<?xml version="1.0" encoding="UTF-8" standalone="no" ?>
<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="80" proto="tcp" src_ip="164.232.94.2" src_port="80"/>
      <filter dst_port="80" proto="udp" src_ip="164.232.94.2" src_port="80"/>
      <filter dst_port="25" proto="tcp" src_ip="164.232.94.2" src_port="80"/>
      <filter dst_port="25" proto="udp" src_ip="164.232.94.2" src_port="80"/>
      <filter dst_port="53" proto="tcp" src_ip="164.232.94.2" src_port="80"/>
      <filter dst_port="53" proto="udp" src_ip="164.232.94.2" src_port="80"/>
      <from sec="1204520404" usec="0"/>
      <to sec="1204521290" usec="0"/>
    </slice>
    <from sec="1204520404" usec="0"/>
    <to sec="1204521290" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,503,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="162.69.14.98" dst_port="80" proto="tcp" src_ip="156.120.155.8" src_port="35784"/>
      <filter dst_ip="162.69.14.98" dst_port="80" proto="udp" src_ip="156.120.155.8" src_port="35784"/>
      <filter dst_ip="162.69.14.98" dst_port="25" proto="tcp" src_ip="156.120.155.8" src_port="35784"/>
      <filter dst_ip="162.69.14.98" dst_port="25" proto="udp" src_ip="156.120.155.8" src_port="35784"/>
      <filter dst_ip="162.69.14.98" dst_port="53" proto="tcp" src_ip="156.120.155.8" src_port="35784"/>
      <filter dst_ip="162.69.14.98" dst_port="53" proto="udp" src_ip="156.120.155.8" src_port="35784"/>
      <from sec="1204521152" usec="0"/>
      <to sec="1204521155" usec="0"/>
    </slice>
    <from sec="1204521150" usec="0"/>
    <to sec="1204521155" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="164.232.188.179" dst_port="80" proto="tcp" src_ip="84.217.233.14" src_port="80"/>
      <filter dst_ip="164.232.188.179" dst_port="80" proto="udp" src_ip="84.217.233.14" src_port="80"/>
      <filter dst_ip="164.232.188.179" dst_port="53" proto="tcp" src_ip="84.217.233.14" src_port="80"/>
      <filter dst_ip="164.232.188.179" dst_port="53" proto="udp" src_ip="84.217.233.14" src_port="80"/>
      <filter dst_ip="164.232.188.179" dst_port="25" proto="tcp" src_ip="84.217.233.14" src_port="80"/>
      <filter dst_ip="164.232.188.179" dst_port="25" proto="udp" src_ip="84.217.233.14" src_port="80"/>
      <from sec="1204520741" usec="0"/>
      <to sec="1204520743" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="164.232.188.179" dst_port="80" proto="tcp" src_ip="156.103.129.30" src_port="80"/>
      <filter dst_ip="164.232.188.179" dst_port="80" proto="udp" src_ip="156.103.129.30" src_port="80"/>
      <filter dst_ip="164.232.188.179" dst_port="53" proto="tcp" src_ip="156.103.129.30" src_port="80"/>
      <filter dst_ip="164.232.188.179" dst_port="53" proto="udp" src_ip="156.103.129.30" src_port="80"/>
      <filter dst_ip="164.232.188.179" dst_port="25" proto="tcp" src_ip="156.103.129.30" src_port="80"/>
      <filter dst_ip="164.232.188.179" dst_port="25" proto="udp" src_ip="156.103.129.30" src_port="80"/>
      <from sec="1204520739" usec="0"/>
      <to sec="1204520744" usec="0"/>
    </slice>
    <from sec="1204520739" usec="0"/>
    <to sec="1204520744" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="80" proto="tcp" src_ip="197.33.211.34" src_port="3128"/>
      <filter dst_port="80" proto="tcp" src_ip="197.33.211.34" src_port="3127"/>
      <filter dst_port="80" proto="tcp" src_ip="197.33.211.34" src_port="3124"/>
      <filter dst_port="80" proto="tcp" src_ip="197.33.211.34" src_port="8080"/>
      <from sec="1204520428" usec="0"/>
      <to sec="1204521200" usec="0"/>
    </slice>
    <from sec="1204520428" usec="0"/>
    <to sec="1204521200" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,999,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="164.232.176.250" dst_port="113" proto="tcp" src_ip="84.125.136.158" src_port="2653"/>
      <filter dst_ip="164.232.176.250" dst_port="113" proto="udp" src_ip="84.125.136.158" src_port="2653"/>
      <filter dst_ip="164.232.176.250" dst_port="25" proto="tcp" src_ip="84.125.136.158" src_port="2653"/>
      <filter dst_ip="164.232.176.250" dst_port="25" proto="udp" src_ip="84.125.136.158" src_port="2653"/>
      <filter dst_ip="164.232.176.250" dst_port="80" proto="tcp" src_ip="84.125.136.158" src_port="2653"/>
      <filter dst_ip="164.232.176.250" dst_port="80" proto="udp" src_ip="84.125.136.158" src_port="2653"/>
      <filter dst_ip="164.232.176.250" dst_port="53" proto="tcp" src_ip="84.125.136.158" src_port="2653"/>
      <filter dst_ip="164.232.176.250" dst_port="53" proto="udp" src_ip="84.125.136.158" src_port="2653"/>
      <from sec="1204521264" usec="0"/>
      <to sec="1204521286" usec="0"/>
    </slice>
    <from sec="1204521264" usec="0"/>
    <to sec="1204521286" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,503,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="217.74.150.215" dst_port="80" proto="tcp" src_ip="153.253.116.185" src_port="2387"/>
      <filter dst_ip="217.74.150.215" dst_port="80" proto="udp" src_ip="153.253.116.185" src_port="2387"/>
      <filter dst_ip="217.74.150.215" dst_port="53" proto="tcp" src_ip="153.253.116.185" src_port="2387"/>
      <filter dst_ip="217.74.150.215" dst_port="53" proto="udp" src_ip="153.253.116.185" src_port="2387"/>
      <filter dst_ip="217.74.150.215" dst_port="25" proto="tcp" src_ip="153.253.116.185" src_port="2387"/>
      <filter dst_ip="217.74.150.215" dst_port="25" proto="udp" src_ip="153.253.116.185" src_port="2387"/>
      <filter dst_ip="222.87.83.19" dst_port="80" proto="tcp" src_ip="153.253.116.185" src_port="2387"/>
      <filter dst_ip="222.87.83.19" dst_port="80" proto="udp" src_ip="153.253.116.185" src_port="2387"/>
      <filter dst_ip="222.87.83.19" dst_port="53" proto="tcp" src_ip="153.253.116.185" src_port="2387"/>
      <filter dst_ip="222.87.83.19" dst_port="53" proto="udp" src_ip="153.253.116.185" src_port="2387"/>
      <filter dst_ip="222.87.83.19" dst_port="25" proto="tcp" src_ip="153.253.116.185" src_port="2387"/>
      <filter dst_ip="222.87.83.19" dst_port="25" proto="udp" src_ip="153.253.116.185" src_port="2387"/>
      <from sec="1204520400" usec="0"/>
      <to sec="1204521262" usec="0"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521262" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="153.253.86.14" dst_port="80" proto="tcp" src_ip="71.48.131.189" src_port="80"/>
      <filter dst_ip="215.1.32.51" dst_port="80" proto="tcp" src_ip="71.48.131.189" src_port="80"/>
      <from sec="1204520613" usec="0"/>
      <to sec="1204520631" usec="0"/>
    </slice>
    <from sec="1204520613" usec="0"/>
    <to sec="1204520631" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_port="25" proto="tcp" src_ip="197.33.208.206" src_port="80"/>
      <filter dst_port="25" proto="udp" src_ip="197.33.208.206" src_port="80"/>
      <filter dst_port="80" proto="tcp" src_ip="197.33.208.206" src_port="80"/>
      <filter dst_port="80" proto="udp" src_ip="197.33.208.206" src_port="80"/>
      <from sec="1204520438" usec="0"/>
      <to sec="1204521299" usec="0"/>
    </slice>
    <from sec="1204520438" usec="0"/>
    <to sec="1204521299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="223.187.211.10" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <from sec="1204520499" usec="0"/>
      <to sec="1204521271" usec="0"/>
    </slice>
    <from sec="1204520499" usec="0"/>
    <to sec="1204521271" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="156.103.129.30" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <from sec="1204520407" usec="0"/>
      <to sec="1204521296" usec="0"/>
    </slice>
    <from sec="1204520407" usec="0"/>
    <to sec="1204521296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="197.33.218.30" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <from sec="1204520462" usec="0"/>
      <to sec="1204521251" usec="0"/>
    </slice>
    <from sec="1204520462" usec="0"/>
    <to sec="1204521251" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="196.252.58.42" proto="tcp" src_ip="196.252.58.42" src_port="8080"/>
      <filter dst_ip="196.252.58.42" proto="icmp" src_ip="196.252.58.42" src_port="8080"/>
      <filter dst_ip="196.252.58.42" proto="tcp" src_ip="196.252.58.42" src_port="8080"/>
      <filter dst_ip="196.252.58.42" proto="icmp" src_ip="196.252.58.42" src_port="8080"/>
      <filter dst_ip="196.252.58.42" proto="tcp" src_ip="196.252.58.42" src_port="8080"/>
      <filter dst_ip="196.252.58.42" proto="icmp" src_ip="196.252.58.42" src_port="8080"/>
      <filter dst_ip="196.252.58.42" proto="tcp" src_ip="196.252.58.42" src_port="8080"/>
      <filter dst_ip="196.252.58.42" proto="icmp" src_ip="196.252.58.42" src_port="8080"/>
      <filter dst_ip="196.252.58.42" proto="tcp" src_ip="196.252.58.42" src_port="6588"/>
      <filter dst_ip="196.252.58.42" proto="icmp" src_ip="196.252.58.42" src_port="6588"/>
      <filter dst_ip="196.252.58.42" proto="tcp" src_ip="196.252.58.42" src_port="6588"/>
      <filter dst_ip="196.252.58.42" proto="icmp" src_ip="196.252.58.42" src_port="6588"/>
      <filter dst_ip="196.252.58.42" proto="tcp" src_ip="196.252.58.42" src_port="6588"/>
      <filter dst_ip="196.252.58.42" proto="icmp" src_ip="196.252.58.42" src_port="6588"/>
      <filter dst_ip="196.252.58.42" proto="tcp" src_ip="196.252.58.42" src_port="6588"/>
      <filter dst_ip="196.252.58.42" proto="icmp" src_ip="196.252.58.42" src_port="6588"/>
      <filter dst_ip="196.252.58.42" proto="tcp" src_ip="196.252.58.42" src_port="3128"/>
      <filter dst_ip="196.252.58.42" proto="icmp" src_ip="196.252.58.42" src_port="3128"/>
      <filter dst_ip="196.252.58.42" proto="tcp" src_ip="196.252.58.42" src_port="3128"/>
      <filter dst_ip="196.252.58.42" proto="icmp" src_ip="196.252.58.42" src_port="3128"/>
      <filter dst_ip="196.252.58.42" proto="tcp" src_ip="196.252.58.42" src_port="3128"/>
      <filter dst_ip="196.252.58.42" proto="icmp" src_ip="196.252.58.42" src_port="3128"/>
      <filter dst_ip="196.252.58.42" proto="tcp" src_ip="196.252.58.42" src_port="3128"/>
      <filter dst_ip="196.252.58.42" proto="icmp" src_ip="196.252.58.42" src_port="3128"/>
      <from sec="1204520657" usec="0"/>
      <to sec="1204521264" usec="0"/>
    </slice>
    <from sec="1204520657" usec="0"/>
    <to sec="1204521264" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="153.253.210.42" dst_port="80" proto="tcp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="80" proto="udp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="80" proto="tcp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="80" proto="udp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="80" proto="tcp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="80" proto="udp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="80" proto="tcp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="80" proto="udp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="443" proto="tcp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="443" proto="udp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="443" proto="tcp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="443" proto="udp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="443" proto="tcp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="443" proto="udp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="443" proto="tcp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="443" proto="udp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="25" proto="tcp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="25" proto="udp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="25" proto="tcp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="25" proto="udp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="25" proto="tcp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="25" proto="udp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="25" proto="tcp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="25" proto="udp" src_ip="153.253.210.42"/>
      <from sec="1204520469" usec="0"/>
      <to sec="1204521277" usec="0"/>
    </slice>
    <from sec="1204520469" usec="0"/>
    <to sec="1204521277" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="197.33.220.72" dst_port="21" proto="tcp" src_ip="197.33.220.72"/>
      <filter dst_ip="197.33.220.72" dst_port="21" proto="tcp" src_ip="197.33.220.72"/>
      <filter dst_ip="197.33.220.72" dst_port="21" proto="tcp" src_ip="197.33.220.72"/>
      <filter dst_ip="197.33.220.72" dst_port="21" proto="tcp" src_ip="197.33.220.72"/>
      <filter dst_ip="197.33.220.72" dst_port="25" proto="tcp" src_ip="197.33.220.72"/>
      <filter dst_ip="197.33.220.72" dst_port="25" proto="tcp" src_ip="197.33.220.72"/>
      <filter dst_ip="197.33.220.72" dst_port="25" proto="tcp" src_ip="197.33.220.72"/>
      <filter dst_ip="197.33.220.72" dst_port="25" proto="tcp" src_ip="197.33.220.72"/>
      <filter dst_ip="197.33.220.72" dst_port="80" proto="tcp" src_ip="197.33.220.72"/>
      <filter dst_ip="197.33.220.72" dst_port="80" proto="tcp" src_ip="197.33.220.72"/>
      <filter dst_ip="197.33.220.72" dst_port="80" proto="tcp" src_ip="197.33.220.72"/>
      <filter dst_ip="197.33.220.72" dst_port="80" proto="tcp" src_ip="197.33.220.72"/>
      <from sec="1204520417" usec="0"/>
      <to sec="1204521237" usec="0"/>
    </slice>
    <from sec="1204520417" usec="0"/>
    <to sec="1204521237" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="71.48.131.189" dst_port="80" proto="tcp" src_ip="71.48.131.189" src_port="2992"/>
      <filter dst_ip="71.48.131.189" dst_port="80" proto="tcp" src_ip="71.48.131.189" src_port="2992"/>
      <filter dst_ip="71.48.131.189" dst_port="80" proto="tcp" src_ip="71.48.131.189" src_port="2992"/>
      <filter dst_ip="71.48.131.189" dst_port="80" proto="tcp" src_ip="71.48.131.189" src_port="2992"/>
      <from sec="1204520404" usec="0"/>
      <to sec="1204520890" usec="0"/>
    </slice>
    <from sec="1204520404" usec="0"/>
    <to sec="1204520890" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="196.16.199.248" dst_port="80" proto="tcp" src_ip="196.16.199.248" src_port="80"/>
      <filter dst_ip="196.16.199.248" dst_port="80" proto="udp" src_ip="196.16.199.248" src_port="80"/>
      <filter dst_ip="196.16.199.248" dst_port="80" proto="tcp" src_ip="196.16.199.248" src_port="80"/>
      <filter dst_ip="196.16.199.248" dst_port="80" proto="udp" src_ip="196.16.199.248" src_port="80"/>
      <filter dst_ip="196.16.199.248" dst_port="80" proto="tcp" src_ip="196.16.199.248" src_port="80"/>
      <filter dst_ip="196.16.199.248" dst_port="80" proto="udp" src_ip="196.16.199.248" src_port="80"/>
      <filter dst_ip="196.16.199.248" dst_port="80" proto="tcp" src_ip="196.16.199.248" src_port="80"/>
      <filter dst_ip="196.16.199.248" dst_port="80" proto="udp" src_ip="196.16.199.248" src_port="80"/>
      <filter dst_ip="196.16.199.248" dst_port="25" proto="tcp" src_ip="196.16.199.248" src_port="80"/>
      <filter dst_ip="196.16.199.248" dst_port="25" proto="udp" src_ip="196.16.199.248" src_port="80"/>
      <filter dst_ip="196.16.199.248" dst_port="25" proto="tcp" src_ip="196.16.199.248" src_port="80"/>
      <filter dst_ip="196.16.199.248" dst_port="25" proto="udp" src_ip="196.16.199.248" src_port="80"/>
      <filter dst_ip="196.16.199.248" dst_port="25" proto="tcp" src_ip="196.16.199.248" src_port="80"/>
      <filter dst_ip="196.16.199.248" dst_port="25" proto="udp" src_ip="196.16.199.248" src_port="80"/>
      <filter dst_ip="196.16.199.248" dst_port="25" proto="tcp" src_ip="196.16.199.248" src_port="80"/>
      <filter dst_ip="196.16.199.248" dst_port="25" proto="udp" src_ip="196.16.199.248" src_port="80"/>
      <from sec="1204520419" usec="0"/>
      <to sec="1204521248" usec="0"/>
    </slice>
    <from sec="1204520419" usec="0"/>
    <to sec="1204521248" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.35" src_port="3124"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.35" src_port="3124"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.35" src_port="3124"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.35" src_port="3124"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.35" src_port="3128"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.35" src_port="3128"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.35" src_port="3128"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.35" src_port="3128"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.35" src_port="3127"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.35" src_port="3127"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.35" src_port="3127"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.35" src_port="3127"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.45" src_port="3124"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.45" src_port="3124"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.45" src_port="3124"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.45" src_port="3124"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.45" src_port="3128"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.45" src_port="3128"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.45" src_port="3128"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.45" src_port="3128"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.45" src_port="3127"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.45" src_port="3127"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.45" src_port="3127"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.45" src_port="3127"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="164.232.94.121" src_port="3124"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="164.232.94.121" src_port="3124"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="164.232.94.121" src_port="3124"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="164.232.94.121" src_port="3124"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="164.232.94.121" src_port="3128"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="164.232.94.121" src_port="3128"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="164.232.94.121" src_port="3128"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="164.232.94.121" src_port="3128"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="164.232.94.121" src_port="3127"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="164.232.94.121" src_port="3127"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="164.232.94.121" src_port="3127"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="164.232.94.121" src_port="3127"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.34" src_port="3124"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.34" src_port="3124"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.34" src_port="3124"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.34" src_port="3124"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.34" src_port="3128"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.34" src_port="3128"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.34" src_port="3128"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.34" src_port="3128"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.34" src_port="3127"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.34" src_port="3127"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.34" src_port="3127"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="197.33.211.34" src_port="3127"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="3124"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="3124"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="3124"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="3124"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="3128"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="3128"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="3128"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="3128"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="3127"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="3127"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="3127"/>
      <filter dst_ip="215.42.195.49" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="3127"/>
      <from sec="1204521027" usec="0"/>
      <to sec="1204521030" usec="0"/>
    </slice>
    <from sec="1204521027" usec="0"/>
    <to sec="1204521030" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="12.48.64.67" proto="icmp" src_ip="156.131.208.36"/>
      <filter dst_ip="12.48.64.67" proto="icmp" src_ip="156.131.208.36"/>
      <filter dst_ip="12.48.64.67" proto="icmp" src_ip="156.131.208.36"/>
      <filter dst_ip="12.48.64.67" proto="icmp" src_ip="156.131.208.36"/>
      <filter dst_ip="12.48.64.67" proto="icmp" src_ip="197.33.208.145"/>
      <filter dst_ip="12.48.64.67" proto="icmp" src_ip="197.33.208.145"/>
      <filter dst_ip="12.48.64.67" proto="icmp" src_ip="197.33.208.145"/>
      <filter dst_ip="12.48.64.67" proto="icmp" src_ip="197.33.208.145"/>
      <from sec="1204520715" usec="0"/>
      <to sec="1204520720" usec="0"/>
    </slice>
    <from sec="1204520715" usec="0"/>
    <to sec="1204520721" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,999,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="197.33.211.45" dst_port="3127" proto="tcp" src_ip="46.104.165.123"/>
      <filter dst_ip="197.33.211.45" dst_port="3128" proto="tcp" src_ip="46.104.165.123"/>
      <filter dst_ip="197.33.211.45" dst_port="3124" proto="tcp" src_ip="46.104.165.123"/>
      <filter dst_ip="197.33.211.35" dst_port="3127" proto="tcp" src_ip="46.104.165.123"/>
      <filter dst_ip="197.33.211.35" dst_port="3128" proto="tcp" src_ip="46.104.165.123"/>
      <filter dst_ip="197.33.211.35" dst_port="3124" proto="tcp" src_ip="46.104.165.123"/>
      <filter dst_ip="197.33.211.34" dst_port="3127" proto="tcp" src_ip="46.104.165.123"/>
      <filter dst_ip="197.33.211.34" dst_port="3128" proto="tcp" src_ip="46.104.165.123"/>
      <filter dst_ip="197.33.211.34" dst_port="3124" proto="tcp" src_ip="46.104.165.123"/>
      <from sec="1204521265" usec="0"/>
      <to sec="1204521284" usec="0"/>
    </slice>
    <from sec="1204521265" usec="0"/>
    <to sec="1204521284" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,503,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="215.38.244.211" dst_port="80" proto="tcp" src_ip="153.253.88.139"/>
      <filter dst_ip="215.38.244.211" dst_port="80" proto="udp" src_ip="153.253.88.139"/>
      <filter dst_ip="215.38.244.211" dst_port="25" proto="tcp" src_ip="153.253.88.139"/>
      <filter dst_ip="215.38.244.211" dst_port="25" proto="udp" src_ip="153.253.88.139"/>
      <filter dst_ip="215.38.244.211" dst_port="53" proto="tcp" src_ip="153.253.88.139"/>
      <filter dst_ip="215.38.244.211" dst_port="53" proto="udp" src_ip="153.253.88.139"/>
      <from sec="1204521160" usec="0"/>
      <to sec="1204521164" usec="0"/>
    </slice>
    <from sec="1204521160" usec="0"/>
    <to sec="1204521164" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,503,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="45.195.10.96" dst_port="80" proto="tcp" src_ip="164.232.173.188" src_port="51621"/>
      <filter dst_ip="45.195.10.96" dst_port="80" proto="udp" src_ip="164.232.173.188" src_port="51621"/>
      <filter dst_ip="45.195.10.96" dst_port="25" proto="tcp" src_ip="164.232.173.188" src_port="51621"/>
      <filter dst_ip="45.195.10.96" dst_port="25" proto="udp" src_ip="164.232.173.188" src_port="51621"/>
      <filter dst_ip="45.195.10.96" dst_port="53" proto="tcp" src_ip="164.232.173.188" src_port="51621"/>
      <filter dst_ip="45.195.10.96" dst_port="53" proto="udp" src_ip="164.232.173.188" src_port="51621"/>
      <filter dst_ip="193.184.130.87" dst_port="80" proto="tcp" src_ip="164.232.173.188" src_port="51621"/>
      <filter dst_ip="193.184.130.87" dst_port="80" proto="udp" src_ip="164.232.173.188" src_port="51621"/>
      <filter dst_ip="193.184.130.87" dst_port="25" proto="tcp" src_ip="164.232.173.188" src_port="51621"/>
      <filter dst_ip="193.184.130.87" dst_port="25" proto="udp" src_ip="164.232.173.188" src_port="51621"/>
      <filter dst_ip="193.184.130.87" dst_port="53" proto="tcp" src_ip="164.232.173.188" src_port="51621"/>
      <filter dst_ip="193.184.130.87" dst_port="53" proto="udp" src_ip="164.232.173.188" src_port="51621"/>
      <from sec="1204521244" usec="0"/>
      <to sec="1204521251" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="45.195.10.96" dst_port="80" proto="tcp" src_ip="153.253.144.22" src_port="51621"/>
      <filter dst_ip="45.195.10.96" dst_port="80" proto="udp" src_ip="153.253.144.22" src_port="51621"/>
      <filter dst_ip="45.195.10.96" dst_port="25" proto="tcp" src_ip="153.253.144.22" src_port="51621"/>
      <filter dst_ip="45.195.10.96" dst_port="25" proto="udp" src_ip="153.253.144.22" src_port="51621"/>
      <filter dst_ip="45.195.10.96" dst_port="53" proto="tcp" src_ip="153.253.144.22" src_port="51621"/>
      <filter dst_ip="45.195.10.96" dst_port="53" proto="udp" src_ip="153.253.144.22" src_port="51621"/>
      <filter dst_ip="193.184.130.87" dst_port="80" proto="tcp" src_ip="153.253.144.22" src_port="51621"/>
      <filter dst_ip="193.184.130.87" dst_port="80" proto="udp" src_ip="153.253.144.22" src_port="51621"/>
      <filter dst_ip="193.184.130.87" dst_port="25" proto="tcp" src_ip="153.253.144.22" src_port="51621"/>
      <filter dst_ip="193.184.130.87" dst_port="25" proto="udp" src_ip="153.253.144.22" src_port="51621"/>
      <filter dst_ip="193.184.130.87" dst_port="53" proto="tcp" src_ip="153.253.144.22" src_port="51621"/>
      <filter dst_ip="193.184.130.87" dst_port="53" proto="udp" src_ip="153.253.144.22" src_port="51621"/>
      <from sec="1204521247" usec="0"/>
      <to sec="1204521251" usec="0"/>
    </slice>
    <from sec="1204521241" usec="0"/>
    <to sec="1204521251" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,503,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="46.104.33.65" dst_port="80" proto="tcp" src_ip="153.253.28.205"/>
      <filter dst_ip="46.104.33.65" dst_port="80" proto="udp" src_ip="153.253.28.205"/>
      <filter dst_ip="46.104.33.65" dst_port="25" proto="tcp" src_ip="153.253.28.205"/>
      <filter dst_ip="46.104.33.65" dst_port="25" proto="udp" src_ip="153.253.28.205"/>
      <filter dst_ip="46.104.33.65" dst_port="53" proto="tcp" src_ip="153.253.28.205"/>
      <filter dst_ip="46.104.33.65" dst_port="53" proto="udp" src_ip="153.253.28.205"/>
      <from sec="1204521241" usec="0"/>
      <to sec="1204521245" usec="0"/>
    </slice>
    <from sec="1204521241" usec="0"/>
    <to sec="1204521245" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="36.109.168.120" dst_port="80" proto="tcp" src_ip="153.253.115.230" src_port="80"/>
      <filter dst_ip="36.109.168.120" dst_port="25" proto="tcp" src_ip="153.253.115.230" src_port="80"/>
      <filter dst_ip="36.109.168.120" dst_port="21" proto="tcp" src_ip="153.253.115.230" src_port="80"/>
      <from sec="1204520408" usec="0"/>
      <to sec="1204521261" usec="0"/>
    </slice>
    <from sec="1204520408" usec="0"/>
    <to sec="1204521261" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="221.20.211.190" dst_port="80" proto="tcp" src_ip="196.25.98.253" src_port="80"/>
      <filter dst_ip="221.20.211.190" dst_port="25" proto="tcp" src_ip="196.25.98.253" src_port="80"/>
      <filter dst_ip="167.81.163.190" dst_port="80" proto="tcp" src_ip="196.25.98.253" src_port="80"/>
      <filter dst_ip="167.81.163.190" dst_port="25" proto="tcp" src_ip="196.25.98.253" src_port="80"/>
      <from sec="1204521127" usec="0"/>
      <to sec="1204521138" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="221.20.211.190" dst_port="80" proto="tcp" src_ip="153.253.20.10" src_port="80"/>
      <filter dst_ip="221.20.211.190" dst_port="25" proto="tcp" src_ip="153.253.20.10" src_port="80"/>
      <filter dst_ip="167.81.163.190" dst_port="80" proto="tcp" src_ip="153.253.20.10" src_port="80"/>
      <filter dst_ip="167.81.163.190" dst_port="25" proto="tcp" src_ip="153.253.20.10" src_port="80"/>
      <from sec="1204521134" usec="0"/>
      <to sec="1204521138" usec="0"/>
    </slice>
    <from sec="1204521127" usec="0"/>
    <to sec="1204521138" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="84.179.5.22" dst_port="80" proto="tcp" src_ip="156.131.208.36"/>
      <filter dst_ip="84.179.5.22" dst_port="80" proto="icmp" src_ip="156.131.208.36"/>
      <filter dst_ip="84.179.5.22" dst_port="80" proto="tcp" src_ip="156.131.208.36"/>
      <filter dst_ip="84.179.5.22" dst_port="80" proto="icmp" src_ip="156.131.208.36"/>
      <filter dst_ip="84.179.5.22" dst_port="80" proto="tcp" src_ip="156.131.208.36"/>
      <filter dst_ip="84.179.5.22" dst_port="80" proto="icmp" src_ip="156.131.208.36"/>
      <filter dst_ip="84.179.5.22" dst_port="80" proto="tcp" src_ip="156.131.208.36"/>
      <filter dst_ip="84.179.5.22" dst_port="80" proto="icmp" src_ip="156.131.208.36"/>
      <from sec="1204521235" usec="0"/>
      <to sec="1204521266" usec="0"/>
    </slice>
    <from sec="1204521235" usec="0"/>
    <to sec="1204521266" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="195.49.211.43" dst_port="25" proto="tcp" src_ip="195.49.211.43" src_port="32095"/>
      <filter dst_ip="195.49.211.43" dst_port="25" proto="tcp" src_ip="195.49.211.43" src_port="32095"/>
      <filter dst_ip="195.49.211.43" dst_port="25" proto="tcp" src_ip="195.49.211.43" src_port="32095"/>
      <filter dst_ip="195.49.211.43" dst_port="25" proto="tcp" src_ip="195.49.211.43" src_port="32095"/>
      <filter dst_ip="195.49.211.43" dst_port="80" proto="tcp" src_ip="195.49.211.43" src_port="32095"/>
      <filter dst_ip="195.49.211.43" dst_port="80" proto="tcp" src_ip="195.49.211.43" src_port="32095"/>
      <filter dst_ip="195.49.211.43" dst_port="80" proto="tcp" src_ip="195.49.211.43" src_port="32095"/>
      <filter dst_ip="195.49.211.43" dst_port="80" proto="tcp" src_ip="195.49.211.43" src_port="32095"/>
      <from sec="1204520589" usec="0"/>
      <to sec="1204521225" usec="0"/>
    </slice>
    <from sec="1204520588" usec="0"/>
    <to sec="1204521225" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="196.16.238.94" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="196.16.238.94" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="196.16.238.94" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="196.16.238.94" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="196.16.238.94" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="196.16.238.94" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="196.16.238.94" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="196.16.238.94" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="196.16.238.94" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="196.16.238.94" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="196.16.238.94" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="196.16.238.94" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="196.16.238.94" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="196.16.238.94" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="196.16.238.94" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="196.16.238.94" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="196.16.238.94" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="196.16.238.94" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="196.16.238.94" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="196.16.238.94" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="196.16.238.94" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="196.16.238.94" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="196.16.238.94" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="196.16.238.94" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <from sec="1204520537" usec="0"/>
      <to sec="1204521274" usec="0"/>
    </slice>
    <from sec="1204520537" usec="0"/>
    <to sec="1204521274" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="221.139.95.167" dst_port="25" proto="tcp" src_ip="221.139.95.167"/>
      <filter dst_ip="221.139.95.167" dst_port="25" proto="udp" src_ip="221.139.95.167"/>
      <filter dst_ip="221.139.95.167" dst_port="25" proto="tcp" src_ip="221.139.95.167"/>
      <filter dst_ip="221.139.95.167" dst_port="25" proto="udp" src_ip="221.139.95.167"/>
      <filter dst_ip="221.139.95.167" dst_port="25" proto="tcp" src_ip="221.139.95.167"/>
      <filter dst_ip="221.139.95.167" dst_port="25" proto="udp" src_ip="221.139.95.167"/>
      <filter dst_ip="221.139.95.167" dst_port="25" proto="tcp" src_ip="221.139.95.167"/>
      <filter dst_ip="221.139.95.167" dst_port="25" proto="udp" src_ip="221.139.95.167"/>
      <filter dst_ip="221.139.95.167" dst_port="53" proto="tcp" src_ip="221.139.95.167"/>
      <filter dst_ip="221.139.95.167" dst_port="53" proto="udp" src_ip="221.139.95.167"/>
      <filter dst_ip="221.139.95.167" dst_port="53" proto="tcp" src_ip="221.139.95.167"/>
      <filter dst_ip="221.139.95.167" dst_port="53" proto="udp" src_ip="221.139.95.167"/>
      <filter dst_ip="221.139.95.167" dst_port="53" proto="tcp" src_ip="221.139.95.167"/>
      <filter dst_ip="221.139.95.167" dst_port="53" proto="udp" src_ip="221.139.95.167"/>
      <filter dst_ip="221.139.95.167" dst_port="53" proto="tcp" src_ip="221.139.95.167"/>
      <filter dst_ip="221.139.95.167" dst_port="53" proto="udp" src_ip="221.139.95.167"/>
      <filter dst_ip="221.139.95.167" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="221.139.95.167" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="221.139.95.167" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="221.139.95.167" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="221.139.95.167" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="221.139.95.167" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="221.139.95.167" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="221.139.95.167" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="221.139.95.167" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="221.139.95.167" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="221.139.95.167" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="221.139.95.167" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="221.139.95.167" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="221.139.95.167" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="221.139.95.167" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="221.139.95.167" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <from sec="1204520967" usec="0"/>
      <to sec="1204521248" usec="0"/>
    </slice>
    <from sec="1204520967" usec="0"/>
    <to sec="1204521248" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="214.29.71.176" dst_port="80" proto="tcp" src_ip="214.29.71.176"/>
      <filter dst_ip="214.29.71.176" dst_port="80" proto="tcp" src_ip="214.29.71.176"/>
      <filter dst_ip="214.29.71.176" dst_port="80" proto="tcp" src_ip="214.29.71.176"/>
      <filter dst_ip="214.29.71.176" dst_port="80" proto="tcp" src_ip="214.29.71.176"/>
      <filter dst_ip="214.29.71.176" dst_port="25" proto="tcp" src_ip="214.29.71.176"/>
      <filter dst_ip="214.29.71.176" dst_port="25" proto="tcp" src_ip="214.29.71.176"/>
      <filter dst_ip="214.29.71.176" dst_port="25" proto="tcp" src_ip="214.29.71.176"/>
      <filter dst_ip="214.29.71.176" dst_port="25" proto="tcp" src_ip="214.29.71.176"/>
      <from sec="1204520411" usec="0"/>
      <to sec="1204521248" usec="0"/>
    </slice>
    <from sec="1204520411" usec="0"/>
    <to sec="1204521248" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="34.168.58.195" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="43041"/>
      <filter dst_ip="34.168.58.195" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="43041"/>
      <filter dst_ip="34.168.58.195" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="43041"/>
      <filter dst_ip="34.168.58.195" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="43041"/>
      <filter dst_ip="34.168.58.195" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="43041"/>
      <filter dst_ip="34.168.58.195" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="43041"/>
      <filter dst_ip="34.168.58.195" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="43041"/>
      <filter dst_ip="34.168.58.195" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="43041"/>
      <filter dst_ip="34.168.58.195" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="43041"/>
      <filter dst_ip="34.168.58.195" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="43041"/>
      <filter dst_ip="34.168.58.195" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="43041"/>
      <filter dst_ip="34.168.58.195" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="43041"/>
      <filter dst_ip="34.168.58.195" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="43041"/>
      <filter dst_ip="34.168.58.195" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="43041"/>
      <filter dst_ip="34.168.58.195" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="43041"/>
      <filter dst_ip="34.168.58.195" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="43041"/>
      <from sec="1204520620" usec="0"/>
      <to sec="1204521197" usec="0"/>
    </slice>
    <from sec="1204520620" usec="0"/>
    <to sec="1204521197" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="156.103.178.254" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="443" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="443" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="443" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="443" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="443" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="443" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="443" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.178.254" dst_port="443" proto="udp" src_ip="223.38.40.87"/>
      <from sec="1204520642" usec="0"/>
      <to sec="1204521242" usec="0"/>
    </slice>
    <from sec="1204520642" usec="0"/>
    <to sec="1204521242" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="223.187.211.254" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.254" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.254" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.254" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.254" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.254" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.254" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.254" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <from sec="1204520672" usec="0"/>
      <to sec="1204521168" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="153.253.115.230" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="153.253.115.230" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="153.253.115.230" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="153.253.115.230" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="153.253.115.230" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="153.253.115.230" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="153.253.115.230" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="153.253.115.230" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <from sec="1204520672" usec="0"/>
      <to sec="1204521168" usec="0"/>
    </slice>
    <from sec="1204520672" usec="0"/>
    <to sec="1204521168" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="12.48.64.67" proto="icmp" src_ip="197.33.208.145"/>
      <filter dst_ip="197.33.208.145" proto="icmp" src_ip="197.33.208.145"/>
      <from sec="1204520719" usec="0"/>
      <to sec="1204520723" usec="0"/>
    </slice>
    <from sec="1204520719" usec="0"/>
    <to sec="1204520723" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="156.103.3.152" dst_port="139" proto="tcp" src_ip="84.215.64.15" src_port="2703"/>
      <filter dst_ip="156.103.3.152" dst_port="445" proto="tcp" src_ip="84.215.64.15" src_port="2703"/>
      <from sec="1204520635" usec="0"/>
      <to sec="1204520684" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="156.103.3.152" dst_port="139" proto="tcp" src_ip="36.75.80.15" src_port="2703"/>
      <filter dst_ip="156.103.3.152" dst_port="445" proto="tcp" src_ip="36.75.80.15" src_port="2703"/>
      <from sec="1204520637" usec="0"/>
      <to sec="1204520684" usec="0"/>
    </slice>
    <from sec="1204520635" usec="0"/>
    <to sec="1204520684" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,503,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="209.198.145.185" dst_port="80" proto="tcp" src_ip="153.253.89.42"/>
      <filter dst_ip="209.198.145.185" dst_port="25" proto="tcp" src_ip="153.253.89.42"/>
      <from sec="1204521270" usec="0"/>
      <to sec="1204521274" usec="0"/>
    </slice>
    <from sec="1204521270" usec="0"/>
    <to sec="1204521274" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,503,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="36.109.168.67" dst_port="53" proto="tcp" src_ip="153.253.14.217" src_port="1067"/>
      <filter dst_ip="36.109.168.67" dst_port="53" proto="udp" src_ip="153.253.14.217" src_port="1067"/>
      <filter dst_ip="36.109.168.67" dst_port="80" proto="tcp" src_ip="153.253.14.217" src_port="1067"/>
      <filter dst_ip="36.109.168.67" dst_port="80" proto="udp" src_ip="153.253.14.217" src_port="1067"/>
      <filter dst_ip="36.109.168.67" dst_port="25" proto="tcp" src_ip="153.253.14.217" src_port="1067"/>
      <filter dst_ip="36.109.168.67" dst_port="25" proto="udp" src_ip="153.253.14.217" src_port="1067"/>
      <filter dst_ip="153.253.160.26" dst_port="53" proto="tcp" src_ip="153.253.14.217" src_port="1067"/>
      <filter dst_ip="153.253.160.26" dst_port="53" proto="udp" src_ip="153.253.14.217" src_port="1067"/>
      <filter dst_ip="153.253.160.26" dst_port="80" proto="tcp" src_ip="153.253.14.217" src_port="1067"/>
      <filter dst_ip="153.253.160.26" dst_port="80" proto="udp" src_ip="153.253.14.217" src_port="1067"/>
      <filter dst_ip="153.253.160.26" dst_port="25" proto="tcp" src_ip="153.253.14.217" src_port="1067"/>
      <filter dst_ip="153.253.160.26" dst_port="25" proto="udp" src_ip="153.253.14.217" src_port="1067"/>
      <from sec="1204520941" usec="0"/>
      <to sec="1204520944" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="36.109.168.67" dst_port="53" proto="tcp" src_ip="156.103.129.30" src_port="1067"/>
