<?xml version="1.0" encoding="UTF-8" standalone="no" ?>
<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">

  <anomaly type="notice" value="1.24663,2.05012,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="64.12.100.31" proto="icmp" src_ip="64.12.100.31"/>
      <filter dst_ip="64.12.100.31" proto="icmp" src_ip="64.12.100.31"/>
      <filter dst_ip="64.12.100.31" proto="icmp" src_ip="64.12.100.31"/>
      <filter dst_ip="64.12.100.31" proto="icmp" src_ip="64.12.100.31"/>
      <from sec="1123477515" usec="0"/>
      <to sec="1123477518" usec="0"/>
    </slice>
    <from sec="1123477514" usec="0"/>
    <to sec="1123477518" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.24663,2.05012,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="tcp" src_ip="219.174.52.2" src_port="1029"/>
      <filter dst_port="137" proto="udp" src_ip="219.174.52.2" src_port="1029"/>
      <filter dst_port="1434" proto="tcp" src_ip="219.174.52.2" src_port="1029"/>
      <filter dst_port="1434" proto="udp" src_ip="219.174.52.2" src_port="1029"/>
      <filter dst_port="80" proto="tcp" src_ip="219.174.52.2" src_port="1029"/>
      <filter dst_port="80" proto="udp" src_ip="219.174.52.2" src_port="1029"/>
      <from sec="1123477210" usec="0"/>
      <to sec="1123477225" usec="0"/>
    </slice>
    <from sec="1123477210" usec="0"/>
    <to sec="1123477225" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.24663,2.05012,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="211.36.202.37" src_port="1026"/>
      <from sec="1123477997" usec="0"/>
      <to sec="1123478005" usec="0"/>
    </slice>
    <from sec="1123477997" usec="0"/>
    <to sec="1123478005" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.24663,2.05012,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="tcp" src_ip="215.221.136.52" src_port="1688"/>
      <filter dst_port="137" proto="udp" src_ip="215.221.136.52" src_port="1688"/>
      <filter dst_port="137" proto="tcp" src_ip="215.221.136.52" src_port="80"/>
      <filter dst_port="137" proto="udp" src_ip="215.221.136.52" src_port="80"/>
      <from sec="1123477778" usec="0"/>
      <to sec="1123477781" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="137" proto="tcp" src_ip="71.84.204.52" src_port="1688"/>
      <filter dst_port="137" proto="udp" src_ip="71.84.204.52" src_port="1688"/>
      <filter dst_port="137" proto="tcp" src_ip="71.84.204.52" src_port="80"/>
      <filter dst_port="137" proto="udp" src_ip="71.84.204.52" src_port="80"/>
      <from sec="1123477778" usec="0"/>
      <to sec="1123477782" usec="0"/>
    </slice>
    <from sec="1123477778" usec="0"/>
    <to sec="1123477782" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.24663,2.05012,002,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="137" proto="udp" src_ip="211.39.225.118" src_port="62171"/>
      <from sec="1123477356" usec="0"/>
      <to sec="1123477368" usec="0"/>
    </slice>
    <from sec="1123477356" usec="0"/>
    <to sec="1123477368" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.24663,2.05012,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="139" proto="tcp" src_ip="219.123.36.42" src_port="53"/>
      <filter dst_port="139" proto="udp" src_ip="219.123.36.42" src_port="53"/>
      <from sec="1123477501" usec="0"/>
      <to sec="1123477522" usec="0"/>
    </slice>
    <slice>
      <filter dst_port="139" proto="tcp" src_ip="201.117.144.42" src_port="53"/>
      <filter dst_port="139" proto="udp" src_ip="201.117.144.42" src_port="53"/>
      <from sec="1123477499" usec="0"/>
      <to sec="1123477523" usec="0"/>
    </slice>
    <from sec="1123477499" usec="0"/>
    <to sec="1123477523" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_36{
style=filled;
color=gray75;
169[label="158.189.128.66;s;174pkt 174fpkt", shape=diamond, color=yellow];
170[label="70.71.94.111;d;149pkt 149fpkt", shape=diamond, color=yellow];
1867[label="218.243.87.85;d;17pkt 17fpkt", shape=diamond, color=yellow];
3492[label="158.189.128.66;183pkt 183fpkt", shape=pentagon, color=darkviolet];
stat36[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.189.128.66:80, 70.71.94.111:*}[84.153%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.1836%)&lt;BR/&gt; 8000: (1.43403%)&lt;BR/&gt; 18000: (0.382409%)&lt;BR/&gt; 3270: (0.286807%)&lt;BR/&gt; 3269: (0.286807%)&gt;];
}
169--170[label="1;149pkt 149fpkt"];
169--1867[label="1;17pkt 17fpkt"];
169--3492[label="1;174pkt 174fpkt"];
170--3492[label="1;149pkt 149fpkt"];
1867--3492[label="1;17pkt 17fpkt"];
</description>
    <slice>
      <filter dst_ip="70.71.94.111" src_ip="158.189.128.66" src_port="80"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,011,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="71.106.16.240"/>
      <from sec="1123477200" usec="0"/>
      <to sec="1123478028" usec="0"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_38{
style=filled;
color=gray75;
218[label="152.21.110.65;d;4pkt 4fpkt", shape=diamond, color=yellow];
221[label="215.34.77.165;s;4pkt 4fpkt", shape=diamond, color=yellow];
stat38[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.34.77.165:80, 152.21.110.65:*}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1237: (12.5%)&lt;BR/&gt; 1236: (12.5%)&lt;BR/&gt; 64982: (6.25%)&lt;BR/&gt; 50157: (6.25%)&gt;];
}
218--221[label="0.5;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="152.21.110.65" src_ip="215.34.77.165" src_port="80"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123477938" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_39{
style=filled;
color=gray75;
263[label="158.47.80.253;s;1pkt 1fpkt", shape=diamond, color=yellow];
264[label="1.214.167.130;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat39[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.47.80.253:1256, 1.214.167.130:12255}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 12255: (50%)&lt;BR/&gt; 1256: (50%)&gt;];
}
263--264[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="1.214.167.130" dst_port="12255" src_ip="158.47.80.253" src_port="1256"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_40{
style=filled;
color=gray75;
262[label="158.47.80.253;d;1pkt 1fpkt", shape=diamond, color=yellow];
265[label="1.214.167.130;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat40[shape=component, label=&lt;Rules:&lt;BR/&gt;{1.214.167.130:12255, 158.47.80.253:1256}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 12255: (50%)&lt;BR/&gt; 1256: (50%)&gt;];
}
262--265[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="158.47.80.253" dst_port="1256" src_ip="1.214.167.130" src_port="12255"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="152.21.9.73"/>
      <from sec="1123477200" usec="0"/>
      <to sec="1123478028" usec="0"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_42{
style=filled;
color=gray75;
306[label="132.117.202.115;d;1pkt 1fpkt", shape=diamond, color=yellow];
307[label="6.12.37.112;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat42[shape=component, label=&lt;Rules:&lt;BR/&gt;{6.12.37.112:44575, 132.117.202.115:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 44575: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
306--307[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="132.117.202.115" dst_port="80" src_ip="6.12.37.112" src_port="44575"/>
    </slice>
    <from sec="1123477943" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.33083,2.05381,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_43{
style=filled;
color=gray75;
309[label="220.40.246.173;d;1pkt 1fpkt", shape=diamond, color=yellow];
310[label="158.47.80.147;s;1pkt 1fpkt", shape=diamond, color=yellow];
2800[label="158.47.80.147;s;1pkt 1fpkt", shape=hexagon, color=black];
stat43[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.47.80.147:3061, 220.40.246.173:8050}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8050: (50%)&lt;BR/&gt; 3061: (50%)&gt;];
}
309--310[label="1;1pkt 1fpkt"];
309--2800[label="1;1pkt 1fpkt"];
310--2800[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="220.40.246.173" dst_port="8050" src_ip="158.47.80.147" src_port="3061"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,901,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_44{
style=filled;
color=gray75;
325[label="172.118.70.229;d;9pkt 9fpkt", shape=diamond, color=yellow];
327[label="64.170.3.206;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat44[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.153.92.20:110, 172.118.70.229:*}[33.3333%]&lt;BR/&gt;{164.184.153.213:110, 172.118.70.229:*}[33.3333%]&lt;BR/&gt;{*:*, 172.118.70.229:63154}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 110: (30%)&lt;BR/&gt; 63154: (10%)&lt;BR/&gt; 55765: (10%)&lt;BR/&gt; 23230: (10%)&lt;BR/&gt; 48055: (5%)&gt;];
}
325--327[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="172.118.70.229" dst_port="63154"/>
      <filter dst_ip="172.118.70.229" src_ip="164.184.153.213" src_port="110"/>
      <filter dst_ip="172.118.70.229" src_ip="218.153.92.20" src_port="110"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,001,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="214.232.98.63"/>
      <from sec="1123477200" usec="0"/>
      <to sec="1123478027" usec="0"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,001,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_46{
style=filled;
color=gray75;
395[label="215.47.116.121;d;2767pkt 2767fpkt", shape=diamond, color=yellow];
stat46[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:5554, 215.47.116.121:*}[30.1771%]&lt;BR/&gt;{*:1023, 215.47.116.121:*}[29.4904%]&lt;BR/&gt;{*:8967, 215.47.116.121:*}[22.4431%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (15.0885%)&lt;BR/&gt; 1023: (14.7452%)&lt;BR/&gt; 8967: (11.2215%)&lt;BR/&gt; 9898: (8.92664%)&lt;BR/&gt; 2485: (0.108421%)&gt;];
}
395--1057[label="0.00613497;1pkt 1fpkt"];
395--2879[label="0.000982318;1pkt 1fpkt"];
395--2880[label="0.00107181;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="215.47.116.121" src_port="5554"/>
      <filter dst_ip="215.47.116.121" src_port="1023"/>
      <filter dst_ip="215.47.116.121" src_port="8967"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123477903" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="219.2.99.163"/>
      <from sec="1123477200" usec="0"/>
      <to sec="1123478028" usec="0"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,901,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_48{
style=filled;
color=gray75;
414[label="172.118.110.114;d;21pkt 21fpkt", shape=diamond, color=yellow];
415[label="68.90.13.138;s;7pkt 7fpkt", shape=diamond, color=yellow];
2343[label="68.90.13.149;s;7pkt 7fpkt", shape=diamond, color=yellow];
stat48[shape=component, label=&lt;Rules:&lt;BR/&gt;{68.90.13.138:80, 172.118.110.114:*}[66.6667%]&lt;BR/&gt;{68.90.13.149:80, 172.118.110.114:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1974: (2.85714%)&lt;BR/&gt; 1973: (2.85714%)&lt;BR/&gt; 1972: (2.85714%)&lt;BR/&gt; 1971: (2.85714%)&gt;];
}
414--415[label="1;7pkt 7fpkt"];
414--2343[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="172.118.110.114" src_ip="68.90.13.138" src_port="80"/>
      <filter dst_ip="172.118.110.114" src_ip="68.90.13.149" src_port="80"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.760206,1.9198,999,0 0 0 1 0 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_49{
style=filled;
color=gray75;
423[label="132.117.210.37;d;2pkt 2fpkt", shape=diamond, color=yellow];
424[label="71.41.124.53;s;2pkt 2fpkt", shape=diamond, color=yellow];
3388[label="71.41.124.53;1pkt 1fpkt", shape=pentagon, color=darkviolet];
6143[label="71.41.124.53;1pkt 1fpkt", shape=invhouse, color=bisque];
stat49[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.41.124.53:2519, 132.117.210.37:2322}[50%]&lt;BR/&gt;{71.41.124.53:4058, 132.117.210.37:3300}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4058: (33.3333%)&lt;BR/&gt; 3300: (33.3333%)&lt;BR/&gt; 2519: (16.6667%)&lt;BR/&gt; 2322: (16.6667%)&gt;];
}
423--424[label="1;2pkt 2fpkt"];
423--3388[label="1;1pkt 1fpkt"];
423--6143[label="1;1pkt 1fpkt"];
424--3388[label="1;1pkt 1fpkt"];
424--6143[label="1;1pkt 1fpkt"];
3388--6143[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="132.117.210.37" dst_port="3300" src_ip="71.41.124.53" src_port="4058"/>
      <filter dst_ip="132.117.210.37" dst_port="2322" src_ip="71.41.124.53" src_port="2519"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_50{
style=filled;
color=gray75;
351[label="200.85.0.145;s;5pkt 5fpkt", shape=diamond, color=yellow];
433[label="1.150.12.203;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat50[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.85.0.145:2553, 1.19.132.50:6699}[20%]&lt;BR/&gt;{200.85.0.145:2554, 6.173.48.162:6699}[20%]&lt;BR/&gt;{200.85.0.145:0, 211.222.225.171:0}[20%]&lt;BR/&gt;{200.85.0.145:2495, 1.150.12.203:6699}[20%]&lt;BR/&gt;{200.85.0.145:2522, 1.48.64.215:6699}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6699: (41.6667%)&lt;BR/&gt; 2495: (16.6667%)&lt;BR/&gt; 0: (16.6667%)&lt;BR/&gt; 2554: (8.33333%)&lt;BR/&gt; 2553: (8.33333%)&gt;];
}
351--433[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="1.48.64.215" dst_port="6699" src_ip="200.85.0.145" src_port="2522"/>
      <filter dst_ip="1.150.12.203" dst_port="6699" src_ip="200.85.0.145" src_port="2495"/>
      <filter dst_ip="211.222.225.171" src_ip="200.85.0.145"/>
      <filter dst_ip="6.173.48.162" dst_port="6699" src_ip="200.85.0.145" src_port="2554"/>
      <filter dst_ip="1.19.132.50" dst_port="6699" src_ip="200.85.0.145" src_port="2553"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_51{
style=filled;
color=gray75;
476[label="71.72.77.153;s;1920pkt 1920fpkt", shape=diamond, color=yellow];
stat51[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.72.77.153:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 39702: (0.078125%)&lt;BR/&gt; 65322: (0.0520833%)&lt;BR/&gt; 64607: (0.0520833%)&lt;BR/&gt; 58206: (0.0520833%)&gt;];
}
476--753[label="0.00140845;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="71.72.77.153" src_port="80"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.28507,1.98938,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_52{
style=filled;
color=gray75;
483[label="218.34.43.52;d;1pkt 1fpkt", shape=diamond, color=yellow];
484[label="158.189.179.133;s;1pkt 1fpkt", shape=diamond, color=yellow];
2678[label="218.34.43.52;d;1pkt 1fpkt", shape=hexagon, color=black];
4057[label="158.189.179.133;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat52[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.189.179.133:9232, 218.34.43.52:61794}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 61794: (50%)&lt;BR/&gt; 9232: (50%)&gt;];
}
483--484[label="1;1pkt 1fpkt"];
483--2678[label="1;1pkt 1fpkt"];
483--4057[label="1;1pkt 1fpkt"];
484--2678[label="1;1pkt 1fpkt"];
484--4057[label="1;1pkt 1fpkt"];
2678--4057[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="218.34.43.52" dst_port="61794" src_ip="158.189.179.133" src_port="9232"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123477652" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,504,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_54{
style=filled;
color=gray75;
533[label="217.118.83.15;d;2pkt 2fpkt", shape=diamond, color=yellow];
534[label="200.89.1.152;s;2pkt 2fpkt", shape=diamond, color=yellow];
4196[label="200.89.1.152;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5611[label="200.89.1.152;2pkt 2fpkt", shape=invtriangle, color=brown];
stat54[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.89.1.152:1905, 217.118.83.15:443}[50%]&lt;BR/&gt;{200.89.1.152:3175, 217.118.83.15:443}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (50%)&lt;BR/&gt; 3175: (25%)&lt;BR/&gt; 1905: (25%)&gt;];
}
533--534[label="1;2pkt 2fpkt"];
533--4196[label="1;2pkt 2fpkt"];
533--5611[label="1;2pkt 2fpkt"];
534--4196[label="1;2pkt 2fpkt"];
534--5611[label="1;2pkt 2fpkt"];
4196--5611[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="217.118.83.15" dst_port="443" src_ip="200.89.1.152" src_port="3175"/>
      <filter dst_ip="217.118.83.15" dst_port="443" src_ip="200.89.1.152" src_port="1905"/>
    </slice>
    <from sec="1123477202" usec="0"/>
    <to sec="1123477273" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_55{
style=filled;
color=gray75;
540[label="152.21.54.212;s;124pkt 124fpkt", shape=diamond, color=yellow];
stat55[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.54.212:25, 202.9.1.64:*}[40.3226%]&lt;BR/&gt;{152.21.54.212:*, *:25}[23.3871%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (48.3871%)&lt;BR/&gt; 0: (1.6129%)&lt;BR/&gt; 43062: (0.806452%)&lt;BR/&gt; 113: (0.806452%)&lt;BR/&gt; 61093: (0.403226%)&gt;];
}
540--1435[label="0.00806452;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="25" src_ip="152.21.54.212"/>
      <filter dst_ip="202.9.1.64" src_ip="152.21.54.212" src_port="25"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478022" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_56{
style=filled;
color=gray75;
272[label="152.21.170.170;s;37pkt 37fpkt", shape=diamond, color=yellow];
567[label="219.113.41.67;d;1pkt 1fpkt", shape=diamond, color=yellow];
4341[label="152.21.170.170;39pkt 39fpkt", shape=pentagon, color=darkviolet];
stat56[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.170.170:*, 211.8.91.62:80}[89.7436%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3659: (1.94805%)&lt;BR/&gt; 3658: (1.2987%)&lt;BR/&gt; 3657: (1.2987%)&lt;BR/&gt; 3656: (1.2987%)&gt;];
}
272--567[label="1;1pkt 1fpkt"];
272--2875[label="0.027027;1pkt 1fpkt"];
272--4341[label="1;37pkt 37fpkt"];
567--2875[label="1;1pkt 1fpkt"];
567--4341[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="211.8.91.62" dst_port="80" src_ip="152.21.170.170"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123477393" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="210.116.48.146"/>
      <from sec="1123477200" usec="0"/>
      <to sec="1123478028" usec="0"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="152.20.11.163"/>
      <from sec="1123477200" usec="0"/>
      <to sec="1123477379" usec="0"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123477379" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.33083,2.05381,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_60{
style=filled;
color=gray75;
624[label="16.222.63.48;d;1pkt 1fpkt", shape=diamond, color=yellow];
626[label="158.47.80.199;s;2pkt 2fpkt", shape=diamond, color=yellow];
2727[label="158.47.80.199;s;2pkt 2fpkt", shape=hexagon, color=black];
stat60[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.47.80.199:5003, 16.222.63.48:20}[50%]&lt;BR/&gt;{158.47.80.199:1119, 209.139.44.194:5222}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5003: (30%)&lt;BR/&gt; 20: (30%)&lt;BR/&gt; 5222: (20%)&lt;BR/&gt; 1119: (20%)&gt;];
}
624--626[label="1;1pkt 1fpkt"];
624--2727[label="1;1pkt 1fpkt"];
626--2727[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="209.139.44.194" dst_port="5222" src_ip="158.47.80.199" src_port="1119"/>
      <filter dst_ip="16.222.63.48" dst_port="20" src_ip="158.47.80.199" src_port="5003"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,901,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_61{
style=filled;
color=gray75;
628[label="5.109.55.207;d;1pkt 1fpkt", shape=diamond, color=yellow];
629[label="172.118.94.210;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat61[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.118.94.210:1673, 5.109.55.207:8000}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8000: (50%)&lt;BR/&gt; 1673: (50%)&gt;];
}
628--629[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="5.109.55.207" dst_port="8000" src_ip="172.118.94.210" src_port="1673"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,901,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_62{
style=filled;
color=gray75;
671[label="207.5.146.99;d;1pkt 1fpkt", shape=diamond, color=yellow];
672[label="152.21.179.41;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat62[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.179.41:8277, 207.5.146.99:8292}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8292: (50%)&lt;BR/&gt; 8277: (50%)&gt;];
}
671--672[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="207.5.146.99" dst_port="8292" src_ip="152.21.179.41" src_port="8277"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,901,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_63{
style=filled;
color=gray75;
384[label="201.117.145.106;s;128pkt 128fpkt", shape=diamond, color=yellow];
750[label="211.164.3.94;d;1pkt 1fpkt", shape=diamond, color=yellow];
789[label="219.57.143.218;d;5pkt 5fpkt", shape=diamond, color=yellow];
802[label="0.17.33.165;d;2pkt 2fpkt", shape=diamond, color=yellow];
1191[label="4.228.75.50;d;1pkt 1fpkt", shape=diamond, color=yellow];
1253[label="196.21.161.206;d;2pkt 2fpkt", shape=diamond, color=yellow];
1277[label="201.68.41.35;d;7pkt 7fpkt", shape=diamond, color=yellow];
1319[label="201.210.234.195;d;1pkt 1fpkt", shape=diamond, color=yellow];
1358[label="17.141.79.221;d;3pkt 3fpkt", shape=diamond, color=yellow];
2061[label="201.12.53.91;d;2pkt 2fpkt", shape=diamond, color=yellow];
stat63[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.117.145.106:80, *:*}[70.5426%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (33.8816%)&lt;BR/&gt; 0: (7.89474%)&lt;BR/&gt; 21: (3.94737%)&lt;BR/&gt; 20: (2.63158%)&lt;BR/&gt; 873: (1.31579%)&gt;];
}
384--750[label="1;1pkt 1fpkt"];
384--789[label="0.8;4pkt 4fpkt"];
384--802[label="1;2pkt 2fpkt"];
384--1191[label="1;1pkt 1fpkt"];
384--1253[label="1;2pkt 2fpkt"];
384--1277[label="1;7pkt 7fpkt"];
384--1319[label="1;1pkt 1fpkt"];
384--1358[label="1;3pkt 3fpkt"];
384--1527[label="0.0078125;1pkt 1fpkt"];
384--2061[label="1;2pkt 2fpkt"];
384--2345[label="0.0238095;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_ip="201.117.145.106" src_port="80"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,003,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="19.211.65.153"/>
      <from sec="1123477201" usec="0"/>
      <to sec="1123478027" usec="0"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.33083,2.05381,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_66{
style=filled;
color=gray75;
625[label="158.47.80.199;d;1pkt 1fpkt", shape=diamond, color=yellow];
922[label="16.222.63.48;s;1pkt 1fpkt", shape=diamond, color=yellow];
2726[label="16.222.63.48;s;1pkt 1fpkt", shape=hexagon, color=black];
stat66[shape=component, label=&lt;Rules:&lt;BR/&gt;{16.222.63.48:20, 158.47.80.199:5003}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5003: (50%)&lt;BR/&gt; 20: (50%)&gt;];
}
625--922[label="1;1pkt 1fpkt"];
625--2726[label="1;1pkt 1fpkt"];
922--2726[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="158.47.80.199" dst_port="5003" src_ip="16.222.63.48" src_port="20"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="211.162.58.47"/>
      <from sec="1123477200" usec="0"/>
      <to sec="1123477938" usec="0"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123477938" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,901,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_68{
style=filled;
color=gray75;
374[label="200.89.27.157;s;153pkt 153fpkt", shape=diamond, color=yellow];
991[label="19.227.164.116;d;1pkt 1fpkt", shape=diamond, color=yellow];
1003[label="211.39.89.182;d;1pkt 1fpkt", shape=diamond, color=yellow];
2056[label="20.173.125.100;d;1pkt 1fpkt", shape=diamond, color=yellow];
2419[label="19.154.33.185;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat68[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.89.27.157:24066, *:*}[49.0196%]&lt;BR/&gt;{200.89.27.157:24069, *:4672}[22.8758%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 24066: (23.8854%)&lt;BR/&gt; 24069: (15.6051%)&lt;BR/&gt; 4672: (11.1465%)&lt;BR/&gt; 4662: (7.96178%)&lt;BR/&gt; 4661: (0.955414%)&gt;];
}
374--991[label="1;1pkt 1fpkt"];
374--1003[label="1;1pkt 1fpkt"];
374--2056[label="1;1pkt 1fpkt"];
374--2419[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="200.89.27.157" src_port="24066"/>
      <filter dst_port="4672" src_ip="200.89.27.157" src_port="24069"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,901,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_69{
style=filled;
color=gray75;
731[label="4.234.187.80;d;1pkt 1fpkt", shape=diamond, color=yellow];
992[label="152.21.64.93;s;4pkt 4fpkt", shape=diamond, color=yellow];
stat69[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.64.93:49157, 4.234.187.80:11986}[25%]&lt;BR/&gt;{152.21.64.93:52164, 208.129.182.163:80}[25%]&lt;BR/&gt;{152.21.64.93:52190, 204.68.188.194:80}[25%]&lt;BR/&gt;{152.21.64.93:52389, 204.68.188.194:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (30%)&lt;BR/&gt; 49157: (20%)&lt;BR/&gt; 11986: (20%)&lt;BR/&gt; 52389: (10%)&lt;BR/&gt; 52190: (10%)&gt;];
}
731--992[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="204.68.188.194" dst_port="80" src_ip="152.21.64.93" src_port="52389"/>
      <filter dst_ip="204.68.188.194" dst_port="80" src_ip="152.21.64.93" src_port="52190"/>
      <filter dst_ip="208.129.182.163" dst_port="80" src_ip="152.21.64.93" src_port="52164"/>
      <filter dst_ip="4.234.187.80" dst_port="11986" src_ip="152.21.64.93" src_port="49157"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.33083,2.05381,901,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_70{
style=filled;
color=gray75;
732[label="132.117.40.195;d;2pkt 2fpkt", shape=diamond, color=yellow];
996[label="215.204.55.235;s;1pkt 1fpkt", shape=diamond, color=yellow];
2698[label="132.117.40.195;d;2pkt 2fpkt", shape=hexagon, color=black];
stat70[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.70.152.67:5050, 132.117.40.195:1232}[50%]&lt;BR/&gt;{215.204.55.235:32647, 132.117.40.195:1328}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 32647: (30%)&lt;BR/&gt; 1328: (30%)&lt;BR/&gt; 5050: (20%)&lt;BR/&gt; 1232: (20%)&gt;];
}
732--996[label="1;1pkt 1fpkt"];
732--2698[label="1;2pkt 2fpkt"];
996--2698[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="132.117.40.195" dst_port="1328" src_ip="215.204.55.235" src_port="32647"/>
      <filter dst_ip="132.117.40.195" dst_port="1232" src_ip="208.70.152.67" src_port="5050"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="5.244.137.68"/>
      <from sec="1123477200" usec="0"/>
      <to sec="1123478028" usec="0"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="5.244.137.68"/>
      <from sec="1123477200" usec="0"/>
      <to sec="1123478028" usec="0"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="71.72.77.16"/>
      <from sec="1123477200" usec="0"/>
      <to sec="1123478028" usec="0"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="211.146.13.24"/>
      <from sec="1123477200" usec="0"/>
      <to sec="1123478028" usec="0"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="172.6.176.1"/>
      <from sec="1123477201" usec="0"/>
      <to sec="1123477560" usec="0"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123477560" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.33083,2.05381,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_76{
style=filled;
color=gray75;
1136[label="214.45.80.37;s;1pkt 1fpkt", shape=diamond, color=yellow];
1137[label="201.117.145.136;d;2pkt 2fpkt", shape=diamond, color=yellow];
2781[label="214.45.80.37;s;1pkt 1fpkt", shape=hexagon, color=black];
stat76[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.45.80.37:65529, 201.117.145.136:2401}[50%]&lt;BR/&gt;{215.218.150.137:1077, 201.117.145.136:1434}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 65529: (37.5%)&lt;BR/&gt; 2401: (37.5%)&lt;BR/&gt; 1434: (12.5%)&lt;BR/&gt; 1077: (12.5%)&gt;];
}
1136--1137[label="1;1pkt 1fpkt"];
1136--2781[label="1;1pkt 1fpkt"];
1137--2781[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="201.117.145.136" dst_port="1434" src_ip="215.218.150.137" src_port="1077"/>
      <filter dst_ip="201.117.145.136" dst_port="2401" src_ip="214.45.80.37" src_port="65529"/>
    </slice>
    <from sec="1123477211" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_77{
style=filled;
color=gray75;
847[label="214.45.80.37;d;1pkt 1fpkt", shape=diamond, color=yellow];
1138[label="201.117.145.136;s;1pkt 1fpkt", shape=diamond, color=yellow];
4080[label="201.117.145.136;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat77[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.117.145.136:2401, 214.45.80.37:65529}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 65529: (50%)&lt;BR/&gt; 2401: (50%)&gt;];
}
847--1138[label="1;1pkt 1fpkt"];
847--4080[label="1;1pkt 1fpkt"];
1138--4080[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="214.45.80.37" dst_port="65529" src_ip="201.117.145.136" src_port="2401"/>
    </slice>
    <from sec="1123477211" usec="0"/>
    <to sec="1123478084" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_78{
style=filled;
color=gray75;
1148[label="152.21.221.6;d;63pkt 63fpkt", shape=diamond, color=yellow];
1160[label="71.82.52.203;s;63pkt 63fpkt", shape=diamond, color=yellow];
4584[label="71.82.52.203;63pkt 63fpkt", shape=pentagon, color=darkviolet];
5813[label="71.82.52.203;63pkt 63fpkt", shape=invtriangle, color=brown];
stat78[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.82.52.203:80, 152.21.221.6:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1394: (0.793651%)&lt;BR/&gt; 1393: (0.793651%)&lt;BR/&gt; 1392: (0.793651%)&lt;BR/&gt; 1391: (0.793651%)&gt;];
}
1148--1160[label="1;63pkt 63fpkt"];
1148--4584[label="1;63pkt 63fpkt"];
1148--5813[label="1;63pkt 63fpkt"];
1160--4584[label="1;63pkt 63fpkt"];
1160--5813[label="1;63pkt 63fpkt"];
4584--5813[label="1;63pkt 63fpkt"];
</description>
    <slice>
      <filter dst_ip="152.21.221.6" src_ip="71.82.52.203" src_port="80"/>
    </slice>
    <from sec="1123477224" usec="0"/>
    <to sec="1123477485" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="203.167.75.207"/>
      <from sec="1123477861" usec="0"/>
      <to sec="1123477940" usec="0"/>
    </slice>
    <from sec="1123477861" usec="0"/>
    <to sec="1123477940" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_80{
style=filled;
color=gray75;
619[label="158.17.245.45;s;296pkt 296fpkt", shape=diamond, color=yellow];
1202[label="211.38.139.162;d;1pkt 1fpkt", shape=diamond, color=yellow];
1941[label="211.217.27.113;d;1pkt 1fpkt", shape=diamond, color=yellow];
1944[label="210.103.57.4;d;1pkt 1fpkt", shape=diamond, color=yellow];
2185[label="71.123.10.15;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat80[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.17.245.45:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
619--1202[label="1;1pkt 1fpkt"];
619--1508[label="0.00337838;1pkt 1fpkt"];
619--1515[label="0.00337838;1pkt 1fpkt"];
619--1519[label="0.00337838;1pkt 1fpkt"];
619--1527[label="0.00337838;1pkt 1fpkt"];
619--1532[label="0.00337838;1pkt 1fpkt"];
619--1565[label="0.00337838;1pkt 1fpkt"];
619--1735[label="0.00337838;1pkt 1fpkt"];
619--1794[label="0.00408163;1pkt 1fpkt"];
619--1929[label="0.0037594;1pkt 1fpkt"];
619--1935[label="0.00380228;1pkt 1fpkt"];
619--1941[label="1;1pkt 1fpkt"];
619--1943[label="0.00337838;1pkt 1fpkt"];
619--1944[label="1;1pkt 1fpkt"];
619--2175[label="0.00425532;1pkt 1fpkt"];
619--2185[label="1;1pkt 1fpkt"];
619--2225[label="0.00444444;1pkt 1fpkt"];
619--2409[label="0.00380228;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="158.17.245.45"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="152.21.9.73"/>
      <from sec="1123477200" usec="0"/>
      <to sec="1123477848" usec="0"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123477848" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.33083,2.05381,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_82{
style=filled;
color=gray75;
993[label="158.47.41.67;s;27pkt 27fpkt", shape=diamond, color=yellow];
1255[label="202.194.122.12;d;1pkt 1fpkt", shape=diamond, color=yellow];
2697[label="158.47.41.67;s;21pkt 21fpkt", shape=hexagon, color=black];
stat82[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.47.41.67:80, 5.218.200.9:*}[62.963%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1351: (3.06122%)&lt;BR/&gt; 42464: (2.04082%)&lt;BR/&gt; 42181: (2.04082%)&lt;BR/&gt; 41951: (2.04082%)&gt;];
}
993--1255[label="1;1pkt 1fpkt"];
993--2697[label="1;21pkt 21fpkt"];
1255--2697[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="5.218.200.9" src_ip="158.47.41.67" src_port="80"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="158.160.245.194"/>
      <from sec="1123477202" usec="0"/>
      <to sec="1123477938" usec="0"/>
    </slice>
    <from sec="1123477202" usec="0"/>
    <to sec="1123477938" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,504,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_84{
style=filled;
color=gray75;
1402[label="4.138.192.4;d;1pkt 1fpkt", shape=diamond, color=yellow];
1403[label="169.169.153.93;s;3pkt 3fpkt", shape=diamond, color=yellow];
stat84[shape=component, label=&lt;Rules:&lt;BR/&gt;{169.169.153.93:1506, 4.138.192.4:443}[33.3333%]&lt;BR/&gt;{169.169.153.93:1240, 207.71.176.40:443}[33.3333%]&lt;BR/&gt;{169.169.153.93:1307, 208.70.152.104:5050}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (37.5%)&lt;BR/&gt; 1506: (25%)&lt;BR/&gt; 5050: (12.5%)&lt;BR/&gt; 1307: (12.5%)&lt;BR/&gt; 1240: (12.5%)&gt;];
}
1402--1403[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="208.70.152.104" dst_port="5050" src_ip="169.169.153.93" src_port="1307"/>
      <filter dst_ip="207.71.176.40" dst_port="443" src_ip="169.169.153.93" src_port="1240"/>
      <filter dst_ip="4.138.192.4" dst_port="443" src_ip="169.169.153.93" src_port="1506"/>
    </slice>
    <from sec="1123477209" usec="0"/>
    <to sec="1123477938" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_85{
style=filled;
color=gray75;
1419[label="193.72.189.128;d;32pkt 32fpkt", shape=diamond, color=yellow];
1420[label="152.20.36.5;s;32pkt 32fpkt", shape=diamond, color=yellow];
2976[label="152.20.36.5;31pkt 31fpkt", shape=pentagon, color=darkviolet];
4939[label="152.20.36.5;31pkt 31fpkt", shape=invtriangle, color=brown];
6013[label="152.20.36.5;31pkt 31fpkt", shape=invhouse, color=bisque];
stat85[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.20.36.5:*, 193.72.189.128:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1163: (1.59236%)&lt;BR/&gt; 1162: (1.59236%)&lt;BR/&gt; 1161: (1.59236%)&lt;BR/&gt; 1160: (1.59236%)&gt;];
}
1419--1420[label="1;32pkt 32fpkt"];
1419--2875[label="0.09375;3pkt 3fpkt"];
1419--2976[label="1;31pkt 31fpkt"];
1419--4939[label="1;31pkt 31fpkt"];
1419--6013[label="1;31pkt 31fpkt"];
1420--2875[label="0.09375;3pkt 3fpkt"];
1420--2976[label="1;31pkt 31fpkt"];
1420--4939[label="1;31pkt 31fpkt"];
1420--6013[label="1;31pkt 31fpkt"];
2976--4939[label="1;31pkt 31fpkt"];
2976--6013[label="1;31pkt 31fpkt"];
4939--6013[label="1;31pkt 31fpkt"];
</description>
    <slice>
      <filter dst_ip="193.72.189.128" dst_port="80" src_ip="152.20.36.5"/>
    </slice>
    <from sec="1123477215" usec="0"/>
    <to sec="1123477539" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,502,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_86{
style=filled;
color=gray75;
1172[label="158.47.1.24;s;1pkt 1fpkt", shape=diamond, color=yellow];
1445[label="194.229.212.103;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat86[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.47.1.24:49621, 194.229.212.103:22}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 49621: (50%)&lt;BR/&gt; 22: (50%)&gt;];
}
1172--1445[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="194.229.212.103" dst_port="22" src_ip="158.47.1.24" src_port="49621"/>
    </slice>
    <from sec="1123477259" usec="0"/>
    <to sec="1123477980" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_87{
style=filled;
color=gray75;
1029[label="152.21.21.87;s;91pkt 91fpkt", shape=diamond, color=yellow];
1448[label="217.101.11.166;d;19pkt 19fpkt", shape=diamond, color=yellow];
stat87[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.21.87:0, *:0}[83.4862%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (86.3636%)&lt;BR/&gt; 3306: (6.81818%)&lt;BR/&gt; 3503: (0.454545%)&lt;BR/&gt; 3494: (0.454545%)&lt;BR/&gt; 3493: (0.454545%)&gt;];
}
1029--1269[label="0.010989;1pkt 1fpkt"];
1029--1448[label="0.0526316;1pkt 1fpkt"];
1029--1724[label="0.010989;1pkt 1fpkt"];
1029--1794[label="0.010989;1pkt 1fpkt"];
1029--1943[label="0.010989;1pkt 1fpkt"];
1029--2429[label="0.010989;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="152.21.21.87"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_88{
style=filled;
color=gray75;
1167[label="172.118.147.157;s;3pkt 3fpkt", shape=diamond, color=yellow];
1462[label="0.49.110.51;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat88[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.118.147.157:80, 0.49.110.51:43332}[33.3333%]&lt;BR/&gt;{172.118.147.157:80, 6.38.27.244:60397}[33.3333%]&lt;BR/&gt;{172.118.147.157:80, 6.38.27.245:40433}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 43332: (25%)&lt;BR/&gt; 60397: (12.5%)&lt;BR/&gt; 40433: (12.5%)&gt;];
}
1167--1462[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="6.38.27.245" dst_port="40433" src_ip="172.118.147.157" src_port="80"/>
      <filter dst_ip="6.38.27.244" dst_port="60397" src_ip="172.118.147.157" src_port="80"/>
      <filter dst_ip="0.49.110.51" dst_port="43332" src_ip="172.118.147.157" src_port="80"/>
    </slice>
    <from sec="1123477247" usec="0"/>
    <to sec="1123477618" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,011,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_90{
style=filled;
color=gray75;
1502[label="212.90.228.37;s;1164pkt 1164fpkt", shape=diamond, color=yellow];
stat90[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.90.228.37:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50.2148%)&lt;BR/&gt; 126: (0.558419%)&lt;BR/&gt; 6: (0.472509%)&lt;BR/&gt; 209: (0.429553%)&lt;BR/&gt; 170: (0.429553%)&gt;];
}
1502--2875[label="0.000859107;1pkt 1fpkt"];
1502--2876[label="0.000859107;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="212.90.228.37" src_port="80"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_91{
style=filled;
color=gray75;
1515[label="71.122.11.245;d;316pkt 316fpkt", shape=diamond, color=yellow];
stat91[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 71.122.11.245:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1515--2219[label="0.00392157;1pkt 1fpkt"];
1515--2276[label="0.00416667;1pkt 1fpkt"];
1515--2282[label="0.0052356;1pkt 1fpkt"];
1515--2508[label="0.00409836;1pkt 1fpkt"];
1515--2732[label="0.00316456;1pkt 1fpkt"];
1515--2969[label="0.0075188;1pkt 1fpkt"];
1515--3014[label="0.00421941;1pkt 1fpkt"];
1515--3634[label="0.00316456;1pkt 1fpkt"];
1515--3970[label="0.00387597;1pkt 1fpkt"];
1515--4669[label="0.00316456;1pkt 1fpkt"];
1515--4747[label="0.00471698;1pkt 1fpkt"];
1515--4758[label="0.00383142;1pkt 1fpkt"];
1515--4934[label="0.00757576;1pkt 1fpkt"];
1515--4961[label="0.00420168;1pkt 1fpkt"];
1515--5296[label="0.00316456;1pkt 1fpkt"];
1515--5328[label="0.0037037;1pkt 1fpkt"];
1515--5860[label="0.00316456;1pkt 1fpkt"];
1515--6009[label="0.00757576;1pkt 1fpkt"];
1515--6527[label="0.00316456;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="71.122.11.245"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_92{
style=filled;
color=gray75;
1519[label="71.122.13.217;d;304pkt 304fpkt", shape=diamond, color=yellow];
stat92[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 71.122.13.217:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1519--2219[label="0.00392157;1pkt 1fpkt"];
1519--2276[label="0.00416667;1pkt 1fpkt"];
1519--2282[label="0.0052356;1pkt 1fpkt"];
1519--2732[label="0.00328947;1pkt 1fpkt"];
1519--2969[label="0.0075188;1pkt 1fpkt"];
1519--3014[label="0.00421941;1pkt 1fpkt"];
1519--3144[label="0.00740741;1pkt 1fpkt"];
1519--3634[label="0.00328947;1pkt 1fpkt"];
1519--4669[label="0.00328947;1pkt 1fpkt"];
1519--4747[label="0.00471698;1pkt 1fpkt"];
1519--4758[label="0.00383142;1pkt 1fpkt"];
1519--4934[label="0.00757576;1pkt 1fpkt"];
1519--4961[label="0.00420168;1pkt 1fpkt"];
1519--5028[label="0.00746269;1pkt 1fpkt"];
1519--5296[label="0.00328947;1pkt 1fpkt"];
1519--5328[label="0.0037037;1pkt 1fpkt"];
1519--5860[label="0.00328947;1pkt 1fpkt"];
1519--6009[label="0.00757576;1pkt 1fpkt"];
1519--6527[label="0.00328947;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="71.122.13.217"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_93{
style=filled;
color=gray75;
1527[label="210.96.96.162;d;349pkt 349fpkt", shape=diamond, color=yellow];
stat93[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 210.96.96.162:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1527--1807[label="0.00826446;1pkt 1fpkt"];
1527--2219[label="0.00392157;1pkt 1fpkt"];
1527--2276[label="0.00416667;1pkt 1fpkt"];
1527--2282[label="0.0052356;1pkt 1fpkt"];
1527--2508[label="0.00409836;1pkt 1fpkt"];
1527--2732[label="0.00286533;1pkt 1fpkt"];
1527--2969[label="0.0075188;1pkt 1fpkt"];
1527--3014[label="0.00421941;1pkt 1fpkt"];
1527--3301[label="0.00787402;1pkt 1fpkt"];
1527--3634[label="0.00286533;1pkt 1fpkt"];
1527--3970[label="0.00387597;1pkt 1fpkt"];
1527--4669[label="0.00286533;1pkt 1fpkt"];
1527--4675[label="0.00813008;1pkt 1fpkt"];
1527--4747[label="0.00471698;1pkt 1fpkt"];
1527--4758[label="0.00383142;1pkt 1fpkt"];
1527--4934[label="0.00757576;1pkt 1fpkt"];
1527--4961[label="0.00420168;1pkt 1fpkt"];
1527--5296[label="0.00286533;1pkt 1fpkt"];
1527--5328[label="0.0037037;1pkt 1fpkt"];
1527--5860[label="0.00286533;1pkt 1fpkt"];
1527--5864[label="0.00813008;1pkt 1fpkt"];
1527--6009[label="0.00757576;1pkt 1fpkt"];
1527--6527[label="0.00286533;1pkt 1fpkt"];
1527--6530[label="0.00813008;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="210.96.96.162"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_94{
style=filled;
color=gray75;
1532[label="71.117.29.14;d;338pkt 338fpkt", shape=diamond, color=yellow];
stat94[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 71.117.29.14:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1532--1807[label="0.00826446;1pkt 1fpkt"];
1532--2219[label="0.00392157;1pkt 1fpkt"];
1532--2276[label="0.00416667;1pkt 1fpkt"];
1532--2282[label="0.0052356;1pkt 1fpkt"];
1532--2508[label="0.00409836;1pkt 1fpkt"];
1532--2732[label="0.00295858;1pkt 1fpkt"];
1532--2969[label="0.0075188;1pkt 1fpkt"];
1532--3014[label="0.00421941;1pkt 1fpkt"];
1532--3301[label="0.00787402;1pkt 1fpkt"];
1532--3634[label="0.00295858;1pkt 1fpkt"];
1532--3970[label="0.00387597;1pkt 1fpkt"];
1532--4669[label="0.00295858;1pkt 1fpkt"];
1532--4675[label="0.00813008;1pkt 1fpkt"];
1532--4747[label="0.00471698;1pkt 1fpkt"];
1532--4758[label="0.00383142;1pkt 1fpkt"];
1532--4934[label="0.00757576;1pkt 1fpkt"];
1532--4961[label="0.00420168;1pkt 1fpkt"];
1532--5296[label="0.00295858;1pkt 1fpkt"];
1532--5328[label="0.0037037;1pkt 1fpkt"];
1532--5860[label="0.00295858;1pkt 1fpkt"];
1532--5864[label="0.00813008;1pkt 1fpkt"];
1532--6009[label="0.00757576;1pkt 1fpkt"];
1532--6527[label="0.00295858;1pkt 1fpkt"];
1532--6530[label="0.00813008;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="71.117.29.14"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.760206,1.9198,999,0 0 0 1 0 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_95{
style=filled;
color=gray75;
1570[label="6.129.251.58;d;1pkt 1fpkt", shape=diamond, color=yellow];
1571[label="201.117.149.11;s;52pkt 52fpkt", shape=diamond, color=yellow];
3026[label="201.117.149.11;2pkt 2fpkt", shape=pentagon, color=darkviolet];
6031[label="201.117.149.11;53pkt 53fpkt", shape=invhouse, color=bisque];
stat95[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.117.149.11:25, *:*}[72.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (44.4444%)&lt;BR/&gt; 443: (5.55556%)&lt;BR/&gt; 4622: (1.85185%)&lt;BR/&gt; 62099: (0.925926%)&lt;BR/&gt; 60121: (0.925926%)&gt;];
}
1570--1571[label="1;1pkt 1fpkt"];
1570--3026[label="1;1pkt 1fpkt"];
1570--6031[label="1;1pkt 1fpkt"];
1571--3026[label="0.5;1pkt 1fpkt"];
1571--6031[label="0.980769;51pkt 51fpkt"];
3026--6031[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_ip="201.117.149.11" src_port="25"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,011,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="210.97.205.236"/>
      <from sec="1123477201" usec="0"/>
      <to sec="1123478027" usec="0"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="214.129.79.131"/>
      <from sec="1123477203" usec="0"/>
      <to sec="1123478028" usec="0"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.733897,1.97787,503,0 0 0 1 0 0 0 0 0 0 1 0 ">
    <description>subgraph cluster_98{
style=filled;
color=gray75;
1013[label="152.21.166.88;s;188pkt 188fpkt", shape=diamond, color=yellow];
1648[label="219.77.87.27;d;47pkt 47fpkt", shape=diamond, color=yellow];
5337[label="152.21.166.88;184pkt 184fpkt", shape=invtriangle, color=brown];
stat98[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.166.88:*, 219.77.86.33:80}[31.9149%]&lt;BR/&gt;{152.21.166.88:*, 219.77.35.93:80}[27.1277%]&lt;BR/&gt;{152.21.166.88:*, 219.77.87.27:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3481: (0.357995%)&lt;BR/&gt; 3480: (0.357995%)&lt;BR/&gt; 3476: (0.357995%)&lt;BR/&gt; 3472: (0.357995%)&gt;];
}
1013--1648[label="1;47pkt 47fpkt"];
1013--2875[label="0.0106383;2pkt 2fpkt"];
1013--5337[label="1;184pkt 184fpkt"];
1648--2875[label="0.0425532;2pkt 2fpkt"];
1648--5337[label="1;47pkt 47fpkt"];
</description>
    <slice>
      <filter dst_ip="219.77.86.33" dst_port="80" src_ip="152.21.166.88"/>
      <filter dst_ip="219.77.35.93" dst_port="80" src_ip="152.21.166.88"/>
      <filter dst_ip="219.77.87.27" dst_port="80" src_ip="152.21.166.88"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123477804" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="98.138.11.137"/>
      <from sec="1123477425" usec="0"/>
      <to sec="1123478007" usec="0"/>
    </slice>
    <from sec="1123477425" usec="0"/>
    <to sec="1123478007" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_100{
style=filled;
color=gray75;
1346[label="172.118.214.73;d;17pkt 17fpkt", shape=diamond, color=yellow];
1704[label="65.54.65.65;s;11pkt 11fpkt", shape=diamond, color=yellow];
3474[label="65.54.65.65;11pkt 11fpkt", shape=pentagon, color=darkviolet];
5207[label="65.54.65.65;11pkt 11fpkt", shape=invtriangle, color=brown];
stat100[shape=component, label=&lt;Rules:&lt;BR/&gt;{65.54.65.65:9548, 172.118.214.73:*}[64.7059%]&lt;BR/&gt;{*:*, 172.118.214.73:9548}[29.4118%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9548: (50%)&lt;BR/&gt; 4373: (4%)&lt;BR/&gt; 4372: (4%)&lt;BR/&gt; 4371: (4%)&lt;BR/&gt; 4370: (4%)&gt;];
}
1346--1704[label="1;11pkt 11fpkt"];
1346--3474[label="1;11pkt 11fpkt"];
1346--5207[label="1;11pkt 11fpkt"];
1704--3474[label="1;11pkt 11fpkt"];
1704--5207[label="1;11pkt 11fpkt"];
3474--5207[label="1;11pkt 11fpkt"];
</description>
    <slice>
      <filter dst_ip="172.118.214.73" dst_port="9548"/>
      <filter dst_ip="172.118.214.73" src_ip="65.54.65.65" src_port="9548"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_101{
style=filled;
color=gray75;
1718[label="206.137.71.83;d;1pkt 1fpkt", shape=diamond, color=yellow];
1719[label="152.21.37.136;s;1pkt 1fpkt", shape=diamond, color=yellow];
4075[label="152.21.37.136;2pkt 2fpkt", shape=pentagon, color=darkviolet];
stat101[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.37.136:1426, 206.137.71.83:80}[50%]&lt;BR/&gt;{152.21.37.136:1431, 206.137.71.83:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1431: (37.5%)&lt;BR/&gt; 1426: (12.5%)&gt;];
}
1718--1719[label="1;1pkt 1fpkt"];
1718--4075[label="1;1pkt 1fpkt"];
1719--4075[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="206.137.71.83" dst_port="80" src_ip="152.21.37.136" src_port="1431"/>
      <filter dst_ip="206.137.71.83" dst_port="80" src_ip="152.21.37.136" src_port="1426"/>
    </slice>
    <from sec="1123477627" usec="0"/>
    <to sec="1123477937" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_102{
style=filled;
color=gray75;
173[label="211.41.81.229;s;1pkt 1fpkt", shape=diamond, color=yellow];
191[label="2.81.254.57;s;1pkt 1fpkt", shape=diamond, color=yellow];
697[label="1.114.97.236;s;1pkt 1fpkt", shape=diamond, color=yellow];
1721[label="201.117.159.48;d;308pkt 308fpkt", shape=diamond, color=yellow];
1758[label="69.26.13.198;s;1pkt 1fpkt", shape=diamond, color=yellow];
2275[label="8.232.133.134;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat102[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:6257, 201.117.159.48:6257}[90.9091%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6257: (91.5335%)&lt;BR/&gt; 6699: (2.8754%)&lt;BR/&gt; 0: (0.958466%)&lt;BR/&gt; 16257: (0.319489%)&lt;BR/&gt; 3389: (0.319489%)&gt;];
}
173--1721[label="1;1pkt 1fpkt"];
191--1721[label="1;1pkt 1fpkt"];
697--1721[label="1;1pkt 1fpkt"];
1721--1758[label="1;1pkt 1fpkt"];
1721--2275[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="201.117.159.48" dst_port="6257" src_port="6257"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_103{
style=filled;
color=gray75;
934[label="207.5.146.111;d;2pkt 2fpkt", shape=diamond, color=yellow];
966[label="204.1.243.218;d;3pkt 3fpkt", shape=diamond, color=yellow];
1729[label="152.21.181.48;s;5pkt 5fpkt", shape=diamond, color=yellow];
1928[label="216.160.87.91;d;3pkt 3fpkt", shape=diamond, color=yellow];
stat103[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:8198, *:8195}[25%]&lt;BR/&gt;{*:*, 207.5.146.111:8292}[25%]&lt;BR/&gt;{*:*, 216.160.87.91:8195}[25%]&lt;BR/&gt;{*:*, 204.1.243.218:8195}[25%]&lt;BR/&gt;{152.21.162.199:*, *:8195}[25%]&lt;BR/&gt;{152.21.181.48:*, *:8194}[25%]&lt;BR/&gt;{152.21.181.48:*, *:8195}[25%]&lt;BR/&gt;{152.21.181.48:*, 216.160.87.91:*}[25%]&lt;BR/&gt;{152.21.181.48:*, 204.1.243.218:*}[25%]&lt;BR/&gt;{*:8201, *:*}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8195: (23.0769%)&lt;BR/&gt; 8194: (15.3846%)&lt;BR/&gt; 8292: (11.5385%)&lt;BR/&gt; 8201: (11.5385%)&lt;BR/&gt; 8198: (11.5385%)&gt;];
}
934--1729[label="0.5;1pkt 1fpkt"];
966--1729[label="0.666667;2pkt 2fpkt"];
1729--1928[label="0.666667;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_port="8201"/>
      <filter dst_ip="204.1.243.218" src_ip="152.21.181.48"/>
      <filter dst_ip="216.160.87.91" src_ip="152.21.181.48"/>
      <filter dst_port="8195" src_ip="152.21.181.48"/>
      <filter dst_port="8194" src_ip="152.21.181.48"/>
      <filter dst_port="8195" src_ip="152.21.162.199"/>
      <filter dst_ip="204.1.243.218" dst_port="8195"/>
      <filter dst_ip="216.160.87.91" dst_port="8195"/>
      <filter dst_ip="207.5.146.111" dst_port="8292"/>
      <filter dst_port="8195" src_port="8198"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_104{
style=filled;
color=gray75;
1735[label="71.101.80.7;d;317pkt 317fpkt", shape=diamond, color=yellow];
stat104[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 71.101.80.7:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1735--1807[label="0.00826446;1pkt 1fpkt"];
1735--2276[label="0.00416667;1pkt 1fpkt"];
1735--2282[label="0.0052356;1pkt 1fpkt"];
1735--2508[label="0.00409836;1pkt 1fpkt"];
1735--2732[label="0.00315457;1pkt 1fpkt"];
1735--2969[label="0.0075188;1pkt 1fpkt"];
1735--3014[label="0.00421941;1pkt 1fpkt"];
1735--3301[label="0.00787402;1pkt 1fpkt"];
1735--3970[label="0.00387597;1pkt 1fpkt"];
1735--4669[label="0.00315457;1pkt 1fpkt"];
1735--4675[label="0.00813008;1pkt 1fpkt"];
1735--4747[label="0.00471698;1pkt 1fpkt"];
1735--4758[label="0.00383142;1pkt 1fpkt"];
1735--4934[label="0.00757576;1pkt 1fpkt"];
1735--4961[label="0.00420168;1pkt 1fpkt"];
1735--5860[label="0.00315457;1pkt 1fpkt"];
1735--5864[label="0.00813008;1pkt 1fpkt"];
1735--6009[label="0.00757576;1pkt 1fpkt"];
1735--6527[label="0.00315457;1pkt 1fpkt"];
1735--6530[label="0.00813008;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="71.101.80.7"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_105{
style=filled;
color=gray75;
1738[label="200.178.87.220;s;1pkt 1fpkt", shape=diamond, color=yellow];
1739[label="169.169.244.150;d;1pkt 1fpkt", shape=diamond, color=yellow];
4703[label="200.178.87.220;3pkt 3fpkt", shape=pentagon, color=darkviolet];
5878[label="200.178.87.220;3pkt 3fpkt", shape=invtriangle, color=brown];
stat105[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.178.87.220:6666, 169.169.244.150:1269}[33.3333%]&lt;BR/&gt;{200.178.87.220:7000, 200.89.24.204:4398}[33.3333%]&lt;BR/&gt;{200.178.87.220:53728, 200.89.24.204:113}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6666: (25%)&lt;BR/&gt; 1269: (25%)&lt;BR/&gt; 53728: (12.5%)&lt;BR/&gt; 7000: (12.5%)&lt;BR/&gt; 4398: (12.5%)&gt;];
}
1738--1739[label="1;1pkt 1fpkt"];
1738--4703[label="1;1pkt 1fpkt"];
1738--5878[label="1;1pkt 1fpkt"];
1739--4703[label="1;1pkt 1fpkt"];
1739--5878[label="1;1pkt 1fpkt"];
4703--5878[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="200.89.24.204" dst_port="113" src_ip="200.178.87.220" src_port="53728"/>
      <filter dst_ip="200.89.24.204" dst_port="4398" src_ip="200.178.87.220" src_port="7000"/>
      <filter dst_ip="169.169.244.150" dst_port="1269" src_ip="200.178.87.220" src_port="6666"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_106{
style=filled;
color=gray75;
1757[label="211.208.65.108;d;282pkt 282fpkt", shape=diamond, color=yellow];
stat106[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 211.208.65.108:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1757--1807[label="0.00826446;1pkt 1fpkt"];
1757--2219[label="0.00392157;1pkt 1fpkt"];
1757--2276[label="0.00416667;1pkt 1fpkt"];
1757--2282[label="0.0052356;1pkt 1fpkt"];
1757--2508[label="0.00409836;1pkt 1fpkt"];
1757--2732[label="0.0035461;1pkt 1fpkt"];
1757--3014[label="0.00421941;1pkt 1fpkt"];
1757--3144[label="0.00740741;1pkt 1fpkt"];
1757--3301[label="0.00787402;1pkt 1fpkt"];
1757--3634[label="0.0035461;1pkt 1fpkt"];
1757--3970[label="0.00387597;1pkt 1fpkt"];
1757--4030[label="0.0078125;1pkt 1fpkt"];
1757--4669[label="0.0035461;1pkt 1fpkt"];
1757--4675[label="0.00813008;1pkt 1fpkt"];
1757--4747[label="0.00471698;1pkt 1fpkt"];
1757--4758[label="0.00383142;1pkt 1fpkt"];
1757--4961[label="0.00420168;1pkt 1fpkt"];
1757--5028[label="0.00746269;1pkt 1fpkt"];
1757--5296[label="0.0035461;1pkt 1fpkt"];
1757--5328[label="0.0037037;1pkt 1fpkt"];
1757--5860[label="0.0035461;1pkt 1fpkt"];
1757--5864[label="0.00813008;1pkt 1fpkt"];
1757--6527[label="0.0035461;1pkt 1fpkt"];
1757--6530[label="0.00813008;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="211.208.65.108"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="208.70.152.96"/>
      <from sec="1123477200" usec="0"/>
      <to sec="1123478028" usec="0"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_108{
style=filled;
color=gray75;
1794[label="197.130.84.46;d;245pkt 245fpkt", shape=diamond, color=yellow];
stat108[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 197.130.84.46:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1794--1807[label="0.00826446;1pkt 1fpkt"];
1794--2276[label="0.00416667;1pkt 1fpkt"];
1794--2282[label="0.0052356;1pkt 1fpkt"];
1794--2508[label="0.00409836;1pkt 1fpkt"];
1794--2732[label="0.00408163;1pkt 1fpkt"];
1794--3014[label="0.00421941;1pkt 1fpkt"];
1794--3144[label="0.00740741;1pkt 1fpkt"];
1794--3301[label="0.00787402;1pkt 1fpkt"];
1794--3970[label="0.00408163;1pkt 1fpkt"];
1794--4030[label="0.0078125;1pkt 1fpkt"];
1794--4669[label="0.00408163;1pkt 1fpkt"];
1794--4675[label="0.00813008;1pkt 1fpkt"];
1794--4747[label="0.00471698;1pkt 1fpkt"];
1794--4758[label="0.00408163;1pkt 1fpkt"];
1794--4961[label="0.00420168;1pkt 1fpkt"];
1794--5028[label="0.00746269;1pkt 1fpkt"];
1794--5860[label="0.00408163;1pkt 1fpkt"];
1794--5864[label="0.00813008;1pkt 1fpkt"];
1794--6527[label="0.00408163;1pkt 1fpkt"];
1794--6530[label="0.00813008;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="197.130.84.46"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123477938" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="98.138.11.137"/>
      <from sec="1123477425" usec="0"/>
      <to sec="1123478007" usec="0"/>
    </slice>
    <from sec="1123477425" usec="0"/>
    <to sec="1123478007" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_110{
style=filled;
color=gray75;
1708[label="200.248.112.55;s;1pkt 1fpkt", shape=diamond, color=yellow];
1885[label="152.21.170.210;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat110[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.248.112.55:80, 152.21.170.210:1560}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1560: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
1708--1885[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="152.21.170.210" dst_port="1560" src_ip="200.248.112.55" src_port="80"/>
    </slice>
    <from sec="1123477511" usec="0"/>
    <to sec="1123477823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.33083,2.05381,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_111{
style=filled;
color=gray75;
1873[label="152.21.171.10;s;5pkt 5fpkt", shape=diamond, color=yellow];
1898[label="0.49.110.22;d;1pkt 1fpkt", shape=diamond, color=yellow];
2832[label="152.21.171.10;s;5pkt 5fpkt", shape=hexagon, color=black];
stat111[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.171.10:80, 0.49.110.22:41189}[20%]&lt;BR/&gt;{152.21.171.10:80, 0.190.139.23:2292}[20%]&lt;BR/&gt;{152.21.171.10:80, 7.42.9.50:2199}[20%]&lt;BR/&gt;{152.21.171.10:80, 0.49.111.134:59448}[20%]&lt;BR/&gt;{152.21.171.10:80, 0.49.108.194:50854}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 41189: (13.6364%)&lt;BR/&gt; 59448: (9.09091%)&lt;BR/&gt; 50854: (9.09091%)&lt;BR/&gt; 2292: (9.09091%)&gt;];
}
1873--1898[label="1;1pkt 1fpkt"];
1873--2832[label="1;5pkt 5fpkt"];
1898--2832[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="0.49.108.194" dst_port="50854" src_ip="152.21.171.10" src_port="80"/>
      <filter dst_ip="0.49.111.134" dst_port="59448" src_ip="152.21.171.10" src_port="80"/>
      <filter dst_ip="7.42.9.50" dst_port="2199" src_ip="152.21.171.10" src_port="80"/>
      <filter dst_ip="0.190.139.23" dst_port="2292" src_ip="152.21.171.10" src_port="80"/>
      <filter dst_ip="0.49.110.22" dst_port="41189" src_ip="152.21.171.10" src_port="80"/>
    </slice>
    <from sec="1123477445" usec="0"/>
    <to sec="1123477839" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="152.20.69.21"/>
      <from sec="1123477200" usec="0"/>
      <to sec="1123478028" usec="0"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_113{
style=filled;
color=gray75;
1943[label="70.68.244.230;d;369pkt 369fpkt", shape=diamond, color=yellow];
stat113[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 70.68.244.230:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1943--2219[label="0.00392157;1pkt 1fpkt"];
1943--2276[label="0.00416667;1pkt 1fpkt"];
1943--2282[label="0.0052356;1pkt 1fpkt"];
1943--2508[label="0.00409836;1pkt 1fpkt"];
1943--2732[label="0.00271003;1pkt 1fpkt"];
1943--2969[label="0.0075188;1pkt 1fpkt"];
1943--3014[label="0.00421941;1pkt 1fpkt"];
1943--3634[label="0.0027933;1pkt 1fpkt"];
1943--3970[label="0.00387597;1pkt 1fpkt"];
1943--4669[label="0.00271003;1pkt 1fpkt"];
1943--4675[label="0.00813008;1pkt 1fpkt"];
1943--4747[label="0.00471698;1pkt 1fpkt"];
1943--4758[label="0.00383142;1pkt 1fpkt"];
1943--4934[label="0.00757576;1pkt 1fpkt"];
1943--4961[label="0.00420168;1pkt 1fpkt"];
1943--5296[label="0.0027933;1pkt 1fpkt"];
1943--5328[label="0.0037037;1pkt 1fpkt"];
1943--5860[label="0.00271003;1pkt 1fpkt"];
1943--5864[label="0.00813008;1pkt 1fpkt"];
1943--6009[label="0.00757576;1pkt 1fpkt"];
1943--6527[label="0.00271003;1pkt 1fpkt"];
1943--6530[label="0.00813008;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="70.68.244.230"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,504,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_114{
style=filled;
color=gray75;
439[label="158.47.1.126;s;735pkt 735fpkt", shape=diamond, color=yellow];
1051[label="5.133.215.104;d;338pkt 338fpkt", shape=diamond, color=yellow];
1754[label="206.94.125.58;d;392pkt 392fpkt", shape=diamond, color=yellow];
stat114[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.47.1.126:*, 206.94.125.58:443}[53.3333%]&lt;BR/&gt;{158.47.1.126:*, 5.133.215.104:443}[45.9864%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (49.8294%)&lt;BR/&gt; 80: (0.170648%)&lt;BR/&gt; 2707: (0.0682594%)&lt;BR/&gt; 2706: (0.0682594%)&lt;BR/&gt; 2705: (0.0682594%)&gt;];
}
439--1051[label="1;338pkt 338fpkt"];
439--1754[label="1;392pkt 392fpkt"];
439--1955[label="1;2pkt 2fpkt"];
439--2875[label="0.00272109;2pkt 2fpkt"];
439--2885[label="0.00136054;1pkt 1fpkt"];
439--2899[label="0.00136054;1pkt 1fpkt"];
439--2909[label="0.00136054;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="206.94.125.58" dst_port="443" src_ip="158.47.1.126"/>
      <filter dst_ip="5.133.215.104" dst_port="443" src_ip="158.47.1.126"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="208.70.152.106"/>
      <from sec="1123477200" usec="0"/>
      <to sec="1123477938" usec="0"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123477938" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="158.189.44.179"/>
      <from sec="1123477200" usec="0"/>
      <to sec="1123477938" usec="0"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123477938" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="201.117.151.32"/>
      <from sec="1123477200" usec="0"/>
      <to sec="1123477848" usec="0"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123477848" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_118{
style=filled;
color=gray75;
2012[label="5.71.244.18;d;65pkt 65fpkt", shape=diamond, color=yellow];
2013[label="200.85.213.112;s;61pkt 61fpkt", shape=diamond, color=yellow];
stat118[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.85.213.112:80, 5.71.244.18:*}[95.5882%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 50786: (0.793651%)&lt;BR/&gt; 50502: (0.793651%)&lt;BR/&gt; 50447: (0.793651%)&lt;BR/&gt; 49938: (0.793651%)&gt;];
}
2012--2013[label="0.95082;58pkt 58fpkt"];
</description>
    <slice>
      <filter dst_ip="5.71.244.18" src_ip="200.85.213.112" src_port="80"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478025" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="3.68.169.56"/>
      <from sec="1123477204" usec="0"/>
      <to sec="1123478022" usec="0"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478022" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="211.217.51.115"/>
      <from sec="1123477222" usec="0"/>
      <to sec="1123478021" usec="0"/>
    </slice>
    <from sec="1123477222" usec="0"/>
    <to sec="1123478021" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,502,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_121{
