<?xml version="1.0" encoding="UTF-8" standalone="no" ?>
<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">

  <anomaly type="notice" value="0.616717,1.38048,503,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="145.238.10.57" dst_port="80" proto="tcp" src_ip="49.129.94.35" src_port="46353"/>
      <filter dst_ip="145.238.10.57" dst_port="80" proto="tcp" src_ip="49.129.94.35" src_port="65523"/>
      <filter dst_ip="145.238.10.57" dst_port="80" proto="tcp" src_ip="49.129.94.35" src_port="65493"/>
      <filter dst_ip="145.238.213.66" dst_port="80" proto="tcp" src_ip="49.129.94.35" src_port="46353"/>
      <filter dst_ip="145.238.213.66" dst_port="80" proto="tcp" src_ip="49.129.94.35" src_port="65523"/>
      <filter dst_ip="145.238.213.66" dst_port="80" proto="tcp" src_ip="49.129.94.35" src_port="65493"/>
      <from sec="1097384853" usec="0"/>
      <to sec="1097385222" usec="0"/>
    </slice>
    <from sec="1097384853" usec="0"/>
    <to sec="1097385226" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.616717,1.38048,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="192.146.232.86" src_port="443"/>
      <from sec="1097384504" usec="0"/>
      <to sec="1097384869" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="165.74.0.86" src_port="443"/>
      <from sec="1097384501" usec="0"/>
      <to sec="1097384875" usec="0"/>
    </slice>
    <from sec="1097384501" usec="0"/>
    <to sec="1097384877" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.616717,1.38048,999,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="145.238.204.25" dst_port="2400" proto="tcp" src_ip="48.11.40.163" src_port="17637"/>
      <from sec="1097384711" usec="0"/>
      <to sec="1097385054" usec="0"/>
    </slice>
    <from sec="1097384711" usec="0"/>
    <to sec="1097385054" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.616717,1.38048,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="tcp" src_ip="53.15.32.197" src_port="1025"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="udp" src_ip="53.15.32.197" src_port="1025"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="tcp" src_ip="53.15.32.197" src_port="1025"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="udp" src_ip="53.15.32.197" src_port="1025"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="tcp" src_ip="53.15.32.197" src_port="1025"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="udp" src_ip="53.15.32.197" src_port="1025"/>
      <from sec="1097384910" usec="0"/>
      <to sec="1097384941" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="tcp" src_ip="209.225.135.92" src_port="1025"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="udp" src_ip="209.225.135.92" src_port="1025"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="tcp" src_ip="209.225.135.92" src_port="1025"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="udp" src_ip="209.225.135.92" src_port="1025"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="tcp" src_ip="209.225.135.92" src_port="1025"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="udp" src_ip="209.225.135.92" src_port="1025"/>
      <from sec="1097384914" usec="0"/>
      <to sec="1097384941" usec="0"/>
    </slice>
    <from sec="1097384910" usec="0"/>
    <to sec="1097384941" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.616717,1.38048,503,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="139.80.117.57" dst_port="2325" proto="tcp" src_ip="208.21.218.200" src_port="80"/>
      <filter dst_ip="139.80.117.57" dst_port="2326" proto="tcp" src_ip="208.21.218.200" src_port="80"/>
      <from sec="1097385113" usec="0"/>
      <to sec="1097385115" usec="0"/>
    </slice>
    <from sec="1097385110" usec="0"/>
    <to sec="1097385115" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.616717,1.38048,999,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="139.80.33.135" dst_port="63652" proto="tcp" src_ip="49.66.48.214" src_port="873"/>
      <from sec="1097384522" usec="0"/>
      <to sec="1097384560" usec="0"/>
    </slice>
    <from sec="1097384522" usec="0"/>
    <to sec="1097384560" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.616717,1.38048,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="52.201.66.193" dst_port="80" proto="icmp"/>
      <filter dst_ip="52.201.66.193" dst_port="80" proto="icmp"/>
      <filter dst_ip="52.201.66.193" dst_port="80" proto="icmp"/>
      <filter dst_ip="52.201.66.193" dst_port="80" proto="icmp"/>
      <from sec="1097384855" usec="0"/>
      <to sec="1097385297" usec="0"/>
    </slice>
    <from sec="1097384855" usec="0"/>
    <to sec="1097385298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.616717,1.38048,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="193.37.96.2" src_port="1030"/>
      <from sec="1097385234" usec="0"/>
      <to sec="1097385242" usec="0"/>
    </slice>
    <from sec="1097385234" usec="0"/>
    <to sec="1097385242" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.616717,1.38048,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="193.80.178.32" src_port="1047"/>
      <from sec="1097385171" usec="0"/>
      <to sec="1097385185" usec="0"/>
    </slice>
    <from sec="1097385171" usec="0"/>
    <to sec="1097385185" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.616717,1.38048,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="197.218.150.89" src_port="60252"/>
      <from sec="1097384855" usec="0"/>
      <to sec="1097384869" usec="0"/>
    </slice>
    <from sec="1097384855" usec="0"/>
    <to sec="1097384869" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.616717,1.38048,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="tcp" src_ip="192.149.89.107" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="udp" src_ip="192.149.89.107" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="tcp" src_ip="192.149.89.107" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="udp" src_ip="192.149.89.107" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="tcp" src_ip="192.149.89.107" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="udp" src_ip="192.149.89.107" src_port="1029"/>
      <from sec="1097384742" usec="0"/>
      <to sec="1097384757" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="tcp" src_ip="209.225.135.92" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="udp" src_ip="209.225.135.92" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="tcp" src_ip="209.225.135.92" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="udp" src_ip="209.225.135.92" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="tcp" src_ip="209.225.135.92" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="udp" src_ip="209.225.135.92" src_port="1029"/>
      <from sec="1097384744" usec="0"/>
      <to sec="1097384754" usec="0"/>
    </slice>
    <from sec="1097384742" usec="0"/>
    <to sec="1097384757" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.616717,1.38048,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="197.207.172.107" src_port="10000"/>
      <from sec="1097384962" usec="0"/>
      <to sec="1097384971" usec="0"/>
    </slice>
    <from sec="1097384962" usec="0"/>
    <to sec="1097384971" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.616717,1.38048,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="108.212.100.131" src_port="1039"/>
      <from sec="1097385241" usec="0"/>
      <to sec="1097385249" usec="0"/>
    </slice>
    <from sec="1097385241" usec="0"/>
    <to sec="1097385249" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.616717,1.38048,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="193.70.60.182" src_port="10252"/>
      <from sec="1097385061" usec="0"/>
      <to sec="1097385070" usec="0"/>
    </slice>
    <from sec="1097385061" usec="0"/>
    <to sec="1097385070" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.616717,1.38048,999,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="146.161.88.94" dst_port="137" proto="udp" src_ip="108.187.101.194" src_port="1027"/>
      <filter dst_ip="146.161.88.94" dst_port="53" proto="udp" src_ip="108.187.101.194" src_port="1027"/>
      <filter dst_ip="146.161.88.94" dst_port="137" proto="udp" src_ip="108.187.101.194" src_port="49152"/>
      <filter dst_ip="146.161.88.94" dst_port="53" proto="udp" src_ip="108.187.101.194" src_port="49152"/>
      <from sec="1097385227" usec="0"/>
      <to sec="1097385235" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="146.161.88.94" dst_port="137" proto="udp" src_ip="165.74.61.194" src_port="1027"/>
      <filter dst_ip="146.161.88.94" dst_port="53" proto="udp" src_ip="165.74.61.194" src_port="1027"/>
      <filter dst_ip="146.161.88.94" dst_port="137" proto="udp" src_ip="165.74.61.194" src_port="49152"/>
      <filter dst_ip="146.161.88.94" dst_port="53" proto="udp" src_ip="165.74.61.194" src_port="49152"/>
      <from sec="1097385232" usec="0"/>
      <to sec="1097385234" usec="0"/>
    </slice>
    <from sec="1097385227" usec="0"/>
    <to sec="1097385235" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.616717,1.38048,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="158.47.105.216" src_port="1025"/>
      <from sec="1097385263" usec="0"/>
      <to sec="1097385271" usec="0"/>
    </slice>
    <from sec="1097385263" usec="0"/>
    <to sec="1097385271" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.616717,1.38048,010,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="135" proto="tcp" src_ip="166.219.58.11"/>
      <filter dst_port="135" proto="udp" src_ip="166.219.58.11"/>
      <filter dst_port="445" proto="tcp" src_ip="166.219.58.11"/>
      <filter dst_port="445" proto="udp" src_ip="166.219.58.11"/>
      <filter dst_port="53" proto="tcp" src_ip="166.219.58.11"/>
      <filter dst_port="53" proto="udp" src_ip="166.219.58.11"/>
      <from sec="1097385276" usec="0"/>
      <to sec="1097385284" usec="0"/>
    </slice>
    <from sec="1097385276" usec="0"/>
    <to sec="1097385284" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.616717,1.38048,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="216.149.62.50" dst_port="137" proto="tcp" src_ip="201.231.75.154"/>
      <filter dst_ip="216.149.62.50" dst_port="137" proto="udp" src_ip="201.231.75.154"/>
      <from sec="1097385241" usec="0"/>
      <to sec="1097385254" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="216.149.62.50" dst_port="137" proto="tcp" src_ip="108.150.243.154"/>
      <filter dst_ip="216.149.62.50" dst_port="137" proto="udp" src_ip="108.150.243.154"/>
      <from sec="1097385249" usec="0"/>
      <to sec="1097385253" usec="0"/>
    </slice>
    <from sec="1097385241" usec="0"/>
    <to sec="1097385256" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.616717,1.38048,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="197.132.228.232"/>
      <from sec="1097385091" usec="0"/>
      <to sec="1097385107" usec="0"/>
    </slice>
    <from sec="1097385091" usec="0"/>
    <to sec="1097385107" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.616717,1.38048,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="138.125.96.181" proto="icmp"/>
      <filter dst_ip="138.125.96.181" proto="icmp"/>
      <filter dst_ip="138.125.96.181" proto="icmp"/>
      <filter dst_ip="138.125.96.181" proto="icmp"/>
      <from sec="1097384933" usec="0"/>
      <to sec="1097384947" usec="0"/>
    </slice>
    <from sec="1097384933" usec="0"/>
    <to sec="1097384947" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.616717,1.38048,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="109.129.231.120" proto="tcp"/>
      <filter dst_ip="109.129.231.120" proto="icmp"/>
      <filter dst_ip="109.129.231.120" proto="tcp"/>
      <filter dst_ip="109.129.231.120" proto="icmp"/>
      <filter dst_ip="109.129.231.120" proto="tcp"/>
      <filter dst_ip="109.129.231.120" proto="icmp"/>
      <filter dst_ip="109.129.231.120" proto="tcp"/>
      <filter dst_ip="109.129.231.120" proto="icmp"/>
      <from sec="1097385266" usec="0"/>
      <to sec="1097385277" usec="0"/>
    </slice>
    <from sec="1097385266" usec="0"/>
    <to sec="1097385277" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.684015,1.39916,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="150.159.164.162" dst_port="135" proto="tcp" src_ip="192.160.99.46" src_port="54321"/>
      <filter dst_ip="150.159.164.162" dst_port="80" proto="tcp" src_ip="192.160.99.46" src_port="54321"/>
      <filter dst_ip="162.95.224.34" dst_port="135" proto="tcp" src_ip="192.160.99.46" src_port="54321"/>
      <filter dst_ip="162.95.224.34" dst_port="80" proto="tcp" src_ip="192.160.99.46" src_port="54321"/>
      <filter dst_ip="150.201.160.94" dst_port="135" proto="tcp" src_ip="192.160.99.46" src_port="54321"/>
      <filter dst_ip="150.201.160.94" dst_port="80" proto="tcp" src_ip="192.160.99.46" src_port="54321"/>
      <filter dst_ip="150.13.196.221" dst_port="135" proto="tcp" src_ip="192.160.99.46" src_port="54321"/>
      <filter dst_ip="150.13.196.221" dst_port="80" proto="tcp" src_ip="192.160.99.46" src_port="54321"/>
      <filter dst_ip="150.13.133.240" dst_port="135" proto="tcp" src_ip="192.160.99.46" src_port="54321"/>
      <filter dst_ip="150.13.133.240" dst_port="80" proto="tcp" src_ip="192.160.99.46" src_port="54321"/>
      <from sec="1097384575" usec="0"/>
      <to sec="1097384607" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="150.159.164.162" dst_port="135" proto="tcp" src_ip="111.193.123.46" src_port="54321"/>
      <filter dst_ip="150.159.164.162" dst_port="80" proto="tcp" src_ip="111.193.123.46" src_port="54321"/>
      <filter dst_ip="162.95.224.34" dst_port="135" proto="tcp" src_ip="111.193.123.46" src_port="54321"/>
      <filter dst_ip="162.95.224.34" dst_port="80" proto="tcp" src_ip="111.193.123.46" src_port="54321"/>
      <filter dst_ip="150.201.160.94" dst_port="135" proto="tcp" src_ip="111.193.123.46" src_port="54321"/>
      <filter dst_ip="150.201.160.94" dst_port="80" proto="tcp" src_ip="111.193.123.46" src_port="54321"/>
      <filter dst_ip="150.13.196.221" dst_port="135" proto="tcp" src_ip="111.193.123.46" src_port="54321"/>
      <filter dst_ip="150.13.196.221" dst_port="80" proto="tcp" src_ip="111.193.123.46" src_port="54321"/>
      <filter dst_ip="150.13.133.240" dst_port="135" proto="tcp" src_ip="111.193.123.46" src_port="54321"/>
      <filter dst_ip="150.13.133.240" dst_port="80" proto="tcp" src_ip="111.193.123.46" src_port="54321"/>
      <from sec="1097384594" usec="0"/>
      <to sec="1097384606" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="150.159.164.162" dst_port="135" proto="tcp" src_ip="52.255.167.46" src_port="54321"/>
      <filter dst_ip="150.159.164.162" dst_port="80" proto="tcp" src_ip="52.255.167.46" src_port="54321"/>
      <filter dst_ip="162.95.224.34" dst_port="135" proto="tcp" src_ip="52.255.167.46" src_port="54321"/>
      <filter dst_ip="162.95.224.34" dst_port="80" proto="tcp" src_ip="52.255.167.46" src_port="54321"/>
      <filter dst_ip="150.201.160.94" dst_port="135" proto="tcp" src_ip="52.255.167.46" src_port="54321"/>
      <filter dst_ip="150.201.160.94" dst_port="80" proto="tcp" src_ip="52.255.167.46" src_port="54321"/>
      <filter dst_ip="150.13.196.221" dst_port="135" proto="tcp" src_ip="52.255.167.46" src_port="54321"/>
      <filter dst_ip="150.13.196.221" dst_port="80" proto="tcp" src_ip="52.255.167.46" src_port="54321"/>
      <filter dst_ip="150.13.133.240" dst_port="135" proto="tcp" src_ip="52.255.167.46" src_port="54321"/>
      <filter dst_ip="150.13.133.240" dst_port="80" proto="tcp" src_ip="52.255.167.46" src_port="54321"/>
      <from sec="1097384595" usec="0"/>
      <to sec="1097384604" usec="0"/>
    </slice>
    <from sec="1097384575" usec="0"/>
    <to sec="1097384607" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.684015,1.39916,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="192.146.232.86" src_port="443"/>
      <from sec="1097384504" usec="0"/>
      <to sec="1097384869" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="165.74.0.86" src_port="443"/>
      <from sec="1097384501" usec="0"/>
      <to sec="1097384875" usec="0"/>
    </slice>
    <from sec="1097384501" usec="0"/>
    <to sec="1097384877" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.751869,1.2225,503,1 1 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_26{
style=filled;
color=gray75;
48[label="193.129.95.121s;1pkt 1fpkt", shape=rectangle, color=red];
306[label="193.129.95.121s;1pkt 1fpkt", shape=ellipse, color=green];
673[label="145.238.81.250;d;75pkt 75fpkt", shape=diamond, color=yellow];
970[label="197.40.247.121;s;8pkt 8fpkt", shape=diamond, color=yellow];
1191[label="49.16.79.131;s;104pkt 104fpkt", shape=diamond, color=yellow];
1533[label="212.43.107.140;s;1pkt 1fpkt", shape=diamond, color=yellow];
1989[label="42.110.20.37;4pkt 4fpkt", shape=pentagon, color=darkviolet];
2132[label="197.40.247.121;13pkt 13fpkt", shape=pentagon, color=darkviolet];
2164[label="199.44.64.140;20pkt 20fpkt", shape=pentagon, color=darkviolet];
2169[label="51.212.50.142;38pkt 38fpkt", shape=pentagon, color=darkviolet];
stat26[shape=component, label=&lt;Rules:&lt;BR/&gt;{49.16.79.131:80, *:*}[45.2174%]&lt;BR/&gt;{*:80, 145.238.81.250:*}[25.6522%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (41.8868%)&lt;BR/&gt; 18387: (4.33962%)&lt;BR/&gt; 18067: (2.07547%)&lt;BR/&gt; 2023: (0.754717%)&lt;BR/&gt; 1755: (0.754717%)&gt;];
}
48--306[label="1;1pkt 1fpkt"];
48--673[label="1;1pkt 1fpkt"];
306--673[label="1;1pkt 1fpkt"];
673--970[label="1;8pkt 8fpkt"];
673--1038[label="0.0666667;5pkt 5fpkt"];
673--1191[label="0.0533333;4pkt 4fpkt"];
673--1533[label="1;1pkt 1fpkt"];
673--1989[label="0.25;1pkt 1fpkt"];
673--2132[label="0.923077;12pkt 12fpkt"];
673--2164[label="0.1;2pkt 2fpkt"];
673--2169[label="0.131579;5pkt 5fpkt"];
970--2132[label="0.875;7pkt 7fpkt"];
1191--1358[label="0.213333;16pkt 16fpkt"];
1191--1365[label="0.103448;3pkt 3fpkt"];
1191--1593[label="0.0714286;1pkt 1fpkt"];
1191--1639[label="0.00961538;1pkt 1fpkt"];
1191--1643[label="0.0615385;4pkt 4fpkt"];
1191--1737[label="0.233333;14pkt 14fpkt"];
1191--1825[label="0.00961538;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="49.16.79.131" src_port="80"/>
      <filter dst_ip="145.238.81.250" src_port="80"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385297" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.753972,1.28641,503,1 1 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_28{
style=filled;
color=gray75;
96[label="208.139.229.133s;38pkt 38fpkt", shape=rectangle, color=red];
323[label="208.139.229.133s;27pkt 27fpkt", shape=ellipse, color=green];
1615[label="208.139.229.133;s;61pkt 61fpkt", shape=diamond, color=yellow];
stat28[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.139.229.133:*, 51.243.230.127:80}[97.1429%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2510: (1.5873%)&lt;BR/&gt; 2549: (1.19048%)&lt;BR/&gt; 2546: (1.19048%)&lt;BR/&gt; 2544: (1.19048%)&gt;];
}
96--323[label="0.925926;25pkt 25fpkt"];
96--1615[label="0.815789;31pkt 31fpkt"];
323--1615[label="0.925926;25pkt 25fpkt"];
</description>
    <slice>
      <filter dst_ip="51.243.230.127" dst_port="80" src_ip="208.139.229.133"/>
    </slice>
    <from sec="1097385190" usec="0"/>
    <to sec="1097385232" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.684015,1.39916,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="52.201.66.193" dst_port="80" proto="icmp"/>
      <filter dst_ip="52.201.66.193" dst_port="80" proto="icmp"/>
      <filter dst_ip="52.201.66.193" dst_port="80" proto="icmp"/>
      <filter dst_ip="52.201.66.193" dst_port="80" proto="icmp"/>
      <from sec="1097384875" usec="0"/>
      <to sec="1097385297" usec="0"/>
    </slice>
    <from sec="1097384875" usec="0"/>
    <to sec="1097385298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.684015,1.39916,002,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="194.50.62.12" src_port="63075"/>
      <from sec="1097385002" usec="0"/>
      <to sec="1097385011" usec="0"/>
    </slice>
    <from sec="1097385002" usec="0"/>
    <to sec="1097385011" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.753972,1.28641,999,1 1 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_33{
style=filled;
color=gray75;
108[label="209.46.164.17s;1pkt 1fpkt", shape=rectangle, color=red];
330[label="209.46.164.17s;1pkt 1fpkt", shape=ellipse, color=green];
753[label="209.46.164.17;s;1292pkt 1292fpkt", shape=diamond, color=yellow];
1361[label="50.35.152.23;d;39pkt 39fpkt", shape=diamond, color=yellow];
1551[label="205.210.4.48;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat33[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.46.164.17:25, *:*}[48.9559%]&lt;BR/&gt;{209.46.164.17:2883, *:53}[30.2398%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (23.988%)&lt;BR/&gt; 53: (20.3898%)&lt;BR/&gt; 2883: (14.6552%)&lt;BR/&gt; 80: (5.2099%)&lt;BR/&gt; 0: (1.27436%)&gt;];
}
108--330[label="1;1pkt 1fpkt"];
108--753[label="1;1pkt 1fpkt"];
330--753[label="1;1pkt 1fpkt"];
753--1144[label="0.0116279;1pkt 1fpkt"];
753--1333[label="0.0107527;1pkt 1fpkt"];
753--1361[label="0.974359;38pkt 38fpkt"];
753--1406[label="0.0140845;1pkt 1fpkt"];
753--1493[label="0.0119048;1pkt 1fpkt"];
753--1499[label="0.0140845;1pkt 1fpkt"];
753--1551[label="1;1pkt 1fpkt"];
753--1571[label="0.00699301;1pkt 1fpkt"];
753--1831[label="0.0255418;33pkt 33fpkt"];
753--1846[label="0.0410217;53pkt 53fpkt"];
753--1858[label="0.0534056;69pkt 69fpkt"];
753--1865[label="0.0255418;33pkt 33fpkt"];
753--1879[label="0.0417957;54pkt 54fpkt"];
753--1893[label="0.0263158;34pkt 34fpkt"];
753--1902[label="0.0410217;53pkt 53fpkt"];
</description>
    <slice>
      <filter src_ip="209.46.164.17" src_port="25"/>
      <filter dst_port="53" src_ip="209.46.164.17" src_port="2883"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.745844,1.33897,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_34{
style=filled;
color=gray75;
109[label="108.189.96.23s;252pkt 252fpkt", shape=rectangle, color=red];
331[label="108.189.96.23s;209pkt 209fpkt", shape=ellipse, color=green];
stat34[shape=component, label=&lt;Rules:&lt;BR/&gt;{108.189.96.23:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
109--331[label="1;209pkt 209fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="108.189.96.23" src_port="1028"/>
    </slice>
    <from sec="1097384900" usec="0"/>
    <to sec="1097384941" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.684015,1.39916,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="tcp" src_ip="45.103.123.56" src_port="1031"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="udp" src_ip="45.103.123.56" src_port="1031"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="tcp" src_ip="45.103.123.56" src_port="1031"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="udp" src_ip="45.103.123.56" src_port="1031"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="tcp" src_ip="45.103.123.56" src_port="1031"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="udp" src_ip="45.103.123.56" src_port="1031"/>
      <from sec="1097384688" usec="0"/>
      <to sec="1097384698" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="tcp" src_ip="209.225.135.92" src_port="1031"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="udp" src_ip="209.225.135.92" src_port="1031"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="tcp" src_ip="209.225.135.92" src_port="1031"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="udp" src_ip="209.225.135.92" src_port="1031"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="tcp" src_ip="209.225.135.92" src_port="1031"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="udp" src_ip="209.225.135.92" src_port="1031"/>
      <from sec="1097384688" usec="0"/>
      <to sec="1097384698" usec="0"/>
    </slice>
    <from sec="1097384687" usec="0"/>
    <to sec="1097384698" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.684015,1.39916,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="tcp" src_ip="132.221.244.70" src_port="1027"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="udp" src_ip="132.221.244.70" src_port="1027"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="tcp" src_ip="132.221.244.70" src_port="1027"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="udp" src_ip="132.221.244.70" src_port="1027"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="tcp" src_ip="132.221.244.70" src_port="1027"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="udp" src_ip="132.221.244.70" src_port="1027"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="tcp" src_ip="132.221.244.70" src_port="1026"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="udp" src_ip="132.221.244.70" src_port="1026"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="tcp" src_ip="132.221.244.70" src_port="1026"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="udp" src_ip="132.221.244.70" src_port="1026"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="tcp" src_ip="132.221.244.70" src_port="1026"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="udp" src_ip="132.221.244.70" src_port="1026"/>
      <from sec="1097385025" usec="0"/>
      <to sec="1097385036" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="tcp" src_ip="145.238.72.246" src_port="1027"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="udp" src_ip="145.238.72.246" src_port="1027"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="tcp" src_ip="145.238.72.246" src_port="1027"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="udp" src_ip="145.238.72.246" src_port="1027"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="tcp" src_ip="145.238.72.246" src_port="1027"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="udp" src_ip="145.238.72.246" src_port="1027"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="tcp" src_ip="145.238.72.246" src_port="1026"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="udp" src_ip="145.238.72.246" src_port="1026"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="tcp" src_ip="145.238.72.246" src_port="1026"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="udp" src_ip="145.238.72.246" src_port="1026"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="tcp" src_ip="145.238.72.246" src_port="1026"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="udp" src_ip="145.238.72.246" src_port="1026"/>