      <filter dst_ip="36.109.168.67" dst_port="53" proto="udp" src_ip="156.103.129.30" src_port="1067"/>
      <filter dst_ip="36.109.168.67" dst_port="80" proto="tcp" src_ip="156.103.129.30" src_port="1067"/>
      <filter dst_ip="36.109.168.67" dst_port="80" proto="udp" src_ip="156.103.129.30" src_port="1067"/>
      <filter dst_ip="36.109.168.67" dst_port="25" proto="tcp" src_ip="156.103.129.30" src_port="1067"/>
      <filter dst_ip="36.109.168.67" dst_port="25" proto="udp" src_ip="156.103.129.30" src_port="1067"/>
      <filter dst_ip="153.253.160.26" dst_port="53" proto="tcp" src_ip="156.103.129.30" src_port="1067"/>
      <filter dst_ip="153.253.160.26" dst_port="53" proto="udp" src_ip="156.103.129.30" src_port="1067"/>
      <filter dst_ip="153.253.160.26" dst_port="80" proto="tcp" src_ip="156.103.129.30" src_port="1067"/>
      <filter dst_ip="153.253.160.26" dst_port="80" proto="udp" src_ip="156.103.129.30" src_port="1067"/>
      <filter dst_ip="153.253.160.26" dst_port="25" proto="tcp" src_ip="156.103.129.30" src_port="1067"/>
      <filter dst_ip="153.253.160.26" dst_port="25" proto="udp" src_ip="156.103.129.30" src_port="1067"/>
      <from sec="1204520942" usec="0"/>
      <to sec="1204520946" usec="0"/>
    </slice>
    <from sec="1204520941" usec="0"/>
    <to sec="1204520946" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="215.32.246.84" dst_port="53" proto="tcp" src_ip="153.253.212.252"/>
      <filter dst_ip="215.32.246.84" dst_port="53" proto="udp" src_ip="153.253.212.252"/>
      <filter dst_ip="215.32.246.84" dst_port="53" proto="tcp" src_ip="153.253.212.252"/>
      <filter dst_ip="215.32.246.84" dst_port="53" proto="udp" src_ip="153.253.212.252"/>
      <filter dst_ip="215.32.246.84" dst_port="53" proto="tcp" src_ip="153.253.212.252"/>
      <filter dst_ip="215.32.246.84" dst_port="53" proto="udp" src_ip="153.253.212.252"/>
      <filter dst_ip="215.32.246.84" dst_port="53" proto="tcp" src_ip="153.253.212.252"/>
      <filter dst_ip="215.32.246.84" dst_port="53" proto="udp" src_ip="153.253.212.252"/>
      <filter dst_ip="215.32.246.84" dst_port="25" proto="tcp" src_ip="153.253.212.252"/>
      <filter dst_ip="215.32.246.84" dst_port="25" proto="udp" src_ip="153.253.212.252"/>
      <filter dst_ip="215.32.246.84" dst_port="25" proto="tcp" src_ip="153.253.212.252"/>
      <filter dst_ip="215.32.246.84" dst_port="25" proto="udp" src_ip="153.253.212.252"/>
      <filter dst_ip="215.32.246.84" dst_port="25" proto="tcp" src_ip="153.253.212.252"/>
      <filter dst_ip="215.32.246.84" dst_port="25" proto="udp" src_ip="153.253.212.252"/>
      <filter dst_ip="215.32.246.84" dst_port="25" proto="tcp" src_ip="153.253.212.252"/>
      <filter dst_ip="215.32.246.84" dst_port="25" proto="udp" src_ip="153.253.212.252"/>
      <filter dst_ip="215.32.246.84" dst_port="80" proto="tcp" src_ip="153.253.212.252"/>
      <filter dst_ip="215.32.246.84" dst_port="80" proto="udp" src_ip="153.253.212.252"/>
      <filter dst_ip="215.32.246.84" dst_port="80" proto="tcp" src_ip="153.253.212.252"/>
      <filter dst_ip="215.32.246.84" dst_port="80" proto="udp" src_ip="153.253.212.252"/>
      <filter dst_ip="215.32.246.84" dst_port="80" proto="tcp" src_ip="153.253.212.252"/>
      <filter dst_ip="215.32.246.84" dst_port="80" proto="udp" src_ip="153.253.212.252"/>
      <filter dst_ip="215.32.246.84" dst_port="80" proto="tcp" src_ip="153.253.212.252"/>
      <filter dst_ip="215.32.246.84" dst_port="80" proto="udp" src_ip="153.253.212.252"/>
      <from sec="1204520945" usec="0"/>
      <to sec="1204520949" usec="0"/>
    </slice>
    <from sec="1204520945" usec="0"/>
    <to sec="1204520950" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,999,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="164.232.94.120" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="80" proto="tcp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="80" proto="udp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="80" proto="tcp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="80" proto="udp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="80" proto="tcp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="80" proto="udp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="80" proto="tcp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="80" proto="udp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="25" proto="tcp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="25" proto="udp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="25" proto="tcp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="25" proto="udp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="25" proto="tcp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="25" proto="udp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="25" proto="tcp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="25" proto="udp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="80" proto="tcp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="80" proto="udp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="80" proto="tcp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="80" proto="udp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="80" proto="tcp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="80" proto="udp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="80" proto="tcp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="80" proto="udp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="53" proto="tcp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="53" proto="udp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="53" proto="tcp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="53" proto="udp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="53" proto="tcp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="53" proto="udp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="53" proto="tcp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="53" proto="udp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="25" proto="tcp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="25" proto="udp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="25" proto="tcp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="25" proto="udp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="25" proto="tcp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="25" proto="udp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="25" proto="tcp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="25" proto="udp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="80" proto="tcp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="80" proto="udp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="80" proto="tcp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="80" proto="udp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="80" proto="tcp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="80" proto="udp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="80" proto="tcp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="80" proto="udp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="53" proto="tcp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="53" proto="udp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="53" proto="tcp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="53" proto="udp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="53" proto="tcp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="53" proto="udp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="53" proto="tcp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="164.232.94.120" dst_port="53" proto="udp" src_ip="2.50.206.11" src_port="53318"/>
      <from sec="1204521257" usec="0"/>
      <to sec="1204521261" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="153.253.78.155" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="80" proto="tcp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="80" proto="udp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="80" proto="tcp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="80" proto="udp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="80" proto="tcp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="80" proto="udp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="80" proto="tcp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="80" proto="udp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="25" proto="tcp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="25" proto="udp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="25" proto="tcp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="25" proto="udp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="25" proto="tcp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="25" proto="udp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="25" proto="tcp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="25" proto="udp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="80" proto="tcp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="80" proto="udp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="80" proto="tcp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="80" proto="udp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="80" proto="tcp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="80" proto="udp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="80" proto="tcp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="80" proto="udp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="53" proto="tcp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="53" proto="udp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="53" proto="tcp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="53" proto="udp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="53" proto="tcp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="53" proto="udp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="53" proto="tcp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="53" proto="udp" src_ip="61.147.165.249" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="25" proto="tcp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="25" proto="udp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="25" proto="tcp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="25" proto="udp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="25" proto="tcp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="25" proto="udp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="25" proto="tcp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="25" proto="udp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="80" proto="tcp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="80" proto="udp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="80" proto="tcp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="80" proto="udp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="80" proto="tcp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="80" proto="udp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="80" proto="tcp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="80" proto="udp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="53" proto="tcp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="53" proto="udp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="53" proto="tcp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="53" proto="udp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="53" proto="tcp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="53" proto="udp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="53" proto="tcp" src_ip="2.50.206.11" src_port="53318"/>
      <filter dst_ip="153.253.78.155" dst_port="53" proto="udp" src_ip="2.50.206.11" src_port="53318"/>
      <from sec="1204521257" usec="0"/>
      <to sec="1204521261" usec="0"/>
    </slice>
    <from sec="1204521257" usec="0"/>
    <to sec="1204521261" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="153.253.210.160" dst_port="25" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="25" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="25" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="25" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="25" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="25" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="25" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="25" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="80" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="80" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="80" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="80" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="80" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="80" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="80" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="80" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="21" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="21" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="21" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="21" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="21" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="21" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="21" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="21" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="53" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="53" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="53" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="53" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="53" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="53" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="53" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="53" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="80" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="80" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="80" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="80" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="80" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="80" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="80" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="80" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="21" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="21" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="21" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="21" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="21" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="21" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="21" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="21" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="25" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="25" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="25" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="25" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="25" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="25" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="25" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="25" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="80" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="80" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="80" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="80" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="80" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="80" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="80" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="80" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="21" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="21" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="21" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="21" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="21" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="21" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="21" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="21" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="53" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="53" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="53" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="53" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="53" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="53" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="53" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="153.253.210.160" dst_port="53" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <from sec="1204520588" usec="0"/>
      <to sec="1204520591" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="197.33.208.172" dst_port="25" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="25" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="25" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="25" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="25" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="25" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="25" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="25" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="80" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="80" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="80" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="80" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="80" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="80" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="80" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="80" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="21" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="21" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="21" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="21" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="21" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="21" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="21" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="21" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="53" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="53" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="53" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="53" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="53" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="53" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="53" proto="tcp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="53" proto="udp" src_ip="84.177.93.126" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="80" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="80" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="80" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="80" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="80" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="80" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="80" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="80" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="21" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="21" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="21" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="21" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="21" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="21" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="21" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="21" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="25" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="25" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="25" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="25" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="25" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="25" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="25" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="25" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="80" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="80" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="80" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="80" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="80" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="80" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="80" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="80" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="21" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="21" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="21" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="21" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="21" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="21" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="21" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="21" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="53" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="53" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="53" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="53" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="53" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="53" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="53" proto="tcp" src_ip="196.145.35.237" src_port="80"/>
      <filter dst_ip="197.33.208.172" dst_port="53" proto="udp" src_ip="196.145.35.237" src_port="80"/>
      <from sec="1204520587" usec="0"/>
      <to sec="1204520592" usec="0"/>
    </slice>
    <from sec="1204520587" usec="0"/>
    <to sec="1204520592" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="36.56.30.204" dst_port="25" proto="tcp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="25" proto="udp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="25" proto="tcp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="25" proto="udp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="25" proto="tcp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="25" proto="udp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="25" proto="tcp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="25" proto="udp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="53" proto="tcp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="53" proto="udp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="53" proto="tcp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="53" proto="udp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="53" proto="tcp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="53" proto="udp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="53" proto="tcp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="53" proto="udp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="80" proto="tcp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="80" proto="udp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="80" proto="tcp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="80" proto="udp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="80" proto="tcp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="80" proto="udp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="80" proto="tcp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="80" proto="udp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="993" proto="tcp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="993" proto="udp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="993" proto="tcp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="993" proto="udp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="993" proto="tcp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="993" proto="udp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="993" proto="tcp" src_ip="215.0.125.233"/>
      <filter dst_ip="36.56.30.204" dst_port="993" proto="udp" src_ip="215.0.125.233"/>
      <from sec="1204521193" usec="0"/>
      <to sec="1204521197" usec="0"/>
    </slice>
    <from sec="1204521193" usec="0"/>
    <to sec="1204521197" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.842106,1.81809,011,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="153.253.94.234" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="80" proto="tcp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="80" proto="udp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="80" proto="tcp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="80" proto="udp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="80" proto="tcp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="80" proto="udp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="80" proto="tcp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="80" proto="udp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="25" proto="tcp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="25" proto="udp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="25" proto="tcp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="25" proto="udp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="25" proto="tcp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="25" proto="udp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="25" proto="tcp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="25" proto="udp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="80" proto="tcp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="80" proto="udp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="80" proto="tcp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="80" proto="udp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="80" proto="tcp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="80" proto="udp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="80" proto="tcp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="80" proto="udp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="53" proto="tcp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="53" proto="udp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="53" proto="tcp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="53" proto="udp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="53" proto="tcp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="53" proto="udp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="53" proto="tcp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.94.234" dst_port="53" proto="udp" src_ip="5.39.152.215" src_port="22863"/>
      <from sec="1204520462" usec="0"/>
      <to sec="1204520466" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="153.253.67.4" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="25" proto="tcp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="25" proto="udp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="80" proto="tcp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="80" proto="udp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="80" proto="tcp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="80" proto="udp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="80" proto="tcp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="80" proto="udp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="80" proto="tcp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="80" proto="udp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="53" proto="tcp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="53" proto="udp" src_ip="223.38.40.87" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="25" proto="tcp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="25" proto="udp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="25" proto="tcp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="25" proto="udp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="25" proto="tcp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="25" proto="udp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="25" proto="tcp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="25" proto="udp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="80" proto="tcp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="80" proto="udp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="80" proto="tcp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="80" proto="udp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="80" proto="tcp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="80" proto="udp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="80" proto="tcp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="80" proto="udp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="53" proto="tcp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="53" proto="udp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="53" proto="tcp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="53" proto="udp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="53" proto="tcp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="53" proto="udp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="53" proto="tcp" src_ip="5.39.152.215" src_port="22863"/>
      <filter dst_ip="153.253.67.4" dst_port="53" proto="udp" src_ip="5.39.152.215" src_port="22863"/>
      <from sec="1204520462" usec="0"/>
      <to sec="1204520467" usec="0"/>
    </slice>
    <from sec="1204520462" usec="0"/>
    <to sec="1204520467" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.26239,1.89682,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="153.253.86.14" dst_port="80" proto="tcp" src_ip="153.253.86.14" src_port="1031"/>
      <filter dst_ip="153.253.86.14" dst_port="80" proto="udp" src_ip="153.253.86.14" src_port="1031"/>
      <filter dst_ip="153.253.86.14" dst_port="1031" proto="tcp" src_ip="153.253.86.14" src_port="1031"/>
      <filter dst_ip="153.253.86.14" dst_port="1031" proto="udp" src_ip="153.253.86.14" src_port="1031"/>
      <from sec="1204520463" usec="0"/>
      <to sec="1204521271" usec="0"/>
    </slice>
    <from sec="1204520463" usec="0"/>
    <to sec="1204521271" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.26239,1.89682,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="196.252.58.42" proto="tcp" src_ip="197.33.211.34" src_port="3128"/>
      <filter dst_ip="196.252.58.42" proto="tcp" src_ip="197.33.211.34" src_port="3124"/>
      <filter dst_ip="196.252.58.42" proto="tcp" src_ip="197.33.211.34" src_port="3127"/>
      <from sec="1204520436" usec="0"/>
      <to sec="1204520945" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="196.252.58.42" proto="tcp" src_ip="164.232.94.120" src_port="3128"/>
      <filter dst_ip="196.252.58.42" proto="tcp" src_ip="164.232.94.120" src_port="3124"/>
      <filter dst_ip="196.252.58.42" proto="tcp" src_ip="164.232.94.120" src_port="3127"/>
      <from sec="1204520653" usec="0"/>
      <to sec="1204520940" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="196.252.58.42" proto="tcp" src_ip="197.33.211.35" src_port="3128"/>
      <filter dst_ip="196.252.58.42" proto="tcp" src_ip="197.33.211.35" src_port="3124"/>
      <filter dst_ip="196.252.58.42" proto="tcp" src_ip="197.33.211.35" src_port="3127"/>
      <from sec="1204520653" usec="0"/>
      <to sec="1204520940" usec="0"/>
    </slice>
    <from sec="1204520436" usec="0"/>
    <to sec="1204520945" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.26239,1.89682,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="12.48.64.67" proto="icmp" src_ip="156.131.208.36"/>
      <filter dst_ip="12.48.64.67" proto="icmp" src_ip="156.131.208.36"/>
      <filter dst_ip="12.48.64.67" proto="icmp" src_ip="156.131.208.36"/>
      <filter dst_ip="12.48.64.67" proto="icmp" src_ip="156.131.208.36"/>
      <filter dst_ip="12.48.64.67" proto="icmp" src_ip="197.33.208.145"/>
      <filter dst_ip="12.48.64.67" proto="icmp" src_ip="197.33.208.145"/>
      <filter dst_ip="12.48.64.67" proto="icmp" src_ip="197.33.208.145"/>
      <filter dst_ip="12.48.64.67" proto="icmp" src_ip="197.33.208.145"/>
      <from sec="1204520715" usec="0"/>
      <to sec="1204520720" usec="0"/>
    </slice>
    <from sec="1204520715" usec="0"/>
    <to sec="1204520721" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.26239,1.89682,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="223.187.211.10" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="223.187.211.10" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <from sec="1204520890" usec="0"/>
      <to sec="1204521135" usec="0"/>
    </slice>
    <from sec="1204520890" usec="0"/>
    <to sec="1204521135" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.26239,1.89682,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="156.103.129.30" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="156.103.129.30" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <from sec="1204520564" usec="0"/>
      <to sec="1204521028" usec="0"/>
    </slice>
    <from sec="1204520564" usec="0"/>
    <to sec="1204521028" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.26239,1.89682,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="153.253.210.42" dst_port="80" proto="tcp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="80" proto="udp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="80" proto="tcp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="80" proto="udp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="80" proto="tcp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="80" proto="udp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="80" proto="tcp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="80" proto="udp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="25" proto="tcp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="25" proto="udp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="25" proto="tcp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="25" proto="udp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="25" proto="tcp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="25" proto="udp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="25" proto="tcp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="25" proto="udp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="443" proto="tcp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="443" proto="udp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="443" proto="tcp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="443" proto="udp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="443" proto="tcp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="443" proto="udp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="443" proto="tcp" src_ip="153.253.210.42"/>
      <filter dst_ip="153.253.210.42" dst_port="443" proto="udp" src_ip="153.253.210.42"/>
      <from sec="1204520509" usec="0"/>
      <to sec="1204521271" usec="0"/>
    </slice>
    <from sec="1204520509" usec="0"/>
    <to sec="1204521271" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.26239,1.89682,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="12.48.64.67" proto="icmp" src_ip="197.33.208.145"/>
      <filter dst_ip="197.33.208.145" proto="icmp" src_ip="197.33.208.145"/>
      <from sec="1204520719" usec="0"/>
      <to sec="1204520723" usec="0"/>
    </slice>
    <from sec="1204520719" usec="0"/>
    <to sec="1204520723" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.26239,1.89682,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="156.103.3.152" dst_port="139" proto="tcp" src_ip="84.215.64.15" src_port="2703"/>
      <from sec="1204520635" usec="0"/>
      <to sec="1204520646" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="156.103.3.152" dst_port="139" proto="tcp" src_ip="36.75.80.15" src_port="2703"/>
      <from sec="1204520637" usec="0"/>
      <to sec="1204520646" usec="0"/>
    </slice>
    <from sec="1204520635" usec="0"/>
    <to sec="1204520647" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.26239,1.89682,503,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="38.228.238.79" dst_port="80" proto="tcp" src_ip="164.232.168.15" src_port="23162"/>
      <filter dst_ip="38.228.238.79" dst_port="80" proto="udp" src_ip="164.232.168.15" src_port="23162"/>
      <filter dst_ip="38.228.238.79" dst_port="53" proto="tcp" src_ip="164.232.168.15" src_port="23162"/>
      <filter dst_ip="38.228.238.79" dst_port="53" proto="udp" src_ip="164.232.168.15" src_port="23162"/>
      <filter dst_ip="38.228.238.79" dst_port="25" proto="tcp" src_ip="164.232.168.15" src_port="23162"/>
      <filter dst_ip="38.228.238.79" dst_port="25" proto="udp" src_ip="164.232.168.15" src_port="23162"/>
      <filter dst_ip="45.195.10.96" dst_port="80" proto="tcp" src_ip="164.232.168.15" src_port="23162"/>
      <filter dst_ip="45.195.10.96" dst_port="80" proto="udp" src_ip="164.232.168.15" src_port="23162"/>
      <filter dst_ip="45.195.10.96" dst_port="53" proto="tcp" src_ip="164.232.168.15" src_port="23162"/>
      <filter dst_ip="45.195.10.96" dst_port="53" proto="udp" src_ip="164.232.168.15" src_port="23162"/>
      <filter dst_ip="45.195.10.96" dst_port="25" proto="tcp" src_ip="164.232.168.15" src_port="23162"/>
      <filter dst_ip="45.195.10.96" dst_port="25" proto="udp" src_ip="164.232.168.15" src_port="23162"/>
      <filter dst_ip="215.32.246.81" dst_port="80" proto="tcp" src_ip="164.232.168.15" src_port="23162"/>
      <filter dst_ip="215.32.246.81" dst_port="80" proto="udp" src_ip="164.232.168.15" src_port="23162"/>
      <filter dst_ip="215.32.246.81" dst_port="53" proto="tcp" src_ip="164.232.168.15" src_port="23162"/>
      <filter dst_ip="215.32.246.81" dst_port="53" proto="udp" src_ip="164.232.168.15" src_port="23162"/>
      <filter dst_ip="215.32.246.81" dst_port="25" proto="tcp" src_ip="164.232.168.15" src_port="23162"/>
      <filter dst_ip="215.32.246.81" dst_port="25" proto="udp" src_ip="164.232.168.15" src_port="23162"/>
      <from sec="1204521242" usec="0"/>
      <to sec="1204521245" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="38.228.238.79" dst_port="80" proto="tcp" src_ip="164.232.173.188" src_port="23162"/>
      <filter dst_ip="38.228.238.79" dst_port="80" proto="udp" src_ip="164.232.173.188" src_port="23162"/>
      <filter dst_ip="38.228.238.79" dst_port="53" proto="tcp" src_ip="164.232.173.188" src_port="23162"/>
      <filter dst_ip="38.228.238.79" dst_port="53" proto="udp" src_ip="164.232.173.188" src_port="23162"/>
      <filter dst_ip="38.228.238.79" dst_port="25" proto="tcp" src_ip="164.232.173.188" src_port="23162"/>
      <filter dst_ip="38.228.238.79" dst_port="25" proto="udp" src_ip="164.232.173.188" src_port="23162"/>
      <filter dst_ip="45.195.10.96" dst_port="80" proto="tcp" src_ip="164.232.173.188" src_port="23162"/>
      <filter dst_ip="45.195.10.96" dst_port="80" proto="udp" src_ip="164.232.173.188" src_port="23162"/>
      <filter dst_ip="45.195.10.96" dst_port="53" proto="tcp" src_ip="164.232.173.188" src_port="23162"/>
      <filter dst_ip="45.195.10.96" dst_port="53" proto="udp" src_ip="164.232.173.188" src_port="23162"/>
      <filter dst_ip="45.195.10.96" dst_port="25" proto="tcp" src_ip="164.232.173.188" src_port="23162"/>
      <filter dst_ip="45.195.10.96" dst_port="25" proto="udp" src_ip="164.232.173.188" src_port="23162"/>
      <filter dst_ip="215.32.246.81" dst_port="80" proto="tcp" src_ip="164.232.173.188" src_port="23162"/>
      <filter dst_ip="215.32.246.81" dst_port="80" proto="udp" src_ip="164.232.173.188" src_port="23162"/>
      <filter dst_ip="215.32.246.81" dst_port="53" proto="tcp" src_ip="164.232.173.188" src_port="23162"/>
      <filter dst_ip="215.32.246.81" dst_port="53" proto="udp" src_ip="164.232.173.188" src_port="23162"/>
      <filter dst_ip="215.32.246.81" dst_port="25" proto="tcp" src_ip="164.232.173.188" src_port="23162"/>
      <filter dst_ip="215.32.246.81" dst_port="25" proto="udp" src_ip="164.232.173.188" src_port="23162"/>
      <from sec="1204521241" usec="0"/>
      <to sec="1204521245" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="38.228.238.79" dst_port="80" proto="tcp" src_ip="153.253.252.155" src_port="23162"/>
      <filter dst_ip="38.228.238.79" dst_port="80" proto="udp" src_ip="153.253.252.155" src_port="23162"/>
      <filter dst_ip="38.228.238.79" dst_port="53" proto="tcp" src_ip="153.253.252.155" src_port="23162"/>
      <filter dst_ip="38.228.238.79" dst_port="53" proto="udp" src_ip="153.253.252.155" src_port="23162"/>
      <filter dst_ip="38.228.238.79" dst_port="25" proto="tcp" src_ip="153.253.252.155" src_port="23162"/>
      <filter dst_ip="38.228.238.79" dst_port="25" proto="udp" src_ip="153.253.252.155" src_port="23162"/>
      <filter dst_ip="45.195.10.96" dst_port="80" proto="tcp" src_ip="153.253.252.155" src_port="23162"/>
      <filter dst_ip="45.195.10.96" dst_port="80" proto="udp" src_ip="153.253.252.155" src_port="23162"/>
      <filter dst_ip="45.195.10.96" dst_port="53" proto="tcp" src_ip="153.253.252.155" src_port="23162"/>
      <filter dst_ip="45.195.10.96" dst_port="53" proto="udp" src_ip="153.253.252.155" src_port="23162"/>
      <filter dst_ip="45.195.10.96" dst_port="25" proto="tcp" src_ip="153.253.252.155" src_port="23162"/>
      <filter dst_ip="45.195.10.96" dst_port="25" proto="udp" src_ip="153.253.252.155" src_port="23162"/>
      <filter dst_ip="215.32.246.81" dst_port="80" proto="tcp" src_ip="153.253.252.155" src_port="23162"/>
      <filter dst_ip="215.32.246.81" dst_port="80" proto="udp" src_ip="153.253.252.155" src_port="23162"/>
      <filter dst_ip="215.32.246.81" dst_port="53" proto="tcp" src_ip="153.253.252.155" src_port="23162"/>
      <filter dst_ip="215.32.246.81" dst_port="53" proto="udp" src_ip="153.253.252.155" src_port="23162"/>
      <filter dst_ip="215.32.246.81" dst_port="25" proto="tcp" src_ip="153.253.252.155" src_port="23162"/>
      <filter dst_ip="215.32.246.81" dst_port="25" proto="udp" src_ip="153.253.252.155" src_port="23162"/>
      <from sec="1204521241" usec="0"/>
      <to sec="1204521242" usec="0"/>
    </slice>
    <from sec="1204521241" usec="0"/>
    <to sec="1204521245" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.26239,1.89682,901,0 1 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="197.33.218.30" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="53" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="53" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="80" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="80" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="25" proto="tcp" src_ip="223.38.40.87"/>
