<?xml version="1.0" encoding="UTF-8" standalone="no" ?>
<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">

  <anomaly type="notice" value="0.757479,1.76153,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="tcp" src_ip="211.183.14.26" src_port="1029"/>
      <filter dst_port="137" proto="udp" src_ip="211.183.14.26" src_port="1029"/>
      <filter dst_port="1434" proto="tcp" src_ip="211.183.14.26" src_port="1029"/>
      <filter dst_port="1434" proto="udp" src_ip="211.183.14.26" src_port="1029"/>
      <from sec="1115269487" usec="0"/>
      <to sec="1115269533" usec="0"/>
    </slice>
    <from sec="1115269487" usec="0"/>
    <to sec="1115269533" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757479,1.76153,503,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="213.208.135.107" dst_port="80" proto="tcp" src_ip="131.5.200.27" src_port="1063"/>
      <filter dst_ip="213.208.135.107" dst_port="80" proto="udp" src_ip="131.5.200.27" src_port="1063"/>
      <filter dst_ip="213.208.135.107" dst_port="80" proto="tcp" src_ip="131.5.200.27" src_port="1064"/>
      <filter dst_ip="213.208.135.107" dst_port="80" proto="udp" src_ip="131.5.200.27" src_port="1064"/>
      <filter dst_ip="213.208.135.107" dst_port="80" proto="tcp" src_ip="131.5.200.27" src_port="1066"/>
      <filter dst_ip="213.208.135.107" dst_port="80" proto="udp" src_ip="131.5.200.27" src_port="1066"/>
      <from sec="1115269212" usec="0"/>
      <to sec="1115269223" usec="0"/>
    </slice>
    <from sec="1115269212" usec="0"/>
    <to sec="1115269223" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757479,1.76153,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="212.64.236.114" dst_port="53" proto="udp" src_ip="210.53.128.148" src_port="44556"/>
      <filter dst_ip="212.64.236.114" dst_port="53" proto="udp" src_ip="210.53.128.148" src_port="53"/>
      <from sec="1115269203" usec="0"/>
      <to sec="1115270096" usec="0"/>
    </slice>
    <from sec="1115269203" usec="0"/>
    <to sec="1115270096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757479,1.76153,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="68.138.67.188" dst_port="53" proto="tcp" src_ip="131.4.108.149" src_port="80"/>
      <filter dst_ip="68.138.67.188" dst_port="53" proto="udp" src_ip="131.4.108.149" src_port="80"/>
      <filter dst_ip="68.138.67.188" dst_port="25" proto="tcp" src_ip="131.4.108.149" src_port="80"/>
      <filter dst_ip="68.138.67.188" dst_port="25" proto="udp" src_ip="131.4.108.149" src_port="80"/>
      <from sec="1115269385" usec="0"/>
      <to sec="1115269471" usec="0"/>
    </slice>
    <from sec="1115269353" usec="0"/>
    <to sec="1115269472" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757479,1.76153,503,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="172.195.175.139" dst_port="80" proto="tcp" src_ip="64.162.87.235" src_port="37526"/>
      <from sec="1115269455" usec="0"/>
      <to sec="1115269457" usec="0"/>
    </slice>
    <from sec="1115269451" usec="0"/>
    <to sec="1115269459" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757479,1.76153,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="204.62.15.184" dst_port="25" proto="tcp" src_ip="202.165.151.210" src_port="80"/>
      <filter dst_ip="204.62.15.184" dst_port="25" proto="udp" src_ip="202.165.151.210" src_port="80"/>
      <filter dst_ip="204.62.15.184" dst_port="25" proto="tcp" src_ip="202.165.151.210" src_port="80"/>
      <filter dst_ip="204.62.15.184" dst_port="25" proto="udp" src_ip="202.165.151.210" src_port="80"/>
      <filter dst_ip="204.62.15.184" dst_port="25" proto="tcp" src_ip="202.165.151.210" src_port="80"/>
      <filter dst_ip="204.62.15.184" dst_port="25" proto="udp" src_ip="202.165.151.210" src_port="80"/>
      <filter dst_ip="204.62.15.184" dst_port="25" proto="tcp" src_ip="202.165.151.210" src_port="80"/>
      <filter dst_ip="204.62.15.184" dst_port="25" proto="udp" src_ip="202.165.151.210" src_port="80"/>
      <filter dst_ip="204.62.15.184" dst_port="25" proto="tcp" src_ip="131.5.137.114" src_port="80"/>
      <filter dst_ip="204.62.15.184" dst_port="25" proto="udp" src_ip="131.5.137.114" src_port="80"/>
      <filter dst_ip="204.62.15.184" dst_port="25" proto="tcp" src_ip="131.5.137.114" src_port="80"/>
      <filter dst_ip="204.62.15.184" dst_port="25" proto="udp" src_ip="131.5.137.114" src_port="80"/>
      <filter dst_ip="204.62.15.184" dst_port="25" proto="tcp" src_ip="131.5.137.114" src_port="80"/>
      <filter dst_ip="204.62.15.184" dst_port="25" proto="udp" src_ip="131.5.137.114" src_port="80"/>
      <filter dst_ip="204.62.15.184" dst_port="25" proto="tcp" src_ip="131.5.137.114" src_port="80"/>
      <filter dst_ip="204.62.15.184" dst_port="25" proto="udp" src_ip="131.5.137.114" src_port="80"/>
      <filter dst_ip="204.62.15.184" dst_port="25" proto="tcp" src_ip="133.21.198.124" src_port="80"/>
      <filter dst_ip="204.62.15.184" dst_port="25" proto="udp" src_ip="133.21.198.124" src_port="80"/>
      <filter dst_ip="204.62.15.184" dst_port="25" proto="tcp" src_ip="133.21.198.124" src_port="80"/>
      <filter dst_ip="204.62.15.184" dst_port="25" proto="udp" src_ip="133.21.198.124" src_port="80"/>
      <filter dst_ip="204.62.15.184" dst_port="25" proto="tcp" src_ip="133.21.198.124" src_port="80"/>
      <filter dst_ip="204.62.15.184" dst_port="25" proto="udp" src_ip="133.21.198.124" src_port="80"/>
      <filter dst_ip="204.62.15.184" dst_port="25" proto="tcp" src_ip="133.21.198.124" src_port="80"/>
      <filter dst_ip="204.62.15.184" dst_port="25" proto="udp" src_ip="133.21.198.124" src_port="80"/>
      <from sec="1115269461" usec="0"/>
      <to sec="1115269472" usec="0"/>
    </slice>
    <from sec="1115269461" usec="0"/>
    <to sec="1115269472" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757479,1.76153,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="210.53.128.195" dst_port="80" proto="tcp" src_ip="212.64.236.114"/>
      <filter dst_ip="210.53.128.195" dst_port="80" proto="tcp" src_ip="212.64.236.114"/>
      <filter dst_ip="210.53.128.195" dst_port="80" proto="tcp" src_ip="212.64.236.114"/>
      <filter dst_ip="210.53.128.195" dst_port="80" proto="tcp" src_ip="212.64.236.114"/>
      <filter dst_ip="210.53.128.195" dst_port="53" proto="tcp" src_ip="212.64.236.114"/>
      <filter dst_ip="210.53.128.195" dst_port="53" proto="tcp" src_ip="212.64.236.114"/>
      <filter dst_ip="210.53.128.195" dst_port="53" proto="tcp" src_ip="212.64.236.114"/>
      <filter dst_ip="210.53.128.195" dst_port="53" proto="tcp" src_ip="212.64.236.114"/>
      <filter dst_ip="210.53.128.195" dst_port="25" proto="tcp" src_ip="212.64.236.114"/>
      <filter dst_ip="210.53.128.195" dst_port="25" proto="tcp" src_ip="212.64.236.114"/>
      <filter dst_ip="210.53.128.195" dst_port="25" proto="tcp" src_ip="212.64.236.114"/>
      <filter dst_ip="210.53.128.195" dst_port="25" proto="tcp" src_ip="212.64.236.114"/>
      <filter dst_ip="210.53.128.195" dst_port="80" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="210.53.128.195" dst_port="80" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="210.53.128.195" dst_port="80" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="210.53.128.195" dst_port="80" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="210.53.128.195" dst_port="53" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="210.53.128.195" dst_port="53" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="210.53.128.195" dst_port="53" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="210.53.128.195" dst_port="53" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="210.53.128.195" dst_port="25" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="210.53.128.195" dst_port="25" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="210.53.128.195" dst_port="25" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="210.53.128.195" dst_port="25" proto="tcp" src_ip="202.165.151.210"/>
      <from sec="1115269328" usec="0"/>
      <to sec="1115269959" usec="0"/>
    </slice>
    <from sec="1115269328" usec="0"/>
    <to sec="1115269959" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757479,1.76153,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="172.195.144.179" dst_port="53" proto="tcp" src_ip="194.68.169.44" src_port="80"/>
      <filter dst_ip="172.195.144.179" dst_port="53" proto="udp" src_ip="194.68.169.44" src_port="80"/>
      <filter dst_ip="172.195.144.179" dst_port="80" proto="tcp" src_ip="194.68.169.44" src_port="80"/>
      <filter dst_ip="172.195.144.179" dst_port="80" proto="udp" src_ip="194.68.169.44" src_port="80"/>
      <filter dst_ip="172.195.144.179" dst_port="25" proto="tcp" src_ip="194.68.169.44" src_port="80"/>
      <filter dst_ip="172.195.144.179" dst_port="25" proto="udp" src_ip="194.68.169.44" src_port="80"/>
      <from sec="1115269919" usec="0"/>
      <to sec="1115269924" usec="0"/>
    </slice>
    <from sec="1115269917" usec="0"/>
    <to sec="1115269924" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757479,1.76153,503,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="214.12.219.68" dst_port="80" proto="tcp" src_ip="131.4.96.36" src_port="1131"/>
      <filter dst_ip="214.12.219.68" dst_port="80" proto="udp" src_ip="131.4.96.36" src_port="1131"/>
      <filter dst_ip="214.12.219.68" dst_port="53" proto="tcp" src_ip="131.4.96.36" src_port="1131"/>
      <filter dst_ip="214.12.219.68" dst_port="53" proto="udp" src_ip="131.4.96.36" src_port="1131"/>
      <filter dst_ip="214.12.219.68" dst_port="80" proto="tcp" src_ip="131.4.96.36" src_port="1132"/>
      <filter dst_ip="214.12.219.68" dst_port="80" proto="udp" src_ip="131.4.96.36" src_port="1132"/>
      <filter dst_ip="214.12.219.68" dst_port="53" proto="tcp" src_ip="131.4.96.36" src_port="1132"/>
      <filter dst_ip="214.12.219.68" dst_port="53" proto="udp" src_ip="131.4.96.36" src_port="1132"/>
      <from sec="1115269484" usec="0"/>
      <to sec="1115269535" usec="0"/>
    </slice>
    <from sec="1115269482" usec="0"/>
    <to sec="1115269535" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757479,1.76153,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="197.70.44.145" dst_port="80" proto="tcp" src_ip="172.195.11.80" src_port="61343"/>
      <filter dst_ip="197.70.44.145" dst_port="80" proto="udp" src_ip="172.195.11.80" src_port="61343"/>
      <filter dst_ip="197.70.44.145" dst_port="53" proto="tcp" src_ip="172.195.11.80" src_port="61343"/>
      <filter dst_ip="197.70.44.145" dst_port="53" proto="udp" src_ip="172.195.11.80" src_port="61343"/>
      <filter dst_ip="197.70.44.206" dst_port="80" proto="tcp" src_ip="172.195.11.80" src_port="61343"/>
      <filter dst_ip="197.70.44.206" dst_port="80" proto="udp" src_ip="172.195.11.80" src_port="61343"/>
      <filter dst_ip="197.70.44.206" dst_port="53" proto="tcp" src_ip="172.195.11.80" src_port="61343"/>
      <filter dst_ip="197.70.44.206" dst_port="53" proto="udp" src_ip="172.195.11.80" src_port="61343"/>
      <filter dst_ip="197.70.44.133" dst_port="80" proto="tcp" src_ip="172.195.11.80" src_port="61343"/>
      <filter dst_ip="197.70.44.133" dst_port="80" proto="udp" src_ip="172.195.11.80" src_port="61343"/>
      <filter dst_ip="197.70.44.133" dst_port="53" proto="tcp" src_ip="172.195.11.80" src_port="61343"/>
      <filter dst_ip="197.70.44.133" dst_port="53" proto="udp" src_ip="172.195.11.80" src_port="61343"/>
      <from sec="1115269981" usec="0"/>
      <to sec="1115269991" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="197.70.44.145" dst_port="80" proto="tcp" src_ip="171.76.43.80" src_port="61343"/>
      <filter dst_ip="197.70.44.145" dst_port="80" proto="udp" src_ip="171.76.43.80" src_port="61343"/>
      <filter dst_ip="197.70.44.145" dst_port="53" proto="tcp" src_ip="171.76.43.80" src_port="61343"/>
      <filter dst_ip="197.70.44.145" dst_port="53" proto="udp" src_ip="171.76.43.80" src_port="61343"/>
      <filter dst_ip="197.70.44.206" dst_port="80" proto="tcp" src_ip="171.76.43.80" src_port="61343"/>
      <filter dst_ip="197.70.44.206" dst_port="80" proto="udp" src_ip="171.76.43.80" src_port="61343"/>
      <filter dst_ip="197.70.44.206" dst_port="53" proto="tcp" src_ip="171.76.43.80" src_port="61343"/>
      <filter dst_ip="197.70.44.206" dst_port="53" proto="udp" src_ip="171.76.43.80" src_port="61343"/>
      <filter dst_ip="197.70.44.133" dst_port="80" proto="tcp" src_ip="171.76.43.80" src_port="61343"/>
      <filter dst_ip="197.70.44.133" dst_port="80" proto="udp" src_ip="171.76.43.80" src_port="61343"/>
      <filter dst_ip="197.70.44.133" dst_port="53" proto="tcp" src_ip="171.76.43.80" src_port="61343"/>
      <filter dst_ip="197.70.44.133" dst_port="53" proto="udp" src_ip="171.76.43.80" src_port="61343"/>
      <from sec="1115269981" usec="0"/>
      <to sec="1115269991" usec="0"/>
    </slice>
    <from sec="1115269328" usec="0"/>
    <to sec="1115269991" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757479,1.76153,503,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="220.214.59.103" dst_port="80" proto="tcp" src_ip="131.4.69.81"/>
      <filter dst_ip="220.214.59.103" dst_port="80" proto="udp" src_ip="131.4.69.81"/>
      <filter dst_ip="220.214.59.103" dst_port="53" proto="tcp" src_ip="131.4.69.81"/>
      <filter dst_ip="220.214.59.103" dst_port="53" proto="udp" src_ip="131.4.69.81"/>
      <from sec="1115269700" usec="0"/>
      <to sec="1115269706" usec="0"/>
    </slice>
    <from sec="1115269683" usec="0"/>
    <to sec="1115269707" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757479,1.76153,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="172.195.111.182" dst_port="5554" proto="tcp" src_ip="200.151.75.24" src_port="80"/>
      <filter dst_ip="172.195.111.182" dst_port="9898" proto="tcp" src_ip="200.151.75.24" src_port="80"/>
      <from sec="1115269812" usec="0"/>
      <to sec="1115269815" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="172.195.111.182" dst_port="5554" proto="tcp" src_ip="200.188.55.24" src_port="80"/>
      <filter dst_ip="172.195.111.182" dst_port="9898" proto="tcp" src_ip="200.188.55.24" src_port="80"/>
      <from sec="1115269812" usec="0"/>
      <to sec="1115269820" usec="0"/>
    </slice>
    <from sec="1115269812" usec="0"/>
    <to sec="1115269820" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757479,1.76153,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="tcp" src_ip="95.84.97.42" src_port="29148"/>
      <filter dst_port="137" proto="udp" src_ip="95.84.97.42" src_port="29148"/>
      <from sec="1115269393" usec="0"/>
      <to sec="1115269407" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="137" proto="tcp" src_ip="211.25.21.42" src_port="29148"/>
      <filter dst_port="137" proto="udp" src_ip="211.25.21.42" src_port="29148"/>
      <from sec="1115269392" usec="0"/>
      <to sec="1115269405" usec="0"/>
    </slice>
    <from sec="1115269392" usec="0"/>
    <to sec="1115269407" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757479,1.76153,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="20.42.11.54" src_port="1028"/>
      <from sec="1115269200" usec="0"/>
      <to sec="1115269211" usec="0"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115269211" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757479,1.76153,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="21.1.140.58" src_port="1025"/>
      <from sec="1115269577" usec="0"/>
      <to sec="1115269583" usec="0"/>
    </slice>
    <from sec="1115269577" usec="0"/>
    <to sec="1115269583" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757479,1.76153,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="149.188.129.162" dst_port="137" proto="tcp" src_ip="209.81.40.88" src_port="1084"/>
      <filter dst_ip="149.188.129.162" dst_port="137" proto="udp" src_ip="209.81.40.88" src_port="1084"/>
      <filter dst_ip="149.188.129.162" dst_port="1434" proto="tcp" src_ip="209.81.40.88" src_port="1084"/>
      <filter dst_ip="149.188.129.162" dst_port="1434" proto="udp" src_ip="209.81.40.88" src_port="1084"/>
      <from sec="1115269428" usec="0"/>
      <to sec="1115269438" usec="0"/>
    </slice>
    <from sec="1115269428" usec="0"/>
    <to sec="1115269440" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757479,1.76153,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="64.160.23.97" dst_port="137" proto="tcp" src_ip="207.135.18.157" src_port="1026"/>
      <filter dst_ip="64.160.23.97" dst_port="137" proto="udp" src_ip="207.135.18.157" src_port="1026"/>
      <filter dst_ip="64.160.23.97" dst_port="1434" proto="tcp" src_ip="207.135.18.157" src_port="1026"/>
      <filter dst_ip="64.160.23.97" dst_port="1434" proto="udp" src_ip="207.135.18.157" src_port="1026"/>
      <filter dst_ip="64.160.23.97" dst_port="2401" proto="tcp" src_ip="207.135.18.157" src_port="1026"/>
      <filter dst_ip="64.160.23.97" dst_port="2401" proto="udp" src_ip="207.135.18.157" src_port="1026"/>
      <from sec="1115269716" usec="0"/>
      <to sec="1115269728" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="64.160.23.97" dst_port="137" proto="tcp" src_ip="171.76.32.204" src_port="1026"/>
      <filter dst_ip="64.160.23.97" dst_port="137" proto="udp" src_ip="171.76.32.204" src_port="1026"/>
      <filter dst_ip="64.160.23.97" dst_port="1434" proto="tcp" src_ip="171.76.32.204" src_port="1026"/>
      <filter dst_ip="64.160.23.97" dst_port="1434" proto="udp" src_ip="171.76.32.204" src_port="1026"/>
      <filter dst_ip="64.160.23.97" dst_port="2401" proto="tcp" src_ip="171.76.32.204" src_port="1026"/>
      <filter dst_ip="64.160.23.97" dst_port="2401" proto="udp" src_ip="171.76.32.204" src_port="1026"/>
      <from sec="1115269720" usec="0"/>
      <to sec="1115269728" usec="0"/>
    </slice>
    <from sec="1115269716" usec="0"/>
    <to sec="1115269728" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757479,1.76153,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="209.198.99.240" src_port="1026"/>
      <from sec="1115269615" usec="0"/>
      <to sec="1115269623" usec="0"/>
    </slice>
    <from sec="1115269614" usec="0"/>
    <to sec="1115269623" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757479,1.76153,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="445" proto="tcp" src_ip="211.220.90.101" src_port="7003"/>
      <from sec="1115269972" usec="0"/>
      <to sec="1115270047" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="445" proto="tcp" src_ip="21.17.70.101" src_port="7003"/>
      <from sec="1115269981" usec="0"/>
      <to sec="1115269991" usec="0"/>
    </slice>
    <from sec="1115269972" usec="0"/>
    <to sec="1115270047" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757479,1.76153,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="88.162.35.183"/>
      <filter dst_port="137" proto="icmp" src_ip="88.162.35.183"/>
      <from sec="1115269555" usec="0"/>
      <to sec="1115269569" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="137" proto="udp" src_ip="210.53.131.183"/>
      <filter dst_port="137" proto="icmp" src_ip="210.53.131.183"/>
      <from sec="1115269556" usec="0"/>
      <to sec="1115269571" usec="0"/>
    </slice>
    <from sec="1115269555" usec="0"/>
    <to sec="1115269571" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757479,1.76153,504,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="202.165.151.210" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="202.165.151.210" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="69.56.152.12" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="69.56.152.12" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="131.5.71.200" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="131.5.71.200" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="214.12.38.139" src_port="1039"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="tcp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="25" proto="udp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="tcp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="53" proto="udp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="tcp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="135" proto="udp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="tcp" src_ip="214.12.38.139" src_port="1031"/>
      <filter dst_ip="214.12.38.139" dst_port="443" proto="udp" src_ip="214.12.38.139" src_port="1031"/>
      <from sec="1115269615" usec="0"/>
      <to sec="1115269669" usec="0"/>
    </slice>
    <from sec="1115269615" usec="0"/>
    <to sec="1115269669" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757479,1.76153,504,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="66.213.229.13" dst_port="53" proto="tcp" src_ip="172.195.16.133" src_port="1264"/>
      <filter dst_ip="66.213.229.13" dst_port="53" proto="udp" src_ip="172.195.16.133" src_port="1264"/>
      <filter dst_ip="66.213.229.13" dst_port="443" proto="tcp" src_ip="172.195.16.133" src_port="1264"/>
      <filter dst_ip="66.213.229.13" dst_port="443" proto="udp" src_ip="172.195.16.133" src_port="1264"/>
      <filter dst_ip="149.188.86.22" dst_port="53" proto="tcp" src_ip="172.195.16.133" src_port="1264"/>
      <filter dst_ip="149.188.86.22" dst_port="53" proto="udp" src_ip="172.195.16.133" src_port="1264"/>
      <filter dst_ip="149.188.86.22" dst_port="443" proto="tcp" src_ip="172.195.16.133" src_port="1264"/>
      <filter dst_ip="149.188.86.22" dst_port="443" proto="udp" src_ip="172.195.16.133" src_port="1264"/>
      <from sec="1115269706" usec="0"/>
      <to sec="1115269711" usec="0"/>
    </slice>
    <from sec="1115269706" usec="0"/>
    <to sec="1115269717" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757479,1.76153,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="210.53.134.171" dst_port="80" proto="tcp" src_ip="202.165.151.210" src_port="53"/>
      <filter dst_ip="210.53.134.171" dst_port="80" proto="udp" src_ip="202.165.151.210" src_port="53"/>
      <filter dst_ip="210.53.134.171" dst_port="80" proto="tcp" src_ip="202.165.151.210" src_port="53"/>
      <filter dst_ip="210.53.134.171" dst_port="80" proto="udp" src_ip="202.165.151.210" src_port="53"/>
      <filter dst_ip="210.53.134.171" dst_port="80" proto="tcp" src_ip="202.165.151.210" src_port="53"/>
      <filter dst_ip="210.53.134.171" dst_port="80" proto="udp" src_ip="202.165.151.210" src_port="53"/>
      <filter dst_ip="210.53.134.171" dst_port="80" proto="tcp" src_ip="202.165.151.210" src_port="53"/>
      <filter dst_ip="210.53.134.171" dst_port="80" proto="udp" src_ip="202.165.151.210" src_port="53"/>
      <filter dst_ip="210.53.134.171" dst_port="25" proto="tcp" src_ip="202.165.151.210" src_port="53"/>
      <filter dst_ip="210.53.134.171" dst_port="25" proto="udp" src_ip="202.165.151.210" src_port="53"/>
      <filter dst_ip="210.53.134.171" dst_port="25" proto="tcp" src_ip="202.165.151.210" src_port="53"/>
      <filter dst_ip="210.53.134.171" dst_port="25" proto="udp" src_ip="202.165.151.210" src_port="53"/>
      <filter dst_ip="210.53.134.171" dst_port="25" proto="tcp" src_ip="202.165.151.210" src_port="53"/>
      <filter dst_ip="210.53.134.171" dst_port="25" proto="udp" src_ip="202.165.151.210" src_port="53"/>
      <filter dst_ip="210.53.134.171" dst_port="25" proto="tcp" src_ip="202.165.151.210" src_port="53"/>
      <filter dst_ip="210.53.134.171" dst_port="25" proto="udp" src_ip="202.165.151.210" src_port="53"/>
      <filter dst_ip="210.53.134.171" dst_port="53" proto="tcp" src_ip="202.165.151.210" src_port="53"/>
      <filter dst_ip="210.53.134.171" dst_port="53" proto="udp" src_ip="202.165.151.210" src_port="53"/>
      <filter dst_ip="210.53.134.171" dst_port="53" proto="tcp" src_ip="202.165.151.210" src_port="53"/>
      <filter dst_ip="210.53.134.171" dst_port="53" proto="udp" src_ip="202.165.151.210" src_port="53"/>
      <filter dst_ip="210.53.134.171" dst_port="53" proto="tcp" src_ip="202.165.151.210" src_port="53"/>
      <filter dst_ip="210.53.134.171" dst_port="53" proto="udp" src_ip="202.165.151.210" src_port="53"/>
      <filter dst_ip="210.53.134.171" dst_port="53" proto="tcp" src_ip="202.165.151.210" src_port="53"/>
      <filter dst_ip="210.53.134.171" dst_port="53" proto="udp" src_ip="202.165.151.210" src_port="53"/>
      <from sec="1115269855" usec="0"/>
      <to sec="1115269862" usec="0"/>
    </slice>
    <from sec="1115269855" usec="0"/>
    <to sec="1115269862" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.06897,1.81617,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="149.188.129.162" dst_port="22" proto="tcp" src_ip="20.41.117.79" src_port="20895"/>
      <filter dst_ip="149.188.129.162" dst_port="20" proto="tcp" src_ip="20.41.117.79" src_port="20895"/>
      <filter dst_ip="149.188.129.162" dst_port="80" proto="tcp" src_ip="20.41.117.79" src_port="20895"/>
      <from sec="1115269947" usec="0"/>
      <to sec="1115269950" usec="0"/>
    </slice>
    <from sec="1115269947" usec="0"/>
    <to sec="1115269959" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.06897,1.81617,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="212.64.236.114" dst_port="53" proto="udp" src_ip="210.53.128.148" src_port="44556"/>
      <filter dst_ip="212.64.236.114" dst_port="53" proto="udp" src_ip="210.53.128.148" src_port="53"/>
      <from sec="1115269219" usec="0"/>
      <to sec="1115270096" usec="0"/>
    </slice>
    <from sec="1115269219" usec="0"/>
    <to sec="1115270096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.06897,1.81617,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="149.188.129.162" dst_port="25" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="25" proto="udp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="53" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="53" proto="udp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="20" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="20" proto="udp" src_ip="202.165.151.210"/>
      <from sec="1115269219" usec="0"/>
      <to sec="1115269933" usec="0"/>
    </slice>
    <from sec="1115269219" usec="0"/>
    <to sec="1115269937" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.14496,1.86712,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="149.188.129.162" dst_port="22" proto="tcp" src_ip="20.41.117.79" src_port="20895"/>
      <filter dst_ip="149.188.129.162" dst_port="20" proto="tcp" src_ip="20.41.117.79" src_port="20895"/>
      <filter dst_ip="149.188.129.162" dst_port="80" proto="tcp" src_ip="20.41.117.79" src_port="20895"/>
      <from sec="1115269947" usec="0"/>
      <to sec="1115269950" usec="0"/>
    </slice>
    <from sec="1115269947" usec="0"/>
    <to sec="1115269959" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.14496,1.86712,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="149.188.129.162" dst_port="25" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="25" proto="udp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="53" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="53" proto="udp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="20" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="20" proto="udp" src_ip="202.165.151.210"/>
      <from sec="1115269219" usec="0"/>
      <to sec="1115269933" usec="0"/>
    </slice>
    <from sec="1115269219" usec="0"/>
    <to sec="1115269937" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.14496,1.86712,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="149.188.129.162" dst_port="80" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="80" proto="udp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="80" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="80" proto="udp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="80" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="80" proto="udp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="80" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="80" proto="udp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="25" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="25" proto="udp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="25" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="25" proto="udp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="25" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="25" proto="udp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="25" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="25" proto="udp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="20" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="20" proto="udp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="20" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="20" proto="udp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="20" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="20" proto="udp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="20" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="20" proto="udp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="53" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="53" proto="udp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="53" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="53" proto="udp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="53" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="53" proto="udp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="53" proto="tcp" src_ip="202.165.151.210"/>
      <filter dst_ip="149.188.129.162" dst_port="53" proto="udp" src_ip="202.165.151.210"/>
      <from sec="1115269212" usec="0"/>
      <to sec="1115269948" usec="0"/>
    </slice>
    <from sec="1115269212" usec="0"/>
    <to sec="1115269948" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.14496,1.86712,002,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="tcp" src_ip="206.75.148.163" src_port="1025"/>
      <filter dst_port="137" proto="udp" src_ip="206.75.148.163" src_port="1025"/>
      <filter dst_port="1434" proto="tcp" src_ip="206.75.148.163" src_port="1025"/>
      <filter dst_port="1434" proto="udp" src_ip="206.75.148.163" src_port="1025"/>
      <filter dst_port="80" proto="tcp" src_ip="206.75.148.163" src_port="1025"/>
      <filter dst_port="80" proto="udp" src_ip="206.75.148.163" src_port="1025"/>
      <from sec="1115269549" usec="0"/>
      <to sec="1115269564" usec="0"/>
    </slice>
    <from sec="1115269549" usec="0"/>
    <to sec="1115269566" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.14496,1.86712,901,0 0 1 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="133.21.198.124" dst_port="137" proto="tcp" src_ip="194.44.104.242" src_port="1033"/>
      <filter dst_ip="133.21.198.124" dst_port="137" proto="udp" src_ip="194.44.104.242" src_port="1033"/>
      <filter dst_ip="133.21.198.124" dst_port="1434" proto="tcp" src_ip="194.44.104.242" src_port="1033"/>
      <filter dst_ip="133.21.198.124" dst_port="1434" proto="udp" src_ip="194.44.104.242" src_port="1033"/>
      <from sec="1115269536" usec="0"/>
      <to sec="1115269549" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="133.21.198.124" dst_port="137" proto="tcp" src_ip="69.101.83.49" src_port="1033"/>
      <filter dst_ip="133.21.198.124" dst_port="137" proto="udp" src_ip="69.101.83.49" src_port="1033"/>
      <filter dst_ip="133.21.198.124" dst_port="1434" proto="tcp" src_ip="69.101.83.49" src_port="1033"/>
      <filter dst_ip="133.21.198.124" dst_port="1434" proto="udp" src_ip="69.101.83.49" src_port="1033"/>
      <from sec="1115269540" usec="0"/>
      <to sec="1115269549" usec="0"/>
    </slice>
    <from sec="1115269536" usec="0"/>
    <to sec="1115269549" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_77{
style=filled;
color=gray75;
371[label="172.185.57.40;s;3436pkt 3436fpkt", shape=diamond, color=yellow];
stat77[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.185.57.40:23006, *:*}[97.8754%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 23006: (48.9377%)&lt;BR/&gt; 80: (0.523865%)&lt;BR/&gt; 443: (0.509313%)&lt;BR/&gt; 54045: (0.130966%)&lt;BR/&gt; 0: (0.116414%)&gt;];
}
371--517[label="0.00220264;1pkt 1fpkt"];
371--1983[label="0.00107296;3pkt 3fpkt"];
371--1989[label="0.000334225;1pkt 1fpkt"];
371--1997[label="0.0011274;3pkt 3fpkt"];
371--2004[label="0.000413223;1pkt 1fpkt"];
371--2015[label="0.000334225;1pkt 1fpkt"];
371--2020[label="0.0011274;3pkt 3fpkt"];
371--2024[label="0.000413223;1pkt 1fpkt"];
371--2031[label="0.0011274;3pkt 3fpkt"];
371--2035[label="0.000413223;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="172.185.57.40" src_port="23006"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.06446,1.62418,999,1 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_78{
style=filled;
color=gray75;
23[label="172.195.77.86s;1pkt 1fpkt", shape=rectangle, color=red];
382[label="172.195.77.86;s;12pkt 12fpkt", shape=diamond, color=yellow];
383[label="66.171.190.31;d;1pkt 1fpkt", shape=diamond, color=yellow];
1880[label="172.195.77.86;s;12pkt 12fpkt", shape=hexagon, color=black];
2373[label="172.195.77.86;12pkt 12fpkt", shape=pentagon, color=darkviolet];
stat78[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.77.86:*, 214.176.27.49:80}[50%]&lt;BR/&gt;{172.195.77.86:*, *:1863}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (38.1579%)&lt;BR/&gt; 1863: (11.8421%)&lt;BR/&gt; 4390: (6.57895%)&lt;BR/&gt; 4425: (3.94737%)&lt;BR/&gt; 4424: (3.94737%)&gt;];
}
23--382[label="1;1pkt 1fpkt"];
23--383[label="1;1pkt 1fpkt"];
23--1880[label="1;1pkt 1fpkt"];
23--2373[label="1;1pkt 1fpkt"];
382--383[label="1;1pkt 1fpkt"];
382--1880[label="1;12pkt 12fpkt"];
382--2373[label="1;12pkt 12fpkt"];
383--1880[label="1;1pkt 1fpkt"];
383--2373[label="1;1pkt 1fpkt"];
1880--2373[label="1;12pkt 12fpkt"];
</description>
    <slice>
      <filter dst_port="1863" src_ip="172.195.77.86"/>
      <filter dst_ip="214.176.27.49" dst_port="80" src_ip="172.195.77.86"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.827641,1.7154,999,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_79{
style=filled;
color=gray75;
82[label="131.5.11.119d;2pkt 2fpkt", shape=rectangle, color=red];
386[label="202.146.238.15;s;1pkt 1fpkt", shape=diamond, color=yellow];
406[label="206.149.71.136;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat79[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.146.238.15:15048, 131.5.11.119:1297}[50%]&lt;BR/&gt;{206.149.71.136:15005, 131.5.11.119:1300}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 15048: (25%)&lt;BR/&gt; 15005: (25%)&lt;BR/&gt; 1300: (25%)&lt;BR/&gt; 1297: (25%)&gt;];
}
82--386[label="1;1pkt 1fpkt"];
82--406[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="131.5.11.119" dst_port="1300" src_ip="206.149.71.136" src_port="15005"/>
      <filter dst_ip="131.5.11.119" dst_port="1297" src_ip="202.146.238.15" src_port="15048"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.10354,1.68992,999,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_80{
style=filled;
color=gray75;
73[label="149.188.86.22d;1pkt 1fpkt", shape=rectangle, color=red];
395[label="206.37.173.221;s;1pkt 1fpkt", shape=diamond, color=yellow];
1820[label="206.37.173.221;s;1pkt 1fpkt", shape=hexagon, color=black];
stat80[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.37.173.221:4148, 149.188.86.22:1064}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4148: (50%)&lt;BR/&gt; 1064: (50%)&gt;];
}
73--395[label="1;1pkt 1fpkt"];
73--644[label="1;1pkt 1fpkt"];
73--1820[label="1;1pkt 1fpkt"];
395--644[label="1;1pkt 1fpkt"];
395--1820[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.86.22" dst_port="1064" src_ip="206.37.173.221" src_port="4148"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.77477,1.65068,503,1 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_81{
style=filled;
color=gray75;
89[label="133.190.149.216d;1036pkt 1036fpkt", shape=rectangle, color=red];
411[label="207.135.173.198;s;1237pkt 1237fpkt", shape=diamond, color=yellow];
2756[label="207.135.173.198;1237pkt 1237fpkt", shape=pentagon, color=darkviolet];
stat81[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.135.173.198:*, 133.190.149.216:80}[99.9192%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.9715%)&lt;BR/&gt; 0: (0.0569801%)&lt;BR/&gt; 60999: (0.042735%)&lt;BR/&gt; 60998: (0.042735%)&lt;BR/&gt; 60996: (0.042735%)&gt;];
}
89--366[label="0.00343053;2pkt 2fpkt"];
89--411[label="1;1036pkt 1036fpkt"];
89--2756[label="1;1036pkt 1036fpkt"];
411--2756[label="1;1237pkt 1237fpkt"];
</description>
    <slice>
      <filter dst_ip="133.190.149.216" dst_port="80" src_ip="207.135.173.198"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115269967" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.77477,1.65068,503,1 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_82{
style=filled;
color=gray75;
75[label="149.188.130.50d;2pkt 2fpkt", shape=rectangle, color=red];
415[label="152.109.88.144;s;6pkt 6fpkt", shape=diamond, color=yellow];
2562[label="152.109.88.144;11pkt 11fpkt", shape=pentagon, color=darkviolet];
stat82[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.109.88.144:*, 149.188.130.50:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3129: (7.89474%)&lt;BR/&gt; 3124: (7.89474%)&lt;BR/&gt; 3128: (5.26316%)&lt;BR/&gt; 3127: (5.26316%)&gt;];
}
75--414[label="1;2pkt 2fpkt"];
75--415[label="1;2pkt 2fpkt"];
75--2562[label="1;2pkt 2fpkt"];
415--2562[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.130.50" dst_port="80" src_ip="152.109.88.144"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270024" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.859378,1.64748,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_84{
style=filled;
color=gray75;
420[label="131.4.94.170;s;605pkt 605fpkt", shape=diamond, color=yellow];
425[label="207.147.76.117;d;86pkt 86fpkt", shape=diamond, color=yellow];
718[label="21.39.6.96;d;4pkt 4fpkt", shape=diamond, color=yellow];
916[label="157.229.137.227;d;2pkt 2fpkt", shape=diamond, color=yellow];
1040[label="172.195.110.177;s;123pkt 123fpkt", shape=diamond, color=yellow];
1101[label="69.94.88.130;d;1pkt 1fpkt", shape=diamond, color=yellow];
1584[label="131.4.121.173;s;71pkt 71fpkt", shape=diamond, color=yellow];
2655[label="131.4.94.170;642pkt 642fpkt", shape=pentagon, color=darkviolet];
2662[label="131.4.121.173;136pkt 136fpkt", shape=pentagon, color=darkviolet];
3293[label="131.4.94.170;642pkt 642fpkt", shape=invtriangle, color=brown];
3299[label="131.4.121.173;136pkt 136fpkt", shape=invtriangle, color=brown];
3642[label="131.4.94.170;643pkt 643fpkt", shape=invhouse, color=bisque];
stat84[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.94.170:*, *:*}[67.6842%]&lt;BR/&gt;{*:*, *:80}[35.7895%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (11.1129%)&lt;BR/&gt; 16881: (4.23811%)&lt;BR/&gt; 8285: (1.98965%)&lt;BR/&gt; 26059: (1.76318%)&lt;BR/&gt; 10916: (1.5529%)&gt;];
}
420--425[label="0.255814;22pkt 22fpkt"];
420--718[label="1;4pkt 4fpkt"];
420--916[label="1;2pkt 2fpkt"];
420--1101[label="1;1pkt 1fpkt"];
420--2655[label="0.998347;604pkt 604fpkt"];
420--3293[label="0.998347;604pkt 604fpkt"];
420--3642[label="1;605pkt 605fpkt"];
425--433[label="0.0930233;8pkt 8fpkt"];
425--577[label="0.453488;39pkt 39fpkt"];
425--1040[label="0.0348837;3pkt 3fpkt"];
425--1584[label="0.0422535;3pkt 3fpkt"];
425--1760[label="0.406977;35pkt 35fpkt"];
425--2655[label="0.255814;22pkt 22fpkt"];
425--2662[label="0.151163;13pkt 13fpkt"];
425--2802[label="0.0930233;8pkt 8fpkt"];
425--3293[label="0.255814;22pkt 22fpkt"];
425--3299[label="0.151163;13pkt 13fpkt"];
425--3374[label="0.0930233;8pkt 8fpkt"];
425--3642[label="0.255814;22pkt 22fpkt"];
718--2655[label="0.75;3pkt 3fpkt"];
718--3293[label="0.75;3pkt 3fpkt"];
718--3642[label="1;4pkt 4fpkt"];
916--2655[label="1;2pkt 2fpkt"];
916--3293[label="1;2pkt 2fpkt"];
916--3642[label="1;2pkt 2fpkt"];
1101--2655[label="1;1pkt 1fpkt"];
1101--3293[label="1;1pkt 1fpkt"];
1101--3642[label="1;1pkt 1fpkt"];
1584--2662[label="1;71pkt 71fpkt"];
1584--3299[label="1;71pkt 71fpkt"];
2655--3293[label="1;642pkt 642fpkt"];
2655--3642[label="1;642pkt 642fpkt"];
2662--3299[label="1;136pkt 136fpkt"];
3293--3642[label="1;642pkt 642fpkt"];
</description>
    <slice>
      <filter src_ip="131.4.94.170"/>
      <filter dst_port="80"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.859378,1.64748,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_85{
style=filled;
color=gray75;
428[label="205.144.222.249;d;22pkt 22fpkt", shape=diamond, color=yellow];
429[label="133.190.133.251;s;30pkt 30fpkt", shape=diamond, color=yellow];
1175[label="131.5.50.15;s;194pkt 194fpkt", shape=diamond, color=yellow];
1662[label="67.35.16.90;d;92pkt 92fpkt", shape=diamond, color=yellow];
1689[label="131.4.176.16;s;73pkt 73fpkt", shape=diamond, color=yellow];
2574[label="131.4.176.148;9pkt 9fpkt", shape=pentagon, color=darkviolet];
2719[label="131.4.125.189;8pkt 8fpkt", shape=pentagon, color=darkviolet];
2744[label="131.5.180.195;25pkt 25fpkt", shape=pentagon, color=darkviolet];
2948[label="133.190.133.251;30pkt 30fpkt", shape=pentagon, color=darkviolet];
3329[label="131.4.125.189;7pkt 7fpkt", shape=invtriangle, color=brown];
3345[label="131.5.180.195;25pkt 25fpkt", shape=invtriangle, color=brown];
3452[label="133.190.133.251;29pkt 29fpkt", shape=invtriangle, color=brown];
3723[label="133.190.133.251;30pkt 30fpkt", shape=invhouse, color=bisque];
stat85[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.50.15:*, *:80}[45.4327%]&lt;BR/&gt;{*:*, 67.35.16.90:*}[22.1154%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (40.4181%)&lt;BR/&gt; 443: (6.27178%)&lt;BR/&gt; 1863: (1.30662%)&lt;BR/&gt; 0: (1.0453%)&lt;BR/&gt; 1187: (0.783972%)&gt;];
}
428--429[label="1;22pkt 22fpkt"];
428--2948[label="1;22pkt 22fpkt"];
428--3452[label="1;22pkt 22fpkt"];
428--3723[label="1;22pkt 22fpkt"];
429--1662[label="0.0666667;2pkt 2fpkt"];
429--2948[label="1;30pkt 30fpkt"];
429--3452[label="1;29pkt 29fpkt"];
429--3723[label="1;30pkt 30fpkt"];
1175--1662[label="0.0434783;4pkt 4fpkt"];
1662--1672[label="0.0344828;2pkt 2fpkt"];
1662--1688[label="0.0307692;2pkt 2fpkt"];
1662--1689[label="0.0684932;5pkt 5fpkt"];
1662--1750[label="0.0238095;1pkt 1fpkt"];
1662--1760[label="0.076087;7pkt 7fpkt"];
1662--1813[label="0.0108696;1pkt 1fpkt"];
1662--1912[label="0.0108696;1pkt 1fpkt"];
1662--1949[label="0.0344828;2pkt 2fpkt"];
1662--2040[label="0.0666667;1pkt 1fpkt"];
1662--2094[label="0.0217391;2pkt 2fpkt"];
1662--2118[label="0.0344828;2pkt 2fpkt"];
1662--2226[label="0.0326087;3pkt 3fpkt"];
1662--2509[label="0.0454545;1pkt 1fpkt"];
1662--2567[label="0.0108696;1pkt 1fpkt"];
1662--2574[label="0.111111;1pkt 1fpkt"];
1662--2719[label="0.125;1pkt 1fpkt"];
1662--2744[label="0.08;2pkt 2fpkt"];
1662--2802[label="0.141304;13pkt 13fpkt"];
1662--2948[label="0.0666667;2pkt 2fpkt"];
1662--2953[label="0.076087;7pkt 7fpkt"];
1662--2961[label="0.0666667;1pkt 1fpkt"];
1662--2985[label="0.0217391;2pkt 2fpkt"];
1662--2995[label="0.0543478;5pkt 5fpkt"];
1662--3002[label="0.0344828;2pkt 2fpkt"];
1662--3179[label="0.0357143;2pkt 2fpkt"];
1662--3246[label="0.0108696;1pkt 1fpkt"];
1662--3312[label="0.0108696;1pkt 1fpkt"];
1662--3329[label="0.142857;1pkt 1fpkt"];
1662--3345[label="0.08;2pkt 2fpkt"];
1662--3374[label="0.141304;13pkt 13fpkt"];
1662--3452[label="0.0689655;2pkt 2fpkt"];
1662--3455[label="0.076087;7pkt 7fpkt"];
1662--3460[label="0.0666667;1pkt 1fpkt"];
1662--3486[label="0.0350877;2pkt 2fpkt"];
1662--3723[label="0.0666667;2pkt 2fpkt"];
1662--3724[label="0.076087;7pkt 7fpkt"];
1689--2995[label="1;73pkt 73fpkt"];
2719--3329[label="1;7pkt 7fpkt"];
2744--3345[label="1;25pkt 25fpkt"];
2948--3452[label="1;29pkt 29fpkt"];
2948--3723[label="1;30pkt 30fpkt"];
3452--3723[label="1;29pkt 29fpkt"];
</description>
    <slice>
      <filter dst_ip="67.35.16.90"/>
      <filter dst_port="80" src_ip="131.5.50.15"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.827641,1.7154,503,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_86{
style=filled;
color=gray75;
32[label="171.76.42.135s;1pkt 1fpkt", shape=rectangle, color=red];
207[label="172.195.155.89d;1pkt 1fpkt", shape=rectangle, color=red];
443[label="193.117.67.98;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat86[shape=component, label=&lt;Rules:&lt;BR/&gt;{171.76.42.135:1327, 193.117.67.98:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1327: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
32--207[label="1;1pkt 1fpkt"];
32--443[label="1;1pkt 1fpkt"];
32--445[label="1;1pkt 1fpkt"];
207--443[label="1;1pkt 1fpkt"];
207--445[label="1;1pkt 1fpkt"];
443--445[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="193.117.67.98" dst_port="80" src_ip="171.76.42.135" src_port="1327"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115269828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.827641,1.7154,999,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_87{
style=filled;
color=gray75;
3[label="202.168.235.22s;1pkt 1fpkt", shape=rectangle, color=red];
452[label="149.188.172.27;d;3pkt 3fpkt", shape=diamond, color=yellow];
453[label="202.168.235.22;s;2pkt 2fpkt", shape=diamond, color=yellow];
stat87[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.7.0.65:23, 149.188.172.27:1560}[33.3333%]&lt;BR/&gt;{202.168.235.22:57591, 149.188.172.27:1598}[33.3333%]&lt;BR/&gt;{202.168.235.22:57591, 149.188.172.27:13655}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 57591: (41.6667%)&lt;BR/&gt; 13655: (25%)&lt;BR/&gt; 1598: (16.6667%)&lt;BR/&gt; 1560: (8.33333%)&lt;BR/&gt; 23: (8.33333%)&gt;];
}
3--452[label="1;1pkt 1fpkt"];
3--453[label="1;1pkt 1fpkt"];
452--453[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.172.27" dst_port="13655" src_ip="202.168.235.22" src_port="57591"/>
      <filter dst_ip="149.188.172.27" dst_port="1598" src_ip="202.168.235.22" src_port="57591"/>
      <filter dst_ip="149.188.172.27" dst_port="1560" src_ip="204.7.0.65" src_port="23"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_88{
style=filled;
color=gray75;
2183[label="59.44.208.35;7pkt 7fpkt", shape=pentagon, color=darkviolet];
stat88[shape=component, label=&lt;Rules:&lt;BR/&gt;{59.44.208.35:143, 211.19.90.226:*}[28.5714%]&lt;BR/&gt;{59.44.208.35:993, 133.33.242.234:*}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 143: (28.5714%)&lt;BR/&gt; 993: (21.4286%)&lt;BR/&gt; 49539: (7.14286%)&lt;BR/&gt; 49238: (7.14286%)&lt;BR/&gt; 49222: (7.14286%)&gt;];
}
2183--3039[label="1;7pkt 7fpkt"];
2183--3505[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="133.33.242.234" src_ip="59.44.208.35" src_port="993"/>
      <filter dst_ip="211.19.90.226" src_ip="59.44.208.35" src_port="143"/>
    </slice>
    <from sec="1115269226" usec="0"/>
    <to sec="1115270065" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.827641,1.7154,999,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_90{
style=filled;
color=gray75;
26[label="210.53.133.104s;3pkt 3fpkt", shape=rectangle, color=red];
401[label="210.53.133.104;s;166pkt 166fpkt", shape=diamond, color=yellow];
402[label="211.213.168.96;d;4pkt 4fpkt", shape=diamond, color=yellow];
481[label="93.156.158.200;d;3pkt 3fpkt", shape=diamond, color=yellow];
606[label="221.234.23.205;d;1pkt 1fpkt", shape=diamond, color=yellow];
748[label="205.152.198.95;d;1pkt 1fpkt", shape=diamond, color=yellow];
758[label="196.179.225.218;d;1pkt 1fpkt", shape=diamond, color=yellow];
904[label="68.166.200.174;d;4pkt 4fpkt", shape=diamond, color=yellow];
975[label="94.171.109.39;d;1pkt 1fpkt", shape=diamond, color=yellow];
1119[label="206.93.28.234;d;1pkt 1fpkt", shape=diamond, color=yellow];
1360[label="206.82.212.6;d;4pkt 4fpkt", shape=diamond, color=yellow];
1620[label="207.77.36.246;d;165pkt 165fpkt", shape=diamond, color=yellow];
stat90[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.53.133.104:20, 207.77.36.246:*}[50.9346%]&lt;BR/&gt;{210.53.133.104:21, 207.77.36.246:*}[26.1682%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 20: (26.8362%)&lt;BR/&gt; 21: (14.548%)&lt;BR/&gt; 80: (2.9661%)&lt;BR/&gt; 873: (1.69492%)&lt;BR/&gt; 0: (1.12994%)&gt;];
}
26--401[label="1;3pkt 3fpkt"];
26--481[label="0.666667;2pkt 2fpkt"];
26--606[label="1;1pkt 1fpkt"];
401--402[label="1;4pkt 4fpkt"];
401--481[label="1;3pkt 3fpkt"];
401--606[label="1;1pkt 1fpkt"];
401--614[label="0.0060241;1pkt 1fpkt"];
401--667[label="1;2pkt 2fpkt"];
401--673[label="0.75;6pkt 6fpkt"];
401--748[label="1;1pkt 1fpkt"];
401--758[label="1;1pkt 1fpkt"];
401--904[label="1;4pkt 4fpkt"];
401--975[label="1;1pkt 1fpkt"];
401--1119[label="1;1pkt 1fpkt"];
401--1360[label="1;4pkt 4fpkt"];
401--1620[label="0.709091;117pkt 117fpkt"];
401--1983[label="0.0481928;8pkt 8fpkt"];
401--1989[label="0.0240964;4pkt 4fpkt"];
401--1997[label="0.0120482;2pkt 2fpkt"];
401--2004[label="0.0120482;2pkt 2fpkt"];
401--2015[label="0.0240964;4pkt 4fpkt"];
401--2020[label="0.0120482;2pkt 2fpkt"];
401--2024[label="0.0120482;2pkt 2fpkt"];
401--2031[label="0.0120482;2pkt 2fpkt"];
401--2035[label="0.0120482;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="207.77.36.246" src_ip="210.53.133.104" src_port="20"/>
      <filter dst_ip="207.77.36.246" src_ip="210.53.133.104" src_port="21"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.967126,1.64128,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_92{
style=filled;
color=gray75;
487[label="67.35.29.249;d;8pkt 8fpkt", shape=diamond, color=yellow];
488[label="210.53.130.219;s;24pkt 24fpkt", shape=diamond, color=yellow];
677[label="210.53.130.210;s;164pkt 164fpkt", shape=diamond, color=yellow];
894[label="67.234.199.42;d;73pkt 73fpkt", shape=diamond, color=yellow];
1829[label="210.53.130.219;s;16pkt 16fpkt", shape=hexagon, color=black];
2804[label="210.53.130.210;181pkt 181fpkt", shape=pentagon, color=darkviolet];
2835[label="210.53.130.219;24pkt 24fpkt", shape=pentagon, color=darkviolet];
3376[label="210.53.130.210;181pkt 181fpkt", shape=invtriangle, color=brown];
3392[label="210.53.130.219;24pkt 24fpkt", shape=invtriangle, color=brown];
stat92[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.53.130.210:80, 67.234.199.42:*}[41.4634%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (30.8633%)&lt;BR/&gt; 53: (14.8921%)&lt;BR/&gt; 0: (7.33813%)&lt;BR/&gt; 3858: (4.31655%)&lt;BR/&gt; 65534: (3.38129%)&gt;];
}
487--488[label="0.5;4pkt 4fpkt"];
487--677[label="0.5;4pkt 4fpkt"];
487--1829[label="0.375;3pkt 3fpkt"];
487--1983[label="0.125;1pkt 1fpkt"];
487--1989[label="0.125;1pkt 1fpkt"];
487--2015[label="0.125;1pkt 1fpkt"];
487--2804[label="0.5;4pkt 4fpkt"];
487--2835[label="0.5;4pkt 4fpkt"];
487--3376[label="0.5;4pkt 4fpkt"];
487--3392[label="0.5;4pkt 4fpkt"];
488--614[label="0.0416667;1pkt 1fpkt"];
488--1030[label="0.25;1pkt 1fpkt"];
488--1829[label="1;16pkt 16fpkt"];
488--1983[label="0.0416667;1pkt 1fpkt"];
488--1989[label="0.0833333;2pkt 2fpkt"];
488--2015[label="0.0833333;2pkt 2fpkt"];
488--2835[label="1;24pkt 24fpkt"];
488--3392[label="1;24pkt 24fpkt"];
677--894[label="1;73pkt 73fpkt"];
677--1616[label="0.0138889;1pkt 1fpkt"];
677--1659[label="0.00645161;1pkt 1fpkt"];
677--1982[label="0.0304878;5pkt 5fpkt"];
677--1983[label="0.054878;9pkt 9fpkt"];
677--1988[label="0.00609756;1pkt 1fpkt"];
677--1989[label="0.0670732;11pkt 11fpkt"];
677--1997[label="0.0426829;7pkt 7fpkt"];
677--2003[label="0.00609756;1pkt 1fpkt"];
677--2004[label="0.0365854;6pkt 6fpkt"];
677--2014[label="0.00609756;1pkt 1fpkt"];
677--2015[label="0.0670732;11pkt 11fpkt"];
677--2020[label="0.0426829;7pkt 7fpkt"];
677--2023[label="0.00609756;1pkt 1fpkt"];
677--2024[label="0.0365854;6pkt 6fpkt"];
677--2031[label="0.0426829;7pkt 7fpkt"];
677--2034[label="0.00609756;1pkt 1fpkt"];
677--2035[label="0.0365854;6pkt 6fpkt"];
677--2804[label="1;164pkt 164fpkt"];
677--3376[label="1;164pkt 164fpkt"];
894--1983[label="0.0958904;7pkt 7fpkt"];
894--1989[label="0.0547945;4pkt 4fpkt"];
894--1997[label="0.0547945;4pkt 4fpkt"];
894--2004[label="0.0684932;5pkt 5fpkt"];
894--2015[label="0.0547945;4pkt 4fpkt"];
894--2020[label="0.0547945;4pkt 4fpkt"];
894--2024[label="0.0684932;5pkt 5fpkt"];
894--2031[label="0.0547945;4pkt 4fpkt"];
894--2035[label="0.0684932;5pkt 5fpkt"];
894--2804[label="1;73pkt 73fpkt"];
894--3376[label="1;73pkt 73fpkt"];
1829--1983[label="0.0625;1pkt 1fpkt"];
1829--1989[label="0.125;2pkt 2fpkt"];
1829--2015[label="0.125;2pkt 2fpkt"];
1829--2835[label="1;16pkt 16fpkt"];
1829--3392[label="1;16pkt 16fpkt"];
2804--3376[label="1;181pkt 181fpkt"];
2835--3392[label="1;24pkt 24fpkt"];
</description>
    <slice>
      <filter dst_ip="67.234.199.42" src_ip="210.53.130.210" src_port="80"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_94{
style=filled;
color=gray75;
509[label="21.20.211.12;s;101pkt 101fpkt", shape=diamond, color=yellow];
510[label="131.5.140.64;d;154pkt 154fpkt", shape=diamond, color=yellow];
stat94[shape=component, label=&lt;Rules:&lt;BR/&gt;{21.20.211.12:*, 131.5.140.64:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 60974: (0.392157%)&lt;BR/&gt; 60833: (0.392157%)&lt;BR/&gt; 60831: (0.392157%)&lt;BR/&gt; 59820: (0.392157%)&gt;];
}
509--510[label="1;101pkt 101fpkt"];
</description>
    <slice>
      <filter dst_ip="131.5.140.64" dst_port="80" src_ip="21.20.211.12"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.540993,1.70541,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_95{
style=filled;
color=gray75;
540[label="64.138.181.118;d;5pkt 5fpkt", shape=diamond, color=yellow];
542[label="131.4.104.51;s;17pkt 17fpkt", shape=diamond, color=yellow];
2237[label="131.4.104.51;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat95[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.104.51:*, 66.213.212.2:80}[29.4118%]&lt;BR/&gt;{131.4.104.51:*, 64.138.181.118:80}[29.4118%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (45.6522%)&lt;BR/&gt; 1347: (6.52174%)&lt;BR/&gt; 1346: (4.34783%)&lt;BR/&gt; 1322: (4.34783%)&lt;BR/&gt; 1312: (4.34783%)&gt;];
}
540--542[label="1;5pkt 5fpkt"];
540--2237[label="1;1pkt 1fpkt"];
542--2237[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="64.138.181.118" dst_port="80" src_ip="131.4.104.51"/>
      <filter dst_ip="66.213.212.2" dst_port="80" src_ip="131.4.104.51"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.95405,1.74342,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_97{
style=filled;
color=gray75;
559[label="149.188.218.158;d;1pkt 1fpkt", shape=diamond, color=yellow];
560[label="204.112.110.160;s;1pkt 1fpkt", shape=diamond, color=yellow];
1789[label="204.112.110.160;s;1pkt 1fpkt", shape=hexagon, color=black];
stat97[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.112.110.160:20136, 149.188.218.158:49289}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 49289: (50%)&lt;BR/&gt; 20136: (50%)&gt;];
}
559--560[label="1;1pkt 1fpkt"];
559--1789[label="1;1pkt 1fpkt"];
560--1789[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.218.158" dst_port="49289" src_ip="204.112.110.160" src_port="20136"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="131.4.108.164"/>
