pkt 4fpkt"];
3570--4367[label="1;26pkt 26fpkt"];
3774--4502[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="141.26.185.195" dst_port="80"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.670948,1.37086,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="213.223.16.12"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_628{
style=filled;
color=gray75;
3389[label="151.125.40.12;19pkt 19fpkt", shape=pentagon, color=darkviolet];
4247[label="151.125.40.12;18pkt 18fpkt", shape=invtriangle, color=brown];
stat628[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.125.40.12:*, 192.119.204.16:80}[21.0526%]&lt;BR/&gt;{151.125.40.12:*, 200.134.40.68:80}[21.0526%]&lt;BR/&gt;{151.125.40.12:*, 5.201.4.96:80}[21.0526%]&lt;BR/&gt;{151.125.40.12:*, 221.7.79.139:80}[21.0526%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 37522: (2.7027%)&lt;BR/&gt; 37520: (2.7027%)&lt;BR/&gt; 37519: (2.7027%)&lt;BR/&gt; 37518: (2.7027%)&gt;];
}
3389--4247[label="1;18pkt 18fpkt"];
</description>
    <slice>
      <filter dst_ip="221.7.79.139" dst_port="80" src_ip="151.125.40.12"/>
      <filter dst_ip="5.201.4.96" dst_port="80" src_ip="151.125.40.12"/>
      <filter dst_ip="200.134.40.68" dst_port="80" src_ip="151.125.40.12"/>
      <filter dst_ip="192.119.204.16" dst_port="80" src_ip="151.125.40.12"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_629{
style=filled;
color=gray75;
3407[label="136.171.90.16;12pkt 12fpkt", shape=pentagon, color=darkviolet];
4256[label="136.171.90.16;12pkt 12fpkt", shape=invtriangle, color=brown];
stat629[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.171.90.16:*, *:25}[66.6667%]&lt;BR/&gt;{136.171.90.16:25, *:*}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (45.8333%)&lt;BR/&gt; 2387: (8.33333%)&lt;BR/&gt; 26192: (4.16667%)&lt;BR/&gt; 3577: (4.16667%)&lt;BR/&gt; 2386: (4.16667%)&gt;];
}
3407--4256[label="1;12pkt 12fpkt"];
</description>
    <slice>
      <filter src_ip="136.171.90.16" src_port="25"/>
      <filter dst_port="25" src_ip="136.171.90.16"/>
    </slice>
    <from sec="1091941424" usec="0"/>
    <to sec="1091942079" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.670948,1.37086,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="81.129.128.16"/>
    </slice>
    <from sec="1091941475" usec="0"/>
    <to sec="1091942083" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_631{
style=filled;
color=gray75;
3414[label="136.171.50.17;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4260[label="136.171.50.17;1pkt 1fpkt", shape=invtriangle, color=brown];
stat631[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.171.50.17:25, 150.65.166.96:4285}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4285: (50%)&lt;BR/&gt; 25: (50%)&gt;];
}
3414--4260[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="150.65.166.96" dst_port="4285" src_ip="136.171.50.17" src_port="25"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_632{
style=filled;
color=gray75;
3421[label="206.97.148.19;228pkt 228fpkt", shape=pentagon, color=darkviolet];
4264[label="206.97.148.19;227pkt 227fpkt", shape=invtriangle, color=brown];
stat632[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.97.148.19:10054, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 10054: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3421--4264[label="1;227pkt 227fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="206.97.148.19" src_port="10054"/>
    </slice>
    <from sec="1091941731" usec="0"/>
    <to sec="1091941766" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_633{
style=filled;
color=gray75;
3424[label="151.125.99.20;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4267[label="151.125.99.20;2pkt 2fpkt", shape=invtriangle, color=brown];
stat633[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.125.99.20:1220, 5.128.191.28:80}[50%]&lt;BR/&gt;{151.125.99.20:1222, 5.128.191.28:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1222: (25%)&lt;BR/&gt; 1220: (25%)&gt;];
}
3424--4267[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="5.128.191.28" dst_port="80" src_ip="151.125.99.20" src_port="1222"/>
      <filter dst_ip="5.128.191.28" dst_port="80" src_ip="151.125.99.20" src_port="1220"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,020,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_635{
style=filled;
color=gray75;
3432[label="204.40.44.22;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4271[label="204.40.44.22;1pkt 1fpkt", shape=invtriangle, color=brown];
stat635[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.40.44.22:0, 212.33.97.49:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
3432--4271[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="212.33.97.49" src_ip="204.40.44.22"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.656163,1.22043,010,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_636{
style=filled;
color=gray75;
2444[label="0.202.135.24;s;177pkt 177fpkt", shape=diamond, color=yellow];
3438[label="0.202.135.24;189pkt 189fpkt", shape=pentagon, color=darkviolet];
4276[label="0.202.135.24;189pkt 189fpkt", shape=invtriangle, color=brown];
stat636[shape=component, label=&lt;Rules:&lt;BR/&gt;{0.202.135.24:*, *:135}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 4582: (0.540541%)&lt;BR/&gt; 2118: (0.540541%)&lt;BR/&gt; 1408: (0.540541%)&lt;BR/&gt; 4837: (0.27027%)&gt;];
}
2444--3265[label="0.0451977;8pkt 8fpkt"];
2444--3320[label="0.0451977;8pkt 8fpkt"];
2444--3438[label="1;177pkt 177fpkt"];
2444--4276[label="1;177pkt 177fpkt"];
3438--4276[label="1;189pkt 189fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="0.202.135.24"/>
    </slice>
    <from sec="1091941243" usec="0"/>
    <to sec="1091942096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,504,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_637{
style=filled;
color=gray75;
3439[label="141.26.160.24;4pkt 4fpkt", shape=pentagon, color=darkviolet];
4277[label="141.26.160.24;4pkt 4fpkt", shape=invtriangle, color=brown];
stat637[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.26.160.24:1133, 202.70.36.20:80}[25%]&lt;BR/&gt;{141.26.160.24:1131, 202.70.35.90:80}[25%]&lt;BR/&gt;{141.26.160.24:1132, 202.70.43.51:80}[25%]&lt;BR/&gt;{141.26.160.24:1135, 202.70.43.51:443}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (37.5%)&lt;BR/&gt; 1135: (12.5%)&lt;BR/&gt; 1133: (12.5%)&lt;BR/&gt; 1132: (12.5%)&lt;BR/&gt; 1131: (12.5%)&gt;];
}
3439--4277[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="202.70.43.51" dst_port="443" src_ip="141.26.160.24" src_port="1135"/>
      <filter dst_ip="202.70.43.51" dst_port="80" src_ip="141.26.160.24" src_port="1132"/>
      <filter dst_ip="202.70.35.90" dst_port="80" src_ip="141.26.160.24" src_port="1131"/>
      <filter dst_ip="202.70.36.20" dst_port="80" src_ip="141.26.160.24" src_port="1133"/>
    </slice>
    <from sec="1091941289" usec="0"/>
    <to sec="1091941381" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_640{
style=filled;
color=gray75;
3449[label="4.32.108.27;88pkt 88fpkt", shape=pentagon, color=darkviolet];
4285[label="4.32.108.27;89pkt 89fpkt", shape=invtriangle, color=brown];
stat640[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.32.108.27:*, *:3127}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3127: (50%)&lt;BR/&gt; 2413: (1.12994%)&lt;BR/&gt; 4980: (0.564972%)&lt;BR/&gt; 4963: (0.564972%)&lt;BR/&gt; 4882: (0.564972%)&gt;];
}
3449--4285[label="1;88pkt 88fpkt"];
</description>
    <slice>
      <filter dst_port="3127" src_ip="4.32.108.27"/>
    </slice>
    <from sec="1091941203" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.656163,1.22043,001,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_641{
style=filled;
color=gray75;
2120[label="214.67.244.27;s;508pkt 508fpkt", shape=diamond, color=yellow];
3450[label="214.67.244.27;507pkt 507fpkt", shape=pentagon, color=darkviolet];
4287[label="214.67.244.27;508pkt 508fpkt", shape=invtriangle, color=brown];
stat641[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.67.244.27:*, *:5554}[50%]&lt;BR/&gt;{214.67.244.27:*, *:9898}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (25.0164%)&lt;BR/&gt; 5554: (24.9836%)&lt;BR/&gt; 34206: (0.0984898%)&lt;BR/&gt; 34205: (0.0984898%)&lt;BR/&gt; 34204: (0.0984898%)&gt;];
}
2120--3450[label="1;507pkt 507fpkt"];
2120--4287[label="1;508pkt 508fpkt"];
3450--4287[label="1;507pkt 507fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="214.67.244.27"/>
      <filter dst_port="5554" src_ip="214.67.244.27"/>
    </slice>
    <from sec="1091941643" usec="0"/>
    <to sec="1091941645" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.656163,1.22043,010,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_642{
style=filled;
color=gray75;
2250[label="82.89.20.31;s;320pkt 320fpkt", shape=diamond, color=yellow];
3457[label="82.89.20.31;339pkt 339fpkt", shape=pentagon, color=darkviolet];
4294[label="82.89.20.31;339pkt 339fpkt", shape=invtriangle, color=brown];
stat642[shape=component, label=&lt;Rules:&lt;BR/&gt;{82.89.20.31:*, *:135}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 4144: (0.450902%)&lt;BR/&gt; 3492: (0.400802%)&lt;BR/&gt; 4686: (0.300601%)&lt;BR/&gt; 4645: (0.300601%)&gt;];
}
2250--3265[label="0.053125;17pkt 17fpkt"];
2250--3320[label="0.053125;17pkt 17fpkt"];
2250--3457[label="0.996875;319pkt 319fpkt"];
2250--4294[label="0.996875;319pkt 319fpkt"];
3457--4294[label="1;339pkt 339fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="82.89.20.31"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.773242,1.19457,010,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_643{
style=filled;
color=gray75;
2267[label="218.195.53.31;s;316pkt 316fpkt", shape=diamond, color=yellow];
3029[label="218.195.53.31;s;260pkt 260fpkt", shape=hexagon, color=black];
3458[label="218.195.53.31;339pkt 339fpkt", shape=pentagon, color=darkviolet];
4295[label="218.195.53.31;339pkt 339fpkt", shape=invtriangle, color=brown];
stat643[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.195.53.31:*, *:135}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 4380: (0.318979%)&lt;BR/&gt; 4267: (0.318979%)&lt;BR/&gt; 4232: (0.318979%)&lt;BR/&gt; 4134: (0.318979%)&gt;];
}
2267--3029[label="1;260pkt 260fpkt"];
2267--3265[label="0.0727848;23pkt 23fpkt"];
2267--3320[label="0.0727848;23pkt 23fpkt"];
2267--3458[label="1;316pkt 316fpkt"];
2267--4295[label="1;316pkt 316fpkt"];
3029--3265[label="0.0884615;23pkt 23fpkt"];
3029--3320[label="0.0884615;23pkt 23fpkt"];
3029--3458[label="1;260pkt 260fpkt"];
3029--4295[label="1;260pkt 260fpkt"];
3458--4295[label="1;339pkt 339fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="218.195.53.31"/>
    </slice>
    <from sec="1091941202" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.670948,1.37086,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="0.157.154.31"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_645{
style=filled;
color=gray75;
3462[label="205.248.184.31;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4298[label="205.248.184.31;1pkt 1fpkt", shape=invtriangle, color=brown];
4857[label="205.248.184.31;1pkt 1fpkt", shape=invhouse, color=bisque];
stat645[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.248.184.31:53, 196.21.143.28:1504}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1504: (50%)&lt;BR/&gt; 53: (50%)&gt;];
}
3462--4298[label="1;1pkt 1fpkt"];
3462--4857[label="1;1pkt 1fpkt"];
4298--4857[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="196.21.143.28" dst_port="1504" src_ip="205.248.184.31" src_port="53"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_646{
style=filled;
color=gray75;
3464[label="151.125.5.32;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4300[label="151.125.5.32;2pkt 2fpkt", shape=invtriangle, color=brown];
stat646[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.125.5.32:1430, 202.70.188.32:1863}[50%]&lt;BR/&gt;{151.125.5.32:1361, 202.70.186.42:1863}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1863: (50%)&lt;BR/&gt; 1430: (33.3333%)&lt;BR/&gt; 1361: (16.6667%)&gt;];
}
3464--4300[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="202.70.186.42" dst_port="1863" src_ip="151.125.5.32" src_port="1361"/>