      <filter dst_ip="197.33.218.30" dst_port="25" proto="udp" src_ip="223.38.40.87"/>
      <from sec="1204521027" usec="0"/>
      <to sec="1204521032" usec="0"/>
    </slice>
    <from sec="1204521027" usec="0"/>
    <to sec="1204521032" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.632622,1.77076,901,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="0.0.0.0"/>
      <from sec="1204520400" usec="0"/>
      <to sec="1204521228" usec="0"/>
    </slice>
    <from sec="0" usec="0"/>
    <to sec="0" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.632622,1.77076,901,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="0.0.0.0"/>
      <from sec="1204520400" usec="0"/>
      <to sec="1204521228" usec="0"/>
    </slice>
    <from sec="57252760" usec="0"/>
    <to sec="57252760" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,010,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_65{
style=filled;
color=gray75;
569[label="153.253.5.100;d;14pkt 14fpkt", shape=diamond, color=yellow];
570[label="209.201.161.214;s;1pkt 1fpkt", shape=diamond, color=yellow];
4011[label="153.253.5.100;d;14pkt 14fpkt", shape=hexagon, color=black];
4200[label="209.201.161.214;s;1pkt 1fpkt", shape=hexagon, color=black];
stat65[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.201.180.217:80, 153.253.5.100:*}[85.7143%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (40%)&lt;BR/&gt; 3215: (6.66667%)&lt;BR/&gt; 554: (6.66667%)&lt;BR/&gt; 5000: (3.33333%)&lt;BR/&gt; 3699: (3.33333%)&gt;];
}
569--570[label="1;1pkt 1fpkt"];
569--4011[label="1;14pkt 14fpkt"];
569--4200[label="1;1pkt 1fpkt"];
570--4011[label="1;1pkt 1fpkt"];
570--4200[label="1;1pkt 1fpkt"];
4011--4200[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="153.253.5.100" src_ip="209.201.180.217" src_port="80"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521220" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.05976,1.65963,999,1 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_66{
style=filled;
color=gray75;
120[label="156.103.144.97s;1pkt 1fpkt", shape=rectangle, color=red];
577[label="156.103.144.97;s;16pkt 16fpkt", shape=diamond, color=yellow];
1255[label="218.121.170.115;d;2pkt 2fpkt", shape=diamond, color=yellow];
4012[label="156.103.144.97;s;4pkt 4fpkt", shape=hexagon, color=black];
4201[label="218.121.170.115;d;2pkt 2fpkt", shape=hexagon, color=black];
7339[label="156.103.144.97;16pkt 16fpkt", shape=pentagon, color=darkviolet];
stat66[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.103.144.97:13131, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 13131: (50%)&lt;BR/&gt; 51427: (7.31707%)&lt;BR/&gt; 51589: (6.09756%)&lt;BR/&gt; 39881: (3.65854%)&lt;BR/&gt; 10012: (3.65854%)&gt;];
}
120--577[label="1;1pkt 1fpkt"];
120--1255[label="1;1pkt 1fpkt"];
120--4012[label="1;1pkt 1fpkt"];
120--4201[label="1;1pkt 1fpkt"];
120--7339[label="1;1pkt 1fpkt"];
577--1255[label="1;2pkt 2fpkt"];
577--4012[label="1;4pkt 4fpkt"];
577--4201[label="1;2pkt 2fpkt"];
577--7339[label="1;16pkt 16fpkt"];
1255--4012[label="1;2pkt 2fpkt"];
1255--4201[label="1;2pkt 2fpkt"];
1255--7339[label="1;2pkt 2fpkt"];
4012--4201[label="1;2pkt 2fpkt"];
4012--7339[label="1;4pkt 4fpkt"];
4201--7339[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_ip="156.103.144.97" src_port="13131"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.08475,1.70201,503,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_67{
style=filled;
color=gray75;
55[label="156.161.181.58s;5pkt 5fpkt", shape=rectangle, color=red];
612[label="138.49.157.121;d;8pkt 8fpkt", shape=diamond, color=yellow];
615[label="156.161.181.58;s;9pkt 9fpkt", shape=diamond, color=yellow];
4447[label="156.161.181.58;s;9pkt 9fpkt", shape=hexagon, color=black];
stat67[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.161.181.58:*, 138.49.157.121:80}[88.8889%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2054: (6.45161%)&lt;BR/&gt; 2053: (6.45161%)&lt;BR/&gt; 2051: (6.45161%)&lt;BR/&gt; 2049: (6.45161%)&gt;];
}
55--612[label="1;5pkt 5fpkt"];
55--615[label="1;5pkt 5fpkt"];
55--4447[label="1;5pkt 5fpkt"];
612--615[label="1;8pkt 8fpkt"];
612--4447[label="1;8pkt 8fpkt"];
615--4447[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="138.49.157.121" dst_port="80" src_ip="156.161.181.58"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204520624" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_68{
style=filled;
color=gray75;
613[label="138.49.157.121;s;8pkt 8fpkt", shape=diamond, color=yellow];
614[label="156.161.181.58;d;8pkt 8fpkt", shape=diamond, color=yellow];
4023[label="156.161.181.58;d;6pkt 6fpkt", shape=hexagon, color=black];
7528[label="138.49.157.121;8pkt 8fpkt", shape=pentagon, color=darkviolet];
stat68[shape=component, label=&lt;Rules:&lt;BR/&gt;{138.49.157.121:80, 156.161.181.58:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2051: (6.66667%)&lt;BR/&gt; 2049: (6.66667%)&lt;BR/&gt; 2046: (6.66667%)&lt;BR/&gt; 2044: (6.66667%)&gt;];
}
613--614[label="1;8pkt 8fpkt"];
613--4023[label="1;6pkt 6fpkt"];
613--7528[label="1;8pkt 8fpkt"];
614--4023[label="1;6pkt 6fpkt"];
614--7528[label="1;8pkt 8fpkt"];
4023--7528[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="156.161.181.58" src_ip="138.49.157.121" src_port="80"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204520625" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,053,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_69{
style=filled;
color=gray75;
755[label="156.103.74.22;d;7pkt 7fpkt", shape=diamond, color=yellow];
756[label="196.145.34.2;s;1pkt 1fpkt", shape=diamond, color=yellow];
4481[label="196.145.34.2;s;1pkt 1fpkt", shape=hexagon, color=black];
4999[label="156.103.74.22;d;3pkt 3fpkt", shape=hexagon, color=black];
stat69[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.197.117.77:80, 156.103.74.22:*}[85.7143%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (33.3333%)&lt;BR/&gt; 2997: (16.6667%)&lt;BR/&gt; 554: (16.6667%)&lt;BR/&gt; 3677: (8.33333%)&lt;BR/&gt; 3675: (8.33333%)&gt;];
}
755--756[label="1;1pkt 1fpkt"];
755--4481[label="1;1pkt 1fpkt"];
755--4999[label="1;3pkt 3fpkt"];
756--4481[label="1;1pkt 1fpkt"];
756--4999[label="1;1pkt 1fpkt"];
4481--4999[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="156.103.74.22" src_ip="194.197.117.77" src_port="80"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_73{
style=filled;
color=gray75;
980[label="217.20.16.88;d;1pkt 1fpkt", shape=diamond, color=yellow];
981[label="156.120.110.26;s;2pkt 2fpkt", shape=diamond, color=yellow];
4123[label="156.120.110.26;s;2pkt 2fpkt", shape=hexagon, color=black];
stat73[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.120.110.26:15000, 222.232.94.86:21519}[50%]&lt;BR/&gt;{156.120.110.26:15000, 217.20.16.88:41150}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 15000: (50%)&lt;BR/&gt; 41150: (30%)&lt;BR/&gt; 21519: (20%)&gt;];
}
980--981[label="1;1pkt 1fpkt"];
980--4123[label="1;1pkt 1fpkt"];
981--4123[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="217.20.16.88" dst_port="41150" src_ip="156.120.110.26" src_port="15000"/>
      <filter dst_ip="222.232.94.86" dst_port="21519" src_ip="156.120.110.26" src_port="15000"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204520595" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_74{
style=filled;
color=gray75;
1013[label="153.253.202.53;d;1pkt 1fpkt", shape=diamond, color=yellow];
1016[label="36.183.4.49;s;1pkt 1fpkt", shape=diamond, color=yellow];
4564[label="153.253.202.53;d;1pkt 1fpkt", shape=hexagon, color=black];
stat74[shape=component, label=&lt;Rules:&lt;BR/&gt;{36.183.4.49:80, 153.253.202.53:50286}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 50286: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
1013--1016[label="1;1pkt 1fpkt"];
1013--4564[label="1;1pkt 1fpkt"];
1016--4564[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="153.253.202.53" dst_port="50286" src_ip="36.183.4.49" src_port="80"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521225" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.632622,1.77076,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_75{
style=filled;
color=gray75;
1045[label="201.40.140.64;d;96pkt 96fpkt", shape=diamond, color=yellow];
1047[label="156.161.173.236;s;237pkt 237fpkt", shape=diamond, color=yellow];
stat75[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.161.173.236:*, 201.40.140.64:80}[39.1837%]&lt;BR/&gt;{156.161.173.236:*, 201.40.140.66:80}[24.898%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2146: (0.3003%)&lt;BR/&gt; 2145: (0.3003%)&lt;BR/&gt; 2144: (0.3003%)&lt;BR/&gt; 2143: (0.3003%)&gt;];
}
1045--1047[label="0.916667;88pkt 88fpkt"];
1047--3485[label="0.00757576;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="201.40.140.64" dst_port="80" src_ip="156.161.173.236"/>
      <filter dst_ip="201.40.140.66" dst_port="80" src_ip="156.161.173.236"/>
    </slice>
    <from sec="1204520401" usec="0"/>
    <to sec="1204520606" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_76{
style=filled;
color=gray75;
1044[label="153.253.82.113;s;6pkt 6fpkt", shape=diamond, color=yellow];
1134[label="193.131.71.163;d;1pkt 1fpkt", shape=diamond, color=yellow];
4796[label="153.253.82.113;s;6pkt 6fpkt", shape=hexagon, color=black];
5857[label="193.131.71.163;d;1pkt 1fpkt", shape=hexagon, color=black];
stat76[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.253.82.113:*, 105.162.164.142:80}[66.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 52093: (14.2857%)&lt;BR/&gt; 52092: (7.14286%)&lt;BR/&gt; 52091: (7.14286%)&lt;BR/&gt; 52090: (7.14286%)&gt;];
}
1044--1134[label="1;1pkt 1fpkt"];
1044--4796[label="1;6pkt 6fpkt"];
1044--5857[label="1;1pkt 1fpkt"];
1134--4796[label="1;1pkt 1fpkt"];
1134--5857[label="1;1pkt 1fpkt"];
4796--5857[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="105.162.164.142" dst_port="80" src_ip="153.253.82.113"/>
    </slice>
    <from sec="1204520401" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.910784,1.65195,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_78{
style=filled;
color=gray75;
1139[label="164.232.101.16;d;2pkt 2fpkt", shape=diamond, color=yellow];
1151[label="71.48.131.179;s;2pkt 2fpkt", shape=diamond, color=yellow];
4606[label="164.232.101.16;d;2pkt 2fpkt", shape=hexagon, color=black];
8058[label="71.48.131.179;2pkt 2fpkt", shape=pentagon, color=darkviolet];
9187[label="71.48.131.179;2pkt 2fpkt", shape=invtriangle, color=brown];
stat78[shape=component, label=&lt;Rules:&lt;BR/&gt;{71.48.131.179:80, 164.232.101.16:2799}[50%]&lt;BR/&gt;{71.48.131.179:80, 164.232.101.16:2801}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2801: (25%)&lt;BR/&gt; 2799: (25%)&gt;];
}
1139--1151[label="1;2pkt 2fpkt"];
1139--4606[label="1;2pkt 2fpkt"];
1139--8058[label="1;2pkt 2fpkt"];
1139--9187[label="1;2pkt 2fpkt"];
1151--4606[label="1;2pkt 2fpkt"];
1151--8058[label="1;2pkt 2fpkt"];
1151--9187[label="1;2pkt 2fpkt"];
4606--8058[label="1;2pkt 2fpkt"];
4606--9187[label="1;2pkt 2fpkt"];
8058--9187[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="164.232.101.16" dst_port="2801" src_ip="71.48.131.179" src_port="80"/>
      <filter dst_ip="164.232.101.16" dst_port="2799" src_ip="71.48.131.179" src_port="80"/>
    </slice>
    <from sec="1204520418" usec="0"/>
    <to sec="1204521219" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.632622,1.77076,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="196.145.33.3"/>
      <from sec="1204520433" usec="0"/>
      <to sec="1204520551" usec="0"/>
    </slice>
    <from sec="1204520433" usec="0"/>
    <to sec="1204520551" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.952275,1.75926,503,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_81{
style=filled;
color=gray75;
266[label="196.145.44.89s;84pkt 84fpkt", shape=rectangle, color=red];
1189[label="164.232.236.242;d;93pkt 93fpkt", shape=diamond, color=yellow];
1190[label="196.145.44.89;s;93pkt 93fpkt", shape=diamond, color=yellow];
stat81[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.145.44.89:80, 164.232.236.242:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2486: (0.555556%)&lt;BR/&gt; 2485: (0.555556%)&lt;BR/&gt; 2484: (0.555556%)&lt;BR/&gt; 2483: (0.555556%)&gt;];
}
266--1189[label="1;84pkt 84fpkt"];
266--1190[label="1;84pkt 84fpkt"];
1189--1190[label="1;93pkt 93fpkt"];
</description>
    <slice>
      <filter dst_ip="164.232.236.242" src_ip="196.145.44.89" src_port="80"/>
    </slice>
    <from sec="1204520448" usec="0"/>
    <to sec="1204520484" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.939741,1.69452,999,0 0 0 1 1 0 0 0 0 0 1 0 ">
    <description>subgraph cluster_82{
style=filled;
color=gray75;
936[label="153.253.107.45;s;21pkt 21fpkt", shape=diamond, color=yellow];
1196[label="208.232.70.114;d;1pkt 1fpkt", shape=diamond, color=yellow];
4113[label="153.253.107.45;s;21pkt 21fpkt", shape=hexagon, color=black];
4624[label="208.232.70.114;d;1pkt 1fpkt", shape=hexagon, color=black];
8761[label="153.253.107.45;22pkt 22fpkt", shape=invtriangle, color=brown];
stat82[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.253.107.45:37757, *:*}[72.7273%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 37757: (37.8788%)&lt;BR/&gt; 16205: (4.54545%)&lt;BR/&gt; 41947: (3.78788%)&lt;BR/&gt; 63197: (2.27273%)&lt;BR/&gt; 62010: (2.27273%)&gt;];
}
936--1196[label="1;1pkt 1fpkt"];
936--4113[label="1;21pkt 21fpkt"];
936--4624[label="1;1pkt 1fpkt"];
936--8761[label="1;21pkt 21fpkt"];
1196--4113[label="1;1pkt 1fpkt"];
1196--4624[label="1;1pkt 1fpkt"];
1196--8761[label="1;1pkt 1fpkt"];
4113--4624[label="1;1pkt 1fpkt"];
4113--8761[label="1;21pkt 21fpkt"];
4624--8761[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="153.253.107.45" src_port="37757"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521221" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.05976,1.65963,999,1 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_84{
style=filled;
color=gray75;
330[label="222.95.193.23s;1pkt 1fpkt", shape=rectangle, color=red];
629[label="164.232.169.23;s;15pkt 15fpkt", shape=diamond, color=yellow];
1267[label="56.234.30.227;d;1pkt 1fpkt", shape=diamond, color=yellow];
3967[label="56.234.30.240;d;1pkt 1fpkt", shape=diamond, color=yellow];
3979[label="56.234.30.26;d;1pkt 1fpkt", shape=diamond, color=yellow];
4026[label="164.232.169.23;s;3pkt 3fpkt", shape=hexagon, color=black];
4449[label="56.234.30.227;d;1pkt 1fpkt", shape=hexagon, color=black];
5977[label="56.234.30.240;d;1pkt 1fpkt", shape=hexagon, color=black];
6630[label="164.232.169.23;24pkt 24fpkt", shape=pentagon, color=darkviolet];
stat84[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.232.169.23:31459, *:80}[25%]&lt;BR/&gt;{164.232.169.23:47215, *:80}[25%]&lt;BR/&gt;{164.232.169.23:*, 43.58.225.233:80}[20.8333%]&lt;BR/&gt;{164.232.169.23:14568, *:*}[20.8333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (29.1667%)&lt;BR/&gt; 14568: (17.7083%)&lt;BR/&gt; 31459: (12.5%)&lt;BR/&gt; 47215: (6.25%)&lt;BR/&gt; 11113: (6.25%)&gt;];
}
330--629[label="1;1pkt 1fpkt"];
330--1267[label="1;1pkt 1fpkt"];
330--4026[label="1;1pkt 1fpkt"];
330--4449[label="1;1pkt 1fpkt"];
330--6630[label="1;1pkt 1fpkt"];
629--1267[label="1;1pkt 1fpkt"];
629--3967[label="1;1pkt 1fpkt"];
629--3979[label="1;1pkt 1fpkt"];
629--4026[label="1;3pkt 3fpkt"];
629--4449[label="1;1pkt 1fpkt"];
629--5977[label="1;1pkt 1fpkt"];
629--6630[label="1;15pkt 15fpkt"];
1267--4026[label="1;1pkt 1fpkt"];
1267--4449[label="1;1pkt 1fpkt"];
1267--6630[label="1;1pkt 1fpkt"];
3967--5977[label="1;1pkt 1fpkt"];
3967--6630[label="1;1pkt 1fpkt"];
3979--6630[label="1;1pkt 1fpkt"];
4026--4449[label="1;1pkt 1fpkt"];
4026--6630[label="1;3pkt 3fpkt"];
4449--6630[label="1;1pkt 1fpkt"];
5977--6630[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="164.232.169.23" src_port="14568"/>
      <filter dst_ip="43.58.225.233" dst_port="80" src_ip="164.232.169.23"/>
      <filter dst_port="80" src_ip="164.232.169.23" src_port="47215"/>
      <filter dst_port="80" src_ip="164.232.169.23" src_port="31459"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.08475,1.70201,504,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_85{
style=filled;
color=gray75;
285[label="156.161.209.92s;209pkt 209fpkt", shape=rectangle, color=red];
1316[label="1.179.137.124;d;219pkt 219fpkt", shape=diamond, color=yellow];
1317[label="156.161.209.92;s;220pkt 220fpkt", shape=diamond, color=yellow];
5357[label="1.179.137.124;d;219pkt 219fpkt", shape=hexagon, color=black];
stat85[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.161.209.92:*, 1.179.137.124:443}[99.5455%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (49.9423%)&lt;BR/&gt; 4754: (0.230681%)&lt;BR/&gt; 4753: (0.230681%)&lt;BR/&gt; 4752: (0.230681%)&lt;BR/&gt; 4751: (0.230681%)&gt;];
}
285--1316[label="1;209pkt 209fpkt"];
285--1317[label="1;209pkt 209fpkt"];
285--5357[label="1;209pkt 209fpkt"];
1316--1317[label="1;219pkt 219fpkt"];
1316--5357[label="1;219pkt 219fpkt"];
1317--5357[label="1;219pkt 219fpkt"];
</description>
    <slice>
      <filter dst_ip="1.179.137.124" dst_port="443" src_ip="156.161.209.92"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204520950" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.632622,1.77076,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="38.231.114.194"/>
      <from sec="1204520400" usec="0"/>
      <to sec="1204520458" usec="0"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204520458" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_87{
style=filled;
color=gray75;
1403[label="193.223.26.34;d;1pkt 1fpkt", shape=diamond, color=yellow];
1404[label="156.161.189.105;s;1pkt 1fpkt", shape=diamond, color=yellow];
5375[label="156.161.189.105;s;1pkt 1fpkt", shape=hexagon, color=black];
stat87[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.161.189.105:1314, 193.223.26.34:8000}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8000: (50%)&lt;BR/&gt; 1314: (50%)&gt;];
}
1403--1404[label="1;1pkt 1fpkt"];
1403--5375[label="1;1pkt 1fpkt"];
1404--5375[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="193.223.26.34" dst_port="8000" src_ip="156.161.189.105" src_port="1314"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,010,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_88{
style=filled;
color=gray75;
926[label="153.253.137.75;s;107pkt 107fpkt", shape=diamond, color=yellow];
1422[label="83.80.121.120;d;1pkt 1fpkt", shape=diamond, color=yellow];
1436[label="13.97.50.211;d;1pkt 1fpkt", shape=diamond, color=yellow];
4109[label="153.253.137.75;s;41pkt 41fpkt", shape=hexagon, color=black];
4290[label="13.97.50.211;d;1pkt 1fpkt", shape=hexagon, color=black];
4753[label="83.80.121.120;d;1pkt 1fpkt", shape=hexagon, color=black];
stat88[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.253.137.75:*, 5.140.234.108:8282}[55.1402%]&lt;BR/&gt;{153.253.137.75:*, 218.45.26.94:*}[34.5794%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8282: (25.9868%)&lt;BR/&gt; 8000: (8.88158%)&lt;BR/&gt; 500: (7.56579%)&lt;BR/&gt; 1099: (4.60526%)&lt;BR/&gt; 53: (4.60526%)&gt;];
}
926--1422[label="1;1pkt 1fpkt"];
926--1436[label="1;1pkt 1fpkt"];
926--1871[label="0.00934579;1pkt 1fpkt"];
926--2752[label="0.00934579;1pkt 1fpkt"];
926--4109[label="1;41pkt 41fpkt"];
926--4290[label="1;1pkt 1fpkt"];
926--4752[label="0.00934579;1pkt 1fpkt"];
926--4753[label="1;1pkt 1fpkt"];
926--6304[label="0.046729;5pkt 5fpkt"];
926--6347[label="0.046729;5pkt 5fpkt"];
926--6362[label="0.046729;5pkt 5fpkt"];
926--6384[label="0.046729;5pkt 5fpkt"];
926--6399[label="0.046729;5pkt 5fpkt"];
1422--4109[label="1;1pkt 1fpkt"];
1422--4753[label="1;1pkt 1fpkt"];
1436--4109[label="1;1pkt 1fpkt"];
1436--4290[label="1;1pkt 1fpkt"];
4109--4290[label="1;1pkt 1fpkt"];
4109--4752[label="0.0243902;1pkt 1fpkt"];
4109--4753[label="1;1pkt 1fpkt"];
4109--6304[label="0.121951;5pkt 5fpkt"];
4109--6347[label="0.121951;5pkt 5fpkt"];
4109--6362[label="0.121951;5pkt 5fpkt"];
4109--6384[label="0.121951;5pkt 5fpkt"];
4109--6399[label="0.121951;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="218.45.26.94" src_ip="153.253.137.75"/>
      <filter dst_ip="5.140.234.108" dst_port="8282" src_ip="153.253.137.75"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_89{
style=filled;
color=gray75;
1534[label="194.183.226.167;d;1pkt 1fpkt", shape=diamond, color=yellow];
1535[label="156.161.234.214;s;1pkt 1fpkt", shape=diamond, color=yellow];
4320[label="194.183.226.167;d;1pkt 1fpkt", shape=hexagon, color=black];
stat89[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.161.234.214:2849, 194.183.226.167:8004}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8004: (50%)&lt;BR/&gt; 2849: (50%)&gt;];
}
1534--1535[label="1;1pkt 1fpkt"];
1534--4320[label="1;1pkt 1fpkt"];
1535--4320[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="194.183.226.167" dst_port="8004" src_ip="156.161.234.214" src_port="2849"/>
    </slice>
    <from sec="1204520401" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_90{
style=filled;
color=gray75;
1597[label="215.16.166.100;d;14pkt 14fpkt", shape=diamond, color=yellow];
1598[label="153.253.85.83;s;14pkt 14fpkt", shape=diamond, color=yellow];
4345[label="153.253.85.83;s;14pkt 14fpkt", shape=hexagon, color=black];
4590[label="215.16.166.100;d;14pkt 14fpkt", shape=hexagon, color=black];
7214[label="153.253.85.83;14pkt 14fpkt", shape=pentagon, color=darkviolet];
stat90[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.253.85.83:*, 215.16.166.100:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1115: (3.57143%)&lt;BR/&gt; 1112: (3.57143%)&lt;BR/&gt; 1111: (3.57143%)&lt;BR/&gt; 1109: (3.57143%)&gt;];
}
1597--1598[label="1;14pkt 14fpkt"];
1597--4345[label="1;14pkt 14fpkt"];
1597--4590[label="1;14pkt 14fpkt"];
1597--7214[label="1;14pkt 14fpkt"];
1598--4345[label="1;14pkt 14fpkt"];
1598--4590[label="1;14pkt 14fpkt"];
1598--7214[label="1;14pkt 14fpkt"];
4345--4590[label="1;14pkt 14fpkt"];
4345--7214[label="1;14pkt 14fpkt"];
4590--7214[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter dst_ip="215.16.166.100" dst_port="80" src_ip="153.253.85.83"/>
    </slice>
    <from sec="1204520405" usec="0"/>
    <to sec="1204520680" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_91{
style=filled;
color=gray75;
7562[label="197.176.128.126;98pkt 98fpkt", shape=pentagon, color=darkviolet];
stat91[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.176.128.126:0, *:0}[98.9796%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (98.9796%)&lt;BR/&gt; 20397: (0.510204%)&lt;BR/&gt; 179: (0.510204%)&gt;];
}
</description>
    <slice>
      <filter src_ip="197.176.128.126"/>
    </slice>
    <from sec="1204520404" usec="0"/>
    <to sec="1204521298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,020,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_92{
style=filled;
color=gray75;
1648[label="214.50.24.34;d;1pkt 1fpkt", shape=diamond, color=yellow];
1649[label="196.25.98.35;s;3pkt 3fpkt", shape=diamond, color=yellow];
4857[label="214.50.24.34;d;1pkt 1fpkt", shape=hexagon, color=black];
5638[label="196.25.98.35;s;3pkt 3fpkt", shape=hexagon, color=black];
6753[label="196.25.98.35;3pkt 3fpkt", shape=pentagon, color=darkviolet];
stat92[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.25.98.35:0, 214.50.24.34:0}[33.3333%]&lt;BR/&gt;{196.25.98.35:0, 221.217.24.125:0}[33.3333%]&lt;BR/&gt;{196.25.98.35:0, 36.136.17.137:0}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1648--1649[label="1;1pkt 1fpkt"];
1648--4857[label="1;1pkt 1fpkt"];
1648--5638[label="1;1pkt 1fpkt"];
1648--6753[label="1;1pkt 1fpkt"];
1649--4857[label="1;1pkt 1fpkt"];
1649--5638[label="1;3pkt 3fpkt"];
1649--6753[label="1;3pkt 3fpkt"];
4857--5638[label="1;1pkt 1fpkt"];
4857--6753[label="1;1pkt 1fpkt"];
5638--6753[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="36.136.17.137" src_ip="196.25.98.35"/>
      <filter dst_ip="221.217.24.125" src_ip="196.25.98.35"/>
      <filter dst_ip="214.50.24.34" src_ip="196.25.98.35"/>
    </slice>
    <from sec="1204520421" usec="0"/>
    <to sec="1204521249" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.632622,1.77076,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_94{
style=filled;
color=gray75;
698[label="153.253.116.185;s;13pkt 13fpkt", shape=diamond, color=yellow];
1712[label="217.74.150.215;d;2pkt 2fpkt", shape=diamond, color=yellow];
3856[label="85.76.12.183;d;5pkt 5fpkt", shape=diamond, color=yellow];
stat94[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.253.116.185:*, 85.76.12.183:80}[38.4615%]&lt;BR/&gt;{153.253.116.185:*, 222.87.83.19:80}[30.7692%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2476: (5%)&lt;BR/&gt; 2458: (5%)&lt;BR/&gt; 2443: (5%)&lt;BR/&gt; 2442: (5%)&gt;];
}
698--1712[label="1;2pkt 2fpkt"];
698--3856[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="85.76.12.183" dst_port="80" src_ip="153.253.116.185"/>
      <filter dst_ip="222.87.83.19" dst_port="80" src_ip="153.253.116.185"/>
    </slice>
    <from sec="1204520966" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_95{
style=filled;
color=gray75;
1729[label="153.253.116.197;d;3pkt 3fpkt", shape=diamond, color=yellow];
1730[label="12.73.163.236;s;2pkt 2fpkt", shape=diamond, color=yellow];
4633[label="153.253.116.197;d;3pkt 3fpkt", shape=hexagon, color=black];
8491[label="12.73.163.236;2pkt 2fpkt", shape=pentagon, color=darkviolet];
stat95[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.69.116.65:80, 153.253.116.197:4441}[33.3333%]&lt;BR/&gt;{12.73.163.236:80, 153.253.116.197:4431}[33.3333%]&lt;BR/&gt;{12.73.163.236:80, 153.253.116.197:4432}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4432: (20%)&lt;BR/&gt; 4431: (20%)&lt;BR/&gt; 4441: (10%)&gt;];
}
1729--1730[label="1;2pkt 2fpkt"];
1729--4633[label="1;3pkt 3fpkt"];
1729--8491[label="1;2pkt 2fpkt"];
1730--4633[label="1;2pkt 2fpkt"];
1730--8491[label="1;2pkt 2fpkt"];
4633--8491[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="153.253.116.197" dst_port="4432" src_ip="12.73.163.236" src_port="80"/>
      <filter dst_ip="153.253.116.197" dst_port="4431" src_ip="12.73.163.236" src_port="80"/>
      <filter dst_ip="153.253.116.197" dst_port="4441" src_ip="197.69.116.65" src_port="80"/>
    </slice>
    <from sec="1204520503" usec="0"/>
    <to sec="1204520578" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.08475,1.70201,503,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_96{
style=filled;
color=gray75;
303[label="153.253.70.225s;76pkt 76fpkt", shape=rectangle, color=red];
1577[label="153.253.70.225;s;132pkt 132fpkt", shape=diamond, color=yellow];
1732[label="32.136.106.53;d;131pkt 131fpkt", shape=diamond, color=yellow];
4585[label="153.253.70.225;s;120pkt 120fpkt", shape=hexagon, color=black];
4635[label="32.136.106.53;d;89pkt 89fpkt", shape=hexagon, color=black];
stat96[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.253.70.225:*, 32.136.106.53:80}[99.2424%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 56533: (0.456204%)&lt;BR/&gt; 56532: (0.456204%)&lt;BR/&gt; 56531: (0.456204%)&lt;BR/&gt; 56530: (0.456204%)&gt;];
}
303--1577[label="1;76pkt 76fpkt"];
303--1732[label="1;76pkt 76fpkt"];
303--4585[label="1;76pkt 76fpkt"];
303--4635[label="0.934211;71pkt 71fpkt"];
1577--1732[label="1;131pkt 131fpkt"];
1577--4585[label="1;120pkt 120fpkt"];
1577--4635[label="1;89pkt 89fpkt"];
1732--4585[label="0.991667;119pkt 119fpkt"];
1732--4635[label="1;89pkt 89fpkt"];
4585--4635[label="1;89pkt 89fpkt"];
</description>
    <slice>
      <filter dst_ip="32.136.106.53" dst_port="80" src_ip="153.253.70.225"/>
    </slice>
    <from sec="1204520402" usec="0"/>
    <to sec="1204521054" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.74811,1.71088,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_97{
style=filled;
color=gray75;
1662[label="36.56.2.12;d;8pkt 8fpkt", shape=diamond, color=yellow];
1737[label="131.66.205.76;s;1pkt 1fpkt", shape=diamond, color=yellow];
7134[label="131.66.205.76;10pkt 10fpkt", shape=pentagon, color=darkviolet];
8864[label="131.66.205.76;10pkt 10fpkt", shape=invtriangle, color=brown];
stat97[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.66.205.76:80, 167.168.18.145:*}[33.3333%]&lt;BR/&gt;{131.66.205.76:80, 36.56.2.12:*}[26.6667%]&lt;BR/&gt;{139.77.0.80:80, 36.56.2.12:*}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 57592: (6.89655%)&lt;BR/&gt; 57278: (5.17241%)&lt;BR/&gt; 34592: (5.17241%)&lt;BR/&gt; 63297: (3.44828%)&gt;];
}
1662--1737[label="1;1pkt 1fpkt"];
1662--7134[label="0.375;3pkt 3fpkt"];
1662--8435[label="0.5;1pkt 1fpkt"];
1662--8864[label="0.375;3pkt 3fpkt"];
1737--7134[label="1;1pkt 1fpkt"];
1737--8864[label="1;1pkt 1fpkt"];
7134--8864[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter dst_ip="36.56.2.12" src_ip="131.66.205.76" src_port="80"/>
      <filter dst_ip="167.168.18.145" src_ip="131.66.205.76" src_port="80"/>
      <filter dst_ip="36.56.2.12" src_ip="139.77.0.80" src_port="80"/>
    </slice>
    <from sec="1204520443" usec="0"/>
    <to sec="1204521239" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.05976,1.65963,503,1 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_98{
style=filled;
color=gray75;
340[label="164.232.169.233s;1pkt 1fpkt", shape=rectangle, color=red];
1778[label="164.232.169.233;s;4pkt 4fpkt", shape=diamond, color=yellow];
1779[label="83.191.139.251;d;1pkt 1fpkt", shape=diamond, color=yellow];
4422[label="164.232.169.233;s;4pkt 4fpkt", shape=hexagon, color=black];
4423[label="83.191.139.251;d;1pkt 1fpkt", shape=hexagon, color=black];
8472[label="164.232.169.233;4pkt 4fpkt", shape=pentagon, color=darkviolet];
stat98[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.232.169.233:2003, 213.133.64.58:80}[25%]&lt;BR/&gt;{164.232.169.233:2005, 83.191.139.251:80}[25%]&lt;BR/&gt;{164.232.169.233:2001, 213.133.64.157:80}[25%]&lt;BR/&gt;{164.232.169.233:2007, 213.133.64.157:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2005: (20%)&lt;BR/&gt; 2007: (10%)&lt;BR/&gt; 2003: (10%)&lt;BR/&gt; 2001: (10%)&gt;];
}
340--1778[label="1;1pkt 1fpkt"];
340--1779[label="1;1pkt 1fpkt"];
340--4422[label="1;1pkt 1fpkt"];
340--4423[label="1;1pkt 1fpkt"];
340--8472[label="1;1pkt 1fpkt"];
1778--1779[label="1;1pkt 1fpkt"];
1778--4422[label="1;4pkt 4fpkt"];
1778--4423[label="1;1pkt 1fpkt"];
1778--8472[label="1;4pkt 4fpkt"];
1779--4422[label="1;1pkt 1fpkt"];
1779--4423[label="1;1pkt 1fpkt"];
1779--8472[label="1;1pkt 1fpkt"];
4422--4423[label="1;1pkt 1fpkt"];
4422--8472[label="1;4pkt 4fpkt"];
4423--8472[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="213.133.64.157" dst_port="80" src_ip="164.232.169.233" src_port="2007"/>
      <filter dst_ip="213.133.64.157" dst_port="80" src_ip="164.232.169.233" src_port="2001"/>
      <filter dst_ip="83.191.139.251" dst_port="80" src_ip="164.232.169.233" src_port="2005"/>
      <filter dst_ip="213.133.64.58" dst_port="80" src_ip="164.232.169.233" src_port="2003"/>
    </slice>
    <from sec="1204520550" usec="0"/>
    <to sec="1204520609" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_99{
style=filled;
color=gray75;
1777[label="164.232.169.233;d;1pkt 1fpkt", shape=diamond, color=yellow];
1780[label="83.191.139.251;s;1pkt 1fpkt", shape=diamond, color=yellow];
4421[label="164.232.169.233;d;1pkt 1fpkt", shape=hexagon, color=black];
4424[label="83.191.139.251;s;1pkt 1fpkt", shape=hexagon, color=black];
stat99[shape=component, label=&lt;Rules:&lt;BR/&gt;{83.191.139.251:80, 164.232.169.233:2005}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2005: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
1777--1780[label="1;1pkt 1fpkt"];
1777--4421[label="1;1pkt 1fpkt"];
1777--4424[label="1;1pkt 1fpkt"];
1780--4421[label="1;1pkt 1fpkt"];
1780--4424[label="1;1pkt 1fpkt"];
4421--4424[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="164.232.169.233" dst_port="2005" src_ip="83.191.139.251" src_port="80"/>
    </slice>
    <from sec="1204520550" usec="0"/>
    <to sec="1204520608" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.632622,1.77076,011,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="37.170.200.159"/>
      <from sec="1204520558" usec="0"/>
      <to sec="1204520597" usec="0"/>
    </slice>
    <from sec="1204520558" usec="0"/>
    <to sec="1204520597" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.632622,1.77076,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_101{
style=filled;
color=gray75;
1870[label="197.33.219.143;s;445pkt 445fpkt", shape=diamond, color=yellow];
stat101[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.33.219.143:0, *:0}[99.7753%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.7753%)&lt;BR/&gt; 6000: (0.11236%)&lt;BR/&gt; 2967: (0.11236%)&gt;];
}
1870--2146[label="0.00224719;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="197.33.219.143"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.632622,1.77076,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_102{
style=filled;
color=gray75;
1906[label="197.33.219.129;s;460pkt 460fpkt", shape=diamond, color=yellow];
stat102[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.33.219.129:0, *:0}[99.5652%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.5652%)&lt;BR/&gt; 64898: (0.108696%)&lt;BR/&gt; 6000: (0.108696%)&lt;BR/&gt; 2967: (0.108696%)&lt;BR/&gt; 80: (0.108696%)&gt;];
}
1906--2146[label="0.00217391;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="197.33.219.129"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.632622,1.77076,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_103{
style=filled;
color=gray75;
1948[label="197.33.222.137;s;83pkt 83fpkt", shape=diamond, color=yellow];
stat103[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.33.222.137:1038, *:*}[85.5422%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1038: (42.7711%)&lt;BR/&gt; 443: (5.42169%)&lt;BR/&gt; 65436: (0.60241%)&lt;BR/&gt; 64973: (0.60241%)&lt;BR/&gt; 60210: (0.60241%)&gt;];
}
1948--2146[label="0.0120482;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="197.33.222.137" src_port="1038"/>
    </slice>
    <from sec="1204520402" usec="0"/>
    <to sec="1204521224" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_104{
style=filled;
color=gray75;
1868[label="156.103.96.173;d;37pkt 37fpkt", shape=diamond, color=yellow];
2124[label="221.88.248.197;s;2pkt 2fpkt", shape=diamond, color=yellow];
4524[label="156.103.96.173;d;30pkt 30fpkt", shape=hexagon, color=black];
stat104[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 156.103.96.173:25}[75.6757%]&lt;BR/&gt;{*:80, 156.103.96.173:*}[21.6216%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (36.9565%)&lt;BR/&gt; 80: (11.5942%)&lt;BR/&gt; 123: (2.89855%)&lt;BR/&gt; 48049: (2.17391%)&lt;BR/&gt; 48048: (2.17391%)&gt;];
}
1868--2124[label="1;2pkt 2fpkt"];
1868--4524[label="1;30pkt 30fpkt"];
2124--4524[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="156.103.96.173" src_port="80"/>
      <filter dst_ip="156.103.96.173" dst_port="25"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521214" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.588747,1.73007,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_105{
style=filled;
color=gray75;
2054[label="153.253.20.88;d;32pkt 32fpkt", shape=diamond, color=yellow];
2131[label="197.176.146.11;s;16pkt 16fpkt", shape=diamond, color=yellow];
6523[label="197.176.146.11;15pkt 15fpkt", shape=pentagon, color=darkviolet];
stat105[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.176.146.11:80, 153.253.20.88:*}[50%]&lt;BR/&gt;{5.202.77.102:80, 153.253.20.88:*}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2194: (2.38095%)&lt;BR/&gt; 2193: (2.38095%)&lt;BR/&gt; 2192: (2.38095%)&lt;BR/&gt; 2191: (2.38095%)&gt;];
}
2054--2131[label="1;16pkt 16fpkt"];
2054--6523[label="1;15pkt 15fpkt"];
2131--6523[label="1;15pkt 15fpkt"];
</description>
    <slice>
      <filter dst_ip="153.253.20.88" src_ip="5.202.77.102" src_port="80"/>
      <filter dst_ip="153.253.20.88" src_ip="197.176.146.11" src_port="80"/>
    </slice>
    <from sec="1204520517" usec="0"/>
    <to sec="1204520633" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.08475,1.70201,503,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_106{
style=filled;
color=gray75;
171[label="223.154.155.171s;2pkt 2fpkt", shape=rectangle, color=red];
2148[label="153.253.66.54;d;2pkt 2fpkt", shape=diamond, color=yellow];
2428[label="223.154.155.171;s;2pkt 2fpkt", shape=diamond, color=yellow];
4922[label="153.253.66.54;d;2pkt 2fpkt", shape=hexagon, color=black];
4923[label="223.154.155.171;s;2pkt 2fpkt", shape=hexagon, color=black];
stat106[shape=component, label=&lt;Rules:&lt;BR/&gt;{223.154.155.171:19555, 153.253.66.54:80}[50%]&lt;BR/&gt;{223.154.155.171:19584, 153.253.66.54:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 19584: (25%)&lt;BR/&gt; 19555: (25%)&gt;];
}
171--2148[label="1;2pkt 2fpkt"];
171--2428[label="1;2pkt 2fpkt"];
171--4922[label="1;2pkt 2fpkt"];
171--4923[label="1;2pkt 2fpkt"];
2148--2428[label="1;2pkt 2fpkt"];
2148--4922[label="1;2pkt 2fpkt"];
2148--4923[label="1;2pkt 2fpkt"];
2428--4922[label="1;2pkt 2fpkt"];
2428--4923[label="1;2pkt 2fpkt"];
4922--4923[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="153.253.66.54" dst_port="80" src_ip="223.154.155.171" src_port="19584"/>
      <filter dst_ip="153.253.66.54" dst_port="80" src_ip="223.154.155.171" src_port="19555"/>
    </slice>
    <from sec="1204520631" usec="0"/>
    <to sec="1204520706" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.632622,1.77076,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="139.77.103.170"/>
      <from sec="1204520401" usec="0"/>
      <to sec="1204520823" usec="0"/>
    </slice>
    <from sec="1204520401" usec="0"/>
    <to sec="1204520823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.632622,1.77076,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="139.77.103.170"/>
      <from sec="1204520401" usec="0"/>
      <to sec="1204520823" usec="0"/>
    </slice>
    <from sec="1204520401" usec="0"/>
    <to sec="1204520823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.632622,1.77076,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_111{
style=filled;
color=gray75;
2326[label="166.218.172.38;d;135pkt 135fpkt", shape=diamond, color=yellow];
stat111[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 166.218.172.38:1737}[95.5556%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1737: (47.7778%)&lt;BR/&gt; 45306: (1.85185%)&lt;BR/&gt; 13892: (0.740741%)&lt;BR/&gt; 13861: (0.740741%)&lt;BR/&gt; 13850: (0.740741%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="166.218.172.38" dst_port="1737"/>
    </slice>
    <from sec="1204520403" usec="0"/>
    <to sec="1204521221" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.632622,1.77076,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="222.87.83.19"/>
      <from sec="1204520702" usec="0"/>
      <to sec="1204520838" usec="0"/>
    </slice>
    <from sec="1204520702" usec="0"/>
    <to sec="1204520838" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.632622,1.77076,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="196.25.123.55"/>
      <from sec="1204520400" usec="0"/>
      <to sec="1204521136" usec="0"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521136" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,504,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_115{
style=filled;
color=gray75;
1541[label="164.232.192.85;s;112pkt 112fpkt", shape=diamond, color=yellow];
2621[label="84.145.26.68;d;110pkt 110fpkt", shape=diamond, color=yellow];
2641[label="208.136.112.145;d;1pkt 1fpkt", shape=diamond, color=yellow];
4575[label="164.232.192.85;s;112pkt 112fpkt", shape=hexagon, color=black];
5829[label="208.136.112.145;d;1pkt 1fpkt", shape=hexagon, color=black];
stat115[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.232.192.85:*, 84.145.26.68:443}[98.2143%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (49.7024%)&lt;BR/&gt; 2093: (0.595238%)&lt;BR/&gt; 1365: (0.446429%)&lt;BR/&gt; 1364: (0.446429%)&lt;BR/&gt; 1363: (0.446429%)&gt;];
}
1541--2621[label="1;110pkt 110fpkt"];
1541--2641[label="1;1pkt 1fpkt"];
1541--4575[label="1;112pkt 112fpkt"];
1541--5829[label="1;1pkt 1fpkt"];
2621--4575[label="1;110pkt 110fpkt"];
2641--4575[label="1;1pkt 1fpkt"];
2641--5829[label="1;1pkt 1fpkt"];
4575--5829[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="84.145.26.68" dst_port="443" src_ip="164.232.192.85"/>
    </slice>
    <from sec="1204520401" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_116{
style=filled;
color=gray75;
8344[label="197.144.32.214;69pkt 69fpkt", shape=pentagon, color=darkviolet];
stat116[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.144.32.214:80, 153.253.229.248:*}[75.3623%]&lt;BR/&gt;{197.144.32.214:80, 153.253.25.106:*}[23.1884%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 48038: (0.724638%)&lt;BR/&gt; 48036: (0.724638%)&lt;BR/&gt; 48032: (0.724638%)&lt;BR/&gt; 48030: (0.724638%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="153.253.229.248" src_ip="197.144.32.214" src_port="80"/>
      <filter dst_ip="153.253.25.106" src_ip="197.144.32.214" src_port="80"/>
    </slice>
    <from sec="1204520685" usec="0"/>
    <to sec="1204521149" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_117{
style=filled;
color=gray75;
2825[label="153.253.16.186;s;3pkt 3fpkt", shape=diamond, color=yellow];
2829[label="51.213.78.156;d;2pkt 2fpkt", shape=diamond, color=yellow];
5182[label="51.213.78.156;d;2pkt 2fpkt", shape=hexagon, color=black];
stat117[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.253.16.186:4874, 192.22.71.4:80}[33.3333%]&lt;BR/&gt;{153.253.16.186:4875, 51.213.78.156:80}[33.3333%]&lt;BR/&gt;{153.253.16.186:4880, 51.213.78.156:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4880: (21.4286%)&lt;BR/&gt; 4875: (21.4286%)&lt;BR/&gt; 4874: (7.14286%)&gt;];
}
2825--2829[label="1;2pkt 2fpkt"];
2825--5182[label="1;2pkt 2fpkt"];
2829--5182[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="51.213.78.156" dst_port="80" src_ip="153.253.16.186" src_port="4880"/>
      <filter dst_ip="51.213.78.156" dst_port="80" src_ip="153.253.16.186" src_port="4875"/>
      <filter dst_ip="192.22.71.4" dst_port="80" src_ip="153.253.16.186" src_port="4874"/>
    </slice>
    <from sec="1204520825" usec="0"/>
    <to sec="1204520873" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.632622,1.77076,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_118{
style=filled;
color=gray75;
2824[label="153.253.16.186;d;2pkt 2fpkt", shape=diamond, color=yellow];
2830[label="51.213.78.156;s;2pkt 2fpkt", shape=diamond, color=yellow];