      <from sec="1097385027" usec="0"/>
      <to sec="1097385036" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="tcp" src_ip="209.225.135.92" src_port="1027"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="udp" src_ip="209.225.135.92" src_port="1027"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="tcp" src_ip="209.225.135.92" src_port="1027"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="udp" src_ip="209.225.135.92" src_port="1027"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="tcp" src_ip="209.225.135.92" src_port="1027"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="udp" src_ip="209.225.135.92" src_port="1027"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="tcp" src_ip="209.225.135.92" src_port="1026"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="udp" src_ip="209.225.135.92" src_port="1026"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="tcp" src_ip="209.225.135.92" src_port="1026"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="udp" src_ip="209.225.135.92" src_port="1026"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="tcp" src_ip="209.225.135.92" src_port="1026"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="udp" src_ip="209.225.135.92" src_port="1026"/>
      <from sec="1097385027" usec="0"/>
      <to sec="1097385036" usec="0"/>
    </slice>
    <from sec="1097385025" usec="0"/>
    <to sec="1097385036" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.684015,1.39916,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="tcp" src_ip="192.149.89.107" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="udp" src_ip="192.149.89.107" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="tcp" src_ip="192.149.89.107" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="udp" src_ip="192.149.89.107" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="tcp" src_ip="192.149.89.107" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="udp" src_ip="192.149.89.107" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="tcp" src_ip="192.149.89.107" src_port="1036"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="udp" src_ip="192.149.89.107" src_port="1036"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="tcp" src_ip="192.149.89.107" src_port="1036"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="udp" src_ip="192.149.89.107" src_port="1036"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="tcp" src_ip="192.149.89.107" src_port="1036"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="udp" src_ip="192.149.89.107" src_port="1036"/>
      <from sec="1097384743" usec="0"/>
      <to sec="1097384754" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="tcp" src_ip="108.235.101.207" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="udp" src_ip="108.235.101.207" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="tcp" src_ip="108.235.101.207" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="udp" src_ip="108.235.101.207" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="tcp" src_ip="108.235.101.207" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="udp" src_ip="108.235.101.207" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="tcp" src_ip="108.235.101.207" src_port="1036"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="udp" src_ip="108.235.101.207" src_port="1036"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="tcp" src_ip="108.235.101.207" src_port="1036"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="udp" src_ip="108.235.101.207" src_port="1036"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="tcp" src_ip="108.235.101.207" src_port="1036"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="udp" src_ip="108.235.101.207" src_port="1036"/>
      <from sec="1097384743" usec="0"/>
      <to sec="1097384754" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="tcp" src_ip="209.225.135.92" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="udp" src_ip="209.225.135.92" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="tcp" src_ip="209.225.135.92" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="udp" src_ip="209.225.135.92" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="tcp" src_ip="209.225.135.92" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="udp" src_ip="209.225.135.92" src_port="1029"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="tcp" src_ip="209.225.135.92" src_port="1036"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="udp" src_ip="209.225.135.92" src_port="1036"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="tcp" src_ip="209.225.135.92" src_port="1036"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="udp" src_ip="209.225.135.92" src_port="1036"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="tcp" src_ip="209.225.135.92" src_port="1036"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="udp" src_ip="209.225.135.92" src_port="1036"/>
      <from sec="1097384744" usec="0"/>
      <to sec="1097384754" usec="0"/>
    </slice>
    <from sec="1097384743" usec="0"/>
    <to sec="1097384754" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.745844,1.33897,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_49{
style=filled;
color=gray75;
133[label="196.129.72.120s;138pkt 138fpkt", shape=rectangle, color=red];
349[label="196.129.72.120s;138pkt 138fpkt", shape=ellipse, color=green];
stat49[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.129.72.120:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
133--349[label="1;138pkt 138fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="196.129.72.120" src_port="1027"/>
    </slice>
    <from sec="1097384841" usec="0"/>
    <to sec="1097384849" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.743718,1.27769,002,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_50{
style=filled;
color=gray75;
138[label="108.212.100.151s;256pkt 256fpkt", shape=rectangle, color=red];
353[label="108.212.100.151s;229pkt 229fpkt", shape=ellipse, color=green];
2190[label="108.212.100.151;256pkt 256fpkt", shape=pentagon, color=darkviolet];
stat50[shape=component, label=&lt;Rules:&lt;BR/&gt;{108.212.100.151:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
138--353[label="1;229pkt 229fpkt"];
138--2190[label="1;256pkt 256fpkt"];
353--2190[label="1;229pkt 229fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="108.212.100.151" src_port="1027"/>
    </slice>
    <from sec="1097384635" usec="0"/>
    <to sec="1097384651" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.745844,1.33897,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_51{
style=filled;
color=gray75;
141[label="193.65.189.179s;148pkt 148fpkt", shape=rectangle, color=red];
355[label="193.65.189.179s;47pkt 47fpkt", shape=ellipse, color=green];
stat51[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.65.189.179:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
141--355[label="1;47pkt 47fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="193.65.189.179" src_port="1029"/>
    </slice>
    <from sec="1097384917" usec="0"/>
    <to sec="1097384941" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.684015,1.39916,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="tcp" src_ip="53.15.32.197" src_port="1025"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="udp" src_ip="53.15.32.197" src_port="1025"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="tcp" src_ip="53.15.32.197" src_port="1025"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="udp" src_ip="53.15.32.197" src_port="1025"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="tcp" src_ip="53.15.32.197" src_port="1025"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="udp" src_ip="53.15.32.197" src_port="1025"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="tcp" src_ip="53.15.32.197" src_port="1026"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="udp" src_ip="53.15.32.197" src_port="1026"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="tcp" src_ip="53.15.32.197" src_port="1026"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="udp" src_ip="53.15.32.197" src_port="1026"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="tcp" src_ip="53.15.32.197" src_port="1026"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="udp" src_ip="53.15.32.197" src_port="1026"/>
      <from sec="1097384914" usec="0"/>
      <to sec="1097384941" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="tcp" src_ip="209.225.135.92" src_port="1025"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="udp" src_ip="209.225.135.92" src_port="1025"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="tcp" src_ip="209.225.135.92" src_port="1025"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="udp" src_ip="209.225.135.92" src_port="1025"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="tcp" src_ip="209.225.135.92" src_port="1025"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="udp" src_ip="209.225.135.92" src_port="1025"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="tcp" src_ip="209.225.135.92" src_port="1026"/>
      <filter dst_ip="209.46.163.169" dst_port="137" proto="udp" src_ip="209.225.135.92" src_port="1026"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="tcp" src_ip="209.225.135.92" src_port="1026"/>
      <filter dst_ip="209.46.163.169" dst_port="53" proto="udp" src_ip="209.225.135.92" src_port="1026"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="tcp" src_ip="209.225.135.92" src_port="1026"/>
      <filter dst_ip="209.46.163.169" dst_port="80" proto="udp" src_ip="209.225.135.92" src_port="1026"/>
      <from sec="1097384914" usec="0"/>
      <to sec="1097384933" usec="0"/>
    </slice>
    <from sec="1097384914" usec="0"/>
    <to sec="1097384941" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.743718,1.27769,001,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_75{
style=filled;
color=gray75;
183[label="192.206.93.37s;222pkt 222fpkt", shape=rectangle, color=red];
388[label="192.206.93.37s;222pkt 222fpkt", shape=ellipse, color=green];
1990[label="192.206.93.37;233pkt 233fpkt", shape=pentagon, color=darkviolet];
stat75[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.206.93.37:*, *:1023}[47.4359%]&lt;BR/&gt;{192.206.93.37:*, *:9898}[47.4359%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (24.5938%)&lt;BR/&gt; 1023: (24.5199%)&lt;BR/&gt; 5554: (0.886263%)&lt;BR/&gt; 4964: (0.443131%)&lt;BR/&gt; 4938: (0.443131%)&gt;];
}
183--388[label="1;222pkt 222fpkt"];
183--1990[label="0.995495;221pkt 221fpkt"];
388--1990[label="0.995495;221pkt 221fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="192.206.93.37"/>
      <filter dst_port="1023" src_ip="192.206.93.37"/>
    </slice>
    <from sec="1097384469" usec="0"/>
    <to sec="1097384475" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.745844,1.33897,010,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_76{
style=filled;
color=gray75;
184[label="43.204.109.41s;150pkt 150fpkt", shape=rectangle, color=red];
389[label="43.204.109.41s;150pkt 150fpkt", shape=ellipse, color=green];
stat76[shape=component, label=&lt;Rules:&lt;BR/&gt;{43.204.109.41:*, *:135}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 4954: (0.666667%)&lt;BR/&gt; 4911: (0.666667%)&lt;BR/&gt; 4894: (0.666667%)&lt;BR/&gt; 4891: (0.666667%)&gt;];
}
184--389[label="1;150pkt 150fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="43.204.109.41"/>
    </slice>
    <from sec="1097385284" usec="0"/>
    <to sec="1097385291" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.743718,1.27769,001,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_83{
style=filled;
color=gray75;
195[label="197.160.156.71s;358pkt 358fpkt", shape=rectangle, color=red];
398[label="197.160.156.71s;358pkt 358fpkt", shape=ellipse, color=green];
2045[label="197.160.156.71;358pkt 358fpkt", shape=pentagon, color=darkviolet];
stat83[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.160.156.71:*, *:5554}[51.3966%]&lt;BR/&gt;{197.160.156.71:*, *:9898}[48.6034%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (25.6983%)&lt;BR/&gt; 9898: (24.3017%)&lt;BR/&gt; 4470: (0.139665%)&lt;BR/&gt; 4464: (0.139665%)&lt;BR/&gt; 4455: (0.139665%)&gt;];
}
195--398[label="1;358pkt 358fpkt"];
195--2045[label="1;358pkt 358fpkt"];
398--2045[label="1;358pkt 358fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="197.160.156.71"/>
      <filter dst_port="9898" src_ip="197.160.156.71"/>
    </slice>
    <from sec="1097384496" usec="0"/>
    <to sec="1097384502" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.745844,1.33897,010,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_97{
style=filled;
color=gray75;
214[label="196.27.130.115s;146pkt 146fpkt", shape=rectangle, color=red];
417[label="196.27.130.115s;146pkt 146fpkt", shape=ellipse, color=green];
stat97[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.27.130.115:*, *:135}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 4571: (0.342466%)&lt;BR/&gt; 4567: (0.342466%)&lt;BR/&gt; 4565: (0.342466%)&lt;BR/&gt; 4561: (0.342466%)&gt;];
}
214--417[label="1;146pkt 146fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="196.27.130.115"/>
    </slice>
    <from sec="1097384618" usec="0"/>
    <to sec="1097384623" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.745844,1.33897,001,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_140{
style=filled;
color=gray75;
276[label="197.149.22.246s;234pkt 234fpkt", shape=rectangle, color=red];
474[label="197.149.22.246s;234pkt 234fpkt", shape=ellipse, color=green];
stat140[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.149.22.246:*, *:9898}[63.6752%]&lt;BR/&gt;{197.149.22.246:*, *:5554}[36.3248%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (31.8376%)&lt;BR/&gt; 5554: (18.1624%)&lt;BR/&gt; 4992: (0.213675%)&lt;BR/&gt; 4990: (0.213675%)&lt;BR/&gt; 4986: (0.213675%)&gt;];
}
276--474[label="1;234pkt 234fpkt"];
276--1900[label="0.363248;85pkt 85fpkt"];
276--1901[label="0.636752;149pkt 149fpkt"];
474--1900[label="0.363248;85pkt 85fpkt"];
474--1901[label="0.636752;149pkt 149fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="197.149.22.246"/>
      <filter dst_port="5554" src_ip="197.149.22.246"/>
    </slice>
    <from sec="1097384402" usec="0"/>
    <to sec="1097384411" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.745844,1.33897,020,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_144{
style=filled;
color=gray75;
286[label="197.217.15.144d;219pkt 219fpkt", shape=rectangle, color=red];
481[label="197.217.15.144d;219pkt 219fpkt", shape=ellipse, color=green];
stat144[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 197.217.15.144:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
286--481[label="1;219pkt 219fpkt"];
</description>
    <slice>
      <filter dst_ip="197.217.15.144"/>
    </slice>
    <from sec="1097384718" usec="0"/>
    <to sec="1097384725" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.729528,1.42147,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="192.146.232.86" src_port="443"/>
      <from sec="1097384504" usec="0"/>
      <to sec="1097384869" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="197.160.156.71" src_port="443"/>
      <from sec="1097384499" usec="0"/>
      <to sec="1097384501" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="193.187.171.0" src_port="443"/>
      <from sec="1097384501" usec="0"/>
      <to sec="1097384503" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="165.74.0.86" src_port="443"/>
      <from sec="1097384501" usec="0"/>
      <to sec="1097384868" usec="0"/>
    </slice>
    <from sec="1097384499" usec="0"/>
    <to sec="1097384877" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.729528,1.42147,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="52.201.66.193" dst_port="80" proto="icmp"/>
      <filter dst_ip="52.201.66.193" dst_port="80" proto="icmp"/>
      <filter dst_ip="52.201.66.193" dst_port="80" proto="icmp"/>
      <filter dst_ip="52.201.66.193" dst_port="80" proto="icmp"/>
      <from sec="1097384875" usec="0"/>
      <to sec="1097385284" usec="0"/>
    </slice>
    <from sec="1097384875" usec="0"/>
    <to sec="1097385284" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.729528,1.42147,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="150.159.164.162" dst_port="135" proto="tcp" src_ip="192.160.99.46" src_port="54321"/>
      <filter dst_ip="150.159.164.162" dst_port="80" proto="tcp" src_ip="192.160.99.46" src_port="54321"/>
      <filter dst_ip="150.13.196.221" dst_port="135" proto="tcp" src_ip="192.160.99.46" src_port="54321"/>
      <filter dst_ip="150.13.196.221" dst_port="80" proto="tcp" src_ip="192.160.99.46" src_port="54321"/>
      <filter dst_ip="162.95.224.34" dst_port="135" proto="tcp" src_ip="192.160.99.46" src_port="54321"/>
      <filter dst_ip="162.95.224.34" dst_port="80" proto="tcp" src_ip="192.160.99.46" src_port="54321"/>
      <from sec="1097384594" usec="0"/>
      <to sec="1097384601" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="150.159.164.162" dst_port="135" proto="tcp" src_ip="111.193.123.46" src_port="54321"/>
      <filter dst_ip="150.159.164.162" dst_port="80" proto="tcp" src_ip="111.193.123.46" src_port="54321"/>
      <filter dst_ip="150.13.196.221" dst_port="135" proto="tcp" src_ip="111.193.123.46" src_port="54321"/>
      <filter dst_ip="150.13.196.221" dst_port="80" proto="tcp" src_ip="111.193.123.46" src_port="54321"/>
      <filter dst_ip="162.95.224.34" dst_port="135" proto="tcp" src_ip="111.193.123.46" src_port="54321"/>
      <filter dst_ip="162.95.224.34" dst_port="80" proto="tcp" src_ip="111.193.123.46" src_port="54321"/>
      <from sec="1097384594" usec="0"/>
      <to sec="1097384601" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="150.159.164.162" dst_port="135" proto="tcp" src_ip="52.255.167.46" src_port="54321"/>
      <filter dst_ip="150.159.164.162" dst_port="80" proto="tcp" src_ip="52.255.167.46" src_port="54321"/>
      <filter dst_ip="150.13.196.221" dst_port="135" proto="tcp" src_ip="52.255.167.46" src_port="54321"/>
      <filter dst_ip="150.13.196.221" dst_port="80" proto="tcp" src_ip="52.255.167.46" src_port="54321"/>
      <filter dst_ip="162.95.224.34" dst_port="135" proto="tcp" src_ip="52.255.167.46" src_port="54321"/>
      <filter dst_ip="162.95.224.34" dst_port="80" proto="tcp" src_ip="52.255.167.46" src_port="54321"/>
      <from sec="1097384595" usec="0"/>
      <to sec="1097384598" usec="0"/>
    </slice>
    <from sec="1097384594" usec="0"/>
    <to sec="1097384601" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.729528,1.42147,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="145.238.233.52" dst_port="137" proto="tcp" src_ip="108.212.100.151" src_port="1027"/>
      <filter dst_ip="145.238.233.52" dst_port="137" proto="udp" src_ip="108.212.100.151" src_port="1027"/>
      <filter dst_ip="145.238.233.52" dst_port="137" proto="tcp" src_ip="108.212.100.151" src_port="80"/>
      <filter dst_ip="145.238.233.52" dst_port="137" proto="udp" src_ip="108.212.100.151" src_port="80"/>
      <from sec="1097384643" usec="0"/>
      <to sec="1097384649" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="145.238.233.52" dst_port="137" proto="tcp" src_ip="108.169.112.151" src_port="1027"/>
      <filter dst_ip="145.238.233.52" dst_port="137" proto="udp" src_ip="108.169.112.151" src_port="1027"/>
      <filter dst_ip="145.238.233.52" dst_port="137" proto="tcp" src_ip="108.169.112.151" src_port="80"/>
      <filter dst_ip="145.238.233.52" dst_port="137" proto="udp" src_ip="108.169.112.151" src_port="80"/>
      <from sec="1097384646" usec="0"/>
      <to sec="1097384649" usec="0"/>
    </slice>
    <from sec="1097384643" usec="0"/>
    <to sec="1097384649" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.795492,1.31064,010,1 0 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_170{
style=filled;
color=gray75;
239[label="43.82.32.165s;253pkt 253fpkt", shape=rectangle, color=red];
597[label="43.82.32.165s;195pkt 195fpkt", shape=triangle, color=blue];
1297[label="43.82.32.165;s;253pkt 253fpkt", shape=diamond, color=yellow];
stat170[shape=component, label=&lt;Rules:&lt;BR/&gt;{43.82.32.165:*, *:135}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 4922: (0.21398%)&lt;BR/&gt; 4915: (0.21398%)&lt;BR/&gt; 4914: (0.21398%)&lt;BR/&gt; 4897: (0.21398%)&gt;];
}
239--597[label="1;195pkt 195fpkt"];
239--1297[label="1;253pkt 253fpkt"];
597--1297[label="1;195pkt 195fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="43.82.32.165"/>
    </slice>
    <from sec="1097384833" usec="0"/>
    <to sec="1097384855" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614144,1.32113,503,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_181{
style=filled;
color=gray75;
5[label="192.35.37.7s;2pkt 2fpkt", shape=rectangle, color=red];
1927[label="192.35.37.7;5pkt 5fpkt", shape=pentagon, color=darkviolet];
stat181[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.35.37.7:80, 139.80.8.80:2247}[20%]&lt;BR/&gt;{192.35.37.7:80, 139.80.8.80:2248}[20%]&lt;BR/&gt;{192.35.37.7:80, 139.80.8.80:2250}[20%]&lt;BR/&gt;{192.35.37.7:80, 139.80.8.80:2251}[20%]&lt;BR/&gt;{192.35.37.7:80, 139.80.8.80:2257}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2257: (14.2857%)&lt;BR/&gt; 2251: (14.2857%)&lt;BR/&gt; 2250: (7.14286%)&lt;BR/&gt; 2248: (7.14286%)&gt;];
}
5--663[label="1;2pkt 2fpkt"];
5--664[label="1;2pkt 2fpkt"];
5--1927[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="139.80.8.80" dst_port="2257" src_ip="192.35.37.7" src_port="80"/>
      <filter dst_ip="139.80.8.80" dst_port="2251" src_ip="192.35.37.7" src_port="80"/>
      <filter dst_ip="139.80.8.80" dst_port="2250" src_ip="192.35.37.7" src_port="80"/>
      <filter dst_ip="139.80.8.80" dst_port="2248" src_ip="192.35.37.7" src_port="80"/>
      <filter dst_ip="139.80.8.80" dst_port="2247" src_ip="192.35.37.7" src_port="80"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385274" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.795492,1.31064,999,1 0 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_182{
style=filled;
color=gray75;
122[label="132.221.244.70s;275pkt 275fpkt", shape=rectangle, color=red];
518[label="132.221.244.70s;66pkt 66fpkt", shape=triangle, color=blue];
667[label="145.238.72.246;s;1975pkt 1975fpkt", shape=diamond, color=yellow];
748[label="150.159.14.87;s;890pkt 890fpkt", shape=diamond, color=yellow];
914[label="209.46.162.21;s;839pkt 839fpkt", shape=diamond, color=yellow];
1077[label="72.207.114.113;d;8pkt 8fpkt", shape=diamond, color=yellow];
1186[label="145.238.72.249;s;453pkt 453fpkt", shape=diamond, color=yellow];
stat182[shape=component, label=&lt;Rules:&lt;BR/&gt;{145.238.72.246:53, *:*}[28.9995%]&lt;BR/&gt;{150.159.14.87:*, *:*}[20.5164%]&lt;BR/&gt;{*:1026, *:53}[20.4011%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (49.9556%)&lt;BR/&gt; 1026: (10.9854%)&lt;BR/&gt; 47213: (3.29561%)&lt;BR/&gt; 1027: (2.76298%)&lt;BR/&gt; 137: (2.6964%)&gt;];
}
122--518[label="1;66pkt 66fpkt"];
122--667[label="0.356364;98pkt 98fpkt"];
122--1144[label="0.0116279;1pkt 1fpkt"];
122--1333[label="0.0107527;1pkt 1fpkt"];
122--1406[label="0.0140845;1pkt 1fpkt"];
122--1493[label="0.0119048;1pkt 1fpkt"];
122--1499[label="0.0140845;1pkt 1fpkt"];
122--1571[label="0.00699301;1pkt 1fpkt"];
122--1831[label="0.0654545;18pkt 18fpkt"];
122--1846[label="0.134545;37pkt 37fpkt"];
122--1858[label="0.167273;46pkt 46fpkt"];
122--1865[label="0.0654545;18pkt 18fpkt"];
122--1879[label="0.134545;37pkt 37fpkt"];
122--1893[label="0.0654545;18pkt 18fpkt"];
122--1902[label="0.134545;37pkt 37fpkt"];
667--811[label="0.0232558;1pkt 1fpkt"];
667--1077[label="0.125;1pkt 1fpkt"];
667--1144[label="0.0116279;1pkt 1fpkt"];
667--1333[label="0.0107527;1pkt 1fpkt"];
667--1406[label="0.0140845;1pkt 1fpkt"];
667--1493[label="0.0119048;1pkt 1fpkt"];
667--1499[label="0.0140845;1pkt 1fpkt"];
667--1571[label="0.00699301;1pkt 1fpkt"];
667--1831[label="0.041519;82pkt 82fpkt"];
667--1846[label="0.0607595;120pkt 120fpkt"];
667--1858[label="0.0668354;132pkt 132fpkt"];
667--1865[label="0.041519;82pkt 82fpkt"];
667--1879[label="0.0607595;120pkt 120fpkt"];
667--1893[label="0.041519;82pkt 82fpkt"];
667--1902[label="0.0607595;120pkt 120fpkt"];
748--1077[label="0.125;1pkt 1fpkt"];
748--1144[label="0.0116279;1pkt 1fpkt"];
748--1333[label="0.0107527;1pkt 1fpkt"];
748--1406[label="0.0140845;1pkt 1fpkt"];
748--1493[label="0.0119048;1pkt 1fpkt"];
748--1499[label="0.0140845;1pkt 1fpkt"];
748--1831[label="0.088764;79pkt 79fpkt"];
748--1846[label="0.103371;92pkt 92fpkt"];
748--1858[label="0.146067;130pkt 130fpkt"];
748--1865[label="0.088764;79pkt 79fpkt"];
748--1879[label="0.103371;92pkt 92fpkt"];
748--1893[label="0.088764;79pkt 79fpkt"];
748--1902[label="0.103371;92pkt 92fpkt"];
914--1077[label="0.125;1pkt 1fpkt"];
914--1144[label="0.0116279;1pkt 1fpkt"];
914--1333[label="0.0107527;1pkt 1fpkt"];
914--1406[label="0.0140845;1pkt 1fpkt"];
914--1493[label="0.0119048;1pkt 1fpkt"];
914--1499[label="0.0140845;1pkt 1fpkt"];
914--1831[label="0.0417163;35pkt 35fpkt"];
914--1846[label="0.0429082;36pkt 36fpkt"];
914--1858[label="0.0357569;30pkt 30fpkt"];
914--1865[label="0.0417163;35pkt 35fpkt"];
914--1879[label="0.0429082;36pkt 36fpkt"];
914--1893[label="0.0417163;35pkt 35fpkt"];
914--1902[label="0.0429082;36pkt 36fpkt"];