      <filter dst_ip="202.70.188.32" dst_port="1863" src_ip="151.125.5.32" src_port="1430"/>
    </slice>
    <from sec="1091941242" usec="0"/>
    <to sec="1091942100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_647{
style=filled;
color=gray75;
3466[label="151.125.61.32;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4302[label="151.125.61.32;1pkt 1fpkt", shape=invtriangle, color=brown];
4859[label="151.125.61.32;1pkt 1fpkt", shape=invhouse, color=bisque];
stat647[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.125.61.32:42745, 139.72.138.146:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 42745: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
3466--4302[label="1;1pkt 1fpkt"];
3466--4859[label="1;1pkt 1fpkt"];
4302--4859[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="139.72.138.146" dst_port="80" src_ip="151.125.61.32" src_port="42745"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_648{
style=filled;
color=gray75;
3476[label="17.24.136.34;250pkt 250fpkt", shape=pentagon, color=darkviolet];
4308[label="17.24.136.34;250pkt 250fpkt", shape=invtriangle, color=brown];
stat648[shape=component, label=&lt;Rules:&lt;BR/&gt;{17.24.136.34:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3476--4308[label="1;250pkt 250fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="17.24.136.34" src_port="1027"/>
    </slice>
    <from sec="1091941473" usec="0"/>
    <to sec="1091941513" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_649{
style=filled;
color=gray75;
3479[label="219.189.105.35;216pkt 216fpkt", shape=pentagon, color=darkviolet];
4311[label="219.189.105.35;216pkt 216fpkt", shape=invtriangle, color=brown];
4866[label="219.189.105.35;215pkt 215fpkt", shape=invhouse, color=bisque];
stat649[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.189.105.35:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3479--4311[label="1;216pkt 216fpkt"];
3479--4866[label="1;215pkt 215fpkt"];
4311--4866[label="1;215pkt 215fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="219.189.105.35" src_port="1026"/>
    </slice>
    <from sec="1091941303" usec="0"/>
    <to sec="1091941344" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,504,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_650{
style=filled;
color=gray75;
3482[label="174.104.242.35;4pkt 4fpkt", shape=pentagon, color=darkviolet];
4312[label="174.104.242.35;4pkt 4fpkt", shape=invtriangle, color=brown];
4867[label="174.104.242.35;3pkt 3fpkt", shape=invhouse, color=bisque];
stat650[shape=component, label=&lt;Rules:&lt;BR/&gt;{174.104.242.35:4448, 202.70.82.63:80}[25%]&lt;BR/&gt;{174.104.242.35:4444, 202.70.77.221:80}[25%]&lt;BR/&gt;{174.104.242.35:4446, 202.70.32.61:80}[25%]&lt;BR/&gt;{174.104.242.35:4450, 202.70.32.61:443}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (36.3636%)&lt;BR/&gt; 4450: (13.6364%)&lt;BR/&gt; 4448: (13.6364%)&lt;BR/&gt; 4446: (13.6364%)&lt;BR/&gt; 443: (13.6364%)&gt;];
}
3482--4312[label="1;4pkt 4fpkt"];
3482--4867[label="1;3pkt 3fpkt"];
4312--4867[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="202.70.32.61" dst_port="443" src_ip="174.104.242.35" src_port="4450"/>
      <filter dst_ip="202.70.32.61" dst_port="80" src_ip="174.104.242.35" src_port="4446"/>
      <filter dst_ip="202.70.77.221" dst_port="80" src_ip="174.104.242.35" src_port="4444"/>
      <filter dst_ip="202.70.82.63" dst_port="80" src_ip="174.104.242.35" src_port="4448"/>
    </slice>
    <from sec="1091941499" usec="0"/>
    <to sec="1091941508" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.74076,1.19023,001,1 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_651{
style=filled;
color=gray75;
137[label="214.132.133.36s;444pkt 444fpkt", shape=rectangle, color=red];
1669[label="214.132.133.36;s;11600pkt 11600fpkt", shape=diamond, color=yellow];
3484[label="214.132.133.36;11599pkt 11599fpkt", shape=pentagon, color=darkviolet];
4313[label="214.132.133.36;11599pkt 11599fpkt", shape=invtriangle, color=brown];
stat651[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.132.133.36:*, *:9898}[40.4224%]&lt;BR/&gt;{214.132.133.36:*, *:1023}[32.3879%]&lt;BR/&gt;{214.132.133.36:*, *:5554}[27.1897%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (20.3138%)&lt;BR/&gt; 1023: (16.1625%)&lt;BR/&gt; 5554: (13.5236%)&lt;BR/&gt; 3552: (0.0312128%)&lt;BR/&gt; 3280: (0.0312128%)&gt;];
}
137--530[label="0.162162;72pkt 72fpkt"];
137--824[label="0.11036;49pkt 49fpkt"];
137--1141[label="0.11036;49pkt 49fpkt"];
137--1669[label="1;444pkt 444fpkt"];
137--3484[label="1;444pkt 444fpkt"];
137--4313[label="1;444pkt 444fpkt"];
1669--3484[label="1;11599pkt 11599fpkt"];
1669--4313[label="1;11599pkt 11599fpkt"];
3484--4313[label="1;11599pkt 11599fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="214.132.133.36"/>
      <filter dst_port="1023" src_ip="214.132.133.36"/>
      <filter dst_port="5554" src_ip="214.132.133.36"/>
    </slice>
    <from sec="1091941353" usec="0"/>
    <to sec="1091941399" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_652{
style=filled;
color=gray75;
3499[label="210.225.82.41;119pkt 119fpkt", shape=pentagon, color=darkviolet];
4323[label="210.225.82.41;120pkt 120fpkt", shape=invtriangle, color=brown];
4876[label="210.225.82.41;120pkt 120fpkt", shape=invhouse, color=bisque];
stat652[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.225.82.41:*, *:1023}[35%]&lt;BR/&gt;{210.225.82.41:*, *:5554}[33.3333%]&lt;BR/&gt;{210.225.82.41:*, *:9898}[31.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1023: (17.5487%)&lt;BR/&gt; 5554: (16.7131%)&lt;BR/&gt; 9898: (15.7382%)&lt;BR/&gt; 4467: (0.835655%)&lt;BR/&gt; 4412: (0.835655%)&gt;];
}
3499--4323[label="1;119pkt 119fpkt"];
3499--4876[label="1;119pkt 119fpkt"];
4323--4876[label="1;120pkt 120fpkt"];
</description>
    <slice>
      <filter dst_port="1023" src_ip="210.225.82.41"/>
      <filter dst_port="5554" src_ip="210.225.82.41"/>
      <filter dst_port="9898" src_ip="210.225.82.41"/>
    </slice>
    <from sec="1091941278" usec="0"/>
    <to sec="1091941282" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_653{
style=filled;
color=gray75;
3508[label="141.7.83.44;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4327[label="141.7.83.44;1pkt 1fpkt", shape=invtriangle, color=brown];
4878[label="141.7.83.44;1pkt 1fpkt", shape=invhouse, color=bisque];
stat653[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.7.83.44:2612, 141.26.212.38:445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2612: (50%)&lt;BR/&gt; 445: (50%)&gt;];
}
3508--4327[label="1;1pkt 1fpkt"];
3508--4878[label="1;1pkt 1fpkt"];
4327--4878[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="141.26.212.38" dst_port="445" src_ip="141.7.83.44" src_port="2612"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_654{
style=filled;
color=gray75;
3516[label="19.3.219.45;99pkt 99fpkt", shape=pentagon, color=darkviolet];
4332[label="19.3.219.45;99pkt 99fpkt", shape=invtriangle, color=brown];
stat654[shape=component, label=&lt;Rules:&lt;BR/&gt;{19.3.219.45:*, *:445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (50%)&lt;BR/&gt; 65436: (1.0101%)&lt;BR/&gt; 65430: (1.0101%)&lt;BR/&gt; 65144: (1.0101%)&lt;BR/&gt; 64949: (1.0101%)&gt;];
}
3516--4332[label="1;99pkt 99fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="19.3.219.45"/>
    </slice>
    <from sec="1091941203" usec="0"/>
    <to sec="1091941397" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,020,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_655{
style=filled;
color=gray75;
3528[label="212.33.97.49;7pkt 7fpkt", shape=pentagon, color=darkviolet];
4343[label="212.33.97.49;7pkt 7fpkt", shape=invtriangle, color=brown];
4886[label="212.33.97.49;7pkt 7fpkt", shape=invhouse, color=bisque];
stat655[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.33.97.49:0, *:0}[85.7143%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (85.7143%)&lt;BR/&gt; 63917: (7.14286%)&lt;BR/&gt; 1080: (7.14286%)&gt;];
}
3528--4343[label="1;7pkt 7fpkt"];
3528--4886[label="1;7pkt 7fpkt"];
4343--4886[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter src_ip="212.33.97.49"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_656{
style=filled;
color=gray75;
3534[label="213.49.210.50;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4347[label="213.49.210.50;1pkt 1fpkt", shape=invtriangle, color=brown];
4888[label="213.49.210.50;1pkt 1fpkt", shape=invhouse, color=bisque];
stat656[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.49.210.50:80, 136.171.134.127:1153}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1153: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
3534--4347[label="1;1pkt 1fpkt"];
3534--4888[label="1;1pkt 1fpkt"];
4347--4888[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="136.171.134.127" dst_port="1153" src_ip="213.49.210.50" src_port="80"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_657{
style=filled;
color=gray75;
3542[label="206.180.203.52;182pkt 182fpkt", shape=pentagon, color=darkviolet];
4349[label="206.180.203.52;182pkt 182fpkt", shape=invtriangle, color=brown];
stat657[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.180.203.52:*, *:445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (50%)&lt;BR/&gt; 3340: (0.549451%)&lt;BR/&gt; 2554: (0.549451%)&lt;BR/&gt; 2529: (0.549451%)&lt;BR/&gt; 2487: (0.549451%)&gt;];
}
3542--4349[label="1;182pkt 182fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="206.180.203.52"/>
    </slice>
    <from sec="1091941203" usec="0"/>
    <to sec="1091941379" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_659{
style=filled;
color=gray75;
3547[label="151.125.174.54;5pkt 5fpkt", shape=pentagon, color=darkviolet];
4352[label="151.125.174.54;5pkt 5fpkt", shape=invtriangle, color=brown];
stat659[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.125.174.54:3096, 0.3.50.24:80}[20%]&lt;BR/&gt;{151.125.174.54:3125, 202.70.188.86:1863}[20%]&lt;BR/&gt;{151.125.174.54:3028, 202.70.186.168:1863}[20%]&lt;BR/&gt;{151.125.174.54:3126, 202.70.188.22:1863}[20%]&lt;BR/&gt;{151.125.174.54:3127, 202.70.188.22:1863}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1863: (40%)&lt;BR/&gt; 3127: (10%)&lt;BR/&gt; 3126: (10%)&lt;BR/&gt; 3125: (10%)&lt;BR/&gt; 3096: (10%)&gt;];
}
3547--4352[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="202.70.188.22" dst_port="1863" src_ip="151.125.174.54" src_port="3127"/>
      <filter dst_ip="202.70.188.22" dst_port="1863" src_ip="151.125.174.54" src_port="3126"/>
      <filter dst_ip="202.70.186.168" dst_port="1863" src_ip="151.125.174.54" src_port="3028"/>
      <filter dst_ip="202.70.188.86" dst_port="1863" src_ip="151.125.174.54" src_port="3125"/>
      <filter dst_ip="0.3.50.24" dst_port="80" src_ip="151.125.174.54" src_port="3096"/>
    </slice>
    <from sec="1091941213" usec="0"/>
    <to sec="1091942099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_660{
style=filled;
color=gray75;
3557[label="211.1.110.57;216pkt 216fpkt", shape=pentagon, color=darkviolet];
4358[label="211.1.110.57;216pkt 216fpkt", shape=invtriangle, color=brown];
4894[label="211.1.110.57;216pkt 216fpkt", shape=invhouse, color=bisque];
stat660[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.1.110.57:*, *:9898}[49.537%]&lt;BR/&gt;{211.1.110.57:*, *:445}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (24.7685%)&lt;BR/&gt; 445: (11.1111%)&lt;BR/&gt; 1023: (8.56481%)&lt;BR/&gt; 5554: (5.55556%)&lt;BR/&gt; 4996: (0.231481%)&gt;];
}
3557--4358[label="1;216pkt 216fpkt"];
3557--4894[label="1;216pkt 216fpkt"];
4358--4894[label="1;216pkt 216fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="211.1.110.57"/>
      <filter dst_port="445" src_ip="211.1.110.57"/>
    </slice>
    <from sec="1091941250" usec="0"/>
    <to sec="1091941251" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_661{
style=filled;
color=gray75;
3577[label="206.106.190.63;250pkt 250fpkt", shape=pentagon, color=darkviolet];
4371[label="206.106.190.63;250pkt 250fpkt", shape=invtriangle, color=brown];
4899[label="206.106.190.63;250pkt 250fpkt", shape=invhouse, color=bisque];
stat661[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.106.190.63:2418, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2418: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3577--4371[label="1;250pkt 250fpkt"];