stat118[shape=component, label=&lt;Rules:&lt;BR/&gt;{51.213.78.156:80, 153.253.16.186:4875}[50%]&lt;BR/&gt;{51.213.78.156:80, 153.253.16.186:4880}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4880: (25%)&lt;BR/&gt; 4875: (25%)&gt;];
}
2824--2830[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="153.253.16.186" dst_port="4880" src_ip="51.213.78.156" src_port="80"/>
      <filter dst_ip="153.253.16.186" dst_port="4875" src_ip="51.213.78.156" src_port="80"/>
    </slice>
    <from sec="1204520825" usec="0"/>
    <to sec="1204520873" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_119{
style=filled;
color=gray75;
1283[label="153.253.9.220;d;438pkt 438fpkt", shape=diamond, color=yellow];
2878[label="63.212.20.222;s;1pkt 1fpkt", shape=diamond, color=yellow];
3764[label="33.69.237.45;s;2pkt 2fpkt", shape=diamond, color=yellow];
3848[label="199.172.78.140;s;3pkt 3fpkt", shape=diamond, color=yellow];
4220[label="153.253.9.220;d;327pkt 327fpkt", shape=hexagon, color=black];
stat119[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 153.253.9.220:62385}[69.4064%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 62385: (35.8625%)&lt;BR/&gt; 0: (7.00389%)&lt;BR/&gt; 41228: (4.28016%)&lt;BR/&gt; 6881: (1.36187%)&lt;BR/&gt; 16001: (1.03761%)&gt;];
}
1283--1944[label="0.00262467;1pkt 1fpkt"];
1283--2878[label="1;1pkt 1fpkt"];
1283--3764[label="1;2pkt 2fpkt"];
1283--3848[label="1;3pkt 3fpkt"];
1283--4220[label="1;327pkt 327fpkt"];
1283--4532[label="0.00925926;1pkt 1fpkt"];
1283--5255[label="0.00352113;1pkt 1fpkt"];
1283--6321[label="0.00228311;1pkt 1fpkt"];
1283--6545[label="0.00228311;1pkt 1fpkt"];
1283--8445[label="0.00456621;2pkt 2fpkt"];
1283--8657[label="0.00228311;1pkt 1fpkt"];
2878--4220[label="1;1pkt 1fpkt"];
3764--4220[label="1;2pkt 2fpkt"];
4220--4532[label="0.00925926;1pkt 1fpkt"];
4220--5255[label="0.00352113;1pkt 1fpkt"];
4220--8445[label="0.0030581;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="153.253.9.220" dst_port="62385"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_120{
style=filled;
color=gray75;
2898[label="192.168.128.255;d;1pkt 1fpkt", shape=diamond, color=yellow];
2899[label="153.253.24.100;s;1pkt 1fpkt", shape=diamond, color=yellow];
5410[label="153.253.24.100;s;1pkt 1fpkt", shape=hexagon, color=black];
stat120[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.253.24.100:4445, 192.168.128.255:4445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4445: (100%)&gt;];
}
2898--2899[label="1;1pkt 1fpkt"];
2898--5410[label="1;1pkt 1fpkt"];
2899--5410[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="192.168.128.255" dst_port="4445" src_ip="153.253.24.100" src_port="4445"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_121{
style=filled;
color=gray75;
2600[label="196.16.198.109;s;174pkt 174fpkt", shape=diamond, color=yellow];
2902[label="203.2.191.191;d;166pkt 166fpkt", shape=diamond, color=yellow];
5411[label="196.16.198.109;s;137pkt 137fpkt", shape=hexagon, color=black];
stat121[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.16.198.109:*, 203.2.191.191:80}[95.4023%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.5807%)&lt;BR/&gt; 2529: (0.314465%)&lt;BR/&gt; 2528: (0.314465%)&lt;BR/&gt; 2522: (0.314465%)&lt;BR/&gt; 2521: (0.314465%)&gt;];
}
2600--2902[label="1;166pkt 166fpkt"];
2600--2967[label="0.0704225;5pkt 5fpkt"];
2600--5411[label="1;137pkt 137fpkt"];
2902--5411[label="0.948905;130pkt 130fpkt"];
</description>
    <slice>
      <filter dst_ip="203.2.191.191" dst_port="80" src_ip="196.16.198.109"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.588747,1.73007,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_122{
style=filled;
color=gray75;
2903[label="203.2.191.191;s;166pkt 166fpkt", shape=diamond, color=yellow];
2904[label="196.16.198.109;d;183pkt 183fpkt", shape=diamond, color=yellow];
8152[label="203.2.191.191;180pkt 180fpkt", shape=pentagon, color=darkviolet];
stat122[shape=component, label=&lt;Rules:&lt;BR/&gt;{203.2.191.191:80, 196.16.198.109:*}[91.3706%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.1493%)&lt;BR/&gt; 25059: (0.283554%)&lt;BR/&gt; 24977: (0.283554%)&lt;BR/&gt; 3435: (0.283554%)&lt;BR/&gt; 2570: (0.283554%)&gt;];
}
2903--2904[label="1;166pkt 166fpkt"];
2903--6318[label="0.0542169;9pkt 9fpkt"];
2903--6321[label="0.0542169;9pkt 9fpkt"];
2903--6361[label="0.0542169;9pkt 9fpkt"];
2903--6398[label="0.0542169;9pkt 9fpkt"];
2903--8152[label="1;166pkt 166fpkt"];
2904--4003[label="0.0273224;5pkt 5fpkt"];
2904--6318[label="0.0601093;11pkt 11fpkt"];
2904--6321[label="0.0491803;9pkt 9fpkt"];
2904--6361[label="0.0601093;11pkt 11fpkt"];
2904--6398[label="0.0601093;11pkt 11fpkt"];
2904--7928[label="0.0273224;5pkt 5fpkt"];
2904--8152[label="0.922222;166pkt 166fpkt"];
</description>
    <slice>
      <filter dst_ip="196.16.198.109" src_ip="203.2.191.191" src_port="80"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,504,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_123{
style=filled;
color=gray75;
1540[label="164.232.192.85;d;113pkt 113fpkt", shape=diamond, color=yellow];
2642[label="208.136.112.145;s;1pkt 1fpkt", shape=diamond, color=yellow];
2915[label="84.145.26.68;s;110pkt 110fpkt", shape=diamond, color=yellow];
4574[label="164.232.192.85;d;39pkt 39fpkt", shape=hexagon, color=black];
5830[label="208.136.112.145;s;1pkt 1fpkt", shape=hexagon, color=black];
stat123[shape=component, label=&lt;Rules:&lt;BR/&gt;{84.145.26.68:443, 164.232.192.85:*}[97.3451%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (49.6212%)&lt;BR/&gt; 2093: (0.757576%)&lt;BR/&gt; 1327: (0.568182%)&lt;BR/&gt; 1265: (0.568182%)&lt;BR/&gt; 1264: (0.568182%)&gt;];
}
1540--2642[label="1;1pkt 1fpkt"];
1540--2915[label="1;110pkt 110fpkt"];
1540--4574[label="1;39pkt 39fpkt"];
1540--5830[label="1;1pkt 1fpkt"];
2642--4574[label="1;1pkt 1fpkt"];
2642--5830[label="1;1pkt 1fpkt"];
2915--4574[label="0.974359;38pkt 38fpkt"];
4574--5830[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="164.232.192.85" src_ip="84.145.26.68" src_port="443"/>
    </slice>
    <from sec="1204520401" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_124{
style=filled;
color=gray75;
2139[label="156.103.161.117;s;480pkt 480fpkt", shape=diamond, color=yellow];
2997[label="47.163.75.171;d;2pkt 2fpkt", shape=diamond, color=yellow];
3000[label="42.158.165.184;d;1pkt 1fpkt", shape=diamond, color=yellow];
3001[label="33.32.47.9;d;1pkt 1fpkt", shape=diamond, color=yellow];
3003[label="34.68.39.11;d;2pkt 2fpkt", shape=diamond, color=yellow];
3004[label="33.89.132.43;d;1pkt 1fpkt", shape=diamond, color=yellow];
3005[label="47.14.153.8;d;1pkt 1fpkt", shape=diamond, color=yellow];
3007[label="47.164.122.65;d;1pkt 1fpkt", shape=diamond, color=yellow];
3283[label="192.89.51.145;d;2pkt 2fpkt", shape=diamond, color=yellow];
3285[label="33.31.7.172;d;3pkt 3fpkt", shape=diamond, color=yellow];
3543[label="39.164.117.231;d;2pkt 2fpkt", shape=diamond, color=yellow];
4661[label="156.103.161.117;s;480pkt 480fpkt", shape=hexagon, color=black];
5486[label="42.158.165.184;d;1pkt 1fpkt", shape=hexagon, color=black];
5650[label="33.31.7.172;d;3pkt 3fpkt", shape=hexagon, color=black];
5652[label="33.89.132.43;d;1pkt 1fpkt", shape=hexagon, color=black];
5654[label="47.14.153.8;d;1pkt 1fpkt", shape=hexagon, color=black];
5655[label="47.164.122.65;d;1pkt 1fpkt", shape=hexagon, color=black];
stat124[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.103.161.117:20641, *:*}[86.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 20641: (42.6246%)&lt;BR/&gt; 6346: (1.47508%)&lt;BR/&gt; 15958: (0.610376%)&lt;BR/&gt; 42587: (0.305188%)&lt;BR/&gt; 24864: (0.305188%)&gt;];
}
2139--2997[label="1;2pkt 2fpkt"];
2139--3000[label="1;1pkt 1fpkt"];
2139--3001[label="1;1pkt 1fpkt"];
2139--3003[label="1;2pkt 2fpkt"];
2139--3004[label="1;1pkt 1fpkt"];
2139--3005[label="1;1pkt 1fpkt"];
2139--3007[label="1;1pkt 1fpkt"];
2139--3283[label="1;2pkt 2fpkt"];
2139--3285[label="1;3pkt 3fpkt"];
2139--3543[label="1;2pkt 2fpkt"];
2139--4661[label="1;480pkt 480fpkt"];
2139--5486[label="1;1pkt 1fpkt"];
2139--5650[label="1;3pkt 3fpkt"];
2139--5652[label="1;1pkt 1fpkt"];
2139--5654[label="1;1pkt 1fpkt"];
2139--5655[label="1;1pkt 1fpkt"];
2997--4661[label="1;2pkt 2fpkt"];
3000--4661[label="1;1pkt 1fpkt"];
3000--5486[label="1;1pkt 1fpkt"];
3001--4661[label="1;1pkt 1fpkt"];
3003--4661[label="1;2pkt 2fpkt"];
3004--4661[label="1;1pkt 1fpkt"];
3004--5652[label="1;1pkt 1fpkt"];
3005--4661[label="1;1pkt 1fpkt"];
3005--5654[label="1;1pkt 1fpkt"];
3007--4661[label="1;1pkt 1fpkt"];
3007--5655[label="1;1pkt 1fpkt"];
3283--4661[label="1;2pkt 2fpkt"];
3285--4661[label="1;3pkt 3fpkt"];
3285--5650[label="1;3pkt 3fpkt"];
3543--4661[label="1;2pkt 2fpkt"];
4661--5486[label="1;1pkt 1fpkt"];
4661--5650[label="1;3pkt 3fpkt"];
4661--5652[label="1;1pkt 1fpkt"];
4661--5654[label="1;1pkt 1fpkt"];
4661--5655[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="156.103.161.117" src_port="20641"/>
    </slice>
    <from sec="1204520623" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_125{
style=filled;
color=gray75;
3037[label="164.232.197.69;s;6pkt 6fpkt", shape=diamond, color=yellow];
3044[label="193.223.26.32;d;1pkt 1fpkt", shape=diamond, color=yellow];
5505[label="193.223.26.32;d;1pkt 1fpkt", shape=hexagon, color=black];
5900[label="164.232.197.69;s;6pkt 6fpkt", shape=hexagon, color=black];
stat125[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.232.197.69:*, 105.64.87.50:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (35.7143%)&lt;BR/&gt; 8020: (14.2857%)&lt;BR/&gt; 1703: (14.2857%)&lt;BR/&gt; 1701: (7.14286%)&lt;BR/&gt; 1700: (7.14286%)&gt;];
}
3037--3044[label="1;1pkt 1fpkt"];
3037--5505[label="1;1pkt 1fpkt"];
3037--5900[label="1;6pkt 6fpkt"];
3044--5505[label="1;1pkt 1fpkt"];
3044--5900[label="1;1pkt 1fpkt"];
5505--5900[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="105.64.87.50" dst_port="80" src_ip="164.232.197.69"/>
    </slice>
    <from sec="1204520795" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03261,1.69897,503,1 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_126{
style=filled;
color=gray75;
298[label="131.66.46.176s;1pkt 1fpkt", shape=rectangle, color=red];
3080[label="131.66.46.176;s;34pkt 34fpkt", shape=diamond, color=yellow];
8031[label="131.66.46.176;34pkt 34fpkt", shape=pentagon, color=darkviolet];
9180[label="131.66.46.176;34pkt 34fpkt", shape=invtriangle, color=brown];
stat126[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.66.46.176:*, 83.28.37.53:80}[23.5294%]&lt;BR/&gt;{131.66.46.176:*, 83.28.36.172:80}[20.5882%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 60352: (1.94175%)&lt;BR/&gt; 65277: (1.45631%)&lt;BR/&gt; 65271: (1.45631%)&lt;BR/&gt; 62263: (1.45631%)&gt;];
}
298--3080[label="1;1pkt 1fpkt"];
298--8031[label="1;1pkt 1fpkt"];
298--9180[label="1;1pkt 1fpkt"];
3080--8031[label="1;34pkt 34fpkt"];
3080--9180[label="1;34pkt 34fpkt"];
8031--9180[label="1;34pkt 34fpkt"];
</description>
    <slice>
      <filter dst_ip="83.28.37.53" dst_port="80" src_ip="131.66.46.176"/>
      <filter dst_ip="83.28.36.172" dst_port="80" src_ip="131.66.46.176"/>
    </slice>
    <from sec="1204520875" usec="0"/>
    <to sec="1204520950" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_127{
style=filled;
color=gray75;
3094[label="46.89.107.140;d;1pkt 1fpkt", shape=diamond, color=yellow];
3095[label="164.232.8.194;s;1pkt 1fpkt", shape=diamond, color=yellow];
5512[label="46.89.107.140;d;1pkt 1fpkt", shape=hexagon, color=black];
stat127[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.232.8.194:80, 46.89.107.140:41623}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 41623: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
3094--3095[label="1;1pkt 1fpkt"];
3094--5512[label="1;1pkt 1fpkt"];
3095--5512[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="46.89.107.140" dst_port="41623" src_ip="164.232.8.194" src_port="80"/>
    </slice>
    <from sec="1204520885" usec="0"/>
    <to sec="1204520891" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.952275,1.75926,503,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_128{
style=filled;
color=gray75;
70[label="153.253.218.68s;2pkt 2fpkt", shape=rectangle, color=red];
3099[label="153.253.218.68;s;23pkt 23fpkt", shape=diamond, color=yellow];
3122[label="200.8.99.36;d;13pkt 13fpkt", shape=diamond, color=yellow];
stat128[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.253.218.68:*, 200.8.99.36:80}[56.5217%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 51148: (3.94737%)&lt;BR/&gt; 51147: (3.94737%)&lt;BR/&gt; 51151: (2.63158%)&lt;BR/&gt; 51150: (2.63158%)&gt;];
}
70--3099[label="1;2pkt 2fpkt"];
70--3122[label="1;2pkt 2fpkt"];
3099--3122[label="1;13pkt 13fpkt"];
</description>
    <slice>
      <filter dst_ip="200.8.99.36" dst_port="80" src_ip="153.253.218.68"/>
    </slice>
    <from sec="1204520887" usec="0"/>
    <to sec="1204521011" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.929633,1.7153,901,0 0 0 1 0 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_129{
style=filled;
color=gray75;
3038[label="156.161.130.100;s;2pkt 2fpkt", shape=diamond, color=yellow];
3100[label="46.89.100.158;d;1pkt 1fpkt", shape=diamond, color=yellow];
7367[label="156.161.130.100;7pkt 7fpkt", shape=pentagon, color=darkviolet];
9500[label="156.161.130.100;6pkt 6fpkt", shape=invhouse, color=bisque];
stat129[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.161.130.100:80, 2.228.1.158:*}[42.8571%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 34053: (12.5%)&lt;BR/&gt; 61283: (9.375%)&lt;BR/&gt; 59619: (6.25%)&lt;BR/&gt; 59617: (6.25%)&gt;];
}
3038--3100[label="1;1pkt 1fpkt"];
3038--7367[label="1;2pkt 2fpkt"];
3038--9500[label="1;2pkt 2fpkt"];
3100--7367[label="1;1pkt 1fpkt"];
3100--9500[label="1;1pkt 1fpkt"];
7367--9500[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="2.228.1.158" src_ip="156.161.130.100" src_port="80"/>
    </slice>
    <from sec="1204520410" usec="0"/>
    <to sec="1204521055" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.910784,1.65195,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_130{
style=filled;
color=gray75;
3115[label="36.56.4.65;d;1pkt 1fpkt", shape=diamond, color=yellow];
3116[label="156.120.186.9;s;2pkt 2fpkt", shape=diamond, color=yellow];
5330[label="36.56.4.65;d;1pkt 1fpkt", shape=hexagon, color=black];
6511[label="156.120.186.9;2pkt 2fpkt", shape=pentagon, color=darkviolet];
8642[label="156.120.186.9;2pkt 2fpkt", shape=invtriangle, color=brown];
stat130[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.120.186.9:80, 36.56.4.65:60916}[50%]&lt;BR/&gt;{156.120.186.9:25, 86.236.161.155:57866}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 60916: (31.25%)&lt;BR/&gt; 80: (31.25%)&lt;BR/&gt; 57866: (18.75%)&lt;BR/&gt; 25: (18.75%)&gt;];
}
3115--3116[label="1;1pkt 1fpkt"];
3115--5330[label="1;1pkt 1fpkt"];
3115--6511[label="1;1pkt 1fpkt"];
3115--8642[label="1;1pkt 1fpkt"];
3116--5330[label="1;1pkt 1fpkt"];
3116--6511[label="1;2pkt 2fpkt"];
3116--8642[label="1;2pkt 2fpkt"];
5330--6511[label="1;1pkt 1fpkt"];
5330--8642[label="1;1pkt 1fpkt"];
6511--8642[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="86.236.161.155" dst_port="57866" src_ip="156.120.186.9" src_port="25"/>
      <filter dst_ip="36.56.4.65" dst_port="60916" src_ip="156.120.186.9" src_port="80"/>
    </slice>
    <from sec="1204520909" usec="0"/>
    <to sec="1204521012" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_131{
style=filled;
color=gray75;
3132[label="36.56.4.61;d;1pkt 1fpkt", shape=diamond, color=yellow];
3133[label="131.66.203.147;s;1pkt 1fpkt", shape=diamond, color=yellow];
5334[label="131.66.203.147;s;1pkt 1fpkt", shape=hexagon, color=black];
stat131[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.66.203.147:80, 36.56.4.61:63121}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 63121: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
3132--3133[label="1;1pkt 1fpkt"];
3132--5334[label="1;1pkt 1fpkt"];
3133--5334[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="36.56.4.61" dst_port="63121" src_ip="131.66.203.147" src_port="80"/>
    </slice>
    <from sec="1204520929" usec="0"/>
    <to sec="1204520946" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.632622,1.77076,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="156.161.186.2"/>
      <from sec="1204520400" usec="0"/>
      <to sec="1204521223" usec="0"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521223" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_133{
style=filled;
color=gray75;
3177[label="32.229.40.79;d;3pkt 3fpkt", shape=diamond, color=yellow];
3178[label="153.253.208.163;s;9pkt 9fpkt", shape=diamond, color=yellow];
5387[label="153.253.208.163;s;9pkt 9fpkt", shape=hexagon, color=black];
5771[label="32.229.40.79;d;3pkt 3fpkt", shape=hexagon, color=black];
7902[label="153.253.208.163;9pkt 9fpkt", shape=pentagon, color=darkviolet];
stat133[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.253.208.163:*, 223.187.209.124:80}[44.4444%]&lt;BR/&gt;{153.253.208.163:*, 32.229.40.79:80}[33.3333%]&lt;BR/&gt;{153.253.208.163:*, 223.187.209.102:80}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2922: (7.57576%)&lt;BR/&gt; 2835: (7.57576%)&lt;BR/&gt; 1639: (7.57576%)&lt;BR/&gt; 3529: (4.54545%)&gt;];
}
3177--3178[label="1;3pkt 3fpkt"];
3177--5387[label="1;3pkt 3fpkt"];
3177--5771[label="1;3pkt 3fpkt"];
3177--7902[label="1;3pkt 3fpkt"];
3178--5387[label="1;9pkt 9fpkt"];
3178--5771[label="1;3pkt 3fpkt"];
3178--7902[label="1;9pkt 9fpkt"];
5387--5771[label="1;3pkt 3fpkt"];
5387--7902[label="1;9pkt 9fpkt"];
5771--7902[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="223.187.209.124" dst_port="80" src_ip="153.253.208.163"/>
      <filter dst_ip="32.229.40.79" dst_port="80" src_ip="153.253.208.163"/>
      <filter dst_ip="223.187.209.102" dst_port="80" src_ip="153.253.208.163"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,053,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_135{
style=filled;
color=gray75;
2241[label="156.161.167.70;d;143pkt 143fpkt", shape=diamond, color=yellow];
3253[label="205.98.144.249;s;27pkt 27fpkt", shape=diamond, color=yellow];
3491[label="205.98.144.248;s;89pkt 89fpkt", shape=diamond, color=yellow];
4751[label="156.161.167.70;d;78pkt 78fpkt", shape=hexagon, color=black];
stat135[shape=component, label=&lt;Rules:&lt;BR/&gt;{205.98.144.248:80, 156.161.167.70:*}[61.5385%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.0712%)&lt;BR/&gt; 137: (1.48368%)&lt;BR/&gt; 2280: (0.445104%)&lt;BR/&gt; 1567: (0.445104%)&lt;BR/&gt; 1565: (0.445104%)&gt;];
}
2241--3253[label="1;27pkt 27fpkt"];
2241--3491[label="1;89pkt 89fpkt"];
2241--4751[label="1;78pkt 78fpkt"];
2241--6318[label="0.0629371;9pkt 9fpkt"];
2241--6321[label="0.0559441;8pkt 8fpkt"];
2241--6361[label="0.0629371;9pkt 9fpkt"];
2241--6398[label="0.0629371;9pkt 9fpkt"];
3253--4751[label="0.555556;15pkt 15fpkt"];
3253--6318[label="0.037037;1pkt 1fpkt"];
3253--6321[label="0.037037;1pkt 1fpkt"];
3253--6361[label="0.037037;1pkt 1fpkt"];
3253--6398[label="0.037037;1pkt 1fpkt"];
3491--4751[label="0.628205;49pkt 49fpkt"];
3491--6318[label="0.0449438;4pkt 4fpkt"];
3491--6321[label="0.0786517;7pkt 7fpkt"];
3491--6361[label="0.0449438;4pkt 4fpkt"];
3491--6398[label="0.0449438;4pkt 4fpkt"];
4751--6318[label="0.115385;9pkt 9fpkt"];
4751--6361[label="0.115385;9pkt 9fpkt"];
4751--6398[label="0.115385;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="156.161.167.70" src_ip="205.98.144.248" src_port="80"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.632622,1.77076,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_136{
style=filled;
color=gray75;
3259[label="197.33.218.165;s;108pkt 108fpkt", shape=diamond, color=yellow];
stat136[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.33.218.165:0, *:0}[99.0741%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.0741%)&lt;BR/&gt; 6000: (0.462963%)&lt;BR/&gt; 2967: (0.462963%)&gt;];
}
3259--3450[label="0.00925926;1pkt 1fpkt"];
3259--3729[label="0.00925926;1pkt 1fpkt"];
3259--5035[label="0.00925926;1pkt 1fpkt"];
3259--5789[label="0.00925926;1pkt 1fpkt"];
3259--6146[label="0.00925926;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="197.33.218.165"/>
    </slice>
    <from sec="1204520409" usec="0"/>
    <to sec="1204521203" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_137{
style=filled;
color=gray75;
2969[label="164.232.171.214;d;19pkt 19fpkt", shape=diamond, color=yellow];
3277[label="63.182.192.104;s;1pkt 1fpkt", shape=diamond, color=yellow];
5870[label="63.182.192.104;s;1pkt 1fpkt", shape=hexagon, color=black];
stat137[shape=component, label=&lt;Rules:&lt;BR/&gt;{63.182.193.78:80, 164.232.171.214:*}[36.8421%]&lt;BR/&gt;{*:3478, 164.232.171.214:*}[31.5789%]&lt;BR/&gt;{32.229.48.134:*, 164.232.171.214:*}[21.0526%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (16.6667%)&lt;BR/&gt; 3478: (14.2857%)&lt;BR/&gt; 26000: (7.14286%)&lt;BR/&gt; 1349: (7.14286%)&lt;BR/&gt; 39481: (4.7619%)&gt;];
}
2969--3277[label="1;1pkt 1fpkt"];
2969--5870[label="1;1pkt 1fpkt"];
2969--6318[label="0.157895;3pkt 3fpkt"];
2969--6361[label="0.157895;3pkt 3fpkt"];
2969--6398[label="0.157895;3pkt 3fpkt"];
3277--5870[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="164.232.171.214" src_ip="32.229.48.134"/>
      <filter dst_ip="164.232.171.214" src_port="3478"/>
      <filter dst_ip="164.232.171.214" src_ip="63.182.193.78" src_port="80"/>
    </slice>
    <from sec="1204520413" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.632622,1.77076,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_138{
style=filled;
color=gray75;
3468[label="166.218.72.105;d;495pkt 495fpkt", shape=diamond, color=yellow];
stat138[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 166.218.72.105:7941}[97.3737%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 7941: (48.6869%)&lt;BR/&gt; 0: (2.62626%)&lt;BR/&gt; 16001: (0.606061%)&lt;BR/&gt; 21588: (0.505051%)&lt;BR/&gt; 6881: (0.40404%)&gt;];
}
3468--6301[label="0.0040404;2pkt 2fpkt"];
3468--6344[label="0.0040404;2pkt 2fpkt"];
3468--6381[label="0.0040404;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="166.218.72.105" dst_port="7941"/>
    </slice>
    <from sec="1204520401" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.05976,1.65963,503,1 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_139{
style=filled;
color=gray75;
295[label="153.253.69.155s;23pkt 23fpkt", shape=rectangle, color=red];
3521[label="153.253.69.155;s;119pkt 119fpkt", shape=diamond, color=yellow];
5860[label="153.253.69.155;s;119pkt 119fpkt", shape=hexagon, color=black];
7822[label="153.253.69.155;125pkt 125fpkt", shape=pentagon, color=darkviolet];
stat139[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.253.69.155:*, 222.72.202.121:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 50021: (0.518135%)&lt;BR/&gt; 49994: (0.518135%)&lt;BR/&gt; 49990: (0.518135%)&lt;BR/&gt; 49988: (0.518135%)&gt;];
}
295--3521[label="1;23pkt 23fpkt"];
295--5860[label="1;23pkt 23fpkt"];
295--7822[label="1;23pkt 23fpkt"];
3521--5860[label="1;119pkt 119fpkt"];
3521--7822[label="1;119pkt 119fpkt"];
5860--7822[label="1;119pkt 119fpkt"];
</description>
    <slice>
      <filter dst_ip="222.72.202.121" dst_port="80" src_ip="153.253.69.155"/>
    </slice>
    <from sec="1204520417" usec="0"/>
    <to sec="1204521242" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,504,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_140{
style=filled;
color=gray75;
3562[label="156.124.63.9;d;63pkt 63fpkt", shape=diamond, color=yellow];
3563[label="1.34.226.210;s;63pkt 63fpkt", shape=diamond, color=yellow];
5666[label="156.124.63.9;d;62pkt 62fpkt", shape=hexagon, color=black];
5667[label="1.34.226.210;s;62pkt 62fpkt", shape=hexagon, color=black];
8318[label="1.34.226.210;73pkt 73fpkt", shape=pentagon, color=darkviolet];
stat140[shape=component, label=&lt;Rules:&lt;BR/&gt;{1.34.226.210:*, 156.124.63.9:443}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (50%)&lt;BR/&gt; 49801: (0.773994%)&lt;BR/&gt; 49800: (0.773994%)&lt;BR/&gt; 49799: (0.773994%)&lt;BR/&gt; 49798: (0.773994%)&gt;];
}
3562--3563[label="1;63pkt 63fpkt"];
3562--5666[label="1;62pkt 62fpkt"];
3562--5667[label="1;62pkt 62fpkt"];
3562--8318[label="1;63pkt 63fpkt"];
3563--5666[label="1;62pkt 62fpkt"];
3563--5667[label="1;62pkt 62fpkt"];
3563--8318[label="1;63pkt 63fpkt"];
5666--5667[label="1;62pkt 62fpkt"];
5666--8318[label="1;62pkt 62fpkt"];
5667--8318[label="1;62pkt 62fpkt"];
</description>
    <slice>
      <filter dst_ip="156.124.63.9" dst_port="443" src_ip="1.34.226.210"/>
    </slice>
    <from sec="1204520653" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_141{
style=filled;
color=gray75;
2282[label="36.56.8.228;d;202pkt 202fpkt", shape=diamond, color=yellow];
2283[label="156.120.69.156;s;207pkt 207fpkt", shape=diamond, color=yellow];
3598[label="167.168.18.89;d;6pkt 6fpkt", shape=diamond, color=yellow];
5051[label="156.120.69.156;s;162pkt 162fpkt", shape=hexagon, color=black];
5919[label="167.168.18.89;d;6pkt 6fpkt", shape=hexagon, color=black];
stat141[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.120.69.156:80, 36.56.8.228:*}[95.6938%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 45664: (0.343053%)&lt;BR/&gt; 45034: (0.343053%)&lt;BR/&gt; 44994: (0.343053%)&lt;BR/&gt; 65476: (0.25729%)&gt;];
}
2282--2283[label="0.990099;200pkt 200fpkt"];
2282--5051[label="0.975309;158pkt 158fpkt"];
2282--6318[label="0.0643564;13pkt 13fpkt"];
2282--6321[label="0.0594059;12pkt 12fpkt"];
2282--6361[label="0.0643564;13pkt 13fpkt"];
2282--6398[label="0.0643564;13pkt 13fpkt"];
2283--3598[label="1;6pkt 6fpkt"];
2283--5051[label="1;162pkt 162fpkt"];
2283--5919[label="1;6pkt 6fpkt"];
2283--6318[label="0.0628019;13pkt 13fpkt"];
2283--6321[label="0.0628019;13pkt 13fpkt"];
2283--6361[label="0.0628019;13pkt 13fpkt"];
2283--6398[label="0.0628019;13pkt 13fpkt"];
3598--5051[label="0.5;3pkt 3fpkt"];
3598--5919[label="1;6pkt 6fpkt"];
3598--6321[label="0.166667;1pkt 1fpkt"];
5051--5919[label="0.5;3pkt 3fpkt"];
5051--6318[label="0.0802469;13pkt 13fpkt"];
5051--6361[label="0.0802469;13pkt 13fpkt"];
5051--6398[label="0.0802469;13pkt 13fpkt"];
5919--6321[label="0.166667;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="36.56.8.228" src_ip="156.120.69.156" src_port="80"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.952275,1.75926,503,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_142{
style=filled;
color=gray75;
30[label="196.25.148.26s;1pkt 1fpkt", shape=rectangle, color=red];
3621[label="196.25.148.26;s;6pkt 6fpkt", shape=diamond, color=yellow];
3673[label="215.16.155.50;d;3pkt 3fpkt", shape=diamond, color=yellow];
stat142[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.25.148.26:*, 215.16.155.50:80}[50%]&lt;BR/&gt;{196.25.148.26:*, 197.144.32.243:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 49211: (15%)&lt;BR/&gt; 49210: (10%)&lt;BR/&gt; 49209: (10%)&lt;BR/&gt; 49207: (5%)&gt;];
}
30--3621[label="1;1pkt 1fpkt"];
30--3673[label="1;1pkt 1fpkt"];
3621--3673[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="197.144.32.243" dst_port="80" src_ip="196.25.148.26"/>
      <filter dst_ip="215.16.155.50" dst_port="80" src_ip="196.25.148.26"/>
    </slice>
    <from sec="1204521046" usec="0"/>
    <to sec="1204521137" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_143{
style=filled;
color=gray75;
3381[label="153.253.95.165;d;10pkt 10fpkt", shape=diamond, color=yellow];
3602[label="196.130.128.29;s;15pkt 15fpkt", shape=diamond, color=yellow];
3605[label="196.130.128.30;s;2pkt 2fpkt", shape=diamond, color=yellow];
3627[label="153.253.1.129;d;7pkt 7fpkt", shape=diamond, color=yellow];
5693[label="196.130.128.29;s;15pkt 15fpkt", shape=hexagon, color=black];
stat143[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.130.128.29:80, 153.253.95.165:*}[47.0588%]&lt;BR/&gt;{196.130.128.29:80, 153.253.1.129:*}[41.1765%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 49931: (3.06122%)&lt;BR/&gt; 49930: (3.06122%)&lt;BR/&gt; 49929: (3.06122%)&lt;BR/&gt; 49928: (3.06122%)&gt;];
}
3381--3602[label="0.8;8pkt 8fpkt"];
3381--3605[label="1;2pkt 2fpkt"];
3381--5693[label="0.8;8pkt 8fpkt"];
3602--3627[label="1;7pkt 7fpkt"];
3602--5693[label="1;15pkt 15fpkt"];
3627--5693[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="153.253.95.165" src_ip="196.130.128.29" src_port="80"/>
      <filter dst_ip="153.253.1.129" src_ip="196.130.128.29" src_port="80"/>
    </slice>
    <from sec="1204520981" usec="0"/>
    <to sec="1204521138" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.632622,1.77076,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_144{
style=filled;
color=gray75;
3603[label="153.253.75.252;s;2pkt 2fpkt", shape=diamond, color=yellow];
3677[label="195.22.58.227;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat144[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.253.75.252:8197, 195.22.58.227:8194}[50%]&lt;BR/&gt;{153.253.75.252:48129, 195.22.58.234:48129}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 48129: (33.3333%)&lt;BR/&gt; 8197: (33.3333%)&lt;BR/&gt; 8194: (33.3333%)&gt;];
}
3603--3677[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="195.22.58.234" dst_port="48129" src_ip="153.253.75.252" src_port="48129"/>
      <filter dst_ip="195.22.58.227" dst_port="8194" src_ip="153.253.75.252" src_port="8197"/>
    </slice>
    <from sec="1204520982" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.632622,1.77076,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="156.103.74.22"/>
      <from sec="1204520400" usec="0"/>
      <to sec="1204521228" usec="0"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.632622,1.77076,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="166.218.50.241"/>
      <from sec="1204520400" usec="0"/>
      <to sec="1204521224" usec="0"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521224" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_148{
style=filled;
color=gray75;
3731[label="153.253.91.137;d;2pkt 2fpkt", shape=diamond, color=yellow];
3732[label="84.82.86.173;s;1pkt 1fpkt", shape=diamond, color=yellow];
5790[label="84.82.86.173;s;1pkt 1fpkt", shape=hexagon, color=black];
stat148[shape=component, label=&lt;Rules:&lt;BR/&gt;{84.8.138.152:123, 153.253.91.137:123}[50%]&lt;BR/&gt;{84.82.86.173:123, 153.253.91.137:123}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 123: (100%)&gt;];
}
3731--3732[label="1;1pkt 1fpkt"];
3731--5790[label="1;1pkt 1fpkt"];
3732--5790[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="153.253.91.137" dst_port="123" src_ip="84.82.86.173" src_port="123"/>
      <filter dst_ip="153.253.91.137" dst_port="123" src_ip="84.8.138.152" src_port="123"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_149{
style=filled;
color=gray75;
2879[label="38.42.64.94;d;19pkt 19fpkt", shape=diamond, color=yellow];
3757[label="162.3.171.176;s;1pkt 1fpkt", shape=diamond, color=yellow];
5390[label="38.42.64.94;d;19pkt 19fpkt", shape=hexagon, color=black];
5824[label="162.3.171.176;s;1pkt 1fpkt", shape=hexagon, color=black];
stat149[shape=component, label=&lt;Rules:&lt;BR/&gt;{162.3.128.55:*, 38.42.64.94:995}[21.0526%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 995: (40%)&lt;BR/&gt; 33666: (5%)&lt;BR/&gt; 110: (5%)&lt;BR/&gt; 0: (5%)&lt;BR/&gt; 61638: (2.5%)&gt;];
}
2879--3757[label="1;1pkt 1fpkt"];
2879--5390[label="1;19pkt 19fpkt"];
2879--5824[label="1;1pkt 1fpkt"];
3757--5390[label="1;1pkt 1fpkt"];
3757--5824[label="1;1pkt 1fpkt"];
5390--5824[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="38.42.64.94" dst_port="995" src_ip="162.3.128.55"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.632622,1.77076,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="121.154.255.96"/>
      <from sec="1204520871" usec="0"/>
      <to sec="1204521187" usec="0"/>
    </slice>
    <from sec="1204520871" usec="0"/>
    <to sec="1204521187" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.632622,1.77076,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="153.253.107.180"/>
      <from sec="1204520923" usec="0"/>
      <to sec="1204521210" usec="0"/>
    </slice>
    <from sec="1204520923" usec="0"/>
    <to sec="1204521210" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_152{
style=filled;
color=gray75;
3876[label="153.253.4.58;s;7pkt 7fpkt", shape=diamond, color=yellow];
3887[label="200.171.35.89;d;3pkt 3fpkt", shape=diamond, color=yellow];
5934[label="153.253.4.58;s;7pkt 7fpkt", shape=hexagon, color=black];
stat152[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.253.4.58:*, 200.171.35.89:80}[42.8571%]&lt;BR/&gt;{153.253.4.58:*, 197.144.32.154:80}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1057: (8.82353%)&lt;BR/&gt; 1056: (8.82353%)&lt;BR/&gt; 1052: (8.82353%)&lt;BR/&gt; 1064: (5.88235%)&gt;];
}
3876--3887[label="1;3pkt 3fpkt"];
3876--5934[label="1;7pkt 7fpkt"];
3887--5934[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="200.171.35.89" dst_port="80" src_ip="153.253.4.58"/>
      <filter dst_ip="197.144.32.154" dst_port="80" src_ip="153.253.4.58"/>
    </slice>
    <from sec="1204521047" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.952275,1.75926,503,1 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_153{
style=filled;
color=gray75;
147[label="164.232.173.133s;1pkt 1fpkt", shape=rectangle, color=red];
3950[label="36.142.101.37;d;2pkt 2fpkt", shape=diamond, color=yellow];
3953[label="164.232.173.133;s;3pkt 3fpkt", shape=diamond, color=yellow];
stat153[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.232.173.133:54654, 214.29.51.131:80}[33.3333%]&lt;BR/&gt;{164.232.173.133:54664, 36.142.101.37:80}[33.3333%]&lt;BR/&gt;{164.232.173.133:54665, 36.142.101.37:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 54665: (25%)&lt;BR/&gt; 54664: (16.6667%)&lt;BR/&gt; 54654: (8.33333%)&gt;];
}
147--3950[label="1;1pkt 1fpkt"];
147--3953[label="1;1pkt 1fpkt"];
3950--3953[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="36.142.101.37" dst_port="80" src_ip="164.232.173.133" src_port="54665"/>
      <filter dst_ip="36.142.101.37" dst_port="80" src_ip="164.232.173.133" src_port="54664"/>
      <filter dst_ip="214.29.51.131" dst_port="80" src_ip="164.232.173.133" src_port="54654"/>
    </slice>
    <from sec="1204521179" usec="0"/>
    <to sec="1204521283" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_156{
style=filled;
color=gray75;
817[label="82.150.134.29;s;1pkt 1fpkt", shape=diamond, color=yellow];
4075[label="82.150.134.29;s;1pkt 1fpkt", shape=hexagon, color=black];
stat156[shape=component, label=&lt;Rules:&lt;BR/&gt;{82.150.134.29:80, 153.253.116.185:2369}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2369: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
817--4075[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="153.253.116.185" dst_port="2369" src_ip="82.150.134.29" src_port="80"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204520514" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_160{
style=filled;
color=gray75;
935[label="153.253.107.45;d;11pkt 11fpkt", shape=diamond, color=yellow];
1197[label="208.232.70.114;s;2pkt 2fpkt", shape=diamond, color=yellow];
4112[label="153.253.107.45;d;11pkt 11fpkt", shape=hexagon, color=black];
7491[label="208.232.70.114;3pkt 3fpkt", shape=pentagon, color=darkviolet];
stat160[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 153.253.107.45:37757}[50%]&lt;BR/&gt;{208.232.70.114:41947, *:*}[21.4286%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 37757: (31.4815%)&lt;BR/&gt; 41947: (11.1111%)&lt;BR/&gt; 16205: (7.40741%)&lt;BR/&gt; 62010: (3.7037%)&lt;BR/&gt; 54991: (3.7037%)&gt;];
}
935--1197[label="0.5;1pkt 1fpkt"];
935--4112[label="1;11pkt 11fpkt"];
1197--4112[label="0.5;1pkt 1fpkt"];
1197--7491[label="0.5;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="208.232.70.114" src_port="41947"/>
      <filter dst_ip="153.253.107.45" dst_port="37757"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204520987" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_163{
style=filled;
color=gray75;
1374[label="213.84.39.3;s;580pkt 580fpkt", shape=diamond, color=yellow];
1508[label="197.33.208.157;d;304pkt 304fpkt", shape=diamond, color=yellow];
1671[label="197.148.87.173;s;13pkt 13fpkt", shape=diamond, color=yellow];
1853[label="197.33.208.224;d;291pkt 291fpkt", shape=diamond, color=yellow];
4265[label="213.84.39.3;s;138pkt 138fpkt", shape=hexagon, color=black];
4308[label="197.33.208.157;d;106pkt 106fpkt", shape=hexagon, color=black];
4380[label="197.148.87.173;s;3pkt 3fpkt", shape=hexagon, color=black];
5011[label="197.33.208.224;d;166pkt 166fpkt", shape=hexagon, color=black];
stat163[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.84.39.3:*, 197.33.208.224:80}[48.7395%]&lt;BR/&gt;{213.84.39.3:*, 197.33.208.157:80}[48.7395%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.8751%)&lt;BR/&gt; 39896: (0.124922%)&lt;BR/&gt; 39895: (0.124922%)&lt;BR/&gt; 39894: (0.124922%)&lt;BR/&gt; 6000: (0.124922%)&gt;];
}
1374--1508[label="0.953947;290pkt 290fpkt"];
1374--1853[label="0.996564;290pkt 290fpkt"];
1374--4265[label="1;138pkt 138fpkt"];
1374--4308[label="0.95283;101pkt 101fpkt"];
1374--5011[label="0.993976;165pkt 165fpkt"];
1508--1671[label="1;13pkt 13fpkt"];
1508--2147[label="0.00328947;1pkt 1fpkt"];
1508--4265[label="0.5;69pkt 69fpkt"];
1508--4308[label="1;106pkt 106fpkt"];
1508--4380[label="1;3pkt 3fpkt"];
1508--4664[label="0.00328947;1pkt 1fpkt"];
1508--6065[label="0.00328947;1pkt 1fpkt"];
1508--6316[label="0.00328947;1pkt 1fpkt"];
1508--6359[label="0.00328947;1pkt 1fpkt"];
1508--6396[label="0.00328947;1pkt 1fpkt"];
1508--7880[label="0.00328947;1pkt 1fpkt"];
1508--9126[label="0.00328947;1pkt 1fpkt"];
1508--9570[label="0.00328947;1pkt 1fpkt"];
1671--4308[label="0.307692;4pkt 4fpkt"];
1671--4380[label="1;3pkt 3fpkt"];
1853--2147[label="0.00343643;1pkt 1fpkt"];
1853--4265[label="0.5;69pkt 69fpkt"];
1853--4664[label="0.00343643;1pkt 1fpkt"];
1853--5011[label="1;166pkt 166fpkt"];
1853--6065[label="0.00343643;1pkt 1fpkt"];
1853--6316[label="0.00343643;1pkt 1fpkt"];
1853--6359[label="0.00343643;1pkt 1fpkt"];
1853--6396[label="0.00343643;1pkt 1fpkt"];
1853--7880[label="0.00343643;1pkt 1fpkt"];
1853--9126[label="0.00343643;1pkt 1fpkt"];
1853--9570[label="0.00343643;1pkt 1fpkt"];
4265--4308[label="0.650943;69pkt 69fpkt"];
4265--5011[label="0.5;69pkt 69fpkt"];
4308--4380[label="1;3pkt 3fpkt"];
4308--4664[label="0.00943396;1pkt 1fpkt"];
4308--6065[label="0.00943396;1pkt 1fpkt"];
4308--6316[label="0.00943396;1pkt 1fpkt"];
4308--6359[label="0.00943396;1pkt 1fpkt"];
4308--6396[label="0.00943396;1pkt 1fpkt"];
4308--7880[label="0.00943396;1pkt 1fpkt"];
4308--9126[label="0.00943396;1pkt 1fpkt"];
4308--9570[label="0.00943396;1pkt 1fpkt"];
5011--6065[label="0.0060241;1pkt 1fpkt"];
5011--6316[label="0.0060241;1pkt 1fpkt"];
5011--6359[label="0.0060241;1pkt 1fpkt"];
5011--6396[label="0.0060241;1pkt 1fpkt"];
5011--7880[label="0.0060241;1pkt 1fpkt"];
5011--9126[label="0.0060241;1pkt 1fpkt"];
5011--9570[label="0.0060241;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="197.33.208.157" dst_port="80" src_ip="213.84.39.3"/>
      <filter dst_ip="197.33.208.224" dst_port="80" src_ip="213.84.39.3"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,011,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_166{
style=filled;
color=gray75;
925[label="153.253.137.75;d;106pkt 106fpkt", shape=diamond, color=yellow];
1423[label="83.80.121.120;s;1pkt 1fpkt", shape=diamond, color=yellow];
1437[label="13.97.50.211;s;1pkt 1fpkt", shape=diamond, color=yellow];
4281[label="83.80.121.120;s;1pkt 1fpkt", shape=hexagon, color=black];
5218[label="153.253.137.75;d;106pkt 106fpkt", shape=hexagon, color=black];
5384[label="13.97.50.211;s;1pkt 1fpkt", shape=hexagon, color=black];
7437[label="5.140.234.108;64pkt 64fpkt", shape=pentagon, color=darkviolet];
stat166[shape=component, label=&lt;Rules:&lt;BR/&gt;{5.140.234.108:8282, 153.253.137.75:*}[58.0357%]&lt;BR/&gt;{218.45.26.94:*, 153.253.137.75:*}[33.0357%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8282: (32.5%)&lt;BR/&gt; 8000: (7.14286%)&lt;BR/&gt; 500: (6.07143%)&lt;BR/&gt; 1099: (2.85714%)&lt;BR/&gt; 53: (2.85714%)&gt;];
}
925--1423[label="1;1pkt 1fpkt"];
925--1437[label="1;1pkt 1fpkt"];
925--2242[label="0.00943396;1pkt 1fpkt"];
925--4281[label="1;1pkt 1fpkt"];
925--5218[label="1;106pkt 106fpkt"];
925--5379[label="0.00943396;1pkt 1fpkt"];
925--5384[label="1;1pkt 1fpkt"];
925--6320[label="0.0660377;7pkt 7fpkt"];
925--6325[label="0.0188679;2pkt 2fpkt"];
925--6363[label="0.0188679;2pkt 2fpkt"];
925--6400[label="0.0188679;2pkt 2fpkt"];
925--7437[label="0.90625;58pkt 58fpkt"];
1423--4281[label="1;1pkt 1fpkt"];
1423--5218[label="1;1pkt 1fpkt"];
1437--5218[label="1;1pkt 1fpkt"];
1437--5384[label="1;1pkt 1fpkt"];
4281--5218[label="1;1pkt 1fpkt"];
5218--5379[label="0.00943396;1pkt 1fpkt"];
5218--5384[label="1;1pkt 1fpkt"];
5218--6320[label="0.0660377;7pkt 7fpkt"];
5218--6325[label="0.0188679;2pkt 2fpkt"];
5218--6363[label="0.0188679;2pkt 2fpkt"];
5218--6400[label="0.0188679;2pkt 2fpkt"];
5218--7437[label="0.90625;58pkt 58fpkt"];
</description>
    <slice>
      <filter dst_ip="153.253.137.75" src_ip="218.45.26.94"/>
      <filter dst_ip="153.253.137.75" src_ip="5.140.234.108" src_port="8282"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_167{
style=filled;
color=gray75;
1458[label="164.232.84.153;s;450pkt 450fpkt", shape=diamond, color=yellow];
4299[label="164.232.84.153;s;450pkt 450fpkt", shape=hexagon, color=black];
stat167[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.232.84.153:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1458--4299[label="1;450pkt 450fpkt"];
</description>
    <slice>
      <filter src_ip="164.232.84.153"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_168{
style=filled;
color=gray75;
1491[label="197.33.223.2;s;484pkt 484fpkt", shape=diamond, color=yellow];
4304[label="197.33.223.2;s;484pkt 484fpkt", shape=hexagon, color=black];
stat168[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.33.223.2:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1491--1614[label="0.0147059;1pkt 1fpkt"];
1491--2146[label="0.00206612;1pkt 1fpkt"];
1491--2583[label="0.0047619;1pkt 1fpkt"];
1491--2857[label="0.00255102;1pkt 1fpkt"];
1491--3192[label="0.00277778;1pkt 1fpkt"];
1491--3420[label="0.00314465;1pkt 1fpkt"];
1491--3427[label="0.00363636;1pkt 1fpkt"];
1491--3428[label="0.003367;1pkt 1fpkt"];
1491--3437[label="0.0119048;1pkt 1fpkt"];
1491--3449[label="0.00289855;1pkt 1fpkt"];
1491--3729[label="0.0037037;1pkt 1fpkt"];
1491--4304[label="1;484pkt 484fpkt"];
1491--5553[label="0.003367;1pkt 1fpkt"];
1491--5731[label="0.00314465;1pkt 1fpkt"];
1491--5789[label="0.0037037;1pkt 1fpkt"];
4304--5553[label="0.003367;1pkt 1fpkt"];
4304--5731[label="0.00314465;1pkt 1fpkt"];