1077--1155[label="0.125;1pkt 1fpkt"];
1077--1186[label="0.125;1pkt 1fpkt"];
1077--1831[label="0.25;2pkt 2fpkt"];
1077--1846[label="0.75;6pkt 6fpkt"];
1077--1858[label="0.75;6pkt 6fpkt"];
1077--1865[label="0.25;2pkt 2fpkt"];
1077--1879[label="0.75;6pkt 6fpkt"];
1077--1893[label="0.25;2pkt 2fpkt"];
1077--1902[label="0.75;6pkt 6fpkt"];
1186--1333[label="0.0107527;1pkt 1fpkt"];
1186--1406[label="0.0140845;1pkt 1fpkt"];
1186--1493[label="0.0119048;1pkt 1fpkt"];
1186--1499[label="0.0140845;1pkt 1fpkt"];
1186--1831[label="0.0331126;15pkt 15fpkt"];
1186--1846[label="0.0838852;38pkt 38fpkt"];
1186--1858[label="0.0816777;37pkt 37fpkt"];
1186--1865[label="0.0331126;15pkt 15fpkt"];
1186--1879[label="0.0838852;38pkt 38fpkt"];
1186--1893[label="0.0331126;15pkt 15fpkt"];
1186--1902[label="0.0838852;38pkt 38fpkt"];
</description>
    <slice>
      <filter src_ip="150.159.14.87"/>
      <filter src_ip="145.238.72.246" src_port="53"/>
      <filter dst_port="53" src_port="1026"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.626523,1.32957,999,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_186{
style=filled;
color=gray75;
51[label="209.46.166.130s;2pkt 2fpkt", shape=rectangle, color=red];
696[label="194.48.199.251;d;2pkt 2fpkt", shape=diamond, color=yellow];
849[label="209.46.166.130;s;25pkt 25fpkt", shape=diamond, color=yellow];
850[label="108.143.243.49;d;17pkt 17fpkt", shape=diamond, color=yellow];
stat186[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.46.166.130:*, 108.143.243.49:*}[68%]&lt;BR/&gt;{209.46.166.130:21, *:*}[28%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (9.78261%)&lt;BR/&gt; 49028: (3.26087%)&lt;BR/&gt; 43697: (3.26087%)&lt;BR/&gt; 43345: (3.26087%)&lt;BR/&gt; 1975: (3.26087%)&gt;];
}
51--696[label="0.5;1pkt 1fpkt"];
51--849[label="1;2pkt 2fpkt"];
51--850[label="0.5;1pkt 1fpkt"];
696--849[label="1;2pkt 2fpkt"];
849--850[label="1;17pkt 17fpkt"];
</description>
    <slice>
      <filter dst_ip="108.143.243.49" src_ip="209.46.166.130"/>
      <filter src_ip="209.46.166.130" src_port="21"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.62399,1.26784,999,1 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_187{
style=filled;
color=gray75;
57[label="162.10.185.163s;3pkt 3fpkt", shape=rectangle, color=red];
697[label="194.48.199.251;s;2pkt 2fpkt", shape=diamond, color=yellow];
848[label="209.46.166.130;d;21pkt 21fpkt", shape=diamond, color=yellow];
851[label="108.143.243.49;s;16pkt 16fpkt", shape=diamond, color=yellow];
1521[label="162.10.185.163;s;84pkt 84fpkt", shape=diamond, color=yellow];
2219[label="162.10.185.163;84pkt 84fpkt", shape=pentagon, color=darkviolet];
2382[label="194.48.199.251;2pkt 2fpkt", shape=pentagon, color=darkviolet];
stat187[shape=component, label=&lt;Rules:&lt;BR/&gt;{162.10.185.163:*, *:80}[77.1429%]&lt;BR/&gt;{*:*, 209.46.166.130:*}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (38.6792%)&lt;BR/&gt; 53: (1.41509%)&lt;BR/&gt; 21: (1.41509%)&lt;BR/&gt; 49028: (0.943396%)&lt;BR/&gt; 1975: (0.943396%)&gt;];
}
57--697[label="0.5;1pkt 1fpkt"];
57--848[label="0.333333;1pkt 1fpkt"];
57--1521[label="0.666667;2pkt 2fpkt"];
57--2219[label="0.666667;2pkt 2fpkt"];
57--2382[label="0.5;1pkt 1fpkt"];
697--848[label="1;2pkt 2fpkt"];
697--2382[label="1;2pkt 2fpkt"];
848--851[label="1;16pkt 16fpkt"];
848--2382[label="1;2pkt 2fpkt"];
1521--1846[label="0.0238095;2pkt 2fpkt"];
1521--1847[label="0.0357143;3pkt 3fpkt"];
1521--1858[label="0.0238095;2pkt 2fpkt"];
1521--1879[label="0.0238095;2pkt 2fpkt"];
1521--1880[label="0.0357143;3pkt 3fpkt"];
1521--1902[label="0.0238095;2pkt 2fpkt"];
1521--1903[label="0.0357143;3pkt 3fpkt"];
1521--2219[label="1;84pkt 84fpkt"];
</description>
    <slice>
      <filter dst_ip="209.46.166.130"/>
      <filter dst_port="80" src_ip="162.10.185.163"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.872352,1.44276,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_189{
style=filled;
color=gray75;
708[label="162.10.245.193;d;404pkt 404fpkt", shape=diamond, color=yellow];
709[label="42.110.20.6;s;372pkt 372fpkt", shape=diamond, color=yellow];
1703[label="162.10.245.193;d;404pkt 404fpkt", shape=hexagon, color=black];
stat189[shape=component, label=&lt;Rules:&lt;BR/&gt;{42.110.20.6:80, 162.10.245.193:*}[99.7531%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4114: (0.127119%)&lt;BR/&gt; 4113: (0.127119%)&lt;BR/&gt; 4112: (0.127119%)&lt;BR/&gt; 4111: (0.127119%)&gt;];
}
708--709[label="0.997312;371pkt 371fpkt"];
708--1703[label="1;404pkt 404fpkt"];
709--1703[label="0.997312;371pkt 371fpkt"];
</description>
    <slice>
      <filter dst_ip="162.10.245.193" src_ip="42.110.20.6" src_port="80"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.790354,1.2448,999,1 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_190{
style=filled;
color=gray75;
83[label="52.241.53.248s;1pkt 1fpkt", shape=rectangle, color=red];
737[label="52.241.53.248;s;1pkt 1fpkt", shape=diamond, color=yellow];
2376[label="52.241.53.248;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2578[label="52.241.53.248;1pkt 1fpkt", shape=invtriangle, color=brown];
stat190[shape=component, label=&lt;Rules:&lt;BR/&gt;{52.241.53.248:65155, 150.68.152.16:13926}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 65155: (50%)&lt;BR/&gt; 13926: (50%)&gt;];
}
83--641[label="1;1pkt 1fpkt"];
83--737[label="1;1pkt 1fpkt"];
83--1619[label="1;1pkt 1fpkt"];
83--1800[label="1;1pkt 1fpkt"];
83--2376[label="1;1pkt 1fpkt"];
83--2578[label="1;1pkt 1fpkt"];
737--1619[label="1;1pkt 1fpkt"];
737--1800[label="1;1pkt 1fpkt"];
737--2376[label="1;1pkt 1fpkt"];
737--2578[label="1;1pkt 1fpkt"];
2376--2578[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="150.68.152.16" dst_port="13926" src_ip="52.241.53.248" src_port="65155"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548596,1.33125,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_191{
style=filled;
color=gray75;
724[label="196.138.147.119;d;12pkt 12fpkt", shape=diamond, color=yellow];
740[label="139.80.183.9;s;9pkt 9fpkt", shape=diamond, color=yellow];
883[label="139.80.183.80;s;6pkt 6fpkt", shape=diamond, color=yellow];
2070[label="139.80.183.80;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat191[shape=component, label=&lt;Rules:&lt;BR/&gt;{139.80.183.9:*, 196.138.147.119:2002}[26.6667%]&lt;BR/&gt;{139.80.183.9:*, 196.138.147.119:3001}[26.6667%]&lt;BR/&gt;{139.80.183.80:*, 196.138.147.119:*}[26.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2002: (23.2143%)&lt;BR/&gt; 3001: (21.4286%)&lt;BR/&gt; 2740: (5.35714%)&lt;BR/&gt; 8000: (3.57143%)&lt;BR/&gt; 4000: (3.57143%)&gt;];
}
724--740[label="0.888889;8pkt 8fpkt"];
724--883[label="0.666667;4pkt 4fpkt"];
724--2070[label="1;1pkt 1fpkt"];
883--2070[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="196.138.147.119" src_ip="139.80.183.80"/>
      <filter dst_ip="196.138.147.119" dst_port="3001" src_ip="139.80.183.9"/>
      <filter dst_ip="196.138.147.119" dst_port="2002" src_ip="139.80.183.9"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_193{
style=filled;
color=gray75;
756[label="157.207.123.228;d;4pkt 4fpkt", shape=diamond, color=yellow];
757[label="145.239.227.233;s;139pkt 139fpkt", shape=diamond, color=yellow];
stat193[shape=component, label=&lt;Rules:&lt;BR/&gt;{145.239.227.233:25, *:*}[86.3309%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 4209: (0.699301%)&lt;BR/&gt; 4158: (0.699301%)&lt;BR/&gt; 2318: (0.699301%)&lt;BR/&gt; 2142: (0.699301%)&gt;];
}
756--757[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter src_ip="145.239.227.233" src_port="25"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_194{
style=filled;
color=gray75;
767[label="161.131.220.74;d;3pkt 3fpkt", shape=diamond, color=yellow];
768[label="199.220.224.18;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat194[shape=component, label=&lt;Rules:&lt;BR/&gt;{199.220.224.18:15046, 161.131.220.74:1032}[33.3333%]&lt;BR/&gt;{108.233.61.50:61990, 161.131.220.74:137}[33.3333%]&lt;BR/&gt;{42.134.136.53:62921, 161.131.220.74:137}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 15046: (25%)&lt;BR/&gt; 1032: (25%)&lt;BR/&gt; 137: (25%)&lt;BR/&gt; 62921: (12.5%)&lt;BR/&gt; 61990: (12.5%)&gt;];
}
767--768[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="161.131.220.74" dst_port="137" src_ip="42.134.136.53" src_port="62921"/>
      <filter dst_ip="161.131.220.74" dst_port="137" src_ip="108.233.61.50" src_port="61990"/>
      <filter dst_ip="161.131.220.74" dst_port="1032" src_ip="199.220.224.18" src_port="15046"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,011,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="208.18.142.141"/>
      <from sec="1097384400" usec="0"/>
      <to sec="1097385138" usec="0"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385138" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="145.238.227.177"/>
      <from sec="1097384400" usec="0"/>
      <to sec="1097385136" usec="0"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385136" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="145.238.62.130"/>
      <from sec="1097384843" usec="0"/>
      <to sec="1097385136" usec="0"/>
    </slice>
    <from sec="1097384843" usec="0"/>
    <to sec="1097385136" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.790354,1.2448,999,1 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_201{
style=filled;
color=gray75;
32[label="145.238.101.77s;2pkt 2fpkt", shape=rectangle, color=red];
804[label="158.81.104.169;d;1pkt 1fpkt", shape=diamond, color=yellow];
1001[label="49.200.153.243;d;1pkt 1fpkt", shape=diamond, color=yellow];
1543[label="145.238.101.77;s;66pkt 66fpkt", shape=diamond, color=yellow];
2062[label="145.238.101.77;68pkt 68fpkt", shape=pentagon, color=darkviolet];
2446[label="145.238.101.77;68pkt 68fpkt", shape=invtriangle, color=brown];
stat201[shape=component, label=&lt;Rules:&lt;BR/&gt;{145.238.101.77:50937, *:53}[72.0588%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (46.1165%)&lt;BR/&gt; 50937: (35.1942%)&lt;BR/&gt; 0: (8.73786%)&lt;BR/&gt; 1024: (1.45631%)&lt;BR/&gt; 34544: (1.21359%)&gt;];
}
32--804[label="1;1pkt 1fpkt"];
32--1001[label="1;1pkt 1fpkt"];
32--1543[label="1;2pkt 2fpkt"];
32--2062[label="1;2pkt 2fpkt"];
32--2446[label="1;2pkt 2fpkt"];
804--1543[label="1;1pkt 1fpkt"];
804--2062[label="1;1pkt 1fpkt"];
804--2446[label="1;1pkt 1fpkt"];
1001--1543[label="1;1pkt 1fpkt"];
1001--2062[label="1;1pkt 1fpkt"];
1001--2446[label="1;1pkt 1fpkt"];
1543--1846[label="0.0151515;1pkt 1fpkt"];
1543--1858[label="0.106061;7pkt 7fpkt"];
1543--1879[label="0.0151515;1pkt 1fpkt"];
1543--1902[label="0.0151515;1pkt 1fpkt"];
1543--2062[label="1;66pkt 66fpkt"];
1543--2446[label="1;66pkt 66fpkt"];
2062--2446[label="1;68pkt 68fpkt"];
</description>
    <slice>
      <filter dst_port="53" src_ip="145.238.101.77" src_port="50937"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.62399,1.26784,999,1 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_202{
style=filled;
color=gray75;
3[label="139.80.34.1s;1pkt 1fpkt", shape=rectangle, color=red];
715[label="209.46.162.6;s;2181pkt 2181fpkt", shape=diamond, color=yellow];
810[label="139.80.34.1;s;133pkt 133fpkt", shape=diamond, color=yellow];
811[label="49.211.126.171;d;43pkt 43fpkt", shape=diamond, color=yellow];
1926[label="209.46.162.6;2361pkt 2361fpkt", shape=pentagon, color=darkviolet];
stat202[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.46.162.6:53, *:*}[94.4734%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (53.9203%)&lt;BR/&gt; 32768: (2.07671%)&lt;BR/&gt; 80: (1.83302%)&lt;BR/&gt; 1024: (1.36682%)&lt;BR/&gt; 32769: (0.858233%)&gt;];
}
3--810[label="1;1pkt 1fpkt"];
3--811[label="1;1pkt 1fpkt"];
715--811[label="0.0465116;2pkt 2fpkt"];
715--1831[label="0.00917011;20pkt 20fpkt"];
715--1846[label="0.0132967;29pkt 29fpkt"];
715--1858[label="0.0142137;31pkt 31fpkt"];
715--1865[label="0.00917011;20pkt 20fpkt"];
715--1879[label="0.0132967;29pkt 29fpkt"];
715--1893[label="0.00917011;20pkt 20fpkt"];
715--1902[label="0.0132967;29pkt 29fpkt"];
715--1926[label="1;2181pkt 2181fpkt"];
810--811[label="0.883721;38pkt 38fpkt"];
811--1926[label="0.0465116;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_ip="209.46.162.6" src_port="53"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.921631,1.38447,503,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_205{
style=filled;
color=gray75;
15[label="150.159.14.31s;1pkt 1fpkt", shape=rectangle, color=red];
682[label="150.159.14.31;s;258pkt 258fpkt", shape=diamond, color=yellow];
843[label="110.159.80.63;d;1pkt 1fpkt", shape=diamond, color=yellow];
866[label="50.35.152.90;d;209pkt 209fpkt", shape=diamond, color=yellow];
1036[label="150.159.14.80;s;143pkt 143fpkt", shape=diamond, color=yellow];
1332[label="150.159.204.214;s;82pkt 82fpkt", shape=diamond, color=yellow];
1702[label="110.159.80.63;d;1pkt 1fpkt", shape=hexagon, color=black];
stat205[shape=component, label=&lt;Rules:&lt;BR/&gt;{150.159.14.31:80, *:*}[45.167%]&lt;BR/&gt;{*:80, 50.35.152.90:*}[37.7856%]&lt;BR/&gt;{150.159.14.80:80, *:*}[24.9561%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.1295%)&lt;BR/&gt; 25: (1.07914%)&lt;BR/&gt; 22: (0.57554%)&lt;BR/&gt; 0: (0.431655%)&lt;BR/&gt; 16916: (0.28777%)&gt;];
}
15--682[label="1;1pkt 1fpkt"];
15--843[label="1;1pkt 1fpkt"];
15--1702[label="1;1pkt 1fpkt"];
682--843[label="1;1pkt 1fpkt"];
682--866[label="0.205742;43pkt 43fpkt"];
682--1268[label="0.0597015;8pkt 8fpkt"];
682--1702[label="1;1pkt 1fpkt"];
843--1702[label="1;1pkt 1fpkt"];
866--1036[label="0.251748;36pkt 36fpkt"];
866--1332[label="0.536585;44pkt 44fpkt"];
866--1445[label="0.606557;37pkt 37fpkt"];
1332--1484[label="1;14pkt 14fpkt"];
1332--1767[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter src_ip="150.159.14.31" src_port="80"/>
      <filter src_ip="150.159.14.80" src_port="80"/>
      <filter dst_ip="50.35.152.90" src_port="80"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_206{
style=filled;
color=gray75;
854[label="209.46.176.36;d;1798pkt 1798fpkt", shape=diamond, color=yellow];
stat206[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 209.46.176.36:45222}[99.5551%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 45222: (49.7775%)&lt;BR/&gt; 54045: (0.166852%)&lt;BR/&gt; 1025: (0.139043%)&lt;BR/&gt; 80: (0.139043%)&lt;BR/&gt; 443: (0.111235%)&gt;];
}
854--1832[label="0.00126662;2pkt 2fpkt"];
854--1847[label="0.00112233;2pkt 2fpkt"];
854--1866[label="0.00126662;2pkt 2fpkt"];
854--1880[label="0.00112233;2pkt 2fpkt"];
854--1894[label="0.00126662;2pkt 2fpkt"];
854--1903[label="0.00112233;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="209.46.176.36" dst_port="45222"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_207{
style=filled;
color=gray75;
694[label="221.20.132.241;d;129pkt 129fpkt", shape=diamond, color=yellow];
858[label="208.129.244.107;s;129pkt 129fpkt", shape=diamond, color=yellow];
stat207[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.129.244.107:*, 221.20.132.241:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 51742: (6.58915%)&lt;BR/&gt; 51067: (6.58915%)&lt;BR/&gt; 50591: (6.58915%)&lt;BR/&gt; 49925: (6.58915%)&lt;BR/&gt; 49321: (6.58915%)&gt;];
}
694--858[label="1;129pkt 129fpkt"];
</description>
    <slice>
      <filter dst_ip="221.20.132.241" src_ip="208.129.244.107"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097384640" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548596,1.33125,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_210{
style=filled;
color=gray75;
812[label="49.211.126.171;s;40pkt 40fpkt", shape=diamond, color=yellow];
877[label="209.46.162.6;d;1113pkt 1113fpkt", shape=diamond, color=yellow];
2185[label="199.217.76.149;41pkt 41fpkt", shape=pentagon, color=darkviolet];
stat210[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 209.46.162.6:53}[93.5185%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (53.392%)&lt;BR/&gt; 32768: (1.67504%)&lt;BR/&gt; 80: (1.59129%)&lt;BR/&gt; 1024: (0.879397%)&lt;BR/&gt; 32769: (0.670017%)&gt;];
}
812--877[label="0.05;2pkt 2fpkt"];
812--1832[label="0.1;4pkt 4fpkt"];
812--1847[label="0.125;5pkt 5fpkt"];
812--1866[label="0.1;4pkt 4fpkt"];
812--1880[label="0.125;5pkt 5fpkt"];
812--1894[label="0.1;4pkt 4fpkt"];
812--1903[label="0.125;5pkt 5fpkt"];
812--2234[label="1;40pkt 40fpkt"];
877--1831[label="0.066487;74pkt 74fpkt"];
877--1846[label="0.0934412;104pkt 104fpkt"];
877--1858[label="0.0853549;95pkt 95fpkt"];
877--1865[label="0.066487;74pkt 74fpkt"];
877--1879[label="0.0934412;104pkt 104fpkt"];
877--1893[label="0.066487;74pkt 74fpkt"];
877--1902[label="0.0934412;104pkt 104fpkt"];
877--2185[label="0.097561;4pkt 4fpkt"];
877--2234[label="0.0357143;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="209.46.162.6" dst_port="53"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385277" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.626523,1.32957,503,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_211{
style=filled;
color=gray75;
22[label="205.179.254.41s;1pkt 1fpkt", shape=rectangle, color=red];
880[label="205.179.254.3;s;1pkt 1fpkt", shape=diamond, color=yellow];
881[label="208.139.1.2;d;12pkt 12fpkt", shape=diamond, color=yellow];
stat211[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.179.254.18:80, 208.139.1.2:*}[33.3333%]&lt;BR/&gt;{205.179.254.111:80, 208.139.1.2:*}[33.3333%]&lt;BR/&gt;{205.179.254.41:80, 208.139.1.2:*}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (42.8571%)&lt;BR/&gt; 7070: (7.14286%)&lt;BR/&gt; 1536: (7.14286%)&lt;BR/&gt; 1484: (7.14286%)&lt;BR/&gt; 1541: (3.57143%)&gt;];
}
22--881[label="1;1pkt 1fpkt"];
880--881[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="208.139.1.2" src_ip="205.179.254.111" src_port="80"/>
      <filter dst_ip="208.139.1.2" src_ip="205.179.254.18" src_port="80"/>
      <filter dst_ip="208.139.1.2" src_ip="205.179.254.41" src_port="80"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385036" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.921631,1.38447,999,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_212{
style=filled;
color=gray75;
35[label="218.235.112.83s;1pkt 1fpkt", shape=rectangle, color=red];
743[label="208.139.229.128;d;1pkt 1fpkt", shape=diamond, color=yellow];
894[label="218.235.112.83;s;1pkt 1fpkt", shape=diamond, color=yellow];
1783[label="208.139.229.128;d;1pkt 1fpkt", shape=hexagon, color=black];
stat212[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.235.112.83:8000, 208.139.229.128:3182}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8000: (50%)&lt;BR/&gt; 3182: (50%)&gt;];
}
35--743[label="1;1pkt 1fpkt"];
35--894[label="1;1pkt 1fpkt"];
35--1783[label="1;1pkt 1fpkt"];
743--894[label="1;1pkt 1fpkt"];
743--1783[label="1;1pkt 1fpkt"];
894--1783[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="208.139.229.128" dst_port="3182" src_ip="218.235.112.83" src_port="8000"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_214{
style=filled;
color=gray75;
938[label="150.159.53.76;d;1pkt 1fpkt", shape=diamond, color=yellow];
939[label="202.236.46.254;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat214[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.236.46.254:32771, 150.159.53.76:19001}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 32771: (50%)&lt;BR/&gt; 19001: (50%)&gt;];
}
938--939[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="150.159.53.76" dst_port="19001" src_ip="202.236.46.254" src_port="32771"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.626523,1.32957,999,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_216{
style=filled;
color=gray75;
17[label="139.80.33.33s;5pkt 5fpkt", shape=rectangle, color=red];
949[label="139.80.33.33;s;255pkt 255fpkt", shape=diamond, color=yellow];
stat216[shape=component, label=&lt;Rules:&lt;BR/&gt;{139.80.33.33:25, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 60888: (0.384615%)&lt;BR/&gt; 57739: (0.384615%)&lt;BR/&gt; 57655: (0.384615%)&lt;BR/&gt; 56032: (0.384615%)&gt;];
}
17--949[label="0.8;4pkt 4fpkt"];
</description>
    <slice>
      <filter src_ip="139.80.33.33" src_port="25"/>
    </slice>
    <from sec="1097384403" usec="0"/>
    <to sec="1097385290" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_219{
style=filled;
color=gray75;
982[label="111.74.82.190;s;1pkt 1fpkt", shape=diamond, color=yellow];
983[label="145.238.28.157;d;2pkt 2fpkt", shape=diamond, color=yellow];
stat219[shape=component, label=&lt;Rules:&lt;BR/&gt;{51.236.181.121:0, 145.238.28.157:0}[50%]&lt;BR/&gt;{111.74.82.190:25, 145.238.28.157:34411}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 34411: (33.3333%)&lt;BR/&gt; 25: (33.3333%)&lt;BR/&gt; 0: (33.3333%)&gt;];
}
982--983[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="145.238.28.157" dst_port="34411" src_ip="111.74.82.190" src_port="25"/>
      <filter dst_ip="145.238.28.157" src_ip="51.236.181.121"/>
    </slice>
    <from sec="1097384464" usec="0"/>
    <to sec="1097384587" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_220{
style=filled;
color=gray75;
981[label="111.74.82.190;d;1pkt 1fpkt", shape=diamond, color=yellow];
984[label="145.238.28.157;s;2pkt 2fpkt", shape=diamond, color=yellow];
stat220[shape=component, label=&lt;Rules:&lt;BR/&gt;{145.238.28.157:0, 51.236.181.121:0}[50%]&lt;BR/&gt;{145.238.28.157:34411, 111.74.82.190:25}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 34411: (33.3333%)&lt;BR/&gt; 25: (33.3333%)&lt;BR/&gt; 0: (33.3333%)&gt;];
}
981--984[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="111.74.82.190" dst_port="25" src_ip="145.238.28.157" src_port="34411"/>
      <filter dst_ip="51.236.181.121" src_ip="145.238.28.157"/>
    </slice>
    <from sec="1097384464" usec="0"/>
    <to sec="1097384587" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.872352,1.44276,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_221{
style=filled;
color=gray75;
990[label="201.161.233.192;s;3pkt 3fpkt", shape=diamond, color=yellow];
991[label="208.139.7.122;d;3pkt 3fpkt", shape=diamond, color=yellow];
1661[label="208.139.7.122;d;3pkt 3fpkt", shape=hexagon, color=black];
stat221[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.161.233.192:80, 208.139.7.122:1995}[33.3333%]&lt;BR/&gt;{201.161.233.192:80, 208.139.7.122:2000}[33.3333%]&lt;BR/&gt;{201.161.233.192:80, 208.139.7.122:2006}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2006: (16.6667%)&lt;BR/&gt; 2000: (16.6667%)&lt;BR/&gt; 1995: (16.6667%)&gt;];
}
990--991[label="1;3pkt 3fpkt"];
990--1661[label="1;3pkt 3fpkt"];
991--1661[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="208.139.7.122" dst_port="2006" src_ip="201.161.233.192" src_port="80"/>
      <filter dst_ip="208.139.7.122" dst_port="2000" src_ip="201.161.233.192" src_port="80"/>
      <filter dst_ip="208.139.7.122" dst_port="1995" src_ip="201.161.233.192" src_port="80"/>
    </slice>
    <from sec="1097384545" usec="0"/>
    <to sec="1097384562" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_223{
style=filled;
color=gray75;
1010[label="216.16.255.104;s;893pkt 893fpkt", shape=diamond, color=yellow];
stat223[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.16.255.104:53, *:*}[99.6641%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (57.4468%)&lt;BR/&gt; 32768: (1.95969%)&lt;BR/&gt; 1024: (1.51176%)&lt;BR/&gt; 32769: (1.17581%)&lt;BR/&gt; 1025: (0.447928%)&gt;];
}
1010--1831[label="0.00783875;7pkt 7fpkt"];
1010--1846[label="0.0100784;9pkt 9fpkt"];
1010--1858[label="0.0100784;9pkt 9fpkt"];
1010--1865[label="0.00783875;7pkt 7fpkt"];
1010--1879[label="0.0100784;9pkt 9fpkt"];
1010--1893[label="0.00783875;7pkt 7fpkt"];
1010--1902[label="0.0100784;9pkt 9fpkt"];
</description>
    <slice>
      <filter src_ip="216.16.255.104" src_port="53"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_224{
style=filled;
color=gray75;
1012[label="150.159.52.228;d;425pkt 425fpkt", shape=diamond, color=yellow];
stat224[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 150.159.52.228:24069}[96.9412%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 24069: (48.4706%)&lt;BR/&gt; 443: (0.705882%)&lt;BR/&gt; 0: (0.705882%)&lt;BR/&gt; 80: (0.470588%)&lt;BR/&gt; 1025: (0.352941%)&gt;];
}
1012--1847[label="0.00235294;1pkt 1fpkt"];
1012--1880[label="0.00235294;1pkt 1fpkt"];
1012--1903[label="0.00235294;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="150.159.52.228" dst_port="24069"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385138" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="193.75.137.185"/>
      <from sec="1097384400" usec="0"/>
      <to sec="1097385048" usec="0"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385048" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.790354,1.2448,503,1 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_227{
style=filled;
color=gray75;
0[label="162.10.210.0s;1pkt 1fpkt", shape=rectangle, color=red];
729[label="201.27.227.225;d;1pkt 1fpkt", shape=diamond, color=yellow];
1031[label="162.10.210.0;s;20pkt 20fpkt", shape=diamond, color=yellow];
1917[label="162.10.210.0;19pkt 19fpkt", shape=pentagon, color=darkviolet];
2391[label="162.10.210.0;19pkt 19fpkt", shape=invtriangle, color=brown];
stat227[shape=component, label=&lt;Rules:&lt;BR/&gt;{162.10.210.0:*, 108.84.145.91:80}[30%]&lt;BR/&gt;{162.10.210.0:*, 108.82.20.36:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (40.8333%)&lt;BR/&gt; 4765: (4.16667%)&lt;BR/&gt; 1755: (4.16667%)&lt;BR/&gt; 10015: (2.5%)&lt;BR/&gt; 10002: (2.5%)&gt;];
}
0--729[label="1;1pkt 1fpkt"];
0--1031[label="1;1pkt 1fpkt"];
0--1917[label="1;1pkt 1fpkt"];
0--2391[label="1;1pkt 1fpkt"];
729--1031[label="1;1pkt 1fpkt"];
729--1917[label="1;1pkt 1fpkt"];
729--2391[label="1;1pkt 1fpkt"];
1031--1917[label="1;19pkt 19fpkt"];
1031--2391[label="1;19pkt 19fpkt"];
1917--2391[label="1;19pkt 19fpkt"];
</description>
    <slice>
      <filter dst_ip="108.84.145.91" dst_port="80" src_ip="162.10.210.0"/>
