<?xml version="1.0" encoding="UTF-8" standalone="no" ?>
<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">

  <anomaly type="notice" value="0.774426,1.41258,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="128.0.235.228" dst_port="9898" proto="tcp" src_ip="197.37.134.122"/>
      <filter dst_ip="128.0.235.228" dst_port="9898" proto="udp" src_ip="197.37.134.122"/>
      <filter dst_ip="128.0.235.228" dst_port="1023" proto="tcp" src_ip="197.37.134.122"/>
      <filter dst_ip="128.0.235.228" dst_port="1023" proto="udp" src_ip="197.37.134.122"/>
      <filter dst_ip="128.0.235.228" dst_port="5554" proto="tcp" src_ip="197.37.134.122"/>
      <filter dst_ip="128.0.235.228" dst_port="5554" proto="udp" src_ip="197.37.134.122"/>
      <from sec="1100149222" usec="0"/>
      <to sec="1100149270" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="128.0.235.228" dst_port="9898" proto="tcp" src_ip="194.6.222.122"/>
      <filter dst_ip="128.0.235.228" dst_port="9898" proto="udp" src_ip="194.6.222.122"/>
      <filter dst_ip="128.0.235.228" dst_port="1023" proto="tcp" src_ip="194.6.222.122"/>
      <filter dst_ip="128.0.235.228" dst_port="1023" proto="udp" src_ip="194.6.222.122"/>
      <filter dst_ip="128.0.235.228" dst_port="5554" proto="tcp" src_ip="194.6.222.122"/>
      <filter dst_ip="128.0.235.228" dst_port="5554" proto="udp" src_ip="194.6.222.122"/>
      <from sec="1100149222" usec="0"/>
      <to sec="1100149270" usec="0"/>
    </slice>
    <from sec="1100149222" usec="0"/>
    <to sec="1100149270" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.774426,1.41258,999,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="214.58.238.91" dst_port="9898" proto="tcp" src_ip="199.205.237.137" src_port="4812"/>
      <filter dst_ip="214.58.238.91" dst_port="25" proto="tcp" src_ip="199.205.237.137" src_port="4812"/>
      <from sec="1100149480" usec="0"/>
      <to sec="1100149482" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="214.58.238.91" dst_port="9898" proto="tcp" src_ip="199.82.29.137" src_port="4812"/>
      <filter dst_ip="214.58.238.91" dst_port="25" proto="tcp" src_ip="199.82.29.137" src_port="4812"/>
      <from sec="1100149478" usec="0"/>
      <to sec="1100149483" usec="0"/>
    </slice>
    <from sec="1100149477" usec="0"/>
    <to sec="1100149484" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.774426,1.41258,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="tcp" src_ip="196.81.19.234" src_port="1044"/>
      <filter dst_port="137" proto="udp" src_ip="196.81.19.234" src_port="1044"/>
      <filter dst_port="80" proto="tcp" src_ip="196.81.19.234" src_port="1044"/>
      <filter dst_port="80" proto="udp" src_ip="196.81.19.234" src_port="1044"/>
      <filter dst_port="53" proto="tcp" src_ip="196.81.19.234" src_port="1044"/>
      <filter dst_port="53" proto="udp" src_ip="196.81.19.234" src_port="1044"/>
      <from sec="1100149836" usec="0"/>
      <to sec="1100149848" usec="0"/>
    </slice>
    <from sec="1100149836" usec="0"/>
    <to sec="1100149848" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.774426,1.41258,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="197.48.148.95" dst_port="1023" proto="tcp" src_port="5554"/>
      <filter dst_ip="197.48.148.95" dst_port="1023" proto="tcp" src_port="5554"/>
      <filter dst_ip="197.48.148.95" dst_port="1023" proto="tcp" src_port="5554"/>
      <filter dst_ip="197.48.148.95" dst_port="1023" proto="tcp" src_port="5554"/>
      <filter dst_ip="197.48.148.95" dst_port="80" proto="tcp" src_port="5554"/>
      <filter dst_ip="197.48.148.95" dst_port="80" proto="tcp" src_port="5554"/>
      <filter dst_ip="197.48.148.95" dst_port="80" proto="tcp" src_port="5554"/>
      <filter dst_ip="197.48.148.95" dst_port="80" proto="tcp" src_port="5554"/>
      <filter dst_ip="197.48.148.95" dst_port="1023" proto="tcp" src_port="1023"/>
      <filter dst_ip="197.48.148.95" dst_port="1023" proto="tcp" src_port="1023"/>
      <filter dst_ip="197.48.148.95" dst_port="1023" proto="tcp" src_port="1023"/>
      <filter dst_ip="197.48.148.95" dst_port="1023" proto="tcp" src_port="1023"/>
      <filter dst_ip="197.48.148.95" dst_port="80" proto="tcp" src_port="1023"/>
      <filter dst_ip="197.48.148.95" dst_port="80" proto="tcp" src_port="1023"/>
      <filter dst_ip="197.48.148.95" dst_port="80" proto="tcp" src_port="1023"/>
      <filter dst_ip="197.48.148.95" dst_port="80" proto="tcp" src_port="1023"/>
      <from sec="1100149216" usec="0"/>
      <to sec="1100149227" usec="0"/>
    </slice>
    <from sec="1100149216" usec="0"/>
    <to sec="1100149228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.774426,1.41258,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="tcp" src_ip="45.84.173.5" src_port="1026"/>
      <filter dst_port="137" proto="udp" src_ip="45.84.173.5" src_port="1026"/>
      <filter dst_port="53" proto="tcp" src_ip="45.84.173.5" src_port="1026"/>
      <filter dst_port="53" proto="udp" src_ip="45.84.173.5" src_port="1026"/>
      <filter dst_port="80" proto="tcp" src_ip="45.84.173.5" src_port="1026"/>
      <filter dst_port="80" proto="udp" src_ip="45.84.173.5" src_port="1026"/>
      <from sec="1100149794" usec="0"/>
      <to sec="1100149822" usec="0"/>
    </slice>
    <from sec="1100149794" usec="0"/>
    <to sec="1100149822" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.774426,1.41258,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_5{
style=filled;
color=gray75;
113[label="41.198.168.34s;256pkt 256fpkt", shape=rectangle, color=red];
stat5[shape=component, label=&lt;Rules:&lt;BR/&gt;{41.198.168.34:1120, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1120: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
113--2323[label="0.00390625;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="41.198.168.34" src_port="1120"/>
    </slice>
    <from sec="1100149500" usec="0"/>
    <to sec="1100149526" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.774426,1.41258,503,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="147.203.218.219" dst_port="137" proto="tcp" src_ip="197.166.74.40" src_port="1030"/>
      <filter dst_ip="147.203.218.219" dst_port="137" proto="udp" src_ip="197.166.74.40" src_port="1030"/>
      <filter dst_ip="147.203.218.219" dst_port="3594" proto="tcp" src_ip="197.166.74.40" src_port="1030"/>
      <filter dst_ip="147.203.218.219" dst_port="3594" proto="udp" src_ip="197.166.74.40" src_port="1030"/>
      <filter dst_ip="147.203.218.219" dst_port="137" proto="tcp" src_ip="197.166.74.40" src_port="80"/>
      <filter dst_ip="147.203.218.219" dst_port="137" proto="udp" src_ip="197.166.74.40" src_port="80"/>
      <filter dst_ip="147.203.218.219" dst_port="3594" proto="tcp" src_ip="197.166.74.40" src_port="80"/>
      <filter dst_ip="147.203.218.219" dst_port="3594" proto="udp" src_ip="197.166.74.40" src_port="80"/>
      <from sec="1100150020" usec="0"/>
      <to sec="1100150026" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="147.203.218.219" dst_port="137" proto="tcp" src_ip="87.162.242.40" src_port="1030"/>
      <filter dst_ip="147.203.218.219" dst_port="137" proto="udp" src_ip="87.162.242.40" src_port="1030"/>
      <filter dst_ip="147.203.218.219" dst_port="3594" proto="tcp" src_ip="87.162.242.40" src_port="1030"/>
      <filter dst_ip="147.203.218.219" dst_port="3594" proto="udp" src_ip="87.162.242.40" src_port="1030"/>
      <filter dst_ip="147.203.218.219" dst_port="137" proto="tcp" src_ip="87.162.242.40" src_port="80"/>
      <filter dst_ip="147.203.218.219" dst_port="137" proto="udp" src_ip="87.162.242.40" src_port="80"/>
      <filter dst_ip="147.203.218.219" dst_port="3594" proto="tcp" src_ip="87.162.242.40" src_port="80"/>
      <filter dst_ip="147.203.218.219" dst_port="3594" proto="udp" src_ip="87.162.242.40" src_port="80"/>
      <from sec="1100150023" usec="0"/>
      <to sec="1100150024" usec="0"/>
    </slice>
    <from sec="1100150020" usec="0"/>
    <to sec="1100150026" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.774426,1.41258,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="150.208.74.64" dst_port="137" proto="tcp" src_ip="197.134.198.50" src_port="1028"/>
      <filter dst_ip="150.208.74.64" dst_port="137" proto="udp" src_ip="197.134.198.50" src_port="1028"/>
      <filter dst_ip="150.208.74.64" dst_port="80" proto="tcp" src_ip="197.134.198.50" src_port="1028"/>
      <filter dst_ip="150.208.74.64" dst_port="80" proto="udp" src_ip="197.134.198.50" src_port="1028"/>
      <from sec="1100149780" usec="0"/>
      <to sec="1100149799" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="150.208.74.64" dst_port="137" proto="tcp" src_ip="147.203.10.50" src_port="1028"/>
      <filter dst_ip="150.208.74.64" dst_port="137" proto="udp" src_ip="147.203.10.50" src_port="1028"/>
      <filter dst_ip="150.208.74.64" dst_port="80" proto="tcp" src_ip="147.203.10.50" src_port="1028"/>
      <filter dst_ip="150.208.74.64" dst_port="80" proto="udp" src_ip="147.203.10.50" src_port="1028"/>
      <from sec="1100149780" usec="0"/>
      <to sec="1100149800" usec="0"/>
    </slice>
    <from sec="1100149780" usec="0"/>
    <to sec="1100149801" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.774426,1.41258,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="199.210.96.142" src_port="1028"/>
      <from sec="1100149997" usec="0"/>
      <to sec="1100150014" usec="0"/>
    </slice>
    <from sec="1100149997" usec="0"/>
    <to sec="1100150014" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.774426,1.41258,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="131.225.224.162" src_port="1034"/>
      <from sec="1100149620" usec="0"/>
      <to sec="1100149631" usec="0"/>
    </slice>
    <from sec="1100149620" usec="0"/>
    <to sec="1100149631" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.774426,1.41258,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="214.161.208.47" dst_port="137" proto="tcp" src_ip="87.91.229.163" src_port="1025"/>
      <filter dst_ip="214.161.208.47" dst_port="137" proto="udp" src_ip="87.91.229.163" src_port="1025"/>
      <filter dst_ip="214.161.208.47" dst_port="137" proto="tcp" src_ip="87.91.229.163" src_port="80"/>
      <filter dst_ip="214.161.208.47" dst_port="137" proto="udp" src_ip="87.91.229.163" src_port="80"/>
      <from sec="1100150064" usec="0"/>
      <to sec="1100150091" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="214.161.208.47" dst_port="137" proto="tcp" src_ip="215.8.145.163" src_port="1025"/>
      <filter dst_ip="214.161.208.47" dst_port="137" proto="udp" src_ip="215.8.145.163" src_port="1025"/>
      <filter dst_ip="214.161.208.47" dst_port="137" proto="tcp" src_ip="215.8.145.163" src_port="80"/>
      <filter dst_ip="214.161.208.47" dst_port="137" proto="udp" src_ip="215.8.145.163" src_port="80"/>
      <from sec="1100150085" usec="0"/>
      <to sec="1100150091" usec="0"/>
    </slice>
    <from sec="1100150064" usec="0"/>
    <to sec="1100150091" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.774426,1.41258,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="212.246.132.180" src_port="1028"/>
      <from sec="1100150080" usec="0"/>
      <to sec="1100150086" usec="0"/>
    </slice>
    <from sec="1100150079" usec="0"/>
    <to sec="1100150086" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.774426,1.41258,503,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="200.142.104.138" dst_port="137" proto="tcp" src_ip="214.68.62.226" src_port="1040"/>
      <filter dst_ip="200.142.104.138" dst_port="137" proto="udp" src_ip="214.68.62.226" src_port="1040"/>
      <filter dst_ip="200.142.104.138" dst_port="80" proto="tcp" src_ip="214.68.62.226" src_port="1040"/>
      <filter dst_ip="200.142.104.138" dst_port="80" proto="udp" src_ip="214.68.62.226" src_port="1040"/>
      <filter dst_ip="200.142.104.138" dst_port="137" proto="tcp" src_ip="214.68.62.226" src_port="1499"/>
      <filter dst_ip="200.142.104.138" dst_port="137" proto="udp" src_ip="214.68.62.226" src_port="1499"/>
      <filter dst_ip="200.142.104.138" dst_port="80" proto="tcp" src_ip="214.68.62.226" src_port="1499"/>
      <filter dst_ip="200.142.104.138" dst_port="80" proto="udp" src_ip="214.68.62.226" src_port="1499"/>
      <from sec="1100149946" usec="0"/>
      <to sec="1100149961" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="200.142.104.138" dst_port="137" proto="tcp" src_ip="148.245.174.226" src_port="1040"/>
      <filter dst_ip="200.142.104.138" dst_port="137" proto="udp" src_ip="148.245.174.226" src_port="1040"/>
      <filter dst_ip="200.142.104.138" dst_port="80" proto="tcp" src_ip="148.245.174.226" src_port="1040"/>
      <filter dst_ip="200.142.104.138" dst_port="80" proto="udp" src_ip="148.245.174.226" src_port="1040"/>
      <filter dst_ip="200.142.104.138" dst_port="137" proto="tcp" src_ip="148.245.174.226" src_port="1499"/>
      <filter dst_ip="200.142.104.138" dst_port="137" proto="udp" src_ip="148.245.174.226" src_port="1499"/>
      <filter dst_ip="200.142.104.138" dst_port="80" proto="tcp" src_ip="148.245.174.226" src_port="1499"/>
      <filter dst_ip="200.142.104.138" dst_port="80" proto="udp" src_ip="148.245.174.226" src_port="1499"/>
      <from sec="1100149949" usec="0"/>
      <to sec="1100149963" usec="0"/>
    </slice>
    <from sec="1100149946" usec="0"/>
    <to sec="1100149963" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.774426,1.41258,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="196.101.161.246" src_port="1031"/>
      <from sec="1100149525" usec="0"/>
      <to sec="1100149531" usec="0"/>
    </slice>
    <from sec="1100149525" usec="0"/>
    <to sec="1100149531" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.774426,1.41258,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="205.16.183.246" src_port="1032"/>
      <from sec="1100149995" usec="0"/>
      <to sec="1100150001" usec="0"/>
    </slice>
    <from sec="1100149995" usec="0"/>
    <to sec="1100150001" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.774426,1.41258,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="200.72.210.252" src_port="61717"/>
      <from sec="1100149806" usec="0"/>
      <to sec="1100149812" usec="0"/>
    </slice>
    <from sec="1100149806" usec="0"/>
    <to sec="1100149812" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.774426,1.41258,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="215.26.204.93" dst_port="9898" proto="tcp" src_ip="194.128.193.179"/>
      <filter dst_ip="215.26.204.93" dst_port="5554" proto="tcp" src_ip="194.128.193.179"/>
      <filter dst_ip="215.26.204.93" dst_port="80" proto="tcp" src_ip="194.128.193.179"/>
      <from sec="1100149410" usec="0"/>
      <to sec="1100149412" usec="0"/>
    </slice>
    <from sec="1100149408" usec="0"/>
    <to sec="1100149415" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.774426,1.41258,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="214.68.62.226" proto="icmp"/>
      <filter dst_ip="214.68.62.226" proto="icmp"/>
      <filter dst_ip="214.68.62.226" proto="icmp"/>
      <filter dst_ip="214.68.62.226" proto="icmp"/>
      <from sec="1100149947" usec="0"/>
      <to sec="1100149953" usec="0"/>
    </slice>
    <from sec="1100149947" usec="0"/>
    <to sec="1100149953" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.85265,1.43117,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="128.0.235.228" dst_port="9898" proto="tcp" src_ip="197.37.134.122"/>
      <filter dst_ip="128.0.235.228" dst_port="9898" proto="udp" src_ip="197.37.134.122"/>
      <filter dst_ip="128.0.235.228" dst_port="1023" proto="tcp" src_ip="197.37.134.122"/>
      <filter dst_ip="128.0.235.228" dst_port="1023" proto="udp" src_ip="197.37.134.122"/>
      <filter dst_ip="128.0.235.228" dst_port="5554" proto="tcp" src_ip="197.37.134.122"/>
      <filter dst_ip="128.0.235.228" dst_port="5554" proto="udp" src_ip="197.37.134.122"/>
      <from sec="1100149222" usec="0"/>
      <to sec="1100149270" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="128.0.235.228" dst_port="9898" proto="tcp" src_ip="194.6.222.122"/>
      <filter dst_ip="128.0.235.228" dst_port="9898" proto="udp" src_ip="194.6.222.122"/>
      <filter dst_ip="128.0.235.228" dst_port="1023" proto="tcp" src_ip="194.6.222.122"/>
      <filter dst_ip="128.0.235.228" dst_port="1023" proto="udp" src_ip="194.6.222.122"/>
      <filter dst_ip="128.0.235.228" dst_port="5554" proto="tcp" src_ip="194.6.222.122"/>
      <filter dst_ip="128.0.235.228" dst_port="5554" proto="udp" src_ip="194.6.222.122"/>
      <from sec="1100149222" usec="0"/>
      <to sec="1100149270" usec="0"/>
    </slice>
    <from sec="1100149222" usec="0"/>
    <to sec="1100149270" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.85265,1.43117,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="197.48.148.95" dst_port="1023" proto="tcp" src_port="1023"/>
      <filter dst_ip="197.48.148.95" dst_port="1023" proto="tcp" src_port="1023"/>
      <filter dst_ip="197.48.148.95" dst_port="1023" proto="tcp" src_port="1023"/>
      <filter dst_ip="197.48.148.95" dst_port="1023" proto="tcp" src_port="1023"/>
      <filter dst_ip="197.48.148.95" dst_port="80" proto="tcp" src_port="1023"/>
      <filter dst_ip="197.48.148.95" dst_port="80" proto="tcp" src_port="1023"/>
      <filter dst_ip="197.48.148.95" dst_port="80" proto="tcp" src_port="1023"/>
      <filter dst_ip="197.48.148.95" dst_port="80" proto="tcp" src_port="1023"/>
      <filter dst_ip="197.48.148.95" dst_port="1023" proto="tcp" src_port="1075"/>
      <filter dst_ip="197.48.148.95" dst_port="1023" proto="tcp" src_port="1075"/>
      <filter dst_ip="197.48.148.95" dst_port="1023" proto="tcp" src_port="1075"/>
      <filter dst_ip="197.48.148.95" dst_port="1023" proto="tcp" src_port="1075"/>
      <filter dst_ip="197.48.148.95" dst_port="80" proto="tcp" src_port="1075"/>
      <filter dst_ip="197.48.148.95" dst_port="80" proto="tcp" src_port="1075"/>
      <filter dst_ip="197.48.148.95" dst_port="80" proto="tcp" src_port="1075"/>
      <filter dst_ip="197.48.148.95" dst_port="80" proto="tcp" src_port="1075"/>
      <from sec="1100149216" usec="0"/>
      <to sec="1100149227" usec="0"/>
    </slice>
    <from sec="1100149216" usec="0"/>
    <to sec="1100149228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.85265,1.43117,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="82.233.55.126" dst_port="137" proto="tcp" src_ip="197.134.198.50" src_port="1028"/>
      <filter dst_ip="82.233.55.126" dst_port="137" proto="udp" src_ip="197.134.198.50" src_port="1028"/>
      <filter dst_ip="82.233.55.126" dst_port="80" proto="tcp" src_ip="197.134.198.50" src_port="1028"/>
      <filter dst_ip="82.233.55.126" dst_port="80" proto="udp" src_ip="197.134.198.50" src_port="1028"/>
      <from sec="1100149780" usec="0"/>
      <to sec="1100149796" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="82.233.55.126" dst_port="137" proto="tcp" src_ip="148.245.138.50" src_port="1028"/>
      <filter dst_ip="82.233.55.126" dst_port="137" proto="udp" src_ip="148.245.138.50" src_port="1028"/>
      <filter dst_ip="82.233.55.126" dst_port="80" proto="tcp" src_ip="148.245.138.50" src_port="1028"/>
      <filter dst_ip="82.233.55.126" dst_port="80" proto="udp" src_ip="148.245.138.50" src_port="1028"/>
      <from sec="1100149780" usec="0"/>
      <to sec="1100149782" usec="0"/>
    </slice>
    <from sec="1100149780" usec="0"/>
    <to sec="1100149796" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.85265,1.43117,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="5554" proto="tcp" src_ip="87.54.233.80" src_port="80"/>
      <filter dst_port="9898" proto="tcp" src_ip="87.54.233.80" src_port="80"/>
      <from sec="1100150040" usec="0"/>
      <to sec="1100150042" usec="0"/>
    </slice>
    <from sec="1100150040" usec="0"/>
    <to sec="1100150047" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.91805,1.46532,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="150.208.74.64" dst_port="137" proto="tcp" src_ip="197.134.198.50" src_port="1028"/>
      <filter dst_ip="150.208.74.64" dst_port="137" proto="udp" src_ip="197.134.198.50" src_port="1028"/>
      <filter dst_ip="150.208.74.64" dst_port="80" proto="tcp" src_ip="197.134.198.50" src_port="1028"/>
      <filter dst_ip="150.208.74.64" dst_port="80" proto="udp" src_ip="197.134.198.50" src_port="1028"/>
      <from sec="1100149790" usec="0"/>
      <to sec="1100149796" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="150.208.74.64" dst_port="137" proto="tcp" src_ip="147.203.10.50" src_port="1028"/>
      <filter dst_ip="150.208.74.64" dst_port="137" proto="udp" src_ip="147.203.10.50" src_port="1028"/>
      <filter dst_ip="150.208.74.64" dst_port="80" proto="tcp" src_ip="147.203.10.50" src_port="1028"/>
      <filter dst_ip="150.208.74.64" dst_port="80" proto="udp" src_ip="147.203.10.50" src_port="1028"/>
      <from sec="1100149791" usec="0"/>
      <to sec="1100149796" usec="0"/>
    </slice>
    <from sec="1100149790" usec="0"/>
    <to sec="1100149796" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.91805,1.46532,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="214.161.210.66" dst_port="137" proto="tcp" src_ip="215.75.210.223" src_port="1026"/>
      <filter dst_ip="214.161.210.66" dst_port="137" proto="udp" src_ip="215.75.210.223" src_port="1026"/>
      <filter dst_ip="214.161.210.66" dst_port="137" proto="tcp" src_ip="215.75.210.223" src_port="80"/>
      <filter dst_ip="214.161.210.66" dst_port="137" proto="udp" src_ip="215.75.210.223" src_port="80"/>
      <from sec="1100149548" usec="0"/>
      <to sec="1100149562" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="214.161.210.66" dst_port="137" proto="tcp" src_ip="217.247.110.223" src_port="1026"/>
      <filter dst_ip="214.161.210.66" dst_port="137" proto="udp" src_ip="217.247.110.223" src_port="1026"/>
      <filter dst_ip="214.161.210.66" dst_port="137" proto="tcp" src_ip="217.247.110.223" src_port="80"/>
      <filter dst_ip="214.161.210.66" dst_port="137" proto="udp" src_ip="217.247.110.223" src_port="80"/>
      <from sec="1100149546" usec="0"/>
      <to sec="1100149559" usec="0"/>
    </slice>
    <from sec="1100149546" usec="0"/>
    <to sec="1100149562" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_121{
style=filled;
color=gray75;
729[label="83.10.235.141;d;1pkt 1fpkt", shape=diamond, color=yellow];
730[label="128.0.70.108;s;34pkt 34fpkt", shape=diamond, color=yellow];
2723[label="83.10.235.141;d;1pkt 1fpkt", shape=hexagon, color=black];
stat121[shape=component, label=&lt;Rules:&lt;BR/&gt;{128.0.70.108:*, *:80}[50%]&lt;BR/&gt;{128.0.70.108:62733, *:*}[47.0588%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (23.6111%)&lt;BR/&gt; 62733: (22.2222%)&lt;BR/&gt; 9416: (4.16667%)&lt;BR/&gt; 2150: (4.16667%)&lt;BR/&gt; 2333: (2.77778%)&gt;];
}
729--730[label="1;1pkt 1fpkt"];
729--2723[label="1;1pkt 1fpkt"];
730--2500[label="0.147059;5pkt 5fpkt"];
730--2723[label="1;1pkt 1fpkt"];
730--3549[label="0.0882353;3pkt 3fpkt"];
730--3555[label="0.0294118;1pkt 1fpkt"];
730--3561[label="0.0588235;2pkt 2fpkt"];
730--3770[label="0.0882353;3pkt 3fpkt"];
730--3775[label="0.0294118;1pkt 1fpkt"];
730--3781[label="0.0588235;2pkt 2fpkt"];
730--3982[label="0.0882353;3pkt 3fpkt"];
730--3986[label="0.0294118;1pkt 1fpkt"];
730--3991[label="0.0588235;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_ip="128.0.70.108" src_port="62733"/>
      <filter dst_port="80" src_ip="128.0.70.108"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100149753" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_123{
style=filled;
color=gray75;
750[label="215.26.201.29;d;1469pkt 1469fpkt", shape=diamond, color=yellow];
stat123[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 215.26.201.29:5253}[99.6596%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5253: (49.8298%)&lt;BR/&gt; 54045: (0.272294%)&lt;BR/&gt; 1025: (0.204221%)&lt;BR/&gt; 50177: (0.136147%)&lt;BR/&gt; 80: (0.10211%)&gt;];
}
750--3547[label="0.00149254;1pkt 1fpkt"];
750--3549[label="0.00136147;2pkt 2fpkt"];
750--3768[label="0.00149254;1pkt 1fpkt"];
750--3770[label="0.00136147;2pkt 2fpkt"];
750--3982[label="0.00136147;2pkt 2fpkt"];
750--5035[label="0.00917431;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="215.26.201.29" dst_port="5253"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="219.229.46.109"/>
      <from sec="1100149200" usec="0"/>
      <to sec="1100150028" usec="0"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="205.200.103.199"/>
      <from sec="1100149200" usec="0"/>
      <to sec="1100149278" usec="0"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100149278" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.815594,1.29127,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_126{
style=filled;
color=gray75;
866[label="166.164.218.210;d;4pkt 4fpkt", shape=diamond, color=yellow];
867[label="192.102.254.199;s;1pkt 1fpkt", shape=diamond, color=yellow];
2760[label="192.102.254.199;s;1pkt 1fpkt", shape=hexagon, color=black];
5188[label="192.102.254.199;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat126[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.102.255.45:32823, 166.164.218.210:33457}[25%]&lt;BR/&gt;{192.102.255.46:32832, 166.164.218.210:33446}[25%]&lt;BR/&gt;{192.102.255.55:32831, 166.164.218.210:33445}[25%]&lt;BR/&gt;{192.102.254.199:20974, 166.164.218.210:1040}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 20974: (28.5714%)&lt;BR/&gt; 1040: (28.5714%)&lt;BR/&gt; 33457: (7.14286%)&lt;BR/&gt; 33446: (7.14286%)&lt;BR/&gt; 33445: (7.14286%)&gt;];
}
866--867[label="1;1pkt 1fpkt"];
866--2760[label="1;1pkt 1fpkt"];
866--5188[label="1;1pkt 1fpkt"];
867--2760[label="1;1pkt 1fpkt"];
867--5188[label="1;1pkt 1fpkt"];
2760--5188[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="166.164.218.210" dst_port="1040" src_ip="192.102.254.199" src_port="20974"/>
      <filter dst_ip="166.164.218.210" dst_port="33445" src_ip="192.102.255.55" src_port="32831"/>
      <filter dst_ip="166.164.218.210" dst_port="33446" src_ip="192.102.255.46" src_port="32832"/>
      <filter dst_ip="166.164.218.210" dst_port="33457" src_ip="192.102.255.45" src_port="32823"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.815594,1.29127,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_127{
style=filled;
color=gray75;
810[label="148.245.37.64;s;13pkt 13fpkt", shape=diamond, color=yellow];
902[label="45.225.91.243;d;2pkt 2fpkt", shape=diamond, color=yellow];
2744[label="148.245.37.64;s;11pkt 11fpkt", shape=hexagon, color=black];
4409[label="148.245.37.64;16pkt 16fpkt", shape=pentagon, color=darkviolet];
stat127[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.37.64:5539, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5539: (50%)&lt;BR/&gt; 13273: (4.7619%)&lt;BR/&gt; 1267: (4.7619%)&lt;BR/&gt; 64748: (3.57143%)&lt;BR/&gt; 57608: (3.57143%)&gt;];
}
810--902[label="1;2pkt 2fpkt"];
810--2744[label="1;11pkt 11fpkt"];
810--4409[label="0.923077;12pkt 12fpkt"];
902--2744[label="1;2pkt 2fpkt"];
902--4409[label="1;2pkt 2fpkt"];
2744--4409[label="1;11pkt 11fpkt"];
</description>
    <slice>
      <filter src_ip="148.245.37.64" src_port="5539"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100149998" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_130{
style=filled;
color=gray75;
895[label="148.245.168.18;s;3pkt 3fpkt", shape=diamond, color=yellow];
959[label="65.34.110.232;d;1pkt 1fpkt", shape=diamond, color=yellow];
2843[label="148.245.168.18;s;3pkt 3fpkt", shape=hexagon, color=black];
stat130[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.168.18:4921, 87.65.92.19:1024}[33.3333%]&lt;BR/&gt;{148.245.168.18:4849, 211.199.66.208:6667}[33.3333%]&lt;BR/&gt;{148.245.168.18:4930, 65.34.110.232:63203}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 63203: (21.4286%)&lt;BR/&gt; 4930: (21.4286%)&lt;BR/&gt; 6667: (14.2857%)&lt;BR/&gt; 4921: (14.2857%)&lt;BR/&gt; 4849: (14.2857%)&gt;];
}
895--959[label="1;1pkt 1fpkt"];
895--2843[label="1;3pkt 3fpkt"];
959--2843[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="65.34.110.232" dst_port="63203" src_ip="148.245.168.18" src_port="4930"/>
      <filter dst_ip="211.199.66.208" dst_port="6667" src_ip="148.245.168.18" src_port="4849"/>
      <filter dst_ip="87.65.92.19" dst_port="1024" src_ip="148.245.168.18" src_port="4921"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_131{
style=filled;
color=gray75;
894[label="148.245.168.18;d;2pkt 2fpkt", shape=diamond, color=yellow];
960[label="65.34.110.232;s;1pkt 1fpkt", shape=diamond, color=yellow];
3064[label="148.245.168.18;d;2pkt 2fpkt", shape=hexagon, color=black];
stat131[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.199.66.208:6667, 148.245.168.18:4849}[50%]&lt;BR/&gt;{65.34.110.232:63203, 148.245.168.18:4930}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 63203: (30%)&lt;BR/&gt; 4930: (30%)&lt;BR/&gt; 6667: (20%)&lt;BR/&gt; 4849: (20%)&gt;];
}
894--960[label="1;1pkt 1fpkt"];
894--3064[label="1;2pkt 2fpkt"];
960--3064[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="148.245.168.18" dst_port="4930" src_ip="65.34.110.232" src_port="63203"/>
      <filter dst_ip="148.245.168.18" dst_port="4849" src_ip="211.199.66.208" src_port="6667"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.815594,1.29127,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_132{
style=filled;
color=gray75;
1026[label="147.203.229.231;s;3pkt 3fpkt", shape=diamond, color=yellow];
1035[label="208.20.26.106;d;2pkt 2fpkt", shape=diamond, color=yellow];
2798[label="147.203.229.231;s;3pkt 3fpkt", shape=hexagon, color=black];
2874[label="208.20.26.106;d;2pkt 2fpkt", shape=hexagon, color=black];
5356[label="147.203.229.231;2pkt 2fpkt", shape=pentagon, color=darkviolet];
stat132[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.203.229.231:2409, 216.59.174.67:80}[33.3333%]&lt;BR/&gt;{147.203.229.231:2411, 208.20.26.106:21}[33.3333%]&lt;BR/&gt;{147.203.229.231:2415, 208.20.26.106:42347}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 42347: (20.8333%)&lt;BR/&gt; 2415: (20.8333%)&lt;BR/&gt; 2411: (20.8333%)&lt;BR/&gt; 21: (20.8333%)&lt;BR/&gt; 2409: (8.33333%)&gt;];
}
1026--1035[label="1;2pkt 2fpkt"];
1026--2798[label="1;3pkt 3fpkt"];
1026--2874[label="1;2pkt 2fpkt"];
1026--5356[label="1;2pkt 2fpkt"];
1035--2798[label="1;2pkt 2fpkt"];
1035--2874[label="1;2pkt 2fpkt"];
1035--5356[label="1;2pkt 2fpkt"];
2798--2874[label="1;2pkt 2fpkt"];
2798--5356[label="1;2pkt 2fpkt"];
2874--5356[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="208.20.26.106" dst_port="42347" src_ip="147.203.229.231" src_port="2415"/>
      <filter dst_ip="208.20.26.106" dst_port="21" src_ip="147.203.229.231" src_port="2411"/>
      <filter dst_ip="216.59.174.67" dst_port="80" src_ip="147.203.229.231" src_port="2409"/>
    </slice>
    <from sec="1100149250" usec="0"/>
    <to sec="1100149681" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,502,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_133{
style=filled;
color=gray75;
1036[label="204.10.245.185;d;4pkt 4fpkt", shape=diamond, color=yellow];
1037[label="147.203.148.160;s;4pkt 4fpkt", shape=diamond, color=yellow];
stat133[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.203.148.160:22, 204.10.245.185:35656}[25%]&lt;BR/&gt;{147.203.148.160:22, 204.10.245.185:35657}[25%]&lt;BR/&gt;{147.203.148.160:22, 204.10.245.185:35658}[25%]&lt;BR/&gt;{147.203.148.160:22, 204.10.245.185:35662}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 22: (50%)&lt;BR/&gt; 35662: (12.5%)&lt;BR/&gt; 35658: (12.5%)&lt;BR/&gt; 35657: (12.5%)&lt;BR/&gt; 35656: (12.5%)&gt;];
}
1036--1037[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="204.10.245.185" dst_port="35662" src_ip="147.203.148.160" src_port="22"/>
      <filter dst_ip="204.10.245.185" dst_port="35658" src_ip="147.203.148.160" src_port="22"/>
      <filter dst_ip="204.10.245.185" dst_port="35657" src_ip="147.203.148.160" src_port="22"/>
      <filter dst_ip="204.10.245.185" dst_port="35656" src_ip="147.203.148.160" src_port="22"/>
    </slice>
    <from sec="1100149265" usec="0"/>
    <to sec="1100149404" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_135{
style=filled;
color=gray75;
1062[label="214.172.8.230;d;1685pkt 1685fpkt", shape=diamond, color=yellow];
1072[label="197.9.52.53;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat135[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:6346, 214.172.8.230:3839}[24.6884%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3839: (36.3286%)&lt;BR/&gt; 6346: (12.5148%)&lt;BR/&gt; 4662: (9.9051%)&lt;BR/&gt; 4672: (9.1637%)&lt;BR/&gt; 0: (3.26216%)&gt;];
}
1062--1072[label="1;1pkt 1fpkt"];
1062--1656[label="0.0160428;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="214.172.8.230" dst_port="3839" src_port="6346"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_136{
style=filled;
color=gray75;
768[label="192.102.254.217;d;2pkt 2fpkt", shape=diamond, color=yellow];
1091[label="147.203.224.68;s;1pkt 1fpkt", shape=diamond, color=yellow];
1116[label="148.245.219.54;s;5pkt 5fpkt", shape=diamond, color=yellow];
2826[label="147.203.224.68;s;1pkt 1fpkt", shape=hexagon, color=black];
stat136[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.219.54:*, 195.106.217.37:*}[33.3333%]&lt;BR/&gt;{*:*, 192.102.254.217:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 49330: (16.6667%)&lt;BR/&gt; 20326: (16.6667%)&lt;BR/&gt; 49228: (11.1111%)&lt;BR/&gt; 20010: (11.1111%)&lt;BR/&gt; 56648: (5.55556%)&gt;];
}
768--1091[label="1;1pkt 1fpkt"];
768--1116[label="0.5;1pkt 1fpkt"];
768--2826[label="1;1pkt 1fpkt"];
1091--2826[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="192.102.254.217"/>
      <filter dst_ip="195.106.217.37" src_ip="148.245.219.54"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100149938" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_137{
style=filled;
color=gray75;
1105[label="215.217.163.209;d;1pkt 1fpkt", shape=diamond, color=yellow];
1106[label="148.244.8.84;s;1pkt 1fpkt", shape=diamond, color=yellow];
3118[label="215.217.163.209;d;1pkt 1fpkt", shape=hexagon, color=black];
stat137[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.244.8.84:37849, 215.217.163.209:1755}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 37849: (50%)&lt;BR/&gt; 1755: (50%)&gt;];
}
1105--1106[label="1;1pkt 1fpkt"];
1105--3118[label="1;1pkt 1fpkt"];
1106--3118[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="215.217.163.209" dst_port="1755" src_ip="148.244.8.84" src_port="37849"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="195.175.36.182"/>
      <from sec="1100149200" usec="0"/>
      <to sec="1100150028" usec="0"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_139{
style=filled;
color=gray75;
1206[label="210.207.65.204;d;1pkt 1fpkt", shape=diamond, color=yellow];
1207[label="165.16.229.137;s;1pkt 1fpkt", shape=diamond, color=yellow];
3073[label="210.207.65.204;d;1pkt 1fpkt", shape=hexagon, color=black];
stat139[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.16.229.137:1681, 210.207.65.204:8020}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8020: (50%)&lt;BR/&gt; 1681: (50%)&gt;];
}
1206--1207[label="1;1pkt 1fpkt"];
1206--3073[label="1;1pkt 1fpkt"];
1207--3073[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="210.207.65.204" dst_port="8020" src_ip="165.16.229.137" src_port="1681"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,504,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_140{
style=filled;
color=gray75;
1240[label="80.235.0.40;d;54pkt 54fpkt", shape=diamond, color=yellow];
1241[label="128.0.113.94;s;54pkt 54fpkt", shape=diamond, color=yellow];
2857[label="80.235.0.40;d;54pkt 54fpkt", shape=hexagon, color=black];
2858[label="128.0.113.94;s;54pkt 54fpkt", shape=hexagon, color=black];
stat140[shape=component, label=&lt;Rules:&lt;BR/&gt;{128.0.113.94:*, 80.235.0.40:443}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (50%)&lt;BR/&gt; 2660: (0.925926%)&lt;BR/&gt; 2659: (0.925926%)&lt;BR/&gt; 2658: (0.925926%)&lt;BR/&gt; 2657: (0.925926%)&gt;];
}
1240--1241[label="1;54pkt 54fpkt"];
1240--2857[label="1;54pkt 54fpkt"];
1240--2858[label="1;54pkt 54fpkt"];
1241--2857[label="1;54pkt 54fpkt"];
1241--2858[label="1;54pkt 54fpkt"];
2857--2858[label="1;54pkt 54fpkt"];
</description>
    <slice>
      <filter dst_ip="80.235.0.40" dst_port="443" src_ip="128.0.113.94"/>
    </slice>
    <from sec="1100149203" usec="0"/>
    <to sec="1100149381" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.815594,1.29127,504,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_141{
style=filled;
color=gray75;
966[label="165.16.18.28;s;112pkt 112fpkt", shape=diamond, color=yellow];
1257[label="80.80.94.235;d;111pkt 111fpkt", shape=diamond, color=yellow];
2785[label="165.16.18.28;s;57pkt 57fpkt", shape=hexagon, color=black];
4204[label="165.16.18.28;112pkt 112fpkt", shape=pentagon, color=darkviolet];
stat141[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.16.18.28:*, 80.80.94.235:443}[99.1071%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (49.6173%)&lt;BR/&gt; 4921: (0.510204%)&lt;BR/&gt; 4920: (0.510204%)&lt;BR/&gt; 4919: (0.510204%)&lt;BR/&gt; 4918: (0.510204%)&gt;];
}
966--1257[label="1;111pkt 111fpkt"];
966--2785[label="1;57pkt 57fpkt"];
966--2848[label="0.00892857;1pkt 1fpkt"];
966--3341[label="0.00892857;1pkt 1fpkt"];
966--3549[label="0.00892857;1pkt 1fpkt"];
966--3555[label="0.00892857;1pkt 1fpkt"];
966--3561[label="0.00892857;1pkt 1fpkt"];
966--3770[label="0.00892857;1pkt 1fpkt"];
966--3775[label="0.00892857;1pkt 1fpkt"];
966--3781[label="0.00892857;1pkt 1fpkt"];
966--3982[label="0.00892857;1pkt 1fpkt"];
966--3986[label="0.00892857;1pkt 1fpkt"];
966--3991[label="0.00892857;1pkt 1fpkt"];
966--4204[label="1;112pkt 112fpkt"];
1257--2785[label="0.982456;56pkt 56fpkt"];
1257--4204[label="1;111pkt 111fpkt"];
2785--2848[label="0.0175439;1pkt 1fpkt"];
2785--3341[label="0.0175439;1pkt 1fpkt"];
2785--3549[label="0.0175439;1pkt 1fpkt"];
2785--3555[label="0.0175439;1pkt 1fpkt"];
2785--3561[label="0.0175439;1pkt 1fpkt"];
2785--3770[label="0.0175439;1pkt 1fpkt"];
2785--3775[label="0.0175439;1pkt 1fpkt"];
2785--3781[label="0.0175439;1pkt 1fpkt"];
2785--3982[label="0.0175439;1pkt 1fpkt"];
2785--3986[label="0.0175439;1pkt 1fpkt"];
2785--3991[label="0.0175439;1pkt 1fpkt"];
2785--4204[label="1;57pkt 57fpkt"];
</description>
    <slice>
      <filter dst_ip="80.80.94.235" dst_port="443" src_ip="165.16.18.28"/>
    </slice>
    <from sec="1100149206" usec="0"/>
    <to sec="1100149707" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_142{
style=filled;
color=gray75;
1011[label="148.245.0.198;s;5pkt 5fpkt", shape=diamond, color=yellow];
1293[label="205.10.101.156;d;14pkt 14fpkt", shape=diamond, color=yellow];
2973[label="205.10.101.156;d;8pkt 8fpkt", shape=hexagon, color=black];
stat142[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.203.224.46:*, 205.10.101.156:80}[64.2857%]&lt;BR/&gt;{148.245.0.198:*, 205.10.101.156:80}[35.7143%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1594: (5.55556%)&lt;BR/&gt; 1593: (5.55556%)&lt;BR/&gt; 1592: (5.55556%)&lt;BR/&gt; 1591: (5.55556%)&gt;];
}
1011--1293[label="1;5pkt 5fpkt"];
1011--2973[label="1;5pkt 5fpkt"];
1293--2973[label="1;8pkt 8fpkt"];
1293--3549[label="0.0714286;1pkt 1fpkt"];
1293--3555[label="0.0714286;1pkt 1fpkt"];
1293--3770[label="0.0714286;1pkt 1fpkt"];
1293--3775[label="0.0714286;1pkt 1fpkt"];
1293--3982[label="0.0714286;1pkt 1fpkt"];
1293--3986[label="0.0714286;1pkt 1fpkt"];
2973--3549[label="0.125;1pkt 1fpkt"];
2973--3555[label="0.125;1pkt 1fpkt"];
2973--3770[label="0.125;1pkt 1fpkt"];
2973--3775[label="0.125;1pkt 1fpkt"];
2973--3982[label="0.125;1pkt 1fpkt"];
2973--3986[label="0.125;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="205.10.101.156" dst_port="80" src_ip="147.203.224.46"/>
      <filter dst_ip="205.10.101.156" dst_port="80" src_ip="148.245.0.198"/>