3577--4899[label="1;250pkt 250fpkt"];
4371--4899[label="1;250pkt 250fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="206.106.190.63" src_port="2418"/>
    </slice>
    <from sec="1091941267" usec="0"/>
    <to sec="1091941282" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.723381,1.26679,001,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_662{
style=filled;
color=gray75;
177[label="211.178.22.64s;261pkt 261fpkt", shape=rectangle, color=red];
3580[label="211.178.22.64;261pkt 261fpkt", shape=pentagon, color=darkviolet];
4372[label="211.178.22.64;261pkt 261fpkt", shape=invtriangle, color=brown];
stat662[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.178.22.64:*, *:1023}[33.3333%]&lt;BR/&gt;{211.178.22.64:*, *:5554}[33.3333%]&lt;BR/&gt;{211.178.22.64:*, *:9898}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (16.6667%)&lt;BR/&gt; 5554: (16.6667%)&lt;BR/&gt; 1023: (16.6667%)&lt;BR/&gt; 3832: (0.191571%)&lt;BR/&gt; 3831: (0.191571%)&gt;];
}
177--3580[label="1;261pkt 261fpkt"];
177--4372[label="1;261pkt 261fpkt"];
3580--4372[label="1;261pkt 261fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="211.178.22.64"/>
      <filter dst_port="5554" src_ip="211.178.22.64"/>
      <filter dst_port="1023" src_ip="211.178.22.64"/>
    </slice>
    <from sec="1091941258" usec="0"/>
    <to sec="1091941263" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_663{
style=filled;
color=gray75;
3581[label="215.220.140.64;209pkt 209fpkt", shape=pentagon, color=darkviolet];
4373[label="215.220.140.64;209pkt 209fpkt", shape=invtriangle, color=brown];
4900[label="215.220.140.64;209pkt 209fpkt", shape=invhouse, color=bisque];
stat663[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.220.140.64:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 4979: (0.239234%)&lt;BR/&gt; 4963: (0.239234%)&lt;BR/&gt; 4962: (0.239234%)&lt;BR/&gt; 4956: (0.239234%)&gt;];
}
3581--4373[label="1;209pkt 209fpkt"];
3581--4900[label="1;209pkt 209fpkt"];
4373--4900[label="1;209pkt 209fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="215.220.140.64"/>
    </slice>
    <from sec="1091941324" usec="0"/>
    <to sec="1091941326" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_665{
style=filled;
color=gray75;
3593[label="3.106.25.67;21pkt 21fpkt", shape=pentagon, color=darkviolet];
4381[label="3.106.25.67;21pkt 21fpkt", shape=invtriangle, color=brown];
stat665[shape=component, label=&lt;Rules:&lt;BR/&gt;{3.106.25.67:*, 174.104.168.8:80}[33.3333%]&lt;BR/&gt;{3.106.25.67:*, 136.171.49.171:80}[23.8095%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.619%)&lt;BR/&gt; 64901: (2.38095%)&lt;BR/&gt; 64540: (2.38095%)&lt;BR/&gt; 64524: (2.38095%)&lt;BR/&gt; 64313: (2.38095%)&gt;];
}
3593--4381[label="1;21pkt 21fpkt"];
</description>
    <slice>
      <filter dst_ip="174.104.168.8" dst_port="80" src_ip="3.106.25.67"/>
      <filter dst_ip="136.171.49.171" dst_port="80" src_ip="3.106.25.67"/>
    </slice>
    <from sec="1091941627" usec="0"/>
    <to sec="1091941689" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_666{
style=filled;
color=gray75;
3599[label="164.245.211.67;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4385[label="164.245.211.67;2pkt 2fpkt", shape=invtriangle, color=brown];
stat666[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.245.211.67:21261, 141.164.36.83:135}[50%]&lt;BR/&gt;{164.245.211.67:21222, 141.164.204.194:135}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 21261: (25%)&lt;BR/&gt; 21222: (25%)&gt;];
}
3599--4385[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="141.164.204.194" dst_port="135" src_ip="164.245.211.67" src_port="21222"/>
      <filter dst_ip="141.164.36.83" dst_port="135" src_ip="164.245.211.67" src_port="21261"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_667{
style=filled;
color=gray75;
3600[label="0.245.33.68;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4386[label="0.245.33.68;2pkt 2fpkt", shape=invtriangle, color=brown];
stat667[shape=component, label=&lt;Rules:&lt;BR/&gt;{0.245.33.68:80, 174.104.141.141:39385}[50%]&lt;BR/&gt;{0.245.33.68:80, 174.104.141.141:39387}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 39387: (25%)&lt;BR/&gt; 39385: (25%)&gt;];
}
3600--4386[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="174.104.141.141" dst_port="39387" src_ip="0.245.33.68" src_port="80"/>
      <filter dst_ip="174.104.141.141" dst_port="39385" src_ip="0.245.33.68" src_port="80"/>
    </slice>
    <from sec="1091941274" usec="0"/>
    <to sec="1091941282" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.773242,1.19457,010,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_668{
style=filled;
color=gray75;
1931[label="214.173.5.71;s;634pkt 634fpkt", shape=diamond, color=yellow];
2458[label="141.26.45.255;d;71pkt 71fpkt", shape=diamond, color=yellow];
2783[label="214.173.5.71;s;303pkt 303fpkt", shape=hexagon, color=black];
3606[label="214.173.5.71;685pkt 685fpkt", shape=pentagon, color=darkviolet];
4391[label="214.173.5.71;685pkt 685fpkt", shape=invtriangle, color=brown];
stat668[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.173.5.71:*, *:135}[90.7285%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (48.5282%)&lt;BR/&gt; 80: (1.24054%)&lt;BR/&gt; 4516: (0.231287%)&lt;BR/&gt; 3860: (0.231287%)&lt;BR/&gt; 3718: (0.231287%)&gt;];
}
1931--2458[label="0.0140845;1pkt 1fpkt"];
1931--2783[label="1;303pkt 303fpkt"];
1931--3162[label="0.0140845;1pkt 1fpkt"];
1931--3265[label="0.0709779;45pkt 45fpkt"];
1931--3320[label="0.0709779;45pkt 45fpkt"];
1931--3606[label="1;634pkt 634fpkt"];
1931--4391[label="1;634pkt 634fpkt"];
2458--2903[label="0.197183;14pkt 14fpkt"];
2458--3162[label="1;71pkt 71fpkt"];
2458--3606[label="0.0140845;1pkt 1fpkt"];
2458--3766[label="0.0454545;1pkt 1fpkt"];
2458--4391[label="0.0140845;1pkt 1fpkt"];
2783--3265[label="0.148515;45pkt 45fpkt"];
2783--3320[label="0.148515;45pkt 45fpkt"];
2783--3606[label="1;303pkt 303fpkt"];
2783--4391[label="1;303pkt 303fpkt"];
3606--4391[label="1;685pkt 685fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="214.173.5.71"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_669{
style=filled;
color=gray75;
3617[label="213.49.208.73;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4398[label="213.49.208.73;2pkt 2fpkt", shape=invtriangle, color=brown];
stat669[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.49.208.73:80, 205.248.186.126:59756}[50%]&lt;BR/&gt;{213.49.208.73:80, 205.248.186.126:61361}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 61361: (25%)&lt;BR/&gt; 59756: (25%)&gt;];
}
3617--4398[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="205.248.186.126" dst_port="61361" src_ip="213.49.208.73" src_port="80"/>
      <filter dst_ip="205.248.186.126" dst_port="59756" src_ip="213.49.208.73" src_port="80"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_670{
style=filled;
color=gray75;
3629[label="210.163.148.78;209pkt 209fpkt", shape=pentagon, color=darkviolet];
4406[label="210.163.148.78;209pkt 209fpkt", shape=invtriangle, color=brown];
4918[label="210.163.148.78;208pkt 208fpkt", shape=invhouse, color=bisque];
stat670[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.163.148.78:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 3403: (0.239617%)&lt;BR/&gt; 3402: (0.239617%)&lt;BR/&gt; 3401: (0.239617%)&lt;BR/&gt; 3400: (0.239617%)&gt;];
}
3629--4406[label="1;209pkt 209fpkt"];
3629--4918[label="1;208pkt 208fpkt"];
4406--4918[label="1;208pkt 208fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="210.163.148.78"/>
    </slice>
    <from sec="1091941582" usec="0"/>
    <to sec="1091941585" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_671{
style=filled;
color=gray75;
3641[label="151.24.138.81;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4414[label="151.24.138.81;2pkt 2fpkt", shape=invtriangle, color=brown];
4923[label="151.24.138.81;2pkt 2fpkt", shape=invhouse, color=bisque];
stat671[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.24.138.81:0, 96.118.153.20:0}[50%]&lt;BR/&gt;{151.24.138.81:0, 215.17.63.48:0}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
3641--4414[label="1;2pkt 2fpkt"];
3641--4923[label="1;2pkt 2fpkt"];
4414--4923[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="215.17.63.48" src_ip="151.24.138.81"/>
      <filter dst_ip="96.118.153.20" src_ip="151.24.138.81"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_672{
style=filled;
color=gray75;
3644[label="215.207.151.82;136pkt 136fpkt", shape=pentagon, color=darkviolet];
4416[label="215.207.151.82;136pkt 136fpkt", shape=invtriangle, color=brown];
4925[label="215.207.151.82;136pkt 136fpkt", shape=invhouse, color=bisque];
stat672[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.207.151.82:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 25084: (0.367647%)&lt;BR/&gt; 25079: (0.367647%)&lt;BR/&gt; 25047: (0.367647%)&lt;BR/&gt; 25019: (0.367647%)&gt;];
}
3644--4416[label="1;136pkt 136fpkt"];
3644--4925[label="1;136pkt 136fpkt"];
4416--4925[label="1;136pkt 136fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="215.207.151.82"/>
    </slice>
    <from sec="1091941255" usec="0"/>
    <to sec="1091941257" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_673{
style=filled;
color=gray75;
3652[label="204.40.43.85;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4421[label="204.40.43.85;2pkt 2fpkt", shape=invtriangle, color=brown];
4928[label="204.40.43.85;2pkt 2fpkt", shape=invhouse, color=bisque];
stat673[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.40.43.85:25, 1.108.162.46:62916}[50%]&lt;BR/&gt;{204.40.43.85:25, 219.96.117.129:3853}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 62916: (25%)&lt;BR/&gt; 3853: (25%)&gt;];
}
3652--4421[label="1;2pkt 2fpkt"];
3652--4928[label="1;2pkt 2fpkt"];
4421--4928[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="219.96.117.129" dst_port="3853" src_ip="204.40.43.85" src_port="25"/>
      <filter dst_ip="1.108.162.46" dst_port="62916" src_ip="204.40.43.85" src_port="25"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_674{
style=filled;
color=gray75;
3663[label="3.189.109.88;68pkt 68fpkt", shape=pentagon, color=darkviolet];
4427[label="3.189.109.88;68pkt 68fpkt", shape=invtriangle, color=brown];
stat674[shape=component, label=&lt;Rules:&lt;BR/&gt;{3.189.109.88:*, *:135}[26.4706%]&lt;BR/&gt;{3.189.109.88:*, *:1025}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (13.2353%)&lt;BR/&gt; 1025: (12.5%)&lt;BR/&gt; 2745: (6.61765%)&lt;BR/&gt; 6129: (5.88235%)&lt;BR/&gt; 3127: (5.88235%)&gt;];
}
3663--4427[label="1;68pkt 68fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="3.189.109.88"/>
      <filter dst_port="1025" src_ip="3.189.109.88"/>
    </slice>
    <from sec="1091941284" usec="0"/>
    <to sec="1091942100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.670948,1.37086,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="213.98.176.89"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.670948,1.37086,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="118.245.147.90"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_677{
style=filled;
color=gray75;
3676[label="216.129.133.91;3pkt 3fpkt", shape=pentagon, color=darkviolet];
4437[label="216.129.133.91;3pkt 3fpkt", shape=invtriangle, color=brown];
stat677[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.129.133.91:2418, 141.176.102.42:135}[33.3333%]&lt;BR/&gt;{216.129.133.91:2273, 141.26.11.204:135}[33.3333%]&lt;BR/&gt;{216.129.133.91:1971, 141.176.204.240:135}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 2418: (16.6667%)&lt;BR/&gt; 2273: (16.6667%)&lt;BR/&gt; 1971: (16.6667%)&gt;];
}
3676--4437[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="141.176.204.240" dst_port="135" src_ip="216.129.133.91" src_port="1971"/>
      <filter dst_ip="141.26.11.204" dst_port="135" src_ip="216.129.133.91" src_port="2273"/>
      <filter dst_ip="141.176.102.42" dst_port="135" src_ip="216.129.133.91" src_port="2418"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_678{
style=filled;
color=gray75;
3686[label="214.95.87.94;150pkt 150fpkt", shape=pentagon, color=darkviolet];
