<?xml version="1.0" encoding="UTF-8" standalone="no" ?>
<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">

  <anomaly type="notice" value="0.651071,1.51743,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="81.74.226.197" dst_port="5554" proto="tcp" src_ip="81.74.226.197" src_port="80"/>
      <filter dst_ip="81.74.226.197" dst_port="9898" proto="tcp" src_ip="81.74.226.197" src_port="80"/>
      <filter dst_ip="81.74.226.197" dst_port="1023" proto="tcp" src_ip="81.74.226.197" src_port="80"/>
      <from sec="1102827899" usec="0"/>
      <to sec="1102828123" usec="0"/>
    </slice>
    <from sec="1102827899" usec="0"/>
    <to sec="1102828123" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.651071,1.51743,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="200.146.221.6" dst_port="9898" proto="tcp" src_port="1023"/>
      <filter dst_ip="200.146.221.6" dst_port="9898" proto="tcp" src_port="1023"/>
      <filter dst_ip="200.146.221.6" dst_port="9898" proto="tcp" src_port="1023"/>
      <filter dst_ip="200.146.221.6" dst_port="9898" proto="tcp" src_port="1023"/>
      <filter dst_ip="200.146.221.6" dst_port="1023" proto="tcp" src_port="1023"/>
      <filter dst_ip="200.146.221.6" dst_port="1023" proto="tcp" src_port="1023"/>
      <filter dst_ip="200.146.221.6" dst_port="1023" proto="tcp" src_port="1023"/>
      <filter dst_ip="200.146.221.6" dst_port="1023" proto="tcp" src_port="1023"/>
      <filter dst_ip="200.146.221.6" dst_port="5554" proto="tcp" src_port="1023"/>
      <filter dst_ip="200.146.221.6" dst_port="5554" proto="tcp" src_port="1023"/>
      <filter dst_ip="200.146.221.6" dst_port="5554" proto="tcp" src_port="1023"/>
      <filter dst_ip="200.146.221.6" dst_port="5554" proto="tcp" src_port="1023"/>
      <filter dst_ip="200.146.221.6" dst_port="9898" proto="tcp" src_port="5554"/>
      <filter dst_ip="200.146.221.6" dst_port="9898" proto="tcp" src_port="5554"/>
      <filter dst_ip="200.146.221.6" dst_port="9898" proto="tcp" src_port="5554"/>
      <filter dst_ip="200.146.221.6" dst_port="9898" proto="tcp" src_port="5554"/>
      <filter dst_ip="200.146.221.6" dst_port="1023" proto="tcp" src_port="5554"/>
      <filter dst_ip="200.146.221.6" dst_port="1023" proto="tcp" src_port="5554"/>
      <filter dst_ip="200.146.221.6" dst_port="1023" proto="tcp" src_port="5554"/>
      <filter dst_ip="200.146.221.6" dst_port="1023" proto="tcp" src_port="5554"/>
      <filter dst_ip="200.146.221.6" dst_port="5554" proto="tcp" src_port="5554"/>
      <filter dst_ip="200.146.221.6" dst_port="5554" proto="tcp" src_port="5554"/>
      <filter dst_ip="200.146.221.6" dst_port="5554" proto="tcp" src_port="5554"/>
      <filter dst_ip="200.146.221.6" dst_port="5554" proto="tcp" src_port="5554"/>
      <from sec="1102827985" usec="0"/>
      <to sec="1102828003" usec="0"/>
    </slice>
    <from sec="1102827985" usec="0"/>
    <to sec="1102828003" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.651071,1.51743,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="tcp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="udp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="tcp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="udp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="tcp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="udp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="tcp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="udp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="tcp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="udp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="tcp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="udp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="tcp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="udp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="tcp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="udp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="tcp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="udp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="tcp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="udp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="tcp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="udp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="tcp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="udp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="tcp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="udp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="tcp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="udp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="tcp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="udp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="tcp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="udp" src_port="1026"/>
      <from sec="1102827603" usec="0"/>
      <to sec="1102827635" usec="0"/>
    </slice>
    <from sec="1102827603" usec="0"/>
    <to sec="1102827639" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.651071,1.51743,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="udp" src_port="1023"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="udp" src_port="1023"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="udp" src_port="1023"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="udp" src_port="1023"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="tcp" src_port="5554"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="udp" src_port="5554"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="tcp" src_port="5554"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="udp" src_port="5554"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="tcp" src_port="5554"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="udp" src_port="5554"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="tcp" src_port="5554"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="udp" src_port="5554"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="tcp" src_port="1032"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="udp" src_port="1032"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="tcp" src_port="1032"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="udp" src_port="1032"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="tcp" src_port="1032"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="udp" src_port="1032"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="tcp" src_port="1032"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="udp" src_port="1032"/>
      <from sec="1102827724" usec="0"/>
      <to sec="1102827736" usec="0"/>
    </slice>
    <from sec="1102827724" usec="0"/>
    <to sec="1102827737" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.651071,1.51743,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="203.242.170.194" dst_port="9898" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.242.170.194" dst_port="9898" proto="udp" src_port="1023"/>
      <filter dst_ip="203.242.170.194" dst_port="9898" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.242.170.194" dst_port="9898" proto="udp" src_port="1023"/>
      <filter dst_ip="203.242.170.194" dst_port="9898" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.242.170.194" dst_port="9898" proto="udp" src_port="1023"/>
      <filter dst_ip="203.242.170.194" dst_port="9898" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.242.170.194" dst_port="9898" proto="udp" src_port="1023"/>
      <filter dst_ip="203.242.170.194" dst_port="5554" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.242.170.194" dst_port="5554" proto="udp" src_port="1023"/>
      <filter dst_ip="203.242.170.194" dst_port="5554" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.242.170.194" dst_port="5554" proto="udp" src_port="1023"/>
      <filter dst_ip="203.242.170.194" dst_port="5554" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.242.170.194" dst_port="5554" proto="udp" src_port="1023"/>
      <filter dst_ip="203.242.170.194" dst_port="5554" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.242.170.194" dst_port="5554" proto="udp" src_port="1023"/>
      <filter dst_ip="203.242.170.194" dst_port="53" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.242.170.194" dst_port="53" proto="udp" src_port="1023"/>
      <filter dst_ip="203.242.170.194" dst_port="53" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.242.170.194" dst_port="53" proto="udp" src_port="1023"/>
      <filter dst_ip="203.242.170.194" dst_port="53" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.242.170.194" dst_port="53" proto="udp" src_port="1023"/>
      <filter dst_ip="203.242.170.194" dst_port="53" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.242.170.194" dst_port="53" proto="udp" src_port="1023"/>
      <from sec="1102827781" usec="0"/>
      <to sec="1102827788" usec="0"/>
    </slice>
    <from sec="1102827781" usec="0"/>
    <to sec="1102827790" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.651071,1.51743,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="202.47.122.62" proto="tcp" src_ip="202.47.122.62" src_port="1023"/>
      <filter dst_ip="202.47.122.62" proto="tcp" src_ip="202.47.122.62" src_port="1023"/>
      <filter dst_ip="202.47.122.62" proto="tcp" src_ip="202.47.122.62" src_port="1023"/>
      <filter dst_ip="202.47.122.62" proto="tcp" src_ip="202.47.122.62" src_port="1023"/>
      <filter dst_ip="202.47.122.62" proto="tcp" src_ip="202.47.122.62" src_port="5554"/>
      <filter dst_ip="202.47.122.62" proto="tcp" src_ip="202.47.122.62" src_port="5554"/>
      <filter dst_ip="202.47.122.62" proto="tcp" src_ip="202.47.122.62" src_port="5554"/>
      <filter dst_ip="202.47.122.62" proto="tcp" src_ip="202.47.122.62" src_port="5554"/>
      <from sec="1102827727" usec="0"/>
      <to sec="1102827737" usec="0"/>
    </slice>
    <from sec="1102827727" usec="0"/>
    <to sec="1102827737" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.651071,1.51743,503,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="211.192.36.112" dst_port="80" proto="tcp" src_ip="149.66.12.11" src_port="1368"/>
      <filter dst_ip="211.192.36.112" dst_port="80" proto="tcp" src_ip="149.66.12.11" src_port="1369"/>
      <from sec="1102827905" usec="0"/>
      <to sec="1102828477" usec="0"/>
    </slice>
    <from sec="1102827905" usec="0"/>
    <to sec="1102828477" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.651071,1.51743,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="205.145.51.68" dst_port="137" proto="tcp" src_ip="2.7.39.235" src_port="1031"/>
      <filter dst_ip="205.145.51.68" dst_port="137" proto="udp" src_ip="2.7.39.235" src_port="1031"/>
      <filter dst_ip="205.145.51.68" dst_port="80" proto="tcp" src_ip="2.7.39.235" src_port="1031"/>
      <filter dst_ip="205.145.51.68" dst_port="80" proto="udp" src_ip="2.7.39.235" src_port="1031"/>
      <from sec="1102828284" usec="0"/>
      <to sec="1102828311" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="205.145.51.68" dst_port="137" proto="tcp" src_ip="147.178.9.145" src_port="1031"/>
      <filter dst_ip="205.145.51.68" dst_port="137" proto="udp" src_ip="147.178.9.145" src_port="1031"/>
      <filter dst_ip="205.145.51.68" dst_port="80" proto="tcp" src_ip="147.178.9.145" src_port="1031"/>
      <filter dst_ip="205.145.51.68" dst_port="80" proto="udp" src_ip="147.178.9.145" src_port="1031"/>
      <from sec="1102828286" usec="0"/>
      <to sec="1102828299" usec="0"/>
    </slice>
    <from sec="1102828284" usec="0"/>
    <to sec="1102828311" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.651071,1.51743,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="85.246.241.249" src_port="32803"/>
      <filter dst_port="53" proto="udp" src_ip="85.246.241.249" src_port="32803"/>
      <from sec="1102828445" usec="0"/>
      <to sec="1102828453" usec="0"/>
    </slice>
    <from sec="1102828445" usec="0"/>
    <to sec="1102828453" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.651071,1.51743,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="203.35.92.55" src_port="53"/>
      <filter dst_port="9898" proto="udp" src_ip="203.35.92.55" src_port="53"/>
      <from sec="1102828090" usec="0"/>
      <to sec="1102828091" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="212.104.116.55" src_port="53"/>
      <filter dst_port="9898" proto="udp" src_ip="212.104.116.55" src_port="53"/>
      <from sec="1102828090" usec="0"/>
      <to sec="1102828091" usec="0"/>
    </slice>
    <from sec="1102828090" usec="0"/>
    <to sec="1102828091" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.651071,1.51743,001,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="5554" proto="tcp" src_ip="203.2.167.85"/>
      <filter dst_port="9898" proto="tcp" src_ip="203.2.167.85"/>
      <from sec="1102827814" usec="0"/>
      <to sec="1102827817" usec="0"/>
    </slice>
    <from sec="1102827814" usec="0"/>
    <to sec="1102827817" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.651071,1.51743,001,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="67.97.87.87"/>
      <filter dst_port="5554" proto="tcp" src_ip="67.97.87.87"/>
      <from sec="1102828352" usec="0"/>
      <to sec="1102828354" usec="0"/>
    </slice>
    <from sec="1102828350" usec="0"/>
    <to sec="1102828355" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.651071,1.51743,010,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="4899" proto="tcp" src_ip="202.79.72.181"/>
      <from sec="1102828468" usec="0"/>
      <to sec="1102828500" usec="0"/>
    </slice>
    <from sec="1102828468" usec="0"/>
    <to sec="1102828500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.651071,1.51743,001,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="200.134.100.204"/>
      <from sec="1102828044" usec="0"/>
      <to sec="1102828045" usec="0"/>
    </slice>
    <from sec="1102828044" usec="0"/>
    <to sec="1102828045" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.651071,1.51743,001,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="206.239.156.211"/>
      <filter dst_port="5554" proto="tcp" src_ip="206.239.156.211"/>
      <from sec="1102827741" usec="0"/>
      <to sec="1102827743" usec="0"/>
    </slice>
    <from sec="1102827741" usec="0"/>
    <to sec="1102827743" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.651071,1.51743,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="udp" src_port="1023"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="udp" src_port="1023"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="udp" src_port="1023"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="udp" src_port="1023"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="tcp" src_port="5554"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="udp" src_port="5554"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="tcp" src_port="5554"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="udp" src_port="5554"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="tcp" src_port="5554"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="udp" src_port="5554"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="tcp" src_port="5554"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="udp" src_port="5554"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="tcp" src_port="9898"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="udp" src_port="9898"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="tcp" src_port="9898"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="udp" src_port="9898"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="tcp" src_port="9898"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="udp" src_port="9898"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="tcp" src_port="9898"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="udp" src_port="9898"/>
      <from sec="1102827674" usec="0"/>
      <to sec="1102827705" usec="0"/>
    </slice>
    <from sec="1102827674" usec="0"/>
    <to sec="1102827705" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.651071,1.51743,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="204.12.155.253" proto="icmp"/>
      <filter dst_ip="204.12.155.253" proto="icmp"/>
      <filter dst_ip="204.12.155.253" proto="icmp"/>
      <filter dst_ip="204.12.155.253" proto="icmp"/>
      <from sec="1102827689" usec="0"/>
      <to sec="1102827694" usec="0"/>
    </slice>
    <from sec="1102827689" usec="0"/>
    <to sec="1102827694" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.846598,1.3259,001,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_17{
style=filled;
color=gray75;
0[label="202.37.5.6s;15450pkt 15450fpkt", shape=rectangle, color=red];
450[label="202.37.5.6s;15019pkt 15019fpkt", shape=ellipse, color=green];
797[label="202.37.5.6s;8459pkt 8459fpkt", shape=triangle, color=blue];
2246[label="202.37.5.6;s;15711pkt 15711fpkt", shape=diamond, color=yellow];
stat17[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.37.5.6:*, *:5554}[33.3461%]&lt;BR/&gt;{202.37.5.6:*, *:9898}[33.3333%]&lt;BR/&gt;{202.37.5.6:*, *:1023}[33.3206%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (16.9137%)&lt;BR/&gt; 1023: (16.5623%)&lt;BR/&gt; 5554: (16.5239%)&lt;BR/&gt; 4132: (0.0402643%)&lt;BR/&gt; 4129: (0.0402643%)&gt;];
}
0--450[label="1;15019pkt 15019fpkt"];
0--797[label="1;8459pkt 8459fpkt"];
0--2246[label="1;15450pkt 15450fpkt"];
450--797[label="1;8459pkt 8459fpkt"];
450--2246[label="1;15019pkt 15019fpkt"];
797--2246[label="1;8459pkt 8459fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="202.37.5.6"/>
      <filter dst_port="9898" src_ip="202.37.5.6"/>
      <filter dst_port="1023" src_ip="202.37.5.6"/>
    </slice>
    <from sec="1102828043" usec="0"/>
    <to sec="1102828168" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.846598,1.3259,001,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_19{
style=filled;
color=gray75;
38[label="202.45.81.154s;15681pkt 15681fpkt", shape=rectangle, color=red];
466[label="202.45.81.154s;15265pkt 15265fpkt", shape=ellipse, color=green];
809[label="202.45.81.154s;14116pkt 14116fpkt", shape=triangle, color=blue];
2240[label="202.45.81.154;s;15713pkt 15713fpkt", shape=diamond, color=yellow];
stat19[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.45.81.154:*, *:9898}[33.3418%]&lt;BR/&gt;{202.45.81.154:*, *:1023}[33.3291%]&lt;BR/&gt;{202.45.81.154:*, *:5554}[33.3291%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (16.7297%)&lt;BR/&gt; 1023: (16.7182%)&lt;BR/&gt; 5554: (16.552%)&lt;BR/&gt; 2182: (0.115179%)&lt;BR/&gt; 2170: (0.115179%)&gt;];
}
38--466[label="1;15265pkt 15265fpkt"];
38--809[label="1;14116pkt 14116fpkt"];
38--2240[label="1;15681pkt 15681fpkt"];
466--809[label="1;14116pkt 14116fpkt"];
466--2240[label="1;15265pkt 15265fpkt"];
809--2240[label="1;14116pkt 14116fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="202.45.81.154"/>
      <filter dst_port="5554" src_ip="202.45.81.154"/>
      <filter dst_port="1023" src_ip="202.45.81.154"/>
    </slice>
    <from sec="1102828035" usec="0"/>
    <to sec="1102828127" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.692998,1.52346,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="81.74.226.197" dst_port="5554" proto="tcp" src_ip="81.74.226.197" src_port="80"/>
      <filter dst_ip="81.74.226.197" dst_port="9898" proto="tcp" src_ip="81.74.226.197" src_port="80"/>
      <filter dst_ip="81.74.226.197" dst_port="1023" proto="tcp" src_ip="81.74.226.197" src_port="80"/>
      <from sec="1102827900" usec="0"/>
      <to sec="1102828123" usec="0"/>
    </slice>
    <from sec="1102827900" usec="0"/>
    <to sec="1102828123" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.692998,1.52346,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="tcp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="udp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="tcp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="udp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="tcp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="udp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="tcp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="udp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="tcp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="udp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="tcp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="udp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="tcp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="udp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="tcp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="udp" src_port="1023"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="tcp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="udp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="tcp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="udp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="tcp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="udp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="tcp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="53" proto="udp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="tcp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="udp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="tcp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="udp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="tcp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="udp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="tcp" src_port="1026"/>
      <filter dst_ip="202.40.20.12" dst_port="137" proto="udp" src_port="1026"/>
      <from sec="1102827603" usec="0"/>
      <to sec="1102827635" usec="0"/>
    </slice>
    <from sec="1102827603" usec="0"/>
    <to sec="1102827639" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.692998,1.52346,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="udp" src_port="1023"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="udp" src_port="1023"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="udp" src_port="1023"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.193.167.141" dst_port="137" proto="udp" src_port="1023"/>
      <from sec="1102827724" usec="0"/>
      <to sec="1102827736" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="202.47.122.62" dst_port="137" proto="tcp" src_port="1023"/>
      <filter dst_ip="202.47.122.62" dst_port="137" proto="udp" src_port="1023"/>
      <filter dst_ip="202.47.122.62" dst_port="137" proto="tcp" src_port="1023"/>
      <filter dst_ip="202.47.122.62" dst_port="137" proto="udp" src_port="1023"/>
      <filter dst_ip="202.47.122.62" dst_port="137" proto="tcp" src_port="1023"/>
      <filter dst_ip="202.47.122.62" dst_port="137" proto="udp" src_port="1023"/>
      <filter dst_ip="202.47.122.62" dst_port="137" proto="tcp" src_port="1023"/>
      <filter dst_ip="202.47.122.62" dst_port="137" proto="udp" src_port="1023"/>
      <from sec="1102827727" usec="0"/>
      <to sec="1102827737" usec="0"/>
    </slice>
    <from sec="1102827724" usec="0"/>
    <to sec="1102827737" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.760514,1.46392,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_29{
style=filled;
color=gray75;
81[label="2.199.97.6s;146pkt 146fpkt", shape=rectangle, color=red];
487[label="2.199.97.6s;75pkt 75fpkt", shape=ellipse, color=green];
stat29[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.199.97.6:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
81--487[label="1;75pkt 75fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="2.199.97.6" src_port="1025"/>
    </slice>
    <from sec="1102828439" usec="0"/>
    <to sec="1102828453" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.760514,1.46392,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_30{
style=filled;
color=gray75;
83[label="2.6.240.17s;256pkt 256fpkt", shape=rectangle, color=red];
489[label="2.6.240.17s;256pkt 256fpkt", shape=ellipse, color=green];
stat30[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.6.240.17:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
83--489[label="1;256pkt 256fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="2.6.240.17" src_port="1029"/>
    </slice>
    <from sec="1102828457" usec="0"/>
    <to sec="1102828472" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.846598,1.3259,001,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_31{
style=filled;
color=gray75;
87[label="202.65.136.65s;695pkt 695fpkt", shape=rectangle, color=red];
493[label="202.65.136.65s;695pkt 695fpkt", shape=ellipse, color=green];
821[label="202.65.136.65s;695pkt 695fpkt", shape=triangle, color=blue];
2592[label="202.65.136.65;s;695pkt 695fpkt", shape=diamond, color=yellow];
stat31[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.65.136.65:*, *:1023}[36.5468%]&lt;BR/&gt;{202.65.136.65:*, *:9898}[32.9496%]&lt;BR/&gt;{202.65.136.65:*, *:5554}[30.5036%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1023: (18.2734%)&lt;BR/&gt; 9898: (16.4748%)&lt;BR/&gt; 5554: (15.2518%)&lt;BR/&gt; 4722: (0.0719424%)&lt;BR/&gt; 4721: (0.0719424%)&gt;];
}
87--493[label="1;695pkt 695fpkt"];
87--821[label="1;695pkt 695fpkt"];
87--2592[label="1;695pkt 695fpkt"];
493--821[label="1;695pkt 695fpkt"];
493--2592[label="1;695pkt 695fpkt"];
821--2592[label="1;695pkt 695fpkt"];
</description>
    <slice>
      <filter dst_port="1023" src_ip="202.65.136.65"/>
      <filter dst_port="9898" src_ip="202.65.136.65"/>
      <filter dst_port="5554" src_ip="202.65.136.65"/>
    </slice>
    <from sec="1102828187" usec="0"/>
    <to sec="1102828197" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.846598,1.3259,001,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_32{
style=filled;
color=gray75;
18[label="200.129.220.75s;15727pkt 15727fpkt", shape=rectangle, color=red];
494[label="200.129.220.75s;8898pkt 8898fpkt", shape=ellipse, color=green];
822[label="200.129.220.75s;6402pkt 6402fpkt", shape=triangle, color=blue];
2243[label="200.129.220.75;s;15727pkt 15727fpkt", shape=diamond, color=yellow];
stat32[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.129.220.75:*, *:1023}[33.3376%]&lt;BR/&gt;{200.129.220.75:*, *:9898}[33.3376%]&lt;BR/&gt;{200.129.220.75:*, *:5554}[33.3249%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (16.8306%)&lt;BR/&gt; 1023: (16.6734%)&lt;BR/&gt; 5554: (16.4959%)&lt;BR/&gt; 1061: (0.258801%)&lt;BR/&gt; 1741: (0.250246%)&gt;];
}
18--494[label="1;8898pkt 8898fpkt"];
18--822[label="1;6402pkt 6402fpkt"];
18--2243[label="1;15727pkt 15727fpkt"];
494--822[label="1;6402pkt 6402fpkt"];
494--2243[label="1;8898pkt 8898fpkt"];