      <from sec="1115269200" usec="0"/>
      <to sec="1115270027" usec="0"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.827641,1.7154,503,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_99{
style=filled;
color=gray75;
20[label="131.5.129.81s;2pkt 2fpkt", shape=rectangle, color=red];
564[label="131.5.129.81;s;76pkt 76fpkt", shape=diamond, color=yellow];
1726[label="162.13.15.231;d;1pkt 1fpkt", shape=diamond, color=yellow];
1730[label="194.24.169.132;d;2pkt 2fpkt", shape=diamond, color=yellow];
stat99[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.129.81:*, *:80}[73.6842%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (35.8025%)&lt;BR/&gt; 554: (9.25926%)&lt;BR/&gt; 0: (2.46914%)&lt;BR/&gt; 110: (1.85185%)&lt;BR/&gt; 1963: (1.23457%)&gt;];
}
20--564[label="1;2pkt 2fpkt"];
564--623[label="0.0131579;1pkt 1fpkt"];
564--738[label="0.0487805;2pkt 2fpkt"];
564--1726[label="1;1pkt 1fpkt"];
564--1730[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="131.5.129.81"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.827641,1.7154,503,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_100{
style=filled;
color=gray75;
109[label="131.4.98.156s;183pkt 183fpkt", shape=rectangle, color=red];
489[label="131.4.98.156;s;422pkt 422fpkt", shape=diamond, color=yellow];
568[label="21.39.123.148;d;157pkt 157fpkt", shape=diamond, color=yellow];
stat100[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.98.156:*, 21.39.123.148:80}[36.5566%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.7375%)&lt;BR/&gt; 443: (0.262467%)&lt;BR/&gt; 62751: (0.19685%)&lt;BR/&gt; 62750: (0.19685%)&lt;BR/&gt; 62749: (0.19685%)&gt;];
}
109--489[label="1;183pkt 183fpkt"];
109--568[label="0.980892;154pkt 154fpkt"];
489--568[label="0.987261;155pkt 155fpkt"];
489--681[label="0.0963855;32pkt 32fpkt"];
489--1182[label="0.297872;28pkt 28fpkt"];
489--1662[label="0.0543478;5pkt 5fpkt"];
568--577[label="0.0127389;2pkt 2fpkt"];
568--1760[label="0.0127389;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="21.39.123.148" dst_port="80" src_ip="131.4.98.156"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270026" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.827641,1.7154,503,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_101{
style=filled;
color=gray75;
99[label="131.4.130.53s;227pkt 227fpkt", shape=rectangle, color=red];
782[label="21.39.123.229;d;219pkt 219fpkt", shape=diamond, color=yellow];
1685[label="21.39.123.226;d;94pkt 94fpkt", shape=diamond, color=yellow];
stat101[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.130.53:*, 21.39.123.229:80}[69.3291%]&lt;BR/&gt;{131.4.130.53:*, 21.39.123.226:80}[26.1981%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1990: (0.277778%)&lt;BR/&gt; 2077: (0.185185%)&lt;BR/&gt; 2076: (0.185185%)&lt;BR/&gt; 2075: (0.185185%)&gt;];
}
99--571[label="1;227pkt 227fpkt"];
99--782[label="0.949772;208pkt 208fpkt"];
99--1685[label="0.202128;19pkt 19fpkt"];
782--2802[label="0.00456621;1pkt 1fpkt"];
782--3374[label="0.00456621;1pkt 1fpkt"];
1685--2802[label="0.0851064;8pkt 8fpkt"];
1685--3374[label="0.0851064;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="21.39.123.229" dst_port="80" src_ip="131.4.130.53"/>
      <filter dst_ip="21.39.123.226" dst_port="80" src_ip="131.4.130.53"/>
    </slice>
    <from sec="1115269202" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.757479,1.76153,999,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_102{
style=filled;
color=gray75;
153[label="92.182.105.230s;1pkt 1fpkt", shape=rectangle, color=red];
stat102[shape=component, label=&lt;Rules:&lt;BR/&gt;{23.41.21.230:2571, 133.21.198.124:29483}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 29483: (50%)&lt;BR/&gt; 2571: (50%)&gt;];
}
153--361[label="1;1pkt 1fpkt"];
153--573[label="1;1pkt 1fpkt"];
153--1739[label="1;1pkt 1fpkt"];
153--1759[label="1;1pkt 1fpkt"];
153--1963[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="133.21.198.124" dst_port="29483" src_ip="23.41.21.230" src_port="2571"/>
    </slice>
    <from sec="1115269923" usec="0"/>
    <to sec="1115269937" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_103{
style=filled;
color=gray75;
579[label="203.168.48.77;d;5pkt 5fpkt", shape=diamond, color=yellow];
580[label="131.4.176.67;s;278pkt 278fpkt", shape=diamond, color=yellow];
811[label="205.108.181.194;d;99pkt 99fpkt", shape=diamond, color=yellow];
stat103[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.176.67:*, 205.108.181.194:80}[38.8489%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.644%)&lt;BR/&gt; 443: (0.91623%)&lt;BR/&gt; 0: (0.52356%)&lt;BR/&gt; 58738: (0.26178%)&lt;BR/&gt; 58674: (0.26178%)&gt;];
}
579--580[label="1;5pkt 5fpkt"];
580--811[label="1;99pkt 99fpkt"];
</description>
    <slice>
      <filter dst_ip="205.108.181.194" dst_port="80" src_ip="131.4.176.67"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115269848" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.827641,1.7154,010,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_104{
style=filled;
color=gray75;
176[label="89.222.95.102s;4538pkt 4538fpkt", shape=rectangle, color=red];
585[label="89.222.95.102;s;4707pkt 4707fpkt", shape=diamond, color=yellow];
stat104[shape=component, label=&lt;Rules:&lt;BR/&gt;{89.222.95.102:*, *:445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (50%)&lt;BR/&gt; 4059: (0.03245%)&lt;BR/&gt; 4058: (0.03245%)&lt;BR/&gt; 4056: (0.03245%)&lt;BR/&gt; 4055: (0.03245%)&gt;];
}
176--585[label="1;4538pkt 4538fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="89.222.95.102"/>
    </slice>
    <from sec="1115269202" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.06446,1.62418,503,1 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_106{
style=filled;
color=gray75;
16[label="131.5.14.74s;255pkt 255fpkt", shape=rectangle, color=red];
597[label="131.5.14.74;s;692pkt 692fpkt", shape=diamond, color=yellow];
812[label="195.22.150.34;d;300pkt 300fpkt", shape=diamond, color=yellow];
1333[label="200.172.138.36;d;94pkt 94fpkt", shape=diamond, color=yellow];
1926[label="131.5.14.74;s;692pkt 692fpkt", shape=hexagon, color=black];
2331[label="131.5.14.74;692pkt 692fpkt", shape=pentagon, color=darkviolet];
stat106[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.14.74:*, 195.22.150.34:80}[42.3851%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.844%)&lt;BR/&gt; 8080: (0.880734%)&lt;BR/&gt; 0: (0.220183%)&lt;BR/&gt; 33760: (0.0917431%)&lt;BR/&gt; 33749: (0.0917431%)&gt;];
}
16--597[label="1;255pkt 255fpkt"];
16--812[label="0.643137;164pkt 164fpkt"];
16--1333[label="0.968085;91pkt 91fpkt"];
16--1926[label="1;255pkt 255fpkt"];
16--2331[label="1;255pkt 255fpkt"];
597--812[label="1;300pkt 300fpkt"];
597--950[label="0.015873;1pkt 1fpkt"];
597--1333[label="0.968085;91pkt 91fpkt"];
597--1460[label="0.0576923;6pkt 6fpkt"];
597--1926[label="1;692pkt 692fpkt"];
597--2331[label="0.998555;691pkt 691fpkt"];
812--1926[label="1;300pkt 300fpkt"];
812--2331[label="1;300pkt 300fpkt"];
1333--1873[label="0.0319149;3pkt 3fpkt"];
1333--1926[label="0.968085;91pkt 91fpkt"];
1333--2331[label="0.968085;91pkt 91fpkt"];
1926--2331[label="0.998555;691pkt 691fpkt"];
</description>
    <slice>
      <filter dst_ip="195.22.150.34" dst_port="80" src_ip="131.5.14.74"/>
    </slice>
    <from sec="1115269203" usec="0"/>
    <to sec="1115270097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.908565,1.67978,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_107{
style=filled;
color=gray75;
541[label="64.138.181.118;s;12pkt 12fpkt", shape=diamond, color=yellow];
598[label="149.188.185.18;d;13pkt 13fpkt", shape=diamond, color=yellow];
1806[label="64.138.181.118;s;9pkt 9fpkt", shape=hexagon, color=black];
2476[label="64.138.181.118;13pkt 13fpkt", shape=pentagon, color=darkviolet];
stat107[shape=component, label=&lt;Rules:&lt;BR/&gt;{64.138.181.118:80, 149.188.185.18:*}[92.8571%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.9362%)&lt;BR/&gt; 2561: (4.25532%)&lt;BR/&gt; 2560: (4.25532%)&lt;BR/&gt; 2559: (4.25532%)&lt;BR/&gt; 2558: (4.25532%)&gt;];
}
541--598[label="1;12pkt 12fpkt"];
541--1806[label="1;9pkt 9fpkt"];
541--1983[label="0.166667;2pkt 2fpkt"];
541--1989[label="0.166667;2pkt 2fpkt"];
541--1997[label="0.0833333;1pkt 1fpkt"];
541--2004[label="0.166667;2pkt 2fpkt"];
541--2015[label="0.166667;2pkt 2fpkt"];
541--2020[label="0.0833333;1pkt 1fpkt"];
541--2024[label="0.166667;2pkt 2fpkt"];
541--2031[label="0.0833333;1pkt 1fpkt"];
541--2035[label="0.166667;2pkt 2fpkt"];
541--2476[label="1;12pkt 12fpkt"];
598--1806[label="1;9pkt 9fpkt"];
598--1983[label="0.153846;2pkt 2fpkt"];
598--1989[label="0.153846;2pkt 2fpkt"];
598--1997[label="0.0769231;1pkt 1fpkt"];
598--2004[label="0.153846;2pkt 2fpkt"];
598--2015[label="0.153846;2pkt 2fpkt"];
598--2020[label="0.0769231;1pkt 1fpkt"];
598--2024[label="0.153846;2pkt 2fpkt"];
598--2031[label="0.0769231;1pkt 1fpkt"];
598--2035[label="0.153846;2pkt 2fpkt"];
598--2476[label="0.923077;12pkt 12fpkt"];
1806--1983[label="0.222222;2pkt 2fpkt"];
1806--1989[label="0.222222;2pkt 2fpkt"];
1806--2015[label="0.222222;2pkt 2fpkt"];
1806--2476[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.185.18" src_ip="64.138.181.118" src_port="80"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.0228,1.59075,001,1 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_108{
style=filled;
color=gray75;
173[label="206.146.99.94s;245pkt 245fpkt", shape=rectangle, color=red];
619[label="206.146.99.94;s;2051pkt 2051fpkt", shape=diamond, color=yellow];
2393[label="206.146.99.94;2051pkt 2051fpkt", shape=pentagon, color=darkviolet];
3151[label="206.146.99.94;2050pkt 2050fpkt", shape=invtriangle, color=brown];
3565[label="206.146.99.94;2051pkt 2051fpkt", shape=invhouse, color=bisque];
stat108[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.146.99.94:*, *:5554}[36.7626%]&lt;BR/&gt;{206.146.99.94:*, *:1023}[35.2999%]&lt;BR/&gt;{206.146.99.94:*, *:9898}[27.9376%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (18.6375%)&lt;BR/&gt; 1023: (17.7971%)&lt;BR/&gt; 9898: (13.5653%)&lt;BR/&gt; 4524: (0.828598%)&lt;BR/&gt; 3288: (0.82268%)&gt;];
}
173--619[label="1;245pkt 245fpkt"];
173--2393[label="1;245pkt 245fpkt"];
173--3151[label="1;245pkt 245fpkt"];
173--3565[label="1;245pkt 245fpkt"];
619--2393[label="1;2051pkt 2051fpkt"];
619--3151[label="1;2050pkt 2050fpkt"];
619--3565[label="1;2051pkt 2051fpkt"];
2393--3151[label="1;2050pkt 2050fpkt"];
2393--3565[label="1;2051pkt 2051fpkt"];
3151--3565[label="1;2050pkt 2050fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="206.146.99.94"/>
      <filter dst_port="1023" src_ip="206.146.99.94"/>
      <filter dst_port="9898" src_ip="206.146.99.94"/>
    </slice>
    <from sec="1115269228" usec="0"/>
    <to sec="1115269266" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.77477,1.65068,503,1 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_112{
style=filled;
color=gray75;
204[label="131.5.178.8s;8pkt 8fpkt", shape=rectangle, color=red];
1398[label="131.5.178.8;s;93pkt 93fpkt", shape=diamond, color=yellow];
2080[label="131.5.178.8;96pkt 96fpkt", shape=pentagon, color=darkviolet];
stat112[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.178.8:*, 221.7.172.223:80}[36.4583%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (38.8325%)&lt;BR/&gt; 8000: (7.61421%)&lt;BR/&gt; 64164: (1.52284%)&lt;BR/&gt; 64160: (1.52284%)&lt;BR/&gt; 64157: (1.52284%)&gt;];
}
204--1398[label="1;8pkt 8fpkt"];
204--2080[label="1;8pkt 8fpkt"];
1398--2080[label="1;93pkt 93fpkt"];
</description>
    <slice>
      <filter dst_ip="221.7.172.223" dst_port="80" src_ip="131.5.178.8"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270079" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.967126,1.64128,999,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_113{
style=filled;
color=gray75;
409[label="206.52.93.118;s;3pkt 3fpkt", shape=diamond, color=yellow];
498[label="211.214.238.0;s;1pkt 1fpkt", shape=diamond, color=yellow];
507[label="200.0.22.130;s;1pkt 1fpkt", shape=diamond, color=yellow];
641[label="149.188.205.117;d;74pkt 74fpkt", shape=diamond, color=yellow];
891[label="16.153.37.203;s;1pkt 1fpkt", shape=diamond, color=yellow];
992[label="211.220.147.122;s;1pkt 1fpkt", shape=diamond, color=yellow];
994[label="206.42.62.200;s;1pkt 1fpkt", shape=diamond, color=yellow];
1074[label="207.134.147.5;s;1pkt 1fpkt", shape=diamond, color=yellow];
1082[label="194.127.143.216;s;1pkt 1fpkt", shape=diamond, color=yellow];
1136[label="206.70.217.150;s;2pkt 2fpkt", shape=diamond, color=yellow];
1276[label="206.76.206.191;s;1pkt 1fpkt", shape=diamond, color=yellow];
1533[label="200.130.6.162;s;3pkt 3fpkt", shape=diamond, color=yellow];
1803[label="206.52.93.118;s;3pkt 3fpkt", shape=hexagon, color=black];
2139[label="206.95.3.24;2pkt 2fpkt", shape=pentagon, color=darkviolet];
3016[label="206.95.3.24;2pkt 2fpkt", shape=invtriangle, color=brown];
stat113[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 149.188.205.117:4880}[76.3158%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4880: (40.2062%)&lt;BR/&gt; 4953: (5.15464%)&lt;BR/&gt; 4172: (3.60825%)&lt;BR/&gt; 4756: (1.54639%)&lt;BR/&gt; 1099: (1.54639%)&gt;];
}
409--641[label="1;3pkt 3fpkt"];
409--1803[label="1;3pkt 3fpkt"];
498--641[label="1;1pkt 1fpkt"];
507--641[label="1;1pkt 1fpkt"];
641--652[label="1;1pkt 1fpkt"];
641--891[label="1;1pkt 1fpkt"];
641--985[label="1;2pkt 2fpkt"];
641--992[label="1;1pkt 1fpkt"];
641--994[label="1;1pkt 1fpkt"];
641--1074[label="1;1pkt 1fpkt"];
641--1082[label="1;1pkt 1fpkt"];
641--1136[label="1;2pkt 2fpkt"];
641--1231[label="1;1pkt 1fpkt"];
641--1276[label="1;1pkt 1fpkt"];
641--1533[label="0.666667;2pkt 2fpkt"];
641--1774[label="1;5pkt 5fpkt"];
641--1787[label="1;2pkt 2fpkt"];
641--1803[label="1;3pkt 3fpkt"];
641--1882[label="1;1pkt 1fpkt"];
641--1918[label="1;1pkt 1fpkt"];
641--2116[label="1;1pkt 1fpkt"];
641--2139[label="0.5;1pkt 1fpkt"];
641--2198[label="0.666667;2pkt 2fpkt"];
641--2405[label="0.923077;12pkt 12fpkt"];
641--3016[label="0.5;1pkt 1fpkt"];
641--3048[label="0.5;1pkt 1fpkt"];
2139--3016[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.205.117" dst_port="4880"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.0228,1.59075,503,1 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_114{
style=filled;
color=gray75;
80[label="193.52.22.93d;2pkt 2fpkt", shape=rectangle, color=red];
646[label="172.195.21.114;s;129pkt 129fpkt", shape=diamond, color=yellow];
2462[label="172.195.21.114;134pkt 134fpkt", shape=pentagon, color=darkviolet];
3189[label="172.195.21.114;133pkt 133fpkt", shape=invtriangle, color=brown];
3588[label="172.195.21.114;134pkt 134fpkt", shape=invhouse, color=bisque];
stat114[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.21.114:*, 64.199.181.33:80}[35.7664%]&lt;BR/&gt;{172.195.21.114:*, 193.52.22.93:80}[31.3869%]&lt;BR/&gt;{172.195.21.114:*, 223.35.170.210:80}[21.8978%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.6241%)&lt;BR/&gt; 2864: (0.469925%)&lt;BR/&gt; 2863: (0.469925%)&lt;BR/&gt; 3140: (0.37594%)&lt;BR/&gt; 3139: (0.37594%)&gt;];
}
80--646[label="1;2pkt 2fpkt"];
80--931[label="1;2pkt 2fpkt"];
80--2462[label="1;2pkt 2fpkt"];
80--3189[label="1;2pkt 2fpkt"];
80--3588[label="1;2pkt 2fpkt"];
646--931[label="0.469697;31pkt 31fpkt"];
646--2462[label="0.976744;126pkt 126fpkt"];
646--3189[label="0.968992;125pkt 125fpkt"];
646--3588[label="0.976744;126pkt 126fpkt"];
2462--3189[label="1;133pkt 133fpkt"];
2462--3588[label="1;134pkt 134fpkt"];
3189--3588[label="1;133pkt 133fpkt"];
</description>
    <slice>
      <filter dst_ip="64.199.181.33" dst_port="80" src_ip="172.195.21.114"/>
      <filter dst_ip="193.52.22.93" dst_port="80" src_ip="172.195.21.114"/>
      <filter dst_ip="223.35.170.210" dst_port="80" src_ip="172.195.21.114"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270089" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.634441,1.66751,010,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_115{
style=filled;
color=gray75;
497[label="203.157.82.132;s;2pkt 2fpkt", shape=diamond, color=yellow];
648[label="149.188.174.227;d;127pkt 127fpkt", shape=diamond, color=yellow];
1268[label="200.2.34.152;s;1pkt 1fpkt", shape=diamond, color=yellow];
1433[label="206.34.43.158;s;1pkt 1fpkt", shape=diamond, color=yellow];
1445[label="203.134.186.131;s;8pkt 8fpkt", shape=diamond, color=yellow];
1654[label="200.93.206.142;s;1pkt 1fpkt", shape=diamond, color=yellow];
2510[label="203.134.186.131;7pkt 7fpkt", shape=pentagon, color=darkviolet];
2809[label="21.20.221.210;4pkt 4fpkt", shape=pentagon, color=darkviolet];
3211[label="203.134.186.131;8pkt 8fpkt", shape=invtriangle, color=brown];
3378[label="21.20.221.210;3pkt 3fpkt", shape=invtriangle, color=brown];
stat115[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 149.188.174.227:22162}[46.4567%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 22162: (24.6914%)&lt;BR/&gt; 80: (3.7037%)&lt;BR/&gt; 59571: (3.39506%)&lt;BR/&gt; 11700: (3.39506%)&lt;BR/&gt; 11242: (2.77778%)&gt;];
}
497--648[label="1;2pkt 2fpkt"];
648--1268[label="1;1pkt 1fpkt"];
648--1433[label="1;1pkt 1fpkt"];
648--1445[label="1;8pkt 8fpkt"];
648--1654[label="1;1pkt 1fpkt"];
648--1997[label="0.015748;2pkt 2fpkt"];
648--2020[label="0.015748;2pkt 2fpkt"];
648--2031[label="0.015748;2pkt 2fpkt"];
648--2510[label="1;7pkt 7fpkt"];
648--2809[label="1;4pkt 4fpkt"];
648--3211[label="1;8pkt 8fpkt"];
648--3378[label="1;3pkt 3fpkt"];
1445--2510[label="1;7pkt 7fpkt"];
1445--3211[label="1;8pkt 8fpkt"];
2510--3211[label="1;7pkt 7fpkt"];
2809--3378[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.174.227" dst_port="22162"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_116{
style=filled;
color=gray75;
387[label="131.5.11.119;s;3pkt 3fpkt", shape=diamond, color=yellow];
649[label="206.149.71.136;d;1pkt 1fpkt", shape=diamond, color=yellow];
1095[label="202.146.238.15;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat116[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.11.119:1297, 202.146.238.15:15048}[33.3333%]&lt;BR/&gt;{131.5.11.119:1300, 206.149.71.136:15005}[33.3333%]&lt;BR/&gt;{131.5.11.119:0, 69.139.246.145:0}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 15048: (20%)&lt;BR/&gt; 15005: (20%)&lt;BR/&gt; 1300: (20%)&lt;BR/&gt; 1297: (20%)&lt;BR/&gt; 0: (20%)&gt;];
}
387--649[label="1;1pkt 1fpkt"];
387--1095[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="69.139.246.145" src_ip="131.5.11.119"/>
      <filter dst_ip="206.149.71.136" dst_port="15005" src_ip="131.5.11.119" src_port="1300"/>
      <filter dst_ip="202.146.238.15" dst_port="15048" src_ip="131.5.11.119" src_port="1297"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.10354,1.68992,503,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_120{
style=filled;
color=gray75;
40[label="131.4.35.155s;1pkt 1fpkt", shape=rectangle, color=red];
700[label="131.4.35.155;s;237pkt 237fpkt", shape=diamond, color=yellow];
1076[label="154.24.157.49;d;28pkt 28fpkt", shape=diamond, color=yellow];
1813[label="131.4.35.155;s;183pkt 183fpkt", shape=hexagon, color=black];
stat120[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.35.155:*, *:80}[30.2682%]&lt;BR/&gt;{131.4.35.155:*, 59.44.208.41:443}[25.6705%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (19.4878%)&lt;BR/&gt; 80: (16.147%)&lt;BR/&gt; 7341: (1.78174%)&lt;BR/&gt; 3125: (1.11359%)&lt;BR/&gt; 12160: (0.890869%)&gt;];
}
40--700[label="1;1pkt 1fpkt"];
40--1076[label="1;1pkt 1fpkt"];
40--1813[label="1;1pkt 1fpkt"];
700--1076[label="0.142857;4pkt 4fpkt"];
700--1662[label="0.0108696;1pkt 1fpkt"];
700--1813[label="1;183pkt 183fpkt"];
1076--1813[label="0.142857;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="131.4.35.155"/>
      <filter dst_ip="59.44.208.41" dst_port="443" src_ip="131.4.35.155"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270020" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.634441,1.66751,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_121{
style=filled;
color=gray75;
455[label="66.8.76.198;d;1pkt 1fpkt", shape=diamond, color=yellow];
457[label="131.5.8.243;s;253pkt 253fpkt", shape=diamond, color=yellow];
712[label="207.148.149.226;d;1pkt 1fpkt", shape=diamond, color=yellow];
749[label="92.235.139.28;d;1pkt 1fpkt", shape=diamond, color=yellow];
892[label="209.72.31.94;d;1pkt 1fpkt", shape=diamond, color=yellow];
1489[label="92.52.96.227;d;1pkt 1fpkt", shape=diamond, color=yellow];
2915[label="131.5.8.243;257pkt 257fpkt", shape=pentagon, color=darkviolet];
3433[label="131.5.8.243;258pkt 258fpkt", shape=invtriangle, color=brown];
stat121[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.8.243:4672, *:4672}[50.7752%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4672: (58.8616%)&lt;BR/&gt; 4662: (7.43855%)&lt;BR/&gt; 80: (2.91074%)&lt;BR/&gt; 6672: (1.55239%)&lt;BR/&gt; 0: (1.55239%)&gt;];
}
455--457[label="1;1pkt 1fpkt"];
455--2915[label="1;1pkt 1fpkt"];
455--3433[label="1;1pkt 1fpkt"];
457--517[label="0.00395257;1pkt 1fpkt"];
457--581[label="0.00790514;2pkt 2fpkt"];
457--712[label="1;1pkt 1fpkt"];
457--749[label="1;1pkt 1fpkt"];
457--892[label="1;1pkt 1fpkt"];
457--1489[label="1;1pkt 1fpkt"];
457--1989[label="0.00395257;1pkt 1fpkt"];
457--2015[label="0.00395257;1pkt 1fpkt"];
457--2915[label="0.996047;252pkt 252fpkt"];
457--3433[label="1;253pkt 253fpkt"];
712--2915[label="1;1pkt 1fpkt"];
712--3433[label="1;1pkt 1fpkt"];
749--2915[label="1;1pkt 1fpkt"];
749--3433[label="1;1pkt 1fpkt"];
892--2915[label="1;1pkt 1fpkt"];
892--3433[label="1;1pkt 1fpkt"];
1489--2915[label="1;1pkt 1fpkt"];
1489--3433[label="1;1pkt 1fpkt"];
2915--3433[label="1;257pkt 257fpkt"];
</description>
    <slice>
      <filter dst_port="4672" src_ip="131.5.8.243" src_port="4672"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.908565,1.67978,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_122{
style=filled;
color=gray75;
484[label="131.5.50.90;d;24pkt 24fpkt", shape=diamond, color=yellow];
715[label="194.108.122.72;s;1pkt 1fpkt", shape=diamond, color=yellow];
1559[label="200.172.134.197;s;30pkt 30fpkt", shape=diamond, color=yellow];
1804[label="194.108.122.72;s;1pkt 1fpkt", shape=hexagon, color=black];
1931[label="200.172.134.197;s;30pkt 30fpkt", shape=hexagon, color=black];
2750[label="200.172.134.197;39pkt 39fpkt", shape=pentagon, color=darkviolet];
stat122[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.172.134.197:80, 172.195.115.93:*}[35.5932%]&lt;BR/&gt;{200.172.134.197:80, 131.5.14.74:*}[22.0339%]&lt;BR/&gt;{*:80, 131.5.50.90:*}[22.0339%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (44.8%)&lt;BR/&gt; 1494: (1.6%)&lt;BR/&gt; 33597: (1.2%)&lt;BR/&gt; 33459: (1.2%)&lt;BR/&gt; 33435: (1.2%)&gt;];
}
484--616[label="0.125;3pkt 3fpkt"];
484--686[label="1;1pkt 1fpkt"];
484--715[label="1;1pkt 1fpkt"];
484--1559[label="0.0416667;1pkt 1fpkt"];
484--1764[label="0.125;3pkt 3fpkt"];
484--1781[label="1;1pkt 1fpkt"];
484--1804[label="1;1pkt 1fpkt"];
484--1931[label="0.0416667;1pkt 1fpkt"];
484--1980[label="0.125;3pkt 3fpkt"];
484--1983[label="0.0416667;1pkt 1fpkt"];
484--1989[label="0.0416667;1pkt 1fpkt"];
484--1997[label="0.0416667;1pkt 1fpkt"];
484--2004[label="0.0416667;1pkt 1fpkt"];
484--2011[label="0.125;3pkt 3fpkt"];
484--2015[label="0.0416667;1pkt 1fpkt"];
484--2020[label="0.0416667;1pkt 1fpkt"];
484--2024[label="0.0416667;1pkt 1fpkt"];
484--2027[label="0.125;3pkt 3fpkt"];
484--2031[label="0.0416667;1pkt 1fpkt"];
484--2035[label="0.0416667;1pkt 1fpkt"];
484--2578[label="0.125;3pkt 3fpkt"];
484--2750[label="0.166667;4pkt 4fpkt"];
484--3253[label="0.125;3pkt 3fpkt"];
484--3619[label="0.125;3pkt 3fpkt"];
715--1804[label="1;1pkt 1fpkt"];
1559--1931[label="1;30pkt 30fpkt"];
1559--1997[label="0.1;3pkt 3fpkt"];
1559--2020[label="0.1;3pkt 3fpkt"];
1559--2031[label="0.1;3pkt 3fpkt"];
1559--2750[label="1;30pkt 30fpkt"];
1931--1997[label="0.1;3pkt 3fpkt"];
1931--2020[label="0.1;3pkt 3fpkt"];
1931--2031[label="0.1;3pkt 3fpkt"];
1931--2750[label="1;30pkt 30fpkt"];
</description>
    <slice>
      <filter dst_ip="131.5.50.90" src_port="80"/>
      <filter dst_ip="172.195.115.93" src_ip="200.172.134.197" src_port="80"/>
      <filter dst_ip="131.5.14.74" src_ip="200.172.134.197" src_port="80"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115269938" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_123{
style=filled;
color=gray75;
721[label="210.56.91.220;d;1pkt 1fpkt", shape=diamond, color=yellow];
722[label="131.4.104.38;s;23pkt 23fpkt", shape=diamond, color=yellow];
stat123[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.104.38:*, 21.20.208.201:80}[39.1304%]&lt;BR/&gt;{131.4.104.38:*, 67.229.226.178:*}[26.087%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (35.4167%)&lt;BR/&gt; 8081: (6.25%)&lt;BR/&gt; 888: (6.25%)&lt;BR/&gt; 4995: (4.16667%)&lt;BR/&gt; 53585: (2.08333%)&gt;];
}
721--722[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="67.229.226.178" src_ip="131.4.104.38"/>
      <filter dst_ip="21.20.208.201" dst_port="80" src_ip="131.4.104.38"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_126{
style=filled;
color=gray75;
764[label="70.150.98.162;s;1pkt 1fpkt", shape=diamond, color=yellow];
765[label="133.21.198.191;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat126[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.150.98.162:55888, 133.21.198.191:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 55888: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
764--765[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="133.21.198.191" dst_port="80" src_ip="70.150.98.162" src_port="55888"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.908565,1.67978,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_127{
style=filled;
color=gray75;
777[label="149.188.205.67;d;3pkt 3fpkt", shape=diamond, color=yellow];
778[label="210.74.15.34;s;2pkt 2fpkt", shape=diamond, color=yellow];
1816[label="210.74.15.34;s;2pkt 2fpkt", shape=hexagon, color=black];
2173[label="210.74.15.34;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat127[shape=component, label=&lt;Rules:&lt;BR/&gt;{64.162.87.202:48873, 149.188.205.67:80}[33.3333%]&lt;BR/&gt;{210.74.15.34:2468, 149.188.205.67:80}[33.3333%]&lt;BR/&gt;{210.74.15.34:2471, 149.188.205.67:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2471: (25%)&lt;BR/&gt; 2468: (18.75%)&lt;BR/&gt; 48873: (6.25%)&gt;];
}
777--778[label="1;2pkt 2fpkt"];
777--1816[label="1;2pkt 2fpkt"];
777--2173[label="1;1pkt 1fpkt"];
778--1816[label="1;2pkt 2fpkt"];
778--2173[label="1;1pkt 1fpkt"];
1816--2173[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.205.67" dst_port="80" src_ip="210.74.15.34" src_port="2471"/>
      <filter dst_ip="149.188.205.67" dst_port="80" src_ip="210.74.15.34" src_port="2468"/>
      <filter dst_ip="149.188.205.67" dst_port="80" src_ip="64.162.87.202" src_port="48873"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115269609" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.827641,1.7154,503,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_128{
style=filled;
color=gray75;
60[label="195.34.199.213s;3pkt 3fpkt", shape=rectangle, color=red];
780[label="195.34.199.213;s;64pkt 64fpkt", shape=diamond, color=yellow];
stat128[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.34.199.213:*, 133.190.149.216:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 11254: (1.49254%)&lt;BR/&gt; 10343: (1.49254%)&lt;BR/&gt; 6046: (1.49254%)&lt;BR/&gt; 15361: (0.746269%)&gt;];
}
60--780[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="133.190.149.216" dst_port="80" src_ip="195.34.199.213"/>
    </slice>
    <from sec="1115269202" usec="0"/>
    <to sec="1115270016" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_129{
style=filled;
color=gray75;
571[label="131.4.130.53;s;325pkt 325fpkt", shape=diamond, color=yellow];
stat129[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.130.53:*, 21.39.123.229:80}[66.7692%]&lt;BR/&gt;{131.4.130.53:*, 21.39.123.226:80}[25.2308%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2144: (0.153846%)&lt;BR/&gt; 2143: (0.153846%)&lt;BR/&gt; 2142: (0.153846%)&lt;BR/&gt; 2141: (0.153846%)&gt;];
}
571--782[label="0.990868;217pkt 217fpkt"];
571--1685[label="0.87234;82pkt 82fpkt"];
</description>
    <slice>
      <filter dst_ip="21.39.123.229" dst_port="80" src_ip="131.4.130.53"/>
      <filter dst_ip="21.39.123.226" dst_port="80" src_ip="131.4.130.53"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="131.4.46.157"/>
      <from sec="1115269255" usec="0"/>
      <to sec="1115269359" usec="0"/>
    </slice>
    <from sec="1115269255" usec="0"/>
    <to sec="1115269359" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.77477,1.65068,999,1 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_133{
style=filled;
color=gray75;
74[label="149.188.129.47d;1pkt 1fpkt", shape=rectangle, color=red];
545[label="149.188.129.47;d;148pkt 148fpkt", shape=diamond, color=yellow];
725[label="204.62.15.184;s;47pkt 47fpkt", shape=diamond, color=yellow];
814[label="207.90.108.197;s;2pkt 2fpkt", shape=diamond, color=yellow];
2126[label="66.3.181.21;9pkt 9fpkt", shape=pentagon, color=darkviolet];
2440[label="211.222.176.106;22pkt 22fpkt", shape=pentagon, color=darkviolet];
2704[label="204.62.15.184;48pkt 48fpkt", shape=pentagon, color=darkviolet];
2730[label="69.182.140.193;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2749[label="207.90.108.197;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat133[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 149.188.129.47:25}[22.8723%]&lt;BR/&gt;{204.62.15.184:25, 149.188.129.47:*}[21.2766%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (49.4624%)&lt;BR/&gt; 48516: (0.537634%)&lt;BR/&gt; 48239: (0.537634%)&lt;BR/&gt; 46769: (0.537634%)&lt;BR/&gt; 46735: (0.537634%)&gt;];
}
74--545[label="1;1pkt 1fpkt"];
74--814[label="1;1pkt 1fpkt"];
545--725[label="0.659574;31pkt 31fpkt"];
545--814[label="0.5;1pkt 1fpkt"];
545--2126[label="0.444444;4pkt 4fpkt"];
545--2440[label="0.227273;5pkt 5fpkt"];
545--2704[label="0.645833;31pkt 31fpkt"];
545--2730[label="1;1pkt 1fpkt"];
725--2704[label="1;47pkt 47fpkt"];
814--2749[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.129.47" dst_port="25"/>
      <filter dst_ip="149.188.129.47" src_ip="204.62.15.184" src_port="25"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="133.190.100.30"/>
      <from sec="1115269200" usec="0"/>
      <to sec="1115269936" usec="0"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115269936" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.540993,1.70541,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_135{
style=filled;
color=gray75;
650[label="220.30.88.31;d;342pkt 342fpkt", shape=diamond, color=yellow];
834[label="171.76.90.104;s;286pkt 286fpkt", shape=diamond, color=yellow];
2309[label="171.76.48.69;7pkt 7fpkt", shape=pentagon, color=darkviolet];
2436[label="171.76.90.104;396pkt 396fpkt", shape=pentagon, color=darkviolet];
2625[label="171.76.39.162;10pkt 10fpkt", shape=pentagon, color=darkviolet];
stat135[shape=component, label=&lt;Rules:&lt;BR/&gt;{171.76.90.104:*, 220.30.88.31:6667}[92.9245%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (47.9827%)&lt;BR/&gt; 113: (1.15274%)&lt;BR/&gt; 6661: (0.240154%)&lt;BR/&gt; 6666: (0.192123%)&lt;BR/&gt; 4107: (0.192123%)&gt;];
}
650--834[label="1;286pkt 286fpkt"];
650--2309[label="0.714286;5pkt 5fpkt"];
650--2436[label="0.932749;319pkt 319fpkt"];
650--2625[label="0.7;7pkt 7fpkt"];
834--2436[label="1;286pkt 286fpkt"];
</description>
    <slice>
      <filter dst_ip="220.30.88.31" dst_port="6667" src_ip="171.76.90.104"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.06446,1.62418,010,1 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_138{
style=filled;
color=gray75;
13[label="133.190.77.66s;1pkt 1fpkt", shape=rectangle, color=red];
438[label="133.190.77.66;s;408pkt 408fpkt", shape=diamond, color=yellow];
569[label="133.190.77.181;s;293pkt 293fpkt", shape=diamond, color=yellow];
679[label="131.5.162.169;s;277pkt 277fpkt", shape=diamond, color=yellow];
719[label="172.195.175.131;s;111pkt 111fpkt", shape=diamond, color=yellow];
736[label="171.76.43.84;s;185pkt 185fpkt", shape=diamond, color=yellow];
852[label="66.52.33.232;d;362pkt 362fpkt", shape=diamond, color=yellow];
866[label="131.5.186.247;s;267pkt 267fpkt", shape=diamond, color=yellow];
923[label="131.5.210.171;s;96pkt 96fpkt", shape=diamond, color=yellow];
1105[label="211.25.131.122;s;205pkt 205fpkt", shape=diamond, color=yellow];
1217[label="131.5.137.114;s;266pkt 266fpkt", shape=diamond, color=yellow];
1236[label="204.62.15.184;d;82pkt 82fpkt", shape=diamond, color=yellow];
1357[label="131.5.109.69;s;112pkt 112fpkt", shape=diamond, color=yellow];
1419[label="133.190.65.40;s;126pkt 126fpkt", shape=diamond, color=yellow];
1677[label="66.73.106.40;d;15pkt 15fpkt", shape=diamond, color=yellow];
1805[label="171.76.43.84;s;108pkt 108fpkt", shape=hexagon, color=black];
1837[label="131.5.186.247;s;238pkt 238fpkt", shape=hexagon, color=black];
1883[label="131.5.137.114;s;244pkt 244fpkt", shape=hexagon, color=black];
1922[label="133.190.77.181;s;276pkt 276fpkt", shape=hexagon, color=black];
1937[label="131.5.109.69;s;112pkt 112fpkt", shape=hexagon, color=black];
2294[label="133.190.77.66;499pkt 499fpkt", shape=pentagon, color=darkviolet];
2310[label="131.5.109.69;115pkt 115fpkt", shape=pentagon, color=darkviolet];
2466[label="131.5.137.114;296pkt 296fpkt", shape=pentagon, color=darkviolet];
2629[label="131.5.1.163;79pkt 79fpkt", shape=pentagon, color=darkviolet];
2935[label="131.5.186.247;310pkt 310fpkt", shape=pentagon, color=darkviolet];
stat138[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, *:25}[69.3051%]&lt;BR/&gt;{*:25, *:*}[24.3404%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (47.7277%)&lt;BR/&gt; 53: (0.796774%)&lt;BR/&gt; 113: (0.580366%)&lt;BR/&gt; 80: (0.403305%)&lt;BR/&gt; 443: (0.216408%)&gt;];
}
13--438[label="1;1pkt 1fpkt"];
13--2294[label="1;1pkt 1fpkt"];
438--852[label="0.154696;56pkt 56fpkt"];
438--1236[label="0.0365854;3pkt 3fpkt"];
438--1586[label="0.00735294;3pkt 3fpkt"];
438--1677[label="0.2;3pkt 3fpkt"];
438--1697[label="0.0384615;1pkt 1fpkt"];
438--1708[label="0.0049505;2pkt 2fpkt"];
438--2294[label="1;408pkt 408fpkt"];
569--852[label="0.334471;98pkt 98fpkt"];
569--1236[label="0.121951;10pkt 10fpkt"];
569--1586[label="0.0102389;3pkt 3fpkt"];
569--1677[label="0.0666667;1pkt 1fpkt"];
569--1708[label="0.0102389;3pkt 3fpkt"];
569--1922[label="1;276pkt 276fpkt"];
679--852[label="0.0577617;16pkt 16fpkt"];
679--1982[label="0.00361011;1pkt 1fpkt"];
679--1988[label="0.00361011;1pkt 1fpkt"];
679--2014[label="0.00361011;1pkt 1fpkt"];
719--852[label="0.108108;12pkt 12fpkt"];
736--852[label="0.0540541;10pkt 10fpkt"];
736--1676[label="0.111111;2pkt 2fpkt"];
736--1677[label="0.0666667;1pkt 1fpkt"];
736--1805[label="1;108pkt 108fpkt"];
736--2004[label="0.0108108;2pkt 2fpkt"];
736--2024[label="0.0108108;2pkt 2fpkt"];
736--2035[label="0.0108108;2pkt 2fpkt"];
852--868[label="0.0075188;1pkt 1fpkt"];
852--923[label="0.145833;14pkt 14fpkt"];
852--974[label="0.15;6pkt 6fpkt"];
852--1105[label="0.0341463;7pkt 7fpkt"];
852--1185[label="0.173333;26pkt 26fpkt"];
852--1217[label="0.112782;30pkt 30fpkt"];
852--1357[label="0.0535714;6pkt 6fpkt"];
852--1419[label="0.142857;18pkt 18fpkt"];
852--1805[label="0.0925926;10pkt 10fpkt"];
852--1883[label="0.122951;30pkt 30fpkt"];
852--1922[label="0.336957;93pkt 93fpkt"];
852--1937[label="0.0535714;6pkt 6fpkt"];
852--2294[label="0.18232;66pkt 66fpkt"];
852--2310[label="0.0521739;6pkt 6fpkt"];
852--2466[label="0.101351;30pkt 30fpkt"];
852--2494[label="0.466667;28pkt 28fpkt"];
852--2514[label="0.00704225;1pkt 1fpkt"];
866--1236[label="0.0365854;3pkt 3fpkt"];
866--1677[label="0.0666667;1pkt 1fpkt"];
866--1837[label="1;238pkt 238fpkt"];
866--2935[label="0.996255;266pkt 266fpkt"];
923--1236[label="0.353659;29pkt 29fpkt"];
1217--1236[label="0.109756;9pkt 9fpkt"];
1217--1883[label="1;244pkt 244fpkt"];
1217--2466[label="0.996241;265pkt 265fpkt"];
1236--1357[label="0.0243902;2pkt 2fpkt"];
1236--1419[label="0.256098;21pkt 21fpkt"];
1236--1837[label="0.0365854;3pkt 3fpkt"];
1236--1883[label="0.109756;9pkt 9fpkt"];
1236--1922[label="0.121951;10pkt 10fpkt"];
1236--1937[label="0.0243902;2pkt 2fpkt"];
1236--2289[label="0.0454545;2pkt 2fpkt"];
1236--2294[label="0.0365854;3pkt 3fpkt"];
1236--2310[label="0.0243902;2pkt 2fpkt"];
1236--2466[label="0.109756;9pkt 9fpkt"];
1236--2629[label="0.0253165;2pkt 2fpkt"];
1236--2935[label="0.0365854;3pkt 3fpkt"];
1236--3101[label="0.0454545;2pkt 2fpkt"];
1357--1937[label="1;112pkt 112fpkt"];
1357--1988[label="0.00892857;1pkt 1fpkt"];
1357--2014[label="0.00892857;1pkt 1fpkt"];
1357--2310[label="0.991071;111pkt 111fpkt"];
1677--1837[label="0.0666667;1pkt 1fpkt"];
1677--2294[label="0.266667;4pkt 4fpkt"];
1677--2737[label="0.0666667;1pkt 1fpkt"];
1677--2935[label="0.0666667;1pkt 1fpkt"];
1837--2935[label="0.995798;237pkt 237fpkt"];
1883--2466[label="0.995902;243pkt 243fpkt"];
1937--1988[label="0.00892857;1pkt 1fpkt"];
1937--2014[label="0.00892857;1pkt 1fpkt"];
1937--2310[label="0.991071;111pkt 111fpkt"];
</description>
    <slice>
      <filter src_port="25"/>
      <filter dst_port="25"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842681,1.61149,503,1 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_139{
style=filled;
color=gray75;
114[label="131.4.65.244s;36pkt 36fpkt", shape=rectangle, color=red];
854[label="131.4.65.244;s;185pkt 185fpkt", shape=diamond, color=yellow];
2920[label="131.4.65.244;184pkt 184fpkt", shape=pentagon, color=darkviolet];
3437[label="131.4.65.244;184pkt 184fpkt", shape=invtriangle, color=brown];
stat139[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.65.244:*, 21.39.123.134:80}[30.2703%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.236%)&lt;BR/&gt; 119: (0.509338%)&lt;BR/&gt; 63861: (0.339559%)&lt;BR/&gt; 63748: (0.339559%)&lt;BR/&gt; 63707: (0.339559%)&gt;];
}
114--854[label="1;36pkt 36fpkt"];
114--2920[label="1;36pkt 36fpkt"];
114--3437[label="1;36pkt 36fpkt"];
854--2920[label="1;184pkt 184fpkt"];
854--3437[label="1;184pkt 184fpkt"];
2920--3437[label="1;184pkt 184fpkt"];
</description>
    <slice>
      <filter dst_ip="21.39.123.134" dst_port="80" src_ip="131.4.65.244"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270092" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.10354,1.68992,999,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_140{
style=filled;
color=gray75;
159[label="95.24.54.248s;1pkt 1fpkt", shape=rectangle, color=red];
494[label="149.188.233.235;d;90pkt 90fpkt", shape=diamond, color=yellow];
695[label="195.142.228.48;s;1pkt 1fpkt", shape=diamond, color=yellow];
856[label="195.148.158.249;s;1pkt 1fpkt", shape=diamond, color=yellow];
859[label="207.74.1.162;s;1pkt 1fpkt", shape=diamond, color=yellow];
877[label="206.177.242.88;s;1pkt 1fpkt", shape=diamond, color=yellow];
1121[label="52.192.201.46;s;1pkt 1fpkt", shape=diamond, color=yellow];
1132[label="66.9.20.191;s;1pkt 1fpkt", shape=diamond, color=yellow];
1235[label="195.110.173.76;s;1pkt 1fpkt", shape=diamond, color=yellow];
1365[label="21.38.44.204;s;1pkt 1fpkt", shape=diamond, color=yellow];
1394[label="194.33.174.105;s;1pkt 1fpkt", shape=diamond, color=yellow];
1887[label="21.38.44.204;s;1pkt 1fpkt", shape=hexagon, color=black];
stat140[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 149.188.233.235:1777}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1777: (50%)&lt;BR/&gt; 4231: (1.48515%)&lt;BR/&gt; 1381: (1.48515%)&lt;BR/&gt; 3434: (0.990099%)&lt;BR/&gt; 2866: (0.990099%)&gt;];
}
159--494[label="1;1pkt 1fpkt"];
159--856[label="1;1pkt 1fpkt"];
494--695[label="1;1pkt 1fpkt"];
494--743[label="1;1pkt 1fpkt"];
494--856[label="1;1pkt 1fpkt"];
494--859[label="1;1pkt 1fpkt"];
494--877[label="1;1pkt 1fpkt"];
494--1121[label="1;1pkt 1fpkt"];
494--1123[label="1;1pkt 1fpkt"];
494--1132[label="1;1pkt 1fpkt"];
494--1235[label="1;1pkt 1fpkt"];
494--1365[label="1;1pkt 1fpkt"];
494--1394[label="1;1pkt 1fpkt"];
494--1887[label="1;1pkt 1fpkt"];
494--1889[label="1;1pkt 1fpkt"];
494--3066[label="1;1pkt 1fpkt"];
1365--1887[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.233.235" dst_port="1777"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_141{
style=filled;
color=gray75;
501[label="131.4.101.112;s;8pkt 8fpkt", shape=diamond, color=yellow];
857[label="213.133.31.161;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat141[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.101.112:*, 196.94.22.70:80}[75%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (44.4444%)&lt;BR/&gt; 1223: (11.1111%)&lt;BR/&gt; 4341: (5.55556%)&lt;BR/&gt; 4033: (5.55556%)&lt;BR/&gt; 3286: (5.55556%)&gt;];
}
501--857[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="196.94.22.70" dst_port="80" src_ip="131.4.101.112"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270019" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.95405,1.74342,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_142{
style=filled;
color=gray75;
750[label="206.69.65.207;s;1pkt 1fpkt", shape=diamond, color=yellow];
875[label="149.188.86.3;d;2pkt 2fpkt", shape=diamond, color=yellow];
1865[label="206.69.65.207;s;1pkt 1fpkt", shape=hexagon, color=black];
stat142[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.7.0.113:5050, 149.188.86.3:1078}[50%]&lt;BR/&gt;{206.69.65.207:9906, 149.188.86.3:1102}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9906: (37.5%)&lt;BR/&gt; 1102: (37.5%)&lt;BR/&gt; 5050: (12.5%)&lt;BR/&gt; 1078: (12.5%)&gt;];
}
750--875[label="1;1pkt 1fpkt"];
750--1865[label="1;1pkt 1fpkt"];
875--1865[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.86.3" dst_port="1102" src_ip="206.69.65.207" src_port="9906"/>
      <filter dst_ip="149.188.86.3" dst_port="1078" src_ip="204.7.0.113" src_port="5050"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.634441,1.66751,010,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_143{
style=filled;
color=gray75;
840[label="133.74.159.35;d;477pkt 477fpkt", shape=diamond, color=yellow];
841[label="203.106.27.255;s;1124pkt 1124fpkt", shape=diamond, color=yellow];
847[label="133.21.49.121;d;1083pkt 1083fpkt", shape=diamond, color=yellow];
885[label="203.101.46.188;s;1968pkt 1968fpkt", shape=diamond, color=yellow];
887[label="172.185.19.13;d;1186pkt 1186fpkt", shape=diamond, color=yellow];
889[label="207.153.103.114;s;684pkt 684fpkt", shape=diamond, color=yellow];
935[label="194.108.168.155;s;265pkt 265fpkt", shape=diamond, color=yellow];
991[label="133.74.210.26;d;1137pkt 1137fpkt", shape=diamond, color=yellow];
2463[label="207.153.103.114;697pkt 697fpkt", shape=pentagon, color=darkviolet];
2503[label="207.147.67.130;342pkt 342fpkt", shape=pentagon, color=darkviolet];
2604[label="194.108.168.155;578pkt 578fpkt", shape=pentagon, color=darkviolet];
2958[label="203.106.27.255;1226pkt 1226fpkt", shape=pentagon, color=darkviolet];
3190[label="207.153.103.114;697pkt 697fpkt", shape=invtriangle, color=brown];
stat143[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.101.46.188:*, *:*}[40.6192%]&lt;BR/&gt;{*:7200, *:*}[27.451%]&lt;BR/&gt;{*:7000, *:*}[27.162%]&lt;BR/&gt;{*:*, 133.74.159.35:*}[26.5635%]&lt;BR/&gt;{*:*, 172.185.19.13:*}[25.5315%]&lt;BR/&gt;{203.106.27.255:*, *:*}[25.3251%]&lt;BR/&gt;{*:*, 133.74.210.26:*}[24.644%]&lt;BR/&gt;{*:7100, *:*}[23.8184%]&lt;BR/&gt;{*:*, 133.21.49.121:*}[23.2611%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7000: (13.8172%)&lt;BR/&gt; 7100: (13.4944%)&lt;BR/&gt; 7200: (11.9025%)&lt;BR/&gt; 9096: (5.50419%)&lt;BR/&gt; 6999: (5.2425%)&gt;];
}
840--841[label="0.255765;122pkt 122fpkt"];
840--885[label="0.360587;172pkt 172fpkt"];
840--889[label="0.167715;80pkt 80fpkt"];
840--935[label="0.0301887;8pkt 8fpkt"];
840--2463[label="0.165618;79pkt 79fpkt"];
840--2503[label="0.0730994;25pkt 25fpkt"];
840--2604[label="0.157233;75pkt 75fpkt"];
840--2857[label="0.00900901;1pkt 1fpkt"];
840--2958[label="0.253669;121pkt 121fpkt"];
840--3190[label="0.165618;79pkt 79fpkt"];
841--847[label="0.267775;290pkt 290fpkt"];
841--887[label="0.241103;271pkt 271fpkt"];
841--991[label="0.226868;255pkt 255fpkt"];
841--2958[label="0.99911;1123pkt 1123fpkt"];
847--885[label="0.406279;440pkt 440fpkt"];
847--889[label="0.223684;153pkt 153fpkt"];
847--935[label="0.245283;65pkt 65fpkt"];
847--1997[label="0.000923361;1pkt 1fpkt"];
847--2004[label="0.000923361;1pkt 1fpkt"];
847--2020[label="0.000923361;1pkt 1fpkt"];
847--2024[label="0.000923361;1pkt 1fpkt"];
847--2031[label="0.000923361;1pkt 1fpkt"];
847--2035[label="0.000923361;1pkt 1fpkt"];
847--2463[label="0.219512;153pkt 153fpkt"];
847--2503[label="0.192982;66pkt 66fpkt"];
847--2604[label="0.212803;123pkt 123fpkt"];
847--2958[label="0.267775;290pkt 290fpkt"];
847--3190[label="0.219512;153pkt 153fpkt"];
885--887[label="0.438449;520pkt 520fpkt"];
885--991[label="0.430959;490pkt 490fpkt"];
887--889[label="0.270468;185pkt 185fpkt"];
887--935[label="0.226415;60pkt 60fpkt"];
887--2463[label="0.265423;185pkt 185fpkt"];
887--2503[label="0.292398;100pkt 100fpkt"];
887--2604[label="0.179931;104pkt 104fpkt"];
887--2958[label="0.228499;271pkt 271fpkt"];
887--3190[label="0.265423;185pkt 185fpkt"];
889--991[label="0.25;171pkt 171fpkt"];
889--2463[label="0.998538;683pkt 683fpkt"];
889--3190[label="0.998538;683pkt 683fpkt"];
935--991[label="0.241509;64pkt 64fpkt"];
935--2604[label="1;265pkt 265fpkt"];
991--2463[label="0.245337;171pkt 171fpkt"];
991--2503[label="0.269006;92pkt 92fpkt"];
991--2604[label="0.202422;117pkt 117fpkt"];
991--2958[label="0.224274;255pkt 255fpkt"];
991--3190[label="0.245337;171pkt 171fpkt"];
2463--3190[label="1;697pkt 697fpkt"];
</description>
    <slice>
      <filter src_ip="203.101.46.188"/>
      <filter src_ip="203.106.27.255"/>
      <filter dst_ip="133.74.159.35"/>
      <filter dst_ip="172.185.19.13"/>
      <filter dst_ip="133.74.210.26"/>
      <filter dst_ip="133.21.49.121"/>
      <filter src_port="7200"/>
      <filter src_port="7000"/>
      <filter src_port="7100"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.06446,1.62418,502,1 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_144{
style=filled;
color=gray75;
61[label="171.76.1.214s;1pkt 1fpkt", shape=rectangle, color=red];
910[label="205.43.92.85;d;1pkt 1fpkt", shape=diamond, color=yellow];
911[label="171.76.1.214;s;2pkt 2fpkt", shape=diamond, color=yellow];
1845[label="171.76.1.214;s;2pkt 2fpkt", shape=hexagon, color=black];
2820[label="171.76.1.214;2pkt 2fpkt", shape=pentagon, color=darkviolet];
stat144[shape=component, label=&lt;Rules:&lt;BR/&gt;{171.76.1.214:1052, 204.7.0.86:5050}[33.3333%]&lt;BR/&gt;{171.76.1.214:1213, 205.43.92.85:22}[33.3333%]&lt;BR/&gt;{171.76.1.214:1883, 205.43.92.85:22}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 22: (37.5%)&lt;BR/&gt; 1213: (31.25%)&lt;BR/&gt; 5050: (12.5%)&lt;BR/&gt; 1052: (12.5%)&lt;BR/&gt; 1883: (6.25%)&gt;];
}
61--910[label="1;1pkt 1fpkt"];
61--911[label="1;1pkt 1fpkt"];
61--1845[label="1;1pkt 1fpkt"];
61--2820[label="1;1pkt 1fpkt"];
910--911[label="1;1pkt 1fpkt"];
910--1845[label="1;1pkt 1fpkt"];
910--2820[label="1;1pkt 1fpkt"];
911--1845[label="1;2pkt 2fpkt"];
911--2820[label="0.5;1pkt 1fpkt"];
1845--2820[label="0.5;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="205.43.92.85" dst_port="22" src_ip="171.76.1.214" src_port="1883"/>
      <filter dst_ip="205.43.92.85" dst_port="22" src_ip="171.76.1.214" src_port="1213"/>
      <filter dst_ip="204.7.0.86" dst_port="5050" src_ip="171.76.1.214" src_port="1052"/>
    </slice>
    <from sec="1115269207" usec="0"/>
    <to sec="1115270092" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.827641,1.7154,503,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_145{
style=filled;
color=gray75;
178[label="131.4.176.110s;15pkt 15fpkt", shape=rectangle, color=red];
919[label="131.4.176.110;s;55pkt 55fpkt", shape=diamond, color=yellow];
stat145[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.176.110:*, 211.107.30.161:80}[25.4545%]&lt;BR/&gt;{131.4.176.110:*, 211.107.30.172:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (44.2857%)&lt;BR/&gt; 443: (5%)&lt;BR/&gt; 1158: (1.42857%)&lt;BR/&gt; 1157: (1.42857%)&lt;BR/&gt; 1155: (1.42857%)&gt;];
}
178--919[label="1;15pkt 15fpkt"];
</description>
    <slice>
      <filter dst_ip="211.107.30.161" dst_port="80" src_ip="131.4.176.110"/>
      <filter dst_ip="211.107.30.172" dst_port="80" src_ip="131.4.176.110"/>
    </slice>
    <from sec="1115269229" usec="0"/>
    <to sec="1115269986" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_146{
style=filled;
color=gray75;
810[label="131.4.101.113;s;151pkt 151fpkt", shape=diamond, color=yellow];
927[label="64.198.209.117;d;134pkt 134fpkt", shape=diamond, color=yellow];
stat146[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.101.113:*, 64.198.209.117:80}[88.7417%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4997: (0.350877%)&lt;BR/&gt; 4982: (0.350877%)&lt;BR/&gt; 4972: (0.350877%)&lt;BR/&gt; 4964: (0.350877%)&gt;];
}
810--927[label="1;134pkt 134fpkt"];
</description>
    <slice>
      <filter dst_ip="64.198.209.117" dst_port="80" src_ip="131.4.101.113"/>
    </slice>
    <from sec="1115269266" usec="0"/>
    <to sec="1115269982" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="133.190.217.133"/>
      <from sec="1115269286" usec="0"/>
      <to sec="1115269418" usec="0"/>
    </slice>
    <from sec="1115269286" usec="0"/>
    <to sec="1115269418" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_148{
style=filled;
color=gray75;
902[label="131.4.16.226;s;17pkt 17fpkt", shape=diamond, color=yellow];
944[label="95.164.42.185;d;3pkt 3fpkt", shape=diamond, color=yellow];
stat148[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.16.226:54045, 68.189.195.187:*}[23.5294%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 54045: (45%)&lt;BR/&gt; 3761: (5%)&lt;BR/&gt; 1720: (5%)&lt;BR/&gt; 1714: (5%)&lt;BR/&gt; 1023: (5%)&gt;];
}
902--944[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="68.189.195.187" src_ip="131.4.16.226" src_port="54045"/>
    </slice>
    <from sec="1115269202" usec="0"/>
    <to sec="1115270026" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="172.195.110.105"/>
      <from sec="1115269200" usec="0"/>
      <to sec="1115270016" usec="0"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270016" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.859378,1.64748,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_151{
style=filled;
color=gray75;
980[label="214.12.138.168;d;205pkt 205fpkt", shape=diamond, color=yellow];
1265[label="211.19.97.16;s;75pkt 75fpkt", shape=diamond, color=yellow];
2268[label="171.76.61.60;18pkt 18fpkt", shape=pentagon, color=darkviolet];
2367[label="171.76.48.85;21pkt 21fpkt", shape=pentagon, color=darkviolet];
2701[label="171.76.5.183;24pkt 24fpkt", shape=pentagon, color=darkviolet];
3084[label="171.76.61.60;17pkt 17fpkt", shape=invtriangle, color=brown];
3143[label="171.76.48.85;20pkt 20fpkt", shape=invtriangle, color=brown];
3322[label="171.76.5.183;24pkt 24fpkt", shape=invtriangle, color=brown];
3528[label="171.76.61.60;18pkt 18fpkt", shape=invhouse, color=bisque];
3559[label="171.76.48.85;21pkt 21fpkt", shape=invhouse, color=bisque];
3660[label="171.76.5.183;23pkt 23fpkt", shape=invhouse, color=bisque];
stat151[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 214.12.138.168:*}[67.6375%]&lt;BR/&gt;{211.19.97.16:0, *:0}[24.2718%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (40.3433%)&lt;BR/&gt; 0: (16.309%)&lt;BR/&gt; 25: (1.50215%)&lt;BR/&gt; 64406: (0.429185%)&lt;BR/&gt; 63164: (0.429185%)&gt;];
}
980--1002[label="0.0918367;9pkt 9fpkt"];
980--1140[label="0.352941;12pkt 12fpkt"];
980--1265[label="0.0133333;1pkt 1fpkt"];
980--1840[label="0.521739;12pkt 12fpkt"];
980--1871[label="0.015625;1pkt 1fpkt"];
980--1983[label="0.0682927;14pkt 14fpkt"];
980--1989[label="0.107317;22pkt 22fpkt"];
980--2015[label="0.107317;22pkt 22fpkt"];
980--2268[label="0.722222;13pkt 13fpkt"];
980--2367[label="0.190476;4pkt 4fpkt"];
980--2701[label="0.666667;16pkt 16fpkt"];
980--3084[label="0.764706;13pkt 13fpkt"];
980--3143[label="0.2;4pkt 4fpkt"];
980--3322[label="0.666667;16pkt 16fpkt"];
980--3528[label="0.722222;13pkt 13fpkt"];
980--3559[label="0.190476;4pkt 4fpkt"];
980--3660[label="0.695652;16pkt 16fpkt"];
1265--1415[label="0.0153846;1pkt 1fpkt"];
1265--1520[label="0.0147059;1pkt 1fpkt"];
1265--1532[label="0.0149254;1pkt 1fpkt"];
1265--1604[label="0.0238095;1pkt 1fpkt"];
1265--1606[label="0.0142857;1pkt 1fpkt"];
1265--1616[label="0.0138889;1pkt 1fpkt"];
1265--1618[label="0.0212766;1pkt 1fpkt"];
1265--1633[label="0.0151515;1pkt 1fpkt"];
1265--1635[label="0.0135135;1pkt 1fpkt"];
1265--1644[label="0.0142857;1pkt 1fpkt"];
1265--1871[label="1;64pkt 64fpkt"];
2268--3084[label="1;17pkt 17fpkt"];
2268--3528[label="1;18pkt 18fpkt"];
2367--3143[label="1;20pkt 20fpkt"];
2367--3559[label="1;21pkt 21fpkt"];
2701--3322[label="1;24pkt 24fpkt"];
2701--3660[label="1;23pkt 23fpkt"];
3084--3528[label="1;17pkt 17fpkt"];
3143--3559[label="1;20pkt 20fpkt"];
3322--3660[label="1;23pkt 23fpkt"];
</description>
    <slice>
      <filter dst_ip="214.12.138.168" src_port="80"/>
      <filter src_ip="211.19.97.16"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270094" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.95405,1.74342,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_152{
style=filled;
color=gray75;
900[label="69.216.158.2;s;1pkt 1fpkt", shape=diamond, color=yellow];
1005[label="172.195.18.156;d;1pkt 1fpkt", shape=diamond, color=yellow];
1809[label="69.216.158.2;s;1pkt 1fpkt", shape=hexagon, color=black];
stat152[shape=component, label=&lt;Rules:&lt;BR/&gt;{69.216.158.2:8002, 172.195.18.156:4884}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8002: (50%)&lt;BR/&gt; 4884: (50%)&gt;];
}
900--1005[label="1;1pkt 1fpkt"];
900--1809[label="1;1pkt 1fpkt"];
1005--1809[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="172.195.18.156" dst_port="4884" src_ip="69.216.158.2" src_port="8002"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_153{
style=filled;
color=gray75;
1006[label="172.195.18.156;s;1pkt 1fpkt", shape=diamond, color=yellow];
1007[label="69.216.158.2;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat153[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.18.156:4884, 69.216.158.2:8002}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8002: (50%)&lt;BR/&gt; 4884: (50%)&gt;];
}
1006--1007[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="69.216.158.2" dst_port="8002" src_ip="172.195.18.156" src_port="4884"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.827641,1.7154,503,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_154{
style=filled;
color=gray75;
47[label="203.159.29.183s;2pkt 2fpkt", shape=rectangle, color=red];
1018[label="203.159.29.183;s;3pkt 3fpkt", shape=diamond, color=yellow];
1062[label="21.4.80.47;s;5pkt 5fpkt", shape=diamond, color=yellow];