style=filled;
color=gray75;
1859[label="158.47.1.24;d;1pkt 1fpkt", shape=diamond, color=yellow];
2093[label="194.229.212.103;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat121[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.229.212.103:22, 158.47.1.24:49621}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 49621: (50%)&lt;BR/&gt; 22: (50%)&gt;];
}
1859--2093[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="158.47.1.24" dst_port="49621" src_ip="194.229.212.103" src_port="22"/>
    </slice>
    <from sec="1123477259" usec="0"/>
    <to sec="1123477980" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="18.227.200.102"/>
      <from sec="1123477434" usec="0"/>
      <to sec="1123477848" usec="0"/>
    </slice>
    <from sec="1123477434" usec="0"/>
    <to sec="1123477848" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_123{
style=filled;
color=gray75;
1297[label="158.47.88.74;d;41pkt 41fpkt", shape=diamond, color=yellow];
2106[label="193.147.92.133;s;1pkt 1fpkt", shape=diamond, color=yellow];
4488[label="193.147.92.191;26pkt 26fpkt", shape=pentagon, color=darkviolet];
stat123[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.147.92.191:80, 158.47.88.74:*}[63.4146%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3093: (1.47059%)&lt;BR/&gt; 3091: (1.47059%)&lt;BR/&gt; 3086: (1.47059%)&lt;BR/&gt; 3085: (1.47059%)&gt;];
}
1297--2106[label="1;1pkt 1fpkt"];
1297--4488[label="1;26pkt 26fpkt"];
</description>
    <slice>
      <filter dst_ip="158.47.88.74" src_ip="193.147.92.191" src_port="80"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_124{
style=filled;
color=gray75;
1878[label="138.135.75.113;d;61pkt 61fpkt", shape=diamond, color=yellow];
2108[label="158.189.18.7;s;61pkt 61fpkt", shape=diamond, color=yellow];
stat124[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.189.18.7:*, 138.135.75.113:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2222: (0.819672%)&lt;BR/&gt; 2220: (0.819672%)&lt;BR/&gt; 2219: (0.819672%)&lt;BR/&gt; 2218: (0.819672%)&gt;];
}
1878--2108[label="1;61pkt 61fpkt"];
</description>
    <slice>
      <filter dst_ip="138.135.75.113" dst_port="80" src_ip="158.189.18.7"/>
    </slice>
    <from sec="1123477476" usec="0"/>
    <to sec="1123477741" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_125{
style=filled;
color=gray75;
1727[label="200.85.209.80;s;41pkt 41fpkt", shape=diamond, color=yellow];
2117[label="219.174.66.103;d;5pkt 5fpkt", shape=diamond, color=yellow];
3621[label="200.85.209.80;46pkt 46fpkt", shape=pentagon, color=darkviolet];
5286[label="200.85.209.80;46pkt 46fpkt", shape=invtriangle, color=brown];
6223[label="200.85.209.80;46pkt 46fpkt", shape=invhouse, color=bisque];
stat125[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.85.209.80:80, *:*}[97.8723%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.913%)&lt;BR/&gt; 48042: (1.3587%)&lt;BR/&gt; 48022: (1.3587%)&lt;BR/&gt; 37423: (1.3587%)&lt;BR/&gt; 36879: (1.3587%)&gt;];
}
1727--2117[label="1;5pkt 5fpkt"];
1727--3621[label="0.97561;40pkt 40fpkt"];
1727--5286[label="0.97561;40pkt 40fpkt"];
1727--6223[label="0.97561;40pkt 40fpkt"];
2117--3621[label="1;5pkt 5fpkt"];
2117--5286[label="1;5pkt 5fpkt"];
2117--6223[label="1;5pkt 5fpkt"];
3621--5286[label="1;46pkt 46fpkt"];
3621--6223[label="1;46pkt 46fpkt"];
5286--6223[label="1;46pkt 46fpkt"];
</description>
    <slice>
      <filter src_ip="200.85.209.80" src_port="80"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_126{
style=filled;
color=gray75;
1857[label="152.21.138.5;d;32pkt 32fpkt", shape=diamond, color=yellow];
2121[label="71.126.147.247;s;32pkt 32fpkt", shape=diamond, color=yellow];
4886[label="71.126.147.247;33pkt 33fpkt", shape=pentagon, color=darkviolet];
5980[label="71.126.147.247;33pkt 33fpkt", shape=invtriangle, color=brown];
stat126[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.126.147.247:*, 152.21.138.5:80}[96.9697%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.2308%)&lt;BR/&gt; 45648: (1.53846%)&lt;BR/&gt; 45222: (1.53846%)&lt;BR/&gt; 45221: (1.53846%)&lt;BR/&gt; 44815: (1.53846%)&gt;];
}
1857--2121[label="1;32pkt 32fpkt"];
1857--4886[label="1;32pkt 32fpkt"];
1857--5980[label="1;32pkt 32fpkt"];
2121--4886[label="1;32pkt 32fpkt"];
2121--5980[label="1;32pkt 32fpkt"];
4886--5980[label="1;33pkt 33fpkt"];
</description>
    <slice>
      <filter dst_ip="152.21.138.5" dst_port="80" src_ip="71.126.147.247"/>
    </slice>
    <from sec="1123477255" usec="0"/>
    <to sec="1123477817" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_127{
style=filled;
color=gray75;
1895[label="152.21.220.70;s;54pkt 54fpkt", shape=diamond, color=yellow];
2137[label="155.35.237.103;d;2pkt 2fpkt", shape=diamond, color=yellow];
3537[label="152.21.220.70;54pkt 54fpkt", shape=pentagon, color=darkviolet];
stat127[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.220.70:*, 197.66.34.208:80}[87.037%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1357: (1.36364%)&lt;BR/&gt; 1356: (1.36364%)&lt;BR/&gt; 1355: (0.909091%)&lt;BR/&gt; 1354: (0.909091%)&gt;];
}
1895--2137[label="1;2pkt 2fpkt"];
1895--3537[label="1;54pkt 54fpkt"];
2137--3537[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="197.66.34.208" dst_port="80" src_ip="152.21.220.70"/>
    </slice>
    <from sec="1123477568" usec="0"/>
    <to sec="1123477767" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_128{
style=filled;
color=gray75;
1669[label="201.117.148.244;s;6pkt 6fpkt", shape=diamond, color=yellow];
2153[label="1.220.39.176;d;1pkt 1fpkt", shape=diamond, color=yellow];
4870[label="201.117.148.244;6pkt 6fpkt", shape=pentagon, color=darkviolet];
stat128[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.117.148.244:*, *:21}[33.3333%]&lt;BR/&gt;{201.117.148.244:*, *:80}[33.3333%]&lt;BR/&gt;{201.117.148.244:*, 220.185.57.72:*}[33.3333%]&lt;BR/&gt;{201.117.148.244:*, 82.221.30.85:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (19.2308%)&lt;BR/&gt; 21: (15.3846%)&lt;BR/&gt; 65465: (11.5385%)&lt;BR/&gt; 65471: (7.69231%)&lt;BR/&gt; 65470: (7.69231%)&gt;];
}
1669--2153[label="1;1pkt 1fpkt"];
1669--4870[label="1;6pkt 6fpkt"];
2153--4870[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="82.221.30.85" src_ip="201.117.148.244"/>
      <filter dst_ip="220.185.57.72" src_ip="201.117.148.244"/>
      <filter dst_port="80" src_ip="201.117.148.244"/>
      <filter dst_port="21" src_ip="201.117.148.244"/>
    </slice>
    <from sec="1123477279" usec="0"/>
    <to sec="1123477784" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="16.60.176.65"/>
      <from sec="1123477763" usec="0"/>
      <to sec="1123477911" usec="0"/>
    </slice>
    <from sec="1123477763" usec="0"/>
    <to sec="1123477911" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_130{
style=filled;
color=gray75;
2175[label="218.237.37.134;d;235pkt 235fpkt", shape=diamond, color=yellow];
stat130[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 218.237.37.134:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2175--2219[label="0.00425532;1pkt 1fpkt"];
2175--2276[label="0.00425532;1pkt 1fpkt"];
2175--2282[label="0.0052356;1pkt 1fpkt"];
2175--2508[label="0.00425532;1pkt 1fpkt"];
2175--2732[label="0.00425532;1pkt 1fpkt"];
2175--2969[label="0.0075188;1pkt 1fpkt"];
2175--3014[label="0.00425532;1pkt 1fpkt"];
2175--3970[label="0.00425532;1pkt 1fpkt"];
2175--4669[label="0.00425532;1pkt 1fpkt"];
2175--4747[label="0.00471698;1pkt 1fpkt"];
2175--4758[label="0.00425532;1pkt 1fpkt"];
2175--4934[label="0.00757576;1pkt 1fpkt"];
2175--4961[label="0.00425532;1pkt 1fpkt"];
2175--5328[label="0.00425532;1pkt 1fpkt"];
2175--5860[label="0.00425532;1pkt 1fpkt"];
2175--6009[label="0.00757576;1pkt 1fpkt"];
2175--6527[label="0.00425532;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="218.237.37.134"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123477938" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_131{
style=filled;
color=gray75;
1939[label="169.169.244.150;s;1pkt 1fpkt", shape=diamond, color=yellow];
2195[label="200.178.87.220;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat131[shape=component, label=&lt;Rules:&lt;BR/&gt;{169.169.244.150:1269, 200.178.87.220:6666}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6666: (50%)&lt;BR/&gt; 1269: (50%)&gt;];
}
1939--2195[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="200.178.87.220" dst_port="6666" src_ip="169.169.244.150" src_port="1269"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_132{
style=filled;
color=gray75;
1743[label="221.67.77.92;d;2pkt 2fpkt", shape=diamond, color=yellow];
2198[label="158.189.107.237;s;2pkt 2fpkt", shape=diamond, color=yellow];
4827[label="158.189.107.237;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5945[label="158.189.107.237;1pkt 1fpkt", shape=invtriangle, color=brown];
6572[label="158.189.107.237;1pkt 1fpkt", shape=invhouse, color=bisque];
stat132[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.189.107.237:1463, 221.67.77.92:554}[50%]&lt;BR/&gt;{158.189.107.237:6970, 221.67.77.92:15096}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1463: (35.7143%)&lt;BR/&gt; 554: (35.7143%)&lt;BR/&gt; 15096: (14.2857%)&lt;BR/&gt; 6970: (14.2857%)&gt;];
}
1743--2198[label="1;2pkt 2fpkt"];
1743--4827[label="1;1pkt 1fpkt"];
1743--5945[label="1;1pkt 1fpkt"];
1743--6572[label="1;1pkt 1fpkt"];
2198--4827[label="1;1pkt 1fpkt"];
2198--5945[label="1;1pkt 1fpkt"];
2198--6572[label="1;1pkt 1fpkt"];
4827--5945[label="1;1pkt 1fpkt"];
4827--6572[label="1;1pkt 1fpkt"];
5945--6572[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="221.67.77.92" dst_port="15096" src_ip="158.189.107.237" src_port="6970"/>
      <filter dst_ip="221.67.77.92" dst_port="554" src_ip="158.189.107.237" src_port="1463"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,501,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="216.95.154.200"/>
      <from sec="1123477200" usec="0"/>
      <to sec="1123478028" usec="0"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_134{
style=filled;
color=gray75;
1998[label="169.169.204.5;d;3pkt 3fpkt", shape=diamond, color=yellow];
2222[label="208.68.254.192;s;3pkt 3fpkt", shape=diamond, color=yellow];
stat134[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.68.254.192:6667, 169.169.204.5:1099}[33.3333%]&lt;BR/&gt;{208.68.254.192:6667, 169.169.204.5:1102}[33.3333%]&lt;BR/&gt;{208.68.254.192:6667, 169.169.204.5:3788}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (50%)&lt;BR/&gt; 3788: (16.6667%)&lt;BR/&gt; 1102: (16.6667%)&lt;BR/&gt; 1099: (16.6667%)&gt;];
}
1998--2222[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="169.169.204.5" dst_port="3788" src_ip="208.68.254.192" src_port="6667"/>
      <filter dst_ip="169.169.204.5" dst_port="1102" src_ip="208.68.254.192" src_port="6667"/>
      <filter dst_ip="169.169.204.5" dst_port="1099" src_ip="208.68.254.192" src_port="6667"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="152.20.61.172"/>
      <from sec="1123477201" usec="0"/>
      <to sec="1123478028" usec="0"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_136{
style=filled;
color=gray75;
2256[label="132.117.215.51;d;145pkt 145fpkt", shape=diamond, color=yellow];
stat136[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 132.117.215.51:2361}[91.0345%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2361: (45.5172%)&lt;BR/&gt; 443: (2.75862%)&lt;BR/&gt; 16914: (1.72414%)&lt;BR/&gt; 80: (1.72414%)&lt;BR/&gt; 59510: (0.689655%)&gt;];
}
2256--2875[label="0.00689655;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="132.117.215.51" dst_port="2361"/>
    </slice>
    <from sec="1123477202" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_137{
style=filled;
color=gray75;
2302[label="172.118.216.120;s;34pkt 34fpkt", shape=diamond, color=yellow];
2318[label="5.71.245.237;d;30pkt 30fpkt", shape=diamond, color=yellow];
stat137[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.118.216.120:80, 5.71.245.237:*}[88.2353%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 60961: (1.5625%)&lt;BR/&gt; 60716: (1.5625%)&lt;BR/&gt; 60378: (1.5625%)&lt;BR/&gt; 60066: (1.5625%)&gt;];
}
2302--2318[label="1;30pkt 30fpkt"];
</description>
    <slice>
      <filter dst_ip="5.71.245.237" src_ip="172.118.216.120" src_port="80"/>
    </slice>
    <from sec="1123477213" usec="0"/>
    <to sec="1123478027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="5.148.160.176"/>
      <from sec="1123477430" usec="0"/>
      <to sec="1123478028" usec="0"/>
    </slice>
    <from sec="1123477430" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="18.227.200.102"/>
      <from sec="1123477434" usec="0"/>
      <to sec="1123478001" usec="0"/>
    </slice>
    <from sec="1123477434" usec="0"/>
    <to sec="1123478001" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="219.117.4.3"/>
      <from sec="1123477582" usec="0"/>
      <to sec="1123478028" usec="0"/>
    </slice>
    <from sec="1123477582" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.31781,2.00526,999,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_141{
style=filled;
color=gray75;
91[label="4.42.58.198s;1pkt 1fpkt", shape=rectangle, color=red];
2357[label="4.42.58.198;s;5pkt 5fpkt", shape=diamond, color=yellow];
2610[label="201.117.148.154;d;2pkt 2fpkt", shape=diamond, color=yellow];
stat141[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.42.58.198:995, 132.117.57.162:4717}[20%]&lt;BR/&gt;{4.42.58.198:995, 201.117.148.154:49173}[20%]&lt;BR/&gt;{4.42.58.198:995, 201.117.148.154:49175}[20%]&lt;BR/&gt;{4.42.58.198:995, 201.117.146.204:2563}[20%]&lt;BR/&gt;{4.42.58.198:995, 201.117.146.204:2569}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 995: (50%)&lt;BR/&gt; 49175: (18.75%)&lt;BR/&gt; 49173: (12.5%)&lt;BR/&gt; 4717: (6.25%)&lt;BR/&gt; 2569: (6.25%)&gt;];
}
91--2357[label="1;1pkt 1fpkt"];
91--2610[label="1;1pkt 1fpkt"];
2357--2610[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="201.117.146.204" dst_port="2569" src_ip="4.42.58.198" src_port="995"/>
      <filter dst_ip="201.117.146.204" dst_port="2563" src_ip="4.42.58.198" src_port="995"/>
      <filter dst_ip="201.117.148.154" dst_port="49175" src_ip="4.42.58.198" src_port="995"/>
      <filter dst_ip="201.117.148.154" dst_port="49173" src_ip="4.42.58.198" src_port="995"/>
      <filter dst_ip="132.117.57.162" dst_port="4717" src_ip="4.42.58.198" src_port="995"/>
    </slice>
    <from sec="1123477611" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_142{
style=filled;
color=gray75;
1905[label="152.21.129.138;s;150pkt 150fpkt", shape=diamond, color=yellow];
2373[label="149.35.18.112;d;91pkt 91fpkt", shape=diamond, color=yellow];
4107[label="152.21.129.138;150pkt 150fpkt", shape=pentagon, color=darkviolet];
5563[label="152.21.129.138;150pkt 150fpkt", shape=invtriangle, color=brown];
stat142[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.129.138:*, 149.35.18.112:80}[60.6667%]&lt;BR/&gt;{152.21.129.138:*, 149.35.18.96:80}[23.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1493: (0.369686%)&lt;BR/&gt; 1492: (0.369686%)&lt;BR/&gt; 1491: (0.369686%)&lt;BR/&gt; 1490: (0.369686%)&gt;];
}
1905--2373[label="1;91pkt 91fpkt"];
1905--4107[label="1;150pkt 150fpkt"];
1905--5563[label="1;150pkt 150fpkt"];
2373--4107[label="1;91pkt 91fpkt"];
2373--5563[label="1;91pkt 91fpkt"];
4107--5563[label="1;150pkt 150fpkt"];
</description>
    <slice>
      <filter dst_ip="149.35.18.112" dst_port="80" src_ip="152.21.129.138"/>
      <filter dst_ip="149.35.18.96" dst_port="80" src_ip="152.21.129.138"/>
    </slice>
    <from sec="1123477661" usec="0"/>
    <to sec="1123478010" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_143{
style=filled;
color=gray75;
2267[label="152.21.69.75;d;183pkt 183fpkt", shape=diamond, color=yellow];
2376[label="200.239.158.115;s;170pkt 170fpkt", shape=diamond, color=yellow];
stat143[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.239.158.115:80, 152.21.69.75:*}[92.8962%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 43526: (0.283286%)&lt;BR/&gt; 43525: (0.283286%)&lt;BR/&gt; 43524: (0.283286%)&lt;BR/&gt; 43523: (0.283286%)&gt;];
}
2267--2376[label="1;170pkt 170fpkt"];
</description>
    <slice>
      <filter dst_ip="152.21.69.75" src_ip="200.239.158.115" src_port="80"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_144{
style=filled;
color=gray75;
323[label="152.21.172.75;d;14pkt 14fpkt", shape=diamond, color=yellow];
2397[label="211.140.75.140;s;2pkt 2fpkt", shape=diamond, color=yellow];
stat144[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.50.79.222:80, 152.21.172.75:*}[21.4286%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1075: (6.25%)&lt;BR/&gt; 1074: (6.25%)&lt;BR/&gt; 4887: (3.125%)&lt;BR/&gt; 1136: (3.125%)&gt;];
}
323--2397[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="152.21.172.75" src_ip="212.50.79.222" src_port="80"/>
    </slice>
    <from sec="1123477800" usec="0"/>
    <to sec="1123478024" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="152.21.144.90"/>
      <from sec="1123477919" usec="0"/>
      <to sec="1123477943" usec="0"/>
    </slice>
    <from sec="1123477919" usec="0"/>
    <to sec="1123477943" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_146{
style=filled;
color=gray75;
2409[label="71.109.247.191;d;263pkt 263fpkt", shape=diamond, color=yellow];
stat146[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 71.109.247.191:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2409--2508[label="0.00409836;1pkt 1fpkt"];
2409--2732[label="0.00380228;1pkt 1fpkt"];
2409--2969[label="0.0075188;1pkt 1fpkt"];
2409--3014[label="0.00421941;1pkt 1fpkt"];
2409--3634[label="0.00380228;1pkt 1fpkt"];
2409--3970[label="0.00387597;1pkt 1fpkt"];
2409--4669[label="0.00380228;1pkt 1fpkt"];
2409--4675[label="0.00813008;1pkt 1fpkt"];
2409--4747[label="0.00471698;1pkt 1fpkt"];
2409--4758[label="0.00383142;1pkt 1fpkt"];
2409--4934[label="0.00757576;1pkt 1fpkt"];
2409--4961[label="0.00420168;1pkt 1fpkt"];
2409--5296[label="0.00380228;1pkt 1fpkt"];
2409--5328[label="0.00380228;1pkt 1fpkt"];
2409--5860[label="0.00380228;1pkt 1fpkt"];
2409--5864[label="0.00813008;1pkt 1fpkt"];
2409--6009[label="0.00757576;1pkt 1fpkt"];
2409--6527[label="0.00380228;1pkt 1fpkt"];
2409--6530[label="0.00813008;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="71.109.247.191"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="201.117.151.48"/>
      <from sec="1123477200" usec="0"/>
      <to sec="1123478028" usec="0"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="208.70.152.84"/>
      <from sec="1123477201" usec="0"/>
      <to sec="1123478028" usec="0"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,502,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_149{
style=filled;
color=gray75;
2241[label="6.81.26.76;d;2pkt 2fpkt", shape=diamond, color=yellow];
2469[label="152.20.82.154;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat149[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.20.82.82:0, 6.81.26.76:0}[50%]&lt;BR/&gt;{152.20.82.154:22, 6.81.26.76:4618}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4618: (33.3333%)&lt;BR/&gt; 22: (33.3333%)&lt;BR/&gt; 0: (33.3333%)&gt;];
}
2241--2469[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="6.81.26.76" dst_port="4618" src_ip="152.20.82.154" src_port="22"/>
      <filter dst_ip="6.81.26.76" src_ip="152.20.82.82"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="208.70.152.95"/>
      <from sec="1123477202" usec="0"/>
      <to sec="1123478025" usec="0"/>
    </slice>
    <from sec="1123477202" usec="0"/>
    <to sec="1123478025" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_151{
style=filled;
color=gray75;
1644[label="152.21.162.36;d;1pkt 1fpkt", shape=diamond, color=yellow];
2536[label="215.50.52.223;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat151[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.50.52.223:80, 152.21.162.36:1236}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1236: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
1644--2536[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="152.21.162.36" dst_port="1236" src_ip="215.50.52.223" src_port="80"/>
    </slice>
    <from sec="1123477217" usec="0"/>
    <to sec="1123478027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="71.222.99.192"/>
      <from sec="1123477228" usec="0"/>
      <to sec="1123478013" usec="0"/>
    </slice>
    <from sec="1123477228" usec="0"/>
    <to sec="1123478013" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_153{
style=filled;
color=gray75;
2571[label="200.137.135.135;d;231pkt 231fpkt", shape=diamond, color=yellow];
stat153[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 200.137.135.135:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2571--2732[label="0.004329;1pkt 1fpkt"];
2571--2969[label="0.0075188;1pkt 1fpkt"];
2571--3014[label="0.004329;1pkt 1fpkt"];
2571--3301[label="0.00787402;1pkt 1fpkt"];
2571--3634[label="0.004329;1pkt 1fpkt"];
2571--3970[label="0.004329;1pkt 1fpkt"];
2571--4669[label="0.004329;1pkt 1fpkt"];
2571--4675[label="0.00813008;1pkt 1fpkt"];
2571--4747[label="0.00471698;1pkt 1fpkt"];
2571--4758[label="0.004329;1pkt 1fpkt"];
2571--4934[label="0.00757576;1pkt 1fpkt"];
2571--4961[label="0.004329;1pkt 1fpkt"];
2571--5296[label="0.004329;1pkt 1fpkt"];
2571--5328[label="0.004329;1pkt 1fpkt"];
2571--5860[label="0.004329;1pkt 1fpkt"];
2571--5864[label="0.00813008;1pkt 1fpkt"];
2571--6009[label="0.00757576;1pkt 1fpkt"];
2571--6527[label="0.004329;1pkt 1fpkt"];
2571--6530[label="0.00813008;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="200.137.135.135"/>
    </slice>
    <from sec="1123477492" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_154{
style=filled;
color=gray75;
2298[label="151.81.149.13;s;10pkt 10fpkt", shape=diamond, color=yellow];
2584[label="158.47.80.135;d;8pkt 8fpkt", shape=diamond, color=yellow];
stat154[shape=component, label=&lt;Rules:&lt;BR/&gt;{151.81.149.13:80, 158.47.80.135:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1386: (5.55556%)&lt;BR/&gt; 1384: (5.55556%)&lt;BR/&gt; 1383: (5.55556%)&lt;BR/&gt; 1382: (5.55556%)&gt;];
}
2298--2584[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="158.47.80.135" src_ip="151.81.149.13" src_port="80"/>
    </slice>
    <from sec="1123477210" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_155{
style=filled;
color=gray75;
2330[label="172.118.2.108;s;37pkt 37fpkt", shape=diamond, color=yellow];
2608[label="6.154.41.103;d;2pkt 2fpkt", shape=diamond, color=yellow];
3867[label="172.118.2.108;78pkt 78fpkt", shape=pentagon, color=darkviolet];
stat155[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.118.2.108:*, *:80}[23.0769%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (11.9658%)&lt;BR/&gt; 8685: (7.69231%)&lt;BR/&gt; 443: (6.41026%)&lt;BR/&gt; 9900: (5.12821%)&lt;BR/&gt; 8682: (4.70085%)&gt;];
}
2330--2608[label="1;2pkt 2fpkt"];
2330--3867[label="1;37pkt 37fpkt"];
2608--3867[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="172.118.2.108"/>
    </slice>
    <from sec="1123477277" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="215.51.105.88"/>
      <from sec="1123477955" usec="0"/>
      <to sec="1123478028" usec="0"/>
    </slice>
    <from sec="1123477955" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="152.20.48.26"/>
      <from sec="1123477963" usec="0"/>
      <to sec="1123478000" usec="0"/>
    </slice>
    <from sec="1123477963" usec="0"/>
    <to sec="1123478000" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.677671,2.01448,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_160{
style=filled;
color=gray75;
171[label="201.117.159.48;s;815pkt 815fpkt", shape=diamond, color=yellow];
172[label="211.41.81.229;d;1pkt 1fpkt", shape=diamond, color=yellow];
190[label="2.81.254.57;d;1pkt 1fpkt", shape=diamond, color=yellow];
696[label="1.114.97.236;d;1pkt 1fpkt", shape=diamond, color=yellow];
1292[label="0.170.13.1;d;1pkt 1fpkt", shape=diamond, color=yellow];
1710[label="210.149.203.254;d;2pkt 2fpkt", shape=diamond, color=yellow];
1967[label="133.101.250.203;d;1pkt 1fpkt", shape=diamond, color=yellow];
2497[label="8.232.133.134;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat160[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.117.159.48:6257, *:6257}[87.9755%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6257: (88.8821%)&lt;BR/&gt; 80: (2.43013%)&lt;BR/&gt; 6699: (2.12637%)&lt;BR/&gt; 16257: (0.243013%)&lt;BR/&gt; 9999: (0.243013%)&gt;];
}
171--172[label="1;1pkt 1fpkt"];
171--190[label="1;1pkt 1fpkt"];
171--431[label="0.0490798;40pkt 40fpkt"];
171--696[label="1;1pkt 1fpkt"];
171--1292[label="1;1pkt 1fpkt"];
171--1710[label="1;2pkt 2fpkt"];
171--1967[label="1;1pkt 1fpkt"];
171--2497[label="1;1pkt 1fpkt"];
171--2654[label="0.028436;6pkt 6fpkt"];
171--2875[label="0.00368098;3pkt 3fpkt"];
171--2885[label="0.00368098;3pkt 3fpkt"];
171--2892[label="0.00122699;1pkt 1fpkt"];
171--2899[label="0.00368098;3pkt 3fpkt"];
171--2906[label="0.00122699;1pkt 1fpkt"];
171--2909[label="0.00368098;3pkt 3fpkt"];
171--2916[label="0.00122699;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="6257" src_ip="201.117.159.48" src_port="6257"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.28507,1.98938,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_164{
style=filled;
color=gray75;
337[label="132.117.162.204;d;1412pkt 1412fpkt", shape=diamond, color=yellow];
2690[label="132.117.162.204;d;827pkt 827fpkt", shape=hexagon, color=black];
3006[label="64.171.82.9;9pkt 9fpkt", shape=pentagon, color=darkviolet];
stat164[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 132.117.162.204:3516}[98.0878%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3516: (49.1548%)&lt;BR/&gt; 80: (0.44484%)&lt;BR/&gt; 443: (0.400356%)&lt;BR/&gt; 0: (0.133452%)&lt;BR/&gt; 54045: (0.11121%)&gt;];
}
337--2690[label="1;827pkt 827fpkt"];
337--2885[label="0.000708215;1pkt 1fpkt"];
337--2899[label="0.000708215;1pkt 1fpkt"];
337--2909[label="0.000708215;1pkt 1fpkt"];
337--3006[label="1;9pkt 9fpkt"];
337--4456[label="0.00877193;1pkt 1fpkt"];
337--4713[label="0.0119048;1pkt 1fpkt"];
2690--3006[label="1;9pkt 9fpkt"];
2690--4713[label="0.0119048;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="132.117.162.204" dst_port="3516"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.33083,2.05381,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_165{
style=filled;
color=gray75;
1497[label="70.64.51.23;d;1pkt 1fpkt", shape=diamond, color=yellow];
2720[label="70.64.51.23;d;1pkt 1fpkt", shape=hexagon, color=black];
stat165[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.17.245.45:0, 70.64.51.23:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1497--2720[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="70.64.51.23" src_ip="158.17.245.45"/>
    </slice>
    <from sec="1123477538" usec="0"/>
    <to sec="1123477586" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_168{
style=filled;
color=gray75;
1199[label="158.189.149.183;s;44pkt 44fpkt", shape=diamond, color=yellow];
1200[label="16.185.20.149;d;12pkt 12fpkt", shape=diamond, color=yellow];
2362[label="209.73.78.72;d;28pkt 28fpkt", shape=diamond, color=yellow];
4439[label="158.189.149.183;46pkt 46fpkt", shape=pentagon, color=darkviolet];
5746[label="158.189.149.183;46pkt 46fpkt", shape=invtriangle, color=brown];
6459[label="158.189.149.183;46pkt 46fpkt", shape=invhouse, color=bisque];
stat168[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.189.149.183:*, 209.73.78.72:80}[60.8696%]&lt;BR/&gt;{158.189.149.183:*, 16.185.20.149:80}[28.2609%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.4234%)&lt;BR/&gt; 49791: (1.12613%)&lt;BR/&gt; 49790: (1.12613%)&lt;BR/&gt; 49789: (1.12613%)&lt;BR/&gt; 49788: (1.12613%)&gt;];
}
1199--1200[label="1;12pkt 12fpkt"];
1199--2362[label="1;28pkt 28fpkt"];
1199--2885[label="0.0681818;3pkt 3fpkt"];
1199--2892[label="0.0227273;1pkt 1fpkt"];
1199--2899[label="0.0681818;3pkt 3fpkt"];
1199--2906[label="0.0227273;1pkt 1fpkt"];
1199--2909[label="0.0681818;3pkt 3fpkt"];
1199--2916[label="0.0227273;1pkt 1fpkt"];
1199--4439[label="1;44pkt 44fpkt"];
1199--5746[label="1;44pkt 44fpkt"];
1199--6459[label="1;44pkt 44fpkt"];
1200--4439[label="1;12pkt 12fpkt"];
1200--5746[label="1;12pkt 12fpkt"];
1200--6459[label="1;12pkt 12fpkt"];
2362--2885[label="0.107143;3pkt 3fpkt"];
2362--2899[label="0.107143;3pkt 3fpkt"];
2362--2909[label="0.107143;3pkt 3fpkt"];
2362--4439[label="1;28pkt 28fpkt"];
2362--5746[label="1;28pkt 28fpkt"];
2362--6459[label="1;28pkt 28fpkt"];
4439--5746[label="1;46pkt 46fpkt"];
4439--6459[label="1;46pkt 46fpkt"];
5746--6459[label="1;46pkt 46fpkt"];
</description>
    <slice>
      <filter dst_ip="209.73.78.72" dst_port="80" src_ip="158.189.149.183"/>
      <filter dst_ip="16.185.20.149" dst_port="80" src_ip="158.189.149.183"/>
    </slice>
    <from sec="1123477233" usec="0"/>
    <to sec="1123478076" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="5.97.17.0"/>
    </slice>
    <from sec="1123477473" usec="0"/>
    <to sec="1123477985" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="158.47.41.0"/>
    </slice>
    <from sec="1123477215" usec="0"/>
    <to sec="1123477974" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,011,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_177{
style=filled;
color=gray75;
1288[label="71.108.141.0;s;436pkt 436fpkt", shape=diamond, color=yellow];
2922[label="71.108.141.0;599pkt 599fpkt", shape=pentagon, color=darkviolet];
stat177[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.108.141.0:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 22289: (0.193237%)&lt;BR/&gt; 11267: (0.193237%)&lt;BR/&gt; 57628: (0.144928%)&lt;BR/&gt; 19289: (0.144928%)&gt;];
}
1288--2922[label="0.986239;430pkt 430fpkt"];
</description>
    <slice>
      <filter src_ip="71.108.141.0" src_port="80"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="219.160.146.0"/>
    </slice>
    <from sec="1123477211" usec="0"/>
    <to sec="1123478096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="201.117.151.0"/>
    </slice>
    <from sec="1123477262" usec="0"/>
    <to sec="1123478066" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="5.210.163.0"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.187.168.0"/>
    </slice>
    <from sec="1123478040" usec="0"/>
    <to sec="1123478072" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="71.126.136.1"/>
    </slice>
    <from sec="1123477758" usec="0"/>
    <to sec="1123478079" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.169.154.1"/>
    </slice>
    <from sec="1123477214" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_184{
style=filled;
color=gray75;
2939[label="172.118.192.1;18pkt 18fpkt", shape=pentagon, color=darkviolet];
stat184[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.118.192.1:*, 204.146.72.110:443}[38.8889%]&lt;BR/&gt;{172.118.192.1:*, 6.159.180.161:80}[38.8889%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (27.7778%)&lt;BR/&gt; 443: (22.2222%)&lt;BR/&gt; 2422: (2.77778%)&lt;BR/&gt; 2421: (2.77778%)&lt;BR/&gt; 2416: (2.77778%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="6.159.180.161" dst_port="80" src_ip="172.118.192.1"/>
      <filter dst_ip="204.146.72.110" dst_port="443" src_ip="172.118.192.1"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478059" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="158.160.236.1"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,020,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_186{
style=filled;
color=gray75;
1526[label="200.211.66.2;s;70pkt 70fpkt", shape=diamond, color=yellow];
2945[label="200.211.66.2;73pkt 73fpkt", shape=pentagon, color=darkviolet];
stat186[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.211.66.2:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1526--2945[label="1;70pkt 70fpkt"];
</description>
    <slice>
      <filter src_ip="200.211.66.2"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478082" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.118.155.2"/>
    </slice>
    <from sec="1123477402" usec="0"/>
    <to sec="1123477501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_188{
style=filled;
color=gray75;
2278[label="152.21.179.2;s;136pkt 136fpkt", shape=diamond, color=yellow];
2949[label="152.21.179.2;138pkt 138fpkt", shape=pentagon, color=darkviolet];
stat188[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.179.2:*, 193.74.204.145:80}[50.7246%]&lt;BR/&gt;{152.21.179.2:40903, *:*}[42.7536%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (27.7372%)&lt;BR/&gt; 40903: (21.1679%)&lt;BR/&gt; 65394: (0.364964%)&lt;BR/&gt; 65375: (0.364964%)&lt;BR/&gt; 64983: (0.364964%)&gt;];
}
2278--2885[label="0.00735294;1pkt 1fpkt"];
2278--2892[label="0.00735294;1pkt 1fpkt"];
2278--2899[label="0.00735294;1pkt 1fpkt"];
2278--2906[label="0.00735294;1pkt 1fpkt"];
2278--2909[label="0.00735294;1pkt 1fpkt"];
2278--2916[label="0.00735294;1pkt 1fpkt"];
2278--2949[label="1;136pkt 136fpkt"];
</description>
    <slice>
      <filter src_ip="152.21.179.2" src_port="40903"/>
      <filter dst_ip="193.74.204.145" dst_port="80" src_ip="152.21.179.2"/>
    </slice>
    <from sec="1123477206" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.169.231.2"/>
    </slice>
    <from sec="1123477213" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_190{
style=filled;
color=gray75;
2123[label="219.117.4.3;s;129pkt 129fpkt", shape=diamond, color=yellow];
2954[label="219.117.4.3;152pkt 152fpkt", shape=pentagon, color=darkviolet];
stat190[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.117.4.3:*, *:42}[72.3684%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 42: (35.9431%)&lt;BR/&gt; 0: (9.96441%)&lt;BR/&gt; 80: (9.07473%)&lt;BR/&gt; 4961: (0.355872%)&lt;BR/&gt; 4848: (0.355872%)&gt;];
}
2123--2885[label="0.0155039;2pkt 2fpkt"];
2123--2899[label="0.0155039;2pkt 2fpkt"];
2123--2909[label="0.0155039;2pkt 2fpkt"];
2123--2954[label="1;129pkt 129fpkt"];
</description>
    <slice>
      <filter dst_port="42" src_ip="219.117.4.3"/>
    </slice>
    <from sec="1123477582" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="1.107.6.4"/>
    </slice>
    <from sec="1123477320" usec="0"/>
    <to sec="1123478078" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.176.31.4"/>
    </slice>
    <from sec="1123477222" usec="0"/>
    <to sec="1123478093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.34.48.4"/>
    </slice>
    <from sec="1123478046" usec="0"/>
    <to sec="1123478094" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.18.190.4"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.138.36.5"/>
    </slice>
    <from sec="1123477663" usec="0"/>
    <to sec="1123477805" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_197{
style=filled;
color=gray75;
858[label="152.21.221.6;s;57pkt 57fpkt", shape=diamond, color=yellow];
868[label="71.82.52.203;d;63pkt 63fpkt", shape=diamond, color=yellow];
2988[label="152.21.221.6;103pkt 103fpkt", shape=pentagon, color=darkviolet];
4948[label="152.21.221.6;103pkt 103fpkt", shape=invtriangle, color=brown];
6020[label="152.21.221.6;103pkt 103fpkt", shape=invhouse, color=bisque];
stat197[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.221.6:*, 71.82.52.203:80}[60.5769%]&lt;BR/&gt;{152.21.221.6:*, 71.108.136.194:80}[25.9615%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.2028%)&lt;BR/&gt; 52283: (2.331%)&lt;BR/&gt; 0: (0.932401%)&lt;BR/&gt; 1381: (0.582751%)&lt;BR/&gt; 1380: (0.582751%)&gt;];
}
858--868[label="0.877193;50pkt 50fpkt"];
858--2988[label="0.982456;56pkt 56fpkt"];
858--4948[label="0.982456;56pkt 56fpkt"];
858--6020[label="0.982456;56pkt 56fpkt"];
868--2988[label="1;63pkt 63fpkt"];
868--4948[label="1;63pkt 63fpkt"];
868--6020[label="1;63pkt 63fpkt"];
2988--4948[label="1;103pkt 103fpkt"];
2988--6020[label="1;103pkt 103fpkt"];
4948--6020[label="1;103pkt 103fpkt"];
</description>
    <slice>
      <filter dst_ip="71.82.52.203" dst_port="80" src_ip="152.21.221.6"/>
      <filter dst_ip="71.108.136.194" dst_port="80" src_ip="152.21.221.6"/>
    </slice>
    <from sec="1123477224" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.97.250.6"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478087" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="158.189.18.7"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_200{
style=filled;
color=gray75;
2992[label="192.167.24.7;352pkt 352fpkt", shape=pentagon, color=darkviolet];
stat200[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.167.24.7:53, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (54.5455%)&lt;BR/&gt; 32768: (2.84091%)&lt;BR/&gt; 32769: (2.27273%)&lt;BR/&gt; 1024: (0.994318%)&lt;BR/&gt; 1026: (0.710227%)&gt;];
}
</description>
    <slice>
      <filter src_ip="192.167.24.7" src_port="53"/>
    </slice>
    <from sec="1123477202" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_201{
style=filled;
color=gray75;
794[label="152.21.133.7;s;35pkt 35fpkt", shape=diamond, color=yellow];
1318[label="221.67.77.219;d;13pkt 13fpkt", shape=diamond, color=yellow];
1547[label="152.21.144.82;s;45pkt 45fpkt", shape=diamond, color=yellow];
2995[label="152.21.133.7;35pkt 35fpkt", shape=pentagon, color=darkviolet];
4952[label="152.21.133.7;34pkt 34fpkt", shape=invtriangle, color=brown];
6023[label="152.21.133.7;34pkt 34fpkt", shape=invhouse, color=bisque];
stat201[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.133.7:*, *:80}[38.75%]&lt;BR/&gt;{152.21.144.82:*, 221.67.77.171:80}[22.5%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (37.7551%)&lt;BR/&gt; 554: (6.12245%)&lt;BR/&gt; 6970: (5.61224%)&lt;BR/&gt; 20538: (1.27551%)&lt;BR/&gt; 8750: (1.27551%)&gt;];
}
794--1318[label="0.307692;4pkt 4fpkt"];
794--2995[label="1;35pkt 35fpkt"];
794--4952[label="1;34pkt 34fpkt"];
794--6023[label="1;34pkt 34fpkt"];
1318--1547[label="0.692308;9pkt 9fpkt"];
1318--2995[label="0.307692;4pkt 4fpkt"];
1318--4952[label="0.307692;4pkt 4fpkt"];
1318--6023[label="0.307692;4pkt 4fpkt"];
1547--2875[label="0.0444444;2pkt 2fpkt"];
1547--2885[label="0.0444444;2pkt 2fpkt"];
1547--2899[label="0.0444444;2pkt 2fpkt"];
1547--2909[label="0.0444444;2pkt 2fpkt"];
2995--4952[label="1;34pkt 34fpkt"];
2995--6023[label="1;34pkt 34fpkt"];
4952--6023[label="1;34pkt 34fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="152.21.133.7"/>
      <filter dst_ip="221.67.77.171" dst_port="80" src_ip="152.21.144.82"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="158.160.50.9"/>
    </slice>
    <from sec="1123477210" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_203{
style=filled;
color=gray75;
3005[label="71.48.76.9;30pkt 30fpkt", shape=pentagon, color=darkviolet];
stat203[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.48.76.9:*, 158.189.5.156:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 60665: (1.66667%)&lt;BR/&gt; 60308: (1.66667%)&lt;BR/&gt; 59509: (1.66667%)&lt;BR/&gt; 56786: (1.66667%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="158.189.5.156" dst_port="80" src_ip="71.48.76.9"/>
    </slice>
    <from sec="1123477358" usec="0"/>
    <to sec="1123478081" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.169.157.9"/>
    </slice>
    <from sec="1123477237" usec="0"/>
    <to sec="1123478006" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.224.13.10"/>
    </slice>
    <from sec="1123477397" usec="0"/>
    <to sec="1123477477" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_207{
style=filled;
color=gray75;
582[label="152.21.71.12;s;3967pkt 3967fpkt", shape=diamond, color=yellow];
3036[label="152.21.71.12;9006pkt 9006fpkt", shape=pentagon, color=darkviolet];
4971[label="152.21.71.12;9006pkt 9006fpkt", shape=invtriangle, color=brown];
6034[label="152.21.71.12;9006pkt 9006fpkt", shape=invhouse, color=bisque];
stat207[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.71.12:1179, *:*}[98.7454%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1179: (49.3787%)&lt;BR/&gt; 443: (0.455059%)&lt;BR/&gt; 80: (0.179119%)&lt;BR/&gt; 54045: (0.150073%)&lt;BR/&gt; 1025: (0.066161%)&gt;];
}
582--2879[label="0.00196464;2pkt 2fpkt"];
582--2880[label="0.00321543;3pkt 3fpkt"];
582--2889[label="0.00167926;2pkt 2fpkt"];
582--2890[label="0.00114286;1pkt 1fpkt"];
582--2903[label="0.00167926;2pkt 2fpkt"];
582--2904[label="0.00114286;1pkt 1fpkt"];
582--2913[label="0.00167926;2pkt 2fpkt"];
582--2914[label="0.00114155;1pkt 1fpkt"];
582--3036[label="0.999748;3966pkt 3966fpkt"];
582--4971[label="0.999748;3966pkt 3966fpkt"];
582--6034[label="0.999748;3966pkt 3966fpkt"];
3036--4971[label="1;9006pkt 9006fpkt"];
3036--6034[label="1;9006pkt 9006fpkt"];
4971--6034[label="1;9006pkt 9006fpkt"];
</description>
    <slice>
      <filter src_ip="152.21.71.12" src_port="1179"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.169.194.12"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.235.52.13"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.22.105.13"/>
    </slice>
    <from sec="1123477211" usec="0"/>
    <to sec="1123478063" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="71.128.119.13"/>
    </slice>
    <from sec="1123477673" usec="0"/>
    <to sec="1123477711" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="152.21.171.13"/>
    </slice>
    <from sec="1123477771" usec="0"/>
    <to sec="1123477811" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="18.154.93.14"/>
    </slice>
    <from sec="1123477207" usec="0"/>
    <to sec="1123478095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="201.117.149.14"/>
    </slice>
    <from sec="1123477618" usec="0"/>
    <to sec="1123477664" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.169.145.15"/>
    </slice>
    <from sec="1123477209" usec="0"/>
    <to sec="1123478065" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.169.154.16"/>
    </slice>
    <from sec="1123477205" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="158.160.156.16"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.206.24.17"/>
    </slice>
    <from sec="1123477655" usec="0"/>
    <to sec="1123477674" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.169.154.17"/>
    </slice>
    <from sec="1123477210" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_221{
style=filled;
color=gray75;
1244[label="200.89.27.18;s;784pkt 784fpkt", shape=diamond, color=yellow];
3093[label="200.89.27.18;848pkt 848fpkt", shape=pentagon, color=darkviolet];
5000[label="200.89.27.18;847pkt 847fpkt", shape=invtriangle, color=brown];
6052[label="200.89.27.18;848pkt 848fpkt", shape=invhouse, color=bisque];
stat221[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.89.27.18:53, *:*}[99.7644%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (55.0045%)&lt;BR/&gt; 32768: (2.56988%)&lt;BR/&gt; 32769: (1.48783%)&lt;BR/&gt; 1024: (0.871656%)&lt;BR/&gt; 33701: (0.781485%)&gt;];
}
1244--2874[label="0.00892857;7pkt 7fpkt"];
1244--2880[label="0.00127551;1pkt 1fpkt"];
1244--2884[label="0.00510204;4pkt 4fpkt"];
1244--2893[label="0.00382653;3pkt 3fpkt"];
1244--2898[label="0.00510204;4pkt 4fpkt"];
1244--2907[label="0.00382653;3pkt 3fpkt"];
1244--2917[label="0.00382653;3pkt 3fpkt"];
1244--3093[label="0.998724;783pkt 783fpkt"];
1244--5000[label="0.997449;782pkt 782fpkt"];
1244--6052[label="0.998724;783pkt 783fpkt"];
3093--5000[label="1;847pkt 847fpkt"];
3093--6052[label="1;848pkt 848fpkt"];
5000--6052[label="1;847pkt 847fpkt"];
</description>
    <slice>
      <filter src_ip="200.89.27.18" src_port="53"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="152.20.183.19"/>
    </slice>
    <from sec="1123477805" usec="0"/>
    <to sec="1123478080" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="152.21.172.20"/>
    </slice>
    <from sec="1123477938" usec="0"/>
    <to sec="1123477953" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="19.249.203.20"/>
    </slice>
    <from sec="1123477978" usec="0"/>
    <to sec="1123478095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="158.160.240.20"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_226{
style=filled;
color=gray75;
2565[label="158.47.81.22;s;51pkt 51fpkt", shape=diamond, color=yellow];
3129[label="158.47.81.22;56pkt 56fpkt", shape=pentagon, color=darkviolet];
stat226[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.47.81.22:*, 196.196.13.149:80}[51.7857%]&lt;BR/&gt;{158.47.81.22:*, 167.32.142.40:80}[41.0714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2026: (0.934579%)&lt;BR/&gt; 2024: (0.934579%)&lt;BR/&gt; 2005: (0.934579%)&lt;BR/&gt; 2004: (0.934579%)&gt;];
}
2565--2885[label="0.0392157;2pkt 2fpkt"];
2565--2899[label="0.0392157;2pkt 2fpkt"];
2565--2909[label="0.0392157;2pkt 2fpkt"];
2565--3129[label="1;51pkt 51fpkt"];
</description>
    <slice>
      <filter dst_ip="196.196.13.149" dst_port="80" src_ip="158.47.81.22"/>
      <filter dst_ip="167.32.142.40" dst_port="80" src_ip="158.47.81.22"/>
    </slice>
    <from sec="1123477430" usec="0"/>
    <to sec="1123478093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="1.214.141.23"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="16.19.202.23"/>
    </slice>
    <from sec="1123477639" usec="0"/>
    <to sec="1123477705" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.135.9.24"/>
    </slice>
    <from sec="1123477293" usec="0"/>
    <to sec="1123477993" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_230{
style=filled;
color=gray75;
2127[label="152.21.144.24;s;73pkt 73fpkt", shape=diamond, color=yellow];
3153[label="152.21.144.24;86pkt 86fpkt", shape=pentagon, color=darkviolet];
stat230[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.144.24:*, 4.137.50.53:80}[76.7442%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2887: (0.628931%)&lt;BR/&gt; 2886: (0.628931%)&lt;BR/&gt; 2885: (0.628931%)&lt;BR/&gt; 2884: (0.628931%)&gt;];
}
2127--2885[label="0.0958904;7pkt 7fpkt"];
2127--2899[label="0.0958904;7pkt 7fpkt"];
2127--2909[label="0.0958904;7pkt 7fpkt"];
2127--3153[label="1;73pkt 73fpkt"];
</description>
    <slice>
      <filter dst_ip="4.137.50.53" dst_port="80" src_ip="152.21.144.24"/>
    </slice>
    <from sec="1123477320" usec="0"/>
    <to sec="1123478092" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="152.20.130.25"/>
    </slice>
    <from sec="1123477219" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="18.239.104.26"/>
    </slice>
    <from sec="1123477230" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="152.21.222.28"/>
    </slice>
    <from sec="1123477764" usec="0"/>
    <to sec="1123477847" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="71.206.234.29"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.85.17.30"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478090" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="1.99.81.31"/>
    </slice>
    <from sec="1123477221" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.85.21.32"/>
    </slice>
    <from sec="1123477212" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.85.25.32"/>
    </slice>
    <from sec="1123477214" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.43.129.32"/>
    </slice>
    <from sec="1123477264" usec="0"/>
    <to sec="1123477746" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="71.116.46.34"/>
    </slice>
    <from sec="1123477666" usec="0"/>
    <to sec="1123478064" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.42.2.35"/>
    </slice>
    <from sec="1123477202" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="65.140.17.35"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.85.20.35"/>
    </slice>
    <from sec="1123477216" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="6.122.20.35"/>
    </slice>
    <from sec="1123477209" usec="0"/>
    <to sec="1123478066" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.169.154.35"/>
    </slice>
    <from sec="1123477210" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_248{
style=filled;
color=gray75;
367[label="172.118.165.77;d;2pkt 2fpkt", shape=diamond, color=yellow];
658[label="205.11.69.234;s;1pkt 1fpkt", shape=diamond, color=yellow];
1421[label="5.59.168.35;s;27pkt 27fpkt", shape=diamond, color=yellow];
3250[label="5.59.168.35;30pkt 30fpkt", shape=pentagon, color=darkviolet];
stat248[shape=component, label=&lt;Rules:&lt;BR/&gt;{5.59.168.35:80, 172.118.250.138:*}[22.5806%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.3333%)&lt;BR/&gt; 1680: (2.5%)&lt;BR/&gt; 59835: (1.66667%)&lt;BR/&gt; 53606: (1.66667%)&lt;BR/&gt; 4687: (1.66667%)&gt;];
}
367--658[label="1;1pkt 1fpkt"];
367--1421[label="0.5;1pkt 1fpkt"];
367--3250[label="0.5;1pkt 1fpkt"];
1421--3250[label="1;27pkt 27fpkt"];
</description>
    <slice>
      <filter dst_ip="172.118.250.138" src_ip="5.59.168.35" src_port="80"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_249{
style=filled;
color=gray75;
3252[label="200.42.22.36;95pkt 95fpkt", shape=pentagon, color=darkviolet];
stat249[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.42.22.36:*, 158.189.5.156:80}[98.9474%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.4737%)&lt;BR/&gt; 2999: (0.526316%)&lt;BR/&gt; 2997: (0.526316%)&lt;BR/&gt; 2995: (0.526316%)&lt;BR/&gt; 2993: (0.526316%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="158.189.5.156" dst_port="80" src_ip="200.42.22.36"/>
    </slice>
    <from sec="1123477387" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.129.59.36"/>
    </slice>
    <from sec="1123477213" usec="0"/>
    <to sec="1123477323" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_251{
style=filled;
color=gray75;
611[label="209.2.129.67;d;11pkt 11fpkt", shape=diamond, color=yellow];
721[label="194.208.28.83;d;26pkt 26fpkt", shape=diamond, color=yellow];
1055[label="169.169.224.182;s;3pkt 3fpkt", shape=diamond, color=yellow];
1069[label="169.169.146.3;s;1pkt 1fpkt", shape=diamond, color=yellow];
1217[label="169.169.201.195;s;2pkt 2fpkt", shape=diamond, color=yellow];
1611[label="152.20.28.23;s;106pkt 106fpkt", shape=diamond, color=yellow];
1755[label="208.70.152.102;d;22pkt 22fpkt", shape=diamond, color=yellow];
1946[label="169.169.154.21;s;2pkt 2fpkt", shape=diamond, color=yellow];
1947[label="169.169.224.105;s;2pkt 2fpkt", shape=diamond, color=yellow];
1950[label="169.169.238.2;s;1pkt 1fpkt", shape=diamond, color=yellow];
2043[label="208.70.152.116;d;6pkt 6fpkt", shape=diamond, color=yellow];
2075[label="169.169.201.184;s;2pkt 2fpkt", shape=diamond, color=yellow];
2199[label="169.169.158.175;s;2pkt 2fpkt", shape=diamond, color=yellow];
2272[label="208.70.152.75;d;13pkt 13fpkt", shape=diamond, color=yellow];
2315[label="169.169.193.131;s;8pkt 8fpkt", shape=diamond, color=yellow];
2498[label="169.169.201.232;s;2pkt 2fpkt", shape=diamond, color=yellow];
2570[label="169.169.228.36;s;13pkt 13fpkt", shape=diamond, color=yellow];
3137[label="152.20.28.23;106pkt 106fpkt", shape=pentagon, color=darkviolet];
3264[label="169.169.228.36;13pkt 13fpkt", shape=pentagon, color=darkviolet];
3797[label="169.169.225.98;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4244[label="152.20.106.159;19pkt 19fpkt", shape=pentagon, color=darkviolet];
4264[label="169.169.157.161;39pkt 39fpkt", shape=pentagon, color=darkviolet];
4381[label="169.169.158.175;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5095[label="169.169.228.36;13pkt 13fpkt", shape=invtriangle, color=brown];
5637[label="152.20.106.159;19pkt 19fpkt", shape=invtriangle, color=brown];
5652[label="169.169.157.161;39pkt 39fpkt", shape=invtriangle, color=brown];
6411[label="152.20.106.159;19pkt 19fpkt", shape=invhouse, color=bisque];
stat251[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.20.28.23:*, *:80}[34.8%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (22.3124%)&lt;BR/&gt; 6667: (8.31643%)&lt;BR/&gt; 5050: (5.57809%)&lt;BR/&gt; 443: (4.46247%)&lt;BR/&gt; 1863: (2.12982%)&gt;];
}
611--1055[label="0.666667;2pkt 2fpkt"];
611--1069[label="1;1pkt 1fpkt"];
611--1114[label="0.0909091;1pkt 1fpkt"];
611--1217[label="0.5;1pkt 1fpkt"];
611--2075[label="0.5;1pkt 1fpkt"];
611--2498[label="0.5;1pkt 1fpkt"];
721--1114[label="0.0384615;1pkt 1fpkt"];
721--1946[label="0.5;1pkt 1fpkt"];
721--1947[label="0.5;1pkt 1fpkt"];
721--1950[label="1;1pkt 1fpkt"];
721--2199[label="0.5;1pkt 1fpkt"];
721--2315[label="1;8pkt 8fpkt"];
721--2570[label="0.461538;6pkt 6fpkt"];
721--3264[label="0.461538;6pkt 6fpkt"];
721--3797[label="0.5;1pkt 1fpkt"];
721--4381[label="0.5;1pkt 1fpkt"];
721--5095[label="0.461538;6pkt 6fpkt"];
1217--1755[label="0.5;1pkt 1fpkt"];
1611--2043[label="0.166667;1pkt 1fpkt"];
1611--2875[label="0.0566038;6pkt 6fpkt"];
1611--2885[label="0.0566038;6pkt 6fpkt"];
1611--2892[label="0.0283019;3pkt 3fpkt"];
1611--2899[label="0.0566038;6pkt 6fpkt"];
1611--2906[label="0.0283019;3pkt 3fpkt"];
1611--2909[label="0.0566038;6pkt 6fpkt"];
1611--2916[label="0.0283019;3pkt 3fpkt"];
1611--3137[label="1;106pkt 106fpkt"];
1755--4264[label="0.0454545;1pkt 1fpkt"];
1755--5652[label="0.0454545;1pkt 1fpkt"];
2043--2498[label="0.5;1pkt 1fpkt"];
2043--3137[label="0.166667;1pkt 1fpkt"];
2043--4244[label="0.166667;1pkt 1fpkt"];
2043--4294[label="0.166667;1pkt 1fpkt"];
2043--5637[label="0.166667;1pkt 1fpkt"];
2043--6411[label="0.166667;1pkt 1fpkt"];
2075--2272[label="0.5;1pkt 1fpkt"];
2199--4381[label="1;2pkt 2fpkt"];
2272--2570[label="0.0769231;1pkt 1fpkt"];
2272--3264[label="0.0769231;1pkt 1fpkt"];
2272--5095[label="0.0769231;1pkt 1fpkt"];
2570--3264[label="1;13pkt 13fpkt"];
2570--5095[label="1;13pkt 13fpkt"];
3264--5095[label="1;13pkt 13fpkt"];
4244--5637[label="1;19pkt 19fpkt"];
4244--6411[label="1;19pkt 19fpkt"];
4264--5652[label="1;39pkt 39fpkt"];
5637--6411[label="1;19pkt 19fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="152.20.28.23"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.89.27.37"/>
    </slice>
    <from sec="1123477213" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.45.80.37"/>
    </slice>
    <from sec="1123477213" usec="0"/>
    <to sec="1123478085" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.231.113.37"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.235.150.38"/>
    </slice>
    <from sec="1123477490" usec="0"/>
    <to sec="1123477679" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="201.117.146.40"/>
    </slice>
    <from sec="1123477222" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.97.234.40"/>
    </slice>
    <from sec="1123477686" usec="0"/>
    <to sec="1123477721" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="152.21.179.41"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,010,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_259{
style=filled;
color=gray75;
1695[label="219.123.36.42;s;254pkt 254fpkt", shape=diamond, color=yellow];
3303[label="219.123.36.42;254pkt 254fpkt", shape=pentagon, color=darkviolet];
stat259[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.123.36.42:*, *:139}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 139: (50%)&lt;BR/&gt; 3136: (0.19685%)&lt;BR/&gt; 3135: (0.19685%)&lt;BR/&gt; 3134: (0.19685%)&lt;BR/&gt; 3133: (0.19685%)&gt;];
}
1695--3303[label="1;254pkt 254fpkt"];
</description>
    <slice>
      <filter dst_port="139" src_ip="219.123.36.42"/>
    </slice>
    <from sec="1123477500" usec="0"/>
    <to sec="1123477525" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="204.68.185.42"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="152.21.196.42"/>
    </slice>
    <from sec="1123477218" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,020,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_262{
style=filled;
color=gray75;
717[label="202.0.47.104;d;256pkt 256fpkt", shape=diamond, color=yellow];
3316[label="158.160.169.43;68pkt 68fpkt", shape=pentagon, color=darkviolet];
stat262[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 202.0.47.104:0}[79.257%]&lt;BR/&gt;{158.160.169.43:39877, *:*}[20.743%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (79.321%)&lt;BR/&gt; 39877: (10.3395%)&lt;BR/&gt; 65299: (0.154321%)&lt;BR/&gt; 65117: (0.154321%)&lt;BR/&gt; 64435: (0.154321%)&gt;];
}
717--3316[label="0.0147059;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="158.160.169.43" src_port="39877"/>
      <filter dst_ip="202.0.47.104"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.118.172.43"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478094" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.229.209.43"/>
    </slice>
    <from sec="1123477207" usec="0"/>
    <to sec="1123477615" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.118.74.44"/>
    </slice>
    <from sec="1123477211" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.165.132.44"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.85.25.45"/>
    </slice>
    <from sec="1123477213" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="70.107.193.45"/>
    </slice>
    <from sec="1123477371" usec="0"/>
    <to sec="1123477548" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.89.57.46"/>
    </slice>
    <from sec="1123477208" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="201.89.64.46"/>
    </slice>
    <from sec="1123477646" usec="0"/>
    <to sec="1123477963" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_271{
style=filled;
color=gray75;
322[label="212.129.54.47;s;1pkt 1fpkt", shape=diamond, color=yellow];
3349[label="212.129.54.47;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat271[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.129.54.47:80, 152.21.172.75:4914}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4914: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
322--3349[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="152.21.172.75" dst_port="4914" src_ip="212.129.54.47" src_port="80"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123477276" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_272{
style=filled;
color=gray75;
1658[label="152.20.53.48;s;62pkt 62fpkt", shape=diamond, color=yellow];
3354[label="152.20.53.48;62pkt 62fpkt", shape=pentagon, color=darkviolet];
5137[label="152.20.53.48;62pkt 62fpkt", shape=invtriangle, color=brown];
6132[label="152.20.53.48;62pkt 62fpkt", shape=invhouse, color=bisque];
stat272[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.20.53.48:*, 206.92.21.54:80}[24.1935%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2197: (0.806452%)&lt;BR/&gt; 2196: (0.806452%)&lt;BR/&gt; 2195: (0.806452%)&lt;BR/&gt; 2194: (0.806452%)&gt;];
}
1658--2875[label="0.0483871;3pkt 3fpkt"];
1658--2885[label="0.016129;1pkt 1fpkt"];
1658--2899[label="0.016129;1pkt 1fpkt"];
1658--2909[label="0.016129;1pkt 1fpkt"];
1658--3354[label="1;62pkt 62fpkt"];
1658--5137[label="1;62pkt 62fpkt"];
1658--6132[label="1;62pkt 62fpkt"];
3354--5137[label="1;62pkt 62fpkt"];
3354--6132[label="1;62pkt 62fpkt"];
5137--6132[label="1;62pkt 62fpkt"];
</description>
    <slice>
      <filter dst_ip="206.92.21.54" dst_port="80" src_ip="152.20.53.48"/>
    </slice>
    <from sec="1123477235" usec="0"/>
    <to sec="1123477859" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="71.115.72.49"/>
    </slice>
    <from sec="1123477209" usec="0"/>
    <to sec="1123478088" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.203.148.49"/>
    </slice>
    <from sec="1123477226" usec="0"/>
    <to sec="1123478096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.118.167.49"/>
    </slice>
    <from sec="1123478029" usec="0"/>
    <to sec="1123478043" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="152.21.209.49"/>
    </slice>
    <from sec="1123478071" usec="0"/>
    <to sec="1123478088" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.228.75.50"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,010,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_278{
style=filled;
color=gray75;
1481[label="211.219.114.51;s;502pkt 502fpkt", shape=diamond, color=yellow];
3372[label="211.219.114.51;502pkt 502fpkt", shape=pentagon, color=darkviolet];
5147[label="211.219.114.51;502pkt 502fpkt", shape=invtriangle, color=brown];
stat278[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.219.114.51:*, *:445}[50.1992%]&lt;BR/&gt;{211.219.114.51:*, *:139}[49.8008%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (25.0996%)&lt;BR/&gt; 139: (24.9004%)&lt;BR/&gt; 3171: (0.199203%)&lt;BR/&gt; 3165: (0.199203%)&lt;BR/&gt; 3159: (0.199203%)&gt;];
}
1481--3372[label="1;502pkt 502fpkt"];
1481--5147[label="1;502pkt 502fpkt"];
3372--5147[label="1;502pkt 502fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="211.219.114.51"/>
      <filter dst_port="139" src_ip="211.219.114.51"/>
    </slice>
    <from sec="1123477463" usec="0"/>
    <to sec="1123477512" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="2.69.96.52"/>
    </slice>
    <from sec="1123477202" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="20.181.101.52"/>
    </slice>
    <from sec="1123477244" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="69.40.237.53"/>
    </slice>
    <from sec="1123477218" usec="0"/>
    <to sec="1123478059" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_283{
style=filled;
color=gray75;
1523[label="200.89.0.54;s;643pkt 643fpkt", shape=diamond, color=yellow];
3393[label="200.89.0.54;692pkt 692fpkt", shape=pentagon, color=darkviolet];
stat283[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.89.0.54:53, *:*}[99.422%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (54.382%)&lt;BR/&gt; 32768: (1.53558%)&lt;BR/&gt; 33701: (1.1236%)&lt;BR/&gt; 32769: (1.04869%)&lt;BR/&gt; 32786: (0.786517%)&gt;];
}
1523--2874[label="0.00466563;3pkt 3fpkt"];
1523--2879[label="0.00155521;1pkt 1fpkt"];
1523--2884[label="0.00622084;4pkt 4fpkt"];
1523--2893[label="0.00311042;2pkt 2fpkt"];
1523--2898[label="0.00622084;4pkt 4fpkt"];
1523--2907[label="0.00311042;2pkt 2fpkt"];
1523--2917[label="0.00311042;2pkt 2fpkt"];
1523--3393[label="1;643pkt 643fpkt"];
</description>
    <slice>
      <filter src_ip="200.89.0.54" src_port="53"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_284{
style=filled;
color=gray75;
470[label="201.117.151.54;s;214pkt 214fpkt", shape=diamond, color=yellow];
1332[label="5.71.245.144;d;37pkt 37fpkt", shape=diamond, color=yellow];
1385[label="201.242.149.108;d;1pkt 1fpkt", shape=diamond, color=yellow];
2077[label="201.117.151.50;s;13pkt 13fpkt", shape=diamond, color=yellow];
2150[label="105.202.174.147;d;9pkt 9fpkt", shape=diamond, color=yellow];
3368[label="201.117.151.50;13pkt 13fpkt", shape=pentagon, color=darkviolet];
3399[label="201.117.151.54;3pkt 3fpkt", shape=pentagon, color=darkviolet];
5159[label="201.117.151.54;239pkt 239fpkt", shape=invtriangle, color=brown];
stat284[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.117.151.54:80, *:*}[43.4615%]&lt;BR/&gt;{201.117.151.54:3168, *:53}[20.3846%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (29.8677%)&lt;BR/&gt; 53: (15.3119%)&lt;BR/&gt; 3168: (8.88469%)&lt;BR/&gt; 0: (7.3724%)&lt;BR/&gt; 32768: (0.567108%)&gt;];
}
470--863[label="0.025641;1pkt 1fpkt"];
