<?xml version="1.0" encoding="UTF-8" standalone="no" ?>
<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">

  <anomaly type="notice" value="0.697721,1.60995,999,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="149.223.208.96" dst_port="25" proto="tcp" src_ip="28.118.41.199" src_port="4781"/>
      <from sec="1104555888" usec="0"/>
      <to sec="1104555896" usec="0"/>
    </slice>
    <from sec="1104555888" usec="0"/>
    <to sec="1104555896" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.697721,1.60995,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="147.131.122.23" dst_port="137" proto="tcp" src_ip="81.155.122.248" src_port="1026"/>
      <filter dst_ip="147.131.122.23" dst_port="137" proto="udp" src_ip="81.155.122.248" src_port="1026"/>
      <filter dst_ip="147.131.122.23" dst_port="137" proto="tcp" src_ip="81.155.122.248" src_port="1030"/>
      <filter dst_ip="147.131.122.23" dst_port="137" proto="udp" src_ip="81.155.122.248" src_port="1030"/>
      <from sec="1104555609" usec="0"/>
      <to sec="1104555911" usec="0"/>
    </slice>
    <from sec="1104555609" usec="0"/>
    <to sec="1104555915" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.697721,1.60995,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="205.219.120.190" proto="icmp" src_ip="205.219.120.190"/>
      <filter dst_ip="205.219.120.190" proto="icmp" src_ip="205.219.120.190"/>
      <filter dst_ip="205.219.120.190" proto="icmp" src_ip="205.219.120.190"/>
      <filter dst_ip="205.219.120.190" proto="icmp" src_ip="205.219.120.190"/>
      <from sec="1104555916" usec="0"/>
      <to sec="1104556491" usec="0"/>
    </slice>
    <from sec="1104555916" usec="0"/>
    <to sec="1104556491" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.697721,1.60995,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="171.75.19.14" dst_port="25" proto="tcp" src_ip="209.241.211.32" src_port="80"/>
      <filter dst_ip="173.172.52.211" dst_port="25" proto="tcp" src_ip="209.241.211.32" src_port="80"/>
      <from sec="1104555837" usec="0"/>
      <to sec="1104556037" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="171.75.19.14" dst_port="25" proto="tcp" src_ip="4.8.3.12" src_port="80"/>
      <filter dst_ip="173.172.52.211" dst_port="25" proto="tcp" src_ip="4.8.3.12" src_port="80"/>
      <from sec="1104555834" usec="0"/>
      <to sec="1104555844" usec="0"/>
    </slice>
    <from sec="1104555834" usec="0"/>
    <to sec="1104556037" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.697721,1.60995,503,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="196.149.227.100" dst_port="80" proto="tcp" src_ip="149.223.90.225" src_port="64585"/>
      <filter dst_ip="196.149.227.100" dst_port="80" proto="udp" src_ip="149.223.90.225" src_port="64585"/>
      <filter dst_ip="196.149.227.100" dst_port="53" proto="tcp" src_ip="149.223.90.225" src_port="64585"/>
      <filter dst_ip="196.149.227.100" dst_port="53" proto="udp" src_ip="149.223.90.225" src_port="64585"/>
      <filter dst_ip="196.149.227.100" dst_port="25" proto="tcp" src_ip="149.223.90.225" src_port="64585"/>
      <filter dst_ip="196.149.227.100" dst_port="25" proto="udp" src_ip="149.223.90.225" src_port="64585"/>
      <filter dst_ip="196.149.227.100" dst_port="80" proto="tcp" src_ip="149.223.90.225" src_port="64563"/>
      <filter dst_ip="196.149.227.100" dst_port="80" proto="udp" src_ip="149.223.90.225" src_port="64563"/>
      <filter dst_ip="196.149.227.100" dst_port="53" proto="tcp" src_ip="149.223.90.225" src_port="64563"/>
      <filter dst_ip="196.149.227.100" dst_port="53" proto="udp" src_ip="149.223.90.225" src_port="64563"/>
      <filter dst_ip="196.149.227.100" dst_port="25" proto="tcp" src_ip="149.223.90.225" src_port="64563"/>
      <filter dst_ip="196.149.227.100" dst_port="25" proto="udp" src_ip="149.223.90.225" src_port="64563"/>
      <filter dst_ip="213.166.131.28" dst_port="80" proto="tcp" src_ip="149.223.90.225" src_port="64585"/>
      <filter dst_ip="213.166.131.28" dst_port="80" proto="udp" src_ip="149.223.90.225" src_port="64585"/>
      <filter dst_ip="213.166.131.28" dst_port="53" proto="tcp" src_ip="149.223.90.225" src_port="64585"/>
      <filter dst_ip="213.166.131.28" dst_port="53" proto="udp" src_ip="149.223.90.225" src_port="64585"/>
      <filter dst_ip="213.166.131.28" dst_port="25" proto="tcp" src_ip="149.223.90.225" src_port="64585"/>
      <filter dst_ip="213.166.131.28" dst_port="25" proto="udp" src_ip="149.223.90.225" src_port="64585"/>
      <filter dst_ip="213.166.131.28" dst_port="80" proto="tcp" src_ip="149.223.90.225" src_port="64563"/>
      <filter dst_ip="213.166.131.28" dst_port="80" proto="udp" src_ip="149.223.90.225" src_port="64563"/>
      <filter dst_ip="213.166.131.28" dst_port="53" proto="tcp" src_ip="149.223.90.225" src_port="64563"/>
      <filter dst_ip="213.166.131.28" dst_port="53" proto="udp" src_ip="149.223.90.225" src_port="64563"/>
      <filter dst_ip="213.166.131.28" dst_port="25" proto="tcp" src_ip="149.223.90.225" src_port="64563"/>
      <filter dst_ip="213.166.131.28" dst_port="25" proto="udp" src_ip="149.223.90.225" src_port="64563"/>
      <from sec="1104555872" usec="0"/>
      <to sec="1104556248" usec="0"/>
    </slice>
    <from sec="1104555872" usec="0"/>
    <to sec="1104556252" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.697721,1.60995,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="213.166.131.28" dst_port="80" proto="tcp" src_ip="205.219.120.190"/>
      <filter dst_ip="213.166.131.28" dst_port="80" proto="udp" src_ip="205.219.120.190"/>
      <filter dst_ip="213.166.131.28" dst_port="80" proto="tcp" src_ip="205.219.120.190"/>
      <filter dst_ip="213.166.131.28" dst_port="80" proto="udp" src_ip="205.219.120.190"/>
      <filter dst_ip="213.166.131.28" dst_port="80" proto="tcp" src_ip="205.219.120.190"/>
      <filter dst_ip="213.166.131.28" dst_port="80" proto="udp" src_ip="205.219.120.190"/>
      <filter dst_ip="213.166.131.28" dst_port="80" proto="tcp" src_ip="205.219.120.190"/>
      <filter dst_ip="213.166.131.28" dst_port="80" proto="udp" src_ip="205.219.120.190"/>
      <filter dst_ip="213.166.131.28" dst_port="53" proto="tcp" src_ip="205.219.120.190"/>
      <filter dst_ip="213.166.131.28" dst_port="53" proto="udp" src_ip="205.219.120.190"/>
      <filter dst_ip="213.166.131.28" dst_port="53" proto="tcp" src_ip="205.219.120.190"/>
      <filter dst_ip="213.166.131.28" dst_port="53" proto="udp" src_ip="205.219.120.190"/>
      <filter dst_ip="213.166.131.28" dst_port="53" proto="tcp" src_ip="205.219.120.190"/>
      <filter dst_ip="213.166.131.28" dst_port="53" proto="udp" src_ip="205.219.120.190"/>
      <filter dst_ip="213.166.131.28" dst_port="53" proto="tcp" src_ip="205.219.120.190"/>
      <filter dst_ip="213.166.131.28" dst_port="53" proto="udp" src_ip="205.219.120.190"/>
      <filter dst_ip="213.166.131.28" dst_port="25" proto="tcp" src_ip="205.219.120.190"/>
      <filter dst_ip="213.166.131.28" dst_port="25" proto="udp" src_ip="205.219.120.190"/>
      <filter dst_ip="213.166.131.28" dst_port="25" proto="tcp" src_ip="205.219.120.190"/>
      <filter dst_ip="213.166.131.28" dst_port="25" proto="udp" src_ip="205.219.120.190"/>
      <filter dst_ip="213.166.131.28" dst_port="25" proto="tcp" src_ip="205.219.120.190"/>
      <filter dst_ip="213.166.131.28" dst_port="25" proto="udp" src_ip="205.219.120.190"/>
      <filter dst_ip="213.166.131.28" dst_port="25" proto="tcp" src_ip="205.219.120.190"/>
      <filter dst_ip="213.166.131.28" dst_port="25" proto="udp" src_ip="205.219.120.190"/>
      <from sec="1104556355" usec="0"/>
      <to sec="1104556369" usec="0"/>
    </slice>
    <from sec="1104556355" usec="0"/>
    <to sec="1104556369" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.697721,1.60995,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="194.108.81.2" src_port="1028"/>
      <from sec="1104556064" usec="0"/>
      <to sec="1104556080" usec="0"/>
    </slice>
    <from sec="1104556064" usec="0"/>
    <to sec="1104556080" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.697721,1.60995,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="195.166.51.125" dst_port="137" proto="tcp" src_ip="96.80.96.6" src_port="1026"/>
      <filter dst_ip="195.166.51.125" dst_port="137" proto="udp" src_ip="96.80.96.6" src_port="1026"/>
      <filter dst_ip="195.166.51.125" dst_port="80" proto="tcp" src_ip="96.80.96.6" src_port="1026"/>
      <filter dst_ip="195.166.51.125" dst_port="80" proto="udp" src_ip="96.80.96.6" src_port="1026"/>
      <filter dst_ip="195.166.51.125" dst_port="53" proto="tcp" src_ip="96.80.96.6" src_port="1026"/>
      <filter dst_ip="195.166.51.125" dst_port="53" proto="udp" src_ip="96.80.96.6" src_port="1026"/>
      <from sec="1104556194" usec="0"/>
      <to sec="1104556226" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="195.166.51.125" dst_port="137" proto="tcp" src_ip="149.222.108.26" src_port="1026"/>
      <filter dst_ip="195.166.51.125" dst_port="137" proto="udp" src_ip="149.222.108.26" src_port="1026"/>
      <filter dst_ip="195.166.51.125" dst_port="80" proto="tcp" src_ip="149.222.108.26" src_port="1026"/>
      <filter dst_ip="195.166.51.125" dst_port="80" proto="udp" src_ip="149.222.108.26" src_port="1026"/>
      <filter dst_ip="195.166.51.125" dst_port="53" proto="tcp" src_ip="149.222.108.26" src_port="1026"/>
      <filter dst_ip="195.166.51.125" dst_port="53" proto="udp" src_ip="149.222.108.26" src_port="1026"/>
      <from sec="1104556194" usec="0"/>
      <to sec="1104556201" usec="0"/>
    </slice>
    <from sec="1104556194" usec="0"/>
    <to sec="1104556226" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.697721,1.60995,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="193.42.204.12" src_port="1029"/>
      <filter dst_port="137" proto="icmp" src_ip="193.42.204.12" src_port="1029"/>
      <from sec="1104555709" usec="0"/>
      <to sec="1104555719" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="137" proto="udp" src_ip="149.222.60.12" src_port="1029"/>
      <filter dst_port="137" proto="icmp" src_ip="149.222.60.12" src_port="1029"/>
      <from sec="1104555709" usec="0"/>
      <to sec="1104555718" usec="0"/>
    </slice>
    <from sec="1104555709" usec="0"/>
    <to sec="1104555719" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.697721,1.60995,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="192.219.195.240" dst_port="137" proto="tcp" src_ip="194.158.2.33" src_port="1028"/>
      <filter dst_ip="192.219.195.240" dst_port="137" proto="udp" src_ip="194.158.2.33" src_port="1028"/>
      <filter dst_ip="192.219.195.240" dst_port="20" proto="tcp" src_ip="194.158.2.33" src_port="1028"/>
      <filter dst_ip="192.219.195.240" dst_port="20" proto="udp" src_ip="194.158.2.33" src_port="1028"/>
      <filter dst_ip="192.219.195.240" dst_port="137" proto="tcp" src_ip="194.158.2.33" src_port="3011"/>
      <filter dst_ip="192.219.195.240" dst_port="137" proto="udp" src_ip="194.158.2.33" src_port="3011"/>
      <filter dst_ip="192.219.195.240" dst_port="20" proto="tcp" src_ip="194.158.2.33" src_port="3011"/>
      <filter dst_ip="192.219.195.240" dst_port="20" proto="udp" src_ip="194.158.2.33" src_port="3011"/>
      <from sec="1104555993" usec="0"/>
      <to sec="1104555999" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="192.219.195.240" dst_port="137" proto="tcp" src_ip="173.172.2.33" src_port="1028"/>
      <filter dst_ip="192.219.195.240" dst_port="137" proto="udp" src_ip="173.172.2.33" src_port="1028"/>
      <filter dst_ip="192.219.195.240" dst_port="20" proto="tcp" src_ip="173.172.2.33" src_port="1028"/>
      <filter dst_ip="192.219.195.240" dst_port="20" proto="udp" src_ip="173.172.2.33" src_port="1028"/>
      <filter dst_ip="192.219.195.240" dst_port="137" proto="tcp" src_ip="173.172.2.33" src_port="3011"/>
      <filter dst_ip="192.219.195.240" dst_port="137" proto="udp" src_ip="173.172.2.33" src_port="3011"/>
      <filter dst_ip="192.219.195.240" dst_port="20" proto="tcp" src_ip="173.172.2.33" src_port="3011"/>
      <filter dst_ip="192.219.195.240" dst_port="20" proto="udp" src_ip="173.172.2.33" src_port="3011"/>
      <from sec="1104555995" usec="0"/>
      <to sec="1104556001" usec="0"/>
    </slice>
    <from sec="1104555993" usec="0"/>
    <to sec="1104556001" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.697721,1.60995,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="194.157.61.74" src_port="1025"/>
      <from sec="1104556341" usec="0"/>
      <to sec="1104556347" usec="0"/>
    </slice>
    <from sec="1104556341" usec="0"/>
    <to sec="1104556347" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.697721,1.60995,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="tcp" src_ip="81.165.240.78" src_port="1028"/>
      <filter dst_port="137" proto="udp" src_ip="81.165.240.78" src_port="1028"/>
      <filter dst_port="137" proto="tcp" src_ip="81.165.240.78" src_port="1029"/>
      <filter dst_port="137" proto="udp" src_ip="81.165.240.78" src_port="1029"/>
      <from sec="1104555757" usec="0"/>
      <to sec="1104555790" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="137" proto="tcp" src_ip="2.15.216.152" src_port="1028"/>
      <filter dst_port="137" proto="udp" src_ip="2.15.216.152" src_port="1028"/>
      <filter dst_port="137" proto="tcp" src_ip="2.15.216.152" src_port="1029"/>
      <filter dst_port="137" proto="udp" src_ip="2.15.216.152" src_port="1029"/>
      <from sec="1104555759" usec="0"/>
      <to sec="1104555783" usec="0"/>
    </slice>
    <from sec="1104555757" usec="0"/>
    <to sec="1104555790" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.697721,1.60995,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="211.75.86.108" src_port="1025"/>
      <from sec="1104555914" usec="0"/>
      <to sec="1104555946" usec="0"/>
    </slice>
    <from sec="1104555914" usec="0"/>
    <to sec="1104555946" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.697721,1.60995,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="194.125.4.180" src_port="47892"/>
      <from sec="1104556022" usec="0"/>
      <to sec="1104556030" usec="0"/>
    </slice>
    <from sec="1104556022" usec="0"/>
    <to sec="1104556031" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.697721,1.60995,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="28.233.76.180" src_port="15941"/>
      <from sec="1104555877" usec="0"/>
      <to sec="1104555893" usec="0"/>
    </slice>
    <from sec="1104555877" usec="0"/>
    <to sec="1104555895" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.697721,1.60995,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="209.75.34.250" src_port="10143"/>
      <from sec="1104556315" usec="0"/>
      <to sec="1104556347" usec="0"/>
    </slice>
    <from sec="1104556315" usec="0"/>
    <to sec="1104556347" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.697721,1.60995,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="tcp" src_ip="96.4.57.24" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="udp" src_ip="96.4.57.24" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="tcp" src_ip="96.4.57.24" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="udp" src_ip="96.4.57.24" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="tcp" src_ip="96.4.57.24" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="udp" src_ip="96.4.57.24" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="tcp" src_ip="96.4.57.24" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="udp" src_ip="96.4.57.24" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="tcp" src_ip="96.4.57.24" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="udp" src_ip="96.4.57.24" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="tcp" src_ip="96.4.57.24" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="udp" src_ip="96.4.57.24" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="tcp" src_ip="96.4.57.24" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="udp" src_ip="96.4.57.24" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="tcp" src_ip="96.4.57.24" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="udp" src_ip="96.4.57.24" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="tcp" src_ip="96.4.57.24" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="udp" src_ip="96.4.57.24" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="tcp" src_ip="96.4.57.24" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="udp" src_ip="96.4.57.24" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="tcp" src_ip="96.4.57.24" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="udp" src_ip="96.4.57.24" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="tcp" src_ip="96.4.57.24" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="udp" src_ip="96.4.57.24" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="tcp" src_ip="96.4.57.24" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="udp" src_ip="96.4.57.24" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="tcp" src_ip="96.4.57.24" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="udp" src_ip="96.4.57.24" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="tcp" src_ip="96.4.57.24" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="udp" src_ip="96.4.57.24" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="tcp" src_ip="96.4.57.24" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="udp" src_ip="96.4.57.24" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="tcp" src_ip="96.4.57.24" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="udp" src_ip="96.4.57.24" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="tcp" src_ip="96.4.57.24" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="udp" src_ip="96.4.57.24" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="tcp" src_ip="96.4.57.24" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="udp" src_ip="96.4.57.24" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="tcp" src_ip="96.4.57.24" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="udp" src_ip="96.4.57.24" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="tcp" src_ip="96.4.57.24" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="udp" src_ip="96.4.57.24" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="tcp" src_ip="96.4.57.24" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="udp" src_ip="96.4.57.24" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="tcp" src_ip="96.4.57.24" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="udp" src_ip="96.4.57.24" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="tcp" src_ip="96.4.57.24" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="udp" src_ip="96.4.57.24" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="tcp" src_ip="209.99.172.197" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="udp" src_ip="209.99.172.197" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="tcp" src_ip="209.99.172.197" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="udp" src_ip="209.99.172.197" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="tcp" src_ip="209.99.172.197" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="udp" src_ip="209.99.172.197" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="tcp" src_ip="209.99.172.197" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="udp" src_ip="209.99.172.197" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="tcp" src_ip="209.99.172.197" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="udp" src_ip="209.99.172.197" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="tcp" src_ip="209.99.172.197" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="udp" src_ip="209.99.172.197" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="tcp" src_ip="209.99.172.197" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="udp" src_ip="209.99.172.197" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="tcp" src_ip="209.99.172.197" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="udp" src_ip="209.99.172.197" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="tcp" src_ip="209.99.172.197" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="udp" src_ip="209.99.172.197" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="tcp" src_ip="209.99.172.197" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="udp" src_ip="209.99.172.197" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="tcp" src_ip="209.99.172.197" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="udp" src_ip="209.99.172.197" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="tcp" src_ip="209.99.172.197" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="udp" src_ip="209.99.172.197" src_port="1025"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="tcp" src_ip="209.99.172.197" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="udp" src_ip="209.99.172.197" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="tcp" src_ip="209.99.172.197" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="udp" src_ip="209.99.172.197" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="tcp" src_ip="209.99.172.197" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="udp" src_ip="209.99.172.197" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="tcp" src_ip="209.99.172.197" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="53" proto="udp" src_ip="209.99.172.197" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="tcp" src_ip="209.99.172.197" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="udp" src_ip="209.99.172.197" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="tcp" src_ip="209.99.172.197" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="udp" src_ip="209.99.172.197" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="tcp" src_ip="209.99.172.197" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="udp" src_ip="209.99.172.197" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="tcp" src_ip="209.99.172.197" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="51293" proto="udp" src_ip="209.99.172.197" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="tcp" src_ip="209.99.172.197" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="udp" src_ip="209.99.172.197" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="tcp" src_ip="209.99.172.197" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="udp" src_ip="209.99.172.197" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="tcp" src_ip="209.99.172.197" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="udp" src_ip="209.99.172.197" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="tcp" src_ip="209.99.172.197" src_port="1033"/>
      <filter dst_ip="219.170.48.207" dst_port="137" proto="udp" src_ip="209.99.172.197" src_port="1033"/>
      <from sec="1104556267" usec="0"/>
      <to sec="1104556278" usec="0"/>
    </slice>
    <from sec="1104556266" usec="0"/>
    <to sec="1104556278" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.697721,1.60995,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="96.116.12.65" proto="icmp"/>
      <filter dst_ip="96.116.12.65" proto="icmp"/>
      <filter dst_ip="96.116.12.65" proto="icmp"/>
      <filter dst_ip="96.116.12.65" proto="icmp"/>
      <from sec="1104556244" usec="0"/>
      <to sec="1104556263" usec="0"/>
    </slice>
    <from sec="1104556244" usec="0"/>
    <to sec="1104556263" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.697721,1.60995,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="194.157.61.74" proto="icmp"/>
      <filter dst_ip="194.157.61.74" proto="icmp"/>
      <filter dst_ip="194.157.61.74" proto="icmp"/>
      <filter dst_ip="194.157.61.74" proto="icmp"/>
      <from sec="1104556341" usec="0"/>
      <to sec="1104556347" usec="0"/>
    </slice>
    <from sec="1104556341" usec="0"/>
    <to sec="1104556347" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.697721,1.60995,020,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="209.99.172.197" proto="icmp"/>
      <filter dst_ip="209.99.172.197" proto="icmp"/>
      <filter dst_ip="209.99.172.197" proto="icmp"/>
      <filter dst_ip="209.99.172.197" proto="icmp"/>
      <from sec="1104556271" usec="0"/>
      <to sec="1104556298" usec="0"/>
    </slice>
    <from sec="1104556271" usec="0"/>
    <to sec="1104556298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.697721,1.60995,504,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="212.89.193.204" dst_port="443" proto="tcp" src_ip="149.223.212.101" src_port="2348"/>
      <filter dst_ip="212.89.193.204" dst_port="443" proto="udp" src_ip="149.223.212.101" src_port="2348"/>
      <filter dst_ip="212.89.193.204" dst_port="53" proto="tcp" src_ip="149.223.212.101" src_port="2348"/>
      <filter dst_ip="212.89.193.204" dst_port="53" proto="udp" src_ip="149.223.212.101" src_port="2348"/>
      <filter dst_ip="212.89.193.204" dst_port="25" proto="tcp" src_ip="149.223.212.101" src_port="2348"/>
      <filter dst_ip="212.89.193.204" dst_port="25" proto="udp" src_ip="149.223.212.101" src_port="2348"/>
      <filter dst_ip="212.89.193.204" dst_port="445" proto="tcp" src_ip="149.223.212.101" src_port="2348"/>
      <filter dst_ip="212.89.193.204" dst_port="445" proto="udp" src_ip="149.223.212.101" src_port="2348"/>
      <filter dst_ip="212.89.193.204" dst_port="443" proto="tcp" src_ip="149.223.212.101" src_port="53"/>
      <filter dst_ip="212.89.193.204" dst_port="443" proto="udp" src_ip="149.223.212.101" src_port="53"/>
      <filter dst_ip="212.89.193.204" dst_port="53" proto="tcp" src_ip="149.223.212.101" src_port="53"/>
      <filter dst_ip="212.89.193.204" dst_port="53" proto="udp" src_ip="149.223.212.101" src_port="53"/>
      <filter dst_ip="212.89.193.204" dst_port="25" proto="tcp" src_ip="149.223.212.101" src_port="53"/>
      <filter dst_ip="212.89.193.204" dst_port="25" proto="udp" src_ip="149.223.212.101" src_port="53"/>
      <filter dst_ip="212.89.193.204" dst_port="445" proto="tcp" src_ip="149.223.212.101" src_port="53"/>
      <filter dst_ip="212.89.193.204" dst_port="445" proto="udp" src_ip="149.223.212.101" src_port="53"/>
      <filter dst_ip="212.89.193.204" dst_port="443" proto="tcp" src_ip="149.223.212.101" src_port="2755"/>
      <filter dst_ip="212.89.193.204" dst_port="443" proto="udp" src_ip="149.223.212.101" src_port="2755"/>
      <filter dst_ip="212.89.193.204" dst_port="53" proto="tcp" src_ip="149.223.212.101" src_port="2755"/>
      <filter dst_ip="212.89.193.204" dst_port="53" proto="udp" src_ip="149.223.212.101" src_port="2755"/>
      <filter dst_ip="212.89.193.204" dst_port="25" proto="tcp" src_ip="149.223.212.101" src_port="2755"/>
      <filter dst_ip="212.89.193.204" dst_port="25" proto="udp" src_ip="149.223.212.101" src_port="2755"/>
      <filter dst_ip="212.89.193.204" dst_port="445" proto="tcp" src_ip="149.223.212.101" src_port="2755"/>
      <filter dst_ip="212.89.193.204" dst_port="445" proto="udp" src_ip="149.223.212.101" src_port="2755"/>
      <filter dst_ip="149.223.210.135" dst_port="443" proto="tcp" src_ip="149.223.212.101" src_port="2348"/>
      <filter dst_ip="149.223.210.135" dst_port="443" proto="udp" src_ip="149.223.212.101" src_port="2348"/>
      <filter dst_ip="149.223.210.135" dst_port="53" proto="tcp" src_ip="149.223.212.101" src_port="2348"/>
      <filter dst_ip="149.223.210.135" dst_port="53" proto="udp" src_ip="149.223.212.101" src_port="2348"/>
      <filter dst_ip="149.223.210.135" dst_port="25" proto="tcp" src_ip="149.223.212.101" src_port="2348"/>
      <filter dst_ip="149.223.210.135" dst_port="25" proto="udp" src_ip="149.223.212.101" src_port="2348"/>
      <filter dst_ip="149.223.210.135" dst_port="445" proto="tcp" src_ip="149.223.212.101" src_port="2348"/>
      <filter dst_ip="149.223.210.135" dst_port="445" proto="udp" src_ip="149.223.212.101" src_port="2348"/>
      <filter dst_ip="149.223.210.135" dst_port="443" proto="tcp" src_ip="149.223.212.101" src_port="53"/>
      <filter dst_ip="149.223.210.135" dst_port="443" proto="udp" src_ip="149.223.212.101" src_port="53"/>
      <filter dst_ip="149.223.210.135" dst_port="53" proto="tcp" src_ip="149.223.212.101" src_port="53"/>
      <filter dst_ip="149.223.210.135" dst_port="53" proto="udp" src_ip="149.223.212.101" src_port="53"/>
      <filter dst_ip="149.223.210.135" dst_port="25" proto="tcp" src_ip="149.223.212.101" src_port="53"/>
      <filter dst_ip="149.223.210.135" dst_port="25" proto="udp" src_ip="149.223.212.101" src_port="53"/>
      <filter dst_ip="149.223.210.135" dst_port="445" proto="tcp" src_ip="149.223.212.101" src_port="53"/>
      <filter dst_ip="149.223.210.135" dst_port="445" proto="udp" src_ip="149.223.212.101" src_port="53"/>
      <filter dst_ip="149.223.210.135" dst_port="443" proto="tcp" src_ip="149.223.212.101" src_port="2755"/>
      <filter dst_ip="149.223.210.135" dst_port="443" proto="udp" src_ip="149.223.212.101" src_port="2755"/>
      <filter dst_ip="149.223.210.135" dst_port="53" proto="tcp" src_ip="149.223.212.101" src_port="2755"/>
      <filter dst_ip="149.223.210.135" dst_port="53" proto="udp" src_ip="149.223.212.101" src_port="2755"/>
      <filter dst_ip="149.223.210.135" dst_port="25" proto="tcp" src_ip="149.223.212.101" src_port="2755"/>
      <filter dst_ip="149.223.210.135" dst_port="25" proto="udp" src_ip="149.223.212.101" src_port="2755"/>
      <filter dst_ip="149.223.210.135" dst_port="445" proto="tcp" src_ip="149.223.212.101" src_port="2755"/>
      <filter dst_ip="149.223.210.135" dst_port="445" proto="udp" src_ip="149.223.212.101" src_port="2755"/>
      <from sec="1104556312" usec="0"/>
      <to sec="1104556316" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="212.89.193.204" dst_port="443" proto="tcp" src_ip="192.208.6.103" src_port="2348"/>
      <filter dst_ip="212.89.193.204" dst_port="443" proto="udp" src_ip="192.208.6.103" src_port="2348"/>
      <filter dst_ip="212.89.193.204" dst_port="53" proto="tcp" src_ip="192.208.6.103" src_port="2348"/>
      <filter dst_ip="212.89.193.204" dst_port="53" proto="udp" src_ip="192.208.6.103" src_port="2348"/>
      <filter dst_ip="212.89.193.204" dst_port="25" proto="tcp" src_ip="192.208.6.103" src_port="2348"/>
      <filter dst_ip="212.89.193.204" dst_port="25" proto="udp" src_ip="192.208.6.103" src_port="2348"/>
      <filter dst_ip="212.89.193.204" dst_port="445" proto="tcp" src_ip="192.208.6.103" src_port="2348"/>
      <filter dst_ip="212.89.193.204" dst_port="445" proto="udp" src_ip="192.208.6.103" src_port="2348"/>
      <filter dst_ip="212.89.193.204" dst_port="443" proto="tcp" src_ip="192.208.6.103" src_port="53"/>
      <filter dst_ip="212.89.193.204" dst_port="443" proto="udp" src_ip="192.208.6.103" src_port="53"/>
      <filter dst_ip="212.89.193.204" dst_port="53" proto="tcp" src_ip="192.208.6.103" src_port="53"/>
      <filter dst_ip="212.89.193.204" dst_port="53" proto="udp" src_ip="192.208.6.103" src_port="53"/>
      <filter dst_ip="212.89.193.204" dst_port="25" proto="tcp" src_ip="192.208.6.103" src_port="53"/>
      <filter dst_ip="212.89.193.204" dst_port="25" proto="udp" src_ip="192.208.6.103" src_port="53"/>
      <filter dst_ip="212.89.193.204" dst_port="445" proto="tcp" src_ip="192.208.6.103" src_port="53"/>
      <filter dst_ip="212.89.193.204" dst_port="445" proto="udp" src_ip="192.208.6.103" src_port="53"/>
      <filter dst_ip="212.89.193.204" dst_port="443" proto="tcp" src_ip="192.208.6.103" src_port="2755"/>
      <filter dst_ip="212.89.193.204" dst_port="443" proto="udp" src_ip="192.208.6.103" src_port="2755"/>
      <filter dst_ip="212.89.193.204" dst_port="53" proto="tcp" src_ip="192.208.6.103" src_port="2755"/>