stat154[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.159.29.183:*, 131.5.90.181:80}[37.5%]&lt;BR/&gt;{21.4.80.47:80, 149.188.129.54:*}[37.5%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3175: (10%)&lt;BR/&gt; 3055: (10%)&lt;BR/&gt; 23334: (5%)&lt;BR/&gt; 23333: (5%)&gt;];
}
47--1018[label="1;2pkt 2fpkt"];
47--1019[label="1;2pkt 2fpkt"];
1018--1019[label="1;3pkt 3fpkt"];
1062--1447[label="0.5;1pkt 1fpkt"];
1062--1989[label="0.2;1pkt 1fpkt"];
1062--2015[label="0.2;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.129.54" src_ip="21.4.80.47" src_port="80"/>
      <filter dst_ip="131.5.90.181" dst_port="80" src_ip="203.159.29.183"/>
    </slice>
    <from sec="1115269202" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.859378,1.64748,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_156{
style=filled;
color=gray75;
925[label="131.5.175.185;s;250pkt 250fpkt", shape=diamond, color=yellow];
1029[label="64.199.19.65;d;294pkt 294fpkt", shape=diamond, color=yellow];
1413[label="131.5.253.250;s;157pkt 157fpkt", shape=diamond, color=yellow];
1645[label="131.5.2.208;s;75pkt 75fpkt", shape=diamond, color=yellow];
2706[label="133.190.77.184;21pkt 21fpkt", shape=pentagon, color=darkviolet];
2712[label="133.190.77.187;61pkt 61fpkt", shape=pentagon, color=darkviolet];
2944[label="131.5.253.250;160pkt 160fpkt", shape=pentagon, color=darkviolet];
3323[label="133.190.77.184;22pkt 22fpkt", shape=invtriangle, color=brown];
3450[label="131.5.253.250;160pkt 160fpkt", shape=invtriangle, color=brown];
3661[label="133.190.77.184;21pkt 21fpkt", shape=invhouse, color=bisque];
stat156[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 64.199.19.65:2703}[46.8354%]&lt;BR/&gt;{131.5.175.185:*, *:2703}[38.6076%]&lt;BR/&gt;{*:*, 64.199.19.83:2703}[36.7089%]&lt;BR/&gt;{131.5.253.250:*, *:*}[25.3165%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2703: (42.5061%)&lt;BR/&gt; 25: (6.42916%)&lt;BR/&gt; 9898: (0.3276%)&lt;BR/&gt; 1023: (0.3276%)&lt;BR/&gt; 5554: (0.2457%)&gt;];
}
925--1029[label="0.488;122pkt 122fpkt"];
1029--1110[label="0.352941;48pkt 48fpkt"];
1029--1413[label="0.394904;62pkt 62fpkt"];
1029--1645[label="0.186667;14pkt 14fpkt"];
1029--1828[label="0.320988;26pkt 26fpkt"];
1029--2706[label="0.380952;8pkt 8fpkt"];
1029--2712[label="0.393443;24pkt 24fpkt"];
1029--2944[label="0.3875;62pkt 62fpkt"];
1029--3323[label="0.363636;8pkt 8fpkt"];
1029--3450[label="0.3875;62pkt 62fpkt"];
1029--3661[label="0.380952;8pkt 8fpkt"];
1413--2944[label="1;157pkt 157fpkt"];
1413--3450[label="1;157pkt 157fpkt"];
2706--3323[label="1;21pkt 21fpkt"];
2706--3661[label="1;21pkt 21fpkt"];
2944--3450[label="1;160pkt 160fpkt"];
3323--3661[label="1;21pkt 21fpkt"];
</description>
    <slice>
      <filter src_ip="131.5.253.250"/>
      <filter dst_port="2703" src_ip="131.5.175.185"/>
      <filter dst_ip="64.199.19.65" dst_port="2703"/>
      <filter dst_ip="64.199.19.83" dst_port="2703"/>
    </slice>
    <from sec="1115269202" usec="0"/>
    <to sec="1115270096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842681,1.61149,503,1 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_157{
style=filled;
color=gray75;
46[label="172.195.111.182s;1pkt 1fpkt", shape=rectangle, color=red];
808[label="200.188.55.24;d;312pkt 312fpkt", shape=diamond, color=yellow];
1031[label="172.195.111.182;s;83pkt 83fpkt", shape=diamond, color=yellow];
2698[label="172.195.111.182;93pkt 93fpkt", shape=pentagon, color=darkviolet];
2767[label="131.4.144.201;42pkt 42fpkt", shape=pentagon, color=darkviolet];
3355[label="131.4.144.201;42pkt 42fpkt", shape=invtriangle, color=brown];
stat157[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.26.233:*, 200.188.55.24:80}[68.1499%]&lt;BR/&gt;{172.195.111.182:*, *:80}[21.7799%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.9529%)&lt;BR/&gt; 443: (0.8726%)&lt;BR/&gt; 1150: (0.34904%)&lt;BR/&gt; 59780: (0.26178%)&lt;BR/&gt; 4984: (0.26178%)&gt;];
}
46--808[label="1;1pkt 1fpkt"];
46--1031[label="1;1pkt 1fpkt"];
46--2698[label="1;1pkt 1fpkt"];
808--1031[label="0.228916;19pkt 19fpkt"];
808--2590[label="0.0144928;1pkt 1fpkt"];
808--2698[label="0.204301;19pkt 19fpkt"];
808--2767[label="0.0238095;1pkt 1fpkt"];
808--2882[label="0.932692;291pkt 291fpkt"];
808--3355[label="0.0238095;1pkt 1fpkt"];
808--3410[label="0.932692;291pkt 291fpkt"];
808--3697[label="0.932692;291pkt 291fpkt"];
1031--1441[label="0.409639;34pkt 34fpkt"];
1031--1874[label="1;61pkt 61fpkt"];
1031--2698[label="1;83pkt 83fpkt"];
2767--3355[label="1;42pkt 42fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="172.195.111.182"/>
      <filter dst_ip="200.188.55.24" dst_port="80" src_ip="131.5.26.233"/>
    </slice>
    <from sec="1115269210" usec="0"/>
    <to sec="1115270095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.540993,1.70541,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_158{
style=filled;
color=gray75;
798[label="133.190.221.150;d;15pkt 15fpkt", shape=diamond, color=yellow];
1053[label="207.72.55.202;s;4pkt 4fpkt", shape=diamond, color=yellow];
2411[label="207.134.183.98;12pkt 12fpkt", shape=pentagon, color=darkviolet];
2772[label="207.72.55.202;3pkt 3fpkt", shape=pentagon, color=darkviolet];
stat158[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.134.183.98:*, 133.190.221.150:80}[75%]&lt;BR/&gt;{207.72.55.202:*, *:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 59530: (4.41176%)&lt;BR/&gt; 56074: (4.41176%)&lt;BR/&gt; 16832: (4.41176%)&lt;BR/&gt; 50074: (2.94118%)&gt;];
}
798--1053[label="0.75;3pkt 3fpkt"];
798--2411[label="1;12pkt 12fpkt"];
798--2772[label="1;3pkt 3fpkt"];
1053--2772[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="207.72.55.202"/>
      <filter dst_ip="133.190.221.150" dst_port="80" src_ip="207.134.183.98"/>
    </slice>
    <from sec="1115269228" usec="0"/>
    <to sec="1115270017" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="210.3.210.154"/>
      <from sec="1115269399" usec="0"/>
      <to sec="1115269492" usec="0"/>
    </slice>
    <from sec="1115269399" usec="0"/>
    <to sec="1115269492" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.827641,1.7154,503,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_160{
style=filled;
color=gray75;
33[label="172.195.175.138s;1pkt 1fpkt", shape=rectangle, color=red];
1067[label="172.195.175.138;s;11pkt 11fpkt", shape=diamond, color=yellow];
1311[label="204.21.177.78;d;7pkt 7fpkt", shape=diamond, color=yellow];
stat160[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.175.138:80, 204.21.177.78:*}[63.6364%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1462: (7.89474%)&lt;BR/&gt; 1461: (5.26316%)&lt;BR/&gt; 1459: (5.26316%)&lt;BR/&gt; 1458: (5.26316%)&gt;];
}
33--1067[label="1;1pkt 1fpkt"];
33--1311[label="1;1pkt 1fpkt"];
1067--1311[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="204.21.177.78" src_ip="172.195.175.138" src_port="80"/>
    </slice>
    <from sec="1115269410" usec="0"/>
    <to sec="1115269722" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.827641,1.7154,503,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_161{
style=filled;
color=gray75;
84[label="215.65.240.160d;1pkt 1fpkt", shape=rectangle, color=red];
1070[label="172.195.111.128;s;15pkt 15fpkt", shape=diamond, color=yellow];
stat161[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.111.128:*, 215.65.240.160:80}[46.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4336: (6.25%)&lt;BR/&gt; 4383: (3.125%)&lt;BR/&gt; 4381: (3.125%)&lt;BR/&gt; 4357: (3.125%)&gt;];
}
84--1070[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="215.65.240.160" dst_port="80" src_ip="172.195.111.128"/>
    </slice>
    <from sec="1115269424" usec="0"/>
    <to sec="1115269964" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.859378,1.64748,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_162{
style=filled;
color=gray75;
945[label="172.195.111.128;d;8pkt 8fpkt", shape=diamond, color=yellow];
1073[label="215.65.240.160;s;9pkt 9fpkt", shape=diamond, color=yellow];
2720[label="215.65.241.189;2pkt 2fpkt", shape=pentagon, color=darkviolet];
3330[label="215.65.241.189;1pkt 1fpkt", shape=invtriangle, color=brown];
3665[label="215.65.241.189;1pkt 1fpkt", shape=invhouse, color=bisque];
stat162[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.65.240.160:80, 172.195.111.128:*}[58.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4330: (9.52381%)&lt;BR/&gt; 4340: (4.7619%)&lt;BR/&gt; 4338: (4.7619%)&lt;BR/&gt; 4336: (4.7619%)&gt;];
}
945--1073[label="0.625;5pkt 5fpkt"];
945--2720[label="1;2pkt 2fpkt"];
945--3330[label="1;1pkt 1fpkt"];
945--3665[label="1;1pkt 1fpkt"];
2720--3330[label="1;1pkt 1fpkt"];
2720--3665[label="1;1pkt 1fpkt"];
3330--3665[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="172.195.111.128" src_ip="215.65.240.160" src_port="80"/>
    </slice>
    <from sec="1115269424" usec="0"/>
    <to sec="1115269555" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="66.199.149.232"/>
      <from sec="1115269908" usec="0"/>
      <to sec="1115270028" usec="0"/>
    </slice>
    <from sec="1115269908" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842681,1.61149,503,1 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_164{
style=filled;
color=gray75;
96[label="131.5.81.12s;45pkt 45fpkt", shape=rectangle, color=red];
1078[label="131.5.81.12;s;92pkt 92fpkt", shape=diamond, color=yellow];
2094[label="131.5.81.12;92pkt 92fpkt", shape=pentagon, color=darkviolet];
2985[label="131.5.81.12;92pkt 92fpkt", shape=invtriangle, color=brown];
stat164[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.81.12:*, 223.35.170.226:80}[48.913%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.0654%)&lt;BR/&gt; 443: (0.934579%)&lt;BR/&gt; 32926: (0.623053%)&lt;BR/&gt; 32925: (0.623053%)&lt;BR/&gt; 32924: (0.623053%)&gt;];
}
96--1078[label="1;45pkt 45fpkt"];
96--2094[label="1;45pkt 45fpkt"];
96--2985[label="1;45pkt 45fpkt"];
1078--1182[label="0.0543478;5pkt 5fpkt"];
1078--1662[label="0.0217391;2pkt 2fpkt"];
1078--2094[label="1;92pkt 92fpkt"];
1078--2985[label="1;92pkt 92fpkt"];
2094--2985[label="1;92pkt 92fpkt"];
</description>
    <slice>
      <filter dst_ip="223.35.170.226" dst_port="80" src_ip="131.5.81.12"/>
    </slice>
    <from sec="1115269475" usec="0"/>
    <to sec="1115269766" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.827641,1.7154,503,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_165{
style=filled;
color=gray75;
18[label="193.145.225.76s;2pkt 2fpkt", shape=rectangle, color=red];
1084[label="149.188.175.49;d;16pkt 16fpkt", shape=diamond, color=yellow];
1085[label="193.145.225.76;s;16pkt 16fpkt", shape=diamond, color=yellow];
stat165[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.145.225.76:80, 149.188.175.49:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1200: (4.41176%)&lt;BR/&gt; 1196: (4.41176%)&lt;BR/&gt; 1223: (2.94118%)&lt;BR/&gt; 1221: (2.94118%)&gt;];
}
18--1084[label="1;2pkt 2fpkt"];
18--1085[label="1;2pkt 2fpkt"];
1084--1085[label="1;16pkt 16fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.175.49" src_ip="193.145.225.76" src_port="80"/>
    </slice>
    <from sec="1115269494" usec="0"/>
    <to sec="1115269598" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.859378,1.64748,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_168{
style=filled;
color=gray75;
346[label="203.107.120.203;s;17pkt 17fpkt", shape=diamond, color=yellow];
1093[label="149.188.9.82;d;42pkt 42fpkt", shape=diamond, color=yellow];
2482[label="210.168.134.121;13pkt 13fpkt", shape=pentagon, color=darkviolet];
3201[label="210.168.134.121;13pkt 13fpkt", shape=invtriangle, color=brown];
3593[label="210.168.134.121;13pkt 13fpkt", shape=invhouse, color=bisque];
stat168[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.107.120.203:*, 149.188.9.82:*}[28.3333%]&lt;BR/&gt;{210.168.134.121:*, 149.188.9.82:60258}[23.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 60258: (34.6939%)&lt;BR/&gt; 2121: (4.08163%)&lt;BR/&gt; 2103: (2.55102%)&lt;BR/&gt; 17001: (2.04082%)&lt;BR/&gt; 1220: (2.04082%)&gt;];
}
346--1093[label="0.352941;6pkt 6fpkt"];
1093--2482[label="0.461538;6pkt 6fpkt"];
1093--3201[label="0.461538;6pkt 6fpkt"];
1093--3593[label="0.461538;6pkt 6fpkt"];
2482--3201[label="1;13pkt 13fpkt"];
2482--3593[label="1;13pkt 13fpkt"];
3201--3593[label="1;13pkt 13fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.9.82" src_ip="203.107.120.203"/>
      <filter dst_ip="149.188.9.82" dst_port="60258" src_ip="210.168.134.121"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_169{
style=filled;
color=gray75;
952[label="140.68.210.122;s;19pkt 19fpkt", shape=diamond, color=yellow];
1094[label="171.76.44.94;d;19pkt 19fpkt", shape=diamond, color=yellow];
stat169[shape=component, label=&lt;Rules:&lt;BR/&gt;{140.68.210.122:*, 171.76.44.94:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3555: (2.63158%)&lt;BR/&gt; 3553: (2.63158%)&lt;BR/&gt; 3551: (2.63158%)&lt;BR/&gt; 3549: (2.63158%)&gt;];
}
952--1094[label="1;19pkt 19fpkt"];
</description>
    <slice>
      <filter dst_ip="171.76.44.94" dst_port="80" src_ip="140.68.210.122"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115269847" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="133.190.222.55"/>
      <from sec="1115269200" usec="0"/>
      <to sec="1115269938" usec="0"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115269938" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.827641,1.7154,503,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_172{
style=filled;
color=gray75;
39[label="211.19.99.154s;1pkt 1fpkt", shape=rectangle, color=red];
440[label="211.19.99.154;s;154pkt 154fpkt", shape=diamond, color=yellow];
1116[label="64.21.133.128;d;1pkt 1fpkt", shape=diamond, color=yellow];
1485[label="197.140.233.149;d;74pkt 74fpkt", shape=diamond, color=yellow];
stat172[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.19.99.154:*, 197.140.233.149:80}[48.0519%]&lt;BR/&gt;{211.19.99.154:*, 212.70.213.116:80}[21.4286%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (44.3478%)&lt;BR/&gt; 6881: (5.43478%)&lt;BR/&gt; 2816: (0.652174%)&lt;BR/&gt; 3074: (0.434783%)&lt;BR/&gt; 3062: (0.434783%)&gt;];
}
39--440[label="1;1pkt 1fpkt"];
39--1116[label="1;1pkt 1fpkt"];
440--1116[label="1;1pkt 1fpkt"];
440--1485[label="1;74pkt 74fpkt"];
</description>
    <slice>
      <filter dst_ip="197.140.233.149" dst_port="80" src_ip="211.19.99.154"/>
      <filter dst_ip="212.70.213.116" dst_port="80" src_ip="211.19.99.154"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="210.53.142.247"/>
      <from sec="1115269200" usec="0"/>
      <to sec="1115269938" usec="0"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115269938" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_175{
style=filled;
color=gray75;
1137[label="210.53.131.183;s;211pkt 211fpkt", shape=diamond, color=yellow];
stat175[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.53.131.183:0, *:0}[97.6303%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (97.6303%)&lt;BR/&gt; 80: (0.473934%)&lt;BR/&gt; 4791: (0.236967%)&lt;BR/&gt; 4004: (0.236967%)&lt;BR/&gt; 2281: (0.236967%)&gt;];
}
1137--1989[label="0.00947867;2pkt 2fpkt"];
1137--2015[label="0.00947867;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_ip="210.53.131.183"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115269936" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.699323,1.69856,503,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_176{
style=filled;
color=gray75;
51[label="210.154.196.196s;2pkt 2fpkt", shape=rectangle, color=red];
2747[label="210.154.196.196;50pkt 50fpkt", shape=pentagon, color=darkviolet];
stat176[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.154.196.196:*, 133.190.149.216:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3453: (1.92308%)&lt;BR/&gt; 3445: (1.92308%)&lt;BR/&gt; 3767: (0.961538%)&lt;BR/&gt; 3765: (0.961538%)&gt;];
}
51--1155[label="1;2pkt 2fpkt"];
51--2747[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="133.190.149.216" dst_port="80" src_ip="210.154.196.196"/>
    </slice>
    <from sec="1115269203" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.10354,1.68992,503,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_177{
style=filled;
color=gray75;
103[label="172.195.115.93s;257pkt 257fpkt", shape=rectangle, color=red];
1169[label="172.195.115.93;s;599pkt 599fpkt", shape=diamond, color=yellow];
1323[label="194.193.87.77;d;156pkt 156fpkt", shape=diamond, color=yellow];
1460[label="200.172.138.37;d;104pkt 104fpkt", shape=diamond, color=yellow];
1873[label="172.195.115.93;s;339pkt 339fpkt", shape=hexagon, color=black];
stat177[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.115.93:*, 194.193.87.77:80}[25.7851%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.3849%)&lt;BR/&gt; 8080: (1.40893%)&lt;BR/&gt; 3044: (0.137457%)&lt;BR/&gt; 3043: (0.137457%)&lt;BR/&gt; 3042: (0.137457%)&gt;];
}
103--1169[label="1;257pkt 257fpkt"];
103--1323[label="0.935897;146pkt 146fpkt"];
103--1460[label="0.942308;98pkt 98fpkt"];
103--1873[label="0.883268;227pkt 227fpkt"];
1169--1323[label="1;156pkt 156fpkt"];
1169--1333[label="0.0319149;3pkt 3fpkt"];
1169--1460[label="0.942308;98pkt 98fpkt"];
1169--1873[label="1;339pkt 339fpkt"];
1323--1873[label="1;156pkt 156fpkt"];
1460--1873[label="0.740385;77pkt 77fpkt"];
1460--1926[label="0.0576923;6pkt 6fpkt"];
1460--2331[label="0.0576923;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="194.193.87.77" dst_port="80" src_ip="172.195.115.93"/>
    </slice>
    <from sec="1115269207" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.827641,1.7154,999,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_181{
style=filled;
color=gray75;
211[label="66.52.33.232d;13pkt 13fpkt", shape=rectangle, color=red];
1185[label="131.5.148.0;s;150pkt 150fpkt", shape=diamond, color=yellow];
stat181[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.148.0:*, *:25}[78%]&lt;BR/&gt;{131.5.148.0:25, *:*}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (49.0798%)&lt;BR/&gt; 53: (0.920245%)&lt;BR/&gt; 40127: (0.613497%)&lt;BR/&gt; 40122: (0.613497%)&lt;BR/&gt; 40110: (0.613497%)&gt;];
}
211--852[label="1;13pkt 13fpkt"];
211--1185[label="1;13pkt 13fpkt"];
1185--1988[label="0.00666667;1pkt 1fpkt"];
1185--2014[label="0.00666667;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="131.5.148.0" src_port="25"/>
      <filter dst_port="25" src_ip="131.5.148.0"/>
    </slice>
    <from sec="1115269239" usec="0"/>
    <to sec="1115270022" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.827641,1.7154,503,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_182{
style=filled;
color=gray75;
105[label="131.4.80.148s;143pkt 143fpkt", shape=rectangle, color=red];
1168[label="131.4.80.148;s;272pkt 272fpkt", shape=diamond, color=yellow];
1199[label="129.105.9.125;d;73pkt 73fpkt", shape=diamond, color=yellow];
stat182[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.80.148:*, 129.105.9.125:80}[26.8382%]&lt;BR/&gt;{131.4.80.148:*, 210.134.86.164:80}[25.7353%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.1311%)&lt;BR/&gt; 64299: (0.819672%)&lt;BR/&gt; 64295: (0.717213%)&lt;BR/&gt; 64352: (0.614754%)&lt;BR/&gt; 64344: (0.614754%)&gt;];
}
105--1168[label="1;143pkt 143fpkt"];
105--1199[label="1;73pkt 73fpkt"];
1168--1199[label="1;73pkt 73fpkt"];
1168--1662[label="0.0217391;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="129.105.9.125" dst_port="80" src_ip="131.4.80.148"/>
      <filter dst_ip="210.134.86.164" dst_port="80" src_ip="131.4.80.148"/>
    </slice>
    <from sec="1115269207" usec="0"/>
    <to sec="1115270026" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.95405,1.74342,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_184{
style=filled;
color=gray75;
480[label="88.152.226.161;s;2556pkt 2556fpkt", shape=diamond, color=yellow];
1220[label="88.152.226.161;d;2577pkt 2577fpkt", shape=diamond, color=yellow];
1779[label="88.152.226.161;s;2154pkt 2154fpkt", shape=hexagon, color=black];
stat184[shape=component, label=&lt;Rules:&lt;BR/&gt;{88.152.226.161:80, 88.152.226.161:*}[26.6589%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (17.2705%)&lt;BR/&gt; 21840: (8.94744%)&lt;BR/&gt; 21845: (4.2816%)&lt;BR/&gt; 9548: (1.53698%)&lt;BR/&gt; 25: (1.37231%)&gt;];
}
480--1220[label="1;2556pkt 2556fpkt"];
480--1779[label="1;2154pkt 2154fpkt"];
480--1982[label="0.00156495;4pkt 4fpkt"];
480--1983[label="0.0277778;71pkt 71fpkt"];
480--1988[label="0.000391236;1pkt 1fpkt"];
480--1989[label="0.0410798;105pkt 105fpkt"];
480--1991[label="0.00103093;1pkt 1fpkt"];
480--1992[label="0.00210748;2pkt 2fpkt"];
480--1993[label="0.000926784;1pkt 1fpkt"];
480--1996[label="0.000391236;1pkt 1fpkt"];
480--1997[label="0.0324726;83pkt 83fpkt"];
480--1998[label="0.00102669;1pkt 1fpkt"];
480--1999[label="0.000963391;1pkt 1fpkt"];
480--2003[label="0.000391236;1pkt 1fpkt"];
480--2004[label="0.0301653;73pkt 73fpkt"];
480--2007[label="0.000782473;2pkt 2fpkt"];
480--2014[label="0.000391236;1pkt 1fpkt"];
480--2015[label="0.0410798;105pkt 105fpkt"];
480--2017[label="0.000925926;1pkt 1fpkt"];
480--2019[label="0.000391236;1pkt 1fpkt"];
480--2020[label="0.0324726;83pkt 83fpkt"];
480--2021[label="0.000391236;1pkt 1fpkt"];
480--2022[label="0.00102669;1pkt 1fpkt"];
480--2023[label="0.000391236;1pkt 1fpkt"];
480--2024[label="0.0301653;73pkt 73fpkt"];
480--2030[label="0.000391236;1pkt 1fpkt"];
480--2031[label="0.0324726;83pkt 83fpkt"];
480--2032[label="0.000391236;1pkt 1fpkt"];
480--2033[label="0.00102669;1pkt 1fpkt"];
480--2034[label="0.000391236;1pkt 1fpkt"];
480--2035[label="0.0301653;73pkt 73fpkt"];
1220--1779[label="1;2154pkt 2154fpkt"];
1220--1982[label="0.00155219;4pkt 4fpkt"];
1220--1983[label="0.0275514;71pkt 71fpkt"];
1220--1988[label="0.000388048;1pkt 1fpkt"];
1220--1989[label="0.0407451;105pkt 105fpkt"];
1220--1991[label="0.00103093;1pkt 1fpkt"];
1220--1992[label="0.00210748;2pkt 2fpkt"];
1220--1993[label="0.000926784;1pkt 1fpkt"];
1220--1996[label="0.000388048;1pkt 1fpkt"];
1220--1997[label="0.032208;83pkt 83fpkt"];
1220--1998[label="0.00102669;1pkt 1fpkt"];
1220--1999[label="0.000963391;1pkt 1fpkt"];
1220--2003[label="0.000388048;1pkt 1fpkt"];
1220--2004[label="0.0301653;73pkt 73fpkt"];
1220--2007[label="0.000776096;2pkt 2fpkt"];
1220--2014[label="0.000388048;1pkt 1fpkt"];
1220--2015[label="0.0407451;105pkt 105fpkt"];
1220--2017[label="0.000925926;1pkt 1fpkt"];
1220--2019[label="0.000388048;1pkt 1fpkt"];
1220--2020[label="0.032208;83pkt 83fpkt"];
1220--2021[label="0.000388048;1pkt 1fpkt"];
1220--2022[label="0.00102669;1pkt 1fpkt"];
1220--2023[label="0.000388048;1pkt 1fpkt"];
1220--2024[label="0.0301653;73pkt 73fpkt"];
1220--2030[label="0.000388048;1pkt 1fpkt"];
1220--2031[label="0.032208;83pkt 83fpkt"];
1220--2032[label="0.000388048;1pkt 1fpkt"];
1220--2033[label="0.00102669;1pkt 1fpkt"];
1220--2034[label="0.000388048;1pkt 1fpkt"];
1220--2035[label="0.0301653;73pkt 73fpkt"];
1779--1982[label="0.00185701;4pkt 4fpkt"];
1779--1983[label="0.0329619;71pkt 71fpkt"];
1779--1988[label="0.000464253;1pkt 1fpkt"];
1779--1989[label="0.0487465;105pkt 105fpkt"];
1779--1991[label="0.00103093;1pkt 1fpkt"];
1779--1992[label="0.00210748;2pkt 2fpkt"];
1779--1993[label="0.000926784;1pkt 1fpkt"];
1779--1996[label="0.000464253;1pkt 1fpkt"];
1779--1997[label="0.0241411;52pkt 52fpkt"];
1779--2003[label="0.000464253;1pkt 1fpkt"];
1779--2004[label="0.0218199;47pkt 47fpkt"];
1779--2014[label="0.000464253;1pkt 1fpkt"];
1779--2015[label="0.0487465;105pkt 105fpkt"];
1779--2017[label="0.000925926;1pkt 1fpkt"];
1779--2019[label="0.000464253;1pkt 1fpkt"];
1779--2020[label="0.0241411;52pkt 52fpkt"];
1779--2023[label="0.000464253;1pkt 1fpkt"];
1779--2024[label="0.0218199;47pkt 47fpkt"];
1779--2030[label="0.000464253;1pkt 1fpkt"];
1779--2031[label="0.0241411;52pkt 52fpkt"];
1779--2034[label="0.000464253;1pkt 1fpkt"];
1779--2035[label="0.0218199;47pkt 47fpkt"];
</description>
    <slice>
      <filter dst_ip="88.152.226.161" src_ip="88.152.226.161" src_port="80"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.967126,1.64128,020,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_185{
style=filled;
color=gray75;
385[label="133.33.217.71;s;678pkt 678fpkt", shape=diamond, color=yellow];
708[label="210.53.132.165;s;563pkt 563fpkt", shape=diamond, color=yellow];
1225[label="206.58.26.49;d;28pkt 28fpkt", shape=diamond, color=yellow];
1257[label="172.185.57.188;s;308pkt 308fpkt", shape=diamond, color=yellow];
1354[label="21.17.70.101;d;27pkt 27fpkt", shape=diamond, color=yellow];
1604[label="207.210.244.191;d;42pkt 42fpkt", shape=diamond, color=yellow];
1936[label="21.17.70.101;d;27pkt 27fpkt", shape=hexagon, color=black];
2160[label="211.19.124.29;115pkt 115fpkt", shape=pentagon, color=darkviolet];
2322[label="133.33.217.71;716pkt 716fpkt", shape=pentagon, color=darkviolet];
2533[label="211.19.116.137;114pkt 114fpkt", shape=pentagon, color=darkviolet];
2717[label="172.185.57.188;461pkt 461fpkt", shape=pentagon, color=darkviolet];
3116[label="133.33.217.71;717pkt 717fpkt", shape=invtriangle, color=brown];
3225[label="211.19.116.137;113pkt 113fpkt", shape=invtriangle, color=brown];
stat185[shape=component, label=&lt;Rules:&lt;BR/&gt;{133.33.217.71:0, *:0}[34.8397%]&lt;BR/&gt;{210.53.132.165:0, *:0}[27.3081%]&lt;BR/&gt;{172.185.57.188:0, *:0}[22.2546%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.207%)&lt;BR/&gt; 8500: (0.25582%)&lt;BR/&gt; 80: (0.102328%)&lt;BR/&gt; 3220: (0.025582%)&lt;BR/&gt; 3198: (0.025582%)&gt;];
}
385--977[label="0.00258398;1pkt 1fpkt"];
385--1225[label="0.0357143;1pkt 1fpkt"];
385--1354[label="0.037037;1pkt 1fpkt"];
385--1505[label="0.00346021;1pkt 1fpkt"];
385--1604[label="0.0238095;1pkt 1fpkt"];
385--1936[label="0.037037;1pkt 1fpkt"];
385--2322[label="0.998525;677pkt 677fpkt"];
385--3116[label="1;678pkt 678fpkt"];
708--977[label="0.00258398;1pkt 1fpkt"];
708--1354[label="0.037037;1pkt 1fpkt"];
708--1505[label="0.00346021;1pkt 1fpkt"];
708--1936[label="0.037037;1pkt 1fpkt"];
1225--1257[label="0.0357143;1pkt 1fpkt"];
1225--1527[label="0.0357143;1pkt 1fpkt"];
1225--1867[label="0.0357143;1pkt 1fpkt"];
1225--1881[label="0.0357143;1pkt 1fpkt"];
1225--2160[label="0.0357143;1pkt 1fpkt"];
1225--2187[label="0.0357143;1pkt 1fpkt"];
1225--2322[label="0.0357143;1pkt 1fpkt"];
1225--2533[label="0.0357143;1pkt 1fpkt"];
1225--2536[label="0.0833333;1pkt 1fpkt"];
1225--2597[label="0.2;1pkt 1fpkt"];
1225--2717[label="0.0357143;1pkt 1fpkt"];
1225--2742[label="0.0357143;1pkt 1fpkt"];
1225--3041[label="0.0357143;1pkt 1fpkt"];
1225--3116[label="0.0357143;1pkt 1fpkt"];
1225--3138[label="0.0357143;1pkt 1fpkt"];
1225--3225[label="0.0357143;1pkt 1fpkt"];
1225--3226[label="0.0833333;1pkt 1fpkt"];
1225--3266[label="0.2;1pkt 1fpkt"];
1225--3343[label="0.0357143;1pkt 1fpkt"];
1225--3506[label="0.0357143;1pkt 1fpkt"];
1225--3606[label="0.0769231;1pkt 1fpkt"];
1257--1354[label="0.037037;1pkt 1fpkt"];
1257--1505[label="0.00346021;1pkt 1fpkt"];
1257--1604[label="0.0238095;1pkt 1fpkt"];
1257--1936[label="0.037037;1pkt 1fpkt"];
1257--2717[label="1;308pkt 308fpkt"];
1354--1881[label="0.037037;1pkt 1fpkt"];
1354--1936[label="1;27pkt 27fpkt"];
1354--2187[label="0.037037;1pkt 1fpkt"];
1354--2322[label="0.037037;1pkt 1fpkt"];
1354--2598[label="0.0625;1pkt 1fpkt"];
1354--2717[label="0.037037;1pkt 1fpkt"];
1354--3041[label="0.037037;1pkt 1fpkt"];
1354--3116[label="0.037037;1pkt 1fpkt"];
1354--3267[label="0.0666667;1pkt 1fpkt"];
1354--3506[label="0.037037;1pkt 1fpkt"];
1604--1881[label="0.0238095;1pkt 1fpkt"];
1604--2322[label="0.0238095;1pkt 1fpkt"];
1604--2536[label="0.0833333;1pkt 1fpkt"];
1604--2717[label="0.0238095;1pkt 1fpkt"];
1604--3116[label="0.0238095;1pkt 1fpkt"];
1604--3226[label="0.0833333;1pkt 1fpkt"];
1604--3606[label="0.0769231;1pkt 1fpkt"];
1936--2187[label="0.037037;1pkt 1fpkt"];
1936--2322[label="0.037037;1pkt 1fpkt"];
1936--2598[label="0.0625;1pkt 1fpkt"];
1936--2717[label="0.037037;1pkt 1fpkt"];
1936--3041[label="0.037037;1pkt 1fpkt"];
1936--3116[label="0.037037;1pkt 1fpkt"];
1936--3267[label="0.0666667;1pkt 1fpkt"];
1936--3506[label="0.037037;1pkt 1fpkt"];
2322--3116[label="1;716pkt 716fpkt"];
2533--3225[label="1;113pkt 113fpkt"];
</description>
    <slice>
      <filter src_ip="133.33.217.71"/>
      <filter src_ip="210.53.132.165"/>
      <filter src_ip="172.185.57.188"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.540993,1.70541,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_186{
style=filled;
color=gray75;
972[label="220.77.157.239;d;10pkt 10fpkt", shape=diamond, color=yellow];
1233[label="171.76.48.40;s;1pkt 1fpkt", shape=diamond, color=yellow];
2445[label="171.76.14.108;5pkt 5fpkt", shape=pentagon, color=darkviolet];
stat186[shape=component, label=&lt;Rules:&lt;BR/&gt;{171.76.14.108:25, *:*}[28.5714%]&lt;BR/&gt;{171.76.48.91:*, 220.77.157.239:6667}[21.4286%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (18.75%)&lt;BR/&gt; 25: (12.5%)&lt;BR/&gt; 36742: (6.25%)&lt;BR/&gt; 6665: (6.25%)&lt;BR/&gt; 6663: (6.25%)&gt;];
}
972--1233[label="1;1pkt 1fpkt"];
972--2445[label="0.2;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="171.76.14.108" src_port="25"/>
      <filter dst_ip="220.77.157.239" dst_port="6667" src_ip="171.76.48.91"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="20.160.199.82"/>
      <from sec="1115269200" usec="0"/>
      <to sec="1115270028" usec="0"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="203.130.150.203"/>
      <from sec="1115269200" usec="0"/>
      <to sec="1115270028" usec="0"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_189{
style=filled;
color=gray75;
1141[label="172.195.238.132;s;3pkt 3fpkt", shape=diamond, color=yellow];
1253[label="210.237.11.239;d;2pkt 2fpkt", shape=diamond, color=yellow];
stat189[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.238.132:1033, 214.12.133.196:1863}[33.3333%]&lt;BR/&gt;{172.195.238.132:1424, 210.237.11.239:554}[33.3333%]&lt;BR/&gt;{172.195.238.132:6970, 210.237.11.239:22612}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 22612: (20%)&lt;BR/&gt; 6970: (20%)&lt;BR/&gt; 1424: (20%)&lt;BR/&gt; 554: (20%)&lt;BR/&gt; 1863: (10%)&gt;];
}
1141--1253[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="210.237.11.239" dst_port="22612" src_ip="172.195.238.132" src_port="6970"/>
      <filter dst_ip="210.237.11.239" dst_port="554" src_ip="172.195.238.132" src_port="1424"/>
      <filter dst_ip="214.12.133.196" dst_port="1863" src_ip="172.195.238.132" src_port="1033"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_190{
style=filled;
color=gray75;
1255[label="221.146.194.125;d;1pkt 1fpkt", shape=diamond, color=yellow];
1256[label="131.5.2.211;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat190[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.2.211:0, 221.146.194.125:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1255--1256[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="221.146.194.125" src_ip="131.5.2.211"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115269938" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="211.25.130.24"/>
      <from sec="1115269201" usec="0"/>
      <to sec="1115269932" usec="0"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115269932" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_192{
style=filled;
color=gray75;
1270[label="149.188.174.241;d;4pkt 4fpkt", shape=diamond, color=yellow];
1271[label="21.39.125.53;s;6pkt 6fpkt", shape=diamond, color=yellow];
stat192[shape=component, label=&lt;Rules:&lt;BR/&gt;{21.39.125.53:2002, 149.188.174.241:*}[50%]&lt;BR/&gt;{21.39.125.53:3400, 149.188.174.241:*}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3400: (25%)&lt;BR/&gt; 2002: (25%)&lt;BR/&gt; 1840: (10%)&lt;BR/&gt; 1839: (10%)&lt;BR/&gt; 1560: (10%)&gt;];
}
1270--1271[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.174.241" src_ip="21.39.125.53" src_port="3400"/>
      <filter dst_ip="149.188.174.241" src_ip="21.39.125.53" src_port="2002"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270026" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_193{
style=filled;
color=gray75;
817[label="172.195.52.33;d;3pkt 3fpkt", shape=diamond, color=yellow];
1288[label="67.182.182.57;s;7pkt 7fpkt", shape=diamond, color=yellow];
stat193[shape=component, label=&lt;Rules:&lt;BR/&gt;{67.182.182.57:80, 211.19.90.238:*}[37.5%]&lt;BR/&gt;{67.182.182.57:80, 172.195.52.33:*}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4358: (10%)&lt;BR/&gt; 4357: (10%)&lt;BR/&gt; 37586: (5%)&lt;BR/&gt; 37574: (5%)&gt;];
}
817--1288[label="0.666667;2pkt 2fpkt"];
1288--2004[label="0.142857;1pkt 1fpkt"];
1288--2024[label="0.142857;1pkt 1fpkt"];
1288--2035[label="0.142857;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="211.19.90.238" src_ip="67.182.182.57" src_port="80"/>
      <filter dst_ip="172.195.52.33" src_ip="67.182.182.57" src_port="80"/>
    </slice>
    <from sec="1115269215" usec="0"/>
    <to sec="1115270012" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="64.217.130.178"/>
      <from sec="1115269405" usec="0"/>
      <to sec="1115270028" usec="0"/>
    </slice>
    <from sec="1115269405" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="10.16.168.3"/>
      <from sec="1115269438" usec="0"/>
      <to sec="1115270023" usec="0"/>
    </slice>
    <from sec="1115269438" usec="0"/>
    <to sec="1115270023" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.827641,1.7154,503,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_196{
style=filled;
color=gray75;
4[label="131.4.60.23s;1pkt 1fpkt", shape=rectangle, color=red];
1319[label="131.4.60.23;s;6pkt 6fpkt", shape=diamond, color=yellow];
1684[label="69.199.130.251;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat196[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.60.23:*, 59.40.102.62:80}[66.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 49737: (18.75%)&lt;BR/&gt; 49734: (6.25%)&lt;BR/&gt; 49733: (6.25%)&lt;BR/&gt; 49732: (6.25%)&gt;];
}
4--1319[label="1;1pkt 1fpkt"];
4--1684[label="1;1pkt 1fpkt"];
1319--1684[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="59.40.102.62" dst_port="80" src_ip="131.4.60.23"/>
    </slice>
    <from sec="1115269605" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.859378,1.64748,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_197{
style=filled;
color=gray75;
1326[label="172.195.41.193;s;1pkt 1fpkt", shape=diamond, color=yellow];
2729[label="172.195.41.193;2pkt 2fpkt", shape=pentagon, color=darkviolet];
3336[label="172.195.41.193;2pkt 2fpkt", shape=invtriangle, color=brown];
3667[label="172.195.41.193;2pkt 2fpkt", shape=invhouse, color=bisque];
stat197[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.41.193:80, 67.35.29.44:3266}[50%]&lt;BR/&gt;{172.195.41.193:80, 203.157.136.89:3944}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3944: (28.5714%)&lt;BR/&gt; 3266: (21.4286%)&gt;];
}
1326--2729[label="1;1pkt 1fpkt"];
1326--3336[label="1;1pkt 1fpkt"];
1326--3667[label="1;1pkt 1fpkt"];
2729--3336[label="1;2pkt 2fpkt"];
2729--3667[label="1;2pkt 2fpkt"];
3336--3667[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="203.157.136.89" dst_port="3944" src_ip="172.195.41.193" src_port="80"/>
      <filter dst_ip="67.35.29.44" dst_port="3266" src_ip="172.195.41.193" src_port="80"/>
    </slice>
    <from sec="1115269626" usec="0"/>
    <to sec="1115270045" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.827641,1.7154,503,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_198{
style=filled;
color=gray75;
45[label="200.35.40.182s;1pkt 1fpkt", shape=rectangle, color=red];
1331[label="200.35.40.182;s;7pkt 7fpkt", shape=diamond, color=yellow];
stat198[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.35.40.182:*, 133.33.218.228:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 50644: (12.5%)&lt;BR/&gt; 50726: (6.25%)&lt;BR/&gt; 50725: (6.25%)&lt;BR/&gt; 50645: (6.25%)&gt;];
}
45--1331[label="1;1pkt 1fpkt"];
45--1529[label="1;1pkt 1fpkt"];
1331--1529[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="133.33.218.228" dst_port="80" src_ip="200.35.40.182"/>
    </slice>
    <from sec="1115269654" usec="0"/>
    <to sec="1115269831" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.10354,1.68992,503,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_200{
style=filled;
color=gray75;
17[label="131.5.165.74s;2pkt 2fpkt", shape=rectangle, color=red];
1338[label="131.5.165.74;s;4pkt 4fpkt", shape=diamond, color=yellow];
1905[label="131.5.165.74;s;4pkt 4fpkt", shape=hexagon, color=black];
stat200[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.165.74:2081, 67.182.182.57:80}[25%]&lt;BR/&gt;{131.5.165.74:2082, 67.182.182.57:80}[25%]&lt;BR/&gt;{131.5.165.74:2083, 67.182.182.57:80}[25%]&lt;BR/&gt;{131.5.165.74:2084, 67.182.182.57:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2083: (15%)&lt;BR/&gt; 2082: (15%)&lt;BR/&gt; 2084: (10%)&lt;BR/&gt; 2081: (10%)&gt;];
}
17--1338[label="1;2pkt 2fpkt"];
17--1905[label="1;2pkt 2fpkt"];
1338--1905[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="67.182.182.57" dst_port="80" src_ip="131.5.165.74" src_port="2084"/>
      <filter dst_ip="67.182.182.57" dst_port="80" src_ip="131.5.165.74" src_port="2083"/>
      <filter dst_ip="67.182.182.57" dst_port="80" src_ip="131.5.165.74" src_port="2082"/>
      <filter dst_ip="67.182.182.57" dst_port="80" src_ip="131.5.165.74" src_port="2081"/>
    </slice>
    <from sec="1115269676" usec="0"/>
    <to sec="1115269710" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.540993,1.70541,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_201{
style=filled;
color=gray75;
1337[label="131.4.70.166;s;68pkt 68fpkt", shape=diamond, color=yellow];
1340[label="210.104.56.84;d;62pkt 62fpkt", shape=diamond, color=yellow];
2639[label="131.4.70.166;76pkt 76fpkt", shape=pentagon, color=darkviolet];
stat201[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.70.166:*, 210.104.56.84:80}[81.5789%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.5146%)&lt;BR/&gt; 1361: (0.728155%)&lt;BR/&gt; 1360: (0.728155%)&lt;BR/&gt; 1359: (0.728155%)&lt;BR/&gt; 1358: (0.728155%)&gt;];
}
1337--1340[label="1;62pkt 62fpkt"];
1337--2639[label="1;68pkt 68fpkt"];
1340--2639[label="1;62pkt 62fpkt"];
</description>
    <slice>
      <filter dst_ip="210.104.56.84" dst_port="80" src_ip="131.4.70.166"/>
    </slice>
    <from sec="1115269225" usec="0"/>
    <to sec="1115269815" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.10354,1.68992,503,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_202{
style=filled;
color=gray75;
44[label="131.4.21.180s;2pkt 2fpkt", shape=rectangle, color=red];
1204[label="131.4.21.180;s;7pkt 7fpkt", shape=diamond, color=yellow];
1347[label="69.251.165.41;d;2pkt 2fpkt", shape=diamond, color=yellow];
1901[label="131.4.21.180;s;7pkt 7fpkt", shape=hexagon, color=black];
1907[label="69.251.165.41;d;2pkt 2fpkt", shape=hexagon, color=black];
stat202[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.21.180:*, 211.217.195.141:80}[42.8571%]&lt;BR/&gt;{131.4.21.180:*, 69.251.165.41:80}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 27623: (12.5%)&lt;BR/&gt; 27622: (12.5%)&lt;BR/&gt; 27629: (5%)&lt;BR/&gt; 27611: (5%)&gt;];
}
44--1204[label="1;2pkt 2fpkt"];
44--1347[label="1;2pkt 2fpkt"];
44--1901[label="1;2pkt 2fpkt"];
44--1907[label="1;2pkt 2fpkt"];
1204--1347[label="1;2pkt 2fpkt"];
1204--1901[label="1;7pkt 7fpkt"];
1204--1907[label="1;2pkt 2fpkt"];
1347--1901[label="1;2pkt 2fpkt"];
1347--1907[label="1;2pkt 2fpkt"];
1901--1907[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="211.217.195.141" dst_port="80" src_ip="131.4.21.180"/>
      <filter dst_ip="69.251.165.41" dst_port="80" src_ip="131.4.21.180"/>
    </slice>
    <from sec="1115269544" usec="0"/>
    <to sec="1115269790" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_203{
style=filled;
color=gray75;
1117[label="197.32.112.172;d;2pkt 2fpkt", shape=diamond, color=yellow];
1364[label="172.195.110.26;s;12pkt 12fpkt", shape=diamond, color=yellow];
stat203[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.110.26:*, 197.32.112.2:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (21.4286%)&lt;BR/&gt; 6970: (10.7143%)&lt;BR/&gt; 554: (10.7143%)&lt;BR/&gt; 23198: (7.14286%)&lt;BR/&gt; 1084: (7.14286%)&gt;];
}
1117--1364[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="197.32.112.2" dst_port="80" src_ip="172.195.110.26"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_204{
style=filled;
color=gray75;
1281[label="69.101.66.154;d;3pkt 3fpkt", shape=diamond, color=yellow];
1375[label="131.4.108.6;s;246pkt 246fpkt", shape=diamond, color=yellow];
stat204[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.108.6:0, *:0}[98.7903%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.5984%)&lt;BR/&gt; 2227: (0.200803%)&lt;BR/&gt; 1023: (0.200803%)&gt;];
}
1281--1375[label="0.333333;1pkt 1fpkt"];
1281--1870[label="0.333333;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="131.4.108.6"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="21.4.72.128"/>
      <from sec="1115269200" usec="0"/>
      <to sec="1115270028" usec="0"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.11635,1.72427,010,0 0 0 1 1 0 0 0 0 0 0 1 ">
    <description>subgraph cluster_206{
style=filled;
color=gray75;
537[label="149.188.172.6;d;100pkt 100fpkt", shape=diamond, color=yellow];
1376[label="203.157.71.172;s;1pkt 1fpkt", shape=diamond, color=yellow];
1380[label="206.61.51.239;s;1pkt 1fpkt", shape=diamond, color=yellow];
1401[label="206.65.10.107;s;1pkt 1fpkt", shape=diamond, color=yellow];
1941[label="203.157.71.172;s;1pkt 1fpkt", shape=hexagon, color=black];
3708[label="206.61.51.239;1pkt 1fpkt", shape=invhouse, color=bisque];
stat206[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.217.26.120:80, 149.188.172.6:*}[38%]&lt;BR/&gt;{*:*, 149.188.172.6:80}[37%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (41.9048%)&lt;BR/&gt; 10000: (5.71429%)&lt;BR/&gt; 2050: (1.42857%)&lt;BR/&gt; 1808: (1.42857%)&lt;BR/&gt; 11936: (0.952381%)&gt;];
}
537--884[label="1;1pkt 1fpkt"];
537--1376[label="1;1pkt 1fpkt"];
537--1380[label="1;1pkt 1fpkt"];
537--1401[label="1;1pkt 1fpkt"];
537--1941[label="1;1pkt 1fpkt"];
537--1983[label="0.02;2pkt 2fpkt"];
537--1989[label="0.02;2pkt 2fpkt"];
537--1997[label="0.02;2pkt 2fpkt"];
537--2004[label="0.02;2pkt 2fpkt"];
537--2015[label="0.02;2pkt 2fpkt"];
537--2020[label="0.02;2pkt 2fpkt"];
537--2024[label="0.02;2pkt 2fpkt"];
537--2031[label="0.02;2pkt 2fpkt"];
537--2035[label="0.02;2pkt 2fpkt"];
537--3708[label="1;1pkt 1fpkt"];
1376--1941[label="1;1pkt 1fpkt"];
1380--3708[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.172.6" dst_port="80"/>
      <filter dst_ip="149.188.172.6" src_ip="211.217.26.120" src_port="80"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_207{
style=filled;
color=gray75;
1382[label="131.5.36.80;s;387pkt 387fpkt", shape=diamond, color=yellow];
stat207[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.36.80:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1382--1505[label="0.00346021;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="131.5.36.80"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="21.17.1.179"/>
      <from sec="1115269200" usec="0"/>
      <to sec="1115270028" usec="0"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="207.152.51.79"/>
      <from sec="1115269201" usec="0"/>
      <to sec="1115270028" usec="0"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="52.17.249.114"/>
      <from sec="1115269201" usec="0"/>
      <to sec="1115270026" usec="0"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270026" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="20.160.78.231"/>
      <from sec="1115269201" usec="0"/>
      <to sec="1115270028" usec="0"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="21.4.158.206"/>
      <from sec="1115269201" usec="0"/>
      <to sec="1115270027" usec="0"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_213{
style=filled;
color=gray75;
432[label="131.4.29.24;s;551pkt 551fpkt", shape=diamond, color=yellow];
693[label="89.18.255.42;d;2pkt 2fpkt", shape=diamond, color=yellow];
696[label="202.37.64.17;d;1pkt 1fpkt", shape=diamond, color=yellow];
760[label="206.36.15.57;d;1pkt 1fpkt", shape=diamond, color=yellow];
836[label="207.128.198.63;d;1pkt 1fpkt", shape=diamond, color=yellow];
962[label="200.137.112.108;d;3pkt 3fpkt", shape=diamond, color=yellow];
1014[label="200.195.169.60;d;1pkt 1fpkt", shape=diamond, color=yellow];
1258[label="206.58.202.52;d;1pkt 1fpkt", shape=diamond, color=yellow];
1412[label="207.134.122.60;d;4pkt 4fpkt", shape=diamond, color=yellow];
1422[label="202.71.128.212;d;1pkt 1fpkt", shape=diamond, color=yellow];
1624[label="203.157.188.77;d;3pkt 3fpkt", shape=diamond, color=yellow];
1643[label="202.37.163.19;d;1pkt 1fpkt", shape=diamond, color=yellow];
1655[label="20.165.90.109;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat213[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.29.24:*, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 16881: (7.61821%)&lt;BR/&gt; 80: (3.59019%)&lt;BR/&gt; 10187: (2.36427%)&lt;BR/&gt; 26536: (2.27671%)&lt;BR/&gt; 9629: (2.01401%)&gt;];
}
432--693[label="1;2pkt 2fpkt"];
432--696[label="1;1pkt 1fpkt"];
432--760[label="1;1pkt 1fpkt"];
432--836[label="1;1pkt 1fpkt"];
432--962[label="1;3pkt 3fpkt"];
432--1014[label="1;1pkt 1fpkt"];
432--1258[label="1;1pkt 1fpkt"];
432--1412[label="1;4pkt 4fpkt"];
432--1422[label="1;1pkt 1fpkt"];
432--1509[label="0.019802;2pkt 2fpkt"];
432--1624[label="1;3pkt 3fpkt"];
432--1643[label="1;1pkt 1fpkt"];
432--1655[label="1;1pkt 1fpkt"];
432--1983[label="0.00362976;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_ip="131.4.29.24"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="20.160.199.88"/>
      <from sec="1115269205" usec="0"/>
      <to sec="1115270025" usec="0"/>
    </slice>
    <from sec="1115269205" usec="0"/>
    <to sec="1115270025" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="64.217.130.178"/>
      <from sec="1115269405" usec="0"/>
      <to sec="1115269936" usec="0"/>
    </slice>
    <from sec="1115269405" usec="0"/>
    <to sec="1115269936" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="69.102.213.42"/>
      <from sec="1115269423" usec="0"/>
      <to sec="1115270028" usec="0"/>
    </slice>
    <from sec="1115269423" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.0228,1.59075,503,1 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_217{
style=filled;
color=gray75;
113[label="131.5.177.237s;104pkt 104fpkt", shape=rectangle, color=red];
1071[label="131.5.177.237;s;256pkt 256fpkt", shape=diamond, color=yellow];
1442[label="194.193.66.205;d;129pkt 129fpkt", shape=diamond, color=yellow];
2900[label="131.5.177.237;285pkt 285fpkt", shape=pentagon, color=darkviolet];
3423[label="131.5.177.237;285pkt 285fpkt", shape=invtriangle, color=brown];
3707[label="131.5.177.237;286pkt 286fpkt", shape=invhouse, color=bisque];
stat217[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.177.237:*, 194.193.66.205:80}[44.5993%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2557: (0.223048%)&lt;BR/&gt; 2553: (0.223048%)&lt;BR/&gt; 2551: (0.223048%)&lt;BR/&gt; 2550: (0.223048%)&gt;];
}
113--1071[label="1;104pkt 104fpkt"];
113--1442[label="0.673077;70pkt 70fpkt"];
113--2900[label="1;104pkt 104fpkt"];
113--3423[label="1;104pkt 104fpkt"];
113--3707[label="1;104pkt 104fpkt"];
1071--1442[label="0.992248;128pkt 128fpkt"];
1071--2900[label="0.996094;255pkt 255fpkt"];
1071--3423[label="0.996094;255pkt 255fpkt"];
1071--3707[label="1;256pkt 256fpkt"];
1442--1876[label="0.0123457;1pkt 1fpkt"];
1442--2360[label="0.00847458;1pkt 1fpkt"];
1442--2900[label="0.992248;128pkt 128fpkt"];
1442--3141[label="0.00847458;1pkt 1fpkt"];
1442--3423[label="0.992248;128pkt 128fpkt"];
1442--3707[label="0.992248;128pkt 128fpkt"];
2900--3423[label="1;285pkt 285fpkt"];
2900--3707[label="1;285pkt 285fpkt"];
3423--3707[label="1;285pkt 285fpkt"];
</description>
    <slice>
      <filter dst_ip="194.193.66.205" dst_port="80" src_ip="131.5.177.237"/>
    </slice>
    <from sec="1115269225" usec="0"/>
    <to sec="1115269933" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_218{
style=filled;
color=gray75;
1451[label="210.53.135.100;s;13pkt 13fpkt", shape=diamond, color=yellow];
1456[label="223.84.131.138;d;3pkt 3fpkt", shape=diamond, color=yellow];
stat218[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.53.135.100:3901, *:53}[64.2857%]&lt;BR/&gt;{*:*, 223.84.131.138:*}[21.4286%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (31.25%)&lt;BR/&gt; 3901: (28.125%)&lt;BR/&gt; 53853: (6.25%)&lt;BR/&gt; 53849: (6.25%)&lt;BR/&gt; 110: (6.25%)&gt;];
}
1451--1456[label="0.666667;2pkt 2fpkt"];
1456--2707[label="0.333333;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="223.84.131.138"/>
      <filter dst_port="53" src_ip="210.53.135.100" src_port="3901"/>
    </slice>
    <from sec="1115269598" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.827641,1.7154,503,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_219{
style=filled;
color=gray75;
24[label="131.5.190.86s;3pkt 3fpkt", shape=rectangle, color=red];
1464[label="192.110.225.255;d;18pkt 18fpkt", shape=diamond, color=yellow];
stat219[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.190.86:*, 192.110.225.255:80}[94.7368%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 17815: (4.7619%)&lt;BR/&gt; 17814: (4.7619%)&lt;BR/&gt; 17871: (2.38095%)&lt;BR/&gt; 17822: (2.38095%)&gt;];
}
24--799[label="1;3pkt 3fpkt"];
24--1464[label="0.666667;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="192.110.225.255" dst_port="80" src_ip="131.5.190.86"/>
    </slice>
    <from sec="1115269608" usec="0"/>
    <to sec="1115269959" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.859378,1.64748,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_221{
style=filled;
color=gray75;
797[label="149.188.174.64;d;195pkt 195fpkt", shape=diamond, color=yellow];
828[label="207.157.153.151;s;10pkt 10fpkt", shape=diamond, color=yellow];
2204[label="206.88.19.42;6pkt 6fpkt", shape=pentagon, color=darkviolet];
2584[label="207.157.153.151;40pkt 40fpkt", shape=pentagon, color=darkviolet];
2653[label="207.137.84.170;5pkt 5fpkt", shape=pentagon, color=darkviolet];
2908[label="211.214.146.240;5pkt 5fpkt", shape=pentagon, color=darkviolet];
3258[label="207.157.153.151;39pkt 39fpkt", shape=invtriangle, color=brown];
3429[label="211.214.146.240;5pkt 5fpkt", shape=invtriangle, color=brown];
3622[label="207.157.153.151;40pkt 40fpkt", shape=invhouse, color=bisque];
3710[label="211.214.146.240;4pkt 4fpkt", shape=invhouse, color=bisque];
stat221[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.157.153.151:80, 149.188.174.64:*}[20.5128%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3155: (0.716332%)&lt;BR/&gt; 3154: (0.716332%)&lt;BR/&gt; 3153: (0.716332%)&lt;BR/&gt; 3152: (0.716332%)&gt;];
}
797--828[label="1;10pkt 10fpkt"];
797--1477[label="1;14pkt 14fpkt"];
797--1932[label="1;14pkt 14fpkt"];
797--1983[label="0.0205128;4pkt 4fpkt"];
797--1989[label="0.112821;22pkt 22fpkt"];
797--1997[label="0.205128;40pkt 40fpkt"];
797--2004[label="0.0358974;7pkt 7fpkt"];
797--2015[label="0.112821;22pkt 22fpkt"];
797--2020[label="0.205128;40pkt 40fpkt"];
797--2024[label="0.0358974;7pkt 7fpkt"];
797--2031[label="0.205128;40pkt 40fpkt"];
797--2035[label="0.0358974;7pkt 7fpkt"];
797--2204[label="1;6pkt 6fpkt"];
797--2473[label="0.435897;17pkt 17fpkt"];
797--2584[label="1;40pkt 40fpkt"];
797--2653[label="1;5pkt 5fpkt"];
797--2700[label="0.921053;35pkt 35fpkt"];
797--2898[label="1;14pkt 14fpkt"];
797--2908[label="1;5pkt 5fpkt"];
797--3198[label="0.435897;17pkt 17fpkt"];
797--3258[label="1;39pkt 39fpkt"];
797--3321[label="0.918919;34pkt 34fpkt"];
797--3429[label="1;5pkt 5fpkt"];
797--3622[label="1;40pkt 40fpkt"];
797--3659[label="0.918919;34pkt 34fpkt"];
797--3710[label="1;4pkt 4fpkt"];
828--2584[label="1;10pkt 10fpkt"];
828--3258[label="1;10pkt 10fpkt"];
828--3622[label="1;10pkt 10fpkt"];
2584--3258[label="1;39pkt 39fpkt"];
2584--3622[label="1;40pkt 40fpkt"];
2908--3429[label="1;5pkt 5fpkt"];
2908--3710[label="1;4pkt 4fpkt"];
3258--3622[label="1;39pkt 39fpkt"];
3429--3710[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.174.64" src_ip="207.157.153.151" src_port="80"/>
    </slice>
    <from sec="1115269227" usec="0"/>
    <to sec="1115270023" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="20.160.199.81"/>
      <from sec="1115269200" usec="0"/>
      <to sec="1115270028" usec="0"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.908565,1.67978,010,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_223{
style=filled;
color=gray75;
506[label="131.4.108.160;s;908pkt 908fpkt", shape=diamond, color=yellow];
539[label="131.4.164.144;s;302pkt 302fpkt", shape=diamond, color=yellow];
1490[label="196.203.14.3;d;615pkt 615fpkt", shape=diamond, color=yellow];
1755[label="131.4.164.144;s;126pkt 126fpkt", shape=hexagon, color=black];
1830[label="131.4.108.160;s;841pkt 841fpkt", shape=hexagon, color=black];
2619[label="131.4.108.160;961pkt 961fpkt", shape=pentagon, color=darkviolet];
stat223[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.108.160:25, 196.203.14.3:*}[47.943%]&lt;BR/&gt;{131.4.164.144:*, *:*}[23.8924%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (49.9201%)&lt;BR/&gt; 2780: (0.0932587%)&lt;BR/&gt; 2762: (0.0932587%)&lt;BR/&gt; 2749: (0.0932587%)&lt;BR/&gt; 2687: (0.0932587%)&gt;];
}
506--1490[label="0.926829;570pkt 570fpkt"];
506--1830[label="1;841pkt 841fpkt"];
506--2619[label="0.998899;907pkt 907fpkt"];
539--1490[label="0.149007;45pkt 45fpkt"];
539--1755[label="1;126pkt 126fpkt"];
1490--1755[label="0.111111;14pkt 14fpkt"];
1490--1830[label="0.852033;524pkt 524fpkt"];
1490--2619[label="0.926829;570pkt 570fpkt"];
1830--2619[label="0.998811;840pkt 840fpkt"];
</description>
    <slice>
      <filter src_ip="131.4.164.144"/>
      <filter dst_ip="196.203.14.3" src_ip="131.4.108.160" src_port="25"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.967126,1.64128,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_224{
style=filled;
color=gray75;
1125[label="131.5.11.144;s;126pkt 126fpkt", shape=diamond, color=yellow];
1495[label="194.193.8.146;d;2pkt 2fpkt", shape=diamond, color=yellow];
1891[label="131.5.11.144;s;126pkt 126fpkt", shape=hexagon, color=black];
2557[label="131.5.11.144;128pkt 128fpkt", shape=pentagon, color=darkviolet];
3242[label="131.5.11.144;128pkt 128fpkt", shape=invtriangle, color=brown];
stat224[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.11.144:*, 194.24.160.68:80}[35.1562%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.2353%)&lt;BR/&gt; 1755: (0.980392%)&lt;BR/&gt; 1401: (0.490196%)&lt;BR/&gt; 1400: (0.490196%)&lt;BR/&gt; 8987: (0.392157%)&gt;];
}
1125--1495[label="1;2pkt 2fpkt"];
1125--1891[label="1;126pkt 126fpkt"];
1125--2557[label="1;126pkt 126fpkt"];
1125--3242[label="1;126pkt 126fpkt"];
1495--1891[label="1;2pkt 2fpkt"];
1495--2557[label="1;2pkt 2fpkt"];
1495--3242[label="1;2pkt 2fpkt"];
1891--2557[label="1;126pkt 126fpkt"];
1891--3242[label="1;126pkt 126fpkt"];
2557--3242[label="1;128pkt 128fpkt"];