      <filter dst_ip="108.82.20.36" dst_port="80" src_ip="162.10.210.0"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_228{
style=filled;
color=gray75;
762[label="150.201.207.145;d;6pkt 6fpkt", shape=diamond, color=yellow];
1040[label="196.133.96.154;s;14pkt 14fpkt", shape=diamond, color=yellow];
stat228[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.133.96.154:0, *:0}[36.8421%]&lt;BR/&gt;{*:*, 150.201.207.145:1258}[31.5789%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (35%)&lt;BR/&gt; 1258: (17.5%)&lt;BR/&gt; 60356: (5%)&lt;BR/&gt; 5000: (5%)&lt;BR/&gt; 49065: (2.5%)&gt;];
}
762--1040[label="0.166667;1pkt 1fpkt"];
1040--1408[label="0.0714286;1pkt 1fpkt"];
1040--1847[label="0.0714286;1pkt 1fpkt"];
1040--1858[label="0.0714286;1pkt 1fpkt"];
1040--1880[label="0.0714286;1pkt 1fpkt"];
1040--1903[label="0.0714286;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="150.201.207.145" dst_port="1258"/>
      <filter src_ip="196.133.96.154"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385141" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.62399,1.26784,010,1 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_230{
style=filled;
color=gray75;
93[label="150.159.142.40s;1pkt 1fpkt", shape=rectangle, color=red];
917[label="139.80.235.196;s;134pkt 134fpkt", shape=diamond, color=yellow];
1042[label="201.16.193.9;d;16pkt 16fpkt", shape=diamond, color=yellow];
2286[label="139.80.235.196;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat230[shape=component, label=&lt;Rules:&lt;BR/&gt;{139.80.235.196:*, 43.54.220.50:80}[87.3134%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (38.4868%)&lt;BR/&gt; 4132: (1.31579%)&lt;BR/&gt; 3161: (1.31579%)&lt;BR/&gt; 21: (1.31579%)&lt;BR/&gt; 4616: (0.657895%)&gt;];
}
93--917[label="1;1pkt 1fpkt"];
93--1042[label="1;1pkt 1fpkt"];
93--2286[label="1;1pkt 1fpkt"];
917--1042[label="1;16pkt 16fpkt"];
917--1057[label="0.873134;117pkt 117fpkt"];
917--1733[label="0.604478;81pkt 81fpkt"];
917--1832[label="0.0820896;11pkt 11fpkt"];
917--1847[label="0.0746269;10pkt 10fpkt"];
917--1866[label="0.0820896;11pkt 11fpkt"];
917--1880[label="0.0746269;10pkt 10fpkt"];
917--1894[label="0.0820896;11pkt 11fpkt"];
917--1903[label="0.0746269;10pkt 10fpkt"];
917--2286[label="1;1pkt 1fpkt"];
1042--2286[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="43.54.220.50" dst_port="80" src_ip="139.80.235.196"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="216.110.3.174"/>
      <from sec="1097384400" usec="0"/>
      <to sec="1097385228" usec="0"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="145.238.227.177"/>
      <from sec="1097384400" usec="0"/>
      <to sec="1097385228" usec="0"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_233{
style=filled;
color=gray75;
1053[label="108.179.135.76;s;1653pkt 1653fpkt", shape=diamond, color=yellow];
stat233[shape=component, label=&lt;Rules:&lt;BR/&gt;{108.179.135.76:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 739: (0.120992%)&lt;BR/&gt; 7346: (0.0907441%)&lt;BR/&gt; 7198: (0.0907441%)&lt;BR/&gt; 7136: (0.0907441%)&gt;];
}
</description>
    <slice>
      <filter src_ip="108.179.135.76" src_port="80"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,502,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_234{
style=filled;
color=gray75;
1054[label="208.48.23.104;d;1pkt 1fpkt", shape=diamond, color=yellow];
1055[label="145.239.38.32;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat234[shape=component, label=&lt;Rules:&lt;BR/&gt;{145.239.38.32:22, 208.48.23.104:1058}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1058: (50%)&lt;BR/&gt; 22: (50%)&gt;];
}
1054--1055[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="208.48.23.104" dst_port="1058" src_ip="145.239.38.32" src_port="22"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385114" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_235{
style=filled;
color=gray75;
1062[label="150.159.204.215;s;1207pkt 1207fpkt", shape=diamond, color=yellow];
stat235[shape=component, label=&lt;Rules:&lt;BR/&gt;{150.159.204.215:53, *:*}[99.5857%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (55.0539%)&lt;BR/&gt; 32768: (2.36123%)&lt;BR/&gt; 32769: (1.24275%)&lt;BR/&gt; 1024: (0.91135%)&lt;BR/&gt; 32772: (0.4971%)&gt;];
}
1062--1831[label="0.0024855;3pkt 3fpkt"];
1062--1846[label="0.003314;4pkt 4fpkt"];
1062--1858[label="0.0057995;7pkt 7fpkt"];
1062--1865[label="0.0024855;3pkt 3fpkt"];
1062--1879[label="0.003314;4pkt 4fpkt"];
1062--1893[label="0.0024855;3pkt 3fpkt"];
1062--1902[label="0.003314;4pkt 4fpkt"];
</description>
    <slice>
      <filter src_ip="150.159.204.215" src_port="53"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,011,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="108.179.1.87"/>
      <from sec="1097384401" usec="0"/>
      <to sec="1097384958" usec="0"/>
    </slice>
    <from sec="1097384401" usec="0"/>
    <to sec="1097384958" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="145.238.96.15"/>
      <from sec="1097384403" usec="0"/>
      <to sec="1097385228" usec="0"/>
    </slice>
    <from sec="1097384403" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_238{
style=filled;
color=gray75;
1089[label="145.238.85.179;s;131pkt 131fpkt", shape=diamond, color=yellow];
stat238[shape=component, label=&lt;Rules:&lt;BR/&gt;{145.238.85.179:*, *:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3172: (0.381679%)&lt;BR/&gt; 3171: (0.381679%)&lt;BR/&gt; 3168: (0.381679%)&lt;BR/&gt; 3166: (0.381679%)&gt;];
}
1089--1832[label="0.00763359;1pkt 1fpkt"];
1089--1847[label="0.00763359;1pkt 1fpkt"];
1089--1866[label="0.00763359;1pkt 1fpkt"];
1089--1880[label="0.00763359;1pkt 1fpkt"];
1089--1894[label="0.00763359;1pkt 1fpkt"];
1089--1903[label="0.00763359;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="145.238.85.179"/>
    </slice>
    <from sec="1097384404" usec="0"/>
    <to sec="1097385064" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="209.46.167.141"/>
      <from sec="1097384406" usec="0"/>
      <to sec="1097385210" usec="0"/>
    </slice>
    <from sec="1097384406" usec="0"/>
    <to sec="1097385210" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_244{
style=filled;
color=gray75;
1087[label="162.10.211.192;d;17pkt 17fpkt", shape=diamond, color=yellow];
1133[label="217.198.11.51;s;4pkt 4fpkt", shape=diamond, color=yellow];
stat244[shape=component, label=&lt;Rules:&lt;BR/&gt;{111.245.120.6:80, 162.10.211.192:*}[41.1765%]&lt;BR/&gt;{217.198.11.51:80, 162.10.211.192:*}[23.5294%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (42.8571%)&lt;BR/&gt; 3461: (7.14286%)&lt;BR/&gt; 4897: (4.7619%)&lt;BR/&gt; 4896: (4.7619%)&lt;BR/&gt; 4895: (4.7619%)&gt;];
}
1087--1133[label="1;4pkt 4fpkt"];
1087--1555[label="0.0588235;1pkt 1fpkt"];
1087--1920[label="0.0588235;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="162.10.211.192" src_ip="111.245.120.6" src_port="80"/>
      <filter dst_ip="162.10.211.192" src_ip="217.198.11.51" src_port="80"/>
    </slice>
    <from sec="1097384404" usec="0"/>
    <to sec="1097384752" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_245{
style=filled;
color=gray75;
1137[label="200.54.184.84;d;4pkt 4fpkt", shape=diamond, color=yellow];
1138[label="150.159.56.74;s;4pkt 4fpkt", shape=diamond, color=yellow];
stat245[shape=component, label=&lt;Rules:&lt;BR/&gt;{150.159.56.74:80, 200.54.184.84:29912}[25%]&lt;BR/&gt;{150.159.56.74:80, 200.54.184.84:29913}[25%]&lt;BR/&gt;{150.159.56.74:80, 200.54.184.84:29914}[25%]&lt;BR/&gt;{150.159.56.74:80, 200.54.184.84:29915}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 29915: (12.5%)&lt;BR/&gt; 29914: (12.5%)&lt;BR/&gt; 29913: (12.5%)&lt;BR/&gt; 29912: (12.5%)&gt;];
}
1137--1138[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="200.54.184.84" dst_port="29915" src_ip="150.159.56.74" src_port="80"/>
      <filter dst_ip="200.54.184.84" dst_port="29914" src_ip="150.159.56.74" src_port="80"/>
      <filter dst_ip="200.54.184.84" dst_port="29913" src_ip="150.159.56.74" src_port="80"/>
      <filter dst_ip="200.54.184.84" dst_port="29912" src_ip="150.159.56.74" src_port="80"/>
    </slice>
    <from sec="1097384658" usec="0"/>
    <to sec="1097384686" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_246{
style=filled;
color=gray75;
1131[label="150.159.14.203;d;3pkt 3fpkt", shape=diamond, color=yellow];
1139[label="49.129.95.177;s;3pkt 3fpkt", shape=diamond, color=yellow];
stat246[shape=component, label=&lt;Rules:&lt;BR/&gt;{42.37.40.222:0, 150.159.14.203:0}[25%]&lt;BR/&gt;{49.129.95.177:64904, 150.159.14.32:53}[25%]&lt;BR/&gt;{49.129.95.177:38775, 150.159.14.203:80}[25%]&lt;BR/&gt;{49.129.95.177:38777, 150.159.14.203:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (33.3333%)&lt;BR/&gt; 38777: (16.6667%)&lt;BR/&gt; 38775: (16.6667%)&lt;BR/&gt; 0: (16.6667%)&lt;BR/&gt; 64904: (8.33333%)&gt;];
}
1131--1139[label="0.666667;2pkt 2fpkt"];
1131--2250[label="0.666667;2pkt 2fpkt"];
1139--2250[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="150.159.14.203" dst_port="80" src_ip="49.129.95.177" src_port="38777"/>
      <filter dst_ip="150.159.14.203" dst_port="80" src_ip="49.129.95.177" src_port="38775"/>
      <filter dst_ip="150.159.14.32" dst_port="53" src_ip="49.129.95.177" src_port="64904"/>
      <filter dst_ip="150.159.14.203" src_ip="42.37.40.222"/>
    </slice>
    <from sec="1097384637" usec="0"/>
    <to sec="1097384673" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="129.189.157.44"/>
      <from sec="1097384400" usec="0"/>
      <to sec="1097385228" usec="0"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_250{
style=filled;
color=gray75;
1019[label="162.10.39.87;s;1pkt 1fpkt", shape=diamond, color=yellow];
1146[label="49.47.107.18;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat250[shape=component, label=&lt;Rules:&lt;BR/&gt;{162.10.39.87:1199, 49.47.107.18:8000}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8000: (50%)&lt;BR/&gt; 1199: (50%)&gt;];
}
1019--1146[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="49.47.107.18" dst_port="8000" src_ip="162.10.39.87" src_port="1199"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="209.46.171.10"/>
      <from sec="1097384400" usec="0"/>
      <to sec="1097385228" usec="0"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="216.110.3.142"/>
      <from sec="1097384400" usec="0"/>
      <to sec="1097385138" usec="0"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385138" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="145.239.227.236"/>
      <from sec="1097384400" usec="0"/>
      <to sec="1097385228" usec="0"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,504,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_254{
style=filled;
color=gray75;
1152[label="165.74.0.86;d;1pkt 1fpkt", shape=diamond, color=yellow];
1173[label="208.105.60.241;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat254[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.105.60.241:62874, 165.74.0.86:443}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 62874: (50%)&lt;BR/&gt; 443: (50%)&gt;];
}
1152--1173[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="165.74.0.86" dst_port="443" src_ip="208.105.60.241" src_port="62874"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385138" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_255{
style=filled;
color=gray75;
1185[label="216.149.11.129;s;564pkt 564fpkt", shape=diamond, color=yellow];
stat255[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.149.11.129:53, *:*}[95.922%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (54.078%)&lt;BR/&gt; 25: (2.03901%)&lt;BR/&gt; 32768: (1.24113%)&lt;BR/&gt; 32769: (1.06383%)&lt;BR/&gt; 1024: (0.975177%)&gt;];
}
1185--1831[label="0.0106383;6pkt 6fpkt"];
1185--1846[label="0.0106383;6pkt 6fpkt"];
1185--1858[label="0.0124113;7pkt 7fpkt"];
1185--1865[label="0.0106383;6pkt 6fpkt"];
1185--1879[label="0.0106383;6pkt 6fpkt"];
1185--1893[label="0.0106383;6pkt 6fpkt"];
1185--1902[label="0.0106383;6pkt 6fpkt"];
</description>
    <slice>
      <filter src_ip="216.149.11.129" src_port="53"/>
    </slice>
    <from sec="1097384403" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="208.139.240.174"/>
      <from sec="1097384422" usec="0"/>
      <to sec="1097384787" usec="0"/>
    </slice>
    <from sec="1097384422" usec="0"/>
    <to sec="1097384787" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="150.159.14.81"/>
      <from sec="1097384422" usec="0"/>
      <to sec="1097385223" usec="0"/>
    </slice>
    <from sec="1097384422" usec="0"/>
    <to sec="1097385223" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.626523,1.32957,503,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_258{
style=filled;
color=gray75;
21[label="145.239.171.40s;1pkt 1fpkt", shape=rectangle, color=red];
1223[label="108.179.12.254;d;642pkt 642fpkt", shape=diamond, color=yellow];
stat258[shape=component, label=&lt;Rules:&lt;BR/&gt;{145.239.171.40:*, 108.179.12.254:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4405: (0.155521%)&lt;BR/&gt; 4601: (0.0777605%)&lt;BR/&gt; 4600: (0.0777605%)&lt;BR/&gt; 4599: (0.0777605%)&gt;];
}
21--1218[label="1;1pkt 1fpkt"];
21--1223[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="108.179.12.254" dst_port="80" src_ip="145.239.171.40"/>
    </slice>
    <from sec="1097384640" usec="0"/>
    <to sec="1097385058" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_259{
style=filled;
color=gray75;
688[label="165.74.80.68;s;25pkt 25fpkt", shape=diamond, color=yellow];
865[label="197.208.222.128;d;1pkt 1fpkt", shape=diamond, color=yellow];
1219[label="197.147.28.163;d;2pkt 2fpkt", shape=diamond, color=yellow];
1221[label="216.46.74.158;d;5pkt 5fpkt", shape=diamond, color=yellow];
stat259[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.74.80.68:80, 216.46.74.158:*}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 62148: (3.0303%)&lt;BR/&gt; 55106: (3.0303%)&lt;BR/&gt; 50090: (3.0303%)&lt;BR/&gt; 50042: (3.0303%)&gt;];
}
688--865[label="1;1pkt 1fpkt"];
688--1006[label="1;2pkt 2fpkt"];
688--1219[label="1;2pkt 2fpkt"];
688--1221[label="1;5pkt 5fpkt"];
688--1724[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="216.46.74.158" src_ip="165.74.80.68" src_port="80"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_260{
style=filled;
color=gray75;
1218[label="145.239.171.40;s;655pkt 655fpkt", shape=diamond, color=yellow];
stat260[shape=component, label=&lt;Rules:&lt;BR/&gt;{145.239.171.40:*, 108.179.12.254:80}[98.0153%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.084%)&lt;BR/&gt; 53: (1.83206%)&lt;BR/&gt; 4608: (0.0763359%)&lt;BR/&gt; 4601: (0.0763359%)&lt;BR/&gt; 4600: (0.0763359%)&gt;];
}
1218--1223[label="1;642pkt 642fpkt"];
1218--1333[label="0.0107527;1pkt 1fpkt"];
1218--1499[label="0.0140845;1pkt 1fpkt"];
1218--1858[label="0.00152672;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="108.179.12.254" dst_port="80" src_ip="145.239.171.40"/>
    </slice>
    <from sec="1097384603" usec="0"/>
    <to sec="1097385137" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.62399,1.26784,503,1 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_261{
style=filled;
color=gray75;
90[label="208.86.161.107s;21pkt 21fpkt", shape=rectangle, color=red];
1209[label="145.238.199.197;d;184pkt 184fpkt", shape=diamond, color=yellow];
1227[label="208.86.161.107;s;161pkt 161fpkt", shape=diamond, color=yellow];
2066[label="208.86.161.79;48pkt 48fpkt", shape=pentagon, color=darkviolet];
stat261[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.86.161.107:80, 145.238.199.197:*}[72.8507%]&lt;BR/&gt;{208.86.161.79:80, 145.238.199.197:*}[22.1719%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1678: (0.362319%)&lt;BR/&gt; 1677: (0.362319%)&lt;BR/&gt; 1674: (0.362319%)&lt;BR/&gt; 1673: (0.362319%)&gt;];
}
90--1209[label="1;21pkt 21fpkt"];
90--1227[label="1;21pkt 21fpkt"];
1209--1227[label="0.900621;145pkt 145fpkt"];
1209--2066[label="0.5625;27pkt 27fpkt"];
</description>
    <slice>
      <filter dst_ip="145.238.199.197" src_ip="208.86.161.107" src_port="80"/>
      <filter dst_ip="145.238.199.197" src_ip="208.86.161.79" src_port="80"/>
    </slice>
    <from sec="1097384482" usec="0"/>
    <to sec="1097385300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.626523,1.32957,999,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_263{
style=filled;
color=gray75;
24[label="145.238.110.53s;1pkt 1fpkt", shape=rectangle, color=red];
1180[label="145.238.110.53;s;31pkt 31fpkt", shape=diamond, color=yellow];
1231[label="196.17.23.47;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat263[shape=component, label=&lt;Rules:&lt;BR/&gt;{145.238.110.53:25, *:*}[67.7419%]&lt;BR/&gt;{145.238.110.53:53, *:*}[32.2581%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (34.8485%)&lt;BR/&gt; 53: (19.697%)&lt;BR/&gt; 3356: (4.54545%)&lt;BR/&gt; 65039: (1.51515%)&lt;BR/&gt; 63531: (1.51515%)&gt;];
}
24--1180[label="1;1pkt 1fpkt"];
24--1231[label="1;1pkt 1fpkt"];
1180--1231[label="1;1pkt 1fpkt"];
1180--1831[label="0.0322581;1pkt 1fpkt"];
1180--1865[label="0.0322581;1pkt 1fpkt"];
1180--1893[label="0.0322581;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="145.238.110.53" src_port="25"/>
      <filter src_ip="145.238.110.53" src_port="53"/>
    </slice>
    <from sec="1097384401" usec="0"/>
    <to sec="1097385215" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.870535,1.38608,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_264{
style=filled;
color=gray75;
1213[label="212.83.80.109;d;109pkt 109fpkt", shape=diamond, color=yellow];
1233[label="145.238.33.138;s;35pkt 35fpkt", shape=diamond, color=yellow];
1698[label="212.83.80.109;d;89pkt 89fpkt", shape=hexagon, color=black];
2131[label="139.80.12.121;10pkt 10fpkt", shape=pentagon, color=darkviolet];
2297[label="145.239.38.203;23pkt 23fpkt", shape=pentagon, color=darkviolet];
stat264[shape=component, label=&lt;Rules:&lt;BR/&gt;{145.238.33.138:*, 212.83.80.109:80}[32.2581%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 59117: (0.56391%)&lt;BR/&gt; 59093: (0.56391%)&lt;BR/&gt; 44239: (0.56391%)&lt;BR/&gt; 44236: (0.56391%)&gt;];
}
1213--1233[label="0.4;14pkt 14fpkt"];
1213--1503[label="0.00917431;1pkt 1fpkt"];
1213--1698[label="1;89pkt 89fpkt"];
1213--1847[label="0.0825688;9pkt 9fpkt"];
1213--1880[label="0.0825688;9pkt 9fpkt"];
1213--1903[label="0.0825688;9pkt 9fpkt"];
1213--2131[label="0.2;2pkt 2fpkt"];
1213--2134[label="0.00917431;1pkt 1fpkt"];
1213--2297[label="0.26087;6pkt 6fpkt"];
1213--2481[label="0.00917431;1pkt 1fpkt"];
1233--1698[label="0.4;14pkt 14fpkt"];
1698--1847[label="0.101124;9pkt 9fpkt"];
1698--1880[label="0.101124;9pkt 9fpkt"];
1698--1903[label="0.101124;9pkt 9fpkt"];
1698--2131[label="0.2;2pkt 2fpkt"];
1698--2134[label="0.011236;1pkt 1fpkt"];
1698--2297[label="0.26087;6pkt 6fpkt"];
1698--2481[label="0.011236;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="212.83.80.109" dst_port="80" src_ip="145.238.33.138"/>
    </slice>
    <from sec="1097384449" usec="0"/>
    <to sec="1097385227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,011,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="197.133.168.24"/>
      <from sec="1097384400" usec="0"/>
      <to sec="1097385227" usec="0"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_267{
style=filled;
color=gray75;
1149[label="210.6.164.218;d;1pkt 1fpkt", shape=diamond, color=yellow];
1244[label="165.74.61.255;s;4pkt 4fpkt", shape=diamond, color=yellow];
stat267[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.74.61.255:25, 213.152.162.1:52896}[25%]&lt;BR/&gt;{165.74.61.255:25, 50.19.210.209:3625}[25%]&lt;BR/&gt;{165.74.61.255:80, 210.6.164.218:2312}[25%]&lt;BR/&gt;{165.74.61.255:80, 49.188.197.247:59282}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (30%)&lt;BR/&gt; 2312: (20%)&lt;BR/&gt; 25: (20%)&lt;BR/&gt; 59282: (10%)&lt;BR/&gt; 52896: (10%)&gt;];
}
1149--1244[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="49.188.197.247" dst_port="59282" src_ip="165.74.61.255" src_port="80"/>
      <filter dst_ip="210.6.164.218" dst_port="2312" src_ip="165.74.61.255" src_port="80"/>
      <filter dst_ip="50.19.210.209" dst_port="3625" src_ip="165.74.61.255" src_port="25"/>
      <filter dst_ip="213.152.162.1" dst_port="52896" src_ip="165.74.61.255" src_port="25"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,011,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="197.202.247.84"/>
      <from sec="1097384401" usec="0"/>
      <to sec="1097385138" usec="0"/>
    </slice>
    <from sec="1097384401" usec="0"/>
    <to sec="1097385138" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="139.80.163.47"/>
      <from sec="1097384402" usec="0"/>
      <to sec="1097384867" usec="0"/>
    </slice>
    <from sec="1097384402" usec="0"/>
    <to sec="1097384867" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.921631,1.38447,503,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_270{
style=filled;
color=gray75;
92[label="165.74.38.32s;309pkt 309fpkt", shape=rectangle, color=red];
1291[label="53.155.118.145;d;288pkt 288fpkt", shape=diamond, color=yellow];
1368[label="165.74.38.32;s;281pkt 281fpkt", shape=diamond, color=yellow];
1719[label="53.155.118.145;d;166pkt 166fpkt", shape=hexagon, color=black];
stat270[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.74.38.32:*, 53.155.118.145:80}[88.7931%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.8084%)&lt;BR/&gt; 58798: (0.191571%)&lt;BR/&gt; 58797: (0.191571%)&lt;BR/&gt; 58796: (0.191571%)&lt;BR/&gt; 58793: (0.191571%)&gt;];
}
92--1291[label="0.993056;286pkt 286fpkt"];
92--1368[label="0.868327;244pkt 244fpkt"];
92--1719[label="0.987952;164pkt 164fpkt"];
1291--1368[label="0.868327;244pkt 244fpkt"];
1291--1719[label="1;166pkt 166fpkt"];
1291--2361[label="0.00347222;1pkt 1fpkt"];
1368--1462[label="0.0196078;1pkt 1fpkt"];
1368--1554[label="0.0217391;1pkt 1fpkt"];
1368--1579[label="0.0434783;2pkt 2fpkt"];
1368--1719[label="0.987952;164pkt 164fpkt"];
1368--1832[label="0.0284698;8pkt 8fpkt"];
1368--1866[label="0.0284698;8pkt 8fpkt"];
1368--1894[label="0.0284698;8pkt 8fpkt"];
1719--2361[label="0.0060241;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="53.155.118.145" dst_port="80" src_ip="165.74.38.32"/>
    </slice>
    <from sec="1097384415" usec="0"/>
    <to sec="1097385261" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.872352,1.44276,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_271{
style=filled;
color=gray75;
700[label="150.159.142.40;s;22pkt 22fpkt", shape=diamond, color=yellow];
1295[label="199.11.140.39;d;6pkt 6fpkt", shape=diamond, color=yellow];
1721[label="199.11.140.39;d;11pkt 11fpkt", shape=hexagon, color=black];
stat271[shape=component, label=&lt;Rules:&lt;BR/&gt;{150.159.142.40:*, 199.11.140.39:80}[77.2727%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.1538%)&lt;BR/&gt; 14734: (3.84615%)&lt;BR/&gt; 4351: (2.5641%)&lt;BR/&gt; 4350: (2.5641%)&lt;BR/&gt; 4349: (2.5641%)&gt;];
}
700--1295[label="1;6pkt 6fpkt"];
700--1721[label="1;11pkt 11fpkt"];
</description>
    <slice>
      <filter dst_ip="199.11.140.39" dst_port="80" src_ip="150.159.142.40"/>
    </slice>
    <from sec="1097384824" usec="0"/>
    <to sec="1097385225" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.732293,1.30933,020,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_272{
style=filled;
color=gray75;
1037[label="209.46.160.39;s;276pkt 276fpkt", shape=diamond, color=yellow];
1994[label="209.46.160.39;281pkt 281fpkt", shape=pentagon, color=darkviolet];
2421[label="209.46.160.39;281pkt 281fpkt", shape=invtriangle, color=brown];
stat272[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.46.160.39:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1037--1306[label="0.0666667;1pkt 1fpkt"];
1037--1994[label="1;276pkt 276fpkt"];
1037--2421[label="1;276pkt 276fpkt"];
1994--2421[label="1;281pkt 281fpkt"];
</description>
    <slice>
      <filter src_ip="209.46.160.39"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_273{
style=filled;
color=gray75;
1312[label="139.80.8.109;s;10pkt 10fpkt", shape=diamond, color=yellow];
1313[label="108.130.247.243;d;8pkt 8fpkt", shape=diamond, color=yellow];
stat273[shape=component, label=&lt;Rules:&lt;BR/&gt;{139.80.8.109:*, 108.130.247.243:2002}[40%]&lt;BR/&gt;{139.80.8.109:*, 108.130.247.243:3002}[40%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3002: (22.2222%)&lt;BR/&gt; 2002: (22.2222%)&lt;BR/&gt; 1775: (5.55556%)&lt;BR/&gt; 1774: (5.55556%)&lt;BR/&gt; 1773: (5.55556%)&gt;];
}
1312--1313[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="108.130.247.243" dst_port="3002" src_ip="139.80.8.109"/>
      <filter dst_ip="108.130.247.243" dst_port="2002" src_ip="139.80.8.109"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548596,1.33125,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_274{
style=filled;
color=gray75;
1319[label="212.151.71.175;d;1pkt 1fpkt", shape=diamond, color=yellow];
1320[label="145.238.102.15;s;2pkt 2fpkt", shape=diamond, color=yellow];
1949[label="145.238.102.15;2pkt 2fpkt", shape=pentagon, color=darkviolet];
stat274[shape=component, label=&lt;Rules:&lt;BR/&gt;{145.238.102.15:62875, 192.168.126.1:3558}[50%]&lt;BR/&gt;{145.238.102.15:63196, 212.151.71.175:9700}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 63196: (30%)&lt;BR/&gt; 9700: (30%)&lt;BR/&gt; 62875: (20%)&lt;BR/&gt; 3558: (20%)&gt;];
}
1319--1320[label="1;1pkt 1fpkt"];
1319--1949[label="1;1pkt 1fpkt"];
1320--1949[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="212.151.71.175" dst_port="9700" src_ip="145.238.102.15" src_port="63196"/>
      <filter dst_ip="192.168.126.1" dst_port="3558" src_ip="145.238.102.15" src_port="62875"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.872352,1.44276,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_275{
style=filled;
color=gray75;
1044[label="202.180.60.229;s;2pkt 2fpkt", shape=diamond, color=yellow];