      <filter dst_ip="212.89.193.204" dst_port="53" proto="udp" src_ip="192.208.6.103" src_port="2755"/>
      <filter dst_ip="212.89.193.204" dst_port="25" proto="tcp" src_ip="192.208.6.103" src_port="2755"/>
      <filter dst_ip="212.89.193.204" dst_port="25" proto="udp" src_ip="192.208.6.103" src_port="2755"/>
      <filter dst_ip="212.89.193.204" dst_port="445" proto="tcp" src_ip="192.208.6.103" src_port="2755"/>
      <filter dst_ip="212.89.193.204" dst_port="445" proto="udp" src_ip="192.208.6.103" src_port="2755"/>
      <filter dst_ip="149.223.210.135" dst_port="443" proto="tcp" src_ip="192.208.6.103" src_port="2348"/>
      <filter dst_ip="149.223.210.135" dst_port="443" proto="udp" src_ip="192.208.6.103" src_port="2348"/>
      <filter dst_ip="149.223.210.135" dst_port="53" proto="tcp" src_ip="192.208.6.103" src_port="2348"/>
      <filter dst_ip="149.223.210.135" dst_port="53" proto="udp" src_ip="192.208.6.103" src_port="2348"/>
      <filter dst_ip="149.223.210.135" dst_port="25" proto="tcp" src_ip="192.208.6.103" src_port="2348"/>
      <filter dst_ip="149.223.210.135" dst_port="25" proto="udp" src_ip="192.208.6.103" src_port="2348"/>
      <filter dst_ip="149.223.210.135" dst_port="445" proto="tcp" src_ip="192.208.6.103" src_port="2348"/>
      <filter dst_ip="149.223.210.135" dst_port="445" proto="udp" src_ip="192.208.6.103" src_port="2348"/>
      <filter dst_ip="149.223.210.135" dst_port="443" proto="tcp" src_ip="192.208.6.103" src_port="53"/>
      <filter dst_ip="149.223.210.135" dst_port="443" proto="udp" src_ip="192.208.6.103" src_port="53"/>
      <filter dst_ip="149.223.210.135" dst_port="53" proto="tcp" src_ip="192.208.6.103" src_port="53"/>
      <filter dst_ip="149.223.210.135" dst_port="53" proto="udp" src_ip="192.208.6.103" src_port="53"/>
      <filter dst_ip="149.223.210.135" dst_port="25" proto="tcp" src_ip="192.208.6.103" src_port="53"/>
      <filter dst_ip="149.223.210.135" dst_port="25" proto="udp" src_ip="192.208.6.103" src_port="53"/>
      <filter dst_ip="149.223.210.135" dst_port="445" proto="tcp" src_ip="192.208.6.103" src_port="53"/>
      <filter dst_ip="149.223.210.135" dst_port="445" proto="udp" src_ip="192.208.6.103" src_port="53"/>
      <filter dst_ip="149.223.210.135" dst_port="443" proto="tcp" src_ip="192.208.6.103" src_port="2755"/>
      <filter dst_ip="149.223.210.135" dst_port="443" proto="udp" src_ip="192.208.6.103" src_port="2755"/>
      <filter dst_ip="149.223.210.135" dst_port="53" proto="tcp" src_ip="192.208.6.103" src_port="2755"/>
      <filter dst_ip="149.223.210.135" dst_port="53" proto="udp" src_ip="192.208.6.103" src_port="2755"/>
      <filter dst_ip="149.223.210.135" dst_port="25" proto="tcp" src_ip="192.208.6.103" src_port="2755"/>
      <filter dst_ip="149.223.210.135" dst_port="25" proto="udp" src_ip="192.208.6.103" src_port="2755"/>
      <filter dst_ip="149.223.210.135" dst_port="445" proto="tcp" src_ip="192.208.6.103" src_port="2755"/>
      <filter dst_ip="149.223.210.135" dst_port="445" proto="udp" src_ip="192.208.6.103" src_port="2755"/>
      <from sec="1104556309" usec="0"/>
      <to sec="1104556318" usec="0"/>
    </slice>
    <from sec="1104556308" usec="0"/>
    <to sec="1104556321" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.990577,1.50087,503,1 1 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_23{
style=filled;
color=gray75;
87[label="149.222.8.176s;1pkt 1fpkt", shape=rectangle, color=red];
225[label="149.222.8.176s;1pkt 1fpkt", shape=ellipse, color=green];
2126[label="149.222.8.176;20pkt 20fpkt", shape=pentagon, color=darkviolet];
2577[label="149.222.8.176;20pkt 20fpkt", shape=invtriangle, color=brown];
stat23[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.222.8.176:80, 2.35.124.175:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 36352: (4.7619%)&lt;BR/&gt; 38405: (2.38095%)&lt;BR/&gt; 38305: (2.38095%)&lt;BR/&gt; 38234: (2.38095%)&gt;];
}
87--225[label="1;1pkt 1fpkt"];
87--2126[label="1;1pkt 1fpkt"];
87--2577[label="1;1pkt 1fpkt"];
225--2126[label="1;1pkt 1fpkt"];
225--2577[label="1;1pkt 1fpkt"];
2126--2577[label="1;20pkt 20fpkt"];
</description>
    <slice>
      <filter dst_ip="2.35.124.175" src_ip="149.222.8.176" src_port="80"/>
    </slice>
    <from sec="1104555936" usec="0"/>
    <to sec="1104555971" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.84153,1.64057,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="205.219.120.190" proto="icmp" src_ip="205.219.120.190"/>
      <filter dst_ip="205.219.120.190" proto="icmp" src_ip="205.219.120.190"/>
      <filter dst_ip="205.219.120.190" proto="icmp" src_ip="205.219.120.190"/>
      <filter dst_ip="205.219.120.190" proto="icmp" src_ip="205.219.120.190"/>
      <from sec="1104555916" usec="0"/>
      <to sec="1104556491" usec="0"/>
    </slice>
    <from sec="1104555916" usec="0"/>
    <to sec="1104556491" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.943901,1.53143,002,1 1 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_33{
style=filled;
color=gray75;
112[label="198.6.234.50s;246pkt 246fpkt", shape=rectangle, color=red];
242[label="198.6.234.50s;246pkt 246fpkt", shape=ellipse, color=green];
1833[label="198.6.234.50;245pkt 245fpkt", shape=pentagon, color=darkviolet];
stat33[shape=component, label=&lt;Rules:&lt;BR/&gt;{198.6.234.50:64975, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 64975: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
112--242[label="1;246pkt 246fpkt"];
112--1833[label="1;245pkt 245fpkt"];
242--1833[label="1;245pkt 245fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="198.6.234.50" src_port="64975"/>
    </slice>
    <from sec="1104555729" usec="0"/>
    <to sec="1104555746" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969718,1.59364,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_35{
style=filled;
color=gray75;
114[label="4.185.205.55s;206pkt 206fpkt", shape=rectangle, color=red];
244[label="4.185.205.55s;206pkt 206fpkt", shape=ellipse, color=green];
stat35[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.185.205.55:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
114--244[label="1;206pkt 206fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="4.185.205.55" src_port="1029"/>
    </slice>
    <from sec="1104556156" usec="0"/>
    <to sec="1104556187" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969718,1.59364,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_40{
style=filled;
color=gray75;
128[label="201.113.183.118s;76pkt 76fpkt", shape=rectangle, color=red];
250[label="201.113.183.118s;41pkt 41fpkt", shape=ellipse, color=green];
stat40[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.113.183.118:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
128--250[label="1;41pkt 41fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="201.113.183.118" src_port="1027"/>
    </slice>
    <from sec="1104555783" usec="0"/>
    <to sec="1104555799" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969718,1.59364,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_43{
style=filled;
color=gray75;
132[label="198.15.83.138s;130pkt 130fpkt", shape=rectangle, color=red];
254[label="198.15.83.138s;130pkt 130fpkt", shape=ellipse, color=green];
stat43[shape=component, label=&lt;Rules:&lt;BR/&gt;{198.15.83.138:4999, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4999: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
132--254[label="1;130pkt 130fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="198.15.83.138" src_port="4999"/>
    </slice>
    <from sec="1104555719" usec="0"/>
    <to sec="1104555728" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.990577,1.50087,002,1 1 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_46{
style=filled;
color=gray75;
138[label="194.120.80.161s;182pkt 182fpkt", shape=rectangle, color=red];
258[label="194.120.80.161s;73pkt 73fpkt", shape=ellipse, color=green];
2092[label="194.120.80.161;217pkt 217fpkt", shape=pentagon, color=darkviolet];
2550[label="194.120.80.161;217pkt 217fpkt", shape=invtriangle, color=brown];
stat46[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.120.80.161:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
138--258[label="1;73pkt 73fpkt"];
138--2092[label="1;182pkt 182fpkt"];
138--2550[label="1;182pkt 182fpkt"];
258--2092[label="1;73pkt 73fpkt"];
258--2550[label="1;73pkt 73fpkt"];
2092--2550[label="1;217pkt 217fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="194.120.80.161" src_port="1027"/>
    </slice>
    <from sec="1104556037" usec="0"/>
    <to sec="1104556074" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969718,1.59364,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_48{
style=filled;
color=gray75;
144[label="1.110.253.188s;112pkt 112fpkt", shape=rectangle, color=red];
261[label="1.110.253.188s;62pkt 62fpkt", shape=ellipse, color=green];
stat48[shape=component, label=&lt;Rules:&lt;BR/&gt;{1.110.253.188:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
144--261[label="1;62pkt 62fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="1.110.253.188" src_port="1025"/>
    </slice>
    <from sec="1104555654" usec="0"/>
    <to sec="1104555672" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969718,1.59364,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_49{
style=filled;
color=gray75;
145[label="210.155.185.190s;62pkt 62fpkt", shape=rectangle, color=red];
262[label="210.155.185.190s;62pkt 62fpkt", shape=ellipse, color=green];
stat49[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.155.185.190:1065, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1065: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
145--262[label="1;62pkt 62fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="210.155.185.190" src_port="1065"/>
    </slice>
    <from sec="1104555826" usec="0"/>
    <to sec="1104555835" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969718,1.59364,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_52{
style=filled;
color=gray75;
149[label="209.99.172.197s;242pkt 242fpkt", shape=rectangle, color=red];
265[label="209.99.172.197s;72pkt 72fpkt", shape=ellipse, color=green];
stat52[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.99.172.197:1033, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1033: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
149--265[label="1;72pkt 72fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="209.99.172.197" src_port="1033"/>
    </slice>
    <from sec="1104556262" usec="0"/>
    <to sec="1104556298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969718,1.59364,002,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_53{
style=filled;
color=gray75;
151[label="81.71.152.207s;62pkt 62fpkt", shape=rectangle, color=red];
267[label="81.71.152.207s;62pkt 62fpkt", shape=ellipse, color=green];
stat53[shape=component, label=&lt;Rules:&lt;BR/&gt;{81.71.152.207:1089, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1089: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
151--267[label="1;62pkt 62fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="81.71.152.207" src_port="1089"/>
    </slice>
    <from sec="1104555857" usec="0"/>
    <to sec="1104555866" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969718,1.59364,020,1 1 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_88{
style=filled;
color=gray75;
201[label="194.105.120.222d;254pkt 254fpkt", shape=rectangle, color=red];
309[label="194.105.120.222d;254pkt 254fpkt", shape=ellipse, color=green];
stat88[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 194.105.120.222:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
201--309[label="1;254pkt 254fpkt"];
</description>
    <slice>
      <filter dst_ip="194.105.120.222"/>
    </slice>
    <from sec="1104556370" usec="0"/>
    <to sec="1104556382" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.937442,1.65886,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="205.219.120.190" proto="icmp" src_ip="205.219.120.190"/>
      <filter dst_ip="205.219.120.190" proto="icmp" src_ip="205.219.120.190"/>
      <filter dst_ip="205.219.120.190" proto="icmp" src_ip="205.219.120.190"/>
      <filter dst_ip="205.219.120.190" proto="icmp" src_ip="205.219.120.190"/>
      <from sec="1104555936" usec="0"/>
      <to sec="1104556491" usec="0"/>
    </slice>
    <from sec="1104555936" usec="0"/>
    <to sec="1104556491" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677562,1.52895,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_95{
style=filled;
color=gray75;
388[label="140.10.30.126;d;3pkt 3fpkt", shape=diamond, color=yellow];
389[label="207.33.86.223;s;2pkt 2fpkt", shape=diamond, color=yellow];
2237[label="207.33.86.223;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2639[label="207.33.86.223;1pkt 1fpkt", shape=invtriangle, color=brown];
stat95[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.184.38.190:8000, 140.10.30.126:4000}[33.3333%]&lt;BR/&gt;{207.33.86.223:554, 140.10.30.126:2806}[33.3333%]&lt;BR/&gt;{207.33.86.223:9158, 140.10.30.126:6970}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2806: (25%)&lt;BR/&gt; 554: (25%)&lt;BR/&gt; 9158: (18.75%)&lt;BR/&gt; 6970: (18.75%)&lt;BR/&gt; 8000: (6.25%)&gt;];
}
388--389[label="1;2pkt 2fpkt"];
388--2237[label="1;2pkt 2fpkt"];
388--2639[label="1;1pkt 1fpkt"];
389--2237[label="1;2pkt 2fpkt"];
389--2639[label="1;1pkt 1fpkt"];
2237--2639[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="140.10.30.126" dst_port="6970" src_ip="207.33.86.223" src_port="9158"/>
      <filter dst_ip="140.10.30.126" dst_port="2806" src_ip="207.33.86.223" src_port="554"/>
      <filter dst_ip="140.10.30.126" dst_port="4000" src_ip="195.184.38.190" src_port="8000"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.806461,1.57258,503,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_97{
style=filled;
color=gray75;
27[label="149.222.132.87s;1pkt 1fpkt", shape=rectangle, color=red];
419[label="81.130.24.175;d;3pkt 3fpkt", shape=diamond, color=yellow];
420[label="149.222.132.87;s;66pkt 66fpkt", shape=diamond, color=yellow];
stat97[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.222.132.87:*, 194.113.179.245:80}[42.4242%]&lt;BR/&gt;{149.222.132.87:*, 194.113.179.196:80}[21.2121%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (45%)&lt;BR/&gt; 60752: (2.14286%)&lt;BR/&gt; 3502: (2.14286%)&lt;BR/&gt; 60760: (1.42857%)&lt;BR/&gt; 60754: (1.42857%)&gt;];
}
27--419[label="1;1pkt 1fpkt"];
27--420[label="1;1pkt 1fpkt"];
419--420[label="1;3pkt 3fpkt"];
420--969[label="0.0151515;1pkt 1fpkt"];
420--1653[label="0.0151515;1pkt 1fpkt"];
420--1669[label="0.0151515;1pkt 1fpkt"];
420--1670[label="0.0151515;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="194.113.179.245" dst_port="80" src_ip="149.222.132.87"/>
      <filter dst_ip="194.113.179.196" dst_port="80" src_ip="149.222.132.87"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104555950" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_99{
style=filled;
color=gray75;
421[label="194.163.58.135;d;10pkt 10fpkt", shape=diamond, color=yellow];
423[label="168.157.66.224;s;66pkt 66fpkt", shape=diamond, color=yellow];
stat99[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.157.66.224:*, 212.89.155.48:80}[31.8182%]&lt;BR/&gt;{168.157.66.224:*, 198.32.160.154:9000}[30.303%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (19.0789%)&lt;BR/&gt; 9000: (13.1579%)&lt;BR/&gt; 443: (1.97368%)&lt;BR/&gt; 44263: (1.31579%)&lt;BR/&gt; 44262: (1.31579%)&gt;];
}
421--423[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter dst_ip="212.89.155.48" dst_port="80" src_ip="168.157.66.224"/>
      <filter dst_ip="198.32.160.154" dst_port="9000" src_ip="168.157.66.224"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556403" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_100{
style=filled;
color=gray75;
458[label="147.181.23.155;s;11pkt 11fpkt", shape=diamond, color=yellow];
459[label="195.183.10.185;d;5pkt 5fpkt", shape=diamond, color=yellow];
stat100[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.181.23.155:80, 195.183.10.185:*}[45.4545%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 33323: (6.25%)&lt;BR/&gt; 33314: (6.25%)&lt;BR/&gt; 33262: (6.25%)&lt;BR/&gt; 33260: (6.25%)&gt;];
}
458--459[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="195.183.10.185" src_ip="147.181.23.155" src_port="80"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_104{
style=filled;
color=gray75;
513[label="192.242.184.147;s;1pkt 1fpkt", shape=diamond, color=yellow];
514[label="173.172.7.74;d;5pkt 5fpkt", shape=diamond, color=yellow];
stat104[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.242.184.147:873, 173.172.7.74:33508}[20%]&lt;BR/&gt;{81.1.62.229:43916, 173.172.7.74:80}[20%]&lt;BR/&gt;{81.1.62.229:44106, 173.172.7.74:80}[20%]&lt;BR/&gt;{81.1.62.229:44539, 173.172.7.74:80}[20%]&lt;BR/&gt;{81.1.62.229:45035, 173.172.7.74:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (33.3333%)&lt;BR/&gt; 33508: (16.6667%)&lt;BR/&gt; 873: (16.6667%)&lt;BR/&gt; 45035: (8.33333%)&lt;BR/&gt; 44539: (8.33333%)&gt;];
}
513--514[label="1;1pkt 1fpkt"];
514--1657[label="0.2;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="173.172.7.74" dst_port="80" src_ip="81.1.62.229" src_port="45035"/>
      <filter dst_ip="173.172.7.74" dst_port="80" src_ip="81.1.62.229" src_port="44539"/>
      <filter dst_ip="173.172.7.74" dst_port="80" src_ip="81.1.62.229" src_port="44106"/>
      <filter dst_ip="173.172.7.74" dst_port="80" src_ip="81.1.62.229" src_port="43916"/>
      <filter dst_ip="173.172.7.74" dst_port="33508" src_ip="192.242.184.147" src_port="873"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_106{
style=filled;
color=gray75;
551[label="209.241.217.198;s;7pkt 7fpkt", shape=diamond, color=yellow];
552[label="194.154.49.193;d;5pkt 5fpkt", shape=diamond, color=yellow];
stat106[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.241.217.198:554, 194.154.49.193:*}[28.5714%]&lt;BR/&gt;{209.241.217.198:1755, 194.154.49.193:*}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1755: (16.6667%)&lt;BR/&gt; 554: (16.6667%)&lt;BR/&gt; 17065: (8.33333%)&lt;BR/&gt; 17064: (8.33333%)&lt;BR/&gt; 17063: (8.33333%)&gt;];
}
551--552[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="194.154.49.193" src_ip="209.241.217.198" src_port="1755"/>
      <filter dst_ip="194.154.49.193" src_ip="209.241.217.198" src_port="554"/>
    </slice>
    <from sec="1104555613" usec="0"/>
    <to sec="1104555690" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.607286,1.55897,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_107{
style=filled;
color=gray75;
550[label="209.241.217.198;d;4pkt 4fpkt", shape=diamond, color=yellow];
553[label="194.154.49.193;s;4pkt 4fpkt", shape=diamond, color=yellow];
2160[label="194.154.49.193;4pkt 4fpkt", shape=pentagon, color=darkviolet];
stat107[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.154.49.193:17062, 209.241.217.198:554}[25%]&lt;BR/&gt;{194.154.49.193:17063, 209.241.217.198:554}[25%]&lt;BR/&gt;{194.154.49.193:17064, 209.241.217.198:1755}[25%]&lt;BR/&gt;{194.154.49.193:17065, 209.241.217.198:1755}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1755: (25%)&lt;BR/&gt; 554: (25%)&lt;BR/&gt; 17065: (12.5%)&lt;BR/&gt; 17064: (12.5%)&lt;BR/&gt; 17063: (12.5%)&gt;];
}
550--553[label="1;4pkt 4fpkt"];
550--2160[label="1;4pkt 4fpkt"];
553--2160[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="209.241.217.198" dst_port="1755" src_ip="194.154.49.193" src_port="17065"/>
      <filter dst_ip="209.241.217.198" dst_port="1755" src_ip="194.154.49.193" src_port="17064"/>
      <filter dst_ip="209.241.217.198" dst_port="554" src_ip="194.154.49.193" src_port="17063"/>
      <filter dst_ip="209.241.217.198" dst_port="554" src_ip="194.154.49.193" src_port="17062"/>
    </slice>
    <from sec="1104555613" usec="0"/>
    <to sec="1104555691" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_108{
style=filled;
color=gray75;
565[label="168.157.20.20;d;3pkt 3fpkt", shape=diamond, color=yellow];
566[label="209.130.165.104;s;3pkt 3fpkt", shape=diamond, color=yellow];
stat108[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.130.165.104:37508, 168.157.20.20:80}[33.3333%]&lt;BR/&gt;{209.130.165.104:37577, 168.157.20.20:80}[33.3333%]&lt;BR/&gt;{209.130.165.104:37635, 168.157.20.20:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 37635: (16.6667%)&lt;BR/&gt; 37577: (16.6667%)&lt;BR/&gt; 37508: (16.6667%)&gt;];
}
565--566[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="168.157.20.20" dst_port="80" src_ip="209.130.165.104" src_port="37635"/>
      <filter dst_ip="168.157.20.20" dst_port="80" src_ip="209.130.165.104" src_port="37577"/>
      <filter dst_ip="168.157.20.20" dst_port="80" src_ip="209.130.165.104" src_port="37508"/>
    </slice>
    <from sec="1104555659" usec="0"/>
    <to sec="1104555706" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.921787,1.54294,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_109{
style=filled;
color=gray75;
443[label="140.10.195.76;d;3pkt 3fpkt", shape=diamond, color=yellow];
583[label="194.71.162.219;s;3pkt 3fpkt", shape=diamond, color=yellow];
1386[label="140.10.195.76;d;3pkt 3fpkt", shape=hexagon, color=black];
1482[label="194.71.162.219;s;3pkt 3fpkt", shape=hexagon, color=black];
2227[label="194.71.162.219;3pkt 3fpkt", shape=pentagon, color=darkviolet];
stat109[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.71.162.219:21, 140.10.195.76:3018}[33.3333%]&lt;BR/&gt;{194.71.162.219:50058, 140.10.195.76:3019}[33.3333%]&lt;BR/&gt;{194.71.162.219:50063, 140.10.195.76:3020}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 50063: (16.6667%)&lt;BR/&gt; 50058: (16.6667%)&lt;BR/&gt; 3020: (16.6667%)&lt;BR/&gt; 3019: (16.6667%)&lt;BR/&gt; 3018: (16.6667%)&gt;];
}
443--583[label="1;3pkt 3fpkt"];
443--1386[label="1;3pkt 3fpkt"];
443--1482[label="1;3pkt 3fpkt"];
443--2227[label="1;3pkt 3fpkt"];
583--1386[label="1;3pkt 3fpkt"];
583--1482[label="1;3pkt 3fpkt"];
583--2227[label="1;3pkt 3fpkt"];
1386--1482[label="1;3pkt 3fpkt"];
1386--2227[label="1;3pkt 3fpkt"];
1482--2227[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="140.10.195.76" dst_port="3020" src_ip="194.71.162.219" src_port="50063"/>
      <filter dst_ip="140.10.195.76" dst_port="3019" src_ip="194.71.162.219" src_port="50058"/>
      <filter dst_ip="140.10.195.76" dst_port="3018" src_ip="194.71.162.219" src_port="21"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.948206,1.6047,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_110{
style=filled;
color=gray75;
453[label="25.39.88.155;d;2152pkt 2152fpkt", shape=diamond, color=yellow];
590[label="25.39.88.155;s;2058pkt 2058fpkt", shape=diamond, color=yellow];
1447[label="25.39.88.155;s;1390pkt 1390fpkt", shape=hexagon, color=black];
stat110[shape=component, label=&lt;Rules:&lt;BR/&gt;{25.39.88.155:*, 25.39.88.155:*}[95.632%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (17.2143%)&lt;BR/&gt; 53: (3.76786%)&lt;BR/&gt; 139: (3.45536%)&lt;BR/&gt; 54881: (2.13393%)&lt;BR/&gt; 25: (1.97321%)&gt;];
}
453--590[label="1;2058pkt 2058fpkt"];
453--1447[label="1;1390pkt 1390fpkt"];
453--1638[label="0.00246457;4pkt 4fpkt"];
453--1639[label="0.0330379;41pkt 41fpkt"];
453--1650[label="0.00743494;16pkt 16fpkt"];
453--1653[label="0.0157993;34pkt 34fpkt"];
453--1654[label="0.010223;22pkt 22fpkt"];
453--1656[label="0.00185874;4pkt 4fpkt"];
453--1657[label="0.0139405;30pkt 30fpkt"];
453--1659[label="0.00246457;4pkt 4fpkt"];
453--1660[label="0.0330379;41pkt 41fpkt"];
453--1669[label="0.0199814;43pkt 43fpkt"];
453--1670[label="0.0157993;34pkt 34fpkt"];
453--1672[label="0.00246457;4pkt 4fpkt"];
453--1673[label="0.0330379;41pkt 41fpkt"];
453--1674[label="0.000591366;1pkt 1fpkt"];
590--1447[label="1;1390pkt 1390fpkt"];
590--1638[label="0.00246457;4pkt 4fpkt"];
590--1639[label="0.0330379;41pkt 41fpkt"];
590--1650[label="0.00777454;16pkt 16fpkt"];
590--1653[label="0.016035;33pkt 33fpkt"];
590--1654[label="0.01069;22pkt 22fpkt"];
590--1656[label="0.00194363;4pkt 4fpkt"];
590--1657[label="0.0131195;27pkt 27fpkt"];
590--1659[label="0.00246457;4pkt 4fpkt"];
590--1660[label="0.0330379;41pkt 41fpkt"];
590--1669[label="0.0208941;43pkt 43fpkt"];
590--1670[label="0.016035;33pkt 33fpkt"];
590--1672[label="0.00246457;4pkt 4fpkt"];
590--1673[label="0.0330379;41pkt 41fpkt"];
590--1674[label="0.000591366;1pkt 1fpkt"];
1447--1638[label="0.0028777;4pkt 4fpkt"];
1447--1639[label="0.0330379;41pkt 41fpkt"];
1447--1650[label="0.0115108;16pkt 16fpkt"];
1447--1653[label="0.0136691;19pkt 19fpkt"];
1447--1654[label="0.0107914;15pkt 15fpkt"];
1447--1656[label="0.00215827;3pkt 3fpkt"];
1447--1657[label="0.0028777;4pkt 4fpkt"];
1447--1659[label="0.0028777;4pkt 4fpkt"];
1447--1660[label="0.0330379;41pkt 41fpkt"];
1447--1669[label="0.0309353;43pkt 43fpkt"];
1447--1670[label="0.0136691;19pkt 19fpkt"];
1447--1672[label="0.0028777;4pkt 4fpkt"];
1447--1673[label="0.0330379;41pkt 41fpkt"];
1447--1674[label="0.000719424;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="25.39.88.155" src_ip="25.39.88.155"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.948206,1.6047,504,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_111{
style=filled;
color=gray75;
591[label="1.160.128.27;d;1pkt 1fpkt", shape=diamond, color=yellow];
592[label="173.172.9.255;s;6pkt 6fpkt", shape=diamond, color=yellow];
845[label="158.59.240.241;d;1pkt 1fpkt", shape=diamond, color=yellow];
1387[label="173.172.9.255;s;6pkt 6fpkt", shape=hexagon, color=black];
stat111[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.172.9.255:*, *:443}[66.6667%]&lt;BR/&gt;{173.172.9.255:443, *:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (50%)&lt;BR/&gt; 50796: (10.7143%)&lt;BR/&gt; 2667: (10.7143%)&lt;BR/&gt; 1502: (7.14286%)&lt;BR/&gt; 1156: (7.14286%)&gt;];
}
591--592[label="1;1pkt 1fpkt"];
591--1387[label="1;1pkt 1fpkt"];
592--845[label="1;1pkt 1fpkt"];
592--1387[label="1;6pkt 6fpkt"];
845--1387[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="173.172.9.255" src_port="443"/>
      <filter dst_port="443" src_ip="173.172.9.255"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969528,1.5126,999,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_112{
style=filled;
color=gray75;
601[label="208.214.248.101;d;1pkt 1fpkt", shape=diamond, color=yellow];
602[label="209.241.211.57;s;5pkt 5fpkt", shape=diamond, color=yellow];
1533[label="209.241.211.57;s;5pkt 5fpkt", shape=hexagon, color=black];
1853[label="209.241.211.57;5pkt 5fpkt", shape=pentagon, color=darkviolet];
2404[label="209.241.211.57;5pkt 5fpkt", shape=invtriangle, color=brown];
stat112[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.241.211.57:0, 212.64.253.1:0}[20%]&lt;BR/&gt;{209.241.211.57:873, 208.214.248.101:39478}[20%]&lt;BR/&gt;{209.241.211.57:0, 209.248.119.192:0}[20%]&lt;BR/&gt;{209.241.211.57:21, 214.35.97.7:51992}[20%]&lt;BR/&gt;{209.241.211.57:34962, 214.35.97.7:12201}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (38.0952%)&lt;BR/&gt; 39478: (11.9048%)&lt;BR/&gt; 873: (11.9048%)&lt;BR/&gt; 51992: (9.52381%)&lt;BR/&gt; 34962: (9.52381%)&gt;];
}
601--602[label="1;1pkt 1fpkt"];
601--1533[label="1;1pkt 1fpkt"];
601--1853[label="1;1pkt 1fpkt"];
601--2404[label="1;1pkt 1fpkt"];
602--1533[label="1;5pkt 5fpkt"];
602--1853[label="1;5pkt 5fpkt"];
602--2404[label="1;5pkt 5fpkt"];
1533--1853[label="1;5pkt 5fpkt"];
1533--2404[label="1;5pkt 5fpkt"];
1853--2404[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="214.35.97.7" dst_port="12201" src_ip="209.241.211.57" src_port="34962"/>
      <filter dst_ip="214.35.97.7" dst_port="51992" src_ip="209.241.211.57" src_port="21"/>
      <filter dst_ip="209.248.119.192" src_ip="209.241.211.57"/>
      <filter dst_ip="208.214.248.101" dst_port="39478" src_ip="209.241.211.57" src_port="873"/>
      <filter dst_ip="212.64.253.1" src_ip="209.241.211.57"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.806461,1.57258,011,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_113{
style=filled;
color=gray75;
159[label="198.204.42.248s;1405pkt 1405fpkt", shape=rectangle, color=red];
614[label="198.204.42.248;s;2954pkt 2954fpkt", shape=diamond, color=yellow];
stat113[shape=component, label=&lt;Rules:&lt;BR/&gt;{198.204.42.248:23, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 23: (50%)&lt;BR/&gt; 19275: (0.0573526%)&lt;BR/&gt; 49621: (0.0458821%)&lt;BR/&gt; 44233: (0.0458821%)&lt;BR/&gt; 41635: (0.0458821%)&gt;];
}
159--614[label="1;1405pkt 1405fpkt"];
</description>
    <slice>
      <filter src_ip="198.204.42.248" src_port="23"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556248" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="172.18.128.41"/>
      <from sec="1104556004" usec="0"/>
      <to sec="1104556089" usec="0"/>
    </slice>
    <from sec="1104556004" usec="0"/>
    <to sec="1104556089" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.948206,1.6047,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_117{
style=filled;
color=gray75;
439[label="149.223.96.31;s;1366pkt 1366fpkt", shape=diamond, color=yellow];
695[label="207.51.247.161;d;1357pkt 1357fpkt", shape=diamond, color=yellow];
1444[label="149.223.96.31;s;892pkt 892fpkt", shape=hexagon, color=black];
stat117[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.223.96.31:110, 207.51.247.161:*}[99.3411%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 110: (49.7925%)&lt;BR/&gt; 25: (0.0968188%)&lt;BR/&gt; 3987: (0.0691563%)&lt;BR/&gt; 1274: (0.0691563%)&lt;BR/&gt; 113: (0.055325%)&gt;];
}
439--695[label="1;1357pkt 1357fpkt"];
439--1444[label="1;892pkt 892fpkt"];
695--1444[label="0.993274;886pkt 886fpkt"];
</description>
    <slice>
      <filter dst_ip="207.51.247.161" src_ip="149.223.96.31" src_port="110"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.806461,1.57258,999,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_118{
style=filled;
color=gray75;
33[label="2.253.198.115s;1pkt 1fpkt", shape=rectangle, color=red];
702[label="147.103.8.133;d;117pkt 117fpkt", shape=diamond, color=yellow];
stat118[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 147.103.8.133:25}[82.906%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 35489: (0.847458%)&lt;BR/&gt; 59689: (0.423729%)&lt;BR/&gt; 59679: (0.423729%)&lt;BR/&gt; 57259: (0.423729%)&gt;];
}
33--702[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="147.103.8.133" dst_port="25"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.948206,1.6047,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_119{
style=filled;
color=gray75;
710[label="201.154.196.208;d;3pkt 3fpkt", shape=diamond, color=yellow];
711[label="168.157.38.70;s;3pkt 3fpkt", shape=diamond, color=yellow];
1488[label="168.157.38.70;s;3pkt 3fpkt", shape=hexagon, color=black];
stat119[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.157.38.70:0, 201.154.196.208:0}[33.3333%]&lt;BR/&gt;{168.157.38.70:4876, 201.154.196.208:1755}[33.3333%]&lt;BR/&gt;{168.157.38.70:4877, 201.154.196.208:1755}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1755: (33.3333%)&lt;BR/&gt; 0: (33.3333%)&lt;BR/&gt; 4877: (16.6667%)&lt;BR/&gt; 4876: (16.6667%)&gt;];
}
710--711[label="1;3pkt 3fpkt"];
710--1488[label="1;3pkt 3fpkt"];
711--1488[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="201.154.196.208" dst_port="1755" src_ip="168.157.38.70" src_port="4877"/>
      <filter dst_ip="201.154.196.208" dst_port="1755" src_ip="168.157.38.70" src_port="4876"/>
      <filter dst_ip="201.154.196.208" src_ip="168.157.38.70"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_120{
style=filled;
color=gray75;
714[label="173.172.0.200;s;5pkt 5fpkt", shape=diamond, color=yellow];
715[label="198.15.15.112;d;1pkt 1fpkt", shape=diamond, color=yellow];
1259[label="208.82.42.15;d;3pkt 3fpkt", shape=diamond, color=yellow];