470--1332[label="1;37pkt 37fpkt"];
470--1385[label="1;1pkt 1fpkt"];
470--1802[label="0.0105263;1pkt 1fpkt"];
470--2150[label="0.111111;1pkt 1fpkt"];
470--2588[label="0.0172414;1pkt 1fpkt"];
470--2874[label="0.0046729;1pkt 1fpkt"];
470--3399[label="0.666667;2pkt 2fpkt"];
470--5159[label="0.990654;212pkt 212fpkt"];
1332--5159[label="1;37pkt 37fpkt"];
1385--3399[label="1;1pkt 1fpkt"];
1385--5159[label="1;1pkt 1fpkt"];
2077--2150[label="0.222222;2pkt 2fpkt"];
2077--2885[label="0.0769231;1pkt 1fpkt"];
2077--2899[label="0.0769231;1pkt 1fpkt"];
2077--2909[label="0.0769231;1pkt 1fpkt"];
2077--3368[label="1;13pkt 13fpkt"];
2150--2885[label="0.111111;1pkt 1fpkt"];
2150--2899[label="0.111111;1pkt 1fpkt"];
2150--2909[label="0.111111;1pkt 1fpkt"];
2150--3368[label="0.222222;2pkt 2fpkt"];
2150--5159[label="0.111111;1pkt 1fpkt"];
3399--5159[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter src_ip="201.117.151.54" src_port="80"/>
      <filter dst_port="53" src_ip="201.117.151.54" src_port="3168"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.248.112.55"/>
    </slice>
    <from sec="1123477562" usec="0"/>
    <to sec="1123477616" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="71.201.235.57"/>
    </slice>
    <from sec="1123477234" usec="0"/>
    <to sec="1123477926" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_287{
style=filled;
color=gray75;
1584[label="201.117.159.58;s;56pkt 56fpkt", shape=diamond, color=yellow];
3430[label="201.117.159.58;57pkt 57fpkt", shape=pentagon, color=darkviolet];
5183[label="201.117.159.58;57pkt 57fpkt", shape=invtriangle, color=brown];
stat287[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.117.159.58:37602, *:*}[85.9649%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 37602: (42.9412%)&lt;BR/&gt; 443: (5.29412%)&lt;BR/&gt; 65361: (0.882353%)&lt;BR/&gt; 63206: (0.882353%)&lt;BR/&gt; 62308: (0.882353%)&gt;];
}
1584--3430[label="1;56pkt 56fpkt"];
1584--5183[label="1;56pkt 56fpkt"];
3430--5183[label="1;57pkt 57fpkt"];
</description>
    <slice>
      <filter src_ip="201.117.159.58" src_port="37602"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.118.199.58"/>
    </slice>
    <from sec="1123477780" usec="0"/>
    <to sec="1123478004" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.89.41.59"/>
    </slice>
    <from sec="1123477970" usec="0"/>
    <to sec="1123478087" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.19765,1.98557,010,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_290{
style=filled;
color=gray75;
59[label="211.44.128.60s;265pkt 265fpkt", shape=rectangle, color=red];
3443[label="211.44.128.60;353pkt 353fpkt", shape=pentagon, color=darkviolet];
stat290[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.44.128.60:*, *:139}[53.5411%]&lt;BR/&gt;{211.44.128.60:*, *:445}[46.4589%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (26.5372%)&lt;BR/&gt; 139: (23.4628%)&lt;BR/&gt; 4440: (0.161812%)&lt;BR/&gt; 4439: (0.161812%)&lt;BR/&gt; 4438: (0.161812%)&gt;];
}
59--3443[label="1;265pkt 265fpkt"];
</description>
    <slice>
      <filter dst_port="139" src_ip="211.44.128.60"/>
      <filter dst_port="445" src_ip="211.44.128.60"/>
    </slice>
    <from sec="1123477681" usec="0"/>
    <to sec="1123477723" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.184.145.60"/>
    </slice>
    <from sec="1123477208" usec="0"/>
    <to sec="1123478079" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,010,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_292{
style=filled;
color=gray75;
2244[label="10.0.1.128;d;151pkt 151fpkt", shape=diamond, color=yellow];
3455[label="172.122.136.62;109pkt 109fpkt", shape=pentagon, color=darkviolet];
3529[label="169.169.157.69;56pkt 56fpkt", shape=pentagon, color=darkviolet];
4418[label="169.169.157.180;56pkt 56fpkt", shape=pentagon, color=darkviolet];
stat292[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 10.0.1.128:6667}[31.4394%]&lt;BR/&gt;{172.122.136.62:*, 10.0.1.128:*}[30.303%]&lt;BR/&gt;{172.122.136.62:*, *:6667}[26.1364%]&lt;BR/&gt;{169.169.157.69:*, *:6667}[21.2121%]&lt;BR/&gt;{169.169.157.180:*, *:6667}[21.2121%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (34.9462%)&lt;BR/&gt; 65289: (10.2151%)&lt;BR/&gt; 7569: (4.83871%)&lt;BR/&gt; 2509: (0.537634%)&lt;BR/&gt; 4873: (0.268817%)&gt;];
}
2244--3455[label="0.66055;72pkt 72fpkt"];
2244--3529[label="0.321429;18pkt 18fpkt"];
2244--4418[label="0.321429;18pkt 18fpkt"];
</description>
    <slice>
      <filter dst_ip="10.0.1.128" src_ip="172.122.136.62"/>
      <filter dst_port="6667" src_ip="172.122.136.62"/>
      <filter dst_port="6667" src_ip="169.169.157.180"/>
      <filter dst_port="6667" src_ip="169.169.157.69"/>
      <filter dst_ip="10.0.1.128" dst_port="6667"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.97.144.62"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,001,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_294{
style=filled;
color=gray75;
651[label="214.232.98.63;s;3940pkt 3940fpkt", shape=diamond, color=yellow];
3458[label="214.232.98.63;4100pkt 4100fpkt", shape=pentagon, color=darkviolet];
5194[label="214.232.98.63;4100pkt 4100fpkt", shape=invtriangle, color=brown];
stat294[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.232.98.63:*, *:5554}[30.2654%]&lt;BR/&gt;{214.232.98.63:*, *:1023}[29.0236%]&lt;BR/&gt;{214.232.98.63:*, *:8967}[23.2286%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (15.1318%)&lt;BR/&gt; 1023: (14.5016%)&lt;BR/&gt; 8967: (11.6063%)&lt;BR/&gt; 9898: (8.7603%)&lt;BR/&gt; 2643: (0.0370675%)&gt;];
}
651--3458[label="0.998223;3933pkt 3933fpkt"];
651--5194[label="0.998223;3933pkt 3933fpkt"];
3458--5194[label="1;4100pkt 4100fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="214.232.98.63"/>
      <filter dst_port="1023" src_ip="214.232.98.63"/>
      <filter dst_port="8967" src_ip="214.232.98.63"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="152.20.106.64"/>
    </slice>
    <from sec="1123477216" usec="0"/>
    <to sec="1123478093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="64.171.235.64"/>
    </slice>
    <from sec="1123477464" usec="0"/>
    <to sec="1123477705" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_298{
style=filled;
color=gray75;
720[label="152.21.140.65;s;254pkt 254fpkt", shape=diamond, color=yellow];
3476[label="152.21.140.65;266pkt 266fpkt", shape=pentagon, color=darkviolet];
5208[label="152.21.140.65;266pkt 266fpkt", shape=invtriangle, color=brown];
stat298[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.140.65:25, *:*}[80.8271%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (48.855%)&lt;BR/&gt; 113: (0.763359%)&lt;BR/&gt; 0: (0.763359%)&lt;BR/&gt; 4898: (0.381679%)&lt;BR/&gt; 3161: (0.381679%)&gt;];
}
720--2883[label="0.011811;3pkt 3fpkt"];
720--2897[label="0.011811;3pkt 3fpkt"];
720--2908[label="0.011811;3pkt 3fpkt"];
720--3476[label="1;254pkt 254fpkt"];
720--5208[label="1;254pkt 254fpkt"];
3476--5208[label="1;266pkt 266fpkt"];
</description>
    <slice>
      <filter src_ip="152.21.140.65" src_port="25"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="201.117.153.65"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478062" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,053,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_300{
style=filled;
color=gray75;
271[label="152.21.170.170;d;37pkt 37fpkt", shape=diamond, color=yellow];
568[label="219.113.41.67;s;1pkt 1fpkt", shape=diamond, color=yellow];
3496[label="219.113.41.67;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4753[label="219.112.75.226;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5221[label="219.113.41.67;1pkt 1fpkt", shape=invtriangle, color=brown];
stat300[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.8.91.62:80, 152.21.170.170:*}[94.5946%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3659: (4.87805%)&lt;BR/&gt; 3657: (2.43902%)&lt;BR/&gt; 3658: (1.21951%)&lt;BR/&gt; 3656: (1.21951%)&gt;];
}
271--568[label="1;1pkt 1fpkt"];
271--3496[label="1;1pkt 1fpkt"];
271--4753[label="1;1pkt 1fpkt"];
271--5221[label="1;1pkt 1fpkt"];
568--3496[label="1;1pkt 1fpkt"];
568--5221[label="1;1pkt 1fpkt"];
3496--5221[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="152.21.170.170" src_ip="211.8.91.62" src_port="80"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123477392" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_301{
style=filled;
color=gray75;
490[label="98.36.235.67;s;48pkt 48fpkt", shape=diamond, color=yellow];
3504[label="98.36.235.67;48pkt 48fpkt", shape=pentagon, color=darkviolet];
stat301[shape=component, label=&lt;Rules:&lt;BR/&gt;{98.36.235.67:*, *:3127}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3127: (50%)&lt;BR/&gt; 61222: (2.08333%)&lt;BR/&gt; 64008: (1.04167%)&lt;BR/&gt; 63934: (1.04167%)&lt;BR/&gt; 63793: (1.04167%)&gt;];
}
490--3504[label="1;48pkt 48fpkt"];
</description>
    <slice>
      <filter dst_port="3127" src_ip="98.36.235.67"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123477709" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.164.70.68"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.180.85.68"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,011,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_304{
style=filled;
color=gray75;
815[label="210.126.128.68;s;1664pkt 1664fpkt", shape=diamond, color=yellow];
3511[label="210.126.128.68;2287pkt 2287fpkt", shape=pentagon, color=darkviolet];
5229[label="210.126.128.68;2287pkt 2287fpkt", shape=invtriangle, color=brown];
6188[label="210.126.128.68;2286pkt 2286fpkt", shape=invhouse, color=bisque];
stat304[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.126.128.68:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 65405: (0.0469263%)&lt;BR/&gt; 60773: (0.0469263%)&lt;BR/&gt; 60473: (0.0469263%)&lt;BR/&gt; 55635: (0.0469263%)&gt;];
}
815--3511[label="1;1664pkt 1664fpkt"];
815--5229[label="1;1664pkt 1664fpkt"];
815--6188[label="0.999399;1663pkt 1663fpkt"];
3511--5229[label="1;2287pkt 2287fpkt"];
3511--6188[label="1;2286pkt 2286fpkt"];
5229--6188[label="1;2286pkt 2286fpkt"];
</description>
    <slice>
      <filter src_ip="210.126.128.68" src_port="80"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.70.152.68"/>
    </slice>
    <from sec="1123477212" usec="0"/>
    <to sec="1123478096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.169.154.68"/>
    </slice>
    <from sec="1123477205" usec="0"/>
    <to sec="1123478014" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.122.99.69"/>
    </slice>
    <from sec="1123477211" usec="0"/>
    <to sec="1123478091" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="20.166.244.70"/>
    </slice>
    <from sec="1123477258" usec="0"/>
    <to sec="1123478093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.206.229.71"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.169.168.72"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="204.68.178.72"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.22.169.73"/>
    </slice>
    <from sec="1123477554" usec="0"/>
    <to sec="1123477567" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.52.171.73"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="71.98.57.74"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="162.94.63.74"/>
    </slice>
    <from sec="1123477267" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="2.195.81.74"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="69.15.16.78"/>
    </slice>
    <from sec="1123477599" usec="0"/>
    <to sec="1123478039" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.171.48.80"/>
    </slice>
    <from sec="1123477257" usec="0"/>
    <to sec="1123478071" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="16.148.21.81"/>
    </slice>
    <from sec="1123477226" usec="0"/>
    <to sec="1123477957" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_320{
style=filled;
color=gray75;
1387[label="71.107.48.71;d;176pkt 176fpkt", shape=diamond, color=yellow];
1388[label="152.21.172.81;s;241pkt 241fpkt", shape=diamond, color=yellow];
3626[label="152.21.172.81;272pkt 272fpkt", shape=pentagon, color=darkviolet];
5290[label="152.21.172.81;272pkt 272fpkt", shape=invtriangle, color=brown];
stat320[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.172.81:*, 71.107.48.71:80}[67.6471%]&lt;BR/&gt;{152.21.172.81:*, 71.126.136.1:80}[27.5735%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3644: (0.208117%)&lt;BR/&gt; 3643: (0.208117%)&lt;BR/&gt; 3642: (0.208117%)&lt;BR/&gt; 3641: (0.208117%)&gt;];
}
1387--1388[label="0.914773;161pkt 161fpkt"];
1387--2875[label="0.0625;11pkt 11fpkt"];
1387--2885[label="0.0568182;10pkt 10fpkt"];
1387--2899[label="0.0568182;10pkt 10fpkt"];
1387--2909[label="0.0568182;10pkt 10fpkt"];
1387--3626[label="1;176pkt 176fpkt"];
1387--5290[label="1;176pkt 176fpkt"];
1388--2580[label="0.025;1pkt 1fpkt"];
1388--2875[label="0.0456432;11pkt 11fpkt"];
1388--2885[label="0.0414938;10pkt 10fpkt"];
1388--2899[label="0.0414938;10pkt 10fpkt"];
1388--2909[label="0.0414938;10pkt 10fpkt"];
1388--3626[label="1;241pkt 241fpkt"];
1388--5290[label="1;241pkt 241fpkt"];
3626--5290[label="1;272pkt 272fpkt"];
</description>
    <slice>
      <filter dst_ip="71.107.48.71" dst_port="80" src_ip="152.21.172.81"/>
      <filter dst_ip="71.126.136.1" dst_port="80" src_ip="152.21.172.81"/>
    </slice>
    <from sec="1123477207" usec="0"/>
    <to sec="1123478092" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="71.102.235.81"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.23034,1.94842,010,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_322{
style=filled;
color=gray75;
63[label="218.58.139.82s;254pkt 254fpkt", shape=rectangle, color=red];
3632[label="218.58.139.82;254pkt 254fpkt", shape=pentagon, color=darkviolet];
5294[label="218.58.139.82;254pkt 254fpkt", shape=invtriangle, color=brown];
stat322[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.58.139.82:*, *:139}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 139: (50%)&lt;BR/&gt; 4186: (0.19685%)&lt;BR/&gt; 4185: (0.19685%)&lt;BR/&gt; 4184: (0.19685%)&lt;BR/&gt; 4183: (0.19685%)&gt;];
}
63--3632[label="1;254pkt 254fpkt"];
63--5294[label="1;254pkt 254fpkt"];
3632--5294[label="1;254pkt 254fpkt"];
</description>
    <slice>
      <filter dst_port="139" src_ip="218.58.139.82"/>
    </slice>
    <from sec="1123477421" usec="0"/>
    <to sec="1123477441" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_323{
style=filled;
color=gray75;
1214[label="158.47.71.83;s;31pkt 31fpkt", shape=diamond, color=yellow];
3640[label="158.47.71.83;31pkt 31fpkt", shape=pentagon, color=darkviolet];
stat323[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.47.71.83:*, *:80}[90.3226%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (45.1613%)&lt;BR/&gt; 143: (4.83871%)&lt;BR/&gt; 50649: (1.6129%)&lt;BR/&gt; 50648: (1.6129%)&lt;BR/&gt; 50647: (1.6129%)&gt;];
}
1214--2885[label="0.0645161;2pkt 2fpkt"];
1214--2899[label="0.0645161;2pkt 2fpkt"];
1214--2909[label="0.0645161;2pkt 2fpkt"];
1214--3640[label="1;31pkt 31fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="158.47.71.83"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478016" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="20.179.5.84"/>
    </slice>
    <from sec="1123477525" usec="0"/>
    <to sec="1123478056" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,502,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="152.20.128.84"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123477616" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="152.21.168.84"/>
    </slice>
    <from sec="1123477308" usec="0"/>
    <to sec="1123478093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_327{
style=filled;
color=gray75;
1204[label="211.140.75.85;s;2pkt 2fpkt", shape=diamond, color=yellow];
3666[label="211.140.75.85;2pkt 2fpkt", shape=pentagon, color=darkviolet];
stat327[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.140.75.85:80, 152.21.172.75:4951}[50%]&lt;BR/&gt;{211.140.75.85:80, 152.21.172.75:4952}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4952: (25%)&lt;BR/&gt; 4951: (25%)&gt;];
}
1204--3666[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="152.21.172.75" dst_port="4952" src_ip="211.140.75.85" src_port="80"/>
      <filter dst_ip="152.21.172.75" dst_port="4951" src_ip="211.140.75.85" src_port="80"/>
    </slice>
    <from sec="1123477441" usec="0"/>
    <to sec="1123477574" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.49.139.85"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.73.173.85"/>
    </slice>
    <from sec="1123477647" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="6.24.1.86"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_331{
style=filled;
color=gray75;
1624[label="193.158.119.86;s;316pkt 316fpkt", shape=diamond, color=yellow];
3680[label="193.158.119.86;343pkt 343fpkt", shape=pentagon, color=darkviolet];
stat331[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.158.119.86:*, *:3306}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3306: (50%)&lt;BR/&gt; 2493: (0.151745%)&lt;BR/&gt; 2475: (0.151745%)&lt;BR/&gt; 2474: (0.151745%)&lt;BR/&gt; 2473: (0.151745%)&gt;];
}
1624--3680[label="1;316pkt 316fpkt"];
</description>
    <slice>
      <filter dst_port="3306" src_ip="193.158.119.86"/>
    </slice>
    <from sec="1123477205" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="158.47.41.87"/>
    </slice>
    <from sec="1123477205" usec="0"/>
    <to sec="1123478091" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.70.152.87"/>
    </slice>
    <from sec="1123477215" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.42.44.88"/>
    </slice>
    <from sec="1123477207" usec="0"/>
    <to sec="1123477763" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.51.105.88"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_336{
style=filled;
color=gray75;
1416[label="172.118.133.88;s;137pkt 137fpkt", shape=diamond, color=yellow];
3706[label="172.118.133.88;137pkt 137fpkt", shape=pentagon, color=darkviolet];
stat336[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.118.133.88:*, *:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 33087: (0.364964%)&lt;BR/&gt; 33085: (0.364964%)&lt;BR/&gt; 33044: (0.364964%)&lt;BR/&gt; 33043: (0.364964%)&gt;];
}
1416--2875[label="0.0364964;5pkt 5fpkt"];
1416--2885[label="0.0729927;10pkt 10fpkt"];
1416--2899[label="0.0729927;10pkt 10fpkt"];
1416--2909[label="0.0729927;10pkt 10fpkt"];
1416--3706[label="1;137pkt 137fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="172.118.133.88"/>
    </slice>
    <from sec="1123477214" usec="0"/>
    <to sec="1123478039" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_337{
style=filled;
color=gray75;
3708[label="152.21.170.88;42pkt 42fpkt", shape=pentagon, color=darkviolet];
stat337[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.170.88:*, 205.45.80.17:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4031: (1.19048%)&lt;BR/&gt; 4030: (1.19048%)&lt;BR/&gt; 4029: (1.19048%)&lt;BR/&gt; 4025: (1.19048%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="205.45.80.17" dst_port="80" src_ip="152.21.170.88"/>
    </slice>
    <from sec="1123477213" usec="0"/>
    <to sec="1123478087" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="7.228.14.90"/>
    </slice>
    <from sec="1123477269" usec="0"/>
    <to sec="1123478029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="19.149.1.91"/>
    </slice>
    <from sec="1123477226" usec="0"/>
    <to sec="1123477379" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,504,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_341{
style=filled;
color=gray75;
446[label="172.118.133.9;s;47pkt 47fpkt", shape=diamond, color=yellow];
664[label="19.34.215.229;d;5pkt 5fpkt", shape=diamond, color=yellow];
1116[label="5.171.57.126;d;38pkt 38fpkt", shape=diamond, color=yellow];
1524[label="172.118.133.91;s;1pkt 1fpkt", shape=diamond, color=yellow];
3736[label="172.118.133.91;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5351[label="172.118.133.91;1pkt 1fpkt", shape=invtriangle, color=brown];
stat341[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.118.133.9:443, 5.171.57.126:*}[52.0833%]&lt;BR/&gt;{172.118.133.9:80, 5.171.57.126:*}[27.0833%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (26.8817%)&lt;BR/&gt; 80: (20.9677%)&lt;BR/&gt; 1049: (2.15054%)&lt;BR/&gt; 113: (2.15054%)&lt;BR/&gt; 1162: (1.07527%)&gt;];
}
446--664[label="0.8;4pkt 4fpkt"];
446--1116[label="1;38pkt 38fpkt"];
664--1524[label="1;1pkt 1fpkt"];
664--3736[label="1;1pkt 1fpkt"];
664--5351[label="1;1pkt 1fpkt"];
1524--3736[label="1;1pkt 1fpkt"];
1524--5351[label="1;1pkt 1fpkt"];
3736--5351[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="5.171.57.126" src_ip="172.118.133.9" src_port="443"/>
      <filter dst_ip="5.171.57.126" src_ip="172.118.133.9" src_port="80"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="152.20.140.91"/>
    </slice>
    <from sec="1123477496" usec="0"/>
    <to sec="1123477893" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="170.88.236.91"/>
    </slice>
    <from sec="1123477406" usec="0"/>
    <to sec="1123477978" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.175.251.91"/>
    </slice>
    <from sec="1123477904" usec="0"/>
    <to sec="1123477927" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="2.51.255.92"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="6.122.28.93"/>
    </slice>
    <from sec="1123477212" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,501,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_348{
style=filled;
color=gray75;
223[label="201.117.149.16;d;32pkt 32fpkt", shape=diamond, color=yellow];
224[label="218.49.210.79;s;3pkt 3fpkt", shape=diamond, color=yellow];
670[label="201.117.145.106;d;79pkt 79fpkt", shape=diamond, color=yellow];
751[label="211.164.3.94;s;1pkt 1fpkt", shape=diamond, color=yellow];
790[label="219.57.143.218;s;5pkt 5fpkt", shape=diamond, color=yellow];
1012[label="201.68.41.35;s;7pkt 7fpkt", shape=diamond, color=yellow];
1192[label="4.228.75.50;s;1pkt 1fpkt", shape=diamond, color=yellow];
3243[label="201.68.41.35;7pkt 7fpkt", shape=pentagon, color=darkviolet];
3757[label="211.164.3.94;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5080[label="201.68.41.35;6pkt 6fpkt", shape=invtriangle, color=brown];
5143[label="4.228.75.50;1pkt 1fpkt", shape=invtriangle, color=brown];
stat348[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, *:21}[25.2252%]&lt;BR/&gt;{200.186.66.95:*, 201.117.149.16:*}[24.3243%]&lt;BR/&gt;{*:*, 201.117.145.106:80}[22.5225%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (15.7343%)&lt;BR/&gt; 21: (10.4895%)&lt;BR/&gt; 33436: (7.69231%)&lt;BR/&gt; 20: (4.1958%)&lt;BR/&gt; 0: (3.4965%)&gt;];
}
223--224[label="1;3pkt 3fpkt"];
223--790[label="0.2;1pkt 1fpkt"];
670--751[label="1;1pkt 1fpkt"];
670--790[label="0.8;4pkt 4fpkt"];
670--1012[label="1;7pkt 7fpkt"];
670--1192[label="1;1pkt 1fpkt"];
670--2875[label="0.0759494;6pkt 6fpkt"];
670--2885[label="0.0632911;5pkt 5fpkt"];
670--2899[label="0.0632911;5pkt 5fpkt"];
670--2909[label="0.0632911;5pkt 5fpkt"];
670--3243[label="1;7pkt 7fpkt"];
670--3757[label="1;1pkt 1fpkt"];
670--4271[label="0.0126582;1pkt 1fpkt"];
670--4709[label="1;3pkt 3fpkt"];
670--5080[label="1;6pkt 6fpkt"];
670--5143[label="1;1pkt 1fpkt"];
670--5657[label="0.0126582;1pkt 1fpkt"];
751--3757[label="1;1pkt 1fpkt"];
1012--2875[label="0.428571;3pkt 3fpkt"];
1012--2885[label="0.142857;1pkt 1fpkt"];
1012--2899[label="0.142857;1pkt 1fpkt"];
1012--2909[label="0.142857;1pkt 1fpkt"];
1012--3243[label="1;7pkt 7fpkt"];
1012--5080[label="1;6pkt 6fpkt"];
1192--5143[label="1;1pkt 1fpkt"];
3243--5080[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_port="21"/>
      <filter dst_ip="201.117.149.16" src_ip="200.186.66.95"/>
      <filter dst_ip="201.117.145.106" dst_port="80"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.225.25.95"/>
    </slice>
    <from sec="1123477206" usec="0"/>
    <to sec="1123478081" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="2.193.36.95"/>
    </slice>
    <from sec="1123477554" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.230.137.95"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="158.160.144.95"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_353{
style=filled;
color=gray75;
2484[label="208.70.152.95;s;16pkt 16fpkt", shape=diamond, color=yellow];
3769[label="208.70.152.95;16pkt 16fpkt", shape=pentagon, color=darkviolet];
5369[label="208.70.152.95;16pkt 16fpkt", shape=invtriangle, color=brown];
6273[label="208.70.152.95;15pkt 15fpkt", shape=invhouse, color=bisque];
stat353[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.70.152.95:5050, *:*}[81.25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5050: (41.2698%)&lt;BR/&gt; 20: (6.34921%)&lt;BR/&gt; 2116: (3.1746%)&lt;BR/&gt; 1724: (3.1746%)&lt;BR/&gt; 1610: (3.1746%)&gt;];
}
2484--3769[label="1;16pkt 16fpkt"];
2484--5369[label="1;16pkt 16fpkt"];
2484--6273[label="1;15pkt 15fpkt"];
3769--5369[label="1;16pkt 16fpkt"];
3769--6273[label="1;15pkt 15fpkt"];
5369--6273[label="1;15pkt 15fpkt"];
</description>
    <slice>
      <filter src_ip="208.70.152.95" src_port="5050"/>
    </slice>
    <from sec="1123477202" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_354{
style=filled;
color=gray75;
251[label="200.89.24.204;d;3055pkt 3055fpkt", shape=diamond, color=yellow];
1178[label="211.210.170.92;s;2pkt 2fpkt", shape=diamond, color=yellow];
1690[label="1.229.246.98;s;10pkt 10fpkt", shape=diamond, color=yellow];
1701[label="4.45.3.158;s;6pkt 6fpkt", shape=diamond, color=yellow];
1897[label="4.51.8.232;s;169pkt 169fpkt", shape=diamond, color=yellow];
2363[label="204.41.2.211;s;16pkt 16fpkt", shape=diamond, color=yellow];
2385[label="1.246.116.110;s;9pkt 9fpkt", shape=diamond, color=yellow];
2392[label="4.51.9.77;s;31pkt 31fpkt", shape=diamond, color=yellow];
2604[label="6.24.6.180;s;21pkt 21fpkt", shape=diamond, color=yellow];
2615[label="4.113.176.228;s;11pkt 11fpkt", shape=diamond, color=yellow];
2928[label="1.186.18.1;2pkt 2fpkt", shape=pentagon, color=darkviolet];
3077[label="5.160.155.16;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3202[label="1.186.18.32;14pkt 14fpkt", shape=pentagon, color=darkviolet];
3384[label="217.128.133.52;4pkt 4fpkt", shape=pentagon, color=darkviolet];
3600[label="208.84.172.76;34pkt 34fpkt", shape=pentagon, color=darkviolet];
3606[label="208.84.172.78;46pkt 46fpkt", shape=pentagon, color=darkviolet];
3761[label="220.201.205.94;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3798[label="1.229.246.98;9pkt 9fpkt", shape=pentagon, color=darkviolet];
3889[label="6.168.108.110;10pkt 10fpkt", shape=pentagon, color=darkviolet];
3890[label="1.246.116.110;8pkt 8fpkt", shape=pentagon, color=darkviolet];
3910[label="69.30.195.112;12pkt 12fpkt", shape=pentagon, color=darkviolet];
3980[label="208.209.202.123;16pkt 16fpkt", shape=pentagon, color=darkviolet];
4025[label="16.141.232.129;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4026[label="200.164.70.130;29pkt 29fpkt", shape=pentagon, color=darkviolet];
4111[label="6.168.49.139;7pkt 7fpkt", shape=pentagon, color=darkviolet];
4176[label="4.1.64.147;17pkt 17fpkt", shape=pentagon, color=darkviolet];
4234[label="4.45.3.158;13pkt 13fpkt", shape=pentagon, color=darkviolet];
4256[label="6.24.52.161;12pkt 12fpkt", shape=pentagon, color=darkviolet];
4303[label="6.24.52.165;6pkt 6fpkt", shape=pentagon, color=darkviolet];
4359[label="6.24.0.173;43pkt 43fpkt", shape=pentagon, color=darkviolet];
4410[label="6.24.6.180;20pkt 20fpkt", shape=pentagon, color=darkviolet];
4438[label="217.128.133.183;13pkt 13fpkt", shape=pentagon, color=darkviolet];
4503[label="1.246.100.192;23pkt 23fpkt", shape=pentagon, color=darkviolet];
4617[label="200.164.69.208;10pkt 10fpkt", shape=pentagon, color=darkviolet];
4650[label="204.41.2.211;32pkt 32fpkt", shape=pentagon, color=darkviolet];
4712[label="6.240.88.222;17pkt 17fpkt", shape=pentagon, color=darkviolet];
4746[label="69.36.121.225;4pkt 4fpkt", shape=pentagon, color=darkviolet];
4770[label="4.113.176.228;10pkt 10fpkt", shape=pentagon, color=darkviolet];
4792[label="4.51.8.232;168pkt 168fpkt", shape=pentagon, color=darkviolet];
4914[label="1.186.18.1;1pkt 1fpkt", shape=invtriangle, color=brown];
4992[label="5.160.155.16;1pkt 1fpkt", shape=invtriangle, color=brown];
5057[label="1.186.18.32;14pkt 14fpkt", shape=invtriangle, color=brown];
5154[label="217.128.133.52;4pkt 4fpkt", shape=invtriangle, color=brown];
5271[label="208.84.172.76;34pkt 34fpkt", shape=invtriangle, color=brown];
5389[label="1.229.246.98;9pkt 9fpkt", shape=invtriangle, color=brown];
5444[label="6.168.108.110;10pkt 10fpkt", shape=invtriangle, color=brown];
5455[label="69.30.195.112;12pkt 12fpkt", shape=invtriangle, color=brown];
5492[label="208.209.202.123;16pkt 16fpkt", shape=invtriangle, color=brown];
5565[label="6.168.49.139;7pkt 7fpkt", shape=invtriangle, color=brown];
5600[label="4.1.64.147;17pkt 17fpkt", shape=invtriangle, color=brown];
5648[label="6.24.52.161;12pkt 12fpkt", shape=invtriangle, color=brown];
5671[label="6.24.52.165;6pkt 6fpkt", shape=invtriangle, color=brown];
5700[label="6.24.0.173;43pkt 43fpkt", shape=invtriangle, color=brown];
5745[label="217.128.133.183;13pkt 13fpkt", shape=invtriangle, color=brown];
5925[label="4.51.8.232;168pkt 168fpkt", shape=invtriangle, color=brown];
5998[label="1.186.18.1;1pkt 1fpkt", shape=invhouse, color=bisque];
6048[label="5.160.155.16;1pkt 1fpkt", shape=invhouse, color=bisque];
6083[label="1.186.18.32;14pkt 14fpkt", shape=invhouse, color=bisque];
6142[label="217.128.133.52;4pkt 4fpkt", shape=invhouse, color=bisque];
6215[label="208.84.172.76;33pkt 33fpkt", shape=invhouse, color=bisque];
6316[label="6.168.108.110;10pkt 10fpkt", shape=invhouse, color=bisque];
6321[label="69.30.195.112;12pkt 12fpkt", shape=invhouse, color=bisque];
6342[label="208.209.202.123;16pkt 16fpkt", shape=invhouse, color=bisque];
6391[label="4.1.64.147;17pkt 17fpkt", shape=invhouse, color=bisque];
6416[label="6.24.52.161;12pkt 12fpkt", shape=invhouse, color=bisque];
6430[label="6.24.52.165;6pkt 6fpkt", shape=invhouse, color=bisque];
stat354[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 200.89.24.204:*}[37.7877%]&lt;BR/&gt;{*:6346, 200.89.24.204:50200}[21.4514%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (28.2066%)&lt;BR/&gt; 50200: (16.8445%)&lt;BR/&gt; 6346: (8.98978%)&lt;BR/&gt; 0: (3.65494%)&lt;BR/&gt; 6348: (3.63224%)&gt;];
}
251--449[label="0.0275229;3pkt 3fpkt"];
251--687[label="0.0418719;17pkt 17fpkt"];
251--722[label="0.0119048;1pkt 1fpkt"];
251--843[label="0.163265;8pkt 8fpkt"];
251--1038[label="0.0763889;11pkt 11fpkt"];
251--1130[label="0.216216;8pkt 8fpkt"];
251--1178[label="1;2pkt 2fpkt"];
251--1236[label="0.0894632;45pkt 45fpkt"];
251--1308[label="0.00429185;1pkt 1fpkt"];
251--1522[label="0.0217391;9pkt 9fpkt"];
251--1535[label="0.013245;2pkt 2fpkt"];
251--1548[label="0.047619;1pkt 1fpkt"];
251--1690[label="1;10pkt 10fpkt"];
251--1701[label="1;6pkt 6fpkt"];
251--1781[label="0.037037;1pkt 1fpkt"];
251--1825[label="0.336957;31pkt 31fpkt"];
251--1897[label="1;169pkt 169fpkt"];
251--2082[label="0.168317;17pkt 17fpkt"];
251--2305[label="0.0116732;3pkt 3fpkt"];
251--2363[label="0.75;12pkt 12fpkt"];
251--2385[label="1;9pkt 9fpkt"];
251--2392[label="1;31pkt 31fpkt"];
251--2604[label="1;21pkt 21fpkt"];
251--2615[label="1;11pkt 11fpkt"];
251--2876[label="0.0006035;1pkt 1fpkt"];
251--2928[label="0.5;1pkt 1fpkt"];
251--2981[label="0.0909091;1pkt 1fpkt"];
251--3053[label="0.111111;2pkt 2fpkt"];
251--3077[label="1;1pkt 1fpkt"];
251--3113[label="0.031746;2pkt 2fpkt"];
251--3202[label="1;14pkt 14fpkt"];
251--3284[label="0.161905;17pkt 17fpkt"];
251--3355[label="0.0555556;1pkt 1fpkt"];
251--3384[label="1;4pkt 4fpkt"];
251--3494[label="0.0444444;2pkt 2fpkt"];
251--3600[label="0.735294;25pkt 25fpkt"];
251--3606[label="0.434783;20pkt 20fpkt"];
251--3645[label="0.05;2pkt 2fpkt"];
251--3749[label="0.047619;1pkt 1fpkt"];
251--3760[label="0.0555556;1pkt 1fpkt"];
251--3761[label="1;1pkt 1fpkt"];
251--3793[label="0.037037;1pkt 1fpkt"];
251--3798[label="1;9pkt 9fpkt"];
251--3889[label="1;10pkt 10fpkt"];
251--3890[label="1;8pkt 8fpkt"];
251--3910[label="1;12pkt 12fpkt"];
251--3951[label="0.142857;3pkt 3fpkt"];
251--3974[label="0.333333;31pkt 31fpkt"];
251--3980[label="0.5625;9pkt 9fpkt"];
251--4025[label="1;1pkt 1fpkt"];
251--4026[label="1;29pkt 29fpkt"];
251--4029[label="0.333333;6pkt 6fpkt"];
251--4098[label="0.0952381;2pkt 2fpkt"];
251--4111[label="1;7pkt 7fpkt"];
251--4176[label="1;17pkt 17fpkt"];
251--4179[label="0.125;2pkt 2fpkt"];
251--4234[label="1;13pkt 13fpkt"];
251--4256[label="1;12pkt 12fpkt"];
251--4303[label="1;6pkt 6fpkt"];
251--4305[label="0.00636943;1pkt 1fpkt"];
251--4333[label="0.0224719;2pkt 2fpkt"];
251--4359[label="0.651163;28pkt 28fpkt"];
251--4410[label="1;20pkt 20fpkt"];
251--4438[label="1;13pkt 13fpkt"];
251--4503[label="1;23pkt 23fpkt"];
251--4520[label="0.021978;2pkt 2fpkt"];
251--4601[label="0.163265;8pkt 8fpkt"];
251--4617[label="1;10pkt 10fpkt"];
251--4650[label="0.59375;19pkt 19fpkt"];
251--4712[label="0.882353;15pkt 15fpkt"];
251--4746[label="1;4pkt 4fpkt"];
251--4770[label="1;10pkt 10fpkt"];
251--4792[label="1;168pkt 168fpkt"];
251--4840[label="0.039261;17pkt 17fpkt"];
251--4942[label="0.1;1pkt 1fpkt"];
251--4992[label="1;1pkt 1fpkt"];
251--5010[label="0.031746;2pkt 2fpkt"];
251--5057[label="1;14pkt 14fpkt"];
251--5101[label="0.161905;17pkt 17fpkt"];
251--5138[label="0.0555556;1pkt 1fpkt"];
251--5154[label="1;4pkt 4fpkt"];
251--5218[label="0.0444444;2pkt 2fpkt"];
251--5271[label="0.735294;25pkt 25fpkt"];
251--5357[label="0.047619;1pkt 1fpkt"];
251--5365[label="0.0555556;1pkt 1fpkt"];
251--5389[label="1;9pkt 9fpkt"];
251--5444[label="1;10pkt 10fpkt"];
251--5455[label="1;12pkt 12fpkt"];
251--5477[label="0.142857;3pkt 3fpkt"];
251--5488[label="0.333333;31pkt 31fpkt"];
251--5492[label="0.5625;9pkt 9fpkt"];
251--5565[label="1;7pkt 7fpkt"];
251--5600[label="1;17pkt 17fpkt"];
251--5648[label="1;12pkt 12fpkt"];
251--5671[label="1;6pkt 6fpkt"];
251--5673[label="0.00636943;1pkt 1fpkt"];
251--5690[label="0.0224719;2pkt 2fpkt"];
251--5700[label="0.651163;28pkt 28fpkt"];
251--5745[label="1;13pkt 13fpkt"];
251--5786[label="0.021978;2pkt 2fpkt"];
251--5925[label="1;168pkt 168fpkt"];
251--5953[label="0.039261;17pkt 17fpkt"];
251--6016[label="0.1;1pkt 1fpkt"];
251--6048[label="1;1pkt 1fpkt"];
251--6058[label="0.031746;2pkt 2fpkt"];
251--6083[label="1;14pkt 14fpkt"];
251--6133[label="0.0588235;1pkt 1fpkt"];
251--6142[label="1;4pkt 4fpkt"];
251--6178[label="0.0444444;2pkt 2fpkt"];
251--6215[label="0.757576;25pkt 25fpkt"];
251--6270[label="0.0588235;1pkt 1fpkt"];
251--6316[label="1;10pkt 10fpkt"];
251--6321[label="1;12pkt 12fpkt"];
251--6334[label="0.142857;3pkt 3fpkt"];
251--6342[label="0.5625;9pkt 9fpkt"];
251--6391[label="1;17pkt 17fpkt"];
251--6416[label="1;12pkt 12fpkt"];
251--6430[label="1;6pkt 6fpkt"];
251--6487[label="0.021978;2pkt 2fpkt"];
1690--3798[label="1;9pkt 9fpkt"];
1690--5389[label="1;9pkt 9fpkt"];
1701--4234[label="1;6pkt 6fpkt"];
1897--4792[label="1;168pkt 168fpkt"];
1897--5925[label="1;168pkt 168fpkt"];
2363--4650[label="1;16pkt 16fpkt"];
2385--3890[label="1;8pkt 8fpkt"];
2604--4410[label="1;20pkt 20fpkt"];
2615--4770[label="1;10pkt 10fpkt"];
2928--4914[label="1;1pkt 1fpkt"];
2928--5998[label="1;1pkt 1fpkt"];
3077--4992[label="1;1pkt 1fpkt"];
3077--6048[label="1;1pkt 1fpkt"];
3202--5057[label="1;14pkt 14fpkt"];
3202--6083[label="1;14pkt 14fpkt"];
3384--5154[label="1;4pkt 4fpkt"];
3384--6142[label="1;4pkt 4fpkt"];
3600--5271[label="1;34pkt 34fpkt"];
3600--6215[label="1;33pkt 33fpkt"];
3798--5389[label="1;9pkt 9fpkt"];
3889--5444[label="1;10pkt 10fpkt"];
3889--6316[label="1;10pkt 10fpkt"];
3910--5455[label="1;12pkt 12fpkt"];
3910--6321[label="1;12pkt 12fpkt"];
3980--5492[label="1;16pkt 16fpkt"];
3980--6342[label="1;16pkt 16fpkt"];
4111--5565[label="1;7pkt 7fpkt"];
4176--5600[label="1;17pkt 17fpkt"];
4176--6391[label="1;17pkt 17fpkt"];
4256--5648[label="1;12pkt 12fpkt"];
4256--6416[label="1;12pkt 12fpkt"];
4303--5671[label="1;6pkt 6fpkt"];
4303--6430[label="1;6pkt 6fpkt"];
4359--5700[label="1;43pkt 43fpkt"];
4438--5745[label="1;13pkt 13fpkt"];
4792--5925[label="1;168pkt 168fpkt"];
4914--5998[label="1;1pkt 1fpkt"];
4992--6048[label="1;1pkt 1fpkt"];
5057--6083[label="1;14pkt 14fpkt"];
5154--6142[label="1;4pkt 4fpkt"];
5271--6215[label="1;33pkt 33fpkt"];
5444--6316[label="1;10pkt 10fpkt"];
5455--6321[label="1;12pkt 12fpkt"];
5492--6342[label="1;16pkt 16fpkt"];
5600--6391[label="1;17pkt 17fpkt"];
5648--6416[label="1;12pkt 12fpkt"];
5671--6430[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="200.89.24.204" src_port="80"/>
      <filter dst_ip="200.89.24.204" dst_port="50200" src_port="6346"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_355{
style=filled;
color=gray75;
3800[label="200.52.113.99;90pkt 90fpkt", shape=pentagon, color=darkviolet];
stat355[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.52.113.99:*, *:1433}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1433: (50%)&lt;BR/&gt; 4520: (1.66667%)&lt;BR/&gt; 4980: (0.555556%)&lt;BR/&gt; 4942: (0.555556%)&lt;BR/&gt; 4757: (0.555556%)&gt;];
}
</description>
    <slice>
      <filter dst_port="1433" src_ip="200.52.113.99"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478085" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="7.160.140.99"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478084" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="158.160.97.100"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="20.173.125.100"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_359{
style=filled;
color=gray75;
940[label="217.163.131.14;d;23pkt 23fpkt", shape=diamond, color=yellow];
941[label="152.21.164.100;s;25pkt 25fpkt", shape=diamond, color=yellow];
3811[label="152.21.164.100;28pkt 28fpkt", shape=pentagon, color=darkviolet];
5395[label="152.21.164.100;28pkt 28fpkt", shape=invtriangle, color=brown];
6289[label="152.21.164.100;27pkt 27fpkt", shape=invhouse, color=bisque];
stat359[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.164.100:*, 217.163.131.14:80}[89.2857%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.855%)&lt;BR/&gt; 1288: (1.9084%)&lt;BR/&gt; 1287: (1.9084%)&lt;BR/&gt; 1286: (1.9084%)&lt;BR/&gt; 1285: (1.9084%)&gt;];
}
940--941[label="1;23pkt 23fpkt"];
940--2875[label="0.0869565;2pkt 2fpkt"];
940--3811[label="1;23pkt 23fpkt"];
940--5395[label="1;23pkt 23fpkt"];
940--6289[label="1;23pkt 23fpkt"];
941--2875[label="0.08;2pkt 2fpkt"];
941--3811[label="1;25pkt 25fpkt"];
941--5395[label="1;25pkt 25fpkt"];
941--6289[label="0.96;24pkt 24fpkt"];
3811--5395[label="1;28pkt 28fpkt"];
3811--6289[label="1;27pkt 27fpkt"];
5395--6289[label="1;27pkt 27fpkt"];
</description>
    <slice>
      <filter dst_ip="217.163.131.14" dst_port="80" src_ip="152.21.164.100"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123477564" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="0.134.211.100"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="71.97.2.101"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123477316" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.19765,1.98557,002,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_362{
style=filled;
color=gray75;
41[label="71.37.196.101s;64pkt 64fpkt", shape=rectangle, color=red];
3823[label="71.37.196.101;255pkt 255fpkt", shape=pentagon, color=darkviolet];
stat362[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.37.196.101:1092, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1092: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
41--3823[label="1;64pkt 64fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="71.37.196.101" src_port="1092"/>
    </slice>
    <from sec="1123477375" usec="0"/>
    <to sec="1123477399" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="18.227.200.102"/>
    </slice>
    <from sec="1123477435" usec="0"/>
    <to sec="1123478001" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,020,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_364{
style=filled;
color=gray75;
972[label="202.0.47.104;s;256pkt 256fpkt", shape=diamond, color=yellow];
3841[label="202.0.47.104;256pkt 256fpkt", shape=pentagon, color=darkviolet];
5415[label="202.0.47.104;256pkt 256fpkt", shape=invtriangle, color=brown];
stat364[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.0.47.104:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
972--3841[label="1;256pkt 256fpkt"];
972--5415[label="1;256pkt 256fpkt"];
3841--5415[label="1;256pkt 256fpkt"];
</description>
    <slice>
      <filter src_ip="202.0.47.104"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="71.100.73.104"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="3.19.167.104"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_367{
style=filled;
color=gray75;
1465[label="152.21.198.104;s;150pkt 150fpkt", shape=diamond, color=yellow];
3849[label="152.21.198.104;172pkt 172fpkt", shape=pentagon, color=darkviolet];
5420[label="152.21.198.104;172pkt 172fpkt", shape=invtriangle, color=brown];
stat367[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.198.104:*, *:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3349: (0.303644%)&lt;BR/&gt; 3348: (0.303644%)&lt;BR/&gt; 3346: (0.303644%)&lt;BR/&gt; 3345: (0.303644%)&gt;];
}
1465--1819[label="0.0864198;7pkt 7fpkt"];
1465--1980[label="0.0165289;2pkt 2fpkt"];
1465--2885[label="0.113333;17pkt 17fpkt"];
1465--2899[label="0.113333;17pkt 17fpkt"];
1465--2909[label="0.113333;17pkt 17fpkt"];
1465--3849[label="1;150pkt 150fpkt"];
1465--5420[label="1;150pkt 150fpkt"];
3849--5420[label="1;172pkt 172fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="152.21.198.104"/>
    </slice>
    <from sec="1123477385" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.118.216.104"/>
    </slice>
    <from sec="1123478001" usec="0"/>
    <to sec="1123478020" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,020,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_369{
style=filled;
color=gray75;
2589[label="71.149.170.105;s;210pkt 210fpkt", shape=diamond, color=yellow];
3860[label="71.149.170.105;294pkt 294fpkt", shape=pentagon, color=darkviolet];
stat369[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.149.170.105:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2589--3860[label="1;210pkt 210fpkt"];
</description>
    <slice>
      <filter src_ip="71.149.170.105"/>
    </slice>
    <from sec="1123477247" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="170.57.177.106"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="71.83.130.107"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.43.6.108"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="201.242.149.108"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="20.153.57.110"/>
    </slice>
    <from sec="1123477206" usec="0"/>
    <to sec="1123478090" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="17.224.193.110"/>
    </slice>
    <from sec="1123477381" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.140.113.112"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123477795" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="71.89.150.112"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478064" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.169.175.112"/>
    </slice>
    <from sec="1123477242" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="158.160.76.114"/>
    </slice>
    <from sec="1123477212" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_381{
style=filled;
color=gray75;
315[label="132.117.40.213;d;39pkt 39fpkt", shape=diamond, color=yellow];
316[label="211.205.139.105;s;3pkt 3fpkt", shape=diamond, color=yellow];
435[label="211.179.20.216;s;1pkt 1fpkt", shape=diamond, color=yellow];
436[label="211.169.76.229;s;12pkt 12fpkt", shape=diamond, color=yellow];
649[label="71.74.198.67;s;3pkt 3fpkt", shape=diamond, color=yellow];
682[label="71.83.130.107;s;1pkt 1fpkt", shape=diamond, color=yellow];
695[label="215.221.28.110;s;1pkt 1fpkt", shape=diamond, color=yellow];
813[label="211.181.149.114;s;2pkt 2fpkt", shape=diamond, color=yellow];
1254[label="212.195.223.248;s;5pkt 5fpkt", shape=diamond, color=yellow];
1530[label="200.137.13.135;s;1pkt 1fpkt", shape=diamond, color=yellow];
3502[label="71.74.198.67;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3859[label="211.205.139.105;3pkt 3fpkt", shape=pentagon, color=darkviolet];
3883[label="215.221.28.110;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3923[label="211.181.149.114;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4068[label="200.137.13.135;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4486[label="212.37.226.190;8pkt 8fpkt", shape=pentagon, color=darkviolet];
5426[label="211.205.139.105;3pkt 3fpkt", shape=invtriangle, color=brown];
5464[label="211.181.149.114;2pkt 2fpkt", shape=invtriangle, color=brown];
6185[label="71.74.198.67;2pkt 2fpkt", shape=invhouse, color=bisque];
6327[label="211.181.149.114;2pkt 2fpkt", shape=invhouse, color=bisque];
stat381[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.169.76.229:*, 132.117.40.213:*}[30.7692%]&lt;BR/&gt;{212.37.226.190:*, 132.117.40.213:*}[23.0769%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8021: (4.83871%)&lt;BR/&gt; 65001: (3.22581%)&lt;BR/&gt; 9988: (3.22581%)&lt;BR/&gt; 8020: (3.22581%)&lt;BR/&gt; 4321: (2.68817%)&gt;];
}
315--316[label="1;3pkt 3fpkt"];
315--435[label="1;1pkt 1fpkt"];
315--436[label="1;12pkt 12fpkt"];
315--649[label="1;3pkt 3fpkt"];
315--682[label="1;1pkt 1fpkt"];
315--695[label="1;1pkt 1fpkt"];
315--813[label="1;2pkt 2fpkt"];
315--1254[label="1;5pkt 5fpkt"];
315--1530[label="1;1pkt 1fpkt"];
315--3502[label="1;1pkt 1fpkt"];
315--3859[label="1;3pkt 3fpkt"];
315--3883[label="1;1pkt 1fpkt"];
315--3923[label="1;2pkt 2fpkt"];
315--4068[label="1;1pkt 1fpkt"];
315--4486[label="1;8pkt 8fpkt"];
315--5426[label="1;3pkt 3fpkt"];
315--5464[label="1;2pkt 2fpkt"];
315--6185[label="1;2pkt 2fpkt"];
315--6327[label="1;2pkt 2fpkt"];
316--3859[label="1;3pkt 3fpkt"];
316--5426[label="1;3pkt 3fpkt"];
649--3502[label="1;1pkt 1fpkt"];
649--6185[label="1;2pkt 2fpkt"];
695--3883[label="1;1pkt 1fpkt"];
813--3923[label="1;2pkt 2fpkt"];
813--5464[label="1;2pkt 2fpkt"];
813--6327[label="1;2pkt 2fpkt"];
1530--4068[label="1;1pkt 1fpkt"];
3502--6185[label="1;1pkt 1fpkt"];
3859--5426[label="1;3pkt 3fpkt"];
3923--5464[label="1;2pkt 2fpkt"];
3923--6327[label="1;2pkt 2fpkt"];
5464--6327[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="132.117.40.213" src_ip="211.169.76.229"/>
      <filter dst_ip="132.117.40.213" src_ip="212.37.226.190"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.176.160.114"/>
    </slice>
    <from sec="1123477887" usec="0"/>
    <to sec="1123478016" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="158.160.15.115"/>
    </slice>
    <from sec="1123477209" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_384{
style=filled;
color=gray75;
3931[label="70.211.52.116;22pkt 22fpkt", shape=pentagon, color=darkviolet];
stat384[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.211.52.116:*, 158.189.5.156:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 10249: (2.27273%)&lt;BR/&gt; 10245: (2.27273%)&lt;BR/&gt; 10242: (2.27273%)&lt;BR/&gt; 10239: (2.27273%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="158.189.5.156" dst_port="80" src_ip="70.211.52.116"/>
    </slice>
    <from sec="1123477568" usec="0"/>
    <to sec="1123478086" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.164.172.117"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.70.152.118"/>
    </slice>
    <from sec="1123477209" usec="0"/>
    <to sec="1123478096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.169.147.120"/>
    </slice>
    <from sec="1123477258" usec="0"/>
    <to sec="1123478078" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="71.6.246.120"/>
    </slice>
    <from sec="1123477202" usec="0"/>
    <to sec="1123477838" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="70.136.73.121"/>
    </slice>
    <from sec="1123477202" usec="0"/>
    <to sec="1123477970" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,001,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_391{
style=filled;
color=gray75;
396[label="215.47.116.121;s;2845pkt 2845fpkt", shape=diamond, color=yellow];
3968[label="215.47.116.121;2834pkt 2834fpkt", shape=pentagon, color=darkviolet];
5485[label="215.47.116.121;2834pkt 2834fpkt", shape=invtriangle, color=brown];
stat391[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.47.116.121:*, *:5554}[30.123%]&lt;BR/&gt;{215.47.116.121:*, *:1023}[29.4903%]&lt;BR/&gt;{215.47.116.121:*, *:8967}[22.1793%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (15.0652%)&lt;BR/&gt; 1023: (14.7363%)&lt;BR/&gt; 8967: (11.0948%)&lt;BR/&gt; 9898: (9.0861%)&lt;BR/&gt; 4483: (0.0881006%)&gt;];
}
396--3968[label="1;2834pkt 2834fpkt"];
396--5485[label="1;2834pkt 2834fpkt"];
3968--5485[label="1;2834pkt 2834fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="215.47.116.121"/>
      <filter dst_port="1023" src_ip="215.47.116.121"/>
      <filter dst_port="8967" src_ip="215.47.116.121"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123477903" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="70.138.49.123"/>
    </slice>
    <from sec="1123477367" usec="0"/>
    <to sec="1123477693" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_393{
style=filled;
color=gray75;
2451[label="21.84.57.128;s;31pkt 31fpkt", shape=diamond, color=yellow];
4005[label="21.84.57.128;31pkt 31fpkt", shape=pentagon, color=darkviolet];
stat393[shape=component, label=&lt;Rules:&lt;BR/&gt;{21.84.57.128:*, 201.117.152.96:56280}[32.2581%]&lt;BR/&gt;{21.84.57.128:*, 201.117.146.149:54045}[25.8065%]&lt;BR/&gt;{21.84.57.128:*, 172.118.161.90:18076}[22.5806%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 56280: (16.129%)&lt;BR/&gt; 54045: (12.9032%)&lt;BR/&gt; 18076: (11.2903%)&lt;BR/&gt; 39219: (8.06452%)&lt;BR/&gt; 50269: (1.6129%)&gt;];
}
2451--4005[label="1;31pkt 31fpkt"];
</description>
    <slice>
      <filter dst_ip="201.117.152.96" dst_port="56280" src_ip="21.84.57.128"/>
      <filter dst_ip="201.117.146.149" dst_port="54045" src_ip="21.84.57.128"/>
      <filter dst_ip="172.118.161.90" dst_port="18076" src_ip="21.84.57.128"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="201.27.106.128"/>
    </slice>
    <from sec="1123477305" usec="0"/>
    <to sec="1123477368" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.218.174.128"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="1.214.167.130"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="70.201.214.130"/>
    </slice>
    <from sec="1123477298" usec="0"/>
    <to sec="1123477358" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_398{
style=filled;
color=gray75;
4032[label="6.12.37.131;10pkt 10fpkt", shape=pentagon, color=darkviolet];
stat398[shape=component, label=&lt;Rules:&lt;BR/&gt;{6.12.37.131:*, 200.89.34.102:80}[40%]&lt;BR/&gt;{6.12.37.131:*, 201.117.144.48:80}[30%]&lt;BR/&gt;{6.12.37.131:*, 201.117.144.48:443}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (40%)&lt;BR/&gt; 443: (10%)&lt;BR/&gt; 63148: (5%)&lt;BR/&gt; 62720: (5%)&lt;BR/&gt; 60019: (5%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="201.117.144.48" dst_port="80" src_ip="6.12.37.131"/>
      <filter dst_ip="201.117.144.48" dst_port="443" src_ip="6.12.37.131"/>
      <filter dst_ip="200.89.34.102" dst_port="80" src_ip="6.12.37.131"/>
    </slice>
    <from sec="1123477321" usec="0"/>
    <to sec="1123478051" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.226.63.131"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="6.214.101.131"/>
    </slice>
    <from sec="1123477350" usec="0"/>
    <to sec="1123478080" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="70.107.30.132"/>
    </slice>
    <from sec="1123477207" usec="0"/>
    <to sec="1123478051" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.45.85.132"/>
    </slice>
    <from sec="1123477223" usec="0"/>
    <to sec="1123478093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="193.147.92.133"/>
    </slice>
    <from sec="1123477465" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="8.232.133.134"/>
    </slice>
    <from sec="1123477206" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,010,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_406{
style=filled;
color=gray75;
2617[label="215.221.129.135;s;500pkt 500fpkt", shape=diamond, color=yellow];
4071[label="215.221.129.135;500pkt 500fpkt", shape=pentagon, color=darkviolet];
5543[label="215.221.129.135;500pkt 500fpkt", shape=invtriangle, color=brown];
stat406[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.221.129.135:*, *:139}[50.2%]&lt;BR/&gt;{215.221.129.135:*, *:445}[49.8%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 139: (25.1%)&lt;BR/&gt; 445: (24.9%)&lt;BR/&gt; 3277: (0.2%)&lt;BR/&gt; 3271: (0.2%)&lt;BR/&gt; 3265: (0.2%)&gt;];
}
2617--4071[label="1;500pkt 500fpkt"];
2617--5543[label="1;500pkt 500fpkt"];
4071--5543[label="1;500pkt 500fpkt"];
</description>
    <slice>
      <filter dst_port="139" src_ip="215.221.129.135"/>
      <filter dst_port="445" src_ip="215.221.129.135"/>
    </slice>
    <from sec="1123477891" usec="0"/>
    <to sec="1123477941" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="158.160.121.136"/>
    </slice>
    <from sec="1123477205" usec="0"/>
    <to sec="1123478096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="98.138.11.137"/>
    </slice>
    <from sec="1123477304" usec="0"/>
    <to sec="1123478008" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="219.26.54.137"/>
    </slice>
    <from sec="1123477406" usec="0"/>
    <to sec="1123477418" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_410{
style=filled;
color=gray75;
2556[label="152.21.168.137;s;63pkt 63fpkt", shape=diamond, color=yellow];
4094[label="152.21.168.137;71pkt 71fpkt", shape=pentagon, color=darkviolet];
stat410[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.168.137:*, *:113}[40.8451%]&lt;BR/&gt;{152.21.168.137:25, *:*}[40.8451%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (29.1045%)&lt;BR/&gt; 113: (20.8955%)&lt;BR/&gt; 61557: (0.746269%)&lt;BR/&gt; 48575: (0.746269%)&lt;BR/&gt; 45149: (0.746269%)&gt;];
}
2556--4094[label="1;63pkt 63fpkt"];
</description>
    <slice>
      <filter src_ip="152.21.168.137" src_port="25"/>
      <filter dst_port="113" src_ip="152.21.168.137"/>
    </slice>
    <from sec="1123477268" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="70.78.108.138"/>
    </slice>
    <from sec="1123477607" usec="0"/>
    <to sec="1123478087" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="1.118.228.139"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="207.90.130.140"/>
    </slice>
    <from sec="1123477574" usec="0"/>
    <to sec="1123477764" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="71.119.24.141"/>
    </slice>
    <from sec="1123477270" usec="0"/>
    <to sec="1123477473" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.245.195.141"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_416{
style=filled;
color=gray75;
678[label="194.133.188.40;d;31pkt 31fpkt", shape=diamond, color=yellow];
1572[label="169.169.254.199;s;10pkt 10fpkt", shape=diamond, color=yellow];
1736[label="169.169.244.63;s;4pkt 4fpkt", shape=diamond, color=yellow];
1752[label="208.70.152.90;d;17pkt 17fpkt", shape=diamond, color=yellow];
1778[label="208.70.152.115;d;22pkt 22fpkt", shape=diamond, color=yellow];
1780[label="208.70.152.98;d;26pkt 26fpkt", shape=diamond, color=yellow];
1938[label="169.169.235.2;s;2pkt 2fpkt", shape=diamond, color=yellow];
1958[label="169.169.154.27;s;2pkt 2fpkt", shape=diamond, color=yellow];
1986[label="169.169.193.162;s;2pkt 2fpkt", shape=diamond, color=yellow];
2035[label="169.169.227.35;s;2pkt 2fpkt", shape=diamond, color=yellow];
2196[label="169.169.250.141;s;3pkt 3fpkt", shape=diamond, color=yellow];
2210[label="169.169.154.16;s;1pkt 1fpkt", shape=diamond, color=yellow];
2237[label="169.169.154.22;s;2pkt 2fpkt", shape=diamond, color=yellow];
2263[label="169.169.154.17;s;1pkt 1fpkt", shape=diamond, color=yellow];
2422[label="208.70.152.91;d;15pkt 15fpkt", shape=diamond, color=yellow];
2424[label="169.169.208.88;s;1pkt 1fpkt", shape=diamond, color=yellow];
2436[label="169.169.157.183;s;1pkt 1fpkt", shape=diamond, color=yellow];
2473[label="169.169.157.134;s;1pkt 1fpkt", shape=diamond, color=yellow];
3131[label="169.169.154.22;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3171[label="169.169.154.27;2pkt 2fpkt", shape=pentagon, color=darkviolet];
3460[label="169.169.244.63;4pkt 4fpkt", shape=pentagon, color=darkviolet];
3935[label="169.169.224.116;4pkt 4fpkt", shape=pentagon, color=darkviolet];
3964[label="169.169.249.120;3pkt 3fpkt", shape=pentagon, color=darkviolet];
4134[label="169.169.250.141;3pkt 3fpkt", shape=pentagon, color=darkviolet];
4279[label="169.169.193.162;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4465[label="169.169.153.187;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4645[label="169.169.162.210;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5019[label="169.169.154.22;1pkt 1fpkt", shape=invtriangle, color=brown];
5196[label="169.169.244.63;4pkt 4fpkt", shape=invtriangle, color=brown];
5482[label="169.169.249.120;3pkt 3fpkt", shape=invtriangle, color=brown];
5574[label="169.169.250.141;3pkt 3fpkt", shape=invtriangle, color=brown];
5662[label="169.169.193.162;2pkt 2fpkt", shape=invtriangle, color=brown];
6337[label="169.169.249.120;3pkt 3fpkt", shape=invhouse, color=bisque];
6379[label="169.169.250.141;3pkt 3fpkt", shape=invhouse, color=bisque];
6423[label="169.169.193.162;2pkt 2fpkt", shape=invhouse, color=bisque];
6473[label="169.169.153.187;1pkt 1fpkt", shape=invhouse, color=bisque];
stat416[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, *:5050}[64.3411%]&lt;BR/&gt;{*:*, 194.133.188.40:*}[24.031%]&lt;BR/&gt;{*:*, 208.70.152.98:*}[20.155%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5050: (29.0323%)&lt;BR/&gt; 6667: (3.76344%)&lt;BR/&gt; 6666: (3.49462%)&lt;BR/&gt; 6661: (2.15054%)&lt;BR/&gt; 20: (2.15054%)&gt;];
}
678--1114[label="0.0322581;1pkt 1fpkt"];
678--1572[label="0.1;1pkt 1fpkt"];
678--1736[label="0.25;1pkt 1fpkt"];
678--1938[label="0.5;1pkt 1fpkt"];
678--1958[label="0.5;1pkt 1fpkt"];
678--1986[label="0.5;1pkt 1fpkt"];
678--2035[label="0.5;1pkt 1fpkt"];
678--2196[label="0.666667;2pkt 2fpkt"];
678--2210[label="1;1pkt 1fpkt"];
678--2237[label="0.5;1pkt 1fpkt"];
678--2263[label="1;1pkt 1fpkt"];
678--2424[label="1;1pkt 1fpkt"];
678--2436[label="1;1pkt 1fpkt"];
678--2473[label="1;1pkt 1fpkt"];
678--3171[label="0.5;1pkt 1fpkt"];
678--3460[label="0.25;1pkt 1fpkt"];
678--3935[label="0.25;1pkt 1fpkt"];
678--4134[label="0.666667;2pkt 2fpkt"];
678--4279[label="0.5;1pkt 1fpkt"];
678--4645[label="1;1pkt 1fpkt"];
678--5196[label="0.25;1pkt 1fpkt"];
678--5574[label="0.666667;2pkt 2fpkt"];
678--5662[label="0.5;1pkt 1fpkt"];
678--6379[label="0.666667;2pkt 2fpkt"];
678--6423[label="0.5;1pkt 1fpkt"];
1572--1778[label="0.1;1pkt 1fpkt"];
1736--3460[label="1;4pkt 4fpkt"];
1736--5196[label="1;4pkt 4fpkt"];
1752--2196[label="0.333333;1pkt 1fpkt"];
1752--3964[label="0.333333;1pkt 1fpkt"];
1752--4134[label="0.333333;1pkt 1fpkt"];
1752--5482[label="0.333333;1pkt 1fpkt"];
1752--5574[label="0.333333;1pkt 1fpkt"];
1752--6337[label="0.333333;1pkt 1fpkt"];
1752--6379[label="0.333333;1pkt 1fpkt"];
1778--3964[label="0.333333;1pkt 1fpkt"];
1778--5482[label="0.333333;1pkt 1fpkt"];
1778--6337[label="0.333333;1pkt 1fpkt"];
1780--3935[label="0.25;1pkt 1fpkt"];
1938--2422[label="0.5;1pkt 1fpkt"];
1958--3171[label="1;2pkt 2fpkt"];
1986--4279[label="1;2pkt 2fpkt"];
1986--5662[label="1;2pkt 2fpkt"];
1986--6423[label="1;2pkt 2fpkt"];
2196--4134[label="1;3pkt 3fpkt"];
2196--5574[label="1;3pkt 3fpkt"];
2196--6379[label="1;3pkt 3fpkt"];
2237--3131[label="1;1pkt 1fpkt"];
2237--5019[label="1;1pkt 1fpkt"];
2422--4465[label="1;1pkt 1fpkt"];
2422--6473[label="1;1pkt 1fpkt"];
3131--5019[label="1;1pkt 1fpkt"];
3460--5196[label="1;4pkt 4fpkt"];
3964--5482[label="1;3pkt 3fpkt"];
3964--6337[label="1;3pkt 3fpkt"];
4134--5574[label="1;3pkt 3fpkt"];
4134--6379[label="1;3pkt 3fpkt"];
4279--5662[label="1;2pkt 2fpkt"];
4279--6423[label="1;2pkt 2fpkt"];
4465--6473[label="1;1pkt 1fpkt"];
5482--6337[label="1;3pkt 3fpkt"];
5574--6379[label="1;3pkt 3fpkt"];
5662--6423[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="194.133.188.40"/>
      <filter dst_ip="208.70.152.98"/>
      <filter dst_port="5050"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_417{
style=filled;
color=gray75;
2569[label="208.78.80.58;d;48pkt 48fpkt", shape=diamond, color=yellow];
4149[label="172.118.72.144;59pkt 59fpkt", shape=pentagon, color=darkviolet];
5582[label="172.118.72.144;59pkt 59fpkt", shape=invtriangle, color=brown];
6384[label="172.118.72.144;59pkt 59fpkt", shape=invhouse, color=bisque];
stat417[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.118.72.144:*, 208.78.80.58:80}[81.3559%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.6667%)&lt;BR/&gt; 50500: (0.888889%)&lt;BR/&gt; 50497: (0.888889%)&lt;BR/&gt; 50496: (0.888889%)&lt;BR/&gt; 50495: (0.888889%)&gt;];
}
2569--2885[label="0.104167;5pkt 5fpkt"];
2569--2899[label="0.104167;5pkt 5fpkt"];
2569--2909[label="0.104167;5pkt 5fpkt"];
2569--4149[label="1;48pkt 48fpkt"];
2569--5582[label="1;48pkt 48fpkt"];
2569--6384[label="1;48pkt 48fpkt"];
4149--5582[label="1;59pkt 59fpkt"];
4149--6384[label="1;59pkt 59fpkt"];
5582--6384[label="1;59pkt 59fpkt"];
</description>
    <slice>
      <filter dst_ip="208.78.80.58" dst_port="80" src_ip="172.118.72.144"/>
    </slice>
    <from sec="1123477260" usec="0"/>
    <to sec="1123478089" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="71.74.224.144"/>
    </slice>
    <from sec="1123477207" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="19.153.218.145"/>
    </slice>
    <from sec="1123477281" usec="0"/>
    <to sec="1123478050" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,011,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.136.98.146"/>
    </slice>
    <from sec="1123477596" usec="0"/>
    <to sec="1123477642" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="152.20.53.148"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.235.72.149"/>
    </slice>
    <from sec="1123477209" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="152.21.174.149"/>
    </slice>
    <from sec="1123477388" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.169.228.150"/>
    </slice>
    <from sec="1123477213" usec="0"/>
    <to sec="1123478079" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="152.20.91.151"/>
    </slice>
    <from sec="1123477406" usec="0"/>
    <to sec="1123477422" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.169.162.152"/>