1324[label="208.129.208.226;d;1pkt 1fpkt", shape=diamond, color=yellow];
1685[label="202.180.60.229;s;2pkt 2fpkt", shape=hexagon, color=black];
stat275[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.180.60.229:0, 208.129.210.57:0}[50%]&lt;BR/&gt;{202.180.60.229:0, 208.129.208.226:0}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1044--1323[label="1;1pkt 1fpkt"];
1044--1324[label="1;1pkt 1fpkt"];
1044--1685[label="1;2pkt 2fpkt"];
1324--1685[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="208.129.208.226" src_ip="202.180.60.229"/>
      <filter dst_ip="208.129.210.57" src_ip="202.180.60.229"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_276{
style=filled;
color=gray75;
1326[label="192.168.128.255;d;1pkt 1fpkt", shape=diamond, color=yellow];
1327[label="145.238.84.27;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat276[shape=component, label=&lt;Rules:&lt;BR/&gt;{145.238.84.27:4445, 192.168.128.255:4445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4445: (100%)&gt;];
}
1326--1327[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="192.168.128.255" dst_port="4445" src_ip="145.238.84.27" src_port="4445"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_277{
style=filled;
color=gray75;
1328[label="110.237.86.156;d;2pkt 2fpkt", shape=diamond, color=yellow];
1329[label="139.80.26.204;s;2pkt 2fpkt", shape=diamond, color=yellow];
stat277[shape=component, label=&lt;Rules:&lt;BR/&gt;{139.80.26.204:4370, 110.237.86.156:554}[50%]&lt;BR/&gt;{139.80.26.204:6970, 110.237.86.156:17324}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 17324: (25%)&lt;BR/&gt; 6970: (25%)&lt;BR/&gt; 4370: (25%)&lt;BR/&gt; 554: (25%)&gt;];
}
1328--1329[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="110.237.86.156" dst_port="17324" src_ip="139.80.26.204" src_port="6970"/>
      <filter dst_ip="110.237.86.156" dst_port="554" src_ip="139.80.26.204" src_port="4370"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="209.46.163.137"/>
      <from sec="1097384400" usec="0"/>
      <to sec="1097385228" usec="0"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="209.46.163.140"/>
      <from sec="1097384400" usec="0"/>
      <to sec="1097385138" usec="0"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385138" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_280{
style=filled;
color=gray75;
863[label="219.3.231.159;s;5pkt 5fpkt", shape=diamond, color=yellow];
1310[label="165.74.51.160;d;1pkt 1fpkt", shape=diamond, color=yellow];
1334[label="165.74.50.55;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat280[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.3.231.159:6662, 165.74.50.55:1043}[20%]&lt;BR/&gt;{219.3.231.159:6665, 165.74.51.84:1046}[20%]&lt;BR/&gt;{219.3.231.159:6667, 165.74.51.86:1208}[20%]&lt;BR/&gt;{219.3.231.159:6661, 165.74.51.160:1109}[20%]&lt;BR/&gt;{219.3.231.159:6664, 165.74.51.166:1046}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6662: (14.2857%)&lt;BR/&gt; 6661: (14.2857%)&lt;BR/&gt; 1109: (14.2857%)&lt;BR/&gt; 1046: (14.2857%)&lt;BR/&gt; 1043: (14.2857%)&gt;];
}
863--1310[label="1;1pkt 1fpkt"];
863--1334[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="165.74.51.166" dst_port="1046" src_ip="219.3.231.159" src_port="6664"/>
      <filter dst_ip="165.74.51.160" dst_port="1109" src_ip="219.3.231.159" src_port="6661"/>
      <filter dst_ip="165.74.51.86" dst_port="1208" src_ip="219.3.231.159" src_port="6667"/>
      <filter dst_ip="165.74.51.84" dst_port="1046" src_ip="219.3.231.159" src_port="6665"/>
      <filter dst_ip="165.74.50.55" dst_port="1043" src_ip="219.3.231.159" src_port="6662"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.870535,1.38608,020,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_281{
style=filled;
color=gray75;
924[label="202.180.60.229;d;4pkt 4fpkt", shape=diamond, color=yellow];
1157[label="51.34.177.176;d;391pkt 391fpkt", shape=diamond, color=yellow];
1340[label="208.129.210.58;s;56pkt 56fpkt", shape=diamond, color=yellow];
1343[label="209.46.180.11;s;2pkt 2fpkt", shape=diamond, color=yellow];
1345[label="208.129.210.56;s;4pkt 4fpkt", shape=diamond, color=yellow];
1419[label="208.129.208.34;s;1pkt 1fpkt", shape=diamond, color=yellow];
1649[label="202.180.60.229;d;4pkt 4fpkt", shape=hexagon, color=black];
2017[label="208.129.210.58;78pkt 78fpkt", shape=pentagon, color=darkviolet];
stat281[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 51.34.177.176:0}[82.3158%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (98.5185%)&lt;BR/&gt; 445: (0.37037%)&lt;BR/&gt; 53: (0.277778%)&lt;BR/&gt; 4536: (0.185185%)&lt;BR/&gt; 3850: (0.185185%)&gt;];
}
924--1340[label="0.25;1pkt 1fpkt"];
924--1343[label="0.5;1pkt 1fpkt"];
924--1345[label="0.25;1pkt 1fpkt"];
924--1419[label="1;1pkt 1fpkt"];
924--1649[label="1;4pkt 4fpkt"];
924--2017[label="0.25;1pkt 1fpkt"];
1157--1158[label="0.00255754;1pkt 1fpkt"];
1157--1171[label="0.00255754;1pkt 1fpkt"];
1157--1259[label="0.00255754;1pkt 1fpkt"];
1157--1309[label="0.00255754;1pkt 1fpkt"];
1157--1340[label="0.0178571;1pkt 1fpkt"];
1157--1504[label="0.00255754;1pkt 1fpkt"];
1157--1506[label="0.00255754;1pkt 1fpkt"];
1157--2017[label="0.0128205;1pkt 1fpkt"];
1157--2060[label="0.00289855;1pkt 1fpkt"];
1157--2088[label="0.00255754;1pkt 1fpkt"];
1157--2166[label="0.0107527;1pkt 1fpkt"];
1340--1649[label="0.25;1pkt 1fpkt"];
1340--2017[label="1;56pkt 56fpkt"];
1343--1649[label="0.5;1pkt 1fpkt"];
1345--1649[label="0.25;1pkt 1fpkt"];
1345--1858[label="0.25;1pkt 1fpkt"];
1419--1649[label="1;1pkt 1fpkt"];
1649--2017[label="0.25;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="51.34.177.176"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="162.10.32.92"/>
      <from sec="1097384407" usec="0"/>
      <to sec="1097385225" usec="0"/>
    </slice>
    <from sec="1097384407" usec="0"/>
    <to sec="1097385225" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548596,1.33125,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_283{
style=filled;
color=gray75;
993[label="162.10.188.131;d;110pkt 110fpkt", shape=diamond, color=yellow];
1378[label="197.155.167.13;s;23pkt 23fpkt", shape=diamond, color=yellow];
2352[label="108.165.124.234;8pkt 8fpkt", shape=pentagon, color=darkviolet];
stat283[shape=component, label=&lt;Rules:&lt;BR/&gt;{108.165.124.229:80, 162.10.188.131:*}[38.7387%]&lt;BR/&gt;{197.155.167.13:80, 162.10.188.131:*}[20.7207%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2756: (0.70922%)&lt;BR/&gt; 2752: (0.70922%)&lt;BR/&gt; 2751: (0.70922%)&lt;BR/&gt; 2737: (0.70922%)&gt;];
}
993--1378[label="1;23pkt 23fpkt"];
993--2352[label="0.875;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="162.10.188.131" src_ip="108.165.124.229" src_port="80"/>
      <filter dst_ip="162.10.188.131" src_ip="197.155.167.13" src_port="80"/>
    </slice>
    <from sec="1097384555" usec="0"/>
    <to sec="1097385264" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548596,1.33125,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_284{
style=filled;
color=gray75;
1386[label="51.114.6.0;d;1pkt 1fpkt", shape=diamond, color=yellow];
1387[label="165.74.11.159;s;5pkt 5fpkt", shape=diamond, color=yellow];
2206[label="165.74.11.159;9pkt 9fpkt", shape=pentagon, color=darkviolet];
stat284[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.74.11.159:80, 209.240.151.107:*}[55.5556%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.6667%)&lt;BR/&gt; 3287: (10%)&lt;BR/&gt; 55834: (6.66667%)&lt;BR/&gt; 49847: (6.66667%)&lt;BR/&gt; 49201: (6.66667%)&gt;];
}
1386--1387[label="1;1pkt 1fpkt"];
1386--2206[label="1;1pkt 1fpkt"];
1387--2206[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="209.240.151.107" src_ip="165.74.11.159" src_port="80"/>
    </slice>
    <from sec="1097384426" usec="0"/>
    <to sec="1097385300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.62399,1.26784,503,1 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_285{
style=filled;
color=gray75;
36[label="145.239.156.83s;1pkt 1fpkt", shape=rectangle, color=red];
1388[label="145.239.156.83;s;11pkt 11fpkt", shape=diamond, color=yellow];
2080[label="145.239.156.83;10pkt 10fpkt", shape=pentagon, color=darkviolet];
stat285[shape=component, label=&lt;Rules:&lt;BR/&gt;{145.239.156.83:*, 202.21.138.128:80}[54.5455%]&lt;BR/&gt;{145.239.156.83:*, 202.21.138.128:443}[45.4545%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (27.2727%)&lt;BR/&gt; 443: (22.7273%)&lt;BR/&gt; 9080: (6.81818%)&lt;BR/&gt; 9074: (4.54545%)&lt;BR/&gt; 9056: (4.54545%)&gt;];
}
36--1377[label="1;1pkt 1fpkt"];
36--1388[label="1;1pkt 1fpkt"];
36--2080[label="1;1pkt 1fpkt"];
1388--2080[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter dst_ip="202.21.138.128" dst_port="80" src_ip="145.239.156.83"/>
      <filter dst_ip="202.21.138.128" dst_port="443" src_ip="145.239.156.83"/>
    </slice>
    <from sec="1097384762" usec="0"/>
    <to sec="1097385006" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_286{
style=filled;
color=gray75;
1379[label="162.10.211.73;s;10pkt 10fpkt", shape=diamond, color=yellow];
1391[label="111.233.57.251;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat286[shape=component, label=&lt;Rules:&lt;BR/&gt;{162.10.211.73:*, 49.66.48.216:80}[90%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3049: (9.09091%)&lt;BR/&gt; 3051: (4.54545%)&lt;BR/&gt; 3046: (4.54545%)&lt;BR/&gt; 3045: (4.54545%)&gt;];
}
1379--1391[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="49.66.48.216" dst_port="80" src_ip="162.10.211.73"/>
    </slice>
    <from sec="1097384572" usec="0"/>
    <to sec="1097384990" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="52.201.66.193"/>
      <from sec="1097384846" usec="0"/>
      <to sec="1097385228" usec="0"/>
    </slice>
    <from sec="1097384846" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.872352,1.44276,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_288{
style=filled;
color=gray75;
862[label="219.3.231.159;d;5pkt 5fpkt", shape=diamond, color=yellow];
1335[label="165.74.50.55;s;1pkt 1fpkt", shape=diamond, color=yellow];
1410[label="165.74.51.160;s;2pkt 2fpkt", shape=diamond, color=yellow];
1734[label="165.74.50.55;s;1pkt 1fpkt", shape=hexagon, color=black];
1768[label="219.3.231.159;d;5pkt 5fpkt", shape=hexagon, color=black];
stat288[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:1046, 219.3.231.159:*}[33.3333%]&lt;BR/&gt;{165.74.51.160:*, *:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6662: (14.2857%)&lt;BR/&gt; 1046: (14.2857%)&lt;BR/&gt; 1043: (14.2857%)&lt;BR/&gt; 6661: (10.7143%)&lt;BR/&gt; 1109: (10.7143%)&gt;];
}
862--1335[label="1;1pkt 1fpkt"];
862--1410[label="0.5;1pkt 1fpkt"];
862--1734[label="1;1pkt 1fpkt"];
862--1768[label="1;5pkt 5fpkt"];
1335--1734[label="1;1pkt 1fpkt"];
1335--1768[label="1;1pkt 1fpkt"];
1410--1768[label="0.5;1pkt 1fpkt"];
1734--1768[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="165.74.51.160"/>
      <filter dst_ip="219.3.231.159" src_port="1046"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="209.46.160.39"/>
      <from sec="1097384400" usec="0"/>
      <to sec="1097385228" usec="0"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,011,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="108.148.242.63"/>
      <from sec="1097384400" usec="0"/>
      <to sec="1097385228" usec="0"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_291{
style=filled;
color=gray75;
1430[label="139.80.163.47;d;109pkt 109fpkt", shape=diamond, color=yellow];
stat291[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 139.80.163.47:0}[99.0826%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.0826%)&lt;BR/&gt; 13457: (0.458716%)&lt;BR/&gt; 1433: (0.458716%)&gt;];
}
1430--1621[label="0.00917431;1pkt 1fpkt"];
1430--1802[label="0.00917431;1pkt 1fpkt"];
1430--1863[label="0.00917431;1pkt 1fpkt"];
1430--1934[label="0.00917431;1pkt 1fpkt"];
1430--2398[label="0.00917431;1pkt 1fpkt"];
1430--2587[label="0.00917431;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="139.80.163.47"/>
    </slice>
    <from sec="1097384402" usec="0"/>
    <to sec="1097385227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_292{
style=filled;
color=gray75;
1349[label="150.159.164.79;s;145pkt 145fpkt", shape=diamond, color=yellow];
1432[label="201.6.30.235;d;103pkt 103fpkt", shape=diamond, color=yellow];
stat292[shape=component, label=&lt;Rules:&lt;BR/&gt;{150.159.164.79:25, 201.6.30.235:*}[44.8276%]&lt;BR/&gt;{150.159.164.79:*, 201.6.30.235:113}[44.1379%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (25.2016%)&lt;BR/&gt; 113: (24.7984%)&lt;BR/&gt; 43195: (0.403226%)&lt;BR/&gt; 43193: (0.403226%)&lt;BR/&gt; 43190: (0.403226%)&gt;];
}
1349--1432[label="1;103pkt 103fpkt"];
</description>
    <slice>
      <filter dst_ip="201.6.30.235" src_ip="150.159.164.79" src_port="25"/>
      <filter dst_ip="201.6.30.235" dst_port="113" src_ip="150.159.164.79"/>
    </slice>
    <from sec="1097384402" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="145.238.254.9"/>
      <from sec="1097384407" usec="0"/>
      <to sec="1097385226" usec="0"/>
    </slice>
    <from sec="1097384407" usec="0"/>
    <to sec="1097385226" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.62399,1.26784,503,1 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_295{
style=filled;
color=gray75;
95[label="145.239.229.74s;39pkt 39fpkt", shape=rectangle, color=red];
1461[label="145.239.229.74;s;178pkt 178fpkt", shape=diamond, color=yellow];
1476[label="201.243.208.65;d;90pkt 90fpkt", shape=diamond, color=yellow];
2054[label="145.239.229.74;185pkt 185fpkt", shape=pentagon, color=darkviolet];
stat295[shape=component, label=&lt;Rules:&lt;BR/&gt;{145.239.229.74:*, 201.243.208.65:80}[48.3871%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.7967%)&lt;BR/&gt; 3500: (0.406504%)&lt;BR/&gt; 3499: (0.406504%)&lt;BR/&gt; 3498: (0.406504%)&lt;BR/&gt; 3497: (0.406504%)&gt;];
}
95--1461[label="1;39pkt 39fpkt"];
95--1476[label="0.948718;37pkt 37fpkt"];
95--2054[label="1;39pkt 39fpkt"];
1461--1476[label="1;90pkt 90fpkt"];
1461--1832[label="0.00561798;1pkt 1fpkt"];
1461--1847[label="0.011236;2pkt 2fpkt"];
1461--1866[label="0.00561798;1pkt 1fpkt"];
1461--1880[label="0.011236;2pkt 2fpkt"];
1461--1894[label="0.00561798;1pkt 1fpkt"];
1461--1903[label="0.011236;2pkt 2fpkt"];
1461--2054[label="0.994382;177pkt 177fpkt"];
1476--2054[label="1;90pkt 90fpkt"];
</description>
    <slice>
      <filter dst_ip="201.243.208.65" dst_port="80" src_ip="145.239.229.74"/>
    </slice>
    <from sec="1097384445" usec="0"/>
    <to sec="1097385266" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548596,1.33125,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_296{
style=filled;
color=gray75;
1475[label="145.238.137.47;s;41pkt 41fpkt", shape=diamond, color=yellow];
1478[label="110.236.114.30;d;1pkt 1fpkt", shape=diamond, color=yellow];
2008[label="145.238.137.47;53pkt 53fpkt", shape=pentagon, color=darkviolet];
stat296[shape=component, label=&lt;Rules:&lt;BR/&gt;{145.238.137.47:*, 110.42.109.145:80}[49.0566%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 53656: (1.57895%)&lt;BR/&gt; 53688: (1.05263%)&lt;BR/&gt; 53687: (1.05263%)&lt;BR/&gt; 53686: (1.05263%)&gt;];
}
1475--1478[label="1;1pkt 1fpkt"];
1475--1586[label="0.0731707;3pkt 3fpkt"];
1475--2008[label="1;41pkt 41fpkt"];
1478--2008[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="110.42.109.145" dst_port="80" src_ip="145.238.137.47"/>
    </slice>
    <from sec="1097384870" usec="0"/>
    <to sec="1097385295" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="192.138.165.200"/>
      <from sec="1097384400" usec="0"/>
      <to sec="1097385228" usec="0"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="201.228.99.170"/>
      <from sec="1097384400" usec="0"/>
      <to sec="1097385138" usec="0"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385138" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="145.238.192.203"/>
      <from sec="1097384401" usec="0"/>
      <to sec="1097385226" usec="0"/>
    </slice>
    <from sec="1097384401" usec="0"/>
    <to sec="1097385226" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="139.80.224.74"/>
      <from sec="1097384403" usec="0"/>
      <to sec="1097385227" usec="0"/>
    </slice>
    <from sec="1097384403" usec="0"/>
    <to sec="1097385227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_302{
style=filled;
color=gray75;
1504[label="162.10.87.52;s;486pkt 486fpkt", shape=diamond, color=yellow];
stat302[shape=component, label=&lt;Rules:&lt;BR/&gt;{162.10.87.52:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1504--1552[label="0.00497512;1pkt 1fpkt"];
1504--1563[label="0.00526316;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="162.10.87.52"/>
    </slice>
    <from sec="1097384406" usec="0"/>
    <to sec="1097385226" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="145.238.142.7"/>
      <from sec="1097384406" usec="0"/>
      <to sec="1097385227" usec="0"/>
    </slice>
    <from sec="1097384406" usec="0"/>
    <to sec="1097385227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.872352,1.44276,504,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_304{
style=filled;
color=gray75;
1362[label="165.74.105.92;s;20pkt 20fpkt", shape=diamond, color=yellow];
1758[label="165.74.105.92;s;15pkt 15fpkt", shape=hexagon, color=black];
stat304[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.74.105.92:*, 42.44.203.211:443}[30%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (47.1429%)&lt;BR/&gt; 5050: (2.85714%)&lt;BR/&gt; 1715: (2.85714%)&lt;BR/&gt; 1698: (2.85714%)&lt;BR/&gt; 1696: (2.85714%)&gt;];
}
1362--1510[label="1;1pkt 1fpkt"];
1362--1758[label="1;15pkt 15fpkt"];
</description>
    <slice>
      <filter dst_ip="42.44.203.211" dst_port="443" src_ip="165.74.105.92"/>
    </slice>
    <from sec="1097384408" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="150.105.194.119"/>
      <from sec="1097384706" usec="0"/>
      <to sec="1097385088" usec="0"/>
    </slice>
    <from sec="1097384706" usec="0"/>
    <to sec="1097385088" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_308{
style=filled;
color=gray75;
1472[label="90.62.171.252;d;2pkt 2fpkt", shape=diamond, color=yellow];
1528[label="165.74.54.242;s;3pkt 3fpkt", shape=diamond, color=yellow];
stat308[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.74.54.242:25, 43.122.10.94:3402}[33.3333%]&lt;BR/&gt;{165.74.54.242:80, 90.62.171.252:21250}[33.3333%]&lt;BR/&gt;{165.74.54.242:80, 90.62.171.252:21628}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (40%)&lt;BR/&gt; 21628: (20%)&lt;BR/&gt; 21250: (20%)&lt;BR/&gt; 3402: (10%)&lt;BR/&gt; 25: (10%)&gt;];
}
1472--1528[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="90.62.171.252" dst_port="21628" src_ip="165.74.54.242" src_port="80"/>
      <filter dst_ip="90.62.171.252" dst_port="21250" src_ip="165.74.54.242" src_port="80"/>
      <filter dst_ip="43.122.10.94" dst_port="3402" src_ip="165.74.54.242" src_port="25"/>
    </slice>
    <from sec="1097384745" usec="0"/>
    <to sec="1097385131" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_311{
style=filled;
color=gray75;
1549[label="212.151.71.175;s;1pkt 1fpkt", shape=diamond, color=yellow];
1550[label="145.238.102.15;d;2pkt 2fpkt", shape=diamond, color=yellow];
stat311[shape=component, label=&lt;Rules:&lt;BR/&gt;{41.172.73.124:32378, 145.238.102.15:1433}[50%]&lt;BR/&gt;{212.151.71.175:9700, 145.238.102.15:63196}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 63196: (33.3333%)&lt;BR/&gt; 9700: (33.3333%)&lt;BR/&gt; 32378: (16.6667%)&lt;BR/&gt; 1433: (16.6667%)&gt;];
}
1549--1550[label="1;1pkt 1fpkt"];
1550--1863[label="0.5;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="145.238.102.15" dst_port="63196" src_ip="212.151.71.175" src_port="9700"/>
      <filter dst_ip="145.238.102.15" dst_port="1433" src_ip="41.172.73.124" src_port="32378"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_312{
style=filled;
color=gray75;
1552[label="208.29.158.144;d;201pkt 201fpkt", shape=diamond, color=yellow];
stat312[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 208.29.158.144:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1552--1622[label="0.00497512;1pkt 1fpkt"];
1552--1803[label="0.00497512;1pkt 1fpkt"];
1552--2017[label="0.0128205;1pkt 1fpkt"];
1552--2060[label="0.00497512;1pkt 1fpkt"];
1552--2088[label="0.00497512;1pkt 1fpkt"];
1552--2166[label="0.0107527;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="208.29.158.144"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_313{
style=filled;
color=gray75;
1417[label="165.74.11.227;s;28pkt 28fpkt", shape=diamond, color=yellow];
1553[label="50.35.152.82;d;25pkt 25fpkt", shape=diamond, color=yellow];
stat313[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.74.11.227:80, 50.35.152.82:*}[73.5294%]&lt;BR/&gt;{165.74.11.227:25, *:*}[26.4706%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (41.5094%)&lt;BR/&gt; 25: (8.49057%)&lt;BR/&gt; 59385: (1.88679%)&lt;BR/&gt; 57728: (1.88679%)&lt;BR/&gt; 56211: (1.88679%)&gt;];
}
1417--1553[label="0.76;19pkt 19fpkt"];
</description>
    <slice>
      <filter src_ip="165.74.11.227" src_port="25"/>
      <filter dst_ip="50.35.152.82" src_ip="165.74.11.227" src_port="80"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="209.46.176.40"/>
      <from sec="1097384400" usec="0"/>
      <to sec="1097385228" usec="0"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_316{
style=filled;
color=gray75;
1563[label="167.67.160.149;d;190pkt 190fpkt", shape=diamond, color=yellow];
stat316[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 167.67.160.149:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1563--1622[label="0.00526316;1pkt 1fpkt"];
1563--1803[label="0.00526316;1pkt 1fpkt"];
1563--2088[label="0.00526316;1pkt 1fpkt"];
1563--2166[label="0.0107527;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="167.67.160.149"/>
    </slice>
    <from sec="1097384401" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="165.74.46.51"/>
      <from sec="1097384407" usec="0"/>
      <to sec="1097385225" usec="0"/>
    </slice>
    <from sec="1097384407" usec="0"/>
    <to sec="1097385225" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.870535,1.38608,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_319{
style=filled;
color=gray75;
1147[label="165.74.57.49;d;33pkt 33fpkt", shape=diamond, color=yellow];
1588[label="209.206.80.67;s;16pkt 16fpkt", shape=diamond, color=yellow];
1705[label="165.74.57.49;d;19pkt 19fpkt", shape=hexagon, color=black];
2380[label="200.131.66.250;4pkt 4fpkt", shape=pentagon, color=darkviolet];
stat319[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.206.80.67:*, 165.74.57.49:25}[20.9302%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (47.2222%)&lt;BR/&gt; 33347: (2.77778%)&lt;BR/&gt; 137: (2.77778%)&lt;BR/&gt; 33437: (2.08333%)&lt;BR/&gt; 33406: (2.08333%)&gt;];
}
1147--1588[label="0.5;8pkt 8fpkt"];
1147--1705[label="1;19pkt 19fpkt"];
1147--2380[label="0.5;2pkt 2fpkt"];
1588--1705[label="0.1875;3pkt 3fpkt"];
1705--2380[label="0.25;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="165.74.57.49" dst_port="25" src_ip="209.206.80.67"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548596,1.33125,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_320{
style=filled;
color=gray75;
819[label="52.54.47.118;d;31pkt 31fpkt", shape=diamond, color=yellow];
964[label="145.238.214.216;s;27pkt 27fpkt", shape=diamond, color=yellow];
968[label="49.188.201.215;d;15pkt 15fpkt", shape=diamond, color=yellow];
972[label="145.238.214.212;s;55pkt 55fpkt", shape=diamond, color=yellow];
1513[label="145.239.227.217;s;44pkt 44fpkt", shape=diamond, color=yellow];
1590[label="145.238.78.105;s;13pkt 13fpkt", shape=diamond, color=yellow];
1594[label="90.172.8.104;d;108pkt 108fpkt", shape=diamond, color=yellow];
2107[label="145.238.78.105;16pkt 16fpkt", shape=pentagon, color=darkviolet];
stat320[shape=component, label=&lt;Rules:&lt;BR/&gt;{145.238.214.212:80, 90.172.8.104:*}[42.5703%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4794: (0.485437%)&lt;BR/&gt; 4734: (0.485437%)&lt;BR/&gt; 4732: (0.485437%)&lt;BR/&gt; 58654: (0.323625%)&gt;];
}
819--964[label="0.0740741;2pkt 2fpkt"];
819--972[label="0.16129;5pkt 5fpkt"];
819--1590[label="0.230769;3pkt 3fpkt"];
819--2107[label="0.1875;3pkt 3fpkt"];
964--968[label="0.133333;2pkt 2fpkt"];
964--1594[label="0.0740741;2pkt 2fpkt"];
968--1513[label="0.533333;8pkt 8fpkt"];
972--1530[label="0.25;4pkt 4fpkt"];
972--1594[label="0.454545;25pkt 25fpkt"];
1590--2107[label="1;13pkt 13fpkt"];
</description>
    <slice>
      <filter dst_ip="90.172.8.104" src_ip="145.238.214.212" src_port="80"/>
    </slice>
    <from sec="1097384412" usec="0"/>
    <to sec="1097385274" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="49.129.94.241"/>
      <from sec="1097385027" usec="0"/>
      <to sec="1097385225" usec="0"/>
    </slice>
    <from sec="1097385027" usec="0"/>
    <to sec="1097385225" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_322{
style=filled;
color=gray75;
1486[label="209.46.166.147;s;16pkt 16fpkt", shape=diamond, color=yellow];
1596[label="211.29.87.21;d;4pkt 4fpkt", shape=diamond, color=yellow];
stat322[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.46.166.147:80, 211.29.87.21:*}[23.5294%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 63924: (5%)&lt;BR/&gt; 63923: (5%)&lt;BR/&gt; 63922: (5%)&lt;BR/&gt; 63926: (2.5%)&gt;];
}
1486--1596[label="0.75;3pkt 3fpkt"];
1596--2183[label="1;1pkt 1fpkt"];
1596--2508[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="211.29.87.21" src_ip="209.46.166.147" src_port="80"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="143.139.105.27"/>
      <from sec="1097385075" usec="0"/>
      <to sec="1097385163" usec="0"/>
    </slice>
    <from sec="1097385075" usec="0"/>
    <to sec="1097385163" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_324{
style=filled;