stat120[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.172.0.200:25, 1.88.233.30:42508}[20%]&lt;BR/&gt;{173.172.0.200:80, 198.15.15.112:4325}[20%]&lt;BR/&gt;{173.172.0.200:80, 208.82.42.15:1909}[20%]&lt;BR/&gt;{173.172.0.200:80, 208.82.42.15:1910}[20%]&lt;BR/&gt;{173.172.0.200:80, 208.82.42.15:1912}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (44.4444%)&lt;BR/&gt; 4325: (11.1111%)&lt;BR/&gt; 1912: (11.1111%)&lt;BR/&gt; 1910: (11.1111%)&lt;BR/&gt; 1909: (11.1111%)&gt;];
}
714--715[label="1;1pkt 1fpkt"];
714--1259[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="208.82.42.15" dst_port="1912" src_ip="173.172.0.200" src_port="80"/>
      <filter dst_ip="208.82.42.15" dst_port="1910" src_ip="173.172.0.200" src_port="80"/>
      <filter dst_ip="208.82.42.15" dst_port="1909" src_ip="173.172.0.200" src_port="80"/>
      <filter dst_ip="198.15.15.112" dst_port="4325" src_ip="173.172.0.200" src_port="80"/>
      <filter dst_ip="1.88.233.30" dst_port="42508" src_ip="173.172.0.200" src_port="25"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,011,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_122{
style=filled;
color=gray75;
734[label="81.147.16.2;s;1811pkt 1811fpkt", shape=diamond, color=yellow];
stat122[shape=component, label=&lt;Rules:&lt;BR/&gt;{81.147.16.2:3389, *:*}[51.4633%]&lt;BR/&gt;{81.147.16.2:80, *:*}[48.5367%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3389: (25.7316%)&lt;BR/&gt; 80: (24.2684%)&lt;BR/&gt; 47222: (0.0828272%)&lt;BR/&gt; 36536: (0.0828272%)&lt;BR/&gt; 58431: (0.0552181%)&gt;];
}
734--1224[label="0.00358423;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="81.147.16.2" src_port="3389"/>
      <filter src_ip="81.147.16.2" src_port="80"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556422" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.948206,1.6047,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_123{
style=filled;
color=gray75;
620[label="149.223.109.164;s;22pkt 22fpkt", shape=diamond, color=yellow];
735[label="82.65.52.92;d;1pkt 1fpkt", shape=diamond, color=yellow];
1188[label="217.208.149.84;d;10pkt 10fpkt", shape=diamond, color=yellow];
1456[label="82.65.52.92;d;1pkt 1fpkt", shape=hexagon, color=black];
stat123[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.223.109.164:80, 217.208.149.84:*}[45.4545%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 18299: (4.41176%)&lt;BR/&gt; 49692: (2.94118%)&lt;BR/&gt; 49691: (2.94118%)&lt;BR/&gt; 49690: (2.94118%)&gt;];
}
620--735[label="1;1pkt 1fpkt"];
620--1188[label="1;10pkt 10fpkt"];
620--1456[label="1;1pkt 1fpkt"];
735--1456[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="217.208.149.84" src_ip="149.223.109.164" src_port="80"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.948206,1.6047,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_124{
style=filled;
color=gray75;
517[label="25.75.188.131;s;1085pkt 1085fpkt", shape=diamond, color=yellow];
737[label="170.103.226.11;d;1086pkt 1086fpkt", shape=diamond, color=yellow];
1423[label="25.75.188.131;s;1085pkt 1085fpkt", shape=hexagon, color=black];
stat124[shape=component, label=&lt;Rules:&lt;BR/&gt;{25.75.188.131:*, 170.103.226.11:1433}[99.9079%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1433: (49.9846%)&lt;BR/&gt; 22345: (0.0460688%)&lt;BR/&gt; 22339: (0.0460688%)&lt;BR/&gt; 22335: (0.0460688%)&lt;BR/&gt; 22328: (0.0460688%)&gt;];
}
517--737[label="1;1085pkt 1085fpkt"];
517--1423[label="1;1085pkt 1085fpkt"];
737--1423[label="1;1085pkt 1085fpkt"];
</description>
    <slice>
      <filter dst_ip="170.103.226.11" dst_port="1433" src_ip="25.75.188.131"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_125{
style=filled;
color=gray75;
753[label="209.241.209.50;s;187pkt 187fpkt", shape=diamond, color=yellow];
stat125[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.241.209.50:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
753--1123[label="0.00534759;1pkt 1fpkt"];
753--1217[label="0.00534759;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="209.241.209.50"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104555978" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.775227,1.5095,999,1 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_126{
style=filled;
color=gray75;
35[label="147.103.8.129s;2pkt 2fpkt", shape=rectangle, color=red];
767[label="147.103.8.129;s;175pkt 175fpkt", shape=diamond, color=yellow];
2006[label="147.103.8.129;184pkt 184fpkt", shape=pentagon, color=darkviolet];
stat126[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.103.8.129:*, *:25}[71.3514%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (38.7812%)&lt;BR/&gt; 110: (5.40166%)&lt;BR/&gt; 995: (3.60111%)&lt;BR/&gt; 113: (2.21607%)&lt;BR/&gt; 53853: (0.554017%)&gt;];
}
35--767[label="1;2pkt 2fpkt"];
35--2006[label="1;2pkt 2fpkt"];
767--1289[label="0.0508475;3pkt 3fpkt"];
767--2006[label="0.994286;174pkt 174fpkt"];
</description>
    <slice>
      <filter dst_port="25" src_ip="147.103.8.129"/>
    </slice>
    <from sec="1104555601" usec="0"/>
    <to sec="1104556482" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.948206,1.6047,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_127{
style=filled;
color=gray75;
722[label="209.241.208.152;s;146pkt 146fpkt", shape=diamond, color=yellow];
783[label="3.224.204.141;d;52pkt 52fpkt", shape=diamond, color=yellow];
1284[label="200.174.114.194;d;1pkt 1fpkt", shape=diamond, color=yellow];
1535[label="209.241.208.152;s;112pkt 112fpkt", shape=hexagon, color=black];
1596[label="200.174.114.194;d;1pkt 1fpkt", shape=hexagon, color=black];
stat127[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.241.208.152:80, 3.224.204.141:*}[35.6164%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (33.1731%)&lt;BR/&gt; 53: (12.6603%)&lt;BR/&gt; 0: (7.69231%)&lt;BR/&gt; 4753: (6.08974%)&lt;BR/&gt; 60909: (0.480769%)&gt;];
}
722--783[label="1;52pkt 52fpkt"];
722--1284[label="1;1pkt 1fpkt"];
722--1535[label="1;112pkt 112fpkt"];
722--1596[label="1;1pkt 1fpkt"];
722--1638[label="0.0136986;2pkt 2fpkt"];
722--1650[label="0.0136986;2pkt 2fpkt"];
722--1654[label="0.0136986;2pkt 2fpkt"];
722--1659[label="0.0136986;2pkt 2fpkt"];
722--1672[label="0.0136986;2pkt 2fpkt"];
783--1535[label="0.711538;37pkt 37fpkt"];
1284--1535[label="1;1pkt 1fpkt"];
1284--1596[label="1;1pkt 1fpkt"];
1535--1596[label="1;1pkt 1fpkt"];
1535--1638[label="0.0178571;2pkt 2fpkt"];
1535--1650[label="0.0178571;2pkt 2fpkt"];
1535--1659[label="0.0178571;2pkt 2fpkt"];
1535--1672[label="0.0178571;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="3.224.204.141" src_ip="209.241.208.152" src_port="80"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556427" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.948206,1.6047,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_128{
style=filled;
color=gray75;
799[label="96.57.98.232;d;8pkt 8fpkt", shape=diamond, color=yellow];
800[label="168.157.140.6;s;8pkt 8fpkt", shape=diamond, color=yellow];
1520[label="96.57.98.232;d;8pkt 8fpkt", shape=hexagon, color=black];
stat128[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.157.140.6:80, 96.57.98.232:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1866: (6.25%)&lt;BR/&gt; 1865: (6.25%)&lt;BR/&gt; 1864: (6.25%)&lt;BR/&gt; 1863: (6.25%)&gt;];
}
799--800[label="1;8pkt 8fpkt"];
799--1520[label="1;8pkt 8fpkt"];
800--1520[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="96.57.98.232" src_ip="168.157.140.6" src_port="80"/>
    </slice>
    <from sec="1104555650" usec="0"/>
    <to sec="1104556055" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.921787,1.54294,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_129{
style=filled;
color=gray75;
797[label="149.222.109.40;s;19pkt 19fpkt", shape=diamond, color=yellow];
805[label="5.22.11.75;d;1pkt 1fpkt", shape=diamond, color=yellow];
1472[label="5.22.11.75;d;1pkt 1fpkt", shape=hexagon, color=black];
1803[label="149.222.109.40;20pkt 20fpkt", shape=pentagon, color=darkviolet];
stat129[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.222.109.40:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 34338: (4.87805%)&lt;BR/&gt; 62907: (2.43902%)&lt;BR/&gt; 59674: (2.43902%)&lt;BR/&gt; 53192: (2.43902%)&gt;];
}
797--805[label="1;1pkt 1fpkt"];
797--1472[label="1;1pkt 1fpkt"];
797--1803[label="0.947368;18pkt 18fpkt"];
805--1472[label="1;1pkt 1fpkt"];
805--1803[label="1;1pkt 1fpkt"];
1472--1803[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="149.222.109.40" src_port="80"/>
    </slice>
    <from sec="1104555639" usec="0"/>
    <to sec="1104556373" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.948206,1.6047,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_130{
style=filled;
color=gray75;
471[label="149.222.103.73;s;1pkt 1fpkt", shape=diamond, color=yellow];
833[label="207.179.59.143;d;1pkt 1fpkt", shape=diamond, color=yellow];
1419[label="149.222.103.73;s;1pkt 1fpkt", shape=hexagon, color=black];
stat130[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.222.103.73:25403, 207.179.59.143:9553}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25403: (50%)&lt;BR/&gt; 9553: (50%)&gt;];
}
471--833[label="1;1pkt 1fpkt"];
471--1419[label="1;1pkt 1fpkt"];
833--1419[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="207.179.59.143" dst_port="9553" src_ip="149.222.103.73" src_port="25403"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.948206,1.6047,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_131{
style=filled;
color=gray75;
728[label="28.7.87.31;d;1pkt 1fpkt", shape=diamond, color=yellow];
847[label="149.223.90.225;s;19pkt 19fpkt", shape=diamond, color=yellow];
1493[label="28.7.87.31;d;1pkt 1fpkt", shape=hexagon, color=black];
stat131[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.223.90.225:*, 193.146.91.37:80}[21.0526%]&lt;BR/&gt;{149.223.90.225:*, 193.146.94.169:80}[21.0526%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (35.7143%)&lt;BR/&gt; 3802: (7.14286%)&lt;BR/&gt; 554: (7.14286%)&lt;BR/&gt; 1863: (4.7619%)&lt;BR/&gt; 64983: (2.38095%)&gt;];
}
728--847[label="1;1pkt 1fpkt"];
728--1493[label="1;1pkt 1fpkt"];
847--1493[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="193.146.94.169" dst_port="80" src_ip="149.223.90.225"/>
      <filter dst_ip="193.146.91.37" dst_port="80" src_ip="149.223.90.225"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969528,1.5126,999,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_132{
style=filled;
color=gray75;
757[label="81.5.242.77;s;2pkt 2fpkt", shape=diamond, color=yellow];
865[label="140.10.137.202;d;23pkt 23fpkt", shape=diamond, color=yellow];
1500[label="81.5.242.77;s;2pkt 2fpkt", shape=hexagon, color=black];
1903[label="81.5.242.77;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2435[label="81.5.242.77;1pkt 1fpkt", shape=invtriangle, color=brown];
stat132[shape=component, label=&lt;Rules:&lt;BR/&gt;{198.32.160.154:9000, 140.10.137.202:*}[78.2609%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9000: (31.0345%)&lt;BR/&gt; 12321: (8.62069%)&lt;BR/&gt; 4707: (8.62069%)&lt;BR/&gt; 12320: (5.17241%)&lt;BR/&gt; 4604: (5.17241%)&gt;];
}
757--865[label="1;2pkt 2fpkt"];
757--1500[label="1;2pkt 2fpkt"];
757--1903[label="1;1pkt 1fpkt"];
757--2435[label="1;1pkt 1fpkt"];
865--1500[label="1;2pkt 2fpkt"];
865--1903[label="1;1pkt 1fpkt"];
865--2435[label="1;1pkt 1fpkt"];
1500--1903[label="1;1pkt 1fpkt"];
1500--2435[label="1;1pkt 1fpkt"];
1903--2435[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="140.10.137.202" src_ip="198.32.160.154" src_port="9000"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556327" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_133{
style=filled;
color=gray75;
815[label="149.223.90.157;s;132pkt 132fpkt", shape=diamond, color=yellow];
922[label="150.95.1.24;d;126pkt 126fpkt", shape=diamond, color=yellow];
stat133[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.223.90.157:*, 150.95.1.24:80}[95.4545%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1217: (0.387597%)&lt;BR/&gt; 1216: (0.387597%)&lt;BR/&gt; 1215: (0.387597%)&lt;BR/&gt; 1214: (0.387597%)&gt;];
}
815--922[label="1;126pkt 126fpkt"];
815--1653[label="0.0151515;2pkt 2fpkt"];
815--1669[label="0.0227273;3pkt 3fpkt"];
815--1670[label="0.0151515;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="150.95.1.24" dst_port="80" src_ip="149.223.90.157"/>
    </slice>
    <from sec="1104555846" usec="0"/>
    <to sec="1104556165" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="173.172.57.129"/>
      <from sec="1104555600" usec="0"/>
      <to sec="1104556421" usec="0"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556421" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="147.7.174.34"/>
      <from sec="1104555600" usec="0"/>
      <to sec="1104556428" usec="0"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="194.27.42.13"/>
      <from sec="1104555600" usec="0"/>
      <to sec="1104556427" usec="0"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556427" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_137{
style=filled;
color=gray75;
584[label="147.103.215.228;s;138pkt 138fpkt", shape=diamond, color=yellow];
1020[label="28.178.33.121;d;68pkt 68fpkt", shape=diamond, color=yellow];
stat137[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.103.215.228:80, 28.178.33.121:*}[49.2754%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.7864%)&lt;BR/&gt; 0: (0.970874%)&lt;BR/&gt; 47047: (0.485437%)&lt;BR/&gt; 47046: (0.485437%)&lt;BR/&gt; 47044: (0.485437%)&gt;];
}
584--1020[label="1;68pkt 68fpkt"];
584--1639[label="0.0217391;3pkt 3fpkt"];
584--1660[label="0.0217391;3pkt 3fpkt"];
584--1673[label="0.0217391;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="28.178.33.121" src_ip="147.103.215.228" src_port="80"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556414" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_138{
style=filled;
color=gray75;
1031[label="192.168.128.255;d;1pkt 1fpkt", shape=diamond, color=yellow];
1032[label="149.223.244.5;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat138[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.223.244.5:4445, 192.168.128.255:4445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4445: (100%)&gt;];
}
1031--1032[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="192.168.128.255" dst_port="4445" src_ip="149.223.244.5" src_port="4445"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="149.223.208.96"/>
      <from sec="1104555601" usec="0"/>
      <to sec="1104556376" usec="0"/>
    </slice>
    <from sec="1104555601" usec="0"/>
    <to sec="1104556376" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="195.219.68.226"/>
      <from sec="1104555601" usec="0"/>
      <to sec="1104556422" usec="0"/>
    </slice>
    <from sec="1104555601" usec="0"/>
    <to sec="1104556422" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_142{
style=filled;
color=gray75;
1089[label="147.181.114.71;d;124pkt 124fpkt", shape=diamond, color=yellow];
1093[label="194.113.179.234;s;31pkt 31fpkt", shape=diamond, color=yellow];
stat142[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.113.179.230:80, 147.181.114.71:*}[50.8065%]&lt;BR/&gt;{194.113.179.234:80, 147.181.114.71:*}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1806: (0.645161%)&lt;BR/&gt; 1805: (0.645161%)&lt;BR/&gt; 1803: (0.645161%)&lt;BR/&gt; 1797: (0.645161%)&gt;];
}
1089--1093[label="1;31pkt 31fpkt"];
</description>
    <slice>
      <filter dst_ip="147.181.114.71" src_ip="194.113.179.230" src_port="80"/>
      <filter dst_ip="147.181.114.71" src_ip="194.113.179.234" src_port="80"/>
    </slice>
    <from sec="1104555753" usec="0"/>
    <to sec="1104555999" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="96.154.178.127"/>
      <from sec="1104555806" usec="0"/>
      <to sec="1104556412" usec="0"/>
    </slice>
    <from sec="1104555806" usec="0"/>
    <to sec="1104556412" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="209.241.214.98"/>
      <from sec="1104555600" usec="0"/>
      <to sec="1104556428" usec="0"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_146{
style=filled;
color=gray75;
1025[label="217.98.225.182;s;5pkt 5fpkt", shape=diamond, color=yellow];
1128[label="173.172.33.66;d;2pkt 2fpkt", shape=diamond, color=yellow];
stat146[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.98.225.182:*, 173.172.45.13:*}[33.3333%]&lt;BR/&gt;{*:*, 173.172.33.66:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6664: (14.2857%)&lt;BR/&gt; 3054: (14.2857%)&lt;BR/&gt; 41665: (7.14286%)&lt;BR/&gt; 6667: (7.14286%)&lt;BR/&gt; 6663: (7.14286%)&gt;];
}
1025--1128[label="0.5;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="173.172.33.66"/>
      <filter dst_ip="173.172.45.13" src_ip="217.98.225.182"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.607286,1.55897,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_147{
style=filled;
color=gray75;
1024[label="217.98.225.182;d;5pkt 5fpkt", shape=diamond, color=yellow];
1129[label="173.172.33.66;s;2pkt 2fpkt", shape=diamond, color=yellow];
1720[label="173.172.9.14;2pkt 2fpkt", shape=pentagon, color=darkviolet];
stat147[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.172.45.13:*, 217.98.225.182:*}[28.5714%]&lt;BR/&gt;{*:*, *:5050}[28.5714%]&lt;BR/&gt;{173.172.9.14:*, *:*}[28.5714%]&lt;BR/&gt;{173.172.33.66:*, *:*}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 41665: (11.1111%)&lt;BR/&gt; 6667: (11.1111%)&lt;BR/&gt; 6664: (11.1111%)&lt;BR/&gt; 5050: (11.1111%)&lt;BR/&gt; 3054: (11.1111%)&gt;];
}
1024--1129[label="0.5;1pkt 1fpkt"];
1024--1720[label="0.5;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="173.172.33.66"/>
      <filter src_ip="173.172.9.14"/>
      <filter dst_port="5050"/>
      <filter dst_ip="217.98.225.182" src_ip="173.172.45.13"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556474" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_148{
style=filled;
color=gray75;
1140[label="209.241.213.70;s;472pkt 472fpkt", shape=diamond, color=yellow];
stat148[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.241.213.70:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1140--1217[label="0.00492611;1pkt 1fpkt"];
1140--1453[label="0.00251889;1pkt 1fpkt"];
1140--1571[label="0.00318471;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="209.241.213.70"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="140.10.19.190"/>
      <from sec="1104555601" usec="0"/>
      <to sec="1104556338" usec="0"/>
    </slice>
    <from sec="1104555601" usec="0"/>
    <to sec="1104556338" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_150{
style=filled;
color=gray75;
1163[label="168.157.246.218;s;69pkt 69fpkt", shape=diamond, color=yellow];
stat150[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.157.246.218:25, *:*}[79.7101%]&lt;BR/&gt;{168.157.246.218:*, *:25}[20.2899%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 63380: (0.724638%)&lt;BR/&gt; 61116: (0.724638%)&lt;BR/&gt; 60807: (0.724638%)&lt;BR/&gt; 60384: (0.724638%)&gt;];
}
</description>
    <slice>
      <filter src_ip="168.157.246.218" src_port="25"/>
      <filter dst_port="25" src_ip="168.157.246.218"/>
    </slice>
    <from sec="1104555606" usec="0"/>
    <to sec="1104556248" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.607286,1.55897,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_151{
style=filled;
color=gray75;
1118[label="28.178.33.121;s;60pkt 60fpkt", shape=diamond, color=yellow];
1203[label="147.103.215.228;d;76pkt 76fpkt", shape=diamond, color=yellow];
1708[label="216.223.121.9;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2033[label="28.178.34.139;6pkt 6fpkt", shape=pentagon, color=darkviolet];
stat151[shape=component, label=&lt;Rules:&lt;BR/&gt;{28.178.33.121:*, 147.103.215.228:80}[89.4737%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 64253: (0.694444%)&lt;BR/&gt; 64090: (0.694444%)&lt;BR/&gt; 59444: (0.694444%)&lt;BR/&gt; 59441: (0.694444%)&gt;];
}
1118--1203[label="1;60pkt 60fpkt"];
1118--1639[label="0.0833333;5pkt 5fpkt"];
1118--1653[label="0.0166667;1pkt 1fpkt"];
1118--1660[label="0.0833333;5pkt 5fpkt"];
1118--1670[label="0.0166667;1pkt 1fpkt"];
1118--1673[label="0.0833333;5pkt 5fpkt"];
1203--1639[label="0.0657895;5pkt 5fpkt"];
1203--1653[label="0.0131579;1pkt 1fpkt"];
1203--1657[label="0.0263158;2pkt 2fpkt"];
1203--1660[label="0.0657895;5pkt 5fpkt"];
1203--1670[label="0.0131579;1pkt 1fpkt"];
1203--1673[label="0.0657895;5pkt 5fpkt"];
1203--1708[label="1;2pkt 2fpkt"];
1203--2033[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="147.103.215.228" dst_port="80" src_ip="28.178.33.121"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556414" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="194.66.199.26"/>
      <from sec="1104555600" usec="0"/>
      <to sec="1104556426" usec="0"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556426" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.806461,1.57258,999,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_153{
style=filled;
color=gray75;
209[label="209.241.211.41s;1pkt 1fpkt", shape=rectangle, color=red];
1218[label="209.241.211.41;s;27pkt 27fpkt", shape=diamond, color=yellow];
stat153[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.241.211.41:25, *:*}[88.8889%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (44.6429%)&lt;BR/&gt; 443: (5.35714%)&lt;BR/&gt; 1888: (3.57143%)&lt;BR/&gt; 54448: (1.78571%)&lt;BR/&gt; 53230: (1.78571%)&gt;];
}
209--1218[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="209.241.211.41" src_port="25"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_154{
style=filled;
color=gray75;
1229[label="4.4.5.32;d;19pkt 19fpkt", shape=diamond, color=yellow];
1230[label="149.222.0.38;s;20pkt 20fpkt", shape=diamond, color=yellow];
stat154[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.222.0.38:*, 4.4.5.32:1717}[95%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1717: (48.7179%)&lt;BR/&gt; 65517: (2.5641%)&lt;BR/&gt; 65516: (2.5641%)&lt;BR/&gt; 65515: (2.5641%)&lt;BR/&gt; 65514: (2.5641%)&gt;];
}
1229--1230[label="1;19pkt 19fpkt"];
</description>
    <slice>
      <filter dst_ip="4.4.5.32" dst_port="1717" src_ip="149.222.0.38"/>
    </slice>
    <from sec="1104555605" usec="0"/>
    <to sec="1104556424" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.959275,1.4634,999,1 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_155{
style=filled;
color=gray75;
90[label="209.241.211.122s;50pkt 50fpkt", shape=rectangle, color=red];
1255[label="209.241.211.122;s;121pkt 121fpkt", shape=diamond, color=yellow];
1264[label="200.123.107.98;d;61pkt 61fpkt", shape=diamond, color=yellow];
1996[label="209.241.211.122;122pkt 122fpkt", shape=pentagon, color=darkviolet];
2489[label="209.241.211.122;123pkt 123fpkt", shape=invtriangle, color=brown];
2798[label="209.241.211.122;122pkt 122fpkt", shape=invhouse, color=bisque];
stat155[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.241.211.122:*, 200.123.107.98:25}[49.5935%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (40.9015%)&lt;BR/&gt; 53: (7.09516%)&lt;BR/&gt; 44650: (5.50918%)&lt;BR/&gt; 113: (1.33556%)&lt;BR/&gt; 123: (0.66778%)&gt;];
}
90--1255[label="1;50pkt 50fpkt"];
90--1264[label="1;50pkt 50fpkt"];
90--1996[label="1;50pkt 50fpkt"];
90--2489[label="1;50pkt 50fpkt"];
90--2798[label="1;50pkt 50fpkt"];
1255--1264[label="1;61pkt 61fpkt"];
1255--1996[label="0.991736;120pkt 120fpkt"];
1255--2489[label="1;121pkt 121fpkt"];
1255--2798[label="0.991736;120pkt 120fpkt"];
1264--1996[label="1;61pkt 61fpkt"];
1264--2489[label="1;61pkt 61fpkt"];
1264--2798[label="1;61pkt 61fpkt"];
1996--2489[label="1;122pkt 122fpkt"];
1996--2798[label="1;122pkt 122fpkt"];
2489--2798[label="1;122pkt 122fpkt"];
</description>
    <slice>
      <filter dst_ip="200.123.107.98" dst_port="25" src_ip="209.241.211.122"/>
    </slice>
    <from sec="1104555651" usec="0"/>
    <to sec="1104556490" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="220.37.158.20"/>
      <from sec="1104555604" usec="0"/>
      <to sec="1104556428" usec="0"/>
    </slice>
    <from sec="1104555604" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="5.34.218.208"/>
      <from sec="1104555798" usec="0"/>
      <to sec="1104556428" usec="0"/>
    </slice>
    <from sec="1104555798" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.646683,1.62012,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="168.157.33.49"/>
      <from sec="1104556228" usec="0"/>
      <to sec="1104556428" usec="0"/>
    </slice>
    <from sec="1104556228" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.921787,1.54294,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_159{
style=filled;
color=gray75;
557[label="140.10.6.7;d;402pkt 402fpkt", shape=diamond, color=yellow];
561[label="204.65.67.88;s;58pkt 58fpkt", shape=diamond, color=yellow];
917[label="213.71.140.96;s;39pkt 39fpkt", shape=diamond, color=yellow];
1365[label="204.65.67.88;s;38pkt 38fpkt", shape=hexagon, color=black];
1948[label="213.71.140.96;47pkt 47fpkt", shape=pentagon, color=darkviolet];
stat159[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.71.137.26:*, 140.10.6.7:*}[72.2772%]&lt;BR/&gt;{*:80, 140.10.6.7:*}[27.2277%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (25%)&lt;BR/&gt; 5000: (0.342466%)&lt;BR/&gt; 2312: (0.342466%)&lt;BR/&gt; 2311: (0.342466%)&lt;BR/&gt; 2310: (0.342466%)&gt;];
}
557--561[label="1;58pkt 58fpkt"];
557--652[label="0.02;4pkt 4fpkt"];
557--917[label="1;39pkt 39fpkt"];
557--1365[label="1;38pkt 38fpkt"];
557--1948[label="0.957447;45pkt 45fpkt"];
561--1365[label="1;38pkt 38fpkt"];
917--1948[label="0.974359;38pkt 38fpkt"];
</description>
    <slice>
      <filter dst_ip="140.10.6.7" src_ip="213.71.137.26"/>
      <filter dst_ip="140.10.6.7" src_port="80"/>
    </slice>
    <from sec="1104555617" usec="0"/>
    <to sec="1104556455" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.85763,1.64134,999,0 0 0 0 1 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="172.18.128.41"/>
      <from sec="1104556004" usec="0"/>
      <to sec="1104556068" usec="0"/>
    </slice>
    <from sec="1104556004" usec="0"/>
    <to sec="1104556068" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.948206,1.6047,010,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_161{
style=filled;
color=gray75;
617[label="81.147.67.172;s;882pkt 882fpkt", shape=diamond, color=yellow];
1392[label="81.147.67.172;s;684pkt 684fpkt", shape=hexagon, color=black];
stat161[shape=component, label=&lt;Rules:&lt;BR/&gt;{81.147.67.172:7000, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7000: (50%)&lt;BR/&gt; 39030: (0.127714%)&lt;BR/&gt; 19276: (0.127714%)&lt;BR/&gt; 11299: (0.127714%)&lt;BR/&gt; 4354: (0.127714%)&gt;];
}
617--1392[label="1;684pkt 684fpkt"];
</description>
    <slice>
      <filter src_ip="81.147.67.172" src_port="7000"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556427" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.948206,1.6047,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_163{
style=filled;
color=gray75;
659[label="149.223.81.230;s;85pkt 85fpkt", shape=diamond, color=yellow];
1431[label="149.223.81.230;s;68pkt 68fpkt", shape=hexagon, color=black];
stat163[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.223.81.230:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4189: (1.30719%)&lt;BR/&gt; 57059: (0.653595%)&lt;BR/&gt; 55190: (0.653595%)&lt;BR/&gt; 48267: (0.653595%)&gt;];
}
659--1431[label="1;68pkt 68fpkt"];
</description>
    <slice>
      <filter src_ip="149.223.81.230" src_port="80"/>
    </slice>
    <from sec="1104555611" usec="0"/>
    <to sec="1104556349" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.948206,1.6047,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_166{
style=filled;
color=gray75;
454[label="147.103.8.133;s;161pkt 161fpkt", shape=diamond, color=yellow];
1448[label="147.103.8.133;s;96pkt 96fpkt", shape=hexagon, color=black];
stat166[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.103.8.133:25, *:*}[86.9565%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 4027: (0.77821%)&lt;BR/&gt; 59689: (0.389105%)&lt;BR/&gt; 59679: (0.389105%)&lt;BR/&gt; 57259: (0.389105%)&gt;];
}
454--1448[label="1;96pkt 96fpkt"];
</description>
    <slice>
      <filter src_ip="147.103.8.133" src_port="25"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.921787,1.54294,020,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_167{
style=filled;
color=gray75;
709[label="209.241.209.59;s;321pkt 321fpkt", shape=diamond, color=yellow];
1451[label="209.241.209.59;s;318pkt 318fpkt", shape=hexagon, color=black];
1860[label="209.241.209.59;2pkt 2fpkt", shape=pentagon, color=darkviolet];
stat167[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.241.209.59:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
709--1451[label="1;318pkt 318fpkt"];
709--1860[label="1;2pkt 2fpkt"];
1451--1860[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_ip="209.241.209.59"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.948206,1.6047,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_168{
style=filled;
color=gray75;
866[label="149.222.60.12;s;229pkt 229fpkt", shape=diamond, color=yellow];
1462[label="149.222.60.12;s;212pkt 212fpkt", shape=hexagon, color=black];
stat168[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.222.60.12:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
866--1462[label="1;212pkt 212fpkt"];
</description>
    <slice>
      <filter src_ip="149.222.60.12"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.948206,1.6047,011,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_170{
style=filled;
color=gray75;
957[label="198.1.143.44;s;519pkt 519fpkt", shape=diamond, color=yellow];
1499[label="198.1.143.44;s;358pkt 358fpkt", shape=hexagon, color=black];
stat170[shape=component, label=&lt;Rules:&lt;BR/&gt;{198.1.143.44:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 12407: (0.22805%)&lt;BR/&gt; 54309: (0.171038%)&lt;BR/&gt; 65130: (0.114025%)&lt;BR/&gt; 65125: (0.114025%)&gt;];
}
957--1499[label="1;358pkt 358fpkt"];
</description>
    <slice>
      <filter src_ip="198.1.143.44" src_port="80"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.921787,1.54294,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_171{
style=filled;
color=gray75;
696[label="209.241.213.0;s;46pkt 46fpkt", shape=diamond, color=yellow];
697[label="81.1.62.227;d;30pkt 30fpkt", shape=diamond, color=yellow];
803[label="149.223.217.235;s;29pkt 29fpkt", shape=diamond, color=yellow];
983[label="216.200.27.62;d;1pkt 1fpkt", shape=diamond, color=yellow];
1521[label="149.223.217.235;s;27pkt 27fpkt", shape=hexagon, color=black];
1684[label="209.241.213.0;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2013[label="147.181.23.131;20pkt 20fpkt", shape=pentagon, color=darkviolet];
stat171[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.241.213.0:80, 81.1.62.227:*}[29.1262%]&lt;BR/&gt;{149.223.217.235:80, *:*}[29.1262%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.4516%)&lt;BR/&gt; 0: (5.80645%)&lt;BR/&gt; 35281: (0.967742%)&lt;BR/&gt; 60514: (0.645161%)&lt;BR/&gt; 59430: (0.645161%)&gt;];
}
696--697[label="0.733333;22pkt 22fpkt"];
696--983[label="1;1pkt 1fpkt"];
696--1684[label="0.5;1pkt 1fpkt"];
697--803[label="0.0344828;1pkt 1fpkt"];
697--1521[label="0.037037;1pkt 1fpkt"];
697--2013[label="0.05;1pkt 1fpkt"];
803--1521[label="0.962963;26pkt 26fpkt"];
</description>
    <slice>
      <filter src_ip="149.223.217.235" src_port="80"/>
      <filter dst_ip="81.1.62.227" src_ip="209.241.213.0" src_port="80"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.948206,1.6047,011,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_172{
style=filled;
color=gray75;
832[label="81.147.67.135;s;10pkt 10fpkt", shape=diamond, color=yellow];