    </slice>
    <from sec="1123477251" usec="0"/>
    <to sec="1123478092" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.108.60.154"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.45.83.154"/>
    </slice>
    <from sec="1123477604" usec="0"/>
    <to sec="1123478086" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.45.83.156"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,010,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_431{
style=filled;
color=gray75;
2631[label="211.42.134.156;s;382pkt 382fpkt", shape=diamond, color=yellow];
4226[label="211.42.134.156;508pkt 508fpkt", shape=pentagon, color=darkviolet];
5625[label="211.42.134.156;508pkt 508fpkt", shape=invtriangle, color=brown];
stat431[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.42.134.156:*, *:139}[50%]&lt;BR/&gt;{211.42.134.156:*, *:445}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 139: (27.2532%)&lt;BR/&gt; 445: (22.7468%)&lt;BR/&gt; 4915: (0.107296%)&lt;BR/&gt; 4909: (0.107296%)&lt;BR/&gt; 4905: (0.107296%)&gt;];
}
2631--4226[label="1;382pkt 382fpkt"];
2631--5625[label="1;382pkt 382fpkt"];
4226--5625[label="1;508pkt 508fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="211.42.134.156"/>
      <filter dst_port="139" src_ip="211.42.134.156"/>
    </slice>
    <from sec="1123477958" usec="0"/>
    <to sec="1123478053" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="201.117.148.157"/>
    </slice>
    <from sec="1123477224" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.169.204.157"/>
    </slice>
    <from sec="1123477202" usec="0"/>
    <to sec="1123478054" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,010,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_434{
style=filled;
color=gray75;
594[label="132.117.197.143;d;2pkt 2fpkt", shape=diamond, color=yellow];
595[label="4.9.30.158;s;4pkt 4fpkt", shape=diamond, color=yellow];
2134[label="71.84.204.52;s;528pkt 528fpkt", shape=diamond, color=yellow];
2551[label="132.117.12.21;d;4pkt 4fpkt", shape=diamond, color=yellow];
4235[label="4.9.30.158;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5630[label="4.9.30.158;1pkt 1fpkt", shape=invtriangle, color=brown];
6406[label="4.9.30.158;1pkt 1fpkt", shape=invhouse, color=bisque];
stat434[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.84.204.52:80, *:*}[99.0619%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.8909%)&lt;BR/&gt; 6970: (0.64695%)&lt;BR/&gt; 16136: (0.462107%)&lt;BR/&gt; 554: (0.369686%)&lt;BR/&gt; 57928: (0.184843%)&gt;];
}
594--595[label="1;2pkt 2fpkt"];
595--2551[label="0.5;2pkt 2fpkt"];
595--4235[label="1;1pkt 1fpkt"];
595--5630[label="1;1pkt 1fpkt"];
595--6406[label="1;1pkt 1fpkt"];
2134--2551[label="0.25;1pkt 1fpkt"];
2551--4235[label="1;1pkt 1fpkt"];
2551--5630[label="1;1pkt 1fpkt"];
2551--6406[label="1;1pkt 1fpkt"];
4235--5630[label="1;1pkt 1fpkt"];
4235--6406[label="1;1pkt 1fpkt"];
5630--6406[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="71.84.204.52" src_port="80"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="98.9.213.158"/>
    </slice>
    <from sec="1123477976" usec="0"/>
    <to sec="1123478012" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.169.230.158"/>
    </slice>
    <from sec="1123477216" usec="0"/>
    <to sec="1123478095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_437{
style=filled;
color=gray75;
2369[label="172.118.150.208;s;74pkt 74fpkt", shape=diamond, color=yellow];
4258[label="172.118.94.161;13pkt 13fpkt", shape=pentagon, color=darkviolet];
stat437[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.118.150.208:*, 6.230.163.162:80}[28.7356%]&lt;BR/&gt;{172.118.150.208:*, 6.230.163.177:80}[22.9885%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1753: (0.574713%)&lt;BR/&gt; 1752: (0.574713%)&lt;BR/&gt; 1751: (0.574713%)&lt;BR/&gt; 1750: (0.574713%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="6.230.163.162" dst_port="80" src_ip="172.118.150.208"/>
      <filter dst_ip="6.230.163.177" dst_port="80" src_ip="172.118.150.208"/>
    </slice>
    <from sec="1123477656" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.202.121.161"/>
    </slice>
    <from sec="1123477223" usec="0"/>
    <to sec="1123478095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.169.197.161"/>
    </slice>
    <from sec="1123477246" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="0.106.6.162"/>
    </slice>
    <from sec="1123477230" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="16.116.169.162"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,010,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_443{
style=filled;
color=gray75;
2158[label="71.33.201.162;s;487pkt 487fpkt", shape=diamond, color=yellow];
4280[label="71.33.201.162;487pkt 487fpkt", shape=pentagon, color=darkviolet];
stat443[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.33.201.162:*, *:139}[51.3347%]&lt;BR/&gt;{71.33.201.162:*, *:445}[48.6653%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 139: (25.6674%)&lt;BR/&gt; 445: (24.3326%)&lt;BR/&gt; 4967: (0.205339%)&lt;BR/&gt; 4965: (0.205339%)&lt;BR/&gt; 4963: (0.205339%)&gt;];
}
2158--4280[label="1;487pkt 487fpkt"];
</description>
    <slice>
      <filter dst_port="139" src_ip="71.33.201.162"/>
      <filter dst_port="445" src_ip="71.33.201.162"/>
    </slice>
    <from sec="1123477742" usec="0"/>
    <to sec="1123477787" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,010,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_444{
style=filled;
color=gray75;
1872[label="70.201.248.162;s;431pkt 431fpkt", shape=diamond, color=yellow];
4281[label="70.201.248.162;431pkt 431fpkt", shape=pentagon, color=darkviolet];
5663[label="70.201.248.162;431pkt 431fpkt", shape=invtriangle, color=brown];
6424[label="70.201.248.162;431pkt 431fpkt", shape=invhouse, color=bisque];
stat444[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.201.248.162:*, *:445}[52.2042%]&lt;BR/&gt;{70.201.248.162:*, *:139}[47.7958%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (26.1021%)&lt;BR/&gt; 139: (23.8979%)&lt;BR/&gt; 1921: (0.232019%)&lt;BR/&gt; 1915: (0.232019%)&lt;BR/&gt; 1896: (0.232019%)&gt;];
}
1872--4281[label="1;431pkt 431fpkt"];
1872--5663[label="1;431pkt 431fpkt"];
1872--6424[label="1;431pkt 431fpkt"];
4281--5663[label="1;431pkt 431fpkt"];
4281--6424[label="1;431pkt 431fpkt"];
5663--6424[label="1;431pkt 431fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="70.201.248.162"/>
      <filter dst_port="139" src_ip="70.201.248.162"/>
    </slice>
    <from sec="1123477432" usec="0"/>
    <to sec="1123477634" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_445{
style=filled;
color=gray75;
4283[label="152.20.53.163;23pkt 23fpkt", shape=pentagon, color=darkviolet];
stat445[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.20.53.163:*, 221.31.160.91:443}[78.2609%]&lt;BR/&gt;{152.20.53.163:*, 221.31.160.91:80}[21.7391%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (39.1304%)&lt;BR/&gt; 80: (10.8696%)&lt;BR/&gt; 1684: (2.17391%)&lt;BR/&gt; 1683: (2.17391%)&lt;BR/&gt; 1682: (2.17391%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="221.31.160.91" dst_port="443" src_ip="152.20.53.163"/>
      <filter dst_ip="221.31.160.91" dst_port="80" src_ip="152.20.53.163"/>
    </slice>
    <from sec="1123477214" usec="0"/>
    <to sec="1123477854" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_446{
style=filled;
color=gray75;
1173[label="152.20.106.163;s;118pkt 118fpkt", shape=diamond, color=yellow];
2378[label="19.67.72.101;d;15pkt 15fpkt", shape=diamond, color=yellow];
4285[label="152.20.106.163;146pkt 146fpkt", shape=pentagon, color=darkviolet];
stat446[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.20.106.163:*, 1.225.55.234:80}[35.6164%]&lt;BR/&gt;{152.20.106.163:*, 19.1.87.146:80}[32.1918%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.0573%)&lt;BR/&gt; 53: (3.94265%)&lt;BR/&gt; 34133: (0.537634%)&lt;BR/&gt; 32698: (0.537634%)&lt;BR/&gt; 24229: (0.537634%)&gt;];
}
1173--2378[label="0.333333;5pkt 5fpkt"];
1173--2874[label="0.00847458;1pkt 1fpkt"];
1173--2875[label="0.00847458;1pkt 1fpkt"];
1173--2885[label="0.0169492;2pkt 2fpkt"];
1173--2899[label="0.0169492;2pkt 2fpkt"];
1173--2909[label="0.0169492;2pkt 2fpkt"];
1173--4285[label="1;118pkt 118fpkt"];
2378--2885[label="0.133333;2pkt 2fpkt"];
2378--2899[label="0.133333;2pkt 2fpkt"];
2378--2909[label="0.133333;2pkt 2fpkt"];
2378--4285[label="1;15pkt 15fpkt"];
</description>
    <slice>
      <filter dst_ip="1.225.55.234" dst_port="80" src_ip="152.20.106.163"/>
      <filter dst_ip="19.1.87.146" dst_port="80" src_ip="152.20.106.163"/>
    </slice>
    <from sec="1123477262" usec="0"/>
    <to sec="1123478097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.85.215.163"/>
    </slice>
    <from sec="1123477435" usec="0"/>
    <to sec="1123477508" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="19.152.1.164"/>
    </slice>
    <from sec="1123477684" usec="0"/>
    <to sec="1123478097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="204.41.18.164"/>
    </slice>
    <from sec="1123477943" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.118.98.164"/>
    </slice>
    <from sec="1123477779" usec="0"/>
    <to sec="1123477837" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="68.200.128.164"/>
    </slice>
    <from sec="1123477549" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="152.21.170.164"/>
    </slice>
    <from sec="1123477375" usec="0"/>
    <to sec="1123478004" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.204.176.164"/>
    </slice>
    <from sec="1123477215" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="1.56.20.165"/>
    </slice>
    <from sec="1123477211" usec="0"/>
    <to sec="1123478086" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="204.41.18.166"/>
    </slice>
    <from sec="1123477207" usec="0"/>
    <to sec="1123477288" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="152.21.71.166"/>
    </slice>
    <from sec="1123477220" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.118.110.167"/>
    </slice>
    <from sec="1123477245" usec="0"/>
    <to sec="1123478095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.34.77.168"/>
    </slice>
    <from sec="1123477578" usec="0"/>
    <to sec="1123477767" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_459{
style=filled;
color=gray75;
1828[label="172.118.96.168;s;24pkt 24fpkt", shape=diamond, color=yellow];
4320[label="172.118.96.168;26pkt 26fpkt", shape=pentagon, color=darkviolet];
5684[label="172.118.96.168;26pkt 26fpkt", shape=invtriangle, color=brown];
stat459[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.118.96.168:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 57906: (1.97368%)&lt;BR/&gt; 57054: (1.97368%)&lt;BR/&gt; 54032: (1.97368%)&lt;BR/&gt; 52010: (1.97368%)&gt;];
}
1828--4320[label="1;24pkt 24fpkt"];
1828--5684[label="1;24pkt 24fpkt"];
4320--5684[label="1;26pkt 26fpkt"];
</description>
    <slice>
      <filter src_ip="172.118.96.168" src_port="80"/>
    </slice>
    <from sec="1123477215" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="158.189.176.168"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_461{
style=filled;
color=gray75;
2515[label="172.118.228.168;s;71pkt 71fpkt", shape=diamond, color=yellow];
4326[label="172.118.228.168;80pkt 80fpkt", shape=pentagon, color=darkviolet];
stat461[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.118.228.168:*, 6.122.28.93:8200}[68.75%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8200: (50%)&lt;BR/&gt; 3096: (0.662252%)&lt;BR/&gt; 3095: (0.662252%)&lt;BR/&gt; 3094: (0.662252%)&lt;BR/&gt; 3093: (0.662252%)&gt;];
}
2515--4326[label="1;71pkt 71fpkt"];
</description>
    <slice>
      <filter dst_ip="6.122.28.93" dst_port="8200" src_ip="172.118.228.168"/>
    </slice>
    <from sec="1123477211" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,020,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_462{
style=filled;
color=gray75;
2260[label="152.20.61.169;s;105pkt 105fpkt", shape=diamond, color=yellow];
4329[label="152.20.61.169;105pkt 105fpkt", shape=pentagon, color=darkviolet];
5688[label="152.20.61.169;105pkt 105fpkt", shape=invtriangle, color=brown];
stat462[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.20.61.169:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2260--4329[label="1;105pkt 105fpkt"];
2260--5688[label="1;105pkt 105fpkt"];
4329--5688[label="1;105pkt 105fpkt"];
</description>
    <slice>
      <filter src_ip="152.20.61.169"/>
    </slice>
    <from sec="1123477202" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.118.87.169"/>
    </slice>
    <from sec="1123477390" usec="0"/>
    <to sec="1123477640" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="71.34.171.170"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="152.20.30.172"/>
    </slice>
    <from sec="1123477438" usec="0"/>
    <to sec="1123477641" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.169.248.172"/>
    </slice>
    <from sec="1123477266" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="170.67.124.173"/>
    </slice>
    <from sec="1123477501" usec="0"/>
    <to sec="1123477773" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="152.21.170.173"/>
    </slice>
    <from sec="1123477499" usec="0"/>
    <to sec="1123477518" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="68.200.67.175"/>
    </slice>
    <from sec="1123477946" usec="0"/>
    <to sec="1123477970" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="152.20.104.176"/>
    </slice>
    <from sec="1123477207" usec="0"/>
    <to sec="1123478085" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="1.60.191.176"/>
    </slice>
    <from sec="1123477266" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.244.133.177"/>
    </slice>
    <from sec="1123477681" usec="0"/>
    <to sec="1123477773" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.169.203.178"/>
    </slice>
    <from sec="1123477212" usec="0"/>
    <to sec="1123478088" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="201.74.132.179"/>
    </slice>
    <from sec="1123477736" usec="0"/>
    <to sec="1123477872" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="17.147.148.179"/>
    </slice>
    <from sec="1123477265" usec="0"/>
    <to sec="1123477946" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.49.233.179"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="152.21.52.180"/>
    </slice>
    <from sec="1123477589" usec="0"/>
    <to sec="1123477665" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_479{
style=filled;
color=gray75;
2047[label="132.117.106.55;d;30pkt 30fpkt", shape=diamond, color=yellow];
2172[label="71.72.102.180;s;12pkt 12fpkt", shape=diamond, color=yellow];
4413[label="71.72.102.180;12pkt 12fpkt", shape=pentagon, color=darkviolet];
4574[label="71.84.75.201;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5730[label="71.72.102.180;12pkt 12fpkt", shape=invtriangle, color=brown];
6454[label="71.72.102.180;12pkt 12fpkt", shape=invhouse, color=bisque];
stat479[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.72.101.84:80, 132.117.106.55:*}[53.3333%]&lt;BR/&gt;{71.72.102.180:80, 132.117.106.55:*}[40%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.1013%)&lt;BR/&gt; 4000: (3.16456%)&lt;BR/&gt; 1991: (3.16456%)&lt;BR/&gt; 1990: (3.16456%)&lt;BR/&gt; 1989: (3.16456%)&gt;];
}
2047--2172[label="1;12pkt 12fpkt"];
2047--4413[label="1;12pkt 12fpkt"];
2047--4574[label="1;1pkt 1fpkt"];
2047--5730[label="1;12pkt 12fpkt"];
2047--6454[label="1;12pkt 12fpkt"];
2172--4413[label="1;12pkt 12fpkt"];
2172--5730[label="1;12pkt 12fpkt"];
2172--6454[label="1;12pkt 12fpkt"];
4413--5730[label="1;12pkt 12fpkt"];
4413--6454[label="1;12pkt 12fpkt"];
5730--6454[label="1;12pkt 12fpkt"];
</description>
    <slice>
      <filter dst_ip="132.117.106.55" src_ip="71.72.101.84" src_port="80"/>
      <filter dst_ip="132.117.106.55" src_ip="71.72.102.180" src_port="80"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.85.2.182"/>
    </slice>
    <from sec="1123477208" usec="0"/>
    <to sec="1123478079" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.45.83.182"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123477593" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.225.93.182"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.2.55.183"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.19765,1.98557,999,1 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_484{
style=filled;
color=gray75;
79[label="71.42.131.183s;109pkt 109fpkt", shape=rectangle, color=red];
4437[label="71.42.131.183;466pkt 466fpkt", shape=pentagon, color=darkviolet];
stat484[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.42.131.183:*, *:1027}[50.8584%]&lt;BR/&gt;{71.42.131.183:*, *:1026}[49.1416%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (25.6522%)&lt;BR/&gt; 1026: (24.3478%)&lt;BR/&gt; 35353: (1.47826%)&lt;BR/&gt; 37647: (0.869565%)&lt;BR/&gt; 37643: (0.695652%)&gt;];
}
79--4437[label="1;109pkt 109fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="71.42.131.183"/>
      <filter dst_port="1026" src_ip="71.42.131.183"/>
    </slice>
    <from sec="1123477563" usec="0"/>
    <to sec="1123477803" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.169.205.183"/>
    </slice>
    <from sec="1123477245" usec="0"/>
    <to sec="1123478087" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.45.83.185"/>
    </slice>
    <from sec="1123477851" usec="0"/>
    <to sec="1123477914" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="19.152.15.186"/>
    </slice>
    <from sec="1123477277" usec="0"/>
    <to sec="1123478079" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,001,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_488{
style=filled;
color=gray75;
192[label="214.35.20.186;s;114pkt 114fpkt", shape=diamond, color=yellow];
4456[label="214.35.20.186;114pkt 114fpkt", shape=pentagon, color=darkviolet];
stat488[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.35.20.186:*, *:9898}[97.3684%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9898: (48.6842%)&lt;BR/&gt; 64351: (0.438596%)&lt;BR/&gt; 64201: (0.438596%)&lt;BR/&gt; 64068: (0.438596%)&lt;BR/&gt; 63312: (0.438596%)&gt;];
}
192--278[label="0.00877193;1pkt 1fpkt"];
192--337[label="0.00877193;1pkt 1fpkt"];
192--2644[label="0.00877193;1pkt 1fpkt"];
192--2846[label="0.00877193;1pkt 1fpkt"];
192--2875[label="0.00877193;1pkt 1fpkt"];
192--2885[label="0.00877193;1pkt 1fpkt"];
192--2899[label="0.00877193;1pkt 1fpkt"];
192--2909[label="0.00877193;1pkt 1fpkt"];
192--4456[label="1;114pkt 114fpkt"];
</description>
    <slice>
      <filter dst_port="9898" src_ip="214.35.20.186"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.170.39.186"/>
    </slice>
    <from sec="1123477211" usec="0"/>
    <to sec="1123478015" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.120.222.186"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="17.194.143.187"/>
    </slice>
    <from sec="1123477207" usec="0"/>
    <to sec="1123478095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="158.189.168.188"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_493{
style=filled;
color=gray75;
1730[label="158.189.168.187;d;26pkt 26fpkt", shape=diamond, color=yellow];
4472[label="200.181.252.188;26pkt 26fpkt", shape=pentagon, color=darkviolet];
stat493[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.181.252.188:*, 158.189.168.187:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4964: (1.92308%)&lt;BR/&gt; 4396: (1.92308%)&lt;BR/&gt; 3922: (1.92308%)&lt;BR/&gt; 3721: (1.92308%)&gt;];
}
1730--2875[label="0.346154;9pkt 9fpkt"];
1730--4472[label="1;26pkt 26fpkt"];
</description>
    <slice>
      <filter dst_ip="158.189.168.187" dst_port="80" src_ip="200.181.252.188"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.214.34.189"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.45.83.189"/>
    </slice>
    <from sec="1123477209" usec="0"/>
    <to sec="1123477708" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="17.174.220.189"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.23034,1.94842,002,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_497{
style=filled;
color=gray75;
46[label="201.178.1.190s;90pkt 90fpkt", shape=rectangle, color=red];
4480[label="201.178.1.190;218pkt 218fpkt", shape=pentagon, color=darkviolet];
5765[label="201.178.1.190;218pkt 218fpkt", shape=invtriangle, color=brown];
stat497[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.178.1.190:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
46--4480[label="1;90pkt 90fpkt"];
46--5765[label="1;90pkt 90fpkt"];
4480--5765[label="1;218pkt 218fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="201.178.1.190" src_port="1027"/>
    </slice>
    <from sec="1123477540" usec="0"/>
    <to sec="1123477554" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="71.100.121.190"/>
    </slice>
    <from sec="1123477222" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.169.194.191"/>
    </slice>
    <from sec="1123477216" usec="0"/>
    <to sec="1123478078" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="21.216.194.191"/>
    </slice>
    <from sec="1123477492" usec="0"/>
    <to sec="1123477542" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="0.116.45.192"/>
    </slice>
    <from sec="1123477753" usec="0"/>
    <to sec="1123477792" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,010,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_502{
style=filled;
color=gray75;
2157[label="212.101.64.192;s;1016pkt 1016fpkt", shape=diamond, color=yellow];
4499[label="212.101.64.192;1016pkt 1016fpkt", shape=pentagon, color=darkviolet];
5774[label="212.101.64.192;1016pkt 1016fpkt", shape=invtriangle, color=brown];
stat502[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.101.64.192:*, *:42}[25%]&lt;BR/&gt;{212.101.64.192:*, *:4899}[25%]&lt;BR/&gt;{212.101.64.192:*, *:5900}[25%]&lt;BR/&gt;{212.101.64.192:*, *:6101}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4899: (12.5492%)&lt;BR/&gt; 6101: (12.5%)&lt;BR/&gt; 5900: (12.5%)&lt;BR/&gt; 42: (12.5%)&lt;BR/&gt; 4531: (0.0984252%)&gt;];
}
2157--4499[label="1;1016pkt 1016fpkt"];
2157--5774[label="1;1016pkt 1016fpkt"];
4499--5774[label="1;1016pkt 1016fpkt"];
</description>
    <slice>
      <filter dst_port="6101" src_ip="212.101.64.192"/>
      <filter dst_port="5900" src_ip="212.101.64.192"/>
      <filter dst_port="4899" src_ip="212.101.64.192"/>
      <filter dst_port="42" src_ip="212.101.64.192"/>
    </slice>
    <from sec="1123477736" usec="0"/>
    <to sec="1123477803" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.217.184.193"/>
    </slice>
    <from sec="1123477408" usec="0"/>
    <to sec="1123477755" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,011,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_504{
style=filled;
color=gray75;
1052[label="210.97.205.193;s;928pkt 928fpkt", shape=diamond, color=yellow];
4517[label="210.97.205.193;1022pkt 1022fpkt", shape=pentagon, color=darkviolet];
stat504[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.97.205.193:7000, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7000: (50%)&lt;BR/&gt; 63803: (0.153846%)&lt;BR/&gt; 55320: (0.153846%)&lt;BR/&gt; 64822: (0.102564%)&lt;BR/&gt; 63349: (0.102564%)&gt;];
}
1052--4517[label="1;928pkt 928fpkt"];
</description>
    <slice>
      <filter src_ip="210.97.205.193" src_port="7000"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_505{
style=filled;
color=gray75;
685[label="200.89.27.152;d;6pkt 6fpkt", shape=diamond, color=yellow];
1261[label="98.19.31.194;s;1pkt 1fpkt", shape=diamond, color=yellow];
1937[label="212.81.227.218;s;1pkt 1fpkt", shape=diamond, color=yellow];
4519[label="98.19.31.194;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5785[label="98.19.31.194;1pkt 1fpkt", shape=invtriangle, color=brown];
stat505[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 200.89.27.152:6883}[33.3333%]&lt;BR/&gt;{*:*, 200.89.27.152:6885}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 63377: (20%)&lt;BR/&gt; 6884: (20%)&lt;BR/&gt; 6883: (15%)&lt;BR/&gt; 6885: (10%)&lt;BR/&gt; 4767: (10%)&gt;];
}
685--1261[label="1;1pkt 1fpkt"];
685--1937[label="1;1pkt 1fpkt"];
685--4519[label="1;1pkt 1fpkt"];
685--5785[label="1;1pkt 1fpkt"];
1261--4519[label="1;1pkt 1fpkt"];
1261--5785[label="1;1pkt 1fpkt"];
4519--5785[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="200.89.27.152" dst_port="6885"/>
      <filter dst_ip="200.89.27.152" dst_port="6883"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478091" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.209.200.194"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="202.49.252.194"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="0.133.82.195"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_509{
style=filled;
color=gray75;
657[label="132.117.180.177;d;139pkt 139fpkt", shape=diamond, color=yellow];
1484[label="204.61.48.183;s;6pkt 6fpkt", shape=diamond, color=yellow];
1485[label="206.216.181.195;s;4pkt 4fpkt", shape=diamond, color=yellow];
1486[label="211.160.109.106;s;5pkt 5fpkt", shape=diamond, color=yellow];
2166[label="6.137.78.55;s;2pkt 2fpkt", shape=diamond, color=yellow];
2168[label="210.126.136.59;s;2pkt 2fpkt", shape=diamond, color=yellow];
2613[label="6.11.162.148;s;2pkt 2fpkt", shape=diamond, color=yellow];
3064[label="21.244.225.14;33pkt 33fpkt", shape=pentagon, color=darkviolet];
3386[label="5.218.236.52;9pkt 9fpkt", shape=pentagon, color=darkviolet];
3405[label="6.137.78.55;2pkt 2fpkt", shape=pentagon, color=darkviolet];
3436[label="210.126.136.59;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3619[label="217.172.173.80;2pkt 2fpkt", shape=pentagon, color=darkviolet];
3863[label="211.160.109.106;5pkt 5fpkt", shape=pentagon, color=darkviolet];
4412[label="208.200.92.180;9pkt 9fpkt", shape=pentagon, color=darkviolet];
4435[label="204.61.48.183;7pkt 7fpkt", shape=pentagon, color=darkviolet];
4534[label="206.216.181.195;6pkt 6fpkt", shape=pentagon, color=darkviolet];
4807[label="5.218.244.233;4pkt 4fpkt", shape=pentagon, color=darkviolet];
5284[label="217.172.173.80;2pkt 2fpkt", shape=invtriangle, color=brown];
5729[label="208.200.92.180;9pkt 9fpkt", shape=invtriangle, color=brown];
5791[label="206.216.181.195;6pkt 6fpkt", shape=invtriangle, color=brown];
5932[label="5.218.244.233;4pkt 4fpkt", shape=invtriangle, color=brown];
6453[label="208.200.92.180;9pkt 9fpkt", shape=invhouse, color=bisque];
6562[label="5.218.244.233;4pkt 4fpkt", shape=invhouse, color=bisque];
stat509[shape=component, label=&lt;Rules:&lt;BR/&gt;{21.244.225.14:80, 132.117.180.177:*}[24.1135%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.8971%)&lt;BR/&gt; 53: (0.919118%)&lt;BR/&gt; 4056: (0.735294%)&lt;BR/&gt; 4055: (0.735294%)&lt;BR/&gt; 4004: (0.735294%)&gt;];
}
657--1484[label="1;6pkt 6fpkt"];
657--1485[label="1;4pkt 4fpkt"];
657--1486[label="1;5pkt 5fpkt"];
657--2166[label="1;2pkt 2fpkt"];
657--2168[label="1;2pkt 2fpkt"];
657--2613[label="1;2pkt 2fpkt"];
657--3064[label="1;33pkt 33fpkt"];
657--3386[label="1;9pkt 9fpkt"];
657--3405[label="1;2pkt 2fpkt"];
657--3436[label="1;1pkt 1fpkt"];
657--3619[label="1;2pkt 2fpkt"];
657--3863[label="1;5pkt 5fpkt"];
657--4412[label="1;9pkt 9fpkt"];
657--4435[label="1;7pkt 7fpkt"];
657--4534[label="1;6pkt 6fpkt"];
657--4807[label="0.5;2pkt 2fpkt"];
657--5284[label="1;2pkt 2fpkt"];
657--5729[label="1;9pkt 9fpkt"];
657--5791[label="1;6pkt 6fpkt"];
657--5932[label="0.5;2pkt 2fpkt"];
657--6453[label="1;9pkt 9fpkt"];
657--6562[label="0.5;2pkt 2fpkt"];
1484--4435[label="1;6pkt 6fpkt"];
1485--4534[label="1;4pkt 4fpkt"];
1485--5791[label="1;4pkt 4fpkt"];
1486--3863[label="1;5pkt 5fpkt"];
2166--3405[label="1;2pkt 2fpkt"];
2168--3436[label="1;1pkt 1fpkt"];
3619--5284[label="1;2pkt 2fpkt"];
4412--5729[label="1;9pkt 9fpkt"];
4412--6453[label="1;9pkt 9fpkt"];
4534--5791[label="1;6pkt 6fpkt"];
4807--5932[label="1;4pkt 4fpkt"];
4807--6562[label="1;4pkt 4fpkt"];
5729--6453[label="1;9pkt 9fpkt"];
5932--6562[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="132.117.180.177" src_ip="21.244.225.14" src_port="80"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478020" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="152.20.141.197"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_511{
style=filled;
color=gray75;
403[label="152.20.61.40;s;289pkt 289fpkt", shape=diamond, color=yellow];
1267[label="1.184.95.21;d;181pkt 181fpkt", shape=diamond, color=yellow];
2111[label="200.204.35.33;d;27pkt 27fpkt", shape=diamond, color=yellow];
2339[label="152.20.187.197;s;22pkt 22fpkt", shape=diamond, color=yellow];
3289[label="152.20.61.40;300pkt 300fpkt", shape=pentagon, color=darkviolet];
4556[label="152.20.187.197;22pkt 22fpkt", shape=pentagon, color=darkviolet];
5800[label="152.20.187.197;22pkt 22fpkt", shape=invtriangle, color=brown];
stat511[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.20.61.40:80, 1.184.95.21:*}[58.0745%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2792: (0.23175%)&lt;BR/&gt; 2791: (0.23175%)&lt;BR/&gt; 2790: (0.23175%)&lt;BR/&gt; 2789: (0.23175%)&gt;];
}
403--1267[label="1;181pkt 181fpkt"];
403--2111[label="0.185185;5pkt 5fpkt"];
403--3289[label="1;289pkt 289fpkt"];
1267--3289[label="1;181pkt 181fpkt"];
2111--2339[label="1;22pkt 22fpkt"];
2111--3289[label="0.185185;5pkt 5fpkt"];
2111--4556[label="1;22pkt 22fpkt"];
2111--5800[label="1;22pkt 22fpkt"];
2339--4556[label="1;22pkt 22fpkt"];
2339--5800[label="1;22pkt 22fpkt"];
4556--5800[label="1;22pkt 22fpkt"];
</description>
    <slice>
      <filter dst_ip="1.184.95.21" src_ip="152.20.61.40" src_port="80"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.169.232.197"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123477392" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.169.232.198"/>
    </slice>
    <from sec="1123477219" usec="0"/>
    <to sec="1123478097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.169.234.200"/>
    </slice>
    <from sec="1123477289" usec="0"/>
    <to sec="1123478095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.169.209.202"/>
    </slice>
    <from sec="1123477395" usec="0"/>
    <to sec="1123478077" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="1.150.12.203"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.27157,1.93922,999,1 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_518{
style=filled;
color=gray75;
26[label="211.179.116.203s;24pkt 24fpkt", shape=rectangle, color=red];
194[label="132.117.210.34;d;87pkt 87fpkt", shape=diamond, color=yellow];
195[label="211.179.116.203;s;36pkt 36fpkt", shape=diamond, color=yellow];
1759[label="210.120.199.135;s;12pkt 12fpkt", shape=diamond, color=yellow];
3070[label="210.106.134.15;47pkt 47fpkt", shape=pentagon, color=darkviolet];
4404[label="205.45.83.179;6pkt 6fpkt", shape=pentagon, color=darkviolet];
4587[label="211.179.116.203;37pkt 37fpkt", shape=pentagon, color=darkviolet];
stat518[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.106.134.15:80, 132.117.210.34:*}[41.3793%]&lt;BR/&gt;{211.179.116.203:*, 132.117.210.34:*}[31.8966%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (16.6667%)&lt;BR/&gt; 21: (12.249%)&lt;BR/&gt; 1863: (2.40964%)&lt;BR/&gt; 3001: (1.60643%)&lt;BR/&gt; 8850: (0.803213%)&gt;];
}
26--194[label="0.833333;20pkt 20fpkt"];
26--195[label="0.958333;23pkt 23fpkt"];
26--4587[label="1;24pkt 24fpkt"];
194--195[label="0.833333;30pkt 30fpkt"];
194--1759[label="1;12pkt 12fpkt"];
194--3070[label="0.638298;30pkt 30fpkt"];
194--4404[label="0.166667;1pkt 1fpkt"];
194--4587[label="0.810811;30pkt 30fpkt"];
195--4587[label="1;36pkt 36fpkt"];
</description>
    <slice>
      <filter dst_ip="132.117.210.34" src_ip="211.179.116.203"/>
      <filter dst_ip="132.117.210.34" src_ip="210.106.134.15" src_port="80"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,020,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_519{
style=filled;
color=gray75;
1508[label="210.116.228.4;d;346pkt 346fpkt", shape=diamond, color=yellow];
1531[label="71.112.176.110;d;342pkt 342fpkt", shape=diamond, color=yellow];
1724[label="214.187.128.226;d;311pkt 311fpkt", shape=diamond, color=yellow];
3527[label="201.117.147.69;22pkt 22fpkt", shape=pentagon, color=darkviolet];
4590[label="200.89.3.204;67pkt 67fpkt", shape=pentagon, color=darkviolet];
stat519[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 210.116.228.4:0}[31.9188%]&lt;BR/&gt;{*:0, 71.112.176.110:0}[31.5498%]&lt;BR/&gt;{*:0, 214.187.128.226:0}[28.69%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.8162%)&lt;BR/&gt; 139: (0.0919118%)&lt;BR/&gt; 3961: (0.0459559%)&lt;BR/&gt; 3356: (0.0459559%)&gt;];
}
1508--2219[label="0.00392157;1pkt 1fpkt"];
1508--2276[label="0.00416667;1pkt 1fpkt"];
1508--2282[label="0.0052356;1pkt 1fpkt"];
1508--2508[label="0.00409836;1pkt 1fpkt"];
1508--2732[label="0.00289017;1pkt 1fpkt"];
1508--3014[label="0.00421941;1pkt 1fpkt"];
1508--3144[label="0.00740741;1pkt 1fpkt"];
1508--3301[label="0.00787402;1pkt 1fpkt"];
1508--3527[label="0.0454545;1pkt 1fpkt"];
1508--3634[label="0.00289017;1pkt 1fpkt"];
1508--3970[label="0.00387597;1pkt 1fpkt"];
1508--4030[label="0.0078125;1pkt 1fpkt"];
1508--4590[label="0.0149254;1pkt 1fpkt"];
1508--4669[label="0.00289017;1pkt 1fpkt"];
1508--4747[label="0.00471698;1pkt 1fpkt"];
1508--4758[label="0.00383142;1pkt 1fpkt"];
1508--4961[label="0.00420168;1pkt 1fpkt"];
1508--5028[label="0.00746269;1pkt 1fpkt"];
1508--5296[label="0.00289017;1pkt 1fpkt"];
1508--5328[label="0.0037037;1pkt 1fpkt"];
1508--5860[label="0.00289017;1pkt 1fpkt"];
1508--6527[label="0.00289017;1pkt 1fpkt"];
1531--2276[label="0.00416667;1pkt 1fpkt"];
1531--2282[label="0.0052356;1pkt 1fpkt"];
1531--2508[label="0.00409836;1pkt 1fpkt"];
1531--2732[label="0.00292398;1pkt 1fpkt"];
1531--3014[label="0.00421941;1pkt 1fpkt"];
1531--3144[label="0.00740741;1pkt 1fpkt"];
1531--3301[label="0.00787402;1pkt 1fpkt"];
1531--3634[label="0.00292398;1pkt 1fpkt"];
1531--3970[label="0.00387597;1pkt 1fpkt"];
1531--4030[label="0.0078125;1pkt 1fpkt"];
1531--4590[label="0.0149254;1pkt 1fpkt"];
1531--4669[label="0.00292398;1pkt 1fpkt"];
1531--4747[label="0.00471698;1pkt 1fpkt"];
1531--4758[label="0.00383142;1pkt 1fpkt"];
1531--4961[label="0.00420168;1pkt 1fpkt"];
1531--5028[label="0.00746269;1pkt 1fpkt"];
1531--5296[label="0.00292398;1pkt 1fpkt"];
1531--5860[label="0.00292398;1pkt 1fpkt"];
1531--6527[label="0.00292398;1pkt 1fpkt"];
1724--1807[label="0.00826446;1pkt 1fpkt"];
1724--2219[label="0.00392157;1pkt 1fpkt"];
1724--2276[label="0.00416667;1pkt 1fpkt"];
1724--2282[label="0.0052356;1pkt 1fpkt"];
1724--2508[label="0.00409836;1pkt 1fpkt"];
1724--2732[label="0.00321543;1pkt 1fpkt"];
1724--3014[label="0.00421941;1pkt 1fpkt"];
1724--3144[label="0.00740741;1pkt 1fpkt"];
1724--3634[label="0.00321543;1pkt 1fpkt"];
1724--3970[label="0.00387597;1pkt 1fpkt"];
1724--4030[label="0.0078125;1pkt 1fpkt"];
1724--4590[label="0.0149254;1pkt 1fpkt"];
1724--4669[label="0.00321543;1pkt 1fpkt"];
1724--4675[label="0.00813008;1pkt 1fpkt"];
1724--4747[label="0.00471698;1pkt 1fpkt"];
1724--4758[label="0.00383142;1pkt 1fpkt"];
1724--4961[label="0.00420168;1pkt 1fpkt"];
1724--5028[label="0.00746269;1pkt 1fpkt"];
1724--5296[label="0.00321543;1pkt 1fpkt"];
1724--5328[label="0.0037037;1pkt 1fpkt"];
1724--5860[label="0.00321543;1pkt 1fpkt"];
1724--5864[label="0.00813008;1pkt 1fpkt"];
1724--6527[label="0.00321543;1pkt 1fpkt"];
1724--6530[label="0.00813008;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="210.116.228.4"/>
      <filter dst_ip="71.112.176.110"/>
      <filter dst_ip="214.187.128.226"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="18.67.39.204"/>
    </slice>
    <from sec="1123477226" usec="0"/>
    <to sec="1123478097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="64.170.3.206"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="20.154.208.206"/>
    </slice>
    <from sec="1123477241" usec="0"/>
    <to sec="1123478094" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="152.20.250.207"/>
    </slice>
    <from sec="1123477588" usec="0"/>
    <to sec="1123477616" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="69.26.13.208"/>
    </slice>
    <from sec="1123477205" usec="0"/>
    <to sec="1123478093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.118.150.208"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="1.109.217.208"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="201.104.77.209"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="1.3.84.210"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="172.118.94.210"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="98.39.156.210"/>
    </slice>
    <from sec="1123477325" usec="0"/>
    <to sec="1123477372" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="2.217.178.210"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.169.245.210"/>
    </slice>
    <from sec="1123477533" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="152.21.38.213"/>
    </slice>
    <from sec="1123477396" usec="0"/>
    <to sec="1123478090" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.147.50.213"/>
    </slice>
    <from sec="1123477213" usec="0"/>
    <to sec="1123478096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.80.118.213"/>
    </slice>
    <from sec="1123477250" usec="0"/>
    <to sec="1123478092" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="201.24.149.213"/>
    </slice>
    <from sec="1123477341" usec="0"/>
    <to sec="1123477385" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="69.7.38.214"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_539{
style=filled;
color=gray75;
1677[label="197.177.69.161;d;1pkt 1fpkt", shape=diamond, color=yellow];
4673[label="200.89.26.215;29pkt 29fpkt", shape=pentagon, color=darkviolet];
stat539[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.89.26.215:2074, *:53}[65.5172%]&lt;BR/&gt;{200.89.26.215:0, *:0}[31.0345%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2074: (31.6667%)&lt;BR/&gt; 53: (31.6667%)&lt;BR/&gt; 0: (30%)&lt;BR/&gt; 4395: (3.33333%)&lt;BR/&gt; 80: (3.33333%)&gt;];
}
1677--4673[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_port="53" src_ip="200.89.26.215" src_port="2074"/>
      <filter src_ip="200.89.26.215"/>
    </slice>
    <from sec="1123477216" usec="0"/>
    <to sec="1123477963" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,011,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_540{
style=filled;
color=gray75;
2180[label="214.176.194.215;s;638pkt 638fpkt", shape=diamond, color=yellow];
4677[label="214.176.194.215;795pkt 795fpkt", shape=pentagon, color=darkviolet];
5866[label="214.176.194.215;795pkt 795fpkt", shape=invtriangle, color=brown];
6531[label="214.176.194.215;795pkt 795fpkt", shape=invhouse, color=bisque];
stat540[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.176.194.215:0, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (50%)&lt;BR/&gt; 47595: (0.132319%)&lt;BR/&gt; 37099: (0.132319%)&lt;BR/&gt; 30462: (0.132319%)&lt;BR/&gt; 29470: (0.132319%)&gt;];
}
2180--4677[label="0.998433;637pkt 637fpkt"];
2180--5866[label="0.998433;637pkt 637fpkt"];
2180--6531[label="0.998433;637pkt 637fpkt"];
4677--5866[label="1;795pkt 795fpkt"];
4677--6531[label="1;795pkt 795fpkt"];
5866--6531[label="1;795pkt 795fpkt"];
</description>
    <slice>
      <filter src_ip="214.176.194.215"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.179.20.216"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="6.136.227.216"/>
    </slice>
    <from sec="1123477211" usec="0"/>
    <to sec="1123477603" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="16.50.137.217"/>
    </slice>
    <from sec="1123477208" usec="0"/>
    <to sec="1123478089" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.170.20.218"/>
    </slice>
    <from sec="1123477222" usec="0"/>
    <to sec="1123478095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_547{
style=filled;
color=gray75;
1140[label="158.47.91.218;s;72pkt 72fpkt", shape=diamond, color=yellow];
1894[label="205.200.67.134;d;117pkt 117fpkt", shape=diamond, color=yellow];
4694[label="158.47.91.218;215pkt 215fpkt", shape=pentagon, color=darkviolet];
stat547[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.47.91.218:*, 205.200.67.134:80}[81.8605%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3671: (0.247525%)&lt;BR/&gt; 3670: (0.247525%)&lt;BR/&gt; 3668: (0.247525%)&lt;BR/&gt; 3667: (0.247525%)&gt;];
}
1140--2875[label="0.486111;35pkt 35fpkt"];
1140--4694[label="1;72pkt 72fpkt"];
1894--4694[label="1;117pkt 117fpkt"];
</description>
    <slice>
      <filter dst_ip="205.200.67.134" dst_port="80" src_ip="158.47.91.218"/>
    </slice>
    <from sec="1123477212" usec="0"/>
    <to sec="1123477827" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="71.4.160.219"/>
    </slice>
    <from sec="1123477208" usec="0"/>
    <to sec="1123477475" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.60.78.220"/>
    </slice>
    <from sec="1123478070" usec="0"/>
    <to sec="1123478095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.32.148.222"/>
    </slice>
    <from sec="1123477202" usec="0"/>
    <to sec="1123477631" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.214.188.223"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123477645" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="3.162.11.224"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="169.169.232.224"/>
    </slice>
    <from sec="1123477209" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="221.205.249.224"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_555{
style=filled;
color=gray75;
921[label="192.116.166.225;s;1101pkt 1101fpkt", shape=diamond, color=yellow];
4749[label="192.116.166.225;1278pkt 1278fpkt", shape=pentagon, color=darkviolet];
stat555[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.116.166.225:53, *:*}[99.8435%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (57.0198%)&lt;BR/&gt; 32768: (3.93022%)&lt;BR/&gt; 32769: (1.40815%)&lt;BR/&gt; 1024: (1.15595%)&lt;BR/&gt; 5353: (0.462379%)&gt;];
}
921--2874[label="0.00999092;11pkt 11fpkt"];
921--2884[label="0.0108992;12pkt 12fpkt"];
921--2889[label="0.000908265;1pkt 1fpkt"];
921--2893[label="0.000908265;1pkt 1fpkt"];
921--2898[label="0.0108992;12pkt 12fpkt"];
921--2903[label="0.000908265;1pkt 1fpkt"];
921--2907[label="0.000908265;1pkt 1fpkt"];
921--2913[label="0.000908265;1pkt 1fpkt"];
921--2917[label="0.000908265;1pkt 1fpkt"];
921--4749[label="1;1101pkt 1101fpkt"];
</description>
    <slice>
      <filter src_ip="192.116.166.225" src_port="53"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="158.189.107.227"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="158.160.186.227"/>
    </slice>
    <from sec="1123477212" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="0.250.8.229"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.41.81.229"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="158.160.178.230"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_561{
style=filled;
color=gray75;
1166[label="210.173.76.205;d;145pkt 145fpkt", shape=diamond, color=yellow];
4744[label="158.47.65.225;90pkt 90fpkt", shape=pentagon, color=darkviolet];
4784[label="172.118.42.231;59pkt 59fpkt", shape=pentagon, color=darkviolet];
stat561[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.47.65.225:*, 210.173.76.205:80}[59.7315%]&lt;BR/&gt;{172.118.42.231:*, 210.173.76.205:80}[38.9262%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4783: (0.340136%)&lt;BR/&gt; 4782: (0.340136%)&lt;BR/&gt; 4781: (0.340136%)&lt;BR/&gt; 4780: (0.340136%)&gt;];
}
1166--2875[label="0.0965517;14pkt 14fpkt"];
1166--4744[label="0.966667;87pkt 87fpkt"];
1166--4784[label="0.983051;58pkt 58fpkt"];
</description>
    <slice>
      <filter dst_ip="210.173.76.205" dst_port="80" src_ip="158.47.65.225"/>
      <filter dst_ip="210.173.76.205" dst_port="80" src_ip="172.118.42.231"/>
    </slice>
    <from sec="1123477246" usec="0"/>
    <to sec="1123477882" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.169.189.233"/>
    </slice>
    <from sec="1123477568" usec="0"/>
    <to sec="1123477994" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="205.11.69.234"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="220.81.133.234"/>
    </slice>
    <from sec="1123477206" usec="0"/>
    <to sec="1123478095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.204.55.235"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.97.205.236"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="71.162.132.240"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,010,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_568{
style=filled;
color=gray75;
1186[label="71.33.42.241;s;508pkt 508fpkt", shape=diamond, color=yellow];
4850[label="71.33.42.241;508pkt 508fpkt", shape=pentagon, color=darkviolet];
5959[label="71.33.42.241;508pkt 508fpkt", shape=invtriangle, color=brown];
stat568[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.33.42.241:*, *:139}[50%]&lt;BR/&gt;{71.33.42.241:*, *:445}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (25%)&lt;BR/&gt; 139: (25%)&lt;BR/&gt; 4293: (0.0984252%)&lt;BR/&gt; 4291: (0.0984252%)&lt;BR/&gt; 4289: (0.0984252%)&gt;];
}
1186--4850[label="1;508pkt 508fpkt"];
1186--5959[label="1;508pkt 508fpkt"];
4850--5959[label="1;508pkt 508fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="71.33.42.241"/>
      <filter dst_port="139" src_ip="71.33.42.241"/>
    </slice>
    <from sec="1123477344" usec="0"/>
    <to sec="1123477492" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_569{
style=filled;
color=gray75;
2549[label="4.42.42.243;s;42pkt 42fpkt", shape=diamond, color=yellow];
4862[label="4.42.42.243;44pkt 44fpkt", shape=pentagon, color=darkviolet];
5966[label="4.42.42.243;44pkt 44fpkt", shape=invtriangle, color=brown];
6579[label="4.42.42.243;44pkt 44fpkt", shape=invhouse, color=bisque];
stat569[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.42.42.243:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 49343: (1.14943%)&lt;BR/&gt; 49338: (1.14943%)&lt;BR/&gt; 4833: (1.14943%)&lt;BR/&gt; 4832: (1.14943%)&gt;];
}
2549--2684[label="0.0238095;1pkt 1fpkt"];
2549--4862[label="1;42pkt 42fpkt"];
2549--5966[label="1;42pkt 42fpkt"];
2549--6579[label="1;42pkt 42fpkt"];
4862--5966[label="1;44pkt 44fpkt"];
4862--6579[label="1;44pkt 44fpkt"];
5966--6579[label="1;44pkt 44fpkt"];
</description>
    <slice>
      <filter src_ip="4.42.42.243" src_port="80"/>
    </slice>
    <from sec="1123477238" usec="0"/>
    <to sec="1123478079" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="70.107.78.244"/>
    </slice>
    <from sec="1123477202" usec="0"/>
    <to sec="1123477285" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="7.222.124.244"/>
    </slice>
    <from sec="1123477254" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.224.10.245"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="71.122.11.245"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="20.134.166.246"/>
    </slice>
    <from sec="1123477239" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="20.177.164.248"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="19.148.83.249"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="211.204.43.250"/>
    </slice>
    <from sec="1123477202" usec="0"/>
    <to sec="1123478095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_579{
style=filled;
color=gray75;
167[label="132.117.28.89;d;147pkt 147fpkt", shape=diamond, color=yellow];
230[label="64.55.18.229;s;1pkt 1fpkt", shape=diamond, color=yellow];
296[label="64.55.137.250;s;1pkt 1fpkt", shape=diamond, color=yellow];
895[label="64.55.165.146;s;1pkt 1fpkt", shape=diamond, color=yellow];
4773[label="64.55.18.229;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4893[label="64.55.137.250;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5915[label="64.55.18.229;1pkt 1fpkt", shape=invtriangle, color=brown];
stat579[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 132.117.28.89:8402}[93.1973%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8402: (44.7712%)&lt;BR/&gt; 8403: (2.94118%)&lt;BR/&gt; 8404: (1.63399%)&lt;BR/&gt; 1129: (1.63399%)&lt;BR/&gt; 1132: (0.980392%)&gt;];
}
167--230[label="1;1pkt 1fpkt"];
167--296[label="1;1pkt 1fpkt"];
167--895[label="1;1pkt 1fpkt"];
167--4773[label="1;1pkt 1fpkt"];
167--4893[label="1;1pkt 1fpkt"];
167--5915[label="1;1pkt 1fpkt"];
230--4773[label="1;1pkt 1fpkt"];
230--5915[label="1;1pkt 1fpkt"];
296--4893[label="1;1pkt 1fpkt"];
4773--5915[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="132.117.28.89" dst_port="8402"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="152.20.141.251"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,504,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_581{
style=filled;
color=gray75;
592[label="105.202.174.243;s;41pkt 41fpkt", shape=diamond, color=yellow];
948[label="105.202.174.251;s;235pkt 235fpkt", shape=diamond, color=yellow];
1304[label="105.202.174.197;s;85pkt 85fpkt", shape=diamond, color=yellow];
1311[label="172.118.150.197;d;2pkt 2fpkt", shape=diamond, color=yellow];
1437[label="172.118.74.253;d;79pkt 79fpkt", shape=diamond, color=yellow];
2100[label="200.85.21.100;d;79pkt 79fpkt", shape=diamond, color=yellow];
2132[label="132.117.82.206;d;102pkt 102fpkt", shape=diamond, color=yellow];
4555[label="105.202.174.197;98pkt 98fpkt", shape=pentagon, color=darkviolet];
4897[label="105.202.174.251;242pkt 242fpkt", shape=pentagon, color=darkviolet];
5987[label="105.202.174.251;242pkt 242fpkt", shape=invtriangle, color=brown];
6587[label="105.202.174.251;242pkt 242fpkt", shape=invhouse, color=bisque];
stat581[shape=component, label=&lt;Rules:&lt;BR/&gt;{105.202.174.251:443, *:*}[53.1328%]&lt;BR/&gt;{105.202.174.197:443, *:*}[24.5614%]&lt;BR/&gt;{*:443, 132.117.82.206:*}[22.807%]&lt;BR/&gt;{*:443, 172.118.74.253:*}[21.8045%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (43.5038%)&lt;BR/&gt; 80: (4.9067%)&lt;BR/&gt; 143: (1.03663%)&lt;BR/&gt; 993: (0.24188%)&lt;BR/&gt; 57673: (0.172771%)&gt;];
}
592--1311[label="0.5;1pkt 1fpkt"];
592--1741[label="0.0243902;1pkt 1fpkt"];
592--2132[label="0.0487805;2pkt 2fpkt"];
592--2191[label="0.0243902;1pkt 1fpkt"];
592--2804[label="0.0243902;1pkt 1fpkt"];
948--1437[label="0.886076;70pkt 70fpkt"];
948--2100[label="0.64557;51pkt 51fpkt"];
948--2132[label="0.72549;74pkt 74fpkt"];
948--4897[label="1;235pkt 235fpkt"];
948--5987[label="1;235pkt 235fpkt"];
948--6587[label="1;235pkt 235fpkt"];
1304--1437[label="0.0759494;6pkt 6fpkt"];
1304--2100[label="0.278481;22pkt 22fpkt"];
1304--2132[label="0.211765;18pkt 18fpkt"];
1304--4555[label="1;85pkt 85fpkt"];
1437--4555[label="0.0759494;6pkt 6fpkt"];
1437--4897[label="0.886076;70pkt 70fpkt"];
1437--5987[label="0.886076;70pkt 70fpkt"];
1437--6587[label="0.886076;70pkt 70fpkt"];
2100--4555[label="0.278481;22pkt 22fpkt"];
2100--4897[label="0.64557;51pkt 51fpkt"];
2100--5987[label="0.64557;51pkt 51fpkt"];
2100--6587[label="0.64557;51pkt 51fpkt"];
2132--4555[label="0.183673;18pkt 18fpkt"];
2132--4897[label="0.72549;74pkt 74fpkt"];
2132--5987[label="0.72549;74pkt 74fpkt"];
2132--6587[label="0.72549;74pkt 74fpkt"];
4897--5987[label="1;242pkt 242fpkt"];
4897--6587[label="1;242pkt 242fpkt"];
5987--6587[label="1;242pkt 242fpkt"];
</description>
    <slice>
      <filter src_ip="105.202.174.251" src_port="443"/>
      <filter src_ip="105.202.174.197" src_port="443"/>
      <filter dst_ip="132.117.82.206" src_port="443"/>
      <filter dst_ip="172.118.74.253" src_port="443"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.182.66.253"/>
    </slice>
    <from sec="1123477661" usec="0"/>
    <to sec="1123477684" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.396214,1.99488,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="0.109.165.253"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_584{
style=filled;
color=gray75;
2946[label="152.20.88.2;20pkt 20fpkt", shape=pentagon, color=darkviolet];
4921[label="152.20.88.2;20pkt 20fpkt", shape=invtriangle, color=brown];
stat584[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.20.88.2:80, *:*}[85%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (42.5%)&lt;BR/&gt; 0: (15%)&lt;BR/&gt; 58446: (2.5%)&lt;BR/&gt; 57637: (2.5%)&lt;BR/&gt; 56593: (2.5%)&gt;];
}
2946--4921[label="1;20pkt 20fpkt"];
</description>
    <slice>
      <filter src_ip="152.20.88.2" src_port="80"/>
    </slice>
    <from sec="1123477334" usec="0"/>
    <to sec="1123478078" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_585{
style=filled;
color=gray75;
2947[label="172.118.150.2;30pkt 30fpkt", shape=pentagon, color=darkviolet];
4922[label="172.118.150.2;30pkt 30fpkt", shape=invtriangle, color=brown];
stat585[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.118.150.2:*, 209.129.10.233:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3142: (1.66667%)&lt;BR/&gt; 3141: (1.66667%)&lt;BR/&gt; 3140: (1.66667%)&lt;BR/&gt; 3137: (1.66667%)&gt;];
}
2947--4922[label="1;30pkt 30fpkt"];
</description>
    <slice>
      <filter dst_ip="209.129.10.233" dst_port="80" src_ip="172.118.150.2"/>
    </slice>
    <from sec="1123477226" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="169.169.231.2"/>
    </slice>
    <from sec="1123477213" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,012,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_587{
style=filled;
color=gray75;
1783[label="192.166.170.3;s;3pkt 3fpkt", shape=diamond, color=yellow];
2224[label="68.137.2.73;d;1pkt 1fpkt", shape=diamond, color=yellow];
2959[label="192.166.170.3;3pkt 3fpkt", shape=pentagon, color=darkviolet];
4928[label="192.166.170.3;3pkt 3fpkt", shape=invtriangle, color=brown];
stat587[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.166.170.3:1433, 219.210.134.50:3619}[25%]&lt;BR/&gt;{192.166.170.3:139, 219.172.5.66:3911}[25%]&lt;BR/&gt;{192.166.170.3:80, 68.137.2.73:9063}[25%]&lt;BR/&gt;{192.166.170.3:80, 16.210.230.237:1767}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (25%)&lt;BR/&gt; 3619: (15%)&lt;BR/&gt; 1767: (15%)&lt;BR/&gt; 1433: (15%)&lt;BR/&gt; 9063: (10%)&gt;];
}
1783--2224[label="1;1pkt 1fpkt"];
1783--2959[label="0.666667;2pkt 2fpkt"];
1783--4928[label="0.666667;2pkt 2fpkt"];
2959--4928[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="16.210.230.237" dst_port="1767" src_ip="192.166.170.3" src_port="80"/>
      <filter dst_ip="68.137.2.73" dst_port="9063" src_ip="192.166.170.3" src_port="80"/>
      <filter dst_ip="219.172.5.66" dst_port="3911" src_ip="192.166.170.3" src_port="139"/>
      <filter dst_ip="219.210.134.50" dst_port="3619" src_ip="192.166.170.3" src_port="1433"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="1.107.6.4"/>
    </slice>
    <from sec="1123477320" usec="0"/>
    <to sec="1123478078" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_589{
style=filled;
color=gray75;
2963[label="6.12.37.4;28pkt 28fpkt", shape=pentagon, color=darkviolet];
4931[label="6.12.37.4;27pkt 27fpkt", shape=invtriangle, color=brown];
stat589[shape=component, label=&lt;Rules:&lt;BR/&gt;{6.12.37.4:*, 201.117.144.45:80}[92.8571%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 64003: (1.81818%)&lt;BR/&gt; 56323: (1.81818%)&lt;BR/&gt; 52908: (1.81818%)&lt;BR/&gt; 46299: (1.81818%)&gt;];
}
2963--4931[label="1;27pkt 27fpkt"];
</description>
    <slice>
      <filter dst_ip="201.117.144.45" dst_port="80" src_ip="6.12.37.4"/>
    </slice>
    <from sec="1123477222" usec="0"/>
    <to sec="1123478097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,020,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_590{
style=filled;
color=gray75;
2969[label="201.117.151.4;133pkt 133fpkt", shape=pentagon, color=darkviolet];
4934[label="201.117.151.4;132pkt 132fpkt", shape=invtriangle, color=brown];
6009[label="201.117.151.4;132pkt 132fpkt", shape=invhouse, color=bisque];
stat590[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.117.151.4:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2969--4934[label="1;132pkt 132fpkt"];
2969--6009[label="1;132pkt 132fpkt"];
4934--6009[label="1;132pkt 132fpkt"];
</description>
    <slice>
      <filter src_ip="201.117.151.4"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="208.93.123.6"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="4.97.250.6"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478087" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_593{
style=filled;
color=gray75;
2999[label="6.168.76.8;3pkt 3fpkt", shape=pentagon, color=darkviolet];
4954[label="6.168.76.8;3pkt 3fpkt", shape=invtriangle, color=brown];
stat593[shape=component, label=&lt;Rules:&lt;BR/&gt;{6.168.76.8:80, 172.118.167.49:1043}[33.3333%]&lt;BR/&gt;{6.168.76.8:80, 172.118.46.243:33308}[33.3333%]&lt;BR/&gt;{6.168.76.8:80, 172.118.46.243:33309}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 33309: (16.6667%)&lt;BR/&gt; 33308: (16.6667%)&lt;BR/&gt; 1043: (16.6667%)&gt;];
}
2999--4954[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="172.118.46.243" dst_port="33309" src_ip="6.168.76.8" src_port="80"/>
      <filter dst_ip="172.118.46.243" dst_port="33308" src_ip="6.168.76.8" src_port="80"/>
      <filter dst_ip="172.118.167.49" dst_port="1043" src_ip="6.168.76.8" src_port="80"/>
    </slice>
    <from sec="1123477632" usec="0"/>
    <to sec="1123478043" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_594{
style=filled;
color=gray75;
3001[label="71.219.220.8;5pkt 5fpkt", shape=pentagon, color=darkviolet];
4955[label="71.219.220.8;4pkt 4fpkt", shape=invtriangle, color=brown];
6025[label="71.219.220.8;4pkt 4fpkt", shape=invhouse, color=bisque];
stat594[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.219.220.8:9548, 172.118.214.87:2640}[20%]&lt;BR/&gt;{71.219.220.8:9548, 172.118.214.87:2643}[20%]&lt;BR/&gt;{71.219.220.8:9548, 172.118.214.87:2645}[20%]&lt;BR/&gt;{71.219.220.8:9548, 172.118.214.87:2649}[20%]&lt;BR/&gt;{71.219.220.8:9548, 172.118.214.87:2651}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9548: (50%)&lt;BR/&gt; 2651: (11.5385%)&lt;BR/&gt; 2649: (11.5385%)&lt;BR/&gt; 2645: (11.5385%)&lt;BR/&gt; 2643: (11.5385%)&gt;];
}
3001--4955[label="1;4pkt 4fpkt"];
3001--6025[label="1;4pkt 4fpkt"];
4955--6025[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="172.118.214.87" dst_port="2651" src_ip="71.219.220.8" src_port="9548"/>
      <filter dst_ip="172.118.214.87" dst_port="2649" src_ip="71.219.220.8" src_port="9548"/>
      <filter dst_ip="172.118.214.87" dst_port="2645" src_ip="71.219.220.8" src_port="9548"/>
      <filter dst_ip="172.118.214.87" dst_port="2643" src_ip="71.219.220.8" src_port="9548"/>
      <filter dst_ip="172.118.214.87" dst_port="2640" src_ip="71.219.220.8" src_port="9548"/>
    </slice>
    <from sec="1123477974" usec="0"/>
    <to sec="1123477995" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,020,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_595{
style=filled;
color=gray75;
3011[label="158.189.189.9;49pkt 49fpkt", shape=pentagon, color=darkviolet];
4959[label="158.189.189.9;49pkt 49fpkt", shape=invtriangle, color=brown];
6028[label="158.189.189.9;48pkt 48fpkt", shape=invhouse, color=bisque];
stat595[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.189.189.9:24069, *:*}[36.7347%]&lt;BR/&gt;{158.189.189.9:0, *:0}[34.6939%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (34.2466%)&lt;BR/&gt; 24069: (18.4932%)&lt;BR/&gt; 443: (8.21918%)&lt;BR/&gt; 80: (6.16438%)&lt;BR/&gt; 43548: (2.05479%)&gt;];
}
3011--4959[label="1;49pkt 49fpkt"];
3011--6028[label="1;48pkt 48fpkt"];
4959--6028[label="1;48pkt 48fpkt"];
</description>
    <slice>
      <filter src_ip="158.189.189.9" src_port="24069"/>
      <filter src_ip="158.189.189.9"/>
    </slice>
    <from sec="1123477214" usec="0"/>
    <to sec="1123478095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,020,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_596{
style=filled;
color=gray75;
3014[label="200.89.13.10;237pkt 237fpkt", shape=pentagon, color=darkviolet];
4961[label="200.89.13.10;238pkt 238fpkt", shape=invtriangle, color=brown];
stat596[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.89.13.10:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
3014--4961[label="1;237pkt 237fpkt"];
</description>
    <slice>
      <filter src_ip="200.89.13.10"/>
    </slice>
    <from sec="1123477206" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_597{
style=filled;
color=gray75;
3025[label="4.126.59.11;16pkt 16fpkt", shape=pentagon, color=darkviolet];
4964[label="4.126.59.11;16pkt 16fpkt", shape=invtriangle, color=brown];
stat597[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.126.59.11:80, 158.47.4.241:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3728: (3.125%)&lt;BR/&gt; 3727: (3.125%)&lt;BR/&gt; 3726: (3.125%)&lt;BR/&gt; 3724: (3.125%)&gt;];
}
3025--4964[label="1;16pkt 16fpkt"];
</description>
    <slice>
      <filter dst_ip="158.47.4.241" src_ip="4.126.59.11" src_port="80"/>
    </slice>
    <from sec="1123477542" usec="0"/>
    <to sec="1123477875" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_598{
style=filled;
color=gray75;
3037[label="6.168.76.12;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4972[label="6.168.76.12;1pkt 1fpkt", shape=invtriangle, color=brown];
6035[label="6.168.76.12;1pkt 1fpkt", shape=invhouse, color=bisque];
stat598[shape=component, label=&lt;Rules:&lt;BR/&gt;{6.168.76.12:80, 172.118.216.104:2021}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2021: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
3037--4972[label="1;1pkt 1fpkt"];
3037--6035[label="1;1pkt 1fpkt"];
4972--6035[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="172.118.216.104" dst_port="2021" src_ip="6.168.76.12" src_port="80"/>
    </slice>
    <from sec="1123478001" usec="0"/>
    <to sec="1123478020" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_599{
style=filled;
color=gray75;
3038[label="201.0.79.12;10pkt 10fpkt", shape=pentagon, color=darkviolet];
4973[label="201.0.79.12;9pkt 9fpkt", shape=invtriangle, color=brown];
6036[label="201.0.79.12;10pkt 10fpkt", shape=invhouse, color=bisque];
stat599[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.0.79.12:*, 200.89.34.102:80}[90%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.5517%)&lt;BR/&gt; 51874: (5.17241%)&lt;BR/&gt; 51873: (5.17241%)&lt;BR/&gt; 51872: (5.17241%)&lt;BR/&gt; 51853: (5.17241%)&gt;];
}
3038--4973[label="1;9pkt 9fpkt"];
3038--6036[label="1;10pkt 10fpkt"];
4973--6036[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="200.89.34.102" dst_port="80" src_ip="201.0.79.12"/>
    </slice>
    <from sec="1123477965" usec="0"/>
    <to sec="1123478083" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_600{
style=filled;
color=gray75;
3040[label="172.118.145.12;36pkt 36fpkt", shape=pentagon, color=darkviolet];
4974[label="172.118.145.12;35pkt 35fpkt", shape=invtriangle, color=brown];