</description>
    <slice>
      <filter dst_ip="194.24.160.68" dst_port="80" src_ip="131.5.11.144"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="171.76.43.84"/>
      <from sec="1115269200" usec="0"/>
      <to sec="1115269938" usec="0"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115269938" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="211.178.208.74"/>
      <from sec="1115269201" usec="0"/>
      <to sec="1115270028" usec="0"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.719356,1.73275,901,0 0 0 0 0 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_227{
style=filled;
color=gray75;
2300[label="194.225.90.67;2pkt 2fpkt", shape=pentagon, color=darkviolet];
3538[label="194.225.90.67;2pkt 2fpkt", shape=invhouse, color=bisque];
stat227[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.225.90.67:80, 172.195.115.93:3390}[50%]&lt;BR/&gt;{194.225.90.67:80, 172.195.115.93:3391}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3391: (25%)&lt;BR/&gt; 3390: (25%)&gt;];
}
2300--3106[label="1;2pkt 2fpkt"];
2300--3538[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="172.195.115.93" dst_port="3391" src_ip="194.225.90.67" src_port="80"/>
      <filter dst_ip="172.195.115.93" dst_port="3390" src_ip="194.225.90.67" src_port="80"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.827641,1.7154,502,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_228{
style=filled;
color=gray75;
158[label="210.68.154.246s;1pkt 1fpkt", shape=rectangle, color=red];
1540[label="204.160.137.36;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat228[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.19.90.246:22, 204.160.137.36:49153}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 49153: (50%)&lt;BR/&gt; 22: (50%)&gt;];
}
158--1540[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="204.160.137.36" dst_port="49153" src_ip="211.19.90.246" src_port="22"/>
    </slice>
    <from sec="1115269384" usec="0"/>
    <to sec="1115269945" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="69.102.213.42"/>
      <from sec="1115269423" usec="0"/>
      <to sec="1115269932" usec="0"/>
    </slice>
    <from sec="1115269423" usec="0"/>
    <to sec="1115269932" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="64.112.46.173"/>
      <from sec="1115269694" usec="0"/>
      <to sec="1115269918" usec="0"/>
    </slice>
    <from sec="1115269694" usec="0"/>
    <to sec="1115269918" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_231{
style=filled;
color=gray75;
1537[label="131.5.26.208;s;3pkt 3fpkt", shape=diamond, color=yellow];
1565[label="21.20.197.149;d;2pkt 2fpkt", shape=diamond, color=yellow];
stat231[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.26.208:33027, 214.12.132.13:1863}[25%]&lt;BR/&gt;{131.5.26.208:33695, 67.182.182.57:80}[25%]&lt;BR/&gt;{131.5.26.208:33696, 21.20.197.149:80}[25%]&lt;BR/&gt;{131.5.26.208:33698, 21.20.197.149:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (40%)&lt;BR/&gt; 33696: (20%)&lt;BR/&gt; 33698: (10%)&lt;BR/&gt; 33695: (10%)&lt;BR/&gt; 33027: (10%)&gt;];
}
1537--1565[label="0.5;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="21.20.197.149" dst_port="80" src_ip="131.5.26.208" src_port="33698"/>
      <filter dst_ip="21.20.197.149" dst_port="80" src_ip="131.5.26.208" src_port="33696"/>
      <filter dst_ip="67.182.182.57" dst_port="80" src_ip="131.5.26.208" src_port="33695"/>
      <filter dst_ip="214.12.132.13" dst_port="1863" src_ip="131.5.26.208" src_port="33027"/>
    </slice>
    <from sec="1115269222" usec="0"/>
    <to sec="1115270017" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_232{
style=filled;
color=gray75;
1571[label="131.4.29.148;s;82pkt 82fpkt", shape=diamond, color=yellow];
stat232[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.29.148:*, 69.246.52.104:80}[24.3902%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (34.7561%)&lt;BR/&gt; 7001: (1.82927%)&lt;BR/&gt; 1077: (1.82927%)&lt;BR/&gt; 443: (1.21951%)&lt;BR/&gt; 50911: (0.609756%)&gt;];
}
1571--1662[label="0.0121951;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="69.246.52.104" dst_port="80" src_ip="131.4.29.148"/>
    </slice>
    <from sec="1115269772" usec="0"/>
    <to sec="1115269938" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.827641,1.7154,999,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_233{
style=filled;
color=gray75;
64[label="211.19.90.226s;1pkt 1fpkt", shape=rectangle, color=red];
589[label="211.19.90.226;s;758pkt 758fpkt", shape=diamond, color=yellow];
802[label="128.192.95.25;d;52pkt 52fpkt", shape=diamond, color=yellow];
1573[label="69.196.147.57;d;21pkt 21fpkt", shape=diamond, color=yellow];
1591[label="204.26.107.6;d;14pkt 14fpkt", shape=diamond, color=yellow];
stat233[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.19.90.226:*, 214.139.77.33:80}[22.3097%]&lt;BR/&gt;{211.19.90.226:*, *:53}[20.4724%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (33.9835%)&lt;BR/&gt; 53: (9.33806%)&lt;BR/&gt; 443: (2.36407%)&lt;BR/&gt; 0: (2.24586%)&lt;BR/&gt; 6346: (0.70922%)&gt;];
}
64--589[label="1;1pkt 1fpkt"];
64--1573[label="1;1pkt 1fpkt"];
589--802[label="1;52pkt 52fpkt"];
589--1415[label="0.0307692;2pkt 2fpkt"];
589--1482[label="0.0322581;2pkt 2fpkt"];
589--1520[label="0.0294118;2pkt 2fpkt"];
589--1532[label="0.0298507;2pkt 2fpkt"];
589--1573[label="0.952381;20pkt 20fpkt"];
589--1591[label="0.785714;11pkt 11fpkt"];
589--1606[label="0.0285714;2pkt 2fpkt"];
589--1616[label="0.0138889;1pkt 1fpkt"];
589--1618[label="0.0212766;1pkt 1fpkt"];
589--1633[label="0.0151515;1pkt 1fpkt"];
589--1635[label="0.0135135;1pkt 1fpkt"];
589--1644[label="0.0142857;1pkt 1fpkt"];
589--1659[label="0.00645161;1pkt 1fpkt"];
589--1662[label="0.0434783;4pkt 4fpkt"];
589--1674[label="0.0454545;3pkt 3fpkt"];
589--1950[label="0.0454545;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_port="53" src_ip="211.19.90.226"/>
      <filter dst_ip="214.139.77.33" dst_port="80" src_ip="211.19.90.226"/>
    </slice>
    <from sec="1115269202" usec="0"/>
    <to sec="1115270027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842681,1.61149,001,1 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_234{
style=filled;
color=gray75;
27[label="133.190.76.109s;2pkt 2fpkt", shape=rectangle, color=red];
1298[label="133.190.76.109;s;54pkt 54fpkt", shape=diamond, color=yellow];
1320[label="206.148.58.168;d;5pkt 5fpkt", shape=diamond, color=yellow];
1408[label="133.190.76.108;s;56pkt 56fpkt", shape=diamond, color=yellow];
1586[label="200.184.10.112;d;425pkt 425fpkt", shape=diamond, color=yellow];
1708[label="194.218.193.135;d;404pkt 404fpkt", shape=diamond, color=yellow];
2446[label="133.190.76.109;2pkt 2fpkt", shape=pentagon, color=darkviolet];
3179[label="133.190.76.108;56pkt 56fpkt", shape=invtriangle, color=brown];
3180[label="133.190.76.109;2pkt 2fpkt", shape=invtriangle, color=brown];
stat234[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 200.184.10.112:*}[45.7481%]&lt;BR/&gt;{*:*, 194.218.193.135:*}[43.4876%]&lt;BR/&gt;{*:1023, *:*}[29.4941%]&lt;BR/&gt;{*:5554, *:*}[29.2788%]&lt;BR/&gt;{*:9898, *:*}[29.1712%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1023: (13.9165%)&lt;BR/&gt; 5554: (13.8171%)&lt;BR/&gt; 9898: (13.668%)&lt;BR/&gt; 80: (7.20676%)&lt;BR/&gt; 0: (0.795229%)&gt;];
}
27--1298[label="1;2pkt 2fpkt"];
27--1320[label="1;2pkt 2fpkt"];
1298--1320[label="1;5pkt 5fpkt"];
1298--1586[label="0.0555556;3pkt 3fpkt"];
1298--1708[label="0.0555556;3pkt 3fpkt"];
1298--2446[label="0.5;1pkt 1fpkt"];
1298--3180[label="0.5;1pkt 1fpkt"];
1320--2446[label="0.5;1pkt 1fpkt"];
1320--3180[label="0.5;1pkt 1fpkt"];
1408--1586[label="0.0357143;2pkt 2fpkt"];
1408--1662[label="0.0357143;2pkt 2fpkt"];
1408--1674[label="0.0178571;1pkt 1fpkt"];
1408--1708[label="0.0535714;3pkt 3fpkt"];
1408--1950[label="0.0178571;1pkt 1fpkt"];
1408--3179[label="1;56pkt 56fpkt"];
1586--1922[label="0.0108696;3pkt 3fpkt"];
1586--2294[label="0.00705882;3pkt 3fpkt"];
1586--2706[label="0.142857;3pkt 3fpkt"];
1586--2712[label="0.0491803;3pkt 3fpkt"];
1586--2799[label="0.00925926;3pkt 3fpkt"];
1586--3179[label="0.0357143;2pkt 2fpkt"];
1586--3323[label="0.136364;3pkt 3fpkt"];
1586--3661[label="0.142857;3pkt 3fpkt"];
1708--1922[label="0.0108696;3pkt 3fpkt"];
1708--2294[label="0.0049505;2pkt 2fpkt"];
1708--2706[label="0.0952381;2pkt 2fpkt"];
1708--2712[label="0.0491803;3pkt 3fpkt"];
1708--2799[label="0.00925926;3pkt 3fpkt"];
1708--3179[label="0.0535714;3pkt 3fpkt"];
1708--3323[label="0.136364;3pkt 3fpkt"];
1708--3661[label="0.0952381;2pkt 2fpkt"];
2446--3180[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="200.184.10.112"/>
      <filter dst_ip="194.218.193.135"/>
      <filter src_port="1023"/>
      <filter src_port="5554"/>
      <filter src_port="9898"/>
    </slice>
    <from sec="1115269203" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_235{
style=filled;
color=gray75;
1356[label="220.30.88.31;s;218pkt 218fpkt", shape=diamond, color=yellow];
1599[label="171.76.90.104;d;200pkt 200fpkt", shape=diamond, color=yellow];
stat235[shape=component, label=&lt;Rules:&lt;BR/&gt;{220.30.88.31:6667, 171.76.90.104:*}[89.9543%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (47.3684%)&lt;BR/&gt; 113: (1.31579%)&lt;BR/&gt; 6666: (0.358852%)&lt;BR/&gt; 6661: (0.358852%)&lt;BR/&gt; 4950: (0.239234%)&gt;];
}
1356--1599[label="0.995;199pkt 199fpkt"];
</description>
    <slice>
      <filter dst_ip="171.76.90.104" src_ip="220.30.88.31" src_port="6667"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.540993,1.70541,020,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_236{
style=filled;
color=gray75;
1128[label="222.192.149.13;s;372pkt 372fpkt", shape=diamond, color=yellow];
1601[label="213.210.199.149;d;17pkt 17fpkt", shape=diamond, color=yellow];
2099[label="222.192.149.13;396pkt 396fpkt", shape=pentagon, color=darkviolet];
stat236[shape=component, label=&lt;Rules:&lt;BR/&gt;{222.192.149.13:0, *:0}[96.1165%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1128--1505[label="0.00346021;1pkt 1fpkt"];
1128--1601[label="0.0588235;1pkt 1fpkt"];
1128--2099[label="1;372pkt 372fpkt"];
1601--1640[label="0.0588235;1pkt 1fpkt"];
1601--2099[label="0.0588235;1pkt 1fpkt"];
1601--2694[label="0.0588235;1pkt 1fpkt"];
1601--3657[label="0.0588235;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="222.192.149.13"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="20.160.199.80"/>
      <from sec="1115269200" usec="0"/>
      <to sec="1115270028" usec="0"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="172.195.175.131"/>
      <from sec="1115269200" usec="0"/>
      <to sec="1115270028" usec="0"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.95405,1.74342,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_239{
style=filled;
color=gray75;
1243[label="171.76.48.75;s;1pkt 1fpkt", shape=diamond, color=yellow];
1623[label="211.241.217.58;d;1pkt 1fpkt", shape=diamond, color=yellow];
1940[label="171.76.48.75;s;1pkt 1fpkt", shape=hexagon, color=black];
stat239[shape=component, label=&lt;Rules:&lt;BR/&gt;{171.76.48.75:1382, 211.241.217.58:6665}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6665: (50%)&lt;BR/&gt; 1382: (50%)&gt;];
}
1243--1623[label="1;1pkt 1fpkt"];
1243--1940[label="1;1pkt 1fpkt"];
1623--1940[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="211.241.217.58" dst_port="6665" src_ip="171.76.48.75" src_port="1382"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.540993,1.70541,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_242{
style=filled;
color=gray75;
767[label="68.112.13.193;d;1pkt 1fpkt", shape=diamond, color=yellow];
768[label="131.5.216.251;s;12pkt 12fpkt", shape=diamond, color=yellow];
2949[label="131.5.216.251;15pkt 15fpkt", shape=pentagon, color=darkviolet];
stat242[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.216.251:49152, *:53}[93.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 49152: (44.6429%)&lt;BR/&gt; 53: (44.6429%)&lt;BR/&gt; 2099: (5.35714%)&lt;BR/&gt; 110: (5.35714%)&gt;];
}
767--768[label="1;1pkt 1fpkt"];
767--2949[label="1;1pkt 1fpkt"];
768--1633[label="0.0833333;1pkt 1fpkt"];
768--2949[label="1;12pkt 12fpkt"];
</description>
    <slice>
      <filter dst_port="53" src_ip="131.5.216.251" src_port="49152"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270071" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="200.24.109.6"/>
      <from sec="1115269201" usec="0"/>
      <to sec="1115270027" usec="0"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="207.150.80.68"/>
      <from sec="1115269623" usec="0"/>
      <to sec="1115270028" usec="0"/>
    </slice>
    <from sec="1115269623" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.859378,1.64748,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_245{
style=filled;
color=gray75;
1724[label="131.4.70.138;s;6pkt 6fpkt", shape=diamond, color=yellow];
1727[label="215.83.59.188;d;1pkt 1fpkt", shape=diamond, color=yellow];
2537[label="131.4.70.138;5pkt 5fpkt", shape=pentagon, color=darkviolet];
3227[label="131.4.70.138;5pkt 5fpkt", shape=invtriangle, color=brown];
3607[label="131.4.70.138;5pkt 5fpkt", shape=invhouse, color=bisque];
stat245[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.70.138:*, *:80}[33.3333%]&lt;BR/&gt;{131.4.70.138:*, *:2848}[33.3333%]&lt;BR/&gt;{131.4.70.138:*, 214.12.38.139:*}[33.3333%]&lt;BR/&gt;{131.4.70.138:*, 215.83.59.187:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (18.1818%)&lt;BR/&gt; 2848: (13.6364%)&lt;BR/&gt; 2847: (9.09091%)&lt;BR/&gt; 1063: (9.09091%)&lt;BR/&gt; 1062: (9.09091%)&gt;];
}
1724--1727[label="1;1pkt 1fpkt"];
1724--2537[label="1;5pkt 5fpkt"];
1724--3227[label="1;5pkt 5fpkt"];
1724--3607[label="1;5pkt 5fpkt"];
2537--3227[label="1;5pkt 5fpkt"];
2537--3607[label="1;5pkt 5fpkt"];
3227--3607[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="215.83.59.187" src_ip="131.4.70.138"/>
      <filter dst_ip="214.12.38.139" src_ip="131.4.70.138"/>
      <filter dst_port="2848" src_ip="131.4.70.138"/>
      <filter dst_port="80" src_ip="131.4.70.138"/>
    </slice>
    <from sec="1115269964" usec="0"/>
    <to sec="1115270073" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.06446,1.62418,503,1 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_248{
style=filled;
color=gray75;
54[label="131.4.108.208s;4pkt 4fpkt", shape=rectangle, color=red];
91[label="216.9.201.241d;3pkt 3fpkt", shape=rectangle, color=red];
116[label="69.174.191.44d;11pkt 11fpkt", shape=rectangle, color=red];
124[label="130.86.216.236d;1pkt 1fpkt", shape=rectangle, color=red];
206[label="59.44.208.41d;8pkt 8fpkt", shape=rectangle, color=red];
208[label="197.44.66.149d;3pkt 3fpkt", shape=rectangle, color=red];
577[label="131.4.108.208;s;1169pkt 1169fpkt", shape=diamond, color=yellow];
654[label="59.44.208.41;d;228pkt 228fpkt", shape=diamond, color=yellow];
835[label="172.195.17.93;s;110pkt 110fpkt", shape=diamond, color=yellow];
1300[label="151.146.34.197;d;9pkt 9fpkt", shape=diamond, color=yellow];
1441[label="69.174.191.44;d;95pkt 95fpkt", shape=diamond, color=yellow];
1525[label="131.4.41.141;s;54pkt 54fpkt", shape=diamond, color=yellow];
1760[label="131.4.108.208;s;677pkt 677fpkt", shape=hexagon, color=black];
1938[label="172.195.17.93;s;110pkt 110fpkt", shape=hexagon, color=black];
2388[label="172.195.17.93;111pkt 111fpkt", shape=pentagon, color=darkviolet];
stat248[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.108.208:*, *:80}[69.1157%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (45.0829%)&lt;BR/&gt; 443: (4.68569%)&lt;BR/&gt; 3552: (0.115696%)&lt;BR/&gt; 3179: (0.115696%)&lt;BR/&gt; 51007: (0.0964134%)&gt;];
}
54--577[label="1;4pkt 4fpkt"];
54--1300[label="0.5;2pkt 2fpkt"];
54--1760[label="0.25;1pkt 1fpkt"];
91--577[label="1;3pkt 3fpkt"];
91--1760[label="1;3pkt 3fpkt"];
116--577[label="1;11pkt 11fpkt"];
116--1441[label="1;11pkt 11fpkt"];
116--1760[label="1;11pkt 11fpkt"];
124--577[label="1;1pkt 1fpkt"];
124--1760[label="1;1pkt 1fpkt"];
206--577[label="0.25;2pkt 2fpkt"];
206--584[label="0.25;2pkt 2fpkt"];
206--654[label="0.75;6pkt 6fpkt"];
206--835[label="0.75;6pkt 6fpkt"];
206--1760[label="0.25;2pkt 2fpkt"];
206--1938[label="0.75;6pkt 6fpkt"];
206--2388[label="0.75;6pkt 6fpkt"];
208--577[label="1;3pkt 3fpkt"];
208--929[label="1;3pkt 3fpkt"];
208--1760[label="1;3pkt 3fpkt"];
577--584[label="0.888889;8pkt 8fpkt"];
577--654[label="0.00438596;1pkt 1fpkt"];
577--681[label="0.0542169;18pkt 18fpkt"];
577--738[label="0.0243902;1pkt 1fpkt"];
577--782[label="0.00456621;1pkt 1fpkt"];
577--929[label="0.55;11pkt 11fpkt"];
577--931[label="0.0151515;1pkt 1fpkt"];
577--982[label="0.175;7pkt 7fpkt"];
577--1036[label="0.4;2pkt 2fpkt"];
577--1077[label="0.5;2pkt 2fpkt"];
577--1182[label="0.148936;14pkt 14fpkt"];
577--1192[label="0.631579;12pkt 12fpkt"];
577--1300[label="0.222222;2pkt 2fpkt"];
577--1405[label="0.511111;46pkt 46fpkt"];
577--1441[label="0.147368;14pkt 14fpkt"];
577--1509[label="0.00990099;1pkt 1fpkt"];
577--1662[label="0.119565;11pkt 11fpkt"];
577--1674[label="0.151515;10pkt 10fpkt"];
577--1675[label="0.0163934;1pkt 1fpkt"];
577--1685[label="0.0425532;4pkt 4fpkt"];
577--1760[label="1;677pkt 677fpkt"];
577--1950[label="0.151515;10pkt 10fpkt"];
654--700[label="0.307018;70pkt 70fpkt"];
654--835[label="1;110pkt 110fpkt"];
654--1525[label="0.037037;2pkt 2fpkt"];
654--1813[label="0.377049;69pkt 69fpkt"];
654--1912[label="0.00877193;2pkt 2fpkt"];
654--1938[label="1;110pkt 110fpkt"];
654--2388[label="0.981982;109pkt 109fpkt"];
654--2567[label="0.00877193;2pkt 2fpkt"];
654--2802[label="0.00877193;2pkt 2fpkt"];
654--3246[label="0.00877193;2pkt 2fpkt"];
654--3374[label="0.00877193;2pkt 2fpkt"];
835--1938[label="1;110pkt 110fpkt"];
835--2388[label="0.990909;109pkt 109fpkt"];
1300--1760[label="0.111111;1pkt 1fpkt"];
1300--2802[label="0.777778;7pkt 7fpkt"];
1300--3374[label="0.777778;7pkt 7fpkt"];
1441--1760[label="0.115789;11pkt 11fpkt"];
1441--1874[label="0.52459;32pkt 32fpkt"];
1441--2698[label="0.365591;34pkt 34fpkt"];
1441--2767[label="0.642857;27pkt 27fpkt"];
1441--2802[label="0.126316;12pkt 12fpkt"];
1441--2882[label="0.0736842;7pkt 7fpkt"];
1441--3355[label="0.642857;27pkt 27fpkt"];
1441--3374[label="0.126316;12pkt 12fpkt"];
1441--3410[label="0.0736842;7pkt 7fpkt"];
1441--3697[label="0.0736842;7pkt 7fpkt"];
1525--1662[label="0.037037;2pkt 2fpkt"];
1525--1675[label="0.166667;9pkt 9fpkt"];
1760--1950[label="0.106061;7pkt 7fpkt"];
1938--2388[label="0.990909;109pkt 109fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="131.4.108.208"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.95405,1.74342,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_250{
style=filled;
color=gray75;
672[label="67.72.234.24;s;1pkt 1fpkt", shape=diamond, color=yellow];
1778[label="67.72.234.24;s;1pkt 1fpkt", shape=hexagon, color=black];
stat250[shape=component, label=&lt;Rules:&lt;BR/&gt;{67.72.234.24:1353, 210.53.128.195:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1353: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
672--1778[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="210.53.128.195" dst_port="80" src_ip="67.72.234.24" src_port="1353"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270001" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.95405,1.74342,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_251{
style=filled;
color=gray75;
686[label="194.24.165.153;s;1pkt 1fpkt", shape=diamond, color=yellow];
1781[label="194.24.165.153;s;1pkt 1fpkt", shape=hexagon, color=black];
stat251[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.24.165.153:1755, 131.5.50.90:1173}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1755: (50%)&lt;BR/&gt; 1173: (50%)&gt;];
}
686--1781[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="131.5.50.90" dst_port="1173" src_ip="194.24.165.153" src_port="1755"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.95405,1.74342,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_252{
style=filled;
color=gray75;
694[label="171.76.32.204;s;9pkt 9fpkt", shape=diamond, color=yellow];
1113[label="64.160.23.97;d;5pkt 5fpkt", shape=diamond, color=yellow];
1783[label="171.76.32.204;s;9pkt 9fpkt", shape=hexagon, color=black];
stat252[shape=component, label=&lt;Rules:&lt;BR/&gt;{171.76.32.204:*, 64.160.23.97:2401}[55.5556%]&lt;BR/&gt;{171.76.32.204:1025, *:53}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2401: (32.6087%)&lt;BR/&gt; 1025: (8.69565%)&lt;BR/&gt; 53: (8.69565%)&lt;BR/&gt; 33366: (6.52174%)&lt;BR/&gt; 1043: (6.52174%)&gt;];
}
694--1113[label="1;5pkt 5fpkt"];
694--1783[label="1;9pkt 9fpkt"];
1113--1783[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="64.160.23.97" dst_port="2401" src_ip="171.76.32.204"/>
      <filter dst_port="53" src_ip="171.76.32.204" src_port="1025"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.10354,1.68992,999,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_253{
style=filled;
color=gray75;
112[label="172.195.14.221s;8pkt 8fpkt", shape=rectangle, color=red];
599[label="172.195.14.221;s;210pkt 210fpkt", shape=diamond, color=yellow];
1072[label="21.215.48.178;d;27pkt 27fpkt", shape=diamond, color=yellow];
1342[label="21.212.6.85;d;10pkt 10fpkt", shape=diamond, color=yellow];
1712[label="21.215.13.205;d;14pkt 14fpkt", shape=diamond, color=yellow];
1792[label="172.195.14.221;s;49pkt 49fpkt", shape=hexagon, color=black];
stat253[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.14.221:*, *:80}[35.7143%]&lt;BR/&gt;{172.195.14.221:*, 21.215.48.178:9548}[23.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9548: (33.6478%)&lt;BR/&gt; 80: (16.0377%)&lt;BR/&gt; 2120: (0.314465%)&lt;BR/&gt; 2118: (0.314465%)&lt;BR/&gt; 2116: (0.314465%)&gt;];
}
112--599[label="1;8pkt 8fpkt"];
599--1072[label="1;27pkt 27fpkt"];
599--1342[label="1;10pkt 10fpkt"];
599--1712[label="1;14pkt 14fpkt"];
599--1792[label="1;49pkt 49fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="172.195.14.221"/>
      <filter dst_ip="21.215.48.178" dst_port="9548" src_ip="172.195.14.221"/>
    </slice>
    <from sec="1115269203" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.95405,1.74342,001,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_255{
style=filled;
color=gray75;
634[label="203.210.152.85;s;1766pkt 1766fpkt", shape=diamond, color=yellow];
1796[label="203.210.152.85;s;1766pkt 1766fpkt", shape=hexagon, color=black];
stat255[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.210.152.85:*, *:1023}[38.6183%]&lt;BR/&gt;{203.210.152.85:*, *:5554}[35.9003%]&lt;BR/&gt;{203.210.152.85:*, *:9898}[25.4813%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1023: (19.3092%)&lt;BR/&gt; 5554: (17.9502%)&lt;BR/&gt; 9898: (12.7407%)&lt;BR/&gt; 4920: (1.61382%)&lt;BR/&gt; 4993: (1.55719%)&gt;];
}
634--1796[label="1;1766pkt 1766fpkt"];
634--1993[label="0.00370714;4pkt 4fpkt"];
634--2008[label="0.000566251;1pkt 1fpkt"];
634--2017[label="0.00462963;5pkt 5fpkt"];
1796--1993[label="0.00370714;4pkt 4fpkt"];
1796--2008[label="0.000566251;1pkt 1fpkt"];
1796--2017[label="0.00462963;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_port="1023" src_ip="203.210.152.85"/>
      <filter dst_port="5554" src_ip="203.210.152.85"/>
      <filter dst_port="9898" src_ip="203.210.152.85"/>
    </slice>
    <from sec="1115269268" usec="0"/>
    <to sec="1115269335" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.95405,1.74342,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_256{
style=filled;
color=gray75;
739[label="67.182.182.49;s;10pkt 10fpkt", shape=diamond, color=yellow];
1799[label="172.195.52.33;d;3pkt 3fpkt", shape=hexagon, color=black];
1814[label="67.182.182.49;s;7pkt 7fpkt", shape=hexagon, color=black];
stat256[shape=component, label=&lt;Rules:&lt;BR/&gt;{67.182.182.49:80, 172.195.52.33:*}[70%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4356: (7.5%)&lt;BR/&gt; 4355: (7.5%)&lt;BR/&gt; 4354: (7.5%)&lt;BR/&gt; 4353: (5%)&gt;];
}
739--817[label="0.333333;1pkt 1fpkt"];
739--1799[label="1;3pkt 3fpkt"];
739--1814[label="1;7pkt 7fpkt"];
1799--1814[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="172.195.52.33" src_ip="67.182.182.49" src_port="80"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.967126,1.64128,001,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_257{
style=filled;
color=gray75;
623[label="203.214.72.123;d;742pkt 742fpkt", shape=diamond, color=yellow];
1102[label="131.5.128.93;s;6pkt 6fpkt", shape=diamond, color=yellow];
1484[label="197.168.66.135;d;2pkt 2fpkt", shape=diamond, color=yellow];
1822[label="131.5.128.93;s;6pkt 6fpkt", shape=hexagon, color=black];
2671[label="131.5.165.176;64pkt 64fpkt", shape=pentagon, color=darkviolet];
3305[label="131.5.165.176;63pkt 63fpkt", shape=invtriangle, color=brown];
stat257[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:5554, 203.214.72.123:*}[28.7841%]&lt;BR/&gt;{*:9898, 203.214.72.123:*}[28.66%]&lt;BR/&gt;{*:1023, 203.214.72.123:*}[28.4119%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (13.3635%)&lt;BR/&gt; 9898: (13.3069%)&lt;BR/&gt; 1023: (13.1937%)&lt;BR/&gt; 0: (7.02152%)&lt;BR/&gt; 53: (6.56852%)&gt;];
}
623--1102[label="0.5;3pkt 3fpkt"];
623--1217[label="0.0037594;1pkt 1fpkt"];
623--1822[label="0.5;3pkt 3fpkt"];
623--1883[label="0.00409836;1pkt 1fpkt"];
623--2306[label="0.04;1pkt 1fpkt"];
623--2466[label="0.00337838;1pkt 1fpkt"];
623--2671[label="0.046875;3pkt 3fpkt"];
623--3305[label="0.047619;3pkt 3fpkt"];
1102--1484[label="1;2pkt 2fpkt"];
1102--1822[label="1;6pkt 6fpkt"];
1484--1822[label="1;2pkt 2fpkt"];
2671--3305[label="1;63pkt 63fpkt"];
</description>
    <slice>
      <filter dst_ip="203.214.72.123" src_port="5554"/>
      <filter dst_ip="203.214.72.123" src_port="9898"/>
      <filter dst_ip="203.214.72.123" src_port="1023"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270085" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.95405,1.74342,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_258{
style=filled;
color=gray75;
851[label="92.208.143.220;s;1pkt 1fpkt", shape=diamond, color=yellow];
1827[label="92.208.143.220;s;1pkt 1fpkt", shape=hexagon, color=black];
stat258[shape=component, label=&lt;Rules:&lt;BR/&gt;{92.208.143.220:49209, 210.53.128.195:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 49209: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
851--1827[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="210.53.128.195" dst_port="80" src_ip="92.208.143.220" src_port="49209"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115269757" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.95405,1.74342,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_259{
style=filled;
color=gray75;
1139[label="211.209.90.61;s;930pkt 930fpkt", shape=diamond, color=yellow];
1839[label="211.209.90.61;s;516pkt 516fpkt", shape=hexagon, color=black];
stat259[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.209.90.61:1076, *:1434}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1434: (50%)&lt;BR/&gt; 1076: (50%)&gt;];
}
1139--1839[label="1;516pkt 516fpkt"];
</description>
    <slice>
      <filter dst_port="1434" src_ip="211.209.90.61" src_port="1076"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.95405,1.74342,010,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_260{
style=filled;
color=gray75;
1172[label="131.5.121.2;s;95pkt 95fpkt", shape=diamond, color=yellow];
1846[label="131.5.121.2;s;64pkt 64fpkt", shape=hexagon, color=black];
stat260[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.121.2:*, *:25}[80%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (49.6855%)&lt;BR/&gt; 62511: (0.628931%)&lt;BR/&gt; 33668: (0.628931%)&lt;BR/&gt; 33667: (0.628931%)&lt;BR/&gt; 33666: (0.628931%)&gt;];
}
1172--1846[label="1;64pkt 64fpkt"];
</description>
    <slice>
      <filter dst_port="25" src_ip="131.5.121.2"/>
    </slice>
    <from sec="1115269212" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.614324,1.76813,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_261{
style=filled;
color=gray75;
508[label="21.20.211.12;d;101pkt 101fpkt", shape=diamond, color=yellow];
511[label="131.5.140.64;s;167pkt 167fpkt", shape=diamond, color=yellow];
stat261[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.140.64:80, 21.20.211.12:*}[92.2156%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 60974: (0.373134%)&lt;BR/&gt; 60833: (0.373134%)&lt;BR/&gt; 60831: (0.373134%)&lt;BR/&gt; 59820: (0.373134%)&gt;];
}
508--511[label="1;101pkt 101fpkt"];
508--1856[label="0.387755;38pkt 38fpkt"];
508--1997[label="0.138614;14pkt 14fpkt"];
508--2004[label="0.128713;13pkt 13fpkt"];
508--2020[label="0.138614;14pkt 14fpkt"];
508--2024[label="0.128713;13pkt 13fpkt"];
508--2031[label="0.138614;14pkt 14fpkt"];
508--2035[label="0.128713;13pkt 13fpkt"];
511--581[label="0.0419162;7pkt 7fpkt"];
511--1856[label="1;98pkt 98fpkt"];
511--1983[label="0.0958084;16pkt 16fpkt"];
511--1989[label="0.101796;17pkt 17fpkt"];
511--1997[label="0.0838323;14pkt 14fpkt"];
511--2004[label="0.101796;17pkt 17fpkt"];
511--2015[label="0.101796;17pkt 17fpkt"];
511--2020[label="0.0838323;14pkt 14fpkt"];
511--2024[label="0.101796;17pkt 17fpkt"];
511--2031[label="0.0838323;14pkt 14fpkt"];
511--2035[label="0.101796;17pkt 17fpkt"];
</description>
    <slice>
      <filter dst_ip="21.20.211.12" src_ip="131.5.140.64" src_port="80"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.95405,1.74342,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_262{
style=filled;
color=gray75;
1228[label="206.93.28.234;s;1pkt 1fpkt", shape=diamond, color=yellow];
1858[label="206.93.28.234;s;1pkt 1fpkt", shape=hexagon, color=black];
stat262[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.93.28.234:33968, 210.53.133.104:39153}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 39153: (50%)&lt;BR/&gt; 33968: (50%)&gt;];
}
1228--1858[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="210.53.133.104" dst_port="39153" src_ip="206.93.28.234" src_port="33968"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.95405,1.74342,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_263{
style=filled;
color=gray75;
1238[label="149.188.175.93;d;3pkt 3fpkt", shape=diamond, color=yellow];
1239[label="207.137.76.196;s;1pkt 1fpkt", shape=diamond, color=yellow];
1860[label="207.137.76.196;s;1pkt 1fpkt", shape=hexagon, color=black];
stat263[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.220.68.37:8000, 149.188.175.93:2178}[33.3333%]&lt;BR/&gt;{207.137.67.136:8000, 149.188.175.93:4000}[33.3333%]&lt;BR/&gt;{207.137.76.196:8000, 149.188.175.93:2149}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8000: (50%)&lt;BR/&gt; 2149: (30%)&lt;BR/&gt; 4000: (10%)&lt;BR/&gt; 2178: (10%)&gt;];
}
1238--1239[label="1;1pkt 1fpkt"];
1238--1860[label="1;1pkt 1fpkt"];
1239--1860[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.175.93" dst_port="2149" src_ip="207.137.76.196" src_port="8000"/>
      <filter dst_ip="149.188.175.93" dst_port="4000" src_ip="207.137.67.136" src_port="8000"/>
      <filter dst_ip="149.188.175.93" dst_port="2178" src_ip="211.220.68.37" src_port="8000"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.967126,1.64128,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_264{
style=filled;
color=gray75;
1302[label="131.5.190.82;s;81pkt 81fpkt", shape=diamond, color=yellow];
1876[label="131.5.190.82;s;81pkt 81fpkt", shape=hexagon, color=black];
2360[label="131.5.190.82;118pkt 118fpkt", shape=pentagon, color=darkviolet];
3141[label="131.5.190.82;118pkt 118fpkt", shape=invtriangle, color=brown];
stat264[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.190.82:*, *:80}[99.1525%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.4975%)&lt;BR/&gt; 17376: (0.502513%)&lt;BR/&gt; 3522: (0.502513%)&lt;BR/&gt; 3511: (0.502513%)&lt;BR/&gt; 3510: (0.502513%)&gt;];
}
1302--1442[label="0.0123457;1pkt 1fpkt"];
1302--1876[label="1;81pkt 81fpkt"];
1302--2360[label="1;81pkt 81fpkt"];
1302--3141[label="1;81pkt 81fpkt"];
1876--2360[label="1;81pkt 81fpkt"];
1876--3141[label="1;81pkt 81fpkt"];
2360--3141[label="1;118pkt 118fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="131.5.190.82"/>
    </slice>
    <from sec="1115269266" usec="0"/>
    <to sec="1115270094" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.95405,1.74342,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_265{
style=filled;
color=gray75;
652[label="206.57.176.112;s;1pkt 1fpkt", shape=diamond, color=yellow];
1882[label="206.57.176.112;s;1pkt 1fpkt", shape=hexagon, color=black];
stat265[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.57.176.112:51352, 149.188.205.117:4880}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 51352: (50%)&lt;BR/&gt; 4880: (50%)&gt;];
}
652--1882[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.205.117" dst_port="4880" src_ip="206.57.176.112" src_port="51352"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115269898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.95405,1.74342,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_266{
style=filled;
color=gray75;
1123[label="194.33.135.88;s;1pkt 1fpkt", shape=diamond, color=yellow];
1889[label="194.33.135.88;s;1pkt 1fpkt", shape=hexagon, color=black];
stat266[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.33.135.88:3604, 149.188.233.235:1777}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3604: (50%)&lt;BR/&gt; 1777: (50%)&gt;];
}
1123--1889[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.233.235" dst_port="1777" src_ip="194.33.135.88" src_port="3604"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115269867" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.95405,1.74342,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_267{
style=filled;
color=gray75;
1395[label="211.216.180.109;s;643pkt 643fpkt", shape=diamond, color=yellow];
1897[label="211.216.180.109;s;573pkt 573fpkt", shape=hexagon, color=black];
stat267[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.216.180.109:1034, *:1434}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1434: (50%)&lt;BR/&gt; 1034: (50%)&gt;];
}
1395--1897[label="1;573pkt 573fpkt"];
</description>
    <slice>
      <filter dst_port="1434" src_ip="211.216.180.109" src_port="1034"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.95405,1.74342,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_268{
style=filled;
color=gray75;
1448[label="203.157.136.89;s;1pkt 1fpkt", shape=diamond, color=yellow];
1455[label="172.195.41.193;d;1pkt 1fpkt", shape=diamond, color=yellow];
1902[label="203.157.136.89;s;1pkt 1fpkt", shape=hexagon, color=black];
stat268[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.157.136.89:3944, 172.195.41.193:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3944: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
1448--1455[label="1;1pkt 1fpkt"];
1448--1902[label="1;1pkt 1fpkt"];
1455--1902[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="172.195.41.193" dst_port="80" src_ip="203.157.136.89" src_port="3944"/>
    </slice>
    <from sec="1115269567" usec="0"/>
    <to sec="1115270027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.95405,1.74342,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_269{
style=filled;
color=gray75;
647[label="211.213.168.96;s;4pkt 4fpkt", shape=diamond, color=yellow];
1914[label="211.213.168.96;s;4pkt 4fpkt", shape=hexagon, color=black];
stat269[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.213.168.96:28419, 210.53.133.104:873}[25%]&lt;BR/&gt;{211.213.168.96:28584, 210.53.133.104:873}[25%]&lt;BR/&gt;{211.213.168.96:28878, 210.53.133.104:873}[25%]&lt;BR/&gt;{211.213.168.96:29214, 210.53.133.104:873}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 873: (50%)&lt;BR/&gt; 29214: (12.5%)&lt;BR/&gt; 28878: (12.5%)&lt;BR/&gt; 28584: (12.5%)&lt;BR/&gt; 28419: (12.5%)&gt;];
}
647--1914[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="210.53.133.104" dst_port="873" src_ip="211.213.168.96" src_port="29214"/>
      <filter dst_ip="210.53.133.104" dst_port="873" src_ip="211.213.168.96" src_port="28878"/>
      <filter dst_ip="210.53.133.104" dst_port="873" src_ip="211.213.168.96" src_port="28584"/>
      <filter dst_ip="210.53.133.104" dst_port="873" src_ip="211.213.168.96" src_port="28419"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.95405,1.74342,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_270{
style=filled;
color=gray75;
1222[label="20.160.199.89;s;735pkt 735fpkt", shape=diamond, color=yellow];
1916[label="20.160.199.89;s;735pkt 735fpkt", shape=hexagon, color=black];
stat270[shape=component, label=&lt;Rules:&lt;BR/&gt;{20.160.199.89:4460, *:1434}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4460: (50%)&lt;BR/&gt; 1434: (50%)&gt;];
}
1222--1916[label="1;735pkt 735fpkt"];
</description>
    <slice>
      <filter dst_port="1434" src_ip="20.160.199.89" src_port="4460"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.908565,1.67978,010,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_271{
style=filled;
color=gray75;
861[label="207.156.74.75;s;1140pkt 1140fpkt", shape=diamond, color=yellow];
1917[label="207.156.74.75;s;1020pkt 1020fpkt", shape=hexagon, color=black];
2337[label="207.156.74.75;1237pkt 1237fpkt", shape=pentagon, color=darkviolet];
stat271[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.156.74.75:9159, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9159: (50%)&lt;BR/&gt; 7855: (0.13247%)&lt;BR/&gt; 6953: (0.13247%)&lt;BR/&gt; 5161: (0.13247%)&lt;BR/&gt; 3094: (0.13247%)&gt;];
}
861--1917[label="1;1020pkt 1020fpkt"];
861--2337[label="0.999123;1139pkt 1139fpkt"];
1917--2337[label="0.99902;1019pkt 1019fpkt"];
</description>
    <slice>
      <filter src_ip="207.156.74.75" src_port="9159"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.95405,1.74342,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_272{
style=filled;
color=gray75;
1231[label="203.162.133.67;s;1pkt 1fpkt", shape=diamond, color=yellow];
1918[label="203.162.133.67;s;1pkt 1fpkt", shape=hexagon, color=black];
stat272[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.162.133.67:4617, 149.188.205.117:4880}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4880: (50%)&lt;BR/&gt; 4617: (50%)&gt;];
}
1231--1918[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.205.117" dst_port="4880" src_ip="203.162.133.67" src_port="4617"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.95405,1.74342,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_273{
style=filled;
color=gray75;
1437[label="210.169.69.60;s;1pkt 1fpkt", shape=diamond, color=yellow];
1928[label="210.169.69.60;s;1pkt 1fpkt", shape=hexagon, color=black];
stat273[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.169.69.60:53156, 210.53.128.195:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53156: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
1437--1928[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="210.53.128.195" dst_port="80" src_ip="210.169.69.60" src_port="53156"/>
    </slice>
    <from sec="1115269402" usec="0"/>
    <to sec="1115269788" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.908565,1.67978,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_275{
style=filled;
color=gray75;
1477[label="64.93.55.237;s;14pkt 14fpkt", shape=diamond, color=yellow];
1932[label="64.93.55.237;s;14pkt 14fpkt", shape=hexagon, color=black];
2898[label="64.93.55.237;14pkt 14fpkt", shape=pentagon, color=darkviolet];
stat275[shape=component, label=&lt;Rules:&lt;BR/&gt;{64.93.55.237:80, 149.188.174.64:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3188: (3.57143%)&lt;BR/&gt; 3187: (3.57143%)&lt;BR/&gt; 3186: (3.57143%)&lt;BR/&gt; 3185: (3.57143%)&gt;];
}
1477--1932[label="1;14pkt 14fpkt"];
1477--2898[label="1;14pkt 14fpkt"];
1932--2898[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.174.64" src_ip="64.93.55.237" src_port="80"/>
    </slice>
    <from sec="1115269841" usec="0"/>
    <to sec="1115269849" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.908565,1.67978,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_276{
style=filled;
color=gray75;
1242[label="211.241.217.58;s;1pkt 1fpkt", shape=diamond, color=yellow];
1373[label="171.76.48.75;d;1pkt 1fpkt", shape=diamond, color=yellow];
1939[label="211.241.217.58;s;1pkt 1fpkt", shape=hexagon, color=black];
2264[label="211.241.217.58;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat276[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.241.217.58:6665, 171.76.48.75:1382}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6665: (50%)&lt;BR/&gt; 1382: (50%)&gt;];
}
1242--1373[label="1;1pkt 1fpkt"];
1242--1939[label="1;1pkt 1fpkt"];
1242--2264[label="1;1pkt 1fpkt"];
1373--1939[label="1;1pkt 1fpkt"];
1373--2264[label="1;1pkt 1fpkt"];
1939--2264[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="171.76.48.75" dst_port="1382" src_ip="211.241.217.58" src_port="6665"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.540993,1.70541,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_278{
style=filled;
color=gray75;
1669[label="131.5.114.7;s;9pkt 9fpkt", shape=diamond, color=yellow];
2073[label="131.5.114.7;9pkt 9fpkt", shape=pentagon, color=darkviolet];
stat278[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.114.7:*, 21.190.174.221:80}[33.3333%]&lt;BR/&gt;{131.5.114.7:*, 202.137.2.81:80}[22.2222%]&lt;BR/&gt;{131.5.114.7:*, 21.190.175.141:80}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (38.8889%)&lt;BR/&gt; 33698: (5.55556%)&lt;BR/&gt; 33653: (5.55556%)&lt;BR/&gt; 33648: (5.55556%)&lt;BR/&gt; 33626: (5.55556%)&gt;];
}
1669--1947[label="1;9pkt 9fpkt"];
1669--2073[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="21.190.174.221" dst_port="80" src_ip="131.5.114.7"/>
      <filter dst_ip="21.190.175.141" dst_port="80" src_ip="131.5.114.7"/>
      <filter dst_ip="202.137.2.81" dst_port="80" src_ip="131.5.114.7"/>
    </slice>
    <from sec="1115269212" usec="0"/>
    <to sec="1115270088" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.95405,1.74342,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_280{
style=filled;
color=gray75;
1446[label="194.247.17.200;s;1pkt 1fpkt", shape=diamond, color=yellow];
1952[label="194.247.17.200;s;1pkt 1fpkt", shape=hexagon, color=black];
stat280[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.247.17.200:19101, 149.188.170.237:1825}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 19101: (50%)&lt;BR/&gt; 1825: (50%)&gt;];
}
1446--1952[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.170.237" dst_port="1825" src_ip="194.247.17.200" src_port="19101"/>
    </slice>
    <from sec="1115269546" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.95405,1.74342,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_281{
style=filled;
color=gray75;
1556[label="133.190.111.150;s;20pkt 20fpkt", shape=diamond, color=yellow];
1953[label="133.190.111.150;s;20pkt 20fpkt", shape=hexagon, color=black];
stat281[shape=component, label=&lt;Rules:&lt;BR/&gt;{133.190.111.150:*, 204.123.209.214:80}[60%]&lt;BR/&gt;{133.190.111.150:*, 59.40.102.62:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 49344: (2.5%)&lt;BR/&gt; 49343: (2.5%)&lt;BR/&gt; 49342: (2.5%)&lt;BR/&gt; 49341: (2.5%)&gt;];
}
1556--1953[label="1;20pkt 20fpkt"];
</description>
    <slice>
      <filter dst_ip="204.123.209.214" dst_port="80" src_ip="133.190.111.150"/>
      <filter dst_ip="59.40.102.62" dst_port="80" src_ip="133.190.111.150"/>
    </slice>
    <from sec="1115269613" usec="0"/>
    <to sec="1115270009" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.967126,1.64128,999,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_283{
style=filled;
color=gray75;
1134[label="133.33.218.226;s;226pkt 226fpkt", shape=diamond, color=yellow];
1866[label="133.33.218.226;s;180pkt 180fpkt", shape=hexagon, color=black];
2862[label="133.33.218.226;239pkt 239fpkt", shape=pentagon, color=darkviolet];
3401[label="133.33.218.226;240pkt 240fpkt", shape=invtriangle, color=brown];
stat283[shape=component, label=&lt;Rules:&lt;BR/&gt;{133.33.218.226:64794, *:53}[61.25%]&lt;BR/&gt;{133.33.218.226:53, *:*}[26.25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (44.2373%)&lt;BR/&gt; 64794: (31.2429%)&lt;BR/&gt; 25: (6.21469%)&lt;BR/&gt; 32768: (0.79096%)&lt;BR/&gt; 32772: (0.39548%)&gt;];
}
1134--1415[label="0.0153846;1pkt 1fpkt"];
1134--1482[label="0.016129;1pkt 1fpkt"];
1134--1520[label="0.0147059;1pkt 1fpkt"];
1134--1532[label="0.0149254;1pkt 1fpkt"];
1134--1566[label="0.0714286;1pkt 1fpkt"];
1134--1606[label="0.0142857;1pkt 1fpkt"];
1134--1616[label="0.0138889;1pkt 1fpkt"];
1134--1617[label="0.0322581;1pkt 1fpkt"];
1134--1618[label="0.0212766;1pkt 1fpkt"];
1134--1633[label="0.0151515;1pkt 1fpkt"];
1134--1635[label="0.0135135;1pkt 1fpkt"];
1134--1644[label="0.0142857;1pkt 1fpkt"];
1134--1659[label="0.00645161;1pkt 1fpkt"];
1134--1866[label="1;180pkt 180fpkt"];
1134--1982[label="0.0265487;6pkt 6fpkt"];
1134--1988[label="0.039823;9pkt 9fpkt"];
1134--1996[label="0.0221239;5pkt 5fpkt"];
1134--2003[label="0.0265487;6pkt 6fpkt"];
1134--2014[label="0.039823;9pkt 9fpkt"];
1134--2019[label="0.0221239;5pkt 5fpkt"];
1134--2023[label="0.0265487;6pkt 6fpkt"];
1134--2030[label="0.0221239;5pkt 5fpkt"];
1134--2034[label="0.0265487;6pkt 6fpkt"];
1134--2862[label="0.995575;225pkt 225fpkt"];
1134--3401[label="1;226pkt 226fpkt"];
1866--1982[label="0.0333333;6pkt 6fpkt"];
1866--1988[label="0.05;9pkt 9fpkt"];
1866--1996[label="0.0166667;3pkt 3fpkt"];
1866--2003[label="0.0166667;3pkt 3fpkt"];
1866--2014[label="0.05;9pkt 9fpkt"];
1866--2019[label="0.0166667;3pkt 3fpkt"];
1866--2023[label="0.0166667;3pkt 3fpkt"];
1866--2030[label="0.0166667;3pkt 3fpkt"];
1866--2034[label="0.0166667;3pkt 3fpkt"];
1866--2862[label="0.994444;179pkt 179fpkt"];
1866--3401[label="1;180pkt 180fpkt"];
2862--3401[label="1;239pkt 239fpkt"];
</description>
    <slice>
      <filter src_ip="133.33.218.226" src_port="53"/>
      <filter dst_port="53" src_ip="133.33.218.226" src_port="64794"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.5.3.0"/>
    </slice>
    <from sec="1115269226" usec="0"/>
    <to sec="1115270099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.53.137.0"/>
    </slice>
    <from sec="1115269202" usec="0"/>
    <to sec="1115270095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.5.148.0"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="66.3.188.0"/>
    </slice>
    <from sec="1115269493" usec="0"/>
    <to sec="1115269691" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.234.17.1"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.25.21.1"/>
    </slice>
    <from sec="1115269212" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.195.108.1"/>
    </slice>
    <from sec="1115269222" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.4.155.1"/>
    </slice>
    <from sec="1115269224" usec="0"/>
    <to sec="1115270076" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="69.49.101.2"/>
    </slice>
    <from sec="1115269203" usec="0"/>
    <to sec="1115270092" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="69.216.158.2"/>
    </slice>
    <from sec="1115269206" usec="0"/>
    <to sec="1115270097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,051,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="171.76.246.4"/>
    </slice>
    <from sec="1115269216" usec="0"/>
    <to sec="1115269937" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.859378,1.64748,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_301{
style=filled;
color=gray75;
426[label="69.41.103.209;d;1pkt 1fpkt", shape=diamond, color=yellow];
427[label="171.76.42.5;s;40pkt 40fpkt", shape=diamond, color=yellow];
2062[label="171.76.42.5;40pkt 40fpkt", shape=pentagon, color=darkviolet];
2969[label="171.76.42.5;39pkt 39fpkt", shape=invtriangle, color=brown];
3464[label="171.76.42.5;39pkt 39fpkt", shape=invhouse, color=bisque];
stat301[shape=component, label=&lt;Rules:&lt;BR/&gt;{171.76.42.5:*, *:6881}[42.5%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6881: (21.3836%)&lt;BR/&gt; 1906: (2.51572%)&lt;BR/&gt; 53: (2.51572%)&lt;BR/&gt; 20103: (1.57233%)&lt;BR/&gt; 7041: (1.57233%)&gt;];
}
426--427[label="1;1pkt 1fpkt"];
426--2062[label="1;1pkt 1fpkt"];
426--2969[label="1;1pkt 1fpkt"];
426--3464[label="1;1pkt 1fpkt"];
427--1988[label="0.025;1pkt 1fpkt"];
427--2014[label="0.025;1pkt 1fpkt"];
427--2062[label="1;40pkt 40fpkt"];
427--2969[label="1;39pkt 39fpkt"];
427--3464[label="1;39pkt 39fpkt"];
2062--2969[label="1;39pkt 39fpkt"];
2062--3464[label="1;39pkt 39fpkt"];
2969--3464[label="1;39pkt 39fpkt"];
</description>
    <slice>
      <filter dst_port="6881" src_ip="171.76.42.5"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.5.92.5"/>
    </slice>
    <from sec="1115269295" usec="0"/>
    <to sec="1115270037" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="207.134.147.5"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="149.197.205.5"/>
    </slice>
    <from sec="1115269482" usec="0"/>
    <to sec="1115269880" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.4.29.6"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.893866,1.78883,503,0 0 0 0 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_306{
style=filled;
color=gray75;
1947[label="131.5.114.7;s;9pkt 9fpkt", shape=hexagon, color=black];
stat306[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.114.7:*, 21.190.174.221:80}[33.3333%]&lt;BR/&gt;{131.5.114.7:*, 202.137.2.81:80}[22.2222%]&lt;BR/&gt;{131.5.114.7:*, 21.190.175.141:80}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (38.8889%)&lt;BR/&gt; 33698: (5.55556%)&lt;BR/&gt; 33653: (5.55556%)&lt;BR/&gt; 33648: (5.55556%)&lt;BR/&gt; 33626: (5.55556%)&gt;];
}
1947--2073[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="21.190.174.221" dst_port="80" src_ip="131.5.114.7"/>
      <filter dst_ip="21.190.175.141" dst_port="80" src_ip="131.5.114.7"/>
      <filter dst_ip="202.137.2.81" dst_port="80" src_ip="131.5.114.7"/>
    </slice>
    <from sec="1115269212" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="69.141.165.7"/>
    </slice>
    <from sec="1115269760" usec="0"/>
    <to sec="1115269850" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.5.209.7"/>
    </slice>
    <from sec="1115269299" usec="0"/>
    <to sec="1115270001" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.0228,1.59075,503,1 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_309{
style=filled;
color=gray75;
95[label="131.4.30.8s;2pkt 2fpkt", shape=rectangle, color=red];
562[label="172.195.21.121;s;184pkt 184fpkt", shape=diamond, color=yellow];
931[label="193.52.22.93;d;66pkt 66fpkt", shape=diamond, color=yellow];
1191[label="131.4.30.8;s;40pkt 40fpkt", shape=diamond, color=yellow];
2077[label="131.4.30.8;45pkt 45fpkt", shape=pentagon, color=darkviolet];
2974[label="131.4.30.8;46pkt 46fpkt", shape=invtriangle, color=brown];
3467[label="131.4.30.8;45pkt 45fpkt", shape=invhouse, color=bisque];
stat309[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.21.121:*, 204.21.109.181:80}[60.1504%]&lt;BR/&gt;{*:*, 193.52.22.93:80}[24.812%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.0654%)&lt;BR/&gt; 33168: (1.0514%)&lt;BR/&gt; 32909: (1.0514%)&lt;BR/&gt; 32898: (1.0514%)&lt;BR/&gt; 32833: (1.0514%)&gt;];
}
95--931[label="1;2pkt 2fpkt"];
95--1191[label="1;2pkt 2fpkt"];
95--2077[label="1;2pkt 2fpkt"];
95--2974[label="1;2pkt 2fpkt"];
95--3467[label="1;2pkt 2fpkt"];
562--931[label="0.212121;14pkt 14fpkt"];
562--2479[label="1;183pkt 183fpkt"];
931--936[label="0.0333333;2pkt 2fpkt"];
931--1191[label="0.4;16pkt 16fpkt"];
931--2077[label="0.355556;16pkt 16fpkt"];
931--2462[label="0.469697;31pkt 31fpkt"];
931--2479[label="0.212121;14pkt 14fpkt"];
931--2591[label="0.0655738;4pkt 4fpkt"];
931--2974[label="0.347826;16pkt 16fpkt"];
931--3189[label="0.469697;31pkt 31fpkt"];
931--3262[label="0.0645161;4pkt 4fpkt"];
931--3467[label="0.355556;16pkt 16fpkt"];
931--3588[label="0.469697;31pkt 31fpkt"];
1191--2077[label="0.975;39pkt 39fpkt"];
1191--2974[label="1;40pkt 40fpkt"];
1191--3467[label="0.975;39pkt 39fpkt"];
2077--2974[label="1;45pkt 45fpkt"];
2077--3467[label="1;45pkt 45fpkt"];
2974--3467[label="1;45pkt 45fpkt"];
</description>
    <slice>
      <filter dst_ip="193.52.22.93" dst_port="80"/>
      <filter dst_ip="204.21.109.181" dst_port="80" src_ip="172.195.21.121"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.53.130.8"/>
    </slice>
    <from sec="1115269209" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.859378,1.64748,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_311{
style=filled;
color=gray75;
1041[label="131.4.176.8;s;56pkt 56fpkt", shape=diamond, color=yellow];
2079[label="131.4.176.8;55pkt 55fpkt", shape=pentagon, color=darkviolet];
2975[label="131.4.176.8;56pkt 56fpkt", shape=invtriangle, color=brown];
3468[label="131.4.176.8;56pkt 56fpkt", shape=invhouse, color=bisque];
stat311[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.176.8:*, 196.114.165.101:80}[57.1429%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 33763: (0.896861%)&lt;BR/&gt; 33741: (0.896861%)&lt;BR/&gt; 33706: (0.896861%)&lt;BR/&gt; 33693: (0.896861%)&gt;];
}
1041--2079[label="1;55pkt 55fpkt"];
1041--2975[label="1;56pkt 56fpkt"];
1041--3468[label="1;56pkt 56fpkt"];
2079--2975[label="1;55pkt 55fpkt"];
2079--3468[label="1;55pkt 55fpkt"];
2975--3468[label="1;56pkt 56fpkt"];
</description>
    <slice>
      <filter dst_ip="196.114.165.101" dst_port="80" src_ip="131.4.176.8"/>
    </slice>
    <from sec="1115269222" usec="0"/>
    <to sec="1115269693" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="133.190.77.9"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="69.14.132.10"/>
    </slice>
    <from sec="1115269405" usec="0"/>
    <to sec="1115269510" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="21.20.212.10"/>
    </slice>
    <from sec="1115270052" usec="0"/>
    <to sec="1115270057" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="67.126.56.11"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="67.110.62.12"/>
    </slice>
    <from sec="1115269207" usec="0"/>
    <to sec="1115269509" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="171.76.59.15"/>
    </slice>
    <from sec="1115269204" usec="0"/>
    <to sec="1115270087" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.5.185.16"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.634441,1.66751,010,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_319{
style=filled;
color=gray75;
517[label="192.168.254.254;d;454pkt 454fpkt", shape=diamond, color=yellow];
2108[label="172.203.44.17;42pkt 42fpkt", shape=pentagon, color=darkviolet];
2290[label="210.53.129.65;51pkt 51fpkt", shape=pentagon, color=darkviolet];
2518[label="210.53.129.134;4pkt 4fpkt", shape=pentagon, color=darkviolet];
2743[label="210.53.135.195;48pkt 48fpkt", shape=pentagon, color=darkviolet];
3214[label="210.53.129.134;4pkt 4fpkt", shape=invtriangle, color=brown];
3344[label="210.53.135.195;48pkt 48fpkt", shape=invtriangle, color=brown];