1532[label="81.147.67.135;s;10pkt 10fpkt", shape=hexagon, color=black];
stat172[shape=component, label=&lt;Rules:&lt;BR/&gt;{81.147.67.135:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 29699: (5%)&lt;BR/&gt; 27649: (5%)&lt;BR/&gt; 24776: (5%)&lt;BR/&gt; 19904: (5%)&gt;];
}
832--1532[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter src_ip="81.147.67.135" src_port="80"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.948206,1.6047,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_173{
style=filled;
color=gray75;
951[label="149.223.241.17;d;19pkt 19fpkt", shape=diamond, color=yellow];
1534[label="149.223.241.17;d;19pkt 19fpkt", shape=hexagon, color=black];
stat173[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 149.223.241.17:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 26418: (5.26316%)&lt;BR/&gt; 26374: (5.26316%)&lt;BR/&gt; 80: (5.26316%)&lt;BR/&gt; 26475: (2.63158%)&lt;BR/&gt; 26451: (2.63158%)&gt;];
}
951--1534[label="1;19pkt 19fpkt"];
</description>
    <slice>
      <filter dst_ip="149.223.241.17"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969528,1.5126,999,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_174{
style=filled;
color=gray75;
1046[label="192.216.238.40;d;3pkt 3fpkt", shape=diamond, color=yellow];
1546[label="192.216.238.40;d;3pkt 3fpkt", shape=hexagon, color=black];
2088[label="149.223.17.160;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2546[label="149.223.17.160;3pkt 3fpkt", shape=invtriangle, color=brown];
stat174[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.103.168.182:17886, 192.216.238.40:6667}[25%]&lt;BR/&gt;{149.223.17.160:36831, 1.246.138.163:8080}[25%]&lt;BR/&gt;{149.223.17.160:36834, 192.216.238.40:6667}[25%]&lt;BR/&gt;{149.223.17.160:36860, 192.216.238.40:6667}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (45.4545%)&lt;BR/&gt; 36860: (18.1818%)&lt;BR/&gt; 36834: (18.1818%)&lt;BR/&gt; 17886: (9.09091%)&lt;BR/&gt; 36831: (4.54545%)&gt;];
}
1046--1546[label="1;3pkt 3fpkt"];
1046--2088[label="1;2pkt 2fpkt"];
1046--2546[label="0.666667;2pkt 2fpkt"];
1546--2088[label="1;2pkt 2fpkt"];
1546--2546[label="0.666667;2pkt 2fpkt"];
2088--2546[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="192.216.238.40" dst_port="6667" src_ip="149.223.17.160" src_port="36860"/>
      <filter dst_ip="192.216.238.40" dst_port="6667" src_ip="149.223.17.160" src_port="36834"/>
      <filter dst_ip="1.246.138.163" dst_port="8080" src_ip="149.223.17.160" src_port="36831"/>
      <filter dst_ip="192.216.238.40" dst_port="6667" src_ip="147.103.168.182" src_port="17886"/>
    </slice>
    <from sec="1104555601" usec="0"/>
    <to sec="1104556483" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.948206,1.6047,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_175{
style=filled;
color=gray75;
665[label="140.10.29.37;d;54pkt 54fpkt", shape=diamond, color=yellow];
682[label="207.171.124.21;s;1pkt 1fpkt", shape=diamond, color=yellow];
813[label="196.149.138.157;s;3pkt 3fpkt", shape=diamond, color=yellow];
1381[label="140.10.29.37;d;13pkt 13fpkt", shape=hexagon, color=black];
1563[label="196.149.138.157;s;3pkt 3fpkt", shape=hexagon, color=black];
stat175[shape=component, label=&lt;Rules:&lt;BR/&gt;{198.32.134.66:80, 140.10.29.37:*}[24.0741%]&lt;BR/&gt;{198.32.134.64:80, 140.10.29.37:*}[20.3704%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (31.0811%)&lt;BR/&gt; 1755: (4.72973%)&lt;BR/&gt; 5257: (4.05405%)&lt;BR/&gt; 10002: (2.7027%)&lt;BR/&gt; 8688: (2.7027%)&gt;];
}
665--682[label="1;1pkt 1fpkt"];
665--813[label="1;3pkt 3fpkt"];
665--1381[label="1;13pkt 13fpkt"];
665--1563[label="1;3pkt 3fpkt"];
682--1381[label="1;1pkt 1fpkt"];
813--1563[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="140.10.29.37" src_ip="198.32.134.66" src_port="80"/>
      <filter dst_ip="140.10.29.37" src_ip="198.32.134.64" src_port="80"/>
    </slice>
    <from sec="1104555631" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.948206,1.6047,011,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_177{
style=filled;
color=gray75;
1005[label="81.155.17.30;s;894pkt 894fpkt", shape=diamond, color=yellow];
1565[label="81.155.17.30;s;894pkt 894fpkt", shape=hexagon, color=black];
stat177[shape=component, label=&lt;Rules:&lt;BR/&gt;{81.155.17.30:7000, *:1024}[51.566%]&lt;BR/&gt;{81.155.17.30:7000, *:3072}[48.434%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7000: (50%)&lt;BR/&gt; 1024: (25.783%)&lt;BR/&gt; 3072: (24.217%)&gt;];
}
1005--1038[label="0.0044843;1pkt 1fpkt"];
1005--1565[label="1;894pkt 894fpkt"];
</description>
    <slice>
      <filter dst_port="1024" src_ip="81.155.17.30" src_port="7000"/>
      <filter dst_port="3072" src_ip="81.155.17.30" src_port="7000"/>
    </slice>
    <from sec="1104555991" usec="0"/>
    <to sec="1104556127" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_180{
style=filled;
color=gray75;
1941[label="147.103.6.92;42pkt 42fpkt", shape=pentagon, color=darkviolet];
2456[label="147.103.6.92;41pkt 41fpkt", shape=invtriangle, color=brown];
2776[label="147.103.6.92;42pkt 42fpkt", shape=invhouse, color=bisque];
stat180[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.103.6.92:*, 3.234.189.47:80}[64.2857%]&lt;BR/&gt;{147.103.6.92:*, 115.32.187.21:80}[26.1905%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 49437: (1.2%)&lt;BR/&gt; 49436: (1.2%)&lt;BR/&gt; 49431: (1.2%)&lt;BR/&gt; 49430: (1.2%)&gt;];
}
1941--2456[label="1;41pkt 41fpkt"];
1941--2776[label="1;42pkt 42fpkt"];
2456--2776[label="1;41pkt 41fpkt"];
</description>
    <slice>
      <filter dst_ip="3.234.189.47" dst_port="80" src_ip="147.103.6.92"/>
      <filter dst_ip="115.32.187.21" dst_port="80" src_ip="147.103.6.92"/>
    </slice>
    <from sec="1104555732" usec="0"/>
    <to sec="1104556114" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.185.145.0"/>
    </slice>
    <from sec="1104556271" usec="0"/>
    <to sec="1104556450" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="149.222.153.1"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.144.244.1"/>
    </slice>
    <from sec="1104556289" usec="0"/>
    <to sec="1104556302" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.10.41.2"/>
    </slice>
    <from sec="1104555652" usec="0"/>
    <to sec="1104556470" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="81.230.72.2"/>
    </slice>
    <from sec="1104555603" usec="0"/>
    <to sec="1104555943" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.171.179.2"/>
    </slice>
    <from sec="1104555607" usec="0"/>
    <to sec="1104556499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="193.11.182.2"/>
    </slice>
    <from sec="1104555675" usec="0"/>
    <to sec="1104556450" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="1.147.23.3"/>
    </slice>
    <from sec="1104555603" usec="0"/>
    <to sec="1104555884" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.829474,1.51438,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_197{
style=filled;
color=gray75;
792[label="149.223.17.5;s;11pkt 11fpkt", shape=diamond, color=yellow];
1261[label="2.141.33.128;d;9pkt 9fpkt", shape=diamond, color=yellow];
1699[label="149.223.17.5;18pkt 18fpkt", shape=pentagon, color=darkviolet];
2314[label="149.223.17.5;18pkt 18fpkt", shape=invtriangle, color=brown];
2689[label="149.223.17.5;18pkt 18fpkt", shape=invhouse, color=bisque];
stat197[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.223.17.5:*, 2.141.33.128:7070}[73.6842%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7070: (49.3243%)&lt;BR/&gt; 1985: (3.37838%)&lt;BR/&gt; 1961: (3.37838%)&lt;BR/&gt; 1957: (3.37838%)&lt;BR/&gt; 1955: (3.37838%)&gt;];
}
792--1261[label="0.888889;8pkt 8fpkt"];
792--1699[label="1;11pkt 11fpkt"];
792--2314[label="1;11pkt 11fpkt"];
792--2689[label="1;11pkt 11fpkt"];
1261--1699[label="0.888889;8pkt 8fpkt"];
1261--2314[label="0.888889;8pkt 8fpkt"];
1261--2689[label="0.888889;8pkt 8fpkt"];
1699--2314[label="1;18pkt 18fpkt"];
1699--2689[label="1;18pkt 18fpkt"];
2314--2689[label="1;18pkt 18fpkt"];
</description>
    <slice>
      <filter dst_ip="2.141.33.128" dst_port="7070" src_ip="149.223.17.5"/>
    </slice>
    <from sec="1104555618" usec="0"/>
    <to sec="1104556482" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="0.43.11.11"/>
    </slice>
    <from sec="1104555610" usec="0"/>
    <to sec="1104556498" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="24.226.162.13"/>
    </slice>
    <from sec="1104555651" usec="0"/>
    <to sec="1104556497" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="82.218.253.14"/>
    </slice>
    <from sec="1104555630" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="168.157.93.19"/>
    </slice>
    <from sec="1104555617" usec="0"/>
    <to sec="1104556482" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.214.154.19"/>
    </slice>
    <from sec="1104556111" usec="0"/>
    <to sec="1104556162" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.661371,1.5484,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_203{
style=filled;
color=gray75;
103[label="196.98.102.20s;107pkt 107fpkt", shape=rectangle, color=red];
1746[label="196.98.102.20;152pkt 152fpkt", shape=pentagon, color=darkviolet];
stat203[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.98.102.20:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
103--1746[label="1;107pkt 107fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="196.98.102.20" src_port="1027"/>
    </slice>
    <from sec="1104556329" usec="0"/>
    <to sec="1104556345" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="81.162.11.26"/>
    </slice>
    <from sec="1104555604" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677562,1.52895,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_205{
style=filled;
color=gray75;
1325[label="149.222.108.26;s;58pkt 58fpkt", shape=diamond, color=yellow];
1762[label="149.222.108.26;58pkt 58fpkt", shape=pentagon, color=darkviolet];
2350[label="149.222.108.26;57pkt 57fpkt", shape=invtriangle, color=brown];
stat205[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.222.108.26:*, *:80}[60.3448%]&lt;BR/&gt;{149.222.108.26:33463, *:*}[34.4828%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (30.3468%)&lt;BR/&gt; 33463: (17.052%)&lt;BR/&gt; 48381: (1.7341%)&lt;BR/&gt; 90: (1.7341%)&lt;BR/&gt; 63965: (0.867052%)&gt;];
}
1325--1762[label="1;58pkt 58fpkt"];
1325--2350[label="1;57pkt 57fpkt"];
1762--2350[label="1;57pkt 57fpkt"];
</description>
    <slice>
      <filter src_ip="149.222.108.26" src_port="33463"/>
      <filter dst_port="80" src_ip="149.222.108.26"/>
    </slice>
    <from sec="1104555719" usec="0"/>
    <to sec="1104556434" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.607286,1.55897,020,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_206{
style=filled;
color=gray75;
1122[label="209.241.209.59;d;128pkt 128fpkt", shape=diamond, color=yellow];
1764[label="215.57.218.26;16pkt 16fpkt", shape=pentagon, color=darkviolet];
stat206[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 209.241.209.59:0}[89.5105%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1122--1764[label="0.0625;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="209.241.209.59"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="5.152.187.28"/>
    </slice>
    <from sec="1104555677" usec="0"/>
    <to sec="1104556450" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.183.150.29"/>
    </slice>
    <from sec="1104555601" usec="0"/>
    <to sec="1104555685" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677562,1.52895,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_209{
style=filled;
color=gray75;
749[label="208.176.177.29;s;948pkt 948fpkt", shape=diamond, color=yellow];
1771[label="208.176.177.29;1039pkt 1039fpkt", shape=pentagon, color=darkviolet];
2356[label="208.176.177.29;1038pkt 1038fpkt", shape=invtriangle, color=brown];
stat209[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.176.177.29:53, *:*}[99.3269%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (55.9174%)&lt;BR/&gt; 32768: (1.91736%)&lt;BR/&gt; 9253: (1.10744%)&lt;BR/&gt; 32769: (0.909091%)&lt;BR/&gt; 33701: (0.77686%)&gt;];
}
749--1638[label="0.00632911;6pkt 6fpkt"];
749--1650[label="0.0105485;10pkt 10fpkt"];
749--1654[label="0.0706751;67pkt 67fpkt"];
749--1656[label="0.00316456;3pkt 3fpkt"];
749--1659[label="0.00632911;6pkt 6fpkt"];
749--1672[label="0.00632911;6pkt 6fpkt"];
749--1771[label="0.998945;947pkt 947fpkt"];
749--2356[label="0.99789;946pkt 946fpkt"];
1771--2356[label="1;1038pkt 1038fpkt"];
</description>
    <slice>
      <filter src_ip="208.176.177.29" src_port="53"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="96.192.240.29"/>
    </slice>
    <from sec="1104555601" usec="0"/>
    <to sec="1104556216" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="206.211.200.34"/>
    </slice>
    <from sec="1104556330" usec="0"/>
    <to sec="1104556359" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.87.152.36"/>
    </slice>
    <from sec="1104556475" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="147.103.8.37"/>
    </slice>
    <from sec="1104555618" usec="0"/>
    <to sec="1104556485" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.829474,1.51438,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_214{
style=filled;
color=gray75;
975[label="149.223.116.38;s;23pkt 23fpkt", shape=diamond, color=yellow];
1797[label="149.223.116.38;35pkt 35fpkt", shape=pentagon, color=darkviolet];
2372[label="149.223.116.38;35pkt 35fpkt", shape=invtriangle, color=brown];
2729[label="149.223.116.38;35pkt 35fpkt", shape=invhouse, color=bisque];
stat214[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.223.116.38:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 60833: (1.5625%)&lt;BR/&gt; 59513: (1.5625%)&lt;BR/&gt; 58081: (1.5625%)&lt;BR/&gt; 58018: (1.5625%)&gt;];
}
975--1797[label="1;23pkt 23fpkt"];
975--2372[label="1;23pkt 23fpkt"];
975--2729[label="1;23pkt 23fpkt"];
1797--2372[label="1;35pkt 35fpkt"];
1797--2729[label="1;35pkt 35fpkt"];
2372--2729[label="1;35pkt 35fpkt"];
</description>
    <slice>
      <filter src_ip="149.223.116.38" src_port="80"/>
    </slice>
    <from sec="1104555604" usec="0"/>
    <to sec="1104556499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.607286,1.55897,011,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_215{
style=filled;
color=gray75;
867[label="197.77.144.38;s;9pkt 9fpkt", shape=diamond, color=yellow];
1798[label="197.77.144.38;8pkt 8fpkt", shape=pentagon, color=darkviolet];
stat215[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.77.144.38:8022, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8022: (50%)&lt;BR/&gt; 29699: (5.88235%)&lt;BR/&gt; 24776: (5.88235%)&lt;BR/&gt; 16422: (5.88235%)&lt;BR/&gt; 9777: (5.88235%)&gt;];
}
867--1798[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter src_ip="197.77.144.38" src_port="8022"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="207.10.242.40"/>
    </slice>
    <from sec="1104555958" usec="0"/>
    <to sec="1104556019" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.103.19.42"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="173.172.22.42"/>
    </slice>
    <from sec="1104555603" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="147.181.44.43"/>
    </slice>
    <from sec="1104555802" usec="0"/>
    <to sec="1104556421" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.607286,1.55897,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_220{
style=filled;
color=gray75;
479[label="219.95.126.142;d;2704pkt 2704fpkt", shape=diamond, color=yellow];
858[label="140.10.77.116;d;1721pkt 1721fpkt", shape=diamond, color=yellow];
1820[label="195.190.90.45;9pkt 9fpkt", shape=pentagon, color=darkviolet];
stat220[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 219.95.126.142:34132}[59.0056%]&lt;BR/&gt;{*:*, 140.10.77.116:35357}[37.8305%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 34132: (29.5332%)&lt;BR/&gt; 35357: (18.8881%)&lt;BR/&gt; 443: (0.67659%)&lt;BR/&gt; 80: (0.67659%)&lt;BR/&gt; 0: (0.338295%)&gt;];
}
479--1639[label="0.00805802;10pkt 10fpkt"];
479--1653[label="0.00594354;16pkt 16fpkt"];
479--1655[label="0.0020202;1pkt 1fpkt"];
479--1657[label="0.00443787;12pkt 12fpkt"];
479--1660[label="0.00805802;10pkt 10fpkt"];
479--1669[label="0.00628698;17pkt 17fpkt"];
479--1670[label="0.00594354;16pkt 16fpkt"];
479--1673[label="0.00805802;10pkt 10fpkt"];
479--1820[label="0.888889;8pkt 8fpkt"];
858--1639[label="0.00241741;3pkt 3fpkt"];
858--1653[label="0.000581058;1pkt 1fpkt"];
858--1660[label="0.00241741;3pkt 3fpkt"];
858--1670[label="0.000581058;1pkt 1fpkt"];
858--1673[label="0.00241741;3pkt 3fpkt"];
858--1820[label="0.111111;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="219.95.126.142" dst_port="34132"/>
      <filter dst_ip="140.10.77.116" dst_port="35357"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.20.130.46"/>
    </slice>
    <from sec="1104555601" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.138.93.50"/>
    </slice>
    <from sec="1104555914" usec="0"/>
    <to sec="1104556499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.128.87.52"/>
    </slice>
    <from sec="1104556214" usec="0"/>
    <to sec="1104556260" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_225{
style=filled;
color=gray75;
1838[label="168.198.27.53;58pkt 58fpkt", shape=pentagon, color=darkviolet];
stat225[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.198.27.53:*, *:6129}[65.5172%]&lt;BR/&gt;{168.198.27.53:*, *:1433}[25.8621%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6129: (32.7586%)&lt;BR/&gt; 1433: (12.931%)&lt;BR/&gt; 80: (4.31034%)&lt;BR/&gt; 36023: (0.862069%)&lt;BR/&gt; 36022: (0.862069%)&gt;];
}
</description>
    <slice>
      <filter dst_port="6129" src_ip="168.198.27.53"/>
      <filter dst_port="1433" src_ip="168.198.27.53"/>
    </slice>
    <from sec="1104555626" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="82.8.123.53"/>
    </slice>
    <from sec="1104555658" usec="0"/>
    <to sec="1104556075" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.241.211.54"/>
    </slice>
    <from sec="1104555639" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.607286,1.55897,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_228{
style=filled;
color=gray75;
1044[label="212.89.57.8;d;53pkt 53fpkt", shape=diamond, color=yellow];
1844[label="208.176.136.55;17pkt 17fpkt", shape=pentagon, color=darkviolet];
stat228[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.176.136.54:80, 212.89.57.8:*}[66.1017%]&lt;BR/&gt;{208.176.136.55:80, 212.89.57.8:*}[22.0339%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.2857%)&lt;BR/&gt; 46542: (1.42857%)&lt;BR/&gt; 42967: (1.42857%)&lt;BR/&gt; 42269: (1.42857%)&lt;BR/&gt; 42081: (1.42857%)&gt;];
}
1044--1844[label="0.647059;11pkt 11fpkt"];
</description>
    <slice>
      <filter dst_ip="212.89.57.8" src_ip="208.176.136.54" src_port="80"/>
      <filter dst_ip="212.89.57.8" src_ip="208.176.136.55" src_port="80"/>
    </slice>
    <from sec="1104555601" usec="0"/>
    <to sec="1104556490" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="207.100.63.58"/>
    </slice>
    <from sec="1104555613" usec="0"/>
    <to sec="1104556499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="82.112.43.60"/>
    </slice>
    <from sec="1104555651" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="96.118.35.63"/>
    </slice>
    <from sec="1104555615" usec="0"/>
    <to sec="1104556499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_232{
style=filled;
color=gray75;
1867[label="208.186.144.64;34pkt 34fpkt", shape=pentagon, color=darkviolet];
stat232[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.186.144.64:80, *:*}[88.2353%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (45.5882%)&lt;BR/&gt; 8080: (4.41176%)&lt;BR/&gt; 55353: (1.47059%)&lt;BR/&gt; 55291: (1.47059%)&lt;BR/&gt; 55100: (1.47059%)&gt;];
}
</description>
    <slice>
      <filter src_ip="208.186.144.64" src_port="80"/>
    </slice>
    <from sec="1104555604" usec="0"/>
    <to sec="1104556441" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.75.69.68"/>
    </slice>
    <from sec="1104555607" usec="0"/>
    <to sec="1104556499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="149.222.103.73"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.68.73.74"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="168.157.41.80"/>
    </slice>
    <from sec="1104555896" usec="0"/>
    <to sec="1104556338" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.157.154.81"/>
    </slice>
    <from sec="1104555601" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.829474,1.51438,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_239{
style=filled;
color=gray75;
913[label="147.131.122.83;s;1105pkt 1105fpkt", shape=diamond, color=yellow];
1228[label="1.137.66.126;d;122pkt 122fpkt", shape=diamond, color=yellow];
1724[label="147.103.8.15;20pkt 20fpkt", shape=pentagon, color=darkviolet];
1750[label="149.223.119.22;87pkt 87fpkt", shape=pentagon, color=darkviolet];
1919[label="147.131.122.83;1170pkt 1170fpkt", shape=pentagon, color=darkviolet];
2000[label="149.222.104.124;39pkt 39fpkt", shape=pentagon, color=darkviolet];
2445[label="147.131.122.83;1169pkt 1169fpkt", shape=invtriangle, color=brown];
2772[label="147.131.122.83;1169pkt 1169fpkt", shape=invhouse, color=bisque];
stat239[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.131.122.83:*, *:53}[83.5507%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (46.64%)&lt;BR/&gt; 2703: (3.11412%)&lt;BR/&gt; 80: (0.194632%)&lt;BR/&gt; 4839: (0.163901%)&lt;BR/&gt; 3273: (0.163901%)&gt;];
}
913--1228[label="0.0491803;6pkt 6fpkt"];
913--1650[label="0.0615385;68pkt 68fpkt"];
913--1656[label="0.0190045;21pkt 21fpkt"];
913--1919[label="1;1105pkt 1105fpkt"];
913--2445[label="0.999095;1104pkt 1104fpkt"];
913--2772[label="0.999095;1104pkt 1104fpkt"];
1228--1724[label="0.5;10pkt 10fpkt"];
1228--1750[label="0.436782;38pkt 38fpkt"];
1228--1919[label="0.0491803;6pkt 6fpkt"];
1228--2000[label="0.102564;4pkt 4fpkt"];
1228--2445[label="0.0491803;6pkt 6fpkt"];
1228--2772[label="0.0491803;6pkt 6fpkt"];
1919--2445[label="1;1169pkt 1169fpkt"];
1919--2772[label="1;1169pkt 1169fpkt"];
2445--2772[label="1;1169pkt 1169fpkt"];
</description>
    <slice>
      <filter dst_port="53" src_ip="147.131.122.83"/>
    </slice>
    <from sec="1104555603" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="149.223.139.84"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="173.172.49.90"/>
    </slice>
    <from sec="1104555613" usec="0"/>
    <to sec="1104556456" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.607286,1.55897,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_243{
style=filled;
color=gray75;
876[label="208.176.177.91;s;333pkt 333fpkt", shape=diamond, color=yellow];
1939[label="208.176.177.91;397pkt 397fpkt", shape=pentagon, color=darkviolet];
stat243[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.176.177.91:53, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (56.4384%)&lt;BR/&gt; 32768: (1.64384%)&lt;BR/&gt; 32769: (0.958904%)&lt;BR/&gt; 33701: (0.821918%)&lt;BR/&gt; 32771: (0.821918%)&gt;];
}
876--1638[label="0.00600601;2pkt 2fpkt"];
876--1650[label="0.024024;8pkt 8fpkt"];
876--1654[label="0.0780781;26pkt 26fpkt"];
876--1656[label="0.018018;6pkt 6fpkt"];
876--1659[label="0.00600601;2pkt 2fpkt"];
876--1672[label="0.00600601;2pkt 2fpkt"];
876--1939[label="0.996997;332pkt 332fpkt"];
</description>
    <slice>
      <filter src_ip="208.176.177.91" src_port="53"/>
    </slice>
    <from sec="1104555601" usec="0"/>
    <to sec="1104556497" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.145.217.91"/>
    </slice>
    <from sec="1104555604" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.829474,1.51438,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_245{
style=filled;
color=gray75;
1081[label="168.157.35.181;d;89pkt 89fpkt", shape=diamond, color=yellow];
1328[label="207.98.129.92;s;39pkt 39fpkt", shape=diamond, color=yellow];
1942[label="207.98.129.92;38pkt 38fpkt", shape=pentagon, color=darkviolet];
2457[label="207.98.129.92;39pkt 39fpkt", shape=invtriangle, color=brown];
2777[label="207.98.129.92;38pkt 38fpkt", shape=invhouse, color=bisque];
stat245[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.98.129.92:80, 168.157.35.181:*}[39.7959%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.7942%)&lt;BR/&gt; 1546: (1.02881%)&lt;BR/&gt; 1544: (1.02881%)&lt;BR/&gt; 1540: (1.02881%)&lt;BR/&gt; 1538: (1.02881%)&gt;];
}
1081--1328[label="0.769231;30pkt 30fpkt"];
1081--1942[label="0.763158;29pkt 29fpkt"];
1081--2457[label="0.769231;30pkt 30fpkt"];
1081--2777[label="0.763158;29pkt 29fpkt"];
1328--1942[label="1;38pkt 38fpkt"];
1328--2457[label="1;39pkt 39fpkt"];
1328--2777[label="1;38pkt 38fpkt"];
1942--2457[label="1;38pkt 38fpkt"];
1942--2777[label="1;38pkt 38fpkt"];
2457--2777[label="1;38pkt 38fpkt"];
</description>
    <slice>
      <filter dst_ip="168.157.35.181" src_ip="207.98.129.92" src_port="80"/>
    </slice>
    <from sec="1104555622" usec="0"/>
    <to sec="1104556418" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="81.130.147.92"/>
    </slice>
    <from sec="1104555602" usec="0"/>
    <to sec="1104556447" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="149.222.109.93"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.139.56.95"/>
    </slice>
    <from sec="1104555794" usec="0"/>
    <to sec="1104556122" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="1.137.66.103"/>
    </slice>
    <from sec="1104555621" usec="0"/>
    <to sec="1104556487" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.65.110.106"/>
    </slice>
    <from sec="1104555601" usec="0"/>
    <to sec="1104556065" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.94.22.107"/>
    </slice>
    <from sec="1104555946" usec="0"/>
    <to sec="1104555996" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.180.52.107"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.157.187.107"/>
    </slice>
    <from sec="1104555625" usec="0"/>
    <to sec="1104556498" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="80.53.43.110"/>
    </slice>
    <from sec="1104555618" usec="0"/>
    <to sec="1104556498" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.11.77.110"/>
    </slice>
    <from sec="1104555658" usec="0"/>
    <to sec="1104555724" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="5.137.84.110"/>
    </slice>
    <from sec="1104555613" usec="0"/>
    <to sec="1104556499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.607286,1.55897,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_257{
style=filled;
color=gray75;
857[label="4.47.87.253;d;2pkt 2fpkt", shape=diamond, color=yellow];
1978[label="173.172.58.111;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat257[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.172.22.42:1170, 4.47.87.253:6667}[50%]&lt;BR/&gt;{173.172.58.111:2047, 4.47.87.253:6667}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (50%)&lt;BR/&gt; 2047: (33.3333%)&lt;BR/&gt; 1170: (16.6667%)&gt;];
}
857--1978[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="4.47.87.253" dst_port="6667" src_ip="173.172.58.111" src_port="2047"/>
      <filter dst_ip="4.47.87.253" dst_port="6667" src_ip="173.172.22.42" src_port="1170"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,011,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.73.18.116"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.91.98.118"/>
    </slice>
    <from sec="1104555629" usec="0"/>
    <to sec="1104556489" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.214.162.118"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.115.231.120"/>
    </slice>
    <from sec="1104555609" usec="0"/>
    <to sec="1104556497" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.20.92.121"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="2.105.200.123"/>
    </slice>
    <from sec="1104555632" usec="0"/>
    <to sec="1104556480" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.27.14.125"/>
    </slice>
    <from sec="1104555613" usec="0"/>
    <to sec="1104556490" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.213.195.126"/>
    </slice>
    <from sec="1104555619" usec="0"/>
    <to sec="1104556480" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969528,1.5126,999,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_266{
style=filled;
color=gray75;
881[label="219.94.235.128;s;631pkt 631fpkt", shape=diamond, color=yellow];
1467[label="219.94.235.128;s;365pkt 365fpkt", shape=hexagon, color=black];
2005[label="219.94.235.128;674pkt 674fpkt", shape=pentagon, color=darkviolet];
2494[label="219.94.235.128;675pkt 675fpkt", shape=invtriangle, color=brown];
stat266[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.94.235.128:53, *:*}[95.5556%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (52.3881%)&lt;BR/&gt; 25: (2.06823%)&lt;BR/&gt; 32768: (1.85501%)&lt;BR/&gt; 9253: (1.53518%)&lt;BR/&gt; 32769: (1.00213%)&gt;];
}
881--1467[label="1;365pkt 365fpkt"];
881--1638[label="0.0110935;7pkt 7fpkt"];
881--1650[label="0.00316957;2pkt 2fpkt"];
881--1654[label="0.0475436;30pkt 30fpkt"];
881--1656[label="0.00158479;1pkt 1fpkt"];
881--1659[label="0.0110935;7pkt 7fpkt"];
881--1672[label="0.0110935;7pkt 7fpkt"];
881--2005[label="0.998415;630pkt 630fpkt"];
881--2494[label="1;631pkt 631fpkt"];
1467--1638[label="0.0191781;7pkt 7fpkt"];
1467--1650[label="0.00547945;2pkt 2fpkt"];
1467--1654[label="0.0164384;6pkt 6fpkt"];
1467--1656[label="0.00273973;1pkt 1fpkt"];
1467--1659[label="0.0191781;7pkt 7fpkt"];
1467--1672[label="0.0191781;7pkt 7fpkt"];
1467--2005[label="0.99726;364pkt 364fpkt"];
1467--2494[label="1;365pkt 365fpkt"];
2005--2494[label="1;674pkt 674fpkt"];
</description>
    <slice>
      <filter src_ip="219.94.235.128" src_port="53"/>
    </slice>
    <from sec="1104555602" usec="0"/>
    <to sec="1104556499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="2.14.1.131"/>
    </slice>
    <from sec="1104555614" usec="0"/>
    <to sec="1104556482" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="5.179.46.131"/>
    </slice>
    <from sec="1104555601" usec="0"/>
    <to sec="1104556490" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.175.38.133"/>
    </slice>
    <from sec="1104555611" usec="0"/>
    <to sec="1104556496" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="96.176.87.134"/>
    </slice>
    <from sec="1104555620" usec="0"/>
    <to sec="1104556494" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="29.81.54.141"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.11.20.144"/>
    </slice>
    <from sec="1104555602" usec="0"/>
    <to sec="1104556498" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.829474,1.51438,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_273{
style=filled;
color=gray75;
435[label="206.27.121.108;s;47pkt 47fpkt", shape=diamond, color=yellow];
436[label="168.157.66.147;d;418pkt 418fpkt", shape=diamond, color=yellow];
928[label="194.113.156.133;s;10pkt 10fpkt", shape=diamond, color=yellow];
1103[label="207.200.27.83;s;11pkt 11fpkt", shape=diamond, color=yellow];
1104[label="194.100.44.144;s;3pkt 3fpkt", shape=diamond, color=yellow];
1768[label="81.129.88.29;18pkt 18fpkt", shape=pentagon, color=darkviolet];
1829[label="3.69.226.49;189pkt 189fpkt", shape=pentagon, color=darkviolet];
1898[label="81.150.93.76;4pkt 4fpkt", shape=pentagon, color=darkviolet];
1917[label="207.200.27.83;11pkt 11fpkt", shape=pentagon, color=darkviolet];
2016[label="194.113.156.131;10pkt 10fpkt", shape=pentagon, color=darkviolet];
2045[label="194.100.44.144;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2110[label="206.27.121.168;17pkt 17fpkt", shape=pentagon, color=darkviolet];