4446[label="214.95.87.94;150pkt 150fpkt", shape=invtriangle, color=brown];
stat678[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.95.87.94:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3686--4446[label="1;150pkt 150fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="214.95.87.94" src_port="1025"/>
    </slice>
    <from sec="1091941500" usec="0"/>
    <to sec="1091941531" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_680{
style=filled;
color=gray75;
3706[label="141.26.153.99;24pkt 24fpkt", shape=pentagon, color=darkviolet];
4456[label="141.26.153.99;24pkt 24fpkt", shape=invtriangle, color=brown];
4945[label="141.26.153.99;24pkt 24fpkt", shape=invhouse, color=bisque];
stat680[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.26.153.99:*, 202.30.20.174:80}[75%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.9167%)&lt;BR/&gt; 1863: (2.08333%)&lt;BR/&gt; 1116: (2.08333%)&lt;BR/&gt; 1115: (2.08333%)&lt;BR/&gt; 1114: (2.08333%)&gt;];
}
3706--4456[label="1;24pkt 24fpkt"];
3706--4945[label="1;24pkt 24fpkt"];
4456--4945[label="1;24pkt 24fpkt"];
</description>
    <slice>
      <filter dst_ip="202.30.20.174" dst_port="80" src_ip="141.26.153.99"/>
    </slice>
    <from sec="1091941206" usec="0"/>
    <to sec="1091942094" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_681{
style=filled;
color=gray75;
3712[label="136.171.34.101;14pkt 14fpkt", shape=pentagon, color=darkviolet];
4462[label="136.171.34.101;14pkt 14fpkt", shape=invtriangle, color=brown];
4949[label="136.171.34.101;14pkt 14fpkt", shape=invhouse, color=bisque];
stat681[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.171.34.101:*, 202.70.15.50:80}[28.5714%]&lt;BR/&gt;{136.171.34.101:*, 3.31.209.127:80}[28.5714%]&lt;BR/&gt;{136.171.34.101:*, 202.70.83.142:80}[21.4286%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.4286%)&lt;BR/&gt; 3096: (3.57143%)&lt;BR/&gt; 3094: (3.57143%)&lt;BR/&gt; 3092: (3.57143%)&lt;BR/&gt; 3090: (3.57143%)&gt;];
}
3712--4462[label="1;14pkt 14fpkt"];
3712--4949[label="1;14pkt 14fpkt"];
4462--4949[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter dst_ip="3.31.209.127" dst_port="80" src_ip="136.171.34.101"/>
      <filter dst_ip="202.70.15.50" dst_port="80" src_ip="136.171.34.101"/>
      <filter dst_ip="202.70.83.142" dst_port="80" src_ip="136.171.34.101"/>
    </slice>
    <from sec="1091941714" usec="0"/>
    <to sec="1091941925" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_682{
style=filled;
color=gray75;
3717[label="218.215.81.102;69pkt 69fpkt", shape=pentagon, color=darkviolet];
4464[label="218.215.81.102;69pkt 69fpkt", shape=invtriangle, color=brown];
stat682[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.215.81.102:*, *:445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (50%)&lt;BR/&gt; 3623: (6.52174%)&lt;BR/&gt; 3545: (6.52174%)&lt;BR/&gt; 4799: (4.34783%)&lt;BR/&gt; 4853: (3.62319%)&gt;];
}
3717--4464[label="1;69pkt 69fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="218.215.81.102"/>
    </slice>
    <from sec="1091941221" usec="0"/>
    <to sec="1091942099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_683{
style=filled;
color=gray75;
3724[label="211.97.30.103;110pkt 110fpkt", shape=pentagon, color=darkviolet];
4468[label="211.97.30.103;110pkt 110fpkt", shape=invtriangle, color=brown];
4954[label="211.97.30.103;109pkt 109fpkt", shape=invhouse, color=bisque];
stat683[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.97.30.103:1031, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1031: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3724--4468[label="1;110pkt 110fpkt"];
3724--4954[label="1;109pkt 109fpkt"];
4468--4954[label="1;109pkt 109fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="211.97.30.103" src_port="1031"/>
    </slice>
    <from sec="1091941393" usec="0"/>
    <to sec="1091941419" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_684{
style=filled;
color=gray75;
3728[label="5.168.84.104;20pkt 20fpkt", shape=pentagon, color=darkviolet];
4470[label="5.168.84.104;20pkt 20fpkt", shape=invtriangle, color=brown];
4956[label="5.168.84.104;20pkt 20fpkt", shape=invhouse, color=bisque];
stat684[shape=component, label=&lt;Rules:&lt;BR/&gt;{5.168.84.104:*, *:135}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 2568: (2.5%)&lt;BR/&gt; 2567: (2.5%)&lt;BR/&gt; 2566: (2.5%)&lt;BR/&gt; 2565: (2.5%)&gt;];
}
3728--4470[label="1;20pkt 20fpkt"];
3728--4956[label="1;20pkt 20fpkt"];
4470--4956[label="1;20pkt 20fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="5.168.84.104"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.670948,1.37086,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="221.90.184.105"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_686{
style=filled;
color=gray75;
3738[label="141.26.173.106;82pkt 82fpkt", shape=pentagon, color=darkviolet];
4475[label="141.26.173.106;82pkt 82fpkt", shape=invtriangle, color=brown];
stat686[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.26.173.106:*, 3.31.227.209:80}[69.5122%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.3902%)&lt;BR/&gt; 2935: (1.21951%)&lt;BR/&gt; 2981: (0.609756%)&lt;BR/&gt; 2980: (0.609756%)&lt;BR/&gt; 2979: (0.609756%)&gt;];
}
3738--4475[label="1;82pkt 82fpkt"];
</description>
    <slice>
      <filter dst_ip="3.31.227.209" dst_port="80" src_ip="141.26.173.106"/>
    </slice>
    <from sec="1091942010" usec="0"/>
    <to sec="1091942076" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_687{
style=filled;
color=gray75;
3740[label="214.58.90.107;119pkt 119fpkt", shape=pentagon, color=darkviolet];
4477[label="214.58.90.107;119pkt 119fpkt", shape=invtriangle, color=brown];
4962[label="214.58.90.107;119pkt 119fpkt", shape=invhouse, color=bisque];
stat687[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.58.90.107:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 2274: (0.420168%)&lt;BR/&gt; 2273: (0.420168%)&lt;BR/&gt; 2272: (0.420168%)&lt;BR/&gt; 2271: (0.420168%)&gt;];
}
3740--4477[label="1;119pkt 119fpkt"];
3740--4962[label="1;119pkt 119fpkt"];
4477--4962[label="1;119pkt 119fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="214.58.90.107"/>
    </slice>
    <from sec="1091941489" usec="0"/>
    <to sec="1091941491" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_688{
style=filled;
color=gray75;
3742[label="3.31.253.107;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4479[label="3.31.253.107;1pkt 1fpkt", shape=invtriangle, color=brown];
4963[label="3.31.253.107;1pkt 1fpkt", shape=invhouse, color=bisque];
stat688[shape=component, label=&lt;Rules:&lt;BR/&gt;{3.31.253.107:80, 174.104.157.67:1674}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1674: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
3742--4479[label="1;1pkt 1fpkt"];
3742--4963[label="1;1pkt 1fpkt"];
4479--4963[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="174.104.157.67" dst_port="1674" src_ip="3.31.253.107" src_port="80"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_690{
style=filled;
color=gray75;
3762[label="215.214.144.111;476pkt 476fpkt", shape=pentagon, color=darkviolet];
4493[label="215.214.144.111;476pkt 476fpkt", shape=invtriangle, color=brown];
4976[label="215.214.144.111;476pkt 476fpkt", shape=invhouse, color=bisque];
stat690[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.214.144.111:*, *:9898}[50.6303%]&lt;BR/&gt;{215.214.144.111:*, *:5554}[49.3697%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (25.3151%)&lt;BR/&gt; 5554: (24.6849%)&lt;BR/&gt; 4959: (0.105042%)&lt;BR/&gt; 4958: (0.105042%)&lt;BR/&gt; 4887: (0.105042%)&gt;];
}
3762--4493[label="1;476pkt 476fpkt"];
3762--4976[label="1;476pkt 476fpkt"];
4493--4976[label="1;476pkt 476fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="215.214.144.111"/>
      <filter dst_port="5554" src_ip="215.214.144.111"/>
    </slice>
    <from sec="1091941331" usec="0"/>
    <to sec="1091941333" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,001,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_691{
style=filled;
color=gray75;
3782[label="3.189.171.116;484pkt 484fpkt", shape=pentagon, color=darkviolet];
4506[label="3.189.171.116;484pkt 484fpkt", shape=invtriangle, color=brown];
stat691[shape=component, label=&lt;Rules:&lt;BR/&gt;{3.189.171.116:*, *:5554}[50%]&lt;BR/&gt;{3.189.171.116:*, *:9898}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (25%)&lt;BR/&gt; 5554: (25%)&lt;BR/&gt; 3068: (0.206612%)&lt;BR/&gt; 4820: (0.103306%)&lt;BR/&gt; 4819: (0.103306%)&gt;];
}
3782--4506[label="1;484pkt 484fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="3.189.171.116"/>
      <filter dst_port="5554" src_ip="3.189.171.116"/>
    </slice>
    <from sec="1091941515" usec="0"/>
    <to sec="1091941519" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,001,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_692{
style=filled;
color=gray75;
3787[label="214.201.216.117;167pkt 167fpkt", shape=pentagon, color=darkviolet];
4509[label="214.201.216.117;167pkt 167fpkt", shape=invtriangle, color=brown];
stat692[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.201.216.117:*, *:5554}[54.491%]&lt;BR/&gt;{214.201.216.117:*, *:9898}[45.509%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (27.2455%)&lt;BR/&gt; 9898: (22.7545%)&lt;BR/&gt; 3591: (0.299401%)&lt;BR/&gt; 3562: (0.299401%)&lt;BR/&gt; 3561: (0.299401%)&gt;];
}
3787--4509[label="1;167pkt 167fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="214.201.216.117"/>
      <filter dst_port="9898" src_ip="214.201.216.117"/>
    </slice>
    <from sec="1091941675" usec="0"/>
    <to sec="1091941677" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_693{
style=filled;
color=gray75;
3791[label="202.87.140.119;4pkt 4fpkt", shape=pentagon, color=darkviolet];
4513[label="202.87.140.119;4pkt 4fpkt", shape=invtriangle, color=brown];
stat693[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.87.140.119:3662, 141.158.145.5:135}[25%]&lt;BR/&gt;{202.87.140.119:3647, 141.158.156.88:135}[25%]&lt;BR/&gt;{202.87.140.119:3561, 141.221.147.106:135}[25%]&lt;BR/&gt;{202.87.140.119:3646, 141.176.79.164:135}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 3662: (12.5%)&lt;BR/&gt; 3647: (12.5%)&lt;BR/&gt; 3646: (12.5%)&lt;BR/&gt; 3561: (12.5%)&gt;];
}
3791--4513[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="141.176.79.164" dst_port="135" src_ip="202.87.140.119" src_port="3646"/>
      <filter dst_ip="141.221.147.106" dst_port="135" src_ip="202.87.140.119" src_port="3561"/>
      <filter dst_ip="141.158.156.88" dst_port="135" src_ip="202.87.140.119" src_port="3647"/>
      <filter dst_ip="141.158.145.5" dst_port="135" src_ip="202.87.140.119" src_port="3662"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_694{
style=filled;
color=gray75;
3795[label="0.154.128.120;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4516[label="0.154.128.120;2pkt 2fpkt", shape=invtriangle, color=brown];
4989[label="0.154.128.120;2pkt 2fpkt", shape=invhouse, color=bisque];
stat694[shape=component, label=&lt;Rules:&lt;BR/&gt;{0.154.128.120:2848, 136.171.73.136:80}[50%]&lt;BR/&gt;{0.154.128.120:2850, 136.171.73.136:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2850: (25%)&lt;BR/&gt; 2848: (25%)&gt;];
}
3795--4516[label="1;2pkt 2fpkt"];
3795--4989[label="1;2pkt 2fpkt"];
4516--4989[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="136.171.73.136" dst_port="80" src_ip="0.154.128.120" src_port="2850"/>
      <filter dst_ip="136.171.73.136" dst_port="80" src_ip="0.154.128.120" src_port="2848"/>
    </slice>
    <from sec="1091941954" usec="0"/>
    <to sec="1091941964" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_695{
style=filled;
color=gray75;
3798[label="152.42.185.120;20pkt 20fpkt", shape=pentagon, color=darkviolet];
4519[label="152.42.185.120;20pkt 20fpkt", shape=invtriangle, color=brown];
stat695[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.42.185.120:*, *:135}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 1602: (2.5%)&lt;BR/&gt; 1601: (2.5%)&lt;BR/&gt; 1600: (2.5%)&lt;BR/&gt; 1599: (2.5%)&gt;];
}
3798--4519[label="1;20pkt 20fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="152.42.185.120"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.825684,1.24043,010,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_696{