stat319[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 192.168.254.254:80}[93.8429%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.0046%)&lt;BR/&gt; 0: (3.53303%)&lt;BR/&gt; 6872: (0.768049%)&lt;BR/&gt; 445: (0.460829%)&lt;BR/&gt; 2994: (0.230415%)&gt;];
}
517--597[label="0.00220264;1pkt 1fpkt"];
517--1926[label="0.00220264;1pkt 1fpkt"];
517--2108[label="0.928571;39pkt 39fpkt"];
517--2290[label="0.960784;49pkt 49fpkt"];
517--2331[label="0.00220264;1pkt 1fpkt"];
517--2518[label="0.25;1pkt 1fpkt"];
517--2743[label="0.8125;39pkt 39fpkt"];
517--2915[label="0.00389105;1pkt 1fpkt"];
517--3214[label="0.25;1pkt 1fpkt"];
517--3344[label="0.8125;39pkt 39fpkt"];
517--3433[label="0.00387597;1pkt 1fpkt"];
2518--3214[label="1;4pkt 4fpkt"];
2743--3344[label="1;48pkt 48fpkt"];
</description>
    <slice>
      <filter dst_ip="192.168.254.254" dst_port="80"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.6.211.17"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.540993,1.70541,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_321{
style=filled;
color=gray75;
897[label="209.226.179.18;s;1pkt 1fpkt", shape=diamond, color=yellow];
2112[label="209.226.179.18;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat321[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.226.179.18:24160, 172.195.175.139:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 24160: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
897--2112[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="172.195.175.139" dst_port="80" src_ip="209.226.179.18" src_port="24160"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115269527" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.540993,1.70541,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_322{
style=filled;
color=gray75;
985[label="202.43.43.19;s;2pkt 2fpkt", shape=diamond, color=yellow];
2116[label="202.43.43.19;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat322[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.43.43.19:3804, 149.188.205.117:4880}[50%]&lt;BR/&gt;{202.43.43.19:3845, 149.188.205.117:4880}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4880: (50%)&lt;BR/&gt; 3804: (33.3333%)&lt;BR/&gt; 3845: (16.6667%)&gt;];
}
985--2116[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.205.117" dst_port="4880" src_ip="202.43.43.19" src_port="3845"/>
      <filter dst_ip="149.188.205.117" dst_port="4880" src_ip="202.43.43.19" src_port="3804"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.109.152.22"/>
    </slice>
    <from sec="1115269205" usec="0"/>
    <to sec="1115270096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.4.60.23"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.5.96.23"/>
    </slice>
    <from sec="1115269211" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.859378,1.64748,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_326{
style=filled;
color=gray75;
583[label="149.188.129.54;d;639pkt 639fpkt", shape=diamond, color=yellow];
633[label="194.24.160.68;s;13pkt 13fpkt", shape=diamond, color=yellow];
779[label="149.188.219.97;d;142pkt 142fpkt", shape=diamond, color=yellow];
914[label="64.138.169.95;s;1pkt 1fpkt", shape=diamond, color=yellow];
1344[label="68.36.47.95;s;1pkt 1fpkt", shape=diamond, color=yellow];
2055[label="69.174.69.3;32pkt 32fpkt", shape=pentagon, color=darkviolet];
2138[label="69.200.252.23;15pkt 15fpkt", shape=pentagon, color=darkviolet];
2165[label="66.6.165.31;23pkt 23fpkt", shape=pentagon, color=darkviolet];
2307[label="194.24.160.68;45pkt 45fpkt", shape=pentagon, color=darkviolet];
2333[label="206.48.44.74;32pkt 32fpkt", shape=pentagon, color=darkviolet];
2341[label="206.48.40.77;12pkt 12fpkt", shape=pentagon, color=darkviolet];
2362[label="192.84.122.83;72pkt 72fpkt", shape=pentagon, color=darkviolet];
2398[label="64.138.169.95;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2451[label="64.180.227.110;5pkt 5fpkt", shape=pentagon, color=darkviolet];
2700[label="21.20.213.182;38pkt 38fpkt", shape=pentagon, color=darkviolet];
2708[label="21.20.213.184;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2715[label="204.196.255.187;4pkt 4fpkt", shape=pentagon, color=darkviolet];
2789[label="66.3.166.206;11pkt 11fpkt", shape=pentagon, color=darkviolet];
2830[label="211.152.46.217;17pkt 17fpkt", shape=pentagon, color=darkviolet];
2837[label="211.152.46.221;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2917[label="21.39.123.243;25pkt 25fpkt", shape=pentagon, color=darkviolet];
2923[label="21.39.123.244;81pkt 81fpkt", shape=pentagon, color=darkviolet];
3028[label="66.6.165.31;23pkt 23fpkt", shape=invtriangle, color=brown];
3123[label="206.48.44.74;33pkt 33fpkt", shape=invtriangle, color=brown];
3128[label="206.48.40.77;13pkt 13fpkt", shape=invtriangle, color=brown];
3198[label="207.147.76.117;39pkt 39fpkt", shape=invtriangle, color=brown];
3321[label="21.20.213.182;37pkt 37fpkt", shape=invtriangle, color=brown];
3328[label="204.196.255.187;5pkt 5fpkt", shape=invtriangle, color=brown];
3435[label="21.39.123.243;24pkt 24fpkt", shape=invtriangle, color=brown];
3440[label="21.39.123.244;81pkt 81fpkt", shape=invtriangle, color=brown];
3502[label="66.6.165.31;23pkt 23fpkt", shape=invhouse, color=bisque];
3549[label="206.48.44.74;33pkt 33fpkt", shape=invhouse, color=bisque];
3566[label="68.36.47.95;1pkt 1fpkt", shape=invhouse, color=bisque];
3659[label="21.20.213.182;37pkt 37fpkt", shape=invhouse, color=bisque];
3664[label="204.196.255.187;5pkt 5fpkt", shape=invhouse, color=bisque];
3712[label="21.39.123.243;25pkt 25fpkt", shape=invhouse, color=bisque];
3715[label="21.39.123.244;81pkt 81fpkt", shape=invhouse, color=bisque];
stat326[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 149.188.129.54:*}[67.5676%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.4922%)&lt;BR/&gt; 4380: (0.149343%)&lt;BR/&gt; 26830: (0.119474%)&lt;BR/&gt; 26537: (0.119474%)&lt;BR/&gt; 23820: (0.119474%)&gt;];
}
583--633[label="0.0769231;1pkt 1fpkt"];
583--993[label="0.02;2pkt 2fpkt"];
583--1020[label="0.574468;27pkt 27fpkt"];
583--1062[label="0.6;3pkt 3fpkt"];
583--1154[label="0.0133333;1pkt 1fpkt"];
583--1251[label="0.117647;6pkt 6fpkt"];
583--1344[label="1;1pkt 1fpkt"];
583--1570[label="0.666667;4pkt 4fpkt"];
583--1841[label="0.0227273;2pkt 2fpkt"];
583--1868[label="0.178571;5pkt 5fpkt"];
583--1945[label="0.0133333;1pkt 1fpkt"];
583--1983[label="0.0516432;33pkt 33fpkt"];
583--1989[label="0.109546;70pkt 70fpkt"];
583--1997[label="0.0876369;56pkt 56fpkt"];
583--2004[label="0.056338;36pkt 36fpkt"];
583--2015[label="0.109546;70pkt 70fpkt"];
583--2020[label="0.0876369;56pkt 56fpkt"];
583--2024[label="0.056338;36pkt 36fpkt"];
583--2031[label="0.0876369;56pkt 56fpkt"];
583--2035[label="0.056338;36pkt 36fpkt"];
583--2055[label="1;32pkt 32fpkt"];
583--2138[label="0.933333;14pkt 14fpkt"];
583--2165[label="1;23pkt 23fpkt"];
583--2263[label="0.0285714;1pkt 1fpkt"];
583--2333[label="0.3125;10pkt 10fpkt"];
583--2341[label="1;12pkt 12fpkt"];
583--2362[label="0.902778;65pkt 65fpkt"];
583--2451[label="1;5pkt 5fpkt"];
583--2473[label="0.435897;17pkt 17fpkt"];
583--2700[label="0.0526316;2pkt 2fpkt"];
583--2708[label="1;2pkt 2fpkt"];
583--2715[label="0.25;1pkt 1fpkt"];
583--2727[label="0.00156495;1pkt 1fpkt"];
583--2774[label="0.0186916;2pkt 2fpkt"];
583--2789[label="0.272727;3pkt 3fpkt"];
583--2830[label="0.764706;13pkt 13fpkt"];
583--2837[label="0.666667;2pkt 2fpkt"];
583--2849[label="0.0833333;1pkt 1fpkt"];
583--2897[label="0.75;3pkt 3fpkt"];
583--2905[label="0.16;4pkt 4fpkt"];
583--3028[label="1;23pkt 23fpkt"];
583--3082[label="0.0285714;1pkt 1fpkt"];
583--3123[label="0.333333;11pkt 11fpkt"];
583--3128[label="1;13pkt 13fpkt"];
583--3198[label="0.435897;17pkt 17fpkt"];
583--3321[label="0.0540541;2pkt 2fpkt"];
583--3328[label="0.2;1pkt 1fpkt"];
583--3334[label="0.00156495;1pkt 1fpkt"];
583--3397[label="0.0833333;1pkt 1fpkt"];
583--3421[label="0.8;4pkt 4fpkt"];
583--3502[label="1;23pkt 23fpkt"];
583--3549[label="0.333333;11pkt 11fpkt"];
583--3566[label="1;1pkt 1fpkt"];
583--3659[label="0.0540541;2pkt 2fpkt"];
583--3664[label="0.2;1pkt 1fpkt"];
633--1371[label="0.923077;12pkt 12fpkt"];
633--1989[label="0.0769231;1pkt 1fpkt"];
633--2015[label="0.0769231;1pkt 1fpkt"];
633--2307[label="0.923077;12pkt 12fpkt"];
779--914[label="1;1pkt 1fpkt"];
779--1983[label="0.859155;122pkt 122fpkt"];
779--2333[label="0.0625;2pkt 2fpkt"];
779--2398[label="1;1pkt 1fpkt"];
779--2830[label="0.176471;3pkt 3fpkt"];
779--2837[label="0.333333;1pkt 1fpkt"];
779--2917[label="1;25pkt 25fpkt"];
779--2923[label="1;81pkt 81fpkt"];
779--3123[label="0.0606061;2pkt 2fpkt"];
779--3435[label="1;24pkt 24fpkt"];
779--3440[label="1;81pkt 81fpkt"];
779--3549[label="0.0606061;2pkt 2fpkt"];
779--3712[label="1;25pkt 25fpkt"];
779--3715[label="1;81pkt 81fpkt"];
914--2398[label="1;1pkt 1fpkt"];
1344--3566[label="1;1pkt 1fpkt"];
2165--3028[label="1;23pkt 23fpkt"];
2165--3502[label="1;23pkt 23fpkt"];
2333--3123[label="1;32pkt 32fpkt"];
2333--3549[label="1;32pkt 32fpkt"];
2341--3128[label="1;12pkt 12fpkt"];
2700--3321[label="1;37pkt 37fpkt"];
2700--3659[label="1;37pkt 37fpkt"];
2715--3328[label="1;4pkt 4fpkt"];
2715--3664[label="1;4pkt 4fpkt"];
2917--3435[label="1;24pkt 24fpkt"];
2917--3712[label="1;25pkt 25fpkt"];
2923--3440[label="1;81pkt 81fpkt"];
2923--3715[label="1;81pkt 81fpkt"];
3028--3502[label="1;23pkt 23fpkt"];
3123--3549[label="1;33pkt 33fpkt"];
3321--3659[label="1;37pkt 37fpkt"];
3328--3664[label="1;5pkt 5fpkt"];
3435--3712[label="1;24pkt 24fpkt"];
3440--3715[label="1;81pkt 81fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.129.54" src_port="80"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.24.24.24"/>
    </slice>
    <from sec="1115269206" usec="0"/>
    <to sec="1115269221" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.195.108.24"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115269886" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="67.72.234.24"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270002" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.88.161.25"/>
    </slice>
    <from sec="1115269339" usec="0"/>
    <to sec="1115269380" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.105.181.25"/>
    </slice>
    <from sec="1115269204" usec="0"/>
    <to sec="1115270053" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.209.70.26"/>
    </slice>
    <from sec="1115269208" usec="0"/>
    <to sec="1115270092" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="204.53.4.28"/>
    </slice>
    <from sec="1115269209" usec="0"/>
    <to sec="1115270099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.197.75.28"/>
    </slice>
    <from sec="1115269809" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="220.126.142.30"/>
    </slice>
    <from sec="1115269458" usec="0"/>
    <to sec="1115269488" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.540993,1.70541,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_336{
style=filled;
color=gray75;
1691[label="131.4.31.31;s;32pkt 32fpkt", shape=diamond, color=yellow];
2163[label="131.4.31.31;35pkt 35fpkt", shape=pentagon, color=darkviolet];
stat336[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.31.31:*, 222.211.153.162:80}[30.5556%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.5075%)&lt;BR/&gt; 51967: (1.49254%)&lt;BR/&gt; 51965: (1.49254%)&lt;BR/&gt; 51964: (1.49254%)&lt;BR/&gt; 51963: (1.49254%)&gt;];
}
1691--1697[label="0.423077;11pkt 11fpkt"];
1691--2163[label="0.96875;31pkt 31fpkt"];
</description>
    <slice>
      <filter dst_ip="222.211.153.162" dst_port="80" src_ip="131.4.31.31"/>
    </slice>
    <from sec="1115269698" usec="0"/>
    <to sec="1115270087" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="133.190.222.32"/>
    </slice>
    <from sec="1115269219" usec="0"/>
    <to sec="1115270089" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="21.193.71.34"/>
    </slice>
    <from sec="1115269475" usec="0"/>
    <to sec="1115269655" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.540993,1.70541,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_340{
style=filled;
color=gray75;
1269[label="131.5.172.34;s;52pkt 52fpkt", shape=diamond, color=yellow];
2177[label="131.5.172.34;53pkt 53fpkt", shape=pentagon, color=darkviolet];
stat340[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.172.34:*, *:25}[28.3019%]&lt;BR/&gt;{131.5.172.34:*, *:113}[28.3019%]&lt;BR/&gt;{131.5.172.34:25, *:*}[28.3019%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (28.0952%)&lt;BR/&gt; 113: (14.2857%)&lt;BR/&gt; 80: (6.66667%)&lt;BR/&gt; 2062: (1.90476%)&lt;BR/&gt; 58068: (0.952381%)&gt;];
}
1269--2177[label="1;52pkt 52fpkt"];
</description>
    <slice>
      <filter src_ip="131.5.172.34" src_port="25"/>
      <filter dst_port="113" src_ip="131.5.172.34"/>
      <filter dst_port="25" src_ip="131.5.172.34"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270058" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.4.146.35"/>
    </slice>
    <from sec="1115269202" usec="0"/>
    <to sec="1115270099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.93.170.36"/>
    </slice>
    <from sec="1115269431" usec="0"/>
    <to sec="1115269463" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="206.64.201.36"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="16.164.83.38"/>
    </slice>
    <from sec="1115269455" usec="0"/>
    <to sec="1115269466" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="89.103.88.38"/>
    </slice>
    <from sec="1115269202" usec="0"/>
    <to sec="1115270093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="68.239.157.38"/>
    </slice>
    <from sec="1115269705" usec="0"/>
    <to sec="1115269726" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.5.30.39"/>
    </slice>
    <from sec="1115269209" usec="0"/>
    <to sec="1115270092" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.966908,1.64039,002,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_348{
style=filled;
color=gray75;
130[label="16.238.130.40s;100pkt 100fpkt", shape=rectangle, color=red];
2195[label="16.238.130.40;254pkt 254fpkt", shape=pentagon, color=darkviolet];
3046[label="16.238.130.40;254pkt 254fpkt", shape=invtriangle, color=brown];
3509[label="16.238.130.40;255pkt 255fpkt", shape=invhouse, color=bisque];
stat348[shape=component, label=&lt;Rules:&lt;BR/&gt;{16.238.130.40:64439, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 64439: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
130--2195[label="0.99;99pkt 99fpkt"];
130--3046[label="0.99;99pkt 99fpkt"];
130--3509[label="1;100pkt 100fpkt"];
2195--3046[label="1;254pkt 254fpkt"];
2195--3509[label="1;254pkt 254fpkt"];
3046--3509[label="1;254pkt 254fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="16.238.130.40" src_port="64439"/>
    </slice>
    <from sec="1115269289" usec="0"/>
    <to sec="1115269302" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.967126,1.64128,999,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_349{
style=filled;
color=gray75;
546[label="21.38.195.40;s;3pkt 3fpkt", shape=diamond, color=yellow];
1787[label="21.38.195.40;s;2pkt 2fpkt", shape=hexagon, color=black];
2198[label="21.38.195.40;3pkt 3fpkt", shape=pentagon, color=darkviolet];
3048[label="21.38.195.40;2pkt 2fpkt", shape=invtriangle, color=brown];
stat349[shape=component, label=&lt;Rules:&lt;BR/&gt;{21.38.195.40:2008, 149.188.205.117:4880}[33.3333%]&lt;BR/&gt;{21.38.195.40:2021, 149.188.205.117:4880}[33.3333%]&lt;BR/&gt;{21.38.195.40:2765, 149.188.205.117:4880}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4880: (50%)&lt;BR/&gt; 2008: (20%)&lt;BR/&gt; 2765: (15%)&lt;BR/&gt; 2021: (15%)&gt;];
}
546--641[label="0.666667;2pkt 2fpkt"];
546--1787[label="1;2pkt 2fpkt"];
546--2198[label="1;3pkt 3fpkt"];
546--3048[label="1;2pkt 2fpkt"];
1787--2198[label="1;2pkt 2fpkt"];
1787--3048[label="0.5;1pkt 1fpkt"];
2198--3048[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.205.117" dst_port="4880" src_ip="21.38.195.40" src_port="2765"/>
      <filter dst_ip="149.188.205.117" dst_port="4880" src_ip="21.38.195.40" src_port="2021"/>
      <filter dst_ip="149.188.205.117" dst_port="4880" src_ip="21.38.195.40" src_port="2008"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.181.213.42"/>
    </slice>
    <from sec="1115269216" usec="0"/>
    <to sec="1115270099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.966908,1.64039,002,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_351{
style=filled;
color=gray75;
132[label="195.136.76.43s;40pkt 40fpkt", shape=rectangle, color=red];
2210[label="195.136.76.43;163pkt 163fpkt", shape=pentagon, color=darkviolet];
3055[label="195.136.76.43;162pkt 162fpkt", shape=invtriangle, color=brown];
3513[label="195.136.76.43;163pkt 163fpkt", shape=invhouse, color=bisque];
stat351[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.136.76.43:1033, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1033: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
132--2210[label="1;40pkt 40fpkt"];
132--3055[label="0.975;39pkt 39fpkt"];
132--3513[label="1;40pkt 40fpkt"];
2210--3055[label="1;162pkt 162fpkt"];
2210--3513[label="1;163pkt 163fpkt"];
3055--3513[label="1;162pkt 162fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="195.136.76.43" src_port="1033"/>
    </slice>
    <from sec="1115269969" usec="0"/>
    <to sec="1115270013" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.859378,1.64748,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_352{
style=filled;
color=gray75;
370[label="172.185.57.40;d;1862pkt 1862fpkt", shape=diamond, color=yellow];
2201[label="194.44.170.41;18pkt 18fpkt", shape=pentagon, color=darkviolet];
2213[label="195.205.204.43;37pkt 37fpkt", shape=pentagon, color=darkviolet];
2419[label="202.80.230.99;3pkt 3fpkt", shape=pentagon, color=darkviolet];
3166[label="202.80.230.99;4pkt 4fpkt", shape=invtriangle, color=brown];
3371[label="206.61.11.209;1pkt 1fpkt", shape=invtriangle, color=brown];
3575[label="202.80.230.99;3pkt 3fpkt", shape=invhouse, color=bisque];
3682[label="206.61.11.209;1pkt 1fpkt", shape=invhouse, color=bisque];
stat352[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 172.185.57.40:23006}[96.3646%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 23006: (48.1856%)&lt;BR/&gt; 0: (2.17729%)&lt;BR/&gt; 80: (0.388802%)&lt;BR/&gt; 443: (0.336962%)&lt;BR/&gt; 1034: (0.129601%)&gt;];
}
370--2201[label="1;18pkt 18fpkt"];
370--2213[label="0.027027;1pkt 1fpkt"];
370--2419[label="1;3pkt 3fpkt"];
370--3166[label="1;4pkt 4fpkt"];
370--3371[label="1;1pkt 1fpkt"];
370--3575[label="1;3pkt 3fpkt"];
370--3682[label="1;1pkt 1fpkt"];
2419--3166[label="1;3pkt 3fpkt"];
2419--3575[label="1;3pkt 3fpkt"];
3166--3575[label="1;3pkt 3fpkt"];
3371--3682[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="172.185.57.40" dst_port="23006"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="171.76.59.44"/>
    </slice>
    <from sec="1115269215" usec="0"/>
    <to sec="1115270096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="52.134.229.45"/>
    </slice>
    <from sec="1115269205" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.540993,1.70541,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_355{
style=filled;
color=gray75;
882[label="131.5.1.50;s;54pkt 54fpkt", shape=diamond, color=yellow];
1248[label="66.66.145.60;d;53pkt 53fpkt", shape=diamond, color=yellow];
2229[label="131.5.1.50;58pkt 58fpkt", shape=pentagon, color=darkviolet];
stat355[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.1.50:*, 66.66.145.60:80}[96.5517%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.4848%)&lt;BR/&gt; 54715: (0.909091%)&lt;BR/&gt; 54714: (0.909091%)&lt;BR/&gt; 54713: (0.909091%)&lt;BR/&gt; 54712: (0.909091%)&gt;];
}
882--1248[label="1;53pkt 53fpkt"];
882--2229[label="1;54pkt 54fpkt"];
1248--2229[label="1;53pkt 53fpkt"];
</description>
    <slice>
      <filter dst_ip="66.66.145.60" dst_port="80" src_ip="131.5.1.50"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.40.20.50"/>
    </slice>
    <from sec="1115269828" usec="0"/>
    <to sec="1115270033" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="64.176.131.50"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="207.80.165.50"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.4.186.52"/>
    </slice>
    <from sec="1115269568" usec="0"/>
    <to sec="1115270050" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="94.206.193.54"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="23.10.106.55"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="207.156.65.57"/>
    </slice>
    <from sec="1115269596" usec="0"/>
    <to sec="1115269683" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.3.193.57"/>
    </slice>
    <from sec="1115269217" usec="0"/>
    <to sec="1115270087" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="204.25.245.57"/>
    </slice>
    <from sec="1115270030" usec="0"/>
    <to sec="1115270051" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.195.110.58"/>
    </slice>
    <from sec="1115269867" usec="0"/>
    <to sec="1115270070" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.21.205.60"/>
    </slice>
    <from sec="1115269427" usec="0"/>
    <to sec="1115269438" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="66.8.213.61"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.195.241.61"/>
    </slice>
    <from sec="1115269239" usec="0"/>
    <to sec="1115270080" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.242.0.65"/>
    </slice>
    <from sec="1115269487" usec="0"/>
    <to sec="1115269676" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.634441,1.66751,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_370{
style=filled;
color=gray75;
1223[label="131.5.13.66;s;40pkt 40fpkt", shape=diamond, color=yellow];
2292[label="131.5.13.66;67pkt 67fpkt", shape=pentagon, color=darkviolet];
3102[label="131.5.13.66;68pkt 68fpkt", shape=invtriangle, color=brown];
stat370[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.13.66:25, *:*}[95.6522%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 62044: (0.857143%)&lt;BR/&gt; 59507: (0.857143%)&lt;BR/&gt; 59070: (0.857143%)&lt;BR/&gt; 56789: (0.857143%)&gt;];
}
1223--2292[label="0.95;38pkt 38fpkt"];
1223--3102[label="0.975;39pkt 39fpkt"];
2292--3102[label="1;67pkt 67fpkt"];
</description>
    <slice>
      <filter src_ip="131.5.13.66" src_port="25"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270081" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.162.133.67"/>
    </slice>
    <from sec="1115269204" usec="0"/>
    <to sec="1115270096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="207.150.80.68"/>
    </slice>
    <from sec="1115269624" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="171.76.104.68"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.5.8.69"/>
    </slice>
    <from sec="1115269210" usec="0"/>
    <to sec="1115270097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.0228,1.59075,503,1 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_375{
style=filled;
color=gray75;
15[label="172.195.94.70s;1pkt 1fpkt", shape=rectangle, color=red];
1561[label="64.112.46.173;d;7pkt 7fpkt", shape=diamond, color=yellow];
2312[label="172.195.94.70;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3111[label="172.195.94.70;1pkt 1fpkt", shape=invtriangle, color=brown];
3541[label="172.195.94.70;1pkt 1fpkt", shape=invhouse, color=bisque];
stat375[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.237.212:*, 64.112.46.173:80}[57.1429%]&lt;BR/&gt;{172.195.94.70:*, 64.112.46.173:80}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 35768: (22.7273%)&lt;BR/&gt; 36773: (4.54545%)&lt;BR/&gt; 35767: (4.54545%)&lt;BR/&gt; 7201: (4.54545%)&gt;];
}
15--1561[label="1;1pkt 1fpkt"];
15--2312[label="1;1pkt 1fpkt"];
15--3111[label="1;1pkt 1fpkt"];
15--3541[label="1;1pkt 1fpkt"];
1561--2312[label="1;1pkt 1fpkt"];
1561--2818[label="1;4pkt 4fpkt"];
1561--3111[label="1;1pkt 1fpkt"];
1561--3541[label="1;1pkt 1fpkt"];
2312--3111[label="1;1pkt 1fpkt"];
2312--3541[label="1;1pkt 1fpkt"];
3111--3541[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="64.112.46.173" dst_port="80" src_ip="172.195.237.212"/>
      <filter dst_ip="64.112.46.173" dst_port="80" src_ip="172.195.94.70"/>
    </slice>
    <from sec="1115269694" usec="0"/>
    <to sec="1115269918" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.195.110.70"/>
    </slice>
    <from sec="1115269204" usec="0"/>
    <to sec="1115270003" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.5.83.71"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.4.125.71"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.108.122.72"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115269339" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="69.250.192.72"/>
    </slice>
    <from sec="1115269662" usec="0"/>
    <to sec="1115269698" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.5.14.73"/>
    </slice>
    <from sec="1115269208" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="171.76.14.74"/>
    </slice>
    <from sec="1115269206" usec="0"/>
    <to sec="1115270097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.158.176.74"/>
    </slice>
    <from sec="1115269671" usec="0"/>
    <to sec="1115269763" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="71.104.194.74"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="171.76.48.76"/>
    </slice>
    <from sec="1115269209" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.634441,1.66751,011,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_386{
style=filled;
color=gray75;
1262[label="207.156.74.77;s;690pkt 690fpkt", shape=diamond, color=yellow];
2342[label="207.156.74.77;765pkt 765fpkt", shape=pentagon, color=darkviolet];
3129[label="207.156.74.77;766pkt 766fpkt", shape=invtriangle, color=brown];
stat386[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.156.74.77:7999, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7999: (50%)&lt;BR/&gt; 2110: (0.202611%)&lt;BR/&gt; 1731: (0.202611%)&lt;BR/&gt; 9682: (0.135074%)&lt;BR/&gt; 8597: (0.135074%)&gt;];
}
1262--2342[label="0.998551;689pkt 689fpkt"];
1262--3129[label="1;690pkt 690fpkt"];
2342--3129[label="1;765pkt 765fpkt"];
</description>
    <slice>
      <filter src_ip="207.156.74.77" src_port="7999"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.908565,1.67978,010,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_387{
style=filled;
color=gray75;
1372[label="131.5.187.77;s;110pkt 110fpkt", shape=diamond, color=yellow];
1892[label="131.5.187.77;s;102pkt 102fpkt", shape=hexagon, color=black];
2343[label="131.5.187.77;120pkt 120fpkt", shape=pentagon, color=darkviolet];
stat387[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.187.77:*, *:25}[41.3223%]&lt;BR/&gt;{131.5.187.77:25, *:*}[29.7521%]&lt;BR/&gt;{131.5.187.77:*, *:113}[28.9256%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (35.5422%)&lt;BR/&gt; 113: (14.4578%)&lt;BR/&gt; 3903: (0.60241%)&lt;BR/&gt; 60928: (0.451807%)&lt;BR/&gt; 59681: (0.451807%)&gt;];
}
1372--1892[label="1;102pkt 102fpkt"];
1372--2343[label="0.990909;109pkt 109fpkt"];
1892--2343[label="0.990196;101pkt 101fpkt"];
</description>
    <slice>
      <filter src_ip="131.5.187.77" src_port="25"/>
      <filter dst_port="25" src_ip="131.5.187.77"/>
      <filter dst_port="113" src_ip="131.5.187.77"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.2.90.79"/>
    </slice>
    <from sec="1115269209" usec="0"/>
    <to sec="1115269572" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.129.225.79"/>
    </slice>
    <from sec="1115269213" usec="0"/>
    <to sec="1115270097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="21.50.156.80"/>
    </slice>
    <from sec="1115270023" usec="0"/>
    <to sec="1115270036" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.195.22.82"/>
    </slice>
    <from sec="1115269204" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.967126,1.64128,020,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_392{
style=filled;
color=gray75;
879[label="171.76.43.82;s;88pkt 88fpkt", shape=diamond, color=yellow];
1867[label="171.76.43.82;s;72pkt 72fpkt", shape=hexagon, color=black];
2357[label="171.76.43.82;4pkt 4fpkt", shape=pentagon, color=darkviolet];
3138[label="171.76.43.82;88pkt 88fpkt", shape=invtriangle, color=brown];
stat392[shape=component, label=&lt;Rules:&lt;BR/&gt;{171.76.43.82:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
879--1225[label="0.0357143;1pkt 1fpkt"];
879--1482[label="0.016129;1pkt 1fpkt"];
879--1564[label="0.0113636;1pkt 1fpkt"];
879--1867[label="1;72pkt 72fpkt"];
879--2357[label="0.75;3pkt 3fpkt"];
879--3138[label="1;88pkt 88fpkt"];
1867--2357[label="0.75;3pkt 3fpkt"];
1867--3138[label="1;72pkt 72fpkt"];
2357--3138[label="0.75;3pkt 3fpkt"];
</description>
    <slice>
      <filter src_ip="171.76.43.82"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.634441,1.66751,010,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_393{
style=filled;
color=gray75;
676[label="69.199.129.82;s;2pkt 2fpkt", shape=diamond, color=yellow];
1603[label="149.188.237.219;d;3pkt 3fpkt", shape=diamond, color=yellow];
2358[label="69.199.129.82;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2664[label="195.4.162.173;103pkt 103fpkt", shape=pentagon, color=darkviolet];
3139[label="69.199.129.82;1pkt 1fpkt", shape=invtriangle, color=brown];
stat393[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.4.162.173:*, *:6101}[98.0952%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6101: (46.8468%)&lt;BR/&gt; 1755: (1.8018%)&lt;BR/&gt; 1211: (1.8018%)&lt;BR/&gt; 1208: (1.8018%)&lt;BR/&gt; 2460: (1.35135%)&gt;];
}
676--1603[label="1;2pkt 2fpkt"];
676--2358[label="1;2pkt 2fpkt"];
676--3139[label="1;1pkt 1fpkt"];
1603--2358[label="1;2pkt 2fpkt"];
1603--2664[label="0.333333;1pkt 1fpkt"];
1603--3139[label="1;1pkt 1fpkt"];
2358--3139[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="6101" src_ip="195.4.162.173"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="64.138.185.82"/>
    </slice>
    <from sec="1115269482" usec="0"/>
    <to sec="1115269505" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="71.88.103.83"/>
    </slice>
    <from sec="1115269639" usec="0"/>
    <to sec="1115269971" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.540993,1.70541,020,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_396{
style=filled;
color=gray75;
1100[label="210.53.133.166;d;165pkt 165fpkt", shape=diamond, color=yellow];
1107[label="210.53.132.134;d;173pkt 173fpkt", shape=diamond, color=yellow];
2363[label="213.210.133.83;13pkt 13fpkt", shape=pentagon, color=darkviolet];
stat396[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 210.53.132.134:0}[49.2837%]&lt;BR/&gt;{*:0, 210.53.133.166:0}[46.7049%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.1453%)&lt;BR/&gt; 25: (0.2849%)&lt;BR/&gt; 3232: (0.14245%)&lt;BR/&gt; 3223: (0.14245%)&lt;BR/&gt; 3014: (0.14245%)&gt;];
}
1100--1763[label="0.00606061;1pkt 1fpkt"];
1100--1972[label="0.00606061;1pkt 1fpkt"];
1100--2363[label="0.0769231;1pkt 1fpkt"];
1100--2806[label="0.00606061;1pkt 1fpkt"];
1107--1763[label="0.00578035;1pkt 1fpkt"];
1107--1972[label="0.00578035;1pkt 1fpkt"];
1107--2363[label="0.0769231;1pkt 1fpkt"];
1107--2806[label="0.00578035;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="210.53.132.134"/>
      <filter dst_ip="210.53.133.166"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.540993,1.70541,001,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_397{
style=filled;
color=gray75;
620[label="203.218.20.44;d;482pkt 482fpkt", shape=diamond, color=yellow];
805[label="203.221.115.52;d;448pkt 448fpkt", shape=diamond, color=yellow];
2364[label="131.5.215.83;7pkt 7fpkt", shape=pentagon, color=darkviolet];
stat397[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 203.218.20.44:*}[51.7167%]&lt;BR/&gt;{*:*, 203.221.115.52:*}[48.0687%]&lt;BR/&gt;{*:1023, *:*}[33.2618%]&lt;BR/&gt;{*:9898, *:*}[32.1888%]&lt;BR/&gt;{*:5554, *:*}[31.3305%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1023: (16.6489%)&lt;BR/&gt; 9898: (16.1153%)&lt;BR/&gt; 5554: (15.6884%)&lt;BR/&gt; 0: (2.45464%)&lt;BR/&gt; 8967: (0.320171%)&gt;];
}
620--2364[label="0.571429;4pkt 4fpkt"];
805--2364[label="0.142857;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="203.218.20.44"/>
      <filter dst_ip="203.221.115.52"/>
      <filter src_port="1023"/>
      <filter src_port="9898"/>
      <filter src_port="5554"/>
    </slice>
    <from sec="1115269235" usec="0"/>
    <to sec="1115270063" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.55.78.85"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.540993,1.70541,020,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_399{
style=filled;
color=gray75;
1292[label="211.19.96.85;s;34pkt 34fpkt", shape=diamond, color=yellow];
2369[label="211.19.96.85;35pkt 35fpkt", shape=pentagon, color=darkviolet];
stat399[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.19.96.85:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1292--2369[label="0.970588;33pkt 33fpkt"];
</description>
    <slice>
      <filter src_ip="211.19.96.85"/>
    </slice>
    <from sec="1115269225" usec="0"/>
    <to sec="1115270094" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.773883,1.66051,504,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_400{
style=filled;
color=gray75;
21[label="133.33.150.85s;1pkt 1fpkt", shape=rectangle, color=red];
2370[label="133.33.150.85;2pkt 2fpkt", shape=pentagon, color=darkviolet];
3145[label="133.33.150.85;2pkt 2fpkt", shape=invtriangle, color=brown];
stat400[shape=component, label=&lt;Rules:&lt;BR/&gt;{133.33.150.85:1499, 214.12.5.36:80}[50%]&lt;BR/&gt;{133.33.150.85:1501, 214.12.9.156:443}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1501: (30%)&lt;BR/&gt; 443: (30%)&lt;BR/&gt; 1499: (20%)&lt;BR/&gt; 80: (20%)&gt;];
}
21--2370[label="1;1pkt 1fpkt"];
21--3145[label="1;1pkt 1fpkt"];
2370--3145[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="214.12.9.156" dst_port="443" src_ip="133.33.150.85" src_port="1501"/>
      <filter dst_ip="214.12.5.36" dst_port="80" src_ip="133.33.150.85" src_port="1499"/>
    </slice>
    <from sec="1115269897" usec="0"/>
    <to sec="1115269985" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="52.221.20.86"/>
    </slice>
    <from sec="1115269596" usec="0"/>
    <to sec="1115269787" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.195.110.86"/>
    </slice>
    <from sec="1115269774" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.5.185.86"/>
    </slice>
    <from sec="1115269258" usec="0"/>
    <to sec="1115269913" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.157.136.89"/>
    </slice>
    <from sec="1115269627" usec="0"/>
    <to sec="1115269802" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="204.59.185.90"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="171.76.89.91"/>
    </slice>
    <from sec="1115269204" usec="0"/>
    <to sec="1115270097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="133.190.108.91"/>
    </slice>
    <from sec="1115269221" usec="0"/>
    <to sec="1115270079" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.540993,1.70541,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_408{
style=filled;
color=gray75;
1389[label="20.160.199.91;s;660pkt 660fpkt", shape=diamond, color=yellow];
2386[label="20.160.199.91;804pkt 804fpkt", shape=pentagon, color=darkviolet];
stat408[shape=component, label=&lt;Rules:&lt;BR/&gt;{20.160.199.91:1075, *:1434}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1434: (50%)&lt;BR/&gt; 1075: (50%)&gt;];
}
1389--2386[label="0.99697;658pkt 658fpkt"];
</description>
    <slice>
      <filter dst_port="1434" src_ip="20.160.199.91" src_port="1075"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="65.110.215.92"/>
    </slice>
    <from sec="1115269233" usec="0"/>
    <to sec="1115270081" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.540993,1.70541,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_410{
style=filled;
color=gray75;
1498[label="210.53.137.133;d;76pkt 76fpkt", shape=diamond, color=yellow];
2389[label="200.179.95.93;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat410[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:25, 210.53.137.133:*}[48.6842%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (33.1169%)&lt;BR/&gt; 113: (10.3896%)&lt;BR/&gt; 53: (6.49351%)&lt;BR/&gt; 65532: (2.5974%)&lt;BR/&gt; 51547: (1.2987%)&gt;];
}
1498--1763[label="0.0131579;1pkt 1fpkt"];
1498--1972[label="0.0131579;1pkt 1fpkt"];
1498--1996[label="0.0131579;1pkt 1fpkt"];
1498--2019[label="0.0131579;1pkt 1fpkt"];
1498--2030[label="0.0131579;1pkt 1fpkt"];
1498--2389[label="1;1pkt 1fpkt"];
1498--2806[label="0.0131579;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="210.53.137.133" src_port="25"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115269929" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.72.31.94"/>
    </slice>
    <from sec="1115269203" usec="0"/>
    <to sec="1115270093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.540993,1.70541,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_412{
style=filled;
color=gray75;
1702[label="200.97.158.94;s;99pkt 99fpkt", shape=diamond, color=yellow];
2395[label="200.97.158.94;128pkt 128fpkt", shape=pentagon, color=darkviolet];
stat412[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.97.158.94:*, 133.190.149.216:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 40035: (0.440529%)&lt;BR/&gt; 40032: (0.440529%)&lt;BR/&gt; 40030: (0.440529%)&lt;BR/&gt; 40028: (0.440529%)&gt;];
}
1702--2395[label="1;99pkt 99fpkt"];
</description>
    <slice>
      <filter dst_ip="133.190.149.216" dst_port="80" src_ip="200.97.158.94"/>
    </slice>
    <from sec="1115269857" usec="0"/>
    <to sec="1115270095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="68.36.47.95"/>
    </slice>
    <from sec="1115269709" usec="0"/>
    <to sec="1115269755" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.19.97.96"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.908565,1.67978,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_415{
style=filled;
color=gray75;
363[label="200.88.228.96;s;13pkt 13fpkt", shape=diamond, color=yellow];
1774[label="200.88.228.96;s;5pkt 5fpkt", shape=hexagon, color=black];
2405[label="200.88.228.96;13pkt 13fpkt", shape=pentagon, color=darkviolet];
stat415[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.88.228.96:*, 149.188.205.117:4880}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4880: (50%)&lt;BR/&gt; 5260: (4.83871%)&lt;BR/&gt; 2725: (4.83871%)&lt;BR/&gt; 2724: (4.83871%)&lt;BR/&gt; 2714: (4.83871%)&gt;];
}
363--641[label="0.923077;12pkt 12fpkt"];
363--1774[label="1;5pkt 5fpkt"];
363--2405[label="1;13pkt 13fpkt"];
1774--2405[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.205.117" dst_port="4880" src_ip="200.88.228.96"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.14.179.97"/>
    </slice>
    <from sec="1115269587" usec="0"/>
    <to sec="1115269951" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="22.137.253.98"/>
    </slice>
    <from sec="1115269205" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.5.11.99"/>
    </slice>
    <from sec="1115269239" usec="0"/>
    <to sec="1115270060" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.540993,1.70541,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_419{
style=filled;
color=gray75;
1619[label="149.188.132.39;d;696pkt 696fpkt", shape=diamond, color=yellow];
2415[label="194.44.67.99;2pkt 2fpkt", shape=pentagon, color=darkviolet];
stat419[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 149.188.132.39:3497}[96.6954%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3497: (48.3524%)&lt;BR/&gt; 443: (0.931232%)&lt;BR/&gt; 80: (0.644699%)&lt;BR/&gt; 1025: (0.2149%)&lt;BR/&gt; 61509: (0.143266%)&gt;];
}
1619--2415[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.132.39" dst_port="3497"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.859378,1.64748,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_420{
style=filled;
color=gray75;
1178[label="172.195.110.177;d;124pkt 124fpkt", shape=diamond, color=yellow];
2101[label="21.20.213.14;5pkt 5fpkt", shape=pentagon, color=darkviolet];
2417[label="194.123.143.99;11pkt 11fpkt", shape=pentagon, color=darkviolet];
2991[label="21.20.213.14;5pkt 5fpkt", shape=invtriangle, color=brown];
3164[label="194.123.143.99;11pkt 11fpkt", shape=invtriangle, color=brown];
3480[label="21.20.213.14;5pkt 5fpkt", shape=invhouse, color=bisque];
stat420[shape=component, label=&lt;Rules:&lt;BR/&gt;{21.5.130.76:80, 172.195.110.177:*}[46.9697%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1780: (1.24224%)&lt;BR/&gt; 1725: (1.24224%)&lt;BR/&gt; 1701: (1.24224%)&lt;BR/&gt; 1699: (1.24224%)&gt;];
}
1178--1989[label="0.00806452;1pkt 1fpkt"];
1178--2015[label="0.00806452;1pkt 1fpkt"];
1178--2101[label="0.8;4pkt 4fpkt"];
1178--2417[label="0.363636;4pkt 4fpkt"];
1178--2473[label="0.0769231;3pkt 3fpkt"];
1178--2991[label="0.8;4pkt 4fpkt"];
1178--3164[label="0.363636;4pkt 4fpkt"];
1178--3198[label="0.0769231;3pkt 3fpkt"];
1178--3480[label="0.8;4pkt 4fpkt"];
2101--2991[label="1;5pkt 5fpkt"];
2101--3480[label="1;5pkt 5fpkt"];
2417--3164[label="1;11pkt 11fpkt"];
2991--3480[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="172.195.110.177" src_ip="21.5.130.76" src_port="80"/>
    </slice>
    <from sec="1115269222" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.129.225.99"/>
    </slice>
    <from sec="1115269310" usec="0"/>
    <to sec="1115269490" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="65.74.52.100"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.540993,1.70541,011,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_423{
style=filled;
color=gray75;
397[label="21.17.70.101;s;1477pkt 1477fpkt", shape=diamond, color=yellow];
2421[label="21.17.70.101;6pkt 6fpkt", shape=pentagon, color=darkviolet];
stat423[shape=component, label=&lt;Rules:&lt;BR/&gt;{21.17.70.101:7003, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7003: (50.0337%)&lt;BR/&gt; 7784: (0.101146%)&lt;BR/&gt; 6319: (0.101146%)&lt;BR/&gt; 4499: (0.101146%)&lt;BR/&gt; 1968: (0.101146%)&gt;];
}
397--2421[label="0.166667;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="21.17.70.101" src_port="7003"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="207.137.210.101"/>
    </slice>
    <from sec="1115269578" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="95.149.76.104"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115269761" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.53.129.105"/>
    </slice>
    <from sec="1115269210" usec="0"/>
    <to sec="1115270096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.540993,1.70541,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_427{
style=filled;
color=gray75;
1416[label="172.195.162.107;s;12pkt 12fpkt", shape=diamond, color=yellow];
1658[label="40.171.22.96;d;12pkt 12fpkt", shape=diamond, color=yellow];
2441[label="172.195.162.107;12pkt 12fpkt", shape=pentagon, color=darkviolet];
stat427[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.162.107:*, 40.171.22.96:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1169: (4.16667%)&lt;BR/&gt; 1168: (4.16667%)&lt;BR/&gt; 1167: (4.16667%)&lt;BR/&gt; 1166: (4.16667%)&gt;];
}
1416--1658[label="1;12pkt 12fpkt"];
1416--2441[label="1;12pkt 12fpkt"];
1658--2441[label="1;12pkt 12fpkt"];
</description>
    <slice>
      <filter dst_ip="40.171.22.96" dst_port="80" src_ip="172.195.162.107"/>
    </slice>
    <from sec="1115269205" usec="0"/>
    <to sec="1115270058" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="21.112.232.107"/>
    </slice>
    <from sec="1115269383" usec="0"/>
    <to sec="1115269715" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="64.87.136.109"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.195.163.111"/>
    </slice>
    <from sec="1115269468" usec="0"/>
    <to sec="1115269488" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="70.36.178.111"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270060" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="21.184.194.111"/>
    </slice>
    <from sec="1115269531" usec="0"/>
    <to sec="1115269819" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="65.107.20.112"/>
    </slice>
    <from sec="1115269205" usec="0"/>
    <to sec="1115269324" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.634441,1.66751,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_434{
style=filled;
color=gray75;
946[label="131.5.74.117;s;67pkt 67fpkt", shape=diamond, color=yellow];
2472[label="131.5.74.117;68pkt 68fpkt", shape=pentagon, color=darkviolet];
3197[label="131.5.74.117;67pkt 67fpkt", shape=invtriangle, color=brown];
stat434[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.74.117:*, 215.65.242.196:80}[29.4118%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.505%)&lt;BR/&gt; 54781: (0.742574%)&lt;BR/&gt; 54780: (0.742574%)&lt;BR/&gt; 54779: (0.742574%)&lt;BR/&gt; 54778: (0.742574%)&gt;];
}
946--2472[label="1;67pkt 67fpkt"];
946--3197[label="0.985075;66pkt 66fpkt"];
2472--3197[label="1;67pkt 67fpkt"];
</description>
    <slice>
      <filter dst_ip="215.65.242.196" dst_port="80" src_ip="131.5.74.117"/>
    </slice>
    <from sec="1115269457" usec="0"/>
    <to sec="1115269958" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="21.141.0.118"/>
    </slice>
    <from sec="1115269740" usec="0"/>
    <to sec="1115269761" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.699323,1.69856,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_436{
style=filled;
color=gray75;
143[label="221.50.100.118s;164pkt 164fpkt", shape=rectangle, color=red];
2475[label="221.50.100.118;231pkt 231fpkt", shape=pentagon, color=darkviolet];
stat436[shape=component, label=&lt;Rules:&lt;BR/&gt;{221.50.100.118:34468, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 34468: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
143--2475[label="0.993902;163pkt 163fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="221.50.100.118" src_port="34468"/>
    </slice>
    <from sec="1115269603" usec="0"/>
    <to sec="1115269639" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="21.230.182.119"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="171.76.59.121"/>
    </slice>
    <from sec="1115269208" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.908565,1.67978,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_439{
style=filled;
color=gray75;
926[label="131.5.28.128;s;39pkt 39fpkt", shape=diamond, color=yellow];
1847[label="131.5.28.128;s;39pkt 39fpkt", shape=hexagon, color=black];
2498[label="131.5.28.128;39pkt 39fpkt", shape=pentagon, color=darkviolet];
stat439[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.28.128:*, 66.213.217.17:80}[23.0769%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.7179%)&lt;BR/&gt; 54404: (1.28205%)&lt;BR/&gt; 54401: (1.28205%)&lt;BR/&gt; 54400: (1.28205%)&lt;BR/&gt; 54398: (1.28205%)&gt;];
}
926--1847[label="1;39pkt 39fpkt"];
926--2498[label="1;39pkt 39fpkt"];
1847--2498[label="1;39pkt 39fpkt"];
</description>
    <slice>
      <filter dst_ip="66.213.217.17" dst_port="80" src_ip="131.5.28.128"/>
    </slice>
    <from sec="1115269265" usec="0"/>
    <to sec="1115269541" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="21.190.111.129"/>
    </slice>
    <from sec="1115269742" usec="0"/>
    <to sec="1115269775" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.129.132.130"/>
    </slice>
    <from sec="1115269782" usec="0"/>
    <to sec="1115269846" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.117.69.133"/>
    </slice>
    <from sec="1115269222" usec="0"/>
    <to sec="1115270093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="68.36.142.133"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.77477,1.65068,010,1 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_445{
style=filled;
color=gray75;
183[label="210.86.160.133s;1020pkt 1020fpkt", shape=rectangle, color=red];
1714[label="210.86.160.133;s;1020pkt 1020fpkt", shape=diamond, color=yellow];
2516[label="210.86.160.133;1019pkt 1019fpkt", shape=pentagon, color=darkviolet];
stat445[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.86.160.133:*, *:445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (50%)&lt;BR/&gt; 51342: (0.0980713%)&lt;BR/&gt; 51086: (0.0980713%)&lt;BR/&gt; 50830: (0.0980713%)&lt;BR/&gt; 50574: (0.0980713%)&gt;];
}
183--268[label="0.731373;746pkt 746fpkt"];
183--1714[label="1;1020pkt 1020fpkt"];
183--2516[label="1;1019pkt 1019fpkt"];
1714--2516[label="1;1019pkt 1019fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="210.86.160.133"/>
    </slice>
    <from sec="1115269915" usec="0"/>
    <to sec="1115270041" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="171.76.7.134"/>
    </slice>
    <from sec="1115269232" usec="0"/>
    <to sec="1115270096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="192.235.216.135"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="68.244.57.136"/>
    </slice>
    <from sec="1115269259" usec="0"/>
    <to sec="1115269603" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.634441,1.66751,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_449{
style=filled;
color=gray75;
1035[label="149.188.233.246;d;45pkt 45fpkt", shape=diamond, color=yellow];
2532[label="21.5.38.137;20pkt 20fpkt", shape=pentagon, color=darkviolet];
3224[label="21.5.38.137;20pkt 20fpkt", shape=invtriangle, color=brown];
stat449[shape=component, label=&lt;Rules:&lt;BR/&gt;{21.5.38.137:80, 149.188.233.246:*}[46.6667%]&lt;BR/&gt;{192.9.153.244:80, 149.188.233.246:*}[22.2222%]&lt;BR/&gt;{*:8000, 149.188.233.246:*}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (42.9412%)&lt;BR/&gt; 8000: (5.88235%)&lt;BR/&gt; 4002: (2.94118%)&lt;BR/&gt; 2132: (1.76471%)&lt;BR/&gt; 2119: (1.76471%)&gt;];
}
1035--2532[label="1;20pkt 20fpkt"];
1035--3224[label="1;20pkt 20fpkt"];
2532--3224[label="1;20pkt 20fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.233.246" src_port="8000"/>
      <filter dst_ip="149.188.233.246" src_ip="21.5.38.137" src_port="80"/>
      <filter dst_ip="149.188.233.246" src_ip="192.9.153.244" src_port="80"/>
    </slice>
    <from sec="1115269218" usec="0"/>
    <to sec="1115270010" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.859378,1.64748,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_450{
style=filled;
color=gray75;
773[label="209.226.179.18;d;1pkt 1fpkt", shape=diamond, color=yellow];
774[label="172.195.175.139;s;14pkt 14fpkt", shape=diamond, color=yellow];
815[label="196.91.2.141;d;46pkt 46fpkt", shape=diamond, color=yellow];
2544[label="172.195.175.139;25pkt 25fpkt", shape=pentagon, color=darkviolet];
2816[label="172.195.175.212;39pkt 39fpkt", shape=pentagon, color=darkviolet];
3233[label="172.195.175.139;24pkt 24fpkt", shape=invtriangle, color=brown];
3383[label="172.195.175.212;40pkt 40fpkt", shape=invtriangle, color=brown];
3688[label="172.195.175.212;40pkt 40fpkt", shape=invhouse, color=bisque];
stat450[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.175.212:80, 196.91.2.141:*}[54.5455%]&lt;BR/&gt;{172.195.175.139:80, *:*}[37.8788%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 41005: (0.873362%)&lt;BR/&gt; 40980: (0.873362%)&lt;BR/&gt; 40927: (0.873362%)&lt;BR/&gt; 40892: (0.873362%)&gt;];
}
773--774[label="1;1pkt 1fpkt"];
773--1983[label="1;1pkt 1fpkt"];
773--1989[label="1;1pkt 1fpkt"];
773--2015[label="1;1pkt 1fpkt"];
773--2544[label="1;1pkt 1fpkt"];
773--3233[label="1;1pkt 1fpkt"];
774--815[label="0.642857;9pkt 9fpkt"];
774--1983[label="0.0714286;1pkt 1fpkt"];
774--1989[label="0.5;7pkt 7fpkt"];
774--2015[label="0.5;7pkt 7fpkt"];
774--2544[label="1;14pkt 14fpkt"];
774--3233[label="0.928571;13pkt 13fpkt"];
815--1989[label="0.521739;24pkt 24fpkt"];
815--2015[label="0.521739;24pkt 24fpkt"];
815--2544[label="0.36;9pkt 9fpkt"];
815--2816[label="0.923077;36pkt 36fpkt"];
815--3233[label="0.375;9pkt 9fpkt"];
815--3383[label="0.9;36pkt 36fpkt"];
815--3688[label="0.9;36pkt 36fpkt"];
2544--3233[label="1;24pkt 24fpkt"];
2816--3383[label="1;39pkt 39fpkt"];
2816--3688[label="1;39pkt 39fpkt"];
3383--3688[label="1;40pkt 40fpkt"];
</description>
    <slice>
      <filter src_ip="172.195.175.139" src_port="80"/>
      <filter dst_ip="196.91.2.141" src_ip="172.195.175.212" src_port="80"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270094" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.93.206.142"/>
    </slice>
    <from sec="1115269205" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.142.143.143"/>
    </slice>
    <from sec="1115269652" usec="0"/>
    <to sec="1115269991" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.773883,1.66051,002,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_453{
style=filled;
color=gray75;
146[label="21.213.40.144s;109pkt 109fpkt", shape=rectangle, color=red];
2558[label="21.213.40.144;256pkt 256fpkt", shape=pentagon, color=darkviolet];
3243[label="21.213.40.144;255pkt 255fpkt", shape=invtriangle, color=brown];
stat453[shape=component, label=&lt;Rules:&lt;BR/&gt;{21.213.40.144:1035, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1035: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
146--2558[label="1;109pkt 109fpkt"];
146--3243[label="1;109pkt 109fpkt"];
2558--3243[label="1;255pkt 255fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="21.213.40.144" src_port="1035"/>
    </slice>
    <from sec="1115270083" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.4.54.144"/>
    </slice>
    <from sec="1115269298" usec="0"/>
    <to sec="1115269976" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.859378,1.64748,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_455{
style=filled;
color=gray75;
388[label="172.195.155.89;d;81pkt 81fpkt", shape=diamond, color=yellow];
692[label="210.53.134.171;d;364pkt 364fpkt", shape=diamond, color=yellow];
1103[label="210.53.132.99;d;1154pkt 1154fpkt", shape=diamond, color=yellow];
1362[label="222.216.4.185;d;229pkt 229fpkt", shape=diamond, color=yellow];
1529[label="133.33.218.228;d;16pkt 16fpkt", shape=diamond, color=yellow];
2433[label="202.35.16.104;3pkt 3fpkt", shape=pentagon, color=darkviolet];
2561[label="64.162.80.144;31pkt 31fpkt", shape=pentagon, color=darkviolet];
2577[label="64.162.80.149;69pkt 69fpkt", shape=pentagon, color=darkviolet];
2589[label="64.162.80.152;38pkt 38fpkt", shape=pentagon, color=darkviolet];
2596[label="64.162.80.154;34pkt 34fpkt", shape=pentagon, color=darkviolet];
2617[label="64.162.80.160;44pkt 44fpkt", shape=pentagon, color=darkviolet];
2801[label="64.162.87.210;33pkt 33fpkt", shape=pentagon, color=darkviolet];
2808[label="215.41.200.210;15pkt 15fpkt", shape=pentagon, color=darkviolet];
2833[label="64.162.87.218;35pkt 35fpkt", shape=pentagon, color=darkviolet];
2853[label="64.162.87.225;37pkt 37fpkt", shape=pentagon, color=darkviolet];
2932[label="64.162.87.247;37pkt 37fpkt", shape=pentagon, color=darkviolet];
2952[label="64.162.87.252;37pkt 37fpkt", shape=pentagon, color=darkviolet];