2112[label="206.27.121.169;6pkt 6fpkt", shape=pentagon, color=darkviolet];
2184[label="81.148.13.203;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2354[label="81.129.88.29;18pkt 18fpkt", shape=invtriangle, color=brown];
2431[label="81.150.93.76;5pkt 5fpkt", shape=invtriangle, color=brown];
2517[label="194.100.44.144;2pkt 2fpkt", shape=invtriangle, color=brown];
2565[label="206.27.121.168;17pkt 17fpkt", shape=invtriangle, color=brown];
2611[label="81.148.13.203;4pkt 4fpkt", shape=invtriangle, color=brown];
2719[label="81.129.88.29;18pkt 18fpkt", shape=invhouse, color=bisque];
2842[label="206.27.121.168;17pkt 17fpkt", shape=invhouse, color=bisque];
stat273[shape=component, label=&lt;Rules:&lt;BR/&gt;{3.69.226.49:80, 168.157.66.147:*}[32.7022%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1898: (0.240964%)&lt;BR/&gt; 1855: (0.240964%)&lt;BR/&gt; 1820: (0.240964%)&lt;BR/&gt; 1816: (0.240964%)&gt;];
}
435--436[label="1;47pkt 47fpkt"];
436--928[label="1;10pkt 10fpkt"];
436--1103[label="1;11pkt 11fpkt"];
436--1104[label="1;3pkt 3fpkt"];
436--1768[label="1;18pkt 18fpkt"];
436--1829[label="0.153439;29pkt 29fpkt"];
436--1898[label="1;4pkt 4fpkt"];
436--1917[label="1;11pkt 11fpkt"];
436--2016[label="0.8;8pkt 8fpkt"];
436--2045[label="1;2pkt 2fpkt"];
436--2110[label="1;17pkt 17fpkt"];
436--2112[label="1;6pkt 6fpkt"];
436--2184[label="1;3pkt 3fpkt"];
436--2354[label="1;18pkt 18fpkt"];
436--2431[label="1;5pkt 5fpkt"];
436--2517[label="1;2pkt 2fpkt"];
436--2565[label="1;17pkt 17fpkt"];
436--2611[label="0.75;3pkt 3fpkt"];
436--2719[label="1;18pkt 18fpkt"];
436--2842[label="1;17pkt 17fpkt"];
1103--1917[label="1;11pkt 11fpkt"];
1104--2045[label="1;2pkt 2fpkt"];
1104--2517[label="1;2pkt 2fpkt"];
1768--2354[label="1;18pkt 18fpkt"];
1768--2719[label="1;18pkt 18fpkt"];
1898--2431[label="1;4pkt 4fpkt"];
2045--2517[label="1;2pkt 2fpkt"];
2110--2565[label="1;17pkt 17fpkt"];
2110--2842[label="1;17pkt 17fpkt"];
2184--2611[label="1;3pkt 3fpkt"];
2354--2719[label="1;18pkt 18fpkt"];
2565--2842[label="1;17pkt 17fpkt"];
</description>
    <slice>
      <filter dst_ip="168.157.66.147" src_ip="3.69.226.49" src_port="80"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556484" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="149.223.102.146"/>
    </slice>
    <from sec="1104555622" usec="0"/>
    <to sec="1104556481" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.241.208.146"/>
    </slice>
    <from sec="1104555604" usec="0"/>
    <to sec="1104556489" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.607286,1.55897,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_276{
style=filled;
color=gray75;
559[label="147.103.232.147;s;57pkt 57fpkt", shape=diamond, color=yellow];
2058[label="147.103.232.147;59pkt 59fpkt", shape=pentagon, color=darkviolet];
stat276[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.103.232.147:53, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (59.4828%)&lt;BR/&gt; 32768: (1.72414%)&lt;BR/&gt; 65356: (0.862069%)&lt;BR/&gt; 61876: (0.862069%)&lt;BR/&gt; 61781: (0.862069%)&gt;];
}
559--1654[label="0.0350877;2pkt 2fpkt"];
559--2058[label="0.964912;55pkt 55fpkt"];
</description>
    <slice>
      <filter src_ip="147.103.232.147" src_port="53"/>
    </slice>
    <from sec="1104555622" usec="0"/>
    <to sec="1104556483" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="3.69.200.148"/>
    </slice>
    <from sec="1104555712" usec="0"/>
    <to sec="1104555733" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.726434,1.51817,002,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_279{
style=filled;
color=gray75;
137[label="194.5.13.154s;104pkt 104fpkt", shape=rectangle, color=red];
2070[label="194.5.13.154;103pkt 103fpkt", shape=pentagon, color=darkviolet];
2533[label="194.5.13.154;103pkt 103fpkt", shape=invtriangle, color=brown];
stat279[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.5.13.154:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
137--2070[label="1;103pkt 103fpkt"];
137--2533[label="1;103pkt 103fpkt"];
2070--2533[label="1;103pkt 103fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="194.5.13.154" src_port="1027"/>
    </slice>
    <from sec="1104555774" usec="0"/>
    <to sec="1104555793" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="81.133.14.155"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="81.133.204.156"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="147.181.23.157"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="81.206.176.158"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.829474,1.51438,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_284{
style=filled;
color=gray75;
1333[label="168.157.36.160;s;86pkt 86fpkt", shape=diamond, color=yellow];
2089[label="168.157.36.160;91pkt 91fpkt", shape=pentagon, color=darkviolet];
2547[label="168.157.36.160;91pkt 91fpkt", shape=invtriangle, color=brown];
2831[label="168.157.36.160;90pkt 90fpkt", shape=invhouse, color=bisque];
stat284[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.157.36.160:*, 175.56.75.44:80}[62.6374%]&lt;BR/&gt;{168.157.36.160:*, *:443}[27.4725%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (36.0335%)&lt;BR/&gt; 443: (13.9665%)&lt;BR/&gt; 3210: (0.558659%)&lt;BR/&gt; 3209: (0.558659%)&lt;BR/&gt; 3208: (0.558659%)&gt;];
}
1333--1657[label="0.0116279;1pkt 1fpkt"];
1333--2089[label="1;86pkt 86fpkt"];
1333--2547[label="1;86pkt 86fpkt"];
1333--2831[label="0.988372;85pkt 85fpkt"];
2089--2547[label="1;91pkt 91fpkt"];
2089--2831[label="1;90pkt 90fpkt"];
2547--2831[label="1;90pkt 90fpkt"];
</description>
    <slice>
      <filter dst_port="443" src_ip="168.157.36.160"/>
      <filter dst_ip="175.56.75.44" dst_port="80" src_ip="168.157.36.160"/>
    </slice>
    <from sec="1104556240" usec="0"/>
    <to sec="1104556484" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="1.215.125.161"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.109.104.162"/>
    </slice>
    <from sec="1104555608" usec="0"/>
    <to sec="1104556493" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="31.50.252.164"/>
    </slice>
    <from sec="1104555601" usec="0"/>
    <to sec="1104556474" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="1.229.160.169"/>
    </slice>
    <from sec="1104556167" usec="0"/>
    <to sec="1104556478" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="81.107.102.172"/>
    </slice>
    <from sec="1104555603" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.176.178.174"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_291{
style=filled;
color=gray75;
2124[label="208.176.180.174;87pkt 87fpkt", shape=pentagon, color=darkviolet];
stat291[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.176.180.174:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
</description>
    <slice>
      <filter src_ip="208.176.180.174"/>
    </slice>
    <from sec="1104555611" usec="0"/>
    <to sec="1104556493" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.661371,1.5484,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_292{
style=filled;
color=gray75;
140[label="5.184.240.176s;208pkt 208fpkt", shape=rectangle, color=red];
2127[label="5.184.240.176;231pkt 231fpkt", shape=pentagon, color=darkviolet];
stat292[shape=component, label=&lt;Rules:&lt;BR/&gt;{5.184.240.176:1061, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1061: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
140--2127[label="0.995192;207pkt 207fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="5.184.240.176" src_port="1061"/>
    </slice>
    <from sec="1104555935" usec="0"/>
    <to sec="1104555971" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.142.186.177"/>
    </slice>
    <from sec="1104555603" usec="0"/>
    <to sec="1104556499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.70.60.178"/>
    </slice>
    <from sec="1104555664" usec="0"/>
    <to sec="1104556497" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="149.222.60.178"/>
    </slice>
    <from sec="1104555614" usec="0"/>
    <to sec="1104556456" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="149.222.41.179"/>
    </slice>
    <from sec="1104555616" usec="0"/>
    <to sec="1104556082" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="201.201.195.179"/>
    </slice>
    <from sec="1104555664" usec="0"/>
    <to sec="1104556492" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="96.113.136.181"/>
    </slice>
    <from sec="1104555607" usec="0"/>
    <to sec="1104556499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.869852,1.50349,001,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_299{
style=filled;
color=gray75;
188[label="81.124.140.186s;179pkt 179fpkt", shape=rectangle, color=red];
2150[label="81.124.140.186;178pkt 178fpkt", shape=pentagon, color=darkviolet];
2591[label="81.124.140.186;178pkt 178fpkt", shape=invtriangle, color=brown];
2858[label="81.124.140.186;179pkt 179fpkt", shape=invhouse, color=bisque];
stat299[shape=component, label=&lt;Rules:&lt;BR/&gt;{81.124.140.186:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 3834: (0.280112%)&lt;BR/&gt; 3833: (0.280112%)&lt;BR/&gt; 3832: (0.280112%)&lt;BR/&gt; 3831: (0.280112%)&gt;];
}
188--2150[label="1;178pkt 178fpkt"];
188--2591[label="1;178pkt 178fpkt"];
188--2858[label="1;179pkt 179fpkt"];
2150--2591[label="1;178pkt 178fpkt"];
2150--2858[label="1;178pkt 178fpkt"];
2591--2858[label="1;178pkt 178fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="81.124.140.186"/>
    </slice>
    <from sec="1104555987" usec="0"/>
    <to sec="1104555989" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,001,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.219.203.186"/>
    </slice>
    <from sec="1104555645" usec="0"/>
    <to sec="1104555648" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.869852,1.50349,002,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_301{
style=filled;
color=gray75;
146[label="29.72.228.192s;210pkt 210fpkt", shape=rectangle, color=red];
2158[label="29.72.228.192;210pkt 210fpkt", shape=pentagon, color=darkviolet];
2598[label="29.72.228.192;210pkt 210fpkt", shape=invtriangle, color=brown];
2863[label="29.72.228.192;209pkt 209fpkt", shape=invhouse, color=bisque];
stat301[shape=component, label=&lt;Rules:&lt;BR/&gt;{29.72.228.192:1032, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1032: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
146--2158[label="1;210pkt 210fpkt"];
146--2598[label="1;210pkt 210fpkt"];
146--2863[label="1;209pkt 209fpkt"];
2158--2598[label="1;210pkt 210fpkt"];
2158--2863[label="1;209pkt 209fpkt"];
2598--2863[label="1;209pkt 209fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="29.72.228.192" src_port="1032"/>
    </slice>
    <from sec="1104556413" usec="0"/>
    <to sec="1104556452" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="96.154.24.193"/>
    </slice>
    <from sec="1104555622" usec="0"/>
    <to sec="1104556225" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.921787,1.54294,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_303{
style=filled;
color=gray75;
649[label="168.157.246.210;s;23pkt 23fpkt", shape=diamond, color=yellow];
650[label="81.1.62.228;d;12pkt 12fpkt", shape=diamond, color=yellow];
905[label="3.36.223.80;d;74pkt 74fpkt", shape=diamond, color=yellow];
1033[label="168.157.172.2;s;355pkt 355fpkt", shape=diamond, color=yellow];
1551[label="168.157.246.210;s;18pkt 18fpkt", shape=hexagon, color=black];
1595[label="168.157.172.2;s;355pkt 355fpkt", shape=hexagon, color=black];
1706[label="149.222.87.9;39pkt 39fpkt", shape=pentagon, color=darkviolet];
2161[label="149.223.82.193;4pkt 4fpkt", shape=pentagon, color=darkviolet];
stat303[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.157.172.2:0, *:0}[74.2678%]&lt;BR/&gt;{*:80, *:*}[20.2929%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (80.7955%)&lt;BR/&gt; 80: (8.125%)&lt;BR/&gt; 49153: (1.25%)&lt;BR/&gt; 53: (1.25%)&lt;BR/&gt; 25: (0.227273%)&gt;];
}
649--650[label="0.25;3pkt 3fpkt"];
649--905[label="0.73913;17pkt 17fpkt"];
649--1551[label="1;18pkt 18fpkt"];
650--1551[label="0.25;3pkt 3fpkt"];
650--1706[label="0.5;6pkt 6fpkt"];
650--2161[label="0.5;2pkt 2fpkt"];
905--1033[label="0.0135135;1pkt 1fpkt"];
905--1551[label="0.666667;12pkt 12fpkt"];
905--1595[label="0.0135135;1pkt 1fpkt"];
1033--1123[label="0.0028169;1pkt 1fpkt"];
1033--1217[label="0.00492611;1pkt 1fpkt"];
1033--1292[label="0.0049505;1pkt 1fpkt"];
1033--1453[label="0.0028169;1pkt 1fpkt"];
1033--1571[label="0.00318471;1pkt 1fpkt"];
1033--1595[label="1;355pkt 355fpkt"];
</description>
    <slice>
      <filter src_port="80"/>
      <filter src_ip="168.157.172.2"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556486" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.190.69.196"/>
    </slice>
    <from sec="1104556148" usec="0"/>
    <to sec="1104556401" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="201.157.162.196"/>
    </slice>
    <from sec="1104555611" usec="0"/>
    <to sec="1104556470" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="149.223.81.200"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.188.67.202"/>
    </slice>
    <from sec="1104555603" usec="0"/>
    <to sec="1104555754" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.869852,1.50349,503,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_309{
style=filled;
color=gray75;
95[label="147.103.8.205d;4pkt 4fpkt", shape=rectangle, color=red];
2189[label="204.25.143.205;4pkt 4fpkt", shape=pentagon, color=darkviolet];
2614[label="204.25.143.205;5pkt 5fpkt", shape=invtriangle, color=brown];
2873[label="204.25.143.205;5pkt 5fpkt", shape=invhouse, color=bisque];
stat309[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.25.143.205:1736, 147.103.232.218:80}[20%]&lt;BR/&gt;{204.25.143.205:1737, 147.103.8.205:80}[20%]&lt;BR/&gt;{204.25.143.205:1738, 147.103.8.205:80}[20%]&lt;BR/&gt;{204.25.143.205:1739, 147.103.8.205:80}[20%]&lt;BR/&gt;{204.25.143.205:1740, 147.103.8.205:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1740: (11.1111%)&lt;BR/&gt; 1739: (11.1111%)&lt;BR/&gt; 1738: (11.1111%)&lt;BR/&gt; 1737: (11.1111%)&gt;];
}
95--2189[label="1;4pkt 4fpkt"];
95--2614[label="1;4pkt 4fpkt"];
95--2873[label="1;4pkt 4fpkt"];
2189--2614[label="1;4pkt 4fpkt"];
2189--2873[label="1;4pkt 4fpkt"];
2614--2873[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="147.103.8.205" dst_port="80" src_ip="204.25.143.205" src_port="1740"/>
      <filter dst_ip="147.103.8.205" dst_port="80" src_ip="204.25.143.205" src_port="1739"/>
      <filter dst_ip="147.103.8.205" dst_port="80" src_ip="204.25.143.205" src_port="1738"/>
      <filter dst_ip="147.103.8.205" dst_port="80" src_ip="204.25.143.205" src_port="1737"/>
      <filter dst_ip="147.103.232.218" dst_port="80" src_ip="204.25.143.205" src_port="1736"/>
    </slice>
    <from sec="1104555927" usec="0"/>
    <to sec="1104556498" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.0.9.206"/>
    </slice>
    <from sec="1104555621" usec="0"/>
    <to sec="1104556182" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="5.90.206.207"/>
    </slice>
    <from sec="1104555609" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="193.180.163.210"/>
    </slice>
    <from sec="1104555601" usec="0"/>
    <to sec="1104556479" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="29.86.77.212"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.137.164.212"/>
    </slice>
    <from sec="1104555609" usec="0"/>
    <to sec="1104556458" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.184.74.216"/>
    </slice>
    <from sec="1104555607" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="168.157.246.216"/>
    </slice>
    <from sec="1104555609" usec="0"/>
    <to sec="1104556492" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.607286,1.55897,010,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_318{
style=filled;
color=gray75;
856[label="194.113.171.218;s;734pkt 734fpkt", shape=diamond, color=yellow];
2222[label="194.113.171.218;781pkt 781fpkt", shape=pentagon, color=darkviolet];
stat318[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.113.171.218:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 65067: (0.132013%)&lt;BR/&gt; 47994: (0.132013%)&lt;BR/&gt; 42834: (0.132013%)&lt;BR/&gt; 35127: (0.132013%)&gt;];
}
856--2222[label="0.998638;733pkt 733fpkt"];
</description>
    <slice>
      <filter src_ip="194.113.171.218" src_port="80"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="6.133.20.219"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="219.102.99.219"/>
    </slice>
    <from sec="1104556255" usec="0"/>
    <to sec="1104556260" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="5.42.98.222"/>
    </slice>
    <from sec="1104555857" usec="0"/>
    <to sec="1104556450" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.607286,1.55897,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_322{
style=filled;
color=gray75;
1179[label="168.157.67.223;s;55pkt 55fpkt", shape=diamond, color=yellow];
2236[label="168.157.67.223;59pkt 59fpkt", shape=pentagon, color=darkviolet];
stat322[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.157.67.223:*, 2.244.212.3:80}[30.5085%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.4912%)&lt;BR/&gt; 5050: (1.75439%)&lt;BR/&gt; 123: (1.75439%)&lt;BR/&gt; 8000: (0.877193%)&lt;BR/&gt; 1411: (0.877193%)&gt;];
}
1179--1653[label="0.127273;7pkt 7fpkt"];
1179--1669[label="0.0181818;1pkt 1fpkt"];
1179--1670[label="0.127273;7pkt 7fpkt"];
1179--2236[label="1;55pkt 55fpkt"];
</description>
    <slice>
      <filter dst_ip="2.244.212.3" dst_port="80" src_ip="168.157.67.223"/>
    </slice>
    <from sec="1104555626" usec="0"/>
    <to sec="1104556495" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="173.172.40.224"/>
    </slice>
    <from sec="1104555630" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.726434,1.51817,002,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_324{
style=filled;
color=gray75;
153[label="96.97.73.224s;117pkt 117fpkt", shape=rectangle, color=red];
2241[label="96.97.73.224;136pkt 136fpkt", shape=pentagon, color=darkviolet];
2641[label="96.97.73.224;135pkt 135fpkt", shape=invtriangle, color=brown];
stat324[shape=component, label=&lt;Rules:&lt;BR/&gt;{96.97.73.224:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
153--2241[label="1;117pkt 117fpkt"];
153--2641[label="0.991453;116pkt 116fpkt"];
2241--2641[label="1;135pkt 135fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="96.97.73.224" src_port="1026"/>
    </slice>
    <from sec="1104555884" usec="0"/>
    <to sec="1104555905" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="81.168.67.226"/>
    </slice>
    <from sec="1104555789" usec="0"/>
    <to sec="1104556313" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.116.24.228"/>
    </slice>
    <from sec="1104556253" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.186.44.228"/>
    </slice>
    <from sec="1104555606" usec="0"/>
    <to sec="1104556497" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.607286,1.55897,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_328{
style=filled;
color=gray75;
829[label="147.103.215.229;s;896pkt 896fpkt", shape=diamond, color=yellow];
2256[label="147.103.215.229;1206pkt 1206fpkt", shape=pentagon, color=darkviolet];
stat328[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.103.215.229:53, *:*}[99.6689%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (55.5661%)&lt;BR/&gt; 32768: (2.85442%)&lt;BR/&gt; 32769: (1.21313%)&lt;BR/&gt; 1024: (0.76118%)&lt;BR/&gt; 32772: (0.523311%)&gt;];
}
829--1638[label="0.00669643;6pkt 6fpkt"];
829--1650[label="0.015625;14pkt 14fpkt"];
829--1654[label="0.0301339;27pkt 27fpkt"];
829--1656[label="0.00111607;1pkt 1fpkt"];
829--1659[label="0.00669643;6pkt 6fpkt"];
829--1672[label="0.00669643;6pkt 6fpkt"];
829--2256[label="0.997768;894pkt 894fpkt"];
</description>
    <slice>
      <filter src_ip="147.103.215.229" src_port="53"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="149.223.217.235"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="81.140.192.236"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="5.143.129.237"/>
    </slice>
    <from sec="1104555994" usec="0"/>
    <to sec="1104556284" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="5.253.198.237"/>
    </slice>
    <from sec="1104555621" usec="0"/>
    <to sec="1104556447" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677562,1.52895,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_333{
style=filled;
color=gray75;
1269[label="147.103.18.249;s;23pkt 23fpkt", shape=diamond, color=yellow];
2290[label="147.103.18.249;34pkt 34fpkt", shape=pentagon, color=darkviolet];
2674[label="147.103.18.249;34pkt 34fpkt", shape=invtriangle, color=brown];
stat333[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.103.18.249:*, *:53}[61.7647%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (31.8681%)&lt;BR/&gt; 0: (13.1868%)&lt;BR/&gt; 25: (8.24176%)&lt;BR/&gt; 80: (3.2967%)&lt;BR/&gt; 63031: (1.64835%)&gt;];
}
1269--2290[label="1;23pkt 23fpkt"];
1269--2674[label="1;23pkt 23fpkt"];
2290--2674[label="1;34pkt 34fpkt"];
</description>
    <slice>
      <filter dst_port="53" src_ip="147.103.18.249"/>
    </slice>
    <from sec="1104555605" usec="0"/>
    <to sec="1104556432" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="5.154.89.250"/>
    </slice>
    <from sec="1104555610" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.180.179.251"/>
    </slice>
    <from sec="1104555602" usec="0"/>
    <to sec="1104556242" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.453025,1.59666,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="173.172.9.255"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.543623,1.56736,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_337{
style=filled;
color=gray75;
1688[label="209.241.210.1;50pkt 50fpkt", shape=pentagon, color=darkviolet];
2307[label="209.241.210.1;51pkt 51fpkt", shape=invtriangle, color=brown];
stat337[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.241.210.1:32900, *:53}[82.3529%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (47.0297%)&lt;BR/&gt; 32900: (41.0891%)&lt;BR/&gt; 0: (1.9802%)&lt;BR/&gt; 60000: (0.990099%)&lt;BR/&gt; 37551: (0.990099%)&gt;];
}
1688--2307[label="1;50pkt 50fpkt"];
</description>
    <slice>
      <filter dst_port="53" src_ip="209.241.210.1" src_port="32900"/>
    </slice>
    <from sec="1104555712" usec="0"/>
    <to sec="1104556499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="1.147.23.3"/>
    </slice>
    <from sec="1104555603" usec="0"/>
    <to sec="1104555884" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.543623,1.56736,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_340{
style=filled;
color=gray75;
1702[label="96.80.96.6;242pkt 242fpkt", shape=pentagon, color=darkviolet];
2316[label="96.80.96.6;241pkt 241fpkt", shape=invtriangle, color=brown];
stat340[shape=component, label=&lt;Rules:&lt;BR/&gt;{96.80.96.6:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
1702--2316[label="1;241pkt 241fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="96.80.96.6" src_port="1026"/>
    </slice>
    <from sec="1104556189" usec="0"/>
    <to sec="1104556226" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="5.141.162.7"/>
    </slice>
    <from sec="1104555838" usec="0"/>
    <to sec="1104556434" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.543623,1.56736,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_342{
style=filled;
color=gray75;
1707[label="147.181.98.9;5pkt 5fpkt", shape=pentagon, color=darkviolet];
2319[label="147.181.98.9;5pkt 5fpkt", shape=invtriangle, color=brown];
stat342[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.181.98.9:59465, 106.190.197.166:80}[20%]&lt;BR/&gt;{147.181.98.9:59468, 106.190.197.166:80}[20%]&lt;BR/&gt;{147.181.98.9:59448, 106.190.197.130:443}[20%]&lt;BR/&gt;{147.181.98.9:59449, 106.190.197.130:443}[20%]&lt;BR/&gt;{147.181.98.9:59450, 106.190.197.130:443}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (30%)&lt;BR/&gt; 80: (20%)&lt;BR/&gt; 59468: (10%)&lt;BR/&gt; 59465: (10%)&lt;BR/&gt; 59450: (10%)&gt;];
}
1707--2319[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="106.190.197.130" dst_port="443" src_ip="147.181.98.9" src_port="59450"/>
      <filter dst_ip="106.190.197.130" dst_port="443" src_ip="147.181.98.9" src_port="59449"/>
      <filter dst_ip="106.190.197.130" dst_port="443" src_ip="147.181.98.9" src_port="59448"/>
      <filter dst_ip="106.190.197.166" dst_port="80" src_ip="147.181.98.9" src_port="59468"/>
      <filter dst_ip="106.190.197.166" dst_port="80" src_ip="147.181.98.9" src_port="59465"/>
    </slice>
    <from sec="1104555881" usec="0"/>
    <to sec="1104555926" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,504,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_343{
style=filled;
color=gray75;
1711[label="149.223.13.11;14pkt 14fpkt", shape=pentagon, color=darkviolet];
2320[label="149.223.13.11;14pkt 14fpkt", shape=invtriangle, color=brown];
2693[label="149.223.13.11;15pkt 15fpkt", shape=invhouse, color=bisque];
stat343[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.223.13.11:*, 213.80.197.141:80}[20%]&lt;BR/&gt;{149.223.13.11:*, *:443}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (39.5349%)&lt;BR/&gt; 443: (10.4651%)&lt;BR/&gt; 48137: (3.48837%)&lt;BR/&gt; 48136: (3.48837%)&lt;BR/&gt; 48105: (3.48837%)&gt;];
}
1711--2320[label="1;14pkt 14fpkt"];
1711--2693[label="1;14pkt 14fpkt"];
2320--2693[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter dst_port="443" src_ip="149.223.13.11"/>
      <filter dst_ip="213.80.197.141" dst_port="80" src_ip="149.223.13.11"/>
    </slice>
    <from sec="1104555994" usec="0"/>
    <to sec="1104556398" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="82.218.253.14"/>
    </slice>
    <from sec="1104555630" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.607286,1.55897,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_345{
style=filled;
color=gray75;
1186[label="196.84.233.113;s;8pkt 8fpkt", shape=diamond, color=yellow];
1251[label="149.223.200.106;d;30pkt 30fpkt", shape=diamond, color=yellow];
1980[label="196.84.233.113;7pkt 7fpkt", shape=pentagon, color=darkviolet];
stat345[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:53, 149.223.200.106:32774}[31.25%]&lt;BR/&gt;{196.84.233.113:*, *:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (23.3333%)&lt;BR/&gt; 53: (20%)&lt;BR/&gt; 32774: (11.1111%)&lt;BR/&gt; 0: (8.88889%)&lt;BR/&gt; 16203: (5.55556%)&gt;];
}
1186--1251[label="0.75;6pkt 6fpkt"];
1186--1653[label="0.125;1pkt 1fpkt"];
1186--1669[label="0.25;2pkt 2fpkt"];
1186--1670[label="0.125;1pkt 1fpkt"];
1186--1980[label="1;7pkt 7fpkt"];
1251--1653[label="0.0333333;1pkt 1fpkt"];
1251--1669[label="0.0666667;2pkt 2fpkt"];
1251--1670[label="0.0333333;1pkt 1fpkt"];
1251--1731[label="0.2;1pkt 1fpkt"];
1251--1980[label="0.714286;5pkt 5fpkt"];
1251--2703[label="0.2;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="196.84.233.113"/>
      <filter dst_ip="149.223.200.106" dst_port="32774" src_port="53"/>
    </slice>
    <from sec="1104555642" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_346{
style=filled;
color=gray75;
1734[label="1.88.233.17;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2335[label="1.88.233.17;3pkt 3fpkt", shape=invtriangle, color=brown];
2705[label="1.88.233.17;3pkt 3fpkt", shape=invhouse, color=bisque];
stat346[shape=component, label=&lt;Rules:&lt;BR/&gt;{1.88.233.17:32260, 173.172.55.50:25}[33.3333%]&lt;BR/&gt;{1.88.233.17:32259, 173.172.7.72:25}[33.3333%]&lt;BR/&gt;{1.88.233.17:27687, 173.172.90.196:25}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 32260: (16.6667%)&lt;BR/&gt; 32259: (16.6667%)&lt;BR/&gt; 27687: (16.6667%)&gt;];
}
1734--2335[label="1;3pkt 3fpkt"];
1734--2705[label="1;3pkt 3fpkt"];
2335--2705[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="173.172.90.196" dst_port="25" src_ip="1.88.233.17" src_port="27687"/>
      <filter dst_ip="173.172.7.72" dst_port="25" src_ip="1.88.233.17" src_port="32259"/>
      <filter dst_ip="173.172.55.50" dst_port="25" src_ip="1.88.233.17" src_port="32260"/>
    </slice>
    <from sec="1104556217" usec="0"/>
    <to sec="1104556467" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.543623,1.56736,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_347{
style=filled;
color=gray75;
1744[label="149.223.18.20;25pkt 25fpkt", shape=pentagon, color=darkviolet];
2340[label="149.223.18.20;25pkt 25fpkt", shape=invtriangle, color=brown];
stat347[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.223.18.20:*, 212.89.160.18:80}[60%]&lt;BR/&gt;{149.223.18.20:*, 212.89.148.203:80}[40%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1949: (2%)&lt;BR/&gt; 1948: (2%)&lt;BR/&gt; 1947: (2%)&lt;BR/&gt; 1946: (2%)&gt;];
}
1744--2340[label="1;25pkt 25fpkt"];
</description>
    <slice>
      <filter dst_ip="212.89.160.18" dst_port="80" src_ip="149.223.18.20"/>
      <filter dst_ip="212.89.148.203" dst_port="80" src_ip="149.223.18.20"/>
    </slice>
    <from sec="1104555617" usec="0"/>
    <to sec="1104556473" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.829474,1.51438,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_348{
style=filled;
color=gray75;
1037[label="173.172.53.20;s;80pkt 80fpkt", shape=diamond, color=yellow];
1745[label="173.172.53.20;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2341[label="173.172.53.20;3pkt 3fpkt", shape=invtriangle, color=brown];
2708[label="173.172.53.20;3pkt 3fpkt", shape=invhouse, color=bisque];
stat348[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.172.53.20:25, *:*}[50%]&lt;BR/&gt;{173.172.53.20:*, *:25}[48.7805%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (49.4318%)&lt;BR/&gt; 4983: (1.70455%)&lt;BR/&gt; 4772: (1.70455%)&lt;BR/&gt; 1950: (1.70455%)&lt;BR/&gt; 0: (1.13636%)&gt;];
}
1037--2341[label="0.333333;1pkt 1fpkt"];
1037--2708[label="0.333333;1pkt 1fpkt"];
1745--2341[label="1;2pkt 2fpkt"];
1745--2708[label="1;2pkt 2fpkt"];
2341--2708[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter src_ip="173.172.53.20" src_port="25"/>
      <filter dst_port="25" src_ip="173.172.53.20"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.607286,1.55897,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_349{
style=filled;
color=gray75;
1038[label="147.131.122.46;d;223pkt 223fpkt", shape=diamond, color=yellow];
1685[label="208.195.86.1;13pkt 13fpkt", shape=pentagon, color=darkviolet];
stat349[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:53, 147.131.122.46:3516}[58.296%]&lt;BR/&gt;{*:*, 147.131.122.46:53}[29.5964%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (43.8559%)&lt;BR/&gt; 3516: (27.5424%)&lt;BR/&gt; 25: (8.05085%)&lt;BR/&gt; 1053: (1.05932%)&lt;BR/&gt; 33701: (0.635593%)&gt;];
}
1038--1565[label="0.0044843;1pkt 1fpkt"];
1038--1638[label="0.0179372;4pkt 4fpkt"];
1038--1650[label="0.0269058;6pkt 6fpkt"];
1038--1654[label="0.0672646;15pkt 15fpkt"];
1038--1656[label="0.0134529;3pkt 3fpkt"];
1038--1659[label="0.0179372;4pkt 4fpkt"];
1038--1672[label="0.0179372;4pkt 4fpkt"];
1038--1685[label="1;13pkt 13fpkt"];
1038--1749[label="0.03125;1pkt 1fpkt"];
1038--2137[label="0.0116279;1pkt 1fpkt"];
1038--2143[label="0.025;1pkt 1fpkt"];
1038--2343[label="0.0322581;1pkt 1fpkt"];
1038--2710[label="0.03125;1pkt 1fpkt"];
1038--2852[label="0.0116279;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="147.131.122.46" dst_port="53"/>
      <filter dst_ip="147.131.122.46" dst_port="3516" src_port="53"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556423" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="81.162.11.26"/>