stat600[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.118.145.12:*, 217.7.75.20:80}[69.4444%]&lt;BR/&gt;{172.118.145.12:*, 210.173.72.37:80}[30.5556%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1843: (1.40845%)&lt;BR/&gt; 1842: (1.40845%)&lt;BR/&gt; 1841: (1.40845%)&lt;BR/&gt; 1840: (1.40845%)&gt;];
}
3040--4974[label="1;35pkt 35fpkt"];
</description>
    <slice>
      <filter dst_ip="217.7.75.20" dst_port="80" src_ip="172.118.145.12"/>
      <filter dst_ip="210.173.72.37" dst_port="80" src_ip="172.118.145.12"/>
    </slice>
    <from sec="1123477283" usec="0"/>
    <to sec="1123478085" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="71.34.173.12"/>
    </slice>
    <from sec="1123477202" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_602{
style=filled;
color=gray75;
3044[label="212.99.9.13;159pkt 159fpkt", shape=pentagon, color=darkviolet];
4977[label="212.99.9.13;159pkt 159fpkt", shape=invtriangle, color=brown];
6038[label="212.99.9.13;159pkt 159fpkt", shape=invhouse, color=bisque];
stat602[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.99.9.13:42347, *:1027}[53.4591%]&lt;BR/&gt;{212.99.9.13:42347, *:1026}[46.5409%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 42347: (50%)&lt;BR/&gt; 1027: (26.7296%)&lt;BR/&gt; 1026: (23.2704%)&gt;];
}
3044--4977[label="1;159pkt 159fpkt"];
3044--6038[label="1;159pkt 159fpkt"];
4977--6038[label="1;159pkt 159fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="212.99.9.13" src_port="42347"/>
      <filter dst_port="1026" src_ip="212.99.9.13" src_port="42347"/>
    </slice>
    <from sec="1123477517" usec="0"/>
    <to sec="1123477518" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,001,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_603{
style=filled;
color=gray75;
3047[label="214.222.48.13;323pkt 323fpkt", shape=pentagon, color=darkviolet];
4980[label="214.222.48.13;322pkt 322fpkt", shape=invtriangle, color=brown];
6041[label="214.222.48.13;323pkt 323fpkt", shape=invhouse, color=bisque];
stat603[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.222.48.13:*, *:5554}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5554: (50%)&lt;BR/&gt; 4937: (0.154959%)&lt;BR/&gt; 4932: (0.154959%)&lt;BR/&gt; 4768: (0.154959%)&lt;BR/&gt; 4724: (0.154959%)&gt;];
}
3047--4980[label="1;322pkt 322fpkt"];
3047--6041[label="1;323pkt 323fpkt"];
4980--6041[label="1;322pkt 322fpkt"];
</description>
    <slice>
      <filter dst_port="5554" src_ip="214.222.48.13"/>
    </slice>
    <from sec="1123477227" usec="0"/>
    <to sec="1123477228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="200.235.52.13"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="152.21.171.13"/>
    </slice>
    <from sec="1123477771" usec="0"/>
    <to sec="1123477811" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_606{
style=filled;
color=gray75;
3055[label="172.118.11.14;6pkt 6fpkt", shape=pentagon, color=darkviolet];
4983[label="172.118.11.14;7pkt 7fpkt", shape=invtriangle, color=brown];
6043[label="172.118.11.14;7pkt 7fpkt", shape=invhouse, color=bisque];
stat606[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.118.11.14:*, 208.29.26.63:80}[42.8571%]&lt;BR/&gt;{172.118.11.14:*, 4.81.71.68:80}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (45%)&lt;BR/&gt; 32778: (7.5%)&lt;BR/&gt; 32777: (7.5%)&lt;BR/&gt; 32776: (7.5%)&lt;BR/&gt; 32775: (7.5%)&gt;];
}
3055--4983[label="1;6pkt 6fpkt"];
3055--6043[label="1;6pkt 6fpkt"];
4983--6043[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="208.29.26.63" dst_port="80" src_ip="172.118.11.14"/>
      <filter dst_ip="4.81.71.68" dst_port="80" src_ip="172.118.11.14"/>
    </slice>
    <from sec="1123477907" usec="0"/>
    <to sec="1123478009" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="18.154.93.14"/>
    </slice>
    <from sec="1123477207" usec="0"/>
    <to sec="1123478095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_608{
style=filled;
color=gray75;
3068[label="64.167.70.15;233pkt 233fpkt", shape=pentagon, color=darkviolet];
4990[label="64.167.70.15;234pkt 234fpkt", shape=invtriangle, color=brown];
stat608[shape=component, label=&lt;Rules:&lt;BR/&gt;{64.167.70.15:1030, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1030: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3068--4990[label="1;233pkt 233fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="64.167.70.15" src_port="1030"/>
    </slice>
    <from sec="1123477710" usec="0"/>
    <to sec="1123477750" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_609{
style=filled;
color=gray75;
3086[label="158.47.92.17;20pkt 20fpkt", shape=pentagon, color=darkviolet];
4997[label="158.47.92.17;21pkt 21fpkt", shape=invtriangle, color=brown];
stat609[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.47.92.17:*, 4.235.131.172:80}[90.4762%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2092: (2.43902%)&lt;BR/&gt; 2089: (2.43902%)&lt;BR/&gt; 2088: (2.43902%)&lt;BR/&gt; 2087: (2.43902%)&gt;];
}
3086--4997[label="1;20pkt 20fpkt"];
</description>
    <slice>
      <filter dst_ip="4.235.131.172" dst_port="80" src_ip="158.47.92.17"/>
    </slice>
    <from sec="1123477666" usec="0"/>
    <to sec="1123477767" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_610{
style=filled;
color=gray75;
3097[label="158.189.151.18;41pkt 41fpkt", shape=pentagon, color=darkviolet];
5003[label="158.189.151.18;40pkt 40fpkt", shape=invtriangle, color=brown];
stat610[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.189.151.18:*, 221.67.77.33:80}[43.9024%]&lt;BR/&gt;{158.189.151.18:*, 221.67.77.173:80}[29.2683%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.7654%)&lt;BR/&gt; 4997: (1.23457%)&lt;BR/&gt; 4996: (1.23457%)&lt;BR/&gt; 4988: (1.23457%)&lt;BR/&gt; 4987: (1.23457%)&gt;];
}
3097--5003[label="1;40pkt 40fpkt"];
</description>
    <slice>
      <filter dst_ip="221.67.77.33" dst_port="80" src_ip="158.189.151.18"/>
      <filter dst_ip="221.67.77.173" dst_port="80" src_ip="158.189.151.18"/>
    </slice>
    <from sec="1123477223" usec="0"/>
    <to sec="1123478072" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="71.35.166.18"/>
    </slice>
    <from sec="1123477392" usec="0"/>
    <to sec="1123477454" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="152.20.183.19"/>
    </slice>
    <from sec="1123477805" usec="0"/>
    <to sec="1123478080" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_613{
style=filled;
color=gray75;
3126[label="71.73.2.22;4pkt 4fpkt", shape=pentagon, color=darkviolet];
5018[label="71.73.2.22;4pkt 4fpkt", shape=invtriangle, color=brown];
stat613[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.73.2.22:63306, 132.117.153.65:35719}[25%]&lt;BR/&gt;{71.73.2.22:63308, 132.117.153.65:35719}[25%]&lt;BR/&gt;{71.73.2.22:63299, 132.117.45.155:64732}[25%]&lt;BR/&gt;{71.73.2.22:63303, 132.117.45.155:64732}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 64732: (25%)&lt;BR/&gt; 35719: (25%)&lt;BR/&gt; 63308: (12.5%)&lt;BR/&gt; 63306: (12.5%)&lt;BR/&gt; 63303: (12.5%)&gt;];
}
3126--5018[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="132.117.45.155" dst_port="64732" src_ip="71.73.2.22" src_port="63303"/>
      <filter dst_ip="132.117.45.155" dst_port="64732" src_ip="71.73.2.22" src_port="63299"/>
      <filter dst_ip="132.117.153.65" dst_port="35719" src_ip="71.73.2.22" src_port="63308"/>
      <filter dst_ip="132.117.153.65" dst_port="35719" src_ip="71.73.2.22" src_port="63306"/>
    </slice>
    <from sec="1123477684" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_614{
style=filled;
color=gray75;
2101[label="158.47.81.22;d;29pkt 29fpkt", shape=diamond, color=yellow];
2115[label="167.32.142.40;s;21pkt 21fpkt", shape=diamond, color=yellow];
3135[label="69.67.9.23;4pkt 4fpkt", shape=pentagon, color=darkviolet];
5023[label="69.67.9.23;3pkt 3fpkt", shape=invtriangle, color=brown];
6066[label="69.67.9.23;4pkt 4fpkt", shape=invhouse, color=bisque];
stat614[shape=component, label=&lt;Rules:&lt;BR/&gt;{167.32.142.40:80, 158.47.81.22:*}[72.4138%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1958: (3.27869%)&lt;BR/&gt; 1957: (3.27869%)&lt;BR/&gt; 1949: (3.27869%)&lt;BR/&gt; 1948: (2.45902%)&gt;];
}
2101--2115[label="1;21pkt 21fpkt"];
2101--3135[label="1;4pkt 4fpkt"];
2101--5023[label="1;3pkt 3fpkt"];
2101--6066[label="1;4pkt 4fpkt"];
3135--5023[label="1;3pkt 3fpkt"];
3135--6066[label="1;4pkt 4fpkt"];
5023--6066[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="158.47.81.22" src_ip="167.32.142.40" src_port="80"/>
    </slice>
    <from sec="1123477430" usec="0"/>
    <to sec="1123477846" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_615{
style=filled;
color=gray75;
3136[label="200.178.24.23;130pkt 130fpkt", shape=pentagon, color=darkviolet];
5024[label="200.178.24.23;129pkt 129fpkt", shape=invtriangle, color=brown];
stat615[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.178.24.23:1043, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1043: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3136--5024[label="1;129pkt 129fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="200.178.24.23" src_port="1043"/>
    </slice>
    <from sec="1123477583" usec="0"/>
    <to sec="1123477604" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_616{
style=filled;
color=gray75;
382[label="201.117.144.42;s;2016pkt 2016fpkt", shape=diamond, color=yellow];
997[label="152.21.162.80;s;28pkt 28fpkt", shape=diamond, color=yellow];
1086[label="5.71.245.37;d;24pkt 24fpkt", shape=diamond, color=yellow];
2276[label="172.118.38.227;s;240pkt 240fpkt", shape=diamond, color=yellow];
3151[label="172.118.53.24;12pkt 12fpkt", shape=pentagon, color=darkviolet];
3304[label="201.117.144.42;2pkt 2fpkt", shape=pentagon, color=darkviolet];
3617[label="152.21.162.80;35pkt 35fpkt", shape=pentagon, color=darkviolet];
4454[label="172.118.2.186;24pkt 24fpkt", shape=pentagon, color=darkviolet];
4758[label="172.118.38.227;261pkt 261fpkt", shape=pentagon, color=darkviolet];
5031[label="172.118.53.24;11pkt 11fpkt", shape=invtriangle, color=brown];
5110[label="201.117.144.42;2pkt 2fpkt", shape=invtriangle, color=brown];
5756[label="172.118.2.186;24pkt 24fpkt", shape=invtriangle, color=brown];
6068[label="172.118.53.24;12pkt 12fpkt", shape=invhouse, color=bisque];
6115[label="201.117.144.42;2pkt 2fpkt", shape=invhouse, color=bisque];
6467[label="172.118.2.186;24pkt 24fpkt", shape=invhouse, color=bisque];
stat616[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.117.144.42:53, *:*}[85.5867%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (40.8723%)&lt;BR/&gt; 0: (18.5499%)&lt;BR/&gt; 80: (3.14685%)&lt;BR/&gt; 32768: (2.0611%)&lt;BR/&gt; 32769: (0.883327%)&gt;];
}
382--589[label="0.025974;2pkt 2fpkt"];
382--692[label="0.0487805;2pkt 2fpkt"];
382--1086[label="0.0416667;1pkt 1fpkt"];
382--1180[label="0.00317125;3pkt 3fpkt"];
382--2874[label="0.00694444;14pkt 14fpkt"];
382--2880[label="0.00107181;1pkt 1fpkt"];
382--2884[label="0.0104167;21pkt 21fpkt"];
382--2889[label="0.000839631;1pkt 1fpkt"];
382--2893[label="0.00152439;3pkt 3fpkt"];
382--2898[label="0.0104167;21pkt 21fpkt"];
382--2903[label="0.000839631;1pkt 1fpkt"];
382--2907[label="0.00152362;3pkt 3fpkt"];
382--2913[label="0.000839631;1pkt 1fpkt"];
382--2917[label="0.00152439;3pkt 3fpkt"];
382--3304[label="1;2pkt 2fpkt"];
382--5110[label="1;2pkt 2fpkt"];
382--6115[label="1;2pkt 2fpkt"];
997--1086[label="0.208333;5pkt 5fpkt"];
997--2883[label="0.0357143;1pkt 1fpkt"];
997--2897[label="0.0357143;1pkt 1fpkt"];
997--2908[label="0.0357143;1pkt 1fpkt"];
997--3617[label="1;28pkt 28fpkt"];
1086--2276[label="0.0416667;1pkt 1fpkt"];
1086--2496[label="0.0416667;1pkt 1fpkt"];
1086--3151[label="1;12pkt 12fpkt"];
1086--3617[label="0.208333;5pkt 5fpkt"];
1086--4454[label="0.0416667;1pkt 1fpkt"];
1086--4758[label="0.0416667;1pkt 1fpkt"];
1086--5031[label="1;11pkt 11fpkt"];
1086--5756[label="0.0416667;1pkt 1fpkt"];
1086--6068[label="1;12pkt 12fpkt"];
1086--6467[label="0.0416667;1pkt 1fpkt"];
2276--2409[label="0.00416667;1pkt 1fpkt"];
2276--2429[label="0.00480769;1pkt 1fpkt"];
2276--2571[label="0.004329;1pkt 1fpkt"];
2276--4758[label="1;240pkt 240fpkt"];
3151--5031[label="1;11pkt 11fpkt"];
3151--6068[label="1;12pkt 12fpkt"];
3304--5110[label="1;2pkt 2fpkt"];
3304--6115[label="1;2pkt 2fpkt"];
4454--5756[label="1;24pkt 24fpkt"];
4454--6467[label="1;24pkt 24fpkt"];
5031--6068[label="1;11pkt 11fpkt"];
5110--6115[label="1;2pkt 2fpkt"];
5756--6467[label="1;24pkt 24fpkt"];
</description>
    <slice>
      <filter src_ip="201.117.144.42" src_port="53"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_617{
style=filled;
color=gray75;
3154[label="158.17.202.24;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5033[label="158.17.202.24;1pkt 1fpkt", shape=invtriangle, color=brown];
6069[label="158.17.202.24;1pkt 1fpkt", shape=invhouse, color=bisque];
stat617[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.17.202.24:80, 200.132.225.182:44563}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 44563: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
3154--5033[label="1;1pkt 1fpkt"];
3154--6069[label="1;1pkt 1fpkt"];
5033--6069[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="200.132.225.182" dst_port="44563" src_ip="158.17.202.24" src_port="80"/>
    </slice>
    <from sec="1123477747" usec="0"/>
    <to sec="1123477968" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_618{
style=filled;
color=gray75;
3156[label="158.47.41.25;30pkt 30fpkt", shape=pentagon, color=darkviolet];
5034[label="158.47.41.25;30pkt 30fpkt", shape=invtriangle, color=brown];
stat618[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.47.41.25:80, 205.45.30.152:*}[90%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 63556: (1.66667%)&lt;BR/&gt; 59320: (1.66667%)&lt;BR/&gt; 55840: (1.66667%)&lt;BR/&gt; 54701: (1.66667%)&gt;];
}
3156--5034[label="1;30pkt 30fpkt"];
</description>
    <slice>
      <filter dst_ip="205.45.30.152" src_ip="158.47.41.25" src_port="80"/>
    </slice>
    <from sec="1123477267" usec="0"/>
    <to sec="1123478085" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_619{
style=filled;
color=gray75;
3173[label="152.20.187.27;95pkt 95fpkt", shape=pentagon, color=darkviolet];
5044[label="152.20.187.27;95pkt 95fpkt", shape=invtriangle, color=brown];
6076[label="152.20.187.27;95pkt 95fpkt", shape=invhouse, color=bisque];
stat619[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.20.187.27:*, 194.120.43.218:80}[36.8421%]&lt;BR/&gt;{152.20.187.27:*, 195.232.197.21:80}[21.0526%]&lt;BR/&gt;{152.20.187.27:*, 194.70.219.25:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 33039: (0.526316%)&lt;BR/&gt; 33038: (0.526316%)&lt;BR/&gt; 33036: (0.526316%)&lt;BR/&gt; 33035: (0.526316%)&gt;];
}
3173--5044[label="1;95pkt 95fpkt"];
3173--6076[label="1;95pkt 95fpkt"];
5044--6076[label="1;95pkt 95fpkt"];
</description>
    <slice>
      <filter dst_ip="194.120.43.218" dst_port="80" src_ip="152.20.187.27"/>
      <filter dst_ip="195.232.197.21" dst_port="80" src_ip="152.20.187.27"/>
      <filter dst_ip="194.70.219.25" dst_port="80" src_ip="152.20.187.27"/>
    </slice>
    <from sec="1123477762" usec="0"/>
    <to sec="1123478095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,010,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_620{
style=filled;
color=gray75;
1102[label="3.68.74.159;d;463pkt 463fpkt", shape=diamond, color=yellow];
3155[label="158.160.240.24;32pkt 32fpkt", shape=pentagon, color=darkviolet];
3165[label="158.160.240.25;48pkt 48fpkt", shape=pentagon, color=darkviolet];
3174[label="158.160.240.27;52pkt 52fpkt", shape=pentagon, color=darkviolet];
3182[label="158.160.240.28;44pkt 44fpkt", shape=pentagon, color=darkviolet];
3265[label="158.160.240.36;49pkt 49fpkt", shape=pentagon, color=darkviolet];
3274[label="158.160.240.37;45pkt 45fpkt", shape=pentagon, color=darkviolet];
3281[label="158.160.240.38;52pkt 52fpkt", shape=pentagon, color=darkviolet];
5045[label="158.160.240.27;52pkt 52fpkt", shape=invtriangle, color=brown];
6077[label="158.160.240.27;52pkt 52fpkt", shape=invhouse, color=bisque];
stat620[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:445, 3.68.74.159:*}[51.8367%]&lt;BR/&gt;{*:139, 3.68.74.159:*}[48.1633%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (25.928%)&lt;BR/&gt; 139: (24.072%)&lt;BR/&gt; 65407: (0.224972%)&lt;BR/&gt; 65147: (0.224972%)&lt;BR/&gt; 65083: (0.224972%)&gt;];
}
1102--3155[label="1;32pkt 32fpkt"];
1102--3165[label="0.875;42pkt 42fpkt"];
1102--3174[label="0.923077;48pkt 48fpkt"];
1102--3182[label="0.954545;42pkt 42fpkt"];
1102--3265[label="0.877551;43pkt 43fpkt"];
1102--3274[label="0.911111;41pkt 41fpkt"];
1102--3281[label="0.903846;47pkt 47fpkt"];
1102--5045[label="0.923077;48pkt 48fpkt"];
1102--6077[label="0.923077;48pkt 48fpkt"];
3174--5045[label="1;52pkt 52fpkt"];
3174--6077[label="1;52pkt 52fpkt"];
5045--6077[label="1;52pkt 52fpkt"];
</description>
    <slice>
      <filter dst_ip="3.68.74.159" src_port="445"/>
      <filter dst_ip="3.68.74.159" src_port="139"/>
    </slice>
    <from sec="1123477202" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_621{
style=filled;
color=gray75;
3177[label="152.21.144.28;41pkt 41fpkt", shape=pentagon, color=darkviolet];
5046[label="152.21.144.28;41pkt 41fpkt", shape=invtriangle, color=brown];
stat621[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.144.28:*, 205.45.84.201:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3308: (1.21951%)&lt;BR/&gt; 3307: (1.21951%)&lt;BR/&gt; 3306: (1.21951%)&lt;BR/&gt; 3305: (1.21951%)&gt;];
}
3177--5046[label="1;41pkt 41fpkt"];
</description>
    <slice>
      <filter dst_ip="205.45.84.201" dst_port="80" src_ip="152.21.144.28"/>
    </slice>
    <from sec="1123477205" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="1.99.81.31"/>
    </slice>
    <from sec="1123477221" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="211.43.129.32"/>
    </slice>
    <from sec="1123477264" usec="0"/>
    <to sec="1123477746" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_624{
style=filled;
color=gray75;
3212[label="172.118.161.32;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5063[label="172.118.161.32;1pkt 1fpkt", shape=invtriangle, color=brown];
stat624[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.118.161.32:1188, 205.45.87.119:1863}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1863: (50%)&lt;BR/&gt; 1188: (50%)&gt;];
}
3212--5063[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="205.45.87.119" dst_port="1863" src_ip="172.118.161.32" src_port="1188"/>
    </slice>
    <from sec="1123477209" usec="0"/>
    <to sec="1123478055" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_625{
style=filled;
color=gray75;
3224[label="152.20.84.34;23pkt 23fpkt", shape=pentagon, color=darkviolet];
5067[label="152.20.84.34;23pkt 23fpkt", shape=invtriangle, color=brown];
6090[label="152.20.84.34;23pkt 23fpkt", shape=invhouse, color=bisque];
stat625[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.20.84.34:*, 195.227.183.226:20}[69.5652%]&lt;BR/&gt;{152.20.84.34:*, 7.19.155.46:80}[21.7391%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 20: (34.7826%)&lt;BR/&gt; 80: (10.8696%)&lt;BR/&gt; 21: (4.34783%)&lt;BR/&gt; 1432: (2.17391%)&lt;BR/&gt; 1431: (2.17391%)&gt;];
}
3224--5067[label="1;23pkt 23fpkt"];
3224--6090[label="1;23pkt 23fpkt"];
5067--6090[label="1;23pkt 23fpkt"];
</description>
    <slice>
      <filter dst_ip="195.227.183.226" dst_port="20" src_ip="152.20.84.34"/>
      <filter dst_ip="7.19.155.46" dst_port="80" src_ip="152.20.84.34"/>
    </slice>
    <from sec="1123477440" usec="0"/>
    <to sec="1123477974" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_626{
style=filled;
color=gray75;
3226[label="211.113.129.34;4pkt 4fpkt", shape=pentagon, color=darkviolet];
5069[label="211.113.129.34;406pkt 406fpkt", shape=invtriangle, color=brown];
6092[label="211.113.129.34;405pkt 405fpkt", shape=invhouse, color=bisque];
stat626[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.113.129.34:1069, *:1434}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1434: (50%)&lt;BR/&gt; 1069: (50%)&gt;];
}
3226--5069[label="1;4pkt 4fpkt"];
3226--6092[label="1;4pkt 4fpkt"];
5069--6092[label="1;405pkt 405fpkt"];
</description>
    <slice>
      <filter dst_port="1434" src_ip="211.113.129.34" src_port="1069"/>
    </slice>
    <from sec="1123477945" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_627{
style=filled;
color=gray75;
3231[label="5.59.168.34;15pkt 15fpkt", shape=pentagon, color=darkviolet];
5072[label="5.59.168.34;15pkt 15fpkt", shape=invtriangle, color=brown];
stat627[shape=component, label=&lt;Rules:&lt;BR/&gt;{5.59.168.34:80, 200.89.41.33:*}[26.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4305: (3.33333%)&lt;BR/&gt; 4003: (3.33333%)&lt;BR/&gt; 4002: (3.33333%)&lt;BR/&gt; 4001: (3.33333%)&gt;];
}
3231--5072[label="1;15pkt 15fpkt"];
</description>
    <slice>
      <filter dst_ip="200.89.41.33" src_ip="5.59.168.34" src_port="80"/>
    </slice>
    <from sec="1123477229" usec="0"/>
    <to sec="1123478078" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="211.42.2.35"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="210.138.10.35"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="65.140.17.35"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_631{
style=filled;
color=gray75;
3245[label="211.205.76.35;162pkt 162fpkt", shape=pentagon, color=darkviolet];
5081[label="211.205.76.35;162pkt 162fpkt", shape=invtriangle, color=brown];
6099[label="211.205.76.35;162pkt 162fpkt", shape=invhouse, color=bisque];
stat631[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.205.76.35:33200, *:1026}[50%]&lt;BR/&gt;{211.205.76.35:33200, *:1027}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 33200: (50%)&lt;BR/&gt; 1027: (25%)&lt;BR/&gt; 1026: (25%)&gt;];
}
3245--5081[label="1;162pkt 162fpkt"];
3245--6099[label="1;162pkt 162fpkt"];
5081--6099[label="1;162pkt 162fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="211.205.76.35" src_port="33200"/>
      <filter dst_port="1026" src_ip="211.205.76.35" src_port="33200"/>
    </slice>
    <from sec="1123477548" usec="0"/>
    <to sec="1123477549" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_632{
style=filled;
color=gray75;
1973[label="201.117.144.35;s;126pkt 126fpkt", shape=diamond, color=yellow];
3248[label="201.117.144.35;129pkt 129fpkt", shape=pentagon, color=darkviolet];
5084[label="201.117.144.35;129pkt 129fpkt", shape=invtriangle, color=brown];
stat632[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.117.144.35:25, *:*}[58.4615%]&lt;BR/&gt;{201.117.144.35:*, *:113}[41.5385%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (29.1667%)&lt;BR/&gt; 113: (20.8333%)&lt;BR/&gt; 3812: (0.78125%)&lt;BR/&gt; 63044: (0.390625%)&lt;BR/&gt; 60479: (0.390625%)&gt;];
}
1973--3248[label="0.992063;125pkt 125fpkt"];
1973--5084[label="0.992063;125pkt 125fpkt"];
3248--5084[label="1;129pkt 129fpkt"];
</description>
    <slice>
      <filter src_ip="201.117.144.35" src_port="25"/>
      <filter dst_port="113" src_ip="201.117.144.35"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="169.169.154.35"/>
    </slice>
    <from sec="1123477210" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_634{
style=filled;
color=gray75;
3263[label="158.189.215.36;90pkt 90fpkt", shape=pentagon, color=darkviolet];
5094[label="158.189.215.36;90pkt 90fpkt", shape=invtriangle, color=brown];
6105[label="158.189.215.36;90pkt 90fpkt", shape=invhouse, color=bisque];
stat634[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.189.215.36:2365, *:*}[62.2222%]&lt;BR/&gt;{158.189.215.36:*, *:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2365: (31.1111%)&lt;BR/&gt; 80: (13.3333%)&lt;BR/&gt; 443: (3.88889%)&lt;BR/&gt; 64982: (0.555556%)&lt;BR/&gt; 64954: (0.555556%)&gt;];
}
3263--5094[label="1;90pkt 90fpkt"];
3263--6105[label="1;90pkt 90fpkt"];
5094--6105[label="1;90pkt 90fpkt"];
</description>
    <slice>
      <filter src_ip="158.189.215.36" src_port="2365"/>
      <filter dst_port="80" src_ip="158.189.215.36"/>
    </slice>
    <from sec="1123477209" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="214.45.80.37"/>
    </slice>
    <from sec="1123477213" usec="0"/>
    <to sec="1123478085" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="215.231.113.37"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_637{
style=filled;
color=gray75;
3291[label="152.21.106.40;39pkt 39fpkt", shape=pentagon, color=darkviolet];
5105[label="152.21.106.40;39pkt 39fpkt", shape=invtriangle, color=brown];
stat637[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.106.40:3503, *:53}[79.4872%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (43.5897%)&lt;BR/&gt; 3503: (39.7436%)&lt;BR/&gt; 0: (12.8205%)&lt;BR/&gt; 42663: (1.28205%)&lt;BR/&gt; 34006: (1.28205%)&gt;];
}
3291--5105[label="1;39pkt 39fpkt"];
</description>
    <slice>
      <filter dst_port="53" src_ip="152.21.106.40" src_port="3503"/>
    </slice>
    <from sec="1123477345" usec="0"/>
    <to sec="1123477999" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_638{
style=filled;
color=gray75;
3292[label="4.32.145.40;30pkt 30fpkt", shape=pentagon, color=darkviolet];
5106[label="4.32.145.40;30pkt 30fpkt", shape=invtriangle, color=brown];
6113[label="4.32.145.40;30pkt 30fpkt", shape=invhouse, color=bisque];
stat638[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.32.145.40:80, 200.85.209.197:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3068: (1.66667%)&lt;BR/&gt; 3047: (1.66667%)&lt;BR/&gt; 2960: (1.66667%)&lt;BR/&gt; 2954: (1.66667%)&gt;];
}
3292--5106[label="1;30pkt 30fpkt"];
3292--6113[label="1;30pkt 30fpkt"];
5106--6113[label="1;30pkt 30fpkt"];
</description>
    <slice>
      <filter dst_ip="200.85.209.197" src_ip="4.32.145.40" src_port="80"/>
    </slice>
    <from sec="1123477210" usec="0"/>
    <to sec="1123478097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="152.21.179.41"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,010,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_640{
style=filled;
color=gray75;
2450[label="205.11.67.90;d;160pkt 160fpkt", shape=diamond, color=yellow];
3310[label="152.21.203.42;89pkt 89fpkt", shape=pentagon, color=darkviolet];
5112[label="152.21.203.42;89pkt 89fpkt", shape=invtriangle, color=brown];
stat640[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.203.42:*, 205.11.67.90:443}[53.8922%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (49.8521%)&lt;BR/&gt; 1153: (0.591716%)&lt;BR/&gt; 1152: (0.591716%)&lt;BR/&gt; 1151: (0.591716%)&lt;BR/&gt; 1150: (0.591716%)&gt;];
}
2450--3209[label="0.00625;1pkt 1fpkt"];
2450--3310[label="0.921348;82pkt 82fpkt"];
2450--5112[label="0.921348;82pkt 82fpkt"];
3310--5112[label="1;89pkt 89fpkt"];
</description>
    <slice>
      <filter dst_ip="205.11.67.90" dst_port="443" src_ip="152.21.203.42"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="194.229.209.43"/>
    </slice>
    <from sec="1123477207" usec="0"/>
    <to sec="1123477615" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_642{
style=filled;
color=gray75;
3319[label="152.21.212.43;11pkt 11fpkt", shape=pentagon, color=darkviolet];
5117[label="152.21.212.43;11pkt 11fpkt", shape=invtriangle, color=brown];
6119[label="152.21.212.43;11pkt 11fpkt", shape=invhouse, color=bisque];
stat642[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.212.43:*, 205.181.54.205:80}[72.7273%]&lt;BR/&gt;{152.21.212.43:*, 205.181.54.236:80}[27.2727%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3473: (4.54545%)&lt;BR/&gt; 3472: (4.54545%)&lt;BR/&gt; 3471: (4.54545%)&lt;BR/&gt; 3470: (4.54545%)&gt;];
}
3319--5117[label="1;11pkt 11fpkt"];
3319--6119[label="1;11pkt 11fpkt"];
5117--6119[label="1;11pkt 11fpkt"];
</description>
    <slice>
      <filter dst_ip="205.181.54.205" dst_port="80" src_ip="152.21.212.43"/>
      <filter dst_ip="205.181.54.236" dst_port="80" src_ip="152.21.212.43"/>
    </slice>
    <from sec="1123477541" usec="0"/>
    <to sec="1123477610" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="211.165.132.44"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_644{
style=filled;
color=gray75;
3327[label="71.100.208.44;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5123[label="71.100.208.44;2pkt 2fpkt", shape=invtriangle, color=brown];
6122[label="71.100.208.44;2pkt 2fpkt", shape=invhouse, color=bisque];
stat644[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.100.208.44:113, 201.117.144.35:55138}[50%]&lt;BR/&gt;{71.100.208.44:4732, 201.117.144.35:25}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 55138: (25%)&lt;BR/&gt; 4732: (25%)&lt;BR/&gt; 113: (25%)&lt;BR/&gt; 25: (25%)&gt;];
}
3327--5123[label="1;2pkt 2fpkt"];
3327--6122[label="1;2pkt 2fpkt"];
5123--6122[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="201.117.144.35" dst_port="25" src_ip="71.100.208.44" src_port="4732"/>
      <filter dst_ip="201.117.144.35" dst_port="55138" src_ip="71.100.208.44" src_port="113"/>
    </slice>
    <from sec="1123477292" usec="0"/>
    <to sec="1123477342" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="212.129.54.47"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123477276" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_646{
style=filled;
color=gray75;
255[label="7.34.149.48;d;1pkt 1fpkt", shape=diamond, color=yellow];
256[label="152.20.172.118;s;31pkt 31fpkt", shape=diamond, color=yellow];
569[label="203.66.210.242;d;2pkt 2fpkt", shape=diamond, color=yellow];
1709[label="1.21.166.208;d;2pkt 2fpkt", shape=diamond, color=yellow];
3947[label="152.20.172.118;31pkt 31fpkt", shape=pentagon, color=darkviolet];
stat646[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.20.172.118:*, 205.33.70.11:27901}[32.2581%]&lt;BR/&gt;{152.20.172.118:*, 205.33.70.8:27901}[29.0323%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 27901: (28.3582%)&lt;BR/&gt; 80: (5.97015%)&lt;BR/&gt; 33109: (4.47761%)&lt;BR/&gt; 33099: (4.47761%)&lt;BR/&gt; 2303: (4.47761%)&gt;];
}
255--256[label="1;1pkt 1fpkt"];
255--3947[label="1;1pkt 1fpkt"];
256--569[label="1;2pkt 2fpkt"];
256--1709[label="1;2pkt 2fpkt"];
256--2003[label="0.0645161;2pkt 2fpkt"];
256--3947[label="1;31pkt 31fpkt"];
569--3947[label="1;2pkt 2fpkt"];
1709--3947[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="205.33.70.11" dst_port="27901" src_ip="152.20.172.118"/>
      <filter dst_ip="205.33.70.8" dst_port="27901" src_ip="152.20.172.118"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478084" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_647{
style=filled;
color=gray75;
3353[label="172.118.28.48;17pkt 17fpkt", shape=pentagon, color=darkviolet];
5136[label="172.118.28.48;17pkt 17fpkt", shape=invtriangle, color=brown];
6131[label="172.118.28.48;17pkt 17fpkt", shape=invhouse, color=bisque];
stat647[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.118.28.48:80, 5.218.200.87:*}[88.2353%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 60695: (2.94118%)&lt;BR/&gt; 58354: (2.94118%)&lt;BR/&gt; 58138: (2.94118%)&lt;BR/&gt; 57903: (2.94118%)&gt;];
}
3353--5136[label="1;17pkt 17fpkt"];
3353--6131[label="1;17pkt 17fpkt"];
5136--6131[label="1;17pkt 17fpkt"];
</description>
    <slice>
      <filter dst_ip="5.218.200.87" src_ip="172.118.28.48" src_port="80"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478090" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_648{
style=filled;
color=gray75;
3356[label="172.118.172.48;25pkt 25fpkt", shape=pentagon, color=darkviolet];
5139[label="172.118.172.48;25pkt 25fpkt", shape=invtriangle, color=brown];
stat648[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.118.172.48:*, 220.208.178.23:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2788: (2%)&lt;BR/&gt; 2787: (2%)&lt;BR/&gt; 2786: (2%)&lt;BR/&gt; 2785: (2%)&gt;];
}
3356--5139[label="1;25pkt 25fpkt"];
</description>
    <slice>
      <filter dst_ip="220.208.178.23" dst_port="80" src_ip="172.118.172.48"/>
    </slice>
    <from sec="1123477260" usec="0"/>
    <to sec="1123477333" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="71.115.72.49"/>
    </slice>
    <from sec="1123477209" usec="0"/>
    <to sec="1123478088" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_650{
style=filled;
color=gray75;
3366[label="158.189.82.50;22pkt 22fpkt", shape=pentagon, color=darkviolet];
5144[label="158.189.82.50;22pkt 22fpkt", shape=invtriangle, color=brown];
6135[label="158.189.82.50;22pkt 22fpkt", shape=invhouse, color=bisque];
stat650[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.189.82.50:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 61607: (2.27273%)&lt;BR/&gt; 61069: (2.27273%)&lt;BR/&gt; 60785: (2.27273%)&lt;BR/&gt; 60036: (2.27273%)&gt;];
}
3366--5144[label="1;22pkt 22fpkt"];
3366--6135[label="1;22pkt 22fpkt"];
5144--6135[label="1;22pkt 22fpkt"];
</description>
    <slice>
      <filter src_ip="158.189.82.50" src_port="80"/>
    </slice>
    <from sec="1123477296" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_651{
style=filled;
color=gray75;
3370[label="214.161.41.51;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5146[label="214.161.41.51;2pkt 2fpkt", shape=invtriangle, color=brown];
stat651[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.161.41.51:1163, 158.189.19.110:53288}[50%]&lt;BR/&gt;{214.161.41.51:1513, 158.189.19.110:53288}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53288: (50%)&lt;BR/&gt; 1513: (25%)&lt;BR/&gt; 1163: (25%)&gt;];
}
3370--5146[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="158.189.19.110" dst_port="53288" src_ip="214.161.41.51" src_port="1513"/>
      <filter dst_ip="158.189.19.110" dst_port="53288" src_ip="214.161.41.51" src_port="1163"/>
    </slice>
    <from sec="1123477460" usec="0"/>
    <to sec="1123478092" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="20.181.101.52"/>
    </slice>
    <from sec="1123477244" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_653{
style=filled;
color=gray75;
3387[label="1.186.18.53;3pkt 3fpkt", shape=pentagon, color=darkviolet];
5155[label="1.186.18.53;3pkt 3fpkt", shape=invtriangle, color=brown];
stat653[shape=component, label=&lt;Rules:&lt;BR/&gt;{1.186.18.53:80, 158.47.71.230:44509}[33.3333%]&lt;BR/&gt;{1.186.18.53:80, 158.47.71.230:44512}[33.3333%]&lt;BR/&gt;{1.186.18.53:80, 158.47.71.230:44535}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 44535: (16.6667%)&lt;BR/&gt; 44512: (16.6667%)&lt;BR/&gt; 44509: (16.6667%)&gt;];
}
3387--5155[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="158.47.71.230" dst_port="44535" src_ip="1.186.18.53" src_port="80"/>
      <filter dst_ip="158.47.71.230" dst_port="44512" src_ip="1.186.18.53" src_port="80"/>
      <filter dst_ip="158.47.71.230" dst_port="44509" src_ip="1.186.18.53" src_port="80"/>
    </slice>
    <from sec="1123477973" usec="0"/>
    <to sec="1123478056" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.23034,1.94842,002,1 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_654{
style=filled;
color=gray75;
72[label="200.89.24.145s;162pkt 162fpkt", shape=rectangle, color=red];
3397[label="218.180.129.54;250pkt 250fpkt", shape=pentagon, color=darkviolet];
5157[label="218.180.129.54;250pkt 250fpkt", shape=invtriangle, color=brown];
stat654[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.180.129.54:1044, *:137}[99.6016%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1044: (50%)&lt;BR/&gt; 137: (49.9245%)&lt;BR/&gt; 80: (0.0755287%)&gt;];
}
72--599[label="0.00617284;1pkt 1fpkt"];
72--1851[label="0.05;1pkt 1fpkt"];
72--3397[label="0.993827;161pkt 161fpkt"];
72--4155[label="0.00617284;1pkt 1fpkt"];
72--5157[label="0.993827;161pkt 161fpkt"];
72--6388[label="0.00617284;1pkt 1fpkt"];
3397--5157[label="1;250pkt 250fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="218.180.129.54" src_port="1044"/>
    </slice>
    <from sec="1123477555" usec="0"/>
    <to sec="1123478002" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_655{
style=filled;
color=gray75;
3398[label="71.247.131.54;121pkt 121fpkt", shape=pentagon, color=darkviolet];
5158[label="71.247.131.54;121pkt 121fpkt", shape=invtriangle, color=brown];
6144[label="71.247.131.54;121pkt 121fpkt", shape=invhouse, color=bisque];
stat655[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.247.131.54:1026, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3398--5158[label="1;121pkt 121fpkt"];
3398--6144[label="1;121pkt 121fpkt"];
5158--6144[label="1;121pkt 121fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="71.247.131.54" src_port="1026"/>
    </slice>
    <from sec="1123478041" usec="0"/>
    <to sec="1123478055" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_656{
style=filled;
color=gray75;
429[label="215.34.77.176;s;21pkt 21fpkt", shape=diamond, color=yellow];
478[label="158.189.137.95;d;1pkt 1fpkt", shape=diamond, color=yellow];
968[label="158.189.74.103;d;12pkt 12fpkt", shape=diamond, color=yellow];
1393[label="152.21.110.198;d;8pkt 8fpkt", shape=diamond, color=yellow];
2155[label="212.129.59.69;s;1pkt 1fpkt", shape=diamond, color=yellow];
3403[label="212.129.54.55;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3521[label="212.129.59.69;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5161[label="212.129.54.55;1pkt 1fpkt", shape=invtriangle, color=brown];
5234[label="212.129.59.69;1pkt 1fpkt", shape=invtriangle, color=brown];
6145[label="212.129.54.55;1pkt 1fpkt", shape=invhouse, color=bisque];
stat656[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.34.77.176:80, 158.189.74.103:*}[46.1538%]&lt;BR/&gt;{*:80, 152.21.110.198:*}[30.7692%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1289: (4.16667%)&lt;BR/&gt; 1250: (4.16667%)&lt;BR/&gt; 32828: (2.08333%)&lt;BR/&gt; 3510: (2.08333%)&gt;];
}
429--478[label="1;1pkt 1fpkt"];
429--968[label="1;12pkt 12fpkt"];
429--1393[label="0.375;3pkt 3fpkt"];
1393--2155[label="1;1pkt 1fpkt"];
1393--3403[label="1;1pkt 1fpkt"];
1393--3521[label="1;1pkt 1fpkt"];
1393--5161[label="1;1pkt 1fpkt"];
1393--5234[label="1;1pkt 1fpkt"];
1393--6145[label="1;1pkt 1fpkt"];
2155--3521[label="1;1pkt 1fpkt"];
2155--5234[label="1;1pkt 1fpkt"];
3403--5161[label="1;1pkt 1fpkt"];
3403--6145[label="1;1pkt 1fpkt"];
3521--5234[label="1;1pkt 1fpkt"];
5161--6145[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="152.21.110.198" src_port="80"/>
      <filter dst_ip="158.189.74.103" src_ip="215.34.77.176" src_port="80"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478024" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="200.248.112.55"/>
    </slice>
    <from sec="1123477562" usec="0"/>
    <to sec="1123477616" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_658{
style=filled;
color=gray75;
3411[label="158.160.54.56;62pkt 62fpkt", shape=pentagon, color=darkviolet];
5166[label="158.160.54.56;62pkt 62fpkt", shape=invtriangle, color=brown];
stat658[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.160.54.56:60573, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 60573: (50%)&lt;BR/&gt; 64071: (0.806452%)&lt;BR/&gt; 60355: (0.806452%)&lt;BR/&gt; 59941: (0.806452%)&lt;BR/&gt; 58689: (0.806452%)&gt;];
}
3411--5166[label="1;62pkt 62fpkt"];
</description>
    <slice>
      <filter src_ip="158.160.54.56" src_port="60573"/>
    </slice>
    <from sec="1123477228" usec="0"/>
    <to sec="1123478096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_659{
style=filled;
color=gray75;
3415[label="205.46.186.56;5pkt 5fpkt", shape=pentagon, color=darkviolet];
5170[label="205.46.186.56;5pkt 5fpkt", shape=invtriangle, color=brown];
6149[label="205.46.186.56;5pkt 5fpkt", shape=invhouse, color=bisque];
stat659[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.46.186.56:53, 132.117.141.140:32776}[20%]&lt;BR/&gt;{205.46.186.56:80, 132.117.28.109:2647}[20%]&lt;BR/&gt;{205.46.186.56:80, 132.117.28.109:2648}[20%]&lt;BR/&gt;{205.46.186.56:80, 132.117.28.109:2650}[20%]&lt;BR/&gt;{205.46.186.56:80, 132.117.28.109:2651}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (40%)&lt;BR/&gt; 32776: (10%)&lt;BR/&gt; 2651: (10%)&lt;BR/&gt; 2650: (10%)&lt;BR/&gt; 2648: (10%)&gt;];
}
3415--5170[label="1;5pkt 5fpkt"];
3415--6149[label="1;5pkt 5fpkt"];
5170--6149[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="132.117.28.109" dst_port="2651" src_ip="205.46.186.56" src_port="80"/>
      <filter dst_ip="132.117.28.109" dst_port="2650" src_ip="205.46.186.56" src_port="80"/>
      <filter dst_ip="132.117.28.109" dst_port="2648" src_ip="205.46.186.56" src_port="80"/>
      <filter dst_ip="132.117.28.109" dst_port="2647" src_ip="205.46.186.56" src_port="80"/>
      <filter dst_ip="132.117.141.140" dst_port="32776" src_ip="205.46.186.56" src_port="53"/>
    </slice>
    <from sec="1123477970" usec="0"/>
    <to sec="1123478087" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_660{
style=filled;
color=gray75;
3416[label="200.89.0.57;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5171[label="200.89.0.57;1pkt 1fpkt", shape=invtriangle, color=brown];
stat660[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.89.0.57:55316, 204.68.178.72:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 55316: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
3416--5171[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="204.68.178.72" dst_port="80" src_ip="200.89.0.57" src_port="55316"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="71.201.235.57"/>
    </slice>
    <from sec="1123477234" usec="0"/>
    <to sec="1123477926" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_662{
style=filled;
color=gray75;
3427[label="211.220.124.58;162pkt 162fpkt", shape=pentagon, color=darkviolet];
5180[label="211.220.124.58;162pkt 162fpkt", shape=invtriangle, color=brown];
stat662[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.220.124.58:17075, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 17075: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3427--5180[label="1;162pkt 162fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="211.220.124.58" src_port="17075"/>
    </slice>
    <from sec="1123478013" usec="0"/>
    <to sec="1123478039" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,010,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_663{
style=filled;
color=gray75;
1377[label="193.158.119.86;d;274pkt 274fpkt", shape=diamond, color=yellow];
3428[label="158.160.128.58;28pkt 28fpkt", shape=pentagon, color=darkviolet];
3444[label="158.160.128.60;26pkt 26fpkt", shape=pentagon, color=darkviolet];
5181[label="158.160.128.58;28pkt 28fpkt", shape=invtriangle, color=brown];
6156[label="158.160.128.58;28pkt 28fpkt", shape=invhouse, color=bisque];
stat663[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:3306, 193.158.119.86:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3306: (50%)&lt;BR/&gt; 2114: (0.520833%)&lt;BR/&gt; 2066: (0.520833%)&lt;BR/&gt; 2034: (0.520833%)&lt;BR/&gt; 2015: (0.520833%)&gt;];
}
1377--3428[label="0.785714;22pkt 22fpkt"];
1377--3444[label="0.769231;20pkt 20fpkt"];
1377--5181[label="0.785714;22pkt 22fpkt"];
1377--6156[label="0.785714;22pkt 22fpkt"];
3428--5181[label="1;28pkt 28fpkt"];
3428--6156[label="1;28pkt 28fpkt"];
5181--6156[label="1;28pkt 28fpkt"];
</description>
    <slice>
      <filter dst_ip="193.158.119.86" src_port="3306"/>
    </slice>
    <from sec="1123477205" usec="0"/>
    <to sec="1123478096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_665{
style=filled;
color=gray75;
3461[label="158.47.41.64;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5197[label="158.47.41.64;1pkt 1fpkt", shape=invtriangle, color=brown];
6168[label="158.47.41.64;1pkt 1fpkt", shape=invhouse, color=bisque];
stat665[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.47.41.64:80, 5.71.245.54:41584}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 41584: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
3461--5197[label="1;1pkt 1fpkt"];
3461--6168[label="1;1pkt 1fpkt"];
5197--6168[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="5.71.245.54" dst_port="41584" src_ip="158.47.41.64" src_port="80"/>
    </slice>
    <from sec="1123477709" usec="0"/>
    <to sec="1123477752" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_666{
style=filled;
color=gray75;
3467[label="152.21.146.64;10pkt 10fpkt", shape=pentagon, color=darkviolet];
5200[label="152.21.146.64;10pkt 10fpkt", shape=invtriangle, color=brown];
6170[label="152.21.146.64;10pkt 10fpkt", shape=invhouse, color=bisque];
stat666[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.146.64:80, 5.218.200.196:*}[30%]&lt;BR/&gt;{152.21.146.64:53, *:*}[30%]&lt;BR/&gt;{152.21.146.64:*, 0.49.108.52:*}[20%]&lt;BR/&gt;{152.21.146.64:*, 0.49.111.52:*}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (35%)&lt;BR/&gt; 53: (15%)&lt;BR/&gt; 63066: (5%)&lt;BR/&gt; 54955: (5%)&lt;BR/&gt; 51244: (5%)&gt;];
}
3467--5200[label="1;10pkt 10fpkt"];
3467--6170[label="1;10pkt 10fpkt"];
5200--6170[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter dst_ip="0.49.111.52" src_ip="152.21.146.64"/>
      <filter dst_ip="0.49.108.52" src_ip="152.21.146.64"/>
      <filter src_ip="152.21.146.64" src_port="53"/>
      <filter dst_ip="5.218.200.196" src_ip="152.21.146.64" src_port="80"/>
    </slice>
    <from sec="1123477408" usec="0"/>
    <to sec="1123478066" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="64.171.235.64"/>
    </slice>
    <from sec="1123477464" usec="0"/>
    <to sec="1123477705" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_668{
style=filled;
color=gray75;
3483[label="172.118.200.65;7pkt 7fpkt", shape=pentagon, color=darkviolet];
5211[label="172.118.200.65;7pkt 7fpkt", shape=invtriangle, color=brown];
6176[label="172.118.200.65;7pkt 7fpkt", shape=invhouse, color=bisque];
stat668[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.118.200.65:*, 209.229.136.17:80}[42.8571%]&lt;BR/&gt;{172.118.200.65:*, 208.130.226.95:80}[42.8571%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1498: (7.14286%)&lt;BR/&gt; 1494: (7.14286%)&lt;BR/&gt; 1490: (7.14286%)&lt;BR/&gt; 1489: (7.14286%)&gt;];
}
3483--5211[label="1;7pkt 7fpkt"];
3483--6176[label="1;7pkt 7fpkt"];
5211--6176[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="208.130.226.95" dst_port="80" src_ip="172.118.200.65"/>
      <filter dst_ip="209.229.136.17" dst_port="80" src_ip="172.118.200.65"/>
    </slice>
    <from sec="1123477593" usec="0"/>
    <to sec="1123477702" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_669{
style=filled;
color=gray75;
3491[label="152.21.110.66;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5216[label="152.21.110.66;2pkt 2fpkt", shape=invtriangle, color=brown];
stat669[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.110.66:60648, 206.93.107.131:80}[50%]&lt;BR/&gt;{152.21.110.66:63419, 206.93.107.131:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 63419: (25%)&lt;BR/&gt; 60648: (25%)&gt;];
}
3491--5216[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="206.93.107.131" dst_port="80" src_ip="152.21.110.66" src_port="63419"/>
      <filter dst_ip="206.93.107.131" dst_port="80" src_ip="152.21.110.66" src_port="60648"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_670{
style=filled;
color=gray75;
3493[label="208.70.152.66;5pkt 5fpkt", shape=pentagon, color=darkviolet];
5217[label="208.70.152.66;5pkt 5fpkt", shape=invtriangle, color=brown];
stat670[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.70.152.66:5050, 169.169.242.22:62864}[20%]&lt;BR/&gt;{208.70.152.66:5050, 169.169.245.76:1033}[20%]&lt;BR/&gt;{208.70.152.66:5050, 169.169.245.112:3345}[20%]&lt;BR/&gt;{208.70.152.66:5050, 169.169.173.144:1099}[20%]&lt;BR/&gt;{208.70.152.66:5050, 169.169.147.246:1098}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5050: (50%)&lt;BR/&gt; 62864: (10%)&lt;BR/&gt; 3345: (10%)&lt;BR/&gt; 1099: (10%)&lt;BR/&gt; 1098: (10%)&gt;];
}
3493--5217[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="169.169.147.246" dst_port="1098" src_ip="208.70.152.66" src_port="5050"/>
      <filter dst_ip="169.169.173.144" dst_port="1099" src_ip="208.70.152.66" src_port="5050"/>
      <filter dst_ip="169.169.245.112" dst_port="3345" src_ip="208.70.152.66" src_port="5050"/>
      <filter dst_ip="169.169.245.76" dst_port="1033" src_ip="208.70.152.66" src_port="5050"/>
      <filter dst_ip="169.169.242.22" dst_port="62864" src_ip="208.70.152.66" src_port="5050"/>
    </slice>
    <from sec="1123477215" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_672{
style=filled;
color=gray75;
3498[label="152.21.57.67;4pkt 4fpkt", shape=pentagon, color=darkviolet];
5223[label="152.21.57.67;4pkt 4fpkt", shape=invtriangle, color=brown];
6182[label="152.21.57.67;3pkt 3fpkt", shape=invhouse, color=bisque];
stat672[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.57.67:34217, 217.161.49.38:6667}[25%]&lt;BR/&gt;{152.21.57.67:33534, 193.214.98.66:6667}[25%]&lt;BR/&gt;{152.21.57.67:33524, 195.243.221.196:6667}[25%]&lt;BR/&gt;{152.21.57.67:33537, 201.138.125.226:6667}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (50%)&lt;BR/&gt; 34217: (13.6364%)&lt;BR/&gt; 33537: (13.6364%)&lt;BR/&gt; 33534: (13.6364%)&lt;BR/&gt; 33524: (9.09091%)&gt;];
}
3498--5223[label="1;4pkt 4fpkt"];
3498--6182[label="1;3pkt 3fpkt"];
5223--6182[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="201.138.125.226" dst_port="6667" src_ip="152.21.57.67" src_port="33537"/>
      <filter dst_ip="195.243.221.196" dst_port="6667" src_ip="152.21.57.67" src_port="33524"/>
      <filter dst_ip="193.214.98.66" dst_port="6667" src_ip="152.21.57.67" src_port="33534"/>
      <filter dst_ip="217.161.49.38" dst_port="6667" src_ip="152.21.57.67" src_port="34217"/>
    </slice>
    <from sec="1123477206" usec="0"/>
    <to sec="1123478090" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_673{
style=filled;
color=gray75;
3501[label="152.20.106.67;29pkt 29fpkt", shape=pentagon, color=darkviolet];
5226[label="152.20.106.67;29pkt 29fpkt", shape=invtriangle, color=brown];
6184[label="152.20.106.67;28pkt 28fpkt", shape=invhouse, color=bisque];
stat673[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.20.106.67:*, 4.188.174.205:80}[58.6207%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.2558%)&lt;BR/&gt; 0: (3.48837%)&lt;BR/&gt; 48789: (1.74419%)&lt;BR/&gt; 48767: (1.74419%)&lt;BR/&gt; 45487: (1.74419%)&gt;];
}
3501--5226[label="1;29pkt 29fpkt"];
3501--6184[label="1;28pkt 28fpkt"];
5226--6184[label="1;28pkt 28fpkt"];
</description>
    <slice>
      <filter dst_ip="4.188.174.205" dst_port="80" src_ip="152.20.106.67"/>
    </slice>
    <from sec="1123477211" usec="0"/>
    <to sec="1123478084" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="169.169.154.68"/>
    </slice>
    <from sec="1123477205" usec="0"/>
    <to sec="1123478014" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_675{
style=filled;
color=gray75;
3522[label="212.135.81.69;243pkt 243fpkt", shape=pentagon, color=darkviolet];
5235[label="212.135.81.69;243pkt 243fpkt", shape=invtriangle, color=brown];
6191[label="212.135.81.69;242pkt 242fpkt", shape=invhouse, color=bisque];
stat675[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.135.81.69:10253, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 10253: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3522--5235[label="1;243pkt 243fpkt"];
3522--6191[label="1;242pkt 242fpkt"];
5235--6191[label="1;242pkt 242fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="212.135.81.69" src_port="10253"/>
    </slice>
    <from sec="1123478033" usec="0"/>
    <to sec="1123478046" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_676{
style=filled;
color=gray75;
3525[label="212.204.129.69;229pkt 229fpkt", shape=pentagon, color=darkviolet];
5237[label="212.204.129.69;229pkt 229fpkt", shape=invtriangle, color=brown];
6192[label="212.204.129.69;228pkt 228fpkt", shape=invhouse, color=bisque];
stat676[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.204.129.69:1058, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1058: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3525--5237[label="1;229pkt 229fpkt"];
3525--6192[label="1;228pkt 228fpkt"];
5237--6192[label="1;228pkt 228fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="212.204.129.69" src_port="1058"/>
    </slice>
    <from sec="1123477481" usec="0"/>
    <to sec="1123477501" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,020,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_677{
style=filled;
color=gray75;
2225[label="218.237.41.216;d;225pkt 225fpkt", shape=diamond, color=yellow];
3539[label="218.104.36.71;36pkt 36fpkt", shape=pentagon, color=darkviolet];
5244[label="218.104.36.71;36pkt 36fpkt", shape=invtriangle, color=brown];
stat677[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 218.237.41.216:0}[86.5385%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.3266%)&lt;BR/&gt; 24943: (0.3367%)&lt;BR/&gt; 179: (0.3367%)&gt;];
}
2225--2276[label="0.00444444;1pkt 1fpkt"];
2225--2282[label="0.0052356;1pkt 1fpkt"];
2225--2508[label="0.00444444;1pkt 1fpkt"];
2225--2732[label="0.00444444;1pkt 1fpkt"];
2225--2969[label="0.0075188;1pkt 1fpkt"];
2225--3014[label="0.00444444;1pkt 1fpkt"];
2225--3539[label="0.0277778;1pkt 1fpkt"];
2225--3634[label="0.00444444;1pkt 1fpkt"];
2225--3970[label="0.00444444;1pkt 1fpkt"];
2225--4669[label="0.00444444;1pkt 1fpkt"];
2225--4747[label="0.00471698;1pkt 1fpkt"];
2225--4758[label="0.00444444;1pkt 1fpkt"];
2225--4934[label="0.00757576;1pkt 1fpkt"];
2225--4961[label="0.00444444;1pkt 1fpkt"];
2225--5244[label="0.0277778;1pkt 1fpkt"];
2225--5296[label="0.00444444;1pkt 1fpkt"];
2225--5328[label="0.00444444;1pkt 1fpkt"];
2225--5860[label="0.00444444;1pkt 1fpkt"];
2225--6009[label="0.00757576;1pkt 1fpkt"];
2225--6527[label="0.00444444;1pkt 1fpkt"];
3539--5244[label="1;36pkt 36fpkt"];
</description>
    <slice>
      <filter dst_ip="218.237.41.216"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478088" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_678{
style=filled;
color=gray75;
3541[label="205.54.49.71;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5246[label="205.54.49.71;2pkt 2fpkt", shape=invtriangle, color=brown];
stat678[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.54.49.71:80, 132.117.180.177:4446}[50%]&lt;BR/&gt;{205.54.49.71:80, 132.117.180.177:4447}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4447: (25%)&lt;BR/&gt; 4446: (25%)&gt;];
}
3541--5246[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="132.117.180.177" dst_port="4447" src_ip="205.54.49.71" src_port="80"/>
      <filter dst_ip="132.117.180.177" dst_port="4446" src_ip="205.54.49.71" src_port="80"/>
    </slice>
    <from sec="1123478048" usec="0"/>
    <to sec="1123478086" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_679{
style=filled;
color=gray75;
3548[label="158.47.66.72;13pkt 13fpkt", shape=pentagon, color=darkviolet];
5248[label="158.47.66.72;13pkt 13fpkt", shape=invtriangle, color=brown];
6196[label="158.47.66.72;12pkt 12fpkt", shape=invhouse, color=bisque];
stat679[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.47.66.72:*, 196.56.96.60:80}[46.1538%]&lt;BR/&gt;{158.47.66.72:*, 194.253.56.169:1352}[38.4615%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (31.5789%)&lt;BR/&gt; 1352: (18.4211%)&lt;BR/&gt; 1493: (3.94737%)&lt;BR/&gt; 1492: (3.94737%)&lt;BR/&gt; 1487: (3.94737%)&gt;];
}
3548--5248[label="1;13pkt 13fpkt"];
3548--6196[label="1;12pkt 12fpkt"];
5248--6196[label="1;12pkt 12fpkt"];
</description>
    <slice>
      <filter dst_ip="196.56.96.60" dst_port="80" src_ip="158.47.66.72"/>
      <filter dst_ip="194.253.56.169" dst_port="1352" src_ip="158.47.66.72"/>
    </slice>
    <from sec="1123477269" usec="0"/>
    <to sec="1123478043" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_681{
style=filled;
color=gray75;
3566[label="204.68.177.73;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5256[label="204.68.177.73;1pkt 1fpkt", shape=invtriangle, color=brown];
6205[label="204.68.177.73;2pkt 2fpkt", shape=invhouse, color=bisque];
stat681[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.68.177.73:80, 172.118.210.233:4623}[50%]&lt;BR/&gt;{204.68.177.73:80, 172.118.210.233:4624}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4624: (37.5%)&lt;BR/&gt; 4623: (12.5%)&gt;];
}
3566--5256[label="1;1pkt 1fpkt"];
3566--6205[label="1;1pkt 1fpkt"];
5256--6205[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="172.118.210.233" dst_port="4624" src_ip="204.68.177.73" src_port="80"/>
      <filter dst_ip="172.118.210.233" dst_port="4623" src_ip="204.68.177.73" src_port="80"/>
    </slice>
    <from sec="1123477838" usec="0"/>
    <to sec="1123477856" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="71.98.57.74"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_683{
style=filled;
color=gray75;
3578[label="152.20.97.74;40pkt 40fpkt", shape=pentagon, color=darkviolet];
5263[label="152.20.97.74;40pkt 40fpkt", shape=invtriangle, color=brown];
stat683[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.20.97.74:80, 201.217.181.136:*}[82.5%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 59606: (1.25%)&lt;BR/&gt; 59596: (1.25%)&lt;BR/&gt; 59539: (1.25%)&lt;BR/&gt; 59467: (1.25%)&gt;];
}
3578--5263[label="1;40pkt 40fpkt"];
</description>
    <slice>
      <filter dst_ip="201.217.181.136" src_ip="152.20.97.74" src_port="80"/>
    </slice>
    <from sec="1123477468" usec="0"/>
    <to sec="1123478094" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="212.184.135.75"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="69.15.16.78"/>
    </slice>
    <from sec="1123477599" usec="0"/>
    <to sec="1123478039" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_686{
style=filled;
color=gray75;
3603[label="218.49.148.78;217pkt 217fpkt", shape=pentagon, color=darkviolet];
5275[label="218.49.148.78;217pkt 217fpkt", shape=invtriangle, color=brown];
6217[label="218.49.148.78;217pkt 217fpkt", shape=invhouse, color=bisque];
stat686[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.49.148.78:1034, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1034: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3603--5275[label="1;217pkt 217fpkt"];
3603--6217[label="1;217pkt 217fpkt"];
5275--6217[label="1;217pkt 217fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="218.49.148.78" src_port="1034"/>
    </slice>
    <from sec="1123477696" usec="0"/>
    <to sec="1123477733" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_687{
style=filled;
color=gray75;
3607[label="172.118.224.78;22pkt 22fpkt", shape=pentagon, color=darkviolet];
5277[label="172.118.224.78;22pkt 22fpkt", shape=invtriangle, color=brown];
6219[label="172.118.224.78;21pkt 21fpkt", shape=invhouse, color=bisque];
stat687[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.118.224.78:*, 170.88.161.88:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1550: (2.30769%)&lt;BR/&gt; 1549: (2.30769%)&lt;BR/&gt; 1548: (2.30769%)&lt;BR/&gt; 1547: (2.30769%)&gt;];
}
3607--5277[label="1;22pkt 22fpkt"];
3607--6219[label="1;21pkt 21fpkt"];
5277--6219[label="1;21pkt 21fpkt"];
</description>
    <slice>
      <filter dst_ip="170.88.161.88" dst_port="80" src_ip="172.118.224.78"/>
    </slice>
    <from sec="1123477943" usec="0"/>
    <to sec="1123477956" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="211.171.48.80"/>
    </slice>
    <from sec="1123477257" usec="0"/>
    <to sec="1123478071" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="16.148.21.81"/>
    </slice>
    <from sec="1123477226" usec="0"/>
    <to sec="1123477957" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_691{
style=filled;
color=gray75;
3629[label="203.19.74.82;178pkt 178fpkt", shape=pentagon, color=darkviolet];
5292[label="203.19.74.82;178pkt 178fpkt", shape=invtriangle, color=brown];
6226[label="203.19.74.82;178pkt 178fpkt", shape=invhouse, color=bisque];
stat691[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.19.74.82:1025, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1025: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3629--5292[label="1;178pkt 178fpkt"];
3629--6226[label="1;178pkt 178fpkt"];
5292--6226[label="1;178pkt 178fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="203.19.74.82" src_port="1025"/>
    </slice>
    <from sec="1123477451" usec="0"/>
    <to sec="1123477479" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_692{
style=filled;
color=gray75;
3633[label="152.21.144.82;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5295[label="152.21.144.82;2pkt 2fpkt", shape=invtriangle, color=brown];
6228[label="152.21.144.82;2pkt 2fpkt", shape=invhouse, color=bisque];
stat692[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.144.82:1613, 148.215.143.151:80}[50%]&lt;BR/&gt;{152.21.144.82:1614, 148.215.143.151:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1614: (25%)&lt;BR/&gt; 1613: (25%)&gt;];
}
3633--5295[label="1;2pkt 2fpkt"];
3633--6228[label="1;2pkt 2fpkt"];
5295--6228[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="148.215.143.151" dst_port="80" src_ip="152.21.144.82" src_port="1614"/>
      <filter dst_ip="148.215.143.151" dst_port="80" src_ip="152.21.144.82" src_port="1613"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_693{
style=filled;
color=gray75;
3636[label="71.249.212.82;109pkt 109fpkt", shape=pentagon, color=darkviolet];
5297[label="71.249.212.82;109pkt 109fpkt", shape=invtriangle, color=brown];
6229[label="71.249.212.82;108pkt 108fpkt", shape=invhouse, color=bisque];
stat693[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.249.212.82:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3636--5297[label="1;109pkt 109fpkt"];
3636--6229[label="1;108pkt 108fpkt"];
5297--6229[label="1;108pkt 108fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="71.249.212.82" src_port="1027"/>
    </slice>
    <from sec="1123477377" usec="0"/>
    <to sec="1123477395" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="20.179.5.84"/>
    </slice>
    <from sec="1123477525" usec="0"/>
    <to sec="1123478056" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_695{
style=filled;
color=gray75;
3650[label="152.20.10.84;7pkt 7fpkt", shape=pentagon, color=darkviolet];
5303[label="152.20.10.84;7pkt 7fpkt", shape=invtriangle, color=brown];
6232[label="152.20.10.84;7pkt 7fpkt", shape=invhouse, color=bisque];
stat695[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.20.10.84:80, 0.49.111.27:*}[42.8571%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 55881: (7.14286%)&lt;BR/&gt; 45881: (7.14286%)&lt;BR/&gt; 44610: (7.14286%)&lt;BR/&gt; 44526: (7.14286%)&gt;];
}
3650--5303[label="1;7pkt 7fpkt"];
3650--6232[label="1;7pkt 7fpkt"];
5303--6232[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="0.49.111.27" src_ip="152.20.10.84" src_port="80"/>
    </slice>
    <from sec="1123477248" usec="0"/>
    <to sec="1123478032" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_696{
style=filled;
color=gray75;