    </slice>
    <from sec="1100149230" usec="0"/>
    <to sec="1100149689" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.633119,1.23269,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_143{
style=filled;
color=gray75;
1279[label="162.3.56.87;d;12pkt 12fpkt", shape=diamond, color=yellow];
1306[label="214.65.14.179;s;11pkt 11fpkt", shape=diamond, color=yellow];
5079[label="214.65.14.179;10pkt 10fpkt", shape=pentagon, color=darkviolet];
5970[label="214.65.14.179;10pkt 10fpkt", shape=invtriangle, color=brown];
stat143[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.65.14.179:20, 162.3.56.87:*}[50%]&lt;BR/&gt;{214.65.14.179:21, 162.3.56.87:*}[41.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 20: (27.907%)&lt;BR/&gt; 21: (20.9302%)&lt;BR/&gt; 2735: (4.65116%)&lt;BR/&gt; 2734: (4.65116%)&lt;BR/&gt; 2733: (4.65116%)&gt;];
}
1279--1306[label="1;11pkt 11fpkt"];
1279--5079[label="1;10pkt 10fpkt"];
1279--5970[label="1;10pkt 10fpkt"];
1306--5079[label="1;10pkt 10fpkt"];
1306--5970[label="1;10pkt 10fpkt"];
5079--5970[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter dst_ip="162.3.56.87" src_ip="214.65.14.179" src_port="20"/>
      <filter dst_ip="162.3.56.87" src_ip="214.65.14.179" src_port="21"/>
    </slice>
    <from sec="1100149220" usec="0"/>
    <to sec="1100149537" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,504,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_145{
style=filled;
color=gray75;
1289[label="204.58.52.214;d;11pkt 11fpkt", shape=diamond, color=yellow];
1339[label="165.16.220.56;s;2pkt 2fpkt", shape=diamond, color=yellow];
2881[label="165.16.220.56;s;2pkt 2fpkt", shape=hexagon, color=black];
2971[label="204.58.52.214;d;11pkt 11fpkt", shape=hexagon, color=black];
stat145[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.172.15.163:*, 204.58.52.214:443}[72.7273%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (46.1538%)&lt;BR/&gt; 3380: (7.69231%)&lt;BR/&gt; 3372: (7.69231%)&lt;BR/&gt; 1561: (3.84615%)&lt;BR/&gt; 1560: (3.84615%)&gt;];
}
1289--1339[label="1;2pkt 2fpkt"];
1289--2881[label="1;2pkt 2fpkt"];
1289--2971[label="1;11pkt 11fpkt"];
1339--2881[label="1;2pkt 2fpkt"];
1339--2971[label="1;2pkt 2fpkt"];
2881--2971[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="204.58.52.214" dst_port="443" src_ip="214.172.15.163"/>
    </slice>
    <from sec="1100149225" usec="0"/>
    <to sec="1100149569" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_146{
style=filled;
color=gray75;
1347[label="46.17.150.198;d;1pkt 1fpkt", shape=diamond, color=yellow];
1348[label="148.245.59.41;s;4pkt 4fpkt", shape=diamond, color=yellow];
stat146[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.59.41:1506, 220.217.40.65:80}[25%]&lt;BR/&gt;{148.245.59.41:1504, 220.217.40.147:80}[25%]&lt;BR/&gt;{148.245.59.41:1505, 220.217.40.177:80}[25%]&lt;BR/&gt;{148.245.59.41:1503, 46.17.150.198:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1503: (20%)&lt;BR/&gt; 1506: (10%)&lt;BR/&gt; 1505: (10%)&lt;BR/&gt; 1504: (10%)&gt;];
}
1347--1348[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="46.17.150.198" dst_port="80" src_ip="148.245.59.41" src_port="1503"/>
      <filter dst_ip="220.217.40.177" dst_port="80" src_ip="148.245.59.41" src_port="1505"/>
      <filter dst_ip="220.217.40.147" dst_port="80" src_ip="148.245.59.41" src_port="1504"/>
      <filter dst_ip="220.217.40.65" dst_port="80" src_ip="148.245.59.41" src_port="1506"/>
    </slice>
    <from sec="1100149714" usec="0"/>
    <to sec="1100149802" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.805151,1.21335,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_147{
style=filled;
color=gray75;
1333[label="147.203.83.152;s;3pkt 3fpkt", shape=diamond, color=yellow];
1352[label="47.116.29.29;d;2pkt 2fpkt", shape=diamond, color=yellow];
4927[label="147.203.83.152;3pkt 3fpkt", shape=pentagon, color=darkviolet];
5893[label="147.203.83.152;2pkt 2fpkt", shape=invtriangle, color=brown];
6410[label="147.203.83.152;3pkt 3fpkt", shape=invhouse, color=bisque];
stat147[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.203.83.152:64480, 207.156.100.3:21}[33.3333%]&lt;BR/&gt;{147.203.83.152:53103, 47.116.29.29:21}[33.3333%]&lt;BR/&gt;{147.203.83.152:62020, 47.116.29.29:53450}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (30.7692%)&lt;BR/&gt; 62020: (19.2308%)&lt;BR/&gt; 53450: (19.2308%)&lt;BR/&gt; 53103: (19.2308%)&lt;BR/&gt; 64480: (11.5385%)&gt;];
}
1333--1352[label="1;2pkt 2fpkt"];
1333--4927[label="1;3pkt 3fpkt"];
1333--5893[label="1;2pkt 2fpkt"];
1333--6410[label="1;3pkt 3fpkt"];
1352--4927[label="1;2pkt 2fpkt"];
1352--5893[label="1;2pkt 2fpkt"];
1352--6410[label="1;2pkt 2fpkt"];
4927--5893[label="1;2pkt 2fpkt"];
4927--6410[label="1;3pkt 3fpkt"];
5893--6410[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="47.116.29.29" dst_port="53450" src_ip="147.203.83.152" src_port="62020"/>
      <filter dst_ip="47.116.29.29" dst_port="21" src_ip="147.203.83.152" src_port="53103"/>
      <filter dst_ip="207.156.100.3" dst_port="21" src_ip="147.203.83.152" src_port="64480"/>
    </slice>
    <from sec="1100149311" usec="0"/>
    <to sec="1100149358" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_149{
style=filled;
color=gray75;
1379[label="46.38.44.165;d;1pkt 1fpkt", shape=diamond, color=yellow];
1380[label="148.245.132.155;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat149[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.132.155:3209, 46.38.44.165:554}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3209: (50%)&lt;BR/&gt; 554: (50%)&gt;];
}
1379--1380[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="46.38.44.165" dst_port="554" src_ip="148.245.132.155" src_port="3209"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_150{
style=filled;
color=gray75;
1388[label="80.201.41.226;d;1pkt 1fpkt", shape=diamond, color=yellow];
1389[label="128.0.170.74;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat150[shape=component, label=&lt;Rules:&lt;BR/&gt;{128.0.170.74:7777, 80.201.41.226:14549}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 14549: (50%)&lt;BR/&gt; 7777: (50%)&gt;];
}
1388--1389[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="80.201.41.226" dst_port="14549" src_ip="128.0.170.74" src_port="7777"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="128.0.75.177"/>
      <from sec="1100149200" usec="0"/>
      <to sec="1100150013" usec="0"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150013" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_152{
style=filled;
color=gray75;
759[label="214.161.208.94;s;607pkt 607fpkt", shape=diamond, color=yellow];
1405[label="86.33.33.226;d;1pkt 1fpkt", shape=diamond, color=yellow];
1463[label="41.205.120.136;d;1pkt 1fpkt", shape=diamond, color=yellow];
1795[label="200.184.172.58;d;1pkt 1fpkt", shape=diamond, color=yellow];
2528[label="200.12.108.226;d;1pkt 1fpkt", shape=diamond, color=yellow];
2731[label="214.161.208.94;s;164pkt 164fpkt", shape=hexagon, color=black];
3265[label="200.12.108.226;d;1pkt 1fpkt", shape=hexagon, color=black];
stat152[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.161.208.94:*, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6881: (4.57474%)&lt;BR/&gt; 49408: (3.54381%)&lt;BR/&gt; 6969: (3.41495%)&lt;BR/&gt; 12544: (3.22165%)&lt;BR/&gt; 26368: (2.19072%)&gt;];
}
759--1405[label="1;1pkt 1fpkt"];
759--1463[label="1;1pkt 1fpkt"];
759--1795[label="1;1pkt 1fpkt"];
759--2528[label="1;1pkt 1fpkt"];
759--2692[label="0.00164745;1pkt 1fpkt"];
759--2731[label="1;164pkt 164fpkt"];
759--3265[label="1;1pkt 1fpkt"];
759--3292[label="0.00164745;1pkt 1fpkt"];
759--3561[label="0.00164745;1pkt 1fpkt"];
759--3563[label="0.00164745;1pkt 1fpkt"];
759--3781[label="0.00164745;1pkt 1fpkt"];
759--3783[label="0.00164745;1pkt 1fpkt"];
759--3991[label="0.00164745;1pkt 1fpkt"];
759--3993[label="0.00164745;1pkt 1fpkt"];
1405--2731[label="1;1pkt 1fpkt"];
1463--2731[label="1;1pkt 1fpkt"];
1795--2731[label="1;1pkt 1fpkt"];
2528--2731[label="1;1pkt 1fpkt"];
2528--3265[label="1;1pkt 1fpkt"];
2731--3265[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="214.161.208.94"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="162.3.83.7"/>
      <from sec="1100149200" usec="0"/>
      <to sec="1100150028" usec="0"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55074,1.28899,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_154{
style=filled;
color=gray75;
1065[label="148.245.72.42;d;147pkt 147fpkt", shape=diamond, color=yellow];
1492[label="87.22.4.93;s;1pkt 1fpkt", shape=diamond, color=yellow];
4053[label="200.155.13.9;24pkt 24fpkt", shape=pentagon, color=darkviolet];
4983[label="192.16.160.163;8pkt 8fpkt", shape=pentagon, color=darkviolet];
5417[label="67.73.138.252;4pkt 4fpkt", shape=pentagon, color=darkviolet];
stat154[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 148.245.72.42:15001}[36.646%]&lt;BR/&gt;{*:6881, 148.245.72.42:*}[21.7391%]&lt;BR/&gt;{*:80, 148.245.72.42:*}[21.118%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 15001: (16.0326%)&lt;BR/&gt; 80: (13.8587%)&lt;BR/&gt; 6881: (10.8696%)&lt;BR/&gt; 5050: (2.44565%)&lt;BR/&gt; 6884: (1.90217%)&gt;];
}
1065--1492[label="1;1pkt 1fpkt"];
1065--4053[label="0.708333;17pkt 17fpkt"];
1065--4983[label="0.125;1pkt 1fpkt"];
1065--5417[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="148.245.72.42" src_port="6881"/>
      <filter dst_ip="148.245.72.42" src_port="80"/>
      <filter dst_ip="148.245.72.42" dst_port="15001"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55074,1.28899,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_155{
style=filled;
color=gray75;
1311[label="215.26.197.97;s;233pkt 233fpkt", shape=diamond, color=yellow];
1526[label="168.234.69.211;d;233pkt 233fpkt", shape=diamond, color=yellow];
4623[label="215.26.197.97;234pkt 234fpkt", shape=pentagon, color=darkviolet];
stat155[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.26.197.97:*, 168.234.69.211:*}[99.5726%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (11.5714%)&lt;BR/&gt; 9898: (8.14286%)&lt;BR/&gt; 1023: (7.71429%)&lt;BR/&gt; 5554: (6%)&lt;BR/&gt; 445: (1.35714%)&gt;];
}
1311--1526[label="1;233pkt 233fpkt"];
1311--4623[label="1;233pkt 233fpkt"];
1526--4623[label="1;233pkt 233fpkt"];
</description>
    <slice>
      <filter dst_ip="168.234.69.211" src_ip="215.26.197.97"/>
    </slice>
    <from sec="1100149260" usec="0"/>
    <to sec="1100150097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="41.154.82.170"/>
      <from sec="1100149768" usec="0"/>
      <to sec="1100149968" usec="0"/>
    </slice>
    <from sec="1100149768" usec="0"/>
    <to sec="1100149968" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55074,1.28899,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_157{
style=filled;
color=gray75;
1533[label="147.203.224.238;d;354pkt 354fpkt", shape=diamond, color=yellow];
1555[label="87.131.64.43;s;83pkt 83fpkt", shape=diamond, color=yellow];
4298[label="87.131.64.43;346pkt 346fpkt", shape=pentagon, color=darkviolet];
stat157[shape=component, label=&lt;Rules:&lt;BR/&gt;{87.131.64.43:80, 147.203.224.238:*}[98.0226%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.553%)&lt;BR/&gt; 25542: (0.383142%)&lt;BR/&gt; 1289: (0.191571%)&lt;BR/&gt; 1288: (0.191571%)&lt;BR/&gt; 1287: (0.191571%)&gt;];
}
1533--1555[label="1;83pkt 83fpkt"];
1533--3546[label="0.0508475;18pkt 18fpkt"];
1533--3767[label="0.0508475;18pkt 18fpkt"];
1533--4298[label="1;346pkt 346fpkt"];
1555--4298[label="1;83pkt 83fpkt"];
</description>
    <slice>
      <filter dst_ip="147.203.224.238" src_ip="87.131.64.43" src_port="80"/>
    </slice>
    <from sec="1100149283" usec="0"/>
    <to sec="1100150030" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.815594,1.29127,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_158{
style=filled;
color=gray75;
1369[label="148.245.129.80;s;12pkt 12fpkt", shape=diamond, color=yellow];
1566[label="194.246.213.71;d;5pkt 5fpkt", shape=diamond, color=yellow];
2982[label="194.246.213.71;d;5pkt 5fpkt", shape=hexagon, color=black];
4510[label="148.245.129.80;23pkt 23fpkt", shape=pentagon, color=darkviolet];
stat158[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.129.80:80, 194.6.234.165:*}[41.6667%]&lt;BR/&gt;{148.245.129.80:80, 194.246.213.71:*}[20.8333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (44.4444%)&lt;BR/&gt; 0: (11.1111%)&lt;BR/&gt; 3579: (4.44444%)&lt;BR/&gt; 3578: (4.44444%)&lt;BR/&gt; 3576: (4.44444%)&gt;];
}
1369--1566[label="1;5pkt 5fpkt"];
1369--2982[label="1;5pkt 5fpkt"];
1369--4510[label="0.916667;11pkt 11fpkt"];
1566--2982[label="1;5pkt 5fpkt"];
1566--4510[label="1;5pkt 5fpkt"];
2982--4510[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="194.6.234.165" src_ip="148.245.129.80" src_port="80"/>
      <filter dst_ip="194.246.213.71" src_ip="148.245.129.80" src_port="80"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.805151,1.21335,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_159{
style=filled;
color=gray75;
1316[label="148.245.167.100;s;250pkt 250fpkt", shape=diamond, color=yellow];
1337[label="215.187.179.133;d;123pkt 123fpkt", shape=diamond, color=yellow];
1569[label="215.187.179.225;d;94pkt 94fpkt", shape=diamond, color=yellow];
4650[label="148.245.167.100;254pkt 254fpkt", shape=pentagon, color=darkviolet];
5758[label="148.245.167.100;253pkt 253fpkt", shape=invtriangle, color=brown];
6336[label="148.245.167.100;253pkt 253fpkt", shape=invhouse, color=bisque];
stat159[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.167.100:*, 215.187.179.133:80}[48.4252%]&lt;BR/&gt;{148.245.167.100:*, 215.187.179.225:80}[37.0079%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.8778%)&lt;BR/&gt; 0: (0.244499%)&lt;BR/&gt; 4399: (0.203749%)&lt;BR/&gt; 4398: (0.203749%)&lt;BR/&gt; 4397: (0.203749%)&gt;];
}
1316--1337[label="1;123pkt 123fpkt"];
1316--1569[label="1;94pkt 94fpkt"];
1316--3549[label="0.264;66pkt 66fpkt"];
1316--3770[label="0.264;66pkt 66fpkt"];
1316--3982[label="0.264;66pkt 66fpkt"];
1316--4650[label="1;250pkt 250fpkt"];
1316--5758[label="0.996;249pkt 249fpkt"];
1316--6336[label="0.996;249pkt 249fpkt"];
1337--3549[label="0.528455;65pkt 65fpkt"];
1337--3770[label="0.528455;65pkt 65fpkt"];
1337--3982[label="0.528455;65pkt 65fpkt"];
1337--4650[label="1;123pkt 123fpkt"];
1337--5758[label="1;123pkt 123fpkt"];
1337--6336[label="1;123pkt 123fpkt"];
1569--4650[label="1;94pkt 94fpkt"];
1569--5758[label="1;94pkt 94fpkt"];
1569--6336[label="1;94pkt 94fpkt"];
4650--5758[label="1;253pkt 253fpkt"];
4650--6336[label="1;253pkt 253fpkt"];
5758--6336[label="1;253pkt 253fpkt"];
</description>
    <slice>
      <filter dst_ip="215.187.179.133" dst_port="80" src_ip="148.245.167.100"/>
      <filter dst_ip="215.187.179.225" dst_port="80" src_ip="148.245.167.100"/>
    </slice>
    <from sec="1100149279" usec="0"/>
    <to sec="1100149910" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,502,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_160{
style=filled;
color=gray75;
1480[label="165.16.59.246;s;1pkt 1fpkt", shape=diamond, color=yellow];
1571[label="61.242.190.104;d;2pkt 2fpkt", shape=diamond, color=yellow];
stat160[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.16.34.193:0, 61.242.190.104:0}[50%]&lt;BR/&gt;{165.16.59.246:22, 61.242.190.104:49394}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 49394: (33.3333%)&lt;BR/&gt; 22: (33.3333%)&lt;BR/&gt; 0: (33.3333%)&gt;];
}
1480--1571[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="61.242.190.104" dst_port="49394" src_ip="165.16.59.246" src_port="22"/>
      <filter dst_ip="61.242.190.104" src_ip="165.16.34.193"/>
    </slice>
    <from sec="1100149205" usec="0"/>
    <to sec="1100149553" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_161{
style=filled;
color=gray75;
758[label="214.161.208.94;d;100pkt 100fpkt", shape=diamond, color=yellow];
1603[label="86.33.33.226;s;1pkt 1fpkt", shape=diamond, color=yellow];
3180[label="214.161.208.94;d;100pkt 100fpkt", shape=hexagon, color=black];
stat161[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:6881, 214.161.208.94:*}[21%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6881: (10.4478%)&lt;BR/&gt; 13828: (5.97015%)&lt;BR/&gt; 21558: (5.47264%)&lt;BR/&gt; 24225: (3.48259%)&lt;BR/&gt; 6969: (2.98507%)&gt;];
}
758--1603[label="1;1pkt 1fpkt"];
758--3180[label="1;100pkt 100fpkt"];
758--3563[label="0.01;1pkt 1fpkt"];
758--3783[label="0.01;1pkt 1fpkt"];
758--3993[label="0.01;1pkt 1fpkt"];
1603--3180[label="1;1pkt 1fpkt"];
3180--3563[label="0.01;1pkt 1fpkt"];
3180--3783[label="0.01;1pkt 1fpkt"];
3180--3993[label="0.01;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="214.161.208.94" src_port="6881"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55074,1.28899,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_162{
style=filled;
color=gray75;
1630[label="205.108.121.121;d;1pkt 1fpkt", shape=diamond, color=yellow];
1631[label="214.172.24.188;s;2pkt 2fpkt", shape=diamond, color=yellow];
5133[label="214.172.24.188;2pkt 2fpkt", shape=pentagon, color=darkviolet];
stat162[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.172.24.188:2502, 205.108.121.101:29100}[50%]&lt;BR/&gt;{214.172.24.188:2503, 205.108.121.121:29200}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 29200: (30%)&lt;BR/&gt; 2503: (30%)&lt;BR/&gt; 29100: (20%)&lt;BR/&gt; 2502: (20%)&gt;];
}
1630--1631[label="1;1pkt 1fpkt"];
1630--5133[label="1;1pkt 1fpkt"];
1631--5133[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="205.108.121.121" dst_port="29200" src_ip="214.172.24.188" src_port="2503"/>
      <filter dst_ip="205.108.121.101" dst_port="29100" src_ip="214.172.24.188" src_port="2502"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_163{
style=filled;
color=gray75;
1633[label="128.0.235.195;d;3pkt 3fpkt", shape=diamond, color=yellow];
1636[label="45.50.90.249;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat163[shape=component, label=&lt;Rules:&lt;BR/&gt;{45.200.18.18:80, 128.0.235.195:3765}[33.3333%]&lt;BR/&gt;{45.50.90.240:80, 128.0.235.195:3783}[33.3333%]&lt;BR/&gt;{45.50.90.249:12320, 128.0.235.195:3297}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 12320: (25%)&lt;BR/&gt; 3297: (25%)&lt;BR/&gt; 80: (25%)&lt;BR/&gt; 3783: (12.5%)&lt;BR/&gt; 3765: (12.5%)&gt;];
}
1633--1636[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="128.0.235.195" dst_port="3297" src_ip="45.50.90.249" src_port="12320"/>
      <filter dst_ip="128.0.235.195" dst_port="3783" src_ip="45.50.90.240" src_port="80"/>
      <filter dst_ip="128.0.235.195" dst_port="3765" src_ip="45.200.18.18" src_port="80"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_164{
style=filled;
color=gray75;
1384[label="162.3.48.200;s;76pkt 76fpkt", shape=diamond, color=yellow];
1654[label="80.10.231.97;d;1pkt 1fpkt", shape=diamond, color=yellow];
3200[label="80.10.231.97;d;1pkt 1fpkt", shape=hexagon, color=black];
stat164[shape=component, label=&lt;Rules:&lt;BR/&gt;{162.3.48.200:80, 83.209.172.54:*}[96.0526%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.7949%)&lt;BR/&gt; 0: (2.5641%)&lt;BR/&gt; 3357: (1.92308%)&lt;BR/&gt; 873: (1.92308%)&lt;BR/&gt; 60791: (0.641026%)&gt;];
}
1384--1654[label="1;1pkt 1fpkt"];
1384--3200[label="1;1pkt 1fpkt"];
1384--3353[label="0.0789474;6pkt 6fpkt"];
1384--3546[label="0.0394737;3pkt 3fpkt"];
1384--3574[label="0.0789474;6pkt 6fpkt"];
1384--3767[label="0.0394737;3pkt 3fpkt"];
1384--3792[label="0.0789474;6pkt 6fpkt"];
1654--3200[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="83.209.172.54" src_ip="162.3.48.200" src_port="80"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="196.80.175.103"/>
      <from sec="1100149202" usec="0"/>
      <to sec="1100150028" usec="0"/>
    </slice>
    <from sec="1100149202" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_166{
style=filled;
color=gray75;
1753[label="214.76.73.101;s;14pkt 14fpkt", shape=diamond, color=yellow];
1754[label="147.9.212.80;d;14pkt 14fpkt", shape=diamond, color=yellow];
stat166[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.76.73.101:80, 147.9.212.80:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4043: (3.57143%)&lt;BR/&gt; 4042: (3.57143%)&lt;BR/&gt; 4041: (3.57143%)&lt;BR/&gt; 4040: (3.57143%)&gt;];
}
1753--1754[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter dst_ip="147.9.212.80" src_ip="214.76.73.101" src_port="80"/>
    </slice>
    <from sec="1100149411" usec="0"/>
    <to sec="1100149692" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.815594,1.29127,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_167{
style=filled;
color=gray75;
1764[label="194.61.148.43;s;50pkt 50fpkt", shape=diamond, color=yellow];
1765[label="148.245.142.209;d;311pkt 311fpkt", shape=diamond, color=yellow];
2072[label="194.61.148.55;s;250pkt 250fpkt", shape=diamond, color=yellow];
3104[label="148.245.142.209;d;301pkt 301fpkt", shape=hexagon, color=black];
3106[label="194.61.148.55;s;250pkt 250fpkt", shape=hexagon, color=black];
4301[label="194.61.148.43;49pkt 49fpkt", shape=pentagon, color=darkviolet];
stat167[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.61.148.55:80, 148.245.142.209:*}[80.3859%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3290: (0.165153%)&lt;BR/&gt; 3289: (0.165153%)&lt;BR/&gt; 3288: (0.165153%)&lt;BR/&gt; 3287: (0.165153%)&gt;];
}
1764--1765[label="1;50pkt 50fpkt"];
1764--3104[label="1;50pkt 50fpkt"];
1764--4301[label="1;49pkt 49fpkt"];
1765--2072[label="1;250pkt 250fpkt"];
1765--3104[label="1;301pkt 301fpkt"];
1765--3106[label="1;250pkt 250fpkt"];
1765--4301[label="1;49pkt 49fpkt"];
2072--3104[label="1;250pkt 250fpkt"];
2072--3106[label="1;250pkt 250fpkt"];
3104--3106[label="1;250pkt 250fpkt"];
3104--4301[label="1;49pkt 49fpkt"];
</description>
    <slice>
      <filter dst_ip="148.245.142.209" src_ip="194.61.148.55" src_port="80"/>
    </slice>
    <from sec="1100149452" usec="0"/>
    <to sec="1100150022" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="148.245.8.246"/>
      <from sec="1100149200" usec="0"/>
      <to sec="1100149641" usec="0"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100149641" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_170{
style=filled;
color=gray75;
1596[label="128.0.244.126;s;5pkt 5fpkt", shape=diamond, color=yellow];
1805[label="82.234.7.66;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat170[shape=component, label=&lt;Rules:&lt;BR/&gt;{128.0.244.126:4227, 82.234.187.58:80}[20%]&lt;BR/&gt;{128.0.244.126:3923, 82.234.7.66:554}[20%]&lt;BR/&gt;{128.0.244.126:4199, 210.207.160.73:5190}[20%]&lt;BR/&gt;{128.0.244.126:4012, 210.207.172.145:5190}[20%]&lt;BR/&gt;{128.0.244.126:45402, 194.12.18.152:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5190: (16.6667%)&lt;BR/&gt; 3923: (16.6667%)&lt;BR/&gt; 554: (16.6667%)&lt;BR/&gt; 80: (16.6667%)&lt;BR/&gt; 45402: (8.33333%)&gt;];
}
1596--1805[label="1;1pkt 1fpkt"];
1596--3555[label="0.2;1pkt 1fpkt"];
1596--3775[label="0.2;1pkt 1fpkt"];
1596--3986[label="0.2;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="194.12.18.152" dst_port="80" src_ip="128.0.244.126" src_port="45402"/>
      <filter dst_ip="210.207.172.145" dst_port="5190" src_ip="128.0.244.126" src_port="4012"/>
      <filter dst_ip="210.207.160.73" dst_port="5190" src_ip="128.0.244.126" src_port="4199"/>
      <filter dst_ip="82.234.7.66" dst_port="554" src_ip="128.0.244.126" src_port="3923"/>
      <filter dst_ip="82.234.187.58" dst_port="80" src_ip="128.0.244.126" src_port="4227"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_172{
style=filled;
color=gray75;
1820[label="51.134.16.72;d;7pkt 7fpkt", shape=diamond, color=yellow];
1821[label="147.203.202.165;s;1pkt 1fpkt", shape=diamond, color=yellow];
3192[label="51.134.16.72;d;7pkt 7fpkt", shape=hexagon, color=black];
stat172[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.203.216.22:110, 51.134.16.72:*}[85.7143%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 110: (40%)&lt;BR/&gt; 0: (20%)&lt;BR/&gt; 61661: (6.66667%)&lt;BR/&gt; 61658: (6.66667%)&lt;BR/&gt; 61487: (6.66667%)&gt;];
}
1820--1821[label="1;1pkt 1fpkt"];
1820--3192[label="1;7pkt 7fpkt"];
1821--3192[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="51.134.16.72" src_ip="147.203.216.22" src_port="110"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_173{
style=filled;
color=gray75;
1830[label="215.26.203.26;s;79pkt 79fpkt", shape=diamond, color=yellow];
stat173[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.26.203.26:25, *:*}[50.6329%]&lt;BR/&gt;{215.26.203.26:*, *:113}[48.1013%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (25.3165%)&lt;BR/&gt; 113: (24.0506%)&lt;BR/&gt; 1807: (1.26582%)&lt;BR/&gt; 65118: (0.632911%)&lt;BR/&gt; 64717: (0.632911%)&gt;];
}
</description>
    <slice>
      <filter src_ip="215.26.203.26" src_port="25"/>
      <filter dst_port="113" src_ip="215.26.203.26"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100149935" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_174{
style=filled;
color=gray75;
4018[label="148.245.156.3;24pkt 24fpkt", shape=pentagon, color=darkviolet];
stat174[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.156.3:*, 201.9.132.42:80}[87.5%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1111: (2.08333%)&lt;BR/&gt; 1109: (2.08333%)&lt;BR/&gt; 1108: (2.08333%)&lt;BR/&gt; 1107: (2.08333%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="201.9.132.42" dst_port="80" src_ip="148.245.156.3"/>
    </slice>
    <from sec="1100149385" usec="0"/>
    <to sec="1100149403" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="219.70.248.136"/>
      <from sec="1100149512" usec="0"/>
      <to sec="1100149848" usec="0"/>
    </slice>
    <from sec="1100149512" usec="0"/>
    <to sec="1100149848" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_177{
style=filled;
color=gray75;
1959[label="196.222.92.97;d;5pkt 5fpkt", shape=diamond, color=yellow];
1960[label="148.245.18.64;s;8pkt 8fpkt", shape=diamond, color=yellow];
stat177[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.18.64:80, 196.222.92.97:*}[62.5%]&lt;BR/&gt;{148.245.18.64:80, 215.224.200.74:*}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1413: (7.69231%)&lt;BR/&gt; 1412: (7.69231%)&lt;BR/&gt; 1411: (7.69231%)&lt;BR/&gt; 1409: (7.69231%)&gt;];
}
1959--1960[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="196.222.92.97" src_ip="148.245.18.64" src_port="80"/>
      <filter dst_ip="215.224.200.74" src_ip="148.245.18.64" src_port="80"/>
    </slice>
    <from sec="1100149568" usec="0"/>
    <to sec="1100149774" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.815594,1.29127,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_179{
style=filled;
color=gray75;
2035[label="147.203.31.75;s;21pkt 21fpkt", shape=diamond, color=yellow];
2041[label="45.252.197.138;d;14pkt 14fpkt", shape=diamond, color=yellow];
3148[label="45.252.197.138;d;14pkt 14fpkt", shape=hexagon, color=black];
4476[label="147.203.31.75;22pkt 22fpkt", shape=pentagon, color=darkviolet];
stat179[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.203.31.75:*, 45.252.197.138:995}[68.1818%]&lt;BR/&gt;{147.203.31.75:*, 99.7.137.181:9230}[22.7273%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 995: (40.1408%)&lt;BR/&gt; 9230: (7.04225%)&lt;BR/&gt; 4355: (2.8169%)&lt;BR/&gt; 4352: (2.8169%)&lt;BR/&gt; 4347: (2.8169%)&gt;];
}
2035--2041[label="1;14pkt 14fpkt"];
2035--3148[label="1;14pkt 14fpkt"];
2035--4476[label="1;21pkt 21fpkt"];
2041--3148[label="1;14pkt 14fpkt"];
2041--4476[label="1;14pkt 14fpkt"];
3148--4476[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter dst_ip="45.252.197.138" dst_port="995" src_ip="147.203.31.75"/>
      <filter dst_ip="99.7.137.181" dst_port="9230" src_ip="147.203.31.75"/>
    </slice>
    <from sec="1100149212" usec="0"/>
    <to sec="1100150078" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_181{
style=filled;
color=gray75;
2065[label="147.203.225.210;d;25pkt 25fpkt", shape=diamond, color=yellow];
2069[label="201.9.132.74;s;1pkt 1fpkt", shape=diamond, color=yellow];
2238[label="201.9.156.81;s;12pkt 12fpkt", shape=diamond, color=yellow];
stat181[shape=component, label=&lt;Rules:&lt;BR/&gt;{80.179.44.20:80, 147.203.225.210:*}[34.2857%]&lt;BR/&gt;{201.9.156.81:80, *:*}[34.2857%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2316: (2.63158%)&lt;BR/&gt; 2311: (2.63158%)&lt;BR/&gt; 2310: (2.63158%)&lt;BR/&gt; 62655: (1.31579%)&gt;];
}
2065--2069[label="1;1pkt 1fpkt"];
2065--2238[label="0.166667;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_ip="201.9.156.81" src_port="80"/>
      <filter dst_ip="147.203.225.210" src_ip="80.179.44.20" src_port="80"/>
    </slice>
    <from sec="1100149443" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.633119,1.23269,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_182{
style=filled;
color=gray75;
1957[label="147.203.231.83;d;6pkt 6fpkt", shape=diamond, color=yellow];
2099[label="65.196.105.225;s;4pkt 4fpkt", shape=diamond, color=yellow];
5330[label="65.196.105.225;3pkt 3fpkt", shape=pentagon, color=darkviolet];
6100[label="65.196.105.225;4pkt 4fpkt", shape=invtriangle, color=brown];
stat182[shape=component, label=&lt;Rules:&lt;BR/&gt;{65.196.105.225:80, 147.203.231.83:*}[66.6667%]&lt;BR/&gt;{82.232.213.236:80, 147.203.231.83:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1971: (11.7647%)&lt;BR/&gt; 1970: (11.7647%)&lt;BR/&gt; 1968: (11.7647%)&lt;BR/&gt; 1967: (8.82353%)&gt;];
}
1957--2099[label="1;4pkt 4fpkt"];
1957--5330[label="1;3pkt 3fpkt"];
1957--6100[label="1;4pkt 4fpkt"];
2099--5330[label="1;3pkt 3fpkt"];
2099--6100[label="1;4pkt 4fpkt"];
5330--6100[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="147.203.231.83" src_ip="65.196.105.225" src_port="80"/>
      <filter dst_ip="147.203.231.83" src_ip="82.232.213.236" src_port="80"/>
    </slice>
    <from sec="1100149560" usec="0"/>
    <to sec="1100149806" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_184{
style=filled;
color=gray75;
745[label="218.76.7.186;s;2pkt 2fpkt", shape=diamond, color=yellow];
2119[label="148.245.68.142;d;2pkt 2fpkt", shape=diamond, color=yellow];
3112[label="148.245.68.142;d;2pkt 2fpkt", shape=hexagon, color=black];
stat184[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.76.7.186:80, 148.245.68.142:19064}[50%]&lt;BR/&gt;{218.76.7.186:80, 148.245.68.142:19065}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 19065: (25%)&lt;BR/&gt; 19064: (25%)&gt;];
}
745--2119[label="1;2pkt 2fpkt"];
745--3112[label="1;2pkt 2fpkt"];
2119--3112[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="148.245.68.142" dst_port="19065" src_ip="218.76.7.186" src_port="80"/>
      <filter dst_ip="148.245.68.142" dst_port="19064" src_ip="218.76.7.186" src_port="80"/>
    </slice>
    <from sec="1100149676" usec="0"/>
    <to sec="1100149718" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_185{
style=filled;
color=gray75;
2118[label="218.76.7.186;d;2pkt 2fpkt", shape=diamond, color=yellow];
2120[label="148.245.68.142;s;2pkt 2fpkt", shape=diamond, color=yellow];
stat185[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.68.142:19064, 218.76.7.186:80}[50%]&lt;BR/&gt;{148.245.68.142:19065, 218.76.7.186:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 19065: (25%)&lt;BR/&gt; 19064: (25%)&gt;];
}
2118--2120[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="218.76.7.186" dst_port="80" src_ip="148.245.68.142" src_port="19065"/>
      <filter dst_ip="218.76.7.186" dst_port="80" src_ip="148.245.68.142" src_port="19064"/>
    </slice>
    <from sec="1100149676" usec="0"/>
    <to sec="1100149718" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_186{
style=filled;
color=gray75;
1977[label="201.9.156.255;d;2pkt 2fpkt", shape=diamond, color=yellow];
2130[label="165.16.134.174;s;2pkt 2fpkt", shape=diamond, color=yellow];
stat186[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.16.134.174:3466, 201.9.156.255:554}[50%]&lt;BR/&gt;{165.16.134.174:6970, 201.9.156.255:8078}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8078: (25%)&lt;BR/&gt; 6970: (25%)&lt;BR/&gt; 3466: (25%)&lt;BR/&gt; 554: (25%)&gt;];
}
1977--2130[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="201.9.156.255" dst_port="8078" src_ip="165.16.134.174" src_port="6970"/>
      <filter dst_ip="201.9.156.255" dst_port="554" src_ip="165.16.134.174" src_port="3466"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_188{
style=filled;
color=gray75;
1722[label="147.9.198.200;s;198pkt 198fpkt", shape=diamond, color=yellow];
2230[label="45.152.223.141;d;79pkt 79fpkt", shape=diamond, color=yellow];
stat188[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.9.198.200:*, 45.152.223.141:80}[39.196%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.4585%)&lt;BR/&gt; 8080: (0.541516%)&lt;BR/&gt; 58337: (0.361011%)&lt;BR/&gt; 58320: (0.361011%)&lt;BR/&gt; 58319: (0.361011%)&gt;];
}
1722--2230[label="0.987342;78pkt 78fpkt"];
1722--3549[label="0.116162;23pkt 23fpkt"];
1722--3555[label="0.131313;26pkt 26fpkt"];
1722--3770[label="0.116162;23pkt 23fpkt"];
1722--3775[label="0.131313;26pkt 26fpkt"];
1722--3982[label="0.116162;23pkt 23fpkt"];
1722--3986[label="0.131313;26pkt 26fpkt"];
2230--2407[label="0.0126582;1pkt 1fpkt"];
2230--3549[label="0.0126582;1pkt 1fpkt"];
2230--3770[label="0.0126582;1pkt 1fpkt"];
2230--3982[label="0.0126582;1pkt 1fpkt"];
2230--4430[label="0.0126582;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="45.152.223.141" dst_port="80" src_ip="147.9.198.200"/>
    </slice>
    <from sec="1100149256" usec="0"/>
    <to sec="1100149964" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.815594,1.29127,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_189{
style=filled;
color=gray75;
2273[label="80.37.67.42;s;6pkt 6fpkt", shape=diamond, color=yellow];
2274[label="147.203.229.156;d;7pkt 7fpkt", shape=diamond, color=yellow];
3242[label="80.37.67.42;s;6pkt 6fpkt", shape=hexagon, color=black];
4294[label="80.37.67.42;5pkt 5fpkt", shape=pentagon, color=darkviolet];
stat189[shape=component, label=&lt;Rules:&lt;BR/&gt;{80.37.67.42:80, 147.203.229.156:*}[85.7143%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3107: (8.33333%)&lt;BR/&gt; 3106: (8.33333%)&lt;BR/&gt; 3103: (8.33333%)&lt;BR/&gt; 3101: (8.33333%)&gt;];
}
2273--2274[label="1;6pkt 6fpkt"];
2273--3242[label="1;6pkt 6fpkt"];
2273--4294[label="1;5pkt 5fpkt"];
2274--3242[label="1;6pkt 6fpkt"];
2274--4294[label="1;5pkt 5fpkt"];
3242--4294[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="147.203.229.156" src_ip="80.37.67.42" src_port="80"/>
    </slice>
    <from sec="1100149692" usec="0"/>
    <to sec="1100149798" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_190{
style=filled;
color=gray75;
1989[label="147.9.180.85;s;22pkt 22fpkt", shape=diamond, color=yellow];
2279[label="83.209.172.162;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat190[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.9.180.85:80, 86.133.21.24:*}[63.6364%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 54328: (4.34783%)&lt;BR/&gt; 57709: (2.17391%)&lt;BR/&gt; 43346: (2.17391%)&lt;BR/&gt; 29159: (2.17391%)&gt;];
}
1989--2279[label="1;1pkt 1fpkt"];
1989--3353[label="0.0909091;2pkt 2fpkt"];
1989--3574[label="0.0909091;2pkt 2fpkt"];
1989--3792[label="0.0909091;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="86.133.21.24" src_ip="147.9.180.85" src_port="80"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100149889" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_191{
style=filled;
color=gray75;
2213[label="147.9.156.211;s;8pkt 8fpkt", shape=diamond, color=yellow];
2299[label="193.228.151.67;d;1pkt 1fpkt", shape=diamond, color=yellow];
3146[label="147.9.156.211;s;6pkt 6fpkt", shape=hexagon, color=black];
stat191[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.9.156.211:*, 82.81.250.173:995}[62.5%]&lt;BR/&gt;{147.9.156.211:*, *:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 995: (26.6667%)&lt;BR/&gt; 80: (16.6667%)&lt;BR/&gt; 1648: (10%)&lt;BR/&gt; 5190: (6.66667%)&lt;BR/&gt; 3175: (6.66667%)&gt;];
}
2213--2299[label="1;1pkt 1fpkt"];
2213--3146[label="1;6pkt 6fpkt"];
2299--3146[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="147.9.156.211"/>
      <filter dst_ip="82.81.250.173" dst_port="995" src_ip="147.9.156.211"/>
    </slice>
    <from sec="1100149231" usec="0"/>
    <to sec="1100149969" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,504,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_192{
style=filled;
color=gray75;
2308[label="207.223.73.161;d;5pkt 5fpkt", shape=diamond, color=yellow];
2309[label="214.161.195.247;s;5pkt 5fpkt", shape=diamond, color=yellow];
3171[label="207.223.73.161;d;5pkt 5fpkt", shape=hexagon, color=black];
stat192[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.161.195.247:3221, 207.223.73.161:443}[20%]&lt;BR/&gt;{214.161.195.247:3222, 207.223.73.161:443}[20%]&lt;BR/&gt;{214.161.195.247:3223, 207.223.73.161:443}[20%]&lt;BR/&gt;{214.161.195.247:3224, 207.223.73.161:443}[20%]&lt;BR/&gt;{214.161.195.247:3225, 207.223.73.161:443}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (50%)&lt;BR/&gt; 3225: (10%)&lt;BR/&gt; 3224: (10%)&lt;BR/&gt; 3223: (10%)&lt;BR/&gt; 3222: (10%)&gt;];
}
2308--2309[label="1;5pkt 5fpkt"];
2308--3171[label="1;5pkt 5fpkt"];
2309--3171[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="207.223.73.161" dst_port="443" src_ip="214.161.195.247" src_port="3225"/>
      <filter dst_ip="207.223.73.161" dst_port="443" src_ip="214.161.195.247" src_port="3224"/>
      <filter dst_ip="207.223.73.161" dst_port="443" src_ip="214.161.195.247" src_port="3223"/>
      <filter dst_ip="207.223.73.161" dst_port="443" src_ip="214.161.195.247" src_port="3222"/>
      <filter dst_ip="207.223.73.161" dst_port="443" src_ip="214.161.195.247" src_port="3221"/>
    </slice>
    <from sec="1100149796" usec="0"/>
    <to sec="1100149889" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.805151,1.21335,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_193{
style=filled;
color=gray75;
2280[label="215.26.201.97;s;5pkt 5fpkt", shape=diamond, color=yellow];
2310[label="82.234.173.141;d;4pkt 4fpkt", shape=diamond, color=yellow];
4624[label="215.26.201.97;34pkt 34fpkt", shape=pentagon, color=darkviolet];
5744[label="215.26.201.97;34pkt 34fpkt", shape=invtriangle, color=brown];
6327[label="215.26.201.97;34pkt 34fpkt", shape=invhouse, color=bisque];
stat193[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.26.201.97:*, 65.246.241.244:80}[26.4706%]&lt;BR/&gt;{215.26.201.97:*, 201.227.148.29:80}[20.5882%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 34719: (2.25225%)&lt;BR/&gt; 34718: (2.25225%)&lt;BR/&gt; 34717: (2.25225%)&lt;BR/&gt; 34716: (2.25225%)&gt;];
}
2280--2310[label="1;4pkt 4fpkt"];
2280--4624[label="1;5pkt 5fpkt"];
2280--5744[label="1;5pkt 5fpkt"];
2280--6327[label="1;5pkt 5fpkt"];
2310--4624[label="1;4pkt 4fpkt"];
2310--5744[label="1;4pkt 4fpkt"];
2310--6327[label="1;4pkt 4fpkt"];
4624--5744[label="1;34pkt 34fpkt"];
4624--6327[label="1;34pkt 34fpkt"];
5744--6327[label="1;34pkt 34fpkt"];
</description>
    <slice>
      <filter dst_ip="65.246.241.244" dst_port="80" src_ip="215.26.201.97"/>
      <filter dst_ip="201.227.148.29" dst_port="80" src_ip="215.26.201.97"/>
    </slice>
    <from sec="1100149264" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55074,1.28899,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_194{
style=filled;
color=gray75;
2623[label="207.171.147.253;d;111pkt 111fpkt", shape=diamond, color=yellow];
4124[label="128.0.102.18;14pkt 14fpkt", shape=pentagon, color=darkviolet];
5101[label="148.244.209.181;27pkt 27fpkt", shape=pentagon, color=darkviolet];
stat194[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.172.150.31:*, 207.171.147.253:80}[73.0263%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.3553%)&lt;BR/&gt; 2337: (0.657895%)&lt;BR/&gt; 123: (0.657895%)&lt;BR/&gt; 53: (0.657895%)&lt;BR/&gt; 40647: (0.328947%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="207.171.147.253" dst_port="80" src_ip="214.172.150.31"/>
    </slice>