    </slice>
    <from sec="1104555604" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="5.152.187.28"/>
    </slice>
    <from sec="1104555677" usec="0"/>
    <to sec="1104556450" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="96.192.240.29"/>
    </slice>
    <from sec="1104555604" usec="0"/>
    <to sec="1104556216" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_354{
style=filled;
color=gray75;
1775[label="149.223.96.31;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2360[label="149.223.96.31;3pkt 3fpkt", shape=invtriangle, color=brown];
2722[label="149.223.96.31;3pkt 3fpkt", shape=invhouse, color=bisque];
stat354[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.223.96.31:110, 207.51.247.161:2723}[33.3333%]&lt;BR/&gt;{149.223.96.31:110, 207.51.247.161:2724}[33.3333%]&lt;BR/&gt;{149.223.96.31:110, 207.51.247.161:2727}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 110: (50%)&lt;BR/&gt; 2727: (16.6667%)&lt;BR/&gt; 2724: (16.6667%)&lt;BR/&gt; 2723: (16.6667%)&gt;];
}
1775--2360[label="1;3pkt 3fpkt"];
1775--2722[label="1;3pkt 3fpkt"];
2360--2722[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="207.51.247.161" dst_port="2727" src_ip="149.223.96.31" src_port="110"/>
      <filter dst_ip="207.51.247.161" dst_port="2724" src_ip="149.223.96.31" src_port="110"/>
      <filter dst_ip="207.51.247.161" dst_port="2723" src_ip="149.223.96.31" src_port="110"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_355{
style=filled;
color=gray75;
1784[label="1.88.233.34;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2364[label="1.88.233.34;2pkt 2fpkt", shape=invtriangle, color=brown];
2725[label="1.88.233.34;2pkt 2fpkt", shape=invhouse, color=bisque];
stat355[shape=component, label=&lt;Rules:&lt;BR/&gt;{1.88.233.34:46442, 173.172.45.6:25}[50%]&lt;BR/&gt;{1.88.233.34:47400, 173.172.7.72:25}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 47400: (25%)&lt;BR/&gt; 46442: (25%)&gt;];
}
1784--2364[label="1;2pkt 2fpkt"];
1784--2725[label="1;2pkt 2fpkt"];
2364--2725[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="173.172.7.72" dst_port="25" src_ip="1.88.233.34" src_port="47400"/>
      <filter dst_ip="173.172.45.6" dst_port="25" src_ip="1.88.233.34" src_port="46442"/>
    </slice>
    <from sec="1104555676" usec="0"/>
    <to sec="1104556111" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.543623,1.56736,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_357{
style=filled;
color=gray75;
1800[label="173.172.7.39;12pkt 12fpkt", shape=pentagon, color=darkviolet];
2373[label="173.172.7.39;12pkt 12fpkt", shape=invtriangle, color=brown];
stat357[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.172.7.39:80, *:*}[91.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (45.8333%)&lt;BR/&gt; 45675: (4.16667%)&lt;BR/&gt; 4785: (4.16667%)&lt;BR/&gt; 4236: (4.16667%)&lt;BR/&gt; 3960: (4.16667%)&gt;];
}
1800--2373[label="1;12pkt 12fpkt"];
</description>
    <slice>
      <filter src_ip="173.172.7.39" src_port="80"/>
    </slice>
    <from sec="1104555603" usec="0"/>
    <to sec="1104556484" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_358{
style=filled;
color=gray75;
1804[label="218.78.135.40;58pkt 58fpkt", shape=pentagon, color=darkviolet];
2374[label="218.78.135.40;59pkt 59fpkt", shape=invtriangle, color=brown];
2730[label="218.78.135.40;59pkt 59fpkt", shape=invhouse, color=bisque];
stat358[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.78.135.40:*, 173.172.146.225:25}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 35225: (0.852273%)&lt;BR/&gt; 35172: (0.852273%)&lt;BR/&gt; 35165: (0.852273%)&lt;BR/&gt; 35163: (0.852273%)&gt;];
}
1804--2374[label="1;58pkt 58fpkt"];
1804--2730[label="1;58pkt 58fpkt"];
2374--2730[label="1;59pkt 59fpkt"];
</description>
    <slice>
      <filter dst_ip="173.172.146.225" dst_port="25" src_ip="218.78.135.40"/>
    </slice>
    <from sec="1104555625" usec="0"/>
    <to sec="1104556475" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.829474,1.51438,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_360{
style=filled;
color=gray75;
778[label="140.10.7.115;d;401pkt 401fpkt", shape=diamond, color=yellow];
1087[label="194.113.179.213;s;213pkt 213fpkt", shape=diamond, color=yellow];
1185[label="194.113.179.210;s;98pkt 98fpkt", shape=diamond, color=yellow];
1782[label="208.78.158.34;18pkt 18fpkt", shape=pentagon, color=darkviolet];
1809[label="81.133.17.42;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2205[label="194.113.179.210;113pkt 113fpkt", shape=pentagon, color=darkviolet];
2213[label="194.113.179.213;213pkt 213fpkt", shape=pentagon, color=darkviolet];
2363[label="208.78.158.34;18pkt 18fpkt", shape=invtriangle, color=brown];
2378[label="81.133.17.42;1pkt 1fpkt", shape=invtriangle, color=brown];
2622[label="194.113.179.210;113pkt 113fpkt", shape=invtriangle, color=brown];
2732[label="81.133.17.42;2pkt 2fpkt", shape=invhouse, color=bisque];
2878[label="194.113.179.210;113pkt 113fpkt", shape=invhouse, color=bisque];
stat360[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.113.179.213:80, 140.10.7.115:*}[50.8353%]&lt;BR/&gt;{194.113.179.210:80, 140.10.7.115:*}[27.2076%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.885%)&lt;BR/&gt; 1519: (0.191718%)&lt;BR/&gt; 1518: (0.191718%)&lt;BR/&gt; 1516: (0.191718%)&lt;BR/&gt; 1514: (0.191718%)&gt;];
}
778--1087[label="0.995305;212pkt 212fpkt"];
778--1185[label="1;98pkt 98fpkt"];
778--1214[label="0.00249377;1pkt 1fpkt"];
778--1285[label="0.00333333;1pkt 1fpkt"];
778--1733[label="0.015625;1pkt 1fpkt"];
778--1782[label="1;18pkt 18fpkt"];
778--1809[label="1;1pkt 1fpkt"];
778--2205[label="0.858407;97pkt 97fpkt"];
778--2213[label="0.995305;212pkt 212fpkt"];
778--2275[label="0.00249377;1pkt 1fpkt"];
778--2294[label="0.00309598;1pkt 1fpkt"];
778--2363[label="1;18pkt 18fpkt"];
778--2378[label="1;1pkt 1fpkt"];
778--2622[label="0.858407;97pkt 97fpkt"];
778--2662[label="0.00249377;1pkt 1fpkt"];
778--2677[label="0.00310559;1pkt 1fpkt"];
778--2732[label="1;2pkt 2fpkt"];
778--2878[label="0.858407;97pkt 97fpkt"];
1087--2213[label="0.995305;212pkt 212fpkt"];
1185--2205[label="0.989796;97pkt 97fpkt"];
1185--2622[label="0.989796;97pkt 97fpkt"];
1185--2878[label="0.989796;97pkt 97fpkt"];
1782--2363[label="1;18pkt 18fpkt"];
1809--2378[label="1;1pkt 1fpkt"];
1809--2732[label="1;1pkt 1fpkt"];
2205--2622[label="1;113pkt 113fpkt"];
2205--2878[label="1;113pkt 113fpkt"];
2378--2732[label="1;1pkt 1fpkt"];
2622--2878[label="1;113pkt 113fpkt"];
</description>
    <slice>
      <filter dst_ip="140.10.7.115" src_ip="194.113.179.213" src_port="80"/>
      <filter dst_ip="140.10.7.115" src_ip="194.113.179.210" src_port="80"/>
    </slice>
    <from sec="1104555606" usec="0"/>
    <to sec="1104556490" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="196.103.19.42"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="173.172.22.42"/>
    </slice>
    <from sec="1104555603" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677562,1.52895,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_363{
style=filled;
color=gray75;
1263[label="147.131.122.42;s;106pkt 106fpkt", shape=diamond, color=yellow];
1813[label="147.131.122.42;106pkt 106fpkt", shape=pentagon, color=darkviolet];
2382[label="147.131.122.42;107pkt 107fpkt", shape=invtriangle, color=brown];
stat363[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.131.122.42:1033, *:53}[99.0654%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1033: (49.6865%)&lt;BR/&gt; 53: (49.6865%)&lt;BR/&gt; 0: (0.626959%)&gt;];
}
1263--1656[label="0.0188679;2pkt 2fpkt"];
1263--1813[label="0.990566;105pkt 105fpkt"];
1263--2382[label="1;106pkt 106fpkt"];
1813--2382[label="1;106pkt 106fpkt"];
</description>
    <slice>
      <filter dst_port="53" src_ip="147.131.122.42" src_port="1033"/>
    </slice>
    <from sec="1104555724" usec="0"/>
    <to sec="1104556470" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_364{
style=filled;
color=gray75;
1814[label="1.88.233.42;10pkt 10fpkt", shape=pentagon, color=darkviolet];
2383[label="1.88.233.42;10pkt 10fpkt", shape=invtriangle, color=brown];
2735[label="1.88.233.42;10pkt 10fpkt", shape=invhouse, color=bisque];
stat364[shape=component, label=&lt;Rules:&lt;BR/&gt;{1.88.233.42:*, *:25}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 44629: (5%)&lt;BR/&gt; 44468: (5%)&lt;BR/&gt; 44466: (5%)&lt;BR/&gt; 44443: (5%)&gt;];
}
1814--2383[label="1;10pkt 10fpkt"];
1814--2735[label="1;10pkt 10fpkt"];
2383--2735[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter dst_port="25" src_ip="1.88.233.42"/>
    </slice>
    <from sec="1104556086" usec="0"/>
    <to sec="1104556401" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="1.229.160.51"/>
    </slice>
    <from sec="1104555911" usec="0"/>
    <to sec="1104556207" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="218.128.87.52"/>
    </slice>
    <from sec="1104556214" usec="0"/>
    <to sec="1104556260" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.543623,1.56736,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_367{
style=filled;
color=gray75;
1837[label="209.241.211.52;4pkt 4fpkt", shape=pentagon, color=darkviolet];
2394[label="209.241.211.52;4pkt 4fpkt", shape=invtriangle, color=brown];
stat367[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.241.211.52:80, 0.28.164.73:1314}[25%]&lt;BR/&gt;{209.241.211.52:80, 0.28.164.73:1316}[25%]&lt;BR/&gt;{209.241.211.52:80, 0.28.164.73:1318}[25%]&lt;BR/&gt;{209.241.211.52:80, 0.28.164.73:1320}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1320: (12.5%)&lt;BR/&gt; 1318: (12.5%)&lt;BR/&gt; 1316: (12.5%)&lt;BR/&gt; 1314: (12.5%)&gt;];
}
1837--2394[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="0.28.164.73" dst_port="1320" src_ip="209.241.211.52" src_port="80"/>
      <filter dst_ip="0.28.164.73" dst_port="1318" src_ip="209.241.211.52" src_port="80"/>
      <filter dst_ip="0.28.164.73" dst_port="1316" src_ip="209.241.211.52" src_port="80"/>
      <filter dst_ip="0.28.164.73" dst_port="1314" src_ip="209.241.211.52" src_port="80"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677562,1.52895,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_368{
style=filled;
color=gray75;
1225[label="1.137.74.63;d;109pkt 109fpkt", shape=diamond, color=yellow];
1839[label="149.222.61.53;77pkt 77fpkt", shape=pentagon, color=darkviolet];
2395[label="149.222.61.53;78pkt 78fpkt", shape=invtriangle, color=brown];
stat368[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.222.61.53:*, 1.137.74.63:80}[43.609%]&lt;BR/&gt;{168.157.18.27:*, 1.137.74.63:80}[41.3534%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3662: (0.568182%)&lt;BR/&gt; 3659: (0.568182%)&lt;BR/&gt; 3658: (0.568182%)&lt;BR/&gt; 3657: (0.568182%)&gt;];
}
1225--1639[label="0.0550459;6pkt 6fpkt"];
1225--1653[label="0.0550459;6pkt 6fpkt"];
1225--1657[label="0.0366972;4pkt 4fpkt"];
1225--1660[label="0.0550459;6pkt 6fpkt"];
1225--1669[label="0.0550459;6pkt 6fpkt"];
1225--1670[label="0.0550459;6pkt 6fpkt"];
1225--1673[label="0.0550459;6pkt 6fpkt"];
1225--1839[label="0.701299;54pkt 54fpkt"];
1225--2395[label="0.692308;54pkt 54fpkt"];
1839--2395[label="1;77pkt 77fpkt"];
</description>
    <slice>
      <filter dst_ip="1.137.74.63" dst_port="80" src_ip="149.222.61.53"/>
      <filter dst_ip="1.137.74.63" dst_port="80" src_ip="168.157.18.27"/>
    </slice>
    <from sec="1104555602" usec="0"/>
    <to sec="1104556489" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="82.8.123.53"/>
    </slice>
    <from sec="1104555658" usec="0"/>
    <to sec="1104556075" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_370{
style=filled;
color=gray75;
1852[label="149.222.165.57;19pkt 19fpkt", shape=pentagon, color=darkviolet];
2403[label="149.222.165.57;19pkt 19fpkt", shape=invtriangle, color=brown];
2748[label="149.222.165.57;19pkt 19fpkt", shape=invhouse, color=bisque];
stat370[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.222.165.57:80, 83.162.250.35:*}[94.7368%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 40960: (2.63158%)&lt;BR/&gt; 11472: (2.63158%)&lt;BR/&gt; 11340: (2.63158%)&lt;BR/&gt; 11129: (2.63158%)&gt;];
}
1852--2403[label="1;19pkt 19fpkt"];
1852--2748[label="1;19pkt 19fpkt"];
2403--2748[label="1;19pkt 19fpkt"];
</description>
    <slice>
      <filter dst_ip="83.162.250.35" src_ip="149.222.165.57" src_port="80"/>
    </slice>
    <from sec="1104555950" usec="0"/>
    <to sec="1104556474" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_371{
style=filled;
color=gray75;
1859[label="219.179.179.59;19pkt 19fpkt", shape=pentagon, color=darkviolet];
2406[label="219.179.179.59;18pkt 18fpkt", shape=invtriangle, color=brown];
2749[label="219.179.179.59;19pkt 19fpkt", shape=invhouse, color=bisque];
stat371[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.179.179.59:80, 147.103.6.92:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 49420: (2.67857%)&lt;BR/&gt; 49419: (2.67857%)&lt;BR/&gt; 49418: (2.67857%)&lt;BR/&gt; 49417: (2.67857%)&gt;];
}
1859--2406[label="1;18pkt 18fpkt"];
1859--2749[label="1;19pkt 19fpkt"];
2406--2749[label="1;18pkt 18fpkt"];
</description>
    <slice>
      <filter dst_ip="147.103.6.92" src_ip="219.179.179.59" src_port="80"/>
    </slice>
    <from sec="1104555782" usec="0"/>
    <to sec="1104555948" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="82.112.43.60"/>
    </slice>
    <from sec="1104555651" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.543623,1.56736,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_373{
style=filled;
color=gray75;
1865[label="168.157.120.63;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2408[label="168.157.120.63;1pkt 1fpkt", shape=invtriangle, color=brown];
stat373[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.157.120.63:16058, 1.0.37.211:80}[50%]&lt;BR/&gt;{168.157.120.63:16059, 1.0.37.211:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 16059: (33.3333%)&lt;BR/&gt; 16058: (16.6667%)&gt;];
}
1865--2408[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="1.0.37.211" dst_port="80" src_ip="168.157.120.63" src_port="16059"/>
      <filter dst_ip="1.0.37.211" dst_port="80" src_ip="168.157.120.63" src_port="16058"/>
    </slice>
    <from sec="1104556229" usec="0"/>
    <to sec="1104556233" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="195.88.239.63"/>
    </slice>
    <from sec="1104555605" usec="0"/>
    <to sec="1104556483" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_375{
style=filled;
color=gray75;
1869[label="5.246.97.65;5pkt 5fpkt", shape=pentagon, color=darkviolet];
2411[label="5.246.97.65;5pkt 5fpkt", shape=invtriangle, color=brown];
2751[label="5.246.97.65;5pkt 5fpkt", shape=invhouse, color=bisque];
stat375[shape=component, label=&lt;Rules:&lt;BR/&gt;{5.246.97.65:1125, 209.241.212.132:80}[20%]&lt;BR/&gt;{5.246.97.65:1126, 209.241.212.132:80}[20%]&lt;BR/&gt;{5.246.97.65:1129, 147.131.122.176:80}[20%]&lt;BR/&gt;{5.246.97.65:1130, 147.131.122.176:80}[20%]&lt;BR/&gt;{5.246.97.65:1131, 147.131.122.176:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1131: (10%)&lt;BR/&gt; 1130: (10%)&lt;BR/&gt; 1129: (10%)&lt;BR/&gt; 1126: (10%)&gt;];
}
1869--2411[label="1;5pkt 5fpkt"];
1869--2751[label="1;5pkt 5fpkt"];
2411--2751[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="147.131.122.176" dst_port="80" src_ip="5.246.97.65" src_port="1131"/>
      <filter dst_ip="147.131.122.176" dst_port="80" src_ip="5.246.97.65" src_port="1130"/>
      <filter dst_ip="147.131.122.176" dst_port="80" src_ip="5.246.97.65" src_port="1129"/>
      <filter dst_ip="209.241.212.132" dst_port="80" src_ip="5.246.97.65" src_port="1126"/>
      <filter dst_ip="209.241.212.132" dst_port="80" src_ip="5.246.97.65" src_port="1125"/>
    </slice>
    <from sec="1104556338" usec="0"/>
    <to sec="1104556463" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_376{
style=filled;
color=gray75;
1871[label="4.58.223.65;7pkt 7fpkt", shape=pentagon, color=darkviolet];
2413[label="4.58.223.65;7pkt 7fpkt", shape=invtriangle, color=brown];
2753[label="4.58.223.65;7pkt 7fpkt", shape=invhouse, color=bisque];
stat376[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.58.223.65:80, 208.176.178.168:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 58875: (7.14286%)&lt;BR/&gt; 58874: (7.14286%)&lt;BR/&gt; 58868: (7.14286%)&lt;BR/&gt; 58862: (7.14286%)&gt;];
}
1871--2413[label="1;7pkt 7fpkt"];
1871--2753[label="1;7pkt 7fpkt"];
2413--2753[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="208.176.178.168" src_ip="4.58.223.65" src_port="80"/>
    </slice>
    <from sec="1104556435" usec="0"/>
    <to sec="1104556455" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.543623,1.56736,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_377{
style=filled;
color=gray75;
1873[label="168.157.201.66;5pkt 5fpkt", shape=pentagon, color=darkviolet];
2415[label="168.157.201.66;5pkt 5fpkt", shape=invtriangle, color=brown];
stat377[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.157.201.66:37946, 2.4.1.55:80}[20%]&lt;BR/&gt;{168.157.201.66:37948, 2.4.1.189:80}[20%]&lt;BR/&gt;{168.157.201.66:37945, 2.4.1.179:80}[20%]&lt;BR/&gt;{168.157.201.66:37947, 2.4.1.179:80}[20%]&lt;BR/&gt;{168.157.201.66:37949, 2.4.1.179:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 37949: (10%)&lt;BR/&gt; 37948: (10%)&lt;BR/&gt; 37947: (10%)&lt;BR/&gt; 37946: (10%)&gt;];
}
1873--2415[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="2.4.1.179" dst_port="80" src_ip="168.157.201.66" src_port="37949"/>
      <filter dst_ip="2.4.1.179" dst_port="80" src_ip="168.157.201.66" src_port="37947"/>
      <filter dst_ip="2.4.1.179" dst_port="80" src_ip="168.157.201.66" src_port="37945"/>
      <filter dst_ip="2.4.1.189" dst_port="80" src_ip="168.157.201.66" src_port="37948"/>
      <filter dst_ip="2.4.1.55" dst_port="80" src_ip="168.157.201.66" src_port="37946"/>
    </slice>
    <from sec="1104555654" usec="0"/>
    <to sec="1104555663" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_378{
style=filled;
color=gray75;
1874[label="209.241.216.67;43pkt 43fpkt", shape=pentagon, color=darkviolet];
2416[label="209.241.216.67;42pkt 42fpkt", shape=invtriangle, color=brown];
2755[label="209.241.216.67;43pkt 43fpkt", shape=invhouse, color=bisque];
stat378[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.241.216.67:4167, *:53}[90.6977%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (46.4844%)&lt;BR/&gt; 4167: (45.3125%)&lt;BR/&gt; 42746: (1.17188%)&lt;BR/&gt; 9898: (1.17188%)&lt;BR/&gt; 4504: (1.17188%)&gt;];
}
1874--2416[label="1;42pkt 42fpkt"];
1874--2755[label="1;43pkt 43fpkt"];
2416--2755[label="1;42pkt 42fpkt"];
</description>
    <slice>
      <filter dst_port="53" src_ip="209.241.216.67" src_port="4167"/>
    </slice>
    <from sec="1104555669" usec="0"/>
    <to sec="1104556293" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.543623,1.56736,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_379{
style=filled;
color=gray75;
1881[label="208.176.136.69;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2420[label="208.176.136.69;1pkt 1fpkt", shape=invtriangle, color=brown];
stat379[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.176.136.69:80, 5.22.8.196:34394}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 34394: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
1881--2420[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="5.22.8.196" dst_port="34394" src_ip="208.176.136.69" src_port="80"/>
    </slice>
    <from sec="1104555604" usec="0"/>
    <to sec="1104555609" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_380{
style=filled;
color=gray75;
1884[label="80.37.173.70;125pkt 125fpkt", shape=pentagon, color=darkviolet];
2422[label="80.37.173.70;125pkt 125fpkt", shape=invtriangle, color=brown];
2759[label="80.37.173.70;126pkt 126fpkt", shape=invhouse, color=bisque];
stat380[shape=component, label=&lt;Rules:&lt;BR/&gt;{80.37.173.70:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 3970: (0.398936%)&lt;BR/&gt; 3969: (0.398936%)&lt;BR/&gt; 3968: (0.398936%)&lt;BR/&gt; 3967: (0.398936%)&gt;];
}
1884--2422[label="1;125pkt 125fpkt"];
1884--2759[label="1;125pkt 125fpkt"];
2422--2759[label="1;125pkt 125fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="80.37.173.70"/>
    </slice>
    <from sec="1104556098" usec="0"/>
    <to sec="1104556100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_382{
style=filled;
color=gray75;
1889[label="147.103.176.72;9pkt 9fpkt", shape=pentagon, color=darkviolet];
2424[label="147.103.176.72;9pkt 9fpkt", shape=invtriangle, color=brown];
2760[label="147.103.176.72;9pkt 9fpkt", shape=invhouse, color=bisque];
stat382[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.103.176.72:32790, *:53}[44.4444%]&lt;BR/&gt;{147.103.176.72:80, *:*}[33.3333%]&lt;BR/&gt;{147.103.176.72:53, *:*}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (33.3333%)&lt;BR/&gt; 32790: (22.2222%)&lt;BR/&gt; 80: (16.6667%)&lt;BR/&gt; 60187: (5.55556%)&lt;BR/&gt; 57634: (5.55556%)&gt;];
}
1889--2424[label="1;9pkt 9fpkt"];
1889--2760[label="1;9pkt 9fpkt"];
2424--2760[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter src_ip="147.103.176.72" src_port="80"/>
      <filter src_ip="147.103.176.72" src_port="53"/>
      <filter dst_port="53" src_ip="147.103.176.72" src_port="32790"/>
    </slice>
    <from sec="1104555996" usec="0"/>
    <to sec="1104556492" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="149.222.103.73"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_385{
style=filled;
color=gray75;
1894[label="168.157.92.74;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2427[label="168.157.92.74;2pkt 2fpkt", shape=invtriangle, color=brown];
2762[label="168.157.92.74;2pkt 2fpkt", shape=invhouse, color=bisque];
stat385[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.157.92.74:1058, 1.0.37.211:80}[50%]&lt;BR/&gt;{168.157.92.74:1059, 1.0.37.211:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1059: (30%)&lt;BR/&gt; 1058: (20%)&gt;];
}
1894--2427[label="1;1pkt 1fpkt"];
1894--2762[label="1;1pkt 1fpkt"];
2427--2762[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="1.0.37.211" dst_port="80" src_ip="168.157.92.74" src_port="1059"/>
      <filter dst_ip="1.0.37.211" dst_port="80" src_ip="168.157.92.74" src_port="1058"/>
    </slice>
    <from sec="1104556082" usec="0"/>
    <to sec="1104556086" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.543623,1.56736,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_386{
style=filled;
color=gray75;
1904[label="208.70.143.78;4pkt 4fpkt", shape=pentagon, color=darkviolet];
2436[label="208.70.143.78;5pkt 5fpkt", shape=invtriangle, color=brown];
stat386[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.70.143.78:1894, 149.223.138.116:1434}[20%]&lt;BR/&gt;{208.70.143.78:1894, 147.7.198.128:1434}[20%]&lt;BR/&gt;{208.70.143.78:1894, 168.221.66.197:1434}[20%]&lt;BR/&gt;{208.70.143.78:1894, 147.103.110.223:1434}[20%]&lt;BR/&gt;{208.70.143.78:1894, 147.128.129.244:1434}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1894: (50%)&lt;BR/&gt; 1434: (50%)&gt;];
}
1904--2436[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="147.128.129.244" dst_port="1434" src_ip="208.70.143.78" src_port="1894"/>
      <filter dst_ip="147.103.110.223" dst_port="1434" src_ip="208.70.143.78" src_port="1894"/>
      <filter dst_ip="168.221.66.197" dst_port="1434" src_ip="208.70.143.78" src_port="1894"/>
      <filter dst_ip="147.7.198.128" dst_port="1434" src_ip="208.70.143.78" src_port="1894"/>
      <filter dst_ip="149.223.138.116" dst_port="1434" src_ip="208.70.143.78" src_port="1894"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.543623,1.56736,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_387{
style=filled;
color=gray75;
1920[label="149.222.87.84;38pkt 38fpkt", shape=pentagon, color=darkviolet];
2446[label="149.222.87.84;39pkt 39fpkt", shape=invtriangle, color=brown];
stat387[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.222.87.84:*, *:25}[53.8462%]&lt;BR/&gt;{149.222.87.84:25, *:*}[20.5128%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (37.013%)&lt;BR/&gt; 113: (9.09091%)&lt;BR/&gt; 3003: (3.8961%)&lt;BR/&gt; 53: (3.8961%)&lt;BR/&gt; 62184: (1.2987%)&gt;];
}
1920--2446[label="1;38pkt 38fpkt"];
</description>
    <slice>
      <filter src_ip="149.222.87.84" src_port="25"/>
      <filter dst_port="25" src_ip="149.222.87.84"/>
    </slice>
    <from sec="1104555602" usec="0"/>
    <to sec="1104556407" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.543623,1.56736,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_388{
style=filled;
color=gray75;
1933[label="168.157.140.87;65pkt 65fpkt", shape=pentagon, color=darkviolet];
2452[label="168.157.140.87;66pkt 66fpkt", shape=invtriangle, color=brown];
stat388[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.157.140.87:49323, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 49323: (50%)&lt;BR/&gt; 65022: (0.763359%)&lt;BR/&gt; 63398: (0.763359%)&lt;BR/&gt; 63194: (0.763359%)&lt;BR/&gt; 63049: (0.763359%)&gt;];
}
1933--2452[label="1;65pkt 65fpkt"];
</description>
    <slice>
      <filter src_ip="168.157.140.87" src_port="49323"/>
    </slice>
    <from sec="1104555620" usec="0"/>
    <to sec="1104556489" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="196.145.217.91"/>
    </slice>
    <from sec="1104555604" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="196.139.56.95"/>
    </slice>
    <from sec="1104555794" usec="0"/>
    <to sec="1104556122" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.829474,1.51438,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_391{
style=filled;
color=gray75;
1126[label="149.223.90.225;d;86pkt 86fpkt", shape=diamond, color=yellow];
1879[label="208.51.112.69;11pkt 11fpkt", shape=pentagon, color=darkviolet];
1952[label="196.149.227.100;11pkt 11fpkt", shape=pentagon, color=darkviolet];
2419[label="208.51.112.69;11pkt 11fpkt", shape=invtriangle, color=brown];
2462[label="196.149.227.100;12pkt 12fpkt", shape=invtriangle, color=brown];
2758[label="208.51.112.69;12pkt 12fpkt", shape=invhouse, color=bisque];
2782[label="196.149.227.100;12pkt 12fpkt", shape=invhouse, color=bisque];
stat391[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.141.218.231:80, 149.223.90.225:*}[56.8182%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 65008: (1.29032%)&lt;BR/&gt; 64716: (1.29032%)&lt;BR/&gt; 64693: (1.29032%)&lt;BR/&gt; 64672: (1.29032%)&gt;];
}
1126--1777[label="0.0454545;3pkt 3fpkt"];
1126--1879[label="0.818182;9pkt 9fpkt"];
1126--1952[label="1;11pkt 11fpkt"];
1126--2419[label="0.818182;9pkt 9fpkt"];
1126--2462[label="1;12pkt 12fpkt"];
1126--2758[label="0.833333;10pkt 10fpkt"];
1126--2782[label="1;12pkt 12fpkt"];
1879--2419[label="1;11pkt 11fpkt"];
1879--2758[label="1;11pkt 11fpkt"];
1952--2462[label="1;11pkt 11fpkt"];
1952--2782[label="1;11pkt 11fpkt"];
2419--2758[label="1;11pkt 11fpkt"];
2462--2782[label="1;12pkt 12fpkt"];
</description>
    <slice>
      <filter dst_ip="149.223.90.225" src_ip="209.141.218.231" src_port="80"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556361" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="207.96.237.100"/>
    </slice>
    <from sec="1104555613" usec="0"/>
    <to sec="1104556499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_393{
style=filled;
color=gray75;
1959[label="149.222.152.104;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2467[label="149.222.152.104;12pkt 12fpkt", shape=invtriangle, color=brown];
2786[label="149.222.152.104;11pkt 11fpkt", shape=invhouse, color=bisque];
stat393[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.222.152.104:*, 192.78.32.89:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (45.8333%)&lt;BR/&gt; 1146: (6.25%)&lt;BR/&gt; 1106: (4.16667%)&lt;BR/&gt; 1100: (4.16667%)&lt;BR/&gt; 1098: (4.16667%)&gt;];
}
1959--2467[label="1;1pkt 1fpkt"];
1959--2786[label="1;1pkt 1fpkt"];
2467--2786[label="1;11pkt 11fpkt"];
</description>
    <slice>
      <filter dst_ip="192.78.32.89" dst_port="80" src_ip="149.222.152.104"/>
    </slice>
    <from sec="1104556320" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="209.65.110.106"/>
    </slice>
    <from sec="1104555601" usec="0"/>
    <to sec="1104556065" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831427,1.47848,999,1 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_395{
style=filled;
color=gray75;
40[label="149.222.60.145s;1pkt 1fpkt", shape=rectangle, color=red];
83[label="106.190.197.218d;2pkt 2fpkt", shape=rectangle, color=red];
424[label="106.190.197.218;d;7pkt 7fpkt", shape=diamond, color=yellow];
573[label="149.222.60.145;s;280pkt 280fpkt", shape=diamond, color=yellow];
1890[label="208.176.186.72;30pkt 30fpkt", shape=pentagon, color=darkviolet];
1931[label="208.186.43.87;49pkt 49fpkt", shape=pentagon, color=darkviolet];
1967[label="208.176.136.107;68pkt 68fpkt", shape=pentagon, color=darkviolet];
2048[label="149.222.60.145;360pkt 360fpkt", shape=pentagon, color=darkviolet];
2450[label="208.186.43.87;49pkt 49fpkt", shape=invtriangle, color=brown];
2472[label="208.176.136.107;69pkt 69fpkt", shape=invtriangle, color=brown];
2519[label="149.222.60.145;360pkt 360fpkt", shape=invtriangle, color=brown];
stat395[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.222.60.145:25, *:*}[48.3366%]&lt;BR/&gt;{149.222.60.145:*, *:25}[22.1135%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (48.0392%)&lt;BR/&gt; 113: (1.4902%)&lt;BR/&gt; 53: (0.392157%)&lt;BR/&gt; 2860: (0.352941%)&lt;BR/&gt; 4680: (0.235294%)&gt;];
}
40--83[label="1;1pkt 1fpkt"];
40--211[label="1;1pkt 1fpkt"];
40--424[label="1;1pkt 1fpkt"];
40--573[label="1;1pkt 1fpkt"];
40--2048[label="1;1pkt 1fpkt"];
40--2519[label="1;1pkt 1fpkt"];
83--211[label="0.5;1pkt 1fpkt"];
83--424[label="1;2pkt 2fpkt"];
83--573[label="0.5;1pkt 1fpkt"];
83--1967[label="0.5;1pkt 1fpkt"];
83--2048[label="0.5;1pkt 1fpkt"];
83--2472[label="0.5;1pkt 1fpkt"];
83--2519[label="0.5;1pkt 1fpkt"];
424--573[label="0.142857;1pkt 1fpkt"];
424--1890[label="0.142857;1pkt 1fpkt"];
424--1931[label="0.142857;1pkt 1fpkt"];
424--1967[label="0.142857;1pkt 1fpkt"];
424--2048[label="0.142857;1pkt 1fpkt"];
424--2450[label="0.142857;1pkt 1fpkt"];
424--2472[label="0.142857;1pkt 1fpkt"];
424--2519[label="0.142857;1pkt 1fpkt"];
573--2048[label="1;280pkt 280fpkt"];
573--2519[label="1;280pkt 280fpkt"];
1931--2450[label="1;49pkt 49fpkt"];
1967--2472[label="1;68pkt 68fpkt"];
2048--2519[label="1;360pkt 360fpkt"];
</description>
    <slice>
      <filter src_ip="149.222.60.145" src_port="25"/>
      <filter dst_port="25" src_ip="149.222.60.145"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="196.157.187.107"/>
    </slice>
    <from sec="1104555625" usec="0"/>
    <to sec="1104556498" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_397{
style=filled;
color=gray75;
1971[label="173.172.97.109;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2475[label="173.172.97.109;3pkt 3fpkt", shape=invtriangle, color=brown];
2792[label="173.172.97.109;2pkt 2fpkt", shape=invhouse, color=bisque];
stat397[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.172.97.109:32790, 212.89.52.82:1863}[33.3333%]&lt;BR/&gt;{173.172.97.109:32781, 214.51.163.140:5190}[33.3333%]&lt;BR/&gt;{173.172.97.109:32780, 192.219.195.208:5050}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 32790: (21.4286%)&lt;BR/&gt; 32780: (21.4286%)&lt;BR/&gt; 5050: (21.4286%)&lt;BR/&gt; 1863: (21.4286%)&lt;BR/&gt; 32781: (7.14286%)&gt;];
}
1971--2475[label="1;2pkt 2fpkt"];
1971--2792[label="1;2pkt 2fpkt"];
2475--2792[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="192.219.195.208" dst_port="5050" src_ip="173.172.97.109" src_port="32780"/>
      <filter dst_ip="214.51.163.140" dst_port="5190" src_ip="173.172.97.109" src_port="32781"/>