4304--5789[label="0.0037037;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="197.33.223.2"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_170{
style=filled;
color=gray75;
1581[label="156.103.147.26;s;265pkt 265fpkt", shape=diamond, color=yellow];
4340[label="156.103.147.26;s;95pkt 95fpkt", shape=hexagon, color=black];
6662[label="156.103.147.26;281pkt 281fpkt", shape=pentagon, color=darkviolet];
stat170[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.103.147.26:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 59570: (0.312012%)&lt;BR/&gt; 65347: (0.234009%)&lt;BR/&gt; 65133: (0.234009%)&lt;BR/&gt; 64951: (0.234009%)&gt;];
}
1581--4146[label="0.00877193;1pkt 1fpkt"];
1581--4340[label="1;95pkt 95fpkt"];
1581--6318[label="0.0867925;23pkt 23fpkt"];
1581--6321[label="0.0528302;14pkt 14fpkt"];
1581--6361[label="0.0867925;23pkt 23fpkt"];
1581--6398[label="0.0867925;23pkt 23fpkt"];
1581--6662[label="1;265pkt 265fpkt"];
4340--6662[label="1;95pkt 95fpkt"];
</description>
    <slice>
      <filter src_ip="156.103.147.26" src_port="80"/>
    </slice>
    <from sec="1204520403" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_173{
style=filled;
color=gray75;
1663[label="153.253.65.82;s;159pkt 159fpkt", shape=diamond, color=yellow];
1708[label="214.238.75.203;d;97pkt 97fpkt", shape=diamond, color=yellow];
1753[label="36.113.59.198;d;52pkt 52fpkt", shape=diamond, color=yellow];
4408[label="36.113.59.198;d;52pkt 52fpkt", shape=hexagon, color=black];
4629[label="214.238.75.203;d;97pkt 97fpkt", shape=hexagon, color=black];
stat173[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.253.65.82:*, 214.238.75.203:80}[59.7484%]&lt;BR/&gt;{153.253.65.82:*, 36.113.59.198:80}[32.7044%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.3435%)&lt;BR/&gt; 443: (0.656455%)&lt;BR/&gt; 50794: (0.328228%)&lt;BR/&gt; 50792: (0.328228%)&lt;BR/&gt; 50790: (0.328228%)&gt;];
}
1663--1708[label="1;97pkt 97fpkt"];
1663--1753[label="1;52pkt 52fpkt"];
1663--2666[label="0.00793651;1pkt 1fpkt"];
1663--2864[label="0.00806452;1pkt 1fpkt"];
1663--2927[label="0.00819672;1pkt 1fpkt"];
1663--4408[label="1;52pkt 52fpkt"];
1663--4629[label="1;97pkt 97fpkt"];
1663--5251[label="0.0138889;1pkt 1fpkt"];
1663--5269[label="0.00793651;1pkt 1fpkt"];
1708--4629[label="1;97pkt 97fpkt"];
1753--4408[label="1;52pkt 52fpkt"];
</description>
    <slice>
      <filter dst_ip="214.238.75.203" dst_port="80" src_ip="153.253.65.82"/>
      <filter dst_ip="36.113.59.198" dst_port="80" src_ip="153.253.65.82"/>
    </slice>
    <from sec="1204520444" usec="0"/>
    <to sec="1204520561" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_174{
style=filled;
color=gray75;
1291[label="196.25.114.103;s;4679pkt 4679fpkt", shape=diamond, color=yellow];
4465[label="196.25.114.103;s;1451pkt 1451fpkt", shape=hexagon, color=black];
stat174[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.25.114.103:16756, *:*}[98.8245%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 16756: (49.3964%)&lt;BR/&gt; 3174: (0.603589%)&lt;BR/&gt; 16001: (0.48124%)&lt;BR/&gt; 6881: (0.391517%)&lt;BR/&gt; 1501: (0.391517%)&gt;];
}
1291--4035[label="0.0588235;1pkt 1fpkt"];
1291--4465[label="1;1451pkt 1451fpkt"];
</description>
    <slice>
      <filter src_ip="196.25.114.103" src_port="16756"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_176{
style=filled;
color=gray75;
816[label="82.150.134.29;d;1pkt 1fpkt", shape=diamond, color=yellow];
4492[label="82.150.134.29;d;1pkt 1fpkt", shape=hexagon, color=black];
stat176[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.253.116.185:2369, 82.150.134.29:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2369: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
816--4492[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="82.150.134.29" dst_port="80" src_ip="153.253.116.185" src_port="2369"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204520514" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_177{
style=filled;
color=gray75;
1880[label="156.124.196.43;d;452pkt 452fpkt", shape=diamond, color=yellow];
4531[label="156.124.196.43;d;245pkt 245fpkt", shape=hexagon, color=black];
7304[label="84.215.207.94;2pkt 2fpkt", shape=pentagon, color=darkviolet];
7439[label="84.227.14.109;2pkt 2fpkt", shape=pentagon, color=darkviolet];
7742[label="216.127.17.146;2pkt 2fpkt", shape=pentagon, color=darkviolet];
8245[label="4.1.223.201;3pkt 3fpkt", shape=pentagon, color=darkviolet];
stat177[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 156.124.196.43:35947}[75.9382%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 35947: (38.1728%)&lt;BR/&gt; 20129: (3.39943%)&lt;BR/&gt; 0: (1.27479%)&lt;BR/&gt; 21588: (0.849858%)&lt;BR/&gt; 16597: (0.849858%)&gt;];
}
1880--4531[label="1;245pkt 245fpkt"];
1880--7304[label="1;2pkt 2fpkt"];
1880--7439[label="1;2pkt 2fpkt"];
1880--7742[label="0.5;1pkt 1fpkt"];
1880--8245[label="1;3pkt 3fpkt"];
4531--7304[label="1;2pkt 2fpkt"];
4531--7439[label="0.5;1pkt 1fpkt"];
4531--8245[label="0.666667;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="156.124.196.43" dst_port="35947"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_178{
style=filled;
color=gray75;
965[label="33.40.25.42;d;2pkt 2fpkt", shape=diamond, color=yellow];
966[label="156.103.97.6;s;1094pkt 1094fpkt", shape=diamond, color=yellow];
1480[label="13.107.67.242;d;1pkt 1fpkt", shape=diamond, color=yellow];
2998[label="21.64.197.168;d;145pkt 145fpkt", shape=diamond, color=yellow];
3319[label="32.57.56.8;d;1pkt 1fpkt", shape=diamond, color=yellow];
4541[label="156.103.97.6;s;70pkt 70fpkt", shape=hexagon, color=black];
5033[label="13.107.67.242;d;1pkt 1fpkt", shape=hexagon, color=black];
5906[label="32.57.56.8;d;1pkt 1fpkt", shape=hexagon, color=black];
6484[label="156.103.97.6;1158pkt 1158fpkt", shape=pentagon, color=darkviolet];
stat178[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.103.97.6:27949, *:*}[78.1708%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 27949: (35.8067%)&lt;BR/&gt; 80: (4.14476%)&lt;BR/&gt; 6881: (2.91144%)&lt;BR/&gt; 53: (0.545896%)&lt;BR/&gt; 1031: (0.424586%)&gt;];
}
965--966[label="1;2pkt 2fpkt"];
965--4541[label="1;2pkt 2fpkt"];
965--6484[label="1;2pkt 2fpkt"];
966--1480[label="1;1pkt 1fpkt"];
966--2998[label="1;145pkt 145fpkt"];
966--3319[label="1;1pkt 1fpkt"];
966--4541[label="1;70pkt 70fpkt"];
966--5033[label="1;1pkt 1fpkt"];
966--5906[label="1;1pkt 1fpkt"];
966--6318[label="0.00274223;3pkt 3fpkt"];
966--6361[label="0.00274223;3pkt 3fpkt"];
966--6398[label="0.00274223;3pkt 3fpkt"];
966--6484[label="0.999086;1093pkt 1093fpkt"];
1480--4541[label="1;1pkt 1fpkt"];
1480--5033[label="1;1pkt 1fpkt"];
1480--6484[label="1;1pkt 1fpkt"];
2998--4541[label="0.0285714;2pkt 2fpkt"];
2998--6318[label="0.0206897;3pkt 3fpkt"];
2998--6361[label="0.0206897;3pkt 3fpkt"];
2998--6398[label="0.0206897;3pkt 3fpkt"];
2998--6484[label="1;145pkt 145fpkt"];
3319--5906[label="1;1pkt 1fpkt"];
3319--6484[label="1;1pkt 1fpkt"];
4541--5033[label="1;1pkt 1fpkt"];
4541--6484[label="0.985714;69pkt 69fpkt"];
5033--6484[label="1;1pkt 1fpkt"];
5906--6484[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="156.103.97.6" src_port="27949"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.910784,1.65195,999,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_185{
style=filled;
color=gray75;
2158[label="153.253.90.64;s;2pkt 2fpkt", shape=diamond, color=yellow];
2159[label="214.29.58.43;d;2pkt 2fpkt", shape=diamond, color=yellow];
4668[label="153.253.90.64;s;2pkt 2fpkt", shape=hexagon, color=black];
7009[label="153.253.90.64;2pkt 2fpkt", shape=pentagon, color=darkviolet];
8819[label="153.253.90.64;2pkt 2fpkt", shape=invtriangle, color=brown];
stat185[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.253.197.97:110, 214.29.58.43:38202}[33.3333%]&lt;BR/&gt;{153.253.90.64:995, 214.29.58.32:37852}[33.3333%]&lt;BR/&gt;{153.253.90.64:995, 214.29.58.43:36869}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 995: (45%)&lt;BR/&gt; 36869: (25%)&lt;BR/&gt; 37852: (20%)&lt;BR/&gt; 38202: (5%)&lt;BR/&gt; 110: (5%)&gt;];
}
2158--2159[label="0.5;1pkt 1fpkt"];
2158--4668[label="1;2pkt 2fpkt"];
2158--7009[label="1;2pkt 2fpkt"];
2158--8819[label="1;2pkt 2fpkt"];
2159--4668[label="0.5;1pkt 1fpkt"];
2159--7009[label="0.5;1pkt 1fpkt"];
2159--8819[label="0.5;1pkt 1fpkt"];
4668--7009[label="1;2pkt 2fpkt"];
4668--8819[label="1;2pkt 2fpkt"];
7009--8819[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="214.29.58.43" dst_port="36869" src_ip="153.253.90.64" src_port="995"/>
      <filter dst_ip="214.29.58.32" dst_port="37852" src_ip="153.253.90.64" src_port="995"/>
      <filter dst_ip="214.29.58.43" dst_port="38202" src_ip="153.253.197.97" src_port="110"/>
    </slice>
    <from sec="1204520636" usec="0"/>
    <to sec="1204520680" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,020,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_187{
style=filled;
color=gray75;
1284[label="156.103.133.53;s;452pkt 452fpkt", shape=diamond, color=yellow];
4707[label="156.103.133.53;s;450pkt 450fpkt", shape=hexagon, color=black];
6928[label="156.103.133.53;3pkt 3fpkt", shape=pentagon, color=darkviolet];
stat187[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.103.133.53:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1284--4707[label="1;450pkt 450fpkt"];
1284--6928[label="1;3pkt 3fpkt"];
4707--6928[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter src_ip="156.103.133.53"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,010,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_189{
style=filled;
color=gray75;
1381[label="222.76.180.252;s;1353pkt 1353fpkt", shape=diamond, color=yellow];
2562[label="156.131.24.214;d;475pkt 475fpkt", shape=diamond, color=yellow];
2569[label="156.213.104.204;d;490pkt 490fpkt", shape=diamond, color=yellow];
2895[label="156.213.4.14;d;465pkt 465fpkt", shape=diamond, color=yellow];
4739[label="222.76.180.252;s;628pkt 628fpkt", shape=hexagon, color=black];
7363[label="223.32.57.100;84pkt 84fpkt", shape=pentagon, color=darkviolet];
stat189[shape=component, label=&lt;Rules:&lt;BR/&gt;{222.76.180.252:80, 156.213.104.204:*}[32.0361%]&lt;BR/&gt;{222.76.180.252:80, 156.131.24.214:*}[31.5497%]&lt;BR/&gt;{222.76.180.252:80, 156.213.4.14:*}[30.4378%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 56492: (0.0858369%)&lt;BR/&gt; 52930: (0.0858369%)&lt;BR/&gt; 43512: (0.0858369%)&lt;BR/&gt; 38103: (0.0858369%)&gt;];
}
1381--2562[label="0.955789;454pkt 454fpkt"];
1381--2569[label="0.940816;461pkt 461fpkt"];
1381--2895[label="0.941935;438pkt 438fpkt"];
1381--4739[label="1;628pkt 628fpkt"];
1381--6318[label="0.0657797;89pkt 89fpkt"];
1381--6321[label="0.0672579;91pkt 91fpkt"];
1381--6326[label="0.00221729;3pkt 3fpkt"];
1381--6361[label="0.0657797;89pkt 89fpkt"];
1381--6364[label="0.00221729;3pkt 3fpkt"];
1381--6398[label="0.0657797;89pkt 89fpkt"];
1381--6401[label="0.00221729;3pkt 3fpkt"];
2562--4739[label="0.448421;213pkt 213fpkt"];
2562--6318[label="0.0715789;34pkt 34fpkt"];
2562--6321[label="0.0631579;30pkt 30fpkt"];
2562--6326[label="0.00210526;1pkt 1fpkt"];
2562--6361[label="0.0715789;34pkt 34fpkt"];
2562--6364[label="0.00210526;1pkt 1fpkt"];
2562--6398[label="0.0715789;34pkt 34fpkt"];
2562--6401[label="0.00210526;1pkt 1fpkt"];
2562--7363[label="0.25;21pkt 21fpkt"];
2569--4739[label="0.432653;212pkt 212fpkt"];
2569--6318[label="0.0591837;29pkt 29fpkt"];
2569--6321[label="0.0673469;33pkt 33fpkt"];
2569--6361[label="0.0591837;29pkt 29fpkt"];
2569--6398[label="0.0591837;29pkt 29fpkt"];
2569--7363[label="0.333333;28pkt 28fpkt"];
2895--4739[label="0.436559;203pkt 203fpkt"];
2895--6318[label="0.0623656;29pkt 29fpkt"];
2895--6321[label="0.0623656;29pkt 29fpkt"];
2895--6326[label="0.00430108;2pkt 2fpkt"];
2895--6361[label="0.0623656;29pkt 29fpkt"];
2895--6364[label="0.00430108;2pkt 2fpkt"];
2895--6398[label="0.0623656;29pkt 29fpkt"];
2895--6401[label="0.00430108;2pkt 2fpkt"];
2895--7363[label="0.309524;26pkt 26fpkt"];
4739--6318[label="0.14172;89pkt 89fpkt"];
4739--6321[label="0.00636943;4pkt 4fpkt"];
4739--6361[label="0.14172;89pkt 89fpkt"];
4739--6398[label="0.14172;89pkt 89fpkt"];
</description>
    <slice>
      <filter dst_ip="156.213.104.204" src_ip="222.76.180.252" src_port="80"/>
      <filter dst_ip="156.131.24.214" src_ip="222.76.180.252" src_port="80"/>
      <filter dst_ip="156.213.4.14" src_ip="222.76.180.252" src_port="80"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521291" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_190{
style=filled;
color=gray75;
2237[label="156.161.213.79;s;128pkt 128fpkt", shape=diamond, color=yellow];
4748[label="156.161.213.79;s;128pkt 128fpkt", shape=hexagon, color=black];
stat190[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.161.213.79:*, 56.233.34.202:80}[31.25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 60200: (0.390625%)&lt;BR/&gt; 60187: (0.390625%)&lt;BR/&gt; 60169: (0.390625%)&lt;BR/&gt; 60146: (0.390625%)&gt;];
}
2237--4748[label="1;128pkt 128fpkt"];
</description>
    <slice>
      <filter dst_ip="56.233.34.202" dst_port="80" src_ip="156.161.213.79"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204520974" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_191{
style=filled;
color=gray75;
949[label="13.106.187.127;d;1pkt 1fpkt", shape=diamond, color=yellow];
950[label="156.120.82.47;s;123pkt 123fpkt", shape=diamond, color=yellow];
3589[label="85.111.105.163;d;1pkt 1fpkt", shape=diamond, color=yellow];
3949[label="213.151.92.8;d;1pkt 1fpkt", shape=diamond, color=yellow];
4116[label="156.120.82.47;s;123pkt 123fpkt", shape=hexagon, color=black];
4761[label="13.106.187.127;d;1pkt 1fpkt", shape=hexagon, color=black];
6868[label="156.120.82.47;2pkt 2fpkt", shape=pentagon, color=darkviolet];
stat191[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.120.82.47:26835, *:*}[67.4797%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 26835: (32.9365%)&lt;BR/&gt; 15816: (6.74603%)&lt;BR/&gt; 6642: (5.15873%)&lt;BR/&gt; 8220: (1.5873%)&lt;BR/&gt; 6652: (1.5873%)&gt;];
}
949--950[label="1;1pkt 1fpkt"];
949--4116[label="1;1pkt 1fpkt"];
949--4761[label="1;1pkt 1fpkt"];
950--3589[label="1;1pkt 1fpkt"];
950--3949[label="1;1pkt 1fpkt"];
950--4116[label="1;123pkt 123fpkt"];
950--4761[label="1;1pkt 1fpkt"];
950--6868[label="1;2pkt 2fpkt"];
3589--4116[label="1;1pkt 1fpkt"];
3589--6868[label="1;1pkt 1fpkt"];
3949--4116[label="1;1pkt 1fpkt"];
3949--6868[label="1;1pkt 1fpkt"];
4116--4761[label="1;1pkt 1fpkt"];
4116--6868[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_ip="156.120.82.47" src_port="26835"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_192{
style=filled;
color=gray75;
2263[label="197.33.223.20;d;311pkt 311fpkt", shape=diamond, color=yellow];
2264[label="197.134.56.162;s;341pkt 341fpkt", shape=diamond, color=yellow];
4768[label="197.134.56.162;s;341pkt 341fpkt", shape=hexagon, color=black];
7890[label="197.134.56.162;372pkt 372fpkt", shape=pentagon, color=darkviolet];
stat192[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.134.56.162:*, 197.33.223.20:1433}[88.5027%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1433: (49.9267%)&lt;BR/&gt; 4936: (0.25641%)&lt;BR/&gt; 4863: (0.25641%)&lt;BR/&gt; 4272: (0.25641%)&lt;BR/&gt; 4248: (0.25641%)&gt;];
}
2263--2264[label="0.993569;309pkt 309fpkt"];
2263--4417[label="0.00321543;1pkt 1fpkt"];
2263--4664[label="0.00321543;1pkt 1fpkt"];
2263--4768[label="0.993569;309pkt 309fpkt"];
2263--6065[label="0.00321543;1pkt 1fpkt"];
2263--6316[label="0.00321543;1pkt 1fpkt"];
2263--6359[label="0.00321543;1pkt 1fpkt"];
2263--6396[label="0.00321543;1pkt 1fpkt"];
2263--7880[label="0.00321543;1pkt 1fpkt"];
2263--7890[label="0.993569;309pkt 309fpkt"];
2263--9126[label="0.00321543;1pkt 1fpkt"];
2263--9570[label="0.00321543;1pkt 1fpkt"];
2264--4768[label="1;341pkt 341fpkt"];
2264--7890[label="1;341pkt 341fpkt"];
4768--7890[label="1;341pkt 341fpkt"];
</description>
    <slice>
      <filter dst_ip="197.33.223.20" dst_port="1433" src_ip="197.134.56.162"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_194{
style=filled;
color=gray75;
1932[label="153.253.88.159;s;237pkt 237fpkt", shape=diamond, color=yellow];
2300[label="113.180.234.224;d;209pkt 209fpkt", shape=diamond, color=yellow];
4799[label="153.253.88.159;s;105pkt 105fpkt", shape=hexagon, color=black];
5808[label="113.180.234.224;d;209pkt 209fpkt", shape=hexagon, color=black];
stat194[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.253.88.159:*, 113.180.234.224:80}[88.1857%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3995: (0.263158%)&lt;BR/&gt; 3994: (0.263158%)&lt;BR/&gt; 3993: (0.263158%)&lt;BR/&gt; 3992: (0.263158%)&gt;];
}
1932--2300[label="1;209pkt 209fpkt"];
1932--4799[label="1;105pkt 105fpkt"];
1932--5808[label="1;209pkt 209fpkt"];
2300--4799[label="0.904762;95pkt 95fpkt"];
2300--5808[label="1;209pkt 209fpkt"];
4799--5808[label="0.904762;95pkt 95fpkt"];
</description>
    <slice>
      <filter dst_ip="113.180.234.224" dst_port="80" src_ip="153.253.88.159"/>
    </slice>
    <from sec="1204520401" usec="0"/>
    <to sec="1204521227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_195{
style=filled;
color=gray75;
1056[label="12.136.24.1;d;18pkt 18fpkt", shape=diamond, color=yellow];
1474[label="153.253.88.216;s;162pkt 162fpkt", shape=diamond, color=yellow];
2268[label="12.136.25.21;d;143pkt 143fpkt", shape=diamond, color=yellow];
4803[label="12.136.24.1;d;16pkt 16fpkt", shape=hexagon, color=black];
5032[label="12.136.25.21;d;143pkt 143fpkt", shape=hexagon, color=black];
8361[label="153.253.88.216;175pkt 175fpkt", shape=pentagon, color=darkviolet];
stat195[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.253.88.216:*, 12.136.25.21:80}[81.7143%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4336: (0.304414%)&lt;BR/&gt; 4333: (0.304414%)&lt;BR/&gt; 4330: (0.304414%)&lt;BR/&gt; 4327: (0.304414%)&gt;];
}
1056--1474[label="1;18pkt 18fpkt"];
1056--4803[label="1;16pkt 16fpkt"];
1056--8361[label="1;18pkt 18fpkt"];
1474--2268[label="1;143pkt 143fpkt"];
1474--4086[label="0.00617284;1pkt 1fpkt"];
1474--4803[label="1;16pkt 16fpkt"];
1474--5032[label="1;143pkt 143fpkt"];
1474--6058[label="0.00617284;1pkt 1fpkt"];
1474--8361[label="1;162pkt 162fpkt"];
2268--5032[label="1;143pkt 143fpkt"];
2268--8361[label="1;143pkt 143fpkt"];
4803--8361[label="1;16pkt 16fpkt"];
5032--8361[label="1;143pkt 143fpkt"];
</description>
    <slice>
      <filter dst_ip="12.136.25.21" dst_port="80" src_ip="153.253.88.216"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521283" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_197{
style=filled;
color=gray75;
1667[label="197.96.153.170;d;28pkt 28fpkt", shape=diamond, color=yellow];
1668[label="152.18.69.36;s;34pkt 34fpkt", shape=diamond, color=yellow];
4869[label="197.96.153.170;d;13pkt 13fpkt", shape=hexagon, color=black];
4870[label="152.18.69.36;s;13pkt 13fpkt", shape=hexagon, color=black];
stat197[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.18.69.36:*, 197.96.153.170:80}[77.1429%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 8646: (2.27273%)&lt;BR/&gt; 8645: (2.27273%)&lt;BR/&gt; 8644: (2.27273%)&lt;BR/&gt; 8643: (2.27273%)&gt;];
}
1667--1668[label="0.964286;27pkt 27fpkt"];
1667--4869[label="1;13pkt 13fpkt"];
1667--4870[label="1;13pkt 13fpkt"];
1668--4869[label="1;13pkt 13fpkt"];
1668--4870[label="1;13pkt 13fpkt"];
4869--4870[label="1;13pkt 13fpkt"];
</description>
    <slice>
      <filter dst_ip="197.96.153.170" dst_port="80" src_ip="152.18.69.36"/>
    </slice>
    <from sec="1204520449" usec="0"/>
    <to sec="1204521227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,501,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_198{
style=filled;
color=gray75;
2087[label="166.218.56.115;d;32pkt 32fpkt", shape=diamond, color=yellow];
2088[label="221.80.205.3;s;30pkt 30fpkt", shape=diamond, color=yellow];
4901[label="166.218.56.115;d;32pkt 32fpkt", shape=hexagon, color=black];
4902[label="221.80.205.3;s;30pkt 30fpkt", shape=hexagon, color=black];
6452[label="221.80.205.3;32pkt 32fpkt", shape=pentagon, color=darkviolet];
stat198[shape=component, label=&lt;Rules:&lt;BR/&gt;{221.80.205.3:21, 166.218.56.115:*}[47.0588%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (24.359%)&lt;BR/&gt; 1050: (3.20513%)&lt;BR/&gt; 4941: (1.60256%)&lt;BR/&gt; 4344: (1.60256%)&lt;BR/&gt; 4311: (1.60256%)&gt;];
}
2087--2088[label="1;30pkt 30fpkt"];
2087--4901[label="1;32pkt 32fpkt"];
2087--4902[label="1;30pkt 30fpkt"];
2087--6452[label="0.9375;30pkt 30fpkt"];
2088--4901[label="1;30pkt 30fpkt"];
2088--4902[label="1;30pkt 30fpkt"];
2088--6452[label="1;30pkt 30fpkt"];
4901--4902[label="1;30pkt 30fpkt"];
4901--6452[label="0.9375;30pkt 30fpkt"];
4902--6452[label="1;30pkt 30fpkt"];
</description>
    <slice>
      <filter dst_ip="166.218.56.115" src_ip="221.80.205.3" src_port="21"/>
    </slice>
    <from sec="1204520558" usec="0"/>
    <to sec="1204520887" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_200{
style=filled;
color=gray75;
2537[label="196.25.99.225;d;640pkt 640fpkt", shape=diamond, color=yellow];
4980[label="196.25.99.225;d;640pkt 640fpkt", shape=hexagon, color=black];
stat200[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:20129, 196.25.99.225:20129}[67.6562%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 20129: (81.25%)&lt;BR/&gt; 0: (5.15625%)&lt;BR/&gt; 10007: (0.3125%)&lt;BR/&gt; 65299: (0.15625%)&lt;BR/&gt; 10065: (0.15625%)&gt;];
}
2537--4980[label="1;640pkt 640fpkt"];
</description>
    <slice>
      <filter dst_ip="196.25.99.225" dst_port="20129" src_port="20129"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_203{
style=filled;
color=gray75;
1905[label="197.33.219.129;d;378pkt 378fpkt", shape=diamond, color=yellow];
5039[label="197.33.219.129;d;352pkt 352fpkt", shape=hexagon, color=black];
stat203[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 197.33.219.129:0}[99.4709%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.4521%)&lt;BR/&gt; 64898: (0.136986%)&lt;BR/&gt; 6000: (0.136986%)&lt;BR/&gt; 2967: (0.136986%)&lt;BR/&gt; 80: (0.136986%)&gt;];
}
1905--2147[label="0.0026455;1pkt 1fpkt"];
1905--3207[label="0.0149254;1pkt 1fpkt"];
1905--4417[label="0.0026455;1pkt 1fpkt"];
1905--4664[label="0.0026455;1pkt 1fpkt"];
1905--5039[label="1;352pkt 352fpkt"];
1905--5599[label="0.0149254;1pkt 1fpkt"];
1905--6046[label="0.0026455;1pkt 1fpkt"];
1905--6065[label="0.0026455;1pkt 1fpkt"];
1905--6314[label="0.0026455;1pkt 1fpkt"];
1905--6316[label="0.0026455;1pkt 1fpkt"];
1905--6357[label="0.0026455;1pkt 1fpkt"];
1905--6359[label="0.0026455;1pkt 1fpkt"];
1905--6394[label="0.0026455;1pkt 1fpkt"];
1905--6396[label="0.0026455;1pkt 1fpkt"];
1905--7880[label="0.0026455;1pkt 1fpkt"];
1905--9126[label="0.0026455;1pkt 1fpkt"];
1905--9570[label="0.0026455;1pkt 1fpkt"];
5039--5599[label="0.0149254;1pkt 1fpkt"];
5039--6046[label="0.00284091;1pkt 1fpkt"];
5039--6065[label="0.00284091;1pkt 1fpkt"];
5039--6314[label="0.00284091;1pkt 1fpkt"];
5039--6316[label="0.00284091;1pkt 1fpkt"];
5039--6357[label="0.00284091;1pkt 1fpkt"];
5039--6359[label="0.00284091;1pkt 1fpkt"];
5039--6394[label="0.00284091;1pkt 1fpkt"];
5039--6396[label="0.00284091;1pkt 1fpkt"];
5039--7880[label="0.00284091;1pkt 1fpkt"];
5039--9126[label="0.00284091;1pkt 1fpkt"];
5039--9570[label="0.00284091;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="197.33.219.129"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_204{
style=filled;
color=gray75;
2278[label="153.253.134.26;s;328pkt 328fpkt", shape=diamond, color=yellow];
5046[label="153.253.134.26;s;271pkt 271fpkt", shape=hexagon, color=black];
stat204[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.253.134.26:25, *:*}[90.8537%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (49.8331%)&lt;BR/&gt; 17123: (0.33389%)&lt;BR/&gt; 65316: (0.166945%)&lt;BR/&gt; 65173: (0.166945%)&lt;BR/&gt; 64555: (0.166945%)&gt;];
}
2278--3709[label="0.00769231;1pkt 1fpkt"];
2278--5046[label="1;271pkt 271fpkt"];
2278--5236[label="0.00304878;1pkt 1fpkt"];
2278--6297[label="0.00609756;2pkt 2fpkt"];
2278--6340[label="0.00609756;2pkt 2fpkt"];
2278--6377[label="0.00609756;2pkt 2fpkt"];
5046--6297[label="0.00738007;2pkt 2fpkt"];
5046--6340[label="0.00738007;2pkt 2fpkt"];
5046--6377[label="0.00738007;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_ip="153.253.134.26" src_port="25"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521219" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_207{
style=filled;
color=gray75;
2347[label="36.56.2.219;d;47pkt 47fpkt", shape=diamond, color=yellow];
2348[label="156.120.212.146;s;46pkt 46fpkt", shape=diamond, color=yellow];
5091[label="156.120.212.146;s;26pkt 26fpkt", shape=hexagon, color=black];
7750[label="156.120.212.146;50pkt 50fpkt", shape=pentagon, color=darkviolet];
stat207[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.120.212.146:80, 36.56.2.219:*}[94.2308%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 65439: (1.18343%)&lt;BR/&gt; 64075: (1.18343%)&lt;BR/&gt; 62770: (1.18343%)&lt;BR/&gt; 58240: (1.18343%)&gt;];
}
2347--2348[label="0.978261;45pkt 45fpkt"];
2347--5091[label="0.961538;25pkt 25fpkt"];
2347--6318[label="0.0425532;2pkt 2fpkt"];
2347--6321[label="0.0638298;3pkt 3fpkt"];
2347--6361[label="0.0425532;2pkt 2fpkt"];
2347--6398[label="0.0425532;2pkt 2fpkt"];
2347--7750[label="0.957447;45pkt 45fpkt"];
2348--5091[label="1;26pkt 26fpkt"];
2348--6318[label="0.0434783;2pkt 2fpkt"];
2348--6321[label="0.0652174;3pkt 3fpkt"];
2348--6361[label="0.0434783;2pkt 2fpkt"];
2348--6398[label="0.0434783;2pkt 2fpkt"];
2348--7750[label="1;46pkt 46fpkt"];
5091--6318[label="0.0769231;2pkt 2fpkt"];
5091--6361[label="0.0769231;2pkt 2fpkt"];
5091--6398[label="0.0769231;2pkt 2fpkt"];
5091--7750[label="1;26pkt 26fpkt"];
</description>
    <slice>
      <filter dst_ip="36.56.2.219" src_ip="156.120.212.146" src_port="80"/>
    </slice>
    <from sec="1204520406" usec="0"/>
    <to sec="1204521296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_208{
style=filled;
color=gray75;
2352[label="156.161.3.28;d;124pkt 124fpkt", shape=diamond, color=yellow];
5093[label="156.161.3.28;d;86pkt 86fpkt", shape=hexagon, color=black];
8501[label="5.160.140.237;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat208[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 156.161.3.28:13613}[97.5806%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 13613: (49.0521%)&lt;BR/&gt; 45306: (0.947867%)&lt;BR/&gt; 13280: (0.947867%)&lt;BR/&gt; 63075: (0.473934%)&lt;BR/&gt; 59869: (0.473934%)&gt;];
}
2352--5093[label="1;86pkt 86fpkt"];
2352--8501[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="156.161.3.28" dst_port="13613"/>
    </slice>
    <from sec="1204520407" usec="0"/>
    <to sec="1204521277" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_210{
style=filled;
color=gray75;
2489[label="12.48.64.67;d;254pkt 254fpkt", shape=diamond, color=yellow];
5160[label="12.48.64.67;d;254pkt 254fpkt", shape=hexagon, color=black];
stat210[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 12.48.64.67:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2489--5160[label="1;254pkt 254fpkt"];
</description>
    <slice>
      <filter dst_ip="12.48.64.67"/>
    </slice>
    <from sec="1204520715" usec="0"/>
    <to sec="1204520722" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_211{
style=filled;
color=gray75;
2796[label="38.231.124.165;s;1pkt 1fpkt", shape=diamond, color=yellow];
5176[label="38.231.124.165;s;1pkt 1fpkt", shape=hexagon, color=black];
stat211[shape=component, label=&lt;Rules:&lt;BR/&gt;{38.231.124.165:80, 156.161.233.229:4762}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4762: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
2796--5176[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="156.161.233.229" dst_port="4762" src_ip="38.231.124.165" src_port="80"/>
    </slice>
    <from sec="1204520787" usec="0"/>
    <to sec="1204520908" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_214{
style=filled;
color=gray75;
1821[label="196.25.99.225;s;1362pkt 1362fpkt", shape=diamond, color=yellow];
5196[label="196.25.99.225;s;1362pkt 1362fpkt", shape=hexagon, color=black];
stat214[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.25.99.225:20129, *:20129}[73.7885%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 20129: (86.8943%)&lt;BR/&gt; 65251: (0.0734214%)&lt;BR/&gt; 63611: (0.0734214%)&lt;BR/&gt; 61565: (0.0734214%)&lt;BR/&gt; 60004: (0.0734214%)&gt;];
}
1821--5196[label="1;1362pkt 1362fpkt"];
</description>
    <slice>
      <filter dst_port="20129" src_ip="196.25.99.225" src_port="20129"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_215{
style=filled;
color=gray75;
2594[label="36.56.4.84;d;56pkt 56fpkt", shape=diamond, color=yellow];
2595[label="131.66.11.64;s;54pkt 54fpkt", shape=diamond, color=yellow];
5230[label="131.66.11.64;s;54pkt 54fpkt", shape=hexagon, color=black];
5588[label="36.56.4.84;d;49pkt 49fpkt", shape=hexagon, color=black];
stat215[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.66.11.64:80, 36.56.4.84:*}[96.4286%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 65115: (0.938967%)&lt;BR/&gt; 64568: (0.938967%)&lt;BR/&gt; 63449: (0.938967%)&lt;BR/&gt; 62341: (0.938967%)&gt;];
}
2594--2595[label="1;54pkt 54fpkt"];
2594--5230[label="1;54pkt 54fpkt"];
2594--5588[label="1;49pkt 49fpkt"];
2594--6318[label="0.0714286;4pkt 4fpkt"];
2594--6321[label="0.0535714;3pkt 3fpkt"];
2594--6361[label="0.0714286;4pkt 4fpkt"];
2594--6398[label="0.0714286;4pkt 4fpkt"];
2595--5230[label="1;54pkt 54fpkt"];
2595--5588[label="0.959184;47pkt 47fpkt"];
2595--6318[label="0.0740741;4pkt 4fpkt"];
2595--6321[label="0.0555556;3pkt 3fpkt"];
2595--6361[label="0.0740741;4pkt 4fpkt"];
2595--6398[label="0.0740741;4pkt 4fpkt"];
5230--5588[label="0.959184;47pkt 47fpkt"];
5230--6318[label="0.0740741;4pkt 4fpkt"];
5230--6321[label="0.0555556;3pkt 3fpkt"];
5230--6361[label="0.0740741;4pkt 4fpkt"];
5230--6398[label="0.0740741;4pkt 4fpkt"];
5588--6318[label="0.0816327;4pkt 4fpkt"];
5588--6321[label="0.0612245;3pkt 3fpkt"];
5588--6361[label="0.0816327;4pkt 4fpkt"];
5588--6398[label="0.0816327;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="36.56.4.84" src_ip="131.66.11.64" src_port="80"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521223" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,020,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_216{
style=filled;
color=gray75;
2900[label="156.103.147.100;s;151pkt 151fpkt", shape=diamond, color=yellow];
5235[label="156.103.147.100;s;129pkt 129fpkt", shape=hexagon, color=black];
7369[label="156.103.147.100;180pkt 180fpkt", shape=pentagon, color=darkviolet];
stat216[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.103.147.100:0, *:0}[85.5556%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (88.913%)&lt;BR/&gt; 53: (5.21739%)&lt;BR/&gt; 59717: (0.326087%)&lt;BR/&gt; 45654: (0.326087%)&lt;BR/&gt; 40511: (0.326087%)&gt;];
}
2900--5235[label="1;129pkt 129fpkt"];
2900--5408[label="0.00662252;1pkt 1fpkt"];
2900--5564[label="0.00684932;1pkt 1fpkt"];
2900--6229[label="0.00684932;1pkt 1fpkt"];
2900--7369[label="1;151pkt 151fpkt"];
5235--5408[label="0.00775194;1pkt 1fpkt"];
5235--7369[label="1;129pkt 129fpkt"];
</description>
    <slice>
      <filter src_ip="156.103.147.100"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_218{
style=filled;
color=gray75;
1282[label="196.16.199.154;d;5pkt 5fpkt", shape=diamond, color=yellow];
1826[label="197.128.213.216;s;1pkt 1fpkt", shape=diamond, color=yellow];
5346[label="197.128.213.216;s;1pkt 1fpkt", shape=hexagon, color=black];
8364[label="197.128.213.216;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat218[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.22.111.10:0, 196.16.199.154:0}[20%]&lt;BR/&gt;{196.106.164.135:0, 196.16.199.154:0}[20%]&lt;BR/&gt;{197.128.213.216:0, 196.16.199.154:0}[20%]&lt;BR/&gt;{194.221.183.185:49363, 196.16.199.154:80}[20%]&lt;BR/&gt;{194.221.183.185:0, 196.16.199.154:0}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (87.5%)&lt;BR/&gt; 49363: (6.25%)&lt;BR/&gt; 80: (6.25%)&gt;];
}
1282--1826[label="1;1pkt 1fpkt"];
1282--2259[label="0.2;1pkt 1fpkt"];
1282--5346[label="1;1pkt 1fpkt"];
1282--8364[label="1;1pkt 1fpkt"];
1826--5346[label="1;1pkt 1fpkt"];
1826--8364[label="1;1pkt 1fpkt"];
5346--8364[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="196.16.199.154" src_ip="194.221.183.185"/>
      <filter dst_ip="196.16.199.154" dst_port="80" src_ip="194.221.183.185" src_port="49363"/>
      <filter dst_ip="196.16.199.154" src_ip="197.128.213.216"/>
      <filter dst_ip="196.16.199.154" src_ip="196.106.164.135"/>
      <filter dst_ip="196.16.199.154" src_ip="197.22.111.10"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_220{
style=filled;
color=gray75;
3188[label="36.56.8.204;d;55pkt 55fpkt", shape=diamond, color=yellow];
3189[label="156.120.201.96;s;51pkt 51fpkt", shape=diamond, color=yellow];
5397[label="36.56.8.204;d;43pkt 43fpkt", shape=hexagon, color=black];
5582[label="156.120.201.96;s;46pkt 46fpkt", shape=hexagon, color=black];
stat220[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.120.201.96:80, 36.56.8.204:*}[89.2857%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 64523: (1.02564%)&lt;BR/&gt; 63182: (1.02564%)&lt;BR/&gt; 58056: (1.02564%)&lt;BR/&gt; 56860: (1.02564%)&gt;];
}
3188--3189[label="0.980392;50pkt 50fpkt"];
3188--5397[label="1;43pkt 43fpkt"];
3188--5582[label="0.978261;45pkt 45fpkt"];
3188--6318[label="0.0545455;3pkt 3fpkt"];
3188--6321[label="0.0727273;4pkt 4fpkt"];
3188--6361[label="0.0545455;3pkt 3fpkt"];
3188--6398[label="0.0545455;3pkt 3fpkt"];
3189--5397[label="0.930233;40pkt 40fpkt"];
3189--5582[label="1;46pkt 46fpkt"];
3189--6318[label="0.0588235;3pkt 3fpkt"];
3189--6321[label="0.0588235;3pkt 3fpkt"];
3189--6361[label="0.0588235;3pkt 3fpkt"];
3189--6398[label="0.0588235;3pkt 3fpkt"];
5397--5582[label="0.930233;40pkt 40fpkt"];
5397--6318[label="0.0697674;3pkt 3fpkt"];
5397--6361[label="0.0697674;3pkt 3fpkt"];
5397--6398[label="0.0697674;3pkt 3fpkt"];
5582--6318[label="0.0652174;3pkt 3fpkt"];
5582--6321[label="0.0652174;3pkt 3fpkt"];
5582--6361[label="0.0652174;3pkt 3fpkt"];
5582--6398[label="0.0652174;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="36.56.8.204" src_ip="156.120.201.96" src_port="80"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521222" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_221{
style=filled;
color=gray75;
8163[label="197.33.205.192;67pkt 67fpkt", shape=pentagon, color=darkviolet];
stat221[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.33.205.192:*, 37.170.131.160:80}[44.7761%]&lt;BR/&gt;{197.33.205.192:*, 36.5.93.188:80}[32.8358%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.0149%)&lt;BR/&gt; 53: (2.98507%)&lt;BR/&gt; 33022: (0.746269%)&lt;BR/&gt; 32926: (0.746269%)&lt;BR/&gt; 32778: (0.746269%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="37.170.131.160" dst_port="80" src_ip="197.33.205.192"/>
      <filter dst_ip="36.5.93.188" dst_port="80" src_ip="197.33.205.192"/>
    </slice>
    <from sec="1204520412" usec="0"/>
    <to sec="1204521270" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_222{
style=filled;
color=gray75;
2928[label="156.103.72.193;d;62pkt 62fpkt", shape=diamond, color=yellow];
5424[label="156.103.72.193;d;47pkt 47fpkt", shape=hexagon, color=black];
stat222[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 156.103.72.193:13885}[91.9355%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 13885: (45.4128%)&lt;BR/&gt; 30970: (2.75229%)&lt;BR/&gt; 45306: (1.83486%)&lt;BR/&gt; 40295: (1.83486%)&lt;BR/&gt; 63741: (0.917431%)&gt;];
}
2928--5424[label="1;47pkt 47fpkt"];
</description>
    <slice>
      <filter dst_ip="156.103.72.193" dst_port="13885"/>
    </slice>
    <from sec="1204520402" usec="0"/>
    <to sec="1204521226" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.08475,1.70201,503,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_224{
style=filled;
color=gray75;
73[label="156.161.167.70s;3pkt 3fpkt", shape=rectangle, color=red];
374[label="156.103.3.173d;1pkt 1fpkt", shape=rectangle, color=red];
904[label="164.232.215.120;s;1pkt 1fpkt", shape=diamond, color=yellow];
1406[label="35.132.103.122;d;1pkt 1fpkt", shape=diamond, color=yellow];
1417[label="156.161.167.70;s;171pkt 171fpkt", shape=diamond, color=yellow];
2240[label="37.208.252.50;d;7pkt 7fpkt", shape=diamond, color=yellow];
2943[label="205.98.144.248;d;91pkt 91fpkt", shape=diamond, color=yellow];
3252[label="205.98.144.249;d;28pkt 28fpkt", shape=diamond, color=yellow];
4102[label="164.232.215.120;s;1pkt 1fpkt", shape=hexagon, color=black];
4276[label="35.132.103.122;d;1pkt 1fpkt", shape=hexagon, color=black];
5019[label="37.208.252.50;d;7pkt 7fpkt", shape=hexagon, color=black];
5457[label="205.98.144.249;d;22pkt 22fpkt", shape=hexagon, color=black];
stat224[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.161.167.70:*, 205.98.144.248:80}[51.1494%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (46.1078%)&lt;BR/&gt; 443: (2.24551%)&lt;BR/&gt; 1556: (1.1976%)&lt;BR/&gt; 0: (0.898204%)&lt;BR/&gt; 3020: (0.449102%)&gt;];
}
73--374[label="1;1pkt 1fpkt"];
73--904[label="1;1pkt 1fpkt"];
73--1406[label="1;1pkt 1fpkt"];
73--1417[label="0.666667;2pkt 2fpkt"];
73--4102[label="1;1pkt 1fpkt"];
73--4276[label="1;1pkt 1fpkt"];
374--904[label="1;1pkt 1fpkt"];
374--1406[label="1;1pkt 1fpkt"];
374--4102[label="1;1pkt 1fpkt"];
374--4276[label="1;1pkt 1fpkt"];
904--1406[label="1;1pkt 1fpkt"];
904--4102[label="1;1pkt 1fpkt"];
904--4276[label="1;1pkt 1fpkt"];
1406--4102[label="1;1pkt 1fpkt"];
1406--4276[label="1;1pkt 1fpkt"];
1417--2240[label="1;7pkt 7fpkt"];
1417--2943[label="0.989011;90pkt 90fpkt"];
1417--3252[label="0.964286;27pkt 27fpkt"];
1417--5019[label="1;7pkt 7fpkt"];
1417--5457[label="0.954545;21pkt 21fpkt"];
2240--5019[label="1;7pkt 7fpkt"];
3252--5457[label="1;22pkt 22fpkt"];
4102--4276[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="205.98.144.248" dst_port="80" src_ip="156.161.167.70"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_227{
style=filled;
color=gray75;
1345[label="156.103.29.40;s;2263pkt 2263fpkt", shape=diamond, color=yellow];
5555[label="156.103.29.40;s;2048pkt 2048fpkt", shape=hexagon, color=black];
stat227[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.103.29.40:48662, *:*}[58.3297%]&lt;BR/&gt;{156.103.29.40:10364, *:*}[41.2726%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 48662: (29.3435%)&lt;BR/&gt; 10364: (20.4477%)&lt;BR/&gt; 16001: (0.579912%)&lt;BR/&gt; 6881: (0.533519%)&lt;BR/&gt; 19127: (0.208768%)&gt;];
}
1345--2565[label="0.0044843;1pkt 1fpkt"];
1345--5555[label="1;2048pkt 2048fpkt"];
</description>
    <slice>
      <filter src_ip="156.103.29.40" src_port="48662"/>
      <filter src_ip="156.103.29.40" src_port="10364"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_228{
style=filled;
color=gray75;
2262[label="164.232.84.153;d;261pkt 261fpkt", shape=diamond, color=yellow];
5577[label="164.232.84.153;d;261pkt 261fpkt", shape=hexagon, color=black];
stat228[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 164.232.84.153:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
2262--3207[label="0.0149254;1pkt 1fpkt"];
2262--5577[label="1;261pkt 261fpkt"];
2262--5599[label="0.0149254;1pkt 1fpkt"];
5577--5599[label="0.0149254;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="164.232.84.153"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_229{
style=filled;
color=gray75;
2580[label="197.33.223.20;s;312pkt 312fpkt", shape=diamond, color=yellow];
2581[label="197.134.56.162;d;311pkt 311fpkt", shape=diamond, color=yellow];
5578[label="197.33.223.20;s;284pkt 284fpkt", shape=hexagon, color=black];
6613[label="197.33.223.20;333pkt 333fpkt", shape=pentagon, color=darkviolet];
stat229[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.33.223.20:1433, 197.134.56.162:*}[99.1045%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1433: (49.7984%)&lt;BR/&gt; 4983: (0.16129%)&lt;BR/&gt; 4959: (0.16129%)&lt;BR/&gt; 4943: (0.16129%)&lt;BR/&gt; 4942: (0.16129%)&gt;];
}
2580--2581[label="0.996785;310pkt 310fpkt"];
2580--5578[label="1;284pkt 284fpkt"];
2580--6613[label="0.996795;311pkt 311fpkt"];
2581--5578[label="0.992958;282pkt 282fpkt"];
2581--6613[label="0.996785;310pkt 310fpkt"];
5578--6613[label="0.996479;283pkt 283fpkt"];
</description>
    <slice>
      <filter dst_ip="197.134.56.162" src_ip="197.33.223.20" src_port="1433"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_230{
style=filled;
color=gray75;
2265[label="156.131.19.155;d;173pkt 173fpkt", shape=diamond, color=yellow];
5581[label="156.131.19.155;d;154pkt 154fpkt", shape=hexagon, color=black];
stat230[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 156.131.19.155:13985}[97.6879%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 13985: (49.3884%)&lt;BR/&gt; 13706: (0.917431%)&lt;BR/&gt; 13868: (0.611621%)&lt;BR/&gt; 13860: (0.611621%)&lt;BR/&gt; 13829: (0.611621%)&gt;];
}
2265--5581[label="1;154pkt 154fpkt"];
</description>
    <slice>
      <filter dst_ip="156.131.19.155" dst_port="13985"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,010,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_231{
style=filled;
color=gray75;
2598[label="172.20.32.65;s;355pkt 355fpkt", shape=diamond, color=yellow];
5595[label="172.20.32.65;s;320pkt 320fpkt", shape=hexagon, color=black];
stat231[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.20.32.65:*, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (7.40741%)&lt;BR/&gt; 80: (7.40741%)&lt;BR/&gt; 54503: (0.592593%)&lt;BR/&gt; 57306: (0.37037%)&lt;BR/&gt; 48627: (0.37037%)&gt;];
}
2598--5595[label="1;320pkt 320fpkt"];
</description>
    <slice>
      <filter src_ip="172.20.32.65"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521227" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.687303,1.77423,901,0 0 0 0 1 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="0.0.0.0"/>
      <from sec="1204520400" usec="0"/>
      <to sec="1204521228" usec="0"/>
    </slice>
    <from sec="0" usec="0"/>
    <to sec="0" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,501,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_235{
style=filled;
color=gray75;
773[label="197.33.208.172;s;1829pkt 1829fpkt", shape=diamond, color=yellow];
774[label="84.177.93.126;d;1975pkt 1975fpkt", shape=diamond, color=yellow];
3244[label="197.33.221.1;s;32pkt 32fpkt", shape=diamond, color=yellow];
3389[label="36.56.4.86;d;2pkt 2fpkt", shape=diamond, color=yellow];
3715[label="197.33.211.210;s;56pkt 56fpkt", shape=diamond, color=yellow];
3806[label="197.33.222.69;s;50pkt 50fpkt", shape=diamond, color=yellow];