3174[label="202.35.16.104;3pkt 3fpkt", shape=invtriangle, color=brown];
3252[label="64.162.80.149;68pkt 68fpkt", shape=invtriangle, color=brown];
3265[label="64.162.80.154;33pkt 33fpkt", shape=invtriangle, color=brown];
3391[label="64.162.87.218;35pkt 35fpkt", shape=invtriangle, color=brown];
3444[label="64.162.87.247;36pkt 36fpkt", shape=invtriangle, color=brown];
3454[label="64.162.87.252;36pkt 36fpkt", shape=invtriangle, color=brown];
3618[label="64.162.80.149;69pkt 69fpkt", shape=invhouse, color=bisque];
3626[label="64.162.80.154;34pkt 34fpkt", shape=invhouse, color=bisque];
3683[label="64.162.87.210;32pkt 32fpkt", shape=invhouse, color=bisque];
3718[label="64.162.87.247;36pkt 36fpkt", shape=invhouse, color=bisque];
stat455[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 210.53.132.99:53}[54.7834%]&lt;BR/&gt;{*:*, *:80}[29.7001%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (31.8113%)&lt;BR/&gt; 80: (19.0792%)&lt;BR/&gt; 32768: (0.947329%)&lt;BR/&gt; 554: (0.473664%)&lt;BR/&gt; 32769: (0.416825%)&gt;];
}
388--2561[label="0.0645161;2pkt 2fpkt"];
388--2570[label="0.0666667;3pkt 3fpkt"];
388--2577[label="0.057971;4pkt 4fpkt"];
388--2589[label="0.0789474;3pkt 3fpkt"];
388--2596[label="0.0294118;1pkt 1fpkt"];
388--2617[label="0.0681818;3pkt 3fpkt"];
388--2645[label="0.0833333;3pkt 3fpkt"];
388--2690[label="0.0689655;2pkt 2fpkt"];
388--2762[label="0.117647;6pkt 6fpkt"];
388--2788[label="0.0666667;2pkt 2fpkt"];
388--2801[label="0.0606061;2pkt 2fpkt"];
388--2813[label="0.0384615;1pkt 1fpkt"];
388--2833[label="0.0571429;2pkt 2fpkt"];
388--2853[label="0.0810811;3pkt 3fpkt"];
388--2932[label="0.135135;5pkt 5fpkt"];
388--2946[label="0.0227273;1pkt 1fpkt"];
388--2952[label="0.0540541;2pkt 2fpkt"];
388--3252[label="0.0588235;4pkt 4fpkt"];
388--3265[label="0.030303;1pkt 1fpkt"];
388--3314[label="0.0689655;2pkt 2fpkt"];
388--3353[label="0.115385;6pkt 6fpkt"];
388--3381[label="0.0384615;1pkt 1fpkt"];
388--3391[label="0.0571429;2pkt 2fpkt"];
388--3444[label="0.138889;5pkt 5fpkt"];
388--3454[label="0.0555556;2pkt 2fpkt"];
388--3618[label="0.057971;4pkt 4fpkt"];
388--3626[label="0.0294118;1pkt 1fpkt"];
388--3653[label="0.0714286;2pkt 2fpkt"];
388--3674[label="0.117647;6pkt 6fpkt"];
388--3683[label="0.03125;1pkt 1fpkt"];
388--3718[label="0.138889;5pkt 5fpkt"];
692--1763[label="0.00274725;1pkt 1fpkt"];
692--1972[label="0.00274725;1pkt 1fpkt"];
692--2433[label="1;3pkt 3fpkt"];
692--2561[label="0.322581;10pkt 10fpkt"];
692--2570[label="0.155556;7pkt 7fpkt"];
692--2577[label="0.115942;8pkt 8fpkt"];
692--2589[label="0.315789;12pkt 12fpkt"];
692--2596[label="0.352941;12pkt 12fpkt"];
692--2617[label="0.204545;9pkt 9fpkt"];
692--2645[label="0.277778;10pkt 10fpkt"];
692--2690[label="0.206897;6pkt 6fpkt"];
692--2762[label="0.176471;9pkt 9fpkt"];
692--2788[label="0.233333;7pkt 7fpkt"];
692--2801[label="0.30303;10pkt 10fpkt"];
692--2806[label="0.00274725;1pkt 1fpkt"];
692--2808[label="1;15pkt 15fpkt"];
692--2813[label="0.269231;7pkt 7fpkt"];
692--2826[label="0.321429;9pkt 9fpkt"];
692--2833[label="0.314286;11pkt 11fpkt"];
692--2853[label="0.135135;5pkt 5fpkt"];
692--2860[label="0.241379;7pkt 7fpkt"];
692--2932[label="0.189189;7pkt 7fpkt"];
692--2941[label="0.25;10pkt 10fpkt"];
692--2946[label="0.25;11pkt 11fpkt"];
692--2952[label="0.27027;10pkt 10fpkt"];
692--3174[label="1;3pkt 3fpkt"];
692--3252[label="0.117647;8pkt 8fpkt"];
692--3265[label="0.363636;12pkt 12fpkt"];
692--3314[label="0.206897;6pkt 6fpkt"];
692--3353[label="0.173077;9pkt 9fpkt"];
692--3381[label="0.269231;7pkt 7fpkt"];
692--3391[label="0.314286;11pkt 11fpkt"];
692--3444[label="0.194444;7pkt 7fpkt"];
692--3454[label="0.277778;10pkt 10fpkt"];
692--3618[label="0.115942;8pkt 8fpkt"];
692--3626[label="0.352941;12pkt 12fpkt"];
692--3653[label="0.214286;6pkt 6fpkt"];
692--3674[label="0.176471;9pkt 9fpkt"];
692--3683[label="0.3125;10pkt 10fpkt"];
692--3718[label="0.194444;7pkt 7fpkt"];
1103--1763[label="0.000866551;1pkt 1fpkt"];
1103--1972[label="0.000866551;1pkt 1fpkt"];
1103--1982[label="0.000866551;1pkt 1fpkt"];
1103--1988[label="0.00519931;6pkt 6fpkt"];
1103--1996[label="0.0103986;12pkt 12fpkt"];
1103--2003[label="0.00693241;8pkt 8fpkt"];
1103--2014[label="0.00519931;6pkt 6fpkt"];
1103--2019[label="0.0103986;12pkt 12fpkt"];
1103--2023[label="0.00693241;8pkt 8fpkt"];
1103--2030[label="0.0103986;12pkt 12fpkt"];
1103--2034[label="0.00693241;8pkt 8fpkt"];
1103--2577[label="0.0289855;2pkt 2fpkt"];
1103--2589[label="0.0263158;1pkt 1fpkt"];
1103--2617[label="0.0454545;2pkt 2fpkt"];
1103--2645[label="0.0555556;2pkt 2fpkt"];
1103--2762[label="0.0784314;4pkt 4fpkt"];
1103--2806[label="0.000866551;1pkt 1fpkt"];
1103--2826[label="0.0357143;1pkt 1fpkt"];
1103--2853[label="0.027027;1pkt 1fpkt"];
1103--2952[label="0.0540541;2pkt 2fpkt"];
1103--3252[label="0.0294118;2pkt 2fpkt"];
1103--3353[label="0.0769231;4pkt 4fpkt"];
1103--3454[label="0.0555556;2pkt 2fpkt"];
1103--3618[label="0.0289855;2pkt 2fpkt"];
1103--3674[label="0.0784314;4pkt 4fpkt"];
1362--1982[label="0.00436681;1pkt 1fpkt"];
1362--1984[label="0.00436681;1pkt 1fpkt"];
1362--1988[label="0.00436681;1pkt 1fpkt"];
1362--1996[label="0.00436681;1pkt 1fpkt"];
1362--2003[label="0.00436681;1pkt 1fpkt"];
1362--2014[label="0.00436681;1pkt 1fpkt"];
1362--2019[label="0.00436681;1pkt 1fpkt"];
1362--2023[label="0.00436681;1pkt 1fpkt"];
1362--2030[label="0.00436681;1pkt 1fpkt"];
1362--2034[label="0.00436681;1pkt 1fpkt"];
1362--2589[label="0.0263158;1pkt 1fpkt"];
1362--2596[label="0.0294118;1pkt 1fpkt"];
1362--2617[label="0.0454545;2pkt 2fpkt"];
1362--2833[label="0.0857143;3pkt 3fpkt"];
1362--2946[label="0.0227273;1pkt 1fpkt"];
1362--3265[label="0.030303;1pkt 1fpkt"];
1362--3391[label="0.0857143;3pkt 3fpkt"];
1362--3626[label="0.0294118;1pkt 1fpkt"];
1529--2561[label="0.0625;1pkt 1fpkt"];
1529--2570[label="0.0625;1pkt 1fpkt"];
1529--2853[label="0.0625;1pkt 1fpkt"];
2433--3174[label="1;3pkt 3fpkt"];
2577--3252[label="1;68pkt 68fpkt"];
2577--3618[label="1;69pkt 69fpkt"];
2596--3265[label="1;33pkt 33fpkt"];
2596--3626[label="1;34pkt 34fpkt"];
2801--3683[label="1;32pkt 32fpkt"];
2833--3391[label="1;35pkt 35fpkt"];
2932--3444[label="1;36pkt 36fpkt"];
2932--3718[label="1;36pkt 36fpkt"];
2952--3454[label="1;36pkt 36fpkt"];
3252--3618[label="1;68pkt 68fpkt"];
3265--3626[label="1;33pkt 33fpkt"];
3444--3718[label="1;36pkt 36fpkt"];
</description>
    <slice>
      <filter dst_port="80"/>
      <filter dst_ip="210.53.132.99" dst_port="53"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.4.80.148"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,001,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.220.9.149"/>
    </slice>
    <from sec="1115270056" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.540993,1.70541,020,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_459{
style=filled;
color=gray75;
1642[label="174.9.243.9;d;71pkt 71fpkt", shape=diamond, color=yellow];
2579[label="213.210.199.149;15pkt 15fpkt", shape=pentagon, color=darkviolet];
stat459[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 174.9.243.9:0}[83.5294%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1642--2579[label="0.0666667;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="174.9.243.9"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270026" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="93.92.18.150"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.41.122.150"/>
    </slice>
    <from sec="1115269203" usec="0"/>
    <to sec="1115269404" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.183.175.151"/>
    </slice>
    <from sec="1115269202" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="94.59.188.151"/>
    </slice>
    <from sec="1115269224" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.966908,1.64039,001,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_464{
style=filled;
color=gray75;
188[label="200.180.251.153s;64pkt 64fpkt", shape=rectangle, color=red];
2593[label="200.180.251.153;194pkt 194fpkt", shape=pentagon, color=darkviolet];
3263[label="200.180.251.153;194pkt 194fpkt", shape=invtriangle, color=brown];
3625[label="200.180.251.153;194pkt 194fpkt", shape=invhouse, color=bisque];
stat464[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.180.251.153:*, *:1023}[33.5052%]&lt;BR/&gt;{200.180.251.153:*, *:9898}[33.5052%]&lt;BR/&gt;{200.180.251.153:*, *:5554}[32.9897%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (19.8142%)&lt;BR/&gt; 9898: (15.0929%)&lt;BR/&gt; 1023: (15.0929%)&lt;BR/&gt; 3779: (0.309598%)&lt;BR/&gt; 3778: (0.309598%)&gt;];
}
188--2593[label="1;64pkt 64fpkt"];
188--3263[label="1;64pkt 64fpkt"];
188--3625[label="1;64pkt 64fpkt"];
2593--3263[label="1;194pkt 194fpkt"];
2593--3625[label="1;194pkt 194fpkt"];
3263--3625[label="1;194pkt 194fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="200.180.251.153"/>
      <filter dst_port="1023" src_ip="200.180.251.153"/>
      <filter dst_port="5554" src_ip="200.180.251.153"/>
    </slice>
    <from sec="1115269222" usec="0"/>
    <to sec="1115269227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.153.92.156"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115269822" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.121.77.157"/>
    </slice>
    <from sec="1115269244" usec="0"/>
    <to sec="1115270092" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.699323,1.69856,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_467{
style=filled;
color=gray75;
150[label="69.138.234.157s;254pkt 254fpkt", shape=rectangle, color=red];
2610[label="69.138.234.157;254pkt 254fpkt", shape=pentagon, color=darkviolet];
stat467[shape=component, label=&lt;Rules:&lt;BR/&gt;{69.138.234.157:62617, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 62617: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
150--2610[label="1;254pkt 254fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="69.138.234.157" src_port="62617"/>
    </slice>
    <from sec="1115269590" usec="0"/>
    <to sec="1115269617" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.213.212.158"/>
    </slice>
    <from sec="1115269350" usec="0"/>
    <to sec="1115269402" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.137.2.160"/>
    </slice>
    <from sec="1115269534" usec="0"/>
    <to sec="1115269823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.4.101.160"/>
    </slice>
    <from sec="1115269211" usec="0"/>
    <to sec="1115269838" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="204.112.110.160"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.540993,1.70541,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_472{
style=filled;
color=gray75;
801[label="16.164.6.163;s;9pkt 9fpkt", shape=diamond, color=yellow];
2630[label="16.164.6.163;12pkt 12fpkt", shape=pentagon, color=darkviolet];
stat472[shape=component, label=&lt;Rules:&lt;BR/&gt;{16.164.6.163:9548, 172.195.14.221:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9548: (50%)&lt;BR/&gt; 1946: (4.7619%)&lt;BR/&gt; 1945: (4.7619%)&lt;BR/&gt; 1944: (4.7619%)&lt;BR/&gt; 1943: (4.7619%)&gt;];
}
801--1022[label="1;9pkt 9fpkt"];
801--2630[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="172.195.14.221" src_ip="16.164.6.163" src_port="9548"/>
    </slice>
    <from sec="1115269235" usec="0"/>
    <to sec="1115269767" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.71.164.169"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.220.32.172"/>
    </slice>
    <from sec="1115269235" usec="0"/>
    <to sec="1115269938" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="93.98.238.172"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115269701" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.142.88.174"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.19.99.174"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.634441,1.66751,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_478{
style=filled;
color=gray75;
1686[label="172.195.108.9;d;24pkt 24fpkt", shape=diamond, color=yellow];
2547[label="202.137.2.141;5pkt 5fpkt", shape=pentagon, color=darkviolet];
2668[label="202.137.2.175;5pkt 5fpkt", shape=pentagon, color=darkviolet];
3235[label="202.137.2.141;4pkt 4fpkt", shape=invtriangle, color=brown];
stat478[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.144.174.206:80, 172.195.108.9:*}[23.0769%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.3684%)&lt;BR/&gt; 2841: (3.94737%)&lt;BR/&gt; 2831: (3.94737%)&lt;BR/&gt; 2825: (3.94737%)&lt;BR/&gt; 2824: (3.94737%)&gt;];
}
1686--2547[label="1;5pkt 5fpkt"];
1686--2668[label="0.6;3pkt 3fpkt"];
1686--2790[label="0.714286;5pkt 5fpkt"];
1686--3235[label="1;4pkt 4fpkt"];
2547--3235[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="172.195.108.9" src_ip="202.144.174.206" src_port="80"/>
    </slice>
    <from sec="1115269283" usec="0"/>
    <to sec="1115269975" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="21.107.12.177"/>
    </slice>
    <from sec="1115269863" usec="0"/>
    <to sec="1115269913" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="206.153.196.177"/>
    </slice>
    <from sec="1115269205" usec="0"/>
    <to sec="1115270097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.634441,1.66751,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_481{
style=filled;
color=gray75;
1545[label="172.195.144.179;s;155pkt 155fpkt", shape=diamond, color=yellow];
2682[label="172.195.144.179;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3312[label="172.195.144.179;155pkt 155fpkt", shape=invtriangle, color=brown];
stat481[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.144.179:*, 194.68.169.44:80}[69.0323%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (45.9807%)&lt;BR/&gt; 1863: (2.41158%)&lt;BR/&gt; 7001: (0.643087%)&lt;BR/&gt; 1036: (0.482315%)&lt;BR/&gt; 5050: (0.321543%)&gt;];
}
1545--1662[label="0.0108696;1pkt 1fpkt"];
1545--2682[label="1;1pkt 1fpkt"];
1545--3312[label="1;155pkt 155fpkt"];
2682--3312[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="194.68.169.44" dst_port="80" src_ip="172.195.144.179"/>
    </slice>
    <from sec="1115269424" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.5.53.181"/>
    </slice>
    <from sec="1115269212" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="133.190.77.181"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.79.45.182"/>
    </slice>
    <from sec="1115269451" usec="0"/>
    <to sec="1115270091" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.908565,1.67978,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_486{
style=filled;
color=gray75;
1065[label="2.174.144.183;s;2pkt 2fpkt", shape=diamond, color=yellow];
1877[label="2.174.144.183;s;2pkt 2fpkt", shape=hexagon, color=black];
2702[label="2.174.144.183;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat486[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.174.144.183:80, 211.19.99.212:54155}[50%]&lt;BR/&gt;{2.174.144.183:80, 211.19.99.212:54277}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 54277: (30%)&lt;BR/&gt; 54155: (20%)&gt;];
}
1065--1877[label="1;2pkt 2fpkt"];
1065--2702[label="1;1pkt 1fpkt"];
1877--2702[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="211.19.99.212" dst_port="54277" src_ip="2.174.144.183" src_port="80"/>
      <filter dst_ip="211.19.99.212" dst_port="54155" src_ip="2.174.144.183" src_port="80"/>
    </slice>
    <from sec="1115269401" usec="0"/>
    <to sec="1115269618" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.4.164.183"/>
    </slice>
    <from sec="1115269222" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.25.31.185"/>
    </slice>
    <from sec="1115269210" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.101.46.188"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="192.226.69.190"/>
    </slice>
    <from sec="1115269770" usec="0"/>
    <to sec="1115269967" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.16.92.191"/>
    </slice>
    <from sec="1115269933" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.634441,1.66751,010,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_492{
style=filled;
color=gray75;
467[label="207.210.244.191;s;2938pkt 2938fpkt", shape=diamond, color=yellow];
2727[label="207.210.244.191;3180pkt 3180fpkt", shape=pentagon, color=darkviolet];
3334[label="207.210.244.191;3180pkt 3180fpkt", shape=invtriangle, color=brown];
stat492[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.210.244.191:8500, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8500: (50%)&lt;BR/&gt; 2001: (0.06453%)&lt;BR/&gt; 848: (0.06453%)&lt;BR/&gt; 2725: (0.0591525%)&lt;BR/&gt; 9346: (0.0483975%)&gt;];
}
467--583[label="0.00156495;1pkt 1fpkt"];
467--1992[label="0.00105374;1pkt 1fpkt"];
467--2727[label="1;2938pkt 2938fpkt"];
467--3334[label="1;2938pkt 2938fpkt"];
2727--3334[label="1;3180pkt 3180fpkt"];
</description>
    <slice>
      <filter src_ip="207.210.244.191" src_port="8500"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.540993,1.70541,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_493{
style=filled;
color=gray75;
1392[label="222.250.162.193;s;728pkt 728fpkt", shape=diamond, color=yellow];
2731[label="222.250.162.193;788pkt 788fpkt", shape=pentagon, color=darkviolet];
stat493[shape=component, label=&lt;Rules:&lt;BR/&gt;{222.250.162.193:1032, *:1434}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1434: (50%)&lt;BR/&gt; 1032: (50%)&gt;];
}
1392--2731[label="0.997253;726pkt 726fpkt"];
</description>
    <slice>
      <filter dst_port="1434" src_ip="222.250.162.193" src_port="1032"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="171.76.4.194"/>
    </slice>
    <from sec="1115269251" usec="0"/>
    <to sec="1115269978" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="171.76.80.194"/>
    </slice>
    <from sec="1115269225" usec="0"/>
    <to sec="1115270058" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.35.104.195"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="20.0.146.198"/>
    </slice>
    <from sec="1115269980" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="69.12.153.199"/>
    </slice>
    <from sec="1115269233" usec="0"/>
    <to sec="1115270099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="64.106.193.199"/>
    </slice>
    <from sec="1115269203" usec="0"/>
    <to sec="1115269352" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.634441,1.66751,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_500{
style=filled;
color=gray75;
683[label="93.156.158.200;s;3pkt 3fpkt", shape=diamond, color=yellow];
2763[label="93.156.158.200;2pkt 2fpkt", shape=pentagon, color=darkviolet];
3354[label="93.156.158.200;3pkt 3fpkt", shape=invtriangle, color=brown];
stat500[shape=component, label=&lt;Rules:&lt;BR/&gt;{93.156.158.200:1180, 210.53.133.104:40940}[33.3333%]&lt;BR/&gt;{93.156.158.200:1206, 210.53.133.104:33735}[33.3333%]&lt;BR/&gt;{93.156.158.200:1211, 210.53.133.104:10715}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 40940: (18.75%)&lt;BR/&gt; 33735: (18.75%)&lt;BR/&gt; 1206: (18.75%)&lt;BR/&gt; 1180: (18.75%)&lt;BR/&gt; 10715: (12.5%)&gt;];
}
683--2763[label="1;2pkt 2fpkt"];
683--3354[label="1;3pkt 3fpkt"];
2763--3354[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="210.53.133.104" dst_port="10715" src_ip="93.156.158.200" src_port="1211"/>
      <filter dst_ip="210.53.133.104" dst_port="33735" src_ip="93.156.158.200" src_port="1206"/>
      <filter dst_ip="210.53.133.104" dst_port="40940" src_ip="93.156.158.200" src_port="1180"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.91.76.201"/>
    </slice>
    <from sec="1115269570" usec="0"/>
    <to sec="1115269584" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.195.126.201"/>
    </slice>
    <from sec="1115269287" usec="0"/>
    <to sec="1115270097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.106.20.202"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.178.23.202"/>
    </slice>
    <from sec="1115269213" usec="0"/>
    <to sec="1115270095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.5.114.202"/>
    </slice>
    <from sec="1115269218" usec="0"/>
    <to sec="1115270069" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="52.214.122.202"/>
    </slice>
    <from sec="1115269203" usec="0"/>
    <to sec="1115270094" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="16.153.37.203"/>
    </slice>
    <from sec="1115269202" usec="0"/>
    <to sec="1115270099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.130.150.203"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="67.54.154.205"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.540993,1.70541,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_510{
style=filled;
color=gray75;
1371[label="131.5.11.144;d;121pkt 121fpkt", shape=diamond, color=yellow];
2504[label="206.156.128.130;2pkt 2fpkt", shape=pentagon, color=darkviolet];
2790[label="202.144.174.206;7pkt 7fpkt", shape=pentagon, color=darkviolet];
stat510[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.24.160.68:80, 131.5.11.144:*}[35.7143%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2356: (0.769231%)&lt;BR/&gt; 2355: (0.769231%)&lt;BR/&gt; 2218: (0.769231%)&lt;BR/&gt; 2217: (0.769231%)&gt;];
}
1371--1997[label="0.165289;20pkt 20fpkt"];
1371--2004[label="0.0330579;4pkt 4fpkt"];
1371--2020[label="0.165289;20pkt 20fpkt"];
1371--2024[label="0.0330579;4pkt 4fpkt"];
1371--2031[label="0.165289;20pkt 20fpkt"];
1371--2035[label="0.0330579;4pkt 4fpkt"];
1371--2307[label="1;45pkt 45fpkt"];
1371--2504[label="1;2pkt 2fpkt"];
1371--2790[label="0.285714;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="131.5.11.144" src_ip="194.24.160.68" src_port="80"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270024" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="69.200.181.208"/>
    </slice>
    <from sec="1115269671" usec="0"/>
    <to sec="1115269793" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="206.61.11.209"/>
    </slice>
    <from sec="1115269216" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.77477,1.65068,503,1 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_513{
style=filled;
color=gray75;
110[label="133.190.77.209s;114pkt 114fpkt", shape=rectangle, color=red];
918[label="133.190.77.209;s;320pkt 320fpkt", shape=diamond, color=yellow];
2799[label="133.190.77.209;324pkt 324fpkt", shape=pentagon, color=darkviolet];
stat513[shape=component, label=&lt;Rules:&lt;BR/&gt;{133.190.77.209:*, 67.35.35.8:80}[34.4615%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.2084%)&lt;BR/&gt; 9898: (0.263852%)&lt;BR/&gt; 5554: (0.263852%)&lt;BR/&gt; 1023: (0.263852%)&lt;BR/&gt; 42854: (0.197889%)&gt;];
}
110--918[label="1;114pkt 114fpkt"];
110--2799[label="1;114pkt 114fpkt"];
918--982[label="0.175;7pkt 7fpkt"];
918--1586[label="0.009375;3pkt 3fpkt"];
918--1708[label="0.009375;3pkt 3fpkt"];
918--2799[label="0.996875;319pkt 319fpkt"];
</description>
    <slice>
      <filter dst_ip="67.35.35.8" dst_port="80" src_ip="133.190.77.209"/>
    </slice>
    <from sec="1115269215" usec="0"/>
    <to sec="1115270086" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.55.167.210"/>
    </slice>
    <from sec="1115269205" usec="0"/>
    <to sec="1115270099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.634441,1.66751,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_515{
style=filled;
color=gray75;
1286[label="133.33.228.210;s;58pkt 58fpkt", shape=diamond, color=yellow];
2810[label="133.33.228.210;64pkt 64fpkt", shape=pentagon, color=darkviolet];
3379[label="133.33.228.210;65pkt 65fpkt", shape=invtriangle, color=brown];
stat515[shape=component, label=&lt;Rules:&lt;BR/&gt;{133.33.228.210:*, 64.199.35.196:80}[43.0769%]&lt;BR/&gt;{133.33.228.210:*, 169.193.18.248:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.1979%)&lt;BR/&gt; 4736: (0.802139%)&lt;BR/&gt; 4707: (0.802139%)&lt;BR/&gt; 4703: (0.802139%)&lt;BR/&gt; 4702: (0.802139%)&gt;];
}
1286--2810[label="0.982759;57pkt 57fpkt"];
1286--3379[label="1;58pkt 58fpkt"];
2810--3379[label="1;64pkt 64fpkt"];
</description>
    <slice>
      <filter dst_ip="64.199.35.196" dst_port="80" src_ip="133.33.228.210"/>
      <filter dst_ip="169.193.18.248" dst_port="80" src_ip="133.33.228.210"/>
    </slice>
    <from sec="1115269208" usec="0"/>
    <to sec="1115270080" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.5.2.211"/>
    </slice>
    <from sec="1115269202" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.19.99.211"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.699323,1.69856,503,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_518{
style=filled;
color=gray75;
58[label="172.195.237.212s;1pkt 1fpkt", shape=rectangle, color=red];
2818[label="172.195.237.212;4pkt 4fpkt", shape=pentagon, color=darkviolet];
stat518[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.237.212:7198, 64.112.46.173:80}[25%]&lt;BR/&gt;{172.195.237.212:7199, 64.112.46.173:80}[25%]&lt;BR/&gt;{172.195.237.212:7200, 64.112.46.173:80}[25%]&lt;BR/&gt;{172.195.237.212:7201, 64.112.46.173:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 7199: (20%)&lt;BR/&gt; 7201: (10%)&lt;BR/&gt; 7200: (10%)&lt;BR/&gt; 7198: (10%)&gt;];
}
58--1561[label="1;1pkt 1fpkt"];
58--2818[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="64.112.46.173" dst_port="80" src_ip="172.195.237.212" src_port="7201"/>
      <filter dst_ip="64.112.46.173" dst_port="80" src_ip="172.195.237.212" src_port="7200"/>
      <filter dst_ip="64.112.46.173" dst_port="80" src_ip="172.195.237.212" src_port="7199"/>
      <filter dst_ip="64.112.46.173" dst_port="80" src_ip="172.195.237.212" src_port="7198"/>
    </slice>
    <from sec="1115269694" usec="0"/>
    <to sec="1115269918" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.34.199.213"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="71.92.96.215"/>
    </slice>
    <from sec="1115269205" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.5.177.215"/>
    </slice>
    <from sec="1115269336" usec="0"/>
    <to sec="1115269396" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.5.216.215"/>
    </slice>
    <from sec="1115269481" usec="0"/>
    <to sec="1115269760" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.127.143.216"/>
    </slice>
    <from sec="1115269481" usec="0"/>
    <to sec="1115270090" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="222.53.96.218"/>
    </slice>
    <from sec="1115269394" usec="0"/>
    <to sec="1115269404" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.540993,1.70541,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_525{
style=filled;
color=gray75;
1717[label="202.57.208.220;s;25pkt 25fpkt", shape=diamond, color=yellow];
2836[label="202.57.208.220;32pkt 32fpkt", shape=pentagon, color=darkviolet];
stat525[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.57.208.220:*, 131.5.172.62:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4757: (1.75439%)&lt;BR/&gt; 4756: (1.75439%)&lt;BR/&gt; 4755: (1.75439%)&lt;BR/&gt; 4754: (1.75439%)&gt;];
}
1717--2836[label="1;25pkt 25fpkt"];
</description>
    <slice>
      <filter dst_ip="131.5.172.62" dst_port="80" src_ip="202.57.208.220"/>
    </slice>
    <from sec="1115269926" usec="0"/>
    <to sec="1115270064" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="206.37.173.221"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="206.169.98.224"/>
    </slice>
    <from sec="1115269392" usec="0"/>
    <to sec="1115269431" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.5.186.224"/>
    </slice>
    <from sec="1115269203" usec="0"/>
    <to sec="1115270083" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.5.28.225"/>
    </slice>
    <from sec="1115269234" usec="0"/>
    <to sec="1115269263" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.82.122.225"/>
    </slice>
    <from sec="1115269861" usec="0"/>
    <to sec="1115269908" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="69.208.157.225"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="95.96.66.226"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="20.51.159.226"/>
    </slice>
    <from sec="1115269649" usec="0"/>
    <to sec="1115269673" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.5.223.226"/>
    </slice>
    <from sec="1115269861" usec="0"/>
    <to sec="1115269913" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.195.110.227"/>
    </slice>
    <from sec="1115269206" usec="0"/>
    <to sec="1115269810" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="131.4.228.227"/>
    </slice>
    <from sec="1115269215" usec="0"/>
    <to sec="1115270089" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.634441,1.66751,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_537{
style=filled;
color=gray75;
1514[label="206.77.26.229;s;612pkt 612fpkt", shape=diamond, color=yellow];
2871[label="206.77.26.229;660pkt 660fpkt", shape=pentagon, color=darkviolet];
3408[label="206.77.26.229;661pkt 661fpkt", shape=invtriangle, color=brown];
stat537[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.77.26.229:1040, *:1434}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1434: (50%)&lt;BR/&gt; 1040: (50%)&gt;];
}
1514--2871[label="0.998366;611pkt 611fpkt"];
1514--3408[label="0.998366;611pkt 611fpkt"];
2871--3408[label="1;660pkt 660fpkt"];
</description>
    <slice>
      <filter dst_port="1434" src_ip="206.77.26.229" src_port="1040"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="133.190.133.229"/>
    </slice>
    <from sec="1115269223" usec="0"/>
    <to sec="1115270067" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="69.83.150.229"/>
    </slice>
    <from sec="1115269205" usec="0"/>
    <to sec="1115269848" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="23.41.21.230"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="92.182.105.230"/>
    </slice>
    <from sec="1115269909" usec="0"/>
    <to sec="1115269942" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.773883,1.66051,002,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_542{
style=filled;
color=gray75;
154[label="203.134.73.233s;39pkt 39fpkt", shape=rectangle, color=red];
2883[label="203.134.73.233;117pkt 117fpkt", shape=pentagon, color=darkviolet];
3411[label="203.134.73.233;117pkt 117fpkt", shape=invtriangle, color=brown];
stat542[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.134.73.233:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
154--2883[label="1;39pkt 39fpkt"];
154--3411[label="1;39pkt 39fpkt"];
2883--3411[label="1;117pkt 117fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="203.134.73.233" src_port="1025"/>
    </slice>
    <from sec="1115269755" usec="0"/>
    <to sec="1115269780" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="207.72.148.234"/>
    </slice>
    <from sec="1115269203" usec="0"/>
    <to sec="1115270092" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.170.193.234"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115269354" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.251.76.236"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270003" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.136.220.236"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="206.61.51.239"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.7.86.239"/>
    </slice>
    <from sec="1115269203" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.634441,1.66751,010,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_549{
style=filled;
color=gray75;
973[label="220.77.157.239;s;14pkt 14fpkt", shape=diamond, color=yellow];
1232[label="171.76.48.40;d;1pkt 1fpkt", shape=diamond, color=yellow];
2904[label="220.77.157.239;2pkt 2fpkt", shape=pentagon, color=darkviolet];
3427[label="220.77.157.239;1pkt 1fpkt", shape=invtriangle, color=brown];
stat549[shape=component, label=&lt;Rules:&lt;BR/&gt;{220.77.157.239:*, 171.76.48.91:113}[28.5714%]&lt;BR/&gt;{220.77.157.239:6667, 171.76.48.91:*}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (22.2222%)&lt;BR/&gt; 113: (13.8889%)&lt;BR/&gt; 6665: (8.33333%)&lt;BR/&gt; 1586: (8.33333%)&lt;BR/&gt; 1159: (8.33333%)&gt;];
}
973--1232[label="1;1pkt 1fpkt"];
973--2904[label="1;2pkt 2fpkt"];
973--3427[label="1;1pkt 1fpkt"];
1232--2904[label="1;1pkt 1fpkt"];
2904--3427[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="171.76.48.91" src_ip="220.77.157.239" src_port="6667"/>
      <filter dst_ip="171.76.48.91" dst_port="113" src_ip="220.77.157.239"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="193.92.24.241"/>
    </slice>
    <from sec="1115269448" usec="0"/>
    <to sec="1115269452" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="207.75.2.244"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.97.77.245"/>
    </slice>
    <from sec="1115269217" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="192.250.66.246"/>
    </slice>
    <from sec="1115269274" usec="0"/>
    <to sec="1115269312" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="206.56.113.246"/>
    </slice>
    <from sec="1115269914" usec="0"/>
    <to sec="1115269944" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.208.141.247"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="95.24.54.248"/>
    </slice>
    <from sec="1115269203" usec="0"/>
    <to sec="1115269220" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.859378,1.64748,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_557{
style=filled;
color=gray75;
1695[label="210.0.53.249;s;11pkt 11fpkt", shape=diamond, color=yellow];
2940[label="210.0.53.249;11pkt 11fpkt", shape=pentagon, color=darkviolet];
3447[label="210.0.53.249;10pkt 10fpkt", shape=invtriangle, color=brown];
3721[label="210.0.53.249;11pkt 11fpkt", shape=invhouse, color=bisque];
stat557[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.0.53.249:*, 149.188.130.50:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 64252: (4.65116%)&lt;BR/&gt; 63883: (4.65116%)&lt;BR/&gt; 63083: (4.65116%)&lt;BR/&gt; 59715: (4.65116%)&gt;];
}
1695--2940[label="1;11pkt 11fpkt"];
1695--3447[label="1;10pkt 10fpkt"];
1695--3721[label="1;11pkt 11fpkt"];
2940--3447[label="1;10pkt 10fpkt"];
2940--3721[label="1;11pkt 11fpkt"];
3447--3721[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.130.50" dst_port="80" src_ip="210.0.53.249"/>
    </slice>
    <from sec="1115269751" usec="0"/>
    <to sec="1115270037" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="192.57.16.252"/>
    </slice>
    <from sec="1115269222" usec="0"/>
    <to sec="1115270091" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.425979,1.7518,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="192.43.176.254"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115269340" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="214.234.17.1"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,020,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="211.25.21.1"/>
    </slice>
    <from sec="1115269212" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_562{
style=filled;
color=gray75;
2049[label="172.195.110.1;10pkt 10fpkt", shape=pentagon, color=darkviolet];
2964[label="172.195.110.1;10pkt 10fpkt", shape=invtriangle, color=brown];
stat562[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.110.1:*, 204.166.144.45:80}[70%]&lt;BR/&gt;{172.195.110.1:*, 214.153.51.145:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3915: (5%)&lt;BR/&gt; 3914: (5%)&lt;BR/&gt; 3912: (5%)&lt;BR/&gt; 3911: (5%)&gt;];
}
2049--2964[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter dst_ip="204.166.144.45" dst_port="80" src_ip="172.195.110.1"/>
      <filter dst_ip="214.153.51.145" dst_port="80" src_ip="172.195.110.1"/>
    </slice>
    <from sec="1115269407" usec="0"/>
    <to sec="1115270093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="69.49.101.2"/>
    </slice>
    <from sec="1115269203" usec="0"/>
    <to sec="1115270092" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_564{
style=filled;
color=gray75;
2068[label="215.129.39.6;182pkt 182fpkt", shape=pentagon, color=darkviolet];
2970[label="215.129.39.6;182pkt 182fpkt", shape=invtriangle, color=brown];
stat564[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.129.39.6:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
2068--2970[label="1;182pkt 182fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="215.129.39.6" src_port="1025"/>
    </slice>
    <from sec="1115269318" usec="0"/>
    <to sec="1115269351" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.859378,1.64748,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_566{
style=filled;
color=gray75;
1558[label="172.195.108.9;s;24pkt 24fpkt", shape=diamond, color=yellow];
2084[label="172.195.108.9;43pkt 43fpkt", shape=pentagon, color=darkviolet];
2978[label="172.195.108.9;43pkt 43fpkt", shape=invtriangle, color=brown];
3471[label="172.195.108.9;43pkt 43fpkt", shape=invhouse, color=bisque];
stat566[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.108.9:*, 200.172.193.204:80}[20.9302%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.3856%)&lt;BR/&gt; 10015: (1.30719%)&lt;BR/&gt; 7471: (1.30719%)&lt;BR/&gt; 2849: (1.30719%)&lt;BR/&gt; 2848: (1.30719%)&gt;];
}
1558--2084[label="1;24pkt 24fpkt"];
1558--2978[label="1;24pkt 24fpkt"];
1558--3471[label="1;24pkt 24fpkt"];
2084--2978[label="1;43pkt 43fpkt"];
2084--3471[label="1;43pkt 43fpkt"];
2978--3471[label="1;43pkt 43fpkt"];
</description>
    <slice>
      <filter dst_ip="200.172.193.204" dst_port="80" src_ip="172.195.108.9"/>
    </slice>
    <from sec="1115269281" usec="0"/>
    <to sec="1115270099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_567{
style=filled;
color=gray75;
2091[label="210.73.72.11;134pkt 134fpkt", shape=pentagon, color=darkviolet];
2983[label="210.73.72.11;135pkt 135fpkt", shape=invtriangle, color=brown];
3473[label="210.73.72.11;134pkt 134fpkt", shape=invhouse, color=bisque];
stat567[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.73.72.11:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 4715: (0.372208%)&lt;BR/&gt; 4713: (0.372208%)&lt;BR/&gt; 4712: (0.372208%)&lt;BR/&gt; 4710: (0.372208%)&gt;];
}
2091--2983[label="1;134pkt 134fpkt"];
2091--3473[label="1;134pkt 134fpkt"];
2983--3473[label="1;134pkt 134fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="210.73.72.11"/>
    </slice>
    <from sec="1115269824" usec="0"/>
    <to sec="1115269826" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="67.110.62.12"/>
    </slice>
    <from sec="1115269207" usec="0"/>
    <to sec="1115269509" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,504,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_569{
style=filled;
color=gray75;
2104[label="172.195.98.16;4pkt 4fpkt", shape=pentagon, color=darkviolet];
2993[label="172.195.98.16;4pkt 4fpkt", shape=invtriangle, color=brown];
3481[label="172.195.98.16;4pkt 4fpkt", shape=invhouse, color=bisque];
stat569[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.98.16:4343, 214.12.5.36:80}[25%]&lt;BR/&gt;{172.195.98.16:4333, 214.12.44.182:80}[25%]&lt;BR/&gt;{172.195.98.16:4341, 66.213.229.76:80}[25%]&lt;BR/&gt;{172.195.98.16:4348, 66.213.229.76:443}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (37.5%)&lt;BR/&gt; 4348: (12.5%)&lt;BR/&gt; 4343: (12.5%)&lt;BR/&gt; 4341: (12.5%)&lt;BR/&gt; 4333: (12.5%)&gt;];
}
2104--2993[label="1;4pkt 4fpkt"];
2104--3481[label="1;4pkt 4fpkt"];
2993--3481[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="66.213.229.76" dst_port="443" src_ip="172.195.98.16" src_port="4348"/>
      <filter dst_ip="66.213.229.76" dst_port="80" src_ip="172.195.98.16" src_port="4341"/>
      <filter dst_ip="214.12.44.182" dst_port="80" src_ip="172.195.98.16" src_port="4333"/>
      <filter dst_ip="214.12.5.36" dst_port="80" src_ip="172.195.98.16" src_port="4343"/>
    </slice>
    <from sec="1115269946" usec="0"/>
    <to sec="1115269964" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_570{
style=filled;
color=gray75;
2105[label="207.150.167.16;1pkt 1fpkt", shape=pentagon, color=darkviolet];
2994[label="207.150.167.16;1pkt 1fpkt", shape=invtriangle, color=brown];
stat570[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.150.167.16:80, 211.19.96.146:32391}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 32391: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
2105--2994[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="211.19.96.146" dst_port="32391" src_ip="207.150.167.16" src_port="80"/>
    </slice>
    <from sec="1115269565" usec="0"/>
    <to sec="1115269722" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.634441,1.66751,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_571{
style=filled;
color=gray75;
1657[label="204.157.40.49;d;134pkt 134fpkt", shape=diamond, color=yellow];
2622[label="131.5.0.161;28pkt 28fpkt", shape=pentagon, color=darkviolet];
2695[label="131.5.205.181;29pkt 29fpkt", shape=pentagon, color=darkviolet];
2995[label="131.4.176.16;100pkt 100fpkt", shape=invtriangle, color=brown];
3318[label="131.5.205.181;28pkt 28fpkt", shape=invtriangle, color=brown];
stat571[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 204.157.40.49:80}[60.4839%]&lt;BR/&gt;{131.4.176.16:*, *:80}[31.0484%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.395%)&lt;BR/&gt; 0: (3.1348%)&lt;BR/&gt; 1187: (1.41066%)&lt;BR/&gt; 53: (1.25392%)&lt;BR/&gt; 1263: (0.626959%)&gt;];
}
1657--1689[label="0.164384;12pkt 12fpkt"];
1657--1743[label="0.00746269;1pkt 1fpkt"];
1657--1912[label="0.00746269;1pkt 1fpkt"];
1657--1973[label="0.00746269;1pkt 1fpkt"];
1657--2567[label="0.00746269;1pkt 1fpkt"];
1657--2622[label="0.25;7pkt 7fpkt"];
1657--2695[label="0.827586;24pkt 24fpkt"];
1657--2815[label="0.00746269;1pkt 1fpkt"];
1657--2995[label="0.12;12pkt 12fpkt"];
1657--3246[label="0.00746269;1pkt 1fpkt"];
1657--3318[label="0.821429;23pkt 23fpkt"];
2695--3318[label="1;28pkt 28fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="131.4.176.16"/>
      <filter dst_ip="204.157.40.49" dst_port="80"/>
    </slice>
    <from sec="1115269204" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_572{
style=filled;
color=gray75;
2107[label="131.5.14.17;13pkt 13fpkt", shape=pentagon, color=darkviolet];
2996[label="131.5.14.17;14pkt 14fpkt", shape=invtriangle, color=brown];
3482[label="131.5.14.17;14pkt 14fpkt", shape=invhouse, color=bisque];
stat572[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.14.17:*, 204.152.61.237:80}[42.8571%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.3415%)&lt;BR/&gt; 1070: (3.65854%)&lt;BR/&gt; 1068: (3.65854%)&lt;BR/&gt; 1067: (3.65854%)&lt;BR/&gt; 1066: (3.65854%)&gt;];
}
2107--2996[label="1;13pkt 13fpkt"];
2107--3482[label="1;13pkt 13fpkt"];
2996--3482[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter dst_ip="204.152.61.237" dst_port="80" src_ip="131.5.14.17"/>
    </slice>
    <from sec="1115269781" usec="0"/>
    <to sec="1115270099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_573{
style=filled;
color=gray75;
2113[label="21.233.196.18;4pkt 4fpkt", shape=pentagon, color=darkviolet];
2998[label="21.233.196.18;5pkt 5fpkt", shape=invtriangle, color=brown];
stat573[shape=component, label=&lt;Rules:&lt;BR/&gt;{21.233.196.18:2503, 133.190.149.216:80}[20%]&lt;BR/&gt;{21.233.196.18:2504, 133.190.149.216:80}[20%]&lt;BR/&gt;{21.233.196.18:2505, 133.190.149.216:80}[20%]&lt;BR/&gt;{21.233.196.18:2506, 133.190.149.216:80}[20%]&lt;BR/&gt;{21.233.196.18:2507, 133.190.149.216:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2507: (11.1111%)&lt;BR/&gt; 2506: (11.1111%)&lt;BR/&gt; 2505: (11.1111%)&lt;BR/&gt; 2504: (11.1111%)&gt;];
}
2113--2998[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="133.190.149.216" dst_port="80" src_ip="21.233.196.18" src_port="2507"/>
      <filter dst_ip="133.190.149.216" dst_port="80" src_ip="21.233.196.18" src_port="2506"/>
      <filter dst_ip="133.190.149.216" dst_port="80" src_ip="21.233.196.18" src_port="2505"/>
      <filter dst_ip="133.190.149.216" dst_port="80" src_ip="21.233.196.18" src_port="2504"/>
      <filter dst_ip="133.190.149.216" dst_port="80" src_ip="21.233.196.18" src_port="2503"/>
    </slice>
    <from sec="1115269461" usec="0"/>
    <to sec="1115269514" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_574{
style=filled;
color=gray75;
2115[label="210.62.213.18;82pkt 82fpkt", shape=pentagon, color=darkviolet];
3000[label="210.62.213.18;83pkt 83fpkt", shape=invtriangle, color=brown];
3485[label="210.62.213.18;83pkt 83fpkt", shape=invhouse, color=bisque];
stat574[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.62.213.18:*, *:445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (50%)&lt;BR/&gt; 3599: (1.20968%)&lt;BR/&gt; 3178: (1.20968%)&lt;BR/&gt; 4986: (0.604839%)&lt;BR/&gt; 4878: (0.604839%)&gt;];
}
2115--3000[label="1;82pkt 82fpkt"];
2115--3485[label="1;82pkt 82fpkt"];
3000--3485[label="1;83pkt 83fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="210.62.213.18"/>
    </slice>
    <from sec="1115269251" usec="0"/>
    <to sec="1115270099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.634441,1.66751,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_575{
style=filled;
color=gray75;
1459[label="207.149.65.19;s;1pkt 1fpkt", shape=diamond, color=yellow];
2117[label="207.149.65.19;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3001[label="207.149.65.19;1pkt 1fpkt", shape=invtriangle, color=brown];
stat575[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.149.65.19:4873, 149.188.205.117:2747}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4873: (50%)&lt;BR/&gt; 2747: (50%)&gt;];
}
1459--2117[label="1;1pkt 1fpkt"];
1459--3001[label="1;1pkt 1fpkt"];
2117--3001[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.205.117" dst_port="2747" src_ip="207.149.65.19" src_port="4873"/>
    </slice>
    <from sec="1115269316" usec="0"/>
    <to sec="1115270096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_576{
style=filled;
color=gray75;
2119[label="211.97.100.20;200pkt 200fpkt", shape=pentagon, color=darkviolet];
3003[label="211.97.100.20;201pkt 201fpkt", shape=invtriangle, color=brown];
3487[label="211.97.100.20;201pkt 201fpkt", shape=invhouse, color=bisque];
stat576[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.97.100.20:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
2119--3003[label="1;200pkt 200fpkt"];
2119--3487[label="1;200pkt 200fpkt"];
3003--3487[label="1;201pkt 201fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="211.97.100.20" src_port="1028"/>
    </slice>
    <from sec="1115270074" usec="0"/>
    <to sec="1115270097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_577{
style=filled;
color=gray75;
2122[label="210.3.203.20;49pkt 49fpkt", shape=pentagon, color=darkviolet];
3004[label="210.3.203.20;49pkt 49fpkt", shape=invtriangle, color=brown];
stat577[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.3.203.20:*, *:445}[22.449%]&lt;BR/&gt;{210.3.203.20:*, *:1025}[22.449%]&lt;BR/&gt;{210.3.203.20:*, *:135}[20.4082%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (11.2245%)&lt;BR/&gt; 445: (11.2245%)&lt;BR/&gt; 135: (10.2041%)&lt;BR/&gt; 139: (9.18367%)&lt;BR/&gt; 1433: (8.16327%)&gt;];
}
2122--3004[label="1;49pkt 49fpkt"];
</description>
    <slice>
      <filter dst_port="1025" src_ip="210.3.203.20"/>
      <filter dst_port="445" src_ip="210.3.203.20"/>
      <filter dst_port="135" src_ip="210.3.203.20"/>
    </slice>
    <from sec="1115269215" usec="0"/>
    <to sec="1115270070" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_578{
style=filled;
color=gray75;
2123[label="133.190.226.20;40pkt 40fpkt", shape=pentagon, color=darkviolet];
3005[label="133.190.226.20;39pkt 39fpkt", shape=invtriangle, color=brown];
stat578[shape=component, label=&lt;Rules:&lt;BR/&gt;{133.190.226.20:*, *:80}[27.5%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (13.9241%)&lt;BR/&gt; 65305: (1.26582%)&lt;BR/&gt; 64394: (1.26582%)&lt;BR/&gt; 64000: (1.26582%)&lt;BR/&gt; 63088: (1.26582%)&gt;];
}
2123--3005[label="1;39pkt 39fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="133.190.226.20"/>
    </slice>
    <from sec="1115269233" usec="0"/>
    <to sec="1115270092" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_579{
style=filled;
color=gray75;
2127[label="21.20.211.21;5pkt 5fpkt", shape=pentagon, color=darkviolet];
3008[label="21.20.211.21;5pkt 5fpkt", shape=invtriangle, color=brown];
3489[label="21.20.211.21;5pkt 5fpkt", shape=invhouse, color=bisque];
stat579[shape=component, label=&lt;Rules:&lt;BR/&gt;{21.20.211.21:38831, 133.190.81.197:80}[20%]&lt;BR/&gt;{21.20.211.21:38832, 133.190.81.197:80}[20%]&lt;BR/&gt;{21.20.211.21:38833, 133.190.81.197:80}[20%]&lt;BR/&gt;{21.20.211.21:38834, 133.190.81.197:80}[20%]&lt;BR/&gt;{21.20.211.21:38835, 133.190.81.197:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 38835: (10%)&lt;BR/&gt; 38834: (10%)&lt;BR/&gt; 38833: (10%)&lt;BR/&gt; 38832: (10%)&gt;];
}
2127--3008[label="1;5pkt 5fpkt"];
2127--3489[label="1;5pkt 5fpkt"];
3008--3489[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="133.190.81.197" dst_port="80" src_ip="21.20.211.21" src_port="38835"/>
      <filter dst_ip="133.190.81.197" dst_port="80" src_ip="21.20.211.21" src_port="38834"/>
      <filter dst_ip="133.190.81.197" dst_port="80" src_ip="21.20.211.21" src_port="38833"/>
      <filter dst_ip="133.190.81.197" dst_port="80" src_ip="21.20.211.21" src_port="38832"/>
      <filter dst_ip="133.190.81.197" dst_port="80" src_ip="21.20.211.21" src_port="38831"/>
    </slice>
    <from sec="1115270009" usec="0"/>
    <to sec="1115270041" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_580{
style=filled;
color=gray75;
2129[label="211.19.97.22;2pkt 2fpkt", shape=pentagon, color=darkviolet];
3009[label="211.19.97.22;2pkt 2fpkt", shape=invtriangle, color=brown];
stat580[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.19.97.22:25, 210.90.103.30:59847}[50%]&lt;BR/&gt;{211.19.97.22:25, 88.192.144.46:3840}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 59847: (25%)&lt;BR/&gt; 3840: (25%)&gt;];
}
2129--3009[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="88.192.144.46" dst_port="3840" src_ip="211.19.97.22" src_port="25"/>
      <filter dst_ip="210.90.103.30" dst_port="59847" src_ip="211.19.97.22" src_port="25"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="202.109.152.22"/>
    </slice>
    <from sec="1115269205" usec="0"/>
    <to sec="1115270096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="93.94.232.22"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="131.4.60.23"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_584{
style=filled;
color=gray75;
2137[label="210.3.230.23;41pkt 41fpkt", shape=pentagon, color=darkviolet];
3015[label="210.3.230.23;41pkt 41fpkt", shape=invtriangle, color=brown];
3492[label="210.3.230.23;40pkt 40fpkt", shape=invhouse, color=bisque];
stat584[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.3.230.23:*, *:135}[24.3902%]&lt;BR/&gt;{210.3.230.23:*, *:1025}[21.9512%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (11.8852%)&lt;BR/&gt; 1025: (11.0656%)&lt;BR/&gt; 445: (9.83607%)&lt;BR/&gt; 1433: (8.60656%)&lt;BR/&gt; 139: (8.60656%)&gt;];
}
2137--3015[label="1;41pkt 41fpkt"];
2137--3492[label="1;40pkt 40fpkt"];
3015--3492[label="1;40pkt 40fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="210.3.230.23"/>
      <filter dst_port="1025" src_ip="210.3.230.23"/>
    </slice>
    <from sec="1115269438" usec="0"/>
    <to sec="1115270086" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_585{
style=filled;
color=gray75;
2140[label="210.72.6.24;39pkt 39fpkt", shape=pentagon, color=darkviolet];
3017[label="210.72.6.24;40pkt 40fpkt", shape=invtriangle, color=brown];
3493[label="210.72.6.24;39pkt 39fpkt", shape=invhouse, color=bisque];
stat585[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.72.6.24:*, *:135}[20%]&lt;BR/&gt;{210.72.6.24:*, *:139}[20%]&lt;BR/&gt;{210.72.6.24:*, *:445}[20%]&lt;BR/&gt;{210.72.6.24:*, *:1025}[20%]&lt;BR/&gt;{210.72.6.24:*, *:1433}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1433: (10.1695%)&lt;BR/&gt; 1025: (10.1695%)&lt;BR/&gt; 445: (10.1695%)&lt;BR/&gt; 139: (10.1695%)&lt;BR/&gt; 135: (9.32203%)&gt;];
}
2140--3017[label="1;39pkt 39fpkt"];
2140--3493[label="1;39pkt 39fpkt"];
3017--3493[label="1;39pkt 39fpkt"];
</description>
    <slice>
      <filter dst_port="1433" src_ip="210.72.6.24"/>
      <filter dst_port="1025" src_ip="210.72.6.24"/>
      <filter dst_port="445" src_ip="210.72.6.24"/>
      <filter dst_port="139" src_ip="210.72.6.24"/>
      <filter dst_port="135" src_ip="210.72.6.24"/>
    </slice>
    <from sec="1115269231" usec="0"/>
    <to sec="1115270058" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_586{
style=filled;
color=gray75;
2143[label="200.151.75.24;438pkt 438fpkt", shape=pentagon, color=darkviolet];
3018[label="200.151.75.24;437pkt 437fpkt", shape=invtriangle, color=brown];
3494[label="200.151.75.24;437pkt 437fpkt", shape=invhouse, color=bisque];
stat586[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.151.75.24:*, *:5554}[52.968%]&lt;BR/&gt;{200.151.75.24:*, *:9898}[47.032%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (26.4482%)&lt;BR/&gt; 9898: (23.5518%)&lt;BR/&gt; 3820: (0.114329%)&lt;BR/&gt; 3819: (0.114329%)&lt;BR/&gt; 3818: (0.114329%)&gt;];
}
2143--3018[label="1;437pkt 437fpkt"];
2143--3494[label="1;437pkt 437fpkt"];
3018--3494[label="1;437pkt 437fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="200.151.75.24"/>
      <filter dst_port="9898" src_ip="200.151.75.24"/>
    </slice>
    <from sec="1115269812" usec="0"/>
    <to sec="1115269815" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="212.88.161.25"/>
    </slice>
    <from sec="1115269339" usec="0"/>
    <to sec="1115269380" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,001,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_588{
style=filled;
color=gray75;
2152[label="203.214.193.26;21pkt 21fpkt", shape=pentagon, color=darkviolet];
3022[label="203.214.193.26;20pkt 20fpkt", shape=invtriangle, color=brown];
stat588[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.214.193.26:*, *:1023}[71.4286%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1023: (35.3659%)&lt;BR/&gt; 9898: (7.31707%)&lt;BR/&gt; 5554: (7.31707%)&lt;BR/&gt; 4879: (4.87805%)&lt;BR/&gt; 2831: (4.87805%)&gt;];
}
2152--3022[label="1;20pkt 20fpkt"];
</description>
    <slice>
      <filter dst_port="1023" src_ip="203.214.193.26"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="211.197.75.28"/>
    </slice>
    <from sec="1115269809" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_590{
style=filled;
color=gray75;
2157[label="210.75.91.28;104pkt 104fpkt", shape=pentagon, color=darkviolet];
3025[label="210.75.91.28;105pkt 105fpkt", shape=invtriangle, color=brown];
stat590[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.75.91.28:*, *:445}[75.2381%]&lt;BR/&gt;{210.75.91.28:*, *:135}[24.7619%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (37.5598%)&lt;BR/&gt; 135: (12.4402%)&lt;BR/&gt; 4166: (0.956938%)&lt;BR/&gt; 3561: (0.956938%)&lt;BR/&gt; 3453: (0.956938%)&gt;];
}