3653[label="205.250.69.84;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5305[label="205.250.69.84;1pkt 1fpkt", shape=invtriangle, color=brown];
6233[label="205.250.69.84;1pkt 1fpkt", shape=invhouse, color=bisque];
stat696[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.250.69.84:8008, 132.117.180.38:4768}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8008: (50%)&lt;BR/&gt; 4768: (50%)&gt;];
}
3653--5305[label="1;1pkt 1fpkt"];
3653--6233[label="1;1pkt 1fpkt"];
5305--6233[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="132.117.180.38" dst_port="4768" src_ip="205.250.69.84" src_port="8008"/>
    </slice>
    <from sec="1123477803" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_697{
style=filled;
color=gray75;
3655[label="64.237.120.84;87pkt 87fpkt", shape=pentagon, color=darkviolet];
5307[label="64.237.120.84;87pkt 87fpkt", shape=invtriangle, color=brown];
6235[label="64.237.120.84;87pkt 87fpkt", shape=invhouse, color=bisque];
stat697[shape=component, label=&lt;Rules:&lt;BR/&gt;{64.237.120.84:*, *:1433}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1433: (50%)&lt;BR/&gt; 2209: (1.14943%)&lt;BR/&gt; 4976: (0.574713%)&lt;BR/&gt; 4940: (0.574713%)&lt;BR/&gt; 4726: (0.574713%)&gt;];
}
3655--5307[label="1;87pkt 87fpkt"];
3655--6235[label="1;87pkt 87fpkt"];
5307--6235[label="1;87pkt 87fpkt"];
</description>
    <slice>
      <filter dst_port="1433" src_ip="64.237.120.84"/>
    </slice>
    <from sec="1123477223" usec="0"/>
    <to sec="1123477749" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_698{
style=filled;
color=gray75;
3664[label="209.109.38.85;9pkt 9fpkt", shape=pentagon, color=darkviolet];
5310[label="209.109.38.85;9pkt 9fpkt", shape=invtriangle, color=brown];
stat698[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.109.38.85:*, 169.169.193.212:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 51546: (5.55556%)&lt;BR/&gt; 46138: (5.55556%)&lt;BR/&gt; 26891: (5.55556%)&lt;BR/&gt; 23496: (5.55556%)&gt;];
}
3664--5310[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="169.169.193.212" dst_port="80" src_ip="209.109.38.85"/>
    </slice>
    <from sec="1123477691" usec="0"/>
    <to sec="1123477843" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_700{
style=filled;
color=gray75;
3682[label="152.21.144.86;14pkt 14fpkt", shape=pentagon, color=darkviolet];
5319[label="152.21.144.86;14pkt 14fpkt", shape=invtriangle, color=brown];
6242[label="152.21.144.86;13pkt 13fpkt", shape=invhouse, color=bisque];
stat700[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.144.86:*, 4.137.50.48:80}[42.8571%]&lt;BR/&gt;{152.21.144.86:*, 221.67.77.169:80}[28.5714%]&lt;BR/&gt;{152.21.144.86:*, 221.67.77.249:*}[21.4286%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (39.0244%)&lt;BR/&gt; 0: (7.31707%)&lt;BR/&gt; 7026: (3.65854%)&lt;BR/&gt; 6970: (3.65854%)&lt;BR/&gt; 2990: (3.65854%)&gt;];
}
3682--5319[label="1;14pkt 14fpkt"];
3682--6242[label="1;13pkt 13fpkt"];
5319--6242[label="1;13pkt 13fpkt"];
</description>
    <slice>
      <filter dst_ip="221.67.77.249" src_ip="152.21.144.86"/>
      <filter dst_ip="4.137.50.48" dst_port="80" src_ip="152.21.144.86"/>
      <filter dst_ip="221.67.77.169" dst_port="80" src_ip="152.21.144.86"/>
    </slice>
    <from sec="1123477919" usec="0"/>
    <to sec="1123478007" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_701{
style=filled;
color=gray75;
3685[label="208.70.152.86;15pkt 15fpkt", shape=pentagon, color=darkviolet];
5322[label="208.70.152.86;15pkt 15fpkt", shape=invtriangle, color=brown];
6245[label="208.70.152.86;14pkt 14fpkt", shape=invhouse, color=bisque];
stat701[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.70.152.86:5050, *:*}[73.3333%]&lt;BR/&gt;{208.70.152.86:20, *:*}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5050: (36.3636%)&lt;BR/&gt; 20: (10.2273%)&lt;BR/&gt; 1030: (6.81818%)&lt;BR/&gt; 4056: (3.40909%)&lt;BR/&gt; 3794: (3.40909%)&gt;];
}
3685--5322[label="1;15pkt 15fpkt"];
3685--6245[label="1;14pkt 14fpkt"];
5322--6245[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter src_ip="208.70.152.86" src_port="5050"/>
      <filter src_ip="208.70.152.86" src_port="20"/>
    </slice>
    <from sec="1123477210" usec="0"/>
    <to sec="1123478096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,011,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_702{
style=filled;
color=gray75;
453[label="152.21.174.195;d;484pkt 484fpkt", shape=diamond, color=yellow];
455[label="211.155.147.220;s;1pkt 1fpkt", shape=diamond, color=yellow];
1660[label="71.146.7.157;s;4pkt 4fpkt", shape=diamond, color=yellow];
3686[label="71.149.160.86;5pkt 5fpkt", shape=pentagon, color=darkviolet];
4528[label="215.50.39.195;7pkt 7fpkt", shape=pentagon, color=darkviolet];
4742[label="215.50.39.225;7pkt 7fpkt", shape=pentagon, color=darkviolet];
5323[label="71.149.160.86;5pkt 5fpkt", shape=invtriangle, color=brown];
stat702[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.219.58.228:80, 152.21.174.195:*}[40.7407%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3045: (0.292398%)&lt;BR/&gt; 3041: (0.292398%)&lt;BR/&gt; 3040: (0.292398%)&lt;BR/&gt; 3039: (0.292398%)&gt;];
}
453--455[label="1;1pkt 1fpkt"];
453--1660[label="1;4pkt 4fpkt"];
453--3686[label="0.8;4pkt 4fpkt"];
453--4528[label="0.857143;6pkt 6fpkt"];
453--4742[label="1;7pkt 7fpkt"];
453--5323[label="0.8;4pkt 4fpkt"];
3686--5323[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="152.21.174.195" src_ip="219.219.58.228" src_port="80"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="215.51.105.88"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_704{
style=filled;
color=gray75;
3707[label="170.88.161.88;22pkt 22fpkt", shape=pentagon, color=darkviolet];
5336[label="170.88.161.88;22pkt 22fpkt", shape=invtriangle, color=brown];
6254[label="170.88.161.88;22pkt 22fpkt", shape=invhouse, color=bisque];
stat704[shape=component, label=&lt;Rules:&lt;BR/&gt;{170.88.161.88:80, 172.118.224.78:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1550: (2.27273%)&lt;BR/&gt; 1549: (2.27273%)&lt;BR/&gt; 1548: (2.27273%)&lt;BR/&gt; 1547: (2.27273%)&gt;];
}
3707--5336[label="1;22pkt 22fpkt"];
3707--6254[label="1;22pkt 22fpkt"];
5336--6254[label="1;22pkt 22fpkt"];
</description>
    <slice>
      <filter dst_ip="172.118.224.78" src_ip="170.88.161.88" src_port="80"/>
    </slice>
    <from sec="1123477943" usec="0"/>
    <to sec="1123477954" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_705{
style=filled;
color=gray75;
3709[label="152.21.171.88;4pkt 4fpkt", shape=pentagon, color=darkviolet];
5338[label="152.21.171.88;4pkt 4fpkt", shape=invtriangle, color=brown];
stat705[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.171.88:54708, 6.122.20.35:2703}[25%]&lt;BR/&gt;{152.21.171.88:54709, 6.122.20.35:2703}[25%]&lt;BR/&gt;{152.21.171.88:54710, 6.122.20.35:2703}[25%]&lt;BR/&gt;{152.21.171.88:54711, 6.122.20.35:2703}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2703: (50%)&lt;BR/&gt; 54711: (12.5%)&lt;BR/&gt; 54710: (12.5%)&lt;BR/&gt; 54709: (12.5%)&lt;BR/&gt; 54708: (12.5%)&gt;];
}
3709--5338[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="6.122.20.35" dst_port="2703" src_ip="152.21.171.88" src_port="54711"/>
      <filter dst_ip="6.122.20.35" dst_port="2703" src_ip="152.21.171.88" src_port="54710"/>
      <filter dst_ip="6.122.20.35" dst_port="2703" src_ip="152.21.171.88" src_port="54709"/>
      <filter dst_ip="6.122.20.35" dst_port="2703" src_ip="152.21.171.88" src_port="54708"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_706{
style=filled;
color=gray75;
1817[label="217.198.164.175;d;66pkt 66fpkt", shape=diamond, color=yellow];
3295[label="152.21.220.40;41pkt 41fpkt", shape=pentagon, color=darkviolet];
3710[label="172.118.195.88;5pkt 5fpkt", shape=pentagon, color=darkviolet];
4206[label="152.21.209.152;23pkt 23fpkt", shape=pentagon, color=darkviolet];
5107[label="152.21.220.40;41pkt 41fpkt", shape=invtriangle, color=brown];
5339[label="172.118.195.88;5pkt 5fpkt", shape=invtriangle, color=brown];
6255[label="172.118.195.88;4pkt 4fpkt", shape=invhouse, color=bisque];
stat706[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.220.40:*, 217.198.164.175:80}[59.4203%]&lt;BR/&gt;{152.21.209.152:*, 217.198.164.175:80}[28.9855%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2716: (1.08108%)&lt;BR/&gt; 2715: (1.08108%)&lt;BR/&gt; 2702: (1.08108%)&lt;BR/&gt; 2701: (1.08108%)&gt;];
}
1817--2875[label="0.0757576;5pkt 5fpkt"];
1817--3295[label="1;41pkt 41fpkt"];
1817--3710[label="1;5pkt 5fpkt"];
1817--4206[label="0.869565;20pkt 20fpkt"];
1817--5107[label="1;41pkt 41fpkt"];
1817--5339[label="1;5pkt 5fpkt"];
1817--6255[label="1;4pkt 4fpkt"];
3295--5107[label="1;41pkt 41fpkt"];
3710--5339[label="1;5pkt 5fpkt"];
3710--6255[label="1;4pkt 4fpkt"];
5339--6255[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="217.198.164.175" dst_port="80" src_ip="152.21.220.40"/>
      <filter dst_ip="217.198.164.175" dst_port="80" src_ip="152.21.209.152"/>
    </slice>
    <from sec="1123477207" usec="0"/>
    <to sec="1123478027" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_707{
style=filled;
color=gray75;
3714[label="152.21.48.89;27pkt 27fpkt", shape=pentagon, color=darkviolet];
5341[label="152.21.48.89;27pkt 27fpkt", shape=invtriangle, color=brown];
6257[label="152.21.48.89;26pkt 26fpkt", shape=invhouse, color=bisque];
stat707[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.48.89:*, 204.68.178.77:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4494: (1.875%)&lt;BR/&gt; 4492: (1.875%)&lt;BR/&gt; 4490: (1.875%)&lt;BR/&gt; 4488: (1.875%)&gt;];
}
3714--5341[label="1;27pkt 27fpkt"];
3714--6257[label="1;26pkt 26fpkt"];
5341--6257[label="1;26pkt 26fpkt"];
</description>
    <slice>
      <filter dst_ip="204.68.178.77" dst_port="80" src_ip="152.21.48.89"/>
    </slice>
    <from sec="1123477916" usec="0"/>
    <to sec="1123478029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="7.228.14.90"/>
    </slice>
    <from sec="1123477269" usec="0"/>
    <to sec="1123478029" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_709{
style=filled;
color=gray75;
3722[label="152.20.50.90;18pkt 18fpkt", shape=pentagon, color=darkviolet];
5345[label="152.20.50.90;18pkt 18fpkt", shape=invtriangle, color=brown];
6258[label="152.20.50.90;17pkt 17fpkt", shape=invhouse, color=bisque];
stat709[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.20.50.90:*, 205.181.54.204:80}[88.8889%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 32907: (2.83019%)&lt;BR/&gt; 32906: (2.83019%)&lt;BR/&gt; 32905: (2.83019%)&lt;BR/&gt; 32904: (2.83019%)&gt;];
}
3722--5345[label="1;18pkt 18fpkt"];
3722--6258[label="1;17pkt 17fpkt"];
5345--6258[label="1;17pkt 17fpkt"];
</description>
    <slice>
      <filter dst_ip="205.181.54.204" dst_port="80" src_ip="152.20.50.90"/>
    </slice>
    <from sec="1123477894" usec="0"/>
    <to sec="1123477911" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="19.149.1.91"/>
    </slice>
    <from sec="1123477226" usec="0"/>
    <to sec="1123477379" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_711{
style=filled;
color=gray75;
357[label="132.117.216.66;d;2151pkt 2151fpkt", shape=diamond, color=yellow];
3032[label="71.80.252.11;25pkt 25fpkt", shape=pentagon, color=darkviolet];
3175[label="201.188.8.28;4pkt 4fpkt", shape=pentagon, color=darkviolet];
3363[label="71.6.34.50;3pkt 3fpkt", shape=pentagon, color=darkviolet];
3663[label="212.168.19.85;5pkt 5fpkt", shape=pentagon, color=darkviolet];
3746[label="210.130.71.92;6pkt 6fpkt", shape=pentagon, color=darkviolet];
4021[label="212.104.87.129;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4713[label="210.108.147.222;84pkt 84fpkt", shape=pentagon, color=darkviolet];
5355[label="210.130.71.92;6pkt 6fpkt", shape=invtriangle, color=brown];
stat711[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 132.117.216.66:4080}[98.613%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4080: (49.3438%)&lt;BR/&gt; 443: (0.284339%)&lt;BR/&gt; 80: (0.240595%)&lt;BR/&gt; 0: (0.218723%)&lt;BR/&gt; 1047: (0.109361%)&gt;];
}
357--892[label="0.00090009;1pkt 1fpkt"];
357--2673[label="0.00090009;1pkt 1fpkt"];
357--2858[label="0.000899281;1pkt 1fpkt"];
357--2880[label="0.00107181;1pkt 1fpkt"];
357--3032[label="1;25pkt 25fpkt"];
357--3121[label="0.000749064;1pkt 1fpkt"];
357--3175[label="1;4pkt 4fpkt"];
357--3363[label="1;3pkt 3fpkt"];
357--3663[label="1;5pkt 5fpkt"];
357--3746[label="1;6pkt 6fpkt"];
357--4021[label="1;2pkt 2fpkt"];
357--4713[label="0.857143;72pkt 72fpkt"];
357--5013[label="0.000749625;1pkt 1fpkt"];
357--5355[label="1;6pkt 6fpkt"];
357--6060[label="0.000749064;1pkt 1fpkt"];
3746--5355[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="132.117.216.66" dst_port="4080"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_712{
style=filled;
color=gray75;
3747[label="210.104.73.92;232pkt 232fpkt", shape=pentagon, color=darkviolet];
5356[label="210.104.73.92;232pkt 232fpkt", shape=invtriangle, color=brown];
6265[label="210.104.73.92;231pkt 231fpkt", shape=invhouse, color=bisque];
stat712[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.104.73.92:1031, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1031: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3747--5356[label="1;232pkt 232fpkt"];
3747--6265[label="1;231pkt 231fpkt"];
5356--6265[label="1;231pkt 231fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="210.104.73.92" src_port="1031"/>
    </slice>
    <from sec="1123477611" usec="0"/>
    <to sec="1123477625" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_713{
style=filled;
color=gray75;
3754[label="201.186.198.93;121pkt 121fpkt", shape=pentagon, color=darkviolet];
5360[label="201.186.198.93;121pkt 121fpkt", shape=invtriangle, color=brown];
6267[label="201.186.198.93;120pkt 120fpkt", shape=invhouse, color=bisque];
stat713[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.186.198.93:*, 132.117.232.104:161}[42.9752%]&lt;BR/&gt;{201.186.198.93:*, 132.117.232.105:161}[42.1488%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 161: (43.5083%)&lt;BR/&gt; 2161: (4.97238%)&lt;BR/&gt; 2967: (1.51934%)&lt;BR/&gt; 2024: (0.414365%)&lt;BR/&gt; 2023: (0.414365%)&gt;];
}
3754--5360[label="1;121pkt 121fpkt"];
3754--6267[label="1;120pkt 120fpkt"];
5360--6267[label="1;120pkt 120fpkt"];
</description>
    <slice>
      <filter dst_ip="132.117.232.104" dst_port="161" src_ip="201.186.198.93"/>
      <filter dst_ip="132.117.232.105" dst_port="161" src_ip="201.186.198.93"/>
    </slice>
    <from sec="1123477240" usec="0"/>
    <to sec="1123478075" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="211.164.3.94"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="211.93.26.94"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_716{
style=filled;
color=gray75;
270[label="209.2.129.67;s;9pkt 9fpkt", shape=diamond, color=yellow];
1068[label="169.169.146.3;d;1pkt 1fpkt", shape=diamond, color=yellow];
1216[label="169.169.201.195;d;2pkt 2fpkt", shape=diamond, color=yellow];
1316[label="169.169.224.182;d;3pkt 3fpkt", shape=diamond, color=yellow];
1612[label="169.169.208.180;d;19pkt 19fpkt", shape=diamond, color=yellow];
1713[label="130.70.98.74;s;6pkt 6fpkt", shape=diamond, color=yellow];
1811[label="169.169.201.232;d;2pkt 2fpkt", shape=diamond, color=yellow];
1829[label="169.169.201.184;d;2pkt 2fpkt", shape=diamond, color=yellow];
2273[label="208.70.152.75;s;14pkt 14fpkt", shape=diamond, color=yellow];
2431[label="208.70.152.102;s;23pkt 23fpkt", shape=diamond, color=yellow];
3183[label="200.148.56.29;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3579[label="130.70.98.74;10pkt 10fpkt", shape=pentagon, color=darkviolet];
3846[label="208.70.152.104;17pkt 17fpkt", shape=pentagon, color=darkviolet];
3932[label="208.70.152.116;5pkt 5fpkt", shape=pentagon, color=darkviolet];
stat716[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.70.152.102:5050, *:*}[24.7059%]&lt;BR/&gt;{*:*, 169.169.208.180:*}[22.3529%]&lt;BR/&gt;{208.70.152.104:*, *:*}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5050: (24.5614%)&lt;BR/&gt; 20: (11.8421%)&lt;BR/&gt; 22: (6.57895%)&lt;BR/&gt; 21: (5.70175%)&lt;BR/&gt; 4514: (1.31579%)&gt;];
}
270--1068[label="1;1pkt 1fpkt"];
270--1216[label="0.5;1pkt 1fpkt"];
270--1316[label="0.666667;2pkt 2fpkt"];
270--1811[label="0.5;1pkt 1fpkt"];
270--1829[label="0.5;1pkt 1fpkt"];
1216--2431[label="0.5;1pkt 1fpkt"];
1612--1713[label="1;6pkt 6fpkt"];
1612--3183[label="1;1pkt 1fpkt"];
1612--3579[label="1;10pkt 10fpkt"];
1612--3846[label="0.117647;2pkt 2fpkt"];
1612--3932[label="0.2;1pkt 1fpkt"];
1713--3579[label="1;6pkt 6fpkt"];
1811--3932[label="0.5;1pkt 1fpkt"];
1829--2273[label="0.5;1pkt 1fpkt"];
2273--2336[label="0.0714286;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="208.70.152.104"/>
      <filter dst_ip="169.169.208.180"/>
      <filter src_ip="208.70.152.102" src_port="5050"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="211.225.25.95"/>
    </slice>
    <from sec="1123477206" usec="0"/>
    <to sec="1123478081" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="2.193.36.95"/>
    </slice>
    <from sec="1123477554" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_719{
style=filled;
color=gray75;
3777[label="201.117.152.96;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5374[label="201.117.152.96;1pkt 1fpkt", shape=invtriangle, color=brown];
stat719[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.117.152.96:139, 201.213.4.55:1222}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1222: (50%)&lt;BR/&gt; 139: (50%)&gt;];
}
3777--5374[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="201.213.4.55" dst_port="1222" src_ip="201.117.152.96" src_port="139"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_720{
style=filled;
color=gray75;
3779[label="158.17.244.96;40pkt 40fpkt", shape=pentagon, color=darkviolet];
5376[label="158.17.244.96;40pkt 40fpkt", shape=invtriangle, color=brown];
6278[label="158.17.244.96;39pkt 39fpkt", shape=invhouse, color=bisque];
stat720[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.17.244.96:25, *:*}[27.5%]&lt;BR/&gt;{158.17.244.96:80, 215.172.242.29:*}[22.5%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (26.4706%)&lt;BR/&gt; 25: (13.4454%)&lt;BR/&gt; 53: (11.3445%)&lt;BR/&gt; 65534: (5.04202%)&lt;BR/&gt; 63509: (1.2605%)&gt;];
}
3779--5376[label="1;40pkt 40fpkt"];
3779--6278[label="1;39pkt 39fpkt"];
5376--6278[label="1;39pkt 39fpkt"];
</description>
    <slice>
      <filter src_ip="158.17.244.96" src_port="25"/>
      <filter dst_ip="215.172.242.29" src_ip="158.17.244.96" src_port="80"/>
    </slice>
    <from sec="1123477250" usec="0"/>
    <to sec="1123478089" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_721{
style=filled;
color=gray75;
3791[label="203.18.40.98;184pkt 184fpkt", shape=pentagon, color=darkviolet];
5384[label="203.18.40.98;184pkt 184fpkt", shape=invtriangle, color=brown];
6282[label="203.18.40.98;183pkt 183fpkt", shape=invhouse, color=bisque];
stat721[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.18.40.98:1028, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1028: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3791--5384[label="1;184pkt 184fpkt"];
3791--6282[label="1;183pkt 183fpkt"];
5384--6282[label="1;183pkt 183fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="203.18.40.98" src_port="1028"/>
    </slice>
    <from sec="1123477479" usec="0"/>
    <to sec="1123477508" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_722{
style=filled;
color=gray75;
3803[label="208.70.152.99;12pkt 12fpkt", shape=pentagon, color=darkviolet];
5391[label="208.70.152.99;12pkt 12fpkt", shape=invtriangle, color=brown];
6286[label="208.70.152.99;11pkt 11fpkt", shape=invhouse, color=bisque];
stat722[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.70.152.99:5050, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5050: (50%)&lt;BR/&gt; 4464: (4.28571%)&lt;BR/&gt; 2791: (4.28571%)&lt;BR/&gt; 1554: (4.28571%)&lt;BR/&gt; 1290: (4.28571%)&gt;];
}
3803--5391[label="1;12pkt 12fpkt"];
3803--6286[label="1;11pkt 11fpkt"];
5391--6286[label="1;11pkt 11fpkt"];
</description>
    <slice>
      <filter src_ip="208.70.152.99" src_port="5050"/>
    </slice>
    <from sec="1123477213" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_723{
style=filled;
color=gray75;
3814[label="204.41.1.101;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5397[label="204.41.1.101;2pkt 2fpkt", shape=invtriangle, color=brown];
6290[label="204.41.1.101;2pkt 2fpkt", shape=invhouse, color=bisque];
stat723[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.41.1.101:80, 200.89.24.145:2698}[50%]&lt;BR/&gt;{204.41.1.101:80, 200.89.26.167:31180}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 31180: (25%)&lt;BR/&gt; 2698: (25%)&gt;];
}
3814--5397[label="1;2pkt 2fpkt"];
3814--6290[label="1;2pkt 2fpkt"];
5397--6290[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="200.89.26.167" dst_port="31180" src_ip="204.41.1.101" src_port="80"/>
      <filter dst_ip="200.89.24.145" dst_port="2698" src_ip="204.41.1.101" src_port="80"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_724{
style=filled;
color=gray75;
3819[label="208.70.152.101;10pkt 10fpkt", shape=pentagon, color=darkviolet];
5399[label="208.70.152.101;10pkt 10fpkt", shape=invtriangle, color=brown];
6291[label="208.70.152.101;10pkt 10fpkt", shape=invhouse, color=bisque];
stat724[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.70.152.101:5050, 169.169.144.214:*}[40%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5050: (45%)&lt;BR/&gt; 3332: (5%)&lt;BR/&gt; 3188: (5%)&lt;BR/&gt; 3164: (5%)&lt;BR/&gt; 3077: (5%)&gt;];
}
3819--5399[label="1;10pkt 10fpkt"];
3819--6291[label="1;10pkt 10fpkt"];
5399--6291[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter dst_ip="169.169.144.214" src_ip="208.70.152.101" src_port="5050"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_725{
style=filled;
color=gray75;
3820[label="152.20.172.101;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5400[label="152.20.172.101;2pkt 2fpkt", shape=invtriangle, color=brown];
stat725[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.20.172.101:33053, 210.120.210.75:80}[50%]&lt;BR/&gt;{152.20.172.101:33711, 210.120.210.75:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 33711: (25%)&lt;BR/&gt; 33053: (25%)&gt;];
}
3820--5400[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="210.120.210.75" dst_port="80" src_ip="152.20.172.101" src_port="33711"/>
      <filter dst_ip="210.120.210.75" dst_port="80" src_ip="152.20.172.101" src_port="33053"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_726{
style=filled;
color=gray75;
3825[label="71.108.220.101;252pkt 252fpkt", shape=pentagon, color=darkviolet];
5402[label="71.108.220.101;252pkt 252fpkt", shape=invtriangle, color=brown];
6293[label="71.108.220.101;252pkt 252fpkt", shape=invhouse, color=bisque];
stat726[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.108.220.101:32987, *:1027}[50.3968%]&lt;BR/&gt;{71.108.220.101:32987, *:1026}[49.6032%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 32987: (50%)&lt;BR/&gt; 1027: (25.1984%)&lt;BR/&gt; 1026: (24.8016%)&gt;];
}
3825--5402[label="1;252pkt 252fpkt"];
3825--6293[label="1;252pkt 252fpkt"];
5402--6293[label="1;252pkt 252fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="71.108.220.101" src_port="32987"/>
      <filter dst_port="1026" src_ip="71.108.220.101" src_port="32987"/>
    </slice>
    <from sec="1123477874" usec="0"/>
    <to sec="1123477875" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_727{
style=filled;
color=gray75;
3826[label="204.41.10.102;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5403[label="204.41.10.102;2pkt 2fpkt", shape=invtriangle, color=brown];
6294[label="204.41.10.102;2pkt 2fpkt", shape=invhouse, color=bisque];
stat727[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.41.10.102:80, 200.89.24.144:3520}[50%]&lt;BR/&gt;{204.41.10.102:80, 200.89.24.145:2835}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3520: (25%)&lt;BR/&gt; 2835: (25%)&gt;];
}
3826--5403[label="1;2pkt 2fpkt"];
3826--6294[label="1;2pkt 2fpkt"];
5403--6294[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="200.89.24.145" dst_port="2835" src_ip="204.41.10.102" src_port="80"/>
      <filter dst_ip="200.89.24.144" dst_port="3520" src_ip="204.41.10.102" src_port="80"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="71.45.39.102"/>
    </slice>
    <from sec="1123477207" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="18.227.200.102"/>
    </slice>
    <from sec="1123477435" usec="0"/>
    <to sec="1123478001" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_730{
style=filled;
color=gray75;
3839[label="158.160.231.103;63pkt 63fpkt", shape=pentagon, color=darkviolet];
5413[label="158.160.231.103;63pkt 63fpkt", shape=invtriangle, color=brown];
stat730[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.160.231.103:30484, *:*}[98.4127%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 30484: (49.2063%)&lt;BR/&gt; 64319: (0.793651%)&lt;BR/&gt; 63817: (0.793651%)&lt;BR/&gt; 63578: (0.793651%)&lt;BR/&gt; 63201: (0.793651%)&gt;];
}
3839--5413[label="1;63pkt 63fpkt"];
</description>
    <slice>
      <filter src_ip="158.160.231.103" src_port="30484"/>
    </slice>
    <from sec="1123477210" usec="0"/>
    <to sec="1123478096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_731{
style=filled;
color=gray75;
3845[label="1.5.150.104;67pkt 67fpkt", shape=pentagon, color=darkviolet];
5417[label="1.5.150.104;67pkt 67fpkt", shape=invtriangle, color=brown];
stat731[shape=component, label=&lt;Rules:&lt;BR/&gt;{1.5.150.104:*, *:3127}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3127: (50%)&lt;BR/&gt; 4939: (0.746269%)&lt;BR/&gt; 4837: (0.746269%)&lt;BR/&gt; 4736: (0.746269%)&lt;BR/&gt; 4620: (0.746269%)&gt;];
}
3845--5417[label="1;67pkt 67fpkt"];
</description>
    <slice>
      <filter dst_port="3127" src_ip="1.5.150.104"/>
    </slice>
    <from sec="1123477208" usec="0"/>
    <to sec="1123477803" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="3.19.167.104"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="71.83.130.107"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_734{
style=filled;
color=gray75;
753[label="132.117.213.69;d;710pkt 710fpkt", shape=diamond, color=yellow];
900[label="152.21.71.12;d;2457pkt 2457fpkt", shape=diamond, color=yellow];
2114[label="69.100.144.109;s;14pkt 14fpkt", shape=diamond, color=yellow];
3069[label="211.55.102.15;4pkt 4fpkt", shape=pentagon, color=darkviolet];
3172[label="219.172.171.27;7pkt 7fpkt", shape=pentagon, color=darkviolet];
3348[label="71.101.222.46;15pkt 15fpkt", shape=pentagon, color=darkviolet];
3723[label="145.99.66.90;7pkt 7fpkt", shape=pentagon, color=darkviolet];
3743[label="71.4.211.91;6pkt 6fpkt", shape=pentagon, color=darkviolet];
3783[label="201.185.90.97;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3844[label="210.99.133.104;21pkt 21fpkt", shape=pentagon, color=darkviolet];
3880[label="211.197.129.109;6pkt 6fpkt", shape=pentagon, color=darkviolet];
4108[label="71.1.151.138;25pkt 25fpkt", shape=pentagon, color=darkviolet];
4360[label="201.120.24.173;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4485[label="210.18.173.190;8pkt 8fpkt", shape=pentagon, color=darkviolet];
4501[label="70.107.82.192;3pkt 3fpkt", shape=pentagon, color=darkviolet];
4730[label="200.132.73.224;32pkt 32fpkt", shape=pentagon, color=darkviolet];
5043[label="219.172.171.27;7pkt 7fpkt", shape=invtriangle, color=brown];
5131[label="71.101.222.46;15pkt 15fpkt", shape=invtriangle, color=brown];
5354[label="71.4.211.91;6pkt 6fpkt", shape=invtriangle, color=brown];
5416[label="210.99.133.104;21pkt 21fpkt", shape=invtriangle, color=brown];
5438[label="211.197.129.109;6pkt 6fpkt", shape=invtriangle, color=brown];
5768[label="210.18.173.190;8pkt 8fpkt", shape=invtriangle, color=brown];
5776[label="70.107.82.192;3pkt 3fpkt", shape=invtriangle, color=brown];
5977[label="70.201.160.246;12pkt 12fpkt", shape=invtriangle, color=brown];
6128[label="71.101.222.46;16pkt 16fpkt", shape=invhouse, color=bisque];
6264[label="71.4.211.91;5pkt 5fpkt", shape=invhouse, color=bisque];
6476[label="210.18.173.190;8pkt 8fpkt", shape=invhouse, color=bisque];
6582[label="70.201.160.246;12pkt 12fpkt", shape=invhouse, color=bisque];
stat734[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 152.21.71.12:1179}[75.196%]&lt;BR/&gt;{*:*, 132.117.213.69:58035}[21.8877%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1179: (36.8452%)&lt;BR/&gt; 58035: (11.7142%)&lt;BR/&gt; 443: (0.669383%)&lt;BR/&gt; 80: (0.56752%)&lt;BR/&gt; 0: (0.232829%)&gt;];
}
753--815[label="0.00140845;1pkt 1fpkt"];
753--1052[label="0.00140845;1pkt 1fpkt"];
753--2114[label="0.285714;4pkt 4fpkt"];
753--3348[label="0.933333;14pkt 14fpkt"];
753--3511[label="0.00140845;1pkt 1fpkt"];
753--3844[label="0.904762;19pkt 19fpkt"];
753--3880[label="1;6pkt 6fpkt"];
753--4501[label="1;3pkt 3fpkt"];
753--4517[label="0.00140845;1pkt 1fpkt"];
753--4730[label="0.125;4pkt 4fpkt"];
753--5131[label="0.933333;14pkt 14fpkt"];
753--5229[label="0.00140845;1pkt 1fpkt"];
753--5416[label="0.904762;19pkt 19fpkt"];
753--5438[label="1;6pkt 6fpkt"];
753--5776[label="1;3pkt 3fpkt"];
753--6128[label="0.9375;15pkt 15fpkt"];
753--6188[label="0.00140845;1pkt 1fpkt"];
900--1765[label="0.011236;1pkt 1fpkt"];
900--2875[label="0.000814001;2pkt 2fpkt"];
900--2885[label="0.002035;5pkt 5fpkt"];
900--2899[label="0.002035;5pkt 5fpkt"];
900--2909[label="0.002035;5pkt 5fpkt"];
900--3069[label="1;4pkt 4fpkt"];
900--3172[label="1;7pkt 7fpkt"];
900--3723[label="1;7pkt 7fpkt"];
900--3743[label="1;6pkt 6fpkt"];
900--3783[label="1;1pkt 1fpkt"];
900--3840[label="0.0103093;1pkt 1fpkt"];
900--4108[label="0.76;19pkt 19fpkt"];
900--4360[label="1;1pkt 1fpkt"];
900--4485[label="1;8pkt 8fpkt"];
900--4730[label="0.78125;25pkt 25fpkt"];
900--5043[label="1;7pkt 7fpkt"];
900--5354[label="1;6pkt 6fpkt"];
900--5414[label="0.0104167;1pkt 1fpkt"];
900--5768[label="1;8pkt 8fpkt"];
900--5977[label="1;12pkt 12fpkt"];
900--6264[label="1;5pkt 5fpkt"];
900--6476[label="1;8pkt 8fpkt"];
900--6582[label="1;12pkt 12fpkt"];
3172--5043[label="1;7pkt 7fpkt"];
3348--5131[label="1;15pkt 15fpkt"];
3348--6128[label="1;15pkt 15fpkt"];
3743--5354[label="1;6pkt 6fpkt"];
3743--6264[label="1;5pkt 5fpkt"];
3844--5416[label="1;21pkt 21fpkt"];
3880--5438[label="1;6pkt 6fpkt"];
4485--5768[label="1;8pkt 8fpkt"];
4485--6476[label="1;8pkt 8fpkt"];
4501--5776[label="1;3pkt 3fpkt"];
5131--6128[label="1;15pkt 15fpkt"];
5354--6264[label="1;5pkt 5fpkt"];
5768--6476[label="1;8pkt 8fpkt"];
5977--6582[label="1;12pkt 12fpkt"];
</description>
    <slice>
      <filter dst_ip="152.21.71.12" dst_port="1179"/>
      <filter dst_ip="132.117.213.69" dst_port="58035"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="17.224.193.110"/>
    </slice>
    <from sec="1123477381" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="71.209.138.112"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123477629" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_737{
style=filled;
color=gray75;
3914[label="201.75.177.113;12pkt 12fpkt", shape=pentagon, color=darkviolet];
5458[label="201.75.177.113;12pkt 12fpkt", shape=invtriangle, color=brown];
stat737[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.75.177.113:80, 200.89.24.144:*}[50%]&lt;BR/&gt;{201.75.177.113:80, 200.89.24.145:*}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3320: (4.16667%)&lt;BR/&gt; 3319: (4.16667%)&lt;BR/&gt; 3310: (4.16667%)&lt;BR/&gt; 3154: (4.16667%)&gt;];
}
3914--5458[label="1;12pkt 12fpkt"];
</description>
    <slice>
      <filter dst_ip="200.89.24.145" src_ip="201.75.177.113" src_port="80"/>
      <filter dst_ip="200.89.24.144" src_ip="201.75.177.113" src_port="80"/>
    </slice>
    <from sec="1123477987" usec="0"/>
    <to sec="1123478096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_738{
style=filled;
color=gray75;
3916[label="200.89.34.114;5pkt 5fpkt", shape=pentagon, color=darkviolet];
5460[label="200.89.34.114;5pkt 5fpkt", shape=invtriangle, color=brown];
6324[label="200.89.34.114;5pkt 5fpkt", shape=invhouse, color=bisque];
stat738[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.89.34.114:80, 0.49.111.169:40975}[20%]&lt;BR/&gt;{200.89.34.114:80, 0.49.111.170:48777}[20%]&lt;BR/&gt;{200.89.34.114:80, 205.45.30.33:5518}[20%]&lt;BR/&gt;{200.89.34.114:80, 205.45.30.33:14220}[20%]&lt;BR/&gt;{200.89.34.114:80, 205.45.30.33:60788}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 60788: (10%)&lt;BR/&gt; 48777: (10%)&lt;BR/&gt; 40975: (10%)&lt;BR/&gt; 14220: (10%)&gt;];
}
3916--5460[label="1;5pkt 5fpkt"];
3916--6324[label="1;5pkt 5fpkt"];
5460--6324[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="205.45.30.33" dst_port="60788" src_ip="200.89.34.114" src_port="80"/>
      <filter dst_ip="205.45.30.33" dst_port="14220" src_ip="200.89.34.114" src_port="80"/>
      <filter dst_ip="205.45.30.33" dst_port="5518" src_ip="200.89.34.114" src_port="80"/>
      <filter dst_ip="0.49.111.170" dst_port="48777" src_ip="200.89.34.114" src_port="80"/>
      <filter dst_ip="0.49.111.169" dst_port="40975" src_ip="200.89.34.114" src_port="80"/>
    </slice>
    <from sec="1123477459" usec="0"/>
    <to sec="1123478053" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_739{
style=filled;
color=gray75;
3921[label="215.218.120.114;177pkt 177fpkt", shape=pentagon, color=darkviolet];
5462[label="215.218.120.114;177pkt 177fpkt", shape=invtriangle, color=brown];
6325[label="215.218.120.114;177pkt 177fpkt", shape=invhouse, color=bisque];
stat739[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.218.120.114:57739, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 57739: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3921--5462[label="1;177pkt 177fpkt"];
3921--6325[label="1;177pkt 177fpkt"];
5462--6325[label="1;177pkt 177fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="215.218.120.114" src_port="57739"/>
    </slice>
    <from sec="1123477636" usec="0"/>
    <to sec="1123477665" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_741{
style=filled;
color=gray75;
3936[label="211.204.48.117;120pkt 120fpkt", shape=pentagon, color=darkviolet];
5470[label="211.204.48.117;120pkt 120fpkt", shape=invtriangle, color=brown];
6331[label="211.204.48.117;120pkt 120fpkt", shape=invhouse, color=bisque];
stat741[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.204.48.117:32944, *:1026}[51.6667%]&lt;BR/&gt;{211.204.48.117:32944, *:1027}[48.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 32944: (50%)&lt;BR/&gt; 1026: (25.8333%)&lt;BR/&gt; 1027: (24.1667%)&gt;];
}
3936--5470[label="1;120pkt 120fpkt"];
3936--6331[label="1;120pkt 120fpkt"];
5470--6331[label="1;120pkt 120fpkt"];
</description>
    <slice>
      <filter dst_port="1026" src_ip="211.204.48.117" src_port="32944"/>
      <filter dst_port="1027" src_ip="211.204.48.117" src_port="32944"/>
    </slice>
    <from sec="1123477761" usec="0"/>
    <to sec="1123477762" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_742{
style=filled;
color=gray75;
3938[label="212.18.121.117;204pkt 204fpkt", shape=pentagon, color=darkviolet];
5472[label="212.18.121.117;204pkt 204fpkt", shape=invtriangle, color=brown];
stat742[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.18.121.117:*, *:139}[75.4902%]&lt;BR/&gt;{212.18.121.117:*, *:445}[24.5098%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 139: (37.7451%)&lt;BR/&gt; 445: (12.2549%)&lt;BR/&gt; 1478: (0.490196%)&lt;BR/&gt; 1475: (0.490196%)&lt;BR/&gt; 1473: (0.490196%)&gt;];
}
3938--5472[label="1;204pkt 204fpkt"];
</description>
    <slice>
      <filter dst_port="139" src_ip="212.18.121.117"/>
      <filter dst_port="445" src_ip="212.18.121.117"/>
    </slice>
    <from sec="1123477964" usec="0"/>
    <to sec="1123478001" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_743{
style=filled;
color=gray75;
3939[label="218.49.157.117;40pkt 40fpkt", shape=pentagon, color=darkviolet];
5473[label="218.49.157.117;40pkt 40fpkt", shape=invtriangle, color=brown];
stat743[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.49.157.117:*, 158.189.5.156:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3969: (1.25%)&lt;BR/&gt; 3941: (1.25%)&lt;BR/&gt; 3923: (1.25%)&lt;BR/&gt; 3903: (1.25%)&gt;];
}
3939--5473[label="1;40pkt 40fpkt"];
</description>
    <slice>
      <filter dst_ip="158.189.5.156" dst_port="80" src_ip="218.49.157.117"/>
    </slice>
    <from sec="1123477535" usec="0"/>
    <to sec="1123477816" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="169.169.147.120"/>
    </slice>
    <from sec="1123477258" usec="0"/>
    <to sec="1123478078" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_745{
style=filled;
color=gray75;
394[label="194.133.188.40;s;30pkt 30fpkt", shape=diamond, color=yellow];
722[label="194.208.28.83;s;84pkt 84fpkt", shape=diamond, color=yellow];
961[label="169.169.250.141;d;3pkt 3fpkt", shape=diamond, color=yellow];
1545[label="169.169.224.105;d;2pkt 2fpkt", shape=diamond, color=yellow];
1548[label="208.70.152.92;s;21pkt 21fpkt", shape=diamond, color=yellow];
1549[label="208.70.152.90;s;17pkt 17fpkt", shape=diamond, color=yellow];
1737[label="169.169.235.2;d;2pkt 2fpkt", shape=diamond, color=yellow];
1772[label="169.169.254.199;d;7pkt 7fpkt", shape=diamond, color=yellow];
1781[label="208.70.152.98;s;27pkt 27fpkt", shape=diamond, color=yellow];
1838[label="169.169.193.131;d;23pkt 23fpkt", shape=diamond, color=yellow];
1936[label="169.169.244.63;d;2pkt 2fpkt", shape=diamond, color=yellow];
1945[label="169.169.154.21;d;2pkt 2fpkt", shape=diamond, color=yellow];
1948[label="169.169.158.175;d;2pkt 2fpkt", shape=diamond, color=yellow];
1949[label="169.169.238.2;d;2pkt 2fpkt", shape=diamond, color=yellow];
1954[label="169.169.224.116;d;3pkt 3fpkt", shape=diamond, color=yellow];
1957[label="169.169.154.27;d;2pkt 2fpkt", shape=diamond, color=yellow];
1972[label="169.169.157.183;d;1pkt 1fpkt", shape=diamond, color=yellow];
1977[label="169.169.154.16;d;1pkt 1fpkt", shape=diamond, color=yellow];
1985[label="169.169.193.162;d;2pkt 2fpkt", shape=diamond, color=yellow];
2014[label="169.169.154.22;d;2pkt 2fpkt", shape=diamond, color=yellow];
2034[label="169.169.227.35;d;2pkt 2fpkt", shape=diamond, color=yellow];
2041[label="169.169.154.17;d;1pkt 1fpkt", shape=diamond, color=yellow];
2194[label="208.70.152.91;s;15pkt 15fpkt", shape=diamond, color=yellow];
2197[label="169.169.208.88;d;1pkt 1fpkt", shape=diamond, color=yellow];
2218[label="208.70.152.115;s;21pkt 21fpkt", shape=diamond, color=yellow];
2246[label="169.169.157.134;d;2pkt 2fpkt", shape=diamond, color=yellow];
2270[label="208.70.152.97;s;21pkt 21fpkt", shape=diamond, color=yellow];
2336[label="169.169.228.36;d;26pkt 26fpkt", shape=diamond, color=yellow];
2427[label="169.169.193.140;d;6pkt 6fpkt", shape=diamond, color=yellow];
2444[label="169.169.154.20;d;2pkt 2fpkt", shape=diamond, color=yellow];
2486[label="208.70.152.80;s;19pkt 19fpkt", shape=diamond, color=yellow];
3535[label="208.70.152.70;11pkt 11fpkt", shape=pentagon, color=darkviolet];
3616[label="208.70.152.80;19pkt 19fpkt", shape=pentagon, color=darkviolet];
3643[label="208.70.152.83;11pkt 11fpkt", shape=pentagon, color=darkviolet];
3749[label="208.70.152.92;21pkt 21fpkt", shape=pentagon, color=darkviolet];
3760[label="208.70.152.94;18pkt 18fpkt", shape=pentagon, color=darkviolet];
3793[label="208.70.152.98;27pkt 27fpkt", shape=pentagon, color=darkviolet];
3959[label="208.70.152.120;12pkt 12fpkt", shape=pentagon, color=darkviolet];
3989[label="208.70.152.125;11pkt 11fpkt", shape=pentagon, color=darkviolet];
5241[label="64.225.8.70;450pkt 450fpkt", shape=invtriangle, color=brown];
5242[label="208.70.152.70;11pkt 11fpkt", shape=invtriangle, color=brown];
5283[label="208.70.152.80;19pkt 19fpkt", shape=invtriangle, color=brown];
5357[label="208.70.152.92;21pkt 21fpkt", shape=invtriangle, color=brown];
5365[label="208.70.152.94;18pkt 18fpkt", shape=invtriangle, color=brown];
5480[label="208.70.152.120;12pkt 12fpkt", shape=invtriangle, color=brown];
5501[label="208.70.152.125;11pkt 11fpkt", shape=invtriangle, color=brown];
6270[label="208.70.152.94;17pkt 17fpkt", shape=invhouse, color=bisque];
stat745[shape=component, label=&lt;Rules:&lt;BR/&gt;{64.225.8.70:1373, *:1434}[57.6923%]&lt;BR/&gt;{*:5050, *:*}[24.1026%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1434: (21.7308%)&lt;BR/&gt; 1373: (21.6827%)&lt;BR/&gt; 5050: (17.4519%)&lt;BR/&gt; 20: (1.10577%)&lt;BR/&gt; 23: (1.00962%)&gt;];
}
394--961[label="0.666667;2pkt 2fpkt"];
394--1737[label="0.5;1pkt 1fpkt"];
394--1772[label="0.142857;1pkt 1fpkt"];
394--1936[label="0.5;1pkt 1fpkt"];
394--1954[label="0.333333;1pkt 1fpkt"];
394--1957[label="0.5;1pkt 1fpkt"];
394--1972[label="1;1pkt 1fpkt"];
394--1977[label="1;1pkt 1fpkt"];
394--1985[label="0.5;1pkt 1fpkt"];
394--2014[label="0.5;1pkt 1fpkt"];
394--2034[label="0.5;1pkt 1fpkt"];
394--2041[label="1;1pkt 1fpkt"];
394--2197[label="1;1pkt 1fpkt"];
394--2246[label="0.5;1pkt 1fpkt"];
394--2427[label="0.666667;4pkt 4fpkt"];
394--2444[label="0.5;1pkt 1fpkt"];
722--1545[label="0.5;1pkt 1fpkt"];
722--1838[label="0.956522;22pkt 22fpkt"];
722--1945[label="0.5;1pkt 1fpkt"];
722--1948[label="0.5;1pkt 1fpkt"];
722--1949[label="1;2pkt 2fpkt"];
722--2336[label="0.769231;20pkt 20fpkt"];
722--2875[label="0.0119048;1pkt 1fpkt"];
961--1549[label="0.333333;1pkt 1fpkt"];
1545--3760[label="0.5;1pkt 1fpkt"];
1545--5365[label="0.5;1pkt 1fpkt"];
1545--6270[label="0.5;1pkt 1fpkt"];
1548--2427[label="0.166667;1pkt 1fpkt"];
1548--3749[label="1;21pkt 21fpkt"];
1548--5357[label="1;21pkt 21fpkt"];
1737--2194[label="0.5;1pkt 1fpkt"];
1772--2218[label="0.142857;1pkt 1fpkt"];
1772--2486[label="0.142857;1pkt 1fpkt"];
1772--3535[label="0.142857;1pkt 1fpkt"];
1772--3616[label="0.142857;1pkt 1fpkt"];
1772--3643[label="0.285714;2pkt 2fpkt"];
1772--5242[label="0.142857;1pkt 1fpkt"];
1772--5283[label="0.142857;1pkt 1fpkt"];
1781--1954[label="0.333333;1pkt 1fpkt"];
1781--3793[label="1;27pkt 27fpkt"];
1838--2875[label="0.0434783;1pkt 1fpkt"];
1945--3760[label="0.5;1pkt 1fpkt"];
1945--5365[label="0.5;1pkt 1fpkt"];
1945--6270[label="0.5;1pkt 1fpkt"];
1948--2270[label="0.5;1pkt 1fpkt"];
1954--3793[label="0.333333;1pkt 1fpkt"];
1954--3989[label="0.333333;1pkt 1fpkt"];
1954--5501[label="0.333333;1pkt 1fpkt"];
1957--3760[label="0.5;1pkt 1fpkt"];
1957--5365[label="0.5;1pkt 1fpkt"];
1957--6270[label="0.5;1pkt 1fpkt"];
2034--3959[label="0.5;1pkt 1fpkt"];
2034--5480[label="0.5;1pkt 1fpkt"];
2427--3749[label="0.166667;1pkt 1fpkt"];
2427--3959[label="0.166667;1pkt 1fpkt"];
2427--5357[label="0.166667;1pkt 1fpkt"];
2427--5480[label="0.166667;1pkt 1fpkt"];
2444--5241[label="0.5;1pkt 1fpkt"];
2486--3616[label="1;19pkt 19fpkt"];
2486--5283[label="1;19pkt 19fpkt"];
3535--5242[label="1;11pkt 11fpkt"];
3616--5283[label="1;19pkt 19fpkt"];
3749--5357[label="1;21pkt 21fpkt"];
3760--5365[label="1;18pkt 18fpkt"];
3760--6270[label="1;17pkt 17fpkt"];
3959--5480[label="1;12pkt 12fpkt"];
3989--5501[label="1;11pkt 11fpkt"];
5365--6270[label="1;17pkt 17fpkt"];
</description>
    <slice>
      <filter src_port="5050"/>
      <filter dst_port="1434" src_ip="64.225.8.70" src_port="1373"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="71.6.246.120"/>
    </slice>
    <from sec="1123477202" usec="0"/>
    <to sec="1123477838" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_747{
style=filled;
color=gray75;
3965[label="158.160.4.121;54pkt 54fpkt", shape=pentagon, color=darkviolet];
5483[label="158.160.4.121;54pkt 54fpkt", shape=invtriangle, color=brown];
stat747[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.160.4.121:35732, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 35732: (50%)&lt;BR/&gt; 64975: (0.925926%)&lt;BR/&gt; 64573: (0.925926%)&lt;BR/&gt; 60043: (0.925926%)&lt;BR/&gt; 56768: (0.925926%)&gt;];
}
3965--5483[label="1;54pkt 54fpkt"];
</description>
    <slice>
      <filter src_ip="158.160.4.121" src_port="35732"/>
    </slice>
    <from sec="1123477209" usec="0"/>
    <to sec="1123478096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="70.136.73.121"/>
    </slice>
    <from sec="1123477202" usec="0"/>
    <to sec="1123477970" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_749{
style=filled;
color=gray75;
3971[label="208.70.152.122;7pkt 7fpkt", shape=pentagon, color=darkviolet];
5486[label="208.70.152.122;7pkt 7fpkt", shape=invtriangle, color=brown];
6338[label="208.70.152.122;7pkt 7fpkt", shape=invhouse, color=bisque];
stat749[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.70.152.122:5050, *:*}[85.7143%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5050: (42.8571%)&lt;BR/&gt; 3340: (7.14286%)&lt;BR/&gt; 1175: (7.14286%)&lt;BR/&gt; 1167: (7.14286%)&lt;BR/&gt; 1107: (7.14286%)&gt;];
}
3971--5486[label="1;7pkt 7fpkt"];
3971--6338[label="1;7pkt 7fpkt"];
5486--6338[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter src_ip="208.70.152.122" src_port="5050"/>
    </slice>
    <from sec="1123477302" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="70.138.49.123"/>
    </slice>
    <from sec="1123477367" usec="0"/>
    <to sec="1123477693" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_751{
style=filled;
color=gray75;
3977[label="208.70.152.123;13pkt 13fpkt", shape=pentagon, color=darkviolet];
5490[label="208.70.152.123;13pkt 13fpkt", shape=invtriangle, color=brown];
6340[label="208.70.152.123;13pkt 13fpkt", shape=invhouse, color=bisque];
stat751[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.70.152.123:5050, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5050: (50%)&lt;BR/&gt; 56992: (3.84615%)&lt;BR/&gt; 2952: (3.84615%)&lt;BR/&gt; 2759: (3.84615%)&lt;BR/&gt; 1731: (3.84615%)&gt;];
}
3977--5490[label="1;13pkt 13fpkt"];
3977--6340[label="1;13pkt 13fpkt"];
5490--6340[label="1;13pkt 13fpkt"];
</description>
    <slice>
      <filter src_ip="208.70.152.123" src_port="5050"/>
    </slice>
    <from sec="1123477312" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_752{
style=filled;
color=gray75;
816[label="6.122.20.35;d;352pkt 352fpkt", shape=diamond, color=yellow];
1057[label="152.21.171.88;s;163pkt 163fpkt", shape=diamond, color=yellow];
2227[label="152.21.56.197;s;151pkt 151fpkt", shape=diamond, color=yellow];
2467[label="6.122.20.60;d;149pkt 149fpkt", shape=diamond, color=yellow];
3003[label="152.20.49.9;161pkt 161fpkt", shape=pentagon, color=darkviolet];
3973[label="158.189.168.122;20pkt 20fpkt", shape=pentagon, color=darkviolet];
3979[label="158.189.168.123;26pkt 26fpkt", shape=pentagon, color=darkviolet];
4156[label="172.118.28.145;20pkt 20fpkt", shape=pentagon, color=darkviolet];
4325[label="152.21.188.168;247pkt 247fpkt", shape=pentagon, color=darkviolet];
4453[label="152.21.229.185;55pkt 55fpkt", shape=pentagon, color=darkviolet];
4548[label="152.21.56.197;162pkt 162fpkt", shape=pentagon, color=darkviolet];
4957[label="152.20.49.9;161pkt 161fpkt", shape=invtriangle, color=brown];
5487[label="158.189.168.122;20pkt 20fpkt", shape=invtriangle, color=brown];
5491[label="158.189.168.123;26pkt 26fpkt", shape=invtriangle, color=brown];
6026[label="152.20.49.9;160pkt 160fpkt", shape=invhouse, color=bisque];
6339[label="158.189.168.122;20pkt 20fpkt", shape=invhouse, color=bisque];
6341[label="158.189.168.123;26pkt 26fpkt", shape=invhouse, color=bisque];
stat752[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 6.122.20.35:2703}[50.0527%]&lt;BR/&gt;{152.21.188.168:*, *:2703}[25.8166%]&lt;BR/&gt;{*:*, 6.122.20.60:2703}[22.6554%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2703: (42.7306%)&lt;BR/&gt; 25: (5.49766%)&lt;BR/&gt; 113: (0.833768%)&lt;BR/&gt; 53: (0.755602%)&lt;BR/&gt; 64421: (0.286608%)&gt;];
}
816--1057[label="0.638037;104pkt 104fpkt"];
816--2227[label="0.350993;53pkt 53fpkt"];
816--3003[label="0.372671;60pkt 60fpkt"];
816--3560[label="0.0208333;1pkt 1fpkt"];
816--3973[label="0.1;2pkt 2fpkt"];
816--3979[label="0.346154;9pkt 9fpkt"];
816--4156[label="0.35;7pkt 7fpkt"];
816--4325[label="0.097166;24pkt 24fpkt"];
816--4453[label="0.636364;35pkt 35fpkt"];
816--4548[label="0.32716;53pkt 53fpkt"];
816--4957[label="0.372671;60pkt 60fpkt"];
816--5253[label="0.0208333;1pkt 1fpkt"];
816--5487[label="0.1;2pkt 2fpkt"];
816--5491[label="0.346154;9pkt 9fpkt"];
816--6026[label="0.375;60pkt 60fpkt"];
816--6203[label="0.0208333;1pkt 1fpkt"];
816--6339[label="0.1;2pkt 2fpkt"];
816--6341[label="0.346154;9pkt 9fpkt"];
2227--2467[label="0.362416;54pkt 54fpkt"];
2227--4548[label="1;151pkt 151fpkt"];
2467--3003[label="0.208054;31pkt 31fpkt"];
2467--3973[label="0.1;2pkt 2fpkt"];
2467--3979[label="0.346154;9pkt 9fpkt"];
2467--4156[label="0.2;4pkt 4fpkt"];
2467--4325[label="0.0805369;12pkt 12fpkt"];
2467--4548[label="0.362416;54pkt 54fpkt"];
2467--4957[label="0.208054;31pkt 31fpkt"];
2467--5487[label="0.1;2pkt 2fpkt"];
2467--5491[label="0.346154;9pkt 9fpkt"];
2467--6026[label="0.208054;31pkt 31fpkt"];
2467--6339[label="0.1;2pkt 2fpkt"];
2467--6341[label="0.346154;9pkt 9fpkt"];
3003--4957[label="1;161pkt 161fpkt"];
3003--6026[label="1;160pkt 160fpkt"];
3973--5487[label="1;20pkt 20fpkt"];
3973--6339[label="1;20pkt 20fpkt"];
3979--5491[label="1;26pkt 26fpkt"];
3979--6341[label="1;26pkt 26fpkt"];
4957--6026[label="1;160pkt 160fpkt"];
5487--6339[label="1;20pkt 20fpkt"];
5491--6341[label="1;26pkt 26fpkt"];
</description>
    <slice>
      <filter dst_port="2703" src_ip="152.21.188.168"/>
      <filter dst_ip="6.122.20.35" dst_port="2703"/>
      <filter dst_ip="6.122.20.60" dst_port="2703"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_753{
style=filled;
color=gray75;
3981[label="211.167.249.123;231pkt 231fpkt", shape=pentagon, color=darkviolet];
5493[label="211.167.249.123;231pkt 231fpkt", shape=invtriangle, color=brown];
6343[label="211.167.249.123;231pkt 231fpkt", shape=invhouse, color=bisque];
stat753[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.167.249.123:16596, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 16596: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
3981--5493[label="1;231pkt 231fpkt"];
3981--6343[label="1;231pkt 231fpkt"];
5493--6343[label="1;231pkt 231fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="211.167.249.123" src_port="16596"/>
    </slice>
    <from sec="1123477622" usec="0"/>
    <to sec="1123477659" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="64.164.243.124"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_755{
style=filled;
color=gray75;
3985[label="169.169.253.124;3pkt 3fpkt", shape=pentagon, color=darkviolet];
5498[label="169.169.253.124;3pkt 3fpkt", shape=invtriangle, color=brown];
6346[label="169.169.253.124;3pkt 3fpkt", shape=invhouse, color=bisque];
stat755[shape=component, label=&lt;Rules:&lt;BR/&gt;{169.169.253.124:110, 204.41.18.166:37014}[33.3333%]&lt;BR/&gt;{169.169.253.124:1084, 204.41.18.164:113}[33.3333%]&lt;BR/&gt;{169.169.253.124:110, 204.41.18.164:46056}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 110: (33.3333%)&lt;BR/&gt; 46056: (16.6667%)&lt;BR/&gt; 37014: (16.6667%)&lt;BR/&gt; 1084: (16.6667%)&lt;BR/&gt; 113: (16.6667%)&gt;];
}
3985--5498[label="1;3pkt 3fpkt"];
3985--6346[label="1;3pkt 3fpkt"];
5498--6346[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="204.41.18.164" dst_port="46056" src_ip="169.169.253.124" src_port="110"/>
      <filter dst_ip="204.41.18.164" dst_port="113" src_ip="169.169.253.124" src_port="1084"/>
      <filter dst_ip="204.41.18.166" dst_port="37014" src_ip="169.169.253.124" src_port="110"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_756{
style=filled;
color=gray75;
3988[label="201.117.148.125;51pkt 51fpkt", shape=pentagon, color=darkviolet];
5500[label="201.117.148.125;51pkt 51fpkt", shape=invtriangle, color=brown];
stat756[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.117.148.125:39219, *:*}[92.1569%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 39219: (46.0784%)&lt;BR/&gt; 1863: (2.94118%)&lt;BR/&gt; 61917: (0.980392%)&lt;BR/&gt; 58786: (0.980392%)&lt;BR/&gt; 54045: (0.980392%)&gt;];
}
3988--5500[label="1;51pkt 51fpkt"];
</description>
    <slice>
      <filter src_ip="201.117.148.125" src_port="39219"/>
    </slice>
    <from sec="1123477207" usec="0"/>
    <to sec="1123478091" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_757{
style=filled;
color=gray75;
3990[label="212.20.158.125;391pkt 391fpkt", shape=pentagon, color=darkviolet];
5502[label="212.20.158.125;391pkt 391fpkt", shape=invtriangle, color=brown];
stat757[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.20.158.125:7000, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7000: (50%)&lt;BR/&gt; 33700: (0.255754%)&lt;BR/&gt; 24646: (0.255754%)&lt;BR/&gt; 64302: (0.127877%)&lt;BR/&gt; 63668: (0.127877%)&gt;];
}
3990--5502[label="1;391pkt 391fpkt"];
</description>
    <slice>
      <filter src_ip="212.20.158.125" src_port="7000"/>
    </slice>
    <from sec="1123477206" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_758{
style=filled;
color=gray75;
3993[label="158.47.1.126;3pkt 3fpkt", shape=pentagon, color=darkviolet];
5504[label="158.47.1.126;3pkt 3fpkt", shape=invtriangle, color=brown];
6349[label="158.47.1.126;3pkt 3fpkt", shape=invhouse, color=bisque];
stat758[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.47.1.126:2775, 5.133.215.104:443}[33.3333%]&lt;BR/&gt;{158.47.1.126:2772, 206.94.125.58:443}[33.3333%]&lt;BR/&gt;{158.47.1.126:2774, 206.94.125.58:443}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (50%)&lt;BR/&gt; 2775: (16.6667%)&lt;BR/&gt; 2774: (16.6667%)&lt;BR/&gt; 2772: (16.6667%)&gt;];
}
3993--5504[label="1;3pkt 3fpkt"];
3993--6349[label="1;3pkt 3fpkt"];
5504--6349[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="206.94.125.58" dst_port="443" src_ip="158.47.1.126" src_port="2774"/>
      <filter dst_ip="206.94.125.58" dst_port="443" src_ip="158.47.1.126" src_port="2772"/>
      <filter dst_ip="5.133.215.104" dst_port="443" src_ip="158.47.1.126" src_port="2775"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_760{
style=filled;
color=gray75;
4007[label="201.104.74.128;6pkt 6fpkt", shape=pentagon, color=darkviolet];
5509[label="201.104.74.128;6pkt 6fpkt", shape=invtriangle, color=brown];
stat760[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.104.74.128:*, 158.189.5.156:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 57159: (8.33333%)&lt;BR/&gt; 52143: (8.33333%)&lt;BR/&gt; 49397: (8.33333%)&lt;BR/&gt; 40300: (8.33333%)&gt;];
}
4007--5509[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="158.189.5.156" dst_port="80" src_ip="201.104.74.128"/>
    </slice>
    <from sec="1123477718" usec="0"/>
    <to sec="1123477807" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_761{
style=filled;
color=gray75;
4009[label="205.45.83.128;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5510[label="205.45.83.128;2pkt 2fpkt", shape=invtriangle, color=brown];
stat761[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.45.83.128:1863, 132.117.180.1:1171}[50%]&lt;BR/&gt;{205.45.83.128:1863, 132.117.153.92:1256}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1863: (50%)&lt;BR/&gt; 1256: (25%)&lt;BR/&gt; 1171: (25%)&gt;];
}
4009--5510[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="132.117.153.92" dst_port="1256" src_ip="205.45.83.128" src_port="1863"/>
      <filter dst_ip="132.117.180.1" dst_port="1171" src_ip="205.45.83.128" src_port="1863"/>
    </slice>
    <from sec="1123477521" usec="0"/>
    <to sec="1123477585" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,504,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_762{
style=filled;
color=gray75;
4012[label="4.128.116.128;20pkt 20fpkt", shape=pentagon, color=darkviolet];
5511[label="4.128.116.128;20pkt 20fpkt", shape=invtriangle, color=brown];
6354[label="4.128.116.128;20pkt 20fpkt", shape=invhouse, color=bisque];
stat762[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.128.116.128:443, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (50%)&lt;BR/&gt; 1088: (5%)&lt;BR/&gt; 63485: (2.5%)&lt;BR/&gt; 3137: (2.5%)&lt;BR/&gt; 2100: (2.5%)&gt;];
}
4012--5511[label="1;20pkt 20fpkt"];
4012--6354[label="1;20pkt 20fpkt"];
5511--6354[label="1;20pkt 20fpkt"];
</description>
    <slice>
      <filter src_ip="4.128.116.128" src_port="443"/>
    </slice>
    <from sec="1123477218" usec="0"/>
    <to sec="1123477966" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_763{
style=filled;
color=gray75;
4020[label="211.205.76.129;97pkt 97fpkt", shape=pentagon, color=darkviolet];
5515[label="211.205.76.129;97pkt 97fpkt", shape=invtriangle, color=brown];
stat763[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.205.76.129:33115, *:1027}[51.5464%]&lt;BR/&gt;{211.205.76.129:33115, *:1026}[48.4536%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 33115: (50%)&lt;BR/&gt; 1027: (25.7732%)&lt;BR/&gt; 1026: (24.2268%)&gt;];
}
4020--5515[label="1;97pkt 97fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="211.205.76.129" src_port="33115"/>
      <filter dst_port="1026" src_ip="211.205.76.129" src_port="33115"/>
    </slice>
    <from sec="1123478006" usec="0"/>
    <to sec="1123478007" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="70.201.214.130"/>
    </slice>
    <from sec="1123477298" usec="0"/>
    <to sec="1123477358" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="211.226.63.131"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_767{
style=filled;
color=gray75;
4034[label="200.47.65.131;21pkt 21fpkt", shape=pentagon, color=darkviolet];
5521[label="200.47.65.131;21pkt 21fpkt", shape=invtriangle, color=brown];
stat767[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.47.65.131:80, 200.89.24.144:*}[57.1429%]&lt;BR/&gt;{200.47.65.131:80, 200.89.24.145:*}[42.8571%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3202: (2.38095%)&lt;BR/&gt; 3201: (2.38095%)&lt;BR/&gt; 3049: (2.38095%)&lt;BR/&gt; 3026: (2.38095%)&gt;];
}
4034--5521[label="1;21pkt 21fpkt"];
</description>
    <slice>
      <filter dst_ip="200.89.24.144" src_ip="200.47.65.131" src_port="80"/>
      <filter dst_ip="200.89.24.145" src_ip="200.47.65.131" src_port="80"/>
    </slice>
    <from sec="1123478035" usec="0"/>
    <to sec="1123478095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_768{
style=filled;
color=gray75;
4038[label="211.165.132.131;69pkt 69fpkt", shape=pentagon, color=darkviolet];
5523[label="211.165.132.131;69pkt 69fpkt", shape=invtriangle, color=brown];
stat768[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.165.132.131:*, 158.18.212.135:9100}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9100: (50%)&lt;BR/&gt; 1814: (0.724638%)&lt;BR/&gt; 1813: (0.724638%)&lt;BR/&gt; 1812: (0.724638%)&lt;BR/&gt; 1808: (0.724638%)&gt;];
}
4038--5523[label="1;69pkt 69fpkt"];
</description>
    <slice>
      <filter dst_ip="158.18.212.135" dst_port="9100" src_ip="211.165.132.131"/>
    </slice>
    <from sec="1123477206" usec="0"/>
    <to sec="1123478094" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_769{
style=filled;
color=gray75;
4041[label="200.85.10.132;60pkt 60fpkt", shape=pentagon, color=darkviolet];
5525[label="200.85.10.132;60pkt 60fpkt", shape=invtriangle, color=brown];
6359[label="200.85.10.132;60pkt 60fpkt", shape=invhouse, color=bisque];
stat769[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.85.10.132:*, 192.168.0.1:75}[98.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 75: (49.1667%)&lt;BR/&gt; 4512: (0.833333%)&lt;BR/&gt; 4511: (0.833333%)&lt;BR/&gt; 4510: (0.833333%)&lt;BR/&gt; 4509: (0.833333%)&gt;];
}
4041--5525[label="1;60pkt 60fpkt"];
4041--6359[label="1;60pkt 60fpkt"];
5525--6359[label="1;60pkt 60fpkt"];
</description>
    <slice>
      <filter dst_ip="192.168.0.1" dst_port="75" src_ip="200.85.10.132"/>
    </slice>
    <from sec="1123477208" usec="0"/>
    <to sec="1123478096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="205.45.85.132"/>
    </slice>
    <from sec="1123477223" usec="0"/>
    <to sec="1123478093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_771{
style=filled;
color=gray75;
2050[label="132.117.153.129;d;187pkt 187fpkt", shape=diamond, color=yellow];
3439[label="71.110.12.60;3pkt 3fpkt", shape=pentagon, color=darkviolet];
4045[label="211.160.91.132;13pkt 13fpkt", shape=pentagon, color=darkviolet];
5187[label="71.110.12.60;3pkt 3fpkt", shape=invtriangle, color=brown];
5527[label="211.160.91.132;13pkt 13fpkt", shape=invtriangle, color=brown];
6161[label="71.110.12.60;3pkt 3fpkt", shape=invhouse, color=bisque];
stat771[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.208.28.100:80, 132.117.153.129:*}[37.4332%]&lt;BR/&gt;{71.110.12.178:80, 132.117.153.129:*}[25.6684%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.5495%)&lt;BR/&gt; 1672: (0.900901%)&lt;BR/&gt; 1630: (0.900901%)&lt;BR/&gt; 1629: (0.900901%)&lt;BR/&gt; 1620: (0.675676%)&gt;];
}
2050--3439[label="1;3pkt 3fpkt"];
2050--3693[label="0.00534759;1pkt 1fpkt"];
2050--4045[label="1;13pkt 13fpkt"];
2050--5187[label="1;3pkt 3fpkt"];
2050--5527[label="1;13pkt 13fpkt"];
2050--6161[label="1;3pkt 3fpkt"];
3439--5187[label="1;3pkt 3fpkt"];
3439--6161[label="1;3pkt 3fpkt"];
4045--5527[label="1;13pkt 13fpkt"];
5187--6161[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="132.117.153.129" src_ip="215.208.28.100" src_port="80"/>
      <filter dst_ip="132.117.153.129" src_ip="71.110.12.178" src_port="80"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478017" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_773{
style=filled;
color=gray75;
4053[label="205.45.85.133;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5534[label="205.45.85.133;1pkt 1fpkt", shape=invtriangle, color=brown];
stat773[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.45.85.133:1863, 169.169.246.139:1303}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1863: (50%)&lt;BR/&gt; 1303: (50%)&gt;];
}
4053--5534[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="169.169.246.139" dst_port="1303" src_ip="205.45.85.133" src_port="1863"/>
    </slice>
    <from sec="1123477546" usec="0"/>
    <to sec="1123478094" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="158.189.179.133"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123477642" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_775{
style=filled;
color=gray75;
4058[label="172.118.193.133;4pkt 4fpkt", shape=pentagon, color=darkviolet];
5537[label="172.118.193.133;4pkt 4fpkt", shape=invtriangle, color=brown];
stat775[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.118.193.133:2981, 4.170.85.33:80}[25%]&lt;BR/&gt;{172.118.193.133:2982, 4.170.85.33:80}[25%]&lt;BR/&gt;{172.118.193.133:2983, 4.170.85.33:80}[25%]&lt;BR/&gt;{172.118.193.133:2984, 4.170.85.33:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2984: (12.5%)&lt;BR/&gt; 2983: (12.5%)&lt;BR/&gt; 2982: (12.5%)&lt;BR/&gt; 2981: (12.5%)&gt;];
}
4058--5537[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="4.170.85.33" dst_port="80" src_ip="172.118.193.133" src_port="2984"/>