822--2243[label="1;6402pkt 6402fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="200.129.220.75"/>
      <filter dst_port="1023" src_ip="200.129.220.75"/>
      <filter dst_port="5554" src_ip="200.129.220.75"/>
    </slice>
    <from sec="1102828041" usec="0"/>
    <to sec="1102828145" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.892836,1.42599,002,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_33{
style=filled;
color=gray75;
96[label="2.35.20.177s;98pkt 98fpkt", shape=rectangle, color=red];
497[label="2.35.20.177s;98pkt 98fpkt", shape=ellipse, color=green];
824[label="2.35.20.177s;98pkt 98fpkt", shape=triangle, color=blue];
stat33[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.35.20.177:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
96--497[label="1;98pkt 98fpkt"];
96--824[label="1;98pkt 98fpkt"];
497--824[label="1;98pkt 98fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="2.35.20.177" src_port="1027"/>
    </slice>
    <from sec="1102827854" usec="0"/>
    <to sec="1102827857" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.846598,1.3259,001,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_35{
style=filled;
color=gray75;
110[label="66.199.34.7s;508pkt 508fpkt", shape=rectangle, color=red];
510[label="66.199.34.7s;508pkt 508fpkt", shape=ellipse, color=green];
834[label="66.199.34.7s;508pkt 508fpkt", shape=triangle, color=blue];
1687[label="66.199.34.7;s;508pkt 508fpkt", shape=diamond, color=yellow];
stat35[shape=component, label=&lt;Rules:&lt;BR/&gt;{66.199.34.7:*, *:5554}[50%]&lt;BR/&gt;{66.199.34.7:*, *:9898}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (25%)&lt;BR/&gt; 5554: (25%)&lt;BR/&gt; 2684: (0.0984252%)&lt;BR/&gt; 2681: (0.0984252%)&lt;BR/&gt; 2678: (0.0984252%)&gt;];
}
110--510[label="1;508pkt 508fpkt"];
110--834[label="1;508pkt 508fpkt"];
110--1687[label="1;508pkt 508fpkt"];
510--834[label="1;508pkt 508fpkt"];
510--1687[label="1;508pkt 508fpkt"];
834--1687[label="1;508pkt 508fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="66.199.34.7"/>
      <filter dst_port="5554" src_ip="66.199.34.7"/>
    </slice>
    <from sec="1102827808" usec="0"/>
    <to sec="1102827811" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.846598,1.3259,001,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_37{
style=filled;
color=gray75;
127[label="207.186.9.21s;508pkt 508fpkt", shape=rectangle, color=red];
524[label="207.186.9.21s;508pkt 508fpkt", shape=ellipse, color=green];
845[label="207.186.9.21s;508pkt 508fpkt", shape=triangle, color=blue];
2822[label="207.186.9.21;s;508pkt 508fpkt", shape=diamond, color=yellow];
stat37[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.186.9.21:*, *:5554}[50%]&lt;BR/&gt;{207.186.9.21:*, *:9898}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (25%)&lt;BR/&gt; 5554: (25%)&lt;BR/&gt; 4974: (0.0984252%)&lt;BR/&gt; 4971: (0.0984252%)&lt;BR/&gt; 4970: (0.0984252%)&gt;];
}
127--524[label="1;508pkt 508fpkt"];
127--845[label="1;508pkt 508fpkt"];
127--2822[label="1;508pkt 508fpkt"];
524--845[label="1;508pkt 508fpkt"];
524--2822[label="1;508pkt 508fpkt"];
845--2822[label="1;508pkt 508fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="207.186.9.21"/>
      <filter dst_port="5554" src_ip="207.186.9.21"/>
    </slice>
    <from sec="1102828363" usec="0"/>
    <to sec="1102828370" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.892836,1.42599,001,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_38{
style=filled;
color=gray75;
142[label="207.164.67.30s;254pkt 254fpkt", shape=rectangle, color=red];
537[label="207.164.67.30s;254pkt 254fpkt", shape=ellipse, color=green];
855[label="207.164.67.30s;254pkt 254fpkt", shape=triangle, color=blue];
stat38[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.164.67.30:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 4451: (0.19685%)&lt;BR/&gt; 4442: (0.19685%)&lt;BR/&gt; 4440: (0.19685%)&lt;BR/&gt; 4439: (0.19685%)&gt;];
}
142--537[label="1;254pkt 254fpkt"];
142--855[label="1;254pkt 254fpkt"];
537--855[label="1;254pkt 254fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="207.164.67.30"/>
    </slice>
    <from sec="1102828187" usec="0"/>
    <to sec="1102828190" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.892836,1.42599,001,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_39{
style=filled;
color=gray75;
148[label="206.169.69.36s;406pkt 406fpkt", shape=rectangle, color=red];
542[label="206.169.69.36s;406pkt 406fpkt", shape=ellipse, color=green];
861[label="206.169.69.36s;406pkt 406fpkt", shape=triangle, color=blue];
stat39[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.169.69.36:*, *:9898}[51.7241%]&lt;BR/&gt;{206.169.69.36:*, *:5554}[48.2759%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (25.8621%)&lt;BR/&gt; 5554: (24.1379%)&lt;BR/&gt; 4152: (0.123153%)&lt;BR/&gt; 4143: (0.123153%)&lt;BR/&gt; 4142: (0.123153%)&gt;];
}
148--542[label="1;406pkt 406fpkt"];
148--861[label="1;406pkt 406fpkt"];
542--861[label="1;406pkt 406fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="206.169.69.36"/>
      <filter dst_port="5554" src_ip="206.169.69.36"/>
    </slice>
    <from sec="1102827655" usec="0"/>
    <to sec="1102827661" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.760514,1.46392,010,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_41{
style=filled;
color=gray75;
149[label="68.23.171.36s;238pkt 238fpkt", shape=rectangle, color=red];
544[label="68.23.171.36s;80pkt 80fpkt", shape=ellipse, color=green];
stat41[shape=component, label=&lt;Rules:&lt;BR/&gt;{68.23.171.36:*, *:135}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 2139: (0.314465%)&lt;BR/&gt; 2138: (0.314465%)&lt;BR/&gt; 2137: (0.314465%)&lt;BR/&gt; 2136: (0.314465%)&gt;];
}
149--544[label="1;80pkt 80fpkt"];
149--2724[label="0.00420168;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="68.23.171.36"/>
    </slice>
    <from sec="1102828364" usec="0"/>
    <to sec="1102828385" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.846598,1.3259,001,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_44{
style=filled;
color=gray75;
159[label="203.254.211.43s;7893pkt 7893fpkt", shape=rectangle, color=red];
553[label="203.254.211.43s;7893pkt 7893fpkt", shape=ellipse, color=green];
870[label="203.254.211.43s;7893pkt 7893fpkt", shape=triangle, color=blue];
2435[label="203.254.211.43;s;7893pkt 7893fpkt", shape=diamond, color=yellow];
stat44[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.254.211.43:*, *:5554}[33.346%]&lt;BR/&gt;{203.254.211.43:*, *:9898}[33.346%]&lt;BR/&gt;{203.254.211.43:*, *:1023}[33.308%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (16.673%)&lt;BR/&gt; 5554: (16.673%)&lt;BR/&gt; 1023: (16.654%)&lt;BR/&gt; 3134: (0.0380084%)&lt;BR/&gt; 3099: (0.0380084%)&gt;];
}
159--553[label="1;7893pkt 7893fpkt"];
159--870[label="1;7893pkt 7893fpkt"];
159--2435[label="1;7893pkt 7893fpkt"];
553--870[label="1;7893pkt 7893fpkt"];
553--2435[label="1;7893pkt 7893fpkt"];
870--2435[label="1;7893pkt 7893fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="203.254.211.43"/>
      <filter dst_port="5554" src_ip="203.254.211.43"/>
      <filter dst_port="1023" src_ip="203.254.211.43"/>
    </slice>
    <from sec="1102828077" usec="0"/>
    <to sec="1102828101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.892836,1.42599,001,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_46{
style=filled;
color=gray75;
172[label="3.185.0.53s;191pkt 191fpkt", shape=rectangle, color=red];
562[label="3.185.0.53s;191pkt 191fpkt", shape=ellipse, color=green];
878[label="3.185.0.53s;191pkt 191fpkt", shape=triangle, color=blue];
stat46[shape=component, label=&lt;Rules:&lt;BR/&gt;{3.185.0.53:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 3072: (0.26178%)&lt;BR/&gt; 3071: (0.26178%)&lt;BR/&gt; 3070: (0.26178%)&lt;BR/&gt; 3069: (0.26178%)&gt;];
}
172--562[label="1;191pkt 191fpkt"];
172--878[label="1;191pkt 191fpkt"];
562--878[label="1;191pkt 191fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="3.185.0.53"/>
    </slice>
    <from sec="1102828163" usec="0"/>
    <to sec="1102828171" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.892836,1.42599,001,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_47{
style=filled;
color=gray75;
173[label="2.5.66.53s;492pkt 492fpkt", shape=rectangle, color=red];
563[label="2.5.66.53s;492pkt 492fpkt", shape=ellipse, color=green];
879[label="2.5.66.53s;492pkt 492fpkt", shape=triangle, color=blue];
stat47[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.5.66.53:*, *:9898}[51.0163%]&lt;BR/&gt;{2.5.66.53:*, *:5554}[48.9837%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (25.5081%)&lt;BR/&gt; 5554: (24.4919%)&lt;BR/&gt; 4365: (0.101626%)&lt;BR/&gt; 4336: (0.101626%)&lt;BR/&gt; 4334: (0.101626%)&gt;];
}
173--563[label="1;492pkt 492fpkt"];
173--879[label="1;492pkt 492fpkt"];
563--879[label="1;492pkt 492fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="2.5.66.53"/>
      <filter dst_port="5554" src_ip="2.5.66.53"/>
    </slice>
    <from sec="1102828398" usec="0"/>
    <to sec="1102828404" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.692998,1.52346,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="203.35.92.55" src_port="53"/>
      <filter dst_port="9898" proto="udp" src_ip="203.35.92.55" src_port="53"/>
      <from sec="1102828090" usec="0"/>
      <to sec="1102828091" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="9898" proto="tcp" src_ip="212.104.116.55" src_port="53"/>
      <filter dst_port="9898" proto="udp" src_ip="212.104.116.55" src_port="53"/>
      <from sec="1102828090" usec="0"/>
      <to sec="1102828091" usec="0"/>
    </slice>
    <from sec="1102828090" usec="0"/>
    <to sec="1102828091" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.892836,1.42599,001,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_49{
style=filled;
color=gray75;
187[label="206.239.128.64s;254pkt 254fpkt", shape=rectangle, color=red];
572[label="206.239.128.64s;254pkt 254fpkt", shape=ellipse, color=green];
884[label="206.239.128.64s;254pkt 254fpkt", shape=triangle, color=blue];
stat49[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.239.128.64:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 3732: (0.19685%)&lt;BR/&gt; 3729: (0.19685%)&lt;BR/&gt; 3728: (0.19685%)&lt;BR/&gt; 3727: (0.19685%)&gt;];
}
187--572[label="1;254pkt 254fpkt"];
187--884[label="1;254pkt 254fpkt"];
572--884[label="1;254pkt 254fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="206.239.128.64"/>
    </slice>
    <from sec="1102828337" usec="0"/>
    <to sec="1102828346" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.892836,1.42599,001,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_51{
style=filled;
color=gray75;
197[label="202.163.25.71s;229pkt 229fpkt", shape=rectangle, color=red];
582[label="202.163.25.71s;229pkt 229fpkt", shape=ellipse, color=green];
892[label="202.163.25.71s;229pkt 229fpkt", shape=triangle, color=blue];
stat51[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.163.25.71:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 2808: (0.218341%)&lt;BR/&gt; 2807: (0.218341%)&lt;BR/&gt; 2786: (0.218341%)&lt;BR/&gt; 2777: (0.218341%)&gt;];
}
197--582[label="1;229pkt 229fpkt"];
197--892[label="1;229pkt 229fpkt"];
582--892[label="1;229pkt 229fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="202.163.25.71"/>
    </slice>
    <from sec="1102828370" usec="0"/>
    <to sec="1102828378" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.892836,1.42599,001,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_54{
style=filled;
color=gray75;
211[label="2.3.34.81s;254pkt 254fpkt", shape=rectangle, color=red];
594[label="2.3.34.81s;254pkt 254fpkt", shape=ellipse, color=green];
902[label="2.3.34.81s;254pkt 254fpkt", shape=triangle, color=blue];
stat54[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.3.34.81:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 4964: (0.19685%)&lt;BR/&gt; 4963: (0.19685%)&lt;BR/&gt; 4962: (0.19685%)&lt;BR/&gt; 4961: (0.19685%)&gt;];
}
211--594[label="1;254pkt 254fpkt"];
211--902[label="1;254pkt 254fpkt"];
594--902[label="1;254pkt 254fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="2.3.34.81"/>
    </slice>
    <from sec="1102827656" usec="0"/>
    <to sec="1102827663" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.846598,1.3259,001,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_56{
style=filled;
color=gray75;
219[label="202.11.213.84s;762pkt 762fpkt", shape=rectangle, color=red];
602[label="202.11.213.84s;762pkt 762fpkt", shape=ellipse, color=green];
910[label="202.11.213.84s;762pkt 762fpkt", shape=triangle, color=blue];
2585[label="202.11.213.84;s;762pkt 762fpkt", shape=diamond, color=yellow];
stat56[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.11.213.84:*, *:1023}[33.3333%]&lt;BR/&gt;{202.11.213.84:*, *:5554}[33.3333%]&lt;BR/&gt;{202.11.213.84:*, *:9898}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (16.6667%)&lt;BR/&gt; 5554: (16.6667%)&lt;BR/&gt; 1023: (16.6667%)&lt;BR/&gt; 3969: (0.0656168%)&lt;BR/&gt; 3958: (0.0656168%)&gt;];
}
219--602[label="1;762pkt 762fpkt"];
219--910[label="1;762pkt 762fpkt"];
219--2585[label="1;762pkt 762fpkt"];
602--910[label="1;762pkt 762fpkt"];
602--2585[label="1;762pkt 762fpkt"];
910--2585[label="1;762pkt 762fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="202.11.213.84"/>
      <filter dst_port="5554" src_ip="202.11.213.84"/>
      <filter dst_port="1023" src_ip="202.11.213.84"/>
    </slice>
    <from sec="1102828173" usec="0"/>
    <to sec="1102828182" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.892836,1.42599,001,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_60{
style=filled;
color=gray75;
228[label="203.2.169.90s;484pkt 484fpkt", shape=rectangle, color=red];
612[label="203.2.169.90s;484pkt 484fpkt", shape=ellipse, color=green];
920[label="203.2.169.90s;484pkt 484fpkt", shape=triangle, color=blue];
stat60[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.2.169.90:*, *:5554}[50.8264%]&lt;BR/&gt;{203.2.169.90:*, *:9898}[49.1736%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (25.4132%)&lt;BR/&gt; 9898: (24.5868%)&lt;BR/&gt; 4961: (0.103306%)&lt;BR/&gt; 4929: (0.103306%)&lt;BR/&gt; 4902: (0.103306%)&gt;];
}
228--612[label="1;484pkt 484fpkt"];
228--920[label="1;484pkt 484fpkt"];
612--920[label="1;484pkt 484fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="203.2.169.90"/>
      <filter dst_port="9898" src_ip="203.2.169.90"/>
    </slice>
    <from sec="1102828362" usec="0"/>
    <to sec="1102828369" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.846598,1.3259,001,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_61{
style=filled;
color=gray75;
229[label="2.251.226.90s;508pkt 508fpkt", shape=rectangle, color=red];
613[label="2.251.226.90s;508pkt 508fpkt", shape=ellipse, color=green];
921[label="2.251.226.90s;508pkt 508fpkt", shape=triangle, color=blue];
2825[label="2.251.226.90;s;508pkt 508fpkt", shape=diamond, color=yellow];
stat61[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.251.226.90:*, *:5554}[50%]&lt;BR/&gt;{2.251.226.90:*, *:9898}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (25%)&lt;BR/&gt; 5554: (25%)&lt;BR/&gt; 3716: (0.19685%)&lt;BR/&gt; 3711: (0.19685%)&lt;BR/&gt; 3700: (0.19685%)&gt;];
}
229--613[label="1;508pkt 508fpkt"];
229--921[label="1;508pkt 508fpkt"];
229--2825[label="1;508pkt 508fpkt"];
613--921[label="1;508pkt 508fpkt"];
613--2825[label="1;508pkt 508fpkt"];
921--2825[label="1;508pkt 508fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="2.251.226.90"/>
      <filter dst_port="5554" src_ip="2.251.226.90"/>
    </slice>
    <from sec="1102828375" usec="0"/>
    <to sec="1102828378" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.846598,1.3259,001,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_63{
style=filled;
color=gray75;
233[label="203.245.2.92s;15725pkt 15725fpkt", shape=rectangle, color=red];
616[label="203.245.2.92s;15725pkt 15725fpkt", shape=ellipse, color=green];
924[label="203.245.2.92s;15725pkt 15725fpkt", shape=triangle, color=blue];
2253[label="203.245.2.92;s;15725pkt 15725fpkt", shape=diamond, color=yellow];
stat63[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.245.2.92:*, *:1023}[33.3355%]&lt;BR/&gt;{203.245.2.92:*, *:9898}[33.3355%]&lt;BR/&gt;{203.245.2.92:*, *:5554}[33.3291%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (16.6677%)&lt;BR/&gt; 1023: (16.6677%)&lt;BR/&gt; 5554: (16.6645%)&lt;BR/&gt; 3984: (0.0222576%)&lt;BR/&gt; 3983: (0.0222576%)&gt;];
}
233--616[label="1;15725pkt 15725fpkt"];
233--924[label="1;15725pkt 15725fpkt"];
233--2253[label="1;15725pkt 15725fpkt"];
616--924[label="1;15725pkt 15725fpkt"];
616--2253[label="1;15725pkt 15725fpkt"];
924--2253[label="1;15725pkt 15725fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="203.245.2.92"/>
      <filter dst_port="1023" src_ip="203.245.2.92"/>
      <filter dst_port="5554" src_ip="203.245.2.92"/>
    </slice>
    <from sec="1102828053" usec="0"/>
    <to sec="1102828098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.892836,1.42599,001,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_72{
style=filled;
color=gray75;
263[label="206.248.129.112s;215pkt 215fpkt", shape=rectangle, color=red];
644[label="206.248.129.112s;215pkt 215fpkt", shape=ellipse, color=green];
947[label="206.248.129.112s;215pkt 215fpkt", shape=triangle, color=blue];
stat72[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.248.129.112:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 4999: (0.232558%)&lt;BR/&gt; 4993: (0.232558%)&lt;BR/&gt; 4992: (0.232558%)&lt;BR/&gt; 4991: (0.232558%)&gt;];
}
263--644[label="1;215pkt 215fpkt"];
263--947[label="1;215pkt 215fpkt"];
644--947[label="1;215pkt 215fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="206.248.129.112"/>
    </slice>
    <from sec="1102828424" usec="0"/>
    <to sec="1102828426" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.892836,1.42599,001,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_73{
style=filled;
color=gray75;
264[label="203.215.172.113s;618pkt 618fpkt", shape=rectangle, color=red];
645[label="203.215.172.113s;618pkt 618fpkt", shape=ellipse, color=green];
949[label="203.215.172.113s;618pkt 618fpkt", shape=triangle, color=blue];
stat73[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.215.172.113:*, *:1023}[36.7314%]&lt;BR/&gt;{203.215.172.113:*, *:5554}[31.877%]&lt;BR/&gt;{203.215.172.113:*, *:9898}[31.3916%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1023: (18.3657%)&lt;BR/&gt; 5554: (15.9385%)&lt;BR/&gt; 9898: (15.6958%)&lt;BR/&gt; 3481: (0.0809061%)&lt;BR/&gt; 3479: (0.0809061%)&gt;];
}
264--645[label="1;618pkt 618fpkt"];
264--949[label="1;618pkt 618fpkt"];
645--949[label="1;618pkt 618fpkt"];
</description>
    <slice>
      <filter dst_port="1023" src_ip="203.215.172.113"/>
      <filter dst_port="5554" src_ip="203.215.172.113"/>
      <filter dst_port="9898" src_ip="203.215.172.113"/>
    </slice>
    <from sec="1102828462" usec="0"/>
    <to sec="1102828469" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.892836,1.42599,001,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_74{
style=filled;
color=gray75;
265[label="2.3.203.116s;254pkt 254fpkt", shape=rectangle, color=red];
646[label="2.3.203.116s;254pkt 254fpkt", shape=ellipse, color=green];
950[label="2.3.203.116s;254pkt 254fpkt", shape=triangle, color=blue];
stat74[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.3.203.116:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 4097: (0.19685%)&lt;BR/&gt; 4082: (0.19685%)&lt;BR/&gt; 4081: (0.19685%)&lt;BR/&gt; 4080: (0.19685%)&gt;];
}
265--646[label="1;254pkt 254fpkt"];
265--950[label="1;254pkt 254fpkt"];
646--950[label="1;254pkt 254fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="2.3.203.116"/>
    </slice>
    <from sec="1102828196" usec="0"/>
    <to sec="1102828204" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.846598,1.3259,001,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_75{
style=filled;
color=gray75;
34[label="202.43.218.119s;10647pkt 10647fpkt", shape=rectangle, color=red];
647[label="202.43.218.119s;9568pkt 9568fpkt", shape=ellipse, color=green];
951[label="202.43.218.119s;9568pkt 9568fpkt", shape=triangle, color=blue];
2251[label="202.43.218.119;s;10722pkt 10722fpkt", shape=diamond, color=yellow];
stat75[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.43.218.119:*, *:1023}[41.6807%]&lt;BR/&gt;{202.43.218.119:*, *:9898}[31.3468%]&lt;BR/&gt;{202.43.218.119:*, *:5554}[26.9726%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1023: (21.1258%)&lt;BR/&gt; 9898: (15.7882%)&lt;BR/&gt; 5554: (13.086%)&lt;BR/&gt; 2533: (0.0715961%)&lt;BR/&gt; 2818: (0.0691273%)&gt;];
}
34--647[label="1;9568pkt 9568fpkt"];
34--951[label="1;9568pkt 9568fpkt"];
34--2251[label="1;10647pkt 10647fpkt"];
647--951[label="1;9568pkt 9568fpkt"];
647--2251[label="1;9568pkt 9568fpkt"];
951--2251[label="1;9568pkt 9568fpkt"];
</description>
    <slice>
      <filter dst_port="1023" src_ip="202.43.218.119"/>
      <filter dst_port="9898" src_ip="202.43.218.119"/>
      <filter dst_port="5554" src_ip="202.43.218.119"/>
    </slice>
    <from sec="1102828050" usec="0"/>
    <to sec="1102828141" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.846598,1.3259,001,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_78{
style=filled;
color=gray75;
278[label="166.167.128.131s;15679pkt 15679fpkt", shape=rectangle, color=red];
658[label="166.167.128.131s;15028pkt 15028fpkt", shape=ellipse, color=green];
959[label="166.167.128.131s;3667pkt 3667fpkt", shape=triangle, color=blue];
2255[label="166.167.128.131;s;15679pkt 15679fpkt", shape=diamond, color=yellow];
stat78[shape=component, label=&lt;Rules:&lt;BR/&gt;{166.167.128.131:*, *:5554}[33.3631%]&lt;BR/&gt;{166.167.128.131:*, *:1023}[33.3312%]&lt;BR/&gt;{166.167.128.131:*, *:9898}[33.3057%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (17.0889%)&lt;BR/&gt; 1023: (16.5634%)&lt;BR/&gt; 5554: (16.3477%)&lt;BR/&gt; 3502: (0.0299682%)&lt;BR/&gt; 3125: (0.0299682%)&gt;];
}
278--658[label="1;15028pkt 15028fpkt"];
278--959[label="1;3667pkt 3667fpkt"];
278--2255[label="1;15679pkt 15679fpkt"];
658--959[label="1;3667pkt 3667fpkt"];
658--2255[label="1;15028pkt 15028fpkt"];
959--2255[label="1;3667pkt 3667fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="166.167.128.131"/>
      <filter dst_port="1023" src_ip="166.167.128.131"/>
      <filter dst_port="9898" src_ip="166.167.128.131"/>
    </slice>
    <from sec="1102828055" usec="0"/>
    <to sec="1102828103" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.846598,1.3259,001,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_81{
style=filled;
color=gray75;
302[label="203.212.34.151s;7896pkt 7896fpkt", shape=rectangle, color=red];
678[label="203.212.34.151s;5163pkt 5163fpkt", shape=ellipse, color=green];
973[label="203.212.34.151s;5163pkt 5163fpkt", shape=triangle, color=blue];
2431[label="203.212.34.151;s;7896pkt 7896fpkt", shape=diamond, color=yellow];
stat81[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.212.34.151:*, *:1023}[33.346%]&lt;BR/&gt;{203.212.34.151:*, *:9898}[33.3333%]&lt;BR/&gt;{203.212.34.151:*, *:5554}[33.3207%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (20.1547%)&lt;BR/&gt; 1023: (19.7718%)&lt;BR/&gt; 5554: (10.0735%)&lt;BR/&gt; 3332: (0.0306302%)&lt;BR/&gt; 3271: (0.0306302%)&gt;];
}
302--678[label="1;5163pkt 5163fpkt"];
302--973[label="1;5163pkt 5163fpkt"];
302--2431[label="1;7896pkt 7896fpkt"];
678--973[label="1;5163pkt 5163fpkt"];
678--2431[label="1;5163pkt 5163fpkt"];
973--2431[label="1;5163pkt 5163fpkt"];
</description>
    <slice>
      <filter dst_port="1023" src_ip="203.212.34.151"/>
      <filter dst_port="9898" src_ip="203.212.34.151"/>
      <filter dst_port="5554" src_ip="203.212.34.151"/>
    </slice>
    <from sec="1102828071" usec="0"/>
    <to sec="1102828095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.846598,1.3259,001,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_86{
style=filled;
color=gray75;
317[label="203.218.14.161s;761pkt 761fpkt", shape=rectangle, color=red];
691[label="203.218.14.161s;761pkt 761fpkt", shape=ellipse, color=green];
984[label="203.218.14.161s;761pkt 761fpkt", shape=triangle, color=blue];
1690[label="203.218.14.161;s;761pkt 761fpkt", shape=diamond, color=yellow];
stat86[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.218.14.161:*, *:5554}[33.3771%]&lt;BR/&gt;{203.218.14.161:*, *:9898}[33.3771%]&lt;BR/&gt;{203.218.14.161:*, *:1023}[33.2457%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (16.6886%)&lt;BR/&gt; 5554: (16.6886%)&lt;BR/&gt; 1023: (16.6229%)&lt;BR/&gt; 4984: (0.065703%)&lt;BR/&gt; 4943: (0.065703%)&gt;];
}
317--691[label="1;761pkt 761fpkt"];
317--984[label="1;761pkt 761fpkt"];
317--1690[label="1;761pkt 761fpkt"];
691--984[label="1;761pkt 761fpkt"];
691--1690[label="1;761pkt 761fpkt"];
984--1690[label="1;761pkt 761fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="203.218.14.161"/>
      <filter dst_port="5554" src_ip="203.218.14.161"/>
      <filter dst_port="1023" src_ip="203.218.14.161"/>
    </slice>
    <from sec="1102827836" usec="0"/>
    <to sec="1102827843" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.892836,1.42599,001,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_87{
style=filled;
color=gray75;
319[label="202.74.213.161s;508pkt 508fpkt", shape=rectangle, color=red];
694[label="202.74.213.161s;508pkt 508fpkt", shape=ellipse, color=green];
987[label="202.74.213.161s;508pkt 508fpkt", shape=triangle, color=blue];
stat87[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.74.213.161:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 1937: (0.19685%)&lt;BR/&gt; 1936: (0.19685%)&lt;BR/&gt; 1933: (0.19685%)&lt;BR/&gt; 1926: (0.19685%)&gt;];
}
319--694[label="1;508pkt 508fpkt"];
319--987[label="1;508pkt 508fpkt"];
319--2277[label="0.00344828;1pkt 1fpkt"];
694--987[label="1;508pkt 508fpkt"];
694--2277[label="0.00344828;1pkt 1fpkt"];
987--2277[label="0.00344828;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="202.74.213.161"/>
    </slice>
    <from sec="1102828158" usec="0"/>
    <to sec="1102828400" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.846598,1.3259,001,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_88{
style=filled;
color=gray75;
327[label="202.43.142.165s;15548pkt 15548fpkt", shape=rectangle, color=red];
699[label="202.43.142.165s;15485pkt 15485fpkt", shape=ellipse, color=green];
991[label="202.43.142.165s;15485pkt 15485fpkt", shape=triangle, color=blue];
2239[label="202.43.142.165;s;15719pkt 15719fpkt", shape=diamond, color=yellow];