2157--3025[label="1;104pkt 104fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="210.75.91.28"/>
      <filter dst_port="135" src_ip="210.75.91.28"/>
    </slice>
    <from sec="1115269203" usec="0"/>
    <to sec="1115270099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_591{
style=filled;
color=gray75;
2164[label="21.2.146.31;67pkt 67fpkt", shape=pentagon, color=darkviolet];
3027[label="21.2.146.31;68pkt 68fpkt", shape=invtriangle, color=brown];
3501[label="21.2.146.31;68pkt 68fpkt", shape=invhouse, color=bisque];
stat591[shape=component, label=&lt;Rules:&lt;BR/&gt;{21.2.146.31:*, *:139}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 139: (50%)&lt;BR/&gt; 61033: (0.738916%)&lt;BR/&gt; 59707: (0.738916%)&lt;BR/&gt; 58646: (0.738916%)&lt;BR/&gt; 58116: (0.738916%)&gt;];
}
2164--3027[label="1;67pkt 67fpkt"];
2164--3501[label="1;67pkt 67fpkt"];
3027--3501[label="1;68pkt 68fpkt"];
</description>
    <slice>
      <filter dst_port="139" src_ip="21.2.146.31"/>
    </slice>
    <from sec="1115269427" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_592{
style=filled;
color=gray75;
2170[label="133.190.226.32;64pkt 64fpkt", shape=pentagon, color=darkviolet];
3031[label="133.190.226.32;65pkt 65fpkt", shape=invtriangle, color=brown];
stat592[shape=component, label=&lt;Rules:&lt;BR/&gt;{133.190.226.32:*, *:80}[98.4615%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.2248%)&lt;BR/&gt; 8000: (0.775194%)&lt;BR/&gt; 3857: (0.775194%)&lt;BR/&gt; 3688: (0.775194%)&lt;BR/&gt; 3686: (0.775194%)&gt;];
}
2170--3031[label="1;64pkt 64fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="133.190.226.32"/>
    </slice>
    <from sec="1115269317" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_593{
style=filled;
color=gray75;
2174[label="207.80.64.34;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3033[label="207.80.64.34;1pkt 1fpkt", shape=invtriangle, color=brown];
stat593[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.80.64.34:1801, 149.188.233.235:1777}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1801: (50%)&lt;BR/&gt; 1777: (50%)&gt;];
}
2174--3033[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.233.235" dst_port="1777" src_ip="207.80.64.34" src_port="1801"/>
    </slice>
    <from sec="1115269933" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.634441,1.66751,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_594{
style=filled;
color=gray75;
1538[label="172.195.110.35;s;92pkt 92fpkt", shape=diamond, color=yellow];
2179[label="172.195.110.35;98pkt 98fpkt", shape=pentagon, color=darkviolet];
3036[label="172.195.110.35;98pkt 98fpkt", shape=invtriangle, color=brown];
stat594[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.110.35:*, 210.84.84.235:80}[39.7959%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (39.0625%)&lt;BR/&gt; 4922: (7.8125%)&lt;BR/&gt; 22654: (1.04167%)&lt;BR/&gt; 10773: (1.04167%)&lt;BR/&gt; 1088: (1.04167%)&gt;];
}
1538--2179[label="1;92pkt 92fpkt"];
1538--3036[label="1;92pkt 92fpkt"];
2179--3036[label="1;98pkt 98fpkt"];
</description>
    <slice>
      <filter dst_ip="210.84.84.235" dst_port="80" src_ip="172.195.110.35"/>
    </slice>
    <from sec="1115269223" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_595{
style=filled;
color=gray75;
2184[label="138.128.76.36;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3040[label="138.128.76.36;1pkt 1fpkt", shape=invtriangle, color=brown];
stat595[shape=component, label=&lt;Rules:&lt;BR/&gt;{138.128.76.36:80, 171.76.42.135:3713}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3713: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
2184--3040[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="171.76.42.135" dst_port="3713" src_ip="138.128.76.36" src_port="80"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="16.164.83.38"/>
    </slice>
    <from sec="1115269455" usec="0"/>
    <to sec="1115269466" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.773883,1.66051,503,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_597{
style=filled;
color=gray75;
11[label="211.25.10.42s;2pkt 2fpkt", shape=rectangle, color=red];
2203[label="211.25.10.42;5pkt 5fpkt", shape=pentagon, color=darkviolet];
3051[label="211.25.10.42;4pkt 4fpkt", shape=invtriangle, color=brown];
stat597[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.25.10.42:2885, 197.225.2.131:80}[20%]&lt;BR/&gt;{211.25.10.42:2886, 197.225.2.131:80}[20%]&lt;BR/&gt;{211.25.10.42:2716, 128.192.239.158:80}[20%]&lt;BR/&gt;{211.25.10.42:2717, 128.192.239.158:80}[20%]&lt;BR/&gt;{211.25.10.42:2722, 128.192.239.158:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2717: (13.6364%)&lt;BR/&gt; 2716: (13.6364%)&lt;BR/&gt; 2886: (9.09091%)&lt;BR/&gt; 2722: (9.09091%)&gt;];
}
11--2203[label="1;2pkt 2fpkt"];
11--3051[label="1;2pkt 2fpkt"];
2203--3051[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="128.192.239.158" dst_port="80" src_ip="211.25.10.42" src_port="2722"/>
      <filter dst_ip="128.192.239.158" dst_port="80" src_ip="211.25.10.42" src_port="2717"/>
      <filter dst_ip="128.192.239.158" dst_port="80" src_ip="211.25.10.42" src_port="2716"/>
      <filter dst_ip="197.225.2.131" dst_port="80" src_ip="211.25.10.42" src_port="2886"/>
      <filter dst_ip="197.225.2.131" dst_port="80" src_ip="211.25.10.42" src_port="2885"/>
    </slice>
    <from sec="1115269473" usec="0"/>
    <to sec="1115270081" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.859378,1.64748,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_598{
style=filled;
color=gray75;
1023[label="222.83.39.42;s;936pkt 936fpkt", shape=diamond, color=yellow];
2205[label="222.83.39.42;991pkt 991fpkt", shape=pentagon, color=darkviolet];
3052[label="222.83.39.42;990pkt 990fpkt", shape=invtriangle, color=brown];
3512[label="222.83.39.42;991pkt 991fpkt", shape=invhouse, color=bisque];
stat598[shape=component, label=&lt;Rules:&lt;BR/&gt;{222.83.39.42:53, *:*}[99.6976%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (57.1136%)&lt;BR/&gt; 32768: (2.66121%)&lt;BR/&gt; 32769: (1.31781%)&lt;BR/&gt; 1024: (1.15148%)&lt;BR/&gt; 32773: (0.35824%)&gt;];
}
1023--1982[label="0.0470085;44pkt 44fpkt"];
1023--1988[label="0.0694444;65pkt 65fpkt"];
1023--1996[label="0.151709;142pkt 142fpkt"];
1023--2003[label="0.0779915;73pkt 73fpkt"];
1023--2014[label="0.0694444;65pkt 65fpkt"];
1023--2019[label="0.151709;142pkt 142fpkt"];
1023--2023[label="0.0779915;73pkt 73fpkt"];
1023--2030[label="0.151709;142pkt 142fpkt"];
1023--2034[label="0.0779915;73pkt 73fpkt"];
1023--2205[label="0.998932;935pkt 935fpkt"];
1023--3052[label="0.997863;934pkt 934fpkt"];
1023--3512[label="0.998932;935pkt 935fpkt"];
2205--3052[label="1;990pkt 990fpkt"];
2205--3512[label="1;991pkt 991fpkt"];
3052--3512[label="1;990pkt 990fpkt"];
</description>
    <slice>
      <filter src_ip="222.83.39.42" src_port="53"/>
    </slice>
    <from sec="1115269204" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.634441,1.66751,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_599{
style=filled;
color=gray75;
1193[label="149.188.21.68;d;138pkt 138fpkt", shape=diamond, color=yellow];
2206[label="207.137.66.42;16pkt 16fpkt", shape=pentagon, color=darkviolet];
3053[label="207.137.66.42;15pkt 15fpkt", shape=invtriangle, color=brown];
stat599[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.137.66.146:80, 149.188.21.68:*}[31.1594%]&lt;BR/&gt;{207.137.66.74:80, 149.188.21.68:*}[30.4348%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.3373%)&lt;BR/&gt; 8000: (1.18343%)&lt;BR/&gt; 4000: (0.887574%)&lt;BR/&gt; 2639: (0.887574%)&lt;BR/&gt; 2635: (0.887574%)&gt;];
}
1193--2206[label="1;16pkt 16fpkt"];
1193--3053[label="1;15pkt 15fpkt"];
2206--3053[label="1;15pkt 15fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.21.68" src_ip="207.137.66.146" src_port="80"/>
      <filter dst_ip="149.188.21.68" src_ip="207.137.66.74" src_port="80"/>
    </slice>
    <from sec="1115269314" usec="0"/>
    <to sec="1115270009" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_600{
style=filled;
color=gray75;
2209[label="21.15.0.43;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3054[label="21.15.0.43;1pkt 1fpkt", shape=invtriangle, color=brown];
stat600[shape=component, label=&lt;Rules:&lt;BR/&gt;{21.15.0.43:80, 131.5.114.72:63587}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 63587: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
2209--3054[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="131.5.114.72" dst_port="63587" src_ip="21.15.0.43" src_port="80"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_601{
style=filled;
color=gray75;
2215[label="171.76.36.44;3pkt 3fpkt", shape=pentagon, color=darkviolet];
3057[label="171.76.36.44;3pkt 3fpkt", shape=invtriangle, color=brown];
stat601[shape=component, label=&lt;Rules:&lt;BR/&gt;{171.76.36.44:25, 200.150.17.69:3028}[33.3333%]&lt;BR/&gt;{171.76.36.44:25, 64.18.233.253:36295}[33.3333%]&lt;BR/&gt;{171.76.36.44:25, 64.18.233.253:45911}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 45911: (16.6667%)&lt;BR/&gt; 36295: (16.6667%)&lt;BR/&gt; 3028: (16.6667%)&gt;];
}
2215--3057[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="64.18.233.253" dst_port="45911" src_ip="171.76.36.44" src_port="25"/>
      <filter dst_ip="64.18.233.253" dst_port="36295" src_ip="171.76.36.44" src_port="25"/>
      <filter dst_ip="200.150.17.69" dst_port="3028" src_ip="171.76.36.44" src_port="25"/>
    </slice>
    <from sec="1115269364" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="206.97.144.46"/>
    </slice>
    <from sec="1115269506" usec="0"/>
    <to sec="1115269664" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_603{
style=filled;
color=gray75;
2224[label="200.161.152.48;89pkt 89fpkt", shape=pentagon, color=darkviolet];
3061[label="200.161.152.48;88pkt 88fpkt", shape=invtriangle, color=brown];
3516[label="200.161.152.48;88pkt 88fpkt", shape=invhouse, color=bisque];
stat603[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.161.152.48:*, *:1025}[80.8989%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (40.3774%)&lt;BR/&gt; 5554: (6.79245%)&lt;BR/&gt; 1433: (2.83019%)&lt;BR/&gt; 1755: (1.13208%)&lt;BR/&gt; 4797: (0.566038%)&gt;];
}
2224--3061[label="1;88pkt 88fpkt"];
2224--3516[label="1;88pkt 88fpkt"];
3061--3516[label="1;88pkt 88fpkt"];
</description>
    <slice>
      <filter dst_port="1025" src_ip="200.161.152.48"/>
    </slice>
    <from sec="1115269225" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="64.176.131.50"/>
    </slice>
    <from sec="1115269203" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.698024,1.73161,999,0 0 0 1 0 0 0 0 0 0 1 0 ">
    <description>subgraph cluster_605{
style=filled;
color=gray75;
743[label="207.80.165.50;s;1pkt 1fpkt", shape=diamond, color=yellow];
3066[label="207.80.165.50;1pkt 1fpkt", shape=invtriangle, color=brown];
stat605[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.80.165.50:4748, 149.188.233.235:1777}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4748: (50%)&lt;BR/&gt; 1777: (50%)&gt;];
}
743--3066[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.233.235" dst_port="1777" src_ip="207.80.165.50" src_port="4748"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_606{
style=filled;
color=gray75;
2240[label="172.195.110.52;25pkt 25fpkt", shape=pentagon, color=darkviolet];
3071[label="172.195.110.52;26pkt 26fpkt", shape=invtriangle, color=brown];
stat606[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.110.52:*, 215.65.244.42:80}[42.3077%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2827: (1.96078%)&lt;BR/&gt; 2825: (1.96078%)&lt;BR/&gt; 2807: (1.96078%)&lt;BR/&gt; 2797: (1.96078%)&gt;];
}
2240--3071[label="1;25pkt 25fpkt"];
</description>
    <slice>
      <filter dst_ip="215.65.244.42" dst_port="80" src_ip="172.195.110.52"/>
    </slice>
    <from sec="1115269269" usec="0"/>
    <to sec="1115270076" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="94.206.193.54"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="207.156.65.57"/>
    </slice>
    <from sec="1115269596" usec="0"/>
    <to sec="1115269683" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="195.142.225.57"/>
    </slice>
    <from sec="1115270016" usec="0"/>
    <to sec="1115270057" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_610{
style=filled;
color=gray75;
2267[label="208.88.17.60;78pkt 78fpkt", shape=pentagon, color=darkviolet];
3083[label="208.88.17.60;78pkt 78fpkt", shape=invtriangle, color=brown];
stat610[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.88.17.60:*, *:445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (50%)&lt;BR/&gt; 4987: (0.641026%)&lt;BR/&gt; 4877: (0.641026%)&lt;BR/&gt; 4694: (0.641026%)&lt;BR/&gt; 4661: (0.641026%)&gt;];
}
2267--3083[label="1;78pkt 78fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="208.88.17.60"/>
    </slice>
    <from sec="1115269212" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="210.21.205.60"/>
    </slice>
    <from sec="1115269427" usec="0"/>
    <to sec="1115269438" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_612{
style=filled;
color=gray75;
2271[label="211.209.90.61;3pkt 3fpkt", shape=pentagon, color=darkviolet];
3087[label="211.209.90.61;3pkt 3fpkt", shape=invtriangle, color=brown];
3530[label="211.209.90.61;3pkt 3fpkt", shape=invhouse, color=bisque];
stat612[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.209.90.61:1076, 133.74.162.76:1434}[33.3333%]&lt;BR/&gt;{211.209.90.61:1076, 171.76.32.88:1434}[33.3333%]&lt;BR/&gt;{211.209.90.61:1076, 211.19.103.226:1434}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1434: (50%)&lt;BR/&gt; 1076: (50%)&gt;];
}
2271--3087[label="1;3pkt 3fpkt"];
2271--3530[label="1;3pkt 3fpkt"];
3087--3530[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="211.19.103.226" dst_port="1434" src_ip="211.209.90.61" src_port="1076"/>
      <filter dst_ip="171.76.32.88" dst_port="1434" src_ip="211.209.90.61" src_port="1076"/>
      <filter dst_ip="133.74.162.76" dst_port="1434" src_ip="211.209.90.61" src_port="1076"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_613{
style=filled;
color=gray75;
2272[label="211.19.104.61;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3088[label="211.19.104.61;1pkt 1fpkt", shape=invtriangle, color=brown];
3531[label="211.19.104.61;1pkt 1fpkt", shape=invhouse, color=bisque];
stat613[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.19.104.61:25, 64.162.49.188:4419}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4419: (50%)&lt;BR/&gt; 25: (50%)&gt;];
}
2272--3088[label="1;1pkt 1fpkt"];
2272--3531[label="1;1pkt 1fpkt"];
3088--3531[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="64.162.49.188" dst_port="4419" src_ip="211.19.104.61" src_port="25"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="66.8.213.61"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,504,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_615{
style=filled;
color=gray75;
2275[label="172.195.25.62;3pkt 3fpkt", shape=pentagon, color=darkviolet];
3090[label="172.195.25.62;3pkt 3fpkt", shape=invtriangle, color=brown];
stat615[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.25.62:2083, 214.12.5.36:80}[33.3333%]&lt;BR/&gt;{172.195.25.62:2080, 214.12.9.156:80}[33.3333%]&lt;BR/&gt;{172.195.25.62:2085, 214.12.9.156:443}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (33.3333%)&lt;BR/&gt; 2085: (16.6667%)&lt;BR/&gt; 2083: (16.6667%)&lt;BR/&gt; 2080: (16.6667%)&lt;BR/&gt; 443: (16.6667%)&gt;];
}
2275--3090[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="214.12.9.156" dst_port="443" src_ip="172.195.25.62" src_port="2085"/>
      <filter dst_ip="214.12.9.156" dst_port="80" src_ip="172.195.25.62" src_port="2080"/>
      <filter dst_ip="214.12.5.36" dst_port="80" src_ip="172.195.25.62" src_port="2083"/>
    </slice>
    <from sec="1115269370" usec="0"/>
    <to sec="1115269388" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_616{
style=filled;
color=gray75;
2281[label="145.120.78.64;4pkt 4fpkt", shape=pentagon, color=darkviolet];
3095[label="145.120.78.64;5pkt 5fpkt", shape=invtriangle, color=brown];
stat616[shape=component, label=&lt;Rules:&lt;BR/&gt;{145.120.78.64:63106, 133.190.149.216:80}[20%]&lt;BR/&gt;{145.120.78.64:63107, 133.190.149.216:80}[20%]&lt;BR/&gt;{145.120.78.64:63108, 133.190.149.216:80}[20%]&lt;BR/&gt;{145.120.78.64:63109, 133.190.149.216:80}[20%]&lt;BR/&gt;{145.120.78.64:63110, 133.190.149.216:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 63110: (11.1111%)&lt;BR/&gt; 63109: (11.1111%)&lt;BR/&gt; 63108: (11.1111%)&lt;BR/&gt; 63107: (11.1111%)&gt;];
}
2281--3095[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="133.190.149.216" dst_port="80" src_ip="145.120.78.64" src_port="63110"/>
      <filter dst_ip="133.190.149.216" dst_port="80" src_ip="145.120.78.64" src_port="63109"/>
      <filter dst_ip="133.190.149.216" dst_port="80" src_ip="145.120.78.64" src_port="63108"/>
      <filter dst_ip="133.190.149.216" dst_port="80" src_ip="145.120.78.64" src_port="63107"/>
      <filter dst_ip="133.190.149.216" dst_port="80" src_ip="145.120.78.64" src_port="63106"/>
    </slice>
    <from sec="1115269801" usec="0"/>
    <to sec="1115269856" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.859378,1.64748,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_617{
style=filled;
color=gray75;
1108[label="149.188.174.240;d;88pkt 88fpkt", shape=diamond, color=yellow];
2038[label="211.217.25.0;27pkt 27fpkt", shape=pentagon, color=darkviolet];
2286[label="21.60.65.65;7pkt 7fpkt", shape=pentagon, color=darkviolet];
2679[label="211.222.189.178;16pkt 16fpkt", shape=pentagon, color=darkviolet];
3098[label="21.60.65.65;8pkt 8fpkt", shape=invtriangle, color=brown];
3535[label="21.60.65.65;8pkt 8fpkt", shape=invhouse, color=bisque];
stat617[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.217.25.0:80, 149.188.174.240:*}[31.1111%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.3506%)&lt;BR/&gt; 1607: (1.2987%)&lt;BR/&gt; 1578: (1.2987%)&lt;BR/&gt; 1566: (1.2987%)&lt;BR/&gt; 1559: (1.2987%)&gt;];
}
1108--1983[label="0.0568182;5pkt 5fpkt"];
1108--1989[label="0.125;11pkt 11fpkt"];
1108--2015[label="0.125;11pkt 11fpkt"];
1108--2038[label="1;27pkt 27fpkt"];
1108--2286[label="0.857143;6pkt 6fpkt"];
1108--2679[label="1;16pkt 16fpkt"];
1108--3098[label="0.75;6pkt 6fpkt"];
1108--3535[label="0.75;6pkt 6fpkt"];
2286--3098[label="1;7pkt 7fpkt"];
2286--3535[label="1;7pkt 7fpkt"];
3098--3535[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.174.240" src_ip="211.217.25.0" src_port="80"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_618{
style=filled;
color=gray75;
2299[label="210.3.230.66;55pkt 55fpkt", shape=pentagon, color=darkviolet];
3105[label="210.3.230.66;56pkt 56fpkt", shape=invtriangle, color=brown];
stat618[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.3.230.66:*, *:445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (50%)&lt;BR/&gt; 1266: (1.8018%)&lt;BR/&gt; 4879: (0.900901%)&lt;BR/&gt; 4819: (0.900901%)&lt;BR/&gt; 4785: (0.900901%)&gt;];
}
2299--3105[label="1;55pkt 55fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="210.3.230.66"/>
    </slice>
    <from sec="1115269372" usec="0"/>
    <to sec="1115269973" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="203.162.133.67"/>
    </slice>
    <from sec="1115269205" usec="0"/>
    <to sec="1115270096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.859378,1.64748,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_620{
style=filled;
color=gray75;
1058[label="149.188.82.236;d;89pkt 89fpkt", shape=diamond, color=yellow];
2316[label="206.156.163.70;42pkt 42fpkt", shape=pentagon, color=darkviolet];
3113[label="206.156.163.70;43pkt 43fpkt", shape=invtriangle, color=brown];
3543[label="206.156.163.70;43pkt 43fpkt", shape=invhouse, color=bisque];
stat620[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.156.163.70:80, 149.188.82.236:*}[46.6667%]&lt;BR/&gt;{206.156.163.142:80, 149.188.82.236:*}[24.4444%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.6175%)&lt;BR/&gt; 85: (1.38249%)&lt;BR/&gt; 60079: (0.921659%)&lt;BR/&gt; 60078: (0.921659%)&lt;BR/&gt; 60076: (0.921659%)&gt;];
}
1058--1989[label="0.146067;13pkt 13fpkt"];
1058--2015[label="0.146067;13pkt 13fpkt"];
1058--2316[label="1;42pkt 42fpkt"];
1058--3113[label="0.976744;42pkt 42fpkt"];
1058--3543[label="0.976744;42pkt 42fpkt"];
2316--3113[label="1;42pkt 42fpkt"];
2316--3543[label="1;42pkt 42fpkt"];
3113--3543[label="1;43pkt 43fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.82.236" src_ip="206.156.163.70" src_port="80"/>
      <filter dst_ip="149.188.82.236" src_ip="206.156.163.142" src_port="80"/>
    </slice>
    <from sec="1115269346" usec="0"/>
    <to sec="1115269663" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_621{
style=filled;
color=gray75;
2324[label="211.19.96.72;14pkt 14fpkt", shape=pentagon, color=darkviolet];
3118[label="211.19.96.72;14pkt 14fpkt", shape=invtriangle, color=brown];
3546[label="211.19.96.72;14pkt 14fpkt", shape=invhouse, color=bisque];
stat621[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.19.96.72:80, 210.84.39.243:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 55768: (3.57143%)&lt;BR/&gt; 55767: (3.57143%)&lt;BR/&gt; 55766: (3.57143%)&lt;BR/&gt; 55764: (3.57143%)&gt;];
}
2324--3118[label="1;14pkt 14fpkt"];
2324--3546[label="1;14pkt 14fpkt"];
3118--3546[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter dst_ip="210.84.39.243" src_ip="211.19.96.72" src_port="80"/>
    </slice>
    <from sec="1115269396" usec="0"/>
    <to sec="1115270095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,020,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="131.5.14.73"/>
    </slice>
    <from sec="1115269208" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_623{
style=filled;
color=gray75;
2329[label="172.195.52.73;19pkt 19fpkt", shape=pentagon, color=darkviolet];
3121[label="172.195.52.73;20pkt 20fpkt", shape=invtriangle, color=brown];
3548[label="172.195.52.73;20pkt 20fpkt", shape=invhouse, color=bisque];
stat623[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.52.73:*, 64.242.190.16:80}[55%]&lt;BR/&gt;{172.195.52.73:*, 192.184.80.127:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.4576%)&lt;BR/&gt; 2137: (2.54237%)&lt;BR/&gt; 2135: (2.54237%)&lt;BR/&gt; 2133: (2.54237%)&lt;BR/&gt; 2131: (2.54237%)&gt;];
}
2329--3121[label="1;19pkt 19fpkt"];
2329--3548[label="1;19pkt 19fpkt"];
3121--3548[label="1;20pkt 20fpkt"];
</description>
    <slice>
      <filter dst_ip="64.242.190.16" dst_port="80" src_ip="172.195.52.73"/>
      <filter dst_ip="192.184.80.127" dst_port="80" src_ip="172.195.52.73"/>
    </slice>
    <from sec="1115269206" usec="0"/>
    <to sec="1115270062" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="171.76.14.74"/>
    </slice>
    <from sec="1115269206" usec="0"/>
    <to sec="1115270097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="202.158.176.74"/>
    </slice>
    <from sec="1115269671" usec="0"/>
    <to sec="1115269763" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="71.104.194.74"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="202.2.90.79"/>
    </slice>
    <from sec="1115269209" usec="0"/>
    <to sec="1115269572" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842681,1.61149,504,1 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_628{
style=filled;
color=gray75;
100[label="172.195.5.80s;20pkt 20fpkt", shape=rectangle, color=red];
1574[label="172.195.5.80;s;72pkt 72fpkt", shape=diamond, color=yellow];
1577[label="204.210.71.96;d;48pkt 48fpkt", shape=diamond, color=yellow];
2350[label="172.195.5.80;71pkt 71fpkt", shape=pentagon, color=darkviolet];
3133[label="172.195.5.80;72pkt 72fpkt", shape=invtriangle, color=brown];
stat628[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.5.80:*, 204.210.71.96:443}[66.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (47.3498%)&lt;BR/&gt; 80: (2.65018%)&lt;BR/&gt; 3985: (0.883392%)&lt;BR/&gt; 3984: (0.883392%)&lt;BR/&gt; 3983: (0.883392%)&gt;];
}
100--1574[label="1;20pkt 20fpkt"];
100--1577[label="1;20pkt 20fpkt"];
100--2350[label="1;20pkt 20fpkt"];
100--3133[label="1;20pkt 20fpkt"];
1574--1577[label="1;48pkt 48fpkt"];
1574--2350[label="1;71pkt 71fpkt"];
1574--3133[label="1;72pkt 72fpkt"];
1577--2350[label="1;48pkt 48fpkt"];
1577--3133[label="1;48pkt 48fpkt"];
2350--3133[label="1;71pkt 71fpkt"];
</description>
    <slice>
      <filter dst_ip="204.210.71.96" dst_port="443" src_ip="172.195.5.80"/>
    </slice>
    <from sec="1115269782" usec="0"/>
    <to sec="1115270054" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_629{
style=filled;
color=gray75;
2351[label="210.0.11.80;34pkt 34fpkt", shape=pentagon, color=darkviolet];
3134[label="210.0.11.80;35pkt 35fpkt", shape=invtriangle, color=brown];
3553[label="210.0.11.80;35pkt 35fpkt", shape=invhouse, color=bisque];
stat629[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.0.11.80:*, *:1025}[34.2857%]&lt;BR/&gt;{210.0.11.80:*, *:1433}[20%]&lt;BR/&gt;{210.0.11.80:*, *:6129}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (16.8269%)&lt;BR/&gt; 6129: (10.0962%)&lt;BR/&gt; 1433: (10.0962%)&lt;BR/&gt; 5554: (8.65385%)&lt;BR/&gt; 2745: (4.32692%)&gt;];
}
2351--3134[label="1;34pkt 34fpkt"];
2351--3553[label="1;34pkt 34fpkt"];
3134--3553[label="1;35pkt 35fpkt"];
</description>
    <slice>
      <filter dst_port="1025" src_ip="210.0.11.80"/>
      <filter dst_port="6129" src_ip="210.0.11.80"/>
      <filter dst_port="1433" src_ip="210.0.11.80"/>
    </slice>
    <from sec="1115269209" usec="0"/>
    <to sec="1115270068" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_630{
style=filled;
color=gray75;
2352[label="172.195.11.80;168pkt 168fpkt", shape=pentagon, color=darkviolet];
3135[label="172.195.11.80;169pkt 169fpkt", shape=invtriangle, color=brown];
3554[label="172.195.11.80;169pkt 169fpkt", shape=invhouse, color=bisque];
stat630[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.11.80:*, 197.70.44.145:80}[38.4615%]&lt;BR/&gt;{172.195.11.80:*, 197.70.44.133:80}[25.4438%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1976: (0.296443%)&lt;BR/&gt; 1975: (0.296443%)&lt;BR/&gt; 1974: (0.296443%)&lt;BR/&gt; 1973: (0.296443%)&gt;];
}
2352--3135[label="1;168pkt 168fpkt"];
2352--3554[label="1;168pkt 168fpkt"];
3135--3554[label="1;169pkt 169fpkt"];
</description>
    <slice>
      <filter dst_ip="197.70.44.145" dst_port="80" src_ip="172.195.11.80"/>
      <filter dst_ip="197.70.44.133" dst_port="80" src_ip="172.195.11.80"/>
    </slice>
    <from sec="1115269246" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.859378,1.64748,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_631{
style=filled;
color=gray75;
1363[label="171.76.52.4;d;91pkt 91fpkt", shape=diamond, color=yellow];
2353[label="142.241.28.80;49pkt 49fpkt", shape=pentagon, color=darkviolet];
2545[label="21.4.84.140;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3136[label="142.241.28.80;50pkt 50fpkt", shape=invtriangle, color=brown];
3555[label="142.241.28.80;50pkt 50fpkt", shape=invhouse, color=bisque];
stat631[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 171.76.52.4:25}[69.8413%]&lt;BR/&gt;{142.241.28.80:*, *:25}[30.1587%]&lt;BR/&gt;{142.241.28.80:*, 171.76.43.66:*}[24.6032%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (41.2863%)&lt;BR/&gt; 113: (6.84647%)&lt;BR/&gt; 52988: (1.03734%)&lt;BR/&gt; 53: (1.03734%)&lt;BR/&gt; 52697: (0.829876%)&gt;];
}
1363--2353[label="0.306122;15pkt 15fpkt"];
1363--2545[label="1;1pkt 1fpkt"];
1363--3136[label="0.3;15pkt 15fpkt"];
1363--3555[label="0.3;15pkt 15fpkt"];
2353--3136[label="1;49pkt 49fpkt"];
2353--3555[label="1;49pkt 49fpkt"];
3136--3555[label="1;50pkt 50fpkt"];
</description>
    <slice>
      <filter dst_ip="171.76.43.66" src_ip="142.241.28.80"/>
      <filter dst_port="25" src_ip="142.241.28.80"/>
      <filter dst_ip="171.76.52.4" dst_port="25"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270086" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.966908,1.64039,002,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_632{
style=filled;
color=gray75;
140[label="206.63.215.80s;195pkt 195fpkt", shape=rectangle, color=red];
2355[label="206.63.215.80;213pkt 213fpkt", shape=pentagon, color=darkviolet];
3137[label="206.63.215.80;214pkt 214fpkt", shape=invtriangle, color=brown];
3556[label="206.63.215.80;213pkt 213fpkt", shape=invhouse, color=bisque];
stat632[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.63.215.80:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
140--2355[label="1;195pkt 195fpkt"];
140--3137[label="1;195pkt 195fpkt"];
140--3556[label="1;195pkt 195fpkt"];
2355--3137[label="1;213pkt 213fpkt"];
2355--3556[label="1;213pkt 213fpkt"];
3137--3556[label="1;213pkt 213fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="206.63.215.80" src_port="1025"/>
    </slice>
    <from sec="1115269961" usec="0"/>
    <to sec="1115269985" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="64.138.185.82"/>
    </slice>
    <from sec="1115269482" usec="0"/>
    <to sec="1115269505" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_634{
style=filled;
color=gray75;
2365[label="171.76.43.84;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3142[label="171.76.43.84;1pkt 1fpkt", shape=invtriangle, color=brown];
3558[label="171.76.43.84;1pkt 1fpkt", shape=invhouse, color=bisque];
stat634[shape=component, label=&lt;Rules:&lt;BR/&gt;{171.76.43.84:25, 64.18.233.224:43673}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 43673: (50%)&lt;BR/&gt; 25: (50%)&gt;];
}
2365--3142[label="1;1pkt 1fpkt"];
2365--3558[label="1;1pkt 1fpkt"];
3142--3558[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="64.18.233.224" dst_port="43673" src_ip="171.76.43.84" src_port="25"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="205.55.78.85"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_636{
style=filled;
color=gray75;
2372[label="172.195.41.86;87pkt 87fpkt", shape=pentagon, color=darkviolet];
3146[label="172.195.41.86;86pkt 86fpkt", shape=invtriangle, color=brown];
stat636[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.41.86:*, 64.199.28.198:8200}[66.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8200: (50%)&lt;BR/&gt; 4240: (0.578035%)&lt;BR/&gt; 4239: (0.578035%)&lt;BR/&gt; 4238: (0.578035%)&lt;BR/&gt; 4237: (0.578035%)&gt;];
}
2372--3146[label="1;86pkt 86fpkt"];
</description>
    <slice>
      <filter dst_ip="64.199.28.198" dst_port="8200" src_ip="172.195.41.86"/>
    </slice>
    <from sec="1115269209" usec="0"/>
    <to sec="1115270095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_637{
style=filled;
color=gray75;
2378[label="131.5.0.89;20pkt 20fpkt", shape=pentagon, color=darkviolet];
3147[label="131.5.0.89;20pkt 20fpkt", shape=invtriangle, color=brown];
3561[label="131.5.0.89;21pkt 21fpkt", shape=invhouse, color=bisque];
stat637[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.0.89:*, 215.196.44.176:80}[66.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2700: (2.45902%)&lt;BR/&gt; 2698: (2.45902%)&lt;BR/&gt; 2696: (2.45902%)&lt;BR/&gt; 2694: (2.45902%)&gt;];
}
2378--3147[label="1;20pkt 20fpkt"];
2378--3561[label="1;20pkt 20fpkt"];
3147--3561[label="1;20pkt 20fpkt"];
</description>
    <slice>
      <filter dst_ip="215.196.44.176" dst_port="80" src_ip="131.5.0.89"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270011" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="203.157.136.89"/>
    </slice>
    <from sec="1115269627" usec="0"/>
    <to sec="1115269802" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_639{
style=filled;
color=gray75;
2383[label="131.4.56.91;8pkt 8fpkt", shape=pentagon, color=darkviolet];
3149[label="131.4.56.91;8pkt 8fpkt", shape=invtriangle, color=brown];
3563[label="131.4.56.91;9pkt 9fpkt", shape=invhouse, color=bisque];
stat639[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.56.91:*, 66.162.133.89:80}[33.3333%]&lt;BR/&gt;{131.4.56.91:*, 222.232.177.52:80}[22.2222%]&lt;BR/&gt;{131.4.56.91:*, 66.213.228.76:*}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (38%)&lt;BR/&gt; 21722: (6%)&lt;BR/&gt; 21721: (6%)&lt;BR/&gt; 21663: (6%)&lt;BR/&gt; 21662: (6%)&gt;];
}
2383--3149[label="1;8pkt 8fpkt"];
2383--3563[label="1;8pkt 8fpkt"];
3149--3563[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="66.213.228.76" src_ip="131.4.56.91"/>
      <filter dst_ip="66.162.133.89" dst_port="80" src_ip="131.4.56.91"/>
      <filter dst_ip="222.232.177.52" dst_port="80" src_ip="131.4.56.91"/>
    </slice>
    <from sec="1115269487" usec="0"/>
    <to sec="1115270010" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="69.169.5.94"/>
    </slice>
    <from sec="1115269766" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="68.36.47.95"/>
    </slice>
    <from sec="1115269709" usec="0"/>
    <to sec="1115269755" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="64.138.169.95"/>
    </slice>
    <from sec="1115269210" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_643{
style=filled;
color=gray75;
2410[label="52.196.160.98;7pkt 7fpkt", shape=pentagon, color=darkviolet];
3161[label="52.196.160.98;6pkt 6fpkt", shape=invtriangle, color=brown];
3573[label="52.196.160.98;7pkt 7fpkt", shape=invhouse, color=bisque];
stat643[shape=component, label=&lt;Rules:&lt;BR/&gt;{52.196.160.98:*, 210.53.130.210:21}[42.8571%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (22.5%)&lt;BR/&gt; 61133: (7.5%)&lt;BR/&gt; 54212: (7.5%)&lt;BR/&gt; 54194: (7.5%)&lt;BR/&gt; 54189: (7.5%)&gt;];
}
2410--3161[label="1;6pkt 6fpkt"];
2410--3573[label="1;7pkt 7fpkt"];
3161--3573[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="210.53.130.210" dst_port="21" src_ip="52.196.160.98"/>
    </slice>
    <from sec="1115269206" usec="0"/>
    <to sec="1115270081" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="22.137.253.98"/>
    </slice>
    <from sec="1115269205" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="208.129.225.99"/>
    </slice>
    <from sec="1115269310" usec="0"/>
    <to sec="1115269490" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_647{
style=filled;
color=gray75;
2426[label="131.5.116.102;22pkt 22fpkt", shape=pentagon, color=darkviolet];
3169[label="131.5.116.102;23pkt 23fpkt", shape=invtriangle, color=brown];
3577[label="131.5.116.102;23pkt 23fpkt", shape=invhouse, color=bisque];
stat647[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.116.102:*, *:25}[69.5652%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (43.3824%)&lt;BR/&gt; 113: (6.61765%)&lt;BR/&gt; 4880: (2.20588%)&lt;BR/&gt; 4366: (2.20588%)&lt;BR/&gt; 3939: (2.20588%)&gt;];
}
2426--3169[label="1;22pkt 22fpkt"];
2426--3577[label="1;22pkt 22fpkt"];
3169--3577[label="1;23pkt 23fpkt"];
</description>
    <slice>
      <filter dst_port="25" src_ip="131.5.116.102"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_648{
style=filled;
color=gray75;
2430[label="21.5.130.103;210pkt 210fpkt", shape=pentagon, color=darkviolet];
3172[label="21.5.130.103;209pkt 209fpkt", shape=invtriangle, color=brown];
3580[label="21.5.130.103;209pkt 209fpkt", shape=invhouse, color=bisque];
stat648[shape=component, label=&lt;Rules:&lt;BR/&gt;{21.5.130.103:3414, *:1434}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3414: (50%)&lt;BR/&gt; 1434: (50%)&gt;];
}
2430--3172[label="1;209pkt 209fpkt"];
2430--3580[label="1;209pkt 209fpkt"];
3172--3580[label="1;209pkt 209fpkt"];
</description>
    <slice>
      <filter dst_port="1434" src_ip="21.5.130.103" src_port="3414"/>
    </slice>
    <from sec="1115269206" usec="0"/>
    <to sec="1115270097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.634441,1.66751,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_649{
style=filled;
color=gray75;
1368[label="203.129.229.104;s;644pkt 644fpkt", shape=diamond, color=yellow];
2437[label="203.129.229.104;701pkt 701fpkt", shape=pentagon, color=darkviolet];
3177[label="203.129.229.104;701pkt 701fpkt", shape=invtriangle, color=brown];
stat649[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.129.229.104:1084, *:1434}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1434: (50%)&lt;BR/&gt; 1084: (50%)&gt;];
}
1368--2437[label="0.998447;643pkt 643fpkt"];
1368--3177[label="0.998447;643pkt 643fpkt"];
2437--3177[label="1;701pkt 701fpkt"];
</description>
    <slice>
      <filter dst_port="1434" src_ip="203.129.229.104" src_port="1084"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_650{
style=filled;
color=gray75;
2447[label="172.195.126.109;40pkt 40fpkt", shape=pentagon, color=darkviolet];
3181[label="172.195.126.109;41pkt 41fpkt", shape=invtriangle, color=brown];
stat650[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.126.109:*, 64.138.164.45:80}[60.9756%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3245: (1.23457%)&lt;BR/&gt; 3240: (1.23457%)&lt;BR/&gt; 3239: (1.23457%)&lt;BR/&gt; 3238: (1.23457%)&gt;];
}
2447--3181[label="1;40pkt 40fpkt"];
</description>
    <slice>
      <filter dst_ip="64.138.164.45" dst_port="80" src_ip="172.195.126.109"/>
    </slice>
    <from sec="1115269507" usec="0"/>
    <to sec="1115269680" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_651{
style=filled;
color=gray75;
2452[label="194.202.153.111;44pkt 44fpkt", shape=pentagon, color=darkviolet];
3184[label="194.202.153.111;44pkt 44fpkt", shape=invtriangle, color=brown];
3586[label="194.202.153.111;44pkt 44fpkt", shape=invhouse, color=bisque];
stat651[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.202.153.111:*, *:1023}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1023: (50%)&lt;BR/&gt; 3664: (1.13636%)&lt;BR/&gt; 3663: (1.13636%)&lt;BR/&gt; 3660: (1.13636%)&lt;BR/&gt; 3657: (1.13636%)&gt;];
}
2452--3184[label="1;44pkt 44fpkt"];
2452--3586[label="1;44pkt 44fpkt"];
3184--3586[label="1;44pkt 44fpkt"];
</description>
    <slice>
      <filter dst_port="1023" src_ip="194.202.153.111"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="70.36.178.111"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270060" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_653{
style=filled;
color=gray75;
2456[label="131.5.203.111;22pkt 22fpkt", shape=pentagon, color=darkviolet];
3186[label="131.5.203.111;21pkt 21fpkt", shape=invtriangle, color=brown];
stat653[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.203.111:*, 216.9.201.241:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1499: (2.32558%)&lt;BR/&gt; 1498: (2.32558%)&lt;BR/&gt; 1497: (2.32558%)&lt;BR/&gt; 1496: (2.32558%)&gt;];
}
2456--3186[label="1;21pkt 21fpkt"];
</description>
    <slice>
      <filter dst_ip="216.9.201.241" dst_port="80" src_ip="131.5.203.111"/>
    </slice>
    <from sec="1115269694" usec="0"/>
    <to sec="1115269711" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_654{
style=filled;
color=gray75;
2460[label="220.28.27.113;172pkt 172fpkt", shape=pentagon, color=darkviolet];
3187[label="220.28.27.113;172pkt 172fpkt", shape=invtriangle, color=brown];
stat654[shape=component, label=&lt;Rules:&lt;BR/&gt;{220.28.27.113:21025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
2460--3187[label="1;172pkt 172fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="220.28.27.113" src_port="21025"/>
    </slice>
    <from sec="1115269301" usec="0"/>
    <to sec="1115269328" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_655{
style=filled;
color=gray75;
2464[label="172.195.108.114;16pkt 16fpkt", shape=pentagon, color=darkviolet];
3191[label="172.195.108.114;17pkt 17fpkt", shape=invtriangle, color=brown];
stat655[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.108.114:*, 2.168.0.10:80}[47.0588%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2181: (3.0303%)&lt;BR/&gt; 2180: (3.0303%)&lt;BR/&gt; 2179: (3.0303%)&lt;BR/&gt; 2178: (3.0303%)&gt;];
}
2464--3191[label="1;16pkt 16fpkt"];
</description>
    <slice>
      <filter dst_ip="2.168.0.10" dst_port="80" src_ip="172.195.108.114"/>
    </slice>
    <from sec="1115269453" usec="0"/>
    <to sec="1115269603" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_656{
style=filled;
color=gray75;
2467[label="194.85.177.114;10pkt 10fpkt", shape=pentagon, color=darkviolet];
3192[label="194.85.177.114;9pkt 9fpkt", shape=invtriangle, color=brown];
3589[label="194.85.177.114;10pkt 10fpkt", shape=invhouse, color=bisque];
stat656[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.85.177.114:*, 133.190.77.136:443}[30%]&lt;BR/&gt;{194.85.177.114:*, 133.190.80.132:80}[20%]&lt;BR/&gt;{194.85.177.114:*, 210.53.134.171:80}[20%]&lt;BR/&gt;{194.85.177.114:*, 133.190.77.136:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (34.4828%)&lt;BR/&gt; 443: (15.5172%)&lt;BR/&gt; 32588: (5.17241%)&lt;BR/&gt; 32584: (5.17241%)&lt;BR/&gt; 32554: (5.17241%)&gt;];
}
2467--3192[label="1;9pkt 9fpkt"];
2467--3589[label="1;10pkt 10fpkt"];
3192--3589[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="133.190.77.136" dst_port="80" src_ip="194.85.177.114"/>
      <filter dst_ip="133.190.77.136" dst_port="443" src_ip="194.85.177.114"/>
      <filter dst_ip="210.53.134.171" dst_port="80" src_ip="194.85.177.114"/>
      <filter dst_ip="133.190.80.132" dst_port="80" src_ip="194.85.177.114"/>
    </slice>
    <from sec="1115270031" usec="0"/>
    <to sec="1115270093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_657{
style=filled;
color=gray75;
2468[label="21.230.67.115;133pkt 133fpkt", shape=pentagon, color=darkviolet];
3193[label="21.230.67.115;133pkt 133fpkt", shape=invtriangle, color=brown];
stat657[shape=component, label=&lt;Rules:&lt;BR/&gt;{21.230.67.115:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
2468--3193[label="1;133pkt 133fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="21.230.67.115" src_port="1025"/>
    </slice>
    <from sec="1115270073" usec="0"/>
    <to sec="1115270096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_658{
style=filled;
color=gray75;
2469[label="211.25.132.116;2pkt 2fpkt", shape=pentagon, color=darkviolet];
3194[label="211.25.132.116;2pkt 2fpkt", shape=invtriangle, color=brown];
3590[label="211.25.132.116;115pkt 115fpkt", shape=invhouse, color=bisque];
stat658[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.25.132.116:*, 215.41.206.151:80}[80.8696%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 61996: (1.2605%)&lt;BR/&gt; 61995: (1.2605%)&lt;BR/&gt; 61999: (0.420168%)&lt;BR/&gt; 61998: (0.420168%)&gt;];
}
2469--3194[label="1;2pkt 2fpkt"];
2469--3590[label="1;2pkt 2fpkt"];
3194--3590[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="215.41.206.151" dst_port="80" src_ip="211.25.132.116"/>
    </slice>
    <from sec="1115269259" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_659{
style=filled;
color=gray75;
2471[label="170.72.173.116;26pkt 26fpkt", shape=pentagon, color=darkviolet];
3196[label="170.72.173.116;27pkt 27fpkt", shape=invtriangle, color=brown];
3592[label="170.72.173.116;27pkt 27fpkt", shape=invhouse, color=bisque];
stat659[shape=component, label=&lt;Rules:&lt;BR/&gt;{170.72.173.116:*, 133.190.149.216:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 24560: (1.875%)&lt;BR/&gt; 23985: (1.875%)&lt;BR/&gt; 23149: (1.875%)&lt;BR/&gt; 20006: (1.875%)&gt;];
}
2471--3196[label="1;26pkt 26fpkt"];
2471--3592[label="1;26pkt 26fpkt"];
3196--3592[label="1;27pkt 27fpkt"];
</description>
    <slice>
      <filter dst_ip="133.190.149.216" dst_port="80" src_ip="170.72.173.116"/>
    </slice>
    <from sec="1115269368" usec="0"/>
    <to sec="1115270080" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="21.141.0.118"/>
    </slice>
    <from sec="1115269740" usec="0"/>
    <to sec="1115269761" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_661{
style=filled;
color=gray75;
2488[label="194.138.34.124;60pkt 60fpkt", shape=pentagon, color=darkviolet];
3202[label="194.138.34.124;60pkt 60fpkt", shape=invtriangle, color=brown];
stat661[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.138.34.124:*, *:3127}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3127: (50%)&lt;BR/&gt; 4997: (0.833333%)&lt;BR/&gt; 4747: (0.833333%)&lt;BR/&gt; 4594: (0.833333%)&lt;BR/&gt; 4420: (0.833333%)&gt;];
}
2488--3202[label="1;60pkt 60fpkt"];
</description>
    <slice>
      <filter dst_port="3127" src_ip="194.138.34.124"/>
    </slice>
    <from sec="1115269206" usec="0"/>
    <to sec="1115270095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_663{
style=filled;
color=gray75;
2495[label="207.85.189.126;143pkt 143fpkt", shape=pentagon, color=darkviolet];
3205[label="207.85.189.126;143pkt 143fpkt", shape=invtriangle, color=brown];
3597[label="207.85.189.126;143pkt 143fpkt", shape=invhouse, color=bisque];
stat663[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.85.189.126:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 4915: (0.34965%)&lt;BR/&gt; 4913: (0.34965%)&lt;BR/&gt; 4910: (0.34965%)&lt;BR/&gt; 4906: (0.34965%)&gt;];
}
2495--3205[label="1;143pkt 143fpkt"];
2495--3597[label="1;143pkt 143fpkt"];
3205--3597[label="1;143pkt 143fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="207.85.189.126"/>
    </slice>
    <from sec="1115269285" usec="0"/>
    <to sec="1115269286" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_664{
style=filled;
color=gray75;
2499[label="131.4.108.129;42pkt 42fpkt", shape=pentagon, color=darkviolet];
3206[label="131.4.108.129;42pkt 42fpkt", shape=invtriangle, color=brown];
stat664[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.108.129:*, *:25}[97.619%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (48.8095%)&lt;BR/&gt; 0: (2.38095%)&lt;BR/&gt; 53109: (1.19048%)&lt;BR/&gt; 53098: (1.19048%)&lt;BR/&gt; 53091: (1.19048%)&gt;];
}
2499--3206[label="1;42pkt 42fpkt"];
</description>
    <slice>
      <filter dst_port="25" src_ip="131.4.108.129"/>
    </slice>
    <from sec="1115269224" usec="0"/>
    <to sec="1115270026" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="21.190.111.129"/>
    </slice>
    <from sec="1115269742" usec="0"/>
    <to sec="1115269775" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="68.244.57.136"/>
    </slice>
    <from sec="1115269259" usec="0"/>
    <to sec="1115269603" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_667{
style=filled;
color=gray75;
2528[label="131.5.166.136;25pkt 25fpkt", shape=pentagon, color=darkviolet];
3221[label="131.5.166.136;25pkt 25fpkt", shape=invtriangle, color=brown];
stat667[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.166.136:*, *:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2584: (2%)&lt;BR/&gt; 2582: (2%)&lt;BR/&gt; 2571: (2%)&lt;BR/&gt; 2569: (2%)&gt;];
}
2528--3221[label="1;25pkt 25fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="131.5.166.136"/>
    </slice>
    <from sec="1115269637" usec="0"/>
    <to sec="1115269707" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_668{
style=filled;
color=gray75;
2531[label="206.93.30.137;544pkt 544fpkt", shape=pentagon, color=darkviolet];
3223[label="206.93.30.137;543pkt 543fpkt", shape=invtriangle, color=brown];
stat668[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.93.30.137:*, *:1026}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 48380: (8.83165%)&lt;BR/&gt; 51883: (8.55566%)&lt;BR/&gt; 53195: (8.46366%)&lt;BR/&gt; 52318: (8.18767%)&gt;];
}
2531--3223[label="1;543pkt 543fpkt"];
</description>
    <slice>
      <filter dst_port="1026" src_ip="206.93.30.137"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270010" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.859378,1.64748,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_669{
style=filled;
color=gray75;
1457[label="223.84.131.138;s;3pkt 3fpkt", shape=diamond, color=yellow];
2540[label="223.84.131.138;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3229[label="223.84.131.138;1pkt 1fpkt", shape=invtriangle, color=brown];
3609[label="223.84.131.138;1pkt 1fpkt", shape=invhouse, color=bisque];
stat669[shape=component, label=&lt;Rules:&lt;BR/&gt;{223.84.131.138:0, 210.53.133.184:0}[33.3333%]&lt;BR/&gt;{223.84.131.138:53849, 210.53.135.100:110}[33.3333%]&lt;BR/&gt;{223.84.131.138:53853, 210.53.135.100:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53849: (33.3333%)&lt;BR/&gt; 110: (33.3333%)&lt;BR/&gt; 0: (16.6667%)&lt;BR/&gt; 53853: (8.33333%)&lt;BR/&gt; 80: (8.33333%)&gt;];
}
1457--2540[label="1;1pkt 1fpkt"];
1457--3229[label="1;1pkt 1fpkt"];
1457--3609[label="1;1pkt 1fpkt"];
2540--3229[label="1;1pkt 1fpkt"];
2540--3609[label="1;1pkt 1fpkt"];
3229--3609[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="210.53.135.100" dst_port="80" src_ip="223.84.131.138" src_port="53853"/>
      <filter dst_ip="210.53.135.100" dst_port="110" src_ip="223.84.131.138" src_port="53849"/>
      <filter dst_ip="210.53.133.184" src_ip="223.84.131.138"/>
    </slice>
    <from sec="1115269631" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_670{
style=filled;
color=gray75;
2542[label="202.52.36.139;8pkt 8fpkt", shape=pentagon, color=darkviolet];
3231[label="202.52.36.139;8pkt 8fpkt", shape=invtriangle, color=brown];
stat670[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.52.36.139:*, 131.5.121.2:25}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 2296: (6.25%)&lt;BR/&gt; 2294: (6.25%)&lt;BR/&gt; 2292: (6.25%)&lt;BR/&gt; 2290: (6.25%)&gt;];
}
2542--3231[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="131.5.121.2" dst_port="25" src_ip="202.52.36.139"/>
    </slice>
    <from sec="1115269326" usec="0"/>
    <to sec="1115269359" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_671{
style=filled;
color=gray75;
2548[label="208.208.80.141;80pkt 80fpkt", shape=pentagon, color=darkviolet];
3236[label="208.208.80.141;79pkt 79fpkt", shape=invtriangle, color=brown];
stat671[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.208.80.141:*, *:445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (50%)&lt;BR/&gt; 4262: (1.25786%)&lt;BR/&gt; 4948: (0.628931%)&lt;BR/&gt; 4835: (0.628931%)&lt;BR/&gt; 4670: (0.628931%)&gt;];
}
2548--3236[label="1;79pkt 79fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="208.208.80.141"/>
    </slice>
    <from sec="1115269218" usec="0"/>
    <to sec="1115270092" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_672{
style=filled;
color=gray75;
2551[label="206.56.138.142;10pkt 10fpkt", shape=pentagon, color=darkviolet];
3237[label="206.56.138.142;9pkt 9fpkt", shape=invtriangle, color=brown];
stat672[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.56.138.142:*, 133.190.65.40:25}[50%]&lt;BR/&gt;{206.56.138.142:*, 131.5.162.169:25}[20%]&lt;BR/&gt;{206.56.138.142:*, 131.5.210.171:25}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 4994: (5.26316%)&lt;BR/&gt; 4982: (5.26316%)&lt;BR/&gt; 4980: (5.26316%)&lt;BR/&gt; 1061: (5.26316%)&gt;];
}
2551--3237[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="133.190.65.40" dst_port="25" src_ip="206.56.138.142"/>
      <filter dst_ip="131.5.210.171" dst_port="25" src_ip="206.56.138.142"/>
      <filter dst_ip="131.5.162.169" dst_port="25" src_ip="206.56.138.142"/>
    </slice>
    <from sec="1115269604" usec="0"/>
    <to sec="1115269637" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="202.142.143.143"/>
    </slice>
    <from sec="1115269652" usec="0"/>
    <to sec="1115269991" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_674{
style=filled;
color=gray75;
2565[label="131.4.29.146;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3245[label="131.4.29.146;1pkt 1fpkt", shape=invtriangle, color=brown];
stat674[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.29.146:15664, 196.85.138.160:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 15664: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
2565--3245[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="196.85.138.160" dst_port="80" src_ip="131.4.29.146" src_port="15664"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="200.41.122.150"/>
    </slice>
    <from sec="1115269203" usec="0"/>
    <to sec="1115269404" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_676{
style=filled;
color=gray75;
2582[label="133.190.221.150;2pkt 2fpkt", shape=pentagon, color=darkviolet];
3255[label="133.190.221.150;2pkt 2fpkt", shape=invtriangle, color=brown];
3620[label="133.190.221.150;2pkt 2fpkt", shape=invhouse, color=bisque];
stat676[shape=component, label=&lt;Rules:&lt;BR/&gt;{133.190.221.150:80, 72.167.101.169:46451}[50%]&lt;BR/&gt;{133.190.221.150:80, 72.167.101.169:46452}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 46452: (25%)&lt;BR/&gt; 46451: (25%)&gt;];
}
2582--3255[label="1;2pkt 2fpkt"];
2582--3620[label="1;2pkt 2fpkt"];
3255--3620[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="72.167.101.169" dst_port="46452" src_ip="133.190.221.150" src_port="80"/>
      <filter dst_ip="72.167.101.169" dst_port="46451" src_ip="133.190.221.150" src_port="80"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="65.107.101.151"/>
    </slice>
    <from sec="1115269206" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="197.183.175.151"/>
    </slice>
    <from sec="1115269202" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_679{
style=filled;
color=gray75;
2586[label="194.127.177.151;7pkt 7fpkt", shape=pentagon, color=darkviolet];
3260[label="194.127.177.151;7pkt 7fpkt", shape=invtriangle, color=brown];
stat679[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.127.177.151:*, 131.5.172.62:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 41984: (7.14286%)&lt;BR/&gt; 41361: (7.14286%)&lt;BR/&gt; 40764: (7.14286%)&lt;BR/&gt; 40715: (7.14286%)&gt;];
}
2586--3260[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="131.5.172.62" dst_port="80" src_ip="194.127.177.151"/>
    </slice>
    <from sec="1115269851" usec="0"/>
    <to sec="1115270075" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_680{
style=filled;
color=gray75;
2588[label="215.41.206.151;112pkt 112fpkt", shape=pentagon, color=darkviolet];
3261[label="215.41.206.151;111pkt 111fpkt", shape=invtriangle, color=brown];
3624[label="215.41.206.151;112pkt 112fpkt", shape=invhouse, color=bisque];
stat680[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.41.206.151:80, 211.25.132.116:*}[83.0357%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 61999: (0.447761%)&lt;BR/&gt; 61998: (0.447761%)&lt;BR/&gt; 61997: (0.447761%)&lt;BR/&gt; 61996: (0.447761%)&gt;];
}
2588--3261[label="1;111pkt 111fpkt"];
2588--3624[label="1;112pkt 112fpkt"];
3261--3624[label="1;111pkt 111fpkt"];
</description>
    <slice>
      <filter dst_ip="211.25.132.116" src_ip="215.41.206.151" src_port="80"/>
    </slice>
    <from sec="1115270017" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_681{
style=filled;
color=gray75;
2599[label="210.167.130.154;50pkt 50fpkt", shape=pentagon, color=darkviolet];
3268[label="210.167.130.154;50pkt 50fpkt", shape=invtriangle, color=brown];
3627[label="210.167.130.154;50pkt 50fpkt", shape=invhouse, color=bisque];
stat681[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.167.130.154:*, *:445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (50%)&lt;BR/&gt; 4991: (1%)&lt;BR/&gt; 4954: (1%)&lt;BR/&gt; 4914: (1%)&lt;BR/&gt; 4877: (1%)&gt;];