    <from sec="1100149219" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.815594,1.29127,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_196{
style=filled;
color=gray75;
2155[label="148.244.13.82;s;5pkt 5fpkt", shape=diamond, color=yellow];
2326[label="80.42.100.250;d;3pkt 3fpkt", shape=diamond, color=yellow];
3194[label="80.42.100.250;d;3pkt 3fpkt", shape=hexagon, color=black];
4524[label="148.244.13.82;4pkt 4fpkt", shape=pentagon, color=darkviolet];
stat196[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.244.13.82:65356, 212.16.8.94:63205}[20%]&lt;BR/&gt;{148.244.13.82:65356, 141.83.45.235:60196}[20%]&lt;BR/&gt;{148.244.13.82:65356, 80.42.100.250:14788}[20%]&lt;BR/&gt;{148.244.13.82:65356, 80.42.100.250:14806}[20%]&lt;BR/&gt;{148.244.13.82:65356, 80.42.100.250:15086}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 65356: (50%)&lt;BR/&gt; 15086: (13.3333%)&lt;BR/&gt; 14806: (13.3333%)&lt;BR/&gt; 14788: (13.3333%)&lt;BR/&gt; 63205: (6.66667%)&gt;];
}
2155--2326[label="1;3pkt 3fpkt"];
2155--3194[label="1;3pkt 3fpkt"];
2155--4524[label="1;4pkt 4fpkt"];
2326--3194[label="1;3pkt 3fpkt"];
2326--4524[label="1;3pkt 3fpkt"];
3194--4524[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="80.42.100.250" dst_port="15086" src_ip="148.244.13.82" src_port="65356"/>
      <filter dst_ip="80.42.100.250" dst_port="14806" src_ip="148.244.13.82" src_port="65356"/>
      <filter dst_ip="80.42.100.250" dst_port="14788" src_ip="148.244.13.82" src_port="65356"/>
      <filter dst_ip="141.83.45.235" dst_port="60196" src_ip="148.244.13.82" src_port="65356"/>
      <filter dst_ip="212.16.8.94" dst_port="63205" src_ip="148.244.13.82" src_port="65356"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100149927" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_197{
style=filled;
color=gray75;
2353[label="10.3.241.250;d;183pkt 183fpkt", shape=diamond, color=yellow];
2354[label="148.245.16.26;s;211pkt 211fpkt", shape=diamond, color=yellow];
stat197[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.16.26:139, 10.3.241.250:*}[94.3128%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 139: (47.335%)&lt;BR/&gt; 80: (2.41117%)&lt;BR/&gt; 4958: (0.253807%)&lt;BR/&gt; 4945: (0.253807%)&lt;BR/&gt; 4935: (0.253807%)&gt;];
}
2353--2354[label="1;183pkt 183fpkt"];
2353--3549[label="0.00546448;1pkt 1fpkt"];
2353--3555[label="0.00546448;1pkt 1fpkt"];
2353--3770[label="0.00546448;1pkt 1fpkt"];
2353--3775[label="0.00546448;1pkt 1fpkt"];
2353--3982[label="0.00546448;1pkt 1fpkt"];
2353--3986[label="0.00546448;1pkt 1fpkt"];
2354--3549[label="0.00473934;1pkt 1fpkt"];
2354--3555[label="0.00473934;1pkt 1fpkt"];
2354--3770[label="0.00473934;1pkt 1fpkt"];
2354--3775[label="0.00473934;1pkt 1fpkt"];
2354--3982[label="0.00473934;1pkt 1fpkt"];
2354--3986[label="0.00473934;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="10.3.241.250" src_ip="148.245.16.26" src_port="139"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.805151,1.21335,053,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_198{
style=filled;
color=gray75;
2024[label="148.244.8.148;s;180pkt 180fpkt", shape=diamond, color=yellow];
2370[label="208.121.188.187;d;133pkt 133fpkt", shape=diamond, color=yellow];
4898[label="148.244.8.148;195pkt 195fpkt", shape=pentagon, color=darkviolet];
5872[label="148.244.8.148;195pkt 195fpkt", shape=invtriangle, color=brown];
6400[label="148.244.8.148;196pkt 196fpkt", shape=invhouse, color=bisque];
stat198[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.244.8.148:*, 208.121.188.187:80}[74.1117%]&lt;BR/&gt;{148.244.8.148:*, 208.121.188.188:80}[25.8883%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 37933: (0.278087%)&lt;BR/&gt; 37932: (0.278087%)&lt;BR/&gt; 37931: (0.278087%)&lt;BR/&gt; 37928: (0.278087%)&gt;];
}
2024--2370[label="1;133pkt 133fpkt"];
2024--3549[label="0.05;9pkt 9fpkt"];
2024--3555[label="0.0722222;13pkt 13fpkt"];
2024--3561[label="0.0888889;16pkt 16fpkt"];
2024--3770[label="0.05;9pkt 9fpkt"];
2024--3775[label="0.0722222;13pkt 13fpkt"];
2024--3781[label="0.0888889;16pkt 16fpkt"];
2024--3982[label="0.05;9pkt 9fpkt"];
2024--3986[label="0.0722222;13pkt 13fpkt"];
2024--3991[label="0.0888889;16pkt 16fpkt"];
2024--4898[label="0.988889;178pkt 178fpkt"];
2024--5872[label="0.988889;178pkt 178fpkt"];
2024--6400[label="0.994444;179pkt 179fpkt"];
2370--3549[label="0.0225564;3pkt 3fpkt"];
2370--3555[label="0.075188;10pkt 10fpkt"];
2370--3561[label="0.0977444;13pkt 13fpkt"];
2370--3770[label="0.0225564;3pkt 3fpkt"];
2370--3775[label="0.075188;10pkt 10fpkt"];
2370--3781[label="0.0977444;13pkt 13fpkt"];
2370--3982[label="0.0225564;3pkt 3fpkt"];
2370--3986[label="0.075188;10pkt 10fpkt"];
2370--3991[label="0.0977444;13pkt 13fpkt"];
2370--4898[label="0.992481;132pkt 132fpkt"];
2370--5872[label="0.992481;132pkt 132fpkt"];
2370--6400[label="0.992481;132pkt 132fpkt"];
4898--5872[label="1;195pkt 195fpkt"];
4898--6400[label="1;195pkt 195fpkt"];
5872--6400[label="1;195pkt 195fpkt"];
</description>
    <slice>
      <filter dst_ip="208.121.188.187" dst_port="80" src_ip="148.244.8.148"/>
      <filter dst_ip="208.121.188.188" dst_port="80" src_ip="148.244.8.148"/>
    </slice>
    <from sec="1100149204" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="128.0.217.204"/>
      <from sec="1100149212" usec="0"/>
      <to sec="1100150028" usec="0"/>
    </slice>
    <from sec="1100149212" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_200{
style=filled;
color=gray75;
2390[label="46.26.123.34;s;1pkt 1fpkt", shape=diamond, color=yellow];
2391[label="147.203.230.179;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat200[shape=component, label=&lt;Rules:&lt;BR/&gt;{46.26.123.34:554, 147.203.230.179:4831}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4831: (50%)&lt;BR/&gt; 554: (50%)&gt;];
}
2390--2391[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="147.203.230.179" dst_port="4831" src_ip="46.26.123.34" src_port="554"/>
    </slice>
    <from sec="1100149215" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_201{
style=filled;
color=gray75;
2389[label="46.26.123.34;d;1pkt 1fpkt", shape=diamond, color=yellow];
2392[label="147.203.230.179;s;1pkt 1fpkt", shape=diamond, color=yellow];
3219[label="147.203.230.179;s;1pkt 1fpkt", shape=hexagon, color=black];
stat201[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.203.230.179:4831, 46.26.123.34:554}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4831: (50%)&lt;BR/&gt; 554: (50%)&gt;];
}
2389--2392[label="1;1pkt 1fpkt"];
2389--3219[label="1;1pkt 1fpkt"];
2392--3219[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="46.26.123.34" dst_port="554" src_ip="147.203.230.179" src_port="4831"/>
    </slice>
    <from sec="1100149215" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_202{
style=filled;
color=gray75;
1846[label="165.16.145.125;s;135pkt 135fpkt", shape=diamond, color=yellow];
2429[label="41.179.19.58;d;106pkt 106fpkt", shape=diamond, color=yellow];
stat202[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.16.145.125:80, 41.179.19.58:*}[78.5185%]&lt;BR/&gt;{165.16.145.125:80, 41.75.13.191:*}[20.7407%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2022: (0.414938%)&lt;BR/&gt; 2021: (0.414938%)&lt;BR/&gt; 2020: (0.414938%)&lt;BR/&gt; 2018: (0.414938%)&gt;];
}
1846--2429[label="1;106pkt 106fpkt"];
1846--3353[label="0.0888889;12pkt 12fpkt"];
1846--3546[label="0.00740741;1pkt 1fpkt"];
1846--3574[label="0.0888889;12pkt 12fpkt"];
1846--3767[label="0.00740741;1pkt 1fpkt"];
1846--3792[label="0.0888889;12pkt 12fpkt"];
</description>
    <slice>
      <filter dst_ip="41.179.19.58" src_ip="165.16.145.125" src_port="80"/>
      <filter dst_ip="41.75.13.191" src_ip="165.16.145.125" src_port="80"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="214.172.149.20"/>
      <from sec="1100149685" usec="0"/>
      <to sec="1100149934" usec="0"/>
    </slice>
    <from sec="1100149685" usec="0"/>
    <to sec="1100149934" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_204{
style=filled;
color=gray75;
2453[label="80.37.28.200;s;8pkt 8fpkt", shape=diamond, color=yellow];
2454[label="148.245.140.45;d;8pkt 8fpkt", shape=diamond, color=yellow];
stat204[shape=component, label=&lt;Rules:&lt;BR/&gt;{80.37.28.200:80, 148.245.140.45:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1781: (6.25%)&lt;BR/&gt; 1780: (6.25%)&lt;BR/&gt; 1742: (6.25%)&lt;BR/&gt; 1741: (6.25%)&gt;];
}
2453--2454[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="148.245.140.45" src_ip="80.37.28.200" src_port="80"/>
    </slice>
    <from sec="1100149714" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_205{
style=filled;
color=gray75;
2464[label="148.245.145.149;d;10pkt 10fpkt", shape=diamond, color=yellow];
2465[label="65.89.206.217;s;30pkt 30fpkt", shape=diamond, color=yellow];
stat205[shape=component, label=&lt;Rules:&lt;BR/&gt;{65.89.206.217:80, 148.245.145.149:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3991: (2.5%)&lt;BR/&gt; 3990: (2.5%)&lt;BR/&gt; 3989: (2.5%)&lt;BR/&gt; 3988: (2.5%)&gt;];
}
2464--2465[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter dst_ip="148.245.145.149" src_ip="65.89.206.217" src_port="80"/>
    </slice>
    <from sec="1100149777" usec="0"/>
    <to sec="1100150005" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_206{
style=filled;
color=gray75;
2302[label="148.245.143.180;d;116pkt 116fpkt", shape=diamond, color=yellow];
2466[label="45.176.185.207;s;32pkt 32fpkt", shape=diamond, color=yellow];
stat206[shape=component, label=&lt;Rules:&lt;BR/&gt;{45.176.185.207:80, 148.245.143.180:*}[27.5862%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.6622%)&lt;BR/&gt; 2592: (0.675676%)&lt;BR/&gt; 2581: (0.675676%)&lt;BR/&gt; 2580: (0.675676%)&lt;BR/&gt; 2576: (0.675676%)&gt;];
}
2302--2466[label="1;32pkt 32fpkt"];
</description>
    <slice>
      <filter dst_ip="148.245.143.180" src_ip="45.176.185.207" src_port="80"/>
    </slice>
    <from sec="1100149779" usec="0"/>
    <to sec="1100149911" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_207{
style=filled;
color=gray75;
2286[label="214.172.8.154;s;9pkt 9fpkt", shape=diamond, color=yellow];
2467[label="194.212.225.54;d;1pkt 1fpkt", shape=diamond, color=yellow];
3246[label="194.212.225.54;d;1pkt 1fpkt", shape=hexagon, color=black];
stat207[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.172.8.154:*, 205.214.66.170:17338}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 27378: (13.6364%)&lt;BR/&gt; 4103: (13.6364%)&lt;BR/&gt; 17338: (9.09091%)&lt;BR/&gt; 32157: (4.54545%)&lt;BR/&gt; 24336: (4.54545%)&gt;];
}
2286--2467[label="1;1pkt 1fpkt"];
2286--3246[label="1;1pkt 1fpkt"];
2467--3246[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="205.214.66.170" dst_port="17338" src_ip="214.172.8.154"/>
    </slice>
    <from sec="1100149733" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_208{
style=filled;
color=gray75;
2481[label="192.5.146.28;d;270pkt 270fpkt", shape=diamond, color=yellow];
stat208[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.16.86.1:*, 192.5.146.28:80}[99.6296%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 38361: (0.185185%)&lt;BR/&gt; 3462: (0.185185%)&lt;BR/&gt; 3461: (0.185185%)&lt;BR/&gt; 3460: (0.185185%)&gt;];
}
2481--5044[label="0.0037037;1pkt 1fpkt"];
2481--5955[label="0.0037037;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="192.5.146.28" dst_port="80" src_ip="165.16.86.1"/>
    </slice>
    <from sec="1100149856" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="204.26.212.12"/>
      <from sec="1100149876" usec="0"/>
      <to sec="1100149986" usec="0"/>
    </slice>
    <from sec="1100149876" usec="0"/>
    <to sec="1100149986" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_210{
style=filled;
color=gray75;
2519[label="215.26.202.79;s;627pkt 627fpkt", shape=diamond, color=yellow];
stat210[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.26.202.79:0, *:0}[99.8405%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.8405%)&lt;BR/&gt; 3125: (0.0797448%)&lt;BR/&gt; 445: (0.0797448%)&gt;];
}
</description>
    <slice>
      <filter src_ip="215.26.202.79"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="215.26.202.34"/>
      <from sec="1100149201" usec="0"/>
      <to sec="1100150026" usec="0"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150026" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_212{
style=filled;
color=gray75;
1584[label="215.26.206.3;s;129pkt 129fpkt", shape=diamond, color=yellow];
2531[label="201.119.175.51;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat212[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.26.206.3:80, *:*}[40.3101%]&lt;BR/&gt;{215.26.206.3:2883, *:53}[27.1318%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (21.9231%)&lt;BR/&gt; 80: (20%)&lt;BR/&gt; 2883: (13.4615%)&lt;BR/&gt; 0: (10.7692%)&lt;BR/&gt; 21: (1.15385%)&gt;];
}
1584--2531[label="1;1pkt 1fpkt"];
1584--3353[label="0.0310078;4pkt 4fpkt"];
1584--3545[label="0.0155039;2pkt 2fpkt"];
1584--3546[label="0.0387597;5pkt 5fpkt"];
1584--3560[label="0.0542636;7pkt 7fpkt"];
1584--3574[label="0.0310078;4pkt 4fpkt"];
1584--3766[label="0.0155039;2pkt 2fpkt"];
1584--3767[label="0.0387597;5pkt 5fpkt"];
1584--3780[label="0.0542636;7pkt 7fpkt"];
1584--3792[label="0.0310078;4pkt 4fpkt"];
1584--3990[label="0.0542636;7pkt 7fpkt"];
</description>
    <slice>
      <filter src_ip="215.26.206.3" src_port="80"/>
      <filter dst_port="53" src_ip="215.26.206.3" src_port="2883"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150024" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="192.16.160.182"/>
      <from sec="1100149201" usec="0"/>
      <to sec="1100150027" usec="0"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="192.16.160.182"/>
      <from sec="1100149201" usec="0"/>
      <to sec="1100150027" usec="0"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="80.93.101.117"/>
      <from sec="1100149211" usec="0"/>
      <to sec="1100150028" usec="0"/>
    </slice>
    <from sec="1100149211" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55074,1.28899,501,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_216{
style=filled;
color=gray75;
2008[label="46.38.44.161;d;88pkt 88fpkt", shape=diamond, color=yellow];
2588[label="162.3.100.87;s;51pkt 51fpkt", shape=diamond, color=yellow];
4557[label="162.3.100.87;50pkt 50fpkt", shape=pentagon, color=darkviolet];
stat216[shape=component, label=&lt;Rules:&lt;BR/&gt;{162.3.100.87:*, 46.38.44.161:21}[52.2727%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (45.2381%)&lt;BR/&gt; 20: (4.7619%)&lt;BR/&gt; 2231: (0.793651%)&lt;BR/&gt; 2229: (0.793651%)&lt;BR/&gt; 2227: (0.793651%)&gt;];
}
2008--2588[label="1;51pkt 51fpkt"];
2008--4557[label="1;50pkt 50fpkt"];
2588--4557[label="1;50pkt 50fpkt"];
</description>
    <slice>
      <filter dst_ip="46.38.44.161" dst_port="21" src_ip="162.3.100.87"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150008" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="201.194.87.220"/>
      <from sec="1100149404" usec="0"/>
      <to sec="1100150028" usec="0"/>
    </slice>
    <from sec="1100149404" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_218{
style=filled;
color=gray75;
2614[label="209.228.72.214;s;12pkt 12fpkt", shape=diamond, color=yellow];
2615[label="148.245.167.30;d;14pkt 14fpkt", shape=diamond, color=yellow];
stat218[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.228.72.214:80, 148.245.167.30:*}[85.7143%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2260: (3.84615%)&lt;BR/&gt; 2259: (3.84615%)&lt;BR/&gt; 2258: (3.84615%)&lt;BR/&gt; 2257: (3.84615%)&gt;];
}
2614--2615[label="1;12pkt 12fpkt"];
</description>
    <slice>
      <filter dst_ip="148.245.167.30" src_ip="209.228.72.214" src_port="80"/>
    </slice>
    <from sec="1100149708" usec="0"/>
    <to sec="1100150019" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55074,1.28899,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_219{
style=filled;
color=gray75;
2345[label="214.172.27.214;s;106pkt 106fpkt", shape=diamond, color=yellow];
2631[label="199.156.37.28;d;63pkt 63fpkt", shape=diamond, color=yellow];
5279[label="214.172.27.214;127pkt 127fpkt", shape=pentagon, color=darkviolet];
stat219[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.172.27.214:80, 199.156.37.28:*}[61.7188%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.8176%)&lt;BR/&gt; 0: (2.36486%)&lt;BR/&gt; 2889: (0.506757%)&lt;BR/&gt; 2888: (0.506757%)&lt;BR/&gt; 2887: (0.506757%)&gt;];
}
2345--2631[label="1;63pkt 63fpkt"];
2345--3353[label="0.0188679;2pkt 2fpkt"];
2345--3546[label="0.0188679;2pkt 2fpkt"];
2345--3574[label="0.0188679;2pkt 2fpkt"];
2345--3767[label="0.0188679;2pkt 2fpkt"];
2345--3792[label="0.0188679;2pkt 2fpkt"];
2345--5279[label="0.990566;105pkt 105fpkt"];
2631--5279[label="1;63pkt 63fpkt"];
</description>
    <slice>
      <filter dst_ip="199.156.37.28" src_ip="214.172.27.214" src_port="80"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="201.1.195.205"/>
      <from sec="1100149884" usec="0"/>
      <to sec="1100150012" usec="0"/>
    </slice>
    <from sec="1100149884" usec="0"/>
    <to sec="1100150012" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_221{
style=filled;
color=gray75;
2658[label="143.178.131.134;d;122pkt 122fpkt", shape=diamond, color=yellow];
2659[label="148.245.167.14;s;124pkt 124fpkt", shape=diamond, color=yellow];
stat221[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.167.14:*, 143.178.131.134:80}[98.3871%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3850: (0.406504%)&lt;BR/&gt; 3849: (0.406504%)&lt;BR/&gt; 3848: (0.406504%)&lt;BR/&gt; 3847: (0.406504%)&gt;];
}
2658--2659[label="1;122pkt 122fpkt"];
</description>
    <slice>
      <filter dst_ip="143.178.131.134" dst_port="80" src_ip="148.245.167.14"/>
    </slice>
    <from sec="1100149926" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="148.245.142.174"/>
      <from sec="1100149947" usec="0"/>
      <to sec="1100150027" usec="0"/>
    </slice>
    <from sec="1100149947" usec="0"/>
    <to sec="1100150027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,504,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="147.9.142.175"/>
      <from sec="1100149955" usec="0"/>
      <to sec="1100150018" usec="0"/>
    </slice>
    <from sec="1100149955" usec="0"/>
    <to sec="1100150018" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="148.245.145.187"/>
      <from sec="1100149968" usec="0"/>
      <to sec="1100150028" usec="0"/>
    </slice>
    <from sec="1100149968" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.805151,1.21335,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_225{
style=filled;
color=gray75;
2045[label="147.203.224.88;s;65pkt 65fpkt", shape=diamond, color=yellow];
2680[label="87.169.117.14;d;5pkt 5fpkt", shape=diamond, color=yellow];
4569[label="147.203.224.88;94pkt 94fpkt", shape=pentagon, color=darkviolet];
5716[label="147.203.224.88;93pkt 93fpkt", shape=invtriangle, color=brown];
6311[label="147.203.224.88;93pkt 93fpkt", shape=invhouse, color=bisque];
stat225[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.203.224.88:*, *:80}[95.7447%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.7143%)&lt;BR/&gt; 5190: (1.71429%)&lt;BR/&gt; 63372: (0.714286%)&lt;BR/&gt; 63367: (0.714286%)&lt;BR/&gt; 63366: (0.714286%)&gt;];
}
2045--2680[label="1;5pkt 5fpkt"];
2045--3067[label="0.0615385;4pkt 4fpkt"];
2045--3555[label="0.0461538;3pkt 3fpkt"];
2045--3561[label="0.107692;7pkt 7fpkt"];
2045--3775[label="0.0461538;3pkt 3fpkt"];
2045--3781[label="0.107692;7pkt 7fpkt"];
2045--3986[label="0.0461538;3pkt 3fpkt"];
2045--3991[label="0.107692;7pkt 7fpkt"];
2045--4569[label="1;65pkt 65fpkt"];
2045--5716[label="0.984615;64pkt 64fpkt"];
2045--6311[label="0.984615;64pkt 64fpkt"];
2680--4569[label="1;5pkt 5fpkt"];
2680--5716[label="0.8;4pkt 4fpkt"];
2680--6311[label="0.8;4pkt 4fpkt"];
4569--5716[label="1;93pkt 93fpkt"];
4569--6311[label="1;93pkt 93fpkt"];
5716--6311[label="1;93pkt 93fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="147.203.224.88"/>
    </slice>
    <from sec="1100149242" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="209.149.76.3"/>
      <from sec="1100150002" usec="0"/>
      <to sec="1100150016" usec="0"/>
    </slice>
    <from sec="1100150002" usec="0"/>
    <to sec="1100150016" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="158.210.14.180"/>
      <from sec="1100150006" usec="0"/>
      <to sec="1100150025" usec="0"/>
    </slice>
    <from sec="1100150006" usec="0"/>
    <to sec="1100150025" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_229{
style=filled;
color=gray75;
689[label="219.229.46.107;s;229pkt 229fpkt", shape=diamond, color=yellow];
2716[label="219.229.46.107;s;207pkt 207fpkt", shape=hexagon, color=black];
stat229[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.229.46.107:6667, *:*}[33.6245%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (17.5459%)&lt;BR/&gt; 6668: (4.12844%)&lt;BR/&gt; 6661: (3.66972%)&lt;BR/&gt; 6666: (3.21101%)&lt;BR/&gt; 6665: (2.98165%)&gt;];
}
689--2716[label="1;207pkt 207fpkt"];
</description>
    <slice>
      <filter src_ip="219.229.46.107" src_port="6667"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.815594,1.29127,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_231{
style=filled;
color=gray75;
818[label="128.0.15.84;s;110pkt 110fpkt", shape=diamond, color=yellow];
2748[label="128.0.15.84;s;59pkt 59fpkt", shape=hexagon, color=black];
4534[label="128.0.15.84;115pkt 115fpkt", shape=pentagon, color=darkviolet];
stat231[shape=component, label=&lt;Rules:&lt;BR/&gt;{128.0.15.84:6899, *:6868}[51.3043%]&lt;BR/&gt;{128.0.15.84:6899, 41.80.143.43:*}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6899: (44.1901%)&lt;BR/&gt; 6868: (26.2324%)&lt;BR/&gt; 80: (5.80986%)&lt;BR/&gt; 1748: (1.40845%)&lt;BR/&gt; 63503: (0.528169%)&gt;];
}
818--2748[label="1;59pkt 59fpkt"];
818--3549[label="0.00909091;1pkt 1fpkt"];
818--3555[label="0.00909091;1pkt 1fpkt"];
818--3561[label="0.00909091;1pkt 1fpkt"];
818--3770[label="0.00909091;1pkt 1fpkt"];
818--3775[label="0.00909091;1pkt 1fpkt"];
818--3781[label="0.00909091;1pkt 1fpkt"];
818--3982[label="0.00909091;1pkt 1fpkt"];
818--3986[label="0.00909091;1pkt 1fpkt"];
818--3991[label="0.00909091;1pkt 1fpkt"];
818--4534[label="1;110pkt 110fpkt"];
2748--3549[label="0.0169492;1pkt 1fpkt"];
2748--3770[label="0.0169492;1pkt 1fpkt"];
2748--3982[label="0.0169492;1pkt 1fpkt"];
2748--4534[label="1;59pkt 59fpkt"];
</description>
    <slice>
      <filter dst_ip="41.80.143.43" src_ip="128.0.15.84" src_port="6899"/>
      <filter dst_port="6868" src_ip="128.0.15.84" src_port="6899"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_232{
style=filled;
color=gray75;
836[label="205.16.254.17;s;1560pkt 1560fpkt", shape=diamond, color=yellow];
1124[label="166.164.213.66;d;1617pkt 1617fpkt", shape=diamond, color=yellow];
2753[label="205.16.254.17;s;220pkt 220fpkt", shape=hexagon, color=black];
3052[label="166.164.213.66;d;1241pkt 1241fpkt", shape=hexagon, color=black];
stat232[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.16.254.17:*, 166.164.213.66:1433}[87.9369%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1433: (50%)&lt;BR/&gt; 29373: (0.0539025%)&lt;BR/&gt; 14665: (0.0539025%)&lt;BR/&gt; 11247: (0.0539025%)&lt;BR/&gt; 9285: (0.0539025%)&gt;];
}
836--1124[label="0.899359;1403pkt 1403fpkt"];
836--2753[label="1;220pkt 220fpkt"];
836--3052[label="0.862208;1070pkt 1070fpkt"];
1124--2753[label="1;220pkt 220fpkt"];
1124--3052[label="1;1241pkt 1241fpkt"];
2753--3052[label="1;220pkt 220fpkt"];
</description>
    <slice>
      <filter dst_ip="166.164.213.66" dst_port="1433" src_ip="205.16.254.17"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_235{
style=filled;
color=gray75;
1024[label="214.161.210.2;s;400pkt 400fpkt", shape=diamond, color=yellow];
2797[label="214.161.210.2;s;347pkt 347fpkt", shape=hexagon, color=black];
stat235[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.161.210.2:6346, *:6346}[51.75%]&lt;BR/&gt;{214.161.210.2:6346, *:6348}[22.5%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6346: (72.6908%)&lt;BR/&gt; 6348: (13.9893%)&lt;BR/&gt; 80: (2.27577%)&lt;BR/&gt; 6349: (1.80723%)&lt;BR/&gt; 6350: (0.60241%)&gt;];
}
1024--1883[label="0.00584795;1pkt 1fpkt"];
1024--2161[label="0.00862069;1pkt 1fpkt"];
1024--2692[label="0.005;2pkt 2fpkt"];
1024--2797[label="1;347pkt 347fpkt"];
1024--2848[label="0.0025;1pkt 1fpkt"];
1024--3023[label="0.0104167;1pkt 1fpkt"];
1024--3292[label="0.005;2pkt 2fpkt"];
1024--3341[label="0.0025;1pkt 1fpkt"];
1024--3555[label="0.0625;25pkt 25fpkt"];
1024--3775[label="0.0625;25pkt 25fpkt"];
1024--3986[label="0.0625;25pkt 25fpkt"];
</description>
    <slice>
      <filter dst_port="6346" src_ip="214.161.210.2" src_port="6346"/>
      <filter dst_port="6348" src_ip="214.161.210.2" src_port="6346"/>
    </slice>
    <from sec="1100149250" usec="0"/>
    <to sec="1100149578" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_239{
style=filled;
color=gray75;
828[label="147.203.33.165;s;595pkt 595fpkt", shape=diamond, color=yellow];
1112[label="82.138.184.237;d;264pkt 264fpkt", shape=diamond, color=yellow];
2750[label="147.203.33.165;s;108pkt 108fpkt", shape=hexagon, color=black];
2932[label="82.138.184.237;d;205pkt 205fpkt", shape=hexagon, color=black];
stat239[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.203.33.165:25, 82.138.184.237:*}[44.3697%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (48.8908%)&lt;BR/&gt; 1200: (1.10922%)&lt;BR/&gt; 53: (1.10922%)&lt;BR/&gt; 50884: (0.170648%)&lt;BR/&gt; 50494: (0.170648%)&gt;];
}
828--1112[label="1;264pkt 264fpkt"];
828--1708[label="0.0344828;1pkt 1fpkt"];
828--2750[label="1;108pkt 108fpkt"];
828--2932[label="1;205pkt 205fpkt"];
828--2970[label="0.0588235;1pkt 1fpkt"];
828--3356[label="0.00336134;2pkt 2fpkt"];
828--3559[label="0.00168067;1pkt 1fpkt"];
828--3560[label="0.00336134;2pkt 2fpkt"];
828--3577[label="0.00336134;2pkt 2fpkt"];
828--3779[label="0.00168067;1pkt 1fpkt"];
828--3780[label="0.00336134;2pkt 2fpkt"];
828--3795[label="0.00336134;2pkt 2fpkt"];
828--3990[label="0.00336134;2pkt 2fpkt"];
1112--2750[label="0.37963;41pkt 41fpkt"];
1112--2932[label="1;205pkt 205fpkt"];
2750--2932[label="0.37963;41pkt 41fpkt"];
2750--3356[label="0.0185185;2pkt 2fpkt"];
2750--3560[label="0.0185185;2pkt 2fpkt"];
2750--3577[label="0.0185185;2pkt 2fpkt"];
2750--3780[label="0.0185185;2pkt 2fpkt"];
2750--3795[label="0.0185185;2pkt 2fpkt"];
2750--3990[label="0.0185185;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="82.138.184.237" src_ip="147.203.33.165" src_port="25"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_243{
style=filled;
color=gray75;
1836[label="83.2.199.131;d;14pkt 14fpkt", shape=diamond, color=yellow];
1837[label="165.16.103.37;s;14pkt 14fpkt", shape=diamond, color=yellow];
3007[label="83.2.199.131;d;8pkt 8fpkt", shape=hexagon, color=black];
stat243[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.16.103.37:*, 83.2.199.131:9000}[87.5%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9000: (47.2222%)&lt;BR/&gt; 33203: (4.16667%)&lt;BR/&gt; 33202: (4.16667%)&lt;BR/&gt; 33201: (4.16667%)&lt;BR/&gt; 33200: (4.16667%)&gt;];
}
1836--1837[label="0.857143;12pkt 12fpkt"];
1836--3007[label="1;8pkt 8fpkt"];
1837--3007[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="83.2.199.131" dst_port="9000" src_ip="165.16.103.37"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150021" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.815594,1.29127,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_244{
style=filled;
color=gray75;
1869[label="148.245.173.92;s;41pkt 41fpkt", shape=diamond, color=yellow];
2269[label="205.228.62.208;d;19pkt 19fpkt", shape=diamond, color=yellow];
3016[label="148.245.173.92;s;39pkt 39fpkt", shape=hexagon, color=black];
4598[label="148.245.173.92;49pkt 49fpkt", shape=pentagon, color=darkviolet];
stat244[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.173.92:*, 205.228.62.208:80}[38.7755%]&lt;BR/&gt;{148.245.173.92:*, 156.194.173.233:80}[30.6122%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1755: (1.35135%)&lt;BR/&gt; 1754: (1.35135%)&lt;BR/&gt; 1753: (1.35135%)&lt;BR/&gt; 1752: (1.35135%)&gt;];
}
1869--2269[label="0.578947;11pkt 11fpkt"];
1869--3016[label="1;39pkt 39fpkt"];
1869--3549[label="0.0487805;2pkt 2fpkt"];
1869--3555[label="0.0731707;3pkt 3fpkt"];
1869--3770[label="0.0487805;2pkt 2fpkt"];
1869--3775[label="0.0731707;3pkt 3fpkt"];
1869--3982[label="0.0487805;2pkt 2fpkt"];
1869--3986[label="0.0731707;3pkt 3fpkt"];
1869--4598[label="1;41pkt 41fpkt"];
2269--3016[label="0.473684;9pkt 9fpkt"];
2269--4598[label="1;19pkt 19fpkt"];
3016--3549[label="0.0512821;2pkt 2fpkt"];
3016--3555[label="0.0769231;3pkt 3fpkt"];
3016--3770[label="0.0512821;2pkt 2fpkt"];
3016--3775[label="0.0769231;3pkt 3fpkt"];
3016--3982[label="0.0512821;2pkt 2fpkt"];
3016--3986[label="0.0769231;3pkt 3fpkt"];
3016--4598[label="1;39pkt 39fpkt"];
</description>
    <slice>
      <filter dst_ip="205.228.62.208" dst_port="80" src_ip="148.245.173.92"/>
      <filter dst_ip="156.194.173.233" dst_port="80" src_ip="148.245.173.92"/>
    </slice>
    <from sec="1100149204" usec="0"/>
    <to sec="1100150081" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.815594,1.29127,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_245{
style=filled;
color=gray75;
1276[label="148.245.138.48;s;171pkt 171fpkt", shape=diamond, color=yellow];
1343[label="172.10.110.131;d;63pkt 63fpkt", shape=diamond, color=yellow];
3024[label="148.245.138.48;s;138pkt 138fpkt", shape=hexagon, color=black];
4319[label="148.245.138.48;174pkt 174fpkt", shape=pentagon, color=darkviolet];
stat245[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.138.48:*, 172.10.110.131:80}[56%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2124: (0.3663%)&lt;BR/&gt; 2123: (0.3663%)&lt;BR/&gt; 2122: (0.3663%)&lt;BR/&gt; 2121: (0.3663%)&gt;];
}
1276--1343[label="1;63pkt 63fpkt"];
1276--2848[label="0.0116959;2pkt 2fpkt"];
1276--3024[label="1;138pkt 138fpkt"];
1276--3341[label="0.0116959;2pkt 2fpkt"];
1276--3549[label="0.0818713;14pkt 14fpkt"];
1276--3555[label="0.0643275;11pkt 11fpkt"];
1276--3770[label="0.0818713;14pkt 14fpkt"];
1276--3775[label="0.0643275;11pkt 11fpkt"];
1276--3982[label="0.0818713;14pkt 14fpkt"];
1276--3986[label="0.0643275;11pkt 11fpkt"];
1276--4319[label="0.994152;170pkt 170fpkt"];
1343--3024[label="1;63pkt 63fpkt"];
1343--3549[label="0.206349;13pkt 13fpkt"];
1343--3555[label="0.174603;11pkt 11fpkt"];
1343--3770[label="0.206349;13pkt 13fpkt"];
1343--3775[label="0.174603;11pkt 11fpkt"];
1343--3982[label="0.206349;13pkt 13fpkt"];
1343--3986[label="0.174603;11pkt 11fpkt"];
1343--4319[label="1;63pkt 63fpkt"];
3024--3341[label="0.0144928;2pkt 2fpkt"];
3024--3549[label="0.101449;14pkt 14fpkt"];
3024--3555[label="0.0797101;11pkt 11fpkt"];
3024--3770[label="0.101449;14pkt 14fpkt"];
3024--3775[label="0.0797101;11pkt 11fpkt"];
3024--3982[label="0.101449;14pkt 14fpkt"];
3024--3986[label="0.0797101;11pkt 11fpkt"];
3024--4319[label="0.992754;137pkt 137fpkt"];
</description>
    <slice>
      <filter dst_ip="172.10.110.131" dst_port="80" src_ip="148.245.138.48"/>
    </slice>
    <from sec="1100149216" usec="0"/>
    <to sec="1100150095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.815594,1.29127,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_248{
style=filled;
color=gray75;
700[label="64.47.206.157;d;1pkt 1fpkt", shape=diamond, color=yellow];
701[label="148.244.10.207;s;139pkt 139fpkt", shape=diamond, color=yellow];
1009[label="68.248.106.34;d;1pkt 1fpkt", shape=diamond, color=yellow];
1110[label="193.151.123.136;d;3pkt 3fpkt", shape=diamond, color=yellow];
1224[label="80.122.73.28;d;1pkt 1fpkt", shape=diamond, color=yellow];
1456[label="86.65.73.147;d;1pkt 1fpkt", shape=diamond, color=yellow];
1494[label="41.150.157.66;d;1pkt 1fpkt", shape=diamond, color=yellow];
1590[label="41.208.60.99;d;2pkt 2fpkt", shape=diamond, color=yellow];
1643[label="141.83.175.2;d;1pkt 1fpkt", shape=diamond, color=yellow];
1647[label="86.70.124.235;d;2pkt 2fpkt", shape=diamond, color=yellow];
1664[label="41.144.104.95;d;1pkt 1fpkt", shape=diamond, color=yellow];
1714[label="65.141.41.64;d;1pkt 1fpkt", shape=diamond, color=yellow];
1798[label="86.162.219.146;d;1pkt 1fpkt", shape=diamond, color=yellow];
1985[label="86.68.180.77;d;1pkt 1fpkt", shape=diamond, color=yellow];
2052[label="214.222.230.30;d;1pkt 1fpkt", shape=diamond, color=yellow];
2195[label="80.221.210.65;d;2pkt 2fpkt", shape=diamond, color=yellow];
2215[label="81.96.103.37;d;1pkt 1fpkt", shape=diamond, color=yellow];
2330[label="66.85.163.176;d;1pkt 1fpkt", shape=diamond, color=yellow];
2361[label="200.161.98.93;d;1pkt 1fpkt", shape=diamond, color=yellow];
2540[label="64.47.0.127;d;1pkt 1fpkt", shape=diamond, color=yellow];
2541[label="86.57.140.198;d;1pkt 1fpkt", shape=diamond, color=yellow];
2599[label="41.143.217.217;d;2pkt 2fpkt", shape=diamond, color=yellow];
2927[label="41.208.60.99;d;1pkt 1fpkt", shape=hexagon, color=black];
2967[label="41.150.157.66;d;1pkt 1fpkt", shape=hexagon, color=black];
2972[label="68.248.106.34;d;1pkt 1fpkt", shape=hexagon, color=black];
3009[label="80.122.73.28;d;1pkt 1fpkt", shape=hexagon, color=black];
3046[label="64.47.206.157;d;1pkt 1fpkt", shape=hexagon, color=black];
3078[label="86.65.73.147;d;1pkt 1fpkt", shape=hexagon, color=black];
3098[label="214.222.230.30;d;1pkt 1fpkt", shape=hexagon, color=black];
3139[label="80.221.210.65;d;2pkt 2fpkt", shape=hexagon, color=black];
3195[label="66.85.163.176;d;1pkt 1fpkt", shape=hexagon, color=black];
5234[label="148.244.10.207;229pkt 229fpkt", shape=pentagon, color=darkviolet];
stat248[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.244.10.207:*, *:6881}[37.1179%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6881: (19.0123%)&lt;BR/&gt; 6882: (4.93827%)&lt;BR/&gt; 6883: (2.34568%)&lt;BR/&gt; 6884: (1.48148%)&lt;BR/&gt; 6886: (1.35802%)&gt;];
}
700--701[label="1;1pkt 1fpkt"];
700--3046[label="1;1pkt 1fpkt"];
700--5234[label="1;1pkt 1fpkt"];
701--1009[label="1;1pkt 1fpkt"];
701--1110[label="1;3pkt 3fpkt"];
701--1224[label="1;1pkt 1fpkt"];
701--1456[label="1;1pkt 1fpkt"];
701--1494[label="1;1pkt 1fpkt"];
701--1590[label="0.5;1pkt 1fpkt"];
701--1643[label="1;1pkt 1fpkt"];
701--1647[label="0.5;1pkt 1fpkt"];
701--1664[label="1;1pkt 1fpkt"];
701--1714[label="1;1pkt 1fpkt"];
701--1798[label="1;1pkt 1fpkt"];
701--1985[label="1;1pkt 1fpkt"];
701--2052[label="1;1pkt 1fpkt"];
701--2195[label="0.5;1pkt 1fpkt"];
701--2215[label="1;1pkt 1fpkt"];
701--2330[label="1;1pkt 1fpkt"];
701--2361[label="1;1pkt 1fpkt"];
701--2540[label="1;1pkt 1fpkt"];
701--2541[label="1;1pkt 1fpkt"];
701--2599[label="0.5;1pkt 1fpkt"];
701--2927[label="1;1pkt 1fpkt"];
701--2967[label="1;1pkt 1fpkt"];
701--2972[label="1;1pkt 1fpkt"];
701--3009[label="1;1pkt 1fpkt"];
701--3046[label="1;1pkt 1fpkt"];
701--3078[label="1;1pkt 1fpkt"];
701--3098[label="1;1pkt 1fpkt"];
701--3139[label="0.5;1pkt 1fpkt"];
701--3195[label="1;1pkt 1fpkt"];
701--5234[label="1;139pkt 139fpkt"];
1009--2972[label="1;1pkt 1fpkt"];
1009--5234[label="1;1pkt 1fpkt"];
1110--5234[label="1;3pkt 3fpkt"];
1224--3009[label="1;1pkt 1fpkt"];
1224--5234[label="1;1pkt 1fpkt"];
1456--3078[label="1;1pkt 1fpkt"];
1456--5234[label="1;1pkt 1fpkt"];
1494--2967[label="1;1pkt 1fpkt"];
1494--5234[label="1;1pkt 1fpkt"];
1590--2927[label="1;1pkt 1fpkt"];
1590--5234[label="1;2pkt 2fpkt"];
1643--5234[label="1;1pkt 1fpkt"];
1647--5234[label="1;2pkt 2fpkt"];
1664--5234[label="1;1pkt 1fpkt"];
1714--5234[label="1;1pkt 1fpkt"];
1798--5234[label="1;1pkt 1fpkt"];
1985--5234[label="1;1pkt 1fpkt"];
2052--3098[label="1;1pkt 1fpkt"];
2052--5234[label="1;1pkt 1fpkt"];
2195--3139[label="1;2pkt 2fpkt"];
2195--5234[label="1;2pkt 2fpkt"];
2215--5234[label="1;1pkt 1fpkt"];
2330--3195[label="1;1pkt 1fpkt"];
2330--5234[label="1;1pkt 1fpkt"];
2361--5234[label="1;1pkt 1fpkt"];
2540--5234[label="1;1pkt 1fpkt"];
2541--5234[label="1;1pkt 1fpkt"];
2599--5234[label="1;2pkt 2fpkt"];
2927--5234[label="1;1pkt 1fpkt"];
2967--5234[label="1;1pkt 1fpkt"];
2972--5234[label="1;1pkt 1fpkt"];
3009--5234[label="1;1pkt 1fpkt"];
3046--5234[label="1;1pkt 1fpkt"];
3078--5234[label="1;1pkt 1fpkt"];
3098--5234[label="1;1pkt 1fpkt"];
3139--5234[label="1;2pkt 2fpkt"];
3195--5234[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="6881" src_ip="148.244.10.207"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.815594,1.29127,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_249{
style=filled;
color=gray75;
1987[label="147.9.212.171;s;23pkt 23fpkt", shape=diamond, color=yellow];
3057[label="147.9.212.171;s;17pkt 17fpkt", shape=hexagon, color=black];
5041[label="147.9.212.171;25pkt 25fpkt", shape=pentagon, color=darkviolet];
stat249[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.9.212.171:*, 158.218.160.233:995}[53.8462%]&lt;BR/&gt;{147.9.212.171:*, 201.62.227.154:110}[26.9231%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 995: (26.1538%)&lt;BR/&gt; 110: (15.3846%)&lt;BR/&gt; 80: (3.84615%)&lt;BR/&gt; 5190: (2.30769%)&lt;BR/&gt; 1873: (2.30769%)&gt;];
}
1987--3057[label="1;17pkt 17fpkt"];
1987--5041[label="0.956522;22pkt 22fpkt"];
3057--5041[label="0.941176;16pkt 16fpkt"];
</description>
    <slice>
      <filter dst_ip="158.218.160.233" dst_port="995" src_ip="147.9.212.171"/>
      <filter dst_ip="201.62.227.154" dst_port="110" src_ip="147.9.212.171"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55074,1.28899,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_250{
style=filled;
color=gray75;
1968[label="194.170.100.19;s;5pkt 5fpkt", shape=diamond, color=yellow];
2077[label="165.16.17.132;d;110pkt 110fpkt", shape=diamond, color=yellow];
2248[label="194.170.100.202;s;84pkt 84fpkt", shape=diamond, color=yellow];
5208[label="194.170.100.202;101pkt 101fpkt", shape=pentagon, color=darkviolet];
stat250[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.170.100.202:80, 165.16.17.132:*}[65.625%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2515: (0.5%)&lt;BR/&gt; 2514: (0.5%)&lt;BR/&gt; 2513: (0.5%)&lt;BR/&gt; 2512: (0.5%)&gt;];
}
1968--2077[label="0.8;4pkt 4fpkt"];
2077--2248[label="1;84pkt 84fpkt"];
2077--5208[label="0.831683;84pkt 84fpkt"];
2248--5208[label="1;84pkt 84fpkt"];
</description>
    <slice>
      <filter dst_ip="165.16.17.132" src_ip="194.170.100.202" src_port="80"/>
    </slice>
    <from sec="1100149316" usec="0"/>
    <to sec="1100149861" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_252{
style=filled;
color=gray75;
1965[label="197.33.26.204;d;99pkt 99fpkt", shape=diamond, color=yellow];
3160[label="197.33.26.204;d;99pkt 99fpkt", shape=hexagon, color=black];
stat252[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.140.95:*, 197.33.26.204:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4230: (0.505051%)&lt;BR/&gt; 4228: (0.505051%)&lt;BR/&gt; 4227: (0.505051%)&lt;BR/&gt; 4223: (0.505051%)&gt;];
}
1965--3160[label="1;99pkt 99fpkt"];
1965--3561[label="0.040404;4pkt 4fpkt"];
1965--3781[label="0.040404;4pkt 4fpkt"];
1965--3991[label="0.040404;4pkt 4fpkt"];
3160--3561[label="0.040404;4pkt 4fpkt"];
3160--3781[label="0.040404;4pkt 4fpkt"];
3160--3991[label="0.040404;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="197.33.26.204" dst_port="80" src_ip="148.245.140.95"/>
    </slice>
    <from sec="1100149586" usec="0"/>
    <to sec="1100149733" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_253{
style=filled;
color=gray75;
1979[label="215.26.200.66;d;145pkt 145fpkt", shape=diamond, color=yellow];
3178[label="215.26.200.66;d;145pkt 145fpkt", shape=hexagon, color=black];
stat253[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 215.26.200.66:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1979--3178[label="1;145pkt 145fpkt"];
</description>
    <slice>
      <filter dst_ip="215.26.200.66"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_254{
style=filled;
color=gray75;
1991[label="215.26.207.26;d;147pkt 147fpkt", shape=diamond, color=yellow];