stat88[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.43.142.165:*, *:1023}[33.3482%]&lt;BR/&gt;{202.43.142.165:*, *:9898}[33.3418%]&lt;BR/&gt;{202.43.142.165:*, *:5554}[33.31%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (16.7408%)&lt;BR/&gt; 1023: (16.7248%)&lt;BR/&gt; 5554: (16.5344%)&lt;BR/&gt; 3742: (0.0257082%)&lt;BR/&gt; 3676: (0.0257082%)&gt;];
}
327--699[label="1;15485pkt 15485fpkt"];
327--991[label="1;15485pkt 15485fpkt"];
327--2239[label="1;15548pkt 15548fpkt"];
699--991[label="1;15485pkt 15485fpkt"];
699--2239[label="1;15485pkt 15485fpkt"];
991--2239[label="1;15485pkt 15485fpkt"];
</description>
    <slice>
      <filter dst_port="1023" src_ip="202.43.142.165"/>
      <filter dst_port="9898" src_ip="202.43.142.165"/>
      <filter dst_port="5554" src_ip="202.43.142.165"/>
    </slice>
    <from sec="1102828034" usec="0"/>
    <to sec="1102828081" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.892836,1.42599,001,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_89{
style=filled;
color=gray75;
336[label="195.147.78.172s;96pkt 96fpkt", shape=rectangle, color=red];
708[label="195.147.78.172s;96pkt 96fpkt", shape=ellipse, color=green];
1000[label="195.147.78.172s;96pkt 96fpkt", shape=triangle, color=blue];
stat89[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.147.78.172:*, *:9898}[47.9167%]&lt;BR/&gt;{195.147.78.172:*, *:1023}[30.2083%]&lt;BR/&gt;{195.147.78.172:*, *:5554}[21.875%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (23.9583%)&lt;BR/&gt; 1023: (15.1042%)&lt;BR/&gt; 5554: (10.9375%)&lt;BR/&gt; 2409: (0.520833%)&lt;BR/&gt; 2408: (0.520833%)&gt;];
}
336--708[label="1;96pkt 96fpkt"];
336--1000[label="1;96pkt 96fpkt"];
708--1000[label="1;96pkt 96fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="195.147.78.172"/>
      <filter dst_port="1023" src_ip="195.147.78.172"/>
      <filter dst_port="5554" src_ip="195.147.78.172"/>
    </slice>
    <from sec="1102828262" usec="0"/>
    <to sec="1102828268" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.846598,1.3259,001,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_90{
style=filled;
color=gray75;
342[label="202.40.52.175s;13491pkt 13491fpkt", shape=rectangle, color=red];
714[label="202.40.52.175s;10968pkt 10968fpkt", shape=ellipse, color=green];
1004[label="202.40.52.175s;10324pkt 10324fpkt", shape=triangle, color=blue];
2250[label="202.40.52.175;s;15703pkt 15703fpkt", shape=diamond, color=yellow];
stat90[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.40.52.175:*, *:5554}[33.3567%]&lt;BR/&gt;{202.40.52.175:*, *:9898}[33.3312%]&lt;BR/&gt;{202.40.52.175:*, *:1023}[33.3121%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (17.1463%)&lt;BR/&gt; 1023: (16.5313%)&lt;BR/&gt; 5554: (16.3223%)&lt;BR/&gt; 1273: (0.074278%)&lt;BR/&gt; 2293: (0.0722973%)&gt;];
}
342--714[label="1;10968pkt 10968fpkt"];
342--1004[label="1;10324pkt 10324fpkt"];
342--2250[label="1;13491pkt 13491fpkt"];
714--1004[label="1;10324pkt 10324fpkt"];
714--2250[label="1;10968pkt 10968fpkt"];
1004--2250[label="1;10324pkt 10324fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="202.40.52.175"/>
      <filter dst_port="9898" src_ip="202.40.52.175"/>
      <filter dst_port="1023" src_ip="202.40.52.175"/>
    </slice>
    <from sec="1102828050" usec="0"/>
    <to sec="1102828246" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.846598,1.3259,001,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_92{
style=filled;
color=gray75;
104[label="67.97.28.3s;502pkt 502fpkt", shape=rectangle, color=red];
505[label="67.97.28.3s;502pkt 502fpkt", shape=ellipse, color=green];
830[label="67.97.28.3s;502pkt 502fpkt", shape=triangle, color=blue];
1301[label="67.97.28.3;s;508pkt 508fpkt", shape=diamond, color=yellow];
stat92[shape=component, label=&lt;Rules:&lt;BR/&gt;{67.97.28.3:*, *:5554}[50%]&lt;BR/&gt;{67.97.28.3:*, *:9898}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (25.2234%)&lt;BR/&gt; 9898: (24.7766%)&lt;BR/&gt; 4139: (0.0993049%)&lt;BR/&gt; 4137: (0.0993049%)&lt;BR/&gt; 4136: (0.0993049%)&gt;];
}
104--505[label="1;502pkt 502fpkt"];
104--830[label="1;502pkt 502fpkt"];
104--1301[label="1;502pkt 502fpkt"];
104--3466[label="0.00796813;4pkt 4fpkt"];
104--3467[label="0.0139442;7pkt 7fpkt"];
104--3493[label="0.00796813;4pkt 4fpkt"];
505--830[label="1;502pkt 502fpkt"];
505--1301[label="1;502pkt 502fpkt"];
505--3466[label="0.00796813;4pkt 4fpkt"];
505--3467[label="0.0139442;7pkt 7fpkt"];
505--3493[label="0.00796813;4pkt 4fpkt"];
830--1301[label="1;502pkt 502fpkt"];
830--3466[label="0.00796813;4pkt 4fpkt"];
830--3467[label="0.0139442;7pkt 7fpkt"];
830--3493[label="0.00796813;4pkt 4fpkt"];
1301--3466[label="0.00787402;4pkt 4fpkt"];
1301--3467[label="0.0255906;13pkt 13fpkt"];
1301--3493[label="0.00787402;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="67.97.28.3"/>
      <filter dst_port="5554" src_ip="67.97.28.3"/>
    </slice>
    <from sec="1102827681" usec="0"/>
    <to sec="1102827704" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.705658,1.36661,001,1 1 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_93{
style=filled;
color=gray75;
358[label="203.192.227.186s;10227pkt 10227fpkt", shape=rectangle, color=red];
725[label="203.192.227.186s;617pkt 617fpkt", shape=ellipse, color=green];
2254[label="203.192.227.186;s;11196pkt 11196fpkt", shape=diamond, color=yellow];
stat93[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.192.227.186:*, *:9898}[33.6281%]&lt;BR/&gt;{203.192.227.186:*, *:5554}[33.2976%]&lt;BR/&gt;{203.192.227.186:*, *:1023}[33.0743%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (17.1506%)&lt;BR/&gt; 5554: (16.5472%)&lt;BR/&gt; 1023: (16.3022%)&lt;BR/&gt; 2001: (0.0408348%)&lt;BR/&gt; 3027: (0.0385662%)&gt;];
}
358--725[label="1;617pkt 617fpkt"];
358--2254[label="1;10227pkt 10227fpkt"];
725--2254[label="1;617pkt 617fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="203.192.227.186"/>
      <filter dst_port="5554" src_ip="203.192.227.186"/>
      <filter dst_port="1023" src_ip="203.192.227.186"/>
    </slice>
    <from sec="1102828054" usec="0"/>
    <to sec="1102828102" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.846598,1.3259,001,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_96{
style=filled;
color=gray75;
372[label="203.219.37.196s;762pkt 762fpkt", shape=rectangle, color=red];
735[label="203.219.37.196s;762pkt 762fpkt", shape=ellipse, color=green];
1020[label="203.219.37.196s;762pkt 762fpkt", shape=triangle, color=blue];
2835[label="203.219.37.196;s;762pkt 762fpkt", shape=diamond, color=yellow];
stat96[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.219.37.196:*, *:1023}[33.3333%]&lt;BR/&gt;{203.219.37.196:*, *:5554}[33.3333%]&lt;BR/&gt;{203.219.37.196:*, *:9898}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (16.6667%)&lt;BR/&gt; 5554: (16.6667%)&lt;BR/&gt; 1023: (16.6667%)&lt;BR/&gt; 3287: (0.131234%)&lt;BR/&gt; 3258: (0.131234%)&gt;];
}
372--735[label="1;762pkt 762fpkt"];
372--1020[label="1;762pkt 762fpkt"];
372--2835[label="1;762pkt 762fpkt"];
735--1020[label="1;762pkt 762fpkt"];
735--2835[label="1;762pkt 762fpkt"];
1020--2835[label="1;762pkt 762fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="203.219.37.196"/>
      <filter dst_port="5554" src_ip="203.219.37.196"/>
      <filter dst_port="1023" src_ip="203.219.37.196"/>
    </slice>
    <from sec="1102828413" usec="0"/>
    <to sec="1102828434" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.846598,1.3259,001,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_97{
style=filled;
color=gray75;
380[label="207.184.132.202s;508pkt 508fpkt", shape=rectangle, color=red];
741[label="207.184.132.202s;508pkt 508fpkt", shape=ellipse, color=green];
1025[label="207.184.132.202s;508pkt 508fpkt", shape=triangle, color=blue];
2826[label="207.184.132.202;s;508pkt 508fpkt", shape=diamond, color=yellow];
stat97[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.184.132.202:*, *:5554}[50%]&lt;BR/&gt;{207.184.132.202:*, *:9898}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (25%)&lt;BR/&gt; 5554: (25%)&lt;BR/&gt; 4804: (0.0984252%)&lt;BR/&gt; 4802: (0.0984252%)&lt;BR/&gt; 4799: (0.0984252%)&gt;];
}
380--741[label="1;508pkt 508fpkt"];
380--1025[label="1;508pkt 508fpkt"];
380--2826[label="1;508pkt 508fpkt"];
741--1025[label="1;508pkt 508fpkt"];
741--2826[label="1;508pkt 508fpkt"];
1025--2826[label="1;508pkt 508fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="207.184.132.202"/>
      <filter dst_port="5554" src_ip="207.184.132.202"/>
    </slice>
    <from sec="1102828385" usec="0"/>
    <to sec="1102828399" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.892836,1.42599,001,1 1 1 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_99{
style=filled;
color=gray75;
385[label="64.176.24.205s;472pkt 472fpkt", shape=rectangle, color=red];
745[label="64.176.24.205s;472pkt 472fpkt", shape=ellipse, color=green];
1028[label="64.176.24.205s;472pkt 472fpkt", shape=triangle, color=blue];
stat99[shape=component, label=&lt;Rules:&lt;BR/&gt;{64.176.24.205:*, *:5554}[52.9661%]&lt;BR/&gt;{64.176.24.205:*, *:9898}[47.0339%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (26.4831%)&lt;BR/&gt; 9898: (23.5169%)&lt;BR/&gt; 4457: (0.105932%)&lt;BR/&gt; 4440: (0.105932%)&lt;BR/&gt; 4439: (0.105932%)&gt;];
}
385--745[label="1;472pkt 472fpkt"];
385--1028[label="1;472pkt 472fpkt"];
745--1028[label="1;472pkt 472fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="64.176.24.205"/>
      <filter dst_port="9898" src_ip="64.176.24.205"/>
    </slice>
    <from sec="1102828146" usec="0"/>
    <to sec="1102828153" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.846598,1.3259,001,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_100{
style=filled;
color=gray75;
391[label="206.147.214.209s;502pkt 502fpkt", shape=rectangle, color=red];
749[label="206.147.214.209s;502pkt 502fpkt", shape=ellipse, color=green];
1032[label="206.147.214.209s;502pkt 502fpkt", shape=triangle, color=blue];
2705[label="206.147.214.209;s;502pkt 502fpkt", shape=diamond, color=yellow];
stat100[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.147.214.209:*, *:9898}[50.3984%]&lt;BR/&gt;{206.147.214.209:*, *:5554}[49.6016%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (25.1992%)&lt;BR/&gt; 5554: (24.8008%)&lt;BR/&gt; 2559: (0.0996016%)&lt;BR/&gt; 2545: (0.0996016%)&lt;BR/&gt; 2544: (0.0996016%)&gt;];
}
391--749[label="1;502pkt 502fpkt"];
391--1032[label="1;502pkt 502fpkt"];
391--2705[label="1;502pkt 502fpkt"];
749--1032[label="1;502pkt 502fpkt"];
749--2705[label="1;502pkt 502fpkt"];
1032--2705[label="1;502pkt 502fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="206.147.214.209"/>
      <filter dst_port="5554" src_ip="206.147.214.209"/>
    </slice>
    <from sec="1102828260" usec="0"/>
    <to sec="1102828271" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.760514,1.46392,001,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_104{
style=filled;
color=gray75;
439[label="206.191.166.248s;427pkt 427fpkt", shape=rectangle, color=red];
788[label="206.191.166.248s;427pkt 427fpkt", shape=ellipse, color=green];
stat104[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.191.166.248:*, *:5554}[50.5855%]&lt;BR/&gt;{206.191.166.248:*, *:9898}[49.4145%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (25.2927%)&lt;BR/&gt; 9898: (24.7073%)&lt;BR/&gt; 3970: (0.117096%)&lt;BR/&gt; 3964: (0.117096%)&lt;BR/&gt; 3961: (0.117096%)&gt;];
}
439--788[label="1;427pkt 427fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="206.191.166.248"/>
      <filter dst_port="9898" src_ip="206.191.166.248"/>
    </slice>
    <from sec="1102827803" usec="0"/>
    <to sec="1102827805" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.692998,1.52346,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="203.196.213.205" dst_port="5554" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.196.213.205" dst_port="5554" proto="udp" src_port="1023"/>
      <filter dst_ip="203.196.213.205" dst_port="5554" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.196.213.205" dst_port="5554" proto="udp" src_port="1023"/>
      <filter dst_ip="203.196.213.205" dst_port="5554" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.196.213.205" dst_port="5554" proto="udp" src_port="1023"/>
      <filter dst_ip="203.196.213.205" dst_port="5554" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.196.213.205" dst_port="5554" proto="udp" src_port="1023"/>
      <filter dst_ip="203.196.213.205" dst_port="53" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.196.213.205" dst_port="53" proto="udp" src_port="1023"/>
      <filter dst_ip="203.196.213.205" dst_port="53" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.196.213.205" dst_port="53" proto="udp" src_port="1023"/>
      <filter dst_ip="203.196.213.205" dst_port="53" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.196.213.205" dst_port="53" proto="udp" src_port="1023"/>
      <filter dst_ip="203.196.213.205" dst_port="53" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.196.213.205" dst_port="53" proto="udp" src_port="1023"/>
      <filter dst_ip="203.196.213.205" dst_port="5554" proto="tcp" src_port="5554"/>
      <filter dst_ip="203.196.213.205" dst_port="5554" proto="udp" src_port="5554"/>
      <filter dst_ip="203.196.213.205" dst_port="5554" proto="tcp" src_port="5554"/>
      <filter dst_ip="203.196.213.205" dst_port="5554" proto="udp" src_port="5554"/>
      <filter dst_ip="203.196.213.205" dst_port="5554" proto="tcp" src_port="5554"/>
      <filter dst_ip="203.196.213.205" dst_port="5554" proto="udp" src_port="5554"/>
      <filter dst_ip="203.196.213.205" dst_port="5554" proto="tcp" src_port="5554"/>
      <filter dst_ip="203.196.213.205" dst_port="5554" proto="udp" src_port="5554"/>
      <filter dst_ip="203.196.213.205" dst_port="53" proto="tcp" src_port="5554"/>
      <filter dst_ip="203.196.213.205" dst_port="53" proto="udp" src_port="5554"/>
      <filter dst_ip="203.196.213.205" dst_port="53" proto="tcp" src_port="5554"/>
      <filter dst_ip="203.196.213.205" dst_port="53" proto="udp" src_port="5554"/>
      <filter dst_ip="203.196.213.205" dst_port="53" proto="tcp" src_port="5554"/>
      <filter dst_ip="203.196.213.205" dst_port="53" proto="udp" src_port="5554"/>
      <filter dst_ip="203.196.213.205" dst_port="53" proto="tcp" src_port="5554"/>
      <filter dst_ip="203.196.213.205" dst_port="53" proto="udp" src_port="5554"/>
      <from sec="1102827792" usec="0"/>
      <to sec="1102827799" usec="0"/>
    </slice>
    <from sec="1102827789" usec="0"/>
    <to sec="1102827800" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.692998,1.52346,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="udp" src_port="1023"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="udp" src_port="1023"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="udp" src_port="1023"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="tcp" src_port="1023"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="udp" src_port="1023"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="tcp" src_port="5554"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="udp" src_port="5554"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="tcp" src_port="5554"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="udp" src_port="5554"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="tcp" src_port="5554"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="udp" src_port="5554"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="tcp" src_port="5554"/>
      <filter dst_ip="203.197.86.245" dst_port="53" proto="udp" src_port="5554"/>
      <from sec="1102827674" usec="0"/>
      <to sec="1102827690" usec="0"/>
    </slice>
    <from sec="1102827674" usec="0"/>
    <to sec="1102827690" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.760514,1.46392,020,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_108{
style=filled;
color=gray75;
446[label="2.251.226.90d;123pkt 123fpkt", shape=rectangle, color=red];
795[label="2.251.226.90d;123pkt 123fpkt", shape=ellipse, color=green];
stat108[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 2.251.226.90:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
446--795[label="1;123pkt 123fpkt"];
</description>
    <slice>
      <filter dst_ip="2.251.226.90"/>
    </slice>
    <from sec="1102828376" usec="0"/>
    <to sec="1102828384" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.760514,1.46392,020,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_109{
style=filled;
color=gray75;
448[label="207.166.246.210d;164pkt 164fpkt", shape=rectangle, color=red];
796[label="207.166.246.210d;73pkt 73fpkt", shape=ellipse, color=green];
stat109[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 207.166.246.210:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
448--796[label="1;73pkt 73fpkt"];
</description>
    <slice>
      <filter dst_ip="207.166.246.210"/>
    </slice>
    <from sec="1102828261" usec="0"/>
    <to sec="1102828285" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.846598,1.3259,001,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_116{
style=filled;
color=gray75;
294[label="202.15.196.144s;14370pkt 14370fpkt", shape=rectangle, color=red];
670[label="202.15.196.144s;13113pkt 13113fpkt", shape=ellipse, color=green];
967[label="202.15.196.144s;1125pkt 1125fpkt", shape=triangle, color=blue];
2222[label="202.15.196.144;s;15711pkt 15711fpkt", shape=diamond, color=yellow];
stat116[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.15.196.144:*, *:1023}[33.3461%]&lt;BR/&gt;{202.15.196.144:*, *:5554}[33.327%]&lt;BR/&gt;{202.15.196.144:*, *:9898}[33.327%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (17.1507%)&lt;BR/&gt; 1023: (16.7693%)&lt;BR/&gt; 5554: (16.08%)&lt;BR/&gt; 2841: (0.0394865%)&lt;BR/&gt; 2837: (0.0394865%)&gt;];
}
294--670[label="1;13113pkt 13113fpkt"];
294--719[label="0.0470424;676pkt 676fpkt"];
294--953[label="0.0335421;482pkt 482fpkt"];
294--967[label="1;1125pkt 1125fpkt"];
294--1006[label="0.0470424;676pkt 676fpkt"];
294--2222[label="1;14370pkt 14370fpkt"];
670--967[label="1;1125pkt 1125fpkt"];
670--2222[label="1;13113pkt 13113fpkt"];
967--2222[label="1;1125pkt 1125fpkt"];
</description>
    <slice>
      <filter dst_port="1023" src_ip="202.15.196.144"/>
      <filter dst_port="9898" src_ip="202.15.196.144"/>
      <filter dst_port="5554" src_ip="202.15.196.144"/>
    </slice>
    <from sec="1102828011" usec="0"/>
    <to sec="1102828110" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.846598,1.3259,001,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_123{
style=filled;
color=gray75;
50[label="200.137.134.225s;16211pkt 16211fpkt", shape=rectangle, color=red];
763[label="200.137.134.225s;16211pkt 16211fpkt", shape=ellipse, color=green];
1043[label="200.137.134.225s;15611pkt 15611fpkt", shape=triangle, color=blue];
2148[label="200.137.134.225;s;16469pkt 16469fpkt", shape=diamond, color=yellow];
stat123[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.137.134.225:*, *:5554}[33.3536%]&lt;BR/&gt;{200.137.134.225:*, *:1023}[33.3232%]&lt;BR/&gt;{200.137.134.225:*, *:9898}[33.3232%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (16.815%)&lt;BR/&gt; 1023: (16.815%)&lt;BR/&gt; 5554: (16.37%)&lt;BR/&gt; 3708: (0.0232551%)&lt;BR/&gt; 3642: (0.0232551%)&gt;];
}
50--171[label="0.0154833;251pkt 251fpkt"];
50--561[label="0.00265252;43pkt 43fpkt"];
50--763[label="1;16211pkt 16211fpkt"];
50--877[label="0.00265252;43pkt 43fpkt"];
50--1043[label="1;15611pkt 15611fpkt"];
50--2148[label="1;16211pkt 16211fpkt"];
50--3478[label="0.0154833;251pkt 251fpkt"];
50--3481[label="0.0154833;251pkt 251fpkt"];
763--877[label="0.00265252;43pkt 43fpkt"];
763--1043[label="1;15611pkt 15611fpkt"];
763--2148[label="1;16211pkt 16211fpkt"];
763--3478[label="0.0154833;251pkt 251fpkt"];
763--3481[label="0.0154833;251pkt 251fpkt"];
1043--2148[label="1;15611pkt 15611fpkt"];
2148--3478[label="0.0154229;254pkt 254fpkt"];
2148--3480[label="0.0153015;252pkt 252fpkt"];
2148--3481[label="0.0154229;254pkt 254fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="200.137.134.225"/>
      <filter dst_port="9898" src_ip="200.137.134.225"/>
      <filter dst_port="1023" src_ip="200.137.134.225"/>
    </slice>
    <from sec="1102827894" usec="0"/>
    <to sec="1102828106" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_126{
style=filled;
color=gray75;
1078[label="194.91.119.40;d;1pkt 1fpkt", shape=diamond, color=yellow];
1079[label="212.154.65.174;s;40pkt 40fpkt", shape=diamond, color=yellow];
1548[label="200.249.50.168;d;1pkt 1fpkt", shape=diamond, color=yellow];
2950[label="212.154.65.174;s;10pkt 10fpkt", shape=hexagon, color=black];
stat126[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.154.65.174:6687, *:*}[45%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6687: (25%)&lt;BR/&gt; 11278: (3.84615%)&lt;BR/&gt; 27048: (2.88462%)&lt;BR/&gt; 23174: (2.88462%)&lt;BR/&gt; 7743: (2.88462%)&gt;];
}
1078--1079[label="1;1pkt 1fpkt"];
1078--2950[label="1;1pkt 1fpkt"];
1079--1548[label="1;1pkt 1fpkt"];
1079--2950[label="1;10pkt 10fpkt"];
1548--2950[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="212.154.65.174" src_port="6687"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_127{
style=filled;
color=gray75;
1085[label="200.252.43.56;d;1pkt 1fpkt", shape=diamond, color=yellow];
1086[label="212.154.65.176;s;2pkt 2fpkt", shape=diamond, color=yellow];
2995[label="212.154.65.176;s;2pkt 2fpkt", shape=hexagon, color=black];
stat127[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.154.65.176:1811, 200.252.43.56:1039}[50%]&lt;BR/&gt;{212.154.65.176:12582, 195.120.22.131:61877}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1811: (30%)&lt;BR/&gt; 1039: (30%)&lt;BR/&gt; 61877: (20%)&lt;BR/&gt; 12582: (20%)&gt;];
}
1085--1086[label="1;1pkt 1fpkt"];
1085--2995[label="1;1pkt 1fpkt"];
1086--2995[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="195.120.22.131" dst_port="61877" src_ip="212.154.65.176" src_port="12582"/>
      <filter dst_ip="200.252.43.56" dst_port="1039" src_ip="212.154.65.176" src_port="1811"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828180" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.715901,1.38456,999,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_129{
style=filled;
color=gray75;
46[label="213.88.80.191s;2pkt 2fpkt", shape=rectangle, color=red];
1088[label="64.8.215.20;d;2pkt 2fpkt", shape=diamond, color=yellow];
1089[label="213.88.80.191;s;49pkt 49fpkt", shape=diamond, color=yellow];
1090[label="69.79.37.54;d;2pkt 2fpkt", shape=diamond, color=yellow];
2845[label="64.8.215.20;d;2pkt 2fpkt", shape=hexagon, color=black];
2846[label="69.79.37.54;d;2pkt 2fpkt", shape=hexagon, color=black];
3077[label="213.88.80.191;s;38pkt 38fpkt", shape=hexagon, color=black];
stat129[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.88.80.191:1810, *:*}[91.8367%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1810: (47.4227%)&lt;BR/&gt; 58219: (2.57732%)&lt;BR/&gt; 1183: (2.57732%)&lt;BR/&gt; 38779: (2.06186%)&lt;BR/&gt; 38775: (2.06186%)&gt;];
}
46--1089[label="1;2pkt 2fpkt"];
46--1090[label="1;2pkt 2fpkt"];
46--2846[label="1;2pkt 2fpkt"];
46--3077[label="1;2pkt 2fpkt"];
1088--1089[label="1;2pkt 2fpkt"];
1088--2845[label="1;2pkt 2fpkt"];
1088--3077[label="1;2pkt 2fpkt"];
1089--1090[label="1;2pkt 2fpkt"];
1089--2845[label="1;2pkt 2fpkt"];
1089--2846[label="1;2pkt 2fpkt"];
1089--3077[label="1;38pkt 38fpkt"];
1090--2846[label="1;2pkt 2fpkt"];
1090--3077[label="1;2pkt 2fpkt"];
2845--3077[label="1;2pkt 2fpkt"];
2846--3077[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_ip="213.88.80.191" src_port="1810"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828427" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_130{
style=filled;
color=gray75;
1099[label="200.252.138.70;d;2pkt 2fpkt", shape=diamond, color=yellow];
1100[label="212.154.65.198;s;23pkt 23fpkt", shape=diamond, color=yellow];
2849[label="200.252.138.70;d;1pkt 1fpkt", shape=hexagon, color=black];
2850[label="212.154.65.198;s;5pkt 5fpkt", shape=hexagon, color=black];
stat130[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.154.65.198:*, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 18680: (12.9032%)&lt;BR/&gt; 7744: (6.45161%)&lt;BR/&gt; 3661: (6.45161%)&lt;BR/&gt; 26262: (4.83871%)&lt;BR/&gt; 31245: (3.22581%)&gt;];
}
1099--1100[label="1;2pkt 2fpkt"];
1099--2849[label="1;1pkt 1fpkt"];
1099--2850[label="0.5;1pkt 1fpkt"];
1100--2849[label="1;1pkt 1fpkt"];
1100--2850[label="1;5pkt 5fpkt"];
2849--2850[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="212.154.65.198"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828372" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_131{
style=filled;
color=gray75;
1134[label="1.154.0.15;d;1pkt 1fpkt", shape=diamond, color=yellow];
1135[label="149.66.168.6;s;2pkt 2fpkt", shape=diamond, color=yellow];
stat131[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.66.168.6:64112, 1.154.0.15:554}[50%]&lt;BR/&gt;{149.66.168.6:64155, 212.129.37.58:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 64112: (33.3333%)&lt;BR/&gt; 554: (33.3333%)&lt;BR/&gt; 64155: (16.6667%)&lt;BR/&gt; 80: (16.6667%)&gt;];
}
1134--1135[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="212.129.37.58" dst_port="80" src_ip="149.66.168.6" src_port="64155"/>
      <filter dst_ip="1.154.0.15" dst_port="554" src_ip="149.66.168.6" src_port="64112"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_132{
style=filled;
color=gray75;
1188[label="174.67.66.38;d;1pkt 1fpkt", shape=diamond, color=yellow];
1189[label="70.16.11.15;s;1pkt 1fpkt", shape=diamond, color=yellow];
2906[label="70.16.11.15;s;1pkt 1fpkt", shape=hexagon, color=black];
stat132[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.16.11.15:6881, 174.67.66.38:38850}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 38850: (50%)&lt;BR/&gt; 6881: (50%)&gt;];
}
1188--1189[label="1;1pkt 1fpkt"];
1188--2906[label="1;1pkt 1fpkt"];
1189--2906[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="174.67.66.38" dst_port="38850" src_ip="70.16.11.15" src_port="6881"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_133{
style=filled;
color=gray75;
1193[label="174.67.64.60;d;5pkt 5fpkt", shape=diamond, color=yellow];
1196[label="202.171.68.46;s;3pkt 3fpkt", shape=diamond, color=yellow];
2907[label="202.171.68.46;s;3pkt 3fpkt", shape=hexagon, color=black];
stat133[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.244.9.97:110, 174.67.64.60:1628}[20%]&lt;BR/&gt;{202.171.68.46:10003, 174.67.64.60:1352}[20%]&lt;BR/&gt;{202.171.68.46:10005, 174.67.64.60:1416}[20%]&lt;BR/&gt;{202.171.68.46:21, 174.67.64.60:1345}[20%]&lt;BR/&gt;{202.171.68.46:21, 174.67.64.60:1406}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (18.1818%)&lt;BR/&gt; 10005: (13.6364%)&lt;BR/&gt; 10003: (13.6364%)&lt;BR/&gt; 1416: (13.6364%)&lt;BR/&gt; 1406: (13.6364%)&gt;];