      <filter dst_ip="4.170.85.33" dst_port="80" src_ip="172.118.193.133" src_port="2983"/>
      <filter dst_ip="4.170.85.33" dst_port="80" src_ip="172.118.193.133" src_port="2982"/>
      <filter dst_ip="4.170.85.33" dst_port="80" src_ip="172.118.193.133" src_port="2981"/>
    </slice>
    <from sec="1123477661" usec="0"/>
    <to sec="1123477713" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="8.232.133.134"/>
    </slice>
    <from sec="1123477206" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_777{
style=filled;
color=gray75;
4067[label="158.189.151.134;19pkt 19fpkt", shape=pentagon, color=darkviolet];
5542[label="158.189.151.134;19pkt 19fpkt", shape=invtriangle, color=brown];
6367[label="158.189.151.134;19pkt 19fpkt", shape=invhouse, color=bisque];
stat777[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.189.151.134:*, 210.173.72.37:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2094: (2.63158%)&lt;BR/&gt; 2093: (2.63158%)&lt;BR/&gt; 2092: (2.63158%)&lt;BR/&gt; 2091: (2.63158%)&gt;];
}
4067--5542[label="1;19pkt 19fpkt"];
4067--6367[label="1;19pkt 19fpkt"];
5542--6367[label="1;19pkt 19fpkt"];
</description>
    <slice>
      <filter dst_ip="210.173.72.37" dst_port="80" src_ip="158.189.151.134"/>
    </slice>
    <from sec="1123477233" usec="0"/>
    <to sec="1123478096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_778{
style=filled;
color=gray75;
4072[label="200.137.135.135;4pkt 4fpkt", shape=pentagon, color=darkviolet];
5544[label="200.137.135.135;4pkt 4fpkt", shape=invtriangle, color=brown];
6368[label="200.137.135.135;4pkt 4fpkt", shape=invhouse, color=bisque];
stat778[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.137.135.135:3862, 175.182.160.2:1434}[25%]&lt;BR/&gt;{200.137.135.135:3862, 201.117.143.58:1434}[25%]&lt;BR/&gt;{200.137.135.135:3862, 132.2.225.108:1434}[25%]&lt;BR/&gt;{200.137.135.135:3862, 158.18.125.238:1434}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3862: (50%)&lt;BR/&gt; 1434: (50%)&gt;];
}
4072--5544[label="1;4pkt 4fpkt"];
4072--6368[label="1;4pkt 4fpkt"];
5544--6368[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="158.18.125.238" dst_port="1434" src_ip="200.137.135.135" src_port="3862"/>
      <filter dst_ip="132.2.225.108" dst_port="1434" src_ip="200.137.135.135" src_port="3862"/>
      <filter dst_ip="201.117.143.58" dst_port="1434" src_ip="200.137.135.135" src_port="3862"/>
      <filter dst_ip="175.182.160.2" dst_port="1434" src_ip="200.137.135.135" src_port="3862"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="98.138.11.137"/>
    </slice>
    <from sec="1123477304" usec="0"/>
    <to sec="1123478008" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_780{
style=filled;
color=gray75;
4090[label="152.20.66.137;60pkt 60fpkt", shape=pentagon, color=darkviolet];
5551[label="152.20.66.137;60pkt 60fpkt", shape=invtriangle, color=brown];
6371[label="152.20.66.137;60pkt 60fpkt", shape=invhouse, color=bisque];
stat780[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.20.66.137:*, 193.56.104.146:80}[30%]&lt;BR/&gt;{152.20.66.137:*, *:53}[30%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (15.8333%)&lt;BR/&gt; 53: (15%)&lt;BR/&gt; 1245: (1.66667%)&lt;BR/&gt; 62426: (0.833333%)&lt;BR/&gt; 59058: (0.833333%)&gt;];
}
4090--5551[label="1;60pkt 60fpkt"];
4090--6371[label="1;60pkt 60fpkt"];
5551--6371[label="1;60pkt 60fpkt"];
</description>
    <slice>
      <filter dst_port="53" src_ip="152.20.66.137"/>
      <filter dst_ip="193.56.104.146" dst_port="80" src_ip="152.20.66.137"/>
    </slice>
    <from sec="1123477444" usec="0"/>
    <to sec="1123478014" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_781{
style=filled;
color=gray75;
4096[label="208.75.180.137;11pkt 11fpkt", shape=pentagon, color=darkviolet];
5556[label="208.75.180.137;11pkt 11fpkt", shape=invtriangle, color=brown];
stat781[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.75.180.137:443, 172.118.133.0:*}[72.7273%]&lt;BR/&gt;{208.75.180.137:80, 172.118.133.0:*}[27.2727%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (36.3636%)&lt;BR/&gt; 80: (13.6364%)&lt;BR/&gt; 4464: (4.54545%)&lt;BR/&gt; 4463: (4.54545%)&lt;BR/&gt; 4462: (4.54545%)&gt;];
}
4096--5556[label="1;11pkt 11fpkt"];
</description>
    <slice>
      <filter dst_ip="172.118.133.0" src_ip="208.75.180.137" src_port="443"/>
      <filter dst_ip="172.118.133.0" src_ip="208.75.180.137" src_port="80"/>
    </slice>
    <from sec="1123477832" usec="0"/>
    <to sec="1123477881" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="70.78.108.138"/>
    </slice>
    <from sec="1123477607" usec="0"/>
    <to sec="1123478087" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="207.90.130.140"/>
    </slice>
    <from sec="1123477574" usec="0"/>
    <to sec="1123477764" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="218.245.195.141"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_786{
style=filled;
color=gray75;
4136[label="158.160.123.142;61pkt 61fpkt", shape=pentagon, color=darkviolet];
5577[label="158.160.123.142;61pkt 61fpkt", shape=invtriangle, color=brown];
stat786[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.160.123.142:60563, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 60563: (50%)&lt;BR/&gt; 64478: (0.819672%)&lt;BR/&gt; 62560: (0.819672%)&lt;BR/&gt; 61930: (0.819672%)&lt;BR/&gt; 56864: (0.819672%)&gt;];
}
4136--5577[label="1;61pkt 61fpkt"];
</description>
    <slice>
      <filter src_ip="158.160.123.142" src_port="60563"/>
    </slice>
    <from sec="1123477248" usec="0"/>
    <to sec="1123478096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_787{
style=filled;
color=gray75;
4140[label="0.49.176.142;10pkt 10fpkt", shape=pentagon, color=darkviolet];
5578[label="0.49.176.142;10pkt 10fpkt", shape=invtriangle, color=brown];
6380[label="0.49.176.142;10pkt 10fpkt", shape=invhouse, color=bisque];
stat787[shape=component, label=&lt;Rules:&lt;BR/&gt;{0.49.176.142:80, 158.47.90.134:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1413: (5%)&lt;BR/&gt; 1412: (5%)&lt;BR/&gt; 1411: (5%)&lt;BR/&gt; 1410: (5%)&gt;];
}
4140--5578[label="1;10pkt 10fpkt"];
4140--6380[label="1;10pkt 10fpkt"];
5578--6380[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter dst_ip="158.47.90.134" src_ip="0.49.176.142" src_port="80"/>
    </slice>
    <from sec="1123477934" usec="0"/>
    <to sec="1123477988" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_788{
style=filled;
color=gray75;
4147[label="172.118.195.143;4pkt 4fpkt", shape=pentagon, color=darkviolet];
5581[label="172.118.195.143;4pkt 4fpkt", shape=invtriangle, color=brown];
6383[label="172.118.195.143;4pkt 4fpkt", shape=invhouse, color=bisque];
stat788[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.118.195.143:3988, 197.170.59.247:80}[25%]&lt;BR/&gt;{172.118.195.143:3989, 197.170.59.247:80}[25%]&lt;BR/&gt;{172.118.195.143:3990, 197.170.59.247:80}[25%]&lt;BR/&gt;{172.118.195.143:3991, 197.170.59.247:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3991: (12.5%)&lt;BR/&gt; 3990: (12.5%)&lt;BR/&gt; 3989: (12.5%)&lt;BR/&gt; 3988: (12.5%)&gt;];
}
4147--5581[label="1;4pkt 4fpkt"];
4147--6383[label="1;4pkt 4fpkt"];
5581--6383[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="197.170.59.247" dst_port="80" src_ip="172.118.195.143" src_port="3991"/>
      <filter dst_ip="197.170.59.247" dst_port="80" src_ip="172.118.195.143" src_port="3990"/>
      <filter dst_ip="197.170.59.247" dst_port="80" src_ip="172.118.195.143" src_port="3989"/>
      <filter dst_ip="197.170.59.247" dst_port="80" src_ip="172.118.195.143" src_port="3988"/>
    </slice>
    <from sec="1123477218" usec="0"/>
    <to sec="1123477293" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_789{
style=filled;
color=gray75;
4152[label="212.105.193.144;36pkt 36fpkt", shape=pentagon, color=darkviolet];
5584[label="212.105.193.144;36pkt 36fpkt", shape=invtriangle, color=brown];
6385[label="212.105.193.144;36pkt 36fpkt", shape=invhouse, color=bisque];
stat789[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.105.193.144:*, 158.189.5.156:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 11881: (1.38889%)&lt;BR/&gt; 11880: (1.38889%)&lt;BR/&gt; 11879: (1.38889%)&lt;BR/&gt; 11878: (1.38889%)&gt;];
}
4152--5584[label="1;36pkt 36fpkt"];
4152--6385[label="1;36pkt 36fpkt"];
5584--6385[label="1;36pkt 36fpkt"];
</description>
    <slice>
      <filter dst_ip="158.189.5.156" dst_port="80" src_ip="212.105.193.144"/>
    </slice>
    <from sec="1123477376" usec="0"/>
    <to sec="1123478082" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="169.169.193.144"/>
    </slice>
    <from sec="1123477205" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,020,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_791{
style=filled;
color=gray75;
4153[label="132.2.224.144;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5586[label="132.2.224.144;2pkt 2fpkt", shape=invtriangle, color=brown];
6387[label="132.2.224.144;2pkt 2fpkt", shape=invhouse, color=bisque];
stat791[shape=component, label=&lt;Rules:&lt;BR/&gt;{132.2.224.144:0, 208.181.117.42:0}[50%]&lt;BR/&gt;{132.2.224.144:0, 206.94.198.64:0}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
4153--5586[label="1;2pkt 2fpkt"];
4153--6387[label="1;2pkt 2fpkt"];
5586--6387[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="206.94.198.64" src_ip="132.2.224.144"/>
      <filter dst_ip="208.181.117.42" src_ip="132.2.224.144"/>
    </slice>
    <from sec="1123477262" usec="0"/>
    <to sec="1123478067" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="19.153.218.145"/>
    </slice>
    <from sec="1123477281" usec="0"/>
    <to sec="1123478050" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_793{
style=filled;
color=gray75;
4169[label="152.21.68.146;27pkt 27fpkt", shape=pentagon, color=darkviolet];
5594[label="152.21.68.146;27pkt 27fpkt", shape=invtriangle, color=brown];
stat793[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.68.146:*, *:25}[51.8519%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (33.3333%)&lt;BR/&gt; 53: (16.6667%)&lt;BR/&gt; 2476: (9.25926%)&lt;BR/&gt; 54322: (1.85185%)&lt;BR/&gt; 49256: (1.85185%)&gt;];
}
4169--5594[label="1;27pkt 27fpkt"];
</description>
    <slice>
      <filter dst_port="25" src_ip="152.21.68.146"/>
    </slice>
    <from sec="1123477338" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="64.55.165.146"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_795{
style=filled;
color=gray75;
4174[label="200.89.27.147;98pkt 98fpkt", shape=pentagon, color=darkviolet];
5598[label="200.89.27.147;98pkt 98fpkt", shape=invtriangle, color=brown];
stat795[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.89.27.147:*, *:80}[40.8163%]&lt;BR/&gt;{200.89.27.147:*, *:2710}[26.5306%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (20.4082%)&lt;BR/&gt; 2710: (13.2653%)&lt;BR/&gt; 0: (12.2449%)&lt;BR/&gt; 6969: (6.63265%)&lt;BR/&gt; 8085: (2.55102%)&gt;];
}
4174--5598[label="1;98pkt 98fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="200.89.27.147"/>
      <filter dst_port="2710" src_ip="200.89.27.147"/>
    </slice>
    <from sec="1123477205" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="5.170.142.148"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_797{
style=filled;
color=gray75;
4185[label="158.47.88.149;13pkt 13fpkt", shape=pentagon, color=darkviolet];
5605[label="158.47.88.149;13pkt 13fpkt", shape=invtriangle, color=brown];
6394[label="158.47.88.149;13pkt 13fpkt", shape=invhouse, color=bisque];
stat797[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.47.88.149:*, 4.150.128.143:80}[23.0769%]&lt;BR/&gt;{158.47.88.149:*, 4.161.166.174:80}[23.0769%]&lt;BR/&gt;{158.47.88.149:*, 4.176.47.205:80}[23.0769%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1458: (3.84615%)&lt;BR/&gt; 1457: (3.84615%)&lt;BR/&gt; 1454: (3.84615%)&lt;BR/&gt; 1453: (3.84615%)&gt;];
}
4185--5605[label="1;13pkt 13fpkt"];
4185--6394[label="1;13pkt 13fpkt"];
5605--6394[label="1;13pkt 13fpkt"];
</description>
    <slice>
      <filter dst_ip="4.176.47.205" dst_port="80" src_ip="158.47.88.149"/>
      <filter dst_ip="4.161.166.174" dst_port="80" src_ip="158.47.88.149"/>
      <filter dst_ip="4.150.128.143" dst_port="80" src_ip="158.47.88.149"/>
    </slice>
    <from sec="1123477216" usec="0"/>
    <to sec="1123477299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_798{
style=filled;
color=gray75;
4191[label="152.21.180.149;24pkt 24fpkt", shape=pentagon, color=darkviolet];
5610[label="152.21.180.149;24pkt 24fpkt", shape=invtriangle, color=brown];
stat798[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.180.149:*, 210.173.72.43:80}[41.6667%]&lt;BR/&gt;{152.21.180.149:*, 4.82.12.0:80}[20.8333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 31372: (2.08333%)&lt;BR/&gt; 31371: (2.08333%)&lt;BR/&gt; 31357: (2.08333%)&lt;BR/&gt; 31120: (2.08333%)&gt;];
}
4191--5610[label="1;24pkt 24fpkt"];
</description>
    <slice>
      <filter dst_ip="210.173.72.43" dst_port="80" src_ip="152.21.180.149"/>
      <filter dst_ip="4.82.12.0" dst_port="80" src_ip="152.21.180.149"/>
    </slice>
    <from sec="1123477361" usec="0"/>
    <to sec="1123478086" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_799{
style=filled;
color=gray75;
4205[label="169.169.205.152;24pkt 24fpkt", shape=pentagon, color=darkviolet];
5613[label="169.169.205.152;24pkt 24fpkt", shape=invtriangle, color=brown];
stat799[shape=component, label=&lt;Rules:&lt;BR/&gt;{169.169.205.152:80, 7.36.240.164:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 65052: (2.08333%)&lt;BR/&gt; 65051: (2.08333%)&lt;BR/&gt; 65050: (2.08333%)&lt;BR/&gt; 65049: (2.08333%)&gt;];
}
4205--5613[label="1;24pkt 24fpkt"];
</description>
    <slice>
      <filter dst_ip="7.36.240.164" src_ip="169.169.205.152" src_port="80"/>
    </slice>
    <from sec="1123477994" usec="0"/>
    <to sec="1123478018" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_800{
style=filled;
color=gray75;
4213[label="4.42.32.154;8pkt 8fpkt", shape=pentagon, color=darkviolet];
5617[label="4.42.32.154;8pkt 8fpkt", shape=invtriangle, color=brown];
6400[label="4.42.32.154;8pkt 8fpkt", shape=invhouse, color=bisque];
stat800[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.42.32.154:995, 132.117.181.128:*}[75%]&lt;BR/&gt;{4.42.32.154:995, 132.117.65.4:*}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 995: (50%)&lt;BR/&gt; 48347: (6.25%)&lt;BR/&gt; 48346: (6.25%)&lt;BR/&gt; 4140: (6.25%)&lt;BR/&gt; 4139: (6.25%)&gt;];
}
4213--5617[label="1;8pkt 8fpkt"];
4213--6400[label="1;8pkt 8fpkt"];
5617--6400[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="132.117.181.128" src_ip="4.42.32.154" src_port="995"/>
      <filter dst_ip="132.117.65.4" src_ip="4.42.32.154" src_port="995"/>
    </slice>
    <from sec="1123477329" usec="0"/>
    <to sec="1123477701" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,504,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="212.108.60.154"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,020,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="201.117.148.157"/>
    </slice>
    <from sec="1123477224" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_803{
style=filled;
color=gray75;
4238[label="158.47.81.158;11pkt 11fpkt", shape=pentagon, color=darkviolet];
5632[label="158.47.81.158;11pkt 11fpkt", shape=invtriangle, color=brown];
6408[label="158.47.81.158;11pkt 11fpkt", shape=invhouse, color=bisque];
stat803[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.47.81.158:*, 194.70.219.25:80}[63.6364%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3632: (4.54545%)&lt;BR/&gt; 3631: (4.54545%)&lt;BR/&gt; 3630: (4.54545%)&lt;BR/&gt; 3629: (4.54545%)&gt;];
}
4238--5632[label="1;11pkt 11fpkt"];
4238--6408[label="1;11pkt 11fpkt"];
5632--6408[label="1;11pkt 11fpkt"];
</description>
    <slice>
      <filter dst_ip="194.70.219.25" dst_port="80" src_ip="158.47.81.158"/>
    </slice>
    <from sec="1123477804" usec="0"/>
    <to sec="1123477833" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_804{
style=filled;
color=gray75;
4239[label="219.213.107.158;19pkt 19fpkt", shape=pentagon, color=darkviolet];
5633[label="219.213.107.158;19pkt 19fpkt", shape=invtriangle, color=brown];
stat804[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.213.107.158:80, 158.47.71.22:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3514: (2.63158%)&lt;BR/&gt; 3513: (2.63158%)&lt;BR/&gt; 3510: (2.63158%)&lt;BR/&gt; 3489: (2.63158%)&gt;];
}
4239--5633[label="1;19pkt 19fpkt"];
</description>
    <slice>
      <filter dst_ip="158.47.71.22" src_ip="219.213.107.158" src_port="80"/>
    </slice>
    <from sec="1123477229" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="98.9.213.158"/>
    </slice>
    <from sec="1123477976" usec="0"/>
    <to sec="1123478012" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="169.169.230.158"/>
    </slice>
    <from sec="1123477216" usec="0"/>
    <to sec="1123478095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,504,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_807{
style=filled;
color=gray75;
4245[label="205.45.205.159;13pkt 13fpkt", shape=pentagon, color=darkviolet];
5638[label="205.45.205.159;13pkt 13fpkt", shape=invtriangle, color=brown];
stat807[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.45.205.159:443, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (50%)&lt;BR/&gt; 4671: (3.84615%)&lt;BR/&gt; 3811: (3.84615%)&lt;BR/&gt; 3097: (3.84615%)&lt;BR/&gt; 1957: (3.84615%)&gt;];
}
4245--5638[label="1;13pkt 13fpkt"];
</description>
    <slice>
      <filter src_ip="205.45.205.159" src_port="443"/>
    </slice>
    <from sec="1123477215" usec="0"/>
    <to sec="1123477978" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_808{
style=filled;
color=gray75;
4246[label="200.85.0.160;26pkt 26fpkt", shape=pentagon, color=darkviolet];
5639[label="200.85.0.160;26pkt 26fpkt", shape=invtriangle, color=brown];
6412[label="200.85.0.160;26pkt 26fpkt", shape=invhouse, color=bisque];
stat808[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.85.0.160:*, 6.136.227.216:80}[96.1538%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 34950: (1.92308%)&lt;BR/&gt; 34948: (1.92308%)&lt;BR/&gt; 34946: (1.92308%)&lt;BR/&gt; 34944: (1.92308%)&gt;];
}
4246--5639[label="1;26pkt 26fpkt"];
4246--6412[label="1;26pkt 26fpkt"];
5639--6412[label="1;26pkt 26fpkt"];
</description>
    <slice>
      <filter dst_ip="6.136.227.216" dst_port="80" src_ip="200.85.0.160"/>
    </slice>
    <from sec="1123477211" usec="0"/>
    <to sec="1123477673" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_809{
style=filled;
color=gray75;
4248[label="172.118.82.160;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5641[label="172.118.82.160;2pkt 2fpkt", shape=invtriangle, color=brown];
stat809[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.118.82.160:3324, 4.128.124.96:3544}[50%]&lt;BR/&gt;{172.118.82.160:0, 152.4.202.243:0}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (50%)&lt;BR/&gt; 3544: (25%)&lt;BR/&gt; 3324: (25%)&gt;];
}
4248--5641[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="152.4.202.243" src_ip="172.118.82.160"/>
      <filter dst_ip="4.128.124.96" dst_port="3544" src_ip="172.118.82.160" src_port="3324"/>
    </slice>
    <from sec="1123477209" usec="0"/>
    <to sec="1123478079" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_810{
style=filled;
color=gray75;
4252[label="169.169.206.160;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5645[label="169.169.206.160;2pkt 2fpkt", shape=invtriangle, color=brown];
stat810[shape=component, label=&lt;Rules:&lt;BR/&gt;{169.169.206.160:1476, 207.71.176.135:5190}[50%]&lt;BR/&gt;{169.169.206.160:1068, 207.71.69.207:5190}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5190: (50%)&lt;BR/&gt; 1476: (25%)&lt;BR/&gt; 1068: (25%)&gt;];
}
4252--5645[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="207.71.69.207" dst_port="5190" src_ip="169.169.206.160" src_port="1068"/>
      <filter dst_ip="207.71.176.135" dst_port="5190" src_ip="169.169.206.160" src_port="1476"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="211.202.121.161"/>
    </slice>
    <from sec="1123477223" usec="0"/>
    <to sec="1123478095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_812{
style=filled;
color=gray75;
4261[label="200.137.135.161;96pkt 96fpkt", shape=pentagon, color=darkviolet];
5651[label="200.137.135.161;96pkt 96fpkt", shape=invtriangle, color=brown];
stat812[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.137.135.161:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 65363: (0.520833%)&lt;BR/&gt; 64556: (0.520833%)&lt;BR/&gt; 64344: (0.520833%)&lt;BR/&gt; 64309: (0.520833%)&gt;];
}
4261--5651[label="1;96pkt 96fpkt"];
</description>
    <slice>
      <filter src_ip="200.137.135.161" src_port="80"/>
    </slice>
    <from sec="1123477206" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_813{
style=filled;
color=gray75;
4265[label="152.21.163.161;4pkt 4fpkt", shape=pentagon, color=darkviolet];
5653[label="152.21.163.161;4pkt 4fpkt", shape=invtriangle, color=brown];
stat813[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.163.161:25, 0.174.90.148:2887}[25%]&lt;BR/&gt;{152.21.163.161:54847, 207.84.74.185:80}[25%]&lt;BR/&gt;{152.21.163.161:54852, 207.84.74.34:80}[25%]&lt;BR/&gt;{152.21.163.161:54853, 207.84.74.34:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (37.5%)&lt;BR/&gt; 54853: (12.5%)&lt;BR/&gt; 54852: (12.5%)&lt;BR/&gt; 54847: (12.5%)&lt;BR/&gt; 2887: (12.5%)&gt;];
}
4265--5653[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="207.84.74.34" dst_port="80" src_ip="152.21.163.161" src_port="54853"/>
      <filter dst_ip="207.84.74.34" dst_port="80" src_ip="152.21.163.161" src_port="54852"/>
      <filter dst_ip="207.84.74.185" dst_port="80" src_ip="152.21.163.161" src_port="54847"/>
      <filter dst_ip="0.174.90.148" dst_port="2887" src_ip="152.21.163.161" src_port="25"/>
    </slice>
    <from sec="1123477210" usec="0"/>
    <to sec="1123477407" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="0.106.6.162"/>
    </slice>
    <from sec="1123477230" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_815{
style=filled;
color=gray75;
4270[label="205.45.83.162;6pkt 6fpkt", shape=pentagon, color=darkviolet];
5656[label="205.45.83.162;6pkt 6fpkt", shape=invtriangle, color=brown];
6420[label="205.45.83.162;6pkt 6fpkt", shape=invhouse, color=bisque];
stat815[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.45.83.162:1863, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1863: (50%)&lt;BR/&gt; 4678: (8.33333%)&lt;BR/&gt; 3025: (8.33333%)&lt;BR/&gt; 2995: (8.33333%)&lt;BR/&gt; 2707: (8.33333%)&gt;];
}
4270--5656[label="1;6pkt 6fpkt"];
4270--6420[label="1;6pkt 6fpkt"];
5656--6420[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter src_ip="205.45.83.162" src_port="1863"/>
    </slice>
    <from sec="1123477205" usec="0"/>
    <to sec="1123477974" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_816{
style=filled;
color=gray75;
4273[label="172.118.110.162;8pkt 8fpkt", shape=pentagon, color=darkviolet];
5658[label="172.118.110.162;8pkt 8fpkt", shape=invtriangle, color=brown];
stat816[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.118.110.162:*, 217.116.85.151:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 34587: (6.25%)&lt;BR/&gt; 34586: (6.25%)&lt;BR/&gt; 34585: (6.25%)&lt;BR/&gt; 34584: (6.25%)&gt;];
}
4273--5658[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="217.116.85.151" dst_port="80" src_ip="172.118.110.162"/>
    </slice>
    <from sec="1123478040" usec="0"/>
    <to sec="1123478065" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_817{
style=filled;
color=gray75;
4274[label="210.101.128.162;171pkt 171fpkt", shape=pentagon, color=darkviolet];
5659[label="210.101.128.162;171pkt 171fpkt", shape=invtriangle, color=brown];
6421[label="210.101.128.162;151pkt 151fpkt", shape=invhouse, color=bisque];
stat817[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.101.128.162:21049, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21049: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
4274--5659[label="1;171pkt 171fpkt"];
4274--6421[label="1;151pkt 151fpkt"];
5659--6421[label="1;151pkt 151fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="210.101.128.162" src_port="21049"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123477220" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_818{
style=filled;
color=gray75;
4282[label="71.5.34.163;6pkt 6fpkt", shape=pentagon, color=darkviolet];
5664[label="71.5.34.163;6pkt 6fpkt", shape=invtriangle, color=brown];
6425[label="71.5.34.163;6pkt 6fpkt", shape=invhouse, color=bisque];
stat818[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.5.34.163:*, 132.117.153.41:14428}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 14428: (50%)&lt;BR/&gt; 64549: (8.33333%)&lt;BR/&gt; 64207: (8.33333%)&lt;BR/&gt; 64007: (8.33333%)&lt;BR/&gt; 63981: (8.33333%)&gt;];
}
4282--5664[label="1;6pkt 6fpkt"];
4282--6425[label="1;6pkt 6fpkt"];
5664--6425[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="132.117.153.41" dst_port="14428" src_ip="71.5.34.163"/>
    </slice>
    <from sec="1123477689" usec="0"/>
    <to sec="1123478089" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_819{
style=filled;
color=gray75;
4289[label="152.20.205.163;6pkt 6fpkt", shape=pentagon, color=darkviolet];
5667[label="152.20.205.163;6pkt 6fpkt", shape=invtriangle, color=brown];
6427[label="152.20.205.163;6pkt 6fpkt", shape=invhouse, color=bisque];
stat819[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.20.205.163:*, 205.45.224.72:80}[50%]&lt;BR/&gt;{152.20.205.163:*, *:28805}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 28805: (25%)&lt;BR/&gt; 80: (25%)&lt;BR/&gt; 32929: (8.33333%)&lt;BR/&gt; 32928: (8.33333%)&lt;BR/&gt; 32926: (8.33333%)&gt;];
}
4289--5667[label="1;6pkt 6fpkt"];
4289--6427[label="1;6pkt 6fpkt"];
5667--6427[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_port="28805" src_ip="152.20.205.163"/>
      <filter dst_ip="205.45.224.72" dst_port="80" src_ip="152.20.205.163"/>
    </slice>
    <from sec="1123477651" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="1.56.20.165"/>
    </slice>
    <from sec="1123477211" usec="0"/>
    <to sec="1123478086" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="6.156.159.165"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,020,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="152.21.71.166"/>
    </slice>
    <from sec="1123477220" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_824{
style=filled;
color=gray75;
4310[label="215.34.77.166;10pkt 10fpkt", shape=pentagon, color=darkviolet];
5677[label="215.34.77.166;10pkt 10fpkt", shape=invtriangle, color=brown];
stat824[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.34.77.166:80, 152.21.110.134:*}[90%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 49427: (5%)&lt;BR/&gt; 4913: (5%)&lt;BR/&gt; 4909: (5%)&lt;BR/&gt; 4908: (5%)&gt;];
}
4310--5677[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter dst_ip="152.21.110.134" src_ip="215.34.77.166" src_port="80"/>
    </slice>
    <from sec="1123477368" usec="0"/>
    <to sec="1123477841" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_825{
style=filled;
color=gray75;
4317[label="152.21.207.167;21pkt 21fpkt", shape=pentagon, color=darkviolet];
5682[label="152.21.207.167;21pkt 21fpkt", shape=invtriangle, color=brown];
stat825[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.207.167:*, 205.45.237.191:80}[52.381%]&lt;BR/&gt;{152.21.207.167:*, 205.45.206.144:80}[42.8571%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2990: (2.38095%)&lt;BR/&gt; 2989: (2.38095%)&lt;BR/&gt; 2987: (2.38095%)&lt;BR/&gt; 2986: (2.38095%)&gt;];
}
4317--5682[label="1;21pkt 21fpkt"];
</description>
    <slice>
      <filter dst_ip="205.45.237.191" dst_port="80" src_ip="152.21.207.167"/>
      <filter dst_ip="205.45.206.144" dst_port="80" src_ip="152.21.207.167"/>
    </slice>
    <from sec="1123477271" usec="0"/>
    <to sec="1123477945" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_827{
style=filled;
color=gray75;
4332[label="172.118.96.169;13pkt 13fpkt", shape=pentagon, color=darkviolet];
5689[label="172.118.96.169;13pkt 13fpkt", shape=invtriangle, color=brown];
stat827[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.118.96.169:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 60360: (3.84615%)&lt;BR/&gt; 56489: (3.84615%)&lt;BR/&gt; 54175: (3.84615%)&lt;BR/&gt; 53116: (3.84615%)&gt;];
}
4332--5689[label="1;13pkt 13fpkt"];
</description>
    <slice>
      <filter src_ip="172.118.96.169" src_port="80"/>
    </slice>
    <from sec="1123477610" usec="0"/>
    <to sec="1123478017" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_828{
style=filled;
color=gray75;
4351[label="152.20.33.172;36pkt 36fpkt", shape=pentagon, color=darkviolet];
5696[label="152.20.33.172;36pkt 36fpkt", shape=invtriangle, color=brown];
6438[label="152.20.33.172;36pkt 36fpkt", shape=invhouse, color=bisque];
stat828[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.20.33.172:*, 192.152.142.216:80}[72.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1144: (1.38889%)&lt;BR/&gt; 1143: (1.38889%)&lt;BR/&gt; 1142: (1.38889%)&lt;BR/&gt; 1141: (1.38889%)&gt;];
}
4351--5696[label="1;36pkt 36fpkt"];
4351--6438[label="1;36pkt 36fpkt"];
5696--6438[label="1;36pkt 36fpkt"];
</description>
    <slice>
      <filter dst_ip="192.152.142.216" dst_port="80" src_ip="152.20.33.172"/>
    </slice>
    <from sec="1123477964" usec="0"/>
    <to sec="1123478046" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="170.67.124.173"/>
    </slice>
    <from sec="1123477501" usec="0"/>
    <to sec="1123477773" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,011,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_830{
style=filled;
color=gray75;
4367[label="158.160.130.173;51pkt 51fpkt", shape=pentagon, color=darkviolet];
5704[label="158.160.130.173;51pkt 51fpkt", shape=invtriangle, color=brown];
stat830[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.160.130.173:8000, 71.100.121.190:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8000: (50%)&lt;BR/&gt; 2964: (0.980392%)&lt;BR/&gt; 2951: (0.980392%)&lt;BR/&gt; 2912: (0.980392%)&lt;BR/&gt; 2895: (0.980392%)&gt;];
}
4367--5704[label="1;51pkt 51fpkt"];
</description>
    <slice>
      <filter dst_ip="71.100.121.190" src_ip="158.160.130.173" src_port="8000"/>
    </slice>
    <from sec="1123477222" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_831{
style=filled;
color=gray75;
4369[label="172.118.228.173;7pkt 7fpkt", shape=pentagon, color=darkviolet];
5705[label="172.118.228.173;7pkt 7fpkt", shape=invtriangle, color=brown];
stat831[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.118.228.173:*, 207.71.32.43:80}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (42.8571%)&lt;BR/&gt; 5050: (7.14286%)&lt;BR/&gt; 3531: (7.14286%)&lt;BR/&gt; 3530: (7.14286%)&lt;BR/&gt; 3525: (7.14286%)&gt;];
}
4369--5705[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="207.71.32.43" dst_port="80" src_ip="172.118.228.173"/>
    </slice>
    <from sec="1123477251" usec="0"/>
    <to sec="1123478092" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_832{
style=filled;
color=gray75;
4371[label="210.103.10.174;105pkt 105fpkt", shape=pentagon, color=darkviolet];
5707[label="210.103.10.174;105pkt 105fpkt", shape=invtriangle, color=brown];
stat832[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.103.10.174:7000, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7000: (50%)&lt;BR/&gt; 65398: (0.47619%)&lt;BR/&gt; 65138: (0.47619%)&lt;BR/&gt; 64863: (0.47619%)&lt;BR/&gt; 64533: (0.47619%)&gt;];
}
4371--5707[label="1;105pkt 105fpkt"];
</description>
    <slice>
      <filter src_ip="210.103.10.174" src_port="7000"/>
    </slice>
    <from sec="1123477208" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_833{
style=filled;
color=gray75;
4377[label="218.215.65.175;3pkt 3fpkt", shape=pentagon, color=darkviolet];
5711[label="218.215.65.175;3pkt 3fpkt", shape=invtriangle, color=brown];
stat833[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.215.65.175:53, 152.21.168.100:1647}[33.3333%]&lt;BR/&gt;{218.215.65.175:80, 152.21.170.133:1173}[33.3333%]&lt;BR/&gt;{218.215.65.175:80, 152.21.170.133:1174}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (33.3333%)&lt;BR/&gt; 1647: (16.6667%)&lt;BR/&gt; 1174: (16.6667%)&lt;BR/&gt; 1173: (16.6667%)&lt;BR/&gt; 53: (16.6667%)&gt;];
}
4377--5711[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="152.21.170.133" dst_port="1174" src_ip="218.215.65.175" src_port="80"/>
      <filter dst_ip="152.21.170.133" dst_port="1173" src_ip="218.215.65.175" src_port="80"/>
      <filter dst_ip="152.21.168.100" dst_port="1647" src_ip="218.215.65.175" src_port="53"/>
    </slice>
    <from sec="1123477624" usec="0"/>
    <to sec="1123477668" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_834{
style=filled;
color=gray75;
4379[label="158.189.80.175;58pkt 58fpkt", shape=pentagon, color=darkviolet];
5712[label="158.189.80.175;58pkt 58fpkt", shape=invtriangle, color=brown];
stat834[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.189.80.175:*, 204.23.6.84:80}[68.9655%]&lt;BR/&gt;{158.189.80.175:*, 159.102.197.232:80}[31.0345%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2427: (0.862069%)&lt;BR/&gt; 2426: (0.862069%)&lt;BR/&gt; 2425: (0.862069%)&lt;BR/&gt; 2424: (0.862069%)&gt;];
}
4379--5712[label="1;58pkt 58fpkt"];
</description>
    <slice>
      <filter dst_ip="204.23.6.84" dst_port="80" src_ip="158.189.80.175"/>
      <filter dst_ip="159.102.197.232" dst_port="80" src_ip="158.189.80.175"/>
    </slice>
    <from sec="1123478019" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_835{
style=filled;
color=gray75;
4382[label="217.198.164.175;5pkt 5fpkt", shape=pentagon, color=darkviolet];
5714[label="217.198.164.175;5pkt 5fpkt", shape=invtriangle, color=brown];
stat835[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.198.164.175:80, 172.118.195.88:2700}[20%]&lt;BR/&gt;{217.198.164.175:80, 172.118.195.88:2701}[20%]&lt;BR/&gt;{217.198.164.175:80, 172.118.195.88:2702}[20%]&lt;BR/&gt;{217.198.164.175:80, 172.118.195.88:2715}[20%]&lt;BR/&gt;{217.198.164.175:80, 172.118.195.88:2716}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2716: (10%)&lt;BR/&gt; 2715: (10%)&lt;BR/&gt; 2702: (10%)&lt;BR/&gt; 2701: (10%)&gt;];
}
4382--5714[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="172.118.195.88" dst_port="2716" src_ip="217.198.164.175" src_port="80"/>
      <filter dst_ip="172.118.195.88" dst_port="2715" src_ip="217.198.164.175" src_port="80"/>
      <filter dst_ip="172.118.195.88" dst_port="2702" src_ip="217.198.164.175" src_port="80"/>
      <filter dst_ip="172.118.195.88" dst_port="2701" src_ip="217.198.164.175" src_port="80"/>
      <filter dst_ip="172.118.195.88" dst_port="2700" src_ip="217.198.164.175" src_port="80"/>
    </slice>
    <from sec="1123477633" usec="0"/>
    <to sec="1123477825" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="1.60.191.176"/>
    </slice>
    <from sec="1123477266" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_837{
style=filled;
color=gray75;
4394[label="152.21.75.177;7pkt 7fpkt", shape=pentagon, color=darkviolet];
5720[label="152.21.75.177;7pkt 7fpkt", shape=invtriangle, color=brown];
stat837[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.75.177:*, 136.91.32.220:80}[28.5714%]&lt;BR/&gt;{152.21.75.177:*, 6.24.29.253:80}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1378: (7.14286%)&lt;BR/&gt; 1377: (7.14286%)&lt;BR/&gt; 1375: (7.14286%)&lt;BR/&gt; 1373: (7.14286%)&gt;];
}
4394--5720[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="6.24.29.253" dst_port="80" src_ip="152.21.75.177"/>
      <filter dst_ip="136.91.32.220" dst_port="80" src_ip="152.21.75.177"/>
    </slice>
    <from sec="1123477946" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_839{
style=filled;
color=gray75;
2474[label="205.45.86.42;d;53pkt 53fpkt", shape=diamond, color=yellow];
3185[label="152.20.108.29;65pkt 65fpkt", shape=pentagon, color=darkviolet];
5049[label="152.20.108.29;64pkt 64fpkt", shape=invtriangle, color=brown];
6079[label="152.20.108.29;65pkt 65fpkt", shape=invhouse, color=bisque];
stat839[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.20.108.29:*, 205.45.86.42:80}[74.2857%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.3927%)&lt;BR/&gt; 0: (1.21457%)&lt;BR/&gt; 35811: (0.809717%)&lt;BR/&gt; 35810: (0.809717%)&lt;BR/&gt; 35809: (0.809717%)&gt;];
}
2474--2875[label="0.169811;9pkt 9fpkt"];
2474--2885[label="0.188679;10pkt 10fpkt"];
2474--2899[label="0.188679;10pkt 10fpkt"];
2474--2909[label="0.188679;10pkt 10fpkt"];
2474--3185[label="0.90566;48pkt 48fpkt"];
2474--3732[label="0.0188679;1pkt 1fpkt"];
2474--5049[label="0.886792;47pkt 47fpkt"];
2474--6079[label="0.90566;48pkt 48fpkt"];
2474--6261[label="0.0188679;1pkt 1fpkt"];
3185--5049[label="1;64pkt 64fpkt"];
3185--6079[label="1;65pkt 65fpkt"];
5049--6079[label="1;64pkt 64fpkt"];
</description>
    <slice>
      <filter dst_ip="205.45.86.42" dst_port="80" src_ip="152.20.108.29"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478096" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="169.169.203.178"/>
    </slice>
    <from sec="1123477212" usec="0"/>
    <to sec="1123478088" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="201.74.132.179"/>
    </slice>
    <from sec="1123477736" usec="0"/>
    <to sec="1123477872" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="17.147.148.179"/>
    </slice>
    <from sec="1123477265" usec="0"/>
    <to sec="1123477946" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_843{
style=filled;
color=gray75;
4422[label="152.21.9.181;55pkt 55fpkt", shape=pentagon, color=darkviolet];
5736[label="152.21.9.181;55pkt 55fpkt", shape=invtriangle, color=brown];
stat843[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.9.181:33180, *:*}[61.8182%]&lt;BR/&gt;{152.21.9.181:*, 208.141.50.5:80}[23.6364%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 33180: (30.9091%)&lt;BR/&gt; 80: (14.5455%)&lt;BR/&gt; 53906: (0.909091%)&lt;BR/&gt; 49869: (0.909091%)&lt;BR/&gt; 41842: (0.909091%)&gt;];
}
4422--5736[label="1;55pkt 55fpkt"];
</description>
    <slice>
      <filter src_ip="152.21.9.181" src_port="33180"/>
      <filter dst_ip="208.141.50.5" dst_port="80" src_ip="152.21.9.181"/>
    </slice>
    <from sec="1123477230" usec="0"/>
    <to sec="1123478095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="210.128.128.181"/>
    </slice>
    <from sec="1123477247" usec="0"/>
    <to sec="1123478097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,020,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_845{
style=filled;
color=gray75;
4425[label="201.117.144.181;18pkt 18fpkt", shape=pentagon, color=darkviolet];
5739[label="201.117.144.181;18pkt 18fpkt", shape=invtriangle, color=brown];
stat845[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.117.144.181:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
4425--5739[label="1;18pkt 18fpkt"];
</description>
    <slice>
      <filter src_ip="201.117.144.181"/>
    </slice>
    <from sec="1123477241" usec="0"/>
    <to sec="1123478092" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="211.225.93.182"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="169.169.205.183"/>
    </slice>
    <from sec="1123477245" usec="0"/>
    <to sec="1123478087" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_848{
style=filled;
color=gray75;
4444[label="152.21.170.184;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5749[label="152.21.170.184;1pkt 1fpkt", shape=invtriangle, color=brown];
6461[label="152.21.170.184;1pkt 1fpkt", shape=invhouse, color=bisque];
stat848[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.170.184:1638, 195.22.69.185:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1638: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
4444--5749[label="1;1pkt 1fpkt"];
4444--6461[label="1;1pkt 1fpkt"];
5749--6461[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="195.22.69.185" dst_port="80" src_ip="152.21.170.184" src_port="1638"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_849{
style=filled;
color=gray75;
4459[label="201.117.153.186;53pkt 53fpkt", shape=pentagon, color=darkviolet];
5758[label="201.117.153.186;53pkt 53fpkt", shape=invtriangle, color=brown];
6469[label="201.117.153.186;53pkt 53fpkt", shape=invhouse, color=bisque];
stat849[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.117.153.186:*, *:25}[33.9623%]&lt;BR/&gt;{201.117.153.186:25, *:*}[20.7547%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (27.3585%)&lt;BR/&gt; 53: (12.2642%)&lt;BR/&gt; 113: (10.3774%)&lt;BR/&gt; 65532: (2.83019%)&lt;BR/&gt; 65167: (0.943396%)&gt;];
}
4459--5758[label="1;53pkt 53fpkt"];
4459--6469[label="1;53pkt 53fpkt"];
5758--6469[label="1;53pkt 53fpkt"];
</description>
    <slice>
      <filter src_ip="201.117.153.186" src_port="25"/>
      <filter dst_port="25" src_ip="201.117.153.186"/>
    </slice>
    <from sec="1123477258" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_851{
style=filled;
color=gray75;
1779[label="201.117.159.58;d;30pkt 30fpkt", shape=diamond, color=yellow];
3724[label="211.176.139.90;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4198[label="71.84.42.152;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4464[label="218.49.146.187;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5761[label="218.49.146.187;2pkt 2fpkt", shape=invtriangle, color=brown];
6472[label="218.49.146.187;2pkt 2fpkt", shape=invhouse, color=bisque];
stat851[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 201.117.159.58:37602}[86.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 37602: (44.7368%)&lt;BR/&gt; 3667: (5.26316%)&lt;BR/&gt; 3106: (5.26316%)&lt;BR/&gt; 18914: (2.63158%)&lt;BR/&gt; 6491: (2.63158%)&gt;];
}
1779--3724[label="1;1pkt 1fpkt"];
1779--4198[label="1;1pkt 1fpkt"];
1779--4464[label="1;2pkt 2fpkt"];
1779--5761[label="1;2pkt 2fpkt"];
1779--6472[label="1;2pkt 2fpkt"];
4464--5761[label="1;2pkt 2fpkt"];
4464--6472[label="1;2pkt 2fpkt"];
5761--6472[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="201.117.159.58" dst_port="37602"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478091" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_853{
style=filled;
color=gray75;
4471[label="218.49.226.188;252pkt 252fpkt", shape=pentagon, color=darkviolet];
5764[label="218.49.226.188;252pkt 252fpkt", shape=invtriangle, color=brown];
stat853[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.49.226.188:1288, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1288: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
4471--5764[label="1;252pkt 252fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="218.49.226.188" src_port="1288"/>
    </slice>
    <from sec="1123477855" usec="0"/>
    <to sec="1123477897" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="21.216.194.191"/>
    </slice>
    <from sec="1123477492" usec="0"/>
    <to sec="1123477542" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_856{
style=filled;
color=gray75;
4493[label="71.109.247.191;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5771[label="71.109.247.191;2pkt 2fpkt", shape=invtriangle, color=brown];
6479[label="71.109.247.191;2pkt 2fpkt", shape=invhouse, color=bisque];
stat856[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.109.247.191:1779, 172.118.255.52:1434}[50%]&lt;BR/&gt;{71.109.247.191:1779, 158.160.18.204:1434}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1779: (50%)&lt;BR/&gt; 1434: (50%)&gt;];
}
4493--5771[label="1;2pkt 2fpkt"];
4493--6479[label="1;2pkt 2fpkt"];
5771--6479[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="158.160.18.204" dst_port="1434" src_ip="71.109.247.191" src_port="1779"/>
      <filter dst_ip="172.118.255.52" dst_port="1434" src_ip="71.109.247.191" src_port="1779"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_857{
style=filled;
color=gray75;
1269[label="19.70.35.234;d;205pkt 205fpkt", shape=diamond, color=yellow];
1394[label="152.21.110.198;s;28pkt 28fpkt", shape=diamond, color=yellow];
1473[label="212.129.54.55;d;2pkt 2fpkt", shape=diamond, color=yellow];
2154[label="212.129.59.69;d;1pkt 1fpkt", shape=diamond, color=yellow];
2242[label="5.128.118.210;d;91pkt 91fpkt", shape=diamond, color=yellow];
2437[label="152.21.110.7;s;29pkt 29fpkt", shape=diamond, color=yellow];
2921[label="172.118.133.0;41pkt 41fpkt", shape=pentagon, color=darkviolet];
2994[label="152.21.110.7;31pkt 31fpkt", shape=pentagon, color=darkviolet];
3580[label="152.21.110.74;31pkt 31fpkt", shape=pentagon, color=darkviolet];
3613[label="152.21.110.80;5pkt 5fpkt", shape=pentagon, color=darkviolet];
4004[label="152.21.52.128;22pkt 22fpkt", shape=pentagon, color=darkviolet];
4023[label="152.21.110.129;12pkt 12fpkt", shape=pentagon, color=darkviolet];
4504[label="152.21.110.192;12pkt 12fpkt", shape=pentagon, color=darkviolet];
4655[label="201.117.146.212;24pkt 24fpkt", shape=pentagon, color=darkviolet];
4668[label="152.21.110.214;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4913[label="172.118.133.0;41pkt 41fpkt", shape=invtriangle, color=brown];
4951[label="152.21.110.7;31pkt 31fpkt", shape=invtriangle, color=brown];
5280[label="152.21.110.80;5pkt 5fpkt", shape=invtriangle, color=brown];
5517[label="152.21.110.129;12pkt 12fpkt", shape=invtriangle, color=brown];
5777[label="152.21.110.192;12pkt 12fpkt", shape=invtriangle, color=brown];
5853[label="201.117.146.212;24pkt 24fpkt", shape=invtriangle, color=brown];
5859[label="152.21.110.214;45pkt 45fpkt", shape=invtriangle, color=brown];
5996[label="172.118.133.0;41pkt 41fpkt", shape=invhouse, color=bisque];
6221[label="152.21.110.80;4pkt 4fpkt", shape=invhouse, color=bisque];
6356[label="152.21.110.129;12pkt 12fpkt", shape=invhouse, color=bisque];
6482[label="152.21.110.192;12pkt 12fpkt", shape=invhouse, color=bisque];
6523[label="201.117.146.212;24pkt 24fpkt", shape=invhouse, color=bisque];
stat857[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 19.70.35.234:*}[33.049%]&lt;BR/&gt;{*:*, *:80}[28.145%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (29.7247%)&lt;BR/&gt; 0: (9.26158%)&lt;BR/&gt; 35122: (5.06884%)&lt;BR/&gt; 1863: (3.31665%)&lt;BR/&gt; 443: (2.12766%)&gt;];
}
1269--2262[label="0.0294118;1pkt 1fpkt"];
1269--2437[label="0.172414;5pkt 5fpkt"];
1269--2994[label="0.16129;5pkt 5fpkt"];
1269--3580[label="0.16129;5pkt 5fpkt"];
1269--3613[label="0.2;1pkt 1fpkt"];
1269--3858[label="0.03125;1pkt 1fpkt"];
1269--4023[label="0.583333;7pkt 7fpkt"];
1269--4230[label="0.0434783;3pkt 3fpkt"];
1269--4272[label="0.025;1pkt 1fpkt"];
1269--4504[label="0.75;9pkt 9fpkt"];
1269--4951[label="0.16129;5pkt 5fpkt"];
1269--5280[label="0.2;1pkt 1fpkt"];
1269--5425[label="0.03125;1pkt 1fpkt"];
1269--5517[label="0.583333;7pkt 7fpkt"];
1269--5777[label="0.75;9pkt 9fpkt"];
1269--5859[label="0.111111;5pkt 5fpkt"];
1269--6221[label="0.25;1pkt 1fpkt"];
1269--6356[label="0.583333;7pkt 7fpkt"];
1269--6482[label="0.75;9pkt 9fpkt"];
1394--1473[label="1;2pkt 2fpkt"];
1394--2154[label="1;1pkt 1fpkt"];
1394--2242[label="0.321429;9pkt 9fpkt"];
1394--2875[label="0.142857;4pkt 4fpkt"];
1394--2892[label="0.142857;4pkt 4fpkt"];
1394--2906[label="0.142857;4pkt 4fpkt"];
1394--2916[label="0.142857;4pkt 4fpkt"];
2242--2437[label="0.37931;11pkt 11fpkt"];
2242--2921[label="0.0243902;1pkt 1fpkt"];
2242--2994[label="0.354839;11pkt 11fpkt"];
2242--3580[label="0.290323;9pkt 9fpkt"];
2242--3737[label="0.0588235;1pkt 1fpkt"];
2242--4004[label="0.5;11pkt 11fpkt"];
2242--4150[label="0.021978;2pkt 2fpkt"];
2242--4655[label="0.208333;5pkt 5fpkt"];
2242--4913[label="0.0243902;1pkt 1fpkt"];
2242--4951[label="0.354839;11pkt 11fpkt"];
2242--5383[label="0.142857;13pkt 13fpkt"];
2242--5853[label="0.208333;5pkt 5fpkt"];
2242--5996[label="0.0243902;1pkt 1fpkt"];
2242--6523[label="0.208333;5pkt 5fpkt"];
2437--2875[label="0.0689655;2pkt 2fpkt"];
2437--2892[label="0.0689655;2pkt 2fpkt"];
2437--2906[label="0.0689655;2pkt 2fpkt"];
2437--2916[label="0.0689655;2pkt 2fpkt"];
2437--2994[label="1;29pkt 29fpkt"];
2437--4951[label="1;29pkt 29fpkt"];
2921--4913[label="1;41pkt 41fpkt"];
2921--5996[label="1;41pkt 41fpkt"];
2994--4951[label="1;31pkt 31fpkt"];
3613--5280[label="1;5pkt 5fpkt"];
3613--6221[label="1;4pkt 4fpkt"];
4023--5517[label="1;12pkt 12fpkt"];
4023--6356[label="1;12pkt 12fpkt"];
4504--5777[label="1;12pkt 12fpkt"];
4504--6482[label="1;12pkt 12fpkt"];
4655--5853[label="1;24pkt 24fpkt"];
4655--6523[label="1;24pkt 24fpkt"];
4668--5859[label="1;2pkt 2fpkt"];
4913--5996[label="1;41pkt 41fpkt"];
5280--6221[label="1;4pkt 4fpkt"];
5517--6356[label="1;12pkt 12fpkt"];
5777--6482[label="1;12pkt 12fpkt"];
5853--6523[label="1;24pkt 24fpkt"];
</description>
    <slice>
      <filter dst_port="80"/>
      <filter dst_ip="19.70.35.234" src_port="80"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_858{
style=filled;
color=gray75;
4507[label="4.69.206.192;18pkt 18fpkt", shape=pentagon, color=darkviolet];
5779[label="4.69.206.192;18pkt 18fpkt", shape=invtriangle, color=brown];
6484[label="4.69.206.192;18pkt 18fpkt", shape=invhouse, color=bisque];
stat858[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.69.206.192:*, 169.169.202.137:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 56479: (2.77778%)&lt;BR/&gt; 56451: (2.77778%)&lt;BR/&gt; 56295: (2.77778%)&lt;BR/&gt; 50921: (2.77778%)&gt;];
}
4507--5779[label="1;18pkt 18fpkt"];
4507--6484[label="1;18pkt 18fpkt"];
5779--6484[label="1;18pkt 18fpkt"];
</description>
    <slice>
      <filter dst_ip="169.169.202.137" dst_port="80" src_ip="4.69.206.192"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478081" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_859{
style=filled;
color=gray75;
4508[label="219.155.208.192;11pkt 11fpkt", shape=pentagon, color=darkviolet];
5780[label="219.155.208.192;11pkt 11fpkt", shape=invtriangle, color=brown];
6485[label="219.155.208.192;11pkt 11fpkt", shape=invhouse, color=bisque];
stat859[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.155.208.192:80, 152.21.174.195:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3379: (4.54545%)&lt;BR/&gt; 3378: (4.54545%)&lt;BR/&gt; 3373: (4.54545%)&lt;BR/&gt; 3372: (4.54545%)&gt;];
}
4508--5780[label="1;11pkt 11fpkt"];
4508--6485[label="1;11pkt 11fpkt"];
5780--6485[label="1;11pkt 11fpkt"];
</description>
    <slice>
      <filter dst_ip="152.21.174.195" src_ip="219.155.208.192" src_port="80"/>
    </slice>
    <from sec="1123478049" usec="0"/>
    <to sec="1123478094" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="215.217.184.193"/>
    </slice>
    <from sec="1123477408" usec="0"/>
    <to sec="1123477755" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="0.133.82.195"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,002,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_863{
style=filled;
color=gray75;
4537[label="64.229.27.196;166pkt 166fpkt", shape=pentagon, color=darkviolet];
5793[label="64.229.27.196;166pkt 166fpkt", shape=invtriangle, color=brown];
6492[label="64.229.27.196;166pkt 166fpkt", shape=invhouse, color=bisque];
stat863[shape=component, label=&lt;Rules:&lt;BR/&gt;{64.229.27.196:62965, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 62965: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
4537--5793[label="1;166pkt 166fpkt"];
4537--6492[label="1;166pkt 166fpkt"];
5793--6492[label="1;166pkt 166fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="64.229.27.196" src_port="62965"/>
    </slice>
    <from sec="1123477507" usec="0"/>
    <to sec="1123477541" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_864{
style=filled;
color=gray75;
1132[label="205.145.60.161;d;96pkt 96fpkt", shape=diamond, color=yellow];
1625[label="148.141.16.247;d;108pkt 108fpkt", shape=diamond, color=yellow];
1909[label="205.228.72.78;d;1pkt 1fpkt", shape=diamond, color=yellow];
2063[label="208.129.182.180;d;127pkt 127fpkt", shape=diamond, color=yellow];
2321[label="152.21.39.17;s;39pkt 39fpkt", shape=diamond, color=yellow];
2370[label="152.21.33.131;s;50pkt 50fpkt", shape=diamond, color=yellow];
3083[label="152.21.39.17;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3103[label="158.47.89.19;33pkt 33fpkt", shape=pentagon, color=darkviolet];
3357[label="152.21.36.49;8pkt 8fpkt", shape=pentagon, color=darkviolet];
3560[label="152.20.66.73;48pkt 48fpkt", shape=pentagon, color=darkviolet];
3687[label="152.21.191.86;18pkt 18fpkt", shape=pentagon, color=darkviolet];
3843[label="152.20.91.104;44pkt 44fpkt", shape=pentagon, color=darkviolet];
3902[label="172.118.110.112;46pkt 46fpkt", shape=pentagon, color=darkviolet];
4031[label="152.21.33.131;63pkt 63fpkt", shape=pentagon, color=darkviolet];
4357[label="152.21.218.172;9pkt 9fpkt", shape=pentagon, color=darkviolet];
4414[label="152.20.104.180;8pkt 8fpkt", shape=pentagon, color=darkviolet];
4600[label="152.20.155.205;7pkt 7fpkt", shape=pentagon, color=darkviolet];
4995[label="152.21.39.17;80pkt 80fpkt", shape=invtriangle, color=brown];
5007[label="158.47.89.19;33pkt 33fpkt", shape=invtriangle, color=brown];
5140[label="152.21.36.49;8pkt 8fpkt", shape=invtriangle, color=brown];
5253[label="152.20.66.73;48pkt 48fpkt", shape=invtriangle, color=brown];
5324[label="152.21.191.86;18pkt 18fpkt", shape=invtriangle, color=brown];
5450[label="172.118.110.112;46pkt 46fpkt", shape=invtriangle, color=brown];
5699[label="152.21.218.172;9pkt 9fpkt", shape=invtriangle, color=brown];
5731[label="152.20.104.180;8pkt 8fpkt", shape=invtriangle, color=brown];
6055[label="158.47.89.19;32pkt 32fpkt", shape=invhouse, color=bisque];
6203[label="152.20.66.73;48pkt 48fpkt", shape=invhouse, color=bisque];
6246[label="152.21.191.86;18pkt 18fpkt", shape=invhouse, color=bisque];
6455[label="152.20.104.180;8pkt 8fpkt", shape=invhouse, color=bisque];
stat864[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 208.129.182.180:80}[21.3922%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (43.8324%)&lt;BR/&gt; 443: (2.77778%)&lt;BR/&gt; 123: (1.08286%)&lt;BR/&gt; 53: (0.847458%)&lt;BR/&gt; 25: (0.706215%)&gt;];
}
1132--1378[label="0.0117647;1pkt 1fpkt"];
1132--1405[label="0.0208333;2pkt 2fpkt"];
1132--1511[label="0.03125;3pkt 3fpkt"];
1132--2245[label="0.133333;4pkt 4fpkt"];
1132--2321[label="0.128205;5pkt 5fpkt"];
1132--2598[label="0.0185185;1pkt 1fpkt"];
1132--2875[label="0.0625;6pkt 6fpkt"];
1132--2885[label="0.09375;9pkt 9fpkt"];
1132--2899[label="0.09375;9pkt 9fpkt"];
1132--2909[label="0.09375;9pkt 9fpkt"];
1132--3534[label="0.1875;3pkt 3fpkt"];
1132--3593[label="0.0208333;2pkt 2fpkt"];
1132--3712[label="0.0243902;1pkt 1fpkt"];
1132--3759[label="0.2;2pkt 2fpkt"];
1132--3937[label="0.03125;3pkt 3fpkt"];
1132--3943[label="0.114583;11pkt 11fpkt"];
1132--4321[label="0.0117647;1pkt 1fpkt"];
1132--4357[label="0.666667;6pkt 6fpkt"];
1132--4414[label="0.625;5pkt 5fpkt"];
1132--4600[label="1;7pkt 7fpkt"];
1132--4622[label="0.0769231;1pkt 1fpkt"];
1132--4741[label="0.166667;3pkt 3fpkt"];
1132--4805[label="0.0185185;1pkt 1fpkt"];
1132--4995[label="0.0625;5pkt 5fpkt"];
1132--5340[label="0.0243902;1pkt 1fpkt"];
1132--5364[label="0.2;2pkt 2fpkt"];
1132--5471[label="0.03125;3pkt 3fpkt"];
1132--5685[label="0.0117647;1pkt 1fpkt"];
1132--5699[label="0.666667;6pkt 6fpkt"];
1132--5731[label="0.625;5pkt 5fpkt"];
1132--5820[label="0.03125;3pkt 3fpkt"];
1132--5831[label="0.0769231;1pkt 1fpkt"];
1132--5896[label="0.166667;3pkt 3fpkt"];
1132--6433[label="0.0117647;1pkt 1fpkt"];
1132--6455[label="0.625;5pkt 5fpkt"];
1132--6505[label="0.03125;3pkt 3fpkt"];
1625--2370[label="0.48;24pkt 24fpkt"];
1625--2611[label="0.7;7pkt 7fpkt"];
1625--2875[label="0.12963;14pkt 14fpkt"];
1625--2885[label="0.101852;11pkt 11fpkt"];
1625--2899[label="0.101852;11pkt 11fpkt"];
1625--2909[label="0.101852;11pkt 11fpkt"];
1625--3357[label="0.125;1pkt 1fpkt"];
1625--3560[label="0.0833333;4pkt 4fpkt"];
1625--3654[label="0.0714286;1pkt 1fpkt"];
1625--3712[label="0.0243902;1pkt 1fpkt"];
1625--3843[label="0.409091;18pkt 18fpkt"];
1625--3937[label="0.00925926;1pkt 1fpkt"];
1625--3943[label="0.0833333;9pkt 9fpkt"];
1625--4031[label="0.380952;24pkt 24fpkt"];
1625--4414[label="0.125;1pkt 1fpkt"];
1625--4761[label="0.0833333;1pkt 1fpkt"];
1625--5140[label="0.125;1pkt 1fpkt"];
1625--5253[label="0.0833333;4pkt 4fpkt"];
1625--5306[label="0.0714286;1pkt 1fpkt"];
1625--5340[label="0.0243902;1pkt 1fpkt"];
1625--5383[label="0.037037;4pkt 4fpkt"];
1625--5471[label="0.00925926;1pkt 1fpkt"];
1625--5508[label="0.00925926;1pkt 1fpkt"];
1625--5731[label="0.125;1pkt 1fpkt"];
1625--6203[label="0.0833333;4pkt 4fpkt"];
1625--6234[label="0.0714286;1pkt 1fpkt"];
1625--6256[label="0.025;1pkt 1fpkt"];
1625--6353[label="0.00925926;1pkt 1fpkt"];
1625--6455[label="0.125;1pkt 1fpkt"];
1909--2321[label="1;1pkt 1fpkt"];
1909--4995[label="1;1pkt 1fpkt"];
2063--2370[label="0.28;14pkt 14fpkt"];
2063--2875[label="0.0787402;10pkt 10fpkt"];
2063--2885[label="0.00787402;1pkt 1fpkt"];
2063--2899[label="0.00787402;1pkt 1fpkt"];
2063--2909[label="0.00787402;1pkt 1fpkt"];
2063--3103[label="0.484848;16pkt 16fpkt"];
2063--3210[label="0.0322581;1pkt 1fpkt"];
2063--3687[label="0.222222;4pkt 4fpkt"];
2063--3902[label="0.0217391;1pkt 1fpkt"];
2063--4031[label="0.222222;14pkt 14fpkt"];
2063--4313[label="0.00787402;1pkt 1fpkt"];
2063--5007[label="0.484848;16pkt 16fpkt"];
2063--5062[label="0.0322581;1pkt 1fpkt"];
2063--5324[label="0.222222;4pkt 4fpkt"];
2063--5383[label="0.00787402;1pkt 1fpkt"];
2063--5450[label="0.0217391;1pkt 1fpkt"];
2063--5508[label="0.023622;3pkt 3fpkt"];
2063--5679[label="0.00787402;1pkt 1fpkt"];
2063--6055[label="0.5;16pkt 16fpkt"];
2063--6087[label="0.0333333;1pkt 1fpkt"];
2063--6246[label="0.222222;4pkt 4fpkt"];
2063--6353[label="0.023622;3pkt 3fpkt"];
2321--2885[label="0.025641;1pkt 1fpkt"];
2321--2892[label="0.0769231;3pkt 3fpkt"];
2321--2899[label="0.025641;1pkt 1fpkt"];
2321--2906[label="0.0769231;3pkt 3fpkt"];
2321--2909[label="0.025641;1pkt 1fpkt"];
2321--2916[label="0.0769231;3pkt 3fpkt"];
2321--4995[label="1;39pkt 39fpkt"];
2370--2885[label="0.12;6pkt 6fpkt"];
2370--2899[label="0.12;6pkt 6fpkt"];
2370--2909[label="0.12;6pkt 6fpkt"];
2370--4031[label="1;50pkt 50fpkt"];
3083--4995[label="1;1pkt 1fpkt"];
3103--5007[label="1;33pkt 33fpkt"];
3103--6055[label="1;32pkt 32fpkt"];
3357--5140[label="1;8pkt 8fpkt"];
3560--5253[label="1;48pkt 48fpkt"];
3560--6203[label="1;48pkt 48fpkt"];
3687--5324[label="1;18pkt 18fpkt"];
3687--6246[label="1;18pkt 18fpkt"];
3902--5450[label="1;46pkt 46fpkt"];
4357--5699[label="1;9pkt 9fpkt"];
4414--5731[label="1;8pkt 8fpkt"];
4414--6455[label="1;8pkt 8fpkt"];
5007--6055[label="1;32pkt 32fpkt"];
5253--6203[label="1;48pkt 48fpkt"];
5324--6246[label="1;18pkt 18fpkt"];
5731--6455[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="208.129.182.180" dst_port="80"/>
    </slice>
    <from sec="1123477205" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="169.169.232.197"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123477392" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_866{
style=filled;
color=gray75;
4585[label="5.193.73.203;6pkt 6fpkt", shape=pentagon, color=darkviolet];
5814[label="5.193.73.203;6pkt 6fpkt", shape=invtriangle, color=brown];
stat866[shape=component, label=&lt;Rules:&lt;BR/&gt;{5.193.73.203:20, 169.169.245.15:*}[83.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 20: (41.6667%)&lt;BR/&gt; 5014: (8.33333%)&lt;BR/&gt; 5013: (8.33333%)&lt;BR/&gt; 5011: (8.33333%)&lt;BR/&gt; 5010: (8.33333%)&gt;];
}
4585--5814[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="169.169.245.15" src_ip="5.193.73.203" src_port="20"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478066" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="18.67.39.204"/>
    </slice>
    <from sec="1123477226" usec="0"/>
    <to sec="1123478097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="69.26.13.208"/>
    </slice>
    <from sec="1123477205" usec="0"/>
    <to sec="1123478093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_870{
style=filled;
color=gray75;
4619[label="169.169.193.208;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5828[label="169.169.193.208;2pkt 2fpkt", shape=invtriangle, color=brown];
6510[label="169.169.193.208;2pkt 2fpkt", shape=invhouse, color=bisque];
stat870[shape=component, label=&lt;Rules:&lt;BR/&gt;{169.169.193.208:25, 6.193.148.70:31969}[50%]&lt;BR/&gt;{169.169.193.208:25, 6.193.148.86:43673}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 43673: (25%)&lt;BR/&gt; 31969: (25%)&gt;];
}
4619--5828[label="1;2pkt 2fpkt"];
4619--6510[label="1;2pkt 2fpkt"];
5828--6510[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="6.193.148.86" dst_port="43673" src_ip="169.169.193.208" src_port="25"/>
      <filter dst_ip="6.193.148.70" dst_port="31969" src_ip="169.169.193.208" src_port="25"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_871{
style=filled;
color=gray75;
4625[label="6.12.37.209;4pkt 4fpkt", shape=pentagon, color=darkviolet];
5833[label="6.12.37.209;4pkt 4fpkt", shape=invtriangle, color=brown];
stat871[shape=component, label=&lt;Rules:&lt;BR/&gt;{6.12.37.209:57154, 132.117.86.163:80}[25%]&lt;BR/&gt;{6.12.37.209:50728, 158.47.41.67:80}[25%]&lt;BR/&gt;{6.12.37.209:61799, 158.47.41.67:80}[25%]&lt;BR/&gt;{6.12.37.209:65264, 158.47.41.67:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 65264: (12.5%)&lt;BR/&gt; 61799: (12.5%)&lt;BR/&gt; 57154: (12.5%)&lt;BR/&gt; 50728: (12.5%)&gt;];
}
4625--5833[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="158.47.41.67" dst_port="80" src_ip="6.12.37.209" src_port="65264"/>
      <filter dst_ip="158.47.41.67" dst_port="80" src_ip="6.12.37.209" src_port="61799"/>
      <filter dst_ip="158.47.41.67" dst_port="80" src_ip="6.12.37.209" src_port="50728"/>
      <filter dst_ip="132.117.86.163" dst_port="80" src_ip="6.12.37.209" src_port="57154"/>
    </slice>
    <from sec="1123477390" usec="0"/>
    <to sec="1123477931" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_872{
style=filled;
color=gray75;
4627[label="219.112.78.209;5pkt 5fpkt", shape=pentagon, color=darkviolet];
5834[label="219.112.78.209;5pkt 5fpkt", shape=invtriangle, color=brown];
stat872[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.112.78.209:80, 152.21.174.195:3348}[20%]&lt;BR/&gt;{219.112.78.209:80, 152.21.174.195:3349}[20%]&lt;BR/&gt;{219.112.78.209:80, 152.21.174.195:3353}[20%]&lt;BR/&gt;{219.112.78.209:80, 152.21.174.195:3354}[20%]&lt;BR/&gt;{219.112.78.209:80, 152.21.174.195:3375}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3375: (10%)&lt;BR/&gt; 3354: (10%)&lt;BR/&gt; 3353: (10%)&lt;BR/&gt; 3349: (10%)&gt;];
}
4627--5834[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="152.21.174.195" dst_port="3375" src_ip="219.112.78.209" src_port="80"/>
      <filter dst_ip="152.21.174.195" dst_port="3354" src_ip="219.112.78.209" src_port="80"/>