3193[label="215.26.207.26;d;147pkt 147fpkt", shape=hexagon, color=black];
stat254[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 215.26.207.26:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1991--3193[label="1;147pkt 147fpkt"];
</description>
    <slice>
      <filter dst_ip="215.26.207.26"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,010,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_255{
style=filled;
color=gray75;
2339[label="10.0.1.128;d;183pkt 183fpkt", shape=diamond, color=yellow];
3199[label="10.0.1.128;d;166pkt 166fpkt", shape=hexagon, color=black];
stat255[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 10.0.1.128:12000}[28.4153%]&lt;BR/&gt;{165.27.3.53:*, 10.0.1.128:7569}[20.2186%]&lt;BR/&gt;{165.27.216.212:*, 10.0.1.128:7569}[20.2186%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7569: (29.7994%)&lt;BR/&gt; 12000: (14.4699%)&lt;BR/&gt; 6667: (4.58453%)&lt;BR/&gt; 25: (1.14613%)&lt;BR/&gt; 3732: (0.573066%)&gt;];
}
2339--2526[label="0.0298507;2pkt 2fpkt"];
2339--3199[label="1;166pkt 166fpkt"];
</description>
    <slice>
      <filter dst_ip="10.0.1.128" dst_port="12000"/>
      <filter dst_ip="10.0.1.128" dst_port="7569" src_ip="165.27.216.212"/>
      <filter dst_ip="10.0.1.128" dst_port="7569" src_ip="165.27.3.53"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_257{
style=filled;
color=gray75;
1807[label="128.0.75.177;d;34pkt 34fpkt", shape=diamond, color=yellow];
3255[label="128.0.75.177;d;34pkt 34fpkt", shape=hexagon, color=black];
stat257[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 128.0.75.177:44168}[91.1765%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 44168: (45.5882%)&lt;BR/&gt; 80: (2.94118%)&lt;BR/&gt; 63176: (1.47059%)&lt;BR/&gt; 63088: (1.47059%)&lt;BR/&gt; 62777: (1.47059%)&gt;];
}
1807--3255[label="1;34pkt 34fpkt"];
1807--3555[label="0.0294118;1pkt 1fpkt"];
1807--3775[label="0.0294118;1pkt 1fpkt"];
1807--3986[label="0.0294118;1pkt 1fpkt"];
3255--3555[label="0.0294118;1pkt 1fpkt"];
3255--3775[label="0.0294118;1pkt 1fpkt"];
3255--3986[label="0.0294118;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="128.0.75.177" dst_port="44168"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150013" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_259{
style=filled;
color=gray75;
2630[label="162.3.13.115;s;1pkt 1fpkt", shape=diamond, color=yellow];
3284[label="162.3.13.115;s;1pkt 1fpkt", shape=hexagon, color=black];
stat259[shape=component, label=&lt;Rules:&lt;BR/&gt;{162.3.13.115:55002, 192.5.168.218:5999}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 55002: (50%)&lt;BR/&gt; 5999: (50%)&gt;];
}
2630--3284[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="192.5.168.218" dst_port="5999" src_ip="162.3.13.115" src_port="55002"/>
    </slice>
    <from sec="1100149796" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.163.131.0"/>
    </slice>
    <from sec="1100149866" usec="0"/>
    <to sec="1100150094" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.15.209.0"/>
    </slice>
    <from sec="1100149291" usec="0"/>
    <to sec="1100149303" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="147.203.227.1"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100149322" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.197.237.1"/>
    </slice>
    <from sec="1100149498" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55074,1.28899,020,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_314{
style=filled;
color=gray75;
1844[label="219.64.37.5;s;364pkt 364fpkt", shape=diamond, color=yellow];
4029[label="219.64.37.5;506pkt 506fpkt", shape=pentagon, color=darkviolet];
stat314[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.64.37.5:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1844--4029[label="1;364pkt 364fpkt"];
</description>
    <slice>
      <filter src_ip="219.64.37.5"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.704383,1.30815,010,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_315{
style=filled;
color=gray75;
154[label="204.35.192.5s;155pkt 155fpkt", shape=rectangle, color=red];
4030[label="204.35.192.5;358pkt 358fpkt", shape=pentagon, color=darkviolet];
stat315[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.35.192.5:*, *:135}[51.3966%]&lt;BR/&gt;{204.35.192.5:*, *:445}[48.6034%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (26.0234%)&lt;BR/&gt; 445: (23.9766%)&lt;BR/&gt; 2877: (0.194932%)&lt;BR/&gt; 2876: (0.194932%)&lt;BR/&gt; 2875: (0.194932%)&gt;];
}
154--4030[label="1;155pkt 155fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="204.35.192.5"/>
      <filter dst_port="445" src_ip="204.35.192.5"/>
    </slice>
    <from sec="1100150057" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="207.249.161.6"/>
    </slice>
    <from sec="1100149713" usec="0"/>
    <to sec="1100149751" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742121,1.2705,999,0 0 0 1 0 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_317{
style=filled;
color=gray75;
1366[label="214.161.209.6;s;847pkt 847fpkt", shape=diamond, color=yellow];
4038[label="214.161.209.6;1110pkt 1110fpkt", shape=pentagon, color=darkviolet];
6164[label="214.161.209.6;1085pkt 1085fpkt", shape=invhouse, color=bisque];
stat317[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.161.209.6:53, *:*}[99.009%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (55.5391%)&lt;BR/&gt; 32768: (2.16963%)&lt;BR/&gt; 32769: (1.10125%)&lt;BR/&gt; 0: (1.01907%)&lt;BR/&gt; 9253: (0.723208%)&gt;];
}
1366--3356[label="0.0106257;9pkt 9fpkt"];
1366--3545[label="0.0897285;76pkt 76fpkt"];
1366--3560[label="0.0106257;9pkt 9fpkt"];
1366--3577[label="0.0106257;9pkt 9fpkt"];
1366--3766[label="0.0897285;76pkt 76fpkt"];
1366--3780[label="0.0106257;9pkt 9fpkt"];
1366--3795[label="0.0106257;9pkt 9fpkt"];
1366--3990[label="0.0106257;9pkt 9fpkt"];
1366--4038[label="1;847pkt 847fpkt"];
1366--6164[label="1;847pkt 847fpkt"];
4038--6164[label="1;1085pkt 1085fpkt"];
</description>
    <slice>
      <filter src_ip="214.161.209.6" src_port="53"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55074,1.28899,020,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_318{
style=filled;
color=gray75;
2352[label="215.26.202.8;s;429pkt 429fpkt", shape=diamond, color=yellow];
4050[label="215.26.202.8;466pkt 466fpkt", shape=pentagon, color=darkviolet];
stat318[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.26.202.8:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2352--4050[label="0.997669;428pkt 428fpkt"];
</description>
    <slice>
      <filter src_ip="215.26.202.8"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.704383,1.30815,001,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_320{
style=filled;
color=gray75;
160[label="195.123.136.10s;921pkt 921fpkt", shape=rectangle, color=red];
4067[label="195.123.136.10;921pkt 921fpkt", shape=pentagon, color=darkviolet];
stat320[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.123.136.10:*, *:5554}[50.5972%]&lt;BR/&gt;{195.123.136.10:*, *:9898}[49.4028%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (25.2986%)&lt;BR/&gt; 9898: (24.7014%)&lt;BR/&gt; 4979: (0.108578%)&lt;BR/&gt; 4923: (0.108578%)&lt;BR/&gt; 4892: (0.108578%)&gt;];
}
160--4067[label="1;921pkt 921fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="195.123.136.10"/>
      <filter dst_port="9898" src_ip="195.123.136.10"/>
    </slice>
    <from sec="1100149767" usec="0"/>
    <to sec="1100150101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.704383,1.30815,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_321{
style=filled;
color=gray75;
107[label="86.133.16.11s;133pkt 133fpkt", shape=rectangle, color=red];
4073[label="86.133.16.11;174pkt 174fpkt", shape=pentagon, color=darkviolet];
stat321[shape=component, label=&lt;Rules:&lt;BR/&gt;{86.133.16.11:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
107--4073[label="1;133pkt 133fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="86.133.16.11" src_port="1025"/>
    </slice>
    <from sec="1100149715" usec="0"/>
    <to sec="1100149751" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="148.244.167.12"/>
    </slice>
    <from sec="1100149232" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.33.52.15"/>
    </slice>
    <from sec="1100149843" usec="0"/>
    <to sec="1100149845" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="87.17.15.16"/>
    </slice>
    <from sec="1100149258" usec="0"/>
    <to sec="1100149620" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="82.45.99.16"/>
    </slice>
    <from sec="1100150094" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.161.210.16"/>
    </slice>
    <from sec="1100149207" usec="0"/>
    <to sec="1100150095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="148.245.208.17"/>
    </slice>
    <from sec="1100149207" usec="0"/>
    <to sec="1100150014" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.167.10.18"/>
    </slice>
    <from sec="1100149202" usec="0"/>
    <to sec="1100149241" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="162.3.56.18"/>
    </slice>
    <from sec="1100149219" usec="0"/>
    <to sec="1100150076" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.7.149.18"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.15.199.18"/>
    </slice>
    <from sec="1100149204" usec="0"/>
    <to sec="1100150096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,001,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_334{
style=filled;
color=gray75;
4132[label="197.62.249.18;104pkt 104fpkt", shape=pentagon, color=darkviolet];
stat334[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.62.249.18:*, *:9898}[98.0769%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (49.0385%)&lt;BR/&gt; 5554: (0.480769%)&lt;BR/&gt; 4639: (0.480769%)&lt;BR/&gt; 3423: (0.480769%)&lt;BR/&gt; 2948: (0.480769%)&gt;];
}
</description>
    <slice>
      <filter dst_port="9898" src_ip="197.62.249.18"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100149373" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="193.74.2.19"/>
    </slice>
    <from sec="1100149235" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55074,1.28899,020,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_336{
style=filled;
color=gray75;
2139[label="215.26.207.19;s;87pkt 87fpkt", shape=diamond, color=yellow];
4137[label="215.26.207.19;92pkt 92fpkt", shape=pentagon, color=darkviolet];
stat336[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.26.207.19:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2139--4137[label="0.988506;86pkt 86fpkt"];
</description>
    <slice>
      <filter src_ip="215.26.207.19"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150081" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.26.205.20"/>
    </slice>
    <from sec="1100149205" usec="0"/>
    <to sec="1100150060" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="80.179.44.21"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,001,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.10.148.22"/>
    </slice>
    <from sec="1100149776" usec="0"/>
    <to sec="1100149814" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.138.86.23"/>
    </slice>
    <from sec="1100149933" usec="0"/>
    <to sec="1100150000" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="148.245.164.25"/>
    </slice>
    <from sec="1100149214" usec="0"/>
    <to sec="1100150012" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.15.9.26"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="148.245.148.26"/>
    </slice>
    <from sec="1100149945" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="87.131.85.27"/>
    </slice>
    <from sec="1100149908" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="128.34.11.28"/>
    </slice>
    <from sec="1100149203" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="207.57.139.28"/>
    </slice>
    <from sec="1100149203" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.704383,1.30815,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_349{
style=filled;
color=gray75;
169[label="162.3.21.29s;216pkt 216fpkt", shape=rectangle, color=red];
4210[label="45.165.81.29;215pkt 215fpkt", shape=pentagon, color=darkviolet];
stat349[shape=component, label=&lt;Rules:&lt;BR/&gt;{45.165.81.29:17621, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 17621: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
169--4210[label="1;215pkt 215fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="45.165.81.29" src_port="17621"/>
    </slice>
    <from sec="1100149678" usec="0"/>
    <to sec="1100150063" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55074,1.28899,011,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_350{
style=filled;
color=gray75;
2347[label="45.169.18.30;s;493pkt 493fpkt", shape=diamond, color=yellow];
4216[label="45.169.18.30;604pkt 604fpkt", shape=pentagon, color=darkviolet];
stat350[shape=component, label=&lt;Rules:&lt;BR/&gt;{45.169.18.30:80, *:*}[99.8347%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.9544%)&lt;BR/&gt; 31256: (0.182315%)&lt;BR/&gt; 22111: (0.182315%)&lt;BR/&gt; 64841: (0.0911577%)&lt;BR/&gt; 63114: (0.0911577%)&gt;];
}
2347--3353[label="0.0547667;27pkt 27fpkt"];
2347--3546[label="0.0608519;30pkt 30fpkt"];
2347--3574[label="0.0547667;27pkt 27fpkt"];
2347--3767[label="0.0608519;30pkt 30fpkt"];
2347--3792[label="0.0547667;27pkt 27fpkt"];
2347--4216[label="0.997972;492pkt 492fpkt"];
</description>
    <slice>
      <filter src_ip="45.169.18.30" src_port="80"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.704383,1.30815,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_351{
style=filled;
color=gray75;
111[label="194.24.74.30s;231pkt 231fpkt", shape=rectangle, color=red];
4218[label="194.24.74.30;236pkt 236fpkt", shape=pentagon, color=darkviolet];
stat351[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.24.74.30:4768, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4768: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
111--4218[label="1;231pkt 231fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="194.24.74.30" src_port="4768"/>
    </slice>
    <from sec="1100149888" usec="0"/>
    <to sec="1100149906" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.161.210.31"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="213.50.175.32"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100149247" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="46.26.123.34"/>
    </slice>
    <from sec="1100149246" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="148.245.85.35"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.14.39.37"/>
    </slice>
    <from sec="1100149208" usec="0"/>
    <to sec="1100150097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.170.165.37"/>
    </slice>
    <from sec="1100149208" usec="0"/>
    <to sec="1100150098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="221.113.206.37"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100149674" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.26.201.39"/>
    </slice>
    <from sec="1100149205" usec="0"/>
    <to sec="1100150098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="46.26.123.41"/>
    </slice>
    <from sec="1100149203" usec="0"/>
    <to sec="1100149283" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="47.103.56.42"/>
    </slice>
    <from sec="1100149203" usec="0"/>
    <to sec="1100150085" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55074,1.28899,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_366{
style=filled;
color=gray75;
2171[label="147.203.64.42;s;49pkt 49fpkt", shape=diamond, color=yellow];
4293[label="147.203.64.42;61pkt 61fpkt", shape=pentagon, color=darkviolet];
stat366[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.203.64.42:26214, *:*}[85.4839%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 26214: (42.7273%)&lt;BR/&gt; 443: (4.09091%)&lt;BR/&gt; 80: (2.27273%)&lt;BR/&gt; 56650: (1.81818%)&lt;BR/&gt; 65472: (0.909091%)&gt;];
}
2171--3353[label="0.0204082;1pkt 1fpkt"];
2171--3574[label="0.0204082;1pkt 1fpkt"];
2171--3792[label="0.0204082;1pkt 1fpkt"];
2171--4293[label="0.979592;48pkt 48fpkt"];
</description>
    <slice>
      <filter src_ip="147.203.64.42" src_port="26214"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="201.240.38.44"/>
    </slice>
    <from sec="1100149229" usec="0"/>
    <to sec="1100150090" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.704383,1.30815,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_368{
style=filled;
color=gray75;
180[label="204.35.201.46s;56pkt 56fpkt", shape=rectangle, color=red];
4314[label="204.35.201.46;174pkt 174fpkt", shape=pentagon, color=darkviolet];
stat368[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.35.201.46:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 50960: (0.652174%)&lt;BR/&gt; 50915: (0.652174%)&lt;BR/&gt; 50806: (0.652174%)&lt;BR/&gt; 50042: (0.652174%)&gt;];
}
180--4314[label="1;56pkt 56fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="204.35.201.46"/>
    </slice>
    <from sec="1100149441" usec="0"/>
    <to sec="1100149457" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="64.128.128.48"/>
    </slice>
    <from sec="1100149202" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.11.4.49"/>
    </slice>
    <from sec="1100149671" usec="0"/>
    <to sec="1100149812" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="128.0.32.49"/>
    </slice>
    <from sec="1100149738" usec="0"/>
    <to sec="1100149768" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_372{
style=filled;
color=gray75;
4329[label="148.245.185.49;53pkt 53fpkt", shape=pentagon, color=darkviolet];
stat372[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.185.49:53, *:53}[60.3774%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (64.1509%)&lt;BR/&gt; 0: (13.2075%)&lt;BR/&gt; 113: (4.71698%)&lt;BR/&gt; 25: (4.71698%)&lt;BR/&gt; 2433: (1.88679%)&gt;];
}
</description>
    <slice>
      <filter dst_port="53" src_ip="148.245.185.49" src_port="53"/>
    </slice>
    <from sec="1100149230" usec="0"/>
    <to sec="1100150049" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="199.244.197.49"/>
    </slice>
    <from sec="1100149210" usec="0"/>
    <to sec="1100149290" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="80.35.252.49"/>
    </slice>
    <from sec="1100149469" usec="0"/>
    <to sec="1100149531" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="162.3.98.50"/>
    </slice>
    <from sec="1100149215" usec="0"/>
    <to sec="1100150095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.633119,1.23269,020,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_376{
style=filled;
color=gray75;
1368[label="45.178.123.50;s;1260pkt 1260fpkt", shape=diamond, color=yellow];
4335[label="45.178.123.50;1260pkt 1260fpkt", shape=pentagon, color=darkviolet];
5578[label="45.178.123.50;1259pkt 1259fpkt", shape=invtriangle, color=brown];
stat376[shape=component, label=&lt;Rules:&lt;BR/&gt;{45.178.123.50:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1368--4335[label="1;1260pkt 1260fpkt"];
1368--5578[label="1;1259pkt 1259fpkt"];
4335--5578[label="1;1259pkt 1259fpkt"];
</description>
    <slice>
      <filter src_ip="45.178.123.50"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100149763" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.704383,1.30815,001,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_377{
style=filled;
color=gray75;
181[label="194.27.184.50s;268pkt 268fpkt", shape=rectangle, color=red];
4337[label="194.27.184.50;268pkt 268fpkt", shape=pentagon, color=darkviolet];
stat377[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.27.184.50:*, *:1023}[52.2388%]&lt;BR/&gt;{194.27.184.50:*, *:9898}[47.7612%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1023: (26.1194%)&lt;BR/&gt; 9898: (23.8806%)&lt;BR/&gt; 4046: (0.186567%)&lt;BR/&gt; 4041: (0.186567%)&lt;BR/&gt; 4040: (0.186567%)&gt;];
}
181--4337[label="1;268pkt 268fpkt"];
</description>
    <slice>
      <filter dst_port="1023" src_ip="194.27.184.50"/>
      <filter dst_port="9898" src_ip="194.27.184.50"/>
    </slice>
    <from sec="1100149769" usec="0"/>
    <to sec="1100149776" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="204.44.23.51"/>
    </slice>
    <from sec="1100149223" usec="0"/>
    <to sec="1100150093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="162.3.62.51"/>
    </slice>
    <from sec="1100149203" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="80.79.199.51"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.633119,1.23269,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_381{
style=filled;
color=gray75;
1162[label="148.245.90.52;s;13pkt 13fpkt", shape=diamond, color=yellow];
1327[label="52.39.20.211;d;4pkt 4fpkt", shape=diamond, color=yellow];
4350[label="148.245.90.52;77pkt 77fpkt", shape=pentagon, color=darkviolet];
5590[label="148.245.90.52;78pkt 78fpkt", shape=invtriangle, color=brown];
stat381[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.90.52:*, *:80}[85.8974%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (43.0233%)&lt;BR/&gt; 1024: (5.81395%)&lt;BR/&gt; 53: (5.81395%)&lt;BR/&gt; 0: (2.32558%)&lt;BR/&gt; 62870: (1.16279%)&gt;];
}
1162--1327[label="1;4pkt 4fpkt"];
1162--3549[label="0.0769231;1pkt 1fpkt"];
1162--3770[label="0.0769231;1pkt 1fpkt"];
1162--3982[label="0.0769231;1pkt 1fpkt"];
1162--4350[label="1;13pkt 13fpkt"];
1162--5590[label="1;13pkt 13fpkt"];
1327--3549[label="0.25;1pkt 1fpkt"];
1327--3770[label="0.25;1pkt 1fpkt"];
1327--3982[label="0.25;1pkt 1fpkt"];
1327--4350[label="1;4pkt 4fpkt"];
1327--5590[label="1;4pkt 4fpkt"];
4350--5590[label="1;77pkt 77fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="148.245.90.52"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100149744" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="147.9.180.55"/>
    </slice>
    <from sec="1100149305" usec="0"/>
    <to sec="1100149844" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="84.243.48.56"/>
    </slice>
    <from sec="1100149226" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="148.245.138.56"/>
    </slice>
    <from sec="1100149980" usec="0"/>
    <to sec="1100149987" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="222.101.102.57"/>
    </slice>
    <from sec="1100149255" usec="0"/>
    <to sec="1100149913" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.88.57.58"/>
    </slice>
    <from sec="1100149308" usec="0"/>
    <to sec="1100150042" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="80.96.40.59"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="87.123.17.60"/>
    </slice>
    <from sec="1100149701" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="41.62.91.60"/>
    </slice>
    <from sec="1100149877" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="82.244.155.60"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100149554" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.19.71.62"/>
    </slice>
    <from sec="1100149865" usec="0"/>
    <to sec="1100149885" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="147.203.230.62"/>
    </slice>
    <from sec="1100149202" usec="0"/>
    <to sec="1100149332" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="162.3.62.63"/>
    </slice>
    <from sec="1100149207" usec="0"/>
    <to sec="1100150097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.165.6.64"/>
    </slice>
    <from sec="1100149435" usec="0"/>
    <to sec="1100149460" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.633119,1.23269,020,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_396{
style=filled;
color=gray75;
1373[label="215.26.200.66;s;326pkt 326fpkt", shape=diamond, color=yellow];
4420[label="215.26.200.66;328pkt 328fpkt", shape=pentagon, color=darkviolet];
5632[label="215.26.200.66;329pkt 329fpkt", shape=invtriangle, color=brown];
stat396[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.26.200.66:0, *:0}[99.696%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.6948%)&lt;BR/&gt; 4817: (0.152594%)&lt;BR/&gt; 445: (0.152594%)&gt;];
}
1373--1767[label="0.00613497;2pkt 2fpkt"];
1373--4420[label="0.996933;325pkt 325fpkt"];
1373--5632[label="1;326pkt 326fpkt"];
4420--5632[label="1;328pkt 328fpkt"];
</description>
    <slice>
      <filter src_ip="215.26.200.66"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.27.172.67"/>
    </slice>
    <from sec="1100149639" usec="0"/>
    <to sec="1100149664" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="65.75.140.68"/>
    </slice>
    <from sec="1100149622" usec="0"/>
    <to sec="1100149627" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="83.41.65.69"/>
    </slice>
    <from sec="1100149687" usec="0"/>
    <to sec="1100149851" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.99.26.71"/>
    </slice>
    <from sec="1100149229" usec="0"/>
    <to sec="1100150098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.20.168.73"/>
    </slice>
    <from sec="1100149782" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="162.3.50.74"/>
    </slice>
    <from sec="1100149207" usec="0"/>
    <to sec="1100150080" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="128.0.170.74"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.114.2.77"/>
    </slice>
    <from sec="1100150005" usec="0"/>
    <to sec="1100150086" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="86.244.3.77"/>
    </slice>
    <from sec="1100149351" usec="0"/>
    <to sec="1100150088" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.53.14.77"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="86.22.12.79"/>
    </slice>
    <from sec="1100149204" usec="0"/>
    <to sec="1100149832" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="82.131.189.80"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="47.160.202.80"/>
    </slice>
    <from sec="1100149217" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55074,1.28899,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_411{
style=filled;
color=gray75;
2647[label="148.245.20.182;d;9pkt 9fpkt", shape=diamond, color=yellow];
4517[label="160.88.104.81;4pkt 4fpkt", shape=pentagon, color=darkviolet];
stat411[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.88.104.81:80, 148.245.20.182:*}[44.4444%]&lt;BR/&gt;{205.171.164.101:80, 148.245.20.182:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 56337: (7.69231%)&lt;BR/&gt; 56336: (7.69231%)&lt;BR/&gt; 56319: (7.69231%)&lt;BR/&gt; 56318: (7.69231%)&gt;];
}
2647--4517[label="1;4pkt 4fpkt"];
2647--4619[label="0.111111;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="148.245.20.182" src_ip="160.88.104.81" src_port="80"/>
      <filter dst_ip="148.245.20.182" src_ip="205.171.164.101" src_port="80"/>
    </slice>
    <from sec="1100149874" usec="0"/>
    <to sec="1100150027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.210.151.81"/>
    </slice>
    <from sec="1100149203" usec="0"/>
    <to sec="1100150092" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="148.244.8.84"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="45.82.23.84"/>
    </slice>
    <from sec="1100150094" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="148.245.210.84"/>
    </slice>
    <from sec="1100149202" usec="0"/>
    <to sec="1100150098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="45.193.78.86"/>
    </slice>
    <from sec="1100149216" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="82.40.112.86"/>
    </slice>
    <from sec="1100150043" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="148.245.192.86"/>
    </slice>
    <from sec="1100149850" usec="0"/>
    <to sec="1100150004" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="147.203.29.87"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="141.83.142.87"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.26.204.88"/>
    </slice>
    <from sec="1100149281" usec="0"/>
    <to sec="1100149939" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="148.244.90.90"/>
    </slice>
    <from sec="1100149779" usec="0"/>
    <to sec="1100149912" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_425{
style=filled;
color=gray75;
4600[label="219.173.40.93;110pkt 110fpkt", shape=pentagon, color=darkviolet];
stat425[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.173.40.93:53, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (50%)&lt;BR/&gt; 3580: (0.909091%)&lt;BR/&gt; 1290: (0.909091%)&lt;BR/&gt; 1249: (0.909091%)&lt;BR/&gt; 1122: (0.909091%)&gt;];
}
</description>
    <slice>
      <filter src_ip="219.173.40.93" src_port="53"/>
    </slice>
    <from sec="1100149204" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="199.230.82.98"/>
    </slice>
    <from sec="1100149206" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.88.51.99"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="204.128.35.100"/>
    </slice>
    <from sec="1100149715" usec="0"/>
    <to sec="1100149720" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.633119,1.23269,020,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_429{
style=filled;
color=gray75;
2338[label="148.245.37.100;s;6pkt 6fpkt", shape=diamond, color=yellow];
4645[label="148.245.37.100;5pkt 5fpkt", shape=pentagon, color=darkviolet];
5757[label="148.245.37.100;6pkt 6fpkt", shape=invtriangle, color=brown];
stat429[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.37.100:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2338--4645[label="1;5pkt 5fpkt"];
2338--5757[label="1;6pkt 6fpkt"];
4645--5757[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter src_ip="148.245.37.100"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.172.142.100"/>
    </slice>
    <from sec="1100149203" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_431{
style=filled;
color=gray75;
4649[label="148.245.166.100;27pkt 27fpkt", shape=pentagon, color=darkviolet];
stat431[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.166.100:80, 45.250.196.93:*}[51.8519%]&lt;BR/&gt;{148.245.166.100:80, 204.16.246.187:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 63345: (1.85185%)&lt;BR/&gt; 63344: (1.85185%)&lt;BR/&gt; 63343: (1.85185%)&lt;BR/&gt; 63334: (1.85185%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="45.250.196.93" src_ip="148.245.166.100" src_port="80"/>
      <filter dst_ip="204.16.246.187" src_ip="148.245.166.100" src_port="80"/>
    </slice>
    <from sec="1100149281" usec="0"/>
    <to sec="1100149994" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.36.207.100"/>
    </slice>
    <from sec="1100149208" usec="0"/>
    <to sec="1100150097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="45.84.28.101"/>
    </slice>
    <from sec="1100149213" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="81.186.16.102"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="45.180.160.103"/>
    </slice>
    <from sec="1100149203" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_436{
style=filled;
color=gray75;
4672[label="166.164.217.103;100pkt 100fpkt", shape=pentagon, color=darkviolet];
stat436[shape=component, label=&lt;Rules:&lt;BR/&gt;{166.164.217.103:53, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (54%)&lt;BR/&gt; 32769: (1.5%)&lt;BR/&gt; 1024: (1.5%)&lt;BR/&gt; 32813: (1%)&lt;BR/&gt; 32772: (1%)&gt;];
}
</description>
    <slice>
      <filter src_ip="166.164.217.103" src_port="53"/>
    </slice>
    <from sec="1100149219" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="83.8.216.104"/>
    </slice>
    <from sec="1100149206" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.99.48.107"/>
    </slice>
    <from sec="1100149420" usec="0"/>
    <to sec="1100149648" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="41.190.159.108"/>
    </slice>
    <from sec="1100149308" usec="0"/>
    <to sec="1100149704" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.221.130.109"/>
    </slice>
    <from sec="1100149208" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.805151,1.21335,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_441{
style=filled;
color=gray75;
764[label="219.229.46.110;s;613pkt 613fpkt", shape=diamond, color=yellow];
4702[label="219.229.46.110;649pkt 649fpkt", shape=pentagon, color=darkviolet];
5777[label="219.229.46.110;649pkt 649fpkt", shape=invtriangle, color=brown];
6351[label="219.229.46.110;649pkt 649fpkt", shape=invhouse, color=bisque];
stat441[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.229.46.110:6667, *:*}[38.829%]&lt;BR/&gt;{219.229.46.110:*, 204.73.48.50:*}[26.9646%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (19.5898%)&lt;BR/&gt; 6668: (3.33984%)&lt;BR/&gt; 8080: (2.92969%)&lt;BR/&gt; 113: (2.85156%)&lt;BR/&gt; 10080: (2.55859%)&gt;];
}
764--3549[label="0.00326264;2pkt 2fpkt"];
764--3555[label="0.00326264;2pkt 2fpkt"];
764--3770[label="0.00326264;2pkt 2fpkt"];
764--3775[label="0.00326264;2pkt 2fpkt"];
764--3982[label="0.00326264;2pkt 2fpkt"];
764--3986[label="0.00326264;2pkt 2fpkt"];
764--4702[label="1;613pkt 613fpkt"];
764--5777[label="1;613pkt 613fpkt"];
764--6351[label="1;613pkt 613fpkt"];
4702--5777[label="1;649pkt 649fpkt"];
4702--6351[label="1;649pkt 649fpkt"];
5777--6351[label="1;649pkt 649fpkt"];
</description>
    <slice>
      <filter dst_ip="204.73.48.50" src_ip="219.229.46.110"/>
      <filter src_ip="219.229.46.110" src_port="6667"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_442{
style=filled;
color=gray75;
4704[label="196.108.80.110;249pkt 249fpkt", shape=pentagon, color=darkviolet];
stat442[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.108.80.110:*, *:1027}[54.2169%]&lt;BR/&gt;{196.108.80.110:*, *:1026}[45.7831%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (27.1084%)&lt;BR/&gt; 1026: (22.8916%)&lt;BR/&gt; 3270: (0.60241%)&lt;BR/&gt; 4870: (0.401606%)&lt;BR/&gt; 4789: (0.401606%)&gt;];
}
</description>
    <slice>
      <filter dst_port="1027" src_ip="196.108.80.110"/>
      <filter dst_port="1026" src_ip="196.108.80.110"/>
    </slice>
    <from sec="1100149216" usec="0"/>
    <to sec="1100149911" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="128.0.217.111"/>
    </slice>
    <from sec="1100149210" usec="0"/>
    <to sec="1100150093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="81.187.78.112"/>
    </slice>
    <from sec="1100149684" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="128.0.234.114"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150094" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="162.3.13.115"/>
    </slice>
    <from sec="1100149798" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="67.129.64.116"/>
    </slice>
    <from sec="1100149216" usec="0"/>
    <to sec="1100150033" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.704383,1.30815,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_448{
style=filled;
color=gray75;
51[label="194.123.76.117s;128pkt 128fpkt", shape=rectangle, color=red];
4733[label="194.123.76.117;240pkt 240fpkt", shape=pentagon, color=darkviolet];
stat448[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.123.76.117:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
51--4733[label="1;128pkt 128fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="194.123.76.117" src_port="1029"/>
    </slice>
    <from sec="1100149824" usec="0"/>
    <to sec="1100149839" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="148.245.45.120"/>
    </slice>
    <from sec="1100149316" usec="0"/>
    <to sec="1100149559" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="219.94.20.123"/>
    </slice>
    <from sec="1100149436" usec="0"/>
    <to sec="1100150024" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.0.108.123"/>
    </slice>
    <from sec="1100149519" usec="0"/>
    <to sec="1100150066" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.15.208.124"/>
    </slice>
    <from sec="1100149874" usec="0"/>
    <to sec="1100149888" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.107.103.125"/>
    </slice>
    <from sec="1100149868" usec="0"/>
    <to sec="1100149905" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="148.244.108.125"/>
    </slice>
    <from sec="1100149213" usec="0"/>
    <to sec="1100150098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="128.0.177.127"/>
    </slice>
    <from sec="1100149204" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="201.70.182.128"/>
    </slice>
    <from sec="1100150025" usec="0"/>
    <to sec="1100150085" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="148.245.18.130"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="192.16.160.130"/>
    </slice>
    <from sec="1100149214" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.101.68.131"/>
    </slice>
    <from sec="1100149999" usec="0"/>
    <to sec="1100150024" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="148.245.189.131"/>
    </slice>
    <from sec="1100149205" usec="0"/>
    <to sec="1100150095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,011,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_464{
style=filled;
color=gray75;
4799[label="196.80.31.132;280pkt 280fpkt", shape=pentagon, color=darkviolet];
stat464[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.80.31.132:80, *:*}[30.3571%]&lt;BR/&gt;{196.80.31.132:7200, *:*}[23.9286%]&lt;BR/&gt;{196.80.31.132:7000, *:*}[22.8571%]&lt;BR/&gt;{196.80.31.132:7100, *:*}[22.8571%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (15.1786%)&lt;BR/&gt; 7200: (11.9643%)&lt;BR/&gt; 7100: (11.4286%)&lt;BR/&gt; 7000: (11.4286%)&lt;BR/&gt; 31733: (0.357143%)&gt;];
}
</description>
    <slice>
      <filter src_ip="196.80.31.132" src_port="80"/>
      <filter src_ip="196.80.31.132" src_port="7200"/>
      <filter src_ip="196.80.31.132" src_port="7100"/>
      <filter src_ip="196.80.31.132" src_port="7000"/>
    </slice>
    <from sec="1100149204" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="217.124.128.132"/>
    </slice>
    <from sec="1100149888" usec="0"/>
    <to sec="1100149940" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="147.203.64.133"/>
    </slice>
    <from sec="1100149204" usec="0"/>
    <to sec="1100150097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="192.16.160.137"/>
    </slice>
    <from sec="1100149202" usec="0"/>
    <to sec="1100150097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.704383,1.30815,001,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_468{
style=filled;
color=gray75;
217[label="194.124.215.137s;228pkt 228fpkt", shape=rectangle, color=red];
4832[label="194.124.215.137;227pkt 227fpkt", shape=pentagon, color=darkviolet];
stat468[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.124.215.137:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 4999: (0.21978%)&lt;BR/&gt; 4998: (0.21978%)&lt;BR/&gt; 4996: (0.21978%)&lt;BR/&gt; 4995: (0.21978%)&gt;];
}
217--2019[label="0.00490196;1pkt 1fpkt"];
217--4832[label="1;227pkt 227fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="194.124.215.137"/>
    </slice>
    <from sec="1100149646" usec="0"/>
    <to sec="1100149648" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.49.20.138"/>
    </slice>
    <from sec="1100149784" usec="0"/>
    <to sec="1100149788" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="201.18.102.138"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.172.5.139"/>
    </slice>
    <from sec="1100149239" usec="0"/>
    <to sec="1100149286" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.36.113.139"/>
    </slice>
    <from sec="1100149202" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742121,1.2705,503,0 0 0 1 0 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_473{
style=filled;
color=gray75;
1982[label="148.245.140.141;s;73pkt 73fpkt", shape=diamond, color=yellow];
2321[label="205.10.7.248;d;69pkt 69fpkt", shape=diamond, color=yellow];
4854[label="148.245.140.141;80pkt 80fpkt", shape=pentagon, color=darkviolet];
6390[label="148.245.140.141;78pkt 78fpkt", shape=invhouse, color=bisque];