}
2599--3268[label="1;50pkt 50fpkt"];
2599--3627[label="1;50pkt 50fpkt"];
3268--3627[label="1;50pkt 50fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="210.167.130.154"/>
    </slice>
    <from sec="1115269213" usec="0"/>
    <to sec="1115270083" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_682{
style=filled;
color=gray75;
2606[label="131.4.211.156;9pkt 9fpkt", shape=pentagon, color=darkviolet];
3272[label="131.4.211.156;9pkt 9fpkt", shape=invtriangle, color=brown];
stat682[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.211.156:*, 66.213.198.16:80}[66.6667%]&lt;BR/&gt;{131.4.211.156:*, 66.213.209.66:80}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1660: (5.55556%)&lt;BR/&gt; 1659: (5.55556%)&lt;BR/&gt; 1658: (5.55556%)&lt;BR/&gt; 1657: (5.55556%)&gt;];
}
2606--3272[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="66.213.198.16" dst_port="80" src_ip="131.4.211.156"/>
      <filter dst_ip="66.213.209.66" dst_port="80" src_ip="131.4.211.156"/>
    </slice>
    <from sec="1115269919" usec="0"/>
    <to sec="1115269942" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_683{
style=filled;
color=gray75;
2607[label="207.135.18.157;220pkt 220fpkt", shape=pentagon, color=darkviolet];
3273[label="207.135.18.157;220pkt 220fpkt", shape=invtriangle, color=brown];
stat683[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.135.18.157:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
2607--3273[label="1;220pkt 220fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="207.135.18.157" src_port="1026"/>
    </slice>
    <from sec="1115269716" usec="0"/>
    <to sec="1115269737" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="210.237.158.157"/>
    </slice>
    <from sec="1115269531" usec="0"/>
    <to sec="1115269969" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_685{
style=filled;
color=gray75;
2624[label="206.156.209.161;2pkt 2fpkt", shape=pentagon, color=darkviolet];
3278[label="206.156.209.161;2pkt 2fpkt", shape=invtriangle, color=brown];
stat685[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.156.209.161:80, 211.25.30.240:2773}[50%]&lt;BR/&gt;{206.156.209.161:80, 211.25.30.240:2783}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2783: (25%)&lt;BR/&gt; 2773: (25%)&gt;];
}
2624--3278[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="211.25.30.240" dst_port="2783" src_ip="206.156.209.161" src_port="80"/>
      <filter dst_ip="211.25.30.240" dst_port="2773" src_ip="206.156.209.161" src_port="80"/>
    </slice>
    <from sec="1115269747" usec="0"/>
    <to sec="1115269829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_686{
style=filled;
color=gray75;
2634[label="131.5.9.164;260pkt 260fpkt", shape=pentagon, color=darkviolet];
3284[label="131.5.9.164;260pkt 260fpkt", shape=invtriangle, color=brown];
stat686[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.9.164:53, 223.174.32.17:*}[99.2308%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (49.6154%)&lt;BR/&gt; 80: (0.384615%)&lt;BR/&gt; 65055: (0.192308%)&lt;BR/&gt; 64773: (0.192308%)&lt;BR/&gt; 64689: (0.192308%)&gt;];
}
2634--3284[label="1;260pkt 260fpkt"];
</description>
    <slice>
      <filter dst_ip="223.174.32.17" src_ip="131.5.9.164" src_port="53"/>
    </slice>
    <from sec="1115269335" usec="0"/>
    <to sec="1115269906" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_687{
style=filled;
color=gray75;
2636[label="131.4.108.164;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3286[label="131.4.108.164;1pkt 1fpkt", shape=invtriangle, color=brown];
stat687[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.108.164:25, 200.184.4.213:3028}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3028: (50%)&lt;BR/&gt; 25: (50%)&gt;];
}
2636--3286[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="200.184.4.213" dst_port="3028" src_ip="131.4.108.164" src_port="25"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_688{
style=filled;
color=gray75;
2638[label="21.37.18.165;8pkt 8fpkt", shape=pentagon, color=darkviolet];
3287[label="21.37.18.165;8pkt 8fpkt", shape=invtriangle, color=brown];
stat688[shape=component, label=&lt;Rules:&lt;BR/&gt;{21.37.18.165:*, 149.188.129.162:80}[87.5%]&lt;BR/&gt;{21.37.18.165:21064, *:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 21064: (12.5%)&lt;BR/&gt; 21080: (6.25%)&lt;BR/&gt; 21076: (6.25%)&lt;BR/&gt; 21072: (6.25%)&gt;];
}
2638--3287[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.129.162" dst_port="80" src_ip="21.37.18.165"/>
      <filter dst_port="80" src_ip="21.37.18.165" src_port="21064"/>
    </slice>
    <from sec="1115270036" usec="0"/>
    <to sec="1115270088" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,501,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_689{
style=filled;
color=gray75;
2641[label="171.76.83.166;4pkt 4fpkt", shape=pentagon, color=darkviolet];
3288[label="171.76.83.166;4pkt 4fpkt", shape=invtriangle, color=brown];
stat689[shape=component, label=&lt;Rules:&lt;BR/&gt;{171.76.83.166:3195, 197.116.107.210:21}[25%]&lt;BR/&gt;{171.76.83.166:3204, 197.116.107.210:21}[25%]&lt;BR/&gt;{171.76.83.166:3212, 197.116.107.210:21}[25%]&lt;BR/&gt;{171.76.83.166:3214, 197.116.107.210:21}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (50%)&lt;BR/&gt; 3214: (12.5%)&lt;BR/&gt; 3212: (12.5%)&lt;BR/&gt; 3204: (12.5%)&lt;BR/&gt; 3195: (12.5%)&gt;];
}
2641--3288[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="197.116.107.210" dst_port="21" src_ip="171.76.83.166" src_port="3214"/>
      <filter dst_ip="197.116.107.210" dst_port="21" src_ip="171.76.83.166" src_port="3212"/>
      <filter dst_ip="197.116.107.210" dst_port="21" src_ip="171.76.83.166" src_port="3204"/>
      <filter dst_ip="197.116.107.210" dst_port="21" src_ip="171.76.83.166" src_port="3195"/>
    </slice>
    <from sec="1115269206" usec="0"/>
    <to sec="1115270048" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.859378,1.64748,020,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_690{
style=filled;
color=gray75;
951[label="210.53.133.166;s;280pkt 280fpkt", shape=diamond, color=yellow];
2643[label="210.53.133.166;280pkt 280fpkt", shape=pentagon, color=darkviolet];
3289[label="210.53.133.166;279pkt 279fpkt", shape=invtriangle, color=brown];
3639[label="210.53.133.166;280pkt 280fpkt", shape=invhouse, color=bisque];
stat690[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.53.133.166:0, *:0}[99.2857%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.2851%)&lt;BR/&gt; 3232: (0.178731%)&lt;BR/&gt; 3223: (0.178731%)&lt;BR/&gt; 135: (0.178731%)&lt;BR/&gt; 25: (0.178731%)&gt;];
}
951--958[label="0.0588235;1pkt 1fpkt"];
951--1177[label="0.0769231;1pkt 1fpkt"];
951--2643[label="1;280pkt 280fpkt"];
951--3289[label="1;279pkt 279fpkt"];
951--3639[label="1;280pkt 280fpkt"];
2643--3289[label="1;279pkt 279fpkt"];
2643--3639[label="1;280pkt 280fpkt"];
3289--3639[label="1;279pkt 279fpkt"];
</description>
    <slice>
      <filter src_ip="210.53.133.166"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="70.136.132.171"/>
    </slice>
    <from sec="1115269631" usec="0"/>
    <to sec="1115269745" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_692{
style=filled;
color=gray75;
2660[label="206.168.34.172;39pkt 39fpkt", shape=pentagon, color=darkviolet];
3297[label="206.168.34.172;40pkt 40fpkt", shape=invtriangle, color=brown];
3645[label="206.168.34.172;40pkt 40fpkt", shape=invhouse, color=bisque];
stat692[shape=component, label=&lt;Rules:&lt;BR/&gt;{206.168.34.172:*, *:135}[90%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (44.958%)&lt;BR/&gt; 1025: (5.04202%)&lt;BR/&gt; 4814: (1.2605%)&lt;BR/&gt; 4706: (1.2605%)&lt;BR/&gt; 4695: (1.2605%)&gt;];
}
2660--3297[label="1;39pkt 39fpkt"];
2660--3645[label="1;39pkt 39fpkt"];
3297--3645[label="1;40pkt 40fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="206.168.34.172"/>
    </slice>
    <from sec="1115269205" usec="0"/>
    <to sec="1115270041" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="211.142.88.174"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_694{
style=filled;
color=gray75;
2670[label="171.76.39.176;7pkt 7fpkt", shape=pentagon, color=darkviolet];
3304[label="171.76.39.176;6pkt 6fpkt", shape=invtriangle, color=brown];
3649[label="171.76.39.176;6pkt 6fpkt", shape=invhouse, color=bisque];
stat694[shape=component, label=&lt;Rules:&lt;BR/&gt;{171.76.39.176:25, *:*}[71.4286%]&lt;BR/&gt;{171.76.39.176:80, *:*}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (34.2105%)&lt;BR/&gt; 80: (15.7895%)&lt;BR/&gt; 54174: (7.89474%)&lt;BR/&gt; 46814: (7.89474%)&lt;BR/&gt; 34614: (7.89474%)&gt;];
}
2670--3304[label="1;6pkt 6fpkt"];
2670--3649[label="1;6pkt 6fpkt"];
3304--3649[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter src_ip="171.76.39.176" src_port="25"/>
      <filter src_ip="171.76.39.176" src_port="80"/>
    </slice>
    <from sec="1115269244" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="194.116.207.176"/>
    </slice>
    <from sec="1115269700" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_696{
style=filled;
color=gray75;
2678[label="210.5.111.178;76pkt 76fpkt", shape=pentagon, color=darkviolet];
3309[label="210.5.111.178;76pkt 76fpkt", shape=invtriangle, color=brown];
3651[label="210.5.111.178;76pkt 76fpkt", shape=invhouse, color=bisque];
stat696[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.5.111.178:*, *:445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (50%)&lt;BR/&gt; 4981: (0.657895%)&lt;BR/&gt; 4949: (0.657895%)&lt;BR/&gt; 4927: (0.657895%)&lt;BR/&gt; 4848: (0.657895%)&gt;];
}
2678--3309[label="1;76pkt 76fpkt"];
2678--3651[label="1;76pkt 76fpkt"];
3309--3651[label="1;76pkt 76fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="210.5.111.178"/>
    </slice>
    <from sec="1115269206" usec="0"/>
    <to sec="1115270088" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_697{
style=filled;
color=gray75;
2681[label="211.251.138.179;2pkt 2fpkt", shape=pentagon, color=darkviolet];
3311[label="211.251.138.179;1pkt 1fpkt", shape=invtriangle, color=brown];
stat697[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.251.138.179:113, 131.5.209.7:60441}[50%]&lt;BR/&gt;{211.251.138.179:21098, 131.5.209.7:25}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 60441: (33.3333%)&lt;BR/&gt; 113: (33.3333%)&lt;BR/&gt; 21098: (16.6667%)&lt;BR/&gt; 25: (16.6667%)&gt;];
}
2681--3311[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="131.5.209.7" dst_port="25" src_ip="211.251.138.179" src_port="21098"/>
      <filter dst_ip="131.5.209.7" dst_port="60441" src_ip="211.251.138.179" src_port="113"/>
    </slice>
    <from sec="1115269299" usec="0"/>
    <to sec="1115269319" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_698{
style=filled;
color=gray75;
2692[label="20.174.92.181;232pkt 232fpkt", shape=pentagon, color=darkviolet];
3316[label="20.174.92.181;232pkt 232fpkt", shape=invtriangle, color=brown];
3655[label="20.174.92.181;232pkt 232fpkt", shape=invhouse, color=bisque];
stat698[shape=component, label=&lt;Rules:&lt;BR/&gt;{20.174.92.181:1062, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1062: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
2692--3316[label="1;232pkt 232fpkt"];
2692--3655[label="1;232pkt 232fpkt"];
3316--3655[label="1;232pkt 232fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="20.174.92.181" src_port="1062"/>
    </slice>
    <from sec="1115270000" usec="0"/>
    <to sec="1115270014" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_699{
style=filled;
color=gray75;
2713[label="172.195.108.187;49pkt 49fpkt", shape=pentagon, color=darkviolet];
3326[label="172.195.108.187;48pkt 48fpkt", shape=invtriangle, color=brown];
stat699[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.108.187:*, 206.48.44.74:80}[40.8163%]&lt;BR/&gt;{172.195.108.187:*, 21.39.123.156:80}[24.4898%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.9691%)&lt;BR/&gt; 1863: (1.03093%)&lt;BR/&gt; 1539: (1.03093%)&lt;BR/&gt; 1538: (1.03093%)&lt;BR/&gt; 1537: (1.03093%)&gt;];
}
2713--3326[label="1;48pkt 48fpkt"];
</description>
    <slice>
      <filter dst_ip="206.48.44.74" dst_port="80" src_ip="172.195.108.187"/>
      <filter dst_ip="21.39.123.156" dst_port="80" src_ip="172.195.108.187"/>
    </slice>
    <from sec="1115269204" usec="0"/>
    <to sec="1115270064" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_700{
style=filled;
color=gray75;
2714[label="210.36.121.187;2pkt 2fpkt", shape=pentagon, color=darkviolet];
3327[label="210.36.121.187;2pkt 2fpkt", shape=invtriangle, color=brown];
stat700[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.36.121.187:80, 211.19.96.146:1149}[50%]&lt;BR/&gt;{210.36.121.187:80, 211.19.96.146:1183}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1183: (25%)&lt;BR/&gt; 1149: (25%)&gt;];
}
2714--3327[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="211.19.96.146" dst_port="1183" src_ip="210.36.121.187" src_port="80"/>
      <filter dst_ip="211.19.96.146" dst_port="1149" src_ip="210.36.121.187" src_port="80"/>
    </slice>
    <from sec="1115269236" usec="0"/>
    <to sec="1115270078" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="171.76.4.194"/>
    </slice>
    <from sec="1115269251" usec="0"/>
    <to sec="1115269978" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_702{
style=filled;
color=gray75;
2739[label="210.41.16.195;98pkt 98fpkt", shape=pentagon, color=darkviolet];
3341[label="210.41.16.195;97pkt 97fpkt", shape=invtriangle, color=brown];
stat702[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.41.16.195:*, *:135}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 135: (50%)&lt;BR/&gt; 3269: (1.02564%)&lt;BR/&gt; 4887: (0.512821%)&lt;BR/&gt; 4882: (0.512821%)&lt;BR/&gt; 4874: (0.512821%)&gt;];
}
2739--3341[label="1;97pkt 97fpkt"];
</description>
    <slice>
      <filter dst_port="135" src_ip="210.41.16.195"/>
    </slice>
    <from sec="1115269221" usec="0"/>
    <to sec="1115270097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_703{
style=filled;
color=gray75;
2740[label="195.77.39.195;5pkt 5fpkt", shape=pentagon, color=darkviolet];
3342[label="195.77.39.195;6pkt 6fpkt", shape=invtriangle, color=brown];
3670[label="195.77.39.195;6pkt 6fpkt", shape=invhouse, color=bisque];
stat703[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.77.39.195:80, 131.5.88.152:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2467: (8.82353%)&lt;BR/&gt; 2455: (8.82353%)&lt;BR/&gt; 2422: (8.82353%)&lt;BR/&gt; 2420: (8.82353%)&gt;];
}
2740--3342[label="1;5pkt 5fpkt"];
2740--3670[label="1;5pkt 5fpkt"];
3342--3670[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="131.5.88.152" src_ip="195.77.39.195" src_port="80"/>
    </slice>
    <from sec="1115270021" usec="0"/>
    <to sec="1115270064" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_704{
style=filled;
color=gray75;
2751[label="21.16.139.197;73pkt 73fpkt", shape=pentagon, color=darkviolet];
3346[label="21.16.139.197;73pkt 73fpkt", shape=invtriangle, color=brown];
stat704[shape=component, label=&lt;Rules:&lt;BR/&gt;{21.16.139.197:*, *:8080}[43.8356%]&lt;BR/&gt;{21.16.139.197:*, *:80}[35.6164%]&lt;BR/&gt;{21.16.139.197:*, *:3128}[20.5479%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8080: (21.9178%)&lt;BR/&gt; 80: (17.8082%)&lt;BR/&gt; 3128: (10.274%)&lt;BR/&gt; 20515: (0.684932%)&lt;BR/&gt; 20505: (0.684932%)&gt;];
}
2751--3346[label="1;73pkt 73fpkt"];
</description>
    <slice>
      <filter dst_port="8080" src_ip="21.16.139.197"/>
      <filter dst_port="80" src_ip="21.16.139.197"/>
      <filter dst_port="3128" src_ip="21.16.139.197"/>
    </slice>
    <from sec="1115269234" usec="0"/>
    <to sec="1115269247" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_705{
style=filled;
color=gray75;
2758[label="200.185.86.199;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3349[label="200.185.86.199;1pkt 1fpkt", shape=invtriangle, color=brown];
stat705[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.185.86.199:4320, 171.76.37.105:25}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4320: (50%)&lt;BR/&gt; 25: (50%)&gt;];
}
2758--3349[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="171.76.37.105" dst_port="25" src_ip="200.185.86.199" src_port="4320"/>
    </slice>
    <from sec="1115269674" usec="0"/>
    <to sec="1115269798" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="69.12.153.199"/>
    </slice>
    <from sec="1115269233" usec="0"/>
    <to sec="1115270099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="209.106.20.202"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_708{
style=filled;
color=gray75;
2773[label="195.136.101.202;3pkt 3fpkt", shape=pentagon, color=darkviolet];
3358[label="195.136.101.202;4pkt 4fpkt", shape=invtriangle, color=brown];
stat708[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.136.101.202:2145, 149.188.129.162:80}[25%]&lt;BR/&gt;{195.136.101.202:2146, 149.188.129.162:80}[25%]&lt;BR/&gt;{195.136.101.202:2147, 149.188.129.162:80}[25%]&lt;BR/&gt;{195.136.101.202:2148, 149.188.129.162:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2148: (14.2857%)&lt;BR/&gt; 2147: (14.2857%)&lt;BR/&gt; 2145: (14.2857%)&lt;BR/&gt; 2146: (7.14286%)&gt;];
}
2773--3358[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.129.162" dst_port="80" src_ip="195.136.101.202" src_port="2148"/>
      <filter dst_ip="149.188.129.162" dst_port="80" src_ip="195.136.101.202" src_port="2147"/>
      <filter dst_ip="149.188.129.162" dst_port="80" src_ip="195.136.101.202" src_port="2146"/>
      <filter dst_ip="149.188.129.162" dst_port="80" src_ip="195.136.101.202" src_port="2145"/>
    </slice>
    <from sec="1115270037" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="16.153.37.203"/>
    </slice>
    <from sec="1115269202" usec="0"/>
    <to sec="1115270099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,501,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_710{
style=filled;
color=gray75;
2781[label="171.76.80.204;12pkt 12fpkt", shape=pentagon, color=darkviolet];
3361[label="171.76.80.204;12pkt 12fpkt", shape=invtriangle, color=brown];
stat710[shape=component, label=&lt;Rules:&lt;BR/&gt;{171.76.80.204:*, 220.38.54.76:21}[75%]&lt;BR/&gt;{171.76.80.204:25, *:*}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (37.5%)&lt;BR/&gt; 25: (12.5%)&lt;BR/&gt; 65376: (4.16667%)&lt;BR/&gt; 63389: (4.16667%)&lt;BR/&gt; 59937: (4.16667%)&gt;];
}
2781--3361[label="1;12pkt 12fpkt"];
</description>
    <slice>
      <filter src_ip="171.76.80.204" src_port="25"/>
      <filter dst_ip="220.38.54.76" dst_port="21" src_ip="171.76.80.204"/>
    </slice>
    <from sec="1115269214" usec="0"/>
    <to sec="1115270044" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_711{
style=filled;
color=gray75;
2782[label="145.122.216.204;5pkt 5fpkt", shape=pentagon, color=darkviolet];
3362[label="145.122.216.204;6pkt 6fpkt", shape=invtriangle, color=brown];
stat711[shape=component, label=&lt;Rules:&lt;BR/&gt;{145.122.216.204:*, 133.190.149.216:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2379: (9.09091%)&lt;BR/&gt; 2378: (9.09091%)&lt;BR/&gt; 2377: (9.09091%)&lt;BR/&gt; 2376: (9.09091%)&gt;];
}
2782--3362[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="133.190.149.216" dst_port="80" src_ip="145.122.216.204"/>
    </slice>
    <from sec="1115269470" usec="0"/>
    <to sec="1115269927" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_712{
style=filled;
color=gray75;
2783[label="208.91.232.204;67pkt 67fpkt", shape=pentagon, color=darkviolet];
3363[label="208.91.232.204;67pkt 67fpkt", shape=invtriangle, color=brown];
3678[label="208.91.232.204;66pkt 66fpkt", shape=invhouse, color=bisque];
stat712[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.91.232.204:*, *:445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (50%)&lt;BR/&gt; 4964: (0.75%)&lt;BR/&gt; 4953: (0.75%)&lt;BR/&gt; 4941: (0.75%)&lt;BR/&gt; 4825: (0.75%)&gt;];
}
2783--3363[label="1;67pkt 67fpkt"];
2783--3678[label="1;66pkt 66fpkt"];
3363--3678[label="1;66pkt 66fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="208.91.232.204"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270074" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="209.179.198.207"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_714{
style=filled;
color=gray75;
2792[label="171.76.42.208;3pkt 3fpkt", shape=pentagon, color=darkviolet];
3368[label="171.76.42.208;4pkt 4fpkt", shape=invtriangle, color=brown];
stat714[shape=component, label=&lt;Rules:&lt;BR/&gt;{171.76.42.208:25, 68.173.91.75:14913}[25%]&lt;BR/&gt;{171.76.42.208:25, 64.18.233.230:45279}[25%]&lt;BR/&gt;{171.76.42.208:25, 93.35.81.240:1950}[25%]&lt;BR/&gt;{171.76.42.208:25, 204.196.193.245:3391}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 45279: (14.2857%)&lt;BR/&gt; 14913: (14.2857%)&lt;BR/&gt; 1950: (14.2857%)&lt;BR/&gt; 3391: (7.14286%)&gt;];
}
2792--3368[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="204.196.193.245" dst_port="3391" src_ip="171.76.42.208" src_port="25"/>
      <filter dst_ip="93.35.81.240" dst_port="1950" src_ip="171.76.42.208" src_port="25"/>
      <filter dst_ip="64.18.233.230" dst_port="45279" src_ip="171.76.42.208" src_port="25"/>
      <filter dst_ip="68.173.91.75" dst_port="14913" src_ip="171.76.42.208" src_port="25"/>
    </slice>
    <from sec="1115269294" usec="0"/>
    <to sec="1115270035" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_715{
style=filled;
color=gray75;
2795[label="172.195.137.208;3pkt 3fpkt", shape=pentagon, color=darkviolet];
3370[label="172.195.137.208;3pkt 3fpkt", shape=invtriangle, color=brown];
3681[label="172.195.137.208;3pkt 3fpkt", shape=invhouse, color=bisque];
stat715[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.137.208:3031, 66.213.233.16:3544}[33.3333%]&lt;BR/&gt;{172.195.137.208:3031, 66.213.233.18:3544}[33.3333%]&lt;BR/&gt;{172.195.137.208:3031, 66.213.233.22:3544}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3544: (50%)&lt;BR/&gt; 3031: (50%)&gt;];
}
2795--3370[label="1;3pkt 3fpkt"];
2795--3681[label="1;3pkt 3fpkt"];
3370--3681[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="66.213.233.22" dst_port="3544" src_ip="172.195.137.208" src_port="3031"/>
      <filter dst_ip="66.213.233.18" dst_port="3544" src_ip="172.195.137.208" src_port="3031"/>
      <filter dst_ip="66.213.233.16" dst_port="3544" src_ip="172.195.137.208" src_port="3031"/>
    </slice>
    <from sec="1115269215" usec="0"/>
    <to sec="1115270086" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="196.195.177.209"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,504,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_717{
style=filled;
color=gray75;
2803[label="172.195.128.210;3pkt 3fpkt", shape=pentagon, color=darkviolet];
3375[label="172.195.128.210;4pkt 4fpkt", shape=invtriangle, color=brown];
3684[label="172.195.128.210;3pkt 3fpkt", shape=invhouse, color=bisque];
stat717[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.128.210:1601, 214.12.5.36:80}[25%]&lt;BR/&gt;{172.195.128.210:1597, 214.12.218.199:80}[25%]&lt;BR/&gt;{172.195.128.210:1599, 66.213.229.76:80}[25%]&lt;BR/&gt;{172.195.128.210:1603, 66.213.229.76:443}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (35%)&lt;BR/&gt; 1603: (15%)&lt;BR/&gt; 1601: (15%)&lt;BR/&gt; 1599: (15%)&lt;BR/&gt; 443: (15%)&gt;];
}
2803--3375[label="1;3pkt 3fpkt"];
2803--3684[label="1;3pkt 3fpkt"];
3375--3684[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="66.213.229.76" dst_port="443" src_ip="172.195.128.210" src_port="1603"/>
      <filter dst_ip="66.213.229.76" dst_port="80" src_ip="172.195.128.210" src_port="1599"/>
      <filter dst_ip="214.12.218.199" dst_port="80" src_ip="172.195.128.210" src_port="1597"/>
      <filter dst_ip="214.12.5.36" dst_port="80" src_ip="172.195.128.210" src_port="1601"/>
    </slice>
    <from sec="1115269278" usec="0"/>
    <to sec="1115269296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_718{
style=filled;
color=gray75;
2814[label="70.41.97.212;9pkt 9fpkt", shape=pentagon, color=darkviolet];
3382[label="70.41.97.212;9pkt 9fpkt", shape=invtriangle, color=brown];
3687[label="70.41.97.212;10pkt 10fpkt", shape=invhouse, color=bisque];
stat718[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.41.97.212:*, 133.33.218.151:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2415: (5.35714%)&lt;BR/&gt; 2414: (5.35714%)&lt;BR/&gt; 2413: (5.35714%)&lt;BR/&gt; 2391: (5.35714%)&gt;];
}
2814--3382[label="1;9pkt 9fpkt"];
2814--3687[label="1;9pkt 9fpkt"];
3382--3687[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="133.33.218.151" dst_port="80" src_ip="70.41.97.212"/>
    </slice>
    <from sec="1115269444" usec="0"/>
    <to sec="1115269507" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="71.92.96.215"/>
    </slice>
    <from sec="1115269205" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="194.127.143.216"/>
    </slice>
    <from sec="1115269481" usec="0"/>
    <to sec="1115270090" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.859378,1.64748,011,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_721{
style=filled;
color=gray75;
614[label="202.165.151.210;d;855pkt 855fpkt", shape=diamond, color=yellow];
689[label="210.53.136.254;s;24pkt 24fpkt", shape=diamond, color=yellow];
819[label="210.93.146.79;d;238pkt 238fpkt", shape=diamond, color=yellow];
868[label="210.53.137.133;s;133pkt 133fpkt", shape=diamond, color=yellow];
905[label="210.53.128.194;s;67pkt 67fpkt", shape=diamond, color=yellow];
977[label="21.1.160.81;d;387pkt 387fpkt", shape=diamond, color=yellow];
1109[label="211.148.163.40;d;6pkt 6fpkt", shape=diamond, color=yellow];
1240[label="210.53.128.219;s;60pkt 60fpkt", shape=diamond, color=yellow];
1527[label="210.53.131.195;s;110pkt 110fpkt", shape=diamond, color=yellow];
1531[label="210.53.130.212;s;35pkt 35fpkt", shape=diamond, color=yellow];
1629[label="210.53.132.105;s;88pkt 88fpkt", shape=diamond, color=yellow];
1640[label="210.53.131.204;s;64pkt 64fpkt", shape=diamond, color=yellow];
2136[label="210.53.137.23;34pkt 34fpkt", shape=pentagon, color=darkviolet];
2315[label="210.53.130.70;51pkt 51fpkt", shape=pentagon, color=darkviolet];
2402[label="210.53.132.96;55pkt 55fpkt", shape=pentagon, color=darkviolet];
2407[label="210.53.134.97;13pkt 13fpkt", shape=pentagon, color=darkviolet];
2459[label="210.53.147.112;21pkt 21fpkt", shape=pentagon, color=darkviolet];
2483[label="211.19.126.122;55pkt 55fpkt", shape=pentagon, color=darkviolet];
2514[label="210.53.137.133;142pkt 142fpkt", shape=pentagon, color=darkviolet];
2598[label="210.53.130.154;16pkt 16fpkt", shape=pentagon, color=darkviolet];
2601[label="210.53.148.154;48pkt 48fpkt", shape=pentagon, color=darkviolet];
2694[label="210.53.133.181;32pkt 32fpkt", shape=pentagon, color=darkviolet];
2707[label="210.53.133.184;18pkt 18fpkt", shape=pentagon, color=darkviolet];
2737[label="210.53.128.194;68pkt 68fpkt", shape=pentagon, color=darkviolet];
2742[label="210.53.131.195;118pkt 118fpkt", shape=pentagon, color=darkviolet];
2956[label="210.53.136.254;24pkt 24fpkt", shape=pentagon, color=darkviolet];
3014[label="210.53.137.23;34pkt 34fpkt", shape=invtriangle, color=brown];
3159[label="210.53.134.97;13pkt 13fpkt", shape=invtriangle, color=brown];
3267[label="210.53.130.154;15pkt 15fpkt", shape=invtriangle, color=brown];
3343[label="210.53.131.195;118pkt 118fpkt", shape=invtriangle, color=brown];
3457[label="210.53.136.254;23pkt 23fpkt", shape=invtriangle, color=brown];
3491[label="210.53.137.23;34pkt 34fpkt", shape=invhouse, color=bisque];
3572[label="210.53.134.97;14pkt 14fpkt", shape=invhouse, color=bisque];
3582[label="210.53.132.105;100pkt 100fpkt", shape=invhouse, color=bisque];
3657[label="210.53.133.181;32pkt 32fpkt", shape=invhouse, color=bisque];
3726[label="210.53.136.254;23pkt 23fpkt", shape=invhouse, color=bisque];
stat721[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, *:0}[32.7651%]&lt;BR/&gt;{*:25, 202.165.151.210:*}[32.0582%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (34.5328%)&lt;BR/&gt; 25: (20.5966%)&lt;BR/&gt; 445: (3.59848%)&lt;BR/&gt; 113: (3.23548%)&lt;BR/&gt; 53: (2.95139%)&gt;];
}
614--689[label="0.0416667;1pkt 1fpkt"];
614--708[label="0.0035524;2pkt 2fpkt"];
614--846[label="0.00353357;1pkt 1fpkt"];
614--868[label="0.0150376;2pkt 2fpkt"];
614--883[label="0.00233918;2pkt 2fpkt"];
614--905[label="0.0149254;1pkt 1fpkt"];
614--951[label="0.00357143;1pkt 1fpkt"];
614--990[label="0.00183824;1pkt 1fpkt"];
614--1111[label="0.00552486;1pkt 1fpkt"];
614--1137[label="0.00473934;1pkt 1fpkt"];
614--1240[label="0.0166667;1pkt 1fpkt"];
614--1385[label="0.00390625;2pkt 2fpkt"];
614--1406[label="0.0131579;1pkt 1fpkt"];
614--1527[label="0.00909091;1pkt 1fpkt"];
614--1531[label="0.0285714;1pkt 1fpkt"];
614--1610[label="0.00338983;1pkt 1fpkt"];
614--1629[label="0.0227273;2pkt 2fpkt"];
614--1640[label="0.03125;2pkt 2fpkt"];
614--1825[label="0.0037037;1pkt 1fpkt"];
614--1829[label="0.0625;1pkt 1fpkt"];
614--1943[label="0.00390625;2pkt 2fpkt"];
614--2109[label="0.00365631;2pkt 2fpkt"];
614--2136[label="0.0588235;2pkt 2fpkt"];
614--2283[label="0.00483092;1pkt 1fpkt"];
614--2315[label="0.0196078;1pkt 1fpkt"];
614--2402[label="0.0181818;1pkt 1fpkt"];
614--2403[label="0.00653595;1pkt 1fpkt"];
614--2406[label="0.00172117;1pkt 1fpkt"];
614--2407[label="0.153846;2pkt 2fpkt"];
614--2459[label="0.0952381;2pkt 2fpkt"];
614--2514[label="0.0140845;2pkt 2fpkt"];
614--2519[label="0.00352113;1pkt 1fpkt"];
614--2598[label="0.125;2pkt 2fpkt"];
614--2601[label="0.0208333;1pkt 1fpkt"];
614--2643[label="0.00357143;1pkt 1fpkt"];
614--2694[label="0.0625;2pkt 2fpkt"];
614--2707[label="0.0555556;1pkt 1fpkt"];
614--2737[label="0.0147059;1pkt 1fpkt"];
614--2742[label="0.00847458;1pkt 1fpkt"];
614--2835[label="0.0416667;1pkt 1fpkt"];
614--2865[label="0.0131579;1pkt 1fpkt"];
614--2956[label="0.0416667;1pkt 1fpkt"];
614--2997[label="0.00365631;2pkt 2fpkt"];
614--3014[label="0.0588235;2pkt 2fpkt"];
614--3096[label="0.00485437;1pkt 1fpkt"];
614--3156[label="0.00657895;1pkt 1fpkt"];
614--3158[label="0.00172414;1pkt 1fpkt"];
614--3159[label="0.153846;2pkt 2fpkt"];
614--3215[label="0.00352113;1pkt 1fpkt"];
614--3267[label="0.133333;2pkt 2fpkt"];
614--3289[label="0.00358423;1pkt 1fpkt"];
614--3343[label="0.00847458;1pkt 1fpkt"];
614--3392[label="0.0416667;1pkt 1fpkt"];
614--3403[label="0.0131579;1pkt 1fpkt"];
614--3457[label="0.0434783;1pkt 1fpkt"];
614--3483[label="0.00365631;2pkt 2fpkt"];
614--3491[label="0.0588235;2pkt 2fpkt"];
614--3569[label="0.00657895;1pkt 1fpkt"];
614--3571[label="0.00172117;1pkt 1fpkt"];
614--3572[label="0.142857;2pkt 2fpkt"];
614--3582[label="0.02;2pkt 2fpkt"];
614--3601[label="0.00353357;1pkt 1fpkt"];
614--3639[label="0.00357143;1pkt 1fpkt"];
614--3657[label="0.0625;2pkt 2fpkt"];
614--3694[label="0.012987;1pkt 1fpkt"];
614--3726[label="0.0434783;1pkt 1fpkt"];
689--977[label="0.0416667;1pkt 1fpkt"];
689--1109[label="1;6pkt 6fpkt"];
689--1983[label="0.0416667;1pkt 1fpkt"];
689--1989[label="0.0416667;1pkt 1fpkt"];
689--1997[label="0.0416667;1pkt 1fpkt"];
689--2004[label="0.0833333;2pkt 2fpkt"];
689--2015[label="0.0416667;1pkt 1fpkt"];
689--2020[label="0.0416667;1pkt 1fpkt"];
689--2024[label="0.0833333;2pkt 2fpkt"];
689--2031[label="0.0416667;1pkt 1fpkt"];
689--2035[label="0.0833333;2pkt 2fpkt"];
689--2956[label="1;24pkt 24fpkt"];
689--3457[label="1;23pkt 23fpkt"];
689--3726[label="1;23pkt 23fpkt"];
819--1111[label="0.00552486;1pkt 1fpkt"];
819--1137[label="0.00473934;1pkt 1fpkt"];
819--1385[label="0.00420168;1pkt 1fpkt"];
819--1527[label="0.0181818;2pkt 2fpkt"];
819--1640[label="0.03125;2pkt 2fpkt"];
819--1943[label="0.00420168;1pkt 1fpkt"];
819--2109[label="0.00420168;1pkt 1fpkt"];
819--2407[label="0.153846;2pkt 2fpkt"];
819--2518[label="0.75;3pkt 3fpkt"];
819--2598[label="0.0625;1pkt 1fpkt"];
819--2694[label="0.03125;1pkt 1fpkt"];
819--2742[label="0.0169492;2pkt 2fpkt"];
819--2997[label="0.00420168;1pkt 1fpkt"];
819--3159[label="0.153846;2pkt 2fpkt"];
819--3214[label="0.75;3pkt 3fpkt"];
819--3267[label="0.0666667;1pkt 1fpkt"];
819--3343[label="0.0169492;2pkt 2fpkt"];
819--3483[label="0.00420168;1pkt 1fpkt"];
819--3572[label="0.142857;2pkt 2fpkt"];
819--3657[label="0.03125;1pkt 1fpkt"];
868--2514[label="0.992481;132pkt 132fpkt"];
905--1677[label="0.0666667;1pkt 1fpkt"];
905--2737[label="0.985075;66pkt 66fpkt"];
977--1128[label="0.00268817;1pkt 1fpkt"];
977--1257[label="0.00324675;1pkt 1fpkt"];
977--1382[label="0.00258398;1pkt 1fpkt"];
977--1385[label="0.00258398;1pkt 1fpkt"];
977--1527[label="0.00909091;1pkt 1fpkt"];
977--1881[label="0.00258398;1pkt 1fpkt"];
977--1943[label="0.00258398;1pkt 1fpkt"];
977--2099[label="0.00258398;1pkt 1fpkt"];
977--2109[label="0.00258398;1pkt 1fpkt"];
977--2160[label="0.00869565;1pkt 1fpkt"];
977--2187[label="0.027027;1pkt 1fpkt"];
977--2322[label="0.00258398;1pkt 1fpkt"];
977--2483[label="0.0181818;1pkt 1fpkt"];
977--2533[label="0.00877193;1pkt 1fpkt"];
977--2717[label="0.00258398;1pkt 1fpkt"];
977--2742[label="0.00847458;1pkt 1fpkt"];
977--2956[label="0.0416667;1pkt 1fpkt"];
977--2997[label="0.00258398;1pkt 1fpkt"];
977--3041[label="0.027027;1pkt 1fpkt"];
977--3116[label="0.00258398;1pkt 1fpkt"];
977--3225[label="0.00884956;1pkt 1fpkt"];
977--3343[label="0.00847458;1pkt 1fpkt"];
977--3457[label="0.0434783;1pkt 1fpkt"];
977--3483[label="0.00258398;1pkt 1fpkt"];
977--3506[label="0.027027;1pkt 1fpkt"];
977--3726[label="0.0434783;1pkt 1fpkt"];
1109--1983[label="0.166667;1pkt 1fpkt"];
1109--1989[label="0.166667;1pkt 1fpkt"];
1109--1997[label="0.166667;1pkt 1fpkt"];
1109--2004[label="0.166667;1pkt 1fpkt"];
1109--2015[label="0.166667;1pkt 1fpkt"];
1109--2020[label="0.166667;1pkt 1fpkt"];
1109--2024[label="0.166667;1pkt 1fpkt"];
1109--2031[label="0.166667;1pkt 1fpkt"];
1109--2035[label="0.166667;1pkt 1fpkt"];
1109--2956[label="1;6pkt 6fpkt"];
1109--3457[label="1;6pkt 6fpkt"];
1109--3726[label="1;6pkt 6fpkt"];
1240--1677[label="0.133333;2pkt 2fpkt"];
1527--2742[label="0.990909;109pkt 109fpkt"];
1527--3343[label="0.990909;109pkt 109fpkt"];
1629--3582[label="0.965909;85pkt 85fpkt"];
2136--3014[label="1;34pkt 34fpkt"];
2136--3491[label="1;34pkt 34fpkt"];
2407--3159[label="1;13pkt 13fpkt"];
2407--3572[label="1;13pkt 13fpkt"];
2598--3267[label="1;15pkt 15fpkt"];
2694--3657[label="1;32pkt 32fpkt"];
2742--3343[label="1;118pkt 118fpkt"];
2956--3457[label="1;23pkt 23fpkt"];
2956--3726[label="1;23pkt 23fpkt"];
3014--3491[label="1;34pkt 34fpkt"];
3159--3572[label="1;13pkt 13fpkt"];
3457--3726[label="1;23pkt 23fpkt"];
</description>
    <slice>
      <filter dst_ip="202.165.151.210" src_port="25"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="69.201.90.224"/>
    </slice>
    <from sec="1115269215" usec="0"/>
    <to sec="1115270092" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="69.208.157.225"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="131.5.223.226"/>
    </slice>
    <from sec="1115269861" usec="0"/>
    <to sec="1115269913" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,020,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_725{
style=filled;
color=gray75;
2865[label="210.53.128.227;76pkt 76fpkt", shape=pentagon, color=darkviolet];
3403[label="210.53.128.227;76pkt 76fpkt", shape=invtriangle, color=brown];
3694[label="210.53.128.227;77pkt 77fpkt", shape=invhouse, color=bisque];
stat725[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.53.128.227:0, *:0}[93.5065%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (93.4498%)&lt;BR/&gt; 80: (1.96507%)&lt;BR/&gt; 40359: (0.655022%)&lt;BR/&gt; 40348: (0.655022%)&lt;BR/&gt; 40342: (0.655022%)&gt;];
}
2865--3403[label="1;76pkt 76fpkt"];
2865--3694[label="1;76pkt 76fpkt"];
3403--3694[label="1;76pkt 76fpkt"];
</description>
    <slice>
      <filter src_ip="210.53.128.227"/>
    </slice>
    <from sec="1115269216" usec="0"/>
    <to sec="1115270092" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="95.187.10.229"/>
    </slice>
    <from sec="1115269224" usec="0"/>
    <to sec="1115270091" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_727{
style=filled;
color=gray75;
2877[label="211.214.146.230;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3409[label="211.214.146.230;1pkt 1fpkt", shape=invtriangle, color=brown];
stat727[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.214.146.230:80, 172.195.110.177:1889}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1889: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
2877--3409[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="172.195.110.177" dst_port="1889" src_ip="211.214.146.230" src_port="80"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.859378,1.64748,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_728{
style=filled;
color=gray75;
804[label="131.5.26.233;s;265pkt 265fpkt", shape=diamond, color=yellow];
2882[label="131.5.26.233;326pkt 326fpkt", shape=pentagon, color=darkviolet];
3410[label="131.5.26.233;325pkt 325fpkt", shape=invtriangle, color=brown];
3697[label="131.5.26.233;326pkt 326fpkt", shape=invhouse, color=bisque];
stat728[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.5.26.233:*, 200.188.55.24:80}[89.2638%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.4638%)&lt;BR/&gt; 1039: (1.57005%)&lt;BR/&gt; 53: (1.57005%)&lt;BR/&gt; 443: (0.483092%)&lt;BR/&gt; 9898: (0.161031%)&gt;];
}
804--808[label="0.954717;253pkt 253fpkt"];
804--1771[label="0.0113208;3pkt 3fpkt"];
804--2882[label="1;265pkt 265fpkt"];
804--3410[label="1;265pkt 265fpkt"];
804--3697[label="1;265pkt 265fpkt"];
2882--3410[label="1;325pkt 325fpkt"];
2882--3697[label="1;326pkt 326fpkt"];
3410--3697[label="1;325pkt 325fpkt"];
</description>
    <slice>
      <filter dst_ip="200.188.55.24" dst_port="80" src_ip="131.5.26.233"/>
    </slice>
    <from sec="1115269249" usec="0"/>
    <to sec="1115270081" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.966908,1.64039,002,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_729{
style=filled;
color=gray75;
195[label="66.11.42.237s;205pkt 205fpkt", shape=rectangle, color=red];
2895[label="66.11.42.237;250pkt 250fpkt", shape=pentagon, color=darkviolet];
3419[label="66.11.42.237;249pkt 249fpkt", shape=invtriangle, color=brown];
3704[label="66.11.42.237;249pkt 249fpkt", shape=invhouse, color=bisque];
stat729[shape=component, label=&lt;Rules:&lt;BR/&gt;{66.11.42.237:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 61996: (0.209864%)&lt;BR/&gt; 61990: (0.209864%)&lt;BR/&gt; 61984: (0.209864%)&lt;BR/&gt; 61978: (0.209864%)&gt;];
}
195--2895[label="1;205pkt 205fpkt"];
195--3419[label="0.995122;204pkt 204fpkt"];
195--3704[label="0.995122;204pkt 204fpkt"];
2895--3419[label="1;249pkt 249fpkt"];
2895--3704[label="1;249pkt 249fpkt"];
3419--3704[label="1;249pkt 249fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="66.11.42.237"/>
    </slice>
    <from sec="1115269540" usec="0"/>
    <to sec="1115269579" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.634441,1.66751,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_730{
style=filled;
color=gray75;
1570[label="204.214.52.237;s;6pkt 6fpkt", shape=diamond, color=yellow];
2897[label="204.214.52.237;4pkt 4fpkt", shape=pentagon, color=darkviolet];
3421[label="204.214.52.237;5pkt 5fpkt", shape=invtriangle, color=brown];
stat730[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.214.52.237:80, 149.188.129.54:*}[66.6667%]&lt;BR/&gt;{204.214.52.237:53, *:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (36.6667%)&lt;BR/&gt; 53: (13.3333%)&lt;BR/&gt; 32776: (10%)&lt;BR/&gt; 25617: (10%)&lt;BR/&gt; 25616: (10%)&gt;];
}
1570--2897[label="1;4pkt 4fpkt"];
1570--3421[label="1;5pkt 5fpkt"];
2897--3421[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter src_ip="204.214.52.237" src_port="53"/>
      <filter dst_ip="149.188.129.54" src_ip="204.214.52.237" src_port="80"/>
    </slice>
    <from sec="1115269760" usec="0"/>
    <to sec="1115269894" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.966908,1.64039,001,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_731{
style=filled;
color=gray75;
196[label="207.158.169.237s;228pkt 228fpkt", shape=rectangle, color=red];
2899[label="207.158.169.237;227pkt 227fpkt", shape=pentagon, color=darkviolet];
3422[label="207.158.169.237;227pkt 227fpkt", shape=invtriangle, color=brown];
3706[label="207.158.169.237;228pkt 228fpkt", shape=invhouse, color=bisque];
stat731[shape=component, label=&lt;Rules:&lt;BR/&gt;{207.158.169.237:*, *:9898}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (50%)&lt;BR/&gt; 1576: (0.21978%)&lt;BR/&gt; 1575: (0.21978%)&lt;BR/&gt; 1574: (0.21978%)&lt;BR/&gt; 1573: (0.21978%)&gt;];
}
196--2899[label="1;227pkt 227fpkt"];
196--3422[label="1;227pkt 227fpkt"];
196--3706[label="1;228pkt 228fpkt"];
2899--3422[label="1;227pkt 227fpkt"];
2899--3706[label="1;227pkt 227fpkt"];
3422--3706[label="1;227pkt 227fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="207.158.169.237"/>
    </slice>
    <from sec="1115269835" usec="0"/>
    <to sec="1115269841" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="206.61.51.239"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="205.7.86.239"/>
    </slice>
    <from sec="1115269203" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_734{
style=filled;
color=gray75;
2906[label="128.117.192.239;3pkt 3fpkt", shape=pentagon, color=darkviolet];
3428[label="128.117.192.239;3pkt 3fpkt", shape=invtriangle, color=brown];
stat734[shape=component, label=&lt;Rules:&lt;BR/&gt;{128.117.192.239:80, 171.76.42.135:3742}[33.3333%]&lt;BR/&gt;{128.117.192.239:80, 171.76.42.135:3791}[33.3333%]&lt;BR/&gt;{128.117.192.239:80, 171.76.42.135:3797}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3797: (16.6667%)&lt;BR/&gt; 3791: (16.6667%)&lt;BR/&gt; 3742: (16.6667%)&gt;];
}
2906--3428[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="171.76.42.135" dst_port="3797" src_ip="128.117.192.239" src_port="80"/>
      <filter dst_ip="171.76.42.135" dst_port="3791" src_ip="128.117.192.239" src_port="80"/>
      <filter dst_ip="171.76.42.135" dst_port="3742" src_ip="128.117.192.239" src_port="80"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="193.92.24.241"/>
    </slice>
    <from sec="1115269448" usec="0"/>
    <to sec="1115269452" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_736{
style=filled;
color=gray75;
2916[label="210.84.39.243;14pkt 14fpkt", shape=pentagon, color=darkviolet];
3434[label="210.84.39.243;14pkt 14fpkt", shape=invtriangle, color=brown];
3711[label="210.84.39.243;14pkt 14fpkt", shape=invhouse, color=bisque];
stat736[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.84.39.243:*, 211.19.96.72:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 55768: (3.57143%)&lt;BR/&gt; 55767: (3.57143%)&lt;BR/&gt; 55766: (3.57143%)&lt;BR/&gt; 55764: (3.57143%)&gt;];
}
2916--3434[label="1;14pkt 14fpkt"];
2916--3711[label="1;14pkt 14fpkt"];
3434--3711[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter dst_ip="211.19.96.72" dst_port="80" src_ip="210.84.39.243"/>
    </slice>
    <from sec="1115269396" usec="0"/>
    <to sec="1115270095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="207.75.2.244"/>
    </slice>
    <from sec="1115269203" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_738{
style=filled;
color=gray75;
2929[label="16.36.135.246;10pkt 10fpkt", shape=pentagon, color=darkviolet];
3441[label="16.36.135.246;10pkt 10fpkt", shape=invtriangle, color=brown];
stat738[shape=component, label=&lt;Rules:&lt;BR/&gt;{16.36.135.246:*, 131.5.172.60:80}[60%]&lt;BR/&gt;{16.36.135.246:*, 131.5.178.71:80}[30%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1325: (5%)&lt;BR/&gt; 1324: (5%)&lt;BR/&gt; 1323: (5%)&lt;BR/&gt; 1320: (5%)&gt;];
}
2929--3441[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter dst_ip="131.5.172.60" dst_port="80" src_ip="16.36.135.246"/>
      <filter dst_ip="131.5.178.71" dst_port="80" src_ip="16.36.135.246"/>
    </slice>
    <from sec="1115269298" usec="0"/>
    <to sec="1115269457" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_739{
style=filled;
color=gray75;
2930[label="210.68.154.246;141pkt 141fpkt", shape=pentagon, color=darkviolet];
3442[label="210.68.154.246;141pkt 141fpkt", shape=invtriangle, color=brown];
3716[label="210.68.154.246;141pkt 141fpkt", shape=invhouse, color=bisque];
stat739[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.68.154.246:63949, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 63949: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
2930--3442[label="1;141pkt 141fpkt"];
2930--3716[label="1;141pkt 141fpkt"];
3442--3716[label="1;141pkt 141fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="210.68.154.246" src_port="63949"/>
    </slice>
    <from sec="1115269922" usec="0"/>
    <to sec="1115269945" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.792032,1.69546,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_740{
style=filled;
color=gray75;
2933[label="169.38.101.247;5pkt 5fpkt", shape=pentagon, color=darkviolet];
3445[label="169.38.101.247;4pkt 4fpkt", shape=invtriangle, color=brown];
3719[label="169.38.101.247;4pkt 4fpkt", shape=invhouse, color=bisque];
stat740[shape=component, label=&lt;Rules:&lt;BR/&gt;{169.38.101.247:1225, 133.190.149.216:80}[20%]&lt;BR/&gt;{169.38.101.247:1226, 133.190.149.216:80}[20%]&lt;BR/&gt;{169.38.101.247:1227, 133.190.149.216:80}[20%]&lt;BR/&gt;{169.38.101.247:1228, 133.190.149.216:80}[20%]&lt;BR/&gt;{169.38.101.247:1229, 133.190.149.216:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1229: (11.5385%)&lt;BR/&gt; 1228: (11.5385%)&lt;BR/&gt; 1227: (11.5385%)&lt;BR/&gt; 1226: (11.5385%)&gt;];
}
2933--3445[label="1;4pkt 4fpkt"];
2933--3719[label="1;4pkt 4fpkt"];
3445--3719[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="133.190.149.216" dst_port="80" src_ip="169.38.101.247" src_port="1229"/>
      <filter dst_ip="133.190.149.216" dst_port="80" src_ip="169.38.101.247" src_port="1228"/>
      <filter dst_ip="133.190.149.216" dst_port="80" src_ip="169.38.101.247" src_port="1227"/>
      <filter dst_ip="133.190.149.216" dst_port="80" src_ip="169.38.101.247" src_port="1226"/>
      <filter dst_ip="133.190.149.216" dst_port="80" src_ip="169.38.101.247" src_port="1225"/>
    </slice>
    <from sec="1115269654" usec="0"/>
    <to sec="1115269688" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_741{
style=filled;
color=gray75;
2942[label="172.195.64.250;42pkt 42fpkt", shape=pentagon, color=darkviolet];
3448[label="172.195.64.250;43pkt 43fpkt", shape=invtriangle, color=brown];
stat741[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.195.64.250:*, 214.12.130.236:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 59510: (1.17647%)&lt;BR/&gt; 59504: (1.17647%)&lt;BR/&gt; 59501: (1.17647%)&lt;BR/&gt; 59492: (1.17647%)&gt;];
}
2942--3448[label="1;42pkt 42fpkt"];
</description>
    <slice>
      <filter dst_ip="214.12.130.236" dst_port="80" src_ip="172.195.64.250"/>
    </slice>
    <from sec="1115269212" usec="0"/>
    <to sec="1115270097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_742{
style=filled;
color=gray75;
2943[label="210.168.71.250;63pkt 63fpkt", shape=pentagon, color=darkviolet];
3449[label="210.168.71.250;62pkt 62fpkt", shape=invtriangle, color=brown];
stat742[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.168.71.250:*, *:445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (50%)&lt;BR/&gt; 4860: (0.8%)&lt;BR/&gt; 4653: (0.8%)&lt;BR/&gt; 4571: (0.8%)&lt;BR/&gt; 4503: (0.8%)&gt;];
}
2943--3449[label="1;62pkt 62fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="210.168.71.250"/>
    </slice>
    <from sec="1115269220" usec="0"/>
    <to sec="1115270095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="200.19.130.251"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.539722,1.71493,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_744{
style=filled;
color=gray75;
2951[label="209.109.36.252;3pkt 3fpkt", shape=pentagon, color=darkviolet];
3453[label="209.109.36.252;3pkt 3fpkt", shape=invtriangle, color=brown];
stat744[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.109.36.252:61985, 172.195.115.165:28500}[33.3333%]&lt;BR/&gt;{209.109.36.252:61985, 210.53.135.195:6872}[33.3333%]&lt;BR/&gt;{209.109.36.252:61985, 211.19.96.219:49528}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 61985: (50%)&lt;BR/&gt; 49528: (16.6667%)&lt;BR/&gt; 28500: (16.6667%)&lt;BR/&gt; 6872: (16.6667%)&gt;];
}
2951--3453[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="211.19.96.219" dst_port="49528" src_ip="209.109.36.252" src_port="61985"/>
      <filter dst_ip="210.53.135.195" dst_port="6872" src_ip="209.109.36.252" src_port="61985"/>
      <filter dst_ip="172.195.115.165" dst_port="28500" src_ip="209.109.36.252" src_port="61985"/>
    </slice>
    <from sec="1115269225" usec="0"/>
    <to sec="1115270094" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="211.74.49.254"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.613206,1.77731,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="192.43.176.254"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115269340" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.966908,1.64039,503,1 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_747{
style=filled;
color=gray75;
0[label="131.4.104.0s;1pkt 1fpkt", shape=rectangle, color=red];
2040[label="131.4.104.0;15pkt 15fpkt", shape=pentagon, color=darkviolet];
2961[label="131.4.104.0;15pkt 15fpkt", shape=invtriangle, color=brown];
3460[label="131.4.104.0;15pkt 15fpkt", shape=invhouse, color=bisque];
stat747[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.4.104.0:*, 214.58.94.149:80}[40%]&lt;BR/&gt;{131.4.104.0:*, 204.152.61.86:80}[26.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (40.2174%)&lt;BR/&gt; 47368: (6.52174%)&lt;BR/&gt; 43681: (4.34783%)&lt;BR/&gt; 43799: (3.26087%)&lt;BR/&gt; 43798: (3.26087%)&gt;];
}
0--2040[label="1;1pkt 1fpkt"];
0--2961[label="1;1pkt 1fpkt"];
0--3460[label="1;1pkt 1fpkt"];
2040--2961[label="1;15pkt 15fpkt"];
2040--3460[label="1;15pkt 15fpkt"];
2961--3460[label="1;15pkt 15fpkt"];
</description>
    <slice>
      <filter dst_ip="214.58.94.149" dst_port="80" src_ip="131.4.104.0"/>
      <filter dst_ip="204.152.61.86" dst_port="80" src_ip="131.4.104.0"/>
    </slice>
    <from sec="1115269511" usec="0"/>
    <to sec="1115270099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.776012,1.79451,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="214.234.17.1"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.776012,1.79451,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="67.110.62.12"/>
    </slice>
    <from sec="1115269207" usec="0"/>
    <to sec="1115269509" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.776012,1.79451,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="212.88.161.25"/>
    </slice>
    <from sec="1115269339" usec="0"/>
    <to sec="1115269380" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.776012,1.79451,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="211.197.75.28"/>
    </slice>
    <from sec="1115269809" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.776012,1.79451,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="64.138.185.82"/>
    </slice>
    <from sec="1115269482" usec="0"/>
    <to sec="1115269505" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.776012,1.79451,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="205.55.78.85"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.776012,1.79451,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="203.157.136.89"/>
    </slice>
    <from sec="1115269627" usec="0"/>
    <to sec="1115269802" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.776012,1.79451,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="64.138.169.95"/>
    </slice>
    <from sec="1115269210" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.776012,1.79451,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="208.129.225.99"/>
    </slice>
    <from sec="1115269310" usec="0"/>
    <to sec="1115269490" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.776012,1.79451,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="70.36.178.111"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115270060" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.776012,1.79451,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="68.244.57.136"/>
    </slice>
    <from sec="1115269259" usec="0"/>
    <to sec="1115269603" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.776012,1.79451,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="197.183.175.151"/>
    </slice>
    <from sec="1115269202" usec="0"/>
    <to sec="1115270098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.776012,1.79451,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="211.142.88.174"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.776012,1.79451,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="171.76.4.194"/>
    </slice>
    <from sec="1115269251" usec="0"/>
    <to sec="1115269978" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.843823,1.75853,999,0 0 0 0 0 0 0 0 0 0 1 1 ">
    <description>subgraph cluster_762{
style=filled;
color=gray75;
3348[label="20.0.146.198;1pkt 1fpkt", shape=invtriangle, color=brown];
3671[label="20.0.146.198;1pkt 1fpkt", shape=invhouse, color=bisque];
stat762[shape=component, label=&lt;Rules:&lt;BR/&gt;{20.0.146.198:3649, 149.188.233.235:1777}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3649: (50%)&lt;BR/&gt; 1777: (50%)&gt;];
}
3348--3671[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="149.188.233.235" dst_port="1777" src_ip="20.0.146.198" src_port="3649"/>
    </slice>
    <from sec="1115269980" usec="0"/>
    <to sec="1115270100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.776012,1.79451,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="209.106.20.202"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.776012,1.79451,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="211.19.99.211"/>
    </slice>
    <from sec="1115269200" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.776012,1.79451,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="194.127.143.216"/>
    </slice>
    <from sec="1115269481" usec="0"/>
    <to sec="1115270090" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.776012,1.79451,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="69.208.157.225"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.776012,1.79451,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="209.170.193.234"/>
    </slice>
    <from sec="1115269201" usec="0"/>
    <to sec="1115269354" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.776012,1.79451,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="210.136.220.236"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.776012,1.79451,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="200.19.130.251"/>
    </slice>
    <from sec="1115270100" usec="0"/>
    <to sec="1115270101" usec="0"/>
  </anomaly>

</admd:annotation>