}
1193--1196[label="1;3pkt 3fpkt"];
1193--2907[label="1;3pkt 3fpkt"];
1196--2907[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="174.67.64.60" dst_port="1406" src_ip="202.171.68.46" src_port="21"/>
      <filter dst_ip="174.67.64.60" dst_port="1345" src_ip="202.171.68.46" src_port="21"/>
      <filter dst_ip="174.67.64.60" dst_port="1416" src_ip="202.171.68.46" src_port="10005"/>
      <filter dst_ip="174.67.64.60" dst_port="1352" src_ip="202.171.68.46" src_port="10003"/>
      <filter dst_ip="174.67.64.60" dst_port="1628" src_ip="2.244.9.97" src_port="110"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828414" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_134{
style=filled;
color=gray75;
1206[label="195.101.50.30;d;2pkt 2fpkt", shape=diamond, color=yellow];
1207[label="212.154.93.171;s;3pkt 3fpkt", shape=diamond, color=yellow];
2862[label="195.101.50.30;d;2pkt 2fpkt", shape=hexagon, color=black];
stat134[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.154.93.171:4354, 203.66.46.219:24628}[33.3333%]&lt;BR/&gt;{212.154.93.171:3110, 195.101.50.30:7743}[33.3333%]&lt;BR/&gt;{212.154.93.171:4348, 195.101.50.30:7743}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7743: (42.8571%)&lt;BR/&gt; 4348: (21.4286%)&lt;BR/&gt; 3110: (21.4286%)&lt;BR/&gt; 24628: (7.14286%)&lt;BR/&gt; 4354: (7.14286%)&gt;];
}
1206--1207[label="1;2pkt 2fpkt"];
1206--2862[label="1;2pkt 2fpkt"];
1207--2862[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="195.101.50.30" dst_port="7743" src_ip="212.154.93.171" src_port="4348"/>
      <filter dst_ip="195.101.50.30" dst_port="7743" src_ip="212.154.93.171" src_port="3110"/>
      <filter dst_ip="203.66.46.219" dst_port="24628" src_ip="212.154.93.171" src_port="4354"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102827965" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_135{
style=filled;
color=gray75;
1222[label="172.63.132.175;d;1076pkt 1076fpkt", shape=diamond, color=yellow];
1223[label="200.152.5.199;s;1076pkt 1076fpkt", shape=diamond, color=yellow];
3098[label="200.152.5.199;s;564pkt 564fpkt", shape=hexagon, color=black];
stat135[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.152.5.199:*, 172.63.132.175:1433}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1433: (50%)&lt;BR/&gt; 49854: (0.0552283%)&lt;BR/&gt; 49832: (0.0552283%)&lt;BR/&gt; 49754: (0.0552283%)&lt;BR/&gt; 49712: (0.0552283%)&gt;];
}
1222--1223[label="1;1076pkt 1076fpkt"];
1222--3098[label="1;564pkt 564fpkt"];
1223--3098[label="1;564pkt 564fpkt"];
</description>
    <slice>
      <filter dst_ip="172.63.132.175" dst_port="1433" src_ip="200.152.5.199"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_136{
style=filled;
color=gray75;
1145[label="212.154.65.26;s;33pkt 33fpkt", shape=diamond, color=yellow];
1245[label="207.116.1.218;d;1pkt 1fpkt", shape=diamond, color=yellow];
1507[label="200.240.215.89;d;2pkt 2fpkt", shape=diamond, color=yellow];
2450[label="205.137.159.187;d;1pkt 1fpkt", shape=diamond, color=yellow];
2891[label="212.154.65.26;s;30pkt 30fpkt", shape=hexagon, color=black];
stat136[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.154.65.26:22415, *:*}[42.4242%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 22415: (22.3881%)&lt;BR/&gt; 80: (8.95522%)&lt;BR/&gt; 15450: (2.23881%)&lt;BR/&gt; 3634: (2.23881%)&lt;BR/&gt; 3135: (2.23881%)&gt;];
}
1145--1245[label="1;1pkt 1fpkt"];
1145--1507[label="1;2pkt 2fpkt"];
1145--2450[label="1;1pkt 1fpkt"];
1145--2891[label="1;30pkt 30fpkt"];
1245--2891[label="1;1pkt 1fpkt"];
1507--2891[label="1;2pkt 2fpkt"];
2450--2891[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="212.154.65.26" src_port="22415"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828427" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_137{
style=filled;
color=gray75;
1247[label="134.203.34.173;d;2pkt 2fpkt", shape=diamond, color=yellow];
1248[label="2.72.159.37;s;1pkt 1fpkt", shape=diamond, color=yellow];
2869[label="134.203.34.173;d;1pkt 1fpkt", shape=hexagon, color=black];
2914[label="2.72.159.37;s;1pkt 1fpkt", shape=hexagon, color=black];
stat137[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.196.149.14:10015, 134.203.34.173:1093}[50%]&lt;BR/&gt;{2.72.159.37:15030, 134.203.34.173:3496}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 15030: (40%)&lt;BR/&gt; 3496: (40%)&lt;BR/&gt; 10015: (10%)&lt;BR/&gt; 1093: (10%)&gt;];
}
1247--1248[label="1;1pkt 1fpkt"];
1247--2869[label="1;1pkt 1fpkt"];
1247--2914[label="1;1pkt 1fpkt"];
1248--2869[label="1;1pkt 1fpkt"];
1248--2914[label="1;1pkt 1fpkt"];
2869--2914[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="134.203.34.173" dst_port="3496" src_ip="2.72.159.37" src_port="15030"/>
      <filter dst_ip="134.203.34.173" dst_port="1093" src_ip="203.196.149.14" src_port="10015"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102827866" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_138{
style=filled;
color=gray75;
1221[label="213.88.87.89;s;592pkt 592fpkt", shape=diamond, color=yellow];
1264[label="64.180.182.156;d;550pkt 550fpkt", shape=diamond, color=yellow];
2276[label="207.171.219.247;d;2pkt 2fpkt", shape=diamond, color=yellow];
stat138[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.88.87.89:25, 64.180.182.156:*}[92.9054%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (49.9126%)&lt;BR/&gt; 59361: (0.0874126%)&lt;BR/&gt; 59350: (0.0874126%)&lt;BR/&gt; 59340: (0.0874126%)&lt;BR/&gt; 59330: (0.0874126%)&gt;];
}
1221--1264[label="1;550pkt 550fpkt"];
1221--2276[label="1;2pkt 2fpkt"];
1221--2560[label="0.00168919;1pkt 1fpkt"];
1221--2707[label="0.00168919;1pkt 1fpkt"];
1221--3348[label="0.00168919;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="64.180.182.156" src_ip="213.88.87.89" src_port="25"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.846598,1.3259,002,1 1 1 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_140{
style=filled;
color=gray75;
92[label="203.32.96.144s;256pkt 256fpkt", shape=rectangle, color=red];
496[label="203.32.96.144s;80pkt 80fpkt", shape=ellipse, color=green];
823[label="203.32.96.144s;80pkt 80fpkt", shape=triangle, color=blue];
2083[label="149.66.2.206;d;32pkt 32fpkt", shape=diamond, color=yellow];
stat140[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.32.96.144:1032, *:137}[89.1986%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1032: (46.5402%)&lt;BR/&gt; 137: (46.5402%)&lt;BR/&gt; 25: (2.45536%)&lt;BR/&gt; 80: (0.78125%)&lt;BR/&gt; 53: (0.223214%)&gt;];
}
92--496[label="1;80pkt 80fpkt"];
92--823[label="1;80pkt 80fpkt"];
92--2083[label="0.03125;1pkt 1fpkt"];
496--823[label="1;80pkt 80fpkt"];
2083--3449[label="0.03125;1pkt 1fpkt"];
2083--3471[label="0.03125;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="203.32.96.144" src_port="1032"/>
    </slice>
    <from sec="1102827601" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_141{
style=filled;
color=gray75;
1312[label="69.0.16.23;d;3pkt 3fpkt", shape=diamond, color=yellow];
1313[label="212.154.65.20;s;4pkt 4fpkt", shape=diamond, color=yellow];
2883[label="69.0.16.23;d;3pkt 3fpkt", shape=hexagon, color=black];
stat141[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.154.65.20:1401, 208.89.215.148:80}[25%]&lt;BR/&gt;{212.154.65.20:8000, 69.0.16.23:49265}[25%]&lt;BR/&gt;{212.154.65.20:8000, 69.0.16.23:49266}[25%]&lt;BR/&gt;{212.154.65.20:8000, 69.0.16.23:49267}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8000: (45%)&lt;BR/&gt; 49267: (15%)&lt;BR/&gt; 49266: (15%)&lt;BR/&gt; 49265: (15%)&lt;BR/&gt; 1401: (5%)&gt;];
}
1312--1313[label="1;3pkt 3fpkt"];
1312--2883[label="1;3pkt 3fpkt"];
1313--2883[label="1;3pkt 3fpkt"];
1313--3473[label="0.25;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="69.0.16.23" dst_port="49267" src_ip="212.154.65.20" src_port="8000"/>
      <filter dst_ip="69.0.16.23" dst_port="49266" src_ip="212.154.65.20" src_port="8000"/>
      <filter dst_ip="69.0.16.23" dst_port="49265" src_ip="212.154.65.20" src_port="8000"/>
      <filter dst_ip="208.89.215.148" dst_port="80" src_ip="212.154.65.20" src_port="1401"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102827885" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_142{
style=filled;
color=gray75;
1364[label="212.154.81.192;d;257pkt 257fpkt", shape=diamond, color=yellow];
1365[label="0.103.140.107;s;257pkt 257fpkt", shape=diamond, color=yellow];
3097[label="0.103.140.107;s;246pkt 246fpkt", shape=hexagon, color=black];
stat142[shape=component, label=&lt;Rules:&lt;BR/&gt;{0.103.140.107:*, 212.154.81.192:7}[99.6109%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7: (50%)&lt;BR/&gt; 0: (0.592105%)&lt;BR/&gt; 255: (0.197368%)&lt;BR/&gt; 254: (0.197368%)&lt;BR/&gt; 253: (0.197368%)&gt;];
}
1364--1365[label="1;257pkt 257fpkt"];
1364--3097[label="1;246pkt 246fpkt"];
1364--3456[label="0.00389105;1pkt 1fpkt"];
1364--3470[label="0.00389105;1pkt 1fpkt"];
1365--3097[label="1;246pkt 246fpkt"];
1365--3456[label="0.00389105;1pkt 1fpkt"];
1365--3470[label="0.00389105;1pkt 1fpkt"];
3097--3456[label="0.00406504;1pkt 1fpkt"];
3097--3470[label="0.00406504;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="212.154.81.192" dst_port="7" src_ip="0.103.140.107"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_143{
style=filled;
color=gray75;
1367[label="147.70.132.237;d;911pkt 911fpkt", shape=diamond, color=yellow];
stat143[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 147.70.132.237:4662}[99.4512%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4662: (49.7256%)&lt;BR/&gt; 4267: (0.164654%)&lt;BR/&gt; 3566: (0.164654%)&lt;BR/&gt; 3267: (0.164654%)&lt;BR/&gt; 4924: (0.109769%)&gt;];
}
1367--1975[label="0.00329308;3pkt 3fpkt"];
1367--3161[label="0.00329308;3pkt 3fpkt"];
1367--3708[label="0.00329308;3pkt 3fpkt"];
1367--4124[label="0.00329308;3pkt 3fpkt"];
1367--4481[label="0.00329308;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="147.70.132.237" dst_port="4662"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_145{
style=filled;
color=gray75;
1372[label="212.154.94.160;s;6pkt 6fpkt", shape=diamond, color=yellow];
1373[label="212.56.126.215;d;5pkt 5fpkt", shape=diamond, color=yellow];
3194[label="212.154.94.160;s;4pkt 4fpkt", shape=hexagon, color=black];
stat145[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.154.94.160:*, 212.56.126.215:1000}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1000: (26.6667%)&lt;BR/&gt; 4407: (10%)&lt;BR/&gt; 2287: (10%)&lt;BR/&gt; 2273: (10%)&lt;BR/&gt; 2272: (10%)&gt;];
}
1372--1373[label="1;5pkt 5fpkt"];
1372--3194[label="1;4pkt 4fpkt"];
1373--3194[label="0.75;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="212.56.126.215" dst_port="1000" src_ip="212.154.94.160"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828379" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_146{
style=filled;
color=gray75;
1383[label="149.67.81.212;s;170pkt 170fpkt", shape=diamond, color=yellow];
stat146[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.67.81.212:25, *:*}[82.3529%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 2681: (0.588235%)&lt;BR/&gt; 1061: (0.588235%)&lt;BR/&gt; 65040: (0.294118%)&lt;BR/&gt; 63122: (0.294118%)&gt;];
}
1383--3457[label="0.00588235;1pkt 1fpkt"];
1383--3471[label="0.0117647;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_ip="149.67.81.212" src_port="25"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828337" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_147{
style=filled;
color=gray75;
1399[label="149.66.0.132;d;1pkt 1fpkt", shape=diamond, color=yellow];
1400[label="208.40.145.26;s;1pkt 1fpkt", shape=diamond, color=yellow];
3200[label="208.40.145.26;s;1pkt 1fpkt", shape=hexagon, color=black];
stat147[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.40.145.26:554, 149.66.0.132:49168}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 49168: (50%)&lt;BR/&gt; 554: (50%)&gt;];
}
1399--1400[label="1;1pkt 1fpkt"];
1399--3200[label="1;1pkt 1fpkt"];
1400--3200[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="149.66.0.132" dst_port="49168" src_ip="208.40.145.26" src_port="554"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828426" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_148{
style=filled;
color=gray75;
1269[label="200.244.117.118;d;5pkt 5fpkt", shape=diamond, color=yellow];
1426[label="149.66.89.165;s;5pkt 5fpkt", shape=diamond, color=yellow];
stat148[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.66.89.165:80, 200.244.117.118:1552}[20%]&lt;BR/&gt;{149.66.89.165:80, 200.244.117.118:1553}[20%]&lt;BR/&gt;{149.66.89.165:80, 200.244.117.118:1554}[20%]&lt;BR/&gt;{149.66.89.165:80, 200.244.117.118:1555}[20%]&lt;BR/&gt;{149.66.89.165:80, 200.244.117.118:1556}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1556: (10%)&lt;BR/&gt; 1555: (10%)&lt;BR/&gt; 1554: (10%)&lt;BR/&gt; 1553: (10%)&gt;];
}
1269--1426[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="200.244.117.118" dst_port="1556" src_ip="149.66.89.165" src_port="80"/>
      <filter dst_ip="200.244.117.118" dst_port="1555" src_ip="149.66.89.165" src_port="80"/>
      <filter dst_ip="200.244.117.118" dst_port="1554" src_ip="149.66.89.165" src_port="80"/>
      <filter dst_ip="200.244.117.118" dst_port="1553" src_ip="149.66.89.165" src_port="80"/>
      <filter dst_ip="200.244.117.118" dst_port="1552" src_ip="149.66.89.165" src_port="80"/>
    </slice>
    <from sec="1102827602" usec="0"/>
    <to sec="1102827666" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="2.74.28.184"/>
      <from sec="1102827636" usec="0"/>
      <to sec="1102827675" usec="0"/>
    </slice>
    <from sec="1102827636" usec="0"/>
    <to sec="1102827675" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.586058,1.42378,999,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_150{
style=filled;
color=gray75;
17[label="149.66.15.73s;1pkt 1fpkt", shape=rectangle, color=red];
1462[label="149.66.15.73;s;14pkt 14fpkt", shape=diamond, color=yellow];
1479[label="32.101.48.168;d;1pkt 1fpkt", shape=diamond, color=yellow];
1809[label="206.16.29.173;d;10pkt 10fpkt", shape=diamond, color=yellow];
stat150[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.66.15.73:18317, 206.16.29.173:*}[66.6667%]&lt;BR/&gt;{149.66.15.73:19101, *:*}[26.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 18317: (36.5385%)&lt;BR/&gt; 19101: (11.5385%)&lt;BR/&gt; 35367: (3.84615%)&lt;BR/&gt; 35347: (3.84615%)&lt;BR/&gt; 35346: (3.84615%)&gt;];
}
17--1462[label="1;1pkt 1fpkt"];
1462--1479[label="1;1pkt 1fpkt"];
1462--1809[label="0.9;9pkt 9fpkt"];
</description>
    <slice>
      <filter src_ip="149.66.15.73" src_port="19101"/>
      <filter dst_ip="206.16.29.173" src_ip="149.66.15.73" src_port="18317"/>
    </slice>
    <from sec="1102827646" usec="0"/>
    <to sec="1102828494" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="149.67.36.240"/>
      <from sec="1102828183" usec="0"/>
      <to sec="1102828219" usec="0"/>
    </slice>
    <from sec="1102828183" usec="0"/>
    <to sec="1102828219" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_152{
style=filled;
color=gray75;
1450[label="213.88.81.48;s;203pkt 203fpkt", shape=diamond, color=yellow];
1510[label="194.44.32.77;d;176pkt 176fpkt", shape=diamond, color=yellow];
stat152[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.88.81.48:*, 194.44.32.77:80}[88.2353%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.3404%)&lt;BR/&gt; 53: (0.395778%)&lt;BR/&gt; 4091: (0.263852%)&lt;BR/&gt; 4090: (0.263852%)&lt;BR/&gt; 4087: (0.263852%)&gt;];
}
1450--1510[label="0.994318;175pkt 175fpkt"];
1450--1638[label="0.00990099;1pkt 1fpkt"];
1450--2560[label="0.00492611;1pkt 1fpkt"];
1450--2707[label="0.00492611;1pkt 1fpkt"];
1450--3276[label="0.0121951;1pkt 1fpkt"];
1450--3348[label="0.00492611;1pkt 1fpkt"];
1450--3449[label="0.00985222;2pkt 2fpkt"];
1450--3456[label="0.00492611;1pkt 1fpkt"];
1450--3459[label="0.00492611;1pkt 1fpkt"];
1450--3473[label="0.00985222;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="194.44.32.77" dst_port="80" src_ip="213.88.81.48"/>
    </slice>
    <from sec="1102827627" usec="0"/>
    <to sec="1102828304" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.801936,1.34796,001,1 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_153{
style=filled;
color=gray75;
413[label="194.116.1.230s;1510pkt 1510fpkt", shape=rectangle, color=red];
1536[label="194.116.1.230;s;2576pkt 2576fpkt", shape=diamond, color=yellow];
2948[label="194.116.1.230;s;1314pkt 1314fpkt", shape=hexagon, color=black];
3904[label="194.116.1.230;2576pkt 2576fpkt", shape=pentagon, color=darkviolet];
stat153[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.116.1.230:*, *:9898}[36.413%]&lt;BR/&gt;{194.116.1.230:*, *:1023}[35.3261%]&lt;BR/&gt;{194.116.1.230:*, *:5554}[28.2609%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (17.9852%)&lt;BR/&gt; 1023: (17.8598%)&lt;BR/&gt; 5554: (14.155%)&lt;BR/&gt; 1956: (0.883902%)&lt;BR/&gt; 1239: (0.865095%)&gt;];
}
413--1536[label="1;1510pkt 1510fpkt"];
413--2948[label="0.261035;343pkt 343fpkt"];
413--3904[label="1;1510pkt 1510fpkt"];
1536--2948[label="1;1314pkt 1314fpkt"];
1536--3904[label="1;2576pkt 2576fpkt"];
2948--3904[label="1;1314pkt 1314fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="194.116.1.230"/>
      <filter dst_port="1023" src_ip="194.116.1.230"/>
      <filter dst_port="5554" src_ip="194.116.1.230"/>
    </slice>
    <from sec="1102827768" usec="0"/>
    <to sec="1102827826" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_154{
style=filled;
color=gray75;
1599[label="195.245.33.242;s;8pkt 8fpkt", shape=diamond, color=yellow];
1600[label="168.188.141.255;d;8pkt 8fpkt", shape=diamond, color=yellow];
3110[label="195.245.33.242;s;6pkt 6fpkt", shape=hexagon, color=black];
3315[label="168.188.141.255;d;7pkt 7fpkt", shape=hexagon, color=black];
stat154[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.245.33.242:20, 168.188.141.255:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 20: (50%)&lt;BR/&gt; 3475: (6.89655%)&lt;BR/&gt; 3474: (6.89655%)&lt;BR/&gt; 3473: (6.89655%)&lt;BR/&gt; 3469: (6.89655%)&gt;];
}
1599--1600[label="1;8pkt 8fpkt"];
1599--3110[label="1;6pkt 6fpkt"];
1599--3315[label="1;7pkt 7fpkt"];
1600--3110[label="1;6pkt 6fpkt"];
1600--3315[label="1;7pkt 7fpkt"];
3110--3315[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="168.188.141.255" src_ip="195.245.33.242" src_port="20"/>
    </slice>
    <from sec="1102827601" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.586058,1.42378,020,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_156{
style=filled;
color=gray75;
447[label="202.46.84.189d;254pkt 254fpkt", shape=rectangle, color=red];
1721[label="202.46.84.189;d;254pkt 254fpkt", shape=diamond, color=yellow];
stat156[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 202.46.84.189:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
447--1721[label="1;254pkt 254fpkt"];
</description>
    <slice>
      <filter dst_ip="202.46.84.189"/>
    </slice>
    <from sec="1102827884" usec="0"/>
    <to sec="1102827889" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_157{
style=filled;
color=gray75;
1229[label="213.88.83.183;s;355pkt 355fpkt", shape=diamond, color=yellow];
1750[label="0.103.140.107;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat157[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.88.83.183:0, *:0}[99.4366%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.4382%)&lt;BR/&gt; 3389: (0.140449%)&lt;BR/&gt; 3241: (0.140449%)&lt;BR/&gt; 2158: (0.140449%)&lt;BR/&gt; 1433: (0.140449%)&gt;];
}
1229--1750[label="1;1pkt 1fpkt"];
1229--2267[label="0.00344828;1pkt 1fpkt"];
1229--2466[label="0.00398406;1pkt 1fpkt"];
1229--2560[label="0.0028169;1pkt 1fpkt"];
1229--2707[label="0.0028169;1pkt 1fpkt"];
1229--2725[label="0.00458716;1pkt 1fpkt"];
1229--3348[label="0.0028169;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="213.88.83.183"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="174.67.161.232"/>
      <from sec="1102827600" usec="0"/>
      <to sec="1102828428" usec="0"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="212.146.17.225"/>
      <from sec="1102827600" usec="0"/>
      <to sec="1102828428" usec="0"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_160{
style=filled;
color=gray75;
1594[label="149.66.0.132;s;1pkt 1fpkt", shape=diamond, color=yellow];
1770[label="208.40.145.26;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat160[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.66.0.132:49168, 208.40.145.26:554}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 49168: (50%)&lt;BR/&gt; 554: (50%)&gt;];
}
1594--1770[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="208.40.145.26" dst_port="554" src_ip="149.66.0.132" src_port="49168"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828426" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_161{
style=filled;
color=gray75;
1602[label="149.66.200.23;d;26pkt 26fpkt", shape=diamond, color=yellow];
1817[label="68.255.210.242;s;5pkt 5fpkt", shape=diamond, color=yellow];
3128[label="68.255.210.242;s;4pkt 4fpkt", shape=hexagon, color=black];
stat161[shape=component, label=&lt;Rules:&lt;BR/&gt;{68.255.210.242:1755, 149.66.200.23:*}[50%]&lt;BR/&gt;{66.241.178.46:80, 149.66.200.23:*}[30.7692%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1755: (32.8571%)&lt;BR/&gt; 80: (17.1429%)&lt;BR/&gt; 2161: (4.28571%)&lt;BR/&gt; 2158: (4.28571%)&lt;BR/&gt; 2145: (4.28571%)&gt;];
}
1602--1817[label="1;5pkt 5fpkt"];
1602--3128[label="1;4pkt 4fpkt"];
1602--3470[label="0.0384615;1pkt 1fpkt"];
1817--3128[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="149.66.200.23" src_ip="68.255.210.242" src_port="1755"/>
      <filter dst_ip="149.66.200.23" src_ip="66.241.178.46" src_port="80"/>
    </slice>
    <from sec="1102827601" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_164{
style=filled;
color=gray75;
1751[label="174.67.66.140;s;17pkt 17fpkt", shape=diamond, color=yellow];
2055[label="0.17.254.122;d;10pkt 10fpkt", shape=diamond, color=yellow];
stat164[shape=component, label=&lt;Rules:&lt;BR/&gt;{174.67.66.140:*, 195.100.13.49:80}[41.1765%]&lt;BR/&gt;{174.67.66.140:*, 0.17.254.122:8080}[29.4118%]&lt;BR/&gt;{174.67.66.140:6970, 0.17.254.122:*}[29.4118%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8080: (18.5185%)&lt;BR/&gt; 6970: (18.5185%)&lt;BR/&gt; 80: (12.963%)&lt;BR/&gt; 29598: (3.7037%)&lt;BR/&gt; 28670: (3.7037%)&gt;];
}
1751--2055[label="1;10pkt 10fpkt"];
1751--3449[label="0.0588235;1pkt 1fpkt"];
1751--3459[label="0.0588235;1pkt 1fpkt"];
1751--3473[label="0.117647;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="0.17.254.122" src_ip="174.67.66.140" src_port="6970"/>
      <filter dst_ip="0.17.254.122" dst_port="8080" src_ip="174.67.66.140"/>
      <filter dst_ip="195.100.13.49" dst_port="80" src_ip="174.67.66.140"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828338" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="149.66.8.88"/>
      <from sec="1102827618" usec="0"/>
      <to sec="1102828245" usec="0"/>
    </slice>
    <from sec="1102827618" usec="0"/>
    <to sec="1102828245" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_167{
style=filled;
color=gray75;
2184[label="32.132.154.254;d;1pkt 1fpkt", shape=diamond, color=yellow];
2185[label="149.67.181.57;s;6pkt 6fpkt", shape=diamond, color=yellow];
2790[label="213.177.245.97;d;4pkt 4fpkt", shape=diamond, color=yellow];
stat167[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.67.181.57:80, 213.177.245.97:*}[66.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 50033: (9.09091%)&lt;BR/&gt; 1204: (9.09091%)&lt;BR/&gt; 1203: (9.09091%)&lt;BR/&gt; 1202: (9.09091%)&gt;];
}
2184--2185[label="1;1pkt 1fpkt"];
2185--2790[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="213.177.245.97" src_ip="149.67.181.57" src_port="80"/>
    </slice>
    <from sec="1102827969" usec="0"/>
    <to sec="1102828418" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_168{
style=filled;
color=gray75;
2191[label="213.239.99.177;d;9pkt 9fpkt", shape=diamond, color=yellow];
2192[label="149.67.43.145;s;16pkt 16fpkt", shape=diamond, color=yellow];
stat168[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.67.43.145:*, 213.239.99.177:80}[56.25%]&lt;BR/&gt;{149.67.43.145:1284, *:*}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (42%)&lt;BR/&gt; 1284: (8%)&lt;BR/&gt; 40698: (4%)&lt;BR/&gt; 40697: (4%)&lt;BR/&gt; 40696: (4%)&gt;];
}
2191--2192[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter src_ip="149.67.43.145" src_port="1284"/>
      <filter dst_ip="213.239.99.177" dst_port="80" src_ip="149.67.43.145"/>
    </slice>
    <from sec="1102827976" usec="0"/>
    <to sec="1102828052" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_171{
style=filled;
color=gray75;
2269[label="213.88.81.155;d;132pkt 132fpkt", shape=diamond, color=yellow];
stat171[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 213.88.81.155:0}[99.2424%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.2424%)&lt;BR/&gt; 3803: (0.378788%)&lt;BR/&gt; 1433: (0.378788%)&gt;];
}
2269--2708[label="0.00757576;1pkt 1fpkt"];
2269--3349[label="0.00757576;1pkt 1fpkt"];
2269--3487[label="0.00757576;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="213.88.81.155"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_172{
style=filled;
color=gray75;
2290[label="192.168.128.255;d;1pkt 1fpkt", shape=diamond, color=yellow];
2291[label="149.66.60.186;s;1pkt 1fpkt", shape=diamond, color=yellow];
3198[label="192.168.128.255;d;1pkt 1fpkt", shape=hexagon, color=black];
3199[label="149.66.60.186;s;1pkt 1fpkt", shape=hexagon, color=black];
stat172[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.66.60.186:4445, 192.168.128.255:4445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4445: (100%)&gt;];
}
2290--2291[label="1;1pkt 1fpkt"];
2290--3198[label="1;1pkt 1fpkt"];
2290--3199[label="1;1pkt 1fpkt"];
2291--3198[label="1;1pkt 1fpkt"];
2291--3199[label="1;1pkt 1fpkt"];
3198--3199[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="192.168.128.255" dst_port="4445" src_ip="149.66.60.186" src_port="4445"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_173{
style=filled;
color=gray75;
1773[label="212.154.76.68;d;7pkt 7fpkt", shape=diamond, color=yellow];
2310[label="84.138.178.231;s;1pkt 1fpkt", shape=diamond, color=yellow];
2612[label="214.202.183.175;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat173[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:6699, 212.154.76.68:*}[57.1429%]&lt;BR/&gt;{84.149.143.136:*, 212.154.76.68:*}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (33.3333%)&lt;BR/&gt; 4195: (11.1111%)&lt;BR/&gt; 2395: (11.1111%)&lt;BR/&gt; 0: (11.1111%)&lt;BR/&gt; 26699: (5.55556%)&gt;];