stat473[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.140.141:*, 205.10.7.248:80}[95%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1329: (0.666667%)&lt;BR/&gt; 1328: (0.666667%)&lt;BR/&gt; 1327: (0.666667%)&lt;BR/&gt; 1326: (0.666667%)&gt;];
}
1982--2321[label="1;69pkt 69fpkt"];
1982--3555[label="0.0273973;2pkt 2fpkt"];
1982--3561[label="0.219178;16pkt 16fpkt"];
1982--3775[label="0.0273973;2pkt 2fpkt"];
1982--3781[label="0.219178;16pkt 16fpkt"];
1982--3986[label="0.0273973;2pkt 2fpkt"];
1982--3991[label="0.219178;16pkt 16fpkt"];
1982--4854[label="1;73pkt 73fpkt"];
1982--6390[label="0.986301;72pkt 72fpkt"];
2321--3555[label="0.0289855;2pkt 2fpkt"];
2321--3561[label="0.231884;16pkt 16fpkt"];
2321--3775[label="0.0289855;2pkt 2fpkt"];
2321--3781[label="0.231884;16pkt 16fpkt"];
2321--3986[label="0.0289855;2pkt 2fpkt"];
2321--3991[label="0.231884;16pkt 16fpkt"];
2321--4854[label="1;69pkt 69fpkt"];
2321--6390[label="1;69pkt 69fpkt"];
4854--6390[label="1;78pkt 78fpkt"];
</description>
    <slice>
      <filter dst_ip="205.10.7.248" dst_port="80" src_ip="148.245.140.141"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.805151,1.21335,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_474{
style=filled;
color=gray75;
1171[label="217.105.0.33;s;27pkt 27fpkt", shape=diamond, color=yellow];
1802[label="162.3.16.149;d;2pkt 2fpkt", shape=diamond, color=yellow];
1990[label="162.3.83.155;d;2pkt 2fpkt", shape=diamond, color=yellow];
2153[label="162.3.8.251;d;2pkt 2fpkt", shape=diamond, color=yellow];
2170[label="162.3.16.38;d;27pkt 27fpkt", shape=diamond, color=yellow];
2172[label="162.3.50.181;d;1pkt 1fpkt", shape=diamond, color=yellow];
2327[label="162.3.9.30;d;2pkt 2fpkt", shape=diamond, color=yellow];
2346[label="192.16.160.141;s;13pkt 13fpkt", shape=diamond, color=yellow];
2369[label="192.16.160.175;s;11pkt 11fpkt", shape=diamond, color=yellow];
4821[label="192.16.160.136;6pkt 6fpkt", shape=pentagon, color=darkviolet];
4856[label="192.16.160.141;12pkt 12fpkt", shape=pentagon, color=darkviolet];
4864[label="192.16.160.142;11pkt 11fpkt", shape=pentagon, color=darkviolet];
4947[label="192.16.160.156;8pkt 8fpkt", shape=pentagon, color=darkviolet];
5003[label="192.16.160.166;13pkt 13fpkt", shape=pentagon, color=darkviolet];
5063[label="192.16.160.175;10pkt 10fpkt", shape=pentagon, color=darkviolet];
5087[label="192.16.160.179;5pkt 5fpkt", shape=pentagon, color=darkviolet];
5834[label="192.16.160.136;5pkt 5fpkt", shape=invtriangle, color=brown];
5852[label="192.16.160.141;13pkt 13fpkt", shape=invtriangle, color=brown];
5856[label="192.16.160.142;11pkt 11fpkt", shape=invtriangle, color=brown];
5963[label="192.16.160.175;11pkt 11fpkt", shape=invtriangle, color=brown];
6382[label="192.16.160.136;5pkt 5fpkt", shape=invhouse, color=bisque];
stat474[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:5050, 162.3.16.38:*}[23.4783%]&lt;BR/&gt;{217.105.0.33:*, *:*}[23.4783%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5050: (37.0558%)&lt;BR/&gt; 20: (2.79188%)&lt;BR/&gt; 6667: (1.77665%)&lt;BR/&gt; 6664: (1.52284%)&lt;BR/&gt; 1030: (1.52284%)&gt;];
}
1171--1802[label="0.5;1pkt 1fpkt"];
1171--1990[label="0.5;1pkt 1fpkt"];
1171--2153[label="0.5;1pkt 1fpkt"];
1171--2172[label="1;1pkt 1fpkt"];
1171--2327[label="0.5;1pkt 1fpkt"];
1990--2346[label="0.5;1pkt 1fpkt"];
1990--4856[label="0.5;1pkt 1fpkt"];
1990--5852[label="0.5;1pkt 1fpkt"];
2170--2346[label="0.0769231;1pkt 1fpkt"];
2170--2369[label="0.181818;2pkt 2fpkt"];
2170--4821[label="0.166667;1pkt 1fpkt"];
2170--4856[label="0.0833333;1pkt 1fpkt"];
2170--4864[label="0.0909091;1pkt 1fpkt"];
2170--4947[label="0.125;1pkt 1fpkt"];
2170--5003[label="0.0769231;1pkt 1fpkt"];
2170--5063[label="0.2;2pkt 2fpkt"];
2170--5087[label="0.4;2pkt 2fpkt"];
2170--5852[label="0.0769231;1pkt 1fpkt"];
2170--5856[label="0.0909091;1pkt 1fpkt"];
2170--5963[label="0.181818;2pkt 2fpkt"];
2346--4856[label="1;12pkt 12fpkt"];
2346--5852[label="1;13pkt 13fpkt"];
2369--5063[label="1;10pkt 10fpkt"];
2369--5963[label="1;11pkt 11fpkt"];
4821--5834[label="1;5pkt 5fpkt"];
4821--6382[label="1;5pkt 5fpkt"];
4856--5852[label="1;12pkt 12fpkt"];
4864--5856[label="1;11pkt 11fpkt"];
5063--5963[label="1;10pkt 10fpkt"];
5834--6382[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter src_ip="217.105.0.33"/>
      <filter dst_ip="162.3.16.38" src_port="5050"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="148.245.170.141"/>
    </slice>
    <from sec="1100149732" usec="0"/>
    <to sec="1100150093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="46.116.225.141"/>
    </slice>
    <from sec="1100149496" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.704383,1.30815,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_477{
style=filled;
color=gray75;
131[label="192.255.159.142s;73pkt 73fpkt", shape=rectangle, color=red];
4863[label="192.255.159.142;222pkt 222fpkt", shape=pentagon, color=darkviolet];
stat477[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.255.159.142:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
131--4863[label="0.986301;72pkt 72fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="192.255.159.142" src_port="1025"/>
    </slice>
    <from sec="1100150059" usec="0"/>
    <to sec="1100150093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.168.234.142"/>
    </slice>
    <from sec="1100149948" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_479{
style=filled;
color=gray75;
4868[label="148.245.142.143;8pkt 8fpkt", shape=pentagon, color=darkviolet];
stat479[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.142.143:*, 193.49.104.127:80}[50%]&lt;BR/&gt;{148.245.142.143:*, 201.227.148.163:80}[37.5%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2801: (6.25%)&lt;BR/&gt; 2800: (6.25%)&lt;BR/&gt; 2799: (6.25%)&lt;BR/&gt; 2798: (6.25%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="193.49.104.127" dst_port="80" src_ip="148.245.142.143"/>
      <filter dst_ip="201.227.148.163" dst_port="80" src_ip="148.245.142.143"/>
    </slice>
    <from sec="1100150022" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="162.3.59.144"/>
    </slice>
    <from sec="1100149203" usec="0"/>
    <to sec="1100150084" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="81.227.125.144"/>
    </slice>
    <from sec="1100149203" usec="0"/>
    <to sec="1100150098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="148.245.171.144"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="147.203.227.144"/>
    </slice>
    <from sec="1100149212" usec="0"/>
    <to sec="1100150093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="41.80.64.145"/>
    </slice>
    <from sec="1100149202" usec="0"/>
    <to sec="1100149416" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="147.9.201.146"/>
    </slice>
    <from sec="1100149202" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.162.189.149"/>
    </slice>
    <from sec="1100149204" usec="0"/>
    <to sec="1100150096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="199.250.116.152"/>
    </slice>
    <from sec="1100150043" usec="0"/>
    <to sec="1100150071" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="162.3.85.154"/>
    </slice>
    <from sec="1100149229" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="148.245.132.155"/>
    </slice>
    <from sec="1100149202" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.805151,1.21335,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_492{
style=filled;
color=gray75;
642[label="215.26.201.159;s;4941pkt 4941fpkt", shape=diamond, color=yellow];
4960[label="215.26.201.159;5255pkt 5255fpkt", shape=pentagon, color=darkviolet];
5914[label="215.26.201.159;5255pkt 5255fpkt", shape=invtriangle, color=brown];
6418[label="215.26.201.159;5256pkt 5256fpkt", shape=invhouse, color=bisque];
stat492[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.26.201.159:1810, *:*}[97.3554%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1810: (48.6719%)&lt;BR/&gt; 443: (0.760612%)&lt;BR/&gt; 80: (0.5771%)&lt;BR/&gt; 1025: (0.152122%)&lt;BR/&gt; 54045: (0.0820978%)&gt;];
}
642--3353[label="0.00722496;22pkt 22fpkt"];
642--3546[label="0.00899129;32pkt 32fpkt"];
642--3574[label="0.00722496;22pkt 22fpkt"];
642--3767[label="0.00899129;32pkt 32fpkt"];
642--3792[label="0.00722496;22pkt 22fpkt"];
642--4960[label="0.999798;4940pkt 4940fpkt"];
642--5914[label="0.999798;4940pkt 4940fpkt"];
642--6418[label="1;4941pkt 4941fpkt"];
4960--5914[label="1;5255pkt 5255fpkt"];
4960--6418[label="1;5255pkt 5255fpkt"];
5914--6418[label="1;5255pkt 5255fpkt"];
</description>
    <slice>
      <filter src_ip="215.26.201.159" src_port="1810"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="192.16.160.161"/>
    </slice>
    <from sec="1100149214" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.815594,1.29127,004,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_494{
style=filled;
color=gray75;
853[label="215.26.207.90;s;17pkt 17fpkt", shape=diamond, color=yellow];
864[label="215.26.206.4;s;54pkt 54fpkt", shape=diamond, color=yellow];
1132[label="204.116.95.6;d;3pkt 3fpkt", shape=diamond, color=yellow];
1767[label="215.124.35.14;d;1503pkt 1503fpkt", shape=diamond, color=yellow];
1812[label="205.40.202.205;d;3pkt 3fpkt", shape=diamond, color=yellow];
2759[label="215.26.206.4;s;11pkt 11fpkt", shape=hexagon, color=black];
3186[label="204.116.95.6;d;3pkt 3fpkt", shape=hexagon, color=black];
4026[label="215.26.206.4;64pkt 64fpkt", shape=pentagon, color=darkviolet];
4618[label="215.26.197.96;11pkt 11fpkt", shape=pentagon, color=darkviolet];
4632[label="215.26.202.98;33pkt 33fpkt", shape=pentagon, color=darkviolet];
4847[label="215.26.201.139;69pkt 69fpkt", shape=pentagon, color=darkviolet];
4972[label="215.26.193.161;143pkt 143fpkt", shape=pentagon, color=darkviolet];
5030[label="215.26.206.170;130pkt 130fpkt", shape=pentagon, color=darkviolet];
stat494[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:445, 215.124.35.14:*}[59.6315%]&lt;BR/&gt;{*:139, 215.124.35.14:*}[28.0849%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (28.9873%)&lt;BR/&gt; 139: (15.1663%)&lt;BR/&gt; 25: (3.05773%)&lt;BR/&gt; 0: (3.03327%)&lt;BR/&gt; 80: (0.391389%)&gt;];
}
853--1132[label="1;3pkt 3fpkt"];
853--1767[label="0.0588235;1pkt 1fpkt"];
853--3186[label="1;3pkt 3fpkt"];
864--1812[label="1;3pkt 3fpkt"];
864--2759[label="0.909091;10pkt 10fpkt"];
864--4026[label="1;54pkt 54fpkt"];
1132--3186[label="1;3pkt 3fpkt"];
1767--1830[label="0.0126582;1pkt 1fpkt"];
1767--1834[label="0.00323625;1pkt 1fpkt"];
1767--1839[label="0.00380228;1pkt 1fpkt"];
1767--2139[label="0.0114943;1pkt 1fpkt"];
1767--2519[label="0.00318979;2pkt 2fpkt"];
1767--2941[label="0.00165837;1pkt 1fpkt"];
1767--4002[label="0.000665336;1pkt 1fpkt"];
1767--4026[label="0.015625;1pkt 1fpkt"];
1767--4136[label="0.000665336;1pkt 1fpkt"];
1767--4137[label="0.0108696;1pkt 1fpkt"];
1767--4191[label="0.00581395;2pkt 2fpkt"];
1767--4237[label="0.000665336;1pkt 1fpkt"];
1767--4420[label="0.00609756;2pkt 2fpkt"];
1767--4455[label="0.00862069;1pkt 1fpkt"];
1767--4486[label="0.0217391;1pkt 1fpkt"];
1767--4618[label="0.0909091;1pkt 1fpkt"];
1767--4623[label="0.0042735;1pkt 1fpkt"];
1767--4632[label="0.030303;1pkt 1fpkt"];
1767--4847[label="0.0434783;3pkt 3fpkt"];
1767--4881[label="0.0652174;3pkt 3fpkt"];
1767--4972[label="0.979021;140pkt 140fpkt"];
1767--4973[label="0.0909091;1pkt 1fpkt"];
1767--5030[label="0.246154;32pkt 32fpkt"];
1767--5259[label="0.0208333;1pkt 1fpkt"];
1767--5267[label="0.00534759;1pkt 1fpkt"];
1767--5275[label="0.00217391;1pkt 1fpkt"];
1767--5430[label="0.000665336;1pkt 1fpkt"];
1767--5494[label="0.000665336;1pkt 1fpkt"];
1767--5544[label="0.00377358;1pkt 1fpkt"];
1767--5632[label="0.00607903;2pkt 2fpkt"];
1767--5652[label="0.00869565;1pkt 1fpkt"];
1767--6061[label="0.0208333;1pkt 1fpkt"];
1767--6064[label="0.00534759;1pkt 1fpkt"];
1767--6154[label="0.000665336;1pkt 1fpkt"];
1767--6221[label="0.00377358;1pkt 1fpkt"];
1767--6279[label="0.00869565;1pkt 1fpkt"];
1812--2759[label="0.333333;1pkt 1fpkt"];
1812--4026[label="1;3pkt 3fpkt"];
2759--4026[label="1;11pkt 11fpkt"];
</description>
    <slice>
      <filter dst_ip="215.124.35.14" src_port="445"/>
      <filter dst_ip="215.124.35.14" src_port="139"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55074,1.28899,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_495{
style=filled;
color=gray75;
2470[label="128.0.213.209;d;20pkt 20fpkt", shape=diamond, color=yellow];
4974[label="45.162.204.161;2pkt 2fpkt", shape=pentagon, color=darkviolet];
stat495[shape=component, label=&lt;Rules:&lt;BR/&gt;{45.162.204.181:80, 128.0.213.209:*}[25%]&lt;BR/&gt;{*:7709, 128.0.213.209:*}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (18.1818%)&lt;BR/&gt; 7709: (11.3636%)&lt;BR/&gt; 8601: (6.81818%)&lt;BR/&gt; 1050: (4.54545%)&lt;BR/&gt; 1048: (4.54545%)&gt;];
}
2470--4974[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="128.0.213.209" src_port="7709"/>
      <filter dst_ip="128.0.213.209" src_ip="45.162.204.181" src_port="80"/>
    </slice>
    <from sec="1100149808" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="80.213.150.162"/>
    </slice>
    <from sec="1100149868" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="207.150.179.164"/>
    </slice>
    <from sec="1100149214" usec="0"/>
    <to sec="1100150094" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="147.203.33.165"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="45.185.31.166"/>
    </slice>
    <from sec="1100149211" usec="0"/>
    <to sec="1100150094" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="86.26.45.166"/>
    </slice>
    <from sec="1100149381" usec="0"/>
    <to sec="1100149594" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55074,1.28899,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_503{
style=filled;
color=gray75;
2595[label="147.203.86.205;d;34pkt 34fpkt", shape=diamond, color=yellow];
5000[label="65.51.95.166;3pkt 3fpkt", shape=pentagon, color=darkviolet];
stat503[shape=component, label=&lt;Rules:&lt;BR/&gt;{80.126.105.31:80, 147.203.86.205:*}[35.2941%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1148: (2.7027%)&lt;BR/&gt; 1143: (2.7027%)&lt;BR/&gt; 1112: (2.7027%)&lt;BR/&gt; 1167: (1.35135%)&gt;];
}
2595--5000[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="147.203.86.205" src_ip="80.126.105.31" src_port="80"/>
    </slice>
    <from sec="1100149484" usec="0"/>
    <to sec="1100150022" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="87.119.150.167"/>
    </slice>
    <from sec="1100149206" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55074,1.28899,020,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_506{
style=filled;
color=gray75;
2154[label="165.92.83.169;s;461pkt 461fpkt", shape=diamond, color=yellow];
5018[label="165.92.83.169;635pkt 635fpkt", shape=pentagon, color=darkviolet];
stat506[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.92.83.169:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2154--5018[label="0.997831;460pkt 460fpkt"];
</description>
    <slice>
      <filter src_ip="165.92.83.169"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.181.95.169"/>
    </slice>
    <from sec="1100149202" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="82.88.40.170"/>
    </slice>
    <from sec="1100149769" usec="0"/>
    <to sec="1100150020" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="201.62.234.170"/>
    </slice>
    <from sec="1100150015" usec="0"/>
    <to sec="1100150024" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="162.3.62.172"/>
    </slice>
    <from sec="1100149205" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.181.46.173"/>
    </slice>
    <from sec="1100149213" usec="0"/>
    <to sec="1100150097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55074,1.28899,010,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_513{
style=filled;
color=gray75;
2518[label="45.182.207.21;d;186pkt 186fpkt", shape=diamond, color=yellow];
5050[label="148.244.182.173;202pkt 202fpkt", shape=pentagon, color=darkviolet];
stat513[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.244.182.173:*, 45.182.207.21:21}[99.0099%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (49.6134%)&lt;BR/&gt; 0: (0.515464%)&lt;BR/&gt; 2981: (0.257732%)&lt;BR/&gt; 2980: (0.257732%)&lt;BR/&gt; 2979: (0.257732%)&gt;];
}
2518--5050[label="1;186pkt 186fpkt"];
</description>
    <slice>
      <filter dst_ip="45.182.207.21" dst_port="21" src_ip="148.244.182.173"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="86.103.131.176"/>
    </slice>
    <from sec="1100149202" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="82.95.97.177"/>
    </slice>
    <from sec="1100149234" usec="0"/>
    <to sec="1100150071" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="87.167.51.178"/>
    </slice>
    <from sec="1100149363" usec="0"/>
    <to sec="1100149429" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_517{
style=filled;
color=gray75;
5083[label="128.0.68.179;252pkt 252fpkt", shape=pentagon, color=darkviolet];
stat517[shape=component, label=&lt;Rules:&lt;BR/&gt;{128.0.68.179:22270, *:*}[99.6032%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 22270: (49.8016%)&lt;BR/&gt; 63903: (0.396825%)&lt;BR/&gt; 4962: (0.396825%)&lt;BR/&gt; 1025: (0.396825%)&lt;BR/&gt; 65435: (0.198413%)&gt;];
}
</description>
    <slice>
      <filter src_ip="128.0.68.179" src_port="22270"/>
    </slice>
    <from sec="1100149206" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="147.203.230.179"/>
    </slice>
    <from sec="1100149216" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="45.172.28.180"/>
    </slice>
    <from sec="1100150085" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="83.40.153.181"/>
    </slice>
    <from sec="1100149209" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="83.86.199.182"/>
    </slice>
    <from sec="1100149204" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="147.203.202.182"/>
    </slice>
    <from sec="1100149813" usec="0"/>
    <to sec="1100149869" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="86.32.131.184"/>
    </slice>
    <from sec="1100149704" usec="0"/>
    <to sec="1100149756" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="221.58.186.185"/>
    </slice>
    <from sec="1100149206" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,001,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.104.26.186"/>
    </slice>
    <from sec="1100149541" usec="0"/>
    <to sec="1100149544" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="45.162.204.187"/>
    </slice>
    <from sec="1100149909" usec="0"/>
    <to sec="1100150079" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="86.181.68.193"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.805151,1.21335,011,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_528{
style=filled;
color=gray75;
801[label="45.161.106.63;s;1501pkt 1501fpkt", shape=diamond, color=yellow];
2385[label="148.245.1.202;d;65pkt 65fpkt", shape=diamond, color=yellow];
2475[label="87.170.76.194;s;30pkt 30fpkt", shape=diamond, color=yellow];
4405[label="45.161.106.63;2120pkt 2120fpkt", shape=pentagon, color=darkviolet];
5157[label="87.170.76.194;30pkt 30fpkt", shape=pentagon, color=darkviolet];
5622[label="45.161.106.63;2119pkt 2119fpkt", shape=invtriangle, color=brown];
6004[label="87.170.76.194;29pkt 29fpkt", shape=invtriangle, color=brown];
6262[label="45.161.106.63;2120pkt 2120fpkt", shape=invhouse, color=bisque];
stat528[shape=component, label=&lt;Rules:&lt;BR/&gt;{45.161.106.63:7000, *:*}[97.0696%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7000: (49.0454%)&lt;BR/&gt; 80: (0.954579%)&lt;BR/&gt; 31282: (0.0499127%)&lt;BR/&gt; 30081: (0.0499127%)&lt;BR/&gt; 29960: (0.0499127%)&gt;];
}
801--2385[label="0.0153846;1pkt 1fpkt"];
801--4405[label="1;1501pkt 1501fpkt"];
801--5622[label="0.999334;1500pkt 1500fpkt"];
801--6262[label="1;1501pkt 1501fpkt"];
2385--2475[label="1;30pkt 30fpkt"];
2385--4405[label="0.0153846;1pkt 1fpkt"];
2385--5157[label="1;30pkt 30fpkt"];
2385--5622[label="0.0153846;1pkt 1fpkt"];
2385--6004[label="1;29pkt 29fpkt"];
2385--6262[label="0.0153846;1pkt 1fpkt"];
2475--5157[label="1;30pkt 30fpkt"];
2475--6004[label="1;29pkt 29fpkt"];
4405--5622[label="1;2119pkt 2119fpkt"];
4405--6262[label="1;2120pkt 2120fpkt"];
5157--6004[label="1;29pkt 29fpkt"];
5622--6262[label="1;2119pkt 2119fpkt"];
</description>
    <slice>
      <filter src_ip="45.161.106.63" src_port="7000"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="192.244.33.195"/>
    </slice>
    <from sec="1100149581" usec="0"/>
    <to sec="1100149689" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="46.26.124.195"/>
    </slice>
    <from sec="1100149282" usec="0"/>
    <to sec="1100149320" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="192.64.134.195"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="192.241.195.197"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.172.218.198"/>
    </slice>
    <from sec="1100149974" usec="0"/>
    <to sec="1100150088" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_534{
style=filled;
color=gray75;
5194[label="215.26.205.200;49pkt 49fpkt", shape=pentagon, color=darkviolet];
stat534[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.26.205.200:32768, *:53}[93.8776%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (48.9796%)&lt;BR/&gt; 32768: (46.9388%)&lt;BR/&gt; 62457: (1.02041%)&lt;BR/&gt; 48777: (1.02041%)&lt;BR/&gt; 34054: (1.02041%)&gt;];
}
</description>
    <slice>
      <filter dst_port="53" src_ip="215.26.205.200" src_port="32768"/>
    </slice>
    <from sec="1100149247" usec="0"/>
    <to sec="1100150073" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="46.2.131.201"/>
    </slice>
    <from sec="1100149729" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="162.3.59.202"/>
    </slice>
    <from sec="1100149203" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="41.184.221.202"/>
    </slice>
    <from sec="1100149202" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="45.69.115.206"/>
    </slice>
    <from sec="1100149230" usec="0"/>
    <to sec="1100149295" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.633119,1.23269,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_539{
style=filled;
color=gray75;
1816[label="219.242.128.206;s;847pkt 847fpkt", shape=diamond, color=yellow];
5230[label="219.242.128.206;915pkt 915fpkt", shape=pentagon, color=darkviolet];
6042[label="219.242.128.206;915pkt 915fpkt", shape=invtriangle, color=brown];
stat539[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.242.128.206:53, *:*}[98.0328%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (57.471%)&lt;BR/&gt; 32768: (2.05454%)&lt;BR/&gt; 0: (1.94247%)&lt;BR/&gt; 1024: (1.30743%)&lt;BR/&gt; 32769: (1.10198%)&gt;];
}
1816--3356[label="0.00708383;6pkt 6fpkt"];
1816--3545[label="0.0602125;51pkt 51fpkt"];
1816--3560[label="0.0094451;8pkt 8fpkt"];
1816--3577[label="0.00708383;6pkt 6fpkt"];
1816--3766[label="0.0602125;51pkt 51fpkt"];
1816--3780[label="0.0094451;8pkt 8fpkt"];
1816--3795[label="0.00708383;6pkt 6fpkt"];
1816--3990[label="0.0094451;8pkt 8fpkt"];
1816--5230[label="1;847pkt 847fpkt"];
1816--6042[label="1;847pkt 847fpkt"];
5230--6042[label="1;915pkt 915fpkt"];
</description>
    <slice>
      <filter src_ip="219.242.128.206" src_port="53"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.199.66.208"/>
    </slice>
    <from sec="1100149202" usec="0"/>
    <to sec="1100150095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.102.67.212"/>
    </slice>
    <from sec="1100149204" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55074,1.28899,010,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_545{
style=filled;
color=gray75;
1594[label="195.96.117.212;s;1392pkt 1392fpkt", shape=diamond, color=yellow];
5265[label="195.96.117.212;1504pkt 1504fpkt", shape=pentagon, color=darkviolet];
stat545[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.96.117.212:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 56253: (0.0690608%)&lt;BR/&gt; 55538: (0.0690608%)&lt;BR/&gt; 48769: (0.0690608%)&lt;BR/&gt; 46080: (0.0690608%)&gt;];
}
1594--3353[label="0.049569;69pkt 69fpkt"];
1594--3546[label="0.0567529;79pkt 79fpkt"];
1594--3574[label="0.049569;69pkt 69fpkt"];
1594--3767[label="0.0567529;79pkt 79fpkt"];
1594--3792[label="0.049569;69pkt 69fpkt"];
1594--5265[label="0.999282;1391pkt 1391fpkt"];
</description>
    <slice>
      <filter src_ip="195.96.117.212" src_port="80"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="45.26.188.219"/>
    </slice>
    <from sec="1100149248" usec="0"/>
    <to sec="1100150094" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.805151,1.21335,011,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_548{
style=filled;
color=gray75;
1412[label="196.131.197.220;s;1732pkt 1732fpkt", shape=diamond, color=yellow];
5310[label="196.131.197.220;1893pkt 1893fpkt", shape=pentagon, color=darkviolet];
6083[label="196.131.197.220;1893pkt 1893fpkt", shape=invtriangle, color=brown];
6508[label="196.131.197.220;1893pkt 1893fpkt", shape=invhouse, color=bisque];
stat548[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.131.197.220:8088, *:*}[97.7285%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8088: (50%)&lt;BR/&gt; 23097: (0.0809607%)&lt;BR/&gt; 22584: (0.0809607%)&lt;BR/&gt; 64585: (0.0539738%)&lt;BR/&gt; 64077: (0.0539738%)&gt;];
}
1412--5310[label="1;1732pkt 1732fpkt"];
1412--6083[label="1;1732pkt 1732fpkt"];
1412--6508[label="1;1732pkt 1732fpkt"];
5310--6083[label="1;1893pkt 1893fpkt"];
5310--6508[label="1;1893pkt 1893fpkt"];
6083--6508[label="1;1893pkt 1893fpkt"];
</description>
    <slice>
      <filter src_ip="196.131.197.220" src_port="8088"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.172.1.223"/>
    </slice>
    <from sec="1100149205" usec="0"/>
    <to sec="1100150078" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55074,1.28899,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_550{
style=filled;
color=gray75;
1889[label="148.245.156.10;d;92pkt 92fpkt", shape=diamond, color=yellow];
2244[label="194.0.101.212;s;44pkt 44fpkt", shape=diamond, color=yellow];
2431[label="148.245.38.59;d;87pkt 87fpkt", shape=diamond, color=yellow];
5326[label="194.0.101.224;11pkt 11fpkt", shape=pentagon, color=darkviolet];
stat550[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 148.245.156.10:*}[51.3966%]&lt;BR/&gt;{*:80, 148.245.38.59:*}[41.3408%]&lt;BR/&gt;{194.0.27.197:80, *:*}[28.4916%]&lt;BR/&gt;{194.0.101.212:80, *:*}[24.581%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.2222%)&lt;BR/&gt; 57649: (2.5641%)&lt;BR/&gt; 25216: (0.42735%)&lt;BR/&gt; 1857: (0.42735%)&lt;BR/&gt; 1852: (0.42735%)&gt;];
}
1889--2244[label="0.568182;25pkt 25fpkt"];
1889--2791[label="0.0666667;1pkt 1fpkt"];
1889--3353[label="0.0108696;1pkt 1fpkt"];
1889--3546[label="0.0108696;1pkt 1fpkt"];
1889--3574[label="0.0108696;1pkt 1fpkt"];
1889--3767[label="0.0108696;1pkt 1fpkt"];
1889--3792[label="0.0108696;1pkt 1fpkt"];
1889--5326[label="1;11pkt 11fpkt"];
2244--2431[label="0.431818;19pkt 19fpkt"];
</description>
    <slice>
      <filter src_ip="194.0.27.197" src_port="80"/>
      <filter src_ip="194.0.101.212" src_port="80"/>
      <filter dst_ip="148.245.156.10" src_port="80"/>
      <filter dst_ip="148.245.38.59" src_port="80"/>
    </slice>
    <from sec="1100149216" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="65.128.96.231"/>
    </slice>
    <from sec="1100149493" usec="0"/>
    <to sec="1100149541" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="65.34.110.232"/>
    </slice>
    <from sec="1100149204" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="46.26.124.232"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="87.179.137.232"/>
    </slice>
    <from sec="1100149202" usec="0"/>
    <to sec="1100149347" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.637883,1.39486,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_556{
style=filled;
color=gray75;
2622[label="147.9.211.219;s;66pkt 66fpkt", shape=diamond, color=yellow];
stat556[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.9.211.219:*, 214.33.240.167:80}[30.303%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1587: (0.757576%)&lt;BR/&gt; 1586: (0.757576%)&lt;BR/&gt; 1585: (0.757576%)&lt;BR/&gt; 1584: (0.757576%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="214.33.240.167" dst_port="80" src_ip="147.9.211.219"/>
    </slice>
    <from sec="1100149749" usec="0"/>
    <to sec="1100150024" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="46.26.124.235"/>
    </slice>
    <from sec="1100149538" usec="0"/>
    <to sec="1100149623" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.172.16.236"/>
    </slice>
    <from sec="1100149207" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="193.74.209.236"/>
    </slice>
    <from sec="1100149205" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.171.55.240"/>
    </slice>
    <from sec="1100149208" usec="0"/>
    <to sec="1100150097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="148.245.87.242"/>
    </slice>
    <from sec="1100149938" usec="0"/>
    <to sec="1100149984" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.26.215.242"/>
    </slice>
    <from sec="1100149211" usec="0"/>
    <to sec="1100150098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.176.90.245"/>
    </slice>
    <from sec="1100149448" usec="0"/>
    <to sec="1100150098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55074,1.28899,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_564{
style=filled;
color=gray75;
2668[label="208.93.181.157;d;29pkt 29fpkt", shape=diamond, color=yellow];
5405[label="147.203.230.248;22pkt 22fpkt", shape=pentagon, color=darkviolet];
stat564[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.203.230.248:*, 208.93.181.157:80}[75.8621%]&lt;BR/&gt;{148.245.216.22:*, 208.93.181.157:80}[24.1379%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3651: (1.96078%)&lt;BR/&gt; 3650: (1.96078%)&lt;BR/&gt; 3649: (1.96078%)&lt;BR/&gt; 3648: (1.96078%)&gt;];
}
2668--5405[label="1;22pkt 22fpkt"];
</description>
    <slice>
      <filter dst_ip="208.93.181.157" dst_port="80" src_ip="147.203.230.248"/>
      <filter dst_ip="208.93.181.157" dst_port="80" src_ip="148.245.216.22"/>
    </slice>
    <from sec="1100149949" usec="0"/>
    <to sec="1100150011" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="81.131.191.249"/>
    </slice>
    <from sec="1100149206" usec="0"/>
    <to sec="1100150098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.431313,1.36203,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="148.244.69.250"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100149676" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55074,1.28899,020,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_567{
style=filled;
color=gray75;
1986[label="166.164.43.254;s;307pkt 307fpkt", shape=diamond, color=yellow];
5421[label="166.164.43.254;492pkt 492fpkt", shape=pentagon, color=darkviolet];
stat567[shape=component, label=&lt;Rules:&lt;BR/&gt;{166.164.43.254:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1986--5421[label="0.996743;306pkt 306fpkt"];
</description>
    <slice>
      <filter src_ip="166.164.43.254"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_568{
style=filled;
color=gray75;
3999[label="148.244.10.0;17pkt 17fpkt", shape=pentagon, color=darkviolet];
5429[label="148.244.10.0;16pkt 16fpkt", shape=invtriangle, color=brown];
6152[label="148.244.10.0;16pkt 16fpkt", shape=invhouse, color=bisque];
stat568[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.244.10.0:*, 83.110.148.221:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4950: (3.06122%)&lt;BR/&gt; 4429: (3.06122%)&lt;BR/&gt; 4148: (3.06122%)&lt;BR/&gt; 3834: (3.06122%)&gt;];
}
3999--5429[label="1;16pkt 16fpkt"];
3999--6152[label="1;16pkt 16fpkt"];
5429--6152[label="1;16pkt 16fpkt"];
</description>
    <slice>
      <filter dst_ip="83.110.148.221" dst_port="80" src_ip="148.244.10.0"/>
    </slice>
    <from sec="1100149248" usec="0"/>
    <to sec="1100149340" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="209.15.209.0"/>
    </slice>
    <from sec="1100149291" usec="0"/>
    <to sec="1100149303" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_570{
style=filled;
color=gray75;
4019[label="197.58.161.3;153pkt 153fpkt", shape=pentagon, color=darkviolet];
5437[label="197.58.161.3;153pkt 153fpkt", shape=invtriangle, color=brown];
6159[label="197.58.161.3;153pkt 153fpkt", shape=invhouse, color=bisque];
stat570[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.58.161.3:*, *:1023}[55.5556%]&lt;BR/&gt;{197.58.161.3:*, *:9898}[44.4444%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1023: (27.7778%)&lt;BR/&gt; 9898: (22.2222%)&lt;BR/&gt; 4917: (0.653595%)&lt;BR/&gt; 4914: (0.653595%)&lt;BR/&gt; 4907: (0.653595%)&gt;];
}
4019--5437[label="1;153pkt 153fpkt"];
4019--6159[label="1;153pkt 153fpkt"];
5437--6159[label="1;153pkt 153fpkt"];
</description>
    <slice>
      <filter dst_port="1023" src_ip="197.58.161.3"/>
      <filter dst_port="9898" src_ip="197.58.161.3"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100149203" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.805151,1.21335,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_571{
style=filled;
color=gray75;
1586[label="148.244.72.9;s;45pkt 45fpkt", shape=diamond, color=yellow];
4054[label="148.244.72.9;47pkt 47fpkt", shape=pentagon, color=darkviolet];
5452[label="148.244.72.9;48pkt 48fpkt", shape=invtriangle, color=brown];
6165[label="148.244.72.9;48pkt 48fpkt", shape=invhouse, color=bisque];
stat571[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.244.72.9:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 65440: (1.06383%)&lt;BR/&gt; 64814: (1.06383%)&lt;BR/&gt; 64722: (1.06383%)&lt;BR/&gt; 64689: (1.06383%)&gt;];
}
1586--3353[label="0.0222222;1pkt 1fpkt"];
1586--3546[label="0.177778;8pkt 8fpkt"];
1586--3574[label="0.0222222;1pkt 1fpkt"];
1586--3767[label="0.177778;8pkt 8fpkt"];
1586--3792[label="0.0222222;1pkt 1fpkt"];
1586--4054[label="0.977778;44pkt 44fpkt"];
1586--5452[label="1;45pkt 45fpkt"];
1586--6165[label="1;45pkt 45fpkt"];
4054--5452[label="1;47pkt 47fpkt"];
4054--6165[label="1;47pkt 47fpkt"];
5452--6165[label="1;48pkt 48fpkt"];
</description>
    <slice>
      <filter src_ip="148.244.72.9" src_port="80"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_572{
style=filled;
color=gray75;
4061[label="148.245.143.9;22pkt 22fpkt", shape=pentagon, color=darkviolet];
5453[label="148.245.143.9;23pkt 23fpkt", shape=invtriangle, color=brown];
6166[label="148.245.143.9;23pkt 23fpkt", shape=invhouse, color=bisque];
stat572[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.143.9:*, 209.125.177.133:80}[91.3043%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3875: (2.20588%)&lt;BR/&gt; 3874: (2.20588%)&lt;BR/&gt; 3873: (2.20588%)&lt;BR/&gt; 3872: (2.20588%)&gt;];
}
4061--5453[label="1;22pkt 22fpkt"];
4061--6166[label="1;22pkt 22fpkt"];
5453--6166[label="1;23pkt 23fpkt"];
</description>
    <slice>
      <filter dst_ip="209.125.177.133" dst_port="80" src_ip="148.245.143.9"/>
    </slice>
    <from sec="1100149306" usec="0"/>
    <to sec="1100149796" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_573{
style=filled;
color=gray75;
4077[label="147.9.29.12;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5461[label="147.9.29.12;1pkt 1fpkt", shape=invtriangle, color=brown];
stat573[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.9.29.12:56282, 152.146.199.156:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 56282: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
4077--5461[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="152.146.199.156" dst_port="80" src_ip="147.9.29.12" src_port="56282"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="148.244.167.12"/>
    </slice>
    <from sec="1100149232" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="197.33.52.15"/>
    </slice>
    <from sec="1100149843" usec="0"/>
    <to sec="1100149845" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_576{
style=filled;
color=gray75;
4109[label="214.172.22.16;44pkt 44fpkt", shape=pentagon, color=darkviolet];
5482[label="214.172.22.16;45pkt 45fpkt", shape=invtriangle, color=brown];
stat576[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.172.22.16:0, *:0}[64.4444%]&lt;BR/&gt;{214.172.22.16:2848, *:*}[35.5556%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (64.0449%)&lt;BR/&gt; 2848: (17.9775%)&lt;BR/&gt; 65363: (1.1236%)&lt;BR/&gt; 63016: (1.1236%)&lt;BR/&gt; 61313: (1.1236%)&gt;];
}
4109--5482[label="1;44pkt 44fpkt"];
</description>
    <slice>
      <filter src_ip="214.172.22.16" src_port="2848"/>
      <filter src_ip="214.172.22.16"/>
    </slice>
    <from sec="1100149246" usec="0"/>
    <to sec="1100150098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="214.161.210.16"/>
    </slice>
    <from sec="1100149207" usec="0"/>
    <to sec="1100150095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_578{
style=filled;
color=gray75;
4116[label="128.0.234.16;53pkt 53fpkt", shape=pentagon, color=darkviolet];
5486[label="128.0.234.16;54pkt 54fpkt", shape=invtriangle, color=brown];
6186[label="128.0.234.16;54pkt 54fpkt", shape=invhouse, color=bisque];
stat578[shape=component, label=&lt;Rules:&lt;BR/&gt;{128.0.234.16:*, 45.179.201.72:80}[20.3704%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (42.5466%)&lt;BR/&gt; 3478: (2.79503%)&lt;BR/&gt; 19530: (1.86335%)&lt;BR/&gt; 9000: (1.86335%)&lt;BR/&gt; 5050: (1.86335%)&gt;];
}
4116--5486[label="1;53pkt 53fpkt"];
4116--6186[label="1;53pkt 53fpkt"];
5486--6186[label="1;54pkt 54fpkt"];
</description>
    <slice>
      <filter dst_ip="45.179.201.72" dst_port="80" src_ip="128.0.234.16"/>
    </slice>
    <from sec="1100149219" usec="0"/>
    <to sec="1100150089" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="162.3.56.18"/>
    </slice>
    <from sec="1100149219" usec="0"/>
    <to sec="1100150076" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_581{
style=filled;
color=gray75;
4140[label="197.51.44.20;15pkt 15fpkt", shape=pentagon, color=darkviolet];
5495[label="197.51.44.20;15pkt 15fpkt", shape=invtriangle, color=brown];
6191[label="197.51.44.20;15pkt 15fpkt", shape=invhouse, color=bisque];
stat581[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.51.44.20:80, 214.161.192.185:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3215: (3.33333%)&lt;BR/&gt; 3210: (3.33333%)&lt;BR/&gt; 3209: (3.33333%)&lt;BR/&gt; 3208: (3.33333%)&gt;];
}
4140--5495[label="1;15pkt 15fpkt"];
4140--6191[label="1;15pkt 15fpkt"];
5495--6191[label="1;15pkt 15fpkt"];
</description>
    <slice>
      <filter dst_ip="214.161.192.185" src_ip="197.51.44.20" src_port="80"/>
    </slice>
    <from sec="1100149294" usec="0"/>
    <to sec="1100149332" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="87.52.80.25"/>
    </slice>
    <from sec="1100149214" usec="0"/>
    <to sec="1100150096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="208.15.9.26"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_584{
style=filled;
color=gray75;
4186[label="195.97.12.26;122pkt 122fpkt", shape=pentagon, color=darkviolet];
5517[label="195.97.12.26;122pkt 122fpkt", shape=invtriangle, color=brown];
6207[label="195.97.12.26;122pkt 122fpkt", shape=invhouse, color=bisque];
stat584[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.97.12.26:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 33293: (0.409836%)&lt;BR/&gt; 33292: (0.409836%)&lt;BR/&gt; 33291: (0.409836%)&lt;BR/&gt; 33290: (0.409836%)&gt;];
}
4186--5517[label="1;122pkt 122fpkt"];
4186--6207[label="1;122pkt 122fpkt"];
5517--6207[label="1;122pkt 122fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="195.97.12.26"/>
    </slice>
    <from sec="1100149612" usec="0"/>
    <to sec="1100149613" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_585{
style=filled;
color=gray75;
4195[label="215.177.85.27;5pkt 5fpkt", shape=pentagon, color=darkviolet];