color=gray75;
1591[label="150.105.194.102;s;13pkt 13fpkt", shape=diamond, color=yellow];
1601[label="108.165.96.32;d;9pkt 9fpkt", shape=diamond, color=yellow];
stat324[shape=component, label=&lt;Rules:&lt;BR/&gt;{150.105.194.102:80, 108.165.96.32:*}[69.2308%]&lt;BR/&gt;{150.105.194.102:*, 131.64.62.35:*}[23.0769%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (40.9091%)&lt;BR/&gt; 29515: (4.54545%)&lt;BR/&gt; 29514: (4.54545%)&lt;BR/&gt; 29513: (4.54545%)&lt;BR/&gt; 29512: (4.54545%)&gt;];
}
1591--1601[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="131.64.62.35" src_ip="150.105.194.102"/>
      <filter dst_ip="108.165.96.32" src_ip="150.105.194.102" src_port="80"/>
    </slice>
    <from sec="1097384830" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_325{
style=filled;
color=gray75;
1529[label="150.105.194.102;d;34pkt 34fpkt", shape=diamond, color=yellow];
1602[label="108.165.96.32;s;10pkt 10fpkt", shape=diamond, color=yellow];
stat325[shape=component, label=&lt;Rules:&lt;BR/&gt;{108.165.96.32:*, 150.105.194.102:80}[26.4706%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (44.3182%)&lt;BR/&gt; 0: (4.54545%)&lt;BR/&gt; 29515: (2.27273%)&lt;BR/&gt; 29514: (2.27273%)&lt;BR/&gt; 29513: (2.27273%)&gt;];
}
1529--1602[label="1;10pkt 10fpkt"];
1529--2163[label="0.111111;3pkt 3fpkt"];
1529--2213[label="0.0882353;3pkt 3fpkt"];
1529--2226[label="0.0322581;1pkt 1fpkt"];
1529--2250[label="0.0294118;1pkt 1fpkt"];
1529--2526[label="0.0294118;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="150.105.194.102" dst_port="80" src_ip="108.165.96.32"/>
    </slice>
    <from sec="1097384830" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="49.97.134.174"/>
      <from sec="1097385141" usec="0"/>
      <to sec="1097385226" usec="0"/>
    </slice>
    <from sec="1097385141" usec="0"/>
    <to sec="1097385226" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="72.73.107.57"/>
      <from sec="1097385163" usec="0"/>
      <to sec="1097385228" usec="0"/>
    </slice>
    <from sec="1097385163" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="208.139.229.98"/>
      <from sec="1097385196" usec="0"/>
      <to sec="1097385228" usec="0"/>
    </slice>
    <from sec="1097385196" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.872352,1.44276,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_333{
style=filled;
color=gray75;
705[label="213.114.44.114;d;1pkt 1fpkt", shape=diamond, color=yellow];
1631[label="213.114.44.114;d;1pkt 1fpkt", shape=hexagon, color=black];
stat333[shape=component, label=&lt;Rules:&lt;BR/&gt;{139.80.33.135:63213, 213.114.44.114:1295}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 63213: (50%)&lt;BR/&gt; 1295: (50%)&gt;];
}
705--1631[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="213.114.44.114" dst_port="1295" src_ip="139.80.33.135" src_port="63213"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.872352,1.44276,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_335{
style=filled;
color=gray75;
874[label="205.179.254.133;d;1pkt 1fpkt", shape=diamond, color=yellow];
1241[label="150.105.149.111;s;1pkt 1fpkt", shape=diamond, color=yellow];
1644[label="205.179.254.133;d;1pkt 1fpkt", shape=hexagon, color=black];
stat335[shape=component, label=&lt;Rules:&lt;BR/&gt;{150.105.149.111:1366, 205.179.254.133:554}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1366: (50%)&lt;BR/&gt; 554: (50%)&gt;];
}
874--1241[label="1;1pkt 1fpkt"];
874--1644[label="1;1pkt 1fpkt"];
1241--1644[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="205.179.254.133" dst_port="554" src_ip="150.105.149.111" src_port="1366"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.872352,1.44276,011,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_336{
style=filled;
color=gray75;
915[label="196.23.82.12;d;612pkt 612fpkt", shape=diamond, color=yellow];
916[label="145.238.116.79;s;615pkt 615fpkt", shape=diamond, color=yellow];
1648[label="196.23.82.12;d;551pkt 551fpkt", shape=hexagon, color=black];
stat336[shape=component, label=&lt;Rules:&lt;BR/&gt;{145.238.116.79:3128, 196.23.82.12:*}[99.5122%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3128: (50%)&lt;BR/&gt; 1756: (0.112486%)&lt;BR/&gt; 4994: (0.0843645%)&lt;BR/&gt; 4964: (0.0843645%)&lt;BR/&gt; 4961: (0.0843645%)&gt;];
}
915--916[label="1;612pkt 612fpkt"];
915--1648[label="1;551pkt 551fpkt"];
916--1648[label="1;551pkt 551fpkt"];
</description>
    <slice>
      <filter dst_ip="196.23.82.12" src_ip="145.238.116.79" src_port="3128"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.872352,1.44276,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_337{
style=filled;
color=gray75;
814[label="150.159.168.185;d;12pkt 12fpkt", shape=diamond, color=yellow];
962[label="194.138.111.202;s;1pkt 1fpkt", shape=diamond, color=yellow];
1659[label="150.159.168.185;d;12pkt 12fpkt", shape=hexagon, color=black];
stat337[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 150.159.168.185:3260}[50%]&lt;BR/&gt;{*:*, 150.159.168.185:3643}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3260: (26%)&lt;BR/&gt; 3643: (24%)&lt;BR/&gt; 50154: (6%)&lt;BR/&gt; 49052: (4%)&lt;BR/&gt; 26341: (4%)&gt;];
}
814--962[label="1;1pkt 1fpkt"];
814--1659[label="1;12pkt 12fpkt"];
962--1659[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="150.159.168.185" dst_port="3643"/>
      <filter dst_ip="150.159.168.185" dst_port="3260"/>
    </slice>
    <from sec="1097384414" usec="0"/>
    <to sec="1097384840" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.872352,1.44276,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_338{
style=filled;
color=gray75;
945[label="145.238.220.47;d;255pkt 255fpkt", shape=diamond, color=yellow];
1669[label="145.238.220.47;d;127pkt 127fpkt", shape=hexagon, color=black];
stat338[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:25, 145.238.220.47:*}[54.902%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (32.199%)&lt;BR/&gt; 80: (8.90052%)&lt;BR/&gt; 113: (7.59162%)&lt;BR/&gt; 0: (1.57068%)&lt;BR/&gt; 137: (0.52356%)&gt;];
}
945--1669[label="1;127pkt 127fpkt"];
945--2518[label="0.0769231;1pkt 1fpkt"];
1669--2518[label="0.0769231;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="145.238.220.47" src_port="25"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_340{
style=filled;
color=gray75;
1323[label="208.129.210.57;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat340[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.180.60.229:0, 208.129.210.57:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1323--1685[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="208.129.210.57" src_ip="202.180.60.229"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.870535,1.38608,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_341{
style=filled;
color=gray75;
1106[label="49.129.94.208;s;22pkt 22fpkt", shape=diamond, color=yellow];
1113[label="162.10.10.194;d;6pkt 6fpkt", shape=diamond, color=yellow];
1695[label="49.129.94.208;s;11pkt 11fpkt", shape=hexagon, color=black];
1741[label="162.10.10.194;d;6pkt 6fpkt", shape=hexagon, color=black];
2305[label="49.129.94.208;24pkt 24fpkt", shape=pentagon, color=darkviolet];
stat341[shape=component, label=&lt;Rules:&lt;BR/&gt;{49.129.94.208:*, 150.159.165.1:80}[45.8333%]&lt;BR/&gt;{49.129.94.208:*, 162.10.10.194:80}[29.1667%]&lt;BR/&gt;{49.129.94.208:*, 150.159.117.161:80}[20.8333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 57826: (3.62319%)&lt;BR/&gt; 57773: (3.62319%)&lt;BR/&gt; 49904: (3.62319%)&lt;BR/&gt; 49881: (3.62319%)&gt;];
}
1106--1113[label="1;6pkt 6fpkt"];
1106--1695[label="1;11pkt 11fpkt"];
1106--1741[label="1;6pkt 6fpkt"];
1106--1847[label="0.0909091;2pkt 2fpkt"];
1106--1880[label="0.0909091;2pkt 2fpkt"];
1106--1903[label="0.0909091;2pkt 2fpkt"];
1106--2305[label="1;22pkt 22fpkt"];
1113--1695[label="1;6pkt 6fpkt"];
1113--1741[label="1;6pkt 6fpkt"];
1113--1847[label="0.333333;2pkt 2fpkt"];
1113--1880[label="0.333333;2pkt 2fpkt"];
1113--1903[label="0.333333;2pkt 2fpkt"];
1113--2305[label="1;6pkt 6fpkt"];
1695--1741[label="1;6pkt 6fpkt"];
1695--1847[label="0.181818;2pkt 2fpkt"];
1695--1880[label="0.181818;2pkt 2fpkt"];
1695--1903[label="0.181818;2pkt 2fpkt"];
1695--2305[label="1;11pkt 11fpkt"];
1741--1847[label="0.333333;2pkt 2fpkt"];
1741--1880[label="0.333333;2pkt 2fpkt"];
1741--1903[label="0.333333;2pkt 2fpkt"];
1741--2305[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="150.159.165.1" dst_port="80" src_ip="49.129.94.208"/>
      <filter dst_ip="162.10.10.194" dst_port="80" src_ip="49.129.94.208"/>
      <filter dst_ip="150.159.117.161" dst_port="80" src_ip="49.129.94.208"/>
    </slice>
    <from sec="1097384457" usec="0"/>
    <to sec="1097385245" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.872352,1.44276,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_342{
style=filled;
color=gray75;
1088[label="162.10.211.192;s;41pkt 41fpkt", shape=diamond, color=yellow];
1132[label="217.198.11.51;d;4pkt 4fpkt", shape=diamond, color=yellow];
1208[label="85.182.50.196;d;14pkt 14fpkt", shape=diamond, color=yellow];
1674[label="217.198.11.51;d;4pkt 4fpkt", shape=hexagon, color=black];
1697[label="85.182.50.196;d;13pkt 13fpkt", shape=hexagon, color=black];
stat342[shape=component, label=&lt;Rules:&lt;BR/&gt;{162.10.211.192:*, *:80}[50%]&lt;BR/&gt;{*:*, 85.182.50.196:80}[28.8462%]&lt;BR/&gt;{162.10.211.192:3461, *:*}[28.8462%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (40.1316%)&lt;BR/&gt; 3461: (9.86842%)&lt;BR/&gt; 4915: (1.97368%)&lt;BR/&gt; 4914: (1.97368%)&lt;BR/&gt; 4913: (1.97368%)&gt;];
}
1088--1132[label="1;4pkt 4fpkt"];
1088--1208[label="0.285714;4pkt 4fpkt"];
1088--1554[label="0.0243902;1pkt 1fpkt"];
1088--1674[label="1;4pkt 4fpkt"];
1088--1697[label="0.307692;4pkt 4fpkt"];
1132--1674[label="1;4pkt 4fpkt"];
1208--1697[label="0.923077;12pkt 12fpkt"];
1208--1847[label="0.0714286;1pkt 1fpkt"];
1208--1880[label="0.0714286;1pkt 1fpkt"];
1208--1903[label="0.0714286;1pkt 1fpkt"];
1697--1847[label="0.0769231;1pkt 1fpkt"];
1697--1880[label="0.0769231;1pkt 1fpkt"];
1697--1903[label="0.0769231;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="162.10.211.192" src_port="3461"/>
      <filter dst_port="80" src_ip="162.10.211.192"/>
      <filter dst_ip="85.182.50.196" dst_port="80"/>
    </slice>
    <from sec="1097384404" usec="0"/>
    <to sec="1097384977" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.872352,1.44276,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_346{
style=filled;
color=gray75;
1066[label="209.46.165.104;s;293pkt 293fpkt", shape=diamond, color=yellow];
1715[label="209.46.165.104;s;267pkt 267fpkt", shape=hexagon, color=black];
stat346[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.46.165.104:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1066--1715[label="1;267pkt 267fpkt"];
</description>
    <slice>
      <filter src_ip="209.46.165.104"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385138" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.872352,1.44276,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_348{
style=filled;
color=gray75;
1006[label="209.10.223.75;d;2pkt 2fpkt", shape=diamond, color=yellow];
1724[label="209.10.223.75;d;1pkt 1fpkt", shape=hexagon, color=black];
stat348[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.74.80.68:80, 209.10.223.75:4265}[50%]&lt;BR/&gt;{165.74.80.68:80, 209.10.223.75:64595}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 64595: (33.3333%)&lt;BR/&gt; 4265: (16.6667%)&gt;];
}
1006--1724[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="209.10.223.75" dst_port="64595" src_ip="165.74.80.68" src_port="80"/>
      <filter dst_ip="209.10.223.75" dst_port="4265" src_ip="165.74.80.68" src_port="80"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.872352,1.44276,010,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_350{
style=filled;
color=gray75;
1057[label="43.54.220.50;d;396pkt 396fpkt", shape=diamond, color=yellow];
1172[label="139.80.235.213;s;257pkt 257fpkt", shape=diamond, color=yellow];
1733[label="43.54.220.50;d;267pkt 267fpkt", shape=hexagon, color=black];
stat350[shape=component, label=&lt;Rules:&lt;BR/&gt;{139.80.235.213:*, 43.54.220.50:80}[70.2771%]&lt;BR/&gt;{139.80.235.196:*, 43.54.220.50:80}[29.471%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.9457%)&lt;BR/&gt; 4539: (0.217391%)&lt;BR/&gt; 4529: (0.217391%)&lt;BR/&gt; 4523: (0.217391%)&lt;BR/&gt; 4484: (0.217391%)&gt;];
}
1057--1172[label="0.996109;256pkt 256fpkt"];
1057--1733[label="1;267pkt 267fpkt"];
1057--1832[label="0.0833333;33pkt 33fpkt"];
1057--1847[label="0.0681818;27pkt 27fpkt"];
1057--1866[label="0.0833333;33pkt 33fpkt"];
1057--1880[label="0.0681818;27pkt 27fpkt"];
1057--1894[label="0.0833333;33pkt 33fpkt"];
1057--1903[label="0.0681818;27pkt 27fpkt"];
1172--1733[label="0.723735;186pkt 186fpkt"];
1172--1832[label="0.0856031;22pkt 22fpkt"];
1172--1847[label="0.0661479;17pkt 17fpkt"];
1172--1866[label="0.0856031;22pkt 22fpkt"];
1172--1880[label="0.0661479;17pkt 17fpkt"];
1172--1894[label="0.0856031;22pkt 22fpkt"];
1172--1903[label="0.0661479;17pkt 17fpkt"];
1733--1832[label="0.123596;33pkt 33fpkt"];
1733--1847[label="0.101124;27pkt 27fpkt"];
1733--1866[label="0.123596;33pkt 33fpkt"];
1733--1880[label="0.101124;27pkt 27fpkt"];
1733--1894[label="0.123596;33pkt 33fpkt"];
1733--1903[label="0.101124;27pkt 27fpkt"];
</description>
    <slice>
      <filter dst_ip="43.54.220.50" dst_port="80" src_ip="139.80.235.213"/>
      <filter dst_ip="43.54.220.50" dst_port="80" src_ip="139.80.235.196"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.872352,1.44276,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_352{
style=filled;
color=gray75;
1399[label="145.238.120.64;d;4pkt 4fpkt", shape=diamond, color=yellow];
1400[label="208.210.115.39;s;4pkt 4fpkt", shape=diamond, color=yellow];
1745[label="145.238.120.64;d;4pkt 4fpkt", shape=hexagon, color=black];
stat352[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.210.115.39:55421, 145.238.120.64:25}[25%]&lt;BR/&gt;{208.210.115.39:55422, 145.238.120.64:25}[25%]&lt;BR/&gt;{208.210.115.39:113, 145.238.120.64:3082}[25%]&lt;BR/&gt;{208.210.115.39:113, 145.238.120.64:3083}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 113: (25%)&lt;BR/&gt; 25: (25%)&lt;BR/&gt; 55422: (12.5%)&lt;BR/&gt; 55421: (12.5%)&lt;BR/&gt; 3083: (12.5%)&gt;];
}
1399--1400[label="1;4pkt 4fpkt"];
1399--1745[label="1;4pkt 4fpkt"];
1400--1745[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="145.238.120.64" dst_port="3083" src_ip="208.210.115.39" src_port="113"/>
      <filter dst_ip="145.238.120.64" dst_port="3082" src_ip="208.210.115.39" src_port="113"/>
      <filter dst_ip="145.238.120.64" dst_port="25" src_ip="208.210.115.39" src_port="55422"/>
      <filter dst_ip="145.238.120.64" dst_port="25" src_ip="208.210.115.39" src_port="55421"/>
    </slice>
    <from sec="1097384898" usec="0"/>
    <to sec="1097384906" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.872352,1.44276,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_353{
style=filled;
color=gray75;
856[label="50.208.71.82;d;1pkt 1fpkt", shape=diamond, color=yellow];
857[label="139.80.9.17;s;1pkt 1fpkt", shape=diamond, color=yellow];
1750[label="50.208.71.82;d;1pkt 1fpkt", shape=hexagon, color=black];
stat353[shape=component, label=&lt;Rules:&lt;BR/&gt;{139.80.9.17:49636, 50.208.71.82:8100}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 49636: (50%)&lt;BR/&gt; 8100: (50%)&gt;];
}
856--857[label="1;1pkt 1fpkt"];
856--1750[label="1;1pkt 1fpkt"];
857--1750[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="50.208.71.82" dst_port="8100" src_ip="139.80.9.17" src_port="49636"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.872352,1.44276,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_354{
style=filled;
color=gray75;
1421[label="209.46.165.104;d;134pkt 134fpkt", shape=diamond, color=yellow];
1753[label="209.46.165.104;d;134pkt 134fpkt", shape=hexagon, color=black];
stat354[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 209.46.165.104:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1421--1753[label="1;134pkt 134fpkt"];
</description>
    <slice>
      <filter dst_ip="209.46.165.104"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385138" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,504,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_355{
style=filled;
color=gray75;
1510[label="213.20.43.58;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat355[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.74.105.92:1377, 213.20.43.58:443}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1377: (50%)&lt;BR/&gt; 443: (50%)&gt;];
}
1510--1758[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="213.20.43.58" dst_port="443" src_ip="165.74.105.92" src_port="1377"/>
    </slice>
    <from sec="1097384408" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.872352,1.44276,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_356{
style=filled;
color=gray75;
1286[label="162.10.211.101;s;19pkt 19fpkt", shape=diamond, color=yellow];
1383[label="199.180.135.27;d;9pkt 9fpkt", shape=diamond, color=yellow];
1763[label="199.180.135.27;d;9pkt 9fpkt", shape=hexagon, color=black];
stat356[shape=component, label=&lt;Rules:&lt;BR/&gt;{162.10.211.101:*, 199.180.135.27:80}[47.3684%]&lt;BR/&gt;{162.10.211.101:*, 147.141.231.57:80}[42.1053%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1210: (4.05405%)&lt;BR/&gt; 1207: (4.05405%)&lt;BR/&gt; 1206: (4.05405%)&lt;BR/&gt; 1203: (4.05405%)&gt;];
}
1286--1383[label="1;9pkt 9fpkt"];
1286--1763[label="1;9pkt 9fpkt"];
1383--1763[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="199.180.135.27" dst_port="80" src_ip="162.10.211.101"/>
      <filter dst_ip="147.141.231.57" dst_port="80" src_ip="162.10.211.101"/>
    </slice>
    <from sec="1097384617" usec="0"/>
    <to sec="1097384957" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.872352,1.44276,502,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_357{
style=filled;
color=gray75;
1484[label="146.67.4.154;d;14pkt 14fpkt", shape=diamond, color=yellow];
1767[label="146.67.4.154;d;14pkt 14fpkt", shape=hexagon, color=black];
stat357[shape=component, label=&lt;Rules:&lt;BR/&gt;{150.159.204.214:*, 146.67.4.154:22}[57.1429%]&lt;BR/&gt;{150.159.204.214:25, 146.67.4.154:*}[42.8571%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 22: (28.5714%)&lt;BR/&gt; 25: (21.4286%)&lt;BR/&gt; 48812: (3.57143%)&lt;BR/&gt; 48809: (3.57143%)&lt;BR/&gt; 48808: (3.57143%)&gt;];
}
1484--1767[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter dst_ip="146.67.4.154" src_ip="150.159.204.214" src_port="25"/>
      <filter dst_ip="146.67.4.154" dst_port="22" src_ip="150.159.204.214"/>
    </slice>
    <from sec="1097385009" usec="0"/>
    <to sec="1097385032" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.872352,1.44276,502,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_358{
style=filled;
color=gray75;
1524[label="41.230.191.77;d;3pkt 3fpkt", shape=diamond, color=yellow];
1779[label="41.230.191.77;d;3pkt 3fpkt", shape=hexagon, color=black];
stat358[shape=component, label=&lt;Rules:&lt;BR/&gt;{145.238.108.150:22, 41.230.191.77:1246}[33.3333%]&lt;BR/&gt;{145.238.20.48:80, 41.230.191.77:1289}[33.3333%]&lt;BR/&gt;{145.238.20.48:80, 41.230.191.77:1290}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (33.3333%)&lt;BR/&gt; 1290: (16.6667%)&lt;BR/&gt; 1289: (16.6667%)&lt;BR/&gt; 1246: (16.6667%)&lt;BR/&gt; 22: (16.6667%)&gt;];
}
1524--1779[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="41.230.191.77" dst_port="1290" src_ip="145.238.20.48" src_port="80"/>
      <filter dst_ip="41.230.191.77" dst_port="1289" src_ip="145.238.20.48" src_port="80"/>
      <filter dst_ip="41.230.191.77" dst_port="1246" src_ip="145.238.108.150" src_port="22"/>
    </slice>
    <from sec="1097384601" usec="0"/>
    <to sec="1097385092" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.872352,1.44276,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_359{
style=filled;
color=gray75;
1265[label="145.238.192.203;s;204pkt 204fpkt", shape=diamond, color=yellow];
1788[label="145.238.192.203;s;204pkt 204fpkt", shape=hexagon, color=black];
stat359[shape=component, label=&lt;Rules:&lt;BR/&gt;{145.238.192.203:*, *:25}[93.6275%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (48.7745%)&lt;BR/&gt; 113: (1.22549%)&lt;BR/&gt; 52569: (0.490196%)&lt;BR/&gt; 53635: (0.245098%)&lt;BR/&gt; 53099: (0.245098%)&gt;];
}
1265--1788[label="1;204pkt 204fpkt"];
1265--1911[label="0.00490196;1pkt 1fpkt"];
1788--1911[label="0.00490196;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="25" src_ip="145.238.192.203"/>
    </slice>
    <from sec="1097384401" usec="0"/>
    <to sec="1097385226" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.872352,1.44276,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_360{
style=filled;
color=gray75;
1566[label="139.80.10.21;d;36pkt 36fpkt", shape=diamond, color=yellow];
1789[label="139.80.10.21;d;36pkt 36fpkt", shape=hexagon, color=black];
stat360[shape=component, label=&lt;Rules:&lt;BR/&gt;{110.217.195.36:80, 139.80.10.21:*}[22.2222%]&lt;BR/&gt;{110.227.98.228:80, 139.80.10.21:*}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2064: (1.38889%)&lt;BR/&gt; 2063: (1.38889%)&lt;BR/&gt; 2059: (1.38889%)&lt;BR/&gt; 2053: (1.38889%)&gt;];
}
1566--1789[label="1;36pkt 36fpkt"];
</description>
    <slice>
      <filter dst_ip="139.80.10.21" src_ip="110.227.98.228" src_port="80"/>
      <filter dst_ip="139.80.10.21" src_ip="110.217.195.36" src_port="80"/>
    </slice>
    <from sec="1097384402" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.872352,1.44276,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_361{
style=filled;
color=gray75;
1351[label="139.80.33.33;d;56pkt 56fpkt", shape=diamond, color=yellow];
1790[label="139.80.33.33;d;56pkt 56fpkt", shape=hexagon, color=black];
stat361[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 139.80.33.33:25}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 61126: (0.892857%)&lt;BR/&gt; 61123: (0.892857%)&lt;BR/&gt; 61121: (0.892857%)&lt;BR/&gt; 60889: (0.892857%)&gt;];
}
1351--1790[label="1;56pkt 56fpkt"];
</description>
    <slice>
      <filter dst_ip="139.80.33.33" dst_port="25"/>
    </slice>
    <from sec="1097384403" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="219.150.222.0"/>
    </slice>
    <from sec="1097385080" usec="0"/>
    <to sec="1097385280" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,001,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.46.230.2"/>
    </slice>
    <from sec="1097385147" usec="0"/>
    <to sec="1097385149" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="90.133.67.4"/>
    </slice>
    <from sec="1097384413" usec="0"/>
    <to sec="1097385300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_378{
style=filled;
color=gray75;
664[label="192.35.37.7;s;5pkt 5fpkt", shape=diamond, color=yellow];
stat378[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.35.37.7:80, 139.80.8.80:2247}[20%]&lt;BR/&gt;{192.35.37.7:80, 139.80.8.80:2248}[20%]&lt;BR/&gt;{192.35.37.7:80, 139.80.8.80:2250}[20%]&lt;BR/&gt;{192.35.37.7:80, 139.80.8.80:2251}[20%]&lt;BR/&gt;{192.35.37.7:80, 139.80.8.80:2257}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2257: (10%)&lt;BR/&gt; 2251: (10%)&lt;BR/&gt; 2250: (10%)&lt;BR/&gt; 2248: (10%)&gt;];
}
664--1927[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="139.80.8.80" dst_port="2257" src_ip="192.35.37.7" src_port="80"/>
      <filter dst_ip="139.80.8.80" dst_port="2251" src_ip="192.35.37.7" src_port="80"/>
      <filter dst_ip="139.80.8.80" dst_port="2250" src_ip="192.35.37.7" src_port="80"/>
      <filter dst_ip="139.80.8.80" dst_port="2248" src_ip="192.35.37.7" src_port="80"/>
      <filter dst_ip="139.80.8.80" dst_port="2247" src_ip="192.35.37.7" src_port="80"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385221" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="108.147.173.7"/>
    </slice>
    <from sec="1097384879" usec="0"/>
    <to sec="1097384905" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548596,1.33125,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_380{
style=filled;
color=gray75;
901[label="209.46.171.10;s;593pkt 593fpkt", shape=diamond, color=yellow];
1935[label="209.46.171.10;639pkt 639fpkt", shape=pentagon, color=darkviolet];
stat380[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.46.171.10:54290, *:*}[98.748%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 54290: (49.3506%)&lt;BR/&gt; 443: (0.324675%)&lt;BR/&gt; 80: (0.243506%)&lt;BR/&gt; 56093: (0.162338%)&lt;BR/&gt; 25706: (0.162338%)&gt;];
}
901--1935[label="1;593pkt 593fpkt"];
</description>
    <slice>
      <filter src_ip="209.46.171.10" src_port="54290"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614144,1.32113,503,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_382{
style=filled;
color=gray75;
88[label="134.133.206.14s;1pkt 1fpkt", shape=rectangle, color=red];
1947[label="134.133.206.14;53pkt 53fpkt", shape=pentagon, color=darkviolet];
stat382[shape=component, label=&lt;Rules:&lt;BR/&gt;{134.133.206.14:80, 139.80.33.1:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 59760: (1.85185%)&lt;BR/&gt; 59839: (0.925926%)&lt;BR/&gt; 59833: (0.925926%)&lt;BR/&gt; 59832: (0.925926%)&gt;];
}
88--689[label="1;1pkt 1fpkt"];
88--1947[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="139.80.33.1" src_ip="134.133.206.14" src_port="80"/>
    </slice>
    <from sec="1097384742" usec="0"/>
    <to sec="1097384763" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="40.44.68.17"/>
    </slice>
    <from sec="1097384479" usec="0"/>
    <to sec="1097384515" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548596,1.33125,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_384{
style=filled;
color=gray75;
1071[label="208.129.205.46;s;783pkt 783fpkt", shape=diamond, color=yellow];