}
1773--2310[label="1;1pkt 1fpkt"];
1773--2612[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="212.154.76.68" src_ip="84.149.143.136"/>
      <filter dst_ip="212.154.76.68" src_port="6699"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828425" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="213.88.82.200"/>
      <from sec="1102827604" usec="0"/>
      <to sec="1102828248" usec="0"/>
    </slice>
    <from sec="1102827604" usec="0"/>
    <to sec="1102828248" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_175{
style=filled;
color=gray75;
2039[label="149.67.108.9;s;203pkt 203fpkt", shape=diamond, color=yellow];
2360[label="0.87.7.233;d;129pkt 129fpkt", shape=diamond, color=yellow];
stat175[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.67.108.9:*, 0.87.7.233:6667}[56.7308%]&lt;BR/&gt;{149.67.108.9:*, 204.47.34.240:6667}[37.5%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (47.2892%)&lt;BR/&gt; 113: (2.71084%)&lt;BR/&gt; 60775: (0.301205%)&lt;BR/&gt; 60752: (0.301205%)&lt;BR/&gt; 60748: (0.301205%)&gt;];
}
2039--2360[label="0.96124;124pkt 124fpkt"];
</description>
    <slice>
      <filter dst_ip="0.87.7.233" dst_port="6667" src_ip="149.67.108.9"/>
      <filter dst_ip="204.47.34.240" dst_port="6667" src_ip="149.67.108.9"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828411" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,001,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="206.31.0.99"/>
      <from sec="1102828031" usec="0"/>
      <to sec="1102828082" usec="0"/>
    </slice>
    <from sec="1102828031" usec="0"/>
    <to sec="1102828082" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_177{
style=filled;
color=gray75;
2244[label="200.245.91.35;d;4pkt 4fpkt", shape=diamond, color=yellow];
2423[label="212.154.65.228;s;4pkt 4fpkt", shape=diamond, color=yellow];
3231[label="212.154.65.228;s;2pkt 2fpkt", shape=hexagon, color=black];
stat177[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.154.65.228:3948, 200.245.91.35:7000}[25%]&lt;BR/&gt;{212.154.65.228:3949, 200.245.91.35:7000}[25%]&lt;BR/&gt;{212.154.65.228:15661, 200.245.91.35:4341}[25%]&lt;BR/&gt;{212.154.65.228:15661, 200.245.91.35:4354}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 15661: (25%)&lt;BR/&gt; 7000: (25%)&lt;BR/&gt; 4341: (15%)&lt;BR/&gt; 3948: (15%)&lt;BR/&gt; 4354: (10%)&gt;];
}
2244--2423[label="1;4pkt 4fpkt"];
2244--3231[label="1;2pkt 2fpkt"];
2423--3231[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="200.245.91.35" dst_port="4354" src_ip="212.154.65.228" src_port="15661"/>
      <filter dst_ip="200.245.91.35" dst_port="4341" src_ip="212.154.65.228" src_port="15661"/>
      <filter dst_ip="200.245.91.35" dst_port="7000" src_ip="212.154.65.228" src_port="3949"/>
      <filter dst_ip="200.245.91.35" dst_port="7000" src_ip="212.154.65.228" src_port="3948"/>
    </slice>
    <from sec="1102828042" usec="0"/>
    <to sec="1102828191" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.586058,1.42378,001,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_179{
style=filled;
color=gray75;
123[label="203.216.177.19s;893pkt 893fpkt", shape=rectangle, color=red];
2445[label="203.216.177.19;s;1547pkt 1547fpkt", shape=diamond, color=yellow];
stat179[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.216.177.19:*, *:1023}[34.8416%]&lt;BR/&gt;{203.216.177.19:*, *:5554}[33.9367%]&lt;BR/&gt;{203.216.177.19:*, *:9898}[31.2217%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1023: (20.5943%)&lt;BR/&gt; 5554: (19.5082%)&lt;BR/&gt; 9898: (9.89754%)&lt;BR/&gt; 1761: (0.491803%)&lt;BR/&gt; 4339: (0.471311%)&gt;];
}
123--1133[label="0.00206186;1pkt 1fpkt"];
123--2041[label="0.0114943;1pkt 1fpkt"];
123--2445[label="1;893pkt 893fpkt"];
</description>
    <slice>
      <filter dst_port="1023" src_ip="203.216.177.19"/>
      <filter dst_port="5554" src_ip="203.216.177.19"/>
      <filter dst_port="9898" src_ip="203.216.177.19"/>
    </slice>
    <from sec="1102828117" usec="0"/>
    <to sec="1102828178" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_180{
style=filled;
color=gray75;
1162[label="168.188.164.89;s;428pkt 428fpkt", shape=diamond, color=yellow];
2279[label="216.32.110.252;d;28pkt 28fpkt", shape=diamond, color=yellow];
2326[label="66.202.249.102;d;128pkt 128fpkt", shape=diamond, color=yellow];
2472[label="205.2.30.82;d;155pkt 155fpkt", shape=diamond, color=yellow];
2736[label="168.188.171.92;s;2pkt 2fpkt", shape=diamond, color=yellow];
2897[label="168.188.164.89;s;279pkt 279fpkt", shape=hexagon, color=black];
stat180[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.188.164.89:*, 205.2.30.82:*}[34.5982%]&lt;BR/&gt;{168.188.164.89:*, 66.202.249.102:6667}[28.5714%]&lt;BR/&gt;{168.188.164.89:113, *:*}[21.2054%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (37.9412%)&lt;BR/&gt; 113: (11.4216%)&lt;BR/&gt; 3913: (0.245098%)&lt;BR/&gt; 2130: (0.245098%)&lt;BR/&gt; 80: (0.196078%)&gt;];
}
1162--2279[label="0.821429;23pkt 23fpkt"];
1162--2326[label="0.890625;114pkt 114fpkt"];
1162--2472[label="1;155pkt 155fpkt"];
1162--2897[label="1;279pkt 279fpkt"];
1162--3456[label="0.00233645;1pkt 1fpkt"];
2279--2736[label="0.5;1pkt 1fpkt"];
2279--2897[label="0.535714;15pkt 15fpkt"];
2326--2897[label="0.554688;71pkt 71fpkt"];
2472--2897[label="0.63871;99pkt 99fpkt"];
2897--3456[label="0.00358423;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="205.2.30.82" src_ip="168.188.164.89"/>
      <filter src_ip="168.188.164.89" src_port="113"/>
      <filter dst_ip="66.202.249.102" dst_port="6667" src_ip="168.188.164.89"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_181{
style=filled;
color=gray75;
2473[label="213.88.87.18;d;132pkt 132fpkt", shape=diamond, color=yellow];
stat181[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 213.88.87.18:0}[99.2424%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.2424%)&lt;BR/&gt; 4479: (0.378788%)&lt;BR/&gt; 1433: (0.378788%)&gt;];
}
2473--2708[label="0.00757576;1pkt 1fpkt"];
2473--3349[label="0.00757576;1pkt 1fpkt"];
2473--3487[label="0.00757576;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="213.88.87.18"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_182{
style=filled;
color=gray75;
2061[label="141.169.152.87;s;1pkt 1fpkt", shape=diamond, color=yellow];
2478[label="90.202.255.159;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat182[shape=component, label=&lt;Rules:&lt;BR/&gt;{141.169.152.87:4496, 90.202.255.159:981}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4496: (50%)&lt;BR/&gt; 981: (50%)&gt;];
}
2061--2478[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="90.202.255.159" dst_port="981" src_ip="141.169.152.87" src_port="4496"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_183{
style=filled;
color=gray75;
1774[label="212.154.76.68;s;18pkt 18fpkt", shape=diamond, color=yellow];
2494[label="84.138.178.231;d;1pkt 1fpkt", shape=diamond, color=yellow];
2745[label="214.202.183.175;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat183[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.154.76.68:*, *:6699}[77.7778%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (40%)&lt;BR/&gt; 27960: (5%)&lt;BR/&gt; 4195: (5%)&lt;BR/&gt; 2395: (5%)&lt;BR/&gt; 26699: (2.5%)&gt;];
}
1774--2494[label="1;1pkt 1fpkt"];
1774--2745[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="6699" src_ip="212.154.76.68"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828425" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_184{
style=filled;
color=gray75;
2353[label="149.67.50.198;s;2pkt 2fpkt", shape=diamond, color=yellow];
2524[label="206.170.137.8;d;1pkt 1fpkt", shape=diamond, color=yellow];
3377[label="149.67.50.198;s;2pkt 2fpkt", shape=hexagon, color=black];
stat184[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.67.50.198:3389, 206.170.137.8:1112}[50%]&lt;BR/&gt;{149.67.50.198:3497, 205.212.183.97:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3389: (30%)&lt;BR/&gt; 1112: (30%)&lt;BR/&gt; 3497: (20%)&lt;BR/&gt; 80: (20%)&gt;];
}
2353--2524[label="1;1pkt 1fpkt"];
2353--3377[label="1;2pkt 2fpkt"];
2524--3377[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="205.212.183.97" dst_port="80" src_ip="149.67.50.198" src_port="3497"/>
      <filter dst_ip="206.170.137.8" dst_port="1112" src_ip="149.67.50.198" src_port="3389"/>
    </slice>
    <from sec="1102827613" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_185{
style=filled;
color=gray75;
1783[label="149.66.200.23;s;37pkt 37fpkt", shape=diamond, color=yellow];
2541[label="68.255.210.242;d;6pkt 6fpkt", shape=diamond, color=yellow];
stat185[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.66.200.23:*, 68.255.210.242:1755}[35.1351%]&lt;BR/&gt;{149.66.200.23:*, 66.241.178.46:80}[24.3243%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (25.5814%)&lt;BR/&gt; 1755: (24.4186%)&lt;BR/&gt; 2165: (2.32558%)&lt;BR/&gt; 2162: (2.32558%)&lt;BR/&gt; 2161: (2.32558%)&gt;];
}
1783--2541[label="1;6pkt 6fpkt"];
1783--3449[label="0.027027;1pkt 1fpkt"];
1783--3473[label="0.189189;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="68.255.210.242" dst_port="1755" src_ip="149.66.200.23"/>
      <filter dst_ip="66.241.178.46" dst_port="80" src_ip="149.66.200.23"/>
    </slice>
    <from sec="1102827601" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.68967,1.46767,020,0 0 0 1 0 0 0 0 0 0 1 0 ">
    <description>subgraph cluster_186{
style=filled;
color=gray75;
2314[label="213.88.82.139;s;523pkt 523fpkt", shape=diamond, color=yellow];
2397[label="192.58.154.8;d;46pkt 46fpkt", shape=diamond, color=yellow];
2552[label="218.49.141.99;s;43pkt 43fpkt", shape=diamond, color=yellow];
4091[label="218.49.141.99;42pkt 42fpkt", shape=invtriangle, color=brown];
stat186[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.88.82.139:0, *:0}[91.9014%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (79.9694%)&lt;BR/&gt; 22: (9.93884%)&lt;BR/&gt; 17816: (0.30581%)&lt;BR/&gt; 56149: (0.229358%)&lt;BR/&gt; 55951: (0.229358%)&gt;];
}
2314--2397[label="0.0217391;1pkt 1fpkt"];
2314--2466[label="0.00398406;1pkt 1fpkt"];
2314--2560[label="0.00382409;2pkt 2fpkt"];
2314--2707[label="0.00191205;1pkt 1fpkt"];
2314--2725[label="0.00458716;1pkt 1fpkt"];
2314--3348[label="0.00191205;1pkt 1fpkt"];
2397--2552[label="1;43pkt 43fpkt"];
2397--4091[label="1;42pkt 42fpkt"];
2552--4091[label="1;42pkt 42fpkt"];
</description>
    <slice>
      <filter src_ip="213.88.82.139"/>
    </slice>
    <from sec="1102827601" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="149.66.192.4"/>
      <from sec="1102827948" usec="0"/>
      <to sec="1102828334" usec="0"/>
    </slice>
    <from sec="1102827948" usec="0"/>
    <to sec="1102828334" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_188{
style=filled;
color=gray75;
1815[label="149.66.89.25;s;146pkt 146fpkt", shape=diamond, color=yellow];
2555[label="21.125.102.5;d;105pkt 105fpkt", shape=diamond, color=yellow];
stat188[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.66.89.25:*, 21.125.102.5:80}[71.9178%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1558: (0.398406%)&lt;BR/&gt; 1539: (0.398406%)&lt;BR/&gt; 1537: (0.398406%)&lt;BR/&gt; 1535: (0.398406%)&gt;];
}
1815--2555[label="1;105pkt 105fpkt"];
1815--3459[label="0.0273973;4pkt 4fpkt"];
1815--3473[label="0.0479452;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="21.125.102.5" dst_port="80" src_ip="149.66.89.25"/>
    </slice>
    <from sec="1102827679" usec="0"/>
    <to sec="1102828420" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_189{
style=filled;
color=gray75;
2433[label="174.67.119.196;s;62pkt 62fpkt", shape=diamond, color=yellow];
2572[label="210.193.134.156;d;68pkt 68fpkt", shape=diamond, color=yellow];
stat189[shape=component, label=&lt;Rules:&lt;BR/&gt;{174.67.119.196:*, 210.193.134.156:80}[35.4167%]&lt;BR/&gt;{174.67.66.253:*, 210.193.134.156:80}[20.8333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 40150: (0.769231%)&lt;BR/&gt; 40149: (0.769231%)&lt;BR/&gt; 40147: (0.769231%)&lt;BR/&gt; 40146: (0.769231%)&gt;];
}
2433--2572[label="0.548387;34pkt 34fpkt"];
</description>
    <slice>
      <filter dst_ip="210.193.134.156" dst_port="80" src_ip="174.67.119.196"/>
      <filter dst_ip="210.193.134.156" dst_port="80" src_ip="174.67.66.253"/>
    </slice>
    <from sec="1102828064" usec="0"/>
    <to sec="1102828297" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_190{
style=filled;
color=gray75;
2588[label="147.178.5.231;s;1pkt 1fpkt", shape=diamond, color=yellow];
2589[label="65.2.21.137;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat190[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.178.5.231:80, 65.2.21.137:46013}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 46013: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
2588--2589[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="65.2.21.137" dst_port="46013" src_ip="147.178.5.231" src_port="80"/>
    </slice>
    <from sec="1102828185" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_191{
style=filled;
color=gray75;
2587[label="147.178.5.231;d;3pkt 3fpkt", shape=diamond, color=yellow];
2590[label="65.2.21.137;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat191[shape=component, label=&lt;Rules:&lt;BR/&gt;{65.40.130.125:58052, 147.178.5.231:80}[33.3333%]&lt;BR/&gt;{65.40.130.130:53568, 147.178.5.231:80}[33.3333%]&lt;BR/&gt;{65.2.21.137:46013, 147.178.5.231:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 46013: (25%)&lt;BR/&gt; 58052: (12.5%)&lt;BR/&gt; 53568: (12.5%)&gt;];
}
2587--2590[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="147.178.5.231" dst_port="80" src_ip="65.2.21.137" src_port="46013"/>
      <filter dst_ip="147.178.5.231" dst_port="80" src_ip="65.40.130.130" src_port="53568"/>
      <filter dst_ip="147.178.5.231" dst_port="80" src_ip="65.40.130.125" src_port="58052"/>
    </slice>
    <from sec="1102828185" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_193{
style=filled;
color=gray75;
2607[label="212.129.51.148;d;1pkt 1fpkt", shape=diamond, color=yellow];
2608[label="213.88.69.85;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat193[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.88.69.85:0, 212.129.51.148:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2607--2608[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="212.129.51.148" src_ip="213.88.69.85"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828337" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_195{
style=filled;
color=gray75;
1411[label="147.69.223.79;s;628pkt 628fpkt", shape=diamond, color=yellow];
2344[label="195.218.33.5;d;85pkt 85fpkt", shape=diamond, color=yellow];
2638[label="195.218.33.6;d;61pkt 61fpkt", shape=diamond, color=yellow];
2647[label="195.218.33.7;d;64pkt 64fpkt", shape=diamond, color=yellow];
2918[label="147.69.223.79;s;505pkt 505fpkt", shape=hexagon, color=black];
stat195[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.69.223.79:25, *:*}[47.1338%]&lt;BR/&gt;{147.69.223.79:53, *:*}[31.6879%]&lt;BR/&gt;{147.69.223.79:*, *:53}[23.0892%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (27.662%)&lt;BR/&gt; 53: (23.1571%)&lt;BR/&gt; 3516: (8.22785%)&lt;BR/&gt; 0: (1.19136%)&lt;BR/&gt; 9253: (0.521221%)&gt;];
}
1411--2150[label="0.00159236;1pkt 1fpkt"];
1411--2344[label="1;85pkt 85fpkt"];
1411--2638[label="1;61pkt 61fpkt"];
1411--2647[label="1;64pkt 64fpkt"];
1411--2918[label="1;505pkt 505fpkt"];
1411--3448[label="0.0254777;16pkt 16fpkt"];
1411--3455[label="0.022293;14pkt 14fpkt"];
1411--3458[label="0.0238854;15pkt 15fpkt"];
1411--3469[label="0.0254777;16pkt 16fpkt"];
1411--3472[label="0.0334395;21pkt 21fpkt"];
2344--2918[label="0.8;68pkt 68fpkt"];
2638--2918[label="0.803279;49pkt 49fpkt"];
2647--2918[label="0.765625;49pkt 49fpkt"];
2918--3448[label="0.0316832;16pkt 16fpkt"];
2918--3455[label="0.0277228;14pkt 14fpkt"];
2918--3458[label="0.029703;15pkt 15fpkt"];
2918--3469[label="0.0316832;16pkt 16fpkt"];
2918--3472[label="0.0415842;21pkt 21fpkt"];
</description>
    <slice>
      <filter src_ip="147.69.223.79" src_port="25"/>
      <filter src_ip="147.69.223.79" src_port="53"/>
      <filter dst_port="53" src_ip="147.69.223.79"/>
    </slice>
    <from sec="1102827601" usec="0"/>
    <to sec="1102828427" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_196{
style=filled;
color=gray75;
2096[label="149.66.128.68;s;59pkt 59fpkt", shape=diamond, color=yellow];
2416[label="200.249.146.171;d;5pkt 5fpkt", shape=diamond, color=yellow];
2577[label="200.245.67.17;d;7pkt 7fpkt", shape=diamond, color=yellow];
stat196[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.66.128.68:80, *:*}[98.3051%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.2958%)&lt;BR/&gt; 1855: (1.40845%)&lt;BR/&gt; 1850: (1.40845%)&lt;BR/&gt; 1849: (1.40845%)&lt;BR/&gt; 1830: (1.40845%)&gt;];
}
2096--2346[label="0.0169492;1pkt 1fpkt"];
2096--2416[label="1;5pkt 5fpkt"];
2096--2577[label="1;7pkt 7fpkt"];
2096--2694[label="0.142857;1pkt 1fpkt"];
2096--3375[label="0.0169492;1pkt 1fpkt"];
2096--3456[label="0.0169492;1pkt 1fpkt"];
2096--3470[label="0.0338983;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_ip="149.66.128.68" src_port="80"/>
    </slice>
    <from sec="1102827604" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="194.234.83.10"/>
      <from sec="1102828341" usec="0"/>
      <to sec="1102828428" usec="0"/>
    </slice>
    <from sec="1102828341" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_199{
style=filled;
color=gray75;
1710[label="174.67.52.34;s;4pkt 4fpkt", shape=diamond, color=yellow];
2688[label="67.193.30.192;d;21pkt 21fpkt", shape=diamond, color=yellow];
3341[label="67.193.30.192;d;21pkt 21fpkt", shape=hexagon, color=black];
3347[label="174.67.52.34;s;4pkt 4fpkt", shape=hexagon, color=black];
stat199[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.66.189.149:*, 67.193.30.192:80}[23.8095%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3846: (6%)&lt;BR/&gt; 3845: (4%)&lt;BR/&gt; 3844: (4%)&lt;BR/&gt; 3843: (4%)&gt;];
}
1710--2688[label="1;4pkt 4fpkt"];
1710--3341[label="1;4pkt 4fpkt"];
1710--3347[label="1;4pkt 4fpkt"];
2688--3341[label="1;21pkt 21fpkt"];
2688--3347[label="1;4pkt 4fpkt"];
3341--3347[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="67.193.30.192" dst_port="80" src_ip="149.66.189.149"/>
    </slice>
    <from sec="1102828181" usec="0"/>
    <to sec="1102828297" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_201{
style=filled;
color=gray75;
2692[label="147.178.224.202;s;7pkt 7fpkt", shape=diamond, color=yellow];
2693[label="66.205.4.169;d;5pkt 5fpkt", shape=diamond, color=yellow];
stat201[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.178.224.202:80, 66.205.4.169:*}[71.4286%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 46596: (8.33333%)&lt;BR/&gt; 43652: (8.33333%)&lt;BR/&gt; 42944: (8.33333%)&lt;BR/&gt; 42096: (8.33333%)&gt;];
}
2692--2693[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="66.205.4.169" src_ip="147.178.224.202" src_port="80"/>
    </slice>
    <from sec="1102828194" usec="0"/>
    <to sec="1102828416" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_202{
style=filled;
color=gray75;
2595[label="149.67.65.138;s;152pkt 152fpkt", shape=diamond, color=yellow];
2699[label="204.92.168.40;d;86pkt 86fpkt", shape=diamond, color=yellow];
stat202[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.67.65.138:*, 204.92.168.40:80}[56.5789%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.0588%)&lt;BR/&gt; 53: (2.94118%)&lt;BR/&gt; 32790: (0.840336%)&lt;BR/&gt; 32777: (0.840336%)&lt;BR/&gt; 32776: (0.840336%)&gt;];
}
2595--2699[label="1;86pkt 86fpkt"];
</description>
    <slice>
      <filter dst_ip="204.92.168.40" dst_port="80" src_ip="149.67.65.138"/>
    </slice>
    <from sec="1102828219" usec="0"/>
    <to sec="1102828351" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="149.67.81.51"/>
      <from sec="1102827600" usec="0"/>
      <to sec="1102828424" usec="0"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828424" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="172.63.73.98"/>
      <from sec="1102827600" usec="0"/>
      <to sec="1102828346" usec="0"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828346" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="149.66.212.3"/>
      <from sec="1102828041" usec="0"/>
      <to sec="1102828427" usec="0"/>
    </slice>
    <from sec="1102828041" usec="0"/>
    <to sec="1102828427" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_206{
style=filled;
color=gray75;
2571[label="174.67.144.40;s;15pkt 15fpkt", shape=diamond, color=yellow];
2793[label="57.20.81.145;d;15pkt 15fpkt", shape=diamond, color=yellow];
stat206[shape=component, label=&lt;Rules:&lt;BR/&gt;{174.67.144.40:80, 57.20.81.145:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4061: (3.33333%)&lt;BR/&gt; 4060: (3.33333%)&lt;BR/&gt; 4058: (3.33333%)&lt;BR/&gt; 4057: (3.33333%)&gt;];
}
2571--2793[label="1;15pkt 15fpkt"];
</description>
    <slice>
      <filter dst_ip="57.20.81.145" src_ip="174.67.144.40" src_port="80"/>
    </slice>
    <from sec="1102828060" usec="0"/>
    <to sec="1102828309" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.61312,1.45087,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_207{
style=filled;
color=gray75;
2789[label="212.154.65.180;s;6pkt 6fpkt", shape=diamond, color=yellow];
2794[label="203.73.43.247;d;1pkt 1fpkt", shape=diamond, color=yellow];
3810[label="212.154.65.180;15pkt 15fpkt", shape=pentagon, color=darkviolet];
stat207[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.154.65.180:*, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9071: (6.81818%)&lt;BR/&gt; 7743: (6.81818%)&lt;BR/&gt; 1674: (6.81818%)&lt;BR/&gt; 28155: (4.54545%)&lt;BR/&gt; 21610: (4.54545%)&gt;];
}
2789--2794[label="1;1pkt 1fpkt"];
2789--3810[label="1;6pkt 6fpkt"];
2794--3810[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="212.154.65.180"/>
    </slice>
    <from sec="1102827604" usec="0"/>
    <to sec="1102828499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="209.93.235.239"/>
      <from sec="1102828077" usec="0"/>
      <to sec="1102828428" usec="0"/>
    </slice>
    <from sec="1102828077" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="149.66.10.42"/>
      <from sec="1102828126" usec="0"/>
      <to sec="1102828419" usec="0"/>
    </slice>
    <from sec="1102828126" usec="0"/>
    <to sec="1102828419" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_210{
style=filled;
color=gray75;
2691[label="147.178.224.202;d;6pkt 6fpkt", shape=diamond, color=yellow];
2798[label="66.205.4.169;s;5pkt 5fpkt", shape=diamond, color=yellow];
stat210[shape=component, label=&lt;Rules:&lt;BR/&gt;{66.205.4.169:*, 147.178.224.202:80}[83.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 46596: (9.09091%)&lt;BR/&gt; 43652: (9.09091%)&lt;BR/&gt; 42944: (9.09091%)&lt;BR/&gt; 42096: (9.09091%)&gt;];
}
2691--2798[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="147.178.224.202" dst_port="80" src_ip="66.205.4.169"/>
    </slice>
    <from sec="1102828194" usec="0"/>
    <to sec="1102828371" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_211{
style=filled;
color=gray75;
2697[label="205.145.51.68;d;194pkt 194fpkt", shape=diamond, color=yellow];
2800[label="147.178.9.145;s;254pkt 254fpkt", shape=diamond, color=yellow];
stat211[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.178.9.145:*, 205.145.51.68:80}[76.378%]&lt;BR/&gt;{147.178.9.145:*, 65.21.97.185:80}[23.622%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 5000: (0.223214%)&lt;BR/&gt; 4999: (0.223214%)&lt;BR/&gt; 4998: (0.223214%)&lt;BR/&gt; 4997: (0.223214%)&gt;];
}
2697--2800[label="1;194pkt 194fpkt"];
</description>
    <slice>
      <filter dst_ip="205.145.51.68" dst_port="80" src_ip="147.178.9.145"/>
      <filter dst_ip="65.21.97.185" dst_port="80" src_ip="147.178.9.145"/>
    </slice>
    <from sec="1102828213" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="174.67.98.54"/>
      <from sec="1102828249" usec="0"/>
      <to sec="1102828428" usec="0"/>
    </slice>
    <from sec="1102828249" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_213{
style=filled;
color=gray75;
2788[label="149.67.95.168;s;24pkt 24fpkt", shape=diamond, color=yellow];
2807[label="65.184.233.180;d;2pkt 2fpkt", shape=diamond, color=yellow];
2824[label="205.20.177.156;d;2pkt 2fpkt", shape=diamond, color=yellow];
3385[label="149.67.95.168;s;24pkt 24fpkt", shape=hexagon, color=black];
stat213[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.67.95.168:*, *:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1969: (2.88462%)&lt;BR/&gt; 1940: (2.88462%)&lt;BR/&gt; 1533: (2.88462%)&lt;BR/&gt; 1517: (2.88462%)&gt;];
}
2788--2807[label="1;2pkt 2fpkt"];
2788--2824[label="1;2pkt 2fpkt"];
2788--3385[label="1;24pkt 24fpkt"];
2788--3473[label="0.125;3pkt 3fpkt"];
2807--3385[label="1;2pkt 2fpkt"];
2824--3385[label="1;2pkt 2fpkt"];
3385--3473[label="0.125;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="149.67.95.168"/>
    </slice>
    <from sec="1102827900" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="149.67.53.26"/>
      <from sec="1102828256" usec="0"/>
      <to sec="1102828397" usec="0"/>
    </slice>
    <from sec="1102828256" usec="0"/>
    <to sec="1102828397" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="147.178.192.41"/>
      <from sec="1102828315" usec="0"/>
      <to sec="1102828349" usec="0"/>
    </slice>
    <from sec="1102828315" usec="0"/>
    <to sec="1102828349" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_216{
style=filled;
color=gray75;
2806[label="174.67.98.54;s;6pkt 6fpkt", shape=diamond, color=yellow];
2815[label="195.80.33.133;d;2pkt 2fpkt", shape=diamond, color=yellow];
stat216[shape=component, label=&lt;Rules:&lt;BR/&gt;{174.67.98.54:*, 195.80.33.133:80}[33.3333%]&lt;BR/&gt;{174.67.98.54:*, 210.193.129.149:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2040: (12.5%)&lt;BR/&gt; 2039: (12.5%)&lt;BR/&gt; 2049: (6.25%)&lt;BR/&gt; 2048: (6.25%)&gt;];
}
2806--2815[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="210.193.129.149" dst_port="80" src_ip="174.67.98.54"/>
      <filter dst_ip="195.80.33.133" dst_port="80" src_ip="174.67.98.54"/>
    </slice>
    <from sec="1102828249" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_217{
style=filled;
color=gray75;
2763[label="147.178.4.88;s;88pkt 88fpkt", shape=diamond, color=yellow];
2818[label="1.154.2.151;d;43pkt 43fpkt", shape=diamond, color=yellow];