5519[label="215.177.85.27;6pkt 6fpkt", shape=invtriangle, color=brown];
stat585[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.177.85.27:80, 147.9.210.131:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3577: (9.09091%)&lt;BR/&gt; 3576: (9.09091%)&lt;BR/&gt; 3575: (9.09091%)&lt;BR/&gt; 3574: (9.09091%)&gt;];
}
4195--5519[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="147.9.210.131" src_ip="215.177.85.27" src_port="80"/>
    </slice>
    <from sec="1100149427" usec="0"/>
    <to sec="1100149436" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_586{
style=filled;
color=gray75;
4199[label="194.108.135.27;196pkt 196fpkt", shape=pentagon, color=darkviolet];
5522[label="194.108.135.27;197pkt 197fpkt", shape=invtriangle, color=brown];
stat586[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.108.135.27:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 50993: (0.508906%)&lt;BR/&gt; 50927: (0.508906%)&lt;BR/&gt; 50594: (0.508906%)&lt;BR/&gt; 50560: (0.508906%)&gt;];
}
4199--5522[label="1;196pkt 196fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="194.108.135.27"/>
    </slice>
    <from sec="1100149205" usec="0"/>
    <to sec="1100149238" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="207.57.139.28"/>
    </slice>
    <from sec="1100149203" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.805151,1.21335,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_588{
style=filled;
color=gray75;
2168[label="219.94.22.29;s;497pkt 497fpkt", shape=diamond, color=yellow];
4209[label="219.94.22.29;529pkt 529fpkt", shape=pentagon, color=darkviolet];
5526[label="219.94.22.29;529pkt 529fpkt", shape=invtriangle, color=brown];
6211[label="219.94.22.29;529pkt 529fpkt", shape=invhouse, color=bisque];
stat588[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.94.22.29:53, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (53.8628%)&lt;BR/&gt; 1024: (1.75144%)&lt;BR/&gt; 32768: (1.51152%)&lt;BR/&gt; 32770: (0.863724%)&lt;BR/&gt; 32769: (0.863724%)&gt;];
}
2168--3356[label="0.00201207;1pkt 1fpkt"];
2168--3545[label="0.0744467;37pkt 37fpkt"];
2168--3560[label="0.00603622;3pkt 3fpkt"];
2168--3577[label="0.00201207;1pkt 1fpkt"];
2168--3766[label="0.0744467;37pkt 37fpkt"];
2168--3780[label="0.00603622;3pkt 3fpkt"];
2168--3795[label="0.00201207;1pkt 1fpkt"];
2168--3990[label="0.00603622;3pkt 3fpkt"];
2168--4209[label="0.995976;495pkt 495fpkt"];
2168--5526[label="0.995976;495pkt 495fpkt"];
2168--6211[label="0.995976;495pkt 495fpkt"];
4209--5526[label="1;529pkt 529fpkt"];
4209--6211[label="1;529pkt 529fpkt"];
5526--6211[label="1;529pkt 529fpkt"];
</description>
    <slice>
      <filter src_ip="219.94.22.29" src_port="53"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_589{
style=filled;
color=gray75;
4226[label="205.87.144.31;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5532[label="205.87.144.31;1pkt 1fpkt", shape=invtriangle, color=brown];
6213[label="205.87.144.31;1pkt 1fpkt", shape=invhouse, color=bisque];
stat589[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.87.144.31:1206, 148.245.37.64:5539}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5539: (50%)&lt;BR/&gt; 1206: (50%)&gt;];
}
4226--5532[label="1;1pkt 1fpkt"];
4226--6213[label="1;1pkt 1fpkt"];
5532--6213[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="148.245.37.64" dst_port="5539" src_ip="205.87.144.31" src_port="1206"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100149320" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="213.50.175.32"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100149247" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_591{
style=filled;
color=gray75;
4238[label="148.245.68.33;42pkt 42fpkt", shape=pentagon, color=darkviolet];
5537[label="148.245.68.33;41pkt 41fpkt", shape=invtriangle, color=brown];
stat591[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.68.33:*, 206.60.1.77:80}[26.1905%]&lt;BR/&gt;{148.245.68.33:1040, *:53}[21.4286%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (39.1566%)&lt;BR/&gt; 1040: (10.8434%)&lt;BR/&gt; 53: (10.8434%)&lt;BR/&gt; 4825: (1.20482%)&lt;BR/&gt; 1692: (1.20482%)&gt;];
}
4238--5537[label="1;41pkt 41fpkt"];
</description>
    <slice>
      <filter dst_ip="206.60.1.77" dst_port="80" src_ip="148.245.68.33"/>
      <filter dst_port="53" src_ip="148.245.68.33" src_port="1040"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100149973" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="46.26.123.34"/>
    </slice>
    <from sec="1100149246" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.867092,1.32527,020,0 0 0 1 0 0 0 0 0 0 1 1 ">
    <description>subgraph cluster_593{
style=filled;
color=gray75;
1839[label="215.26.202.34;s;263pkt 263fpkt", shape=diamond, color=yellow];
5544[label="215.26.202.34;265pkt 265fpkt", shape=invtriangle, color=brown];
6221[label="215.26.202.34;265pkt 265fpkt", shape=invhouse, color=bisque];
stat593[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.26.202.34:0, *:0}[99.2453%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.2434%)&lt;BR/&gt; 445: (0.37831%)&lt;BR/&gt; 3699: (0.189155%)&lt;BR/&gt; 3547: (0.189155%)&gt;];
}
1839--5544[label="1;263pkt 263fpkt"];
1839--6221[label="1;263pkt 263fpkt"];
5544--6221[label="1;265pkt 265fpkt"];
</description>
    <slice>
      <filter src_ip="215.26.202.34"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_594{
style=filled;
color=gray75;
4251[label="148.245.82.35;62pkt 62fpkt", shape=pentagon, color=darkviolet];
5546[label="148.245.82.35;62pkt 62fpkt", shape=invtriangle, color=brown];
6222[label="148.245.82.35;62pkt 62fpkt", shape=invhouse, color=bisque];
stat594[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.82.35:*, 80.56.88.36:80}[80.6452%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1277: (0.806452%)&lt;BR/&gt; 1266: (0.806452%)&lt;BR/&gt; 1265: (0.806452%)&lt;BR/&gt; 1264: (0.806452%)&gt;];
}
4251--5546[label="1;62pkt 62fpkt"];
4251--6222[label="1;62pkt 62fpkt"];
5546--6222[label="1;62pkt 62fpkt"];
</description>
    <slice>
      <filter dst_ip="80.56.88.36" dst_port="80" src_ip="148.245.82.35"/>
    </slice>
    <from sec="1100149285" usec="0"/>
    <to sec="1100149440" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="148.245.85.35"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_596{
style=filled;
color=gray75;
4264[label="128.0.234.36;5pkt 5fpkt", shape=pentagon, color=darkviolet];
5552[label="128.0.234.36;4pkt 4fpkt", shape=invtriangle, color=brown];
stat596[shape=component, label=&lt;Rules:&lt;BR/&gt;{128.0.234.36:1263, 87.152.82.101:80}[20%]&lt;BR/&gt;{128.0.234.36:1264, 87.152.82.101:80}[20%]&lt;BR/&gt;{128.0.234.36:1265, 87.152.82.101:80}[20%]&lt;BR/&gt;{128.0.234.36:1266, 87.152.82.101:80}[20%]&lt;BR/&gt;{128.0.234.36:1267, 87.152.82.101:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1267: (11.1111%)&lt;BR/&gt; 1266: (11.1111%)&lt;BR/&gt; 1265: (11.1111%)&lt;BR/&gt; 1264: (11.1111%)&gt;];
}
4264--5552[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="87.152.82.101" dst_port="80" src_ip="128.0.234.36" src_port="1267"/>
      <filter dst_ip="87.152.82.101" dst_port="80" src_ip="128.0.234.36" src_port="1266"/>
      <filter dst_ip="87.152.82.101" dst_port="80" src_ip="128.0.234.36" src_port="1265"/>
      <filter dst_ip="87.152.82.101" dst_port="80" src_ip="128.0.234.36" src_port="1264"/>
      <filter dst_ip="87.152.82.101" dst_port="80" src_ip="128.0.234.36" src_port="1263"/>
    </slice>
    <from sec="1100149836" usec="0"/>
    <to sec="1100149998" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_597{
style=filled;
color=gray75;
4279[label="197.181.77.39;217pkt 217fpkt", shape=pentagon, color=darkviolet];
5558[label="197.181.77.39;218pkt 218fpkt", shape=invtriangle, color=brown];
6232[label="197.181.77.39;218pkt 218fpkt", shape=invhouse, color=bisque];
stat597[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.181.77.39:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
4279--5558[label="1;217pkt 217fpkt"];
4279--6232[label="1;217pkt 217fpkt"];
5558--6232[label="1;218pkt 218fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="197.181.77.39" src_port="1025"/>
    </slice>
    <from sec="1100149721" usec="0"/>
    <to sec="1100149759" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.633119,1.23269,010,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_598{
style=filled;
color=gray75;
1993[label="10.10.10.10;d;288pkt 288fpkt", shape=diamond, color=yellow];
4284[label="165.27.137.40;77pkt 77fpkt", shape=pentagon, color=darkviolet];
5559[label="165.27.137.40;77pkt 77fpkt", shape=invtriangle, color=brown];
stat598[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.27.137.40:*, 10.10.10.10:6667}[26.5306%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (49.8869%)&lt;BR/&gt; 3891: (0.452489%)&lt;BR/&gt; 3980: (0.339367%)&lt;BR/&gt; 3979: (0.339367%)&lt;BR/&gt; 3977: (0.339367%)&gt;];
}
1993--4284[label="0.922078;71pkt 71fpkt"];
1993--5559[label="0.922078;71pkt 71fpkt"];
4284--5559[label="1;77pkt 77fpkt"];
</description>
    <slice>
      <filter dst_ip="10.10.10.10" dst_port="6667" src_ip="165.27.137.40"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="46.26.123.41"/>
    </slice>
    <from sec="1100149203" usec="0"/>
    <to sec="1100149283" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="201.240.38.44"/>
    </slice>
    <from sec="1100149229" usec="0"/>
    <to sec="1100150090" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_602{
style=filled;
color=gray75;
4309[label="197.36.186.45;202pkt 202fpkt", shape=pentagon, color=darkviolet];
5569[label="197.36.186.45;203pkt 203fpkt", shape=invtriangle, color=brown];
6239[label="197.36.186.45;202pkt 202fpkt", shape=invhouse, color=bisque];
stat602[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.36.186.45:*, *:9898}[73.399%]&lt;BR/&gt;{197.36.186.45:*, *:1023}[26.601%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (36.8204%)&lt;BR/&gt; 1023: (13.1796%)&lt;BR/&gt; 4329: (0.247117%)&lt;BR/&gt; 4328: (0.247117%)&lt;BR/&gt; 4327: (0.247117%)&gt;];
}
4309--5569[label="1;202pkt 202fpkt"];
4309--6239[label="1;202pkt 202fpkt"];
5569--6239[label="1;202pkt 202fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="197.36.186.45"/>
      <filter dst_port="1023" src_ip="197.36.186.45"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100149204" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_603{
style=filled;
color=gray75;
4316[label="148.245.68.48;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5572[label="148.245.68.48;1pkt 1fpkt", shape=invtriangle, color=brown];
stat603[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.68.48:19051, 214.33.240.168:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 19051: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
4316--5572[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="214.33.240.168" dst_port="80" src_ip="148.245.68.48" src_port="19051"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_604{
style=filled;
color=gray75;
4326[label="148.244.71.49;27pkt 27fpkt", shape=pentagon, color=darkviolet];
5574[label="148.244.71.49;28pkt 28fpkt", shape=invtriangle, color=brown];
stat604[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.244.71.49:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 60437: (1.81818%)&lt;BR/&gt; 57591: (1.81818%)&lt;BR/&gt; 56227: (1.81818%)&lt;BR/&gt; 55694: (1.81818%)&gt;];
}
4326--5574[label="1;27pkt 27fpkt"];
</description>
    <slice>
      <filter src_ip="148.244.71.49" src_port="80"/>
    </slice>
    <from sec="1100149207" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_605{
style=filled;
color=gray75;
4328[label="148.245.182.49;24pkt 24fpkt", shape=pentagon, color=darkviolet];
5575[label="148.245.182.49;23pkt 23fpkt", shape=invtriangle, color=brown];
6241[label="148.245.182.49;24pkt 24fpkt", shape=invhouse, color=bisque];
stat605[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.182.49:80, 45.4.172.20:*}[62.5%]&lt;BR/&gt;{148.245.182.49:53, *:53}[29.1667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (35.2113%)&lt;BR/&gt; 53: (29.5775%)&lt;BR/&gt; 60798: (2.11268%)&lt;BR/&gt; 60389: (2.11268%)&lt;BR/&gt; 55954: (2.11268%)&gt;];
}
4328--5575[label="1;23pkt 23fpkt"];
4328--6241[label="1;24pkt 24fpkt"];
5575--6241[label="1;23pkt 23fpkt"];
</description>
    <slice>
      <filter dst_ip="45.4.172.20" src_ip="148.245.182.49" src_port="80"/>
      <filter dst_port="53" src_ip="148.245.182.49" src_port="53"/>
    </slice>
    <from sec="1100149221" usec="0"/>
    <to sec="1100150078" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_606{
style=filled;
color=gray75;
4338[label="197.134.198.50;254pkt 254fpkt", shape=pentagon, color=darkviolet];
5579[label="197.134.198.50;255pkt 255fpkt", shape=invtriangle, color=brown];
stat606[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.134.198.50:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
4338--5579[label="1;254pkt 254fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="197.134.198.50" src_port="1028"/>
    </slice>
    <from sec="1100149780" usec="0"/>
    <to sec="1100149799" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="204.44.23.51"/>
    </slice>
    <from sec="1100149223" usec="0"/>
    <to sec="1100150093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_608{
style=filled;
color=gray75;
4342[label="128.0.100.51;49pkt 49fpkt", shape=pentagon, color=darkviolet];
5582[label="128.0.100.51;50pkt 50fpkt", shape=invtriangle, color=brown];
6242[label="128.0.100.51;50pkt 50fpkt", shape=invhouse, color=bisque];
stat608[shape=component, label=&lt;Rules:&lt;BR/&gt;{128.0.100.51:17854, *:*}[90%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 17854: (44.9664%)&lt;BR/&gt; 123: (4.02685%)&lt;BR/&gt; 5456: (2.01342%)&lt;BR/&gt; 64078: (1.00671%)&lt;BR/&gt; 62328: (1.00671%)&gt;];
}
4342--5582[label="1;49pkt 49fpkt"];
4342--6242[label="1;49pkt 49fpkt"];
5582--6242[label="1;50pkt 50fpkt"];
</description>
    <slice>
      <filter src_ip="128.0.100.51" src_port="17854"/>
    </slice>
    <from sec="1100149259" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="46.26.123.51"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100149300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_610{
style=filled;
color=gray75;
4345[label="148.245.160.51;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5585[label="148.245.160.51;3pkt 3fpkt", shape=invtriangle, color=brown];
stat610[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.160.51:1219, 45.4.197.224:80}[33.3333%]&lt;BR/&gt;{148.245.160.51:1212, 192.104.197.100:80}[33.3333%]&lt;BR/&gt;{148.245.160.51:1213, 192.104.197.100:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1213: (20%)&lt;BR/&gt; 1212: (20%)&lt;BR/&gt; 1219: (10%)&gt;];
}
4345--5585[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="192.104.197.100" dst_port="80" src_ip="148.245.160.51" src_port="1213"/>
      <filter dst_ip="192.104.197.100" dst_port="80" src_ip="148.245.160.51" src_port="1212"/>
      <filter dst_ip="45.4.197.224" dst_port="80" src_ip="148.245.160.51" src_port="1219"/>
    </slice>
    <from sec="1100149871" usec="0"/>
    <to sec="1100150058" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="80.79.199.51"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_612{
style=filled;
color=gray75;
4353[label="82.153.186.52;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5591[label="82.153.186.52;1pkt 1fpkt", shape=invtriangle, color=brown];
stat612[shape=component, label=&lt;Rules:&lt;BR/&gt;{82.153.186.52:80, 147.203.203.24:51352}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 51352: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
4353--5591[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="147.203.203.24" dst_port="51352" src_ip="82.153.186.52" src_port="80"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_613{
style=filled;
color=gray75;
4358[label="147.203.230.53;73pkt 73fpkt", shape=pentagon, color=darkviolet];
5594[label="147.203.230.53;73pkt 73fpkt", shape=invtriangle, color=brown];
stat613[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.203.230.53:*, 64.162.171.202:80}[39.726%]&lt;BR/&gt;{147.203.230.53:*, 64.26.241.161:80}[35.6164%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3651: (0.684932%)&lt;BR/&gt; 3649: (0.684932%)&lt;BR/&gt; 3646: (0.684932%)&lt;BR/&gt; 3642: (0.684932%)&gt;];
}
4358--5594[label="1;73pkt 73fpkt"];
</description>
    <slice>
      <filter dst_ip="64.162.171.202" dst_port="80" src_ip="147.203.230.53"/>
      <filter dst_ip="64.26.241.161" dst_port="80" src_ip="147.203.230.53"/>
    </slice>
    <from sec="1100149208" usec="0"/>
    <to sec="1100150061" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,020,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_614{
style=filled;
color=gray75;
4363[label="214.161.205.55;17pkt 17fpkt", shape=pentagon, color=darkviolet];
5597[label="214.161.205.55;18pkt 18fpkt", shape=invtriangle, color=brown];
stat614[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.161.205.55:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
4363--5597[label="1;17pkt 17fpkt"];
</description>
    <slice>
      <filter src_ip="214.161.205.55"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.805151,1.21335,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_617{
style=filled;
color=gray75;
2503[label="148.245.88.59;s;40pkt 40fpkt", shape=diamond, color=yellow];
4386[label="148.245.88.59;42pkt 42fpkt", shape=pentagon, color=darkviolet];
5608[label="148.245.88.59;43pkt 43fpkt", shape=invtriangle, color=brown];
6255[label="148.245.88.59;42pkt 42fpkt", shape=invhouse, color=bisque];
stat617[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.88.59:25, *:*}[69.7674%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (35.0299%)&lt;BR/&gt; 80: (8.38323%)&lt;BR/&gt; 53: (5.38922%)&lt;BR/&gt; 65457: (1.1976%)&lt;BR/&gt; 65295: (1.1976%)&gt;];
}
2503--4386[label="0.975;39pkt 39fpkt"];
2503--5608[label="1;40pkt 40fpkt"];
2503--6255[label="0.975;39pkt 39fpkt"];
4386--5608[label="1;42pkt 42fpkt"];
4386--6255[label="1;42pkt 42fpkt"];
5608--6255[label="1;42pkt 42fpkt"];
</description>
    <slice>
      <filter src_ip="148.245.88.59" src_port="25"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_618{
style=filled;
color=gray75;
4388[label="148.244.168.59;34pkt 34fpkt", shape=pentagon, color=darkviolet];
5611[label="148.244.168.59;35pkt 35fpkt", shape=invtriangle, color=brown];
6256[label="148.244.168.59;35pkt 35fpkt", shape=invhouse, color=bisque];
stat618[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.244.168.59:*, 205.122.204.96:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1948: (1.44231%)&lt;BR/&gt; 1947: (1.44231%)&lt;BR/&gt; 1946: (1.44231%)&lt;BR/&gt; 1945: (1.44231%)&gt;];
}
4388--5611[label="1;34pkt 34fpkt"];
4388--6256[label="1;34pkt 34fpkt"];
5611--6256[label="1;35pkt 35fpkt"];
</description>
    <slice>
      <filter dst_ip="205.122.204.96" dst_port="80" src_ip="148.244.168.59"/>
    </slice>
    <from sec="1100149204" usec="0"/>
    <to sec="1100149390" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="41.62.91.60"/>
    </slice>
    <from sec="1100149877" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="82.244.155.60"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100149554" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_621{
style=filled;
color=gray75;
4392[label="201.50.247.60;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5614[label="201.50.247.60;1pkt 1fpkt", shape=invtriangle, color=brown];
6258[label="201.50.247.60;1pkt 1fpkt", shape=invhouse, color=bisque];
stat621[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.50.247.60:554, 147.203.226.87:1333}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1333: (50%)&lt;BR/&gt; 554: (50%)&gt;];
}
4392--5614[label="1;1pkt 1fpkt"];
4392--6258[label="1;1pkt 1fpkt"];
5614--6258[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="147.203.226.87" dst_port="1333" src_ip="201.50.247.60" src_port="554"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_622{
style=filled;
color=gray75;
4399[label="81.187.104.62;255pkt 255fpkt", shape=pentagon, color=darkviolet];
5618[label="81.187.104.62;254pkt 254fpkt", shape=invtriangle, color=brown];
6260[label="81.187.104.62;255pkt 255fpkt", shape=invhouse, color=bisque];
stat622[shape=component, label=&lt;Rules:&lt;BR/&gt;{81.187.104.62:*, *:135}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 2440: (0.196335%)&lt;BR/&gt; 2439: (0.196335%)&lt;BR/&gt; 2438: (0.196335%)&lt;BR/&gt; 2437: (0.196335%)&gt;];
}
4399--5618[label="1;254pkt 254fpkt"];
4399--6260[label="1;255pkt 255fpkt"];
5618--6260[label="1;254pkt 254fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="81.187.104.62"/>
    </slice>
    <from sec="1100149264" usec="0"/>
    <to sec="1100149289" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="148.245.221.62"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100149238" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="162.3.62.63"/>
    </slice>
    <from sec="1100149207" usec="0"/>
    <to sec="1100150097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.805151,1.21335,010,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_625{
style=filled;
color=gray75;
857[label="148.245.180.200;d;62pkt 62fpkt", shape=diamond, color=yellow];
1093[label="214.74.61.142;s;2321pkt 2321fpkt", shape=diamond, color=yellow];
4406[label="82.93.130.63;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5623[label="82.93.130.63;1pkt 1fpkt", shape=invtriangle, color=brown];
6263[label="82.93.130.63;1pkt 1fpkt", shape=invhouse, color=bisque];
stat625[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.74.61.142:7000, *:*}[49.0344%]&lt;BR/&gt;{214.74.61.142:7200, *:*}[48.4047%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7000: (24.4761%)&lt;BR/&gt; 7200: (24.1827%)&lt;BR/&gt; 80: (1.3202%)&lt;BR/&gt; 60338: (0.0838223%)&lt;BR/&gt; 36990: (0.0628667%)&gt;];
}
857--1093[label="0.016129;1pkt 1fpkt"];
857--1134[label="0.285714;2pkt 2fpkt"];
857--1500[label="0.2;1pkt 1fpkt"];
857--2394[label="0.0175439;1pkt 1fpkt"];
857--2624[label="0.25;2pkt 2fpkt"];
857--2909[label="0.2;1pkt 1fpkt"];
857--3220[label="0.0175439;1pkt 1fpkt"];
857--3549[label="0.0967742;6pkt 6fpkt"];
857--3555[label="0.129032;8pkt 8fpkt"];
857--3561[label="0.112903;7pkt 7fpkt"];
857--3770[label="0.0967742;6pkt 6fpkt"];
857--3775[label="0.129032;8pkt 8fpkt"];
857--3781[label="0.112903;7pkt 7fpkt"];
857--3982[label="0.0967742;6pkt 6fpkt"];
857--3986[label="0.129032;8pkt 8fpkt"];
857--3991[label="0.112903;7pkt 7fpkt"];
857--4059[label="0.0163934;1pkt 1fpkt"];
857--4406[label="1;1pkt 1fpkt"];
857--5112[label="0.285714;2pkt 2fpkt"];
857--5623[label="1;1pkt 1fpkt"];
857--5986[label="0.166667;1pkt 1fpkt"];
857--6263[label="1;1pkt 1fpkt"];
4406--5623[label="1;1pkt 1fpkt"];
4406--6263[label="1;1pkt 1fpkt"];
5623--6263[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="214.74.61.142" src_port="7000"/>
      <filter src_ip="214.74.61.142" src_port="7200"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,020,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_626{
style=filled;
color=gray75;
4411[label="148.245.162.64;31pkt 31fpkt", shape=pentagon, color=darkviolet];
5626[label="148.245.162.64;32pkt 32fpkt", shape=invtriangle, color=brown];
6266[label="148.245.162.64;31pkt 31fpkt", shape=invhouse, color=bisque];
stat626[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.162.64:0, *:0}[93.75%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (93.617%)&lt;BR/&gt; 9898: (1.59574%)&lt;BR/&gt; 5554: (1.59574%)&lt;BR/&gt; 4816: (1.59574%)&lt;BR/&gt; 4448: (1.59574%)&gt;];
}
4411--5626[label="1;31pkt 31fpkt"];
4411--6266[label="1;31pkt 31fpkt"];
5626--6266[label="1;31pkt 31fpkt"];
</description>
    <slice>
      <filter src_ip="148.245.162.64"/>
    </slice>
    <from sec="1100149243" usec="0"/>
    <to sec="1100150071" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_627{
style=filled;
color=gray75;
4413[label="147.203.31.65;23pkt 23fpkt", shape=pentagon, color=darkviolet];
5627[label="147.203.31.65;23pkt 23fpkt", shape=invtriangle, color=brown];
stat627[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.203.31.65:*, 205.11.217.99:80}[52.1739%]&lt;BR/&gt;{147.203.31.65:*, 205.11.217.99:443}[39.1304%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (28.2609%)&lt;BR/&gt; 443: (21.7391%)&lt;BR/&gt; 3755: (2.17391%)&lt;BR/&gt; 3754: (2.17391%)&lt;BR/&gt; 3753: (2.17391%)&gt;];
}
4413--5627[label="1;23pkt 23fpkt"];
</description>
    <slice>
      <filter dst_ip="205.11.217.99" dst_port="80" src_ip="147.203.31.65"/>
      <filter dst_ip="205.11.217.99" dst_port="443" src_ip="147.203.31.65"/>
    </slice>
    <from sec="1100149204" usec="0"/>
    <to sec="1100150055" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_628{
style=filled;
color=gray75;
4418[label="133.128.129.66;16pkt 16fpkt", shape=pentagon, color=darkviolet];
5630[label="133.128.129.66;17pkt 17fpkt", shape=invtriangle, color=brown];
stat628[shape=component, label=&lt;Rules:&lt;BR/&gt;{133.128.129.66:80, 147.9.29.12:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 56261: (3.0303%)&lt;BR/&gt; 56252: (3.0303%)&lt;BR/&gt; 56249: (3.0303%)&lt;BR/&gt; 56239: (3.0303%)&gt;];
}
4418--5630[label="1;16pkt 16fpkt"];
</description>
    <slice>
      <filter dst_ip="147.9.29.12" src_ip="133.128.129.66" src_port="80"/>
    </slice>
    <from sec="1100150038" usec="0"/>
    <to sec="1100150095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_629{
style=filled;
color=gray75;
4419[label="86.193.133.66;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5631[label="86.193.133.66;3pkt 3fpkt", shape=invtriangle, color=brown];
6268[label="86.193.133.66;2pkt 2fpkt", shape=invhouse, color=bisque];
stat629[shape=component, label=&lt;Rules:&lt;BR/&gt;{86.193.133.66:1860, 147.203.182.84:80}[33.3333%]&lt;BR/&gt;{86.193.133.66:1861, 147.203.182.84:80}[33.3333%]&lt;BR/&gt;{86.193.133.66:1862, 147.203.182.84:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1862: (21.4286%)&lt;BR/&gt; 1861: (21.4286%)&lt;BR/&gt; 1860: (7.14286%)&gt;];
}
4419--5631[label="1;2pkt 2fpkt"];
4419--6268[label="1;2pkt 2fpkt"];
5631--6268[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="147.203.182.84" dst_port="80" src_ip="86.193.133.66" src_port="1862"/>
      <filter dst_ip="147.203.182.84" dst_port="80" src_ip="86.193.133.66" src_port="1861"/>
      <filter dst_ip="147.203.182.84" dst_port="80" src_ip="86.193.133.66" src_port="1860"/>
    </slice>
    <from sec="1100149391" usec="0"/>
    <to sec="1100149444" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_631{
style=filled;
color=gray75;
4429[label="64.173.34.68;223pkt 223fpkt", shape=pentagon, color=darkviolet];
5638[label="64.173.34.68;222pkt 222fpkt", shape=invtriangle, color=brown];
stat631[shape=component, label=&lt;Rules:&lt;BR/&gt;{64.173.34.68:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 35261: (0.224719%)&lt;BR/&gt; 35247: (0.224719%)&lt;BR/&gt; 35238: (0.224719%)&lt;BR/&gt; 35165: (0.224719%)&gt;];
}
4429--5638[label="1;222pkt 222fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="64.173.34.68"/>
    </slice>
    <from sec="1100149425" usec="0"/>
    <to sec="1100149459" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,504,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="154.220.36.69"/>
    </slice>
    <from sec="1100149317" usec="0"/>
    <to sec="1100149910" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_633{
style=filled;
color=gray75;
4441[label="82.131.81.69;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5645[label="82.131.81.69;1pkt 1fpkt", shape=invtriangle, color=brown];
6274[label="82.131.81.69;1pkt 1fpkt", shape=invhouse, color=bisque];
stat633[shape=component, label=&lt;Rules:&lt;BR/&gt;{82.131.81.69:80, 148.245.145.221:3287}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3287: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
4441--5645[label="1;1pkt 1fpkt"];
4441--6274[label="1;1pkt 1fpkt"];
5645--6274[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="148.245.145.221" dst_port="3287" src_ip="82.131.81.69" src_port="80"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_634{
style=filled;
color=gray75;
4462[label="45.105.40.73;170pkt 170fpkt", shape=pentagon, color=darkviolet];
5656[label="45.105.40.73;169pkt 169fpkt", shape=invtriangle, color=brown];
6281[label="45.105.40.73;170pkt 170fpkt", shape=invhouse, color=bisque];
stat634[shape=component, label=&lt;Rules:&lt;BR/&gt;{45.105.40.73:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
4462--5656[label="1;169pkt 169fpkt"];
4462--6281[label="1;170pkt 170fpkt"];
5656--6281[label="1;169pkt 169fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="45.105.40.73" src_port="1026"/>
    </slice>
    <from sec="1100149296" usec="0"/>
    <to sec="1100149342" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="214.20.168.73"/>
    </slice>
    <from sec="1100149782" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_636{
style=filled;
color=gray75;
4472[label="148.245.138.74;5pkt 5fpkt", shape=pentagon, color=darkviolet];
5660[label="148.245.138.74;6pkt 6fpkt", shape=invtriangle, color=brown];
6283[label="148.245.138.74;5pkt 5fpkt", shape=invhouse, color=bisque];
stat636[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.138.74:*, 204.77.179.40:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1414: (9.375%)&lt;BR/&gt; 1413: (9.375%)&lt;BR/&gt; 1412: (9.375%)&lt;BR/&gt; 1411: (9.375%)&gt;];
}
4472--5660[label="1;5pkt 5fpkt"];
4472--6283[label="1;5pkt 5fpkt"];
5660--6283[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="204.77.179.40" dst_port="80" src_ip="148.245.138.74"/>
    </slice>
    <from sec="1100149616" usec="0"/>
    <to sec="1100149714" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="128.0.170.74"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_638{
style=filled;
color=gray75;
4487[label="215.26.222.76;14pkt 14fpkt", shape=pentagon, color=darkviolet];
5670[label="215.26.222.76;14pkt 14fpkt", shape=invtriangle, color=brown];
stat638[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.26.222.76:80, 205.20.33.184:*}[85.7143%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.4286%)&lt;BR/&gt; 57338: (3.57143%)&lt;BR/&gt; 57299: (3.57143%)&lt;BR/&gt; 57289: (3.57143%)&lt;BR/&gt; 57216: (3.57143%)&gt;];
}
4487--5670[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter dst_ip="205.20.33.184" src_ip="215.26.222.76" src_port="80"/>
    </slice>
    <from sec="1100149361" usec="0"/>
    <to sec="1100149710" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="83.8.229.76"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_640{
style=filled;
color=gray75;
4489[label="214.247.232.76;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5672[label="214.247.232.76;1pkt 1fpkt", shape=invtriangle, color=brown];
6289[label="214.247.232.76;1pkt 1fpkt", shape=invhouse, color=bisque];
stat640[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.247.232.76:51785, 162.3.58.92:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 51785: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
4489--5672[label="1;1pkt 1fpkt"];
4489--6289[label="1;1pkt 1fpkt"];
5672--6289[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="162.3.58.92" dst_port="80" src_ip="214.247.232.76" src_port="51785"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100149275" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="86.244.3.77"/>
    </slice>
    <from sec="1100149351" usec="0"/>
    <to sec="1100150088" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="205.53.14.77"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_643{
style=filled;
color=gray75;
4498[label="147.35.137.78;159pkt 159fpkt", shape=pentagon, color=darkviolet];
5680[label="147.35.137.78;160pkt 160fpkt", shape=invtriangle, color=brown];
6295[label="147.35.137.78;159pkt 159fpkt", shape=invhouse, color=bisque];
stat643[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.35.137.78:1033, *:53}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1033: (50%)&lt;BR/&gt; 53: (50%)&gt;];
}
4498--5680[label="1;159pkt 159fpkt"];
4498--6295[label="1;159pkt 159fpkt"];
5680--6295[label="1;159pkt 159fpkt"];
</description>
    <slice>
      <filter dst_port="53" src_ip="147.35.137.78" src_port="1033"/>
    </slice>
    <from sec="1100149208" usec="0"/>
    <to sec="1100150076" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.867092,1.32527,020,0 0 0 1 0 0 0 0 0 0 1 1 ">
    <description>subgraph cluster_644{
style=filled;
color=gray75;
2332[label="148.245.108.79;s;455pkt 455fpkt", shape=diamond, color=yellow];
5682[label="148.245.108.79;547pkt 547fpkt", shape=invtriangle, color=brown];
6297[label="148.245.108.79;546pkt 546fpkt", shape=invhouse, color=bisque];
stat644[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.108.79:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2332--5682[label="1;455pkt 455fpkt"];
2332--6297[label="0.997802;454pkt 454fpkt"];
5682--6297[label="1;546pkt 546fpkt"];
</description>
    <slice>
      <filter src_ip="148.245.108.79"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="47.160.202.80"/>
    </slice>
    <from sec="1100149217" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="212.210.151.81"/>
    </slice>
    <from sec="1100149203" usec="0"/>
    <to sec="1100150092" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_647{
style=filled;
color=gray75;
4525[label="194.98.54.82;237pkt 237fpkt", shape=pentagon, color=darkviolet];
5692[label="194.98.54.82;237pkt 237fpkt", shape=invtriangle, color=brown];
stat647[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.98.54.82:1032, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1032: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
4525--5692[label="1;237pkt 237fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="194.98.54.82" src_port="1032"/>
    </slice>
    <from sec="1100149346" usec="0"/>
    <to sec="1100149361" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_648{
style=filled;
color=gray75;
4531[label="194.124.189.83;220pkt 220fpkt", shape=pentagon, color=darkviolet];
5696[label="194.124.189.83;220pkt 220fpkt", shape=invtriangle, color=brown];
6301[label="194.124.189.83;219pkt 219fpkt", shape=invhouse, color=bisque];
stat648[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.124.189.83:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 4998: (0.227618%)&lt;BR/&gt; 4989: (0.227618%)&lt;BR/&gt; 4980: (0.227618%)&lt;BR/&gt; 4979: (0.227618%)&gt;];
}
4531--5696[label="1;220pkt 220fpkt"];
4531--6301[label="1;219pkt 219fpkt"];
5696--6301[label="1;219pkt 219fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="194.124.189.83"/>
    </slice>
    <from sec="1100149236" usec="0"/>
    <to sec="1100149238" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_649{
style=filled;
color=gray75;
4542[label="147.203.249.84;11pkt 11fpkt", shape=pentagon, color=darkviolet];
5701[label="147.203.249.84;11pkt 11fpkt", shape=invtriangle, color=brown];
stat649[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.203.249.84:80, 81.105.7.160:*}[27.2727%]&lt;BR/&gt;{147.203.249.84:*, *:53}[27.2727%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (31.8182%)&lt;BR/&gt; 53: (22.7273%)&lt;BR/&gt; 1024: (9.09091%)&lt;BR/&gt; 53633: (4.54545%)&lt;BR/&gt; 53362: (4.54545%)&gt;];
}
4542--5701[label="1;11pkt 11fpkt"];
</description>
    <slice>
      <filter dst_port="53" src_ip="147.203.249.84"/>
      <filter dst_ip="81.105.7.160" src_ip="147.203.249.84" src_port="80"/>
    </slice>
    <from sec="1100149268" usec="0"/>
    <to sec="1100149858" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,011,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_650{
style=filled;
color=gray75;
4546[label="148.244.122.85;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5704[label="148.244.122.85;1pkt 1fpkt", shape=invtriangle, color=brown];
6303[label="148.244.122.85;1pkt 1fpkt", shape=invhouse, color=bisque];
stat650[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.244.122.85:65032, 221.22.24.73:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 65032: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
4546--5704[label="1;1pkt 1fpkt"];
4546--6303[label="1;1pkt 1fpkt"];
5704--6303[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="221.22.24.73" dst_port="80" src_ip="148.244.122.85" src_port="65032"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="141.83.142.87"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_655{
style=filled;
color=gray75;
4612[label="148.244.186.95;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5739[label="148.244.186.95;2pkt 2fpkt", shape=invtriangle, color=brown];
6324[label="148.244.186.95;1pkt 1fpkt", shape=invhouse, color=bisque];
stat655[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.244.186.95:3804, 214.218.131.6:80}[50%]&lt;BR/&gt;{148.244.186.95:80, 212.16.178.121:64819}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 64819: (37.5%)&lt;BR/&gt; 3804: (12.5%)&gt;];
}
4612--5739[label="1;1pkt 1fpkt"];
4612--6324[label="1;1pkt 1fpkt"];
5739--6324[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="212.16.178.121" dst_port="64819" src_ip="148.244.186.95" src_port="80"/>
      <filter dst_ip="214.218.131.6" dst_port="80" src_ip="148.244.186.95" src_port="3804"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_656{
style=filled;
color=gray75;
4621[label="213.52.101.97;111pkt 111fpkt", shape=pentagon, color=darkviolet];
5743[label="213.52.101.97;112pkt 112fpkt", shape=invtriangle, color=brown];
6326[label="213.52.101.97;111pkt 111fpkt", shape=invhouse, color=bisque];
stat656[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.52.101.97:*, *:9898}[56.25%]&lt;BR/&gt;{213.52.101.97:*, *:5554}[43.75%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (28.2934%)&lt;BR/&gt; 5554: (21.7066%)&lt;BR/&gt; 3764: (0.449102%)&lt;BR/&gt; 3758: (0.449102%)&lt;BR/&gt; 3753: (0.449102%)&gt;];
}
4621--5743[label="1;111pkt 111fpkt"];
4621--6326[label="1;111pkt 111fpkt"];
5743--6326[label="1;111pkt 111fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="213.52.101.97"/>
      <filter dst_port="5554" src_ip="213.52.101.97"/>
    </slice>
    <from sec="1100149303" usec="0"/>
    <to sec="1100149305" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.633119,1.23269,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_657{
style=filled;
color=gray75;
723[label="148.245.140.95;d;307pkt 307fpkt", shape=diamond, color=yellow];
757[label="148.245.115.240;d;141pkt 141fpkt", shape=diamond, color=yellow];
1098[label="201.9.156.254;s;1pkt 1fpkt", shape=diamond, color=yellow];
1966[label="197.33.26.204;s;99pkt 99fpkt", shape=diamond, color=yellow];
2601[label="148.245.82.112;d;96pkt 96fpkt", shape=diamond, color=yellow];
2663[label="46.26.124.232;s;1pkt 1fpkt", shape=diamond, color=yellow];
4601[label="194.170.68.93;3pkt 3fpkt", shape=pentagon, color=darkviolet];
4682[label="83.155.219.106;10pkt 10fpkt", shape=pentagon, color=darkviolet];
4836[label="45.172.18.138;30pkt 30fpkt", shape=pentagon, color=darkviolet];
5423[label="201.9.156.254;1pkt 1fpkt", shape=pentagon, color=darkviolet];
6146[label="201.9.156.254;1pkt 1fpkt", shape=invtriangle, color=brown];
stat657[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 148.245.140.95:*}[52.844%]&lt;BR/&gt;{*:80, 148.245.115.240:*}[23.3028%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.1014%)&lt;BR/&gt; 554: (0.434783%)&lt;BR/&gt; 49937: (0.289855%)&lt;BR/&gt; 8000: (0.289855%)&lt;BR/&gt; 1372: (0.289855%)&gt;];
}
723--726[label="0.0769231;1pkt 1fpkt"];
723--989[label="0.0344828;1pkt 1fpkt"];
723--1261[label="0.0263158;1pkt 1fpkt"];
723--1887[label="0.333333;6pkt 6fpkt"];
723--1966[label="1;99pkt 99fpkt"];
723--2819[label="0.0769231;1pkt 1fpkt"];
723--3353[label="0.00325733;1pkt 1fpkt"];
723--3574[label="0.00325733;1pkt 1fpkt"];
723--3792[label="0.00325733;1pkt 1fpkt"];
723--4601[label="1;3pkt 3fpkt"];
723--4619[label="0.0535714;3pkt 3fpkt"];