4486[label="197.33.208.172;s;1245pkt 1245fpkt", shape=hexagon, color=black];
4487[label="84.177.93.126;d;703pkt 703fpkt", shape=hexagon, color=black];
6803[label="197.33.204.40;53pkt 53fpkt", shape=pentagon, color=darkviolet];
8000[label="197.33.208.172;1986pkt 1986fpkt", shape=pentagon, color=darkviolet];
8317[label="197.33.211.210;60pkt 60fpkt", shape=pentagon, color=darkviolet];
stat235[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.33.208.172:21, 84.177.93.126:*}[90.8757%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (49.6997%)&lt;BR/&gt; 80: (0.225253%)&lt;BR/&gt; 0: (0.0625704%)&lt;BR/&gt; 55916: (0.0500563%)&lt;BR/&gt; 40061: (0.0500563%)&gt;];
}
773--774[label="0.997813;1825pkt 1825fpkt"];
773--4486[label="1;1245pkt 1245fpkt"];
773--4487[label="0.923186;649pkt 649fpkt"];
773--8000[label="1;1829pkt 1829fpkt"];
774--3715[label="0.964286;54pkt 54fpkt"];
774--3806[label="0.98;49pkt 49fpkt"];
774--4486[label="0.998394;1243pkt 1243fpkt"];
774--4487[label="1;703pkt 703fpkt"];
774--6803[label="0.886792;47pkt 47fpkt"];
774--8000[label="0.924051;1825pkt 1825fpkt"];
774--8317[label="0.9;54pkt 54fpkt"];
3244--3389[label="1;2pkt 2fpkt"];
3244--3547[label="0.03125;1pkt 1fpkt"];
3244--6318[label="0.09375;3pkt 3fpkt"];
3244--6321[label="0.09375;3pkt 3fpkt"];
3244--6361[label="0.09375;3pkt 3fpkt"];
3244--6398[label="0.09375;3pkt 3fpkt"];
3715--4487[label="0.357143;20pkt 20fpkt"];
3715--8317[label="1;56pkt 56fpkt"];
3806--4487[label="0.34;17pkt 17fpkt"];
4486--4487[label="0.923186;649pkt 649fpkt"];
4486--8000[label="1;1245pkt 1245fpkt"];
4487--6803[label="0.320755;17pkt 17fpkt"];
4487--8000[label="0.923186;649pkt 649fpkt"];
4487--8317[label="0.333333;20pkt 20fpkt"];
</description>
    <slice>
      <filter dst_ip="84.177.93.126" src_ip="197.33.208.172" src_port="21"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_236{
style=filled;
color=gray75;
1344[label="156.103.29.40;d;1905pkt 1905fpkt", shape=diamond, color=yellow];
5742[label="156.103.29.40;d;1905pkt 1905fpkt", shape=hexagon, color=black];
stat236[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 156.103.29.40:48662}[55.643%]&lt;BR/&gt;{*:*, 156.103.29.40:10364}[42.6247%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 48662: (27.8215%)&lt;BR/&gt; 10364: (21.3123%)&lt;BR/&gt; 0: (1.41732%)&lt;BR/&gt; 16001: (0.367454%)&lt;BR/&gt; 6881: (0.314961%)&gt;];
}
1344--5742[label="1;1905pkt 1905fpkt"];
1344--6301[label="0.00142248;1pkt 1fpkt"];
1344--6344[label="0.00142248;1pkt 1fpkt"];
1344--6381[label="0.00142248;1pkt 1fpkt"];
5742--6301[label="0.00142248;1pkt 1fpkt"];
5742--6344[label="0.00142248;1pkt 1fpkt"];
5742--6381[label="0.00142248;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="156.103.29.40" dst_port="48662"/>
      <filter dst_ip="156.103.29.40" dst_port="10364"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,901,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_238{
style=filled;
color=gray75;
2734[label="212.214.97.114;s;9pkt 9fpkt", shape=diamond, color=yellow];
2746[label="153.253.197.90;d;10pkt 10fpkt", shape=diamond, color=yellow];
5298[label="153.253.197.90;d;10pkt 10fpkt", shape=hexagon, color=black];
stat238[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.214.97.114:80, 153.253.197.90:*}[72.7273%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 64063: (5.17241%)&lt;BR/&gt; 63731: (5.17241%)&lt;BR/&gt; 63364: (5.17241%)&lt;BR/&gt; 63169: (5.17241%)&gt;];
}
2734--2746[label="0.888889;8pkt 8fpkt"];
2734--5298[label="0.888889;8pkt 8fpkt"];
2734--5770[label="0.111111;1pkt 1fpkt"];
2746--5298[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter dst_ip="153.253.197.90" src_ip="212.214.97.114" src_port="80"/>
    </slice>
    <from sec="1204520718" usec="0"/>
    <to sec="1204520839" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_241{
style=filled;
color=gray75;
2592[label="196.25.123.55;s;975pkt 975fpkt", shape=diamond, color=yellow];
5783[label="196.25.123.55;s;975pkt 975fpkt", shape=hexagon, color=black];
stat241[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.25.123.55:39862, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 39862: (50%)&lt;BR/&gt; 16001: (0.461538%)&lt;BR/&gt; 6881: (0.307692%)&lt;BR/&gt; 1501: (0.25641%)&lt;BR/&gt; 21000: (0.153846%)&gt;];
}
2592--5783[label="1;975pkt 975fpkt"];
</description>
    <slice>
      <filter src_ip="196.25.123.55" src_port="39862"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_242{
style=filled;
color=gray75;
3467[label="153.253.144.37;s;23pkt 23fpkt", shape=diamond, color=yellow];
5805[label="153.253.144.37;s;23pkt 23fpkt", shape=hexagon, color=black];
stat242[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.253.144.37:6346, *:*}[86.9565%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6346: (45.6522%)&lt;BR/&gt; 41044: (6.52174%)&lt;BR/&gt; 41033: (4.34783%)&lt;BR/&gt; 41000: (4.34783%)&lt;BR/&gt; 61126: (2.17391%)&gt;];
}
3467--5805[label="1;23pkt 23fpkt"];
</description>
    <slice>
      <filter src_ip="153.253.144.37" src_port="6346"/>
    </slice>
    <from sec="1204520401" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_243{
style=filled;
color=gray75;
2444[label="164.232.195.115;d;109pkt 109fpkt", shape=diamond, color=yellow];
2506[label="57.136.142.0;s;5pkt 5fpkt", shape=diamond, color=yellow];
2722[label="84.217.238.195;s;76pkt 76fpkt", shape=diamond, color=yellow];
3829[label="56.107.66.1;s;24pkt 24fpkt", shape=diamond, color=yellow];
4935[label="164.232.195.115;d;70pkt 70fpkt", shape=hexagon, color=black];
4955[label="57.136.142.0;s;1pkt 1fpkt", shape=hexagon, color=black];
5891[label="56.107.66.1;s;24pkt 24fpkt", shape=hexagon, color=black];
6412[label="57.136.142.0;6pkt 6fpkt", shape=pentagon, color=darkviolet];
stat243[shape=component, label=&lt;Rules:&lt;BR/&gt;{84.217.238.195:80, 164.232.195.115:*}[66.3636%]&lt;BR/&gt;{56.107.66.1:80, 164.232.195.115:*}[21.8182%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (45.2381%)&lt;BR/&gt; 554: (3.01587%)&lt;BR/&gt; 443: (1.74603%)&lt;BR/&gt; 1909: (0.793651%)&lt;BR/&gt; 1975: (0.634921%)&gt;];
}
2444--2506[label="1;5pkt 5fpkt"];
2444--2722[label="1;76pkt 76fpkt"];
2444--3829[label="1;24pkt 24fpkt"];
2444--4935[label="1;70pkt 70fpkt"];
2444--4955[label="1;1pkt 1fpkt"];
2444--5812[label="0.00917431;1pkt 1fpkt"];
2444--5891[label="1;24pkt 24fpkt"];
2444--6318[label="0.0458716;5pkt 5fpkt"];
2444--6321[label="0.183486;20pkt 20fpkt"];
2444--6361[label="0.0458716;5pkt 5fpkt"];
2444--6398[label="0.0458716;5pkt 5fpkt"];
2444--6412[label="0.833333;5pkt 5fpkt"];
2444--7988[label="0.00917431;1pkt 1fpkt"];
2506--4935[label="0.4;2pkt 2fpkt"];
2506--4955[label="1;1pkt 1fpkt"];
2506--6412[label="1;5pkt 5fpkt"];
2722--4935[label="0.714286;50pkt 50fpkt"];
2722--6318[label="0.0526316;4pkt 4fpkt"];
2722--6321[label="0.223684;17pkt 17fpkt"];
2722--6361[label="0.0526316;4pkt 4fpkt"];
2722--6398[label="0.0526316;4pkt 4fpkt"];
3829--4935[label="0.583333;14pkt 14fpkt"];
3829--5891[label="1;24pkt 24fpkt"];
3829--6318[label="0.0416667;1pkt 1fpkt"];
3829--6321[label="0.125;3pkt 3fpkt"];
3829--6361[label="0.0416667;1pkt 1fpkt"];
3829--6398[label="0.0416667;1pkt 1fpkt"];
4935--4955[label="1;1pkt 1fpkt"];
4935--5812[label="0.0142857;1pkt 1fpkt"];
4935--5891[label="0.583333;14pkt 14fpkt"];
4935--6318[label="0.0714286;5pkt 5fpkt"];
4935--6361[label="0.0714286;5pkt 5fpkt"];
4935--6398[label="0.0714286;5pkt 5fpkt"];
4935--6412[label="0.333333;2pkt 2fpkt"];
4935--7988[label="0.0142857;1pkt 1fpkt"];
4955--6412[label="1;1pkt 1fpkt"];
5891--6318[label="0.0416667;1pkt 1fpkt"];
5891--6321[label="0.125;3pkt 3fpkt"];
5891--6361[label="0.0416667;1pkt 1fpkt"];
5891--6398[label="0.0416667;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="164.232.195.115" src_ip="84.217.238.195" src_port="80"/>
      <filter dst_ip="164.232.195.115" src_ip="56.107.66.1" src_port="80"/>
    </slice>
    <from sec="1204520664" usec="0"/>
    <to sec="1204521278" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_244{
style=filled;
color=gray75;
3223[label="196.16.202.48;d;70pkt 70fpkt", shape=diamond, color=yellow];
5816[label="196.16.202.48;d;70pkt 70fpkt", shape=hexagon, color=black];
stat244[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 196.16.202.48:60737}[92.8571%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 60737: (46.4286%)&lt;BR/&gt; 45306: (3.57143%)&lt;BR/&gt; 43014: (1.42857%)&lt;BR/&gt; 13806: (1.42857%)&lt;BR/&gt; 13590: (1.42857%)&gt;];
}
3223--5816[label="1;70pkt 70fpkt"];
</description>
    <slice>
      <filter dst_ip="196.16.202.48" dst_port="60737"/>
    </slice>
    <from sec="1204520402" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_245{
style=filled;
color=gray75;
2635[label="197.33.222.137;d;96pkt 96fpkt", shape=diamond, color=yellow];
5820[label="197.33.222.137;d;96pkt 96fpkt", shape=hexagon, color=black];
stat245[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 197.33.222.137:1038}[66.6667%]&lt;BR/&gt;{*:*, 197.33.222.137:443}[28.125%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1038: (33.3333%)&lt;BR/&gt; 443: (14.0625%)&lt;BR/&gt; 137: (1.04167%)&lt;BR/&gt; 80: (1.04167%)&lt;BR/&gt; 64693: (0.520833%)&gt;];
}
2635--4664[label="0.0104167;1pkt 1fpkt"];
2635--5820[label="1;96pkt 96fpkt"];
2635--6065[label="0.0104167;1pkt 1fpkt"];
2635--6316[label="0.0104167;1pkt 1fpkt"];
2635--6359[label="0.0104167;1pkt 1fpkt"];
2635--6396[label="0.0104167;1pkt 1fpkt"];
2635--7880[label="0.0104167;1pkt 1fpkt"];
2635--9126[label="0.0104167;1pkt 1fpkt"];
2635--9570[label="0.0104167;1pkt 1fpkt"];
5820--6065[label="0.0104167;1pkt 1fpkt"];
5820--6316[label="0.0104167;1pkt 1fpkt"];
5820--6359[label="0.0104167;1pkt 1fpkt"];
5820--6396[label="0.0104167;1pkt 1fpkt"];
5820--7880[label="0.0104167;1pkt 1fpkt"];
5820--9126[label="0.0104167;1pkt 1fpkt"];
5820--9570[label="0.0104167;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="197.33.222.137" dst_port="1038"/>
      <filter dst_ip="197.33.222.137" dst_port="443"/>
    </slice>
    <from sec="1204520402" usec="0"/>
    <to sec="1204521224" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.910784,1.65195,010,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_247{
style=filled;
color=gray75;
3759[label="14.132.17.203;s;279pkt 279fpkt", shape=diamond, color=yellow];
5825[label="14.132.17.203;s;279pkt 279fpkt", shape=hexagon, color=black];
8261[label="14.132.17.203;303pkt 303fpkt", shape=pentagon, color=darkviolet];
9262[label="14.132.17.203;303pkt 303fpkt", shape=invtriangle, color=brown];
stat247[shape=component, label=&lt;Rules:&lt;BR/&gt;{14.132.17.203:*, *:25}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 59810: (0.343643%)&lt;BR/&gt; 54305: (0.343643%)&lt;BR/&gt; 52484: (0.343643%)&lt;BR/&gt; 49738: (0.343643%)&gt;];
}
3759--5825[label="1;279pkt 279fpkt"];
3759--8261[label="1;279pkt 279fpkt"];
3759--9262[label="1;279pkt 279fpkt"];
5825--8261[label="1;279pkt 279fpkt"];
5825--9262[label="1;279pkt 279fpkt"];
8261--9262[label="1;303pkt 303fpkt"];
</description>
    <slice>
      <filter dst_port="25" src_ip="14.132.17.203"/>
    </slice>
    <from sec="1204520402" usec="0"/>
    <to sec="1204521299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_248{
style=filled;
color=gray75;
2640[label="36.56.4.100;d;27pkt 27fpkt", shape=diamond, color=yellow];
3262[label="156.120.80.181;s;15pkt 15fpkt", shape=diamond, color=yellow];
5827[label="36.56.4.100;d;27pkt 27fpkt", shape=hexagon, color=black];
5853[label="156.120.80.181;s;15pkt 15fpkt", shape=hexagon, color=black];
8072[label="156.120.80.181;16pkt 16fpkt", shape=pentagon, color=darkviolet];
stat248[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.120.80.181:80, 36.56.4.100:*}[57.1429%]&lt;BR/&gt;{156.120.177.246:80, 36.56.4.100:*}[42.8571%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 59750: (2.5%)&lt;BR/&gt; 57833: (2.5%)&lt;BR/&gt; 56831: (2.5%)&lt;BR/&gt; 55449: (2.5%)&gt;];
}
2640--3262[label="1;15pkt 15fpkt"];
2640--5827[label="1;27pkt 27fpkt"];
2640--5853[label="1;15pkt 15fpkt"];
2640--6318[label="0.037037;1pkt 1fpkt"];
2640--6321[label="0.037037;1pkt 1fpkt"];
2640--6361[label="0.037037;1pkt 1fpkt"];
2640--6398[label="0.037037;1pkt 1fpkt"];
2640--8072[label="0.9375;15pkt 15fpkt"];
3262--5827[label="1;15pkt 15fpkt"];
3262--5853[label="1;15pkt 15fpkt"];
3262--6321[label="0.0666667;1pkt 1fpkt"];
3262--8072[label="1;15pkt 15fpkt"];
5827--5853[label="1;15pkt 15fpkt"];
5827--6318[label="0.037037;1pkt 1fpkt"];
5827--6321[label="0.037037;1pkt 1fpkt"];
5827--6361[label="0.037037;1pkt 1fpkt"];
5827--6398[label="0.037037;1pkt 1fpkt"];
5827--8072[label="0.9375;15pkt 15fpkt"];
5853--6321[label="0.0666667;1pkt 1fpkt"];
5853--8072[label="1;15pkt 15fpkt"];
</description>
    <slice>
      <filter dst_ip="36.56.4.100" src_ip="156.120.80.181" src_port="80"/>
      <filter dst_ip="36.56.4.100" src_ip="156.120.177.246" src_port="80"/>
    </slice>
    <from sec="1204520403" usec="0"/>
    <to sec="1204521236" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.910784,1.65195,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_249{
style=filled;
color=gray75;
2650[label="156.103.146.53;s;62pkt 62fpkt", shape=diamond, color=yellow];
3060[label="162.161.67.67;d;2pkt 2fpkt", shape=diamond, color=yellow];
3238[label="36.56.8.54;d;52pkt 52fpkt", shape=diamond, color=yellow];
5622[label="156.103.146.53;s;60pkt 60fpkt", shape=hexagon, color=black];
5837[label="36.56.8.54;d;52pkt 52fpkt", shape=hexagon, color=black];
6736[label="131.66.154.33;25pkt 25fpkt", shape=pentagon, color=darkviolet];
7610[label="152.65.107.132;10pkt 10fpkt", shape=pentagon, color=darkviolet];
8722[label="131.66.154.33;25pkt 25fpkt", shape=invtriangle, color=brown];
stat249[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.103.146.53:80, 83.54.153.32:*}[30.9091%]&lt;BR/&gt;{131.66.154.33:80, 36.56.8.54:*}[22.7273%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.3056%)&lt;BR/&gt; 65407: (0.694444%)&lt;BR/&gt; 65025: (0.694444%)&lt;BR/&gt; 63274: (0.694444%)&lt;BR/&gt; 62291: (0.694444%)&gt;];
}
2650--3060[label="1;2pkt 2fpkt"];
2650--3238[label="0.173077;9pkt 9fpkt"];
2650--5622[label="1;60pkt 60fpkt"];
2650--5837[label="0.173077;9pkt 9fpkt"];
2650--6318[label="0.016129;1pkt 1fpkt"];
2650--6321[label="0.387097;24pkt 24fpkt"];
2650--6361[label="0.016129;1pkt 1fpkt"];
2650--6398[label="0.016129;1pkt 1fpkt"];
3060--5622[label="1;2pkt 2fpkt"];
3238--5622[label="0.153846;8pkt 8fpkt"];
3238--5837[label="1;52pkt 52fpkt"];
3238--6318[label="0.115385;6pkt 6fpkt"];
3238--6321[label="0.0576923;3pkt 3fpkt"];
3238--6361[label="0.115385;6pkt 6fpkt"];
3238--6398[label="0.115385;6pkt 6fpkt"];
3238--6736[label="0.84;21pkt 21fpkt"];
3238--7610[label="0.9;9pkt 9fpkt"];
3238--8722[label="0.84;21pkt 21fpkt"];
5622--5837[label="0.153846;8pkt 8fpkt"];
5622--6318[label="0.0166667;1pkt 1fpkt"];
5622--6321[label="0.4;24pkt 24fpkt"];
5622--6361[label="0.0166667;1pkt 1fpkt"];
5622--6398[label="0.0166667;1pkt 1fpkt"];
5837--6318[label="0.115385;6pkt 6fpkt"];
5837--6321[label="0.0576923;3pkt 3fpkt"];
5837--6361[label="0.115385;6pkt 6fpkt"];
5837--6398[label="0.115385;6pkt 6fpkt"];
5837--6736[label="0.84;21pkt 21fpkt"];
5837--7610[label="0.9;9pkt 9fpkt"];
5837--8722[label="0.84;21pkt 21fpkt"];
6736--8722[label="1;25pkt 25fpkt"];
</description>
    <slice>
      <filter dst_ip="83.54.153.32" src_ip="156.103.146.53" src_port="80"/>
      <filter dst_ip="36.56.8.54" src_ip="131.66.154.33" src_port="80"/>
    </slice>
    <from sec="1204520404" usec="0"/>
    <to sec="1204521299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_251{
style=filled;
color=gray75;
2000[label="36.56.4.145;d;65pkt 65fpkt", shape=diamond, color=yellow];
2001[label="152.65.144.188;s;63pkt 63fpkt", shape=diamond, color=yellow];
5863[label="152.65.144.188;s;63pkt 63fpkt", shape=hexagon, color=black];
8127[label="152.65.144.188;68pkt 68fpkt", shape=pentagon, color=darkviolet];
stat251[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.65.144.188:80, 36.56.4.145:*}[94.3662%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 65299: (0.772201%)&lt;BR/&gt; 65242: (0.772201%)&lt;BR/&gt; 65002: (0.772201%)&lt;BR/&gt; 64808: (0.772201%)&gt;];
}
2000--2001[label="0.984127;62pkt 62fpkt"];
2000--5863[label="0.984127;62pkt 62fpkt"];
2000--6318[label="0.0615385;4pkt 4fpkt"];
2000--6321[label="0.0769231;5pkt 5fpkt"];
2000--6361[label="0.0615385;4pkt 4fpkt"];
2000--6398[label="0.0615385;4pkt 4fpkt"];
2000--8127[label="0.953846;62pkt 62fpkt"];
2001--5863[label="1;63pkt 63fpkt"];
2001--6318[label="0.0634921;4pkt 4fpkt"];
2001--6321[label="0.0793651;5pkt 5fpkt"];
2001--6361[label="0.0634921;4pkt 4fpkt"];
2001--6398[label="0.0634921;4pkt 4fpkt"];
2001--8127[label="1;63pkt 63fpkt"];
5863--6318[label="0.0634921;4pkt 4fpkt"];
5863--6321[label="0.0793651;5pkt 5fpkt"];
5863--6361[label="0.0634921;4pkt 4fpkt"];
5863--6398[label="0.0634921;4pkt 4fpkt"];
5863--8127[label="1;63pkt 63fpkt"];
</description>
    <slice>
      <filter dst_ip="36.56.4.145" src_ip="152.65.144.188" src_port="80"/>
    </slice>
    <from sec="1204520419" usec="0"/>
    <to sec="1204521281" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_252{
style=filled;
color=gray75;
3849[label="153.253.107.180;d;44pkt 44fpkt", shape=diamond, color=yellow];
5913[label="153.253.107.180;d;44pkt 44fpkt", shape=hexagon, color=black];
8078[label="40.1.157.181;24pkt 24fpkt", shape=pentagon, color=darkviolet];
stat252[shape=component, label=&lt;Rules:&lt;BR/&gt;{40.1.157.181:80, 153.253.107.180:*}[47.8261%]&lt;BR/&gt;{32.173.169.13:80, 153.253.107.180:*}[43.4783%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.1071%)&lt;BR/&gt; 2127: (1.33929%)&lt;BR/&gt; 2126: (1.33929%)&lt;BR/&gt; 2125: (1.33929%)&lt;BR/&gt; 2124: (1.33929%)&gt;];
}
3849--5913[label="1;44pkt 44fpkt"];
3849--6321[label="0.136364;6pkt 6fpkt"];
3849--8078[label="0.916667;22pkt 22fpkt"];
5913--6321[label="0.136364;6pkt 6fpkt"];
5913--8078[label="0.916667;22pkt 22fpkt"];
</description>
    <slice>
      <filter dst_ip="153.253.107.180" src_ip="40.1.157.181" src_port="80"/>
      <filter dst_ip="153.253.107.180" src_ip="32.173.169.13" src_port="80"/>
    </slice>
    <from sec="1204520923" usec="0"/>
    <to sec="1204521210" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.05976,1.65963,999,1 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_255{
style=filled;
color=gray75;
26[label="33.26.244.21s;1pkt 1fpkt", shape=rectangle, color=red];
716[label="153.253.77.15;d;4pkt 4fpkt", shape=diamond, color=yellow];
719[label="33.26.244.21;s;1pkt 1fpkt", shape=diamond, color=yellow];
3928[label="196.89.251.211;s;1pkt 1fpkt", shape=diamond, color=yellow];
4229[label="153.253.77.15;d;3pkt 3fpkt", shape=hexagon, color=black];
4710[label="33.26.244.21;s;1pkt 1fpkt", shape=hexagon, color=black];
5963[label="196.89.251.211;s;1pkt 1fpkt", shape=hexagon, color=black];
6981[label="45.213.119.60;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat255[shape=component, label=&lt;Rules:&lt;BR/&gt;{33.26.244.21:4039, 153.253.77.15:17772}[25%]&lt;BR/&gt;{45.213.119.60:6669, 153.253.77.15:1039}[25%]&lt;BR/&gt;{98.229.31.195:2903, 153.253.77.15:17772}[25%]&lt;BR/&gt;{196.89.251.211:34112, 153.253.77.15:17772}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 17772: (38.4615%)&lt;BR/&gt; 4039: (19.2308%)&lt;BR/&gt; 34112: (11.5385%)&lt;BR/&gt; 6669: (11.5385%)&lt;BR/&gt; 1039: (11.5385%)&gt;];
}
26--716[label="1;1pkt 1fpkt"];
26--719[label="1;1pkt 1fpkt"];
26--4229[label="1;1pkt 1fpkt"];
26--4710[label="1;1pkt 1fpkt"];
716--719[label="1;1pkt 1fpkt"];
716--3928[label="1;1pkt 1fpkt"];
716--4229[label="1;3pkt 3fpkt"];
716--4710[label="1;1pkt 1fpkt"];
716--5963[label="1;1pkt 1fpkt"];
716--6981[label="1;1pkt 1fpkt"];
719--4229[label="1;1pkt 1fpkt"];
719--4710[label="1;1pkt 1fpkt"];
3928--5963[label="1;1pkt 1fpkt"];
4229--4710[label="1;1pkt 1fpkt"];
4229--6981[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="153.253.77.15" dst_port="17772" src_ip="196.89.251.211" src_port="34112"/>
      <filter dst_ip="153.253.77.15" dst_port="17772" src_ip="98.229.31.195" src_port="2903"/>
      <filter dst_ip="153.253.77.15" dst_port="1039" src_ip="45.213.119.60" src_port="6669"/>
      <filter dst_ip="153.253.77.15" dst_port="17772" src_ip="33.26.244.21" src_port="4039"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,010,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_256{
style=filled;
color=gray75;
3930[label="4.112.105.182;s;254pkt 254fpkt", shape=diamond, color=yellow];
5965[label="4.112.105.182;s;254pkt 254fpkt", shape=hexagon, color=black];
stat256[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.112.105.182:*, *:139}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 139: (50%)&lt;BR/&gt; 64059: (0.393701%)&lt;BR/&gt; 64047: (0.393701%)&lt;BR/&gt; 64027: (0.393701%)&lt;BR/&gt; 64021: (0.393701%)&gt;];
}
3930--5965[label="1;254pkt 254fpkt"];
</description>
    <slice>
      <filter dst_port="139" src_ip="4.112.105.182"/>
    </slice>
    <from sec="1204521153" usec="0"/>
    <to sec="1204521225" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.06493,1.65653,503,0 0 0 1 1 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_260{
style=filled;
color=gray75;
2953[label="152.89.112.150;s;28pkt 28fpkt", shape=diamond, color=yellow];
3498[label="153.253.17.234;d;55pkt 55fpkt", shape=diamond, color=yellow];
5268[label="152.89.112.150;s;26pkt 26fpkt", shape=hexagon, color=black];
5843[label="153.253.17.234;d;55pkt 55fpkt", shape=hexagon, color=black];
6466[label="208.91.176.4;29pkt 29fpkt", shape=pentagon, color=darkviolet];
9392[label="208.91.176.4;24pkt 24fpkt", shape=invhouse, color=bisque];
stat260[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.91.176.4:80, 153.253.17.234:*}[48.3333%]&lt;BR/&gt;{152.89.112.150:80, 153.253.17.234:*}[38.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 51886: (0.921659%)&lt;BR/&gt; 51880: (0.921659%)&lt;BR/&gt; 51876: (0.921659%)&lt;BR/&gt; 51875: (0.921659%)&gt;];
}
2953--3498[label="0.821429;23pkt 23fpkt"];
2953--4759[label="0.107143;3pkt 3fpkt"];
2953--5268[label="1;26pkt 26fpkt"];
2953--5843[label="0.821429;23pkt 23fpkt"];
2953--6091[label="0.107143;3pkt 3fpkt"];
2953--6318[label="0.107143;3pkt 3fpkt"];
2953--6321[label="0.142857;4pkt 4fpkt"];
2953--6326[label="0.0357143;1pkt 1fpkt"];
2953--6361[label="0.107143;3pkt 3fpkt"];
2953--6364[label="0.0357143;1pkt 1fpkt"];
2953--6398[label="0.107143;3pkt 3fpkt"];
2953--6401[label="0.0357143;1pkt 1fpkt"];
3498--5268[label="0.807692;21pkt 21fpkt"];
3498--5843[label="1;55pkt 55fpkt"];
3498--6318[label="0.109091;6pkt 6fpkt"];
3498--6321[label="0.0545455;3pkt 3fpkt"];
3498--6361[label="0.109091;6pkt 6fpkt"];
3498--6398[label="0.109091;6pkt 6fpkt"];
3498--6466[label="1;29pkt 29fpkt"];
3498--9392[label="1;24pkt 24fpkt"];
5268--5843[label="0.807692;21pkt 21fpkt"];
5268--6091[label="0.115385;3pkt 3fpkt"];
5268--6318[label="0.115385;3pkt 3fpkt"];
5268--6321[label="0.0769231;2pkt 2fpkt"];
5268--6326[label="0.0384615;1pkt 1fpkt"];
5268--6361[label="0.115385;3pkt 3fpkt"];
5268--6364[label="0.0384615;1pkt 1fpkt"];
5268--6398[label="0.115385;3pkt 3fpkt"];
5268--6401[label="0.0384615;1pkt 1fpkt"];
5843--6318[label="0.109091;6pkt 6fpkt"];
5843--6321[label="0.0545455;3pkt 3fpkt"];
5843--6361[label="0.109091;6pkt 6fpkt"];
5843--6398[label="0.109091;6pkt 6fpkt"];
5843--6466[label="1;29pkt 29fpkt"];
5843--9392[label="1;24pkt 24fpkt"];
6466--9392[label="1;24pkt 24fpkt"];
</description>
    <slice>
      <filter dst_ip="153.253.17.234" src_ip="208.91.176.4" src_port="80"/>
      <filter dst_ip="153.253.17.234" src_ip="152.89.112.150" src_port="80"/>
    </slice>
    <from sec="1204520406" usec="0"/>
    <to sec="1204521226" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_261{
style=filled;
color=gray75;
1356[label="153.253.67.21;s;113pkt 113fpkt", shape=diamond, color=yellow];
1848[label="197.73.190.98;d;8pkt 8fpkt", shape=diamond, color=yellow];
2319[label="153.253.67.17;s;102pkt 102fpkt", shape=diamond, color=yellow];
3309[label="86.208.47.139;d;14pkt 14fpkt", shape=diamond, color=yellow];
3625[label="208.145.119.11;d;16pkt 16fpkt", shape=diamond, color=yellow];
3774[label="214.29.50.103;d;70pkt 70fpkt", shape=diamond, color=yellow];
3820[label="153.253.67.52;s;49pkt 49fpkt", shape=diamond, color=yellow];
3859[label="63.157.119.112;d;15pkt 15fpkt", shape=diamond, color=yellow];
3886[label="150.36.134.79;d;4pkt 4fpkt", shape=diamond, color=yellow];
3899[label="192.18.20.103;d;18pkt 18fpkt", shape=diamond, color=yellow];
5076[label="153.253.67.17;s;42pkt 42fpkt", shape=hexagon, color=black];
5503[label="86.208.47.139;d;14pkt 14fpkt", shape=hexagon, color=black];
5560[label="153.253.67.21;s;102pkt 102fpkt", shape=hexagon, color=black];
5703[label="208.145.119.11;d;16pkt 16fpkt", shape=hexagon, color=black];
6579[label="153.253.67.17;126pkt 126fpkt", shape=pentagon, color=darkviolet];
6917[label="153.253.66.52;34pkt 34fpkt", shape=pentagon, color=darkviolet];
stat261[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.253.67.17:80, *:*}[33.0688%]&lt;BR/&gt;{153.253.67.21:80, *:*}[29.8942%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.7308%)&lt;BR/&gt; 137: (0.538358%)&lt;BR/&gt; 61656: (0.336474%)&lt;BR/&gt; 44984: (0.336474%)&lt;BR/&gt; 41433: (0.336474%)&gt;];
}
1356--1848[label="1;8pkt 8fpkt"];
1356--3309[label="0.142857;2pkt 2fpkt"];
1356--3547[label="0.0102041;1pkt 1fpkt"];
1356--3625[label="0.1875;3pkt 3fpkt"];
1356--3774[label="0.0571429;4pkt 4fpkt"];
1356--3859[label="0.133333;2pkt 2fpkt"];
1356--3886[label="1;4pkt 4fpkt"];
1356--3899[label="0.111111;2pkt 2fpkt"];
1356--4146[label="0.00884956;1pkt 1fpkt"];
1356--4701[label="0.04;4pkt 4fpkt"];
1356--5503[label="0.142857;2pkt 2fpkt"];
1356--5560[label="1;102pkt 102fpkt"];
1356--5703[label="0.1875;3pkt 3fpkt"];
1356--6318[label="0.0884956;10pkt 10fpkt"];
1356--6321[label="0.0884956;10pkt 10fpkt"];
1356--6361[label="0.0884956;10pkt 10fpkt"];
1356--6398[label="0.0884956;10pkt 10fpkt"];
1848--5560[label="1;8pkt 8fpkt"];
2319--3309[label="0.285714;4pkt 4fpkt"];
2319--3547[label="0.0102041;1pkt 1fpkt"];
2319--3625[label="0.3125;5pkt 5fpkt"];
2319--3774[label="0.214286;15pkt 15fpkt"];
2319--3859[label="0.266667;4pkt 4fpkt"];
2319--3899[label="0.388889;7pkt 7fpkt"];
2319--4701[label="0.01;1pkt 1fpkt"];
2319--5076[label="1;42pkt 42fpkt"];
2319--5503[label="0.285714;4pkt 4fpkt"];
2319--5703[label="0.3125;5pkt 5fpkt"];
2319--6117[label="0.0142857;1pkt 1fpkt"];
2319--6318[label="0.0686275;7pkt 7fpkt"];
2319--6321[label="0.0980392;10pkt 10fpkt"];
2319--6361[label="0.0686275;7pkt 7fpkt"];
2319--6398[label="0.0686275;7pkt 7fpkt"];
2319--6579[label="1;102pkt 102fpkt"];
3309--3820[label="0.285714;4pkt 4fpkt"];
3309--5076[label="0.0714286;1pkt 1fpkt"];
3309--5503[label="1;14pkt 14fpkt"];
3309--5560[label="0.142857;2pkt 2fpkt"];
3309--6579[label="0.285714;4pkt 4fpkt"];
3625--3820[label="0.25;4pkt 4fpkt"];
3625--5560[label="0.125;2pkt 2fpkt"];
3625--5703[label="1;16pkt 16fpkt"];
3625--6321[label="0.5;8pkt 8fpkt"];
3625--6579[label="0.3125;5pkt 5fpkt"];
3625--6917[label="0.0625;1pkt 1fpkt"];
3774--3820[label="0.183673;9pkt 9fpkt"];
3774--4872[label="0.0465116;2pkt 2fpkt"];
3774--5076[label="0.190476;8pkt 8fpkt"];
3774--5560[label="0.0571429;4pkt 4fpkt"];
3774--6318[label="0.1;7pkt 7fpkt"];
3774--6321[label="0.0428571;3pkt 3fpkt"];
3774--6361[label="0.1;7pkt 7fpkt"];
3774--6398[label="0.1;7pkt 7fpkt"];
3774--6579[label="0.214286;15pkt 15fpkt"];
3774--6917[label="0.0882353;3pkt 3fpkt"];
3774--7094[label="0.128571;9pkt 9fpkt"];
3820--3859[label="0.2;3pkt 3fpkt"];
3820--3899[label="0.166667;3pkt 3fpkt"];
3820--5503[label="0.285714;4pkt 4fpkt"];
3820--5703[label="0.25;4pkt 4fpkt"];
3820--6321[label="0.0204082;1pkt 1fpkt"];
3859--5383[label="0.0666667;1pkt 1fpkt"];
3859--5560[label="0.133333;2pkt 2fpkt"];
3859--6321[label="0.0666667;1pkt 1fpkt"];
3859--6579[label="0.266667;4pkt 4fpkt"];
3859--6917[label="0.0666667;1pkt 1fpkt"];
3886--5560[label="1;4pkt 4fpkt"];
3886--6321[label="1;4pkt 4fpkt"];
3899--6321[label="0.0555556;1pkt 1fpkt"];
3899--6579[label="0.388889;7pkt 7fpkt"];
3899--6917[label="0.0555556;1pkt 1fpkt"];
5076--5503[label="0.0714286;1pkt 1fpkt"];
5076--6117[label="0.0238095;1pkt 1fpkt"];
5076--6318[label="0.166667;7pkt 7fpkt"];
5076--6361[label="0.166667;7pkt 7fpkt"];
5076--6398[label="0.166667;7pkt 7fpkt"];
5076--6579[label="1;42pkt 42fpkt"];
5503--5560[label="0.142857;2pkt 2fpkt"];
5503--6579[label="0.285714;4pkt 4fpkt"];
5560--5703[label="0.125;2pkt 2fpkt"];
5560--6318[label="0.0980392;10pkt 10fpkt"];
5560--6321[label="0.0980392;10pkt 10fpkt"];
5560--6361[label="0.0980392;10pkt 10fpkt"];
5560--6398[label="0.0980392;10pkt 10fpkt"];
5703--6321[label="0.5;8pkt 8fpkt"];
5703--6579[label="0.3125;5pkt 5fpkt"];
5703--6917[label="0.0625;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="153.253.67.17" src_port="80"/>
      <filter src_ip="153.253.67.21" src_port="80"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.08475,1.70201,999,1 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_262{
style=filled;
color=gray75;
307[label="153.253.212.252s;77pkt 77fpkt", shape=rectangle, color=red];
1962[label="153.253.212.252;s;1402pkt 1402fpkt", shape=diamond, color=yellow];
5835[label="153.253.212.252;s;1402pkt 1402fpkt", shape=hexagon, color=black];
stat262[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.253.212.252:*, *:25}[72.1826%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (40.4894%)&lt;BR/&gt; 113: (9.51059%)&lt;BR/&gt; 29240: (0.104131%)&lt;BR/&gt; 27552: (0.104131%)&lt;BR/&gt; 7464: (0.104131%)&gt;];
}
307--1962[label="1;77pkt 77fpkt"];
307--5835[label="1;77pkt 77fpkt"];
1962--2224[label="0.00493827;2pkt 2fpkt"];
1962--3709[label="0.0230769;3pkt 3fpkt"];
1962--4302[label="0.00564972;1pkt 1fpkt"];
1962--4556[label="0.008;1pkt 1fpkt"];
1962--4559[label="0.00636943;1pkt 1fpkt"];
1962--4589[label="0.0526316;2pkt 2fpkt"];
1962--4690[label="0.0197628;5pkt 5fpkt"];
1962--5236[label="0.00584795;2pkt 2fpkt"];
1962--5426[label="0.00746269;2pkt 2fpkt"];
1962--5559[label="0.00598802;2pkt 2fpkt"];
1962--5835[label="1;1402pkt 1402fpkt"];
1962--6297[label="0.00784593;11pkt 11fpkt"];
1962--6340[label="0.00784593;11pkt 11fpkt"];
1962--6377[label="0.00784593;11pkt 11fpkt"];
5835--6297[label="0.00784593;11pkt 11fpkt"];
5835--6340[label="0.00784593;11pkt 11fpkt"];
5835--6377[label="0.00784593;11pkt 11fpkt"];
</description>
    <slice>
      <filter dst_port="25" src_ip="153.253.212.252"/>
    </slice>
    <from sec="1204520403" usec="0"/>
    <to sec="1204521242" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_267{
style=filled;
color=gray75;
6934[label="196.25.97.54;9pkt 9fpkt", shape=pentagon, color=darkviolet];
stat267[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.25.97.54:80, 1.42.211.64:*}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 60232: (5.55556%)&lt;BR/&gt; 58627: (5.55556%)&lt;BR/&gt; 58430: (5.55556%)&lt;BR/&gt; 42215: (5.55556%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="1.42.211.64" src_ip="196.25.97.54" src_port="80"/>
    </slice>
    <from sec="1204520522" usec="0"/>
    <to sec="1204521005" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="84.247.99.0"/>
    </slice>
    <from sec="1204520686" usec="0"/>
    <to sec="1204520807" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="38.231.112.0"/>
    </slice>
    <from sec="1204520431" usec="0"/>
    <to sec="1204520450" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="42.116.136.0"/>
    </slice>
    <from sec="1204520762" usec="0"/>
    <to sec="1204521076" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="5.60.38.1"/>
    </slice>
    <from sec="1204521216" usec="0"/>
    <to sec="1204521229" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="45.202.205.1"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="83.178.165.3"/>
    </slice>
    <from sec="1204520410" usec="0"/>
    <to sec="1204521299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="221.25.184.3"/>
    </slice>
    <from sec="1204520810" usec="0"/>
    <to sec="1204520839" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.181.214.3"/>
    </slice>
    <from sec="1204520735" usec="0"/>
    <to sec="1204520749" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.1.32.4"/>
    </slice>
    <from sec="1204520923" usec="0"/>
    <to sec="1204521053" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.16.218.4"/>
    </slice>
    <from sec="1204520414" usec="0"/>
    <to sec="1204521297" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.253.222.4"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="47.42.205.5"/>
    </slice>
    <from sec="1204520563" usec="0"/>
    <to sec="1204520567" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.1.32.6"/>
    </slice>
    <from sec="1204521269" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="176.174.55.6"/>
    </slice>
    <from sec="1204520973" usec="0"/>
    <to sec="1204521005" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="13.52.4.7"/>
    </slice>
    <from sec="1204520757" usec="0"/>
    <to sec="1204520760" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="84.158.164.7"/>
    </slice>
    <from sec="1204520903" usec="0"/>
    <to sec="1204520909" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="156.161.213.7"/>
    </slice>
    <from sec="1204520410" usec="0"/>
    <to sec="1204520844" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="47.14.153.8"/>
    </slice>
    <from sec="1204520653" usec="0"/>
    <to sec="1204521013" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="98.70.74.9"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="84.217.214.9"/>
    </slice>
    <from sec="1204520507" usec="0"/>
    <to sec="1204520655" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="223.33.6.10"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.25.105.10"/>
    </slice>
    <from sec="1204520832" usec="0"/>
    <to sec="1204520856" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="13.41.133.10"/>
    </slice>
    <from sec="1204520788" usec="0"/>
    <to sec="1204520800" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="83.19.93.11"/>
    </slice>
    <from sec="1204520917" usec="0"/>
    <to sec="1204520929" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.96.183.11"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="2.198.212.12"/>
    </slice>
    <from sec="1204520961" usec="0"/>
    <to sec="1204520966" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="42.158.216.12"/>
    </slice>
    <from sec="1204520841" usec="0"/>
    <to sec="1204520874" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.253.99.13"/>
    </slice>
    <from sec="1204520466" usec="0"/>
    <to sec="1204521297" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.145.103.13"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="222.83.5.14"/>
    </slice>
    <from sec="1204520697" usec="0"/>
    <to sec="1204520714" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="5.162.8.14"/>
    </slice>
    <from sec="1204520981" usec="0"/>
    <to sec="1204520991" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.588747,1.73007,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_300{
style=filled;
color=gray75;
1178[label="133.89.80.135;d;114pkt 114fpkt", shape=diamond, color=yellow];
1660[label="156.120.238.81;s;104pkt 104fpkt", shape=diamond, color=yellow];
6549[label="131.66.40.14;23pkt 23fpkt", shape=pentagon, color=darkviolet];
stat300[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.120.238.81:80, 133.89.80.135:*}[71.6535%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 51253: (0.414938%)&lt;BR/&gt; 51252: (0.414938%)&lt;BR/&gt; 51251: (0.414938%)&lt;BR/&gt; 51250: (0.414938%)&gt;];
}
1178--1660[label="0.875;91pkt 91fpkt"];
1178--6549[label="1;23pkt 23fpkt"];
1660--6318[label="0.00961538;1pkt 1fpkt"];
1660--6321[label="0.00961538;1pkt 1fpkt"];
1660--6361[label="0.00961538;1pkt 1fpkt"];
1660--6398[label="0.00961538;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="133.89.80.135" src_ip="156.120.238.81" src_port="80"/>
    </slice>
    <from sec="1204520442" usec="0"/>
    <to sec="1204521194" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="83.164.148.14"/>
    </slice>
    <from sec="1204520493" usec="0"/>
    <to sec="1204520497" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="82.158.198.15"/>
    </slice>
    <from sec="1204520796" usec="0"/>
    <to sec="1204520801" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.221.213.15"/>
    </slice>
    <from sec="1204520844" usec="0"/>
    <to sec="1204521013" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.144.32.16"/>
    </slice>
    <from sec="1204520780" usec="0"/>
    <to sec="1204521242" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.224.60.16"/>
    </slice>
    <from sec="1204520763" usec="0"/>
    <to sec="1204520766" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="206.100.207.16"/>
    </slice>
    <from sec="1204520780" usec="0"/>
    <to sec="1204520821" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.33.221.17"/>
    </slice>
    <from sec="1204520404" usec="0"/>
    <to sec="1204521130" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.253.222.17"/>
    </slice>
    <from sec="1204520442" usec="0"/>
    <to sec="1204520806" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="60.242.27.18"/>
    </slice>
    <from sec="1204520900" usec="0"/>
    <to sec="1204520913" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.26.170.18"/>
    </slice>
    <from sec="1204520675" usec="0"/>
    <to sec="1204520903" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.8.4.19"/>
    </slice>
    <from sec="1204520413" usec="0"/>
    <to sec="1204521287" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.81.87.20"/>
    </slice>
    <from sec="1204520406" usec="0"/>
    <to sec="1204520553" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.89.101.20"/>
    </slice>
    <from sec="1204520807" usec="0"/>
    <to sec="1204520821" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="206.157.137.20"/>
    </slice>
    <from sec="1204521241" usec="0"/>
    <to sec="1204521260" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="222.34.147.21"/>
    </slice>
    <from sec="1204520521" usec="0"/>
    <to sec="1204520565" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.87.230.21"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="33.26.244.21"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="38.231.126.23"/>
    </slice>
    <from sec="1204521200" usec="0"/>
    <to sec="1204521289" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.118.18.25"/>
    </slice>
    <from sec="1204520867" usec="0"/>
    <to sec="1204520870" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="176.144.46.25"/>
    </slice>
    <from sec="1204520409" usec="0"/>
    <to sec="1204521298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.228.106.25"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.74811,1.71088,010,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_324{
style=filled;
color=gray75;
2792[label="84.215.149.25;s;191pkt 191fpkt", shape=diamond, color=yellow];
6648[label="84.215.149.25;191pkt 191fpkt", shape=pentagon, color=darkviolet];
8692[label="84.215.149.25;190pkt 190fpkt", shape=invtriangle, color=brown];
stat324[shape=component, label=&lt;Rules:&lt;BR/&gt;{84.215.149.25:*, *:1080}[27.7487%]&lt;BR/&gt;{84.215.149.25:*, *:8080}[26.7016%]&lt;BR/&gt;{84.215.149.25:*, *:8000}[24.6073%]&lt;BR/&gt;{84.215.149.25:*, *:6588}[20.9424%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1080: (13.8986%)&lt;BR/&gt; 8080: (13.3741%)&lt;BR/&gt; 8000: (12.2378%)&lt;BR/&gt; 6588: (10.4895%)&lt;BR/&gt; 3630: (0.524476%)&gt;];
}
2792--6648[label="1;191pkt 191fpkt"];
2792--8692[label="1;190pkt 190fpkt"];
6648--8692[label="1;190pkt 190fpkt"];
</description>
    <slice>
      <filter dst_port="1080" src_ip="84.215.149.25"/>
      <filter dst_port="8080" src_ip="84.215.149.25"/>
      <filter dst_port="8000" src_ip="84.215.149.25"/>
      <filter dst_port="6588" src_ip="84.215.149.25"/>
    </slice>
    <from sec="1204520781" usec="0"/>
    <to sec="1204520834" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.144.166.25"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="32.62.40.26"/>
    </slice>
    <from sec="1204520825" usec="0"/>
    <to sec="1204520832" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="84.70.96.26"/>
    </slice>
    <from sec="1204521234" usec="0"/>
    <to sec="1204521238" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="217.127.96.26"/>
    </slice>
    <from sec="1204520421" usec="0"/>
    <to sec="1204521062" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="222.92.154.26"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="58.168.24.27"/>
    </slice>
    <from sec="1204520924" usec="0"/>
    <to sec="1204520941" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="38.231.127.27"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="57.133.132.27"/>
    </slice>
    <from sec="1204520825" usec="0"/>
    <to sec="1204520843" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.183.186.27"/>
    </slice>
    <from sec="1204520424" usec="0"/>
    <to sec="1204521019" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.197.217.27"/>
    </slice>
    <from sec="1204520805" usec="0"/>
    <to sec="1204520882" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.253.82.28"/>
    </slice>
    <from sec="1204520420" usec="0"/>
    <to sec="1204521297" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="1.238.78.29"/>
    </slice>
    <from sec="1204520712" usec="0"/>
    <to sec="1204520734" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="2.198.27.30"/>
    </slice>
    <from sec="1204520927" usec="0"/>
    <to sec="1204521097" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="0.129.44.30"/>
    </slice>
    <from sec="1204521134" usec="0"/>
    <to sec="1204521145" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="84.159.117.30"/>
    </slice>
    <from sec="1204520407" usec="0"/>
    <to sec="1204521297" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.588747,1.73007,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_341{
style=filled;
color=gray75;
2277[label="153.253.134.26;d;203pkt 203fpkt", shape=diamond, color=yellow];
6702[label="43.63.146.30;19pkt 19fpkt", shape=pentagon, color=darkviolet];
6805[label="48.6.12.41;20pkt 20fpkt", shape=pentagon, color=darkviolet];
7103[label="178.78.118.73;19pkt 19fpkt", shape=pentagon, color=darkviolet];
8059[label="2.0.226.179;24pkt 24fpkt", shape=pentagon, color=darkviolet];