stat217[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.178.4.88:*, 1.154.2.151:80}[39.3617%]&lt;BR/&gt;{147.178.4.88:*, 1.107.19.124:80}[34.0426%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.4733%)&lt;BR/&gt; 5554: (1.52672%)&lt;BR/&gt; 49591: (0.763359%)&lt;BR/&gt; 49590: (0.763359%)&lt;BR/&gt; 49589: (0.763359%)&gt;];
}
2763--2818[label="0.860465;37pkt 37fpkt"];
2763--2847[label="0.0113636;1pkt 1fpkt"];
2763--2983[label="0.0113636;1pkt 1fpkt"];
2763--3396[label="0.0113636;1pkt 1fpkt"];
2763--3408[label="0.0113636;1pkt 1fpkt"];
2763--3449[label="0.0568182;5pkt 5fpkt"];
2763--3459[label="0.0681818;6pkt 6fpkt"];
2763--3473[label="0.0113636;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="1.154.2.151" dst_port="80" src_ip="147.178.4.88"/>
      <filter dst_ip="1.107.19.124" dst_port="80" src_ip="147.178.4.88"/>
    </slice>
    <from sec="1102827604" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="66.127.43.97"/>
      <from sec="1102828395" usec="0"/>
      <to sec="1102828421" usec="0"/>
    </slice>
    <from sec="1102828395" usec="0"/>
    <to sec="1102828421" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_221{
style=filled;
color=gray75;
2696[label="147.178.9.145;d;158pkt 158fpkt", shape=diamond, color=yellow];
2698[label="205.145.51.68;s;193pkt 193fpkt", shape=diamond, color=yellow];
stat221[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.145.51.68:80, 147.178.9.145:*}[82.8326%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 5000: (0.2849%)&lt;BR/&gt; 4999: (0.2849%)&lt;BR/&gt; 4998: (0.2849%)&lt;BR/&gt; 4997: (0.2849%)&gt;];
}
2696--2698[label="0.746835;118pkt 118fpkt"];
</description>
    <slice>
      <filter dst_ip="147.178.9.145" src_ip="205.145.51.68" src_port="80"/>
    </slice>
    <from sec="1102828213" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,011,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_222{
style=filled;
color=gray75;
1231[label="212.52.94.43;s;753pkt 753fpkt", shape=diamond, color=yellow];
2868[label="212.52.94.43;s;206pkt 206fpkt", shape=hexagon, color=black];
stat222[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.52.94.43:7000, *:*}[35.4582%]&lt;BR/&gt;{212.52.94.43:7100, *:*}[33.5989%]&lt;BR/&gt;{212.52.94.43:7200, *:*}[30.9429%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7000: (19.0302%)&lt;BR/&gt; 7100: (16.6319%)&lt;BR/&gt; 7200: (14.3379%)&lt;BR/&gt; 58152: (0.364964%)&lt;BR/&gt; 61776: (0.260688%)&gt;];
}
1231--2868[label="1;206pkt 206fpkt"];
</description>
    <slice>
      <filter src_ip="212.52.94.43" src_port="7000"/>
      <filter src_ip="212.52.94.43" src_port="7100"/>
      <filter src_ip="212.52.94.43" src_port="7200"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828338" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,001,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_224{
style=filled;
color=gray75;
1297[label="203.197.86.245;d;700pkt 700fpkt", shape=diamond, color=yellow];
2876[label="203.197.86.245;d;668pkt 668fpkt", shape=hexagon, color=black];
stat224[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:5554, 203.197.86.245:*}[39.4286%]&lt;BR/&gt;{*:9898, 203.197.86.245:*}[30.2857%]&lt;BR/&gt;{*:1023, 203.197.86.245:*}[29.7143%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (19.8465%)&lt;BR/&gt; 9898: (14.9488%)&lt;BR/&gt; 1023: (14.9123%)&lt;BR/&gt; 0: (0.584795%)&lt;BR/&gt; 3469: (0.219298%)&gt;];
}
1297--2505[label="0.03125;1pkt 1fpkt"];
1297--2876[label="1;668pkt 668fpkt"];
</description>
    <slice>
      <filter dst_ip="203.197.86.245" src_port="5554"/>
      <filter dst_ip="203.197.86.245" src_port="9898"/>
      <filter dst_ip="203.197.86.245" src_port="1023"/>
    </slice>
    <from sec="1102827670" usec="0"/>
    <to sec="1102827721" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.495307,1.48493,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_226{
style=filled;
color=gray75;
1779[label="195.245.33.242;d;20pkt 20fpkt", shape=diamond, color=yellow];
1780[label="168.188.141.255;s;19pkt 19fpkt", shape=diamond, color=yellow];
stat226[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.188.141.255:*, 195.245.33.242:21}[50%]&lt;BR/&gt;{168.188.141.255:*, 195.245.33.242:20}[45%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (25.641%)&lt;BR/&gt; 20: (23.0769%)&lt;BR/&gt; 3480: (2.5641%)&lt;BR/&gt; 3479: (2.5641%)&lt;BR/&gt; 3478: (2.5641%)&gt;];
}
1779--1780[label="1;19pkt 19fpkt"];
1779--2908[label="0.05;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="195.245.33.242" dst_port="21" src_ip="168.188.141.255"/>
      <filter dst_ip="195.245.33.242" dst_port="20" src_ip="168.188.141.255"/>
    </slice>
    <from sec="1102827601" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,001,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_227{
style=filled;
color=gray75;
1485[label="203.193.167.141;d;338pkt 338fpkt", shape=diamond, color=yellow];
2931[label="203.193.167.141;d;338pkt 338fpkt", shape=hexagon, color=black];
stat227[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:5554, 203.193.167.141:*}[81.9527%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (40.9763%)&lt;BR/&gt; 1023: (4.73373%)&lt;BR/&gt; 9898: (3.69822%)&lt;BR/&gt; 0: (1.18343%)&lt;BR/&gt; 4591: (0.295858%)&gt;];
}
1485--2505[label="0.03125;1pkt 1fpkt"];
1485--2931[label="1;338pkt 338fpkt"];
1485--3465[label="0.00295858;1pkt 1fpkt"];
1485--3492[label="0.00295858;1pkt 1fpkt"];
2931--3465[label="0.00295858;1pkt 1fpkt"];
2931--3492[label="0.00295858;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="203.193.167.141" src_port="5554"/>
    </slice>
    <from sec="1102827713" usec="0"/>
    <to sec="1102827757" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,001,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_228{
style=filled;
color=gray75;
1529[label="203.242.170.194;d;705pkt 705fpkt", shape=diamond, color=yellow];
2985[label="203.242.170.194;d;705pkt 705fpkt", shape=hexagon, color=black];
stat228[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:5554, 203.242.170.194:*}[39.7163%]&lt;BR/&gt;{*:9898, 203.242.170.194:*}[30.0709%]&lt;BR/&gt;{*:1023, 203.242.170.194:*}[29.7872%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (19.8582%)&lt;BR/&gt; 9898: (15.0355%)&lt;BR/&gt; 1023: (14.8936%)&lt;BR/&gt; 0: (0.425532%)&lt;BR/&gt; 4393: (0.212766%)&gt;];
}
1529--2505[label="0.03125;1pkt 1fpkt"];
1529--2985[label="1;705pkt 705fpkt"];
</description>
    <slice>
      <filter dst_ip="203.242.170.194" src_port="5554"/>
      <filter dst_ip="203.242.170.194" src_port="9898"/>
      <filter dst_ip="203.242.170.194" src_port="1023"/>
    </slice>
    <from sec="1102827758" usec="0"/>
    <to sec="1102827858" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_229{
style=filled;
color=gray75;
1554[label="213.88.81.155;s;318pkt 318fpkt", shape=diamond, color=yellow];
3004[label="213.88.81.155;s;302pkt 302fpkt", shape=hexagon, color=black];
stat229[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.88.81.155:0, *:0}[99.6855%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.6774%)&lt;BR/&gt; 3389: (0.16129%)&lt;BR/&gt; 1855: (0.16129%)&gt;];
}
1554--2560[label="0.00628931;2pkt 2fpkt"];
1554--2707[label="0.00314465;1pkt 1fpkt"];
1554--3004[label="1;302pkt 302fpkt"];
1554--3348[label="0.00314465;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="213.88.81.155"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_230{
style=filled;
color=gray75;
1792[label="149.66.2.206;s;61pkt 61fpkt", shape=diamond, color=yellow];
3019[label="149.66.2.206;s;23pkt 23fpkt", shape=hexagon, color=black];
stat230[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.66.2.206:25, *:*}[75.4098%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (36.9048%)&lt;BR/&gt; 53: (7.7381%)&lt;BR/&gt; 80: (7.14286%)&lt;BR/&gt; 65031: (1.19048%)&lt;BR/&gt; 57756: (1.19048%)&gt;];
}
1792--3019[label="1;23pkt 23fpkt"];
</description>
    <slice>
      <filter src_ip="149.66.2.206" src_port="25"/>
    </slice>
    <from sec="1102827601" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.738218,1.4124,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_232{
style=filled;
color=gray75;
1153[label="69.4.226.16;s;1pkt 1fpkt", shape=diamond, color=yellow];
1318[label="134.203.130.31;d;147pkt 147fpkt", shape=diamond, color=yellow];
1319[label="207.178.41.39;s;5pkt 5fpkt", shape=diamond, color=yellow];
1397[label="142.93.164.86;s;1pkt 1fpkt", shape=diamond, color=yellow];
1549[label="64.167.28.139;s;1pkt 1fpkt", shape=diamond, color=yellow];
2062[label="85.201.105.100;s;3pkt 3fpkt", shape=diamond, color=yellow];
2069[label="87.93.102.53;s;7pkt 7fpkt", shape=diamond, color=yellow];
2309[label="214.140.216.30;s;2pkt 2fpkt", shape=diamond, color=yellow];
2333[label="69.120.163.233;s;3pkt 3fpkt", shape=diamond, color=yellow];
2616[label="215.218.29.53;s;2pkt 2fpkt", shape=diamond, color=yellow];
2750[label="67.66.107.20;s;4pkt 4fpkt", shape=diamond, color=yellow];
2758[label="214.173.94.103;s;3pkt 3fpkt", shape=diamond, color=yellow];
2955[label="64.167.28.139;s;1pkt 1fpkt", shape=hexagon, color=black];
3012[label="142.93.164.86;s;1pkt 1fpkt", shape=hexagon, color=black];
3085[label="69.4.226.16;s;1pkt 1fpkt", shape=hexagon, color=black];
3188[label="207.178.41.39;s;5pkt 5fpkt", shape=hexagon, color=black];
3367[label="67.66.107.20;s;4pkt 4fpkt", shape=hexagon, color=black];
3520[label="69.4.226.16;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat232[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:6881, 134.203.130.31:*}[21.4765%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6881: (13.0208%)&lt;BR/&gt; 6884: (7.29167%)&lt;BR/&gt; 6883: (7.03125%)&lt;BR/&gt; 6882: (5.20833%)&lt;BR/&gt; 21882: (2.86458%)&gt;];
}
1153--1318[label="1;1pkt 1fpkt"];
1153--3085[label="1;1pkt 1fpkt"];
1153--3520[label="1;1pkt 1fpkt"];
1318--1319[label="1;5pkt 5fpkt"];
1318--1397[label="1;1pkt 1fpkt"];
1318--1549[label="1;1pkt 1fpkt"];
1318--2062[label="1;3pkt 3fpkt"];
1318--2069[label="1;7pkt 7fpkt"];
1318--2309[label="1;2pkt 2fpkt"];
1318--2333[label="1;3pkt 3fpkt"];
1318--2616[label="1;2pkt 2fpkt"];
1318--2750[label="0.75;3pkt 3fpkt"];
1318--2758[label="0.666667;2pkt 2fpkt"];
1318--2955[label="1;1pkt 1fpkt"];
1318--3012[label="1;1pkt 1fpkt"];
1318--3085[label="1;1pkt 1fpkt"];
1318--3188[label="1;5pkt 5fpkt"];
1318--3367[label="0.75;3pkt 3fpkt"];
1318--3465[label="0.00680272;1pkt 1fpkt"];
1318--3492[label="0.00680272;1pkt 1fpkt"];
1318--3520[label="1;1pkt 1fpkt"];
1318--3538[label="0.00680272;1pkt 1fpkt"];
1319--3188[label="1;5pkt 5fpkt"];
1397--3012[label="1;1pkt 1fpkt"];
1549--2955[label="1;1pkt 1fpkt"];
2750--3367[label="1;4pkt 4fpkt"];
3085--3520[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="134.203.130.31" src_port="6881"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_233{
style=filled;
color=gray75;
1094[label="168.188.185.140;d;168pkt 168fpkt", shape=diamond, color=yellow];
1095[label="195.124.217.208;s;10pkt 10fpkt", shape=diamond, color=yellow];
1169[label="149.66.128.118;d;341pkt 341fpkt", shape=diamond, color=yellow];
1215[label="168.188.161.208;d;157pkt 157fpkt", shape=diamond, color=yellow];
1565[label="66.128.221.242;s;12pkt 12fpkt", shape=diamond, color=yellow];
1590[label="197.109.162.80;s;57pkt 57fpkt", shape=diamond, color=yellow];
1746[label="197.109.162.83;s;50pkt 50fpkt", shape=diamond, color=yellow];
2315[label="168.188.161.216;d;155pkt 155fpkt", shape=diamond, color=yellow];
2600[label="168.188.180.80;d;61pkt 61fpkt", shape=diamond, color=yellow];
2643[label="134.203.4.167;d;89pkt 89fpkt", shape=diamond, color=yellow];
3094[label="66.128.221.242;s;8pkt 8fpkt", shape=hexagon, color=black];
3105[label="197.109.162.80;s;57pkt 57fpkt", shape=hexagon, color=black];
3242[label="195.124.217.208;s;10pkt 10fpkt", shape=hexagon, color=black];
stat233[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:25, *:*}[71.9713%]&lt;BR/&gt;{*:*, 149.66.128.118:25}[21.6632%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (48.0851%)&lt;BR/&gt; 0: (1.70213%)&lt;BR/&gt; 113: (1.02128%)&lt;BR/&gt; 4384: (0.255319%)&lt;BR/&gt; 4490: (0.170213%)&gt;];
}
1094--1095[label="1;10pkt 10fpkt"];
1094--1565[label="0.166667;2pkt 2fpkt"];
1094--3094[label="0.25;2pkt 2fpkt"];
1094--3242[label="1;10pkt 10fpkt"];
1095--3242[label="1;10pkt 10fpkt"];
1169--1394[label="0.00293255;1pkt 1fpkt"];
1169--1565[label="0.166667;2pkt 2fpkt"];
1169--3094[label="0.125;1pkt 1fpkt"];
1169--3457[label="0.0322581;11pkt 11fpkt"];
1169--3471[label="0.0381232;13pkt 13fpkt"];
1215--1565[label="0.0833333;1pkt 1fpkt"];
1215--1590[label="1;57pkt 57fpkt"];
1215--1746[label="1;50pkt 50fpkt"];
1215--3094[label="0.125;1pkt 1fpkt"];
1215--3105[label="1;57pkt 57fpkt"];
1215--3457[label="0.0127389;2pkt 2fpkt"];
1565--2315[label="0.0833333;1pkt 1fpkt"];
1565--2600[label="0.166667;2pkt 2fpkt"];
1565--2643[label="0.0833333;1pkt 1fpkt"];
1565--3094[label="1;8pkt 8fpkt"];
1590--3105[label="1;57pkt 57fpkt"];
2315--3471[label="0.00645161;1pkt 1fpkt"];
2600--3457[label="0.0327869;2pkt 2fpkt"];
2600--3471[label="0.0163934;1pkt 1fpkt"];
2643--3094[label="0.125;1pkt 1fpkt"];
2643--3376[label="0.011236;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_port="25"/>
      <filter dst_ip="149.66.128.118" dst_port="25"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,010,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_234{
style=filled;
color=gray75;
1755[label="2.235.107.176;s;349pkt 349fpkt", shape=diamond, color=yellow];
3102[label="2.235.107.176;s;229pkt 229fpkt", shape=hexagon, color=black];
stat234[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.235.107.176:*, *:2745}[41.8338%]&lt;BR/&gt;{2.235.107.176:*, *:1025}[26.361%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2745: (20.6747%)&lt;BR/&gt; 1025: (12.9758%)&lt;BR/&gt; 3127: (7.35294%)&lt;BR/&gt; 6129: (5.96886%)&lt;BR/&gt; 80: (3.02768%)&gt;];
}
1755--3102[label="1;229pkt 229fpkt"];
1755--3473[label="0.00573066;2pkt 2fpkt"];
3102--3473[label="0.00873362;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_port="2745" src_ip="2.235.107.176"/>
      <filter dst_port="1025" src_ip="2.235.107.176"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828337" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_235{
style=filled;
color=gray75;
1797[label="218.41.31.150;s;273pkt 273fpkt", shape=diamond, color=yellow];
3115[label="218.41.31.150;s;167pkt 167fpkt", shape=hexagon, color=black];
stat235[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.41.31.150:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1797--2267[label="0.003663;1pkt 1fpkt"];
1797--2466[label="0.00398406;1pkt 1fpkt"];
1797--2725[label="0.00458716;1pkt 1fpkt"];
1797--3115[label="1;167pkt 167fpkt"];
</description>
    <slice>
      <filter src_ip="218.41.31.150"/>
    </slice>
    <from sec="1102827602" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_236{
style=filled;
color=gray75;
1811[label="212.154.65.181;s;34pkt 34fpkt", shape=diamond, color=yellow];
3124[label="212.154.65.181;s;21pkt 21fpkt", shape=hexagon, color=black];
stat236[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.154.65.181:21704, *:*}[47.0588%]&lt;BR/&gt;{212.154.65.181:*, 200.248.52.238:*}[29.4118%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21704: (23.6364%)&lt;BR/&gt; 1487: (8.18182%)&lt;BR/&gt; 7408: (3.63636%)&lt;BR/&gt; 25211: (2.72727%)&lt;BR/&gt; 29117: (1.81818%)&gt;];
}
1811--3124[label="1;21pkt 21fpkt"];
</description>
    <slice>
      <filter dst_ip="200.248.52.238" src_ip="212.154.65.181"/>
      <filter src_ip="212.154.65.181" src_port="21704"/>
    </slice>
    <from sec="1102827650" usec="0"/>
    <to sec="1102828337" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_238{
style=filled;
color=gray75;
1097[label="218.225.228.51;s;1017pkt 1017fpkt", shape=diamond, color=yellow];
1237[label="218.225.228.53;s;1040pkt 1040fpkt", shape=diamond, color=yellow];
2506[label="195.101.78.249;d;790pkt 790fpkt", shape=diamond, color=yellow];
3010[label="218.225.228.53;s;1040pkt 1040fpkt", shape=hexagon, color=black];
3187[label="218.225.228.51;s;906pkt 906fpkt", shape=hexagon, color=black];
stat238[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.225.228.51:*, *:*}[49.4169%]&lt;BR/&gt;{*:6667, *:*}[31.7298%]&lt;BR/&gt;{218.225.228.53:*, 195.101.78.249:*}[28.7658%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (15.387%)&lt;BR/&gt; 8080: (9.41999%)&lt;BR/&gt; 113: (9.26351%)&lt;BR/&gt; 6660: (3.25475%)&lt;BR/&gt; 6668: (1.68996%)&gt;];
}
1097--2506[label="0.249367;197pkt 197fpkt"];
1097--3187[label="1;906pkt 906fpkt"];
1097--3449[label="0.00294985;3pkt 3fpkt"];
1097--3459[label="0.00196657;2pkt 2fpkt"];
1237--1799[label="0.142857;2pkt 2fpkt"];
1237--2506[label="0.749367;592pkt 592fpkt"];
1237--3010[label="1;1040pkt 1040fpkt"];
1237--3473[label="0.00192308;2pkt 2fpkt"];
2506--3010[label="0.749367;592pkt 592fpkt"];
2506--3187[label="0.16962;134pkt 134fpkt"];
2506--3448[label="0.00126582;1pkt 1fpkt"];
2506--3458[label="0.00126582;1pkt 1fpkt"];
2506--3472[label="0.00126582;1pkt 1fpkt"];
3010--3473[label="0.00192308;2pkt 2fpkt"];
3187--3449[label="0.00331126;3pkt 3fpkt"];
3187--3459[label="0.00220751;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_ip="218.225.228.51"/>
      <filter src_port="6667"/>
      <filter dst_ip="195.101.78.249" src_ip="218.225.228.53"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,011,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_239{
style=filled;
color=gray75;
2060[label="202.161.177.49;s;9pkt 9fpkt", shape=diamond, color=yellow];
3196[label="202.161.177.49;s;9pkt 9fpkt", shape=hexagon, color=black];
stat239[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.161.177.49:8022, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8022: (50%)&lt;BR/&gt; 29699: (5.55556%)&lt;BR/&gt; 24776: (5.55556%)&lt;BR/&gt; 19904: (5.55556%)&lt;BR/&gt; 16422: (5.55556%)&gt;];
}
2060--3196[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter src_ip="202.161.177.49" src_port="8022"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828427" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_240{
style=filled;
color=gray75;
1311[label="212.146.17.237;d;98pkt 98fpkt", shape=diamond, color=yellow];
1785[label="85.136.0.51;s;2pkt 2fpkt", shape=diamond, color=yellow];
2281[label="221.85.106.170;s;1pkt 1fpkt", shape=diamond, color=yellow];
2284[label="195.113.222.65;s;1pkt 1fpkt", shape=diamond, color=yellow];
2287[label="207.86.61.74;s;1pkt 1fpkt", shape=diamond, color=yellow];
2301[label="0.44.100.55;s;2pkt 2fpkt", shape=diamond, color=yellow];
2307[label="66.233.52.128;s;13pkt 13fpkt", shape=diamond, color=yellow];
2308[label="207.86.143.136;s;1pkt 1fpkt", shape=diamond, color=yellow];
2313[label="87.44.5.227;s;1pkt 1fpkt", shape=diamond, color=yellow];
2449[label="64.182.85.187;s;1pkt 1fpkt", shape=diamond, color=yellow];
2614[label="87.0.189.202;s;1pkt 1fpkt", shape=diamond, color=yellow];
2721[label="68.36.221.96;s;1pkt 1fpkt", shape=diamond, color=yellow];
3201[label="87.44.5.227;s;1pkt 1fpkt", shape=hexagon, color=black];
3259[label="207.86.61.74;s;1pkt 1fpkt", shape=hexagon, color=black];
3318[label="85.136.0.51;s;2pkt 2fpkt", shape=hexagon, color=black];
3363[label="221.85.106.170;s;1pkt 1fpkt", shape=hexagon, color=black];
stat240[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 212.146.17.237:21558}[58.1633%]&lt;BR/&gt;{*:6881, 212.146.17.237:*}[26.5306%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21558: (30.0781%)&lt;BR/&gt; 6881: (12.5%)&lt;BR/&gt; 6882: (1.5625%)&lt;BR/&gt; 8002: (1.17188%)&lt;BR/&gt; 5632: (1.17188%)&gt;];
}
1311--1785[label="1;2pkt 2fpkt"];
1311--2281[label="1;1pkt 1fpkt"];
1311--2284[label="1;1pkt 1fpkt"];
1311--2287[label="1;1pkt 1fpkt"];
1311--2301[label="1;2pkt 2fpkt"];
1311--2307[label="1;13pkt 13fpkt"];
1311--2308[label="1;1pkt 1fpkt"];
1311--2313[label="1;1pkt 1fpkt"];
1311--2449[label="1;1pkt 1fpkt"];
1311--2614[label="1;1pkt 1fpkt"];
1311--2721[label="1;1pkt 1fpkt"];
1311--3201[label="1;1pkt 1fpkt"];
1311--3259[label="1;1pkt 1fpkt"];
1311--3318[label="1;2pkt 2fpkt"];
1311--3363[label="1;1pkt 1fpkt"];
1785--3318[label="1;2pkt 2fpkt"];
2281--3363[label="1;1pkt 1fpkt"];
2287--3259[label="1;1pkt 1fpkt"];
2313--3201[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="212.146.17.237" src_port="6881"/>
      <filter dst_ip="212.146.17.237" dst_port="21558"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_241{
style=filled;
color=gray75;
2331[label="2.246.92.43;s;709pkt 709fpkt", shape=diamond, color=yellow];
3205[label="2.246.92.43;s;709pkt 709fpkt", shape=hexagon, color=black];
stat241[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.246.92.43:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2331--3205[label="1;709pkt 709fpkt"];
</description>
    <slice>
      <filter src_ip="2.246.92.43"/>
    </slice>
    <from sec="1102827603" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.816702,1.3257,999,1 1 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_242{
style=filled;
color=gray75;
3[label="194.234.83.10s;2pkt 2fpkt", shape=rectangle, color=red];
452[label="194.234.83.10s;2pkt 2fpkt", shape=ellipse, color=green];
1461[label="149.66.15.73;d;19pkt 19fpkt", shape=diamond, color=yellow];
1463[label="206.16.29.173;s;10pkt 10fpkt", shape=diamond, color=yellow];
2819[label="194.234.83.10;s;1pkt 1fpkt", shape=diamond, color=yellow];
3212[label="206.16.29.173;s;7pkt 7fpkt", shape=hexagon, color=black];
3283[label="149.66.15.73;d;19pkt 19fpkt", shape=hexagon, color=black];
stat242[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.16.29.173:*, 149.66.15.73:18317}[50%]&lt;BR/&gt;{194.27.18.177:*, 149.66.15.73:19101}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 18317: (30.8333%)&lt;BR/&gt; 19101: (15.8333%)&lt;BR/&gt; 1083: (4.16667%)&lt;BR/&gt; 35346: (3.33333%)&lt;BR/&gt; 35345: (3.33333%)&gt;];
}
3--452[label="1;2pkt 2fpkt"];
3--1461[label="0.5;1pkt 1fpkt"];
3--2819[label="1;1pkt 1fpkt"];
3--3283[label="0.5;1pkt 1fpkt"];
452--1461[label="0.5;1pkt 1fpkt"];
452--2819[label="1;1pkt 1fpkt"];
452--3283[label="0.5;1pkt 1fpkt"];
1461--1463[label="1;10pkt 10fpkt"];
1461--2819[label="1;1pkt 1fpkt"];
1461--3212[label="1;7pkt 7fpkt"];
1461--3283[label="1;19pkt 19fpkt"];
1463--3212[label="1;7pkt 7fpkt"];
1463--3283[label="1;10pkt 10fpkt"];
2819--3283[label="1;1pkt 1fpkt"];
3212--3283[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="149.66.15.73" dst_port="18317" src_ip="206.16.29.173"/>
      <filter dst_ip="149.66.15.73" dst_port="19101" src_ip="194.27.18.177"/>
    </slice>
    <from sec="1102827646" usec="0"/>
    <to sec="1102828477" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_244{
style=filled;
color=gray75;
1096[label="212.146.17.237;s;671pkt 671fpkt", shape=diamond, color=yellow];
1756[label="221.85.106.170;d;1pkt 1fpkt", shape=diamond, color=yellow];
1760[label="67.212.27.43;d;1pkt 1fpkt", shape=diamond, color=yellow];
1786[label="66.233.52.128;d;3pkt 3fpkt", shape=diamond, color=yellow];
2057[label="207.86.61.74;d;1pkt 1fpkt", shape=diamond, color=yellow];
2071[label="70.209.191.171;d;1pkt 1fpkt", shape=diamond, color=yellow];
2074[label="85.136.0.51;d;2pkt 2fpkt", shape=diamond, color=yellow];
2262[label="64.182.85.187;d;1pkt 1fpkt", shape=diamond, color=yellow];
2282[label="80.4.81.118;d;1pkt 1fpkt", shape=diamond, color=yellow];
2283[label="195.113.222.65;d;1pkt 1fpkt", shape=diamond, color=yellow];
2289[label="85.8.38.93;d;1pkt 1fpkt", shape=diamond, color=yellow];
2293[label="215.154.244.232;d;1pkt 1fpkt", shape=diamond, color=yellow];
2296[label="69.43.179.154;d;1pkt 1fpkt", shape=diamond, color=yellow];
2300[label="0.44.100.55;d;1pkt 1fpkt", shape=diamond, color=yellow];
2303[label="87.0.189.202;d;1pkt 1fpkt", shape=diamond, color=yellow];
2304[label="84.185.54.14;d;1pkt 1fpkt", shape=diamond, color=yellow];
2312[label="87.44.5.227;d;1pkt 1fpkt", shape=diamond, color=yellow];
2318[label="69.67.14.110;d;1pkt 1fpkt", shape=diamond, color=yellow];
2319[label="135.16.119.97;d;1pkt 1fpkt", shape=diamond, color=yellow];
2332[label="217.136.70.45;d;3pkt 3fpkt", shape=diamond, color=yellow];
2368[label="68.145.165.197;d;2pkt 2fpkt", shape=diamond, color=yellow];
2447[label="65.167.15.145;d;1pkt 1fpkt", shape=diamond, color=yellow];
2451[label="68.36.221.96;d;1pkt 1fpkt", shape=diamond, color=yellow];
2487[label="206.82.146.216;d;1pkt 1fpkt", shape=diamond, color=yellow];
2515[label="32.188.85.10;d;1pkt 1fpkt", shape=diamond, color=yellow];
2521[label="68.10.93.227;d;1pkt 1fpkt", shape=diamond, color=yellow];
2604[label="86.68.198.126;d;1pkt 1fpkt", shape=diamond, color=yellow];
2617[label="65.216.7.157;d;1pkt 1fpkt", shape=diamond, color=yellow];
2621[label="84.87.33.235;d;1pkt 1fpkt", shape=diamond, color=yellow];
2622[label="207.86.143.136;d;1pkt 1fpkt", shape=diamond, color=yellow];
2640[label="68.90.22.29;d;1pkt 1fpkt", shape=diamond, color=yellow];
2671[label="32.187.153.156;d;5pkt 5fpkt", shape=diamond, color=yellow];
2729[label="84.87.140.82;d;5pkt 5fpkt", shape=diamond, color=yellow];
2730[label="152.4.85.54;d;1pkt 1fpkt", shape=diamond, color=yellow];
2764[label="84.10.110.218;d;2pkt 2fpkt", shape=diamond, color=yellow];
3243[label="65.167.15.145;d;1pkt 1fpkt", shape=hexagon, color=black];
3263[label="0.44.100.55;d;1pkt 1fpkt", shape=hexagon, color=black];
3273[label="32.188.85.10;d;1pkt 1fpkt", shape=hexagon, color=black];
3316[label="84.185.54.14;d;1pkt 1fpkt", shape=hexagon, color=black];
stat244[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.146.17.237:*, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21558: (7.80387%)&lt;BR/&gt; 6881: (5.73204%)&lt;BR/&gt; 2004: (3.45304%)&lt;BR/&gt; 8080: (1.24309%)&lt;BR/&gt; 6969: (1.17403%)&gt;];
}
1096--1756[label="1;1pkt 1fpkt"];
1096--1760[label="1;1pkt 1fpkt"];
1096--1786[label="1;3pkt 3fpkt"];
1096--2057[label="1;1pkt 1fpkt"];
1096--2071[label="1;1pkt 1fpkt"];
1096--2074[label="1;2pkt 2fpkt"];
1096--2262[label="1;1pkt 1fpkt"];
1096--2282[label="1;1pkt 1fpkt"];
1096--2283[label="1;1pkt 1fpkt"];
1096--2289[label="1;1pkt 1fpkt"];
1096--2293[label="1;1pkt 1fpkt"];
1096--2296[label="1;1pkt 1fpkt"];
1096--2300[label="1;1pkt 1fpkt"];
1096--2303[label="1;1pkt 1fpkt"];
1096--2304[label="1;1pkt 1fpkt"];
1096--2312[label="1;1pkt 1fpkt"];
1096--2318[label="1;1pkt 1fpkt"];
1096--2319[label="1;1pkt 1fpkt"];
1096--2332[label="1;3pkt 3fpkt"];
1096--2368[label="1;2pkt 2fpkt"];
1096--2447[label="1;1pkt 1fpkt"];
1096--2451[label="1;1pkt 1fpkt"];
1096--2487[label="1;1pkt 1fpkt"];
1096--2515[label="1;1pkt 1fpkt"];
1096--2521[label="1;1pkt 1fpkt"];
1096--2604[label="1;1pkt 1fpkt"];
1096--2617[label="1;1pkt 1fpkt"];
1096--2621[label="1;1pkt 1fpkt"];
1096--2622[label="1;1pkt 1fpkt"];
1096--2640[label="1;1pkt 1fpkt"];
1096--2671[label="1;5pkt 5fpkt"];