723--4626[label="0.0217391;1pkt 1fpkt"];
723--5348[label="0.0588235;1pkt 1fpkt"];
723--5746[label="0.0212766;1pkt 1fpkt"];
723--6113[label="0.0555556;1pkt 1fpkt"];
723--6329[label="0.0217391;1pkt 1fpkt"];
723--6524[label="0.0555556;1pkt 1fpkt"];
757--955[label="0.0141844;2pkt 2fpkt"];
757--1098[label="1;1pkt 1fpkt"];
757--1174[label="0.0283688;4pkt 4fpkt"];
757--1235[label="0.0141844;2pkt 2fpkt"];
757--1312[label="0.0769231;1pkt 1fpkt"];
757--1490[label="0.0070922;1pkt 1fpkt"];
757--1656[label="0.0141844;2pkt 2fpkt"];
757--2350[label="0.047619;3pkt 3fpkt"];
757--2960[label="0.0141844;2pkt 2fpkt"];
757--2986[label="0.0105263;1pkt 1fpkt"];
757--3353[label="0.0638298;9pkt 9fpkt"];
757--3546[label="0.0283688;4pkt 4fpkt"];
757--3574[label="0.0638298;9pkt 9fpkt"];
757--3767[label="0.0283688;4pkt 4fpkt"];
757--3792[label="0.0638298;9pkt 9fpkt"];
757--4150[label="0.0070922;1pkt 1fpkt"];
757--4296[label="0.0519481;4pkt 4fpkt"];
757--4626[label="0.0217391;1pkt 1fpkt"];
757--4682[label="1;10pkt 10fpkt"];
757--4836[label="0.966667;29pkt 29fpkt"];
757--4905[label="0.0405405;3pkt 3fpkt"];
757--4917[label="0.037037;1pkt 1fpkt"];
757--5034[label="0.0283688;4pkt 4fpkt"];
757--5217[label="0.035461;5pkt 5fpkt"];
757--5423[label="1;1pkt 1fpkt"];
757--5746[label="0.0212766;1pkt 1fpkt"];
757--6146[label="1;1pkt 1fpkt"];
757--6193[label="0.0070922;1pkt 1fpkt"];
757--6329[label="0.0217391;1pkt 1fpkt"];
1098--5423[label="1;1pkt 1fpkt"];
1098--6146[label="1;1pkt 1fpkt"];
2601--2663[label="1;1pkt 1fpkt"];
2601--4626[label="0.0217391;1pkt 1fpkt"];
2601--5217[label="0.0104167;1pkt 1fpkt"];
2601--5746[label="0.0212766;1pkt 1fpkt"];
2601--6329[label="0.0217391;1pkt 1fpkt"];
5423--6146[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="148.245.140.95" src_port="80"/>
      <filter dst_ip="148.245.115.240" src_port="80"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="80.8.3.98"/>
    </slice>
    <from sec="1100149217" usec="0"/>
    <to sec="1100149562" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="194.88.51.99"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.805151,1.21335,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_660{
style=filled;
color=gray75;
1825[label="214.161.218.100;s;463pkt 463fpkt", shape=diamond, color=yellow];
4652[label="214.161.218.100;486pkt 486fpkt", shape=pentagon, color=darkviolet];
5759[label="214.161.218.100;486pkt 486fpkt", shape=invtriangle, color=brown];
6337[label="214.161.218.100;486pkt 486fpkt", shape=invhouse, color=bisque];
stat660[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.161.218.100:53, *:*}[77.8689%]&lt;BR/&gt;{214.161.218.100:*, *:53}[23.1557%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (50.3904%)&lt;BR/&gt; 1026: (6.97553%)&lt;BR/&gt; 25: (4.1645%)&lt;BR/&gt; 1024: (1.09318%)&lt;BR/&gt; 32768: (1.04112%)&gt;];
}
1825--2179[label="0.0185185;1pkt 1fpkt"];
1825--2324[label="0.00970874;1pkt 1fpkt"];
1825--2571[label="0.0188679;1pkt 1fpkt"];
1825--3273[label="0.0188679;1pkt 1fpkt"];
1825--3354[label="0.00431965;2pkt 2fpkt"];
1825--3356[label="0.0107991;5pkt 5fpkt"];
1825--3545[label="0.0453564;21pkt 21fpkt"];
1825--3548[label="0.0107991;5pkt 5fpkt"];
1825--3560[label="0.0215983;10pkt 10fpkt"];
1825--3575[label="0.00431965;2pkt 2fpkt"];
1825--3577[label="0.0107991;5pkt 5fpkt"];
1825--3766[label="0.0453564;21pkt 21fpkt"];
1825--3769[label="0.0107991;5pkt 5fpkt"];
1825--3780[label="0.0215983;10pkt 10fpkt"];
1825--3793[label="0.00431965;2pkt 2fpkt"];
1825--3795[label="0.0107991;5pkt 5fpkt"];
1825--3990[label="0.0215983;10pkt 10fpkt"];
1825--4652[label="0.99568;461pkt 461fpkt"];
1825--5759[label="0.99568;461pkt 461fpkt"];
1825--6337[label="0.99568;461pkt 461fpkt"];
4652--5759[label="1;486pkt 486fpkt"];
4652--6337[label="1;486pkt 486fpkt"];
5759--6337[label="1;486pkt 486fpkt"];
</description>
    <slice>
      <filter src_ip="214.161.218.100" src_port="53"/>
      <filter dst_port="53" src_ip="214.161.218.100"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="45.84.28.101"/>
    </slice>
    <from sec="1100149213" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="86.224.74.103"/>
    </slice>
    <from sec="1100149202" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_664{
style=filled;
color=gray75;
4698[label="195.101.185.109;130pkt 130fpkt", shape=pentagon, color=darkviolet];
5775[label="195.101.185.109;131pkt 131fpkt", shape=invtriangle, color=brown];
6349[label="195.101.185.109;130pkt 130fpkt", shape=invhouse, color=bisque];
stat664[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.101.185.109:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 51022: (0.383632%)&lt;BR/&gt; 51014: (0.383632%)&lt;BR/&gt; 51011: (0.383632%)&lt;BR/&gt; 51004: (0.383632%)&gt;];
}
4698--5775[label="1;130pkt 130fpkt"];
4698--6349[label="1;130pkt 130fpkt"];
5775--6349[label="1;130pkt 130fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="195.101.185.109"/>
    </slice>
    <from sec="1100149510" usec="0"/>
    <to sec="1100149534" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_665{
style=filled;
color=gray75;
4706[label="214.102.35.111;93pkt 93fpkt", shape=pentagon, color=darkviolet];
5780[label="214.102.35.111;94pkt 94fpkt", shape=invtriangle, color=brown];
6353[label="214.102.35.111;94pkt 94fpkt", shape=invhouse, color=bisque];
stat665[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.102.35.111:*, *:445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (50%)&lt;BR/&gt; 4470: (0.533808%)&lt;BR/&gt; 4469: (0.533808%)&lt;BR/&gt; 4468: (0.533808%)&lt;BR/&gt; 4467: (0.533808%)&gt;];
}
4706--5780[label="1;93pkt 93fpkt"];
4706--6353[label="1;93pkt 93fpkt"];
5780--6353[label="1;94pkt 94fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="214.102.35.111"/>
    </slice>
    <from sec="1100149428" usec="0"/>
    <to sec="1100149445" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.815594,1.29127,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_666{
style=filled;
color=gray75;
1237[label="82.39.100.67;d;213pkt 213fpkt", shape=diamond, color=yellow];
1238[label="148.244.56.94;s;272pkt 272fpkt", shape=diamond, color=yellow];
2856[label="148.244.56.94;s;61pkt 61fpkt", shape=hexagon, color=black];
4605[label="148.244.56.94;298pkt 298fpkt", shape=pentagon, color=darkviolet];
stat666[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.244.56.94:*, 82.39.100.67:80}[78.5235%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.3483%)&lt;BR/&gt; 210: (0.473934%)&lt;BR/&gt; 25305: (0.236967%)&lt;BR/&gt; 25302: (0.236967%)&lt;BR/&gt; 25258: (0.236967%)&gt;];
}
1237--1238[label="1;213pkt 213fpkt"];
1237--2856[label="0.688525;42pkt 42fpkt"];
1237--3549[label="0.0375587;8pkt 8fpkt"];
1237--3555[label="0.0610329;13pkt 13fpkt"];
1237--3561[label="0.0985915;21pkt 21fpkt"];
1237--3770[label="0.0375587;8pkt 8fpkt"];
1237--3775[label="0.0610329;13pkt 13fpkt"];
1237--3781[label="0.0985915;21pkt 21fpkt"];
1237--3982[label="0.0375587;8pkt 8fpkt"];
1237--3986[label="0.0610329;13pkt 13fpkt"];
1237--3991[label="0.0985915;21pkt 21fpkt"];
1237--4605[label="1;213pkt 213fpkt"];
1238--2329[label="0.0769231;1pkt 1fpkt"];
1238--2821[label="0.0377358;2pkt 2fpkt"];
1238--2856[label="1;61pkt 61fpkt"];
1238--3549[label="0.0514706;14pkt 14fpkt"];
1238--3555[label="0.0551471;15pkt 15fpkt"];
1238--3561[label="0.0919118;25pkt 25fpkt"];
1238--3770[label="0.0514706;14pkt 14fpkt"];
1238--3775[label="0.0551471;15pkt 15fpkt"];
1238--3781[label="0.0919118;25pkt 25fpkt"];
1238--3982[label="0.0514706;14pkt 14fpkt"];
1238--3986[label="0.0551471;15pkt 15fpkt"];
1238--3991[label="0.0919118;25pkt 25fpkt"];
1238--4605[label="1;272pkt 272fpkt"];
2856--3549[label="0.229508;14pkt 14fpkt"];
2856--3770[label="0.229508;14pkt 14fpkt"];
2856--3982[label="0.229508;14pkt 14fpkt"];
2856--4605[label="1;61pkt 61fpkt"];
</description>
    <slice>
      <filter dst_ip="82.39.100.67" dst_port="80" src_ip="148.244.56.94"/>
    </slice>
    <from sec="1100149202" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_667{
style=filled;
color=gray75;
4714[label="214.206.155.112;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5782[label="214.206.155.112;2pkt 2fpkt", shape=invtriangle, color=brown];
6355[label="214.206.155.112;2pkt 2fpkt", shape=invhouse, color=bisque];
stat667[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.206.155.112:113, 148.245.68.120:2217}[50%]&lt;BR/&gt;{214.206.155.112:47762, 148.245.68.120:25}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2217: (30%)&lt;BR/&gt; 113: (30%)&lt;BR/&gt; 47762: (20%)&lt;BR/&gt; 25: (20%)&gt;];
}
4714--5782[label="1;1pkt 1fpkt"];
4714--6355[label="1;1pkt 1fpkt"];
5782--6355[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="148.245.68.120" dst_port="25" src_ip="214.206.155.112" src_port="47762"/>
      <filter dst_ip="148.245.68.120" dst_port="2217" src_ip="214.206.155.112" src_port="113"/>
    </slice>
    <from sec="1100150067" usec="0"/>
    <to sec="1100150076" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="67.129.64.116"/>
    </slice>
    <from sec="1100149216" usec="0"/>
    <to sec="1100150033" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_669{
style=filled;
color=gray75;
4737[label="45.212.30.118;122pkt 122fpkt", shape=pentagon, color=darkviolet];
5794[label="45.212.30.118;122pkt 122fpkt", shape=invtriangle, color=brown];
stat669[shape=component, label=&lt;Rules:&lt;BR/&gt;{45.212.30.118:1034, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1034: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
4737--5794[label="1;122pkt 122fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="45.212.30.118" src_port="1034"/>
    </slice>
    <from sec="1100149336" usec="0"/>
    <to sec="1100149376" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_671{
style=filled;
color=gray75;
4748[label="147.203.31.121;47pkt 47fpkt", shape=pentagon, color=darkviolet];
5798[label="147.203.31.121;46pkt 46fpkt", shape=invtriangle, color=brown];
stat671[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.203.31.121:*, 217.111.46.77:80}[61.7021%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1370: (1.07527%)&lt;BR/&gt; 1368: (1.07527%)&lt;BR/&gt; 1366: (1.07527%)&lt;BR/&gt; 1365: (1.07527%)&gt;];
}
4748--5798[label="1;46pkt 46fpkt"];
</description>
    <slice>
      <filter dst_ip="217.111.46.77" dst_port="80" src_ip="147.203.31.121"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100149968" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="207.250.106.121"/>
    </slice>
    <from sec="1100149223" usec="0"/>
    <to sec="1100149920" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="45.146.20.123"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100149249" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="209.15.208.124"/>
    </slice>
    <from sec="1100149874" usec="0"/>
    <to sec="1100149888" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="148.245.18.130"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="45.174.94.130"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100149289" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_677{
style=filled;
color=gray75;
4804[label="148.245.160.132;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5826[label="148.245.160.132;1pkt 1fpkt", shape=invtriangle, color=brown];
stat677[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.160.132:59446, 162.0.82.252:25}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 59446: (50%)&lt;BR/&gt; 25: (50%)&gt;];
}
4804--5826[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="162.0.82.252" dst_port="25" src_ip="148.245.160.132" src_port="59446"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="144.54.204.132"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100149408" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_679{
style=filled;
color=gray75;
4806[label="197.135.45.133;255pkt 255fpkt", shape=pentagon, color=darkviolet];
5828[label="197.135.45.133;255pkt 255fpkt", shape=invtriangle, color=brown];
6380[label="197.135.45.133;255pkt 255fpkt", shape=invhouse, color=bisque];
stat679[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.135.45.133:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
4806--5828[label="1;255pkt 255fpkt"];
4806--6380[label="1;255pkt 255fpkt"];
5828--6380[label="1;255pkt 255fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="197.135.45.133" src_port="1028"/>
    </slice>
    <from sec="1100149294" usec="0"/>
    <to sec="1100149309" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_680{
style=filled;
color=gray75;
4820[label="162.3.59.136;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5833[label="162.3.59.136;2pkt 2fpkt", shape=invtriangle, color=brown];
6381[label="162.3.59.136;2pkt 2fpkt", shape=invhouse, color=bisque];
stat680[shape=component, label=&lt;Rules:&lt;BR/&gt;{162.3.59.136:1071, 82.234.161.57:5190}[50%]&lt;BR/&gt;{162.3.59.136:1061, 192.16.160.179:20}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5190: (25%)&lt;BR/&gt; 1071: (25%)&lt;BR/&gt; 1061: (25%)&lt;BR/&gt; 20: (25%)&gt;];
}
4820--5833[label="1;2pkt 2fpkt"];
4820--6381[label="1;2pkt 2fpkt"];
5833--6381[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="192.16.160.179" dst_port="20" src_ip="162.3.59.136" src_port="1061"/>
      <filter dst_ip="82.234.161.57" dst_port="5190" src_ip="162.3.59.136" src_port="1071"/>
    </slice>
    <from sec="1100149222" usec="0"/>
    <to sec="1100150098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="205.49.20.138"/>
    </slice>
    <from sec="1100149784" usec="0"/>
    <to sec="1100149788" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="46.116.225.141"/>
    </slice>
    <from sec="1100149496" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.633119,1.23269,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_684{
style=filled;
color=gray75;
641[label="215.26.201.159;d;2922pkt 2922fpkt", shape=diamond, color=yellow];
4211[label="194.8.118.29;14pkt 14fpkt", shape=pentagon, color=darkviolet];
4686[label="45.65.148.107;10pkt 10fpkt", shape=pentagon, color=darkviolet];
4866[label="217.186.7.143;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5062[label="45.226.154.175;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5857[label="217.186.7.143;1pkt 1fpkt", shape=invtriangle, color=brown];
stat684[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 215.26.201.159:1810}[96.6849%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1810: (48.3384%)&lt;BR/&gt; 443: (0.8647%)&lt;BR/&gt; 80: (0.661241%)&lt;BR/&gt; 0: (0.271278%)&lt;BR/&gt; 1025: (0.101729%)&gt;];
}
641--3547[label="0.00149254;1pkt 1fpkt"];
641--3549[label="0.00718686;21pkt 21fpkt"];
641--3555[label="0.00684463;20pkt 20fpkt"];
641--3561[label="0.00718686;21pkt 21fpkt"];
641--3768[label="0.00149254;1pkt 1fpkt"];
641--3770[label="0.00718686;21pkt 21fpkt"];
641--3775[label="0.00684463;20pkt 20fpkt"];
641--3781[label="0.00718686;21pkt 21fpkt"];
641--3982[label="0.00718686;21pkt 21fpkt"];
641--3986[label="0.00684463;20pkt 20fpkt"];
641--3991[label="0.00718686;21pkt 21fpkt"];
641--4211[label="0.714286;10pkt 10fpkt"];
641--4686[label="1;10pkt 10fpkt"];
641--4866[label="1;1pkt 1fpkt"];
641--5062[label="1;1pkt 1fpkt"];
641--5300[label="1;6pkt 6fpkt"];
641--5857[label="1;1pkt 1fpkt"];
4866--5857[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="215.26.201.159" dst_port="1810"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="162.3.59.144"/>
    </slice>
    <from sec="1100149203" usec="0"/>
    <to sec="1100150084" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.55074,1.28899,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_686{
style=filled;
color=gray75;
2640[label="86.166.179.105;d;1pkt 1fpkt", shape=diamond, color=yellow];
2641[label="148.244.10.59;s;2pkt 2fpkt", shape=diamond, color=yellow];
4380[label="148.244.10.59;4pkt 4fpkt", shape=pentagon, color=darkviolet];
stat686[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.244.10.59:61706, 82.224.60.3:80}[20%]&lt;BR/&gt;{148.244.10.59:61264, 208.100.53.11:80}[20%]&lt;BR/&gt;{148.244.10.59:61553, 86.166.179.105:15402}[20%]&lt;BR/&gt;{148.244.10.59:61386, 34.239.44.80:25}[20%]&lt;BR/&gt;{148.244.10.59:61629, 34.239.44.80:25}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (21.4286%)&lt;BR/&gt; 61629: (14.2857%)&lt;BR/&gt; 61553: (14.2857%)&lt;BR/&gt; 15402: (14.2857%)&lt;BR/&gt; 80: (14.2857%)&gt;];
}
2640--2641[label="1;1pkt 1fpkt"];
2641--4380[label="0.5;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="34.239.44.80" dst_port="25" src_ip="148.244.10.59" src_port="61629"/>
      <filter dst_ip="34.239.44.80" dst_port="25" src_ip="148.244.10.59" src_port="61386"/>
      <filter dst_ip="86.166.179.105" dst_port="15402" src_ip="148.244.10.59" src_port="61553"/>
      <filter dst_ip="208.100.53.11" dst_port="80" src_ip="148.244.10.59" src_port="61264"/>
      <filter dst_ip="82.224.60.3" dst_port="80" src_ip="148.244.10.59" src_port="61706"/>
    </slice>
    <from sec="1100149212" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="41.80.64.145"/>
    </slice>
    <from sec="1100149202" usec="0"/>
    <to sec="1100149416" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="147.9.201.146"/>
    </slice>
    <from sec="1100149202" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,020,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_689{
style=filled;
color=gray75;
4891[label="148.244.72.147;51pkt 51fpkt", shape=pentagon, color=darkviolet];
5868[label="148.244.72.147;51pkt 51fpkt", shape=invtriangle, color=brown];
stat689[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.244.72.147:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
4891--5868[label="1;51pkt 51fpkt"];
</description>
    <slice>
      <filter src_ip="148.244.72.147"/>
    </slice>
    <from sec="1100149204" usec="0"/>
    <to sec="1100150096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_690{
style=filled;
color=gray75;
4894[label="195.104.134.147;238pkt 238fpkt", shape=pentagon, color=darkviolet];
5870[label="195.104.134.147;238pkt 238fpkt", shape=invtriangle, color=brown];
stat690[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.104.134.147:11222, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 11222: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
4894--5870[label="1;238pkt 238fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="195.104.134.147" src_port="11222"/>
    </slice>
    <from sec="1100149442" usec="0"/>
    <to sec="1100149510" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_691{
style=filled;
color=gray75;
4896[label="192.16.160.147;10pkt 10fpkt", shape=pentagon, color=darkviolet];
5871[label="192.16.160.147;11pkt 11fpkt", shape=invtriangle, color=brown];
stat691[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.16.160.147:5050, *:*}[72.7273%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5050: (38.0952%)&lt;BR/&gt; 20: (7.14286%)&lt;BR/&gt; 64741: (4.7619%)&lt;BR/&gt; 34340: (4.7619%)&lt;BR/&gt; 4532: (4.7619%)&gt;];
}
4896--5871[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter src_ip="192.16.160.147" src_port="5050"/>
    </slice>
    <from sec="1100149204" usec="0"/>
    <to sec="1100150097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_692{
style=filled;
color=gray75;
4906[label="214.172.5.149;20pkt 20fpkt", shape=pentagon, color=darkviolet];
5878[label="214.172.5.149;19pkt 19fpkt", shape=invtriangle, color=brown];
6402[label="214.172.5.149;20pkt 20fpkt", shape=invhouse, color=bisque];
stat692[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.172.5.149:*, 195.150.106.27:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 49690: (2.54237%)&lt;BR/&gt; 49689: (2.54237%)&lt;BR/&gt; 49688: (2.54237%)&lt;BR/&gt; 49687: (2.54237%)&gt;];
}
4906--5878[label="1;19pkt 19fpkt"];
4906--6402[label="1;20pkt 20fpkt"];
5878--6402[label="1;19pkt 19fpkt"];
</description>
    <slice>
      <filter dst_ip="195.150.106.27" dst_port="80" src_ip="214.172.5.149"/>
    </slice>
    <from sec="1100149242" usec="0"/>
    <to sec="1100149258" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_693{
style=filled;
color=gray75;
4920[label="197.162.213.150;452pkt 452fpkt", shape=pentagon, color=darkviolet];
5888[label="197.162.213.150;451pkt 451fpkt", shape=invtriangle, color=brown];
6407[label="197.162.213.150;452pkt 452fpkt", shape=invhouse, color=bisque];
stat693[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.162.213.150:*, *:5554}[50%]&lt;BR/&gt;{197.162.213.150:*, *:9898}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (25.0185%)&lt;BR/&gt; 5554: (24.9815%)&lt;BR/&gt; 3264: (0.110701%)&lt;BR/&gt; 3256: (0.110701%)&lt;BR/&gt; 3255: (0.110701%)&gt;];
}
4920--5888[label="1;451pkt 451fpkt"];
4920--6407[label="1;452pkt 452fpkt"];
5888--6407[label="1;451pkt 451fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="197.162.213.150"/>
      <filter dst_port="5554" src_ip="197.162.213.150"/>
    </slice>
    <from sec="1100149285" usec="0"/>
    <to sec="1100149288" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_694{
style=filled;
color=gray75;
4926[label="194.12.18.152;1104pkt 1104fpkt", shape=pentagon, color=darkviolet];
5892[label="194.12.18.152;1104pkt 1104fpkt", shape=invtriangle, color=brown];
stat694[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.12.18.152:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 30081: (0.13587%)&lt;BR/&gt; 42258: (0.0905797%)&lt;BR/&gt; 35535: (0.0905797%)&lt;BR/&gt; 35137: (0.0905797%)&gt;];
}
4926--5892[label="1;1104pkt 1104fpkt"];
</description>
    <slice>
      <filter src_ip="194.12.18.152" src_port="80"/>
    </slice>
    <from sec="1100149203" usec="0"/>
    <to sec="1100150098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_695{
style=filled;
color=gray75;
4932[label="192.16.160.153;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5897[label="192.16.160.153;2pkt 2fpkt", shape=invtriangle, color=brown];
6412[label="192.16.160.153;2pkt 2fpkt", shape=invhouse, color=bisque];
stat695[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.16.160.153:5050, 128.0.57.153:4531}[50%]&lt;BR/&gt;{192.16.160.153:5050, 162.3.110.168:1104}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5050: (50%)&lt;BR/&gt; 4531: (25%)&lt;BR/&gt; 1104: (25%)&gt;];
}
4932--5897[label="1;2pkt 2fpkt"];
4932--6412[label="1;2pkt 2fpkt"];
5897--6412[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="162.3.110.168" dst_port="1104" src_ip="192.16.160.153" src_port="5050"/>
      <filter dst_ip="128.0.57.153" dst_port="4531" src_ip="192.16.160.153" src_port="5050"/>
    </slice>
    <from sec="1100149204" usec="0"/>
    <to sec="1100150084" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="194.32.218.153"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100149245" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="162.3.85.154"/>
    </slice>
    <from sec="1100149229" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_698{
style=filled;
color=gray75;
4949[label="152.146.199.156;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5907[label="152.146.199.156;1pkt 1fpkt", shape=invtriangle, color=brown];
stat698[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.146.199.156:80, 147.9.29.12:56282}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 56282: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
4949--5907[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="147.9.29.12" dst_port="56282" src_ip="152.146.199.156" src_port="80"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_699{
style=filled;
color=gray75;
4956[label="207.32.224.158;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5913[label="207.32.224.158;1pkt 1fpkt", shape=invtriangle, color=brown];
stat699[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.32.224.158:80, 147.203.203.25:33305}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 33305: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
4956--5913[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="147.203.203.25" dst_port="33305" src_ip="207.32.224.158" src_port="80"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_701{
style=filled;
color=gray75;
4975[label="64.26.241.161;25pkt 25fpkt", shape=pentagon, color=darkviolet];
5919[label="64.26.241.161;25pkt 25fpkt", shape=invtriangle, color=brown];
6420[label="64.26.241.161;26pkt 26fpkt", shape=invhouse, color=bisque];
stat701[shape=component, label=&lt;Rules:&lt;BR/&gt;{64.26.241.161:80, 147.203.230.53:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3615: (1.97368%)&lt;BR/&gt; 3613: (1.97368%)&lt;BR/&gt; 3611: (1.97368%)&lt;BR/&gt; 3609: (1.97368%)&gt;];
}
4975--5919[label="1;25pkt 25fpkt"];
4975--6420[label="1;25pkt 25fpkt"];
5919--6420[label="1;25pkt 25fpkt"];
</description>
    <slice>
      <filter dst_ip="147.203.230.53" src_ip="64.26.241.161" src_port="80"/>
    </slice>
    <from sec="1100149274" usec="0"/>
    <to sec="1100149286" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="80.213.150.162"/>
    </slice>
    <from sec="1100149868" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_703{
style=filled;
color=gray75;
4985[label="66.244.43.164;254pkt 254fpkt", shape=pentagon, color=darkviolet];
5926[label="66.244.43.164;254pkt 254fpkt", shape=invtriangle, color=brown];
stat703[shape=component, label=&lt;Rules:&lt;BR/&gt;{66.244.43.164:1033, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1033: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
4985--5926[label="1;254pkt 254fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="66.244.43.164" src_port="1033"/>
    </slice>
    <from sec="1100149238" usec="0"/>
    <to sec="1100149251" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_704{
style=filled;
color=gray75;
4988[label="192.16.160.164;8pkt 8fpkt", shape=pentagon, color=darkviolet];
5928[label="192.16.160.164;8pkt 8fpkt", shape=invtriangle, color=brown];
stat704[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.16.160.164:5050, *:*}[75%]&lt;BR/&gt;{192.16.160.164:23, *:*}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5050: (37.5%)&lt;BR/&gt; 23: (12.5%)&lt;BR/&gt; 3385: (6.25%)&lt;BR/&gt; 3020: (6.25%)&lt;BR/&gt; 2539: (6.25%)&gt;];
}
4988--5928[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter src_ip="192.16.160.164" src_port="5050"/>
      <filter src_ip="192.16.160.164" src_port="23"/>
    </slice>
    <from sec="1100149209" usec="0"/>
    <to sec="1100150098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,020,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="147.203.202.165"/>
    </slice>
    <from sec="1100149202" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_706{
style=filled;
color=gray75;
4993[label="194.6.234.165;10pkt 10fpkt", shape=pentagon, color=darkviolet];
5931[label="194.6.234.165;10pkt 10fpkt", shape=invtriangle, color=brown];
6426[label="194.6.234.165;10pkt 10fpkt", shape=invhouse, color=bisque];
stat706[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.6.234.165:*, 148.245.129.80:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 38811: (5%)&lt;BR/&gt; 38098: (5%)&lt;BR/&gt; 38094: (5%)&lt;BR/&gt; 38049: (5%)&gt;];
}
4993--5931[label="1;10pkt 10fpkt"];
4993--6426[label="1;10pkt 10fpkt"];
5931--6426[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter dst_ip="148.245.129.80" dst_port="80" src_ip="194.6.234.165"/>
    </slice>
    <from sec="1100150034" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="87.119.150.167"/>
    </slice>
    <from sec="1100149206" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="201.96.182.167"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100149275" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_709{
style=filled;
color=gray75;
5015[label="148.245.170.168;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5943[label="148.245.170.168;1pkt 1fpkt", shape=invtriangle, color=brown];
stat709[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.170.168:50128, 207.99.146.2:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 50128: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
5015--5943[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="207.99.146.2" dst_port="80" src_ip="148.245.170.168" src_port="50128"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_710{
style=filled;
color=gray75;
5016[label="208.53.185.168;116pkt 116fpkt", shape=pentagon, color=darkviolet];
5944[label="208.53.185.168;116pkt 116fpkt", shape=invtriangle, color=brown];
6432[label="208.53.185.168;116pkt 116fpkt", shape=invhouse, color=bisque];
stat710[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.53.185.168:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
5016--5944[label="1;116pkt 116fpkt"];
5016--6432[label="1;116pkt 116fpkt"];
5944--6432[label="1;116pkt 116fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="208.53.185.168" src_port="1026"/>
    </slice>
    <from sec="1100149278" usec="0"/>
    <to sec="1100149298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="216.102.132.169"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_712{
style=filled;
color=gray75;
5040[label="192.16.160.171;7pkt 7fpkt", shape=pentagon, color=darkviolet];
5953[label="192.16.160.171;7pkt 7fpkt", shape=invtriangle, color=brown];
stat712[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.16.160.171:5050, *:*}[85.7143%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5050: (42.8571%)&lt;BR/&gt; 4190: (7.14286%)&lt;BR/&gt; 1518: (7.14286%)&lt;BR/&gt; 1153: (7.14286%)&lt;BR/&gt; 1066: (7.14286%)&gt;];
}
5040--5953[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter src_ip="192.16.160.171" src_port="5050"/>
    </slice>
    <from sec="1100149207" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_713{
style=filled;
color=gray75;
5049[label="196.106.160.173;439pkt 439fpkt", shape=pentagon, color=darkviolet];
5957[label="196.106.160.173;438pkt 438fpkt", shape=invtriangle, color=brown];
6441[label="196.106.160.173;439pkt 439fpkt", shape=invhouse, color=bisque];
stat713[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.106.160.173:*, *:5554}[50.5695%]&lt;BR/&gt;{196.106.160.173:*, *:9898}[49.4305%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (25.266%)&lt;BR/&gt; 9898: (24.734%)&lt;BR/&gt; 4286: (0.113982%)&lt;BR/&gt; 4285: (0.113982%)&lt;BR/&gt; 4284: (0.113982%)&gt;];
}
5049--5957[label="1;438pkt 438fpkt"];
5049--6441[label="1;439pkt 439fpkt"];
5957--6441[label="1;438pkt 438fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="196.106.160.173"/>
      <filter dst_port="9898" src_ip="196.106.160.173"/>
    </slice>
    <from sec="1100149210" usec="0"/>
    <to sec="1100149213" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.805151,1.21335,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_714{
style=filled;
color=gray75;
2303[label="148.245.143.180;s;82pkt 82fpkt", shape=diamond, color=yellow];
2628[label="45.176.185.207;d;40pkt 40fpkt", shape=diamond, color=yellow];
2667[label="148.245.142.174;s;45pkt 45fpkt", shape=diamond, color=yellow];
5095[label="148.245.143.180;120pkt 120fpkt", shape=pentagon, color=darkviolet];
5959[label="148.245.142.174;76pkt 76fpkt", shape=invtriangle, color=brown];
6442[label="148.245.142.174;76pkt 76fpkt", shape=invhouse, color=bisque];
stat714[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.143.180:*, *:80}[60.9137%]&lt;BR/&gt;{148.245.142.174:*, *:80}[37.5635%]&lt;BR/&gt;{*:*, 45.176.185.207:80}[20.3046%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.2027%)&lt;BR/&gt; 1501: (0.455581%)&lt;BR/&gt; 1500: (0.455581%)&lt;BR/&gt; 1489: (0.455581%)&lt;BR/&gt; 1476: (0.455581%)&gt;];
}
2303--2628[label="0.575;23pkt 23fpkt"];
2303--5095[label="0.987805;81pkt 81fpkt"];
2628--2667[label="0.2;8pkt 8fpkt"];
2628--5095[label="0.8;32pkt 32fpkt"];
2628--5959[label="0.2;8pkt 8fpkt"];
2628--6442[label="0.2;8pkt 8fpkt"];
2667--5959[label="1;45pkt 45fpkt"];
2667--6442[label="1;45pkt 45fpkt"];
5959--6442[label="1;76pkt 76fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="148.245.143.180"/>
      <filter dst_port="80" src_ip="148.245.142.174"/>
      <filter dst_ip="45.176.185.207" dst_port="80"/>
    </slice>
    <from sec="1100149779" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_715{
style=filled;
color=gray75;
5059[label="194.11.2.175;232pkt 232fpkt", shape=pentagon, color=darkviolet];
5961[label="194.11.2.175;233pkt 233fpkt", shape=invtriangle, color=brown];
6444[label="194.11.2.175;232pkt 232fpkt", shape=invhouse, color=bisque];
stat715[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.11.2.175:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
5059--5961[label="1;232pkt 232fpkt"];
5059--6444[label="1;232pkt 232fpkt"];
5961--6444[label="1;232pkt 232fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="194.11.2.175" src_port="1025"/>
    </slice>
    <from sec="1100149293" usec="0"/>
    <to sec="1100149308" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="86.103.131.176"/>
    </slice>
    <from sec="1100149202" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="87.167.51.178"/>
    </slice>
    <from sec="1100149363" usec="0"/>
    <to sec="1100149429" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.633119,1.23269,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_719{
style=filled;
color=gray75;
1126[label="128.0.49.222;d;427pkt 427fpkt", shape=diamond, color=yellow];
5082[label="194.238.29.179;22pkt 22fpkt", shape=pentagon, color=darkviolet];
5972[label="194.238.29.179;21pkt 21fpkt", shape=invtriangle, color=brown];
stat719[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 128.0.49.222:16795}[98.3721%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 16795: (49.2553%)&lt;BR/&gt; 0: (0.638298%)&lt;BR/&gt; 55972: (0.319149%)&lt;BR/&gt; 54880: (0.319149%)&lt;BR/&gt; 51211: (0.319149%)&gt;];
}
1126--3555[label="0.00234192;1pkt 1fpkt"];
1126--3775[label="0.00234192;1pkt 1fpkt"];
1126--3986[label="0.00234192;1pkt 1fpkt"];
1126--5082[label="0.863636;19pkt 19fpkt"];
1126--5972[label="0.857143;18pkt 18fpkt"];
5082--5972[label="1;21pkt 21fpkt"];
</description>
    <slice>
      <filter dst_ip="128.0.49.222" dst_port="16795"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_720{
style=filled;
color=gray75;
5084[label="64.100.134.179;76pkt 76fpkt", shape=pentagon, color=darkviolet];
5973[label="64.100.134.179;77pkt 77fpkt", shape=invtriangle, color=brown];
6449[label="64.100.134.179;77pkt 77fpkt", shape=invhouse, color=bisque];
stat720[shape=component, label=&lt;Rules:&lt;BR/&gt;{64.100.134.179:*, *:3127}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3127: (50%)&lt;BR/&gt; 4859: (0.652174%)&lt;BR/&gt; 4679: (0.652174%)&lt;BR/&gt; 4655: (0.652174%)&lt;BR/&gt; 4618: (0.652174%)&gt;];
}
5084--5973[label="1;76pkt 76fpkt"];
5084--6449[label="1;76pkt 76fpkt"];
5973--6449[label="1;77pkt 77fpkt"];
</description>
    <slice>
      <filter dst_port="3127" src_ip="64.100.134.179"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100149895" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,001,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_722{
style=filled;
color=gray75;
5088[label="194.128.193.179;182pkt 182fpkt", shape=pentagon, color=darkviolet];
5975[label="194.128.193.179;182pkt 182fpkt", shape=invtriangle, color=brown];
stat722[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.128.193.179:*, *:5554}[50.5495%]&lt;BR/&gt;{194.128.193.179:*, *:9898}[49.4505%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (25.2747%)&lt;BR/&gt; 9898: (24.7253%)&lt;BR/&gt; 1917: (0.274725%)&lt;BR/&gt; 1916: (0.274725%)&lt;BR/&gt; 1915: (0.274725%)&gt;];
}
5088--5975[label="1;182pkt 182fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="194.128.193.179"/>
      <filter dst_port="9898" src_ip="194.128.193.179"/>
    </slice>
    <from sec="1100149410" usec="0"/>
    <to sec="1100149412" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_723{
style=filled;
color=gray75;
5090[label="214.161.234.179;22pkt 22fpkt", shape=pentagon, color=darkviolet];
5976[label="214.161.234.179;22pkt 22fpkt", shape=invtriangle, color=brown];
stat723[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.161.234.179:80, 45.250.202.10:*}[40.9091%]&lt;BR/&gt;{214.161.234.179:80, 197.209.164.180:*}[22.7273%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 62789: (2.27273%)&lt;BR/&gt; 62787: (2.27273%)&lt;BR/&gt; 62786: (2.27273%)&lt;BR/&gt; 62761: (2.27273%)&gt;];
}
5090--5976[label="1;22pkt 22fpkt"];
</description>
    <slice>
      <filter dst_ip="45.250.202.10" src_ip="214.161.234.179" src_port="80"/>
      <filter dst_ip="197.209.164.180" src_ip="214.161.234.179" src_port="80"/>
    </slice>
    <from sec="1100149337" usec="0"/>
    <to sec="1100150098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="66.246.106.180"/>
    </slice>
    <from sec="1100149226" usec="0"/>
    <to sec="1100150098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="83.40.153.181"/>
    </slice>
    <from sec="1100149209" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_727{
style=filled;
color=gray75;
5108[label="147.203.229.182;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5983[label="147.203.229.182;1pkt 1fpkt", shape=invtriangle, color=brown];
6453[label="147.203.229.182;1pkt 1fpkt", shape=invhouse, color=bisque];
stat727[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.203.229.182:2280, 150.203.71.64:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2280: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
5108--5983[label="1;1pkt 1fpkt"];
5108--6453[label="1;1pkt 1fpkt"];
5983--6453[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="150.203.71.64" dst_port="80" src_ip="147.203.229.182" src_port="2280"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.633119,1.23269,020,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_728{
style=filled;
color=gray75;
1799[label="86.149.178.62;d;393pkt 393fpkt", shape=diamond, color=yellow];
5125[label="214.161.192.186;54pkt 54fpkt", shape=pentagon, color=darkviolet];
5988[label="214.161.192.186;53pkt 53fpkt", shape=invtriangle, color=brown];
stat728[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 86.149.178.62:0}[88.1166%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1799--1834[label="0.00323625;1pkt 1fpkt"];
1799--1844[label="0.00274725;1pkt 1fpkt"];
1799--1986[label="0.00325733;1pkt 1fpkt"];
1799--2139[label="0.0114943;1pkt 1fpkt"];
1799--2154[label="0.00254453;1pkt 1fpkt"];
1799--2332[label="0.00254453;1pkt 1fpkt"];
1799--2352[label="0.00254453;1pkt 1fpkt"];
1799--2519[label="0.00254453;1pkt 1fpkt"];
1799--2770[label="0.00662252;1pkt 1fpkt"];
1799--2825[label="0.00316456;1pkt 1fpkt"];
1799--4029[label="0.00254453;1pkt 1fpkt"];
1799--4050[label="0.00254453;1pkt 1fpkt"];
1799--4137[label="0.0108696;1pkt 1fpkt"];
1799--4297[label="0.00254453;1pkt 1fpkt"];
1799--5018[label="0.00254453;1pkt 1fpkt"];
1799--5125[label="0.0185185;1pkt 1fpkt"];
1799--5421[label="0.00254453;1pkt 1fpkt"];
1799--5682[label="0.00254453;1pkt 1fpkt"];
1799--5988[label="0.0188679;1pkt 1fpkt"];
1799--6297[label="0.00254453;1pkt 1fpkt"];
5125--5988[label="1;53pkt 53fpkt"];
</description>
    <slice>
      <filter dst_ip="86.149.178.62"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="209.140.44.188"/>
    </slice>
    <from sec="1100149204" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_730{
style=filled;
color=gray75;
5137[label="45.158.62.189;126pkt 126fpkt", shape=pentagon, color=darkviolet];
5993[label="45.158.62.189;126pkt 126fpkt", shape=invtriangle, color=brown];
6458[label="45.158.62.189;126pkt 126fpkt", shape=invhouse, color=bisque];
stat730[shape=component, label=&lt;Rules:&lt;BR/&gt;{45.158.62.189:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
5137--5993[label="1;126pkt 126fpkt"];
5137--6458[label="1;126pkt 126fpkt"];
5993--6458[label="1;126pkt 126fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="45.158.62.189" src_port="1029"/>
    </slice>
    <from sec="1100149319" usec="0"/>
    <to sec="1100149340" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_731{
style=filled;
color=gray75;
5143[label="147.203.202.192;5pkt 5fpkt", shape=pentagon, color=darkviolet];