1178[label="210.211.228.81;d;3pkt 3fpkt", shape=diamond, color=yellow];
1251[label="208.129.205.18;s;202pkt 202fpkt", shape=diamond, color=yellow];
1955[label="208.129.205.18;212pkt 212fpkt", shape=pentagon, color=darkviolet];
stat384[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.129.205.46:53, *:*}[78.4925%]&lt;BR/&gt;{208.129.205.18:*, *:*}[21.3065%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (55.2917%)&lt;BR/&gt; 3999: (4.66667%)&lt;BR/&gt; 32768: (2.125%)&lt;BR/&gt; 1024: (1%)&lt;BR/&gt; 32769: (0.666667%)&gt;];
}
1071--1178[label="0.333333;1pkt 1fpkt"];
1071--1831[label="0.00893997;7pkt 7fpkt"];
1071--1846[label="0.0166028;13pkt 13fpkt"];
1071--1858[label="0.0178799;14pkt 14fpkt"];
1071--1865[label="0.00893997;7pkt 7fpkt"];
1071--1879[label="0.0166028;13pkt 13fpkt"];
1071--1893[label="0.00893997;7pkt 7fpkt"];
1071--1902[label="0.0166028;13pkt 13fpkt"];
1178--1251[label="0.666667;2pkt 2fpkt"];
1178--1955[label="0.666667;2pkt 2fpkt"];
1251--1333[label="0.0107527;1pkt 1fpkt"];
1251--1406[label="0.0140845;1pkt 1fpkt"];
1251--1493[label="0.0119048;1pkt 1fpkt"];
1251--1831[label="0.0049505;1pkt 1fpkt"];
1251--1846[label="0.00990099;2pkt 2fpkt"];
1251--1858[label="0.049505;10pkt 10fpkt"];
1251--1865[label="0.0049505;1pkt 1fpkt"];
1251--1879[label="0.00990099;2pkt 2fpkt"];
1251--1893[label="0.0049505;1pkt 1fpkt"];
1251--1902[label="0.00990099;2pkt 2fpkt"];
1251--1955[label="1;202pkt 202fpkt"];
</description>
    <slice>
      <filter src_ip="208.129.205.18"/>
      <filter src_ip="208.129.205.46" src_port="53"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="49.97.251.20"/>
    </slice>
    <from sec="1097384633" usec="0"/>
    <to sec="1097384707" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="49.129.94.25"/>
    </slice>
    <from sec="1097384595" usec="0"/>
    <to sec="1097384753" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.211.174.25"/>
    </slice>
    <from sec="1097384416" usec="0"/>
    <to sec="1097385299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="145.238.84.27"/>
    </slice>
    <from sec="1097385300" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.129.172.29"/>
    </slice>
    <from sec="1097384805" usec="0"/>
    <to sec="1097385283" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="193.90.210.30"/>
    </slice>
    <from sec="1097385274" usec="0"/>
    <to sec="1097385295" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="165.74.38.32"/>
    </slice>
    <from sec="1097385300" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.26.209.34"/>
    </slice>
    <from sec="1097384480" usec="0"/>
    <to sec="1097385245" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="108.82.20.36"/>
    </slice>
    <from sec="1097384798" usec="0"/>
    <to sec="1097385136" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548596,1.33125,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_394{
style=filled;
color=gray75;
1599[label="143.139.105.27;d;73pkt 73fpkt", shape=diamond, color=yellow];
1992[label="162.10.210.37;96pkt 96fpkt", shape=pentagon, color=darkviolet];
stat394[shape=component, label=&lt;Rules:&lt;BR/&gt;{162.10.210.37:*, 143.139.105.27:80}[76.0417%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1953: (0.591716%)&lt;BR/&gt; 1952: (0.591716%)&lt;BR/&gt; 1951: (0.591716%)&lt;BR/&gt; 1950: (0.591716%)&gt;];
}
1599--1992[label="1;73pkt 73fpkt"];
</description>
    <slice>
      <filter dst_ip="143.139.105.27" dst_port="80" src_ip="162.10.210.37"/>
    </slice>
    <from sec="1097384403" usec="0"/>
    <to sec="1097385164" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.551475,1.39017,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_395{
style=filled;
color=gray75;
1306[label="215.23.132.99;d;15pkt 15fpkt", shape=diamond, color=yellow];
stat395[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 215.23.132.99:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1306--1994[label="0.0666667;1pkt 1fpkt"];
1306--2421[label="0.0666667;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="215.23.132.99"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385186" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="42.110.20.44"/>
    </slice>
    <from sec="1097385300" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,001,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.29.53.45"/>
    </slice>
    <from sec="1097385078" usec="0"/>
    <to sec="1097385081" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="139.80.128.46"/>
    </slice>
    <from sec="1097384494" usec="0"/>
    <to sec="1097385262" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548596,1.33125,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_399{
style=filled;
color=gray75;
1405[label="165.74.57.49;s;64pkt 64fpkt", shape=diamond, color=yellow];
2010[label="165.74.57.49;70pkt 70fpkt", shape=pentagon, color=darkviolet];
stat399[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.74.57.49:25, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 3116: (1.49254%)&lt;BR/&gt; 2029: (1.49254%)&lt;BR/&gt; 58276: (0.746269%)&lt;BR/&gt; 56537: (0.746269%)&gt;];
}
1405--2010[label="0.984375;63pkt 63fpkt"];
</description>
    <slice>
      <filter src_ip="165.74.57.49" src_port="25"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614144,1.32113,001,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_400{
style=filled;
color=gray75;
188[label="193.1.194.49s;172pkt 172fpkt", shape=rectangle, color=red];
2012[label="193.1.194.49;171pkt 171fpkt", shape=pentagon, color=darkviolet];
stat400[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.1.194.49:*, *:9898}[62.2093%]&lt;BR/&gt;{193.1.194.49:*, *:5554}[37.7907%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (31.1953%)&lt;BR/&gt; 5554: (18.8047%)&lt;BR/&gt; 2666: (0.291545%)&lt;BR/&gt; 2665: (0.291545%)&lt;BR/&gt; 2649: (0.291545%)&gt;];
}
188--2012[label="1;171pkt 171fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="193.1.194.49"/>
      <filter dst_port="5554" src_ip="193.1.194.49"/>
    </slice>
    <from sec="1097385206" usec="0"/>
    <to sec="1097385212" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="145.238.120.64"/>
    </slice>
    <from sec="1097384450" usec="0"/>
    <to sec="1097384907" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614144,1.32113,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_403{
style=filled;
color=gray75;
120[label="108.169.102.67s;137pkt 137fpkt", shape=rectangle, color=red];
2035[label="108.169.102.67;149pkt 149fpkt", shape=pentagon, color=darkviolet];
stat403[shape=component, label=&lt;Rules:&lt;BR/&gt;{108.169.102.67:41412, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 41412: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
120--2035[label="1;137pkt 137fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="108.169.102.67" src_port="41412"/>
    </slice>
    <from sec="1097384808" usec="0"/>
    <to sec="1097384832" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="52.188.162.67"/>
    </slice>
    <from sec="1097385300" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="162.10.211.67"/>
    </slice>
    <from sec="1097385300" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548596,1.33125,010,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_406{
style=filled;
color=gray75;
1416[label="208.129.204.69;s;54pkt 54fpkt", shape=diamond, color=yellow];
2043[label="208.129.204.69;61pkt 61fpkt", shape=pentagon, color=darkviolet];
stat406[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.129.204.69:*, *:24296}[29.5082%]&lt;BR/&gt;{208.129.204.69:*, 108.161.96.170:*}[26.2295%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 24296: (15.2174%)&lt;BR/&gt; 13445: (9.56522%)&lt;BR/&gt; 21558: (6.52174%)&lt;BR/&gt; 6969: (6.08696%)&lt;BR/&gt; 8081: (5.65217%)&gt;];
}
1416--2043[label="1;54pkt 54fpkt"];
</description>
    <slice>
      <filter dst_ip="108.161.96.170" src_ip="208.129.204.69"/>
      <filter dst_port="24296" src_ip="208.129.204.69"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="150.159.33.72"/>
    </slice>
    <from sec="1097384858" usec="0"/>
    <to sec="1097385296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.129.244.74"/>
    </slice>
    <from sec="1097384409" usec="0"/>
    <to sec="1097385298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="139.80.11.75"/>
    </slice>
    <from sec="1097385300" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="108.179.135.76"/>
    </slice>
    <from sec="1097385300" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548596,1.33125,020,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_413{
style=filled;
color=gray75;
1045[label="145.238.73.77;s;325pkt 325fpkt", shape=diamond, color=yellow];
2060[label="145.238.73.77;345pkt 345fpkt", shape=pentagon, color=darkviolet];
stat413[shape=component, label=&lt;Rules:&lt;BR/&gt;{145.238.73.77:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1045--1157[label="0.00307692;1pkt 1fpkt"];
1045--1552[label="0.00497512;1pkt 1fpkt"];
1045--2060[label="1;325pkt 325fpkt"];
</description>
    <slice>
      <filter src_ip="145.238.73.77"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548596,1.33125,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_414{
style=filled;
color=gray75;
1365[label="162.10.210.22;d;29pkt 29fpkt", shape=diamond, color=yellow];
2065[label="108.132.98.79;2pkt 2fpkt", shape=pentagon, color=darkviolet];
stat414[shape=component, label=&lt;Rules:&lt;BR/&gt;{199.217.86.33:80, 162.10.210.22:*}[37.931%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (45.1613%)&lt;BR/&gt; 1561: (3.22581%)&lt;BR/&gt; 1560: (3.22581%)&lt;BR/&gt; 5050: (1.6129%)&lt;BR/&gt; 3002: (1.6129%)&gt;];
}
1365--1518[label="0.44;11pkt 11fpkt"];
1365--2065[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="162.10.210.22" src_ip="199.217.86.33" src_port="80"/>
    </slice>
    <from sec="1097384412" usec="0"/>
    <to sec="1097385214" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="139.80.234.79"/>
    </slice>
    <from sec="1097384870" usec="0"/>
    <to sec="1097385298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.790354,1.2448,503,1 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_416{
style=filled;
color=gray75;
34[label="108.233.239.81s;1pkt 1fpkt", shape=rectangle, color=red];
1402[label="209.46.170.84;d;26pkt 26fpkt", shape=diamond, color=yellow];
1991[label="197.29.135.37;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2033[label="108.234.200.66;4pkt 4fpkt", shape=pentagon, color=darkviolet];
2074[label="108.233.239.81;15pkt 15fpkt", shape=pentagon, color=darkviolet];
2436[label="108.234.200.66;3pkt 3fpkt", shape=invtriangle, color=brown];
stat416[shape=component, label=&lt;Rules:&lt;BR/&gt;{108.233.239.81:*, 209.46.170.84:80}[53.5714%]&lt;BR/&gt;{*:*, 209.46.170.84:1755}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (31%)&lt;BR/&gt; 1755: (13%)&lt;BR/&gt; 554: (5%)&lt;BR/&gt; 4083: (3%)&lt;BR/&gt; 4080: (3%)&gt;];
}
34--1402[label="1;1pkt 1fpkt"];
34--2074[label="1;1pkt 1fpkt"];
1402--1991[label="1;1pkt 1fpkt"];
1402--2033[label="1;4pkt 4fpkt"];
1402--2074[label="0.866667;13pkt 13fpkt"];
1402--2436[label="1;3pkt 3fpkt"];
2033--2436[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="209.46.170.84" dst_port="1755"/>
      <filter dst_ip="209.46.170.84" dst_port="80" src_ip="108.233.239.81"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385291" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="198.34.243.81"/>
    </slice>
    <from sec="1097384443" usec="0"/>
    <to sec="1097385255" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="49.151.0.82"/>
    </slice>
    <from sec="1097384745" usec="0"/>
    <to sec="1097384770" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,001,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="192.146.232.86"/>
    </slice>
    <from sec="1097384504" usec="0"/>
    <to sec="1097384869" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="48.67.29.95"/>
    </slice>
    <from sec="1097384441" usec="0"/>
    <to sec="1097385300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.129.209.97"/>
    </slice>
    <from sec="1097385300" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="145.239.28.98"/>
    </slice>
    <from sec="1097384405" usec="0"/>
    <to sec="1097385296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="162.10.114.105"/>
    </slice>
    <from sec="1097384473" usec="0"/>
    <to sec="1097384510" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="192.149.89.107"/>
    </slice>
    <from sec="1097384742" usec="0"/>
    <to sec="1097384761" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="53.44.222.119"/>
    </slice>
    <from sec="1097384437" usec="0"/>
    <to sec="1097385252" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.732293,1.30933,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_426{
style=filled;
color=gray75;
1268[label="53.155.110.84;d;134pkt 134fpkt", shape=diamond, color=yellow];
1503[label="145.239.137.122;s;129pkt 129fpkt", shape=diamond, color=yellow];
1587[label="145.239.28.15;s;18pkt 18fpkt", shape=diamond, color=yellow];
2134[label="145.239.137.122;137pkt 137fpkt", shape=pentagon, color=darkviolet];
2481[label="145.239.137.122;137pkt 137fpkt", shape=invtriangle, color=brown];
stat426[shape=component, label=&lt;Rules:&lt;BR/&gt;{145.239.137.122:80, 53.155.110.84:*}[59.8837%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.6486%)&lt;BR/&gt; 32805: (1.35135%)&lt;BR/&gt; 53: (1.35135%)&lt;BR/&gt; 4957: (0.36036%)&lt;BR/&gt; 4819: (0.36036%)&gt;];
}
1268--1503[label="0.767442;99pkt 99fpkt"];
1268--1587[label="1;18pkt 18fpkt"];
1268--2134[label="0.738806;99pkt 99fpkt"];
1268--2481[label="0.738806;99pkt 99fpkt"];
1503--1698[label="0.011236;1pkt 1fpkt"];
1503--2134[label="1;129pkt 129fpkt"];
1503--2481[label="1;129pkt 129fpkt"];
2134--2481[label="1;137pkt 137fpkt"];
</description>
    <slice>
      <filter dst_ip="53.155.110.84" src_ip="145.239.137.122" src_port="80"/>
    </slice>
    <from sec="1097384403" usec="0"/>
    <to sec="1097385290" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548596,1.33125,011,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_427{
style=filled;
color=gray75;
1248[label="108.161.41.126;s;10pkt 10fpkt", shape=diamond, color=yellow];
2139[label="108.161.41.126;10pkt 10fpkt", shape=pentagon, color=darkviolet];
stat427[shape=component, label=&lt;Rules:&lt;BR/&gt;{108.161.41.126:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 29699: (5%)&lt;BR/&gt; 27649: (5%)&lt;BR/&gt; 24776: (5%)&lt;BR/&gt; 19904: (5%)&gt;];
}
1248--2139[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter src_ip="108.161.41.126" src_port="80"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="43.136.162.126"/>
    </slice>
    <from sec="1097384421" usec="0"/>
    <to sec="1097385294" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="162.10.75.127"/>
    </slice>
    <from sec="1097384632" usec="0"/>
    <to sec="1097385097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.179.254.133"/>
    </slice>
    <from sec="1097385300" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548596,1.33125,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_432{
style=filled;
color=gray75;
1318[label="212.42.2.224;d;3pkt 3fpkt", shape=diamond, color=yellow];
2156[label="139.80.25.134;29pkt 29fpkt", shape=pentagon, color=darkviolet];
stat432[shape=component, label=&lt;Rules:&lt;BR/&gt;{139.80.25.134:*, 212.42.44.12:80}[58.6207%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (35.9375%)&lt;BR/&gt; 0: (6.25%)&lt;BR/&gt; 6970: (4.6875%)&lt;BR/&gt; 554: (4.6875%)&lt;BR/&gt; 16404: (3.125%)&gt;];
}
1318--2156[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="212.42.44.12" dst_port="80" src_ip="139.80.25.134"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385198" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_433{
style=filled;
color=gray75;
2166[label="208.129.216.140;93pkt 93fpkt", shape=pentagon, color=darkviolet];
stat433[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.129.216.140:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
</description>
    <slice>
      <filter src_ip="208.129.216.140"/>
    </slice>
    <from sec="1097384408" usec="0"/>
    <to sec="1097385300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.129.228.142"/>
    </slice>
    <from sec="1097384435" usec="0"/>
    <to sec="1097385297" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="48.3.225.146"/>
    </slice>
    <from sec="1097385300" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="150.159.166.147"/>
    </slice>
    <from sec="1097385300" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="49.129.94.149"/>
    </slice>
    <from sec="1097384610" usec="0"/>
    <to sec="1097385275" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="140.41.113.153"/>
    </slice>
    <from sec="1097384423" usec="0"/>
    <to sec="1097385294" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="145.239.205.153"/>
    </slice>
    <from sec="1097384469" usec="0"/>
    <to sec="1097385298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="201.231.75.154"/>
    </slice>
    <from sec="1097385217" usec="0"/>
    <to sec="1097385254" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="204.83.162.154"/>
    </slice>
    <from sec="1097384413" usec="0"/>
    <to sec="1097385294" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.732293,1.30933,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_443{
style=filled;
color=gray75;
1482[label="216.85.37.163;d;7pkt 7fpkt", shape=diamond, color=yellow];
1483[label="162.10.215.162;s;3pkt 3fpkt", shape=diamond, color=yellow];
2215[label="162.10.215.162;9pkt 9fpkt", shape=pentagon, color=darkviolet];
2521[label="162.10.215.162;8pkt 8fpkt", shape=invtriangle, color=brown];
stat443[shape=component, label=&lt;Rules:&lt;BR/&gt;{162.10.215.162:*, 216.85.37.163:80}[77.7778%]&lt;BR/&gt;{162.10.215.162:*, 110.50.167.56:80}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2819: (7.40741%)&lt;BR/&gt; 2817: (7.40741%)&lt;BR/&gt; 2816: (7.40741%)&lt;BR/&gt; 2826: (5.55556%)&gt;];
}
1482--1483[label="1;3pkt 3fpkt"];
1482--2215[label="1;7pkt 7fpkt"];
1482--2521[label="1;7pkt 7fpkt"];
1483--2215[label="1;3pkt 3fpkt"];
1483--2521[label="1;3pkt 3fpkt"];
2215--2521[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="216.85.37.163" dst_port="80" src_ip="162.10.215.162"/>
      <filter dst_ip="110.50.167.56" dst_port="80" src_ip="162.10.215.162"/>
    </slice>
    <from sec="1097384619" usec="0"/>
    <to sec="1097385155" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,001,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="150.159.213.163"/>
    </slice>
    <from sec="1097385009" usec="0"/>
    <to sec="1097385129" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="150.159.181.164"/>
    </slice>
    <from sec="1097384762" usec="0"/>
    <to sec="1097384949" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548596,1.33125,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_446{
style=filled;
color=gray75;
1356[label="209.46.167.141;d;32pkt 32fpkt", shape=diamond, color=yellow];
2231[label="198.148.96.170;2pkt 2fpkt", shape=pentagon, color=darkviolet];
stat446[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 209.46.167.141:25}[90.625%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (45.5882%)&lt;BR/&gt; 0: (5.88235%)&lt;BR/&gt; 60333: (2.94118%)&lt;BR/&gt; 60327: (2.94118%)&lt;BR/&gt; 65223: (1.47059%)&gt;];
}
1356--2231[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="209.46.167.141" dst_port="25"/>
    </slice>
    <from sec="1097384406" usec="0"/>
    <to sec="1097385210" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="199.217.86.171"/>
    </slice>
    <from sec="1097384420" usec="0"/>
    <to sec="1097385296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="42.154.87.172"/>
    </slice>
    <from sec="1097384427" usec="0"/>
    <to sec="1097385252" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.130.209.173"/>
    </slice>
    <from sec="1097384823" usec="0"/>
    <to sec="1097384852" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.110.3.174"/>
    </slice>
    <from sec="1097385300" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="145.239.134.174"/>
    </slice>
    <from sec="1097384403" usec="0"/>
    <to sec="1097385212" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.139.6.175"/>
    </slice>
    <from sec="1097385300" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548596,1.33125,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_453{
style=filled;
color=gray75;
1290[label="108.77.193.178;s;6pkt 6fpkt", shape=diamond, color=yellow];
1467[label="145.238.78.208;d;4pkt 4fpkt", shape=diamond, color=yellow];
2252[label="108.77.193.178;6pkt 6fpkt", shape=pentagon, color=darkviolet];
stat453[shape=component, label=&lt;Rules:&lt;BR/&gt;{108.77.193.178:*, 145.238.78.208:25}[25%]&lt;BR/&gt;{108.77.193.178:*, 209.46.162.8:*}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (43.75%)&lt;BR/&gt; 13530: (9.375%)&lt;BR/&gt; 13521: (9.375%)&lt;BR/&gt; 55076: (6.25%)&lt;BR/&gt; 13617: (6.25%)&gt;];
}
1290--1467[label="0.5;2pkt 2fpkt"];
1290--2252[label="1;6pkt 6fpkt"];
1467--2252[label="0.5;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="209.46.162.8" src_ip="108.77.193.178"/>
      <filter dst_ip="145.238.78.208" dst_port="25" src_ip="108.77.193.178"/>
    </slice>
    <from sec="1097384603" usec="0"/>
    <to sec="1097385040" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548596,1.33125,010,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_454{
style=filled;
color=gray75;
1169[label="129.189.146.179;s;401pkt 401fpkt", shape=diamond, color=yellow];
2254[label="129.189.146.179;426pkt 426fpkt", shape=pentagon, color=darkviolet];
stat454[shape=component, label=&lt;Rules:&lt;BR/&gt;{129.189.146.179:*, *:2745}[35.2113%]&lt;BR/&gt;{129.189.146.179:*, *:3140}[35.2113%]&lt;BR/&gt;{129.189.146.179:*, *:6129}[29.5775%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3140: (18.1378%)&lt;BR/&gt; 2745: (16.6264%)&lt;BR/&gt; 6129: (15.2358%)&lt;BR/&gt; 4999: (0.120919%)&lt;BR/&gt; 4998: (0.120919%)&gt;];
}
1169--2254[label="1;401pkt 401fpkt"];
</description>
    <slice>
      <filter dst_port="3140" src_ip="129.189.146.179"/>
      <filter dst_port="2745" src_ip="129.189.146.179"/>
      <filter dst_port="6129" src_ip="129.189.146.179"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385279" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548596,1.33125,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_455{
style=filled;
color=gray75;
852[label="161.131.166.20;d;3243pkt 3243fpkt", shape=diamond, color=yellow];
2258[label="197.142.235.180;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat455[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 161.131.166.20:61346}[97.4098%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 61346: (48.7053%)&lt;BR/&gt; 443: (0.570284%)&lt;BR/&gt; 80: (0.493218%)&lt;BR/&gt; 0: (0.40074%)&lt;BR/&gt; 1025: (0.20037%)&gt;];
}
852--1832[label="0.00759975;12pkt 12fpkt"];
852--1847[label="0.0117845;21pkt 21fpkt"];
852--1866[label="0.00759975;12pkt 12fpkt"];
852--1880[label="0.0117845;21pkt 21fpkt"];
852--1894[label="0.00759975;12pkt 12fpkt"];
852--1903[label="0.0117845;21pkt 21fpkt"];
852--2258[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="161.131.166.20" dst_port="61346"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385265" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.176.234.184"/>
    </slice>
    <from sec="1097384416" usec="0"/>
    <to sec="1097385296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.732293,1.30933,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_457{
style=filled;
color=gray75;
1350[label="145.238.96.15;d;78pkt 78fpkt", shape=diamond, color=yellow];
2264[label="199.202.167.186;15pkt 15fpkt", shape=pentagon, color=darkviolet];
2536[label="199.202.167.186;15pkt 15fpkt", shape=invtriangle, color=brown];
stat457[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 145.238.96.15:25}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 54350: (1.38889%)&lt;BR/&gt; 54333: (1.38889%)&lt;BR/&gt; 54290: (1.38889%)&lt;BR/&gt; 54277: (1.38889%)&gt;];
}
1350--2264[label="1;15pkt 15fpkt"];
1350--2536[label="1;15pkt 15fpkt"];
2264--2536[label="1;15pkt 15fpkt"];
</description>
    <slice>
      <filter dst_ip="145.238.96.15" dst_port="25"/>
    </slice>
    <from sec="1097384403" usec="0"/>
    <to sec="1097385228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614144,1.32113,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_458{
style=filled;
color=gray75;
144[label="210.225.105.187s;208pkt 208fpkt", shape=rectangle, color=red];
2266[label="210.225.105.187;230pkt 230fpkt", shape=pentagon, color=darkviolet];
stat458[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.225.105.187:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
144--2266[label="1;208pkt 208fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="210.225.105.187" src_port="1025"/>
    </slice>
    <from sec="1097384873" usec="0"/>
    <to sec="1097384890" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="43.194.110.187"/>
    </slice>
    <from sec="1097384432" usec="0"/>
    <to sec="1097385278" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="49.211.65.188"/>
    </slice>
    <from sec="1097384495" usec="0"/>
    <to sec="1097385249" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548596,1.33125,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_461{
style=filled;
color=gray75;
1204[label="208.139.240.174;d;117pkt 117fpkt", shape=diamond, color=yellow];
2279[label="108.179.138.192;21pkt 21fpkt", shape=pentagon, color=darkviolet];