style=filled;
color=gray75;
1362[label="215.223.235.120;s;3495pkt 3495fpkt", shape=diamond, color=yellow];
3800[label="215.223.235.120;21pkt 21fpkt", shape=pentagon, color=darkviolet];
4521[label="215.223.235.120;21pkt 21fpkt", shape=invtriangle, color=brown];
4990[label="215.223.235.120;21pkt 21fpkt", shape=invhouse, color=bisque];
stat696[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.223.235.120:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 12649: (0.0702642%)&lt;BR/&gt; 31014: (0.0562114%)&lt;BR/&gt; 27019: (0.0562114%)&lt;BR/&gt; 23619: (0.0562114%)&gt;];
}
1362--2143[label="0.0030303;1pkt 1fpkt"];
1362--3022[label="0.00362319;1pkt 1fpkt"];
1362--3264[label="0.0992908;238pkt 238fpkt"];
1362--3311[label="0.192809;547pkt 547fpkt"];
1362--3319[label="0.0992908;238pkt 238fpkt"];
1362--3337[label="0.192809;547pkt 547fpkt"];
1362--3344[label="0.0992908;238pkt 238fpkt"];
1362--3347[label="0.192809;547pkt 547fpkt"];
1362--3800[label="0.571429;12pkt 12fpkt"];
1362--4521[label="0.571429;12pkt 12fpkt"];
1362--4990[label="0.571429;12pkt 12fpkt"];
3800--4521[label="1;21pkt 21fpkt"];
3800--4990[label="1;21pkt 21fpkt"];
4521--4990[label="1;21pkt 21fpkt"];
</description>
    <slice>
      <filter src_ip="215.223.235.120" src_port="80"/>
    </slice>
    <from sec="1091941203" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_697{
style=filled;
color=gray75;
3806[label="204.40.34.123;3pkt 3fpkt", shape=pentagon, color=darkviolet];
4526[label="204.40.34.123;3pkt 3fpkt", shape=invtriangle, color=brown];
4993[label="204.40.34.123;3pkt 3fpkt", shape=invhouse, color=bisque];
stat697[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.40.34.123:39312, 118.170.193.79:1462}[33.3333%]&lt;BR/&gt;{204.40.34.123:1755, 16.49.87.188:1085}[33.3333%]&lt;BR/&gt;{204.40.34.123:1755, 203.148.171.224:61544}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1755: (33.3333%)&lt;BR/&gt; 61544: (16.6667%)&lt;BR/&gt; 39312: (16.6667%)&lt;BR/&gt; 1462: (16.6667%)&lt;BR/&gt; 1085: (16.6667%)&gt;];
}
3806--4526[label="1;3pkt 3fpkt"];
3806--4993[label="1;3pkt 3fpkt"];
4526--4993[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="203.148.171.224" dst_port="61544" src_ip="204.40.34.123" src_port="1755"/>
      <filter dst_ip="16.49.87.188" dst_port="1085" src_ip="204.40.34.123" src_port="1755"/>
      <filter dst_ip="118.170.193.79" dst_port="1462" src_ip="204.40.34.123" src_port="39312"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_698{
style=filled;
color=gray75;
3811[label="80.126.144.124;249pkt 249fpkt", shape=pentagon, color=darkviolet];
4528[label="80.126.144.124;249pkt 249fpkt", shape=invtriangle, color=brown];
4994[label="80.126.144.124;249pkt 249fpkt", shape=invhouse, color=bisque];
stat698[shape=component, label=&lt;Rules:&lt;BR/&gt;{80.126.144.124:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 4533: (0.200803%)&lt;BR/&gt; 4532: (0.200803%)&lt;BR/&gt; 4531: (0.200803%)&lt;BR/&gt; 4496: (0.200803%)&gt;];
}
3811--4528[label="1;249pkt 249fpkt"];
3811--4994[label="1;249pkt 249fpkt"];
4528--4994[label="1;249pkt 249fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="80.126.144.124"/>
    </slice>
    <from sec="1091941307" usec="0"/>
    <to sec="1091941309" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.670948,1.37086,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="199.191.39.125"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_700{
style=filled;
color=gray75;
3816[label="214.66.164.126;248pkt 248fpkt", shape=pentagon, color=darkviolet];
4533[label="214.66.164.126;248pkt 248fpkt", shape=invtriangle, color=brown];
4999[label="214.66.164.126;248pkt 248fpkt", shape=invhouse, color=bisque];
stat700[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.66.164.126:1070, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1070: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3816--4533[label="1;248pkt 248fpkt"];
3816--4999[label="1;248pkt 248fpkt"];
4533--4999[label="1;248pkt 248fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="214.66.164.126" src_port="1070"/>
    </slice>
    <from sec="1091941302" usec="0"/>
    <to sec="1091941316" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_701{
style=filled;
color=gray75;
3819[label="198.33.228.126;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4536[label="198.33.228.126;1pkt 1fpkt", shape=invtriangle, color=brown];
5002[label="198.33.228.126;1pkt 1fpkt", shape=invhouse, color=bisque];
stat701[shape=component, label=&lt;Rules:&lt;BR/&gt;{198.33.228.126:53, 204.40.42.79:32768}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 32768: (50%)&lt;BR/&gt; 53: (50%)&gt;];
}
3819--4536[label="1;1pkt 1fpkt"];
3819--5002[label="1;1pkt 1fpkt"];
4536--5002[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="204.40.42.79" dst_port="32768" src_ip="198.33.228.126" src_port="53"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619396,1.329,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_702{
style=filled;
color=gray75;
1550[label="151.125.175.9;d;157pkt 157fpkt", shape=diamond, color=yellow];
stat702[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.182.135.226:80, 151.125.175.9:*}[24.8408%]&lt;BR/&gt;{211.182.135.200:80, 151.125.175.9:*}[22.9299%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.3631%)&lt;BR/&gt; 10015: (0.318471%)&lt;BR/&gt; 3231: (0.318471%)&lt;BR/&gt; 3230: (0.318471%)&lt;BR/&gt; 3227: (0.318471%)&gt;];
}
1550--2683[label="0.9;9pkt 9fpkt"];
1550--2910[label="1;104pkt 104fpkt"];
1550--3264[label="0.11465;18pkt 18fpkt"];
1550--3311[label="0.0636943;10pkt 10fpkt"];
1550--3319[label="0.11465;18pkt 18fpkt"];
1550--3337[label="0.0636943;10pkt 10fpkt"];
1550--3344[label="0.11465;18pkt 18fpkt"];
1550--3347[label="0.0636943;10pkt 10fpkt"];
1550--3537[label="0.941176;16pkt 16fpkt"];
1550--3833[label="0.925926;25pkt 25fpkt"];
1550--4080[label="0.657895;25pkt 25fpkt"];
1550--4145[label="1;39pkt 39fpkt"];
1550--4549[label="0.925926;25pkt 25fpkt"];
1550--4716[label="0.657895;25pkt 25fpkt"];
</description>
    <slice>
      <filter dst_ip="151.125.175.9" src_ip="211.182.135.226" src_port="80"/>
      <filter dst_ip="151.125.175.9" src_ip="211.182.135.200" src_port="80"/>
    </slice>
    <from sec="1091941208" usec="0"/>
    <to sec="1091942026" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_703{
style=filled;
color=gray75;
3838[label="10.101.14.134;3pkt 3fpkt", shape=pentagon, color=darkviolet];
4551[label="10.101.14.134;3pkt 3fpkt", shape=invtriangle, color=brown];
stat703[shape=component, label=&lt;Rules:&lt;BR/&gt;{10.101.14.134:57815, 10.151.10.10:53}[33.3333%]&lt;BR/&gt;{10.101.14.134:57815, 10.161.49.10:53}[33.3333%]&lt;BR/&gt;{10.101.14.134:57815, 10.131.21.100:53}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 57815: (50%)&lt;BR/&gt; 53: (50%)&gt;];
}
3838--4551[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="10.131.21.100" dst_port="53" src_ip="10.101.14.134" src_port="57815"/>
      <filter dst_ip="10.161.49.10" dst_port="53" src_ip="10.101.14.134" src_port="57815"/>
      <filter dst_ip="10.151.10.10" dst_port="53" src_ip="10.101.14.134" src_port="57815"/>
    </slice>
    <from sec="1091941216" usec="0"/>
    <to sec="1091942055" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.656163,1.22043,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_704{
style=filled;
color=gray75;
1526[label="151.125.152.135;s;976pkt 976fpkt", shape=diamond, color=yellow];
3844[label="151.125.152.135;1046pkt 1046fpkt", shape=pentagon, color=darkviolet];
4555[label="151.125.152.135;1046pkt 1046fpkt", shape=invtriangle, color=brown];
stat704[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.125.152.135:36229, *:53}[73.9962%]&lt;BR/&gt;{151.125.152.135:53, *:*}[22.5621%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (49.56%)&lt;BR/&gt; 36229: (37.2392%)&lt;BR/&gt; 0: (3.42243%)&lt;BR/&gt; 32768: (0.342243%)&lt;BR/&gt; 32769: (0.244459%)&gt;];
}
1526--1964[label="0.0135135;1pkt 1fpkt"];
1526--2009[label="0.0140845;1pkt 1fpkt"];
1526--2424[label="0.0163934;1pkt 1fpkt"];
1526--2475[label="0.0128205;1pkt 1fpkt"];
1526--3263[label="0.0102459;10pkt 10fpkt"];
1526--3310[label="0.0112705;11pkt 11fpkt"];
1526--3313[label="0.0133197;13pkt 13fpkt"];
1526--3318[label="0.0102459;10pkt 10fpkt"];
1526--3336[label="0.0112705;11pkt 11fpkt"];
1526--3339[label="0.0133197;13pkt 13fpkt"];
1526--3343[label="0.0102459;10pkt 10fpkt"];
1526--3346[label="0.0112705;11pkt 11fpkt"];
1526--3349[label="0.0133197;13pkt 13fpkt"];
1526--3844[label="1;976pkt 976fpkt"];
1526--4555[label="1;976pkt 976fpkt"];
3844--4555[label="1;1046pkt 1046fpkt"];
</description>
    <slice>
      <filter src_ip="151.125.152.135" src_port="53"/>
      <filter dst_port="53" src_ip="151.125.152.135" src_port="36229"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_705{
style=filled;
color=gray75;
3845[label="138.81.174.135;39pkt 39fpkt", shape=pentagon, color=darkviolet];
4556[label="138.81.174.135;39pkt 39fpkt", shape=invtriangle, color=brown];
5016[label="138.81.174.135;39pkt 39fpkt", shape=invhouse, color=bisque];
stat705[shape=component, label=&lt;Rules:&lt;BR/&gt;{138.81.174.135:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3845--4556[label="1;39pkt 39fpkt"];
3845--5016[label="1;39pkt 39fpkt"];
4556--5016[label="1;39pkt 39fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="138.81.174.135" src_port="1028"/>
    </slice>
    <from sec="1091941334" usec="0"/>
    <to sec="1091941337" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_706{
style=filled;
color=gray75;
3847[label="206.126.21.136;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4557[label="206.126.21.136;2pkt 2fpkt", shape=invtriangle, color=brown];
stat706[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.126.21.136:3438, 141.84.243.103:135}[50%]&lt;BR/&gt;{206.126.21.136:3435, 141.26.151.175:135}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 3438: (25%)&lt;BR/&gt; 3435: (25%)&gt;];
}
3847--4557[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="141.26.151.175" dst_port="135" src_ip="206.126.21.136" src_port="3435"/>
      <filter dst_ip="141.84.243.103" dst_port="135" src_ip="206.126.21.136" src_port="3438"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.656163,1.22043,010,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_707{
style=filled;
color=gray75;
1705[label="206.4.98.137;s;1006pkt 1006fpkt", shape=diamond, color=yellow];
3852[label="206.4.98.137;1096pkt 1096fpkt", shape=pentagon, color=darkviolet];
4559[label="206.4.98.137;1096pkt 1096fpkt", shape=invtriangle, color=brown];
stat707[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.4.98.137:*, *:135}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 3276: (0.234522%)&lt;BR/&gt; 4785: (0.140713%)&lt;BR/&gt; 3493: (0.140713%)&lt;BR/&gt; 2717: (0.140713%)&gt;];
}
1705--3265[label="0.0725646;73pkt 73fpkt"];
1705--3320[label="0.0725646;73pkt 73fpkt"];
1705--3852[label="1;1006pkt 1006fpkt"];
1705--4559[label="1;1006pkt 1006fpkt"];
3852--4559[label="1;1096pkt 1096fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="206.4.98.137"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.670948,1.37086,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="174.104.141.141"/>
    </slice>
    <from sec="1091941274" usec="0"/>
    <to sec="1091941357" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.825684,1.24043,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_710{
style=filled;
color=gray75;
1512[label="136.170.150.148;s;122pkt 122fpkt", shape=diamond, color=yellow];
3880[label="136.170.150.148;133pkt 133fpkt", shape=pentagon, color=darkviolet];
4577[label="136.170.150.148;133pkt 133fpkt", shape=invtriangle, color=brown];
5028[label="136.170.150.148;133pkt 133fpkt", shape=invhouse, color=bisque];
stat710[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.170.150.148:25, *:*}[95.4887%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 3819: (0.767754%)&lt;BR/&gt; 3013: (0.767754%)&lt;BR/&gt; 63584: (0.383877%)&lt;BR/&gt; 63582: (0.383877%)&gt;];
}
1512--3880[label="1;122pkt 122fpkt"];
1512--4577[label="1;122pkt 122fpkt"];
1512--5028[label="1;122pkt 122fpkt"];