5995[label="147.203.202.192;5pkt 5fpkt", shape=invtriangle, color=brown];
stat731[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.203.202.192:80, 45.243.153.77:1621}[20%]&lt;BR/&gt;{147.203.202.192:80, 45.243.153.77:1622}[20%]&lt;BR/&gt;{147.203.202.192:80, 45.243.153.77:1623}[20%]&lt;BR/&gt;{147.203.202.192:80, 45.243.153.77:1624}[20%]&lt;BR/&gt;{147.203.202.192:80, 45.243.153.77:1625}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1625: (10%)&lt;BR/&gt; 1624: (10%)&lt;BR/&gt; 1623: (10%)&lt;BR/&gt; 1622: (10%)&gt;];
}
5143--5995[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="45.243.153.77" dst_port="1625" src_ip="147.203.202.192" src_port="80"/>
      <filter dst_ip="45.243.153.77" dst_port="1624" src_ip="147.203.202.192" src_port="80"/>
      <filter dst_ip="45.243.153.77" dst_port="1623" src_ip="147.203.202.192" src_port="80"/>
      <filter dst_ip="45.243.153.77" dst_port="1622" src_ip="147.203.202.192" src_port="80"/>
      <filter dst_ip="45.243.153.77" dst_port="1621" src_ip="147.203.202.192" src_port="80"/>
    </slice>
    <from sec="1100149966" usec="0"/>
    <to sec="1100150057" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.805151,1.21335,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_732{
style=filled;
color=gray75;
1570[label="208.57.69.148;s;5pkt 5fpkt", shape=diamond, color=yellow];
1676[label="147.203.230.171;d;18pkt 18fpkt", shape=diamond, color=yellow];
1863[label="147.9.78.194;d;75pkt 75fpkt", shape=diamond, color=yellow];
2564[label="46.41.104.222;s;38pkt 38fpkt", shape=diamond, color=yellow];
5145[label="47.143.215.192;85pkt 85fpkt", shape=pentagon, color=darkviolet];
5319[label="46.41.104.222;38pkt 38fpkt", shape=pentagon, color=darkviolet];
5996[label="47.143.215.192;85pkt 85fpkt", shape=invtriangle, color=brown];
6091[label="46.41.104.222;38pkt 38fpkt", shape=invtriangle, color=brown];
6460[label="47.143.215.192;86pkt 86fpkt", shape=invhouse, color=bisque];
stat732[shape=component, label=&lt;Rules:&lt;BR/&gt;{47.143.215.192:80, 147.9.78.194:*}[48.366%]&lt;BR/&gt;{46.41.104.222:80, *:*}[24.8366%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.5726%)&lt;BR/&gt; 4537: (0.42735%)&lt;BR/&gt; 4536: (0.42735%)&lt;BR/&gt; 4535: (0.42735%)&lt;BR/&gt; 4532: (0.42735%)&gt;];
}
1570--1676[label="0.6;3pkt 3fpkt"];
1676--2564[label="0.222222;4pkt 4fpkt"];
1676--2908[label="0.0555556;1pkt 1fpkt"];
1676--3546[label="0.277778;5pkt 5fpkt"];
1676--3767[label="0.277778;5pkt 5fpkt"];
1676--5319[label="0.222222;4pkt 4fpkt"];
1676--6091[label="0.222222;4pkt 4fpkt"];
1676--6275[label="0.111111;2pkt 2fpkt"];
1863--2564[label="0.210526;8pkt 8fpkt"];
1863--5145[label="0.72;54pkt 54fpkt"];
1863--5319[label="0.210526;8pkt 8fpkt"];
1863--5996[label="0.72;54pkt 54fpkt"];
1863--6091[label="0.210526;8pkt 8fpkt"];
1863--6460[label="0.72;54pkt 54fpkt"];
2564--3353[label="0.0263158;1pkt 1fpkt"];
2564--3574[label="0.0263158;1pkt 1fpkt"];
2564--3792[label="0.0263158;1pkt 1fpkt"];
2564--5319[label="1;38pkt 38fpkt"];
2564--6091[label="1;38pkt 38fpkt"];
5145--5996[label="1;85pkt 85fpkt"];
5145--6460[label="1;85pkt 85fpkt"];
5319--6091[label="1;38pkt 38fpkt"];
5996--6460[label="1;85pkt 85fpkt"];
</description>
    <slice>
      <filter src_ip="46.41.104.222" src_port="80"/>
      <filter dst_ip="147.9.78.194" src_ip="47.143.215.192" src_port="80"/>
    </slice>
    <from sec="1100149204" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_733{
style=filled;
color=gray75;
5147[label="45.169.4.193;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5998[label="45.169.4.193;1pkt 1fpkt", shape=invtriangle, color=brown];
stat733[shape=component, label=&lt;Rules:&lt;BR/&gt;{45.169.4.193:5000, 128.0.94.129:1591}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5000: (50%)&lt;BR/&gt; 1591: (50%)&gt;];
}
5147--5998[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="128.0.94.129" dst_port="1591" src_ip="45.169.4.193" src_port="5000"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="86.181.68.193"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_735{
style=filled;
color=gray75;
5151[label="214.161.234.193;165pkt 165fpkt", shape=pentagon, color=darkviolet];
6001[label="214.161.234.193;165pkt 165fpkt", shape=invtriangle, color=brown];
stat735[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.161.234.193:*, *:25}[86.0606%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (49.697%)&lt;BR/&gt; 65004: (0.30303%)&lt;BR/&gt; 63657: (0.30303%)&lt;BR/&gt; 63647: (0.30303%)&lt;BR/&gt; 63642: (0.30303%)&gt;];
}
5151--6001[label="1;165pkt 165fpkt"];
</description>
    <slice>
      <filter dst_port="25" src_ip="214.161.234.193"/>
    </slice>
    <from sec="1100149233" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.633119,1.23269,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_736{
style=filled;
color=gray75;
1995[label="148.245.117.126;d;76pkt 76fpkt", shape=diamond, color=yellow];
4539[label="207.32.226.84;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4984[label="80.124.32.164;3pkt 3fpkt", shape=pentagon, color=darkviolet];
5154[label="154.220.36.194;26pkt 26fpkt", shape=pentagon, color=darkviolet];
6003[label="154.220.36.194;26pkt 26fpkt", shape=invtriangle, color=brown];
stat736[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 148.245.117.126:*}[69%]&lt;BR/&gt;{154.220.36.194:80, *:*}[26%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.3684%)&lt;BR/&gt; 90: (2.25564%)&lt;BR/&gt; 1275: (1.12782%)&lt;BR/&gt; 1263: (1.12782%)&lt;BR/&gt; 62287: (0.75188%)&gt;];
}
1995--3353[label="0.0921053;7pkt 7fpkt"];
1995--3546[label="0.0263158;2pkt 2fpkt"];
1995--3574[label="0.0921053;7pkt 7fpkt"];
1995--3767[label="0.0263158;2pkt 2fpkt"];
1995--3792[label="0.0921053;7pkt 7fpkt"];
1995--4093[label="0.0714286;2pkt 2fpkt"];
1995--4539[label="1;2pkt 2fpkt"];
1995--4984[label="1;3pkt 3fpkt"];
1995--5034[label="0.0263158;2pkt 2fpkt"];
1995--5154[label="0.0769231;2pkt 2fpkt"];
1995--6003[label="0.0769231;2pkt 2fpkt"];
5154--6003[label="1;26pkt 26fpkt"];
</description>
    <slice>
      <filter src_ip="154.220.36.194" src_port="80"/>
      <filter dst_ip="148.245.117.126" src_port="80"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,504,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_737{
style=filled;
color=gray75;
5159[label="148.245.142.194;21pkt 21fpkt", shape=pentagon, color=darkviolet];
6005[label="148.245.142.194;21pkt 21fpkt", shape=invtriangle, color=brown];
stat737[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.245.142.194:*, 208.121.162.102:443}[52.381%]&lt;BR/&gt;{148.245.142.194:*, *:80}[47.619%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (26.1905%)&lt;BR/&gt; 80: (23.8095%)&lt;BR/&gt; 3530: (2.38095%)&lt;BR/&gt; 3529: (2.38095%)&lt;BR/&gt; 3528: (2.38095%)&gt;];
}
5159--6005[label="1;21pkt 21fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="148.245.142.194"/>
      <filter dst_ip="208.121.162.102" dst_port="443" src_ip="148.245.142.194"/>
    </slice>
    <from sec="1100149943" usec="0"/>
    <to sec="1100150000" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_739{
style=filled;
color=gray75;
5165[label="214.74.182.195;7pkt 7fpkt", shape=pentagon, color=darkviolet];
6011[label="214.74.182.195;7pkt 7fpkt", shape=invtriangle, color=brown];
stat739[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.74.182.195:110, 147.203.68.137:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 110: (50%)&lt;BR/&gt; 2469: (7.14286%)&lt;BR/&gt; 2465: (7.14286%)&lt;BR/&gt; 2456: (7.14286%)&lt;BR/&gt; 2452: (7.14286%)&gt;];
}
5165--6011[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="147.203.68.137" src_ip="214.74.182.195" src_port="110"/>
    </slice>
    <from sec="1100149215" usec="0"/>
    <to sec="1100149918" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_741{
style=filled;
color=gray75;
5180[label="128.0.97.198;19pkt 19fpkt", shape=pentagon, color=darkviolet];
6018[label="128.0.97.198;20pkt 20fpkt", shape=invtriangle, color=brown];
6472[label="128.0.97.198;20pkt 20fpkt", shape=invhouse, color=bisque];
stat741[shape=component, label=&lt;Rules:&lt;BR/&gt;{128.0.97.198:*, 82.134.196.62:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3345: (2.54237%)&lt;BR/&gt; 3344: (2.54237%)&lt;BR/&gt; 3343: (2.54237%)&lt;BR/&gt; 3342: (2.54237%)&gt;];
}
5180--6018[label="1;19pkt 19fpkt"];
5180--6472[label="1;19pkt 19fpkt"];
6018--6472[label="1;20pkt 20fpkt"];
</description>
    <slice>
      <filter dst_ip="82.134.196.62" dst_port="80" src_ip="128.0.97.198"/>
    </slice>
    <from sec="1100149237" usec="0"/>
    <to sec="1100149275" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_742{
style=filled;
color=gray75;
5195[label="204.35.253.200;256pkt 256fpkt", shape=pentagon, color=darkviolet];
6024[label="204.35.253.200;255pkt 255fpkt", shape=invtriangle, color=brown];
6477[label="204.35.253.200;256pkt 256fpkt", shape=invhouse, color=bisque];
stat742[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.35.253.200:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
5195--6024[label="1;255pkt 255fpkt"];
5195--6477[label="1;256pkt 256fpkt"];
6024--6477[label="1;255pkt 255fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="204.35.253.200" src_port="1025"/>
    </slice>
    <from sec="1100149248" usec="0"/>
    <to sec="1100149262" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_744{
style=filled;
color=gray75;
5211[label="64.162.171.202;29pkt 29fpkt", shape=pentagon, color=darkviolet];
6031[label="64.162.171.202;29pkt 29fpkt", shape=invtriangle, color=brown];
6482[label="64.162.171.202;30pkt 30fpkt", shape=invhouse, color=bisque];
stat744[shape=component, label=&lt;Rules:&lt;BR/&gt;{64.162.171.202:80, 147.203.230.53:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3604: (1.70455%)&lt;BR/&gt; 3599: (1.70455%)&lt;BR/&gt; 3596: (1.70455%)&lt;BR/&gt; 3595: (1.70455%)&gt;];
}
5211--6031[label="1;29pkt 29fpkt"];
5211--6482[label="1;29pkt 29fpkt"];
6031--6482[label="1;29pkt 29fpkt"];
</description>
    <slice>
      <filter dst_ip="147.203.230.53" src_ip="64.162.171.202" src_port="80"/>
    </slice>
    <from sec="1100149208" usec="0"/>
    <to sec="1100149283" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_745{
style=filled;
color=gray75;
5225[label="80.161.165.204;56pkt 56fpkt", shape=pentagon, color=darkviolet];
6041[label="80.161.165.204;56pkt 56fpkt", shape=invtriangle, color=brown];
6488[label="80.161.165.204;55pkt 55fpkt", shape=invhouse, color=bisque];
stat745[shape=component, label=&lt;Rules:&lt;BR/&gt;{80.161.165.204:*, *:139}[41.0714%]&lt;BR/&gt;{80.161.165.204:*, *:445}[41.0714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 139: (20.6587%)&lt;BR/&gt; 445: (20.3593%)&lt;BR/&gt; 80: (8.98204%)&lt;BR/&gt; 2377: (0.898204%)&lt;BR/&gt; 2376: (0.898204%)&gt;];
}
5225--6041[label="1;56pkt 56fpkt"];
5225--6488[label="1;55pkt 55fpkt"];
6041--6488[label="1;55pkt 55fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="80.161.165.204"/>
      <filter dst_port="139" src_ip="80.161.165.204"/>
    </slice>
    <from sec="1100149205" usec="0"/>
    <to sec="1100149323" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="211.199.66.208"/>
    </slice>
    <from sec="1100149202" usec="0"/>
    <to sec="1100150095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,001,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_747{
style=filled;
color=gray75;
5243[label="199.230.22.209;198pkt 198fpkt", shape=pentagon, color=darkviolet];
6050[label="199.230.22.209;148pkt 148fpkt", shape=invtriangle, color=brown];
stat747[shape=component, label=&lt;Rules:&lt;BR/&gt;{199.230.22.209:*, *:1023}[37.3737%]&lt;BR/&gt;{199.230.22.209:*, *:5554}[34.8485%]&lt;BR/&gt;{199.230.22.209:*, *:9898}[27.7778%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (17.4855%)&lt;BR/&gt; 1023: (17.4855%)&lt;BR/&gt; 9898: (15.0289%)&lt;BR/&gt; 3663: (2.74566%)&lt;BR/&gt; 4909: (2.45665%)&gt;];
}
5243--6050[label="1;148pkt 148fpkt"];
</description>
    <slice>
      <filter dst_port="1023" src_ip="199.230.22.209"/>
      <filter dst_port="5554" src_ip="199.230.22.209"/>
      <filter dst_port="9898" src_ip="199.230.22.209"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100149211" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_748{
style=filled;
color=gray75;
5248[label="128.0.65.210;7pkt 7fpkt", shape=pentagon, color=darkviolet];
6055[label="128.0.65.210;7pkt 7fpkt", shape=invtriangle, color=brown];
6494[label="128.0.65.210;6pkt 6fpkt", shape=invhouse, color=bisque];
stat748[shape=component, label=&lt;Rules:&lt;BR/&gt;{128.0.65.210:*, 197.63.201.170:80}[57.1429%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (45%)&lt;BR/&gt; 2758: (7.5%)&lt;BR/&gt; 2751: (7.5%)&lt;BR/&gt; 2736: (7.5%)&lt;BR/&gt; 2730: (7.5%)&gt;];
}
5248--6055[label="1;7pkt 7fpkt"];
5248--6494[label="1;6pkt 6fpkt"];
6055--6494[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="197.63.201.170" dst_port="80" src_ip="128.0.65.210"/>
    </slice>
    <from sec="1100149301" usec="0"/>
    <to sec="1100149788" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="214.102.67.212"/>
    </slice>
    <from sec="1100149204" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.805151,1.21335,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_750{
style=filled;
color=gray75;
1604[label="147.203.230.212;s;76pkt 76fpkt", shape=diamond, color=yellow];
2377[label="208.75.117.119;d;54pkt 54fpkt", shape=diamond, color=yellow];
5073[label="148.245.142.178;10pkt 10fpkt", shape=pentagon, color=darkviolet];
5268[label="147.203.230.212;75pkt 75fpkt", shape=pentagon, color=darkviolet];
6065[label="147.203.230.212;76pkt 76fpkt", shape=invtriangle, color=brown];
6498[label="147.203.230.212;75pkt 75fpkt", shape=invhouse, color=bisque];
stat750[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.203.230.212:*, 208.75.117.119:80}[37.1134%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1356: (0.68306%)&lt;BR/&gt; 1355: (0.68306%)&lt;BR/&gt; 1354: (0.68306%)&lt;BR/&gt; 1353: (0.68306%)&gt;];
}
1604--2377[label="0.666667;36pkt 36fpkt"];
1604--3555[label="0.0921053;7pkt 7fpkt"];
1604--3561[label="0.0657895;5pkt 5fpkt"];
1604--3775[label="0.0921053;7pkt 7fpkt"];
1604--3781[label="0.0657895;5pkt 5fpkt"];
1604--3986[label="0.0921053;7pkt 7fpkt"];
1604--3991[label="0.0657895;5pkt 5fpkt"];
1604--5268[label="1;75pkt 75fpkt"];
1604--6065[label="1;76pkt 76fpkt"];
1604--6498[label="1;75pkt 75fpkt"];
2377--2717[label="0.0185185;1pkt 1fpkt"];
2377--2814[label="0.0185185;1pkt 1fpkt"];
2377--2835[label="0.0185185;1pkt 1fpkt"];
2377--3555[label="0.185185;10pkt 10fpkt"];
2377--3561[label="0.0555556;3pkt 3fpkt"];
2377--3775[label="0.185185;10pkt 10fpkt"];
2377--3781[label="0.0555556;3pkt 3fpkt"];
2377--3986[label="0.185185;10pkt 10fpkt"];
2377--3991[label="0.0555556;3pkt 3fpkt"];
2377--4009[label="0.0185185;1pkt 1fpkt"];
2377--4276[label="0.0185185;1pkt 1fpkt"];
2377--5044[label="0.0185185;1pkt 1fpkt"];
2377--5073[label="0.7;7pkt 7fpkt"];
2377--5268[label="0.648148;35pkt 35fpkt"];
2377--5433[label="0.0185185;1pkt 1fpkt"];
2377--5955[label="0.0185185;1pkt 1fpkt"];
2377--6065[label="0.666667;36pkt 36fpkt"];
2377--6157[label="0.0185185;1pkt 1fpkt"];
2377--6498[label="0.648148;35pkt 35fpkt"];
5268--6065[label="1;75pkt 75fpkt"];
5268--6498[label="1;75pkt 75fpkt"];
6065--6498[label="1;75pkt 75fpkt"];
</description>
    <slice>
      <filter dst_ip="208.75.117.119" dst_port="80" src_ip="147.203.230.212"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100149927" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_751{
style=filled;
color=gray75;
5274[label="165.16.196.213;17pkt 17fpkt", shape=pentagon, color=darkviolet];
6068[label="165.16.196.213;17pkt 17fpkt", shape=invtriangle, color=brown];
stat751[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.16.196.213:*, 205.130.117.137:80}[23.5294%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4858: (2.94118%)&lt;BR/&gt; 4857: (2.94118%)&lt;BR/&gt; 4855: (2.94118%)&lt;BR/&gt; 4854: (2.94118%)&gt;];
}
5274--6068[label="1;17pkt 17fpkt"];
</description>
    <slice>
      <filter dst_ip="205.130.117.137" dst_port="80" src_ip="165.16.196.213"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100149313" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_753{
style=filled;
color=gray75;
5295[label="208.57.69.217;1pkt 1fpkt", shape=pentagon, color=darkviolet];
6077[label="208.57.69.217;2pkt 2fpkt", shape=invtriangle, color=brown];
6503[label="208.57.69.217;1pkt 1fpkt", shape=invhouse, color=bisque];
stat753[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.57.69.217:58241, 165.16.91.0:80}[50%]&lt;BR/&gt;{208.57.69.217:35795, 147.9.180.72:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 58241: (37.5%)&lt;BR/&gt; 35795: (12.5%)&gt;];
}
5295--6077[label="1;1pkt 1fpkt"];
5295--6503[label="1;1pkt 1fpkt"];
6077--6503[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="147.9.180.72" dst_port="80" src_ip="208.57.69.217" src_port="35795"/>
      <filter dst_ip="165.16.91.0" dst_port="80" src_ip="208.57.69.217" src_port="58241"/>
    </slice>
    <from sec="1100149228" usec="0"/>
    <to sec="1100149700" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_755{
style=filled;
color=gray75;
851[label="215.26.215.230;s;352pkt 352fpkt", shape=diamond, color=yellow];
1021[label="205.168.189.20;d;1pkt 1fpkt", shape=diamond, color=yellow];
1972[label="167.18.115.6;d;26pkt 26fpkt", shape=diamond, color=yellow];
2058[label="219.195.90.253;d;61pkt 61fpkt", shape=diamond, color=yellow];
2283[label="195.105.213.166;d;45pkt 45fpkt", shape=diamond, color=yellow];
2438[label="82.233.55.126;d;93pkt 93fpkt", shape=diamond, color=yellow];
2757[label="215.26.215.230;s;14pkt 14fpkt", shape=hexagon, color=black];
2796[label="205.168.189.20;d;1pkt 1fpkt", shape=hexagon, color=black];
3152[label="219.195.90.253;d;57pkt 57fpkt", shape=hexagon, color=black];
stat755[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.26.215.230:*, 82.233.55.120:80}[27.2487%]&lt;BR/&gt;{*:*, 82.233.55.126:80}[24.6032%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (44.9231%)&lt;BR/&gt; 110: (1.15385%)&lt;BR/&gt; 1654: (0.307692%)&lt;BR/&gt; 65510: (0.230769%)&lt;BR/&gt; 64972: (0.230769%)&gt;];
}
851--1021[label="1;1pkt 1fpkt"];
851--1564[label="0.0369318;13pkt 13fpkt"];
851--1704[label="0.492823;103pkt 103fpkt"];
851--1811[label="0.0185185;1pkt 1fpkt"];
851--1826[label="0.025;1pkt 1fpkt"];
851--1972[label="1;26pkt 26fpkt"];
851--2058[label="1;61pkt 61fpkt"];
851--2283[label="1;45pkt 45fpkt"];
851--2382[label="0.0275229;3pkt 3fpkt"];
851--2438[label="0.72043;67pkt 67fpkt"];
851--2757[label="1;14pkt 14fpkt"];
851--2796[label="1;1pkt 1fpkt"];
851--3121[label="0.0196078;1pkt 1fpkt"];
851--3152[label="1;57pkt 57fpkt"];
851--3216[label="0.0294118;3pkt 3fpkt"];
851--3549[label="0.0170455;6pkt 6fpkt"];
851--3555[label="0.00284091;1pkt 1fpkt"];
851--3561[label="0.0255682;9pkt 9fpkt"];
851--3770[label="0.0170455;6pkt 6fpkt"];
851--3775[label="0.00284091;1pkt 1fpkt"];
851--3781[label="0.0255682;9pkt 9fpkt"];
851--3982[label="0.0170455;6pkt 6fpkt"];
851--3986[label="0.00284091;1pkt 1fpkt"];
851--3991[label="0.0255682;9pkt 9fpkt"];
1021--2757[label="1;1pkt 1fpkt"];
1021--2796[label="1;1pkt 1fpkt"];
2058--3152[label="0.982456;56pkt 56fpkt"];
2438--3260[label="0.0107527;1pkt 1fpkt"];
2438--3561[label="0.0107527;1pkt 1fpkt"];
2438--3781[label="0.0107527;1pkt 1fpkt"];
2438--3991[label="0.0107527;1pkt 1fpkt"];
2438--4276[label="0.0107527;1pkt 1fpkt"];
2438--4496[label="0.0107527;1pkt 1fpkt"];
2438--4822[label="0.0322581;3pkt 3fpkt"];
2438--4978[label="0.162162;6pkt 6fpkt"];
2438--5678[label="0.0107527;1pkt 1fpkt"];
2438--6294[label="0.0107527;1pkt 1fpkt"];
2757--2796[label="1;1pkt 1fpkt"];
2757--3121[label="0.0714286;1pkt 1fpkt"];
2757--3152[label="0.0714286;1pkt 1fpkt"];
2757--3549[label="0.428571;6pkt 6fpkt"];
2757--3770[label="0.428571;6pkt 6fpkt"];
2757--3982[label="0.428571;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="82.233.55.126" dst_port="80"/>
      <filter dst_ip="82.233.55.120" dst_port="80" src_ip="215.26.215.230"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_756{
style=filled;
color=gray75;
5307[label="46.41.104.220;1pkt 1fpkt", shape=pentagon, color=darkviolet];
6082[label="46.41.104.220;1pkt 1fpkt", shape=invtriangle, color=brown];
6507[label="46.41.104.220;1pkt 1fpkt", shape=invhouse, color=bisque];
stat756[shape=component, label=&lt;Rules:&lt;BR/&gt;{46.41.104.220:80, 147.9.78.194:4567}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4567: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
5307--6082[label="1;1pkt 1fpkt"];
5307--6507[label="1;1pkt 1fpkt"];
6082--6507[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="147.9.78.194" dst_port="4567" src_ip="46.41.104.220" src_port="80"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_757{
style=filled;
color=gray75;
5313[label="195.102.80.221;455pkt 455fpkt", shape=pentagon, color=darkviolet];
6085[label="195.102.80.221;456pkt 456fpkt", shape=invtriangle, color=brown];
6509[label="195.102.80.221;455pkt 455fpkt", shape=invhouse, color=bisque];
stat757[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.102.80.221:*, *:9898}[52.4123%]&lt;BR/&gt;{195.102.80.221:*, *:5554}[47.5877%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (26.2445%)&lt;BR/&gt; 5554: (23.7555%)&lt;BR/&gt; 4990: (0.10981%)&lt;BR/&gt; 4989: (0.10981%)&lt;BR/&gt; 4988: (0.10981%)&gt;];
}
5313--6085[label="1;455pkt 455fpkt"];
5313--6509[label="1;455pkt 455fpkt"];
6085--6509[label="1;455pkt 455fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="195.102.80.221"/>
      <filter dst_port="5554" src_ip="195.102.80.221"/>
    </slice>
    <from sec="1100149237" usec="0"/>
    <to sec="1100149240" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="215.193.211.225"/>
    </slice>
    <from sec="1100149204" usec="0"/>
    <to sec="1100149620" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_761{
style=filled;
color=gray75;
5333[label="147.203.224.225;4pkt 4fpkt", shape=pentagon, color=darkviolet];
6103[label="147.203.224.225;4pkt 4fpkt", shape=invtriangle, color=brown];
6517[label="147.203.224.225;4pkt 4fpkt", shape=invhouse, color=bisque];
stat761[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.203.224.225:3069, 65.209.89.8:80}[25%]&lt;BR/&gt;{147.203.224.225:3070, 207.189.203.117:80}[25%]&lt;BR/&gt;{147.203.224.225:3071, 207.189.203.117:80}[25%]&lt;BR/&gt;{147.203.224.225:3072, 207.189.203.117:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3072: (12.5%)&lt;BR/&gt; 3071: (12.5%)&lt;BR/&gt; 3070: (12.5%)&lt;BR/&gt; 3069: (12.5%)&gt;];
}
5333--6103[label="1;4pkt 4fpkt"];
5333--6517[label="1;4pkt 4fpkt"];
6103--6517[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="207.189.203.117" dst_port="80" src_ip="147.203.224.225" src_port="3072"/>
      <filter dst_ip="207.189.203.117" dst_port="80" src_ip="147.203.224.225" src_port="3071"/>
      <filter dst_ip="207.189.203.117" dst_port="80" src_ip="147.203.224.225" src_port="3070"/>
      <filter dst_ip="65.209.89.8" dst_port="80" src_ip="147.203.224.225" src_port="3069"/>
    </slice>
    <from sec="1100149301" usec="0"/>
    <to sec="1100149319" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_762{
style=filled;
color=gray75;
5334[label="147.203.31.226;2pkt 2fpkt", shape=pentagon, color=darkviolet];
6104[label="147.203.31.226;2pkt 2fpkt", shape=invtriangle, color=brown];
6518[label="147.203.31.226;3pkt 3fpkt", shape=invhouse, color=bisque];
stat762[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.203.31.226:3120, 82.234.143.123:143}[33.3333%]&lt;BR/&gt;{147.203.31.226:3122, 82.234.143.123:143}[33.3333%]&lt;BR/&gt;{147.203.31.226:3126, 82.234.143.123:143}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 143: (50%)&lt;BR/&gt; 3126: (21.4286%)&lt;BR/&gt; 3122: (21.4286%)&lt;BR/&gt; 3120: (7.14286%)&gt;];
}
5334--6104[label="1;2pkt 2fpkt"];
5334--6518[label="1;2pkt 2fpkt"];
6104--6518[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="82.234.143.123" dst_port="143" src_ip="147.203.31.226" src_port="3126"/>
      <filter dst_ip="82.234.143.123" dst_port="143" src_ip="147.203.31.226" src_port="3122"/>
      <filter dst_ip="82.234.143.123" dst_port="143" src_ip="147.203.31.226" src_port="3120"/>
    </slice>
    <from sec="1100149763" usec="0"/>
    <to sec="1100149789" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_763{
style=filled;
color=gray75;
5336[label="214.68.62.226;245pkt 245fpkt", shape=pentagon, color=darkviolet];
6106[label="214.68.62.226;245pkt 245fpkt", shape=invtriangle, color=brown];
6519[label="214.68.62.226;245pkt 245fpkt", shape=invhouse, color=bisque];
stat763[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.68.62.226:1040, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1040: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
5336--6106[label="1;245pkt 245fpkt"];
5336--6519[label="1;245pkt 245fpkt"];
6106--6519[label="1;245pkt 245fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="214.68.62.226" src_port="1040"/>
    </slice>
    <from sec="1100149944" usec="0"/>
    <to sec="1100149961" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="200.12.108.226"/>
    </slice>
    <from sec="1100149202" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_765{
style=filled;
color=gray75;
5337[label="165.16.176.226;74pkt 74fpkt", shape=pentagon, color=darkviolet];
6108[label="165.16.176.226;74pkt 74fpkt", shape=invtriangle, color=brown];
6520[label="165.16.176.226;74pkt 74fpkt", shape=invhouse, color=bisque];
stat765[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.16.176.226:*, 81.226.10.53:80}[75.6757%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3326: (0.675676%)&lt;BR/&gt; 3324: (0.675676%)&lt;BR/&gt; 3322: (0.675676%)&lt;BR/&gt; 3320: (0.675676%)&gt;];
}
5337--6108[label="1;74pkt 74fpkt"];
5337--6520[label="1;74pkt 74fpkt"];
6108--6520[label="1;74pkt 74fpkt"];
</description>
    <slice>
      <filter dst_ip="81.226.10.53" dst_port="80" src_ip="165.16.176.226"/>
    </slice>
    <from sec="1100149262" usec="0"/>
    <to sec="1100150000" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="46.26.124.232"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_767{
style=filled;
color=gray75;
5379[label="82.138.184.237;1pkt 1fpkt", shape=pentagon, color=darkviolet];
6125[label="82.138.184.237;1pkt 1fpkt", shape=invtriangle, color=brown];
6528[label="82.138.184.237;1pkt 1fpkt", shape=invhouse, color=bisque];
stat767[shape=component, label=&lt;Rules:&lt;BR/&gt;{82.138.184.237:29234, 147.203.33.165:25}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 29234: (50%)&lt;BR/&gt; 25: (50%)&gt;];
}
5379--6125[label="1;1pkt 1fpkt"];
5379--6528[label="1;1pkt 1fpkt"];
6125--6528[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="147.203.33.165" dst_port="25" src_ip="82.138.184.237" src_port="29234"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_768{
style=filled;
color=gray75;
5398[label="197.55.44.245;65pkt 65fpkt", shape=pentagon, color=darkviolet];
6133[label="197.55.44.245;66pkt 66fpkt", shape=invtriangle, color=brown];
stat768[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.55.44.245:*, *:1025}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 32815: (0.763359%)&lt;BR/&gt; 32642: (0.763359%)&lt;BR/&gt; 32301: (0.763359%)&lt;BR/&gt; 31812: (0.763359%)&gt;];
}
5398--6133[label="1;65pkt 65fpkt"];
</description>
    <slice>
      <filter dst_port="1025" src_ip="197.55.44.245"/>
    </slice>
    <from sec="1100149210" usec="0"/>
    <to sec="1100150098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.876797,1.39697,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_769{
style=filled;
color=gray75;
1138[label="128.0.199.32;s;119pkt 119fpkt", shape=diamond, color=yellow];
1558[label="209.15.208.98;d;2pkt 2fpkt", shape=diamond, color=yellow];
2838[label="128.0.199.32;s;26pkt 26fpkt", shape=hexagon, color=black];
stat769[shape=component, label=&lt;Rules:&lt;BR/&gt;{128.0.199.32:25, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 40147: (1.02041%)&lt;BR/&gt; 40146: (1.02041%)&lt;BR/&gt; 65236: (0.680272%)&lt;BR/&gt; 62399: (0.680272%)&gt;];
}
1138--1558[label="1;2pkt 2fpkt"];
1138--2063[label="0.0192308;1pkt 1fpkt"];
1138--2838[label="1;26pkt 26fpkt"];
1558--2838[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_ip="128.0.199.32" src_port="25"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100150017" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.622202,1.41326,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="81.131.191.249"/>
    </slice>
    <from sec="1100149206" usec="0"/>
    <to sec="1100150098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.5325,1.30888,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_772{
style=filled;
color=gray75;
5422[label="147.9.144.254;11pkt 11fpkt", shape=pentagon, color=darkviolet];
6145[label="147.9.144.254;11pkt 11fpkt", shape=invtriangle, color=brown];
stat772[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.9.144.254:*, 212.149.69.133:80}[36.3636%]&lt;BR/&gt;{147.9.144.254:*, 212.149.192.178:80}[36.3636%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1841: (4.54545%)&lt;BR/&gt; 1840: (4.54545%)&lt;BR/&gt; 1839: (4.54545%)&lt;BR/&gt; 1838: (4.54545%)&gt;];
}
5422--6145[label="1;11pkt 11fpkt"];
</description>
    <slice>
      <filter dst_ip="212.149.192.178" dst_port="80" src_ip="147.9.144.254"/>
      <filter dst_ip="212.149.69.133" dst_port="80" src_ip="147.9.144.254"/>
    </slice>
    <from sec="1100149283" usec="0"/>
    <to sec="1100149335" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.73283,1.44636,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="208.168.40.0"/>
    </slice>
    <from sec="1100149203" usec="0"/>
    <to sec="1100150094" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.73283,1.44636,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="209.15.209.0"/>
    </slice>
    <from sec="1100149291" usec="0"/>
    <to sec="1100149303" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.73283,1.44636,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="148.244.167.12"/>
    </slice>
    <from sec="1100149232" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.73283,1.44636,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="194.167.10.18"/>
    </slice>
    <from sec="1100149202" usec="0"/>
    <to sec="1100149241" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.728687,1.29068,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_777{
style=filled;
color=gray75;
4145[label="165.16.210.20;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5496[label="165.16.210.20;1pkt 1fpkt", shape=invtriangle, color=brown];
6192[label="165.16.210.20;1pkt 1fpkt", shape=invhouse, color=bisque];
stat777[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.16.210.20:1252, 80.213.150.151:80}[50%]&lt;BR/&gt;{165.16.210.20:1673, 80.213.150.151:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1673: (37.5%)&lt;BR/&gt; 1252: (12.5%)&gt;];
}
4145--5496[label="1;1pkt 1fpkt"];
4145--6192[label="1;1pkt 1fpkt"];
5496--6192[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="80.213.150.151" dst_port="80" src_ip="165.16.210.20" src_port="1673"/>
      <filter dst_ip="80.213.150.151" dst_port="80" src_ip="165.16.210.20" src_port="1252"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.73283,1.44636,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="207.57.139.28"/>
    </slice>
    <from sec="1100149203" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.73283,1.44636,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="148.245.85.35"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.73283,1.44636,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="82.78.48.36"/>
    </slice>
    <from sec="1100149249" usec="0"/>
    <to sec="1100149290" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.73283,1.44636,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="46.26.123.41"/>
    </slice>
    <from sec="1100149203" usec="0"/>
    <to sec="1100149283" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.73283,1.44636,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="201.240.38.44"/>
    </slice>
    <from sec="1100149229" usec="0"/>
    <to sec="1100150090" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.73283,1.44636,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="205.53.14.77"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.73283,1.44636,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="194.88.51.99"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.73283,1.44636,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="165.16.178.103"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.73283,1.44636,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="207.250.106.121"/>
    </slice>
    <from sec="1100149223" usec="0"/>
    <to sec="1100149920" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.73283,1.44636,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="148.245.18.130"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.73283,1.44636,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="45.174.94.130"/>
    </slice>
    <from sec="1100149200" usec="0"/>
    <to sec="1100149289" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.73283,1.44636,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="217.186.7.143"/>
    </slice>
    <from sec="1100149209" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.73283,1.44636,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="162.3.59.144"/>
    </slice>
    <from sec="1100149203" usec="0"/>
    <to sec="1100150084" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.73283,1.44636,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="41.80.64.145"/>
    </slice>
    <from sec="1100149202" usec="0"/>
    <to sec="1100149416" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.73283,1.44636,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="194.32.218.153"/>
    </slice>
    <from sec="1100149201" usec="0"/>
    <to sec="1100149245" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.808902,1.37779,503,0 0 0 1 0 0 0 0 0 0 0 1 ">
    <description>subgraph cluster_794{
style=filled;
color=gray75;
2110[label="148.245.142.113;d;13pkt 13fpkt", shape=diamond, color=yellow];
6422[label="193.210.193.163;6pkt 6fpkt", shape=invhouse, color=bisque];
stat794[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.210.193.163:80, 148.245.142.113:*}[46.1538%]&lt;BR/&gt;{205.114.212.100:80, 148.245.142.113:*}[30.7692%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2106: (5.26316%)&lt;BR/&gt; 2105: (5.26316%)&lt;BR/&gt; 2104: (5.26316%)&lt;BR/&gt; 2103: (5.26316%)&gt;];
}
2110--6422[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="148.245.142.113" src_ip="193.210.193.163" src_port="80"/>
      <filter dst_ip="148.245.142.113" src_ip="205.114.212.100" src_port="80"/>
    </slice>
    <from sec="1100149633" usec="0"/>
    <to sec="1100149998" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.73283,1.44636,020,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="147.203.202.165"/>
    </slice>
    <from sec="1100149202" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.73283,1.44636,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="216.102.132.169"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.658376,1.34455,999,0 0 0 0 0 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_797{
style=filled;
color=gray75;
5023[label="192.16.160.169;14pkt 14fpkt", shape=pentagon, color=darkviolet];
6437[label="192.16.160.169;14pkt 14fpkt", shape=invhouse, color=bisque];
stat797[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.16.160.169:5050, *:*}[71.4286%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5050: (35.7143%)&lt;BR/&gt; 1033: (7.14286%)&lt;BR/&gt; 20: (7.14286%)&lt;BR/&gt; 49217: (3.57143%)&lt;BR/&gt; 3174: (3.57143%)&gt;];
}
5023--6437[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter src_ip="192.16.160.169" src_port="5050"/>
    </slice>
    <from sec="1100149213" usec="0"/>
    <to sec="1100150099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.73283,1.44636,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="83.40.153.181"/>
    </slice>
    <from sec="1100149209" usec="0"/>
    <to sec="1100150100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.73283,1.44636,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="86.181.68.193"/>
    </slice>
    <from sec="1100150101" usec="0"/>
    <to sec="1100150102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.73283,1.44636,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="215.193.211.225"/>
    </slice>
    <from sec="1100149204" usec="0"/>
    <to sec="1100149620" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.805151,1.21335,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_801{
style=filled;
color=gray75;
2178[label="217.247.110.223;d;175pkt 175fpkt", shape=diamond, color=yellow];
2405[label="148.244.64.242;s;174pkt 174fpkt", shape=diamond, color=yellow];
5389[label="148.244.64.242;175pkt 175fpkt", shape=pentagon, color=darkviolet];
6129[label="148.244.64.242;175pkt 175fpkt", shape=invtriangle, color=brown];
6531[label="148.244.64.242;176pkt 176fpkt", shape=invhouse, color=bisque];
stat801[shape=component, label=&lt;Rules:&lt;BR/&gt;{148.244.64.242:*, 217.247.110.223:80}[50.2128%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (45.3143%)&lt;BR/&gt; 1064: (4.45714%)&lt;BR/&gt; 53: (4.45714%)&lt;BR/&gt; 3306: (0.342857%)&lt;BR/&gt; 3170: (0.342857%)&gt;];
}
2178--2405[label="0.666667;116pkt 116fpkt"];
2178--2818[label="0.0228571;4pkt 4fpkt"];
2178--3177[label="0.165714;29pkt 29fpkt"];
2178--3549[label="0.0571429;10pkt 10fpkt"];
2178--3555[label="0.0342857;6pkt 6fpkt"];
2178--3561[label="0.0114286;2pkt 2fpkt"];
2178--3770[label="0.0571429;10pkt 10fpkt"];
2178--3775[label="0.0342857;6pkt 6fpkt"];
2178--3781[label="0.0114286;2pkt 2fpkt"];
2178--3982[label="0.0571429;10pkt 10fpkt"];
2178--3986[label="0.0342857;6pkt 6fpkt"];
2178--3991[label="0.0114286;2pkt 2fpkt"];
2178--4421[label="0.165714;29pkt 29fpkt"];
2178--4437[label="0.0742857;13pkt 13fpkt"];
2178--4443[label="0.0971429;17pkt 17fpkt"];
2178--5389[label="0.662857;116pkt 116fpkt"];
2178--5633[label="0.165714;29pkt 29fpkt"];
2178--6129[label="0.662857;116pkt 116fpkt"];
2178--6531[label="0.662857;116pkt 116fpkt"];
2405--2544[label="0.00980392;1pkt 1fpkt"];
2405--2556[label="0.00970874;1pkt 1fpkt"];
2405--3015[label="0.0212766;2pkt 2fpkt"];
2405--3549[label="0.0114943;2pkt 2fpkt"];
2405--3555[label="0.0574713;10pkt 10fpkt"];
2405--3560[label="0.00574713;1pkt 1fpkt"];
2405--3770[label="0.0114943;2pkt 2fpkt"];
2405--3775[label="0.0574713;10pkt 10fpkt"];
2405--3780[label="0.00574713;1pkt 1fpkt"];
2405--3982[label="0.0114943;2pkt 2fpkt"];
2405--3986[label="0.0574713;10pkt 10fpkt"];
2405--3990[label="0.00574713;1pkt 1fpkt"];
2405--5389[label="0.994253;173pkt 173fpkt"];
2405--6129[label="0.994253;173pkt 173fpkt"];
2405--6531[label="1;174pkt 174fpkt"];
5389--6129[label="1;175pkt 175fpkt"];
5389--6531[label="1;175pkt 175fpkt"];
6129--6531[label="1;175pkt 175fpkt"];
</description>
    <slice>
      <filter dst_ip="217.247.110.223" dst_port="80" src_ip="148.244.64.242"/>
    </slice>
    <from sec="1100149202" usec="0"/>
    <to sec="1100150079" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.658376,1.34455,999,0 0 0 0 0 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_802{
style=filled;
color=gray75;
5412[label="194.120.16.251;1pkt 1fpkt", shape=pentagon, color=darkviolet];
6537[label="194.120.16.251;1pkt 1fpkt", shape=invhouse, color=bisque];
stat802[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.120.16.251:2432, 165.16.91.8:25}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2432: (50%)&lt;BR/&gt; 25: (50%)&gt;];
}
5412--6537[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="165.16.91.8" dst_port="25" src_ip="194.120.16.251" src_port="2432"/>
    </slice>
    <from sec="1100149770" usec="0"/>
    <to sec="1100149846" usec="0"/>
  </anomaly>

</admd:annotation>