1096--2729[label="1;5pkt 5fpkt"];
1096--2730[label="1;1pkt 1fpkt"];
1096--2764[label="1;2pkt 2fpkt"];
1096--3243[label="1;1pkt 1fpkt"];
1096--3263[label="1;1pkt 1fpkt"];
1096--3273[label="1;1pkt 1fpkt"];
1096--3316[label="1;1pkt 1fpkt"];
2300--3263[label="1;1pkt 1fpkt"];
2304--3316[label="1;1pkt 1fpkt"];
2447--3243[label="1;1pkt 1fpkt"];
2515--3273[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="212.146.17.237"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_246{
style=filled;
color=gray75;
1628[label="213.88.82.200;s;283pkt 283fpkt", shape=diamond, color=yellow];
3324[label="213.88.82.200;s;283pkt 283fpkt", shape=hexagon, color=black];
stat246[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.88.82.200:0, *:0}[99.2933%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.2933%)&lt;BR/&gt; 3418: (0.176678%)&lt;BR/&gt; 3389: (0.176678%)&lt;BR/&gt; 2615: (0.176678%)&lt;BR/&gt; 1433: (0.176678%)&gt;];
}
1628--2560[label="0.00353357;1pkt 1fpkt"];
1628--2707[label="0.00353357;1pkt 1fpkt"];
1628--3324[label="1;283pkt 283fpkt"];
1628--3348[label="0.00353357;1pkt 1fpkt"];
3324--3348[label="0.00353357;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="213.88.82.200"/>
    </slice>
    <from sec="1102827604" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.715901,1.38456,503,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_247{
style=filled;
color=gray75;
45[label="149.66.57.181s;1pkt 1fpkt", shape=rectangle, color=red];
1226[label="149.66.57.181;s;504pkt 504fpkt", shape=diamond, color=yellow];
1227[label="202.33.63.39;d;1pkt 1fpkt", shape=diamond, color=yellow];
1661[label="192.88.118.128;d;311pkt 311fpkt", shape=diamond, color=yellow];
1777[label="219.170.64.166;d;1pkt 1fpkt", shape=diamond, color=yellow];
2642[label="212.68.39.167;d;18pkt 18fpkt", shape=diamond, color=yellow];
2735[label="219.170.64.131;d;46pkt 46fpkt", shape=diamond, color=yellow];
2865[label="202.33.63.39;d;1pkt 1fpkt", shape=hexagon, color=black];
3326[label="212.68.39.167;d;17pkt 17fpkt", shape=hexagon, color=black];
stat247[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.66.57.181:*, 192.88.118.128:80}[61.0672%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.4444%)&lt;BR/&gt; 4662: (1.44444%)&lt;BR/&gt; 15096: (0.222222%)&lt;BR/&gt; 9341: (0.222222%)&lt;BR/&gt; 3084: (0.222222%)&gt;];
}
45--1226[label="1;1pkt 1fpkt"];
45--1227[label="1;1pkt 1fpkt"];
45--2865[label="1;1pkt 1fpkt"];
1226--1227[label="1;1pkt 1fpkt"];
1226--1614[label="1;1pkt 1fpkt"];
1226--1638[label="0.00990099;1pkt 1fpkt"];
1226--1657[label="0.0454545;1pkt 1fpkt"];
1226--1661[label="0.993569;309pkt 309fpkt"];
1226--1777[label="1;1pkt 1fpkt"];
1226--1808[label="0.0588235;2pkt 2fpkt"];
1226--2522[label="0.0425532;2pkt 2fpkt"];
1226--2642[label="1;18pkt 18fpkt"];
1226--2735[label="1;46pkt 46fpkt"];
1226--2865[label="1;1pkt 1fpkt"];
1226--3276[label="0.0121951;1pkt 1fpkt"];
1226--3326[label="1;17pkt 17fpkt"];
1226--3449[label="0.0277778;14pkt 14fpkt"];
1226--3459[label="0.115079;58pkt 58fpkt"];
1226--3473[label="0.0277778;14pkt 14fpkt"];
1227--2865[label="1;1pkt 1fpkt"];
1661--2659[label="0.015625;1pkt 1fpkt"];
1661--2916[label="0.00346021;1pkt 1fpkt"];
1661--3459[label="0.00643087;2pkt 2fpkt"];
1661--3473[label="0.00321543;1pkt 1fpkt"];
2642--3326[label="1;17pkt 17fpkt"];
2642--3449[label="0.111111;2pkt 2fpkt"];
2642--3459[label="0.166667;3pkt 3fpkt"];
2642--3473[label="0.0555556;1pkt 1fpkt"];
2735--3449[label="0.130435;6pkt 6fpkt"];
2735--3459[label="0.108696;5pkt 5fpkt"];
2735--3473[label="0.0869565;4pkt 4fpkt"];
3326--3449[label="0.117647;2pkt 2fpkt"];
3326--3459[label="0.176471;3pkt 3fpkt"];
3326--3473[label="0.0588235;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="192.88.118.128" dst_port="80" src_ip="149.66.57.181"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_248{
style=filled;
color=gray75;
2132[label="149.67.147.170;s;105pkt 105fpkt", shape=diamond, color=yellow];
3336[label="149.67.147.170;s;101pkt 101fpkt", shape=hexagon, color=black];
stat248[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.67.147.170:*, 2.244.26.172:80}[33.3333%]&lt;BR/&gt;{149.67.147.170:*, 2.244.26.35:80}[21.9048%]&lt;BR/&gt;{149.67.147.170:*, 2.244.26.84:80}[20.9524%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 33764: (0.485437%)&lt;BR/&gt; 33762: (0.485437%)&lt;BR/&gt; 33761: (0.485437%)&lt;BR/&gt; 33759: (0.485437%)&gt;];
}
2132--3336[label="1;101pkt 101fpkt"];
2132--3473[label="0.047619;5pkt 5fpkt"];
3336--3473[label="0.049505;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="2.244.26.172" dst_port="80" src_ip="149.67.147.170"/>
      <filter dst_ip="2.244.26.35" dst_port="80" src_ip="149.67.147.170"/>
      <filter dst_ip="2.244.26.84" dst_port="80" src_ip="149.67.147.170"/>
    </slice>
    <from sec="1102827826" usec="0"/>
    <to sec="1102828400" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_249{
style=filled;
color=gray75;
2396[label="149.67.92.135;s;16pkt 16fpkt", shape=diamond, color=yellow];
3338[label="149.67.92.135;s;11pkt 11fpkt", shape=hexagon, color=black];
stat249[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.67.92.135:80, *:*}[50%]&lt;BR/&gt;{149.67.92.135:53, *:*}[31.25%]&lt;BR/&gt;{149.67.92.135:*, *:53}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (25.9259%)&lt;BR/&gt; 53: (25.9259%)&lt;BR/&gt; 32789: (7.40741%)&lt;BR/&gt; 59426: (3.7037%)&lt;BR/&gt; 56151: (3.7037%)&gt;];
}
2396--3338[label="1;11pkt 11fpkt"];
</description>
    <slice>
      <filter src_ip="149.67.92.135" src_port="80"/>
      <filter src_ip="149.67.92.135" src_port="53"/>
      <filter dst_port="53" src_ip="149.67.92.135"/>
    </slice>
    <from sec="1102827922" usec="0"/>
    <to sec="1102828418" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.715901,1.38456,502,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_251{
style=filled;
color=gray75;
6[label="212.146.35.20s;1pkt 1fpkt", shape=rectangle, color=red];
1321[label="200.22.227.108;d;1pkt 1fpkt", shape=diamond, color=yellow];
1322[label="212.146.35.20;s;4pkt 4fpkt", shape=diamond, color=yellow];
2953[label="212.146.35.20;s;1pkt 1fpkt", shape=hexagon, color=black];
3301[label="200.22.227.108;d;1pkt 1fpkt", shape=hexagon, color=black];
stat251[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.146.35.20:80, 65.2.17.3:52366}[25%]&lt;BR/&gt;{212.146.35.20:80, 65.2.16.93:45210}[25%]&lt;BR/&gt;{212.146.35.20:22, 200.22.227.108:1058}[25%]&lt;BR/&gt;{212.146.35.20:80, 195.100.164.240:3115}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1058: (31.25%)&lt;BR/&gt; 22: (31.25%)&lt;BR/&gt; 80: (18.75%)&lt;BR/&gt; 52366: (6.25%)&lt;BR/&gt; 45210: (6.25%)&gt;];
}
6--1321[label="1;1pkt 1fpkt"];
6--1322[label="1;1pkt 1fpkt"];
6--2953[label="1;1pkt 1fpkt"];
6--3301[label="1;1pkt 1fpkt"];
1321--1322[label="1;1pkt 1fpkt"];
1321--2953[label="1;1pkt 1fpkt"];
1321--3301[label="1;1pkt 1fpkt"];
1322--2346[label="0.25;1pkt 1fpkt"];
1322--2953[label="1;1pkt 1fpkt"];
1322--3301[label="1;1pkt 1fpkt"];
1322--3375[label="0.25;1pkt 1fpkt"];
2953--3301[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="195.100.164.240" dst_port="3115" src_ip="212.146.35.20" src_port="80"/>
      <filter dst_ip="200.22.227.108" dst_port="1058" src_ip="212.146.35.20" src_port="22"/>
      <filter dst_ip="65.2.16.93" dst_port="45210" src_ip="212.146.35.20" src_port="80"/>
      <filter dst_ip="65.2.17.3" dst_port="52366" src_ip="212.146.35.20" src_port="80"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828427" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.643722,1.44737,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_252{
style=filled;
color=gray75;
1636[label="206.37.82.63;s;510pkt 510fpkt", shape=diamond, color=yellow];
3376[label="206.37.82.63;s;510pkt 510fpkt", shape=hexagon, color=black];
stat252[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.37.82.63:0, *:0}[98.8235%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (98.8235%)&lt;BR/&gt; 445: (0.294118%)&lt;BR/&gt; 139: (0.294118%)&lt;BR/&gt; 1451: (0.0980392%)&lt;BR/&gt; 1450: (0.0980392%)&gt;];
}
1636--2643[label="0.011236;1pkt 1fpkt"];
1636--3076[label="0.00955414;3pkt 3fpkt"];
1636--3376[label="1;510pkt 510fpkt"];
1636--3423[label="0.0128755;3pkt 3fpkt"];
1636--3476[label="0.00196078;1pkt 1fpkt"];
1636--3477[label="0.00196078;1pkt 1fpkt"];
3376--3423[label="0.0128755;3pkt 3fpkt"];
3376--3476[label="0.00196078;1pkt 1fpkt"];
3376--3477[label="0.00196078;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="206.37.82.63"/>
    </slice>
    <from sec="1102827611" usec="0"/>
    <to sec="1102828415" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.738218,1.4124,001,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_253{
style=filled;
color=gray75;
1326[label="147.178.26.8;s;165pkt 165fpkt", shape=diamond, color=yellow];
1425[label="147.178.26.12;s;158pkt 158fpkt", shape=diamond, color=yellow];
1437[label="1.80.233.160;d;8pkt 8fpkt", shape=diamond, color=yellow];
1497[label="203.247.191.105;d;364pkt 364fpkt", shape=diamond, color=yellow];
1655[label="147.178.28.84;s;126pkt 126fpkt", shape=diamond, color=yellow];
1669[label="200.23.196.100;d;112pkt 112fpkt", shape=diamond, color=yellow];
1680[label="203.210.225.84;d;275pkt 275fpkt", shape=diamond, color=yellow];
1747[label="147.178.26.186;s;39pkt 39fpkt", shape=diamond, color=yellow];
1801[label="65.123.0.119;d;201pkt 201fpkt", shape=diamond, color=yellow];
1818[label="200.240.230.46;d;9pkt 9fpkt", shape=diamond, color=yellow];
1819[label="203.214.17.46;d;442pkt 442fpkt", shape=diamond, color=yellow];
2102[label="149.67.94.20;s;100pkt 100fpkt", shape=diamond, color=yellow];
2126[label="2.165.54.97;d;15pkt 15fpkt", shape=diamond, color=yellow];
2334[label="200.245.88.28;d;6pkt 6fpkt", shape=diamond, color=yellow];
2341[label="147.178.45.117;s;17pkt 17fpkt", shape=diamond, color=yellow];
2648[label="149.66.176.33;s;170pkt 170fpkt", shape=diamond, color=yellow];
3081[label="147.178.26.8;s;106pkt 106fpkt", shape=hexagon, color=black];
3383[label="2.165.54.97;d;15pkt 15fpkt", shape=hexagon, color=black];
3739[label="147.178.26.147;35pkt 35fpkt", shape=pentagon, color=darkviolet];
stat253[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 203.214.17.46:*}[22.866%]&lt;BR/&gt;{*:5554, *:*}[22.09%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2703: (9.79687%)&lt;BR/&gt; 5554: (9.35252%)&lt;BR/&gt; 25: (7.59628%)&lt;BR/&gt; 1023: (7.04613%)&lt;BR/&gt; 9898: (6.98265%)&gt;];
}
1326--1497[label="0.0181818;3pkt 3fpkt"];
1326--1680[label="0.0181818;3pkt 3fpkt"];
1326--1819[label="0.0121212;2pkt 2fpkt"];
1326--3081[label="1;106pkt 106fpkt"];
1326--3457[label="0.00606061;1pkt 1fpkt"];
1326--3471[label="0.00606061;1pkt 1fpkt"];
1425--1437[label="1;8pkt 8fpkt"];
1425--1497[label="0.0189873;3pkt 3fpkt"];
1425--1680[label="0.00632911;1pkt 1fpkt"];
1425--1819[label="0.0189873;3pkt 3fpkt"];
1425--2126[label="0.0666667;1pkt 1fpkt"];
1425--2334[label="0.666667;4pkt 4fpkt"];
1425--3383[label="0.0666667;1pkt 1fpkt"];
1425--3457[label="0.0316456;5pkt 5fpkt"];
1425--3471[label="0.0506329;8pkt 8fpkt"];
1497--1747[label="0.0769231;3pkt 3fpkt"];
1497--2327[label="0.00909091;3pkt 3fpkt"];
1497--2376[label="0.037037;3pkt 3fpkt"];
1497--3081[label="0.0283019;3pkt 3fpkt"];
1497--3086[label="0.00274725;1pkt 1fpkt"];
1497--3739[label="0.0857143;3pkt 3fpkt"];
1655--1669[label="1;112pkt 112fpkt"];
1655--2126[label="0.933333;14pkt 14fpkt"];
1655--3383[label="0.933333;14pkt 14fpkt"];
1680--1747[label="0.025641;1pkt 1fpkt"];
1680--2327[label="0.0109091;3pkt 3fpkt"];
1680--2376[label="0.0123457;1pkt 1fpkt"];
1680--3081[label="0.0283019;3pkt 3fpkt"];
1680--3086[label="0.00363636;1pkt 1fpkt"];
1680--3739[label="0.0285714;1pkt 1fpkt"];
1747--1818[label="1;9pkt 9fpkt"];
1747--1819[label="0.0769231;3pkt 3fpkt"];
1747--3456[label="0.025641;1pkt 1fpkt"];
1747--3470[label="0.025641;1pkt 1fpkt"];
1801--2102[label="0.35;35pkt 35fpkt"];
1801--2648[label="0.482353;82pkt 82fpkt"];
1801--3739[label="0.4;14pkt 14fpkt"];
1819--2327[label="0.00909091;3pkt 3fpkt"];
1819--2376[label="0.037037;3pkt 3fpkt"];
1819--3081[label="0.0188679;2pkt 2fpkt"];
1819--3086[label="0.00678733;3pkt 3fpkt"];
1819--3739[label="0.0857143;3pkt 3fpkt"];
2102--3448[label="0.08;8pkt 8fpkt"];
2102--3457[label="0.01;1pkt 1fpkt"];
2102--3458[label="0.08;8pkt 8fpkt"];
2102--3471[label="0.01;1pkt 1fpkt"];
2102--3472[label="0.08;8pkt 8fpkt"];
2126--3383[label="1;15pkt 15fpkt"];
2334--2341[label="0.166667;1pkt 1fpkt"];
3081--3457[label="0.00943396;1pkt 1fpkt"];
3081--3471[label="0.00943396;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="203.214.17.46"/>
      <filter src_port="5554"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.738218,1.4124,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_254{
style=filled;
color=gray75;
2097[label="149.66.89.216;s;137pkt 137fpkt", shape=diamond, color=yellow];
2573[label="68.137.208.107;d;47pkt 47fpkt", shape=diamond, color=yellow];
2576[label="68.138.58.107;d;10pkt 10fpkt", shape=diamond, color=yellow];
3387[label="68.137.208.107;d;47pkt 47fpkt", shape=hexagon, color=black];
3880[label="149.66.89.216;226pkt 226fpkt", shape=pentagon, color=darkviolet];
stat254[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.66.89.216:*, 68.241.49.196:80}[26.5487%]&lt;BR/&gt;{149.66.89.216:*, 68.137.208.107:80}[20.7965%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.3576%)&lt;BR/&gt; 33744: (0.428266%)&lt;BR/&gt; 33740: (0.428266%)&lt;BR/&gt; 33739: (0.428266%)&lt;BR/&gt; 33700: (0.428266%)&gt;];
}
2097--2113[label="0.0510949;7pkt 7fpkt"];
2097--2573[label="1;47pkt 47fpkt"];
2097--2576[label="1;10pkt 10fpkt"];
2097--3387[label="1;47pkt 47fpkt"];
2097--3449[label="0.131387;18pkt 18fpkt"];
2097--3459[label="0.00729927;1pkt 1fpkt"];
2097--3473[label="0.0656934;9pkt 9fpkt"];
2097--3880[label="1;137pkt 137fpkt"];
2573--3387[label="1;47pkt 47fpkt"];
2573--3880[label="1;47pkt 47fpkt"];
2576--3880[label="1;10pkt 10fpkt"];
3387--3880[label="1;47pkt 47fpkt"];
</description>
    <slice>
      <filter dst_ip="68.241.49.196" dst_port="80" src_ip="149.66.89.216"/>
      <filter dst_ip="68.137.208.107" dst_port="80" src_ip="149.66.89.216"/>
    </slice>
    <from sec="1102827604" usec="0"/>
    <to sec="1102828500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.675533,1.54287,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="174.67.84.0"/>
    </slice>
    <from sec="1102827744" usec="0"/>
    <to sec="1102828393" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.675533,1.54287,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="68.96.152.24"/>
    </slice>
    <from sec="1102827986" usec="0"/>
    <to sec="1102828016" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.675533,1.54287,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="219.98.89.25"/>
    </slice>
    <from sec="1102828033" usec="0"/>
    <to sec="1102828048" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.675533,1.54287,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.208.208.28"/>
    </slice>
    <from sec="1102828452" usec="0"/>
    <to sec="1102828500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.675533,1.54287,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="65.240.82.59"/>
    </slice>
    <from sec="1102828007" usec="0"/>
    <to sec="1102828010" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.675533,1.54287,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.43.130.64"/>
    </slice>
    <from sec="1102827888" usec="0"/>
    <to sec="1102827939" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.675533,1.54287,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="168.188.167.68"/>
    </slice>
    <from sec="1102827642" usec="0"/>
    <to sec="1102828482" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.675533,1.54287,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="147.69.223.79"/>
    </slice>
    <from sec="1102828500" usec="0"/>
    <to sec="1102828501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.675533,1.54287,001,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="206.239.138.91"/>
    </slice>
    <from sec="1102828180" usec="0"/>
    <to sec="1102828182" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.675533,1.54287,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.76.138.107"/>
    </slice>
    <from sec="1102828365" usec="0"/>
    <to sec="1102828434" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.744635,1.48411,001,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_276{
style=filled;
color=gray75;
274[label="2.238.108.125s;439pkt 439fpkt", shape=rectangle, color=red];
3704[label="2.238.108.125;439pkt 439fpkt", shape=pentagon, color=darkviolet];
stat276[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.238.108.125:*, *:5554}[50.3417%]&lt;BR/&gt;{2.238.108.125:*, *:9898}[49.6583%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (25.1708%)&lt;BR/&gt; 9898: (24.8292%)&lt;BR/&gt; 4426: (0.113895%)&lt;BR/&gt; 4425: (0.113895%)&lt;BR/&gt; 4424: (0.113895%)&gt;];
}
274--3704[label="1;439pkt 439fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="2.238.108.125"/>
      <filter dst_port="9898" src_ip="2.238.108.125"/>
    </slice>
    <from sec="1102828108" usec="0"/>
    <to sec="1102828111" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.675533,1.54287,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.56.8.135"/>
    </slice>
    <from sec="1102827919" usec="0"/>
    <to sec="1102828106" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.675533,1.54287,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="149.66.161.138"/>
    </slice>
    <from sec="1102827687" usec="0"/>
    <to sec="1102828427" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.675533,1.54287,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="66.198.91.152"/>
    </slice>
    <from sec="1102827603" usec="0"/>
    <to sec="1102828468" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.675533,1.54287,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.154.182.160"/>
    </slice>
    <from sec="1102827753" usec="0"/>
    <to sec="1102828499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.675533,1.54287,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="149.66.10.162"/>
    </slice>
    <from sec="1102827992" usec="0"/>
    <to sec="1102828068" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.61312,1.45087,001,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_283{
style=filled;
color=gray75;
1483[label="200.146.220.199;d;313pkt 313fpkt", shape=diamond, color=yellow];
1675[label="203.193.27.92;d;154pkt 154fpkt", shape=diamond, color=yellow];
3774[label="147.178.154.163;6pkt 6fpkt", shape=pentagon, color=darkviolet];
stat283[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:5554, 200.146.220.199:*}[23.6674%]&lt;BR/&gt;{*:5554, 203.193.27.92:*}[23.4542%]&lt;BR/&gt;{*:9898, 200.146.220.199:*}[20.2559%]&lt;BR/&gt;{*:1023, 200.146.220.199:*}[20.0426%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (23.5729%)&lt;BR/&gt; 1023: (11.8393%)&lt;BR/&gt; 9898: (11.7336%)&lt;BR/&gt; 0: (5.70825%)&lt;BR/&gt; 3455: (0.317125%)&gt;];
}
1483--2357[label="0.0309278;3pkt 3fpkt"];
1483--3774[label="0.5;3pkt 3fpkt"];
1675--2357[label="0.0309278;3pkt 3fpkt"];
1675--3774[label="0.166667;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="200.146.220.199" src_port="5554"/>
      <filter dst_ip="200.146.220.199" src_port="1023"/>
      <filter dst_ip="200.146.220.199" src_port="9898"/>
      <filter dst_ip="203.193.27.92" src_port="5554"/>
    </slice>
    <from sec="1102827712" usec="0"/>
    <to sec="1102827914" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.61312,1.45087,001,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_285{
style=filled;
color=gray75;
1538[label="202.56.44.169;s;431pkt 431fpkt", shape=diamond, color=yellow];
3789[label="202.56.44.169;431pkt 431fpkt", shape=pentagon, color=darkviolet];
stat285[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.56.44.169:*, *:9898}[53.1323%]&lt;BR/&gt;{202.56.44.169:*, *:5554}[46.8677%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (26.5661%)&lt;BR/&gt; 5554: (23.4339%)&lt;BR/&gt; 4912: (0.116009%)&lt;BR/&gt; 4897: (0.116009%)&lt;BR/&gt; 4895: (0.116009%)&gt;];
}
1538--3789[label="1;431pkt 431fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="202.56.44.169"/>
      <filter dst_port="5554" src_ip="202.56.44.169"/>
    </slice>
    <from sec="1102827778" usec="0"/>
    <to sec="1102827788" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.675533,1.54287,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="70.83.168.172"/>
    </slice>
    <from sec="1102827967" usec="0"/>
    <to sec="1102828019" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.885887,1.46683,001,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_287{
style=filled;
color=gray75;
348[label="3.184.130.181s;191pkt 191fpkt", shape=rectangle, color=red];
3812[label="3.184.130.181;191pkt 191fpkt", shape=pentagon, color=darkviolet];
4210[label="3.184.130.181;191pkt 191fpkt", shape=invtriangle, color=brown];
stat287[shape=component, label=&lt;Rules:&lt;BR/&gt;{3.184.130.181:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 4113: (0.26178%)&lt;BR/&gt; 4112: (0.26178%)&lt;BR/&gt; 4111: (0.26178%)&lt;BR/&gt; 4110: (0.26178%)&gt;];
}
348--3812[label="1;191pkt 191fpkt"];
348--4210[label="1;191pkt 191fpkt"];
3812--4210[label="1;191pkt 191fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="3.184.130.181"/>
    </slice>
    <from sec="1102827799" usec="0"/>
    <to sec="1102827801" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.675533,1.54287,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.67.16.184"/>
    </slice>
    <from sec="1102827971" usec="0"/>
    <to sec="1102828107" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.778609,1.43319,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_289{
style=filled;
color=gray75;
2065[label="168.188.131.191;s;17pkt 17fpkt", shape=diamond, color=yellow];
3831[label="168.188.131.191;16pkt 16fpkt", shape=pentagon, color=darkviolet];
4225[label="168.188.131.191;16pkt 16fpkt", shape=invtriangle, color=brown];
stat289[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.188.131.191:25, 221.177.64.236:*}[88.2353%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 36081: (3.06122%)&lt;BR/&gt; 36055: (3.06122%)&lt;BR/&gt; 36048: (3.06122%)&lt;BR/&gt; 35921: (3.06122%)&gt;];
}
2065--3831[label="1;16pkt 16fpkt"];
2065--4225[label="1;16pkt 16fpkt"];
3831--4225[label="1;16pkt 16fpkt"];
</description>
    <slice>
      <filter dst_ip="221.177.64.236" src_ip="168.188.131.191" src_port="25"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828074" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.61312,1.45087,502,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_291{
style=filled;
color=gray75;
2064[label="168.188.161.222;s;65pkt 65fpkt", shape=diamond, color=yellow];
2701[label="168.188.171.4;s;15pkt 15fpkt", shape=diamond, color=yellow];
2709[label="65.124.80.183;d;7pkt 7fpkt", shape=diamond, color=yellow];
2817[label="85.184.202.252;d;115pkt 115fpkt", shape=diamond, color=yellow];
3884[label="168.188.194.217;3pkt 3fpkt", shape=pentagon, color=darkviolet];
stat291[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:22, 85.184.202.252:*}[59.0674%]&lt;BR/&gt;{168.188.161.222:25, *:*}[33.1606%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 22: (29.0244%)&lt;BR/&gt; 25: (15.6098%)&lt;BR/&gt; 80: (5.12195%)&lt;BR/&gt; 60812: (0.487805%)&lt;BR/&gt; 60811: (0.487805%)&gt;];
}
2064--2817[label="0.0153846;1pkt 1fpkt"];
2701--2709[label="1;7pkt 7fpkt"];
2701--2817[label="0.0666667;1pkt 1fpkt"];
2817--2879[label="0.026087;3pkt 3fpkt"];
2817--3884[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter src_ip="168.188.161.222" src_port="25"/>
      <filter dst_ip="85.184.202.252" src_port="22"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.675533,1.54287,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="87.44.5.227"/>
    </slice>
    <from sec="1102827604" usec="0"/>
    <to sec="1102828489" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.675533,1.54287,001,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="147.178.111.230"/>
    </slice>
    <from sec="1102827748" usec="0"/>
    <to sec="1102827927" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.778609,1.43319,053,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_296{
style=filled;
color=gray75;
1630[label="134.203.113.224;d;130pkt 130fpkt", shape=diamond, color=yellow];
3937[label="203.10.182.248;5pkt 5fpkt", shape=pentagon, color=darkviolet];
4309[label="203.10.182.248;5pkt 5fpkt", shape=invtriangle, color=brown];
stat296[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.193.28.148:80, 134.203.113.224:*}[25.3846%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.4286%)&lt;BR/&gt; 8000: (1.42857%)&lt;BR/&gt; 443: (1.42857%)&lt;BR/&gt; 4001: (1.07143%)&lt;BR/&gt; 2781: (1.07143%)&gt;];
}
1630--3456[label="0.0153846;2pkt 2fpkt"];
1630--3470[label="0.0153846;2pkt 2fpkt"];
1630--3937[label="1;5pkt 5fpkt"];
1630--4309[label="1;5pkt 5fpkt"];
3937--4309[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="134.203.113.224" src_ip="2.193.28.148" src_port="80"/>
    </slice>
    <from sec="1102827605" usec="0"/>
    <to sec="1102828427" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.675533,1.54287,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.154.183.249"/>
    </slice>
    <from sec="1102827771" usec="0"/>
    <to sec="1102827789" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.61312,1.45087,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_298{
style=filled;
color=gray75;
2043[label="168.188.164.89;d;91pkt 91fpkt", shape=diamond, color=yellow];
2280[label="216.32.110.252;s;40pkt 40fpkt", shape=diamond, color=yellow];
2467[label="168.188.171.92;d;2pkt 2fpkt", shape=diamond, color=yellow];
3941[label="216.32.110.252;41pkt 41fpkt", shape=pentagon, color=darkviolet];
stat298[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.32.110.252:6667, 168.188.164.89:*}[28.7234%]&lt;BR/&gt;{*:*, 168.188.164.89:113}[27.6596%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (32.1839%)&lt;BR/&gt; 113: (14.9425%)&lt;BR/&gt; 6665: (0.862069%)&lt;BR/&gt; 4700: (0.862069%)&lt;BR/&gt; 4670: (0.862069%)&gt;];
}
2043--2280[label="0.975;39pkt 39fpkt"];
2043--3459[label="0.010989;1pkt 1fpkt"];
2043--3941[label="0.95122;39pkt 39fpkt"];
2280--2467[label="0.5;1pkt 1fpkt"];
2280--3941[label="1;40pkt 40fpkt"];
2467--3941[label="0.5;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="168.188.164.89" dst_port="113"/>
      <filter dst_ip="168.188.164.89" src_ip="216.32.110.252" src_port="6667"/>
    </slice>