3880--4577[label="1;133pkt 133fpkt"];
3880--5028[label="1;133pkt 133fpkt"];
4577--5028[label="1;133pkt 133fpkt"];
</description>
    <slice>
      <filter src_ip="136.170.150.148" src_port="25"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_711{
style=filled;
color=gray75;
3883[label="168.115.200.149;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4579[label="168.115.200.149;1pkt 1fpkt", shape=invtriangle, color=brown];
stat711[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.115.200.149:1136, 5.249.131.93:6667}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (50%)&lt;BR/&gt; 1136: (50%)&gt;];
}
3883--4579[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="5.249.131.93" dst_port="6667" src_ip="168.115.200.149" src_port="1136"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_712{
style=filled;
color=gray75;
3893[label="207.153.155.152;155pkt 155fpkt", shape=pentagon, color=darkviolet];
4585[label="207.153.155.152;155pkt 155fpkt", shape=invtriangle, color=brown];
stat712[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.153.155.152:*, *:445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (50%)&lt;BR/&gt; 4889: (0.645161%)&lt;BR/&gt; 4854: (0.645161%)&lt;BR/&gt; 4429: (0.645161%)&lt;BR/&gt; 4176: (0.645161%)&gt;];
}
3893--4585[label="1;155pkt 155fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="207.153.155.152"/>
    </slice>
    <from sec="1091941202" usec="0"/>
    <to sec="1091941393" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_713{
style=filled;
color=gray75;
3894[label="214.95.204.152;220pkt 220fpkt", shape=pentagon, color=darkviolet];
4586[label="214.95.204.152;220pkt 220fpkt", shape=invtriangle, color=brown];
5033[label="214.95.204.152;220pkt 220fpkt", shape=invhouse, color=bisque];
stat713[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.95.204.152:10356, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 10356: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3894--4586[label="1;220pkt 220fpkt"];
3894--5033[label="1;220pkt 220fpkt"];
4586--5033[label="1;220pkt 220fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="214.95.204.152" src_port="10356"/>
    </slice>
    <from sec="1091941862" usec="0"/>
    <to sec="1091941897" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_714{
style=filled;
color=gray75;
3896[label="141.26.28.153;41pkt 41fpkt", shape=pentagon, color=darkviolet];
4588[label="141.26.28.153;40pkt 40fpkt", shape=invtriangle, color=brown];
stat714[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.26.28.153:*, *:80}[97.561%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.3827%)&lt;BR/&gt; 48078: (1.23457%)&lt;BR/&gt; 48077: (1.23457%)&lt;BR/&gt; 48075: (1.23457%)&lt;BR/&gt; 48074: (1.23457%)&gt;];
}
3896--4588[label="1;40pkt 40fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="141.26.28.153"/>
    </slice>
    <from sec="1091941210" usec="0"/>
    <to sec="1091942045" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_715{
style=filled;
color=gray75;
3899[label="214.77.99.153;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4590[label="214.77.99.153;1pkt 1fpkt", shape=invtriangle, color=brown];
5035[label="214.77.99.153;1pkt 1fpkt", shape=invhouse, color=bisque];
stat715[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.77.99.153:26620, 151.125.136.12:6970}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 26620: (50%)&lt;BR/&gt; 6970: (50%)&gt;];
}
3899--4590[label="1;1pkt 1fpkt"];
3899--5035[label="1;1pkt 1fpkt"];
4590--5035[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="151.125.136.12" dst_port="6970" src_ip="214.77.99.153" src_port="26620"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_716{
style=filled;
color=gray75;
3905[label="207.153.192.154;3pkt 3fpkt", shape=pentagon, color=darkviolet];
4594[label="207.153.192.154;3pkt 3fpkt", shape=invtriangle, color=brown];
stat716[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.153.192.154:4412, 141.158.63.157:135}[33.3333%]&lt;BR/&gt;{207.153.192.154:4487, 141.179.21.168:135}[33.3333%]&lt;BR/&gt;{207.153.192.154:4413, 141.221.105.206:135}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 4487: (16.6667%)&lt;BR/&gt; 4413: (16.6667%)&lt;BR/&gt; 4412: (16.6667%)&gt;];
}
3905--4594[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="141.221.105.206" dst_port="135" src_ip="207.153.192.154" src_port="4413"/>
      <filter dst_ip="141.179.21.168" dst_port="135" src_ip="207.153.192.154" src_port="4487"/>
      <filter dst_ip="141.158.63.157" dst_port="135" src_ip="207.153.192.154" src_port="4412"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_717{
style=filled;
color=gray75;
3906[label="204.84.210.154;522pkt 522fpkt", shape=pentagon, color=darkviolet];
4595[label="204.84.210.154;522pkt 522fpkt", shape=invtriangle, color=brown];
stat717[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.84.210.154:1046, *:1434}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1434: (50%)&lt;BR/&gt; 1046: (50%)&gt;];
}
3906--4595[label="1;522pkt 522fpkt"];
</description>
    <slice>
      <filter dst_port="1434" src_ip="204.84.210.154" src_port="1046"/>
    </slice>
    <from sec="1091941204" usec="0"/>
    <to sec="1091942097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.670948,1.37086,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="118.129.194.162"/>
    </slice>
    <from sec="1091941268" usec="0"/>
    <to sec="1091941349" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_722{
style=filled;
color=gray75;
3939[label="141.158.238.162;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4616[label="141.158.238.162;1pkt 1fpkt", shape=invtriangle, color=brown];
5055[label="141.158.238.162;1pkt 1fpkt", shape=invhouse, color=bisque];
stat722[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.158.238.162:0, 210.139.38.17:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
3939--4616[label="1;1pkt 1fpkt"];
3939--5055[label="1;1pkt 1fpkt"];
4616--5055[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="210.139.38.17" src_ip="141.158.238.162"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.670948,1.37086,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="220.242.115.164"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_725{
style=filled;
color=gray75;
3953[label="202.70.176.165;54pkt 54fpkt", shape=pentagon, color=darkviolet];
4628[label="202.70.176.165;54pkt 54fpkt", shape=invtriangle, color=brown];
stat725[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.70.176.165:*, 141.26.122.140:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 65462: (0.925926%)&lt;BR/&gt; 63304: (0.925926%)&lt;BR/&gt; 62342: (0.925926%)&lt;BR/&gt; 61157: (0.925926%)&gt;];
}
3953--4628[label="1;54pkt 54fpkt"];
</description>
    <slice>
      <filter dst_ip="141.26.122.140" dst_port="80" src_ip="202.70.176.165"/>
    </slice>
    <from sec="1091941213" usec="0"/>
    <to sec="1091942089" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,001,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_726{
style=filled;
color=gray75;
3955[label="214.40.1.166;341pkt 341fpkt", shape=pentagon, color=darkviolet];
4630[label="214.40.1.166;341pkt 341fpkt", shape=invtriangle, color=brown];
stat726[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.40.1.166:*, *:9898}[50.7331%]&lt;BR/&gt;{214.40.1.166:*, *:5554}[49.2669%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (25.3666%)&lt;BR/&gt; 5554: (24.6334%)&lt;BR/&gt; 2557: (0.146628%)&lt;BR/&gt; 2545: (0.146628%)&lt;BR/&gt; 2539: (0.146628%)&gt;];
}
3955--4630[label="1;341pkt 341fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="214.40.1.166"/>
      <filter dst_port="5554" src_ip="214.40.1.166"/>
    </slice>
    <from sec="1091941497" usec="0"/>
    <to sec="1091941499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_727{
style=filled;
color=gray75;
3957[label="218.96.89.167;99pkt 99fpkt", shape=pentagon, color=darkviolet];
4632[label="218.96.89.167;99pkt 99fpkt", shape=invtriangle, color=brown];
stat727[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.96.89.167:*, *:3127}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3127: (50%)&lt;BR/&gt; 55757: (1.0101%)&lt;BR/&gt; 47527: (1.0101%)&lt;BR/&gt; 61761: (0.505051%)&lt;BR/&gt; 60621: (0.505051%)&gt;];
}
3957--4632[label="1;99pkt 99fpkt"];
</description>
    <slice>
      <filter dst_port="3127" src_ip="218.96.89.167"/>
    </slice>
    <from sec="1091941214" usec="0"/>
    <to sec="1091942100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_728{
style=filled;
color=gray75;
3965[label="198.156.197.169;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4638[label="198.156.197.169;2pkt 2fpkt", shape=invtriangle, color=brown];
stat728[shape=component, label=&lt;Rules:&lt;BR/&gt;{198.156.197.169:53, 192.168.10.6:4891}[50%]&lt;BR/&gt;{198.156.197.169:53, 192.168.61.136:1062}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (50%)&lt;BR/&gt; 4891: (25%)&lt;BR/&gt; 1062: (25%)&gt;];
}
3965--4638[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="192.168.61.136" dst_port="1062" src_ip="198.156.197.169" src_port="53"/>
      <filter dst_ip="192.168.10.6" dst_port="4891" src_ip="198.156.197.169" src_port="53"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_729{
style=filled;
color=gray75;
3969[label="141.26.185.170;6pkt 6fpkt", shape=pentagon, color=darkviolet];
4640[label="141.26.185.170;6pkt 6fpkt", shape=invtriangle, color=brown];
stat729[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.26.185.170:*, *:25}[50%]&lt;BR/&gt;{141.26.185.170:25, *:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (41.6667%)&lt;BR/&gt; 47501: (8.33333%)&lt;BR/&gt; 47500: (8.33333%)&lt;BR/&gt; 47470: (8.33333%)&lt;BR/&gt; 4110: (8.33333%)&gt;];
}
3969--4640[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter src_ip="141.26.185.170" src_port="25"/>
      <filter dst_port="25" src_ip="141.26.185.170"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_730{
style=filled;
color=gray75;
3970[label="205.242.10.171;44pkt 44fpkt", shape=pentagon, color=darkviolet];
4641[label="205.242.10.171;44pkt 44fpkt", shape=invtriangle, color=brown];
stat730[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.242.10.171:*, 10.66.1.141:1080}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1080: (50%)&lt;BR/&gt; 4800: (1.13636%)&lt;BR/&gt; 4799: (1.13636%)&lt;BR/&gt; 4798: (1.13636%)&lt;BR/&gt; 4797: (1.13636%)&gt;];
}
3970--4641[label="1;44pkt 44fpkt"];
</description>
    <slice>
      <filter dst_ip="10.66.1.141" dst_port="1080" src_ip="205.242.10.171"/>
    </slice>
    <from sec="1091941217" usec="0"/>
    <to sec="1091942097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_731{
style=filled;
color=gray75;
3982[label="204.51.42.173;16pkt 16fpkt", shape=pentagon, color=darkviolet];
4649[label="204.51.42.173;16pkt 16fpkt", shape=invtriangle, color=brown];
stat731[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.51.42.173:80, 205.248.185.116:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 31853: (3.125%)&lt;BR/&gt; 31840: (3.125%)&lt;BR/&gt; 31580: (3.125%)&lt;BR/&gt; 31555: (3.125%)&gt;];
}
3982--4649[label="1;16pkt 16fpkt"];
</description>
    <slice>
      <filter dst_ip="205.248.185.116" src_ip="204.51.42.173" src_port="80"/>
    </slice>
    <from sec="1091941258" usec="0"/>
    <to sec="1091941492" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.825684,1.24043,010,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_732{
style=filled;
color=gray75;
1496[label="136.171.83.173;s;525pkt 525fpkt", shape=diamond, color=yellow];
3984[label="136.171.83.173;564pkt 564fpkt", shape=pentagon, color=darkviolet];
4651[label="136.171.83.173;564pkt 564fpkt", shape=invtriangle, color=brown];
5076[label="136.171.83.173;564pkt 564fpkt", shape=invhouse, color=bisque];
stat732[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.171.83.173:*, *:25}[85.9929%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (45.8954%)&lt;BR/&gt; 113: (3.65359%)&lt;BR/&gt; 53: (0.45106%)&lt;BR/&gt; 1287: (0.180424%)&lt;BR/&gt; 57264: (0.090212%)&gt;];
}
1496--2050[label="0.129496;18pkt 18fpkt"];
1496--3030[label="0.149533;16pkt 16fpkt"];
1496--3984[label="1;525pkt 525fpkt"];
1496--4651[label="1;525pkt 525fpkt"];