stat341[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 153.253.134.26:25}[94.2029%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (49.2982%)&lt;BR/&gt; 53: (0.701754%)&lt;BR/&gt; 17123: (0.526316%)&lt;BR/&gt; 17368: (0.350877%)&lt;BR/&gt; 17342: (0.350877%)&gt;];
}
2277--2853[label="0.00492611;1pkt 1fpkt"];
2277--5343[label="0.00492611;1pkt 1fpkt"];
2277--6702[label="1;19pkt 19fpkt"];
2277--6805[label="1;20pkt 20fpkt"];
2277--7103[label="1;19pkt 19fpkt"];
2277--8059[label="0.833333;20pkt 20fpkt"];
2277--8605[label="0.00552486;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="153.253.134.26" dst_port="25"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521219" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.176.1.32"/>
    </slice>
    <from sec="1204520481" usec="0"/>
    <to sec="1204520541" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.79.20.32"/>
    </slice>
    <from sec="1204520805" usec="0"/>
    <to sec="1204520840" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="82.215.58.32"/>
    </slice>
    <from sec="1204520795" usec="0"/>
    <to sec="1204520805" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.165.84.32"/>
    </slice>
    <from sec="1204520916" usec="0"/>
    <to sec="1204520978" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="84.122.119.32"/>
    </slice>
    <from sec="1204520840" usec="0"/>
    <to sec="1204520857" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="38.231.112.33"/>
    </slice>
    <from sec="1204520488" usec="0"/>
    <to sec="1204520540" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.74811,1.71088,010,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_348{
style=filled;
color=gray75;
2439[label="4.214.49.34;s;508pkt 508fpkt", shape=diamond, color=yellow];
6739[label="4.214.49.34;508pkt 508fpkt", shape=pentagon, color=darkviolet];
8723[label="4.214.49.34;508pkt 508fpkt", shape=invtriangle, color=brown];
stat348[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.214.49.34:*, *:139}[50%]&lt;BR/&gt;{4.214.49.34:*, *:445}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (25%)&lt;BR/&gt; 139: (25%)&lt;BR/&gt; 3184: (0.19685%)&lt;BR/&gt; 3164: (0.19685%)&lt;BR/&gt; 3144: (0.19685%)&gt;];
}
2439--6298[label="0.0019685;1pkt 1fpkt"];
2439--6341[label="0.0019685;1pkt 1fpkt"];
2439--6378[label="0.0019685;1pkt 1fpkt"];
2439--6739[label="1;508pkt 508fpkt"];
2439--8723[label="1;508pkt 508fpkt"];
6739--8723[label="1;508pkt 508fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="4.214.49.34"/>
      <filter dst_port="139" src_ip="4.214.49.34"/>
    </slice>
    <from sec="1204520657" usec="0"/>
    <to sec="1204520898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="83.86.69.34"/>
    </slice>
    <from sec="1204521067" usec="0"/>
    <to sec="1204521299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="56.214.169.36"/>
    </slice>
    <from sec="1204520775" usec="0"/>
    <to sec="1204520836" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="82.244.210.36"/>
    </slice>
    <from sec="1204520840" usec="0"/>
    <to sec="1204520862" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="0.66.223.36"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="223.51.84.37"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.230.61.39"/>
    </slice>
    <from sec="1204520420" usec="0"/>
    <to sec="1204521286" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.107.108.39"/>
    </slice>
    <from sec="1204520465" usec="0"/>
    <to sec="1204521061" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="156.161.173.40"/>
    </slice>
    <from sec="1204520411" usec="0"/>
    <to sec="1204520919" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="0.240.49.43"/>
    </slice>
    <from sec="1204520438" usec="0"/>
    <to sec="1204521281" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="86.4.218.43"/>
    </slice>
    <from sec="1204520779" usec="0"/>
    <to sec="1204520808" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.39.77.44"/>
    </slice>
    <from sec="1204520731" usec="0"/>
    <to sec="1204520797" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="38.231.125.44"/>
    </slice>
    <from sec="1204520592" usec="0"/>
    <to sec="1204520611" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="164.232.215.44"/>
    </slice>
    <from sec="1204520726" usec="0"/>
    <to sec="1204521098" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="82.148.163.45"/>
    </slice>
    <from sec="1204520406" usec="0"/>
    <to sec="1204521294" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.172.107.46"/>
    </slice>
    <from sec="1204520910" usec="0"/>
    <to sec="1204520981" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="38.231.112.47"/>
    </slice>
    <from sec="1204520406" usec="0"/>
    <to sec="1204520422" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.76.189.48"/>
    </slice>
    <from sec="1204520417" usec="0"/>
    <to sec="1204521298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="85.142.33.49"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="35.213.120.50"/>
    </slice>
    <from sec="1204520439" usec="0"/>
    <to sec="1204521286" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="82.149.182.51"/>
    </slice>
    <from sec="1204520819" usec="0"/>
    <to sec="1204520893" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="156.161.160.52"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="156.103.166.52"/>
    </slice>
    <from sec="1204520772" usec="0"/>
    <to sec="1204520799" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.2.110.55"/>
    </slice>
    <from sec="1204520430" usec="0"/>
    <to sec="1204520436" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="213.108.117.56"/>
    </slice>
    <from sec="1204520931" usec="0"/>
    <to sec="1204520949" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.253.137.56"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.253.4.60"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="37.242.48.62"/>
    </slice>
    <from sec="1204521275" usec="0"/>
    <to sec="1204521295" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.242.9.63"/>
    </slice>
    <from sec="1204520427" usec="0"/>
    <to sec="1204520559" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.253.226.63"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.253.237.64"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.4.11.65"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.178.42.65"/>
    </slice>
    <from sec="1204520748" usec="0"/>
    <to sec="1204520771" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.130.60.65"/>
    </slice>
    <from sec="1204520402" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="33.16.88.65"/>
    </slice>
    <from sec="1204520734" usec="0"/>
    <to sec="1204520741" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="38.231.126.65"/>
    </slice>
    <from sec="1204521232" usec="0"/>
    <to sec="1204521242" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.253.208.67"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="38.231.127.68"/>
    </slice>
    <from sec="1204520655" usec="0"/>
    <to sec="1204520799" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="40.136.87.69"/>
    </slice>
    <from sec="1204520783" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="217.19.100.70"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.180.67.71"/>
    </slice>
    <from sec="1204520830" usec="0"/>
    <to sec="1204521090" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="38.231.126.71"/>
    </slice>
    <from sec="1204520782" usec="0"/>
    <to sec="1204520788" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.3.10.72"/>
    </slice>
    <from sec="1204520439" usec="0"/>
    <to sec="1204521298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="156.161.160.72"/>
    </slice>
    <from sec="1204520643" usec="0"/>
    <to sec="1204521298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="36.56.2.73"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.25.178.73"/>
    </slice>
    <from sec="1204520703" usec="0"/>
    <to sec="1204520808" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="12.162.33.74"/>
    </slice>
    <from sec="1204520403" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.1.32.77"/>
    </slice>
    <from sec="1204520635" usec="0"/>
    <to sec="1204520783" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="84.247.69.77"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.1.32.78"/>
    </slice>
    <from sec="1204521128" usec="0"/>
    <to sec="1204521162" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="156.120.187.78"/>
    </slice>
    <from sec="1204520885" usec="0"/>
    <to sec="1204520893" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.253.23.80"/>
    </slice>
    <from sec="1204521029" usec="0"/>
    <to sec="1204521054" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="32.34.44.80"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="162.3.208.80"/>
    </slice>
    <from sec="1204520410" usec="0"/>
    <to sec="1204521299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="82.214.179.81"/>
    </slice>
    <from sec="1204520572" usec="0"/>
    <to sec="1204520617" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="33.45.111.82"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="156.161.208.82"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="83.214.230.82"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.29.32.83"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="59.190.134.84"/>
    </slice>
    <from sec="1204521073" usec="0"/>
    <to sec="1204521080" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="164.232.215.84"/>
    </slice>
    <from sec="1204520924" usec="0"/>
    <to sec="1204521035" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="84.110.150.86"/>
    </slice>
    <from sec="1204521075" usec="0"/>
    <to sec="1204521100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.81.167.86"/>
    </slice>
    <from sec="1204521233" usec="0"/>
    <to sec="1204521299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="32.10.95.87"/>
    </slice>
    <from sec="1204520401" usec="0"/>
    <to sec="1204520716" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="98.143.232.87"/>
    </slice>
    <from sec="1204520877" usec="0"/>
    <to sec="1204520891" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="82.70.157.88"/>
    </slice>
    <from sec="1204520449" usec="0"/>
    <to sec="1204520465" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="156.131.211.88"/>
    </slice>
    <from sec="1204520552" usec="0"/>
    <to sec="1204520585" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.167.25.89"/>
    </slice>
    <from sec="1204520408" usec="0"/>
    <to sec="1204521298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="105.65.180.89"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.181.204.89"/>
    </slice>
    <from sec="1204520722" usec="0"/>
    <to sec="1204520803" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="223.64.110.91"/>
    </slice>
    <from sec="1204520405" usec="0"/>
    <to sec="1204521277" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_424{
style=filled;
color=gray75;
3039[label="196.25.98.253;d;243pkt 243fpkt", shape=diamond, color=yellow];
3141[label="221.20.211.190;s;477pkt 477fpkt", shape=diamond, color=yellow];
3371[label="196.25.106.36;d;235pkt 235fpkt", shape=diamond, color=yellow];
5309[label="196.25.98.253;d;243pkt 243fpkt", shape=hexagon, color=black];
5683[label="221.20.211.190;s;387pkt 387fpkt", shape=hexagon, color=black];
8145[label="221.20.211.190;624pkt 624fpkt", shape=pentagon, color=darkviolet];
stat424[shape=component, label=&lt;Rules:&lt;BR/&gt;{221.20.211.190:80, 196.25.106.36:*}[60%]&lt;BR/&gt;{221.20.211.190:80, 196.25.98.253:*}[39.84%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 50494: (0.113173%)&lt;BR/&gt; 50493: (0.113173%)&lt;BR/&gt; 50491: (0.113173%)&lt;BR/&gt; 50490: (0.113173%)&gt;];
}
3039--3141[label="1;243pkt 243fpkt"];
3039--5309[label="1;243pkt 243fpkt"];
3039--5683[label="0.641975;156pkt 156fpkt"];
3039--6321[label="0.0576132;14pkt 14fpkt"];
3039--8145[label="1;243pkt 243fpkt"];
3141--3371[label="0.995745;234pkt 234fpkt"];
3141--5309[label="1;243pkt 243fpkt"];
3141--5683[label="1;387pkt 387fpkt"];
3141--6321[label="0.0314465;15pkt 15fpkt"];
3141--8145[label="1;477pkt 477fpkt"];
3371--5683[label="0.982979;231pkt 231fpkt"];
3371--6321[label="0.00425532;1pkt 1fpkt"];
3371--7283[label="0.02;1pkt 1fpkt"];
3371--8145[label="0.995745;234pkt 234fpkt"];
5309--5683[label="0.641975;156pkt 156fpkt"];
5309--6321[label="0.0576132;14pkt 14fpkt"];
5309--8145[label="1;243pkt 243fpkt"];
5683--6321[label="0.0387597;15pkt 15fpkt"];
5683--8145[label="1;387pkt 387fpkt"];
</description>
    <slice>
      <filter dst_ip="196.25.106.36" src_ip="221.20.211.190" src_port="80"/>
      <filter dst_ip="196.25.98.253" src_ip="221.20.211.190" src_port="80"/>
    </slice>
    <from sec="1204520804" usec="0"/>
    <to sec="1204521291" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="56.187.215.92"/>
    </slice>
    <from sec="1204520919" usec="0"/>
    <to sec="1204520951" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="35.240.224.92"/>
    </slice>
    <from sec="1204520408" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="85.225.74.93"/>
    </slice>
    <from sec="1204521199" usec="0"/>
    <to sec="1204521278" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.170.144.93"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="47.58.17.94"/>
    </slice>
    <from sec="1204521054" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="38.231.124.94"/>
    </slice>
    <from sec="1204520504" usec="0"/>
    <to sec="1204520543" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="40.136.23.95"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="2.2.22.98"/>
    </slice>
    <from sec="1204520974" usec="0"/>
    <to sec="1204520997" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="32.80.155.99"/>
    </slice>
    <from sec="1204520769" usec="0"/>
    <to sec="1204520783" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.253.24.100"/>
    </slice>
    <from sec="1204520402" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.33.220.100"/>
    </slice>
    <from sec="1204520928" usec="0"/>
    <to sec="1204521217" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.121.6.101"/>
    </slice>
    <from sec="1204520406" usec="0"/>
    <to sec="1204521295" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="32.176.58.101"/>
    </slice>
    <from sec="1204520411" usec="0"/>
    <to sec="1204521295" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.25.145.101"/>
    </slice>
    <from sec="1204520700" usec="0"/>
    <to sec="1204520709" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.73.102.103"/>
    </slice>
    <from sec="1204520827" usec="0"/>
    <to sec="1204520856" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="38.231.124.103"/>
    </slice>
    <from sec="1204520690" usec="0"/>
    <to sec="1204520724" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="1.67.113.104"/>
    </slice>
    <from sec="1204520420" usec="0"/>
    <to sec="1204520464" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="156.161.189.105"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.253.137.107"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.253.140.108"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="37.33.176.109"/>
    </slice>
    <from sec="1204520896" usec="0"/>
    <to sec="1204520916" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="213.130.78.110"/>
    </slice>
    <from sec="1204521269" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="61.104.196.111"/>
    </slice>
    <from sec="1204520978" usec="0"/>
    <to sec="1204520990" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="12.42.81.112"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="83.176.84.112"/>
    </slice>
    <from sec="1204520572" usec="0"/>
    <to sec="1204520703" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="46.104.165.113"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="156.120.201.119"/>
    </slice>
    <from sec="1204520530" usec="0"/>
    <to sec="1204520541" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="83.89.76.120"/>
    </slice>
    <from sec="1204520402" usec="0"/>
    <to sec="1204521298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="217.105.99.120"/>
    </slice>
    <from sec="1204520990" usec="0"/>
    <to sec="1204521020" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="83.80.121.120"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="164.232.215.120"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="35.243.224.122"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="139.77.0.123"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="38.42.65.123"/>
    </slice>
    <from sec="1204520576" usec="0"/>
    <to sec="1204520735" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.134.89.123"/>
    </slice>
    <from sec="1204520407" usec="0"/>
    <to sec="1204521298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="87.40.231.123"/>
    </slice>
    <from sec="1204520401" usec="0"/>
    <to sec="1204520502" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="1.219.20.126"/>
    </slice>
    <from sec="1204520800" usec="0"/>
    <to sec="1204520810" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="223.83.95.128"/>
    </slice>
    <from sec="1204520410" usec="0"/>
    <to sec="1204521290" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="1.236.164.128"/>
    </slice>
    <from sec="1204520413" usec="0"/>
    <to sec="1204520467" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.05976,1.65963,503,1 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_466{
style=filled;
color=gray75;
152[label="153.253.158.141s;1pkt 1fpkt", shape=rectangle, color=red];
1507[label="153.253.158.141;s;323pkt 323fpkt", shape=diamond, color=yellow];
2766[label="215.16.144.1;d;8pkt 8fpkt", shape=diamond, color=yellow];
3052[label="214.50.26.238;d;8pkt 8fpkt", shape=diamond, color=yellow];
3197[label="209.201.162.106;d;2pkt 2fpkt", shape=diamond, color=yellow];
5048[label="153.253.158.141;s;296pkt 296fpkt", shape=hexagon, color=black];
5315[label="214.50.26.238;d;8pkt 8fpkt", shape=hexagon, color=black];
7701[label="153.253.158.141;354pkt 354fpkt", shape=pentagon, color=darkviolet];
stat466[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.253.158.141:32769, *:53}[39.2157%]&lt;BR/&gt;{153.253.158.141:*, *:80}[35.2941%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (23.3%)&lt;BR/&gt; 32769: (20.25%)&lt;BR/&gt; 80: (18.05%)&lt;BR/&gt; 25: (8%)&lt;BR/&gt; 0: (0.6%)&gt;];
}
152--1507[label="1;1pkt 1fpkt"];
152--2766[label="1;1pkt 1fpkt"];
152--5048[label="1;1pkt 1fpkt"];
152--7701[label="1;1pkt 1fpkt"];
1507--1538[label="0.00462963;1pkt 1fpkt"];
1507--1543[label="0.00928793;3pkt 3fpkt"];
1507--1560[label="0.00928793;3pkt 3fpkt"];
1507--1617[label="0.00796813;2pkt 2fpkt"];
1507--1634[label="0.00930233;2pkt 2fpkt"];
1507--1650[label="0.0124224;2pkt 2fpkt"];
1507--1866[label="0.030303;1pkt 1fpkt"];
1507--1871[label="0.00609756;1pkt 1fpkt"];
1507--1882[label="0.00588235;1pkt 1fpkt"];
1507--1885[label="0.0171674;4pkt 4fpkt"];
1507--1908[label="0.00636943;1pkt 1fpkt"];
1507--1918[label="0.00598802;1pkt 1fpkt"];
1507--2245[label="0.00649351;1pkt 1fpkt"];
1507--2287[label="0.030303;1pkt 1fpkt"];
1507--2359[label="0.0121212;2pkt 2fpkt"];
1507--2611[label="0.00606061;1pkt 1fpkt"];
1507--2752[label="0.00309598;1pkt 1fpkt"];
1507--2766[label="0.625;5pkt 5fpkt"];
1507--2864[label="0.00806452;1pkt 1fpkt"];
1507--2868[label="0.00684932;1pkt 1fpkt"];
1507--3052[label="1;8pkt 8fpkt"];
1507--3194[label="0.0136986;1pkt 1fpkt"];
1507--3197[label="1;2pkt 2fpkt"];
1507--3220[label="0.00699301;1pkt 1fpkt"];
1507--3237[label="0.00746269;1pkt 1fpkt"];
1507--3458[label="0.0144928;1pkt 1fpkt"];
1507--3704[label="0.0131579;1pkt 1fpkt"];
1507--3766[label="0.02;2pkt 2fpkt"];
1507--4086[label="0.00309598;1pkt 1fpkt"];
1507--4124[label="0.0164835;3pkt 3fpkt"];
1507--4141[label="0.00928793;3pkt 3fpkt"];
1507--4146[label="0.00877193;1pkt 1fpkt"];
1507--4747[label="0.030303;1pkt 1fpkt"];
1507--4752[label="0.00819672;1pkt 1fpkt"];
1507--4778[label="0.00636943;1pkt 1fpkt"];
1507--4786[label="0.00970874;1pkt 1fpkt"];
1507--4787[label="0.00719424;2pkt 2fpkt"];
1507--4789[label="0.03125;1pkt 1fpkt"];
1507--4798[label="0.00649351;1pkt 1fpkt"];
1507--4851[label="0.00930233;2pkt 2fpkt"];
1507--5048[label="1;296pkt 296fpkt"];
1507--5073[label="0.00309598;1pkt 1fpkt"];
1507--5220[label="0.00649351;1pkt 1fpkt"];
1507--5315[label="1;8pkt 8fpkt"];
1507--5408[label="0.00628931;1pkt 1fpkt"];
1507--5420[label="0.00806452;1pkt 1fpkt"];
1507--5439[label="0.00746269;1pkt 1fpkt"];
1507--5564[label="0.00684932;1pkt 1fpkt"];
1507--6145[label="0.00813008;1pkt 1fpkt"];
1507--6229[label="0.00684932;1pkt 1fpkt"];
1507--6242[label="0.00928793;3pkt 3fpkt"];
1507--6297[label="0.00309598;1pkt 1fpkt"];
1507--6304[label="0.0185759;6pkt 6fpkt"];
1507--6320[label="0.0154799;5pkt 5fpkt"];
1507--6340[label="0.00309598;1pkt 1fpkt"];
1507--6347[label="0.0185759;6pkt 6fpkt"];
1507--6362[label="0.0619195;20pkt 20fpkt"];
1507--6377[label="0.00309598;1pkt 1fpkt"];
1507--6384[label="0.0185759;6pkt 6fpkt"];
1507--6399[label="0.0619195;20pkt 20fpkt"];
1507--7701[label="1;323pkt 323fpkt"];
2766--5048[label="0.625;5pkt 5fpkt"];
2766--7701[label="0.625;5pkt 5fpkt"];
3052--5048[label="1;8pkt 8fpkt"];
3052--5315[label="1;8pkt 8fpkt"];
3052--7701[label="1;8pkt 8fpkt"];
3197--5048[label="1;2pkt 2fpkt"];
3197--7701[label="1;2pkt 2fpkt"];
5048--5073[label="0.00337838;1pkt 1fpkt"];
5048--5220[label="0.00649351;1pkt 1fpkt"];
5048--5315[label="1;8pkt 8fpkt"];
5048--5408[label="0.00628931;1pkt 1fpkt"];
5048--5420[label="0.00806452;1pkt 1fpkt"];
5048--5439[label="0.00746269;1pkt 1fpkt"];
5048--5564[label="0.00684932;1pkt 1fpkt"];
5048--6145[label="0.00813008;1pkt 1fpkt"];
5048--6229[label="0.00684932;1pkt 1fpkt"];
5048--6242[label="0.0101351;3pkt 3fpkt"];
5048--6297[label="0.00337838;1pkt 1fpkt"];
5048--6304[label="0.0202703;6pkt 6fpkt"];
5048--6320[label="0.0168919;5pkt 5fpkt"];
5048--6340[label="0.00337838;1pkt 1fpkt"];
5048--6347[label="0.0202703;6pkt 6fpkt"];
5048--6362[label="0.0675676;20pkt 20fpkt"];
5048--6377[label="0.00337838;1pkt 1fpkt"];
5048--6384[label="0.0202703;6pkt 6fpkt"];
5048--6399[label="0.0675676;20pkt 20fpkt"];
5048--7701[label="1;296pkt 296fpkt"];
5315--7701[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="153.253.158.141"/>
      <filter dst_port="53" src_ip="153.253.158.141" src_port="32769"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="156.161.31.130"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="42.216.31.130"/>
    </slice>
    <from sec="1204520721" usec="0"/>
    <to sec="1204520741" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="223.137.77.130"/>
    </slice>
    <from sec="1204520883" usec="0"/>
    <to sec="1204520904" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="0.198.196.130"/>
    </slice>
    <from sec="1204520990" usec="0"/>
    <to sec="1204521213" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.253.91.131"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="36.74.91.134"/>
    </slice>
    <from sec="1204520431" usec="0"/>
    <to sec="1204521278" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="199.109.226.135"/>
    </slice>
    <from sec="1204520745" usec="0"/>
    <to sec="1204520752" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.144.34.136"/>
    </slice>
    <from sec="1204520648" usec="0"/>
    <to sec="1204520744" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="1.13.136.136"/>
    </slice>
    <from sec="1204520768" usec="0"/>
    <to sec="1204520786" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.144.34.137"/>
    </slice>
    <from sec="1204520852" usec="0"/>
    <to sec="1204520883" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="222.84.91.138"/>
    </slice>
    <from sec="1204520414" usec="0"/>
    <to sec="1204521272" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="38.231.124.138"/>
    </slice>
    <from sec="1204521234" usec="0"/>
    <to sec="1204521251" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="46.0.122.139"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.253.88.141"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.253.237.141"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="164.232.168.142"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="84.69.18.144"/>
    </slice>
    <from sec="1204520572" usec="0"/>
    <to sec="1204520898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.34.98.145"/>
    </slice>
    <from sec="1204520791" usec="0"/>
    <to sec="1204520815" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.34.105.148"/>
    </slice>
    <from sec="1204520592" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="49.155.138.148"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.253.156.148"/>
    </slice>
    <from sec="1204521130" usec="0"/>
    <to sec="1204521203" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="85.69.221.148"/>
    </slice>
    <from sec="1204521180" usec="0"/>
    <to sec="1204521188" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.214.59.149"/>
    </slice>
    <from sec="1204520402" usec="0"/>
    <to sec="1204521296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="34.111.1.151"/>
    </slice>
    <from sec="1204521200" usec="0"/>
    <to sec="1204521248" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.74811,1.71088,504,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_495{
style=filled;
color=gray75;
3475[label="36.56.4.130;d;24pkt 24fpkt", shape=diamond, color=yellow];
3476[label="152.65.147.151;s;28pkt 28fpkt", shape=diamond, color=yellow];
7789[label="152.65.147.151;30pkt 30fpkt", shape=pentagon, color=darkviolet];
9092[label="152.65.147.151;30pkt 30fpkt", shape=invtriangle, color=brown];
stat495[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.65.147.151:443, 36.56.4.130:*}[70.9677%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (37.5%)&lt;BR/&gt; 54949: (6.69643%)&lt;BR/&gt; 53: (6.69643%)&lt;BR/&gt; 80: (5.80357%)&lt;BR/&gt; 63040: (1.78571%)&gt;];
}
3475--3476[label="0.958333;23pkt 23fpkt"];
3475--7789[label="0.958333;23pkt 23fpkt"];
3475--9092[label="0.958333;23pkt 23fpkt"];
3476--6362[label="0.0714286;2pkt 2fpkt"];
3476--6399[label="0.0714286;2pkt 2fpkt"];
3476--7789[label="1;28pkt 28fpkt"];
3476--9092[label="1;28pkt 28fpkt"];
7789--9092[label="1;30pkt 30fpkt"];
</description>
    <slice>
      <filter dst_ip="36.56.4.130" src_ip="152.65.147.151" src_port="443"/>
    </slice>
    <from sec="1204520402" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="21.54.80.152"/>
    </slice>
    <from sec="1204520961" usec="0"/>
    <to sec="1204520974" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="46.50.182.152"/>
    </slice>
    <from sec="1204520640" usec="0"/>
    <to sec="1204520742" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.41.26.154"/>
    </slice>
    <from sec="1204520409" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.180.185.154"/>
    </slice>
    <from sec="1204520406" usec="0"/>
    <to sec="1204521298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="164.232.235.154"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.182.44.156"/>
    </slice>
    <from sec="1204520957" usec="0"/>
    <to sec="1204521000" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="36.42.212.156"/>
    </slice>
    <from sec="1204520452" usec="0"/>
    <to sec="1204521255" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="132.112.156.157"/>
    </slice>
    <from sec="1204520944" usec="0"/>
    <to sec="1204520980" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="2.250.32.158"/>
    </slice>
    <from sec="1204520680" usec="0"/>
    <to sec="1204521245" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="84.125.136.158"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="222.2.38.160"/>
    </slice>
    <from sec="1204521036" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.253.42.161"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="36.56.20.163"/>
    </slice>
    <from sec="1204521002" usec="0"/>
    <to sec="1204521017" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="193.131.71.163"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.253.11.165"/>
    </slice>
    <from sec="1204520417" usec="0"/>
    <to sec="1204521270" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.181.66.166"/>
    </slice>
    <from sec="1204520712" usec="0"/>
    <to sec="1204520786" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="176.152.3.168"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="42.136.33.168"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="217.73.246.168"/>
    </slice>
    <from sec="1204521284" usec="0"/>
    <to sec="1204521296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.180.10.170"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="222.245.46.170"/>
    </slice>
    <from sec="1204520403" usec="0"/>
    <to sec="1204521284" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="164.232.218.170"/>
    </slice>
    <from sec="1204520402" usec="0"/>
    <to sec="1204521296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="14.137.4.171"/>
    </slice>
    <from sec="1204520682" usec="0"/>
    <to sec="1204520779" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="36.56.24.171"/>
    </slice>
    <from sec="1204520681" usec="0"/>
    <to sec="1204521157" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="5.144.142.171"/>
    </slice>
    <from sec="1204521236" usec="0"/>
    <to sec="1204521258" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.253.149.171"/>
    </slice>
    <from sec="1204520424" usec="0"/>
    <to sec="1204521127" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="2.249.48.172"/>
    </slice>
    <from sec="1204520634" usec="0"/>
    <to sec="1204521274" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.181.131.172"/>
    </slice>
    <from sec="1204521046" usec="0"/>
    <to sec="1204521104" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="2.248.105.173"/>
    </slice>
    <from sec="1204521185" usec="0"/>
    <to sec="1204521199" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.253.131.173"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.1.32.174"/>
    </slice>
    <from sec="1204520944" usec="0"/>
    <to sec="1204521268" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.135.134.176"/>
    </slice>
    <from sec="1204520566" usec="0"/>
    <to sec="1204520597" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="162.3.171.176"/>
    </slice>
    <from sec="1204520405" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.119.250.177"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.129.76.178"/>
    </slice>
    <from sec="1204520729" usec="0"/>
    <to sec="1204520805" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="39.160.99.181"/>
    </slice>
    <from sec="1204520747" usec="0"/>
    <to sec="1204520856" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="84.40.103.181"/>
    </slice>
    <from sec="1204520407" usec="0"/>
    <to sec="1204521298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="164.232.169.181"/>
    </slice>
    <from sec="1204521230" usec="0"/>
    <to sec="1204521281" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="5.202.81.182"/>
    </slice>
    <from sec="1204520974" usec="0"/>
    <to sec="1204520978" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.112.105.182"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.209.235.182"/>
    </slice>
    <from sec="1204520538" usec="0"/>
    <to sec="1204520565" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="161.137.65.183"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="38.231.125.183"/>
    </slice>
    <from sec="1204520894" usec="0"/>
    <to sec="1204520950" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="42.158.165.184"/>
    </slice>
    <from sec="1204520648" usec="0"/>
    <to sec="1204521001" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="82.141.108.185"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.181.22.186"/>
    </slice>
    <from sec="1204521164" usec="0"/>
    <to sec="1204521188" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="51.36.17.187"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="98.203.69.188"/>
    </slice>
    <from sec="1204520730" usec="0"/>
    <to sec="1204520754" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.186.164.190"/>
    </slice>
    <from sec="1204520408" usec="0"/>
    <to sec="1204521299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="35.37.43.191"/>
    </slice>
    <from sec="1204520407" usec="0"/>
    <to sec="1204521296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="213.142.145.191"/>
    </slice>
    <from sec="1204520410" usec="0"/>
    <to sec="1204521262" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="13.105.204.191"/>
    </slice>
    <from sec="1204520688" usec="0"/>
    <to sec="1204520702" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="198.4.172.192"/>
    </slice>
    <from sec="1204520823" usec="0"/>
    <to sec="1204520849" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.180.137.195"/>
    </slice>
    <from sec="1204520892" usec="0"/>
    <to sec="1204520939" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.12.131.196"/>
    </slice>
    <from sec="1204520804" usec="0"/>
    <to sec="1204521244" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.253.117.197"/>
    </slice>
    <from sec="1204520474" usec="0"/>
    <to sec="1204520491" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.5.13.198"/>
    </slice>
    <from sec="1204520404" usec="0"/>
    <to sec="1204520536" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="2.0.110.198"/>
    </slice>
    <from sec="1204520677" usec="0"/>
    <to sec="1204521078" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="85.91.168.198"/>
    </slice>
    <from sec="1204521064" usec="0"/>
    <to sec="1204521090" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="61.209.115.201"/>
    </slice>
    <from sec="1204520402" usec="0"/>
    <to sec="1204521297" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.139.96.202"/>
    </slice>
    <from sec="1204520448" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.128.193.202"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="33.185.225.202"/>
    </slice>
    <from sec="1204521249" usec="0"/>
    <to sec="1204521264" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="83.176.1.204"/>
    </slice>
    <from sec="1204520825" usec="0"/>
    <to sec="1204520889" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="196.43.39.204"/>
    </slice>
    <from sec="1204520404" usec="0"/>
    <to sec="1204521299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="223.144.59.207"/>
    </slice>
    <from sec="1204521235" usec="0"/>
    <to sec="1204521239" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="217.75.67.207"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.52.112.207"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="199.99.1.210"/>
    </slice>
    <from sec="1204520528" usec="0"/>
    <to sec="1204520828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="12.48.38.211"/>
    </slice>
    <from sec="1204520781" usec="0"/>
    <to sec="1204520831" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.253.88.211"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="5.41.165.211"/>
    </slice>
    <from sec="1204520401" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.128.69.212"/>
    </slice>
    <from sec="1204521174" usec="0"/>
    <to sec="1204521179" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="21.55.111.212"/>
    </slice>
    <from sec="1204520430" usec="0"/>
    <to sec="1204520438" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.110.189.214"/>
    </slice>
    <from sec="1204521245" usec="0"/>
    <to sec="1204521248" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.5.65.216"/>
    </slice>
    <from sec="1204520728" usec="0"/>
    <to sec="1204520752" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="85.144.233.216"/>
    </slice>
    <from sec="1204520403" usec="0"/>
    <to sec="1204521299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.79.226.218"/>
    </slice>
    <from sec="1204520961" usec="0"/>
    <to sec="1204520980" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="83.233.77.219"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="83.130.145.221"/>
    </slice>
    <from sec="1204520532" usec="0"/>
    <to sec="1204520826" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="156.120.184.223"/>
    </slice>
    <from sec="1204520570" usec="0"/>
    <to sec="1204520582" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="36.56.2.224"/>
    </slice>
    <from sec="1204520437" usec="0"/>
    <to sec="1204521287" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.253.82.224"/>
    </slice>
    <from sec="1204520460" usec="0"/>
    <to sec="1204521221" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="222.16.107.229"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.140.16.230"/>
    </slice>
    <from sec="1204520404" usec="0"/>
    <to sec="1204520441" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="82.213.226.230"/>
    </slice>
    <from sec="1204520436" usec="0"/>
    <to sec="1204520447" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="15.95.30.231"/>
    </slice>
    <from sec="1204520634" usec="0"/>
    <to sec="1204521288" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.253.145.231"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.253.12.235"/>
    </slice>
    <from sec="1204521225" usec="0"/>
    <to sec="1204521266" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="57.237.190.235"/>
    </slice>
    <from sec="1204520408" usec="0"/>
    <to sec="1204520436" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="178.160.20.237"/>
    </slice>
    <from sec="1204520969" usec="0"/>
    <to sec="1204521008" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="43.89.132.237"/>
    </slice>
    <from sec="1204520661" usec="0"/>
    <to sec="1204520842" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.22.4.239"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="198.24.66.239"/>
    </slice>
    <from sec="1204520905" usec="0"/>
    <to sec="1204520981" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_600{
style=filled;
color=gray75;
8528[label="204.70.176.241;27pkt 27fpkt", shape=pentagon, color=darkviolet];
stat600[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.70.176.241:80, 156.161.227.135:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1540: (1.85185%)&lt;BR/&gt; 1535: (1.85185%)&lt;BR/&gt; 1531: (1.85185%)&lt;BR/&gt; 1529: (1.85185%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="156.161.227.135" src_ip="204.70.176.241" src_port="80"/>
    </slice>
    <from sec="1204520410" usec="0"/>
    <to sec="1204520672" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="153.253.101.242"/>
    </slice>
    <from sec="1204520401" usec="0"/>
    <to sec="1204521287" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="38.218.159.245"/>
    </slice>
    <from sec="1204520403" usec="0"/>
    <to sec="1204521297" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="83.89.238.245"/>
    </slice>
    <from sec="1204520405" usec="0"/>
    <to sec="1204521298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.128.210.247"/>
    </slice>
    <from sec="1204520722" usec="0"/>
    <to sec="1204520747" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.588747,1.73007,010,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_605{
style=filled;
color=gray75;
3775[label="218.225.21.248;s;130pkt 130fpkt", shape=diamond, color=yellow];
8558[label="218.225.21.248;139pkt 139fpkt", shape=pentagon, color=darkviolet];
stat605[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.225.21.248:3389, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3389: (50%)&lt;BR/&gt; 42072: (0.743494%)&lt;BR/&gt; 65112: (0.371747%)&lt;BR/&gt; 64218: (0.371747%)&lt;BR/&gt; 63583: (0.371747%)&gt;];
}
3775--8558[label="1;130pkt 130fpkt"];
</description>
    <slice>
      <filter src_ip="218.225.21.248" src_port="3389"/>
    </slice>
    <from sec="1204520405" usec="0"/>
    <to sec="1204521298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.33.208.248"/>
    </slice>
    <from sec="1204520458" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_607{
style=filled;
color=gray75;
8566[label="197.33.220.248;78pkt 78fpkt", shape=pentagon, color=darkviolet];
stat607[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.33.220.248:3731, *:*}[92.3077%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3731: (46.1538%)&lt;BR/&gt; 61975: (0.641026%)&lt;BR/&gt; 60779: (0.641026%)&lt;BR/&gt; 60118: (0.641026%)&lt;BR/&gt; 59856: (0.641026%)&gt;];
}
</description>
    <slice>
      <filter src_ip="197.33.220.248" src_port="3731"/>
    </slice>
    <from sec="1204520410" usec="0"/>
    <to sec="1204521297" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="62.243.145.249"/>
    </slice>
    <from sec="1204520408" usec="0"/>
    <to sec="1204521288" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="217.101.13.250"/>
    </slice>
    <from sec="1204520403" usec="0"/>
    <to sec="1204521296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.183.78.250"/>
    </slice>
    <from sec="1204520779" usec="0"/>
    <to sec="1204520835" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="0.125.118.250"/>
    </slice>
    <from sec="1204520492" usec="0"/>
    <to sec="1204520512" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="1.233.14.251"/>
    </slice>
    <from sec="1204520807" usec="0"/>
    <to sec="1204520820" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="61.145.108.251"/>
    </slice>
    <from sec="1204520575" usec="0"/>
    <to sec="1204521253" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.70.161.251"/>
    </slice>
    <from sec="1204520669" usec="0"/>
    <to sec="1204520853" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="139.3.226.252"/>
    </slice>
    <from sec="1204520407" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.385926,1.78986,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.168.203.254"/>
    </slice>
    <from sec="1204520431" usec="0"/>