      <filter dst_ip="212.89.52.82" dst_port="1863" src_ip="173.172.97.109" src_port="32790"/>
    </slice>
    <from sec="1104555625" usec="0"/>
    <to sec="1104556493" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.869852,1.50349,002,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_398{
style=filled;
color=gray75;
125[label="211.75.130.109s;80pkt 80fpkt", shape=rectangle, color=red];
1972[label="211.75.130.109;118pkt 118fpkt", shape=pentagon, color=darkviolet];
2476[label="211.75.130.109;119pkt 119fpkt", shape=invtriangle, color=brown];
2793[label="211.75.130.109;118pkt 118fpkt", shape=invhouse, color=bisque];
stat398[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.75.130.109:1029, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1029: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
125--1972[label="0.9875;79pkt 79fpkt"];
125--2476[label="1;80pkt 80fpkt"];
125--2793[label="0.9875;79pkt 79fpkt"];
1972--2476[label="1;118pkt 118fpkt"];
1972--2793[label="1;118pkt 118fpkt"];
2476--2793[label="1;118pkt 118fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="211.75.130.109" src_port="1029"/>
    </slice>
    <from sec="1104555654" usec="0"/>
    <to sec="1104555683" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_399{
style=filled;
color=gray75;
1973[label="168.157.140.109;7pkt 7fpkt", shape=pentagon, color=darkviolet];
2477[label="168.157.140.109;8pkt 8fpkt", shape=invtriangle, color=brown];
2794[label="168.157.140.109;7pkt 7fpkt", shape=invhouse, color=bisque];
stat399[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.157.140.109:80, 81.1.62.134:*}[62.5%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 53611: (6.81818%)&lt;BR/&gt; 40210: (6.81818%)&lt;BR/&gt; 40085: (6.81818%)&lt;BR/&gt; 39753: (6.81818%)&gt;];
}
1973--2477[label="1;7pkt 7fpkt"];
1973--2794[label="1;7pkt 7fpkt"];
2477--2794[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="81.1.62.134" src_ip="168.157.140.109" src_port="80"/>
    </slice>
    <from sec="1104555843" usec="0"/>
    <to sec="1104556472" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_400{
style=filled;
color=gray75;
1983[label="28.234.16.116;135pkt 135fpkt", shape=pentagon, color=darkviolet];
2481[label="28.234.16.116;135pkt 135fpkt", shape=invtriangle, color=brown];
2796[label="28.234.16.116;135pkt 135fpkt", shape=invhouse, color=bisque];
stat400[shape=component, label=&lt;Rules:&lt;BR/&gt;{28.234.16.116:*, *:1026}[54.8148%]&lt;BR/&gt;{28.234.16.116:*, *:1027}[45.1852%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (27.4074%)&lt;BR/&gt; 1027: (22.5926%)&lt;BR/&gt; 39422: (0.740741%)&lt;BR/&gt; 38569: (0.740741%)&lt;BR/&gt; 37669: (0.740741%)&gt;];
}
1983--2481[label="1;135pkt 135fpkt"];
1983--2796[label="1;135pkt 135fpkt"];
2481--2796[label="1;135pkt 135fpkt"];
</description>
    <slice>
      <filter dst_port="1026" src_ip="28.234.16.116"/>
      <filter dst_port="1027" src_ip="28.234.16.116"/>
    </slice>
    <from sec="1104555609" usec="0"/>
    <to sec="1104556489" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="195.91.98.118"/>
    </slice>
    <from sec="1104555629" usec="0"/>
    <to sec="1104556489" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="194.214.162.118"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="216.115.231.120"/>
    </slice>
    <from sec="1104555609" usec="0"/>
    <to sec="1104556497" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.543623,1.56736,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_404{
style=filled;
color=gray75;
1994[label="28.178.33.121;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2487[label="28.178.33.121;1pkt 1fpkt", shape=invtriangle, color=brown];
stat404[shape=component, label=&lt;Rules:&lt;BR/&gt;{28.178.33.121:47056, 147.103.215.228:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 47056: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
1994--2487[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="147.103.215.228" dst_port="80" src_ip="28.178.33.121" src_port="47056"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="194.20.92.121"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.543623,1.56736,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_406{
style=filled;
color=gray75;
2011[label="209.241.216.130;32pkt 32fpkt", shape=pentagon, color=darkviolet];
2497[label="209.241.216.130;32pkt 32fpkt", shape=invtriangle, color=brown];
stat406[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.241.216.130:*, *:25}[43.75%]&lt;BR/&gt;{209.241.216.130:53, *:*}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (25%)&lt;BR/&gt; 53: (20.3125%)&lt;BR/&gt; 52136: (4.6875%)&lt;BR/&gt; 80: (4.6875%)&lt;BR/&gt; 49579: (3.125%)&gt;];
}
2011--2497[label="1;32pkt 32fpkt"];
</description>
    <slice>
      <filter src_ip="209.241.216.130" src_port="53"/>
      <filter dst_port="25" src_ip="209.241.216.130"/>
    </slice>
    <from sec="1104555618" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="5.179.46.131"/>
    </slice>
    <from sec="1104555601" usec="0"/>
    <to sec="1104556490" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.969528,1.5126,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_408{
style=filled;
color=gray75;
992[label="3.36.223.181;d;404pkt 404fpkt", shape=diamond, color=yellow];
1091[label="173.172.7.76;s;9pkt 9fpkt", shape=diamond, color=yellow];
1562[label="173.172.7.76;s;5pkt 5fpkt", shape=hexagon, color=black];
1712[label="173.172.53.11;22pkt 22fpkt", shape=pentagon, color=darkviolet];
1866[label="173.172.97.64;45pkt 45fpkt", shape=pentagon, color=darkviolet];
1876[label="173.172.96.68;27pkt 27fpkt", shape=pentagon, color=darkviolet];
1958[label="173.172.86.104;16pkt 16fpkt", shape=pentagon, color=darkviolet];
2026[label="173.172.52.136;15pkt 15fpkt", shape=pentagon, color=darkviolet];
2203[label="173.172.96.210;13pkt 13fpkt", shape=pentagon, color=darkviolet];
2504[label="173.172.52.136;15pkt 15fpkt", shape=invtriangle, color=brown];
stat408[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 3.36.223.181:*}[91.8103%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.0736%)&lt;BR/&gt; 25: (1.05079%)&lt;BR/&gt; 0: (0.875657%)&lt;BR/&gt; 113: (0.350263%)&lt;BR/&gt; 60492: (0.262697%)&gt;];
}
992--1091[label="0.666667;6pkt 6fpkt"];
992--1562[label="0.6;3pkt 3fpkt"];
992--1712[label="0.454545;10pkt 10fpkt"];
992--1866[label="0.488889;22pkt 22fpkt"];
992--1876[label="0.666667;18pkt 18fpkt"];
992--1958[label="0.5;8pkt 8fpkt"];
992--2026[label="0.8;12pkt 12fpkt"];
992--2203[label="0.846154;11pkt 11fpkt"];
992--2504[label="0.8;12pkt 12fpkt"];
1091--1562[label="1;5pkt 5fpkt"];
2026--2504[label="1;15pkt 15fpkt"];
</description>
    <slice>
      <filter dst_ip="3.36.223.181" src_port="80"/>
    </slice>
    <from sec="1104555607" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_409{
style=filled;
color=gray75;
2031[label="168.157.93.138;15pkt 15fpkt", shape=pentagon, color=darkviolet];
2507[label="168.157.93.138;14pkt 14fpkt", shape=invtriangle, color=brown];
2808[label="168.157.93.138;15pkt 15fpkt", shape=invhouse, color=bisque];
stat409[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.157.93.138:80, 81.1.62.231:*}[66.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 60701: (3.40909%)&lt;BR/&gt; 56963: (3.40909%)&lt;BR/&gt; 56906: (3.40909%)&lt;BR/&gt; 54383: (3.40909%)&gt;];
}
2031--2507[label="1;14pkt 14fpkt"];
2031--2808[label="1;15pkt 15fpkt"];
2507--2808[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter dst_ip="81.1.62.231" src_ip="168.157.93.138" src_port="80"/>
    </slice>
    <from sec="1104555707" usec="0"/>
    <to sec="1104556432" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_410{
style=filled;
color=gray75;
2032[label="149.223.219.138;90pkt 90fpkt", shape=pentagon, color=darkviolet];
2508[label="149.223.219.138;89pkt 89fpkt", shape=invtriangle, color=brown];
2809[label="149.223.219.138;90pkt 90fpkt", shape=invhouse, color=bisque];
stat410[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.223.219.138:32768, *:53}[46.6667%]&lt;BR/&gt;{149.223.219.138:*, *:25}[34.4444%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (32.1561%)&lt;BR/&gt; 32768: (23.2342%)&lt;BR/&gt; 25: (17.8439%)&lt;BR/&gt; 0: (2.23048%)&lt;BR/&gt; 61799: (0.557621%)&gt;];
}
2032--2508[label="1;89pkt 89fpkt"];
2032--2809[label="1;90pkt 90fpkt"];
2508--2809[label="1;89pkt 89fpkt"];
</description>
    <slice>
      <filter dst_port="25" src_ip="149.223.219.138"/>
      <filter dst_port="53" src_ip="149.223.219.138" src_port="32768"/>
    </slice>
    <from sec="1104555621" usec="0"/>
    <to sec="1104556433" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.543623,1.56736,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_412{
style=filled;
color=gray75;
2035[label="207.142.161.139;43pkt 43fpkt", shape=pentagon, color=darkviolet];
2510[label="207.142.161.139;43pkt 43fpkt", shape=invtriangle, color=brown];
stat412[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.142.161.139:*, 140.72.78.18:524}[27.907%]&lt;BR/&gt;{207.142.161.139:*, 140.72.78.16:524}[25.5814%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 524: (26.7442%)&lt;BR/&gt; 427: (9.30233%)&lt;BR/&gt; 138: (6.97674%)&lt;BR/&gt; 2351: (5.81395%)&lt;BR/&gt; 139: (4.65116%)&gt;];
}
2035--2510[label="1;43pkt 43fpkt"];
</description>
    <slice>
      <filter dst_ip="140.72.78.18" dst_port="524" src_ip="207.142.161.139"/>
      <filter dst_ip="140.72.78.16" dst_port="524" src_ip="207.142.161.139"/>
    </slice>
    <from sec="1104555614" usec="0"/>
    <to sec="1104556441" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.829474,1.51438,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_413{
style=filled;
color=gray75;
501[label="140.10.30.112;d;114pkt 114fpkt", shape=diamond, color=yellow];
1730[label="81.2.31.17;1pkt 1fpkt", shape=pentagon, color=darkviolet];
1951[label="196.184.172.99;1pkt 1fpkt", shape=pentagon, color=darkviolet];
1953[label="207.96.237.100;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2036[label="81.36.224.139;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2093[label="207.74.115.161;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2181[label="206.217.242.201;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2282[label="207.75.108.245;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2291[label="197.203.155.249;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2332[label="81.2.31.17;1pkt 1fpkt", shape=invtriangle, color=brown];
2461[label="196.184.172.99;2pkt 2fpkt", shape=invtriangle, color=brown];
2511[label="81.36.224.139;1pkt 1fpkt", shape=invtriangle, color=brown];
2667[label="207.75.108.245;1pkt 1fpkt", shape=invtriangle, color=brown];
2781[label="196.184.172.99;1pkt 1fpkt", shape=invhouse, color=bisque];
2783[label="207.96.237.100;1pkt 1fpkt", shape=invhouse, color=bisque];
2790[label="196.157.187.107;1pkt 1fpkt", shape=invhouse, color=bisque];
2811[label="81.36.224.139;2pkt 2fpkt", shape=invhouse, color=bisque];
2909[label="207.75.108.245;1pkt 1fpkt", shape=invhouse, color=bisque];
stat413[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:6868, 140.10.30.112:6899}[72.1739%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6899: (38.806%)&lt;BR/&gt; 6868: (33.9552%)&lt;BR/&gt; 0: (22.3881%)&lt;BR/&gt; 1748: (0.746269%)&lt;BR/&gt; 65254: (0.373134%)&gt;];
}
501--1730[label="1;1pkt 1fpkt"];
501--1953[label="1;1pkt 1fpkt"];
501--2036[label="1;2pkt 2fpkt"];
501--2093[label="1;1pkt 1fpkt"];
501--2181[label="1;1pkt 1fpkt"];
501--2282[label="1;1pkt 1fpkt"];
501--2291[label="1;1pkt 1fpkt"];
501--2332[label="1;1pkt 1fpkt"];
501--2461[label="0.5;1pkt 1fpkt"];
501--2511[label="1;1pkt 1fpkt"];
501--2667[label="1;1pkt 1fpkt"];
501--2783[label="1;1pkt 1fpkt"];
501--2790[label="1;1pkt 1fpkt"];
501--2811[label="1;2pkt 2fpkt"];
501--2909[label="1;1pkt 1fpkt"];
1730--2332[label="1;1pkt 1fpkt"];
1951--2461[label="1;1pkt 1fpkt"];
1951--2781[label="1;1pkt 1fpkt"];
1953--2783[label="1;1pkt 1fpkt"];
2036--2511[label="1;1pkt 1fpkt"];
2036--2811[label="1;2pkt 2fpkt"];
2282--2667[label="1;1pkt 1fpkt"];
2282--2909[label="1;1pkt 1fpkt"];
2461--2781[label="1;1pkt 1fpkt"];
2511--2811[label="1;1pkt 1fpkt"];
2667--2909[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="140.10.30.112" dst_port="6899" src_port="6868"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="29.81.54.141"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677562,1.52895,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_416{
style=filled;
color=gray75;
480[label="219.95.126.142;s;4641pkt 4641fpkt", shape=diamond, color=yellow];
2042[label="219.95.126.142;14pkt 14fpkt", shape=pentagon, color=darkviolet];
2515[label="219.95.126.142;13pkt 13fpkt", shape=invtriangle, color=brown];
stat416[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.95.126.142:34132, *:*}[97.7606%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 34132: (48.8218%)&lt;BR/&gt; 443: (0.642674%)&lt;BR/&gt; 80: (0.546272%)&lt;BR/&gt; 54045: (0.149957%)&lt;BR/&gt; 1025: (0.117823%)&gt;];
}
480--1653[label="0.000371471;1pkt 1fpkt"];
480--1657[label="0.000357782;1pkt 1fpkt"];
480--1669[label="0.000355366;1pkt 1fpkt"];
480--1670[label="0.000371471;1pkt 1fpkt"];
480--2042[label="0.785714;11pkt 11fpkt"];
480--2515[label="0.769231;10pkt 10fpkt"];
2042--2515[label="1;13pkt 13fpkt"];
</description>
    <slice>
      <filter src_ip="219.95.126.142" src_port="34132"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="194.11.20.144"/>
    </slice>
    <from sec="1104555613" usec="0"/>
    <to sec="1104556498" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_418{
style=filled;
color=gray75;
2051[label="173.172.48.146;10pkt 10fpkt", shape=pentagon, color=darkviolet];
2523[label="173.172.48.146;10pkt 10fpkt", shape=invtriangle, color=brown];
2817[label="173.172.48.146;10pkt 10fpkt", shape=invhouse, color=bisque];
stat418[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.172.48.146:*, 1.225.165.199:20}[50%]&lt;BR/&gt;{173.172.48.146:*, 200.161.79.191:21}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 20: (25%)&lt;BR/&gt; 21: (15%)&lt;BR/&gt; 5050: (5%)&lt;BR/&gt; 5005: (5%)&lt;BR/&gt; 5004: (5%)&gt;];
}
2051--2523[label="1;10pkt 10fpkt"];
2051--2817[label="1;10pkt 10fpkt"];
2523--2817[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter dst_ip="1.225.165.199" dst_port="20" src_ip="173.172.48.146"/>
      <filter dst_ip="200.161.79.191" dst_port="21" src_ip="173.172.48.146"/>
    </slice>
    <from sec="1104555644" usec="0"/>
    <to sec="1104556485" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_419{
style=filled;
color=gray75;
2057[label="149.223.221.147;16pkt 16fpkt", shape=pentagon, color=darkviolet];
2526[label="149.223.221.147;16pkt 16fpkt", shape=invtriangle, color=brown];
2819[label="149.223.221.147;15pkt 15fpkt", shape=invhouse, color=bisque];
stat419[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.223.221.147:25, *:*}[87.5%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (46.8085%)&lt;BR/&gt; 0: (6.38298%)&lt;BR/&gt; 51369: (3.19149%)&lt;BR/&gt; 35491: (3.19149%)&lt;BR/&gt; 29185: (3.19149%)&gt;];
}
2057--2526[label="1;16pkt 16fpkt"];
2057--2819[label="1;15pkt 15fpkt"];
2526--2819[label="1;15pkt 15fpkt"];
</description>
    <slice>
      <filter src_ip="149.223.221.147" src_port="25"/>
    </slice>
    <from sec="1104555627" usec="0"/>
    <to sec="1104556467" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677562,1.52895,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_421{
style=filled;
color=gray75;
1314[label="209.241.212.154;s;85pkt 85fpkt", shape=diamond, color=yellow];
2073[label="209.241.212.154;91pkt 91fpkt", shape=pentagon, color=darkviolet];
2535[label="209.241.212.154;92pkt 92fpkt", shape=invtriangle, color=brown];
stat421[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.241.212.154:25, *:*}[48.913%]&lt;BR/&gt;{209.241.212.154:*, *:113}[47.8261%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (24.4403%)&lt;BR/&gt; 113: (24.0672%)&lt;BR/&gt; 0: (1.1194%)&lt;BR/&gt; 135: (0.932836%)&lt;BR/&gt; 63519: (0.559701%)&gt;];
}
1314--2073[label="0.988235;84pkt 84fpkt"];
1314--2535[label="1;85pkt 85fpkt"];
2073--2535[label="1;91pkt 91fpkt"];
</description>
    <slice>
      <filter src_ip="209.241.212.154" src_port="25"/>
      <filter dst_port="113" src_ip="209.241.212.154"/>
    </slice>
    <from sec="1104555612" usec="0"/>
    <to sec="1104556498" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="81.133.14.155"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.543623,1.56736,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_423{
style=filled;
color=gray75;
2076[label="210.146.85.156;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2538[label="210.146.85.156;3pkt 3fpkt", shape=invtriangle, color=brown];
stat423[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.146.85.156:80, 173.172.52.211:2362}[33.3333%]&lt;BR/&gt;{210.146.85.156:80, 173.172.52.211:2365}[33.3333%]&lt;BR/&gt;{210.146.85.156:80, 173.172.52.211:2366}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2366: (16.6667%)&lt;BR/&gt; 2365: (16.6667%)&lt;BR/&gt; 2362: (16.6667%)&gt;];
}
2076--2538[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="173.172.52.211" dst_port="2366" src_ip="210.146.85.156" src_port="80"/>
      <filter dst_ip="173.172.52.211" dst_port="2365" src_ip="210.146.85.156" src_port="80"/>
      <filter dst_ip="173.172.52.211" dst_port="2362" src_ip="210.146.85.156" src_port="80"/>
    </slice>
    <from sec="1104556438" usec="0"/>
    <to sec="1104556477" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="81.206.176.158"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.543623,1.56736,001,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_425{
style=filled;
color=gray75;
2083[label="81.124.216.158;253pkt 253fpkt", shape=pentagon, color=darkviolet];
2542[label="81.124.216.158;254pkt 254fpkt", shape=invtriangle, color=brown];
stat425[shape=component, label=&lt;Rules:&lt;BR/&gt;{81.124.216.158:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 4999: (0.197239%)&lt;BR/&gt; 4998: (0.197239%)&lt;BR/&gt; 4997: (0.197239%)&lt;BR/&gt; 4996: (0.197239%)&gt;];
}
2083--2542[label="1;253pkt 253fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="81.124.216.158"/>
    </slice>
    <from sec="1104555712" usec="0"/>
    <to sec="1104555714" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.543623,1.56736,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_426{
style=filled;
color=gray75;
2084[label="149.223.219.158;37pkt 37fpkt", shape=pentagon, color=darkviolet];
2543[label="149.223.219.158;37pkt 37fpkt", shape=invtriangle, color=brown];
stat426[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.223.219.158:*, *:25}[67.5676%]&lt;BR/&gt;{149.223.219.158:*, 197.226.41.217:*}[32.4324%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (41.8919%)&lt;BR/&gt; 113: (8.10811%)&lt;BR/&gt; 4593: (1.35135%)&lt;BR/&gt; 4380: (1.35135%)&lt;BR/&gt; 3445: (1.35135%)&gt;];
}
2084--2543[label="1;37pkt 37fpkt"];
</description>
    <slice>
      <filter dst_ip="197.226.41.217" src_ip="149.223.219.158"/>
      <filter dst_port="25" src_ip="149.223.219.158"/>
    </slice>
    <from sec="1104555603" usec="0"/>
    <to sec="1104556498" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="196.109.104.162"/>
    </slice>
    <from sec="1104555608" usec="0"/>
    <to sec="1104556493" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="31.50.252.164"/>
    </slice>
    <from sec="1104555601" usec="0"/>
    <to sec="1104556474" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.959275,1.4634,999,1 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_429{
style=filled;
color=gray75;
67[label="198.174.47.223s;1pkt 1fpkt", shape=rectangle, color=red];
75[label="140.10.162.100d;1pkt 1fpkt", shape=rectangle, color=red];
430[label="140.10.162.100;d;15pkt 15fpkt", shape=diamond, color=yellow];
575[label="198.174.47.223;s;2pkt 2fpkt", shape=diamond, color=yellow];
2106[label="197.172.239.165;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2235[label="198.174.47.223;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2563[label="197.172.239.165;1pkt 1fpkt", shape=invtriangle, color=brown];
2638[label="198.174.47.223;1pkt 1fpkt", shape=invtriangle, color=brown];
2841[label="197.172.239.165;1pkt 1fpkt", shape=invhouse, color=bisque];
stat429[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 140.10.162.100:2162}[60%]&lt;BR/&gt;{*:8000, 140.10.162.100:4000}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2162: (26%)&lt;BR/&gt; 12009: (18%)&lt;BR/&gt; 25975: (10%)&lt;BR/&gt; 1280: (8%)&lt;BR/&gt; 1272: (8%)&gt;];
}
67--75[label="1;1pkt 1fpkt"];
67--430[label="1;1pkt 1fpkt"];
67--575[label="1;1pkt 1fpkt"];
67--2235[label="1;1pkt 1fpkt"];
75--430[label="1;1pkt 1fpkt"];
75--575[label="1;1pkt 1fpkt"];
75--2235[label="1;1pkt 1fpkt"];
430--575[label="1;2pkt 2fpkt"];
430--2106[label="1;1pkt 1fpkt"];
430--2235[label="1;2pkt 2fpkt"];
430--2563[label="1;1pkt 1fpkt"];
430--2638[label="1;1pkt 1fpkt"];
430--2841[label="1;1pkt 1fpkt"];
575--2235[label="1;2pkt 2fpkt"];
575--2638[label="1;1pkt 1fpkt"];
2106--2563[label="1;1pkt 1fpkt"];
2106--2841[label="1;1pkt 1fpkt"];
2235--2638[label="1;1pkt 1fpkt"];
2563--2841[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="140.10.162.100" dst_port="2162"/>
      <filter dst_ip="140.10.162.100" dst_port="4000" src_port="8000"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677562,1.52895,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_430{
style=filled;
color=gray75;
1050[label="149.222.154.167;s;124pkt 124fpkt", shape=diamond, color=yellow];
2107[label="149.222.154.167;129pkt 129fpkt", shape=pentagon, color=darkviolet];
2564[label="149.222.154.167;129pkt 129fpkt", shape=invtriangle, color=brown];
stat430[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.222.154.167:*, 212.64.252.66:80}[45.3846%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (44.2408%)&lt;BR/&gt; 53: (5.10471%)&lt;BR/&gt; 123: (1.3089%)&lt;BR/&gt; 64394: (0.39267%)&lt;BR/&gt; 64255: (0.39267%)&gt;];
}
1050--1638[label="0.00806452;1pkt 1fpkt"];
1050--1639[label="0.145161;18pkt 18fpkt"];
1050--1653[label="0.016129;2pkt 2fpkt"];
1050--1657[label="0.00806452;1pkt 1fpkt"];
1050--1659[label="0.00806452;1pkt 1fpkt"];
1050--1660[label="0.145161;18pkt 18fpkt"];
1050--1669[label="0.016129;2pkt 2fpkt"];
1050--1670[label="0.016129;2pkt 2fpkt"];
1050--1672[label="0.00806452;1pkt 1fpkt"];
1050--1673[label="0.145161;18pkt 18fpkt"];
1050--2107[label="0.991935;123pkt 123fpkt"];
1050--2564[label="0.991935;123pkt 123fpkt"];
2107--2564[label="1;129pkt 129fpkt"];
</description>
    <slice>
      <filter dst_ip="212.64.252.66" dst_port="80" src_ip="149.222.154.167"/>
    </slice>
    <from sec="1104555601" usec="0"/>
    <to sec="1104556491" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="1.229.160.169"/>
    </slice>
    <from sec="1104556167" usec="0"/>
    <to sec="1104556478" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.543623,1.56736,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_432{
style=filled;
color=gray75;
2115[label="149.222.16.171;75pkt 75fpkt", shape=pentagon, color=darkviolet];
2568[label="149.222.16.171;75pkt 75fpkt", shape=invtriangle, color=brown];
stat432[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.222.16.171:25, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 64270: (0.666667%)&lt;BR/&gt; 62002: (0.666667%)&lt;BR/&gt; 60775: (0.666667%)&lt;BR/&gt; 60709: (0.666667%)&gt;];
}
2115--2568[label="1;75pkt 75fpkt"];
</description>
    <slice>
      <filter src_ip="149.222.16.171" src_port="25"/>
    </slice>
    <from sec="1104555610" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="0.78.40.172"/>
    </slice>
    <from sec="1104555603" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="81.107.102.172"/>
    </slice>
    <from sec="1104555603" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.543623,1.56736,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_435{
style=filled;
color=gray75;
2117[label="192.8.132.172;4pkt 4fpkt", shape=pentagon, color=darkviolet];
2571[label="192.8.132.172;5pkt 5fpkt", shape=invtriangle, color=brown];
stat435[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.8.132.172:80, 149.223.90.157:1286}[20%]&lt;BR/&gt;{192.8.132.172:80, 140.10.172.22:43928}[20%]&lt;BR/&gt;{192.8.132.172:80, 140.10.172.22:43935}[20%]&lt;BR/&gt;{192.8.132.172:80, 140.10.172.22:43936}[20%]&lt;BR/&gt;{192.8.132.172:80, 140.10.172.22:43952}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 43952: (11.1111%)&lt;BR/&gt; 43936: (11.1111%)&lt;BR/&gt; 43935: (11.1111%)&lt;BR/&gt; 43928: (11.1111%)&gt;];
}
2117--2571[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="140.10.172.22" dst_port="43952" src_ip="192.8.132.172" src_port="80"/>
      <filter dst_ip="140.10.172.22" dst_port="43936" src_ip="192.8.132.172" src_port="80"/>
      <filter dst_ip="140.10.172.22" dst_port="43935" src_ip="192.8.132.172" src_port="80"/>
      <filter dst_ip="140.10.172.22" dst_port="43928" src_ip="192.8.132.172" src_port="80"/>
      <filter dst_ip="149.223.90.157" dst_port="1286" src_ip="192.8.132.172" src_port="80"/>
    </slice>
    <from sec="1104555891" usec="0"/>
    <to sec="1104556115" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_436{
style=filled;
color=gray75;
2121[label="149.223.189.173;30pkt 30fpkt", shape=pentagon, color=darkviolet];
2574[label="149.223.189.173;30pkt 30fpkt", shape=invtriangle, color=brown];
2845[label="149.223.189.173;31pkt 31fpkt", shape=invhouse, color=bisque];
stat436[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.223.189.173:*, *:25}[67.7419%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (37.9121%)&lt;BR/&gt; 53: (12.0879%)&lt;BR/&gt; 1025: (8.79121%)&lt;BR/&gt; 46156: (1.64835%)&lt;BR/&gt; 34866: (1.64835%)&gt;];
}
2121--2574[label="1;30pkt 30fpkt"];
2121--2845[label="1;30pkt 30fpkt"];
2574--2845[label="1;30pkt 30fpkt"];
</description>
    <slice>
      <filter dst_port="25" src_ip="149.223.189.173"/>
    </slice>
    <from sec="1104555631" usec="0"/>
    <to sec="1104556480" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_437{
style=filled;
color=gray75;
2128[label="218.128.57.177;39pkt 39fpkt", shape=pentagon, color=darkviolet];
2578[label="218.128.57.177;38pkt 38fpkt", shape=invtriangle, color=brown];
2848[label="218.128.57.177;39pkt 39fpkt", shape=invhouse, color=bisque];
stat437[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.128.57.177:80, 149.223.28.128:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 64845: (1.2931%)&lt;BR/&gt; 64840: (1.2931%)&lt;BR/&gt; 64833: (1.2931%)&lt;BR/&gt; 64826: (1.2931%)&gt;];
}
2128--2578[label="1;38pkt 38fpkt"];
2128--2848[label="1;39pkt 39fpkt"];
2578--2848[label="1;38pkt 38fpkt"];
</description>
    <slice>
      <filter dst_ip="149.223.28.128" src_ip="218.128.57.177" src_port="80"/>
    </slice>
    <from sec="1104555604" usec="0"/>
    <to sec="1104556085" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="197.70.60.178"/>
    </slice>
    <from sec="1104555664" usec="0"/>
    <to sec="1104556497" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="201.201.195.179"/>
    </slice>
    <from sec="1104555664" usec="0"/>
    <to sec="1104556492" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_440{
style=filled;
color=gray75;
2145[label="173.172.2.185;7pkt 7fpkt", shape=pentagon, color=darkviolet];
2587[label="173.172.2.185;8pkt 8fpkt", shape=invtriangle, color=brown];
2854[label="173.172.2.185;8pkt 8fpkt", shape=invhouse, color=bisque];
stat440[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.172.2.185:25, 222.86.5.232:*}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 53998: (6.52174%)&lt;BR/&gt; 52315: (6.52174%)&lt;BR/&gt; 49019: (6.52174%)&lt;BR/&gt; 43805: (6.52174%)&gt;];
}
2145--2587[label="1;7pkt 7fpkt"];
2145--2854[label="1;7pkt 7fpkt"];
2587--2854[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="222.86.5.232" src_ip="173.172.2.185" src_port="25"/>
    </slice>
    <from sec="1104555680" usec="0"/>
    <to sec="1104556483" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_441{
style=filled;
color=gray75;
2146[label="147.103.172.185;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2588[label="147.103.172.185;2pkt 2fpkt", shape=invtriangle, color=brown];
2855[label="147.103.172.185;2pkt 2fpkt", shape=invhouse, color=bisque];
stat441[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.103.172.185:1312, 216.222.61.28:6667}[50%]&lt;BR/&gt;{147.103.172.185:2717, 216.41.203.52:7000}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7000: (25%)&lt;BR/&gt; 6667: (25%)&lt;BR/&gt; 2717: (25%)&lt;BR/&gt; 1312: (25%)&gt;];
}
2146--2588[label="1;2pkt 2fpkt"];
2146--2855[label="1;2pkt 2fpkt"];
2588--2855[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="216.41.203.52" dst_port="7000" src_ip="147.103.172.185" src_port="2717"/>
      <filter dst_ip="216.222.61.28" dst_port="6667" src_ip="147.103.172.185" src_port="1312"/>
    </slice>
    <from sec="1104555619" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.543623,1.56736,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_442{
style=filled;
color=gray75;
2156[label="147.181.23.192;24pkt 24fpkt", shape=pentagon, color=darkviolet];
2596[label="147.181.23.192;24pkt 24fpkt", shape=invtriangle, color=brown];
stat442[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.181.23.192:80, 212.89.57.135:*}[45.8333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 62938: (2.08333%)&lt;BR/&gt; 59762: (2.08333%)&lt;BR/&gt; 59750: (2.08333%)&lt;BR/&gt; 59174: (2.08333%)&gt;];
}
2156--2596[label="1;24pkt 24fpkt"];
</description>
    <slice>
      <filter dst_ip="212.89.57.135" src_ip="147.181.23.192" src_port="80"/>
    </slice>
    <from sec="1104555629" usec="0"/>
    <to sec="1104556490" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.829474,1.51438,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_443{
style=filled;
color=gray75;
970[label="147.103.181.207;d;52pkt 52fpkt", shape=diamond, color=yellow];
2157[label="1.244.47.192;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2597[label="1.244.47.192;1pkt 1fpkt", shape=invtriangle, color=brown];
2862[label="1.244.47.192;1pkt 1fpkt", shape=invhouse, color=bisque];
stat443[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.88.71.243:*, 147.103.181.207:80}[26.9231%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 59773: (3.63636%)&lt;BR/&gt; 58555: (0.909091%)&lt;BR/&gt; 57695: (0.909091%)&lt;BR/&gt; 55650: (0.909091%)&gt;];
}
970--1639[label="0.0192308;1pkt 1fpkt"];
970--1653[label="0.0384615;2pkt 2fpkt"];
970--1657[label="0.0384615;2pkt 2fpkt"];
970--1660[label="0.0192308;1pkt 1fpkt"];
970--1669[label="0.173077;9pkt 9fpkt"];
970--1670[label="0.0384615;2pkt 2fpkt"];
970--1673[label="0.0192308;1pkt 1fpkt"];
970--2157[label="1;1pkt 1fpkt"];
970--2597[label="1;1pkt 1fpkt"];
970--2862[label="1;1pkt 1fpkt"];
2157--2597[label="1;1pkt 1fpkt"];
2157--2862[label="1;1pkt 1fpkt"];
2597--2862[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="147.103.181.207" dst_port="80" src_ip="2.88.71.243"/>
    </slice>
    <from sec="1104555603" usec="0"/>
    <to sec="1104556333" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_444{
style=filled;
color=gray75;
2164[label="147.103.53.194;12pkt 12fpkt", shape=pentagon, color=darkviolet];
2601[label="147.103.53.194;12pkt 12fpkt", shape=invtriangle, color=brown];
2866[label="147.103.53.194;12pkt 12fpkt", shape=invhouse, color=bisque];
stat444[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.103.53.194:*, 207.66.200.175:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 54412: (4.16667%)&lt;BR/&gt; 1422: (4.16667%)&lt;BR/&gt; 1411: (4.16667%)&lt;BR/&gt; 1410: (4.16667%)&gt;];
}