1496--5076[label="1;525pkt 525fpkt"];
3984--4651[label="1;564pkt 564fpkt"];
3984--5076[label="1;564pkt 564fpkt"];
4651--5076[label="1;564pkt 564fpkt"];
</description>
    <slice>
      <filter dst_port="25" src_ip="136.171.83.173"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_733{
style=filled;
color=gray75;
3987[label="68.58.194.173;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4654[label="68.58.194.173;2pkt 2fpkt", shape=invtriangle, color=brown];
5077[label="68.58.194.173;2pkt 2fpkt", shape=invhouse, color=bisque];
stat733[shape=component, label=&lt;Rules:&lt;BR/&gt;{68.58.194.173:1236, 141.221.113.131:135}[50%]&lt;BR/&gt;{68.58.194.173:1413, 141.158.190.145:135}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 1413: (25%)&lt;BR/&gt; 1236: (25%)&gt;];
}
3987--4654[label="1;2pkt 2fpkt"];
3987--5077[label="1;2pkt 2fpkt"];
4654--5077[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="141.158.190.145" dst_port="135" src_ip="68.58.194.173" src_port="1413"/>
      <filter dst_ip="141.221.113.131" dst_port="135" src_ip="68.58.194.173" src_port="1236"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.825684,1.24043,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_734{
style=filled;
color=gray75;
1321[label="136.171.148.174;s;1876pkt 1876fpkt", shape=diamond, color=yellow];
3990[label="136.171.148.174;2033pkt 2033fpkt", shape=pentagon, color=darkviolet];
4656[label="136.171.148.174;2033pkt 2033fpkt", shape=invtriangle, color=brown];
5079[label="136.171.148.174;2033pkt 2033fpkt", shape=invhouse, color=bisque];
stat734[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.171.148.174:53, *:*}[70.2902%]&lt;BR/&gt;{136.171.148.174:2397, *:53}[28.2341%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (53.348%)&lt;BR/&gt; 2397: (14.1129%)&lt;BR/&gt; 0: (1.41693%)&lt;BR/&gt; 32768: (0.934169%)&lt;BR/&gt; 32769: (0.626959%)&gt;];
}
1321--1739[label="0.142857;1pkt 1fpkt"];
1321--1964[label="0.0135135;1pkt 1fpkt"];
1321--2009[label="0.0140845;1pkt 1fpkt"];
1321--2048[label="0.25;1pkt 1fpkt"];
1321--2152[label="0.0169492;1pkt 1fpkt"];
1321--2253[label="0.00980392;1pkt 1fpkt"];
1321--2264[label="0.025;1pkt 1fpkt"];
1321--2266[label="0.00952381;1pkt 1fpkt"];
1321--2416[label="0.0666667;1pkt 1fpkt"];
1321--2424[label="0.0163934;1pkt 1fpkt"];
1321--2784[label="0.2;1pkt 1fpkt"];
1321--2967[label="0.0181818;1pkt 1fpkt"];
1321--3099[label="0.027027;1pkt 1fpkt"];
1321--3263[label="0.033049;62pkt 62fpkt"];
1321--3310[label="0.0703625;132pkt 132fpkt"];
1321--3313[label="0.0687633;129pkt 129fpkt"];
1321--3318[label="0.033049;62pkt 62fpkt"];
1321--3336[label="0.0703625;132pkt 132fpkt"];
1321--3339[label="0.0687633;129pkt 129fpkt"];
1321--3343[label="0.033049;62pkt 62fpkt"];
1321--3346[label="0.0703625;132pkt 132fpkt"];
1321--3349[label="0.0687633;129pkt 129fpkt"];
1321--3990[label="1;1876pkt 1876fpkt"];
1321--4656[label="1;1876pkt 1876fpkt"];
1321--5079[label="1;1876pkt 1876fpkt"];
3990--4656[label="1;2033pkt 2033fpkt"];
3990--5079[label="1;2033pkt 2033fpkt"];
4656--5079[label="1;2033pkt 2033fpkt"];
</description>
    <slice>
      <filter src_ip="136.171.148.174" src_port="53"/>
      <filter dst_port="53" src_ip="136.171.148.174" src_port="2397"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.670948,1.37086,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="213.98.178.174"/>
    </slice>
    <from sec="1091941202" usec="0"/>
    <to sec="1091942063" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_737{
style=filled;
color=gray75;
4009[label="205.248.184.179;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4669[label="205.248.184.179;1pkt 1fpkt", shape=invtriangle, color=brown];
stat737[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.248.184.179:0, 215.223.235.120:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
4009--4669[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="215.223.235.120" src_ip="205.248.184.179"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_738{
style=filled;
color=gray75;
4010[label="136.171.250.179;19pkt 19fpkt", shape=pentagon, color=darkviolet];
4670[label="136.171.250.179;19pkt 19fpkt", shape=invtriangle, color=brown];
stat738[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.171.250.179:*, 212.25.108.38:80}[84.2105%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1377: (2.63158%)&lt;BR/&gt; 1279: (2.63158%)&lt;BR/&gt; 1211: (2.63158%)&lt;BR/&gt; 1210: (2.63158%)&gt;];
}
4010--4670[label="1;19pkt 19fpkt"];
</description>
    <slice>
      <filter dst_ip="212.25.108.38" dst_port="80" src_ip="136.171.250.179"/>
    </slice>
    <from sec="1091941254" usec="0"/>
    <to sec="1091942023" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_739{
style=filled;
color=gray75;
4013[label="221.230.5.181;9pkt 9fpkt", shape=pentagon, color=darkviolet];
4673[label="221.230.5.181;9pkt 9fpkt", shape=invtriangle, color=brown];
stat739[shape=component, label=&lt;Rules:&lt;BR/&gt;{221.230.5.181:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
4013--4673[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="221.230.5.181" src_port="1027"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_740{
style=filled;
color=gray75;
4036[label="204.148.186.186;37pkt 37fpkt", shape=pentagon, color=darkviolet];
4686[label="204.148.186.186;37pkt 37fpkt", shape=invtriangle, color=brown];
stat740[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.148.186.186:*, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2745: (8.10811%)&lt;BR/&gt; 445: (8.10811%)&lt;BR/&gt; 6129: (6.75676%)&lt;BR/&gt; 3127: (6.75676%)&lt;BR/&gt; 1025: (6.75676%)&gt;];
}
4036--4686[label="1;37pkt 37fpkt"];
</description>
    <slice>
      <filter src_ip="204.148.186.186"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942052" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_741{
style=filled;
color=gray75;
4040[label="136.171.54.188;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4690[label="136.171.54.188;2pkt 2fpkt", shape=invtriangle, color=brown];
stat741[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.171.54.188:9898, 215.220.140.64:4462}[50%]&lt;BR/&gt;{136.171.54.188:1153, 4.236.132.156:6699}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (25%)&lt;BR/&gt; 6699: (25%)&lt;BR/&gt; 4462: (25%)&lt;BR/&gt; 1153: (25%)&gt;];
}
4040--4690[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="4.236.132.156" dst_port="6699" src_ip="136.171.54.188" src_port="1153"/>
      <filter dst_ip="215.220.140.64" dst_port="4462" src_ip="136.171.54.188" src_port="9898"/>
    </slice>
    <from sec="1091941210" usec="0"/>
    <to sec="1091942075" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_742{
style=filled;
color=gray75;
4052[label="136.171.255.193;4pkt 4fpkt", shape=pentagon, color=darkviolet];
4697[label="136.171.255.193;4pkt 4fpkt", shape=invtriangle, color=brown];
5108[label="136.171.255.193;3pkt 3fpkt", shape=invhouse, color=bisque];
stat742[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.171.255.193:9898, 104.83.88.242:3766}[25%]&lt;BR/&gt;{136.171.255.193:80, 204.3.34.91:51720}[25%]&lt;BR/&gt;{136.171.255.193:80, 204.3.34.91:51721}[25%]&lt;BR/&gt;{136.171.255.193:80, 204.3.34.91:52164}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (40.9091%)&lt;BR/&gt; 52164: (13.6364%)&lt;BR/&gt; 51721: (13.6364%)&lt;BR/&gt; 51720: (13.6364%)&lt;BR/&gt; 9898: (9.09091%)&gt;];
}
4052--4697[label="1;4pkt 4fpkt"];
4052--5108[label="1;3pkt 3fpkt"];
4697--5108[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="204.3.34.91" dst_port="52164" src_ip="136.171.255.193" src_port="80"/>
      <filter dst_ip="204.3.34.91" dst_port="51721" src_ip="136.171.255.193" src_port="80"/>
      <filter dst_ip="204.3.34.91" dst_port="51720" src_ip="136.171.255.193" src_port="80"/>
      <filter dst_ip="104.83.88.242" dst_port="3766" src_ip="136.171.255.193" src_port="9898"/>
    </slice>
    <from sec="1091941353" usec="0"/>
    <to sec="1091941775" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.656163,1.22043,020,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_743{
style=filled;
color=gray75;
1944[label="172.180.41.194;s;828pkt 828fpkt", shape=diamond, color=yellow];
4053[label="172.180.41.194;901pkt 901fpkt", shape=pentagon, color=darkviolet];
4698[label="172.180.41.194;901pkt 901fpkt", shape=invtriangle, color=brown];
stat743[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.180.41.194:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1944--2892[label="0.00431034;1pkt 1fpkt"];
1944--4053[label="1;828pkt 828fpkt"];
1944--4698[label="1;828pkt 828fpkt"];
4053--4698[label="1;901pkt 901fpkt"];
</description>
    <slice>
      <filter src_ip="172.180.41.194"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_744{
style=filled;
color=gray75;
4054[label="168.115.244.194;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4699[label="168.115.244.194;1pkt 1fpkt", shape=invtriangle, color=brown];
5109[label="168.115.244.194;1pkt 1fpkt", shape=invhouse, color=bisque];
stat744[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.115.244.194:80, 2.229.65.165:49450}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 49450: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
4054--4699[label="1;1pkt 1fpkt"];
4054--5109[label="1;1pkt 1fpkt"];
4699--5109[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="2.229.65.165" dst_port="49450" src_ip="168.115.244.194" src_port="80"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_745{
style=filled;
color=gray75;
4055[label="206.126.1.195;3pkt 3fpkt", shape=pentagon, color=darkviolet];
4700[label="206.126.1.195;3pkt 3fpkt", shape=invtriangle, color=brown];
5110[label="206.126.1.195;3pkt 3fpkt", shape=invhouse, color=bisque];
stat745[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.126.1.195:63872, 141.164.71.96:135}[33.3333%]&lt;BR/&gt;{206.126.1.195:63873, 141.158.79.189:135}[33.3333%]&lt;BR/&gt;{206.126.1.195:63046, 141.176.7.222:135}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 63873: (16.6667%)&lt;BR/&gt; 63872: (16.6667%)&lt;BR/&gt; 63046: (16.6667%)&gt;];
}
4055--4700[label="1;3pkt 3fpkt"];
4055--5110[label="1;3pkt 3fpkt"];
4700--5110[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="141.176.7.222" dst_port="135" src_ip="206.126.1.195" src_port="63046"/>
      <filter dst_ip="141.158.79.189" dst_port="135" src_ip="206.126.1.195" src_port="63873"/>
      <filter dst_ip="141.164.71.96" dst_port="135" src_ip="206.126.1.195" src_port="63872"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_746{
style=filled;
color=gray75;
4062[label="16.109.66.196;231pkt 231fpkt", shape=pentagon, color=darkviolet];
4705[label="16.109.66.196;231pkt 231fpkt", shape=invtriangle, color=brown];
stat746[shape=component, label=&lt;Rules:&lt;BR/&gt;{16.109.66.196:44485, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 44485: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
4062--4705[label="1;231pkt 231fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="16.109.66.196" src_port="44485"/>
    </slice>
    <from sec="1091941502" usec="0"/>
    <to sec="1091941516" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_747{
style=filled;
color=gray75;
4069[label="136.171.65.198;14pkt 14fpkt", shape=pentagon, color=darkviolet];
4709[label="136.171.65.198;14pkt 14fpkt", shape=invtriangle, color=brown];
stat747[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.171.65.198:25, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 4648: (3.57143%)&lt;BR/&gt; 4131: (3.57143%)&lt;BR/&gt; 4082: (3.57143%)&lt;BR/&gt; 4026: (3.57143%)&gt;];
}
4069--4709[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter src_ip="136.171.65.198" src_port="25"/>
    </slice>
    <from sec="1091941206" usec="0"/>
    <to sec="1091942081" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.670948,1.37086,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="204.235.156.202"/>
    </slice>
    <from sec="1091941230" usec="0"/>
    <to sec="1091942089" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_752{
style=filled;
color=gray75;
4098[label="213.147.90.205;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4729[label="213.147.90.205;1pkt 1fpkt", shape=invtriangle, color=brown];