      <filter dst_ip="152.21.174.195" dst_port="3353" src_ip="219.112.78.209" src_port="80"/>
      <filter dst_ip="152.21.174.195" dst_port="3349" src_ip="219.112.78.209" src_port="80"/>
      <filter dst_ip="152.21.174.195" dst_port="3348" src_ip="219.112.78.209" src_port="80"/>
    </slice>
    <from sec="1123478055" usec="0"/>
    <to sec="1123478077" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,504,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_873{
style=filled;
color=gray75;
1257[label="172.118.133.9;d;54pkt 54fpkt", shape=diamond, color=yellow];
1810[label="5.171.57.126;s;29pkt 29fpkt", shape=diamond, color=yellow];
3995[label="5.171.57.126;43pkt 43fpkt", shape=pentagon, color=darkviolet];
5505[label="5.171.57.126;43pkt 43fpkt", shape=invtriangle, color=brown];
6350[label="5.171.57.126;43pkt 43fpkt", shape=invhouse, color=bisque];
stat873[shape=component, label=&lt;Rules:&lt;BR/&gt;{5.171.57.126:*, 172.118.133.9:443}[42.3729%]&lt;BR/&gt;{5.171.57.126:*, 172.118.133.9:80}[30.5085%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (29.4811%)&lt;BR/&gt; 80: (20.5189%)&lt;BR/&gt; 1151: (1.17925%)&lt;BR/&gt; 1150: (1.17925%)&lt;BR/&gt; 1149: (1.17925%)&gt;];
}
1257--1810[label="1;29pkt 29fpkt"];
1257--2875[label="0.0185185;1pkt 1fpkt"];
1257--3275[label="0.0322581;1pkt 1fpkt"];
1257--3995[label="0.883721;38pkt 38fpkt"];
1257--4495[label="0.0185185;1pkt 1fpkt"];
1257--4634[label="0.030303;1pkt 1fpkt"];
1257--5505[label="0.883721;38pkt 38fpkt"];
1257--5841[label="0.030303;1pkt 1fpkt"];
1257--6350[label="0.883721;38pkt 38fpkt"];
1257--6516[label="0.030303;1pkt 1fpkt"];
1810--3995[label="1;29pkt 29fpkt"];
1810--5505[label="1;29pkt 29fpkt"];
1810--6350[label="1;29pkt 29fpkt"];
3995--5505[label="1;43pkt 43fpkt"];
3995--6350[label="1;43pkt 43fpkt"];
5505--6350[label="1;43pkt 43fpkt"];
</description>
    <slice>
      <filter dst_ip="172.118.133.9" dst_port="80" src_ip="5.171.57.126"/>
      <filter dst_ip="172.118.133.9" dst_port="443" src_ip="5.171.57.126"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_874{
style=filled;
color=gray75;
4640[label="201.140.92.210;17pkt 17fpkt", shape=pentagon, color=darkviolet];
5844[label="201.140.92.210;17pkt 17fpkt", shape=invtriangle, color=brown];
stat874[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.140.92.210:*, 158.189.168.188:110}[88.2353%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 110: (44.1176%)&lt;BR/&gt; 4767: (2.94118%)&lt;BR/&gt; 3831: (2.94118%)&lt;BR/&gt; 2803: (2.94118%)&lt;BR/&gt; 2802: (2.94118%)&gt;];
}
4640--5844[label="1;17pkt 17fpkt"];
</description>
    <slice>
      <filter dst_ip="158.189.168.188" dst_port="110" src_ip="201.140.92.210"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="2.217.178.210"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="169.169.245.210"/>
    </slice>
    <from sec="1123477533" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_877{
style=filled;
color=gray75;
4654[label="219.246.40.212;5pkt 5fpkt", shape=pentagon, color=darkviolet];
5852[label="219.246.40.212;5pkt 5fpkt", shape=invtriangle, color=brown];
stat877[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.246.40.212:19816, 158.189.5.156:80}[20%]&lt;BR/&gt;{219.246.40.212:19939, 158.189.5.156:80}[20%]&lt;BR/&gt;{219.246.40.212:20057, 158.189.5.156:80}[20%]&lt;BR/&gt;{219.246.40.212:20178, 158.189.5.156:80}[20%]&lt;BR/&gt;{219.246.40.212:20296, 158.189.5.156:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 20296: (10%)&lt;BR/&gt; 20178: (10%)&lt;BR/&gt; 20057: (10%)&lt;BR/&gt; 19939: (10%)&gt;];
}
4654--5852[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="158.189.5.156" dst_port="80" src_ip="219.246.40.212" src_port="20296"/>
      <filter dst_ip="158.189.5.156" dst_port="80" src_ip="219.246.40.212" src_port="20178"/>
      <filter dst_ip="158.189.5.156" dst_port="80" src_ip="219.246.40.212" src_port="20057"/>
      <filter dst_ip="158.189.5.156" dst_port="80" src_ip="219.246.40.212" src_port="19939"/>
      <filter dst_ip="158.189.5.156" dst_port="80" src_ip="219.246.40.212" src_port="19816"/>
    </slice>
    <from sec="1123477317" usec="0"/>
    <to sec="1123478080" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_878{
style=filled;
color=gray75;
4657[label="169.169.193.212;56pkt 56fpkt", shape=pentagon, color=darkviolet];
5855[label="169.169.193.212;56pkt 56fpkt", shape=invtriangle, color=brown];
6524[label="169.169.193.212;56pkt 56fpkt", shape=invhouse, color=bisque];
stat878[shape=component, label=&lt;Rules:&lt;BR/&gt;{169.169.193.212:2603, *:53}[39.2857%]&lt;BR/&gt;{169.169.193.212:80, 5.71.245.197:*}[23.2143%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (29.4643%)&lt;BR/&gt; 80: (20.5357%)&lt;BR/&gt; 2603: (19.6429%)&lt;BR/&gt; 33701: (5.35714%)&lt;BR/&gt; 60980: (0.892857%)&gt;];
}
4657--5855[label="1;56pkt 56fpkt"];
4657--6524[label="1;56pkt 56fpkt"];
5855--6524[label="1;56pkt 56fpkt"];
</description>
    <slice>
      <filter dst_ip="5.71.245.197" src_ip="169.169.193.212" src_port="80"/>
      <filter dst_port="53" src_ip="169.169.193.212" src_port="2603"/>
    </slice>
    <from sec="1123477214" usec="0"/>
    <to sec="1123478090" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_879{
style=filled;
color=gray75;
4662[label="152.21.56.213;182pkt 182fpkt", shape=pentagon, color=darkviolet];
5857[label="152.21.56.213;182pkt 182fpkt", shape=invtriangle, color=brown];
6525[label="152.21.56.213;182pkt 182fpkt", shape=invhouse, color=bisque];
stat879[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.56.213:53, *:*}[51.0989%]&lt;BR/&gt;{152.21.56.213:60054, *:53}[46.7033%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (52.4725%)&lt;BR/&gt; 60054: (23.3516%)&lt;BR/&gt; 0: (1.64835%)&lt;BR/&gt; 32773: (1.0989%)&lt;BR/&gt; 32777: (0.824176%)&gt;];
}
4662--5857[label="1;182pkt 182fpkt"];
4662--6525[label="1;182pkt 182fpkt"];
5857--6525[label="1;182pkt 182fpkt"];
</description>
    <slice>
      <filter src_ip="152.21.56.213" src_port="53"/>
      <filter dst_port="53" src_ip="152.21.56.213" src_port="60054"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478094" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="201.24.149.213"/>
    </slice>
    <from sec="1123477341" usec="0"/>
    <to sec="1123477385" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_882{
style=filled;
color=gray75;
4682[label="152.20.106.216;8pkt 8fpkt", shape=pentagon, color=darkviolet];
5870[label="152.20.106.216;8pkt 8fpkt", shape=invtriangle, color=brown];
stat882[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.20.106.216:*, *:80}[75%]&lt;BR/&gt;{152.20.106.216:0, *:0}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (37.5%)&lt;BR/&gt; 0: (25%)&lt;BR/&gt; 32793: (6.25%)&lt;BR/&gt; 32790: (6.25%)&lt;BR/&gt; 32788: (6.25%)&gt;];
}
4682--5870[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="152.20.106.216"/>
      <filter src_ip="152.20.106.216"/>
    </slice>
    <from sec="1123477690" usec="0"/>
    <to sec="1123477800" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_883{
style=filled;
color=gray75;
4685[label="205.45.83.217;3pkt 3fpkt", shape=pentagon, color=darkviolet];
5871[label="205.45.83.217;3pkt 3fpkt", shape=invtriangle, color=brown];
6534[label="205.45.83.217;3pkt 3fpkt", shape=invhouse, color=bisque];
stat883[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.45.83.217:1863, 132.117.46.3:1392}[33.3333%]&lt;BR/&gt;{205.45.83.217:1863, 132.117.18.112:2847}[33.3333%]&lt;BR/&gt;{205.45.83.217:1863, 132.117.23.152:2708}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1863: (50%)&lt;BR/&gt; 2847: (16.6667%)&lt;BR/&gt; 2708: (16.6667%)&lt;BR/&gt; 1392: (16.6667%)&gt;];
}
4685--5871[label="1;3pkt 3fpkt"];
4685--6534[label="1;3pkt 3fpkt"];
5871--6534[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="132.117.23.152" dst_port="2708" src_ip="205.45.83.217" src_port="1863"/>
      <filter dst_ip="132.117.18.112" dst_port="2847" src_ip="205.45.83.217" src_port="1863"/>
      <filter dst_ip="132.117.46.3" dst_port="1392" src_ip="205.45.83.217" src_port="1863"/>
    </slice>
    <from sec="1123477532" usec="0"/>
    <to sec="1123478043" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="16.50.137.217"/>
    </slice>
    <from sec="1123477208" usec="0"/>
    <to sec="1123478089" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.582683,1.94875,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_885{
style=filled;
color=gray75;
512[label="132.117.80.171;d;59pkt 59fpkt", shape=diamond, color=yellow];
857[label="6.63.196.19;s;2pkt 2fpkt", shape=diamond, color=yellow];
1777[label="4.42.42.252;s;40pkt 40fpkt", shape=diamond, color=yellow];
3106[label="6.63.196.19;2pkt 2fpkt", shape=pentagon, color=darkviolet];
stat885[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 132.117.80.171:*}[64.0449%]&lt;BR/&gt;{4.42.42.252:80, *:*}[44.9438%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.0291%)&lt;BR/&gt; 2741: (1.45631%)&lt;BR/&gt; 2739: (1.45631%)&lt;BR/&gt; 2763: (0.970874%)&lt;BR/&gt; 2762: (0.970874%)&gt;];
}
512--857[label="1;2pkt 2fpkt"];
512--1777[label="0.25;10pkt 10fpkt"];
512--3106[label="1;2pkt 2fpkt"];
512--4688[label="0.0344828;1pkt 1fpkt"];
512--5873[label="0.0344828;1pkt 1fpkt"];
857--3106[label="1;2pkt 2fpkt"];
1777--2684[label="0.05;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_ip="4.42.42.252" src_port="80"/>
      <filter dst_ip="132.117.80.171" src_port="80"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478024" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_886{
style=filled;
color=gray75;
305[label="200.89.34.98;s;1140pkt 1140fpkt", shape=diamond, color=yellow];
548[label="152.21.0.134;s;101pkt 101fpkt", shape=diamond, color=yellow];
552[label="208.91.121.151;d;182pkt 182fpkt", shape=diamond, color=yellow];
686[label="217.116.84.60;d;318pkt 318fpkt", shape=diamond, color=yellow];
712[label="7.42.152.132;d;1pkt 1fpkt", shape=diamond, color=yellow];
872[label="152.21.89.71;s;15pkt 15fpkt", shape=diamond, color=yellow];
949[label="200.89.0.57;s;182pkt 182fpkt", shape=diamond, color=yellow];
967[label="156.238.188.17;d;13pkt 13fpkt", shape=diamond, color=yellow];
971[label="215.168.43.160;d;1pkt 1fpkt", shape=diamond, color=yellow];
1175[label="172.118.192.161;s;15pkt 15fpkt", shape=diamond, color=yellow];
1240[label="98.38.247.108;d;1pkt 1fpkt", shape=diamond, color=yellow];
1274[label="1.36.101.218;d;1pkt 1fpkt", shape=diamond, color=yellow];
1511[label="152.20.69.205;s;166pkt 166fpkt", shape=diamond, color=yellow];
1852[label="152.21.8.144;s;40pkt 40fpkt", shape=diamond, color=yellow];
1915[label="19.35.128.202;d;2pkt 2fpkt", shape=diamond, color=yellow];
1996[label="0.134.51.101;d;10pkt 10fpkt", shape=diamond, color=yellow];
2052[label="201.117.153.81;s;52pkt 52fpkt", shape=diamond, color=yellow];
2178[label="204.68.176.69;d;34pkt 34fpkt", shape=diamond, color=yellow];
2264[label="208.145.222.1;d;91pkt 91fpkt", shape=diamond, color=yellow];
2558[label="204.68.178.72;d;43pkt 43fpkt", shape=diamond, color=yellow];
2596[label="152.21.203.180;s;55pkt 55fpkt", shape=diamond, color=yellow];
3232[label="152.20.187.34;46pkt 46fpkt", shape=pentagon, color=darkviolet];
3513[label="201.117.145.68;253pkt 253fpkt", shape=pentagon, color=darkviolet];
3542[label="152.21.89.71;15pkt 15fpkt", shape=pentagon, color=darkviolet];
3790[label="200.89.34.98;12pkt 12fpkt", shape=pentagon, color=darkviolet];
4024[label="152.20.130.129;17pkt 17fpkt", shape=pentagon, color=darkviolet];
4060[label="152.21.0.134;101pkt 101fpkt", shape=pentagon, color=darkviolet];
4135[label="200.85.29.142;28pkt 28fpkt", shape=pentagon, color=darkviolet];
4148[label="152.21.8.144;47pkt 47fpkt", shape=pentagon, color=darkviolet];
4247[label="152.21.75.160;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4420[label="152.21.203.180;66pkt 66fpkt", shape=pentagon, color=darkviolet];
4549[label="172.118.70.197;30pkt 30fpkt", shape=pentagon, color=darkviolet];
4579[label="172.118.147.202;28pkt 28fpkt", shape=pentagon, color=darkviolet];
4701[label="152.20.48.220;18pkt 18fpkt", shape=pentagon, color=darkviolet];
5073[label="152.20.187.34;45pkt 45fpkt", shape=invtriangle, color=brown];
5230[label="201.117.145.68;253pkt 253fpkt", shape=invtriangle, color=brown];
5383[label="200.89.34.98;1283pkt 1283fpkt", shape=invtriangle, color=brown];
5518[label="152.20.130.129;17pkt 17fpkt", shape=invtriangle, color=brown];
5576[label="200.85.29.142;28pkt 28fpkt", shape=invtriangle, color=brown];
5640[label="152.21.75.160;1pkt 1fpkt", shape=invtriangle, color=brown];
5812[label="172.118.147.202;28pkt 28fpkt", shape=invtriangle, color=brown];
5820[label="152.20.69.205;191pkt 191fpkt", shape=invtriangle, color=brown];
5877[label="152.20.48.220;18pkt 18fpkt", shape=invtriangle, color=brown];
6189[label="201.117.145.68;252pkt 252fpkt", shape=invhouse, color=bisque];
6357[label="152.20.130.129;17pkt 17fpkt", shape=invhouse, color=bisque];
6502[label="172.118.147.202;28pkt 28fpkt", shape=invhouse, color=bisque];
6505[label="152.20.69.205;191pkt 191fpkt", shape=invhouse, color=bisque];
6538[label="152.20.48.220;18pkt 18fpkt", shape=invhouse, color=bisque];
stat886[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.89.34.98:*, *:80}[26.0852%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (21.1192%)&lt;BR/&gt; 53: (11.3012%)&lt;BR/&gt; 443: (8.16197%)&lt;BR/&gt; 6346: (3.94904%)&lt;BR/&gt; 6348: (0.909918%)&gt;];
}
305--495[label="0.00311526;1pkt 1fpkt"];
305--552[label="0.692308;126pkt 126fpkt"];
305--591[label="0.0117647;1pkt 1fpkt"];
305--610[label="0.00175439;2pkt 2fpkt"];
305--620[label="0.00609756;1pkt 1fpkt"];
305--712[label="1;1pkt 1fpkt"];
305--967[label="0.153846;2pkt 2fpkt"];
305--971[label="1;1pkt 1fpkt"];
305--1087[label="0.0159744;5pkt 5fpkt"];
305--1105[label="0.0134529;3pkt 3fpkt"];
305--1213[label="0.0188679;1pkt 1fpkt"];
305--1237[label="0.00819672;1pkt 1fpkt"];
305--1240[label="1;1pkt 1fpkt"];
305--1274[label="1;1pkt 1fpkt"];
305--1330[label="0.0203046;4pkt 4fpkt"];
305--1391[label="0.0733945;8pkt 8fpkt"];
305--1625[label="0.037037;4pkt 4fpkt"];
305--1647[label="0.0188679;2pkt 2fpkt"];
305--1802[label="0.0315789;3pkt 3fpkt"];
305--1996[label="1;10pkt 10fpkt"];
305--2036[label="0.042735;5pkt 5fpkt"];
305--2037[label="0.0196078;2pkt 2fpkt"];
305--2063[label="0.00787402;1pkt 1fpkt"];
305--2073[label="0.0121951;1pkt 1fpkt"];
305--2078[label="0.00970874;1pkt 1fpkt"];
305--2242[label="0.142857;13pkt 13fpkt"];
305--2446[label="0.0373832;4pkt 4fpkt"];
305--2552[label="0.04;3pkt 3fpkt"];
305--2580[label="0.025;1pkt 1fpkt"];
305--2793[label="0.0238095;2pkt 2fpkt"];
305--2874[label="0.00789474;9pkt 9fpkt"];
305--2875[label="0.0280702;32pkt 32fpkt"];
305--2884[label="0.0201754;23pkt 23fpkt"];
305--2885[label="0.0798246;91pkt 91fpkt"];
305--2892[label="0.0190217;21pkt 21fpkt"];
305--2898[label="0.0201754;23pkt 23fpkt"];
305--2899[label="0.0798246;91pkt 91fpkt"];
305--2906[label="0.0190217;21pkt 21fpkt"];
305--2909[label="0.0798246;91pkt 91fpkt"];
305--2916[label="0.0190217;21pkt 21fpkt"];
305--3790[label="0.25;3pkt 3fpkt"];
305--5383[label="1;1140pkt 1140fpkt"];
548--552[label="0.326733;33pkt 33fpkt"];
548--688[label="0.019802;2pkt 2fpkt"];
548--845[label="0.0121951;1pkt 1fpkt"];
548--1596[label="0.0594059;6pkt 6fpkt"];
548--1819[label="0.0123457;1pkt 1fpkt"];
548--2178[label="0.176471;6pkt 6fpkt"];
548--2552[label="0.0266667;2pkt 2fpkt"];
548--2875[label="0.257426;26pkt 26fpkt"];
548--2885[label="0.19802;20pkt 20fpkt"];
548--2899[label="0.19802;20pkt 20fpkt"];
548--2909[label="0.19802;20pkt 20fpkt"];
548--4060[label="1;101pkt 101fpkt"];
552--578[label="0.010989;2pkt 2fpkt"];
552--599[label="0.0164835;3pkt 3fpkt"];
552--872[label="0.466667;7pkt 7fpkt"];
552--1175[label="0.666667;10pkt 10fpkt"];
552--2875[label="0.126374;23pkt 23fpkt"];
552--2885[label="0.0604396;11pkt 11fpkt"];
552--2899[label="0.0604396;11pkt 11fpkt"];
552--2909[label="0.0604396;11pkt 11fpkt"];
552--3542[label="0.466667;7pkt 7fpkt"];
552--4060[label="0.326733;33pkt 33fpkt"];
552--4155[label="0.0164835;3pkt 3fpkt"];
552--4500[label="0.0526316;1pkt 1fpkt"];
552--5383[label="0.692308;126pkt 126fpkt"];
552--5775[label="0.0526316;1pkt 1fpkt"];
552--6388[label="0.0164835;3pkt 3fpkt"];
686--766[label="0.00314465;1pkt 1fpkt"];
686--949[label="0.43956;80pkt 80fpkt"];
686--1170[label="0.00877193;1pkt 1fpkt"];
686--1511[label="0.0963855;16pkt 16fpkt"];
686--1852[label="0.575;23pkt 23fpkt"];
686--1981[label="0.0151515;1pkt 1fpkt"];
686--2052[label="1;52pkt 52fpkt"];
686--2979[label="0.00869565;1pkt 1fpkt"];
686--4135[label="0.928571;26pkt 26fpkt"];
686--4148[label="0.574468;27pkt 27fpkt"];
686--4549[label="0.9;27pkt 27fpkt"];
686--4579[label="0.928571;26pkt 26fpkt"];
686--4940[label="0.00869565;1pkt 1fpkt"];
686--5508[label="0.00706714;2pkt 2fpkt"];
686--5576[label="0.928571;26pkt 26fpkt"];
686--5812[label="0.928571;26pkt 26fpkt"];
686--5820[label="0.0837696;16pkt 16fpkt"];
686--6014[label="0.00869565;1pkt 1fpkt"];
686--6353[label="0.00706714;2pkt 2fpkt"];
686--6502[label="0.928571;26pkt 26fpkt"];
686--6505[label="0.0837696;16pkt 16fpkt"];
712--5383[label="1;1pkt 1fpkt"];
872--903[label="0.0666667;1pkt 1fpkt"];
872--2875[label="0.266667;4pkt 4fpkt"];
872--3542[label="1;15pkt 15fpkt"];
949--1105[label="0.00549451;1pkt 1fpkt"];
949--1860[label="0.037037;2pkt 2fpkt"];
949--2178[label="0.0588235;2pkt 2fpkt"];
949--2264[label="0.021978;2pkt 2fpkt"];
949--2293[label="0.010989;1pkt 1fpkt"];
949--2492[label="0.0114943;1pkt 1fpkt"];
949--2558[label="0.511628;22pkt 22fpkt"];
949--2875[label="0.0824176;15pkt 15fpkt"];
949--2885[label="0.10989;20pkt 20fpkt"];
949--2892[label="0.00549451;1pkt 1fpkt"];
949--2899[label="0.10989;20pkt 20fpkt"];
949--2906[label="0.00549451;1pkt 1fpkt"];
949--2909[label="0.10989;20pkt 20fpkt"];
949--2916[label="0.00549451;1pkt 1fpkt"];
967--4247[label="1;1pkt 1fpkt"];
967--4500[label="0.0769231;1pkt 1fpkt"];
967--5383[label="0.153846;2pkt 2fpkt"];
967--5640[label="1;1pkt 1fpkt"];
967--5775[label="0.0769231;1pkt 1fpkt"];
971--3790[label="1;1pkt 1fpkt"];
971--5383[label="1;1pkt 1fpkt"];
1175--2875[label="0.266667;4pkt 4fpkt"];
1175--2892[label="0.0666667;1pkt 1fpkt"];
1175--2906[label="0.0666667;1pkt 1fpkt"];
1175--2916[label="0.0666667;1pkt 1fpkt"];
1240--5383[label="1;1pkt 1fpkt"];
1274--3790[label="1;1pkt 1fpkt"];
1274--5383[label="1;1pkt 1fpkt"];
1511--1646[label="0.0361446;6pkt 6fpkt"];
1511--2499[label="0.011236;1pkt 1fpkt"];
1511--2552[label="0.0133333;1pkt 1fpkt"];
1511--2885[label="0.0120482;2pkt 2fpkt"];
1511--2892[label="0.0361446;6pkt 6fpkt"];
1511--2899[label="0.0120482;2pkt 2fpkt"];
1511--2906[label="0.0361446;6pkt 6fpkt"];
1511--2909[label="0.0120482;2pkt 2fpkt"];
1511--2916[label="0.0361446;6pkt 6fpkt"];
1511--5820[label="0.993976;165pkt 165fpkt"];
1511--6505[label="0.993976;165pkt 165fpkt"];
1852--1915[label="1;2pkt 2fpkt"];
1852--2875[label="0.025;1pkt 1fpkt"];
1852--2885[label="0.075;3pkt 3fpkt"];
1852--2899[label="0.075;3pkt 3fpkt"];
1852--2909[label="0.075;3pkt 3fpkt"];
1852--4148[label="1;40pkt 40fpkt"];
1915--4148[label="1;2pkt 2fpkt"];
1996--5383[label="1;10pkt 10fpkt"];
2178--2875[label="0.0882353;3pkt 3fpkt"];
2178--2885[label="0.117647;4pkt 4fpkt"];
2178--2899[label="0.117647;4pkt 4fpkt"];
2178--2909[label="0.117647;4pkt 4fpkt"];
2178--3215[label="0.0294118;1pkt 1fpkt"];
2178--3232[label="0.382353;13pkt 13fpkt"];
2178--3937[label="0.0882353;3pkt 3fpkt"];
2178--3943[label="0.0294118;1pkt 1fpkt"];
2178--4060[label="0.176471;6pkt 6fpkt"];
2178--4701[label="0.333333;6pkt 6fpkt"];
2178--5073[label="0.382353;13pkt 13fpkt"];
2178--5471[label="0.0882353;3pkt 3fpkt"];
2178--5877[label="0.333333;6pkt 6fpkt"];
2178--6538[label="0.333333;6pkt 6fpkt"];
2264--2296[label="0.0114943;1pkt 1fpkt"];
2264--2875[label="0.0549451;5pkt 5fpkt"];
2264--2885[label="0.0989011;9pkt 9fpkt"];
2264--2899[label="0.0989011;9pkt 9fpkt"];
2264--2909[label="0.0989011;9pkt 9fpkt"];
2264--3081[label="0.047619;1pkt 1fpkt"];
2264--3232[label="0.369565;17pkt 17fpkt"];
2264--3377[label="0.021978;2pkt 2fpkt"];
2264--3638[label="0.010989;1pkt 1fpkt"];
2264--3854[label="0.04;1pkt 1fpkt"];
2264--3937[label="0.0549451;5pkt 5fpkt"];
2264--3943[label="0.043956;4pkt 4fpkt"];
2264--4155[label="0.010989;1pkt 1fpkt"];
2264--4420[label="0.0151515;1pkt 1fpkt"];
2264--4557[label="0.010989;1pkt 1fpkt"];
2264--4994[label="0.047619;1pkt 1fpkt"];
2264--5073[label="0.355556;16pkt 16fpkt"];
2264--5148[label="0.021978;2pkt 2fpkt"];
2264--5423[label="0.04;1pkt 1fpkt"];
2264--5471[label="0.0549451;5pkt 5fpkt"];
2264--5508[label="0.010989;1pkt 1fpkt"];
2264--5801[label="0.010989;1pkt 1fpkt"];
2264--6138[label="0.021978;2pkt 2fpkt"];
2264--6353[label="0.010989;1pkt 1fpkt"];
2264--6388[label="0.010989;1pkt 1fpkt"];
2558--2875[label="0.0930233;4pkt 4fpkt"];
2558--2885[label="0.0930233;4pkt 4fpkt"];
2558--2899[label="0.0930233;4pkt 4fpkt"];
2558--2909[label="0.0930233;4pkt 4fpkt"];
2558--3472[label="0.0232558;1pkt 1fpkt"];
2558--3513[label="0.0232558;1pkt 1fpkt"];
2558--4024[label="0.823529;14pkt 14fpkt"];
2558--4701[label="0.222222;4pkt 4fpkt"];
2558--5205[label="0.0232558;1pkt 1fpkt"];
2558--5230[label="0.0232558;1pkt 1fpkt"];
2558--5518[label="0.823529;14pkt 14fpkt"];
2558--5877[label="0.222222;4pkt 4fpkt"];
2558--6172[label="0.0232558;1pkt 1fpkt"];
2558--6189[label="0.0232558;1pkt 1fpkt"];
2558--6357[label="0.823529;14pkt 14fpkt"];
2558--6538[label="0.222222;4pkt 4fpkt"];
2596--4420[label="1;55pkt 55fpkt"];
3232--5073[label="1;45pkt 45fpkt"];
3513--5230[label="1;253pkt 253fpkt"];
3513--6189[label="1;252pkt 252fpkt"];
3790--5383[label="1;12pkt 12fpkt"];
4024--5518[label="1;17pkt 17fpkt"];
4024--6357[label="1;17pkt 17fpkt"];
4135--5576[label="1;28pkt 28fpkt"];
4247--5640[label="1;1pkt 1fpkt"];
4579--5812[label="1;28pkt 28fpkt"];
4579--6502[label="1;28pkt 28fpkt"];
4701--5877[label="1;18pkt 18fpkt"];
4701--6538[label="1;18pkt 18fpkt"];
5230--6189[label="1;252pkt 252fpkt"];
5518--6357[label="1;17pkt 17fpkt"];
5812--6502[label="1;28pkt 28fpkt"];
5820--6505[label="1;191pkt 191fpkt"];
5877--6538[label="1;18pkt 18fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="200.89.34.98"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="3.162.11.224"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_890{
style=filled;
color=gray75;
4728[label="6.235.48.224;161pkt 161fpkt", shape=pentagon, color=darkviolet];
5890[label="6.235.48.224;161pkt 161fpkt", shape=invtriangle, color=brown];
stat890[shape=component, label=&lt;Rules:&lt;BR/&gt;{6.235.48.224:*, *:445}[66.4596%]&lt;BR/&gt;{6.235.48.224:*, *:139}[33.5404%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (33.2298%)&lt;BR/&gt; 139: (16.7702%)&lt;BR/&gt; 4408: (0.621118%)&lt;BR/&gt; 4129: (0.621118%)&lt;BR/&gt; 4993: (0.310559%)&gt;];
}
4728--5890[label="1;161pkt 161fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="6.235.48.224"/>
      <filter dst_port="139" src_ip="6.235.48.224"/>
    </slice>
    <from sec="1123477439" usec="0"/>
    <to sec="1123477521" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_891{
style=filled;
color=gray75;
4736[label="169.169.202.224;9pkt 9fpkt", shape=pentagon, color=darkviolet];
5892[label="169.169.202.224;9pkt 9fpkt", shape=invtriangle, color=brown];
6543[label="169.169.202.224;9pkt 9fpkt", shape=invhouse, color=bisque];
stat891[shape=component, label=&lt;Rules:&lt;BR/&gt;{169.169.202.224:25, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 48733: (5.55556%)&lt;BR/&gt; 47105: (5.55556%)&lt;BR/&gt; 43667: (5.55556%)&lt;BR/&gt; 40896: (5.55556%)&gt;];
}
4736--5892[label="1;9pkt 9fpkt"];
4736--6543[label="1;9pkt 9fpkt"];
5892--6543[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter src_ip="169.169.202.224" src_port="25"/>
    </slice>
    <from sec="1123477207" usec="0"/>
    <to sec="1123477933" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="169.169.232.224"/>
    </slice>
    <from sec="1123477209" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="221.205.249.224"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_894{
style=filled;
color=gray75;
4750[label="211.166.198.225;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5898[label="211.166.198.225;1pkt 1fpkt", shape=invtriangle, color=brown];
stat894[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.166.198.225:8008, 132.117.224.202:1925}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8008: (50%)&lt;BR/&gt; 1925: (50%)&gt;];
}
4750--5898[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="132.117.224.202" dst_port="1925" src_ip="211.166.198.225" src_port="8008"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_895{
style=filled;
color=gray75;
584[label="152.21.190.30;d;239pkt 239fpkt", shape=diamond, color=yellow];
837[label="170.184.227.25;s;51pkt 51fpkt", shape=diamond, color=yellow];
1209[label="219.101.34.192;s;177pkt 177fpkt", shape=diamond, color=yellow];
3164[label="170.184.227.25;89pkt 89fpkt", shape=pentagon, color=darkviolet];
4221[label="212.45.169.155;19pkt 19fpkt", shape=pentagon, color=darkviolet];
4496[label="219.101.34.192;177pkt 177fpkt", shape=pentagon, color=darkviolet];
4755[label="172.52.105.226;7pkt 7fpkt", shape=pentagon, color=darkviolet];
5039[label="170.184.227.25;89pkt 89fpkt", shape=invtriangle, color=brown];
5622[label="212.45.169.155;19pkt 19fpkt", shape=invtriangle, color=brown];
5772[label="219.101.34.192;177pkt 177fpkt", shape=invtriangle, color=brown];
5902[label="172.52.105.226;7pkt 7fpkt", shape=invtriangle, color=brown];
6074[label="170.184.227.25;88pkt 88fpkt", shape=invhouse, color=bisque];
6481[label="219.101.34.192;172pkt 172fpkt", shape=invhouse, color=bisque];
stat895[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.101.34.192:*, 152.21.190.30:80}[55.3125%]&lt;BR/&gt;{170.184.227.25:*, *:*}[28.125%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.6819%)&lt;BR/&gt; 443: (3.31808%)&lt;BR/&gt; 3329: (0.190694%)&lt;BR/&gt; 3328: (0.190694%)&lt;BR/&gt; 3327: (0.190694%)&gt;];
}
584--837[label="0.529412;27pkt 27fpkt"];
584--1209[label="1;177pkt 177fpkt"];
584--2875[label="0.0334728;8pkt 8fpkt"];
584--2885[label="0.0376569;9pkt 9fpkt"];
584--2899[label="0.0376569;9pkt 9fpkt"];
584--2909[label="0.0376569;9pkt 9fpkt"];
584--3164[label="0.292135;26pkt 26fpkt"];
584--4082[label="0.0285714;1pkt 1fpkt"];
584--4221[label="0.0526316;1pkt 1fpkt"];
584--4375[label="1;15pkt 15fpkt"];
584--4496[label="1;177pkt 177fpkt"];
584--4755[label="1;7pkt 7fpkt"];
584--5039[label="0.292135;26pkt 26fpkt"];
584--5622[label="0.0526316;1pkt 1fpkt"];
584--5709[label="1;15pkt 15fpkt"];
584--5772[label="1;177pkt 177fpkt"];
584--5902[label="1;7pkt 7fpkt"];
584--6074[label="0.295455;26pkt 26fpkt"];
584--6445[label="1;15pkt 15fpkt"];
584--6481[label="1;172pkt 172fpkt"];
837--2875[label="0.137255;7pkt 7fpkt"];
837--3164[label="0.980392;50pkt 50fpkt"];
837--5039[label="0.980392;50pkt 50fpkt"];
837--6074[label="0.960784;49pkt 49fpkt"];
1209--4496[label="1;177pkt 177fpkt"];
1209--5772[label="1;177pkt 177fpkt"];
1209--6481[label="1;172pkt 172fpkt"];
3164--5039[label="1;89pkt 89fpkt"];
3164--6074[label="1;88pkt 88fpkt"];
4221--5622[label="1;19pkt 19fpkt"];
4496--5772[label="1;177pkt 177fpkt"];
4496--6481[label="1;172pkt 172fpkt"];
4755--5902[label="1;7pkt 7fpkt"];
5039--6074[label="1;88pkt 88fpkt"];
5772--6481[label="1;172pkt 172fpkt"];
</description>
    <slice>
      <filter src_ip="170.184.227.25"/>
      <filter dst_ip="152.21.190.30" dst_port="80" src_ip="219.101.34.192"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478092" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="1.115.71.227"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478085" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_898{
style=filled;
color=gray75;
4764[label="71.40.210.227;149pkt 149fpkt", shape=pentagon, color=darkviolet];
5908[label="71.40.210.227;149pkt 149fpkt", shape=invtriangle, color=brown];
stat898[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.40.210.227:*, *:1027}[58.3893%]&lt;BR/&gt;{71.40.210.227:*, *:1026}[41.6107%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (29.1946%)&lt;BR/&gt; 1026: (20.8054%)&lt;BR/&gt; 37076: (0.671141%)&lt;BR/&gt; 37029: (0.671141%)&lt;BR/&gt; 37023: (0.671141%)&gt;];
}
4764--5908[label="1;149pkt 149fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="71.40.210.227"/>
      <filter dst_port="1026" src_ip="71.40.210.227"/>
    </slice>
    <from sec="1123477483" usec="0"/>
    <to sec="1123477714" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_899{
style=filled;
color=gray75;
4765[label="158.47.16.228;3pkt 3fpkt", shape=pentagon, color=darkviolet];
5909[label="158.47.16.228;3pkt 3fpkt", shape=invtriangle, color=brown];
6550[label="158.47.16.228;3pkt 3fpkt", shape=invhouse, color=bisque];
stat899[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.47.16.228:3067, 207.71.176.3:5190}[33.3333%]&lt;BR/&gt;{158.47.16.228:3068, 207.71.69.45:5190}[33.3333%]&lt;BR/&gt;{158.47.16.228:3064, 207.71.176.96:5190}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5190: (50%)&lt;BR/&gt; 3068: (16.6667%)&lt;BR/&gt; 3067: (16.6667%)&lt;BR/&gt; 3064: (16.6667%)&gt;];
}
4765--5909[label="1;3pkt 3fpkt"];
4765--6550[label="1;3pkt 3fpkt"];
5909--6550[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="207.71.176.96" dst_port="5190" src_ip="158.47.16.228" src_port="3064"/>
      <filter dst_ip="207.71.69.45" dst_port="5190" src_ip="158.47.16.228" src_port="3068"/>
      <filter dst_ip="207.71.176.3" dst_port="5190" src_ip="158.47.16.228" src_port="3067"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478064" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_900{
style=filled;
color=gray75;
1009[label="201.117.151.54;d;76pkt 76fpkt", shape=diamond, color=yellow];
1815[label="201.242.149.108;s;1pkt 1fpkt", shape=diamond, color=yellow];
4767[label="4.180.40.228;3pkt 3fpkt", shape=pentagon, color=darkviolet];
5911[label="4.180.40.228;3pkt 3fpkt", shape=invtriangle, color=brown];
6552[label="4.180.40.228;3pkt 3fpkt", shape=invhouse, color=bisque];
stat900[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:53, 201.117.151.54:3168}[36.8421%]&lt;BR/&gt;{*:*, 201.117.151.54:80}[22.3684%]&lt;BR/&gt;{*:*, 201.117.151.54:53}[21.0526%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (26.1628%)&lt;BR/&gt; 80: (18.0233%)&lt;BR/&gt; 3168: (16.2791%)&lt;BR/&gt; 0: (5.81395%)&lt;BR/&gt; 3282: (2.32558%)&gt;];
}
1009--1815[label="1;1pkt 1fpkt"];
1009--1914[label="0.125;1pkt 1fpkt"];
1009--3652[label="0.030303;1pkt 1fpkt"];
1009--3812[label="0.0666667;1pkt 1fpkt"];
1009--3908[label="0.0416667;1pkt 1fpkt"];
1009--4051[label="0.037037;1pkt 1fpkt"];
1009--4179[label="0.0625;1pkt 1fpkt"];
1009--4287[label="0.0294118;1pkt 1fpkt"];
1009--4672[label="0.04;1pkt 1fpkt"];
1009--4767[label="1;3pkt 3fpkt"];
1009--5396[label="0.0666667;1pkt 1fpkt"];
1009--5454[label="0.0416667;1pkt 1fpkt"];
1009--5532[label="0.037037;1pkt 1fpkt"];
1009--5863[label="0.04;1pkt 1fpkt"];
1009--5911[label="1;3pkt 3fpkt"];
1009--6320[label="0.0416667;1pkt 1fpkt"];
1009--6529[label="0.04;1pkt 1fpkt"];
1009--6552[label="1;3pkt 3fpkt"];
4767--5911[label="1;3pkt 3fpkt"];
4767--6552[label="1;3pkt 3fpkt"];
5911--6552[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="201.117.151.54" dst_port="80"/>
      <filter dst_ip="201.117.151.54" dst_port="53"/>
      <filter dst_ip="201.117.151.54" dst_port="3168" src_port="53"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="0.250.8.229"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="211.41.81.229"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_903{
style=filled;
color=gray75;
4778[label="214.160.206.229;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5919[label="214.160.206.229;1pkt 1fpkt", shape=invtriangle, color=brown];
6555[label="214.160.206.229;1pkt 1fpkt", shape=invhouse, color=bisque];
stat903[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.160.206.229:2898, 158.189.144.107:4662}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4662: (50%)&lt;BR/&gt; 2898: (50%)&gt;];
}
4778--5919[label="1;1pkt 1fpkt"];
4778--6555[label="1;1pkt 1fpkt"];
5919--6555[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="158.189.144.107" dst_port="4662" src_ip="214.160.206.229" src_port="2898"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_904{
style=filled;
color=gray75;
4783[label="70.68.244.230;4pkt 4fpkt", shape=pentagon, color=darkviolet];
5921[label="70.68.244.230;4pkt 4fpkt", shape=invtriangle, color=brown];
stat904[shape=component, label=&lt;Rules:&lt;BR/&gt;{70.68.244.230:1030, 158.189.219.32:1434}[25%]&lt;BR/&gt;{70.68.244.230:1030, 158.66.54.58:1434}[25%]&lt;BR/&gt;{70.68.244.230:1030, 172.118.221.100:1434}[25%]&lt;BR/&gt;{70.68.244.230:1030, 158.18.145.146:1434}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1434: (50%)&lt;BR/&gt; 1030: (50%)&gt;];
}
4783--5921[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="158.18.145.146" dst_port="1434" src_ip="70.68.244.230" src_port="1030"/>
      <filter dst_ip="172.118.221.100" dst_port="1434" src_ip="70.68.244.230" src_port="1030"/>
      <filter dst_ip="158.66.54.58" dst_port="1434" src_ip="70.68.244.230" src_port="1030"/>
      <filter dst_ip="158.189.219.32" dst_port="1434" src_ip="70.68.244.230" src_port="1030"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="4.169.189.233"/>
    </slice>
    <from sec="1123477568" usec="0"/>
    <to sec="1123477994" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_906{
style=filled;
color=gray75;
4806[label="201.130.230.233;8pkt 8fpkt", shape=pentagon, color=darkviolet];
5931[label="201.130.230.233;8pkt 8fpkt", shape=invtriangle, color=brown];
6561[label="201.130.230.233;8pkt 8fpkt", shape=invhouse, color=bisque];
stat906[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.130.230.233:3478, 132.117.180.126:*}[50%]&lt;BR/&gt;{201.130.230.233:3478, *:1045}[25%]&lt;BR/&gt;{201.130.230.233:3478, 132.117.181.203:*}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3478: (50%)&lt;BR/&gt; 1045: (12.5%)&lt;BR/&gt; 37845: (6.25%)&lt;BR/&gt; 4998: (6.25%)&lt;BR/&gt; 1069: (6.25%)&gt;];
}
4806--5931[label="1;8pkt 8fpkt"];
4806--6561[label="1;8pkt 8fpkt"];
5931--6561[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="132.117.180.126" src_ip="201.130.230.233" src_port="3478"/>
      <filter dst_ip="132.117.181.203" src_ip="201.130.230.233" src_port="3478"/>
      <filter dst_port="1045" src_ip="201.130.230.233" src_port="3478"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="215.204.55.235"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="211.35.156.235"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,504,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_909{
style=filled;
color=gray75;
1688[label="152.21.170.133;s;93pkt 93fpkt", shape=diamond, color=yellow];
1883[label="207.71.20.9;d;33pkt 33fpkt", shape=diamond, color=yellow];
2338[label="152.21.133.143;s;54pkt 54fpkt", shape=diamond, color=yellow];
4056[label="152.21.170.133;93pkt 93fpkt", shape=pentagon, color=darkviolet];
4144[label="152.21.133.143;54pkt 54fpkt", shape=pentagon, color=darkviolet];
4819[label="152.21.205.235;23pkt 23fpkt", shape=pentagon, color=darkviolet];
5535[label="152.21.170.133;93pkt 93fpkt", shape=invtriangle, color=brown];
5939[label="152.21.205.235;23pkt 23fpkt", shape=invtriangle, color=brown];
6363[label="152.21.170.133;93pkt 93fpkt", shape=invhouse, color=bisque];
stat909[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.133.143:*, *:80}[26.4706%]&lt;BR/&gt;{*:*, *:443}[24.7059%]&lt;BR/&gt;{*:*, 4.138.146.170:*}[21.7647%]&lt;BR/&gt;{152.21.170.133:*, 207.71.12.92:80}[21.1765%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (38.1932%)&lt;BR/&gt; 443: (11.8068%)&lt;BR/&gt; 1227: (0.447227%)&lt;BR/&gt; 1226: (0.447227%)&lt;BR/&gt; 1225: (0.447227%)&gt;];
}
1688--1883[label="0.69697;23pkt 23fpkt"];
1688--2885[label="0.0430108;4pkt 4fpkt"];
1688--2899[label="0.0430108;4pkt 4fpkt"];
1688--2909[label="0.0430108;4pkt 4fpkt"];
1688--4056[label="1;93pkt 93fpkt"];
1688--5535[label="1;93pkt 93fpkt"];
1688--6363[label="1;93pkt 93fpkt"];
1883--2338[label="0.121212;4pkt 4fpkt"];
1883--2885[label="0.0909091;3pkt 3fpkt"];
1883--2899[label="0.0909091;3pkt 3fpkt"];
1883--2909[label="0.0909091;3pkt 3fpkt"];
1883--4056[label="0.69697;23pkt 23fpkt"];
1883--4144[label="0.121212;4pkt 4fpkt"];
1883--4819[label="0.26087;6pkt 6fpkt"];
1883--5535[label="0.69697;23pkt 23fpkt"];
1883--5939[label="0.26087;6pkt 6fpkt"];
1883--6363[label="0.69697;23pkt 23fpkt"];
2338--2885[label="0.0925926;5pkt 5fpkt"];
2338--2899[label="0.0925926;5pkt 5fpkt"];
2338--2909[label="0.0925926;5pkt 5fpkt"];
2338--4144[label="1;54pkt 54fpkt"];
4056--5535[label="1;93pkt 93fpkt"];
4056--6363[label="1;93pkt 93fpkt"];
4819--5939[label="1;23pkt 23fpkt"];
5535--6363[label="1;93pkt 93fpkt"];
</description>
    <slice>
      <filter dst_ip="4.138.146.170"/>
      <filter dst_port="443"/>
      <filter dst_port="80" src_ip="152.21.133.143"/>
      <filter dst_ip="207.71.12.92" dst_port="80" src_ip="152.21.170.133"/>
    </slice>
    <from sec="1123477471" usec="0"/>
    <to sec="1123478062" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_910{
style=filled;
color=gray75;
4825[label="71.34.68.237;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5942[label="71.34.68.237;1pkt 1fpkt", shape=invtriangle, color=brown];
6570[label="71.34.68.237;1pkt 1fpkt", shape=invhouse, color=bisque];
stat910[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.34.68.237:4144, 158.189.144.107:4662}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4662: (50%)&lt;BR/&gt; 4144: (50%)&gt;];
}
4825--5942[label="1;1pkt 1fpkt"];
4825--6570[label="1;1pkt 1fpkt"];
5942--6570[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="158.189.144.107" dst_port="4662" src_ip="71.34.68.237" src_port="4144"/>
    </slice>
    <from sec="1123477367" usec="0"/>
    <to sec="1123478089" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_911{
style=filled;
color=gray75;
4826[label="211.42.77.237;203pkt 203fpkt", shape=pentagon, color=darkviolet];
5944[label="211.42.77.237;203pkt 203fpkt", shape=invtriangle, color=brown];
6571[label="211.42.77.237;203pkt 203fpkt", shape=invhouse, color=bisque];
stat911[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.42.77.237:*, *:445}[51.7241%]&lt;BR/&gt;{211.42.77.237:*, *:139}[47.2906%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (25.8621%)&lt;BR/&gt; 139: (23.6453%)&lt;BR/&gt; 62463: (0.492611%)&lt;BR/&gt; 62117: (0.492611%)&lt;BR/&gt; 137: (0.492611%)&gt;];
}
4826--5944[label="1;203pkt 203fpkt"];
4826--6571[label="1;203pkt 203fpkt"];
5944--6571[label="1;203pkt 203fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="211.42.77.237"/>
      <filter dst_port="139" src_ip="211.42.77.237"/>
    </slice>
    <from sec="1123477383" usec="0"/>
    <to sec="1123478004" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_912{
style=filled;
color=gray75;
4857[label="201.182.41.242;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5963[label="201.182.41.242;2pkt 2fpkt", shape=invtriangle, color=brown];
stat912[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.182.41.242:4246, 158.189.168.199:80}[50%]&lt;BR/&gt;{201.182.41.242:4288, 158.189.168.199:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4288: (25%)&lt;BR/&gt; 4246: (25%)&gt;];
}
4857--5963[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="158.189.168.199" dst_port="80" src_ip="201.182.41.242" src_port="4288"/>
      <filter dst_ip="158.189.168.199" dst_port="80" src_ip="201.182.41.242" src_port="4246"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_913{
style=filled;
color=gray75;
4865[label="1.250.32.244;4pkt 4fpkt", shape=pentagon, color=darkviolet];
5968[label="1.250.32.244;4pkt 4fpkt", shape=invtriangle, color=brown];
stat913[shape=component, label=&lt;Rules:&lt;BR/&gt;{1.250.32.244:80, 158.47.2.142:4203}[25%]&lt;BR/&gt;{1.250.32.244:80, 158.47.2.142:4204}[25%]&lt;BR/&gt;{1.250.32.244:80, 158.47.2.142:4214}[25%]&lt;BR/&gt;{1.250.32.244:80, 158.47.2.142:4216}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4216: (12.5%)&lt;BR/&gt; 4214: (12.5%)&lt;BR/&gt; 4204: (12.5%)&lt;BR/&gt; 4203: (12.5%)&gt;];
}
4865--5968[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="158.47.2.142" dst_port="4216" src_ip="1.250.32.244" src_port="80"/>
      <filter dst_ip="158.47.2.142" dst_port="4214" src_ip="1.250.32.244" src_port="80"/>
      <filter dst_ip="158.47.2.142" dst_port="4204" src_ip="1.250.32.244" src_port="80"/>
      <filter dst_ip="158.47.2.142" dst_port="4203" src_ip="1.250.32.244" src_port="80"/>
    </slice>
    <from sec="1123477893" usec="0"/>
    <to sec="1123477914" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_914{
style=filled;
color=gray75;
4867[label="152.20.87.244;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5969[label="152.20.87.244;1pkt 1fpkt", shape=invtriangle, color=brown];
6580[label="152.20.87.244;1pkt 1fpkt", shape=invhouse, color=bisque];
stat914[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.20.87.244:80, 201.75.143.12:55426}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 55426: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
4867--5969[label="1;1pkt 1fpkt"];
4867--6580[label="1;1pkt 1fpkt"];
5969--6580[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="201.75.143.12" dst_port="55426" src_ip="152.20.87.244" src_port="80"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123477431" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.486161,1.95791,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_915{
style=filled;
color=gray75;
4873[label="201.23.226.244;228pkt 228fpkt", shape=pentagon, color=darkviolet];
5971[label="201.23.226.244;228pkt 228fpkt", shape=invtriangle, color=brown];
stat915[shape=component, label=&lt;Rules:&lt;BR/&gt;{201.23.226.244:1031, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1031: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
4873--5971[label="1;228pkt 228fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="201.23.226.244" src_port="1031"/>
    </slice>
    <from sec="1123477247" usec="0"/>
    <to sec="1123477262" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_916{
style=filled;
color=gray75;
1450[label="201.117.148.244;d;6pkt 6fpkt", shape=diamond, color=yellow];
1475[label="220.185.57.72;s;2pkt 2fpkt", shape=diamond, color=yellow];
4874[label="192.134.242.244;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5972[label="192.134.242.244;1pkt 1fpkt", shape=invtriangle, color=brown];
stat916[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:21, 201.117.148.244:*}[33.3333%]&lt;BR/&gt;{220.185.57.72:*, 201.117.148.244:*}[33.3333%]&lt;BR/&gt;{82.221.30.85:*, 201.117.148.244:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 65464: (15%)&lt;BR/&gt; 80: (15%)&lt;BR/&gt; 21: (15%)&lt;BR/&gt; 65468: (10%)&lt;BR/&gt; 65467: (10%)&gt;];
}
1450--1475[label="1;2pkt 2fpkt"];
1450--4874[label="1;1pkt 1fpkt"];
1450--5972[label="1;1pkt 1fpkt"];
4874--5972[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="201.117.148.244" src_ip="82.221.30.85"/>
      <filter dst_ip="201.117.148.244" src_ip="220.185.57.72"/>
      <filter dst_ip="201.117.148.244" src_port="21"/>
    </slice>
    <from sec="1123477279" usec="0"/>
    <to sec="1123477784" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="215.224.10.245"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_918{
style=filled;
color=gray75;
4894[label="217.125.144.250;14pkt 14fpkt", shape=pentagon, color=darkviolet];
5983[label="217.125.144.250;14pkt 14fpkt", shape=invtriangle, color=brown];
6585[label="217.125.144.250;14pkt 14fpkt", shape=invhouse, color=bisque];
stat918[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.125.144.250:443, 200.89.34.98:*}[71.4286%]&lt;BR/&gt;{217.125.144.250:80, 200.89.34.98:*}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (35.7143%)&lt;BR/&gt; 80: (14.2857%)&lt;BR/&gt; 19099: (3.57143%)&lt;BR/&gt; 19020: (3.57143%)&lt;BR/&gt; 19016: (3.57143%)&gt;];
}
4894--5983[label="1;14pkt 14fpkt"];
4894--6585[label="1;14pkt 14fpkt"];
5983--6585[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter dst_ip="200.89.34.98" src_ip="217.125.144.250" src_port="443"/>
      <filter dst_ip="200.89.34.98" src_ip="217.125.144.250" src_port="80"/>
    </slice>
    <from sec="1123478033" usec="0"/>
    <to sec="1123478069" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="71.98.34.251"/>
    </slice>
    <from sec="1123477205" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.647214,1.91089,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_920{
style=filled;
color=gray75;
1795[label="132.117.238.214;d;61pkt 61fpkt", shape=diamond, color=yellow];
4860[label="211.170.195.242;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4898[label="211.41.10.252;15pkt 15fpkt", shape=pentagon, color=darkviolet];
5988[label="211.41.10.252;15pkt 15fpkt", shape=invtriangle, color=brown];
stat920[shape=component, label=&lt;Rules:&lt;BR/&gt;{211.41.10.252:*, 132.117.238.214:28897}[25.8065%]&lt;BR/&gt;{219.174.164.130:*, 132.117.238.214:443}[22.5806%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 28897: (41.8478%)&lt;BR/&gt; 443: (7.6087%)&lt;BR/&gt; 3759: (1.63043%)&lt;BR/&gt; 3758: (1.63043%)&lt;BR/&gt; 3756: (1.63043%)&gt;];
}
1795--4860[label="1;1pkt 1fpkt"];
1795--4898[label="0.933333;14pkt 14fpkt"];
1795--5988[label="0.933333;14pkt 14fpkt"];
4898--5988[label="1;15pkt 15fpkt"];
</description>
    <slice>
      <filter dst_ip="132.117.238.214" dst_port="28897" src_ip="211.41.10.252"/>
      <filter dst_ip="132.117.238.214" dst_port="443" src_ip="219.174.164.130"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_921{
style=filled;
color=gray75;
4899[label="158.47.80.252;22pkt 22fpkt", shape=pentagon, color=darkviolet];
5989[label="158.47.80.252;22pkt 22fpkt", shape=invtriangle, color=brown];
6588[label="158.47.80.252;22pkt 22fpkt", shape=invhouse, color=bisque];
stat921[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.47.80.252:*, *:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1990: (2.27273%)&lt;BR/&gt; 1989: (2.27273%)&lt;BR/&gt; 1987: (2.27273%)&lt;BR/&gt; 1986: (2.27273%)&gt;];
}
4899--5989[label="1;22pkt 22fpkt"];
4899--6588[label="1;22pkt 22fpkt"];
5989--6588[label="1;22pkt 22fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="158.47.80.252"/>
    </slice>
    <from sec="1123477638" usec="0"/>
    <to sec="1123477912" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.596717,2.02334,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="0.109.165.253"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.810728,1.88136,020,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_923{
style=filled;
color=gray75;
1533[label="201.117.150.204;d;174pkt 174fpkt", shape=diamond, color=yellow];
2454[label="201.117.145.200;d;66pkt 66fpkt", shape=diamond, color=yellow];
3469[label="206.94.198.64;19pkt 19fpkt", shape=pentagon, color=darkviolet];
4905[label="206.94.199.253;17pkt 17fpkt", shape=pentagon, color=darkviolet];
5202[label="206.94.198.64;19pkt 19fpkt", shape=invtriangle, color=brown];
5993[label="206.94.199.253;17pkt 17fpkt", shape=invtriangle, color=brown];
6171[label="206.94.198.64;19pkt 19fpkt", shape=invhouse, color=bisque];
6590[label="206.94.199.253;17pkt 17fpkt", shape=invhouse, color=bisque];
stat923[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 201.117.150.204:0}[63.9706%]&lt;BR/&gt;{*:0, 201.117.145.200:0}[24.2647%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1533--3469[label="0.0526316;1pkt 1fpkt"];
1533--4905[label="0.0588235;1pkt 1fpkt"];
1533--5202[label="0.0526316;1pkt 1fpkt"];
1533--5993[label="0.0588235;1pkt 1fpkt"];
1533--6171[label="0.0526316;1pkt 1fpkt"];
1533--6590[label="0.0588235;1pkt 1fpkt"];
2454--3469[label="0.0526316;1pkt 1fpkt"];
2454--4905[label="0.0588235;1pkt 1fpkt"];
2454--5202[label="0.0526316;1pkt 1fpkt"];
2454--5993[label="0.0588235;1pkt 1fpkt"];
2454--6171[label="0.0526316;1pkt 1fpkt"];
2454--6590[label="0.0588235;1pkt 1fpkt"];
3469--5202[label="1;19pkt 19fpkt"];
3469--6171[label="1;19pkt 19fpkt"];
4905--5993[label="1;17pkt 17fpkt"];
4905--6590[label="1;17pkt 17fpkt"];
5202--6171[label="1;19pkt 19fpkt"];
5993--6590[label="1;17pkt 17fpkt"];
</description>
    <slice>
      <filter dst_ip="201.117.150.204"/>
      <filter dst_ip="201.117.145.200"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478040" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="5.210.163.0"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.689018,1.9291,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_925{
style=filled;
color=gray75;
4305[label="212.193.3.166;157pkt 157fpkt", shape=pentagon, color=darkviolet];
4566[label="214.168.20.200;142pkt 142fpkt", shape=pentagon, color=darkviolet];
5673[label="212.193.3.166;157pkt 157fpkt", shape=invtriangle, color=brown];
5805[label="214.168.20.200;142pkt 142fpkt", shape=invtriangle, color=brown];
6498[label="214.168.20.200;142pkt 142fpkt", shape=invhouse, color=bisque];
stat925[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.193.3.166:*, *:1027}[26.7559%]&lt;BR/&gt;{212.193.3.166:*, *:1026}[25.7525%]&lt;BR/&gt;{214.168.20.200:33047, *:1026}[23.7458%]&lt;BR/&gt;{214.168.20.200:33047, *:1027}[23.7458%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 33047: (28.7838%)&lt;BR/&gt; 1027: (25.2027%)&lt;BR/&gt; 1026: (24.7973%)&lt;BR/&gt; 65334: (0.135135%)&lt;BR/&gt; 65301: (0.135135%)&gt;];
}
4305--5673[label="1;157pkt 157fpkt"];
4566--5805[label="1;142pkt 142fpkt"];
4566--6498[label="1;142pkt 142fpkt"];
5805--6498[label="1;142pkt 142fpkt"];
</description>
    <slice>
      <filter dst_port="1027" src_ip="212.193.3.166"/>
      <filter dst_port="1026" src_ip="212.193.3.166"/>
      <filter dst_port="1027" src_ip="214.168.20.200" src_port="33047"/>
      <filter dst_port="1026" src_ip="214.168.20.200" src_port="33047"/>
    </slice>
    <from sec="1123477525" usec="0"/>
    <to sec="1123477668" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="0.106.19.5"/>
    </slice>
    <from sec="1123477761" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="71.34.173.12"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="200.235.52.13"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="18.154.93.14"/>
    </slice>
    <from sec="1123477207" usec="0"/>
    <to sec="1123478095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.628792,1.96661,999,0 0 0 0 0 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_930{
style=filled;
color=gray75;
3079[label="18.129.208.16;1pkt 1fpkt", shape=pentagon, color=darkviolet];
6049[label="18.129.208.16;1pkt 1fpkt", shape=invhouse, color=bisque];
stat930[shape=component, label=&lt;Rules:&lt;BR/&gt;{18.129.208.16:4515, 175.182.147.87:22763}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 22763: (50%)&lt;BR/&gt; 4515: (50%)&gt;];
}
3079--6049[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="175.182.147.87" dst_port="22763" src_ip="18.129.208.16" src_port="4515"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.628792,1.96661,999,0 0 0 0 0 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_931{
style=filled;
color=gray75;
3098[label="71.35.166.18;1pkt 1fpkt", shape=pentagon, color=darkviolet];
6054[label="71.35.166.18;1pkt 1fpkt", shape=invhouse, color=bisque];
stat931[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.35.166.18:2663, 158.189.102.226:4110}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4110: (50%)&lt;BR/&gt; 2663: (50%)&gt;];
}
3098--6054[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="158.189.102.226" dst_port="4110" src_ip="71.35.166.18" src_port="2663"/>
    </slice>
    <from sec="1123477392" usec="0"/>
    <to sec="1123477454" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="152.20.183.19"/>
    </slice>
    <from sec="1123477805" usec="0"/>
    <to sec="1123478080" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="211.43.129.32"/>
    </slice>
    <from sec="1123477264" usec="0"/>
    <to sec="1123477746" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="211.42.2.35"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="210.138.10.35"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="214.45.80.37"/>
    </slice>
    <from sec="1123477213" usec="0"/>
    <to sec="1123478085" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="5.210.130.38"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="152.21.179.41"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="194.229.209.43"/>
    </slice>
    <from sec="1123477207" usec="0"/>
    <to sec="1123477615" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.628792,1.96661,999,0 0 0 0 0 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_940{
style=filled;
color=gray75;
3369[label="158.160.24.51;60pkt 60fpkt", shape=pentagon, color=darkviolet];
6137[label="158.160.24.51;59pkt 59fpkt", shape=invhouse, color=bisque];
stat940[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.160.24.51:11718, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 11718: (50%)&lt;BR/&gt; 65388: (0.840336%)&lt;BR/&gt; 63694: (0.840336%)&lt;BR/&gt; 61751: (0.840336%)&lt;BR/&gt; 61638: (0.840336%)&gt;];
}
3369--6137[label="1;59pkt 59fpkt"];
</description>
    <slice>
      <filter src_ip="158.160.24.51" src_port="11718"/>
    </slice>
    <from sec="1123477211" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="20.181.101.52"/>
    </slice>
    <from sec="1123477244" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="200.248.112.55"/>
    </slice>
    <from sec="1123477562" usec="0"/>
    <to sec="1123477616" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="219.113.41.67"/>
    </slice>
    <from sec="1123477235" usec="0"/>
    <to sec="1123477287" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.628792,1.96661,503,0 0 0 0 0 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_944{
style=filled;
color=gray75;
3507[label="71.120.54.68;1pkt 1fpkt", shape=pentagon, color=darkviolet];
6187[label="71.120.54.68;1pkt 1fpkt", shape=invhouse, color=bisque];
stat944[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.120.54.68:80, 200.89.34.98:19215}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 19215: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
3507--6187[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="200.89.34.98" dst_port="19215" src_ip="71.120.54.68" src_port="80"/>
    </slice>
    <from sec="1123478081" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="212.206.229.71"/>
    </slice>
    <from sec="1123477206" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.628792,1.96661,999,0 0 0 0 0 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_946{
style=filled;
color=gray75;
3555[label="158.160.192.72;68pkt 68fpkt", shape=pentagon, color=darkviolet];
6200[label="158.160.192.72;67pkt 67fpkt", shape=invhouse, color=bisque];
stat946[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.160.192.72:39278, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 39278: (50%)&lt;BR/&gt; 63019: (0.740741%)&lt;BR/&gt; 61366: (0.740741%)&lt;BR/&gt; 61309: (0.740741%)&lt;BR/&gt; 58137: (0.740741%)&gt;];
}
3555--6200[label="1;67pkt 67fpkt"];
</description>
    <slice>
      <filter src_ip="158.160.192.72" src_port="39278"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="212.184.135.75"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="211.171.48.80"/>
    </slice>
    <from sec="1123477257" usec="0"/>
    <to sec="1123478071" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="71.102.235.81"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="219.18.214.86"/>
    </slice>
    <from sec="1123477249" usec="0"/>
    <to sec="1123477350" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="215.51.105.88"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="19.149.1.91"/>
    </slice>
    <from sec="1123477226" usec="0"/>
    <to sec="1123477379" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="19.144.95.93"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="211.164.3.94"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="211.225.25.95"/>
    </slice>
    <from sec="1123477206" usec="0"/>
    <to sec="1123478081" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.628792,1.96661,999,0 0 0 0 0 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_957{
style=filled;
color=gray75;
3809[label="158.160.148.100;60pkt 60fpkt", shape=pentagon, color=darkviolet];
6288[label="158.160.148.100;59pkt 59fpkt", shape=invhouse, color=bisque];
stat957[shape=component, label=&lt;Rules:&lt;BR/&gt;{158.160.148.100:31212, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 31212: (50%)&lt;BR/&gt; 65070: (0.840336%)&lt;BR/&gt; 64865: (0.840336%)&lt;BR/&gt; 64182: (0.840336%)&lt;BR/&gt; 64095: (0.840336%)&gt;];
}
3809--6288[label="1;59pkt 59fpkt"];
</description>
    <slice>
      <filter src_ip="158.160.148.100" src_port="31212"/>
    </slice>
    <from sec="1123477211" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="71.45.39.102"/>
    </slice>
    <from sec="1123477207" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="3.19.167.104"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="170.57.177.106"/>
    </slice>
    <from sec="1123477207" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="214.43.6.108"/>
    </slice>
    <from sec="1123477958" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="68.239.150.111"/>
    </slice>
    <from sec="1123477288" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="169.169.147.120"/>
    </slice>
    <from sec="1123477258" usec="0"/>
    <to sec="1123478078" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="70.201.214.130"/>
    </slice>
    <from sec="1123477298" usec="0"/>
    <to sec="1123477358" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="205.45.85.132"/>
    </slice>
    <from sec="1123477223" usec="0"/>
    <to sec="1123478093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="158.189.179.133"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123477642" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="98.138.11.137"/>
    </slice>
    <from sec="1123477304" usec="0"/>
    <to sec="1123478008" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.881475,1.94936,503,0 0 0 1 0 0 0 0 0 0 1 1 ">
    <description>subgraph cluster_968{
style=filled;
color=gray75;
1924[label="152.21.170.137;s;67pkt 67fpkt", shape=diamond, color=yellow];
5555[label="152.21.170.137;69pkt 69fpkt", shape=invtriangle, color=brown];
6373[label="152.21.170.137;69pkt 69fpkt", shape=invhouse, color=bisque];
stat968[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.21.170.137:*, 195.26.147.133:80}[65.2778%]&lt;BR/&gt;{152.21.170.137:*, 5.97.17.70:80}[31.9444%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1690: (0.731707%)&lt;BR/&gt; 1689: (0.731707%)&lt;BR/&gt; 1688: (0.731707%)&lt;BR/&gt; 1687: (0.731707%)&gt;];
}
1924--2875[label="0.0149254;1pkt 1fpkt"];
1924--5555[label="0.955224;64pkt 64fpkt"];
1924--6373[label="0.955224;64pkt 64fpkt"];
5555--6373[label="1;69pkt 69fpkt"];
</description>
    <slice>
      <filter dst_ip="195.26.147.133" dst_port="80" src_ip="152.21.170.137"/>
      <filter dst_ip="5.97.17.70" dst_port="80" src_ip="152.21.170.137"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478090" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="169.169.193.144"/>
    </slice>
    <from sec="1123477205" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="64.55.165.146"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="5.170.142.148"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,504,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="212.108.60.154"/>
    </slice>
    <from sec="1123477204" usec="0"/>
    <to sec="1123478098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="98.9.213.158"/>
    </slice>
    <from sec="1123477976" usec="0"/>
    <to sec="1123478012" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="211.202.121.161"/>
    </slice>
    <from sec="1123477223" usec="0"/>
    <to sec="1123478095" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="1.56.20.165"/>
    </slice>
    <from sec="1123477211" usec="0"/>
    <to sec="1123478086" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="170.67.124.173"/>
    </slice>
    <from sec="1123477501" usec="0"/>
    <to sec="1123477773" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="1.60.191.176"/>
    </slice>
    <from sec="1123477266" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="169.169.203.178"/>
    </slice>
    <from sec="1123477212" usec="0"/>
    <to sec="1123478088" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="70.107.118.191"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123477554" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="169.169.232.197"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123477392" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="69.26.13.208"/>
    </slice>
    <from sec="1123477205" usec="0"/>
    <to sec="1123478093" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="172.118.94.210"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="2.217.178.210"/>
    </slice>
    <from sec="1123477201" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="201.24.149.213"/>
    </slice>
    <from sec="1123477341" usec="0"/>
    <to sec="1123477385" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="16.50.137.217"/>
    </slice>
    <from sec="1123477208" usec="0"/>
    <to sec="1123478089" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="169.169.232.224"/>
    </slice>
    <from sec="1123477209" usec="0"/>
    <to sec="1123478099" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="221.205.249.224"/>
    </slice>
    <from sec="1123477203" usec="0"/>
    <to sec="1123478100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="0.250.8.229"/>
    </slice>
    <from sec="1123478100" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.760206,1.9198,010,0 0 0 1 0 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_989{
style=filled;
color=gray75;
976[label="71.108.121.233;s;1205pkt 1205fpkt", shape=diamond, color=yellow];
4799[label="71.108.121.233;2pkt 2fpkt", shape=pentagon, color=darkviolet];
6558[label="71.108.121.233;1299pkt 1299fpkt", shape=invhouse, color=bisque];
stat989[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.108.121.233:80, *:*}[98.6973%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.3615%)&lt;BR/&gt; 3389: (0.518755%)&lt;BR/&gt; 0: (0.239425%)&lt;BR/&gt; 55644: (0.0798085%)&lt;BR/&gt; 54624: (0.0798085%)&gt;];
}
976--6558[label="0.995021;1199pkt 1199fpkt"];
4799--6558[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_ip="71.108.121.233" src_port="80"/>
    </slice>
    <from sec="1123477200" usec="0"/>
    <to sec="1123478101" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.717703,2.03176,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="220.81.133.234"/>
    </slice>
    <from sec="1123477215" usec="0"/>
    <to sec="1123478095" usec="0"/>
  </anomaly>

</admd:annotation>