    <from sec="1102827600" usec="0"/>
    <to sec="1102828500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.745703,1.55868,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="206.26.26.6"/>
    </slice>
    <from sec="1102828077" usec="0"/>
    <to sec="1102828106" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.996497,1.52249,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_301{
style=filled;
color=gray75;
3533[label="147.178.193.23;7pkt 7fpkt", shape=pentagon, color=darkviolet];
3980[label="147.178.193.23;7pkt 7fpkt", shape=invtriangle, color=brown];
4353[label="147.178.193.23;7pkt 7fpkt", shape=invhouse, color=bisque];
stat301[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.178.193.23:*, 212.129.43.34:80}[42.8571%]&lt;BR/&gt;{147.178.193.23:*, 212.129.43.44:80}[42.8571%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 33419: (7.14286%)&lt;BR/&gt; 33418: (7.14286%)&lt;BR/&gt; 33401: (7.14286%)&lt;BR/&gt; 33397: (7.14286%)&gt;];
}
3533--3980[label="1;7pkt 7fpkt"];
3533--4353[label="1;7pkt 7fpkt"];
3980--4353[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="212.129.43.44" dst_port="80" src_ip="147.178.193.23"/>
      <filter dst_ip="212.129.43.34" dst_port="80" src_ip="147.178.193.23"/>
    </slice>
    <from sec="1102827918" usec="0"/>
    <to sec="1102827987" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.745703,1.55868,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="68.96.152.24"/>
    </slice>
    <from sec="1102827986" usec="0"/>
    <to sec="1102828016" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.745703,1.55868,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="219.98.89.25"/>
    </slice>
    <from sec="1102828033" usec="0"/>
    <to sec="1102828048" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.82865,1.52626,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_304{
style=filled;
color=gray75;
3543[label="48.39.38.28;97pkt 97fpkt", shape=pentagon, color=darkviolet];
3989[label="48.39.38.28;98pkt 98fpkt", shape=invtriangle, color=brown];
stat304[shape=component, label=&lt;Rules:&lt;BR/&gt;{48.39.38.28:*, *:135}[61.2245%]&lt;BR/&gt;{48.39.38.28:*, *:445}[38.7755%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (30.5128%)&lt;BR/&gt; 445: (19.4872%)&lt;BR/&gt; 3978: (0.512821%)&lt;BR/&gt; 3977: (0.512821%)&lt;BR/&gt; 3976: (0.512821%)&gt;];
}
3543--3989[label="1;97pkt 97fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="48.39.38.28"/>
      <filter dst_port="445" src_ip="48.39.38.28"/>
    </slice>
    <from sec="1102827989" usec="0"/>
    <to sec="1102828002" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.996497,1.52249,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_305{
style=filled;
color=gray75;
3554[label="48.110.49.35;434pkt 434fpkt", shape=pentagon, color=darkviolet];
3998[label="48.110.49.35;434pkt 434fpkt", shape=invtriangle, color=brown];
4368[label="48.110.49.35;434pkt 434fpkt", shape=invhouse, color=bisque];
stat305[shape=component, label=&lt;Rules:&lt;BR/&gt;{48.110.49.35:*, *:135}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 4808: (0.115207%)&lt;BR/&gt; 4805: (0.115207%)&lt;BR/&gt; 4802: (0.115207%)&lt;BR/&gt; 4799: (0.115207%)&gt;];
}
3554--3998[label="1;434pkt 434fpkt"];
3554--4368[label="1;434pkt 434fpkt"];
3998--4368[label="1;434pkt 434fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="48.110.49.35"/>
    </slice>
    <from sec="1102827976" usec="0"/>
    <to sec="1102828043" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.996497,1.52249,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_306{
style=filled;
color=gray75;
3567[label="197.55.102.42;19pkt 19fpkt", shape=pentagon, color=darkviolet];
4008[label="197.55.102.42;20pkt 20fpkt", shape=invtriangle, color=brown];
4376[label="197.55.102.42;20pkt 20fpkt", shape=invhouse, color=bisque];
stat306[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.55.102.42:80, 174.67.67.119:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2961: (2.54237%)&lt;BR/&gt; 2960: (2.54237%)&lt;BR/&gt; 2959: (2.54237%)&lt;BR/&gt; 2958: (2.54237%)&gt;];
}
3567--4008[label="1;19pkt 19fpkt"];
3567--4376[label="1;19pkt 19fpkt"];
4008--4376[label="1;20pkt 20fpkt"];
</description>
    <slice>
      <filter dst_ip="174.67.67.119" src_ip="197.55.102.42" src_port="80"/>
    </slice>
    <from sec="1102828035" usec="0"/>
    <to sec="1102828049" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.996497,1.52249,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_307{
style=filled;
color=gray75;
3572[label="213.40.220.44;20pkt 20fpkt", shape=pentagon, color=darkviolet];
4013[label="213.40.220.44;20pkt 20fpkt", shape=invtriangle, color=brown];
4381[label="213.40.220.44;20pkt 20fpkt", shape=invhouse, color=bisque];
stat307[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.40.220.44:80, 134.203.251.98:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3464: (2.5%)&lt;BR/&gt; 3462: (2.5%)&lt;BR/&gt; 3461: (2.5%)&lt;BR/&gt; 3460: (2.5%)&gt;];
}
3572--4013[label="1;20pkt 20fpkt"];
3572--4381[label="1;20pkt 20fpkt"];
4013--4381[label="1;20pkt 20fpkt"];
</description>
    <slice>
      <filter dst_ip="134.203.251.98" src_ip="213.40.220.44" src_port="80"/>
    </slice>
    <from sec="1102827779" usec="0"/>
    <to sec="1102827786" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.996497,1.52249,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_309{
style=filled;
color=gray75;
3591[label="203.35.92.55;313pkt 313fpkt", shape=pentagon, color=darkviolet];
4027[label="203.35.92.55;312pkt 312fpkt", shape=invtriangle, color=brown];
4392[label="203.35.92.55;313pkt 313fpkt", shape=invhouse, color=bisque];
stat309[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.35.92.55:*, *:9898}[59.4249%]&lt;BR/&gt;{203.35.92.55:*, *:5554}[40.5751%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (29.7441%)&lt;BR/&gt; 5554: (20.2559%)&lt;BR/&gt; 3771: (0.159915%)&lt;BR/&gt; 3770: (0.159915%)&lt;BR/&gt; 3769: (0.159915%)&gt;];
}
3591--4027[label="1;312pkt 312fpkt"];
3591--4392[label="1;313pkt 313fpkt"];
4027--4392[label="1;312pkt 312fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="203.35.92.55"/>
      <filter dst_port="5554" src_ip="203.35.92.55"/>
    </slice>
    <from sec="1102828089" usec="0"/>
    <to sec="1102828092" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.745703,1.55868,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="65.240.82.59"/>
    </slice>
    <from sec="1102828007" usec="0"/>
    <to sec="1102828010" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.82865,1.52626,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_311{
style=filled;
color=gray75;
3598[label="66.205.11.61;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4034[label="66.205.11.61;1pkt 1fpkt", shape=invtriangle, color=brown];
stat311[shape=component, label=&lt;Rules:&lt;BR/&gt;{66.205.11.61:80, 149.66.210.135:3236}[50%]&lt;BR/&gt;{66.205.11.61:80, 149.66.210.135:3237}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3237: (33.3333%)&lt;BR/&gt; 3236: (16.6667%)&gt;];
}
3598--4034[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="149.66.210.135" dst_port="3237" src_ip="66.205.11.61" src_port="80"/>
      <filter dst_ip="149.66.210.135" dst_port="3236" src_ip="66.205.11.61" src_port="80"/>
    </slice>
    <from sec="1102828445" usec="0"/>
    <to sec="1102828470" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.745703,1.55868,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="203.43.130.64"/>
    </slice>
    <from sec="1102827888" usec="0"/>
    <to sec="1102827939" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.884302,1.46375,503,0 0 0 1 0 0 0 0 0 0 1 1 ">
    <description>subgraph cluster_315{
style=filled;
color=gray75;
1976[label="149.67.11.72;s;19pkt 19fpkt", shape=diamond, color=yellow];
4051[label="149.67.11.72;19pkt 19fpkt", shape=invtriangle, color=brown];
4416[label="149.67.11.72;20pkt 20fpkt", shape=invhouse, color=bisque];
stat315[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.67.11.72:*, 221.52.165.83:80}[95%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3000: (2.58621%)&lt;BR/&gt; 2999: (2.58621%)&lt;BR/&gt; 2998: (2.58621%)&lt;BR/&gt; 2997: (2.58621%)&gt;];
}
1976--4051[label="1;19pkt 19fpkt"];
1976--4416[label="1;19pkt 19fpkt"];
4051--4416[label="1;19pkt 19fpkt"];
</description>
    <slice>
      <filter dst_ip="221.52.165.83" dst_port="80" src_ip="149.67.11.72"/>
    </slice>
    <from sec="1102827935" usec="0"/>
    <to sec="1102827980" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.745703,1.55868,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="65.2.7.76"/>
    </slice>
    <from sec="1102828089" usec="0"/>
    <to sec="1102828092" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.996497,1.52249,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_317{
style=filled;
color=gray75;
3637[label="2.2.208.81;100pkt 100fpkt", shape=pentagon, color=darkviolet];
4063[label="2.2.208.81;100pkt 100fpkt", shape=invtriangle, color=brown];
4424[label="2.2.208.81;100pkt 100fpkt", shape=invhouse, color=bisque];
stat317[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.2.208.81:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3637--4063[label="1;100pkt 100fpkt"];
3637--4424[label="1;100pkt 100fpkt"];
4063--4424[label="1;100pkt 100fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="2.2.208.81" src_port="1025"/>
    </slice>
    <from sec="1102828030" usec="0"/>
    <to sec="1102828048" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.996497,1.52249,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_318{
style=filled;
color=gray75;
3648[label="68.23.49.86;178pkt 178fpkt", shape=pentagon, color=darkviolet];
4071[label="68.23.49.86;177pkt 177fpkt", shape=invtriangle, color=brown];
4430[label="68.23.49.86;178pkt 178fpkt", shape=invhouse, color=bisque];
stat318[shape=component, label=&lt;Rules:&lt;BR/&gt;{68.23.49.86:1038, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1038: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3648--4071[label="1;177pkt 177fpkt"];
3648--4430[label="1;178pkt 178fpkt"];
4071--4430[label="1;177pkt 177fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="68.23.49.86" src_port="1038"/>
    </slice>
    <from sec="1102827753" usec="0"/>
    <to sec="1102827780" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.745703,1.55868,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="205.56.8.135"/>
    </slice>
    <from sec="1102827919" usec="0"/>
    <to sec="1102828106" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.996497,1.52249,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_320{
style=filled;
color=gray75;
3720[label="149.66.205.136;6pkt 6fpkt", shape=pentagon, color=darkviolet];
4135[label="149.66.205.136;6pkt 6fpkt", shape=invtriangle, color=brown];
4494[label="149.66.205.136;6pkt 6fpkt", shape=invhouse, color=bisque];
stat320[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.66.205.136:*, 2.161.178.4:80}[33.3333%]&lt;BR/&gt;{149.66.205.136:*, 65.12.227.83:80}[33.3333%]&lt;BR/&gt;{149.66.205.136:*, 65.12.235.180:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3019: (8.33333%)&lt;BR/&gt; 3018: (8.33333%)&lt;BR/&gt; 3015: (8.33333%)&lt;BR/&gt; 3014: (8.33333%)&gt;];
}
3720--4135[label="1;6pkt 6fpkt"];
3720--4494[label="1;6pkt 6fpkt"];
4135--4494[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="65.12.235.180" dst_port="80" src_ip="149.66.205.136"/>
      <filter dst_ip="65.12.227.83" dst_port="80" src_ip="149.66.205.136"/>
      <filter dst_ip="2.161.178.4" dst_port="80" src_ip="149.66.205.136"/>
    </slice>
    <from sec="1102827973" usec="0"/>
    <to sec="1102827978" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.82865,1.52626,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_321{
style=filled;
color=gray75;
3725[label="212.18.25.139;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4139[label="212.18.25.139;1pkt 1fpkt", shape=invtriangle, color=brown];
stat321[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.18.25.139:29489, 213.88.85.75:25}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 29489: (50%)&lt;BR/&gt; 25: (50%)&gt;];
}
3725--4139[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="213.88.85.75" dst_port="25" src_ip="212.18.25.139" src_port="29489"/>
    </slice>
    <from sec="1102828009" usec="0"/>
    <to sec="1102828025" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.745703,1.55868,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="206.190.88.157"/>
    </slice>
    <from sec="1102828120" usec="0"/>
    <to sec="1102828468" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.996497,1.52249,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_326{
style=filled;
color=gray75;
3772[label="214.128.195.162;228pkt 228fpkt", shape=pentagon, color=darkviolet];
4178[label="214.128.195.162;228pkt 228fpkt", shape=invtriangle, color=brown];
4528[label="214.128.195.162;228pkt 228fpkt", shape=invhouse, color=bisque];
stat326[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.128.195.162:61945, *:137}[28.5088%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 61945: (14.2544%)&lt;BR/&gt; 61949: (9.64912%)&lt;BR/&gt; 61955: (7.45614%)&lt;BR/&gt; 63246: (5.70175%)&gt;];
}
3772--4178[label="1;228pkt 228fpkt"];
3772--4528[label="1;228pkt 228fpkt"];
4178--4528[label="1;228pkt 228fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="214.128.195.162" src_port="61945"/>
    </slice>
    <from sec="1102827951" usec="0"/>
    <to sec="1102827965" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.996497,1.52249,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_327{
style=filled;
color=gray75;
3779[label="206.236.137.165;255pkt 255fpkt", shape=pentagon, color=darkviolet];
4183[label="206.236.137.165;255pkt 255fpkt", shape=invtriangle, color=brown];
4533[label="206.236.137.165;255pkt 255fpkt", shape=invhouse, color=bisque];
stat327[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.236.137.165:1030, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1030: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3779--4183[label="1;255pkt 255fpkt"];
3779--4533[label="1;255pkt 255fpkt"];
4183--4533[label="1;255pkt 255fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="206.236.137.165" src_port="1030"/>
    </slice>
    <from sec="1102828434" usec="0"/>
    <to sec="1102828465" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.745703,1.55868,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="70.83.168.172"/>
    </slice>
    <from sec="1102827967" usec="0"/>
    <to sec="1102828019" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.82865,1.52626,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_329{
style=filled;
color=gray75;
3797[label="174.67.70.173;6pkt 6fpkt", shape=pentagon, color=darkviolet];
4198[label="174.67.70.173;6pkt 6fpkt", shape=invtriangle, color=brown];
stat329[shape=component, label=&lt;Rules:&lt;BR/&gt;{174.67.70.173:*, 43.76.195.161:443}[66.6667%]&lt;BR/&gt;{174.67.70.173:*, 43.76.195.144:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (33.3333%)&lt;BR/&gt; 80: (16.6667%)&lt;BR/&gt; 62614: (8.33333%)&lt;BR/&gt; 62613: (8.33333%)&lt;BR/&gt; 62608: (8.33333%)&gt;];
}
3797--4198[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="43.76.195.161" dst_port="443" src_ip="174.67.70.173"/>
      <filter dst_ip="43.76.195.144" dst_port="80" src_ip="174.67.70.173"/>
    </slice>
    <from sec="1102828025" usec="0"/>
    <to sec="1102828089" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.996497,1.52249,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_330{
style=filled;
color=gray75;
3813[label="203.245.17.182;330pkt 330fpkt", shape=pentagon, color=darkviolet];
4211[label="203.245.17.182;330pkt 330fpkt", shape=invtriangle, color=brown];
4557[label="203.245.17.182;330pkt 330fpkt", shape=invhouse, color=bisque];
stat330[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.245.17.182:*, *:5554}[33.6364%]&lt;BR/&gt;{203.245.17.182:*, *:9898}[33.6364%]&lt;BR/&gt;{203.245.17.182:*, *:1023}[32.7273%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (16.8182%)&lt;BR/&gt; 5554: (16.8182%)&lt;BR/&gt; 1023: (16.3636%)&lt;BR/&gt; 4999: (0.151515%)&lt;BR/&gt; 4986: (0.151515%)&gt;];
}
3813--4211[label="1;330pkt 330fpkt"];
3813--4557[label="1;330pkt 330fpkt"];
4211--4557[label="1;330pkt 330fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="203.245.17.182"/>
      <filter dst_port="5554" src_ip="203.245.17.182"/>
      <filter dst_port="1023" src_ip="203.245.17.182"/>
    </slice>
    <from sec="1102828038" usec="0"/>
    <to sec="1102828044" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.996497,1.52249,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_331{
style=filled;
color=gray75;
3847[label="2.142.6.199;232pkt 232fpkt", shape=pentagon, color=darkviolet];
4240[label="2.142.6.199;232pkt 232fpkt", shape=invtriangle, color=brown];
4583[label="2.142.6.199;232pkt 232fpkt", shape=invhouse, color=bisque];
stat331[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.142.6.199:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3847--4240[label="1;232pkt 232fpkt"];
3847--4583[label="1;232pkt 232fpkt"];
4240--4583[label="1;232pkt 232fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="2.142.6.199" src_port="1026"/>
    </slice>
    <from sec="1102827946" usec="0"/>
    <to sec="1102828003" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.996497,1.52249,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_332{
style=filled;
color=gray75;
3873[label="202.15.191.210;76pkt 76fpkt", shape=pentagon, color=darkviolet];
4258[label="202.15.191.210;76pkt 76fpkt", shape=invtriangle, color=brown];
4601[label="202.15.191.210;76pkt 76fpkt", shape=invhouse, color=bisque];
stat332[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.15.191.210:*, 147.178.85.32:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4942: (0.657895%)&lt;BR/&gt; 4826: (0.657895%)&lt;BR/&gt; 4817: (0.657895%)&lt;BR/&gt; 4809: (0.657895%)&gt;];
}
3873--4258[label="1;76pkt 76fpkt"];
3873--4601[label="1;76pkt 76fpkt"];
4258--4601[label="1;76pkt 76fpkt"];
</description>
    <slice>
      <filter dst_ip="147.178.85.32" dst_port="80" src_ip="202.15.191.210"/>
    </slice>
    <from sec="1102827997" usec="0"/>
    <to sec="1102828052" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.996497,1.52249,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_333{
style=filled;
color=gray75;
3875[label="200.158.68.211;145pkt 145fpkt", shape=pentagon, color=darkviolet];
4259[label="200.158.68.211;145pkt 145fpkt", shape=invtriangle, color=brown];
4602[label="200.158.68.211;145pkt 145fpkt", shape=invhouse, color=bisque];
stat333[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.158.68.211:64674, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 64674: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3875--4259[label="1;145pkt 145fpkt"];
3875--4602[label="1;145pkt 145fpkt"];
4259--4602[label="1;145pkt 145fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="200.158.68.211" src_port="64674"/>
    </slice>
    <from sec="1102827938" usec="0"/>
    <to sec="1102827964" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.996497,1.52249,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_334{
style=filled;
color=gray75;
3889[label="195.21.122.222;53pkt 53fpkt", shape=pentagon, color=darkviolet];
4271[label="195.21.122.222;53pkt 53fpkt", shape=invtriangle, color=brown];
4614[label="195.21.122.222;53pkt 53fpkt", shape=invhouse, color=bisque];
stat334[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.21.122.222:*, *:135}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 3385: (0.943396%)&lt;BR/&gt; 3384: (0.943396%)&lt;BR/&gt; 3383: (0.943396%)&lt;BR/&gt; 3382: (0.943396%)&gt;];
}
3889--4271[label="1;53pkt 53fpkt"];
3889--4614[label="1;53pkt 53fpkt"];
4271--4614[label="1;53pkt 53fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="195.21.122.222"/>
    </slice>
    <from sec="1102827971" usec="0"/>
    <to sec="1102828106" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.996497,1.52249,504,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_335{
style=filled;
color=gray75;
3895[label="149.66.189.226;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4275[label="149.66.189.226;2pkt 2fpkt", shape=invtriangle, color=brown];
4619[label="149.66.189.226;2pkt 2fpkt", shape=invhouse, color=bisque];
stat335[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.66.189.226:1617, 32.71.59.68:80}[50%]&lt;BR/&gt;{149.66.189.226:1618, 32.71.59.70:443}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1618: (25%)&lt;BR/&gt; 1617: (25%)&lt;BR/&gt; 443: (25%)&lt;BR/&gt; 80: (25%)&gt;];
}
3895--4275[label="1;2pkt 2fpkt"];
3895--4619[label="1;2pkt 2fpkt"];
4275--4619[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="32.71.59.70" dst_port="443" src_ip="149.66.189.226" src_port="1618"/>
      <filter dst_ip="32.71.59.68" dst_port="80" src_ip="149.66.189.226" src_port="1617"/>
    </slice>
    <from sec="1102827947" usec="0"/>
    <to sec="1102827963" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.996497,1.52249,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_336{
style=filled;
color=gray75;
3900[label="196.184.128.228;245pkt 245fpkt", shape=pentagon, color=darkviolet];
4279[label="196.184.128.228;245pkt 245fpkt", shape=invtriangle, color=brown];
4623[label="196.184.128.228;245pkt 245fpkt", shape=invhouse, color=bisque];
stat336[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.184.128.228:62329, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 62329: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3900--4279[label="1;245pkt 245fpkt"];
3900--4623[label="1;245pkt 245fpkt"];
4279--4623[label="1;245pkt 245fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="196.184.128.228" src_port="62329"/>
    </slice>
    <from sec="1102827973" usec="0"/>
    <to sec="1102827986" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.996497,1.52249,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_337{
style=filled;
color=gray75;
3909[label="2.203.17.231;216pkt 216fpkt", shape=pentagon, color=darkviolet];
4286[label="2.203.17.231;216pkt 216fpkt", shape=invtriangle, color=brown];
4630[label="2.203.17.231;216pkt 216fpkt", shape=invhouse, color=bisque];
stat337[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.203.17.231:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 3044: (0.231481%)&lt;BR/&gt; 3043: (0.231481%)&lt;BR/&gt; 3040: (0.231481%)&lt;BR/&gt; 3039: (0.231481%)&gt;];
}
3909--4286[label="1;216pkt 216fpkt"];
3909--4630[label="1;216pkt 216fpkt"];
4286--4630[label="1;216pkt 216fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="2.203.17.231"/>
    </slice>
    <from sec="1102827778" usec="0"/>
    <to sec="1102827783" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.996497,1.52249,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_338{
style=filled;
color=gray75;
3930[label="202.45.144.242;333pkt 333fpkt", shape=pentagon, color=darkviolet];
4302[label="202.45.144.242;333pkt 333fpkt", shape=invtriangle, color=brown];
4646[label="202.45.144.242;333pkt 333fpkt", shape=invhouse, color=bisque];
stat338[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.45.144.242:*, *:1023}[33.3333%]&lt;BR/&gt;{202.45.144.242:*, *:5554}[33.3333%]&lt;BR/&gt;{202.45.144.242:*, *:9898}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (16.6667%)&lt;BR/&gt; 5554: (16.6667%)&lt;BR/&gt; 1023: (16.6667%)&lt;BR/&gt; 4927: (0.15015%)&lt;BR/&gt; 4924: (0.15015%)&gt;];
}
3930--4302[label="1;333pkt 333fpkt"];
3930--4646[label="1;333pkt 333fpkt"];
4302--4646[label="1;333pkt 333fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="202.45.144.242"/>
      <filter dst_port="5554" src_ip="202.45.144.242"/>
      <filter dst_port="1023" src_ip="202.45.144.242"/>
    </slice>
    <from sec="1102828059" usec="0"/>
    <to sec="1102828069" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.795049,1.57129,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="68.96.152.24"/>
    </slice>
    <from sec="1102827986" usec="0"/>
    <to sec="1102828016" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.795049,1.57129,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="219.98.89.25"/>
    </slice>
    <from sec="1102828033" usec="0"/>
    <to sec="1102828048" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.795049,1.57129,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="87.149.49.60"/>
    </slice>
    <from sec="1102827900" usec="0"/>
    <to sec="1102828055" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.795049,1.57129,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="203.43.130.64"/>
    </slice>
    <from sec="1102827888" usec="0"/>
    <to sec="1102827939" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.795049,1.57129,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="149.66.178.66"/>
    </slice>
    <from sec="1102827933" usec="0"/>
    <to sec="1102828088" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.795049,1.57129,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="205.56.8.135"/>
    </slice>
    <from sec="1102827919" usec="0"/>
    <to sec="1102828106" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.928665,1.55499,503,0 0 0 0 0 0 0 0 0 0 1 1 ">
    <description>subgraph cluster_347{
style=filled;
color=gray75;
4213[label="65.2.7.184;1pkt 1fpkt", shape=invtriangle, color=brown];
4559[label="65.2.7.184;1pkt 1fpkt", shape=invhouse, color=bisque];
stat347[shape=component, label=&lt;Rules:&lt;BR/&gt;{65.2.7.184:47067, 149.66.8.2:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 47067: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
4213--4559[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="149.66.8.2" dst_port="80" src_ip="65.2.7.184" src_port="47067"/>
    </slice>
    <from sec="1102828021" usec="0"/>
    <to sec="1102828038" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.742748,1.48106,503,0 0 0 1 0 0 0 0 0 0 0 1 ">
    <description>subgraph cluster_348{
style=filled;
color=gray75;
1288[label="174.67.46.108;d;9pkt 9fpkt", shape=diamond, color=yellow];
4603[label="217.194.250.211;1pkt 1fpkt", shape=invhouse, color=bisque];
stat348[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.194.30.8:80, 174.67.46.108:*}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1469: (10%)&lt;BR/&gt; 1499: (5%)&lt;BR/&gt; 1498: (5%)&lt;BR/&gt; 1486: (5%)&gt;];
}
1288--4603[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="174.67.46.108" src_ip="217.194.30.8" src_port="80"/>
    </slice>
    <from sec="1102827620" usec="0"/>
    <to sec="1102828107" usec="0"/>
  </anomaly>

</admd:annotation>