stat461[shape=component, label=&lt;Rules:&lt;BR/&gt;{108.179.230.123:80, 208.139.240.174:*}[26.4957%]&lt;BR/&gt;{108.161.82.88:82, 208.139.240.174:*}[23.0769%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (38.0435%)&lt;BR/&gt; 82: (9.78261%)&lt;BR/&gt; 554: (1.08696%)&lt;BR/&gt; 8002: (0.724638%)&lt;BR/&gt; 6001: (0.724638%)&gt;];
}
1204--2279[label="1;21pkt 21fpkt"];
</description>
    <slice>
      <filter dst_ip="208.139.240.174" src_ip="108.179.230.123" src_port="80"/>
      <filter dst_ip="208.139.240.174" src_ip="108.161.82.88" src_port="82"/>
    </slice>
    <from sec="1097384422" usec="0"/>
    <to sec="1097384787" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="52.222.8.193"/>
    </slice>
    <from sec="1097384401" usec="0"/>
    <to sec="1097385254" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="165.74.61.195"/>
    </slice>
    <from sec="1097384407" usec="0"/>
    <to sec="1097385142" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,001,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="198.40.149.195"/>
    </slice>
    <from sec="1097384840" usec="0"/>
    <to sec="1097384842" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.101.198.197"/>
    </slice>
    <from sec="1097385159" usec="0"/>
    <to sec="1097385291" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.151.189.198"/>
    </slice>
    <from sec="1097384455" usec="0"/>
    <to sec="1097384482" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548596,1.33125,010,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_467{
style=filled;
color=gray75;
1005[label="200.36.86.201;s;1955pkt 1955fpkt", shape=diamond, color=yellow];
2293[label="200.36.86.201;2115pkt 2115fpkt", shape=pentagon, color=darkviolet];
stat467[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.36.86.201:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 42341: (0.0982801%)&lt;BR/&gt; 65296: (0.04914%)&lt;BR/&gt; 64550: (0.04914%)&lt;BR/&gt; 64077: (0.04914%)&gt;];
}
1005--2293[label="1;1955pkt 1955fpkt"];
</description>
    <slice>
      <filter src_ip="200.36.86.201" src_port="80"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="139.80.26.204"/>
    </slice>
    <from sec="1097385300" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548596,1.33125,502,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_470{
style=filled;
color=gray75;
1316[label="146.67.4.151;d;5pkt 5fpkt", shape=diamond, color=yellow];
1317[label="150.159.204.207;s;2pkt 2fpkt", shape=diamond, color=yellow];
2304[label="150.159.204.207;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat470[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.46.164.2:53, 146.67.4.151:34681}[20%]&lt;BR/&gt;{150.159.230.14:53, 146.67.4.151:34681}[20%]&lt;BR/&gt;{150.159.14.87:53, 146.67.4.151:34681}[20%]&lt;BR/&gt;{150.159.204.207:33338, 146.67.4.151:22}[20%]&lt;BR/&gt;{150.159.204.207:34209, 146.67.4.151:22}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 22: (31.25%)&lt;BR/&gt; 34681: (18.75%)&lt;BR/&gt; 34209: (18.75%)&lt;BR/&gt; 53: (18.75%)&lt;BR/&gt; 33338: (12.5%)&gt;];
}
1316--1317[label="1;2pkt 2fpkt"];
1316--2304[label="1;1pkt 1fpkt"];
1317--2304[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="146.67.4.151" dst_port="22" src_ip="150.159.204.207" src_port="34209"/>
      <filter dst_ip="146.67.4.151" dst_port="22" src_ip="150.159.204.207" src_port="33338"/>
      <filter dst_ip="146.67.4.151" dst_port="34681" src_ip="150.159.14.87" src_port="53"/>
      <filter dst_ip="146.67.4.151" dst_port="34681" src_ip="150.159.230.14" src_port="53"/>
      <filter dst_ip="146.67.4.151" dst_port="34681" src_ip="209.46.164.2" src_port="53"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548596,1.33125,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_471{
style=filled;
color=gray75;
1202[label="145.239.3.211;s;107pkt 107fpkt", shape=diamond, color=yellow];
2309[label="145.239.3.211;113pkt 113fpkt", shape=pentagon, color=darkviolet];
stat471[shape=component, label=&lt;Rules:&lt;BR/&gt;{145.239.3.211:25, *:*}[82.3009%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 2614: (0.909091%)&lt;BR/&gt; 2106: (0.909091%)&lt;BR/&gt; 61305: (0.454545%)&lt;BR/&gt; 56816: (0.454545%)&gt;];
}
1202--2309[label="1;107pkt 107fpkt"];
</description>
    <slice>
      <filter src_ip="145.239.3.211" src_port="25"/>
    </slice>
    <from sec="1097384414" usec="0"/>
    <to sec="1097385288" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.210.253.222"/>
    </slice>
    <from sec="1097385300" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.242.39.225"/>
    </slice>
    <from sec="1097384634" usec="0"/>
    <to sec="1097385039" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.51.37.226"/>
    </slice>
    <from sec="1097384413" usec="0"/>
    <to sec="1097385293" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.78.189.226"/>
    </slice>
    <from sec="1097384401" usec="0"/>
    <to sec="1097385293" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548596,1.33125,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_477{
style=filled;
color=gray75;
1013[label="150.159.52.228;s;862pkt 862fpkt", shape=diamond, color=yellow];
2342[label="150.159.52.228;901pkt 901fpkt", shape=pentagon, color=darkviolet];
stat477[shape=component, label=&lt;Rules:&lt;BR/&gt;{150.159.52.228:24069, *:*}[97.5583%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 24069: (48.8656%)&lt;BR/&gt; 443: (0.595576%)&lt;BR/&gt; 80: (0.482133%)&lt;BR/&gt; 1031: (0.283607%)&lt;BR/&gt; 1025: (0.226886%)&gt;];
}
1013--2342[label="1;862pkt 862fpkt"];
</description>
    <slice>
      <filter src_ip="150.159.52.228" src_port="24069"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="165.74.11.229"/>
    </slice>
    <from sec="1097384402" usec="0"/>
    <to sec="1097385278" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="193.80.18.229"/>
    </slice>
    <from sec="1097384600" usec="0"/>
    <to sec="1097384616" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.548596,1.33125,504,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_480{
style=filled;
color=gray75;
987[label="49.54.177.22;d;42pkt 42fpkt", shape=diamond, color=yellow];
2348[label="139.38.150.231;20pkt 20fpkt", shape=pentagon, color=darkviolet];
stat480[shape=component, label=&lt;Rules:&lt;BR/&gt;{139.38.150.217:443, 49.54.177.22:*}[60.7843%]&lt;BR/&gt;{139.38.150.231:80, 49.54.177.22:*}[21.5686%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (25%)&lt;BR/&gt; 80: (25%)&lt;BR/&gt; 6023: (1.6129%)&lt;BR/&gt; 6022: (1.6129%)&lt;BR/&gt; 6019: (1.6129%)&gt;];
}
987--2348[label="0.55;11pkt 11fpkt"];
</description>
    <slice>
      <filter dst_ip="49.54.177.22" src_ip="139.38.150.217" src_port="443"/>
      <filter dst_ip="49.54.177.22" src_ip="139.38.150.231" src_port="80"/>
    </slice>
    <from sec="1097384517" usec="0"/>
    <to sec="1097385071" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="145.239.227.234"/>
    </slice>
    <from sec="1097384403" usec="0"/>
    <to sec="1097385296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.8.164.239"/>
    </slice>
    <from sec="1097384829" usec="0"/>
    <to sec="1097385299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="139.80.12.246"/>
    </slice>
    <from sec="1097385235" usec="0"/>
    <to sec="1097385300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="51.145.99.246"/>
    </slice>
    <from sec="1097384405" usec="0"/>
    <to sec="1097385293" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="42.53.88.247"/>
    </slice>
    <from sec="1097384441" usec="0"/>
    <to sec="1097385294" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="45.97.208.247"/>
    </slice>
    <from sec="1097384441" usec="0"/>
    <to sec="1097385275" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="90.38.135.250"/>
    </slice>
    <from sec="1097384462" usec="0"/>
    <to sec="1097385295" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.537371,1.3821,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="145.238.62.255"/>
    </slice>
    <from sec="1097385300" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.726105,1.41868,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="90.133.67.4"/>
    </slice>
    <from sec="1097384413" usec="0"/>
    <to sec="1097385300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.723921,1.361,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_490{
style=filled;
color=gray75;
1923[label="51.168.31.6;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2393[label="51.168.31.6;1pkt 1fpkt", shape=invtriangle, color=brown];
stat490[shape=component, label=&lt;Rules:&lt;BR/&gt;{51.168.31.6:1241, 145.238.214.220:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1241: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
1923--2393[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="145.238.214.220" dst_port="80" src_ip="51.168.31.6" src_port="1241"/>
    </slice>
    <from sec="1097384498" usec="0"/>
    <to sec="1097384518" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.723921,1.361,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_492{
style=filled;
color=gray75;
1944[label="216.248.156.12;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2402[label="216.248.156.12;1pkt 1fpkt", shape=invtriangle, color=brown];
stat492[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.248.156.12:80, 145.238.199.208:1187}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1187: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
1944--2402[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="145.238.199.208" dst_port="1187" src_ip="216.248.156.12" src_port="80"/>
    </slice>
    <from sec="1097384444" usec="0"/>
    <to sec="1097384568" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.726105,1.41868,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="41.49.211.14"/>
    </slice>
    <from sec="1097384761" usec="0"/>
    <to sec="1097385258" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614144,1.32113,999,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_494{
style=filled;
color=gray75;
10[label="145.238.102.20s;1pkt 1fpkt", shape=rectangle, color=red];
1956[label="145.238.102.20;141pkt 141fpkt", shape=pentagon, color=darkviolet];
stat494[shape=component, label=&lt;Rules:&lt;BR/&gt;{145.238.102.20:32768, *:53}[47.5177%]&lt;BR/&gt;{145.238.102.20:53, *:*}[31.9149%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (41.1972%)&lt;BR/&gt; 32768: (23.5915%)&lt;BR/&gt; 25: (9.15493%)&lt;BR/&gt; 0: (2.8169%)&lt;BR/&gt; 58700: (0.704225%)&gt;];
}
10--1956[label="1;1pkt 1fpkt"];
10--2408[label="1;1pkt 1fpkt"];
1956--2408[label="1;141pkt 141fpkt"];
</description>
    <slice>
      <filter src_ip="145.238.102.20" src_port="53"/>
      <filter dst_port="53" src_ip="145.238.102.20" src_port="32768"/>
    </slice>
    <from sec="1097384408" usec="0"/>
    <to sec="1097385292" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.726105,1.41868,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="205.211.174.25"/>
    </slice>
    <from sec="1097384416" usec="0"/>
    <to sec="1097385299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.790354,1.2448,503,1 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_496{
style=filled;
color=gray75;
111[label="193.90.210.30s;1pkt 1fpkt", shape=rectangle, color=red];
1035[label="150.159.14.30;s;26pkt 26fpkt", shape=diamond, color=yellow];
1973[label="150.159.14.30;27pkt 27fpkt", shape=pentagon, color=darkviolet];
2414[label="150.159.14.30;27pkt 27fpkt", shape=invtriangle, color=brown];
stat496[shape=component, label=&lt;Rules:&lt;BR/&gt;{150.159.14.30:80, 208.231.2.175:*}[51.8519%]&lt;BR/&gt;{150.159.14.30:80, 197.33.82.210:*}[29.6296%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 62132: (1.85185%)&lt;BR/&gt; 62131: (1.85185%)&lt;BR/&gt; 62130: (1.85185%)&lt;BR/&gt; 62129: (1.85185%)&gt;];
}
111--1973[label="1;1pkt 1fpkt"];
111--2414[label="1;1pkt 1fpkt"];
1035--1973[label="1;26pkt 26fpkt"];
1035--2414[label="1;26pkt 26fpkt"];
1973--2414[label="1;27pkt 27fpkt"];
</description>
    <slice>
      <filter dst_ip="208.231.2.175" src_ip="150.159.14.30" src_port="80"/>
      <filter dst_ip="197.33.82.210" src_ip="150.159.14.30" src_port="80"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385293" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.723921,1.361,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_497{
style=filled;
color=gray75;
1979[label="49.129.94.32;7pkt 7fpkt", shape=pentagon, color=darkviolet];
2418[label="49.129.94.32;7pkt 7fpkt", shape=invtriangle, color=brown];
stat497[shape=component, label=&lt;Rules:&lt;BR/&gt;{49.129.94.32:*, 150.159.161.109:80}[42.8571%]&lt;BR/&gt;{49.129.94.32:*, 161.131.196.12:80}[28.5714%]&lt;BR/&gt;{49.129.94.32:*, 145.238.96.66:80}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 63056: (7.14286%)&lt;BR/&gt; 61990: (7.14286%)&lt;BR/&gt; 61968: (7.14286%)&lt;BR/&gt; 56626: (7.14286%)&gt;];
}
1979--2418[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="150.159.161.109" dst_port="80" src_ip="49.129.94.32"/>
      <filter dst_ip="145.238.96.66" dst_port="80" src_ip="49.129.94.32"/>
      <filter dst_ip="161.131.196.12" dst_port="80" src_ip="49.129.94.32"/>
    </slice>
    <from sec="1097384482" usec="0"/>
    <to sec="1097385290" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.782604,1.29904,002,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_501{
style=filled;
color=gray75;
118[label="45.103.123.56s;147pkt 147fpkt", shape=rectangle, color=red];
2015[label="45.103.123.56;164pkt 164fpkt", shape=pentagon, color=darkviolet];
2428[label="45.103.123.56;163pkt 163fpkt", shape=invtriangle, color=brown];
stat501[shape=component, label=&lt;Rules:&lt;BR/&gt;{45.103.123.56:1031, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1031: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
118--1861[label="1;147pkt 147fpkt"];
118--2015[label="1;147pkt 147fpkt"];
118--2428[label="0.993197;146pkt 146fpkt"];
2015--2428[label="1;163pkt 163fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="45.103.123.56" src_port="1031"/>
    </slice>
    <from sec="1097384682" usec="0"/>
    <to sec="1097384710" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.726105,1.41868,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="49.151.0.82"/>
    </slice>
    <from sec="1097384745" usec="0"/>
    <to sec="1097384770" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.726105,1.41868,020,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="139.101.11.92"/>
    </slice>
    <from sec="1097384406" usec="0"/>
    <to sec="1097385300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.723921,1.361,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_511{
style=filled;
color=gray75;
2101[label="209.72.208.99;9pkt 9fpkt", shape=pentagon, color=darkviolet];
2464[label="209.72.208.99;10pkt 10fpkt", shape=invtriangle, color=brown];
stat511[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.72.208.99:80, 145.238.142.7:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 39107: (5.26316%)&lt;BR/&gt; 39106: (5.26316%)&lt;BR/&gt; 39105: (5.26316%)&lt;BR/&gt; 39104: (5.26316%)&gt;];
}
2101--2464[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="145.238.142.7" src_ip="209.72.208.99" src_port="80"/>
    </slice>
    <from sec="1097385025" usec="0"/>
    <to sec="1097385106" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.726105,1.41868,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="42.134.127.111"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.726105,1.41868,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="90.209.86.123"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.726105,1.41868,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="205.179.254.133"/>
    </slice>
    <from sec="1097385300" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.723921,1.361,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_519{
style=filled;
color=gray75;
2162[label="194.30.68.136;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2497[label="194.30.68.136;2pkt 2fpkt", shape=invtriangle, color=brown];
stat519[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.30.68.136:80, 162.10.185.163:1866}[50%]&lt;BR/&gt;{194.30.68.136:80, 162.10.185.163:1867}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1867: (25%)&lt;BR/&gt; 1866: (25%)&gt;];
}
2162--2497[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="162.10.185.163" dst_port="1867" src_ip="194.30.68.136" src_port="80"/>
      <filter dst_ip="162.10.185.163" dst_port="1866" src_ip="194.30.68.136" src_port="80"/>
    </slice>
    <from sec="1097385039" usec="0"/>
    <to sec="1097385041" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.732293,1.30933,020,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_520{
style=filled;
color=gray75;
1058[label="209.46.163.140;s;357pkt 357fpkt", shape=diamond, color=yellow];
2165[label="209.46.163.140;360pkt 360fpkt", shape=pentagon, color=darkviolet];
2498[label="209.46.163.140;359pkt 359fpkt", shape=invtriangle, color=brown];
stat520[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.46.163.140:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1058--1301[label="0.0208333;1pkt 1fpkt"];
1058--2165[label="1;357pkt 357fpkt"];
1058--2498[label="0.997199;356pkt 356fpkt"];
2165--2498[label="1;359pkt 359fpkt"];
</description>
    <slice>
      <filter src_ip="209.46.163.140"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.732293,1.30933,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_521{
style=filled;
color=gray75;
1373[label="49.129.92.144;s;15pkt 15fpkt", shape=diamond, color=yellow];
2176[label="49.129.92.144;15pkt 15fpkt", shape=pentagon, color=darkviolet];
2503[label="49.129.92.144;14pkt 14fpkt", shape=invtriangle, color=brown];
stat521[shape=component, label=&lt;Rules:&lt;BR/&gt;{49.129.92.144:*, 145.238.54.38:80}[86.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 60732: (3.40909%)&lt;BR/&gt; 60731: (3.40909%)&lt;BR/&gt; 58059: (3.40909%)&lt;BR/&gt; 53284: (3.40909%)&gt;];
}
1373--1527[label="0.6;9pkt 9fpkt"];
1373--1832[label="0.133333;2pkt 2fpkt"];
1373--1847[label="0.133333;2pkt 2fpkt"];
1373--1866[label="0.133333;2pkt 2fpkt"];
1373--1880[label="0.133333;2pkt 2fpkt"];
1373--1894[label="0.133333;2pkt 2fpkt"];
1373--1903[label="0.133333;2pkt 2fpkt"];
1373--2176[label="1;15pkt 15fpkt"];
1373--2503[label="1;14pkt 14fpkt"];
2176--2503[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter dst_ip="145.238.54.38" dst_port="80" src_ip="49.129.92.144"/>
    </slice>
    <from sec="1097384440" usec="0"/>
    <to sec="1097385137" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.723921,1.361,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_522{
style=filled;
color=gray75;
2179[label="145.238.196.145;107pkt 107fpkt", shape=pentagon, color=darkviolet];
2506[label="145.238.196.145;106pkt 106fpkt", shape=invtriangle, color=brown];
stat522[shape=component, label=&lt;Rules:&lt;BR/&gt;{145.238.196.145:*, *:113}[47.6636%]&lt;BR/&gt;{145.238.196.145:25, *:*}[47.6636%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (26.0563%)&lt;BR/&gt; 113: (23.9437%)&lt;BR/&gt; 4900: (0.938967%)&lt;BR/&gt; 2593: (0.938967%)&lt;BR/&gt; 64998: (0.469484%)&gt;];
}
2179--2506[label="1;106pkt 106fpkt"];
</description>
    <slice>
      <filter src_ip="145.238.196.145" src_port="25"/>
      <filter dst_port="113" src_ip="145.238.196.145"/>
    </slice>
    <from sec="1097384404" usec="0"/>
    <to sec="1097385282" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.723921,1.361,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_523{
style=filled;
color=gray75;
2183[label="209.46.166.147;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2508[label="209.46.166.147;1pkt 1fpkt", shape=invtriangle, color=brown];
stat523[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.46.166.147:80, 211.29.87.21:63926}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 63926: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
2183--2508[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="211.29.87.21" dst_port="63926" src_ip="209.46.166.147" src_port="80"/>
    </slice>
    <from sec="1097385300" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.723921,1.361,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_524{
style=filled;
color=gray75;
2196[label="108.168.110.154;88pkt 88fpkt", shape=pentagon, color=darkviolet];
2513[label="108.168.110.154;87pkt 87fpkt", shape=invtriangle, color=brown];
stat524[shape=component, label=&lt;Rules:&lt;BR/&gt;{108.168.110.154:*, *:3127}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3127: (50%)&lt;BR/&gt; 4931: (0.571429%)&lt;BR/&gt; 4922: (0.571429%)&lt;BR/&gt; 4912: (0.571429%)&lt;BR/&gt; 4881: (0.571429%)&gt;];
}
2196--2513[label="1;87pkt 87fpkt"];
</description>
    <slice>
      <filter dst_port="3127" src_ip="108.168.110.154"/>
    </slice>
    <from sec="1097384407" usec="0"/>
    <to sec="1097385296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.726105,1.41868,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="204.83.162.154"/>
    </slice>
    <from sec="1097384413" usec="0"/>
    <to sec="1097385294" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.726105,1.41868,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="197.130.209.173"/>
    </slice>
    <from sec="1097384823" usec="0"/>
    <to sec="1097384852" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.782604,1.29904,001,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_534{
style=filled;
color=gray75;
277[label="193.164.54.248s;77pkt 77fpkt", shape=rectangle, color=red];
2377[label="193.164.54.248;122pkt 122fpkt", shape=pentagon, color=darkviolet];
2579[label="193.164.54.248;122pkt 122fpkt", shape=invtriangle, color=brown];
stat534[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.164.54.248:*, *:1023}[61.4754%]&lt;BR/&gt;{193.164.54.248:*, *:5554}[31.9672%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1023: (32.0872%)&lt;BR/&gt; 5554: (15.4206%)&lt;BR/&gt; 9898: (2.49221%)&lt;BR/&gt; 4714: (1.40187%)&lt;BR/&gt; 4550: (1.40187%)&gt;];
}
277--2377[label="1;77pkt 77fpkt"];
277--2579[label="1;77pkt 77fpkt"];
2377--2579[label="1;122pkt 122fpkt"];
</description>
    <slice>
      <filter dst_port="1023" src_ip="193.164.54.248"/>
      <filter dst_port="5554" src_ip="193.164.54.248"/>
    </slice>
    <from sec="1097385281" usec="0"/>
    <to sec="1097385288" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.82854,1.46542,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="90.133.67.4"/>
    </slice>
    <from sec="1097384413" usec="0"/>
    <to sec="1097385300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.82854,1.46542,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="52.86.181.27"/>
    </slice>
    <from sec="1097384400" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.82854,1.46542,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="205.179.254.133"/>
    </slice>
    <from sec="1097385300" usec="0"/>
    <to sec="1097385301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.82854,1.46542,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="212.43.107.143"/>
    </slice>
    <from sec="1097384689" usec="0"/>
    <to sec="1097384862" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.878474,1.34993,001,1 0 0 0 0 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_539{
style=filled;
color=gray75;
231[label="193.169.73.146s;242pkt 242fpkt", shape=rectangle, color=red];
2180[label="193.169.73.146;242pkt 242fpkt", shape=pentagon, color=darkviolet];
2652[label="193.169.73.146;136pkt 136fpkt", shape=invhouse, color=bisque];
stat539[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.169.73.146:*, *:1023}[33.4711%]&lt;BR/&gt;{193.169.73.146:*, *:9898}[33.4711%]&lt;BR/&gt;{193.169.73.146:*, *:5554}[33.0579%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1023: (17.5%)&lt;BR/&gt; 9898: (16.7742%)&lt;BR/&gt; 5554: (15.7258%)&lt;BR/&gt; 2796: (0.483871%)&lt;BR/&gt; 2793: (0.483871%)&gt;];
}
231--1897[label="0.334711;81pkt 81fpkt"];
231--1900[label="0.330579;80pkt 80fpkt"];
231--1901[label="0.334711;81pkt 81fpkt"];
231--2180[label="1;242pkt 242fpkt"];
231--2652[label="1;136pkt 136fpkt"];
2180--2652[label="1;136pkt 136fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="193.169.73.146"/>
      <filter dst_port="1023" src_ip="193.169.73.146"/>
      <filter dst_port="5554" src_ip="193.169.73.146"/>
    </slice>
    <from sec="1097384401" usec="0"/>
    <to sec="1097384408" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.82854,1.46542,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="197.130.209.173"/>
    </slice>
    <from sec="1097384823" usec="0"/>
    <to sec="1097384852" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.82854,1.46542,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="162.10.210.212"/>
    </slice>
    <from sec="1097384624" usec="0"/>
    <to sec="1097385249" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.82854,1.46542,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="52.6.54.240"/>
    </slice>
    <from sec="1097384403" usec="0"/>
    <to sec="1097385300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.826626,1.40966,503,0 0 0 0 0 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_544{
style=filled;
color=gray75;
2366[label="49.148.247.242;32pkt 32fpkt", shape=pentagon, color=darkviolet];
2691[label="49.148.247.242;31pkt 31fpkt", shape=invhouse, color=bisque];
stat544[shape=component, label=&lt;Rules:&lt;BR/&gt;{49.148.247.242:80, 162.10.211.67:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1469: (1.5873%)&lt;BR/&gt; 1464: (1.5873%)&lt;BR/&gt; 1463: (1.5873%)&lt;BR/&gt; 1458: (1.5873%)&gt;];
}
2366--2691[label="1;31pkt 31fpkt"];
</description>
    <slice>
      <filter dst_ip="162.10.211.67" src_ip="49.148.247.242" src_port="80"/>
    </slice>
    <from sec="1097384767" usec="0"/>
    <to sec="1097384804" usec="0"/>
  </anomaly>

</admd:annotation>