2164--2601[label="1;12pkt 12fpkt"];
2164--2866[label="1;12pkt 12fpkt"];
2601--2866[label="1;12pkt 12fpkt"];
</description>
    <slice>
      <filter dst_ip="207.66.200.175" dst_port="80" src_ip="147.103.53.194"/>
    </slice>
    <from sec="1104556233" usec="0"/>
    <to sec="1104556287" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.829474,1.51438,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_445{
style=filled;
color=gray75;
1297[label="149.223.125.195;s;241pkt 241fpkt", shape=diamond, color=yellow];
2167[label="149.223.125.195;258pkt 258fpkt", shape=pentagon, color=darkviolet];
2602[label="149.223.125.195;258pkt 258fpkt", shape=invtriangle, color=brown];
2867[label="149.223.125.195;258pkt 258fpkt", shape=invhouse, color=bisque];
stat445[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.223.125.195:*, *:25}[83.3977%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (48.1281%)&lt;BR/&gt; 53: (1.33005%)&lt;BR/&gt; 113: (0.738916%)&lt;BR/&gt; 44690: (0.394089%)&lt;BR/&gt; 44917: (0.295567%)&gt;];
}
1297--1654[label="0.00414938;1pkt 1fpkt"];
1297--2167[label="0.995851;240pkt 240fpkt"];
1297--2602[label="0.995851;240pkt 240fpkt"];
1297--2867[label="0.995851;240pkt 240fpkt"];
2167--2602[label="1;258pkt 258fpkt"];
2167--2867[label="1;258pkt 258fpkt"];
2602--2867[label="1;258pkt 258fpkt"];
</description>
    <slice>
      <filter dst_port="25" src_ip="149.223.125.195"/>
    </slice>
    <from sec="1104555602" usec="0"/>
    <to sec="1104556493" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="195.190.69.196"/>
    </slice>
    <from sec="1104556148" usec="0"/>
    <to sec="1104556401" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_447{
style=filled;
color=gray75;
2173[label="147.103.167.197;12pkt 12fpkt", shape=pentagon, color=darkviolet];
2606[label="147.103.167.197;13pkt 13fpkt", shape=invtriangle, color=brown];
2869[label="147.103.167.197;13pkt 13fpkt", shape=invhouse, color=bisque];
stat447[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.103.167.197:1435, *:53}[53.8462%]&lt;BR/&gt;{147.103.167.197:80, *:*}[23.0769%]&lt;BR/&gt;{147.103.167.197:*, 192.198.196.203:*}[23.0769%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (34.2105%)&lt;BR/&gt; 1435: (26.3158%)&lt;BR/&gt; 80: (11.8421%)&lt;BR/&gt; 59176: (3.94737%)&lt;BR/&gt; 49290: (3.94737%)&gt;];
}
2173--2606[label="1;12pkt 12fpkt"];
2173--2869[label="1;12pkt 12fpkt"];
2606--2869[label="1;13pkt 13fpkt"];
</description>
    <slice>
      <filter dst_ip="192.198.196.203" src_ip="147.103.167.197"/>
      <filter src_ip="147.103.167.197" src_port="80"/>
      <filter dst_port="53" src_ip="147.103.167.197" src_port="1435"/>
    </slice>
    <from sec="1104555934" usec="0"/>
    <to sec="1104556367" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_448{
style=filled;
color=gray75;
2186[label="149.222.169.204;8pkt 8fpkt", shape=pentagon, color=darkviolet];
2613[label="149.222.169.204;7pkt 7fpkt", shape=invtriangle, color=brown];
2872[label="149.222.169.204;8pkt 8fpkt", shape=invhouse, color=bisque];
stat448[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.222.169.204:*, 192.236.17.225:25}[50%]&lt;BR/&gt;{149.222.169.204:80, *:*}[37.5%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (26.087%)&lt;BR/&gt; 80: (17.3913%)&lt;BR/&gt; 49929: (6.52174%)&lt;BR/&gt; 47901: (6.52174%)&lt;BR/&gt; 32779: (6.52174%)&gt;];
}
2186--2613[label="1;7pkt 7fpkt"];
2186--2872[label="1;8pkt 8fpkt"];
2613--2872[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter src_ip="149.222.169.204" src_port="80"/>
      <filter dst_ip="192.236.17.225" dst_port="25" src_ip="149.222.169.204"/>
    </slice>
    <from sec="1104556221" usec="0"/>
    <to sec="1104556489" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="194.0.9.206"/>
    </slice>
    <from sec="1104555621" usec="0"/>
    <to sec="1104556182" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="5.90.206.207"/>
    </slice>
    <from sec="1104555609" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.543623,1.56736,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_451{
style=filled;
color=gray75;
2197[label="147.131.122.208;22pkt 22fpkt", shape=pentagon, color=darkviolet];
2618[label="147.131.122.208;22pkt 22fpkt", shape=invtriangle, color=brown];
stat451[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.131.122.208:1024, *:53}[27.2727%]&lt;BR/&gt;{147.131.122.208:53, *:53}[22.7273%]&lt;BR/&gt;{147.131.122.208:80, *:*}[22.7273%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (50%)&lt;BR/&gt; 1024: (13.6364%)&lt;BR/&gt; 80: (11.3636%)&lt;BR/&gt; 51483: (2.27273%)&lt;BR/&gt; 45403: (2.27273%)&gt;];
}
2197--2618[label="1;22pkt 22fpkt"];
</description>
    <slice>
      <filter src_ip="147.131.122.208" src_port="80"/>
      <filter dst_port="53" src_ip="147.131.122.208" src_port="53"/>
      <filter dst_port="53" src_ip="147.131.122.208" src_port="1024"/>
    </slice>
    <from sec="1104555703" usec="0"/>
    <to sec="1104556447" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="193.180.163.210"/>
    </slice>
    <from sec="1104555601" usec="0"/>
    <to sec="1104556479" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="29.86.77.212"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.829474,1.51438,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_455{
style=filled;
color=gray75;
463[label="140.10.30.26;d;123pkt 123fpkt", shape=diamond, color=yellow];
464[label="194.113.159.183;s;40pkt 40fpkt", shape=diamond, color=yellow];
524[label="140.10.37.30;d;484pkt 484fpkt", shape=diamond, color=yellow];
544[label="140.10.104.62;d;56pkt 56fpkt", shape=diamond, color=yellow];
1069[label="194.113.161.78;s;70pkt 70fpkt", shape=diamond, color=yellow];
1704[label="213.13.132.8;5pkt 5fpkt", shape=pentagon, color=darkviolet];
1727[label="81.185.163.15;12pkt 12fpkt", shape=pentagon, color=darkviolet];
1747[label="81.148.18.21;20pkt 20fpkt", shape=pentagon, color=darkviolet];
1796[label="81.148.5.38;16pkt 16fpkt", shape=pentagon, color=darkviolet];
1905[label="194.113.161.78;75pkt 75fpkt", shape=pentagon, color=darkviolet];
2119[label="81.148.5.173;7pkt 7fpkt", shape=pentagon, color=darkviolet];
2216[label="194.113.179.216;47pkt 47fpkt", shape=pentagon, color=darkviolet];
2269[label="194.113.179.237;34pkt 34fpkt", shape=pentagon, color=darkviolet];
2318[label="213.13.132.8;4pkt 4fpkt", shape=invtriangle, color=brown];
2330[label="81.185.163.15;11pkt 11fpkt", shape=invtriangle, color=brown];
2342[label="81.148.18.21;20pkt 20fpkt", shape=invtriangle, color=brown];
2371[label="81.148.5.38;17pkt 17fpkt", shape=invtriangle, color=brown];
2573[label="81.148.5.173;7pkt 7fpkt", shape=invtriangle, color=brown];
2629[label="194.113.179.216;46pkt 46fpkt", shape=invtriangle, color=brown];
2702[label="81.185.163.15;12pkt 12fpkt", shape=invhouse, color=bisque];
2709[label="81.148.18.21;19pkt 19fpkt", shape=invhouse, color=bisque];
2883[label="194.113.179.216;47pkt 47fpkt", shape=invhouse, color=bisque];
stat455[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 140.10.37.30:*}[70.7071%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.9147%)&lt;BR/&gt; 23822: (0.213311%)&lt;BR/&gt; 24112: (0.170648%)&lt;BR/&gt; 24111: (0.170648%)&lt;BR/&gt; 24068: (0.170648%)&gt;];
}
463--464[label="0.625;25pkt 25fpkt"];
463--2119[label="1;7pkt 7fpkt"];
463--2216[label="0.574468;27pkt 27fpkt"];
463--2269[label="0.941176;32pkt 32fpkt"];
463--2573[label="1;7pkt 7fpkt"];
463--2629[label="0.565217;26pkt 26fpkt"];
463--2883[label="0.574468;27pkt 27fpkt"];
464--544[label="0.375;15pkt 15fpkt"];
524--652[label="0.01;2pkt 2fpkt"];
524--1069[label="1;70pkt 70fpkt"];
524--1087[label="0.00469484;1pkt 1fpkt"];
524--1250[label="0.0175439;1pkt 1fpkt"];
524--1704[label="0.8;4pkt 4fpkt"];
524--1727[label="0.5;6pkt 6fpkt"];
524--1747[label="0.15;3pkt 3fpkt"];
524--1757[label="0.0169492;1pkt 1fpkt"];
524--1905[label="0.92;69pkt 69fpkt"];
524--2174[label="0.0454545;5pkt 5fpkt"];
524--2216[label="0.425532;20pkt 20fpkt"];
524--2269[label="0.0588235;2pkt 2fpkt"];
524--2318[label="0.75;3pkt 3fpkt"];
524--2330[label="0.454545;5pkt 5fpkt"];
524--2331[label="0.125;1pkt 1fpkt"];
524--2342[label="0.15;3pkt 3fpkt"];
524--2346[label="0.0169492;1pkt 1fpkt"];
524--2607[label="0.0540541;6pkt 6fpkt"];
524--2629[label="0.434783;20pkt 20fpkt"];
524--2702[label="0.5;6pkt 6fpkt"];
524--2709[label="0.105263;2pkt 2fpkt"];
524--2713[label="0.0169492;1pkt 1fpkt"];
524--2883[label="0.425532;20pkt 20fpkt"];
544--1727[label="0.25;3pkt 3fpkt"];
544--1747[label="0.5;10pkt 10fpkt"];
544--1796[label="0.1875;3pkt 3fpkt"];
544--2330[label="0.272727;3pkt 3fpkt"];
544--2342[label="0.5;10pkt 10fpkt"];
544--2371[label="0.235294;4pkt 4fpkt"];
544--2702[label="0.25;3pkt 3fpkt"];
544--2709[label="0.526316;10pkt 10fpkt"];
1069--1905[label="0.985714;69pkt 69fpkt"];
1704--2318[label="1;4pkt 4fpkt"];
1727--2330[label="1;11pkt 11fpkt"];
1727--2702[label="1;12pkt 12fpkt"];
1747--2342[label="1;20pkt 20fpkt"];
1747--2709[label="1;19pkt 19fpkt"];
1796--2371[label="1;16pkt 16fpkt"];
2119--2573[label="1;7pkt 7fpkt"];
2216--2629[label="1;46pkt 46fpkt"];
2216--2883[label="1;47pkt 47fpkt"];
2330--2702[label="1;11pkt 11fpkt"];
2342--2709[label="1;19pkt 19fpkt"];
2629--2883[label="1;46pkt 46fpkt"];
</description>
    <slice>
      <filter dst_ip="140.10.37.30" src_port="80"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556496" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,011,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_456{
style=filled;
color=gray75;
2219[label="81.147.18.218;87pkt 87fpkt", shape=pentagon, color=darkviolet];
2631[label="81.147.18.218;86pkt 86fpkt", shape=invtriangle, color=brown];
2884[label="81.147.18.218;86pkt 86fpkt", shape=invhouse, color=bisque];
stat456[shape=component, label=&lt;Rules:&lt;BR/&gt;{81.147.18.218:6667, 173.172.88.2:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (50%)&lt;BR/&gt; 4233: (0.579151%)&lt;BR/&gt; 4232: (0.579151%)&lt;BR/&gt; 4231: (0.579151%)&lt;BR/&gt; 4230: (0.579151%)&gt;];
}
2219--2631[label="1;86pkt 86fpkt"];
2219--2884[label="1;86pkt 86fpkt"];
2631--2884[label="1;86pkt 86fpkt"];
</description>
    <slice>
      <filter dst_ip="173.172.88.2" src_ip="81.147.18.218" src_port="6667"/>
    </slice>
    <from sec="1104555607" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.543623,1.56736,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_457{
style=filled;
color=gray75;
2224[label="168.157.246.218;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2633[label="168.157.246.218;3pkt 3fpkt", shape=invtriangle, color=brown];
stat457[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.157.246.218:25, 196.111.139.3:3591}[33.3333%]&lt;BR/&gt;{168.157.246.218:25, 82.160.100.8:1716}[33.3333%]&lt;BR/&gt;{168.157.246.218:25, 146.116.36.40:34046}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 34046: (16.6667%)&lt;BR/&gt; 3591: (16.6667%)&lt;BR/&gt; 1716: (16.6667%)&gt;];
}
2224--2633[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="146.116.36.40" dst_port="34046" src_ip="168.157.246.218" src_port="25"/>
      <filter dst_ip="82.160.100.8" dst_port="1716" src_ip="168.157.246.218" src_port="25"/>
      <filter dst_ip="196.111.139.3" dst_port="3591" src_ip="168.157.246.218" src_port="25"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="6.133.20.219"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_459{
style=filled;
color=gray75;
2229[label="149.222.49.221;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2635[label="149.222.49.221;2pkt 2fpkt", shape=invtriangle, color=brown];
2887[label="149.222.49.221;2pkt 2fpkt", shape=invhouse, color=bisque];
stat459[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.222.49.221:63404, 192.28.160.23:80}[50%]&lt;BR/&gt;{149.222.49.221:63405, 192.219.192.92:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 63405: (25%)&lt;BR/&gt; 63404: (25%)&gt;];
}
2229--2635[label="1;2pkt 2fpkt"];
2229--2887[label="1;2pkt 2fpkt"];
2635--2887[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="192.219.192.92" dst_port="80" src_ip="149.222.49.221" src_port="63405"/>
      <filter dst_ip="192.28.160.23" dst_port="80" src_ip="149.222.49.221" src_port="63404"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.543623,1.56736,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_460{
style=filled;
color=gray75;
2242[label="173.172.40.225;11pkt 11fpkt", shape=pentagon, color=darkviolet];
2642[label="173.172.40.225;10pkt 10fpkt", shape=invtriangle, color=brown];
stat460[shape=component, label=&lt;Rules:&lt;BR/&gt;{173.172.40.225:25, 196.102.221.111:*}[36.3636%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 52713: (4.7619%)&lt;BR/&gt; 36733: (4.7619%)&lt;BR/&gt; 31647: (4.7619%)&lt;BR/&gt; 4294: (4.7619%)&gt;];
}
2242--2642[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter dst_ip="196.102.221.111" src_ip="173.172.40.225" src_port="25"/>
    </slice>
    <from sec="1104555935" usec="0"/>
    <to sec="1104556497" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_461{
style=filled;
color=gray75;
2243[label="81.231.40.225;109pkt 109fpkt", shape=pentagon, color=darkviolet];
2643[label="81.231.40.225;108pkt 108fpkt", shape=invtriangle, color=brown];
2891[label="81.231.40.225;109pkt 109fpkt", shape=invhouse, color=bisque];
stat461[shape=component, label=&lt;Rules:&lt;BR/&gt;{81.231.40.225:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 40413: (0.460123%)&lt;BR/&gt; 40404: (0.460123%)&lt;BR/&gt; 40395: (0.460123%)&lt;BR/&gt; 40388: (0.460123%)&gt;];
}
2243--2643[label="1;108pkt 108fpkt"];
2243--2891[label="1;109pkt 109fpkt"];
2643--2891[label="1;108pkt 108fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="81.231.40.225"/>
    </slice>
    <from sec="1104555762" usec="0"/>
    <to sec="1104555779" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_462{
style=filled;
color=gray75;
2247[label="147.103.18.226;36pkt 36fpkt", shape=pentagon, color=darkviolet];
2645[label="147.103.18.226;36pkt 36fpkt", shape=invtriangle, color=brown];
2892[label="147.103.18.226;37pkt 37fpkt", shape=invhouse, color=bisque];
stat462[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.103.18.226:80, 81.1.62.233:*}[48.6486%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 60748: (1.37615%)&lt;BR/&gt; 60056: (1.37615%)&lt;BR/&gt; 59247: (1.37615%)&lt;BR/&gt; 58785: (1.37615%)&gt;];
}
2247--2645[label="1;36pkt 36fpkt"];
2247--2892[label="1;36pkt 36fpkt"];
2645--2892[label="1;36pkt 36fpkt"];
</description>
    <slice>
      <filter dst_ip="81.1.62.233" src_ip="147.103.18.226" src_port="80"/>
    </slice>
    <from sec="1104555608" usec="0"/>
    <to sec="1104556493" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.829474,1.51438,020,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_463{
style=filled;
color=gray75;
839[label="149.223.236.66;s;463pkt 463fpkt", shape=diamond, color=yellow];
1147[label="115.162.245.161;d;37pkt 37fpkt", shape=diamond, color=yellow];
2252[label="149.223.105.228;7pkt 7fpkt", shape=pentagon, color=darkviolet];
2647[label="149.223.105.228;6pkt 6fpkt", shape=invtriangle, color=brown];
2894[label="149.223.105.228;7pkt 7fpkt", shape=invhouse, color=bisque];
stat463[shape=component, label=&lt;Rules:&lt;BR/&gt;{149.223.236.66:0, *:0}[91.6832%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
839--843[label="0.00251889;1pkt 1fpkt"];
839--950[label="0.00288184;1pkt 1fpkt"];
839--1021[label="0.00373134;1pkt 1fpkt"];
839--1123[label="0.00268097;1pkt 1fpkt"];
839--1147[label="0.027027;1pkt 1fpkt"];
839--1217[label="0.00492611;1pkt 1fpkt"];
839--1292[label="0.0049505;1pkt 1fpkt"];
839--1453[label="0.00251889;1pkt 1fpkt"];
839--1571[label="0.00318471;1pkt 1fpkt"];
1147--1151[label="0.027027;1pkt 1fpkt"];
1147--1950[label="0.027027;1pkt 1fpkt"];
1147--2252[label="0.142857;1pkt 1fpkt"];
1147--2647[label="0.166667;1pkt 1fpkt"];
1147--2894[label="0.142857;1pkt 1fpkt"];
2252--2647[label="1;6pkt 6fpkt"];
2252--2894[label="1;7pkt 7fpkt"];
2647--2894[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter src_ip="149.223.236.66"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="149.223.217.235"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="81.140.192.236"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="5.253.198.237"/>
    </slice>
    <from sec="1104555621" usec="0"/>
    <to sec="1104556447" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.543623,1.56736,504,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_468{
style=filled;
color=gray75;
2278[label="168.157.154.242;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2664[label="168.157.154.242;3pkt 3fpkt", shape=invtriangle, color=brown];
stat468[shape=component, label=&lt;Rules:&lt;BR/&gt;{168.157.154.242:3026, 212.89.208.206:80}[33.3333%]&lt;BR/&gt;{168.157.154.242:3028, 212.89.173.31:80}[33.3333%]&lt;BR/&gt;{168.157.154.242:3033, 212.89.173.31:443}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (33.3333%)&lt;BR/&gt; 3033: (16.6667%)&lt;BR/&gt; 3028: (16.6667%)&lt;BR/&gt; 3026: (16.6667%)&lt;BR/&gt; 443: (16.6667%)&gt;];
}
2278--2664[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="212.89.173.31" dst_port="443" src_ip="168.157.154.242" src_port="3033"/>
      <filter dst_ip="212.89.173.31" dst_port="80" src_ip="168.157.154.242" src_port="3028"/>
      <filter dst_ip="212.89.208.206" dst_port="80" src_ip="168.157.154.242" src_port="3026"/>
    </slice>
    <from sec="1104556275" usec="0"/>
    <to sec="1104556280" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.829474,1.51438,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_469{
style=filled;
color=gray75;
1335[label="140.10.246.3;d;172pkt 172fpkt", shape=diamond, color=yellow];
2174[label="194.113.179.198;110pkt 110fpkt", shape=pentagon, color=darkviolet];
2284[label="194.113.179.245;27pkt 27fpkt", shape=pentagon, color=darkviolet];
2607[label="194.113.179.198;111pkt 111fpkt", shape=invtriangle, color=brown];
2669[label="194.113.179.245;27pkt 27fpkt", shape=invtriangle, color=brown];
2910[label="194.113.179.245;27pkt 27fpkt", shape=invhouse, color=bisque];
stat469[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.113.179.198:80, 140.10.246.3:*}[58.011%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.5781%)&lt;BR/&gt; 4798: (0.421941%)&lt;BR/&gt; 4793: (0.421941%)&lt;BR/&gt; 4791: (0.421941%)&lt;BR/&gt; 4790: (0.421941%)&gt;];
}
1335--2174[label="0.927273;102pkt 102fpkt"];
1335--2284[label="1;27pkt 27fpkt"];
1335--2607[label="0.918919;102pkt 102fpkt"];
1335--2669[label="1;27pkt 27fpkt"];
1335--2910[label="1;27pkt 27fpkt"];
2174--2607[label="1;110pkt 110fpkt"];
2284--2669[label="1;27pkt 27fpkt"];
2284--2910[label="1;27pkt 27fpkt"];
2669--2910[label="1;27pkt 27fpkt"];
</description>
    <slice>
      <filter dst_ip="140.10.246.3" src_ip="194.113.179.198" src_port="80"/>
    </slice>
    <from sec="1104556171" usec="0"/>
    <to sec="1104556498" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="194.70.169.246"/>
    </slice>
    <from sec="1104555627" usec="0"/>
    <to sec="1104556496" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_471{
style=filled;
color=gray75;
2287[label="29.130.63.247;98pkt 98fpkt", shape=pentagon, color=darkviolet];
2671[label="29.130.63.247;97pkt 97fpkt", shape=invtriangle, color=brown];
2911[label="29.130.63.247;97pkt 97fpkt", shape=invhouse, color=bisque];
stat471[shape=component, label=&lt;Rules:&lt;BR/&gt;{29.130.63.247:*, *:445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (50%)&lt;BR/&gt; 4974: (0.513699%)&lt;BR/&gt; 4966: (0.513699%)&lt;BR/&gt; 4776: (0.513699%)&lt;BR/&gt; 4732: (0.513699%)&gt;];
}
2287--2671[label="1;97pkt 97fpkt"];
2287--2911[label="1;97pkt 97fpkt"];
2671--2911[label="1;97pkt 97fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="29.130.63.247"/>
    </slice>
    <from sec="1104555633" usec="0"/>
    <to sec="1104556470" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="29.86.198.247"/>
    </slice>
    <from sec="1104555628" usec="0"/>
    <to sec="1104556468" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.543623,1.56736,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_473{
style=filled;
color=gray75;
2289[label="198.204.42.248;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2673[label="198.204.42.248;3pkt 3fpkt", shape=invtriangle, color=brown];
stat473[shape=component, label=&lt;Rules:&lt;BR/&gt;{198.204.42.248:23, 147.103.30.16:34400}[33.3333%]&lt;BR/&gt;{198.204.42.248:23, 147.7.195.48:28762}[33.3333%]&lt;BR/&gt;{198.204.42.248:23, 173.172.219.165:55986}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 23: (50%)&lt;BR/&gt; 55986: (16.6667%)&lt;BR/&gt; 34400: (16.6667%)&lt;BR/&gt; 28762: (16.6667%)&gt;];
}
2289--2673[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="173.172.219.165" dst_port="55986" src_ip="198.204.42.248" src_port="23"/>
      <filter dst_ip="147.7.195.48" dst_port="28762" src_ip="198.204.42.248" src_port="23"/>
      <filter dst_ip="147.103.30.16" dst_port="34400" src_ip="198.204.42.248" src_port="23"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_474{
style=filled;
color=gray75;
2292[label="196.111.7.250;9pkt 9fpkt", shape=pentagon, color=darkviolet];
2675[label="196.111.7.250;9pkt 9fpkt", shape=invtriangle, color=brown];
2913[label="196.111.7.250;9pkt 9fpkt", shape=invhouse, color=bisque];
stat474[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.111.7.250:*, 140.10.39.8:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 50842: (5.55556%)&lt;BR/&gt; 50841: (5.55556%)&lt;BR/&gt; 50840: (5.55556%)&lt;BR/&gt; 50839: (5.55556%)&gt;];
}
2292--2675[label="1;9pkt 9fpkt"];
2292--2913[label="1;9pkt 9fpkt"];
2675--2913[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="140.10.39.8" dst_port="80" src_ip="196.111.7.250"/>
    </slice>
    <from sec="1104556208" usec="0"/>
    <to sec="1104556248" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="213.140.45.250"/>
    </slice>
    <from sec="1104555604" usec="0"/>
    <to sec="1104555646" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="5.154.89.250"/>
    </slice>
    <from sec="1104555610" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="195.180.179.251"/>
    </slice>
    <from sec="1104555602" usec="0"/>
    <to sec="1104556242" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_478{
style=filled;
color=gray75;
2298[label="147.103.18.252;6pkt 6fpkt", shape=pentagon, color=darkviolet];
2681[label="147.103.18.252;6pkt 6fpkt", shape=invtriangle, color=brown];
2915[label="147.103.18.252;6pkt 6fpkt", shape=invhouse, color=bisque];
stat478[shape=component, label=&lt;Rules:&lt;BR/&gt;{147.103.18.252:*, 1.168.18.213:80}[33.3333%]&lt;BR/&gt;{147.103.18.252:*, *:1863}[33.3333%]&lt;BR/&gt;{147.103.18.252:*, 2.250.58.53:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (25%)&lt;BR/&gt; 1863: (16.6667%)&lt;BR/&gt; 28834: (8.33333%)&lt;BR/&gt; 16426: (8.33333%)&lt;BR/&gt; 16408: (8.33333%)&gt;];
}
2298--2681[label="1;6pkt 6fpkt"];
2298--2915[label="1;6pkt 6fpkt"];
2681--2915[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="2.250.58.53" src_ip="147.103.18.252"/>
      <filter dst_port="1863" src_ip="147.103.18.252"/>
      <filter dst_ip="1.168.18.213" dst_port="80" src_ip="147.103.18.252"/>
    </slice>
    <from sec="1104555623" usec="0"/>
    <to sec="1104556456" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.724198,1.55315,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_479{
style=filled;
color=gray75;
2300[label="206.139.194.252;16pkt 16fpkt", shape=pentagon, color=darkviolet];
2682[label="206.139.194.252;17pkt 17fpkt", shape=invtriangle, color=brown];
2916[label="206.139.194.252;16pkt 16fpkt", shape=invhouse, color=bisque];
stat479[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.139.194.252:0, *:0}[94.1176%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (93.8776%)&lt;BR/&gt; 29089: (3.06122%)&lt;BR/&gt; 179: (3.06122%)&gt;];
}
2300--2682[label="1;16pkt 16fpkt"];
2300--2916[label="1;16pkt 16fpkt"];
2682--2916[label="1;16pkt 16fpkt"];
</description>
    <slice>
      <filter src_ip="206.139.194.252"/>
    </slice>
    <from sec="1104555619" usec="0"/>
    <to sec="1104556479" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.726434,1.51817,002,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_480{
style=filled;
color=gray75;
158[label="196.104.88.253s;227pkt 227fpkt", shape=rectangle, color=red];
2301[label="196.104.88.253;240pkt 240fpkt", shape=pentagon, color=darkviolet];
2683[label="196.104.88.253;241pkt 241fpkt", shape=invtriangle, color=brown];
stat480[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.104.88.253:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
158--2301[label="0.995595;226pkt 226fpkt"];
158--2683[label="1;227pkt 227fpkt"];
2301--2683[label="1;240pkt 240fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="196.104.88.253" src_port="1028"/>
    </slice>
    <from sec="1104555846" usec="0"/>
    <to sec="1104555892" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.587306,1.6282,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="173.172.9.255"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.543623,1.56736,011,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_482{
style=filled;
color=gray75;
2304[label="194.37.195.255;54pkt 54fpkt", shape=pentagon, color=darkviolet];
2685[label="194.37.195.255;53pkt 53fpkt", shape=invtriangle, color=brown];
stat482[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.37.195.255:21, *:*}[38.8889%]&lt;BR/&gt;{194.37.195.255:80, *:*}[27.7778%]&lt;BR/&gt;{194.37.195.255:25, *:*}[20.3704%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (19.6262%)&lt;BR/&gt; 80: (14.0187%)&lt;BR/&gt; 25: (10.2804%)&lt;BR/&gt; 443: (6.07477%)&lt;BR/&gt; 63096: (0.934579%)&gt;];
}
2304--2685[label="1;53pkt 53fpkt"];
</description>
    <slice>
      <filter src_ip="194.37.195.255" src_port="21"/>
      <filter src_ip="194.37.195.255" src_port="80"/>
      <filter src_ip="194.37.195.255" src_port="25"/>
    </slice>
    <from sec="1104555613" usec="0"/>
    <to sec="1104556496" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695393,1.64298,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="0.43.11.11"/>
    </slice>
    <from sec="1104555612" usec="0"/>
    <to sec="1104556498" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695393,1.64298,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="82.218.253.14"/>
    </slice>
    <from sec="1104555630" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695393,1.64298,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="5.152.187.28"/>
    </slice>
    <from sec="1104555677" usec="0"/>
    <to sec="1104556450" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695393,1.64298,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="196.103.19.42"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695393,1.64298,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="173.172.22.42"/>
    </slice>
    <from sec="1104555603" usec="0"/>
    <to sec="1104556500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695393,1.64298,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="4.222.219.47"/>
    </slice>
    <from sec="1104555609" usec="0"/>
    <to sec="1104556490" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695393,1.64298,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="1.229.160.51"/>
    </slice>
    <from sec="1104555911" usec="0"/>
    <to sec="1104556207" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695393,1.64298,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="218.128.87.52"/>
    </slice>
    <from sec="1104556214" usec="0"/>
    <to sec="1104556260" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695393,1.64298,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="194.148.151.68"/>
    </slice>
    <from sec="1104555603" usec="0"/>
    <to sec="1104556497" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695393,1.64298,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="149.222.103.73"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695393,1.64298,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="194.154.137.75"/>
    </slice>
    <from sec="1104555601" usec="0"/>
    <to sec="1104556461" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.804448,1.60637,020,0 0 0 1 0 0 0 0 0 0 0 1 ">
    <description>subgraph cluster_494{
style=filled;
color=gray75;
723[label="209.241.214.98;s;278pkt 278fpkt", shape=diamond, color=yellow];
2780[label="209.241.214.98;321pkt 321fpkt", shape=invhouse, color=bisque];
stat494[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.241.214.98:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
723--950[label="0.00359712;1pkt 1fpkt"];
723--1571[label="0.00359712;1pkt 1fpkt"];
723--2780[label="1;278pkt 278fpkt"];
</description>
    <slice>
      <filter src_ip="209.241.214.98"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556497" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695393,1.64298,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="209.65.110.106"/>
    </slice>
    <from sec="1104555601" usec="0"/>
    <to sec="1104556065" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695393,1.64298,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="2.14.1.131"/>
    </slice>
    <from sec="1104555614" usec="0"/>
    <to sec="1104556482" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695393,1.64298,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="96.176.87.134"/>
    </slice>
    <from sec="1104555620" usec="0"/>
    <to sec="1104556494" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695393,1.64298,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="29.81.54.141"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695393,1.64298,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="194.11.20.144"/>
    </slice>
    <from sec="1104555613" usec="0"/>
    <to sec="1104556498" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695393,1.64298,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="81.133.14.155"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695393,1.64298,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="81.206.176.158"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695393,1.64298,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="196.109.104.162"/>
    </slice>
    <from sec="1104555608" usec="0"/>
    <to sec="1104556493" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695393,1.64298,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="208.176.178.174"/>
    </slice>
    <from sec="1104555600" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695393,1.64298,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="194.0.9.206"/>
    </slice>
    <from sec="1104555621" usec="0"/>
    <to sec="1104556182" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695393,1.64298,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="6.133.20.219"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695393,1.64298,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="219.102.99.219"/>
    </slice>
    <from sec="1104556257" usec="0"/>
    <to sec="1104556260" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695393,1.64298,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="149.223.217.235"/>
    </slice>
    <from sec="1104556500" usec="0"/>
    <to sec="1104556501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695393,1.64298,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="5.253.198.237"/>
    </slice>
    <from sec="1104555621" usec="0"/>
    <to sec="1104556447" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.695393,1.64298,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="29.86.198.247"/>
    </slice>
    <from sec="1104555628" usec="0"/>
    <to sec="1104556468" usec="0"/>
  </anomaly>

</admd:annotation>