5131[label="213.147.90.205;1pkt 1fpkt", shape=invhouse, color=bisque];
stat752[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.147.90.205:80, 151.125.173.152:3057}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3057: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
4098--4729[label="1;1pkt 1fpkt"];
4098--5131[label="1;1pkt 1fpkt"];
4729--5131[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="151.125.173.152" dst_port="3057" src_ip="213.147.90.205" src_port="80"/>
    </slice>
    <from sec="1091941362" usec="0"/>
    <to sec="1091941370" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_753{
style=filled;
color=gray75;
4105[label="211.101.140.208;239pkt 239fpkt", shape=pentagon, color=darkviolet];
4733[label="211.101.140.208;239pkt 239fpkt", shape=invtriangle, color=brown];
5134[label="211.101.140.208;239pkt 239fpkt", shape=invhouse, color=bisque];
stat753[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.101.140.208:*, *:9898}[57.7406%]&lt;BR/&gt;{211.101.140.208:*, *:5554}[42.2594%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (28.8703%)&lt;BR/&gt; 5554: (21.1297%)&lt;BR/&gt; 2729: (0.209205%)&lt;BR/&gt; 2727: (0.209205%)&lt;BR/&gt; 2726: (0.209205%)&gt;];
}
4105--4733[label="1;239pkt 239fpkt"];
4105--5134[label="1;239pkt 239fpkt"];
4733--5134[label="1;239pkt 239fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="211.101.140.208"/>
      <filter dst_port="5554" src_ip="211.101.140.208"/>
    </slice>
    <from sec="1091941831" usec="0"/>
    <to sec="1091941834" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_755{
style=filled;
color=gray75;
4111[label="198.58.35.212;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4737[label="198.58.35.212;1pkt 1fpkt", shape=invtriangle, color=brown];
5138[label="198.58.35.212;1pkt 1fpkt", shape=invhouse, color=bisque];
stat755[shape=component, label=&lt;Rules:&lt;BR/&gt;{198.58.35.212:0, 82.20.57.48:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
4111--4737[label="1;1pkt 1fpkt"];
4111--5138[label="1;1pkt 1fpkt"];
4737--5138[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="82.20.57.48" src_ip="198.58.35.212"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.773242,1.19457,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_756{
style=filled;
color=gray75;
1720[label="141.26.45.218;s;93pkt 93fpkt", shape=diamond, color=yellow];
2765[label="141.26.45.218;s;78pkt 78fpkt", shape=hexagon, color=black];
4122[label="141.26.45.218;96pkt 96fpkt", shape=pentagon, color=darkviolet];
4746[label="141.26.45.218;96pkt 96fpkt", shape=invtriangle, color=brown];
stat756[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.26.45.218:*, 213.94.69.4:80}[46.875%]&lt;BR/&gt;{141.26.45.218:*, 203.24.32.160:80}[28.125%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4854: (0.550964%)&lt;BR/&gt; 4572: (0.550964%)&lt;BR/&gt; 4570: (0.550964%)&lt;BR/&gt; 4569: (0.550964%)&gt;];
}
1720--2765[label="1;78pkt 78fpkt"];
1720--4122[label="1;93pkt 93fpkt"];
1720--4746[label="1;93pkt 93fpkt"];
2765--4122[label="1;78pkt 78fpkt"];
2765--4746[label="1;78pkt 78fpkt"];
4122--4746[label="1;96pkt 96fpkt"];
</description>
    <slice>
      <filter dst_ip="213.94.69.4" dst_port="80" src_ip="141.26.45.218"/>
      <filter dst_ip="203.24.32.160" dst_port="80" src_ip="141.26.45.218"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_757{
style=filled;
color=gray75;
4130[label="3.181.29.221;4pkt 4fpkt", shape=pentagon, color=darkviolet];
4750[label="3.181.29.221;4pkt 4fpkt", shape=invtriangle, color=brown];
stat757[shape=component, label=&lt;Rules:&lt;BR/&gt;{3.181.29.221:52097, 141.26.185.195:80}[25%]&lt;BR/&gt;{3.181.29.221:52144, 141.26.185.195:80}[25%]&lt;BR/&gt;{3.181.29.221:58309, 141.26.185.195:80}[25%]&lt;BR/&gt;{3.181.29.221:58353, 141.26.185.195:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 58353: (12.5%)&lt;BR/&gt; 58309: (12.5%)&lt;BR/&gt; 52144: (12.5%)&lt;BR/&gt; 52097: (12.5%)&gt;];
}
4130--4750[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="141.26.185.195" dst_port="80" src_ip="3.181.29.221" src_port="58353"/>
      <filter dst_ip="141.26.185.195" dst_port="80" src_ip="3.181.29.221" src_port="58309"/>
      <filter dst_ip="141.26.185.195" dst_port="80" src_ip="3.181.29.221" src_port="52144"/>
      <filter dst_ip="141.26.185.195" dst_port="80" src_ip="3.181.29.221" src_port="52097"/>
    </slice>
    <from sec="1091941321" usec="0"/>
    <to sec="1091941478" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_758{
style=filled;
color=gray75;
4133[label="211.111.148.221;117pkt 117fpkt", shape=pentagon, color=darkviolet];
4752[label="211.111.148.221;117pkt 117fpkt", shape=invtriangle, color=brown];
stat758[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.111.148.221:1032, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1032: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
4133--4752[label="1;117pkt 117fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="211.111.148.221" src_port="1032"/>
    </slice>
    <from sec="1091941754" usec="0"/>
    <to sec="1091941776" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_759{
style=filled;
color=gray75;
4142[label="3.181.27.225;8pkt 8fpkt", shape=pentagon, color=darkviolet];
4758[label="3.181.27.225;8pkt 8fpkt", shape=invtriangle, color=brown];
stat759[shape=component, label=&lt;Rules:&lt;BR/&gt;{3.181.27.225:25, 205.248.144.45:*}[62.5%]&lt;BR/&gt;{3.181.27.225:25, 168.115.209.32:*}[37.5%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 65404: (6.25%)&lt;BR/&gt; 65386: (6.25%)&lt;BR/&gt; 65382: (6.25%)&lt;BR/&gt; 65366: (6.25%)&gt;];
}
4142--4758[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="205.248.144.45" src_ip="3.181.27.225" src_port="25"/>
      <filter dst_ip="168.115.209.32" src_ip="3.181.27.225" src_port="25"/>
    </slice>
    <from sec="1091941252" usec="0"/>
    <to sec="1091942015" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_761{
style=filled;
color=gray75;
4148[label="168.115.154.227;4pkt 4fpkt", shape=pentagon, color=darkviolet];
4761[label="168.115.154.227;4pkt 4fpkt", shape=invtriangle, color=brown];
stat761[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.115.154.227:3017, 216.238.149.5:53}[25%]&lt;BR/&gt;{168.115.154.227:1454, 153.33.21.105:15000}[25%]&lt;BR/&gt;{168.115.154.227:3265, 221.29.116.107:110}[25%]&lt;BR/&gt;{168.115.154.227:3017, 153.33.21.113:53}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3017: (25%)&lt;BR/&gt; 53: (25%)&lt;BR/&gt; 15000: (12.5%)&lt;BR/&gt; 3265: (12.5%)&lt;BR/&gt; 1454: (12.5%)&gt;];
}
4148--4761[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="153.33.21.113" dst_port="53" src_ip="168.115.154.227" src_port="3017"/>
      <filter dst_ip="221.29.116.107" dst_port="110" src_ip="168.115.154.227" src_port="3265"/>
      <filter dst_ip="153.33.21.105" dst_port="15000" src_ip="168.115.154.227" src_port="1454"/>
      <filter dst_ip="216.238.149.5" dst_port="53" src_ip="168.115.154.227" src_port="3017"/>
    </slice>
    <from sec="1091941210" usec="0"/>
    <to sec="1091942097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_762{
style=filled;
color=gray75;
4164[label="197.210.109.233;128pkt 128fpkt", shape=pentagon, color=darkviolet];
4771[label="197.210.109.233;128pkt 128fpkt", shape=invtriangle, color=brown];
5163[label="197.210.109.233;128pkt 128fpkt", shape=invhouse, color=bisque];
stat762[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.210.109.233:10004, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 10004: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
4164--4771[label="1;128pkt 128fpkt"];
4164--5163[label="1;128pkt 128fpkt"];
4771--5163[label="1;128pkt 128fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="197.210.109.233" src_port="10004"/>
    </slice>
    <from sec="1091941384" usec="0"/>
    <to sec="1091941404" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_763{
style=filled;
color=gray75;
4177[label="210.131.199.237;319pkt 319fpkt", shape=pentagon, color=darkviolet];
4783[label="210.131.199.237;319pkt 319fpkt", shape=invtriangle, color=brown];
5171[label="210.131.199.237;319pkt 319fpkt", shape=invhouse, color=bisque];
stat763[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.131.199.237:*, *:9898}[55.4859%]&lt;BR/&gt;{210.131.199.237:*, *:5554}[44.5141%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (27.7429%)&lt;BR/&gt; 5554: (22.2571%)&lt;BR/&gt; 3296: (0.15674%)&lt;BR/&gt; 3292: (0.15674%)&lt;BR/&gt; 3222: (0.15674%)&gt;];
}
4177--4783[label="1;319pkt 319fpkt"];
4177--5171[label="1;319pkt 319fpkt"];
4783--5171[label="1;319pkt 319fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="210.131.199.237"/>
      <filter dst_port="5554" src_ip="210.131.199.237"/>
    </slice>
    <from sec="1091941320" usec="0"/>
    <to sec="1091941322" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.670948,1.37086,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="139.30.170.245"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810129,1.31407,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_766{
style=filled;
color=gray75;
4208[label="136.171.104.248;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4806[label="136.171.104.248;1pkt 1fpkt", shape=invtriangle, color=brown];
5192[label="136.171.104.248;1pkt 1fpkt", shape=invhouse, color=bisque];
stat766[shape=component, label=&lt;Rules:&lt;BR/&gt;{136.171.104.248:58844, 197.73.96.238:25}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 58844: (50%)&lt;BR/&gt; 25: (50%)&gt;];
}
4208--4806[label="1;1pkt 1fpkt"];
4208--5192[label="1;1pkt 1fpkt"];
4806--5192[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="197.73.96.238" dst_port="25" src_ip="136.171.104.248" src_port="58844"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.780648,1.41548,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="204.244.111.5"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.780648,1.41548,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="0.157.154.31"/>
    </slice>
    <from sec="1091941201" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.636478,1.29521,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_771{
style=filled;
color=gray75;
3632[label="204.40.42.79;6pkt 6fpkt", shape=pentagon, color=darkviolet];
4407[label="204.40.42.79;6pkt 6fpkt", shape=invtriangle, color=brown];
stat771[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.40.42.79:32768, *:53}[83.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 32768: (41.6667%)&lt;BR/&gt; 53: (41.6667%)&lt;BR/&gt; 4332: (8.33333%)&lt;BR/&gt; 25: (8.33333%)&gt;];
}
3632--4407[label="1;6pkt 6fpkt"];
3632--4919[label="0.166667;1pkt 1fpkt"];
4407--4919[label="0.166667;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="53" src_ip="204.40.42.79" src_port="32768"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.780648,1.41548,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="118.245.147.90"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.780648,1.41548,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="221.90.184.105"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.780648,1.41548,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="199.191.39.125"/>
    </slice>
    <from sec="1091942100" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.780648,1.41548,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="118.129.194.162"/>
    </slice>
    <from sec="1091941268" usec="0"/>
    <to sec="1091941349" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.796779,1.34739,010,0 0 0 1 0 0 0 0 0 0 0 1 ">
    <description>subgraph cluster_776{
style=filled;
color=gray75;
2294[label="206.80.97.197;s;441pkt 441fpkt", shape=diamond, color=yellow];
5116[label="206.80.97.197;489pkt 489fpkt", shape=invhouse, color=bisque];
stat776[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.80.97.197:*, *:135}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 4062: (0.322581%)&lt;BR/&gt; 3217: (0.322581%)&lt;BR/&gt; 3155: (0.322581%)&lt;BR/&gt; 3100: (0.322581%)&gt;];
}
2294--5116[label="1;441pkt 441fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="206.80.97.197"/>
    </slice>
    <from sec="1091941378" usec="0"/>
    <to sec="1091942101" usec="0"/>
  </anomaly>

</admd:annotation>