    <to sec="1204521280" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="38.231.112.0"/>
    </slice>
    <from sec="1204520431" usec="0"/>
    <to sec="1204520450" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="42.116.136.0"/>
    </slice>
    <from sec="1204520762" usec="0"/>
    <to sec="1204521076" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="5.60.38.1"/>
    </slice>
    <from sec="1204521216" usec="0"/>
    <to sec="1204521229" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,504,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="83.178.165.3"/>
    </slice>
    <from sec="1204520410" usec="0"/>
    <to sec="1204521299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="215.1.32.4"/>
    </slice>
    <from sec="1204520923" usec="0"/>
    <to sec="1204521053" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="216.64.179.4"/>
    </slice>
    <from sec="1204520854" usec="0"/>
    <to sec="1204520864" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="215.1.32.6"/>
    </slice>
    <from sec="1204521269" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="176.174.55.6"/>
    </slice>
    <from sec="1204520973" usec="0"/>
    <to sec="1204521005" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="98.70.74.9"/>
    </slice>
    <from sec="1204520403" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="216.67.231.11"/>
    </slice>
    <from sec="1204521097" usec="0"/>
    <to sec="1204521146" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="35.201.101.12"/>
    </slice>
    <from sec="1204520737" usec="0"/>
    <to sec="1204520742" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="2.198.212.12"/>
    </slice>
    <from sec="1204520961" usec="0"/>
    <to sec="1204520966" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="42.158.216.12"/>
    </slice>
    <from sec="1204520841" usec="0"/>
    <to sec="1204520874" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="222.83.5.14"/>
    </slice>
    <from sec="1204520697" usec="0"/>
    <to sec="1204520714" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="5.162.8.14"/>
    </slice>
    <from sec="1204520981" usec="0"/>
    <to sec="1204520991" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_634{
style=filled;
color=gray75;
6558[label="84.217.233.14;40pkt 40fpkt", shape=pentagon, color=darkviolet];
8662[label="84.217.233.14;41pkt 41fpkt", shape=invtriangle, color=brown];
stat634[shape=component, label=&lt;Rules:&lt;BR/&gt;{84.217.233.14:80, 164.232.188.179:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1239: (1.23457%)&lt;BR/&gt; 1238: (1.23457%)&lt;BR/&gt; 1237: (1.23457%)&lt;BR/&gt; 1236: (1.23457%)&gt;];
}
6558--8662[label="1;40pkt 40fpkt"];
</description>
    <slice>
      <filter dst_ip="164.232.188.179" src_ip="84.217.233.14" src_port="80"/>
    </slice>
    <from sec="1204520741" usec="0"/>
    <to sec="1204520744" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="4.221.213.15"/>
    </slice>
    <from sec="1204520844" usec="0"/>
    <to sec="1204521013" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="82.213.59.17"/>
    </slice>
    <from sec="1204521267" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="60.242.27.18"/>
    </slice>
    <from sec="1204520900" usec="0"/>
    <to sec="1204520913" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_639{
style=filled;
color=gray75;
6631[label="222.95.193.23;485pkt 485fpkt", shape=pentagon, color=darkviolet];
8686[label="222.95.193.23;486pkt 486fpkt", shape=invtriangle, color=brown];
stat639[shape=component, label=&lt;Rules:&lt;BR/&gt;{222.95.193.23:54750, *:1026}[32.3045%]&lt;BR/&gt;{222.95.193.23:54750, *:1027}[30.6584%]&lt;BR/&gt;{222.95.193.23:55713, *:1026}[24.6914%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 54750: (31.5139%)&lt;BR/&gt; 1026: (28.4758%)&lt;BR/&gt; 1027: (21.5242%)&lt;BR/&gt; 55713: (18.4861%)&gt;];
}
6631--8686[label="1;485pkt 485fpkt"];
</description>
    <slice>
      <filter dst_port="1026" src_ip="222.95.193.23" src_port="54750"/>
      <filter dst_port="1027" src_ip="222.95.193.23" src_port="54750"/>
      <filter dst_port="1026" src_ip="222.95.193.23" src_port="55713"/>
    </slice>
    <from sec="1204520806" usec="0"/>
    <to sec="1204520942" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="216.118.18.25"/>
    </slice>
    <from sec="1204520867" usec="0"/>
    <to sec="1204520870" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_641{
style=filled;
color=gray75;
6653[label="197.33.219.25;2pkt 2fpkt", shape=pentagon, color=darkviolet];
8694[label="197.33.219.25;1pkt 1fpkt", shape=invtriangle, color=brown];
stat641[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.33.219.25:0, 84.179.5.22:0}[50%]&lt;BR/&gt;{197.33.219.25:0, 37.47.57.78:0}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
6653--8694[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="37.47.57.78" src_ip="197.33.219.25"/>
      <filter dst_ip="84.179.5.22" src_ip="197.33.219.25"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_642{
style=filled;
color=gray75;
6673[label="83.232.148.27;132pkt 132fpkt", shape=pentagon, color=darkviolet];
8698[label="83.232.148.27;133pkt 133fpkt", shape=invtriangle, color=brown];
stat642[shape=component, label=&lt;Rules:&lt;BR/&gt;{83.232.148.27:*, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 137: (50%)&lt;BR/&gt; 61978: (0.377358%)&lt;BR/&gt; 61955: (0.377358%)&lt;BR/&gt; 61945: (0.377358%)&lt;BR/&gt; 61931: (0.377358%)&gt;];
}
6673--8698[label="1;132pkt 132fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="83.232.148.27"/>
    </slice>
    <from sec="1204520924" usec="0"/>
    <to sec="1204520937" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="4.183.186.27"/>
    </slice>
    <from sec="1204520424" usec="0"/>
    <to sec="1204521019" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="218.197.217.27"/>
    </slice>
    <from sec="1204520805" usec="0"/>
    <to sec="1204520882" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="1.238.78.29"/>
    </slice>
    <from sec="1204520712" usec="0"/>
    <to sec="1204520734" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="84.159.117.30"/>
    </slice>
    <from sec="1204520407" usec="0"/>
    <to sec="1204521297" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="197.165.84.32"/>
    </slice>
    <from sec="1204520916" usec="0"/>
    <to sec="1204520978" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="58.224.39.33"/>
    </slice>
    <from sec="1204520826" usec="0"/>
    <to sec="1204520845" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.937858,1.75689,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_649{
style=filled;
color=gray75;
6732[label="153.253.78.33;1pkt 1fpkt", shape=pentagon, color=darkviolet];
8719[label="153.253.78.33;1pkt 1fpkt", shape=invtriangle, color=brown];
9423[label="153.253.78.33;1pkt 1fpkt", shape=invhouse, color=bisque];
stat649[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.253.78.33:1383, 214.29.4.127:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1383: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
6732--8719[label="1;1pkt 1fpkt"];
6732--9423[label="1;1pkt 1fpkt"];
8719--9423[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="214.29.4.127" dst_port="80" src_ip="153.253.78.33" src_port="1383"/>
    </slice>
    <from sec="1204521265" usec="0"/>
    <to sec="1204521293" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.937858,1.75689,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_650{
style=filled;
color=gray75;
6733[label="156.161.84.33;2pkt 2fpkt", shape=pentagon, color=darkviolet];
8720[label="156.161.84.33;2pkt 2fpkt", shape=invtriangle, color=brown];
9424[label="156.161.84.33;2pkt 2fpkt", shape=invhouse, color=bisque];
stat650[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.161.84.33:51621, 105.63.100.208:80}[50%]&lt;BR/&gt;{156.161.84.33:51616, 105.63.100.210:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 51621: (25%)&lt;BR/&gt; 51616: (25%)&gt;];
}
6733--8720[label="1;2pkt 2fpkt"];
6733--9424[label="1;2pkt 2fpkt"];
8720--9424[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="105.63.100.210" dst_port="80" src_ip="156.161.84.33" src_port="51616"/>
      <filter dst_ip="105.63.100.208" dst_port="80" src_ip="156.161.84.33" src_port="51621"/>
    </slice>
    <from sec="1204521243" usec="0"/>
    <to sec="1204521273" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="38.231.112.33"/>
    </slice>
    <from sec="1204520488" usec="0"/>
    <to sec="1204520540" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="196.236.254.34"/>
    </slice>
    <from sec="1204520765" usec="0"/>
    <to sec="1204520971" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="216.90.39.35"/>
    </slice>
    <from sec="1204520774" usec="0"/>
    <to sec="1204520779" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="45.254.125.35"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="56.214.169.36"/>
    </slice>
    <from sec="1204520775" usec="0"/>
    <to sec="1204520836" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="38.231.124.38"/>
    </slice>
    <from sec="1204520694" usec="0"/>
    <to sec="1204520718" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="197.230.61.39"/>
    </slice>
    <from sec="1204520420" usec="0"/>
    <to sec="1204521286" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,020,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_659{
style=filled;
color=gray75;
6790[label="39.97.150.39;78pkt 78fpkt", shape=pentagon, color=darkviolet];
8743[label="39.97.150.39;77pkt 77fpkt", shape=invtriangle, color=brown];
stat659[shape=component, label=&lt;Rules:&lt;BR/&gt;{39.97.150.39:0, *:0}[92.3077%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (92.2581%)&lt;BR/&gt; 139: (2.58065%)&lt;BR/&gt; 445: (1.29032%)&lt;BR/&gt; 4101: (0.645161%)&lt;BR/&gt; 4078: (0.645161%)&gt;];
}
6790--8743[label="1;77pkt 77fpkt"];
</description>
    <slice>
      <filter src_ip="39.97.150.39"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204520410" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_660{
style=filled;
color=gray75;
6813[label="153.253.89.42;1pkt 1fpkt", shape=pentagon, color=darkviolet];
8747[label="153.253.89.42;1pkt 1fpkt", shape=invtriangle, color=brown];
stat660[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.253.89.42:1367, 195.48.115.2:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1367: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
6813--8747[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="195.48.115.2" dst_port="80" src_ip="153.253.89.42" src_port="1367"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_661{
style=filled;
color=gray75;
6814[label="37.100.105.42;36pkt 36fpkt", shape=pentagon, color=darkviolet];
8748[label="37.100.105.42;35pkt 35fpkt", shape=invtriangle, color=brown];
stat661[shape=component, label=&lt;Rules:&lt;BR/&gt;{37.100.105.42:*, *:3124}[33.3333%]&lt;BR/&gt;{37.100.105.42:*, *:3127}[33.3333%]&lt;BR/&gt;{37.100.105.42:*, *:3128}[33.3333%]&lt;BR/&gt;{37.100.105.42:*, 164.232.94.118:*}[33.3333%]&lt;BR/&gt;{37.100.105.42:*, 164.232.94.120:*}[33.3333%]&lt;BR/&gt;{37.100.105.42:*, 164.232.94.121:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3128: (16.9014%)&lt;BR/&gt; 3127: (16.9014%)&lt;BR/&gt; 3124: (16.1972%)&lt;BR/&gt; 59653: (1.40845%)&lt;BR/&gt; 59072: (1.40845%)&gt;];
}
6814--8748[label="1;35pkt 35fpkt"];
</description>
    <slice>
      <filter dst_ip="164.232.94.121" src_ip="37.100.105.42"/>
      <filter dst_ip="164.232.94.120" src_ip="37.100.105.42"/>
      <filter dst_ip="164.232.94.118" src_ip="37.100.105.42"/>
      <filter dst_port="3128" src_ip="37.100.105.42"/>
      <filter dst_port="3127" src_ip="37.100.105.42"/>
      <filter dst_port="3124" src_ip="37.100.105.42"/>
    </slice>
    <from sec="1204521271" usec="0"/>
    <to sec="1204521298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="0.101.238.42"/>
    </slice>
    <from sec="1204520412" usec="0"/>
    <to sec="1204520428" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="164.232.200.43"/>
    </slice>
    <from sec="1204521221" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="218.39.77.44"/>
    </slice>
    <from sec="1204520731" usec="0"/>
    <to sec="1204520797" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="38.231.125.44"/>
    </slice>
    <from sec="1204520595" usec="0"/>
    <to sec="1204520611" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="218.172.107.46"/>
    </slice>
    <from sec="1204520910" usec="0"/>
    <to sec="1204520981" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="38.231.112.47"/>
    </slice>
    <from sec="1204520406" usec="0"/>
    <to sec="1204520422" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_668{
style=filled;
color=gray75;
6915[label="217.112.34.52;250pkt 250fpkt", shape=pentagon, color=darkviolet];
8788[label="217.112.34.52;250pkt 250fpkt", shape=invtriangle, color=brown];
stat668[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.112.34.52:38327, *:1026}[29.6%]&lt;BR/&gt;{217.112.34.52:35196, *:1026}[25.6%]&lt;BR/&gt;{217.112.34.52:38327, *:1027}[22.8%]&lt;BR/&gt;{217.112.34.52:35196, *:1027}[22%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1026: (27.6%)&lt;BR/&gt; 38327: (26.2%)&lt;BR/&gt; 35196: (23.8%)&lt;BR/&gt; 1027: (22.4%)&gt;];
}
6915--8788[label="1;250pkt 250fpkt"];
</description>
    <slice>
      <filter dst_port="1026" src_ip="217.112.34.52" src_port="38327"/>
      <filter dst_port="1027" src_ip="217.112.34.52" src_port="38327"/>
      <filter dst_port="1026" src_ip="217.112.34.52" src_port="35196"/>
      <filter dst_port="1027" src_ip="217.112.34.52" src_port="35196"/>
    </slice>
    <from sec="1204520577" usec="0"/>
    <to sec="1204521133" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="4.2.110.55"/>
    </slice>
    <from sec="1204520430" usec="0"/>
    <to sec="1204520436" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="195.242.9.63"/>
    </slice>
    <from sec="1204520427" usec="0"/>
    <to sec="1204520559" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.937858,1.75689,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_671{
style=filled;
color=gray75;
7022[label="131.66.19.65;1pkt 1fpkt", shape=pentagon, color=darkviolet];
8824[label="131.66.19.65;1pkt 1fpkt", shape=invtriangle, color=brown];
9453[label="131.66.19.65;1pkt 1fpkt", shape=invhouse, color=bisque];
stat671[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.66.19.65:80, 36.56.2.80:38553}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 38553: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
7022--8824[label="1;1pkt 1fpkt"];
7022--9453[label="1;1pkt 1fpkt"];
8824--9453[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="36.56.2.80" dst_port="38553" src_ip="131.66.19.65" src_port="80"/>
    </slice>
    <from sec="1204520813" usec="0"/>
    <to sec="1204520820" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_672{
style=filled;
color=gray75;
7023[label="197.144.32.65;3pkt 3fpkt", shape=pentagon, color=darkviolet];
8825[label="197.144.32.65;3pkt 3fpkt", shape=invtriangle, color=brown];
stat672[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.144.32.65:80, 164.232.17.69:3544}[33.3333%]&lt;BR/&gt;{197.144.32.65:80, 164.232.17.69:3866}[33.3333%]&lt;BR/&gt;{197.144.32.65:80, 164.232.17.69:3873}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3873: (16.6667%)&lt;BR/&gt; 3866: (16.6667%)&lt;BR/&gt; 3544: (16.6667%)&gt;];
}
7023--8825[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="164.232.17.69" dst_port="3873" src_ip="197.144.32.65" src_port="80"/>
      <filter dst_ip="164.232.17.69" dst_port="3866" src_ip="197.144.32.65" src_port="80"/>
      <filter dst_ip="164.232.17.69" dst_port="3544" src_ip="197.144.32.65" src_port="80"/>
    </slice>
    <from sec="1204520780" usec="0"/>
    <to sec="1204521240" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="208.178.42.65"/>
    </slice>
    <from sec="1204520748" usec="0"/>
    <to sec="1204520771" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.03791,1.69594,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_674{
style=filled;
color=gray75;
1977[label="197.33.212.102;d;93pkt 93fpkt", shape=diamond, color=yellow];
3505[label="36.56.8.212;s;41pkt 41fpkt", shape=diamond, color=yellow];
6927[label="173.192.132.53;1pkt 1fpkt", shape=pentagon, color=darkviolet];
7048[label="220.240.176.67;1pkt 1fpkt", shape=pentagon, color=darkviolet];
8327[label="36.56.8.212;45pkt 45fpkt", shape=pentagon, color=darkviolet];
8836[label="220.240.176.67;1pkt 1fpkt", shape=invtriangle, color=brown];
9456[label="220.240.176.67;1pkt 1fpkt", shape=invhouse, color=bisque];
stat674[shape=component, label=&lt;Rules:&lt;BR/&gt;{36.56.8.212:*, 197.33.212.102:80}[20.6897%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.7268%)&lt;BR/&gt; 33866: (1.36612%)&lt;BR/&gt; 63510: (1.0929%)&lt;BR/&gt; 58366: (0.819672%)&lt;BR/&gt; 58174: (0.819672%)&gt;];
}
1977--2006[label="0.0107527;1pkt 1fpkt"];
1977--2026[label="0.0107527;1pkt 1fpkt"];
1977--2147[label="0.0107527;1pkt 1fpkt"];
1977--2659[label="0.0107527;1pkt 1fpkt"];
1977--3289[label="0.0107527;1pkt 1fpkt"];
1977--3290[label="0.0107527;1pkt 1fpkt"];
1977--3505[label="0.536585;22pkt 22fpkt"];
1977--4610[label="0.0107527;1pkt 1fpkt"];
1977--4664[label="0.0107527;1pkt 1fpkt"];
1977--4860[label="0.0107527;1pkt 1fpkt"];
1977--5445[label="0.0107527;1pkt 1fpkt"];
1977--5475[label="0.0107527;1pkt 1fpkt"];
1977--5888[label="0.0107527;1pkt 1fpkt"];
1977--6065[label="0.0107527;1pkt 1fpkt"];
1977--6316[label="0.0107527;1pkt 1fpkt"];
1977--6359[label="0.0107527;1pkt 1fpkt"];
1977--6396[label="0.0107527;1pkt 1fpkt"];
1977--6635[label="0.0107527;1pkt 1fpkt"];
1977--6927[label="1;1pkt 1fpkt"];
1977--7048[label="1;1pkt 1fpkt"];
1977--7073[label="0.0107527;1pkt 1fpkt"];
1977--7092[label="0.0107527;1pkt 1fpkt"];
1977--7123[label="0.0107527;1pkt 1fpkt"];
1977--7608[label="0.166667;1pkt 1fpkt"];
1977--7880[label="0.0107527;1pkt 1fpkt"];
1977--8039[label="0.133333;6pkt 6fpkt"];
1977--8327[label="0.488889;22pkt 22fpkt"];
1977--8836[label="1;1pkt 1fpkt"];
1977--8844[label="0.0107527;1pkt 1fpkt"];
1977--8860[label="0.0107527;1pkt 1fpkt"];
1977--9031[label="0.166667;1pkt 1fpkt"];
1977--9126[label="0.0107527;1pkt 1fpkt"];
1977--9183[label="0.133333;6pkt 6fpkt"];
1977--9456[label="1;1pkt 1fpkt"];
1977--9468[label="0.0107527;1pkt 1fpkt"];
1977--9533[label="0.166667;1pkt 1fpkt"];
1977--9570[label="0.0107527;1pkt 1fpkt"];
3505--8327[label="1;41pkt 41fpkt"];
7048--8836[label="1;1pkt 1fpkt"];
7048--9456[label="1;1pkt 1fpkt"];
8836--9456[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="197.33.212.102" dst_port="80" src_ip="36.56.8.212"/>
    </slice>
    <from sec="1204520409" usec="0"/>
    <to sec="1204521281" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_675{
style=filled;
color=gray75;
7051[label="214.29.1.68;10pkt 10fpkt", shape=pentagon, color=darkviolet];
8837[label="214.29.1.68;10pkt 10fpkt", shape=invtriangle, color=brown];
stat675[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.29.1.68:80, 197.33.214.37:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 58931: (5%)&lt;BR/&gt; 58930: (5%)&lt;BR/&gt; 58924: (5%)&lt;BR/&gt; 58923: (5%)&gt;];
}
7051--8837[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter dst_ip="197.33.214.37" src_ip="214.29.1.68" src_port="80"/>
    </slice>
    <from sec="1204520783" usec="0"/>
    <to sec="1204521209" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="38.231.127.68"/>
    </slice>
    <from sec="1204520655" usec="0"/>
    <to sec="1204520799" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="222.0.182.68"/>
    </slice>
    <from sec="1204521132" usec="0"/>
    <to sec="1204521135" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="40.136.87.69"/>
    </slice>
    <from sec="1204520783" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="4.180.67.71"/>
    </slice>
    <from sec="1204520830" usec="0"/>
    <to sec="1204521090" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="38.231.126.71"/>
    </slice>
    <from sec="1204520782" usec="0"/>
    <to sec="1204520788" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,504,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="216.3.10.72"/>
    </slice>
    <from sec="1204520439" usec="0"/>
    <to sec="1204521298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="218.25.178.73"/>
    </slice>
    <from sec="1204520703" usec="0"/>
    <to sec="1204520808" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_683{
style=filled;
color=gray75;
7105[label="139.32.182.73;1pkt 1fpkt", shape=pentagon, color=darkviolet];
8854[label="139.32.182.73;1pkt 1fpkt", shape=invtriangle, color=brown];
stat683[shape=component, label=&lt;Rules:&lt;BR/&gt;{139.32.182.73:13983, 197.33.211.34:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 13983: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
7105--8854[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="197.33.211.34" dst_port="80" src_ip="139.32.182.73" src_port="13983"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="215.1.32.77"/>
    </slice>
    <from sec="1204520635" usec="0"/>
    <to sec="1204520783" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_685{
style=filled;
color=gray75;
7143[label="156.120.145.77;6pkt 6fpkt", shape=pentagon, color=darkviolet];
8867[label="156.120.145.77;6pkt 6fpkt", shape=invtriangle, color=brown];
stat685[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.120.145.77:*, 212.3.18.20:80}[83.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 50848: (8.33333%)&lt;BR/&gt; 50158: (8.33333%)&lt;BR/&gt; 50034: (8.33333%)&lt;BR/&gt; 50033: (8.33333%)&gt;];
}
7143--8867[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="212.3.18.20" dst_port="80" src_ip="156.120.145.77"/>
    </slice>
    <from sec="1204520797" usec="0"/>
    <to sec="1204520847" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="213.157.17.78"/>
    </slice>
    <from sec="1204521216" usec="0"/>
    <to sec="1204521218" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="215.1.32.78"/>
    </slice>
    <from sec="1204521128" usec="0"/>
    <to sec="1204521162" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.937858,1.75689,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_688{
style=filled;
color=gray75;
7185[label="4.44.201.81;2pkt 2fpkt", shape=pentagon, color=darkviolet];
8882[label="4.44.201.81;2pkt 2fpkt", shape=invtriangle, color=brown];
9478[label="4.44.201.81;2pkt 2fpkt", shape=invhouse, color=bisque];
stat688[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.44.201.81:113, 156.103.3.152:45840}[50%]&lt;BR/&gt;{4.44.201.81:1299, 156.103.3.152:25}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 45840: (25%)&lt;BR/&gt; 1299: (25%)&lt;BR/&gt; 113: (25%)&lt;BR/&gt; 25: (25%)&gt;];
}
7185--8882[label="1;2pkt 2fpkt"];
7185--9478[label="1;2pkt 2fpkt"];
8882--9478[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="156.103.3.152" dst_port="25" src_ip="4.44.201.81" src_port="1299"/>
      <filter dst_ip="156.103.3.152" dst_port="45840" src_ip="4.44.201.81" src_port="113"/>
    </slice>
    <from sec="1204521247" usec="0"/>
    <to sec="1204521290" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="33.45.111.82"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_690{
style=filled;
color=gray75;
7221[label="208.240.34.84;16pkt 16fpkt", shape=pentagon, color=darkviolet];
8891[label="208.240.34.84;16pkt 16fpkt", shape=invtriangle, color=brown];
stat690[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.240.34.84:*, 153.253.80.212:25}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 13968: (3.125%)&lt;BR/&gt; 13942: (3.125%)&lt;BR/&gt; 13898: (3.125%)&lt;BR/&gt; 13890: (3.125%)&gt;];
}
7221--8891[label="1;16pkt 16fpkt"];
</description>
    <slice>
      <filter dst_ip="153.253.80.212" dst_port="25" src_ip="208.240.34.84"/>
    </slice>
    <from sec="1204520521" usec="0"/>
    <to sec="1204520615" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="59.190.134.84"/>
    </slice>
    <from sec="1204521073" usec="0"/>
    <to sec="1204521080" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.74811,1.71088,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_692{
style=filled;
color=gray75;
1973[label="153.253.28.226;d;59pkt 59fpkt", shape=diamond, color=yellow];
2123[label="197.66.221.145;s;4pkt 4fpkt", shape=diamond, color=yellow];
7413[label="85.225.136.105;22pkt 22fpkt", shape=pentagon, color=darkviolet];
7739[label="197.66.221.145;4pkt 4fpkt", shape=pentagon, color=darkviolet];
8963[label="85.225.136.105;22pkt 22fpkt", shape=invtriangle, color=brown];
9077[label="197.66.221.145;4pkt 4fpkt", shape=invtriangle, color=brown];
stat692[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 153.253.28.226:*}[47.4576%]&lt;BR/&gt;{85.225.136.105:443, 153.253.28.226:*}[37.2881%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (30.4348%)&lt;BR/&gt; 80: (17.3913%)&lt;BR/&gt; 6112: (1.73913%)&lt;BR/&gt; 6096: (1.73913%)&lt;BR/&gt; 6024: (1.73913%)&gt;];
}
1973--2123[label="1;4pkt 4fpkt"];
1973--3158[label="0.0333333;1pkt 1fpkt"];
1973--3486[label="0.0169492;1pkt 1fpkt"];
1973--4120[label="0.0169492;1pkt 1fpkt"];
1973--4322[label="0.0169492;1pkt 1fpkt"];
1973--5352[label="0.0333333;1pkt 1fpkt"];
1973--5826[label="0.0169492;1pkt 1fpkt"];
1973--6318[label="0.152542;9pkt 9fpkt"];
1973--6361[label="0.152542;9pkt 9fpkt"];
1973--6398[label="0.152542;9pkt 9fpkt"];
1973--7398[label="0.0169492;1pkt 1fpkt"];
1973--7413[label="1;22pkt 22fpkt"];
1973--7423[label="0.0222222;1pkt 1fpkt"];
1973--7739[label="1;4pkt 4fpkt"];
1973--8538[label="0.0909091;3pkt 3fpkt"];
1973--8953[label="0.0169492;1pkt 1fpkt"];
1973--8963[label="1;22pkt 22fpkt"];
1973--8967[label="0.0222222;1pkt 1fpkt"];
1973--9077[label="1;4pkt 4fpkt"];
1973--9360[label="0.0909091;3pkt 3fpkt"];
1973--9504[label="0.0169492;1pkt 1fpkt"];
1973--9506[label="0.0227273;1pkt 1fpkt"];
2123--7739[label="1;4pkt 4fpkt"];
2123--9077[label="1;4pkt 4fpkt"];
7413--8963[label="1;22pkt 22fpkt"];
7739--9077[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="153.253.28.226" src_port="80"/>
      <filter dst_ip="153.253.28.226" src_ip="85.225.136.105" src_port="443"/>
    </slice>
    <from sec="1204520405" usec="0"/>
    <to sec="1204521194" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_693{
style=filled;
color=gray75;
7237[label="216.4.52.86;1pkt 1fpkt", shape=pentagon, color=darkviolet];
8898[label="216.4.52.86;1pkt 1fpkt", shape=invtriangle, color=brown];
stat693[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.4.52.86:60524, 197.33.208.206:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 60524: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
7237--8898[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="197.33.208.206" dst_port="80" src_ip="216.4.52.86" src_port="60524"/>
    </slice>
    <from sec="1204521262" usec="0"/>
    <to sec="1204521297" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="32.10.95.87"/>
    </slice>
    <from sec="1204520403" usec="0"/>
    <to sec="1204520716" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.937858,1.75689,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_695{
style=filled;
color=gray75;
7281[label="212.214.76.92;3pkt 3fpkt", shape=pentagon, color=darkviolet];
8910[label="212.214.76.92;3pkt 3fpkt", shape=invtriangle, color=brown];
9488[label="212.214.76.92;2pkt 2fpkt", shape=invhouse, color=bisque];
stat695[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.214.76.92:80, 153.253.116.170:2382}[33.3333%]&lt;BR/&gt;{212.214.76.92:80, 164.232.192.175:1822}[33.3333%]&lt;BR/&gt;{212.214.76.92:80, 164.232.192.175:1832}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1832: (18.75%)&lt;BR/&gt; 1822: (18.75%)&lt;BR/&gt; 2382: (12.5%)&gt;];
}
7281--8910[label="1;3pkt 3fpkt"];
7281--9488[label="1;2pkt 2fpkt"];
8910--9488[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="164.232.192.175" dst_port="1832" src_ip="212.214.76.92" src_port="80"/>
      <filter dst_ip="164.232.192.175" dst_port="1822" src_ip="212.214.76.92" src_port="80"/>
      <filter dst_ip="153.253.116.170" dst_port="2382" src_ip="212.214.76.92" src_port="80"/>
    </slice>
    <from sec="1204520499" usec="0"/>
    <to sec="1204520963" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="38.231.124.94"/>
    </slice>
    <from sec="1204520504" usec="0"/>
    <to sec="1204520543" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="32.80.155.99"/>
    </slice>
    <from sec="1204520769" usec="0"/>
    <to sec="1204520783" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,501,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_698{
style=filled;
color=gray75;
7374[label="218.234.242.100;5pkt 5fpkt", shape=pentagon, color=darkviolet];
8944[label="218.234.242.100;5pkt 5fpkt", shape=invtriangle, color=brown];
stat698[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.234.242.100:2879, 197.33.220.72:21}[20%]&lt;BR/&gt;{218.234.242.100:2905, 197.33.220.72:19641}[20%]&lt;BR/&gt;{218.234.242.100:2906, 197.33.220.72:36011}[20%]&lt;BR/&gt;{218.234.242.100:3124, 197.33.220.72:21}[20%]&lt;BR/&gt;{218.234.242.100:3186, 197.33.220.72:21}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (30%)&lt;BR/&gt; 36011: (10%)&lt;BR/&gt; 19641: (10%)&lt;BR/&gt; 3186: (10%)&lt;BR/&gt; 3124: (10%)&gt;];
}
7374--8944[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="197.33.220.72" dst_port="21" src_ip="218.234.242.100" src_port="3186"/>
      <filter dst_ip="197.33.220.72" dst_port="21" src_ip="218.234.242.100" src_port="3124"/>
      <filter dst_ip="197.33.220.72" dst_port="36011" src_ip="218.234.242.100" src_port="2906"/>
      <filter dst_ip="197.33.220.72" dst_port="19641" src_ip="218.234.242.100" src_port="2905"/>
      <filter dst_ip="197.33.220.72" dst_port="21" src_ip="218.234.242.100" src_port="2879"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,504,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="4.121.6.101"/>
    </slice>
    <from sec="1204520406" usec="0"/>
    <to sec="1204521295" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="38.231.121.101"/>
    </slice>
    <from sec="1204520883" usec="0"/>
    <to sec="1204521066" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="196.25.145.101"/>
    </slice>
    <from sec="1204520700" usec="0"/>
    <to sec="1204520709" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="1.67.113.104"/>
    </slice>
    <from sec="1204520420" usec="0"/>
    <to sec="1204520464" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,504,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="216.90.247.106"/>
    </slice>
    <from sec="1204520407" usec="0"/>
    <to sec="1204521296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.937858,1.75689,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_704{
style=filled;
color=gray75;
7427[label="208.220.172.107;25pkt 25fpkt", shape=pentagon, color=darkviolet];
8968[label="208.220.172.107;25pkt 25fpkt", shape=invtriangle, color=brown];
9507[label="208.220.172.107;25pkt 25fpkt", shape=invhouse, color=bisque];
stat704[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.220.172.107:80, 153.253.88.41:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2931: (2%)&lt;BR/&gt; 2930: (2%)&lt;BR/&gt; 2929: (2%)&lt;BR/&gt; 2928: (2%)&gt;];
}
7427--8968[label="1;25pkt 25fpkt"];
7427--9507[label="1;25pkt 25fpkt"];
8968--9507[label="1;25pkt 25fpkt"];
</description>
    <slice>
      <filter dst_ip="153.253.88.41" src_ip="208.220.172.107" src_port="80"/>
    </slice>
    <from sec="1204520556" usec="0"/>
    <to sec="1204520868" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="153.253.140.108"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.910784,1.65195,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_706{
style=filled;
color=gray75;
1930[label="156.120.49.169;s;51pkt 51fpkt", shape=diamond, color=yellow];
2078[label="167.168.18.145;d;10pkt 10fpkt", shape=diamond, color=yellow];
2674[label="156.120.218.63;s;21pkt 21fpkt", shape=diamond, color=yellow];
3743[label="36.56.2.91;d;33pkt 33fpkt", shape=diamond, color=yellow];
4573[label="156.120.49.169;s;23pkt 23fpkt", shape=hexagon, color=black];
7460[label="156.120.197.110;1pkt 1fpkt", shape=pentagon, color=darkviolet];
7963[label="156.120.49.169;56pkt 56fpkt", shape=pentagon, color=darkviolet];
8980[label="156.120.197.110;1pkt 1fpkt", shape=invtriangle, color=brown];
stat706[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.120.49.169:80, 36.56.2.91:*}[44.3038%]&lt;BR/&gt;{156.120.218.63:80, *:*}[26.5823%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 51522: (1.02041%)&lt;BR/&gt; 49688: (1.02041%)&lt;BR/&gt; 46970: (1.02041%)&lt;BR/&gt; 44865: (1.02041%)&gt;];
}
1930--2078[label="0.3;3pkt 3fpkt"];
1930--3743[label="0.939394;31pkt 31fpkt"];
1930--4573[label="1;23pkt 23fpkt"];
1930--6318[label="0.0784314;4pkt 4fpkt"];
1930--6321[label="0.0784314;4pkt 4fpkt"];
1930--6361[label="0.0784314;4pkt 4fpkt"];
1930--6398[label="0.0784314;4pkt 4fpkt"];
1930--7963[label="1;51pkt 51fpkt"];
2078--2674[label="0.7;7pkt 7fpkt"];
2078--4573[label="0.3;3pkt 3fpkt"];
2078--7963[label="0.3;3pkt 3fpkt"];
2674--6321[label="0.047619;1pkt 1fpkt"];
3743--4573[label="0.478261;11pkt 11fpkt"];
3743--6318[label="0.121212;4pkt 4fpkt"];
3743--6321[label="0.0606061;2pkt 2fpkt"];
3743--6361[label="0.121212;4pkt 4fpkt"];
3743--6398[label="0.121212;4pkt 4fpkt"];
3743--7460[label="1;1pkt 1fpkt"];
3743--7963[label="0.939394;31pkt 31fpkt"];
3743--8980[label="1;1pkt 1fpkt"];
4573--6318[label="0.0869565;2pkt 2fpkt"];
4573--6361[label="0.0869565;2pkt 2fpkt"];
4573--6398[label="0.0869565;2pkt 2fpkt"];
4573--7963[label="1;23pkt 23fpkt"];
7460--8980[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="156.120.218.63" src_port="80"/>
      <filter dst_ip="36.56.2.91" src_ip="156.120.49.169" src_port="80"/>
    </slice>
    <from sec="1204520401" usec="0"/>
    <to sec="1204521299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.937858,1.75689,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_707{
style=filled;
color=gray75;
7470[label="131.66.19.112;65pkt 65fpkt", shape=pentagon, color=darkviolet];
8984[label="131.66.19.112;65pkt 65fpkt", shape=invtriangle, color=brown];
9514[label="131.66.19.112;65pkt 65fpkt", shape=invhouse, color=bisque];
stat707[shape=component, label=&lt;Rules:&lt;BR/&gt;{131.66.19.112:61726, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 61726: (50%)&lt;BR/&gt; 65104: (0.769231%)&lt;BR/&gt; 65081: (0.769231%)&lt;BR/&gt; 64630: (0.769231%)&lt;BR/&gt; 63105: (0.769231%)&gt;];
}
7470--8984[label="1;65pkt 65fpkt"];
7470--9514[label="1;65pkt 65fpkt"];
8984--9514[label="1;65pkt 65fpkt"];
</description>
    <slice>
      <filter src_ip="131.66.19.112" src_port="61726"/>
    </slice>
    <from sec="1204520523" usec="0"/>
    <to sec="1204521287" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="83.176.84.112"/>
    </slice>
    <from sec="1204520572" usec="0"/>
    <to sec="1204520703" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.937858,1.75689,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_709{
style=filled;
color=gray75;
7489[label="218.214.37.114;7pkt 7fpkt", shape=pentagon, color=darkviolet];
8993[label="218.214.37.114;7pkt 7fpkt", shape=invtriangle, color=brown];
9518[label="218.214.37.114;7pkt 7fpkt", shape=invhouse, color=bisque];
stat709[shape=component, label=&lt;Rules:&lt;BR/&gt;{218.214.37.114:80, 164.232.169.58:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1754: (7.14286%)&lt;BR/&gt; 1753: (7.14286%)&lt;BR/&gt; 1752: (7.14286%)&lt;BR/&gt; 1751: (7.14286%)&gt;];
}
7489--8993[label="1;7pkt 7fpkt"];
7489--9518[label="1;7pkt 7fpkt"];
8993--9518[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="164.232.169.58" src_ip="218.214.37.114" src_port="80"/>
    </slice>
    <from sec="1204520896" usec="0"/>
    <to sec="1204520909" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,002,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_710{
style=filled;
color=gray75;
7502[label="85.232.13.117;256pkt 256fpkt", shape=pentagon, color=darkviolet];
8998[label="85.232.13.117;256pkt 256fpkt", shape=invtriangle, color=brown];
stat710[shape=component, label=&lt;Rules:&lt;BR/&gt;{85.232.13.117:1027, *:137}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1027: (50%)&lt;BR/&gt; 137: (50%)&gt;];
}
7502--8998[label="1;256pkt 256fpkt"];
</description>
    <slice>
      <filter dst_port="137" src_ip="85.232.13.117" src_port="1027"/>
    </slice>
    <from sec="1204520577" usec="0"/>
    <to sec="1204520603" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="217.105.99.120"/>
    </slice>
    <from sec="1204520990" usec="0"/>
    <to sec="1204521020" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.937858,1.75689,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_712{
style=filled;
color=gray75;
7519[label="46.89.106.120;1pkt 1fpkt", shape=pentagon, color=darkviolet];
9003[label="46.89.106.120;1pkt 1fpkt", shape=invtriangle, color=brown];
9524[label="46.89.106.120;1pkt 1fpkt", shape=invhouse, color=bisque];
stat712[shape=component, label=&lt;Rules:&lt;BR/&gt;{46.89.106.120:33858, 197.33.218.26:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 33858: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
7519--9003[label="1;1pkt 1fpkt"];
7519--9524[label="1;1pkt 1fpkt"];
9003--9524[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="197.33.218.26" dst_port="80" src_ip="46.89.106.120" src_port="33858"/>
    </slice>
    <from sec="1204520561" usec="0"/>
    <to sec="1204520564" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="1.219.20.126"/>
    </slice>
    <from sec="1204520800" usec="0"/>
    <to sec="1204520810" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,504,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="223.83.95.128"/>
    </slice>
    <from sec="1204520410" usec="0"/>
    <to sec="1204521290" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_715{
style=filled;
color=gray75;
7582[label="83.105.129.129;1pkt 1fpkt", shape=pentagon, color=darkviolet];
9023[label="83.105.129.129;1pkt 1fpkt", shape=invtriangle, color=brown];
stat715[shape=component, label=&lt;Rules:&lt;BR/&gt;{83.105.129.129:52703, 197.33.220.72:28473}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 52703: (50%)&lt;BR/&gt; 28473: (50%)&gt;];
}
7582--9023[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="197.33.220.72" dst_port="28473" src_ip="83.105.129.129" src_port="52703"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="42.216.31.130"/>
    </slice>
    <from sec="1204520721" usec="0"/>
    <to sec="1204520741" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="0.198.196.130"/>
    </slice>
    <from sec="1204520990" usec="0"/>
    <to sec="1204521213" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818578,1.71389,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_719{
style=filled;
color=gray75;
2271[label="153.253.137.107;s;228pkt 228fpkt", shape=diamond, color=yellow];
2585[label="192.23.210.104;d;169pkt 169fpkt", shape=diamond, color=yellow];
4773[label="153.253.137.107;s;81pkt 81fpkt", shape=hexagon, color=black];
5034[label="192.23.210.104;d;94pkt 94fpkt", shape=hexagon, color=black];
stat719[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.253.137.107:*, 192.23.210.104:80}[74.1228%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.5629%)&lt;BR/&gt; 4441: (0.34965%)&lt;BR/&gt; 4440: (0.34965%)&lt;BR/&gt; 4439: (0.34965%)&lt;BR/&gt; 4438: (0.34965%)&gt;];
}
2271--2359[label="0.00606061;1pkt 1fpkt"];
2271--2585[label="1;169pkt 169fpkt"];
2271--3485[label="0.0227273;3pkt 3fpkt"];
2271--3795[label="0.0151515;1pkt 1fpkt"];
2271--4124[label="0.00549451;1pkt 1fpkt"];
2271--4145[label="0.00699301;1pkt 1fpkt"];
2271--4773[label="1;81pkt 81fpkt"];
2271--4804[label="0.00970874;1pkt 1fpkt"];
2271--5034[label="1;94pkt 94fpkt"];
2585--4773[label="0.938272;76pkt 76fpkt"];
2585--5034[label="1;94pkt 94fpkt"];
4773--5034[label="0.938272;76pkt 76fpkt"];
</description>
    <slice>
      <filter dst_ip="192.23.210.104" dst_port="80" src_ip="153.253.137.107"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="1.13.136.136"/>
    </slice>
    <from sec="1204520768" usec="0"/>
    <to sec="1204520786" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="38.231.124.138"/>
    </slice>
    <from sec="1204521234" usec="0"/>
    <to sec="1204521251" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.785164,1.67182,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_724{
style=filled;
color=gray75;
1704[label="197.33.198.108;d;87pkt 87fpkt", shape=diamond, color=yellow];
1717[label="148.208.183.197;s;34pkt 34fpkt", shape=diamond, color=yellow];
4395[label="197.33.198.108;d;3pkt 3fpkt", shape=hexagon, color=black];
4401[label="148.208.183.197;s;34pkt 34fpkt", shape=hexagon, color=black];
8206[label="148.208.183.197;34pkt 34fpkt", shape=pentagon, color=darkviolet];
stat724[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 197.33.198.108:53}[49.4253%]&lt;BR/&gt;{148.208.183.197:80, 197.33.198.108:*}[39.0805%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (35.6771%)&lt;BR/&gt; 53: (14.5833%)&lt;BR/&gt; 57678: (2.86458%)&lt;BR/&gt; 64110: (1.30208%)&lt;BR/&gt; 65221: (1.04167%)&gt;];
}
1704--1717[label="1;34pkt 34fpkt"];
1704--2147[label="0.0114943;1pkt 1fpkt"];
1704--2563[label="0.0114943;1pkt 1fpkt"];
1704--3702[label="0.0555556;1pkt 1fpkt"];
1704--4395[label="1;3pkt 3fpkt"];
1704--4401[label="1;34pkt 34fpkt"];
1704--4664[label="0.0114943;1pkt 1fpkt"];
1704--5016[label="0.0114943;1pkt 1fpkt"];
1704--5752[label="0.0555556;1pkt 1fpkt"];
1704--6065[label="0.0114943;1pkt 1fpkt"];
1704--6316[label="0.0114943;1pkt 1fpkt"];
1704--6318[label="0.0114943;1pkt 1fpkt"];
1704--6359[label="0.0114943;1pkt 1fpkt"];
1704--6361[label="0.0114943;1pkt 1fpkt"];
1704--6396[label="0.0114943;1pkt 1fpkt"];
1704--6398[label="0.0114943;1pkt 1fpkt"];
1704--6432[label="0.0114943;1pkt 1fpkt"];
1704--7659[label="0.1;1pkt 1fpkt"];
1704--7716[label="0.0243902;1pkt 1fpkt"];
1704--7880[label="0.0114943;1pkt 1fpkt"];
1704--8206[label="1;34pkt 34fpkt"];
1704--8375[label="0.0588235;1pkt 1fpkt"];
1704--8399[label="0.0114943;1pkt 1fpkt"];
1704--8620[label="0.0114943;1pkt 1fpkt"];
1704--9048[label="0.1;1pkt 1fpkt"];
1704--9070[label="0.0243902;1pkt 1fpkt"];
1704--9126[label="0.0114943;1pkt 1fpkt"];
1704--9570[label="0.0114943;1pkt 1fpkt"];
1717--4395[label="0.333333;1pkt 1fpkt"];
1717--4401[label="1;34pkt 34fpkt"];
1717--6318[label="0.0294118;1pkt 1fpkt"];
1717--6361[label="0.0294118;1pkt 1fpkt"];
1717--6398[label="0.0294118;1pkt 1fpkt"];
1717--8206[label="1;34pkt 34fpkt"];
4395--4401[label="0.333333;1pkt 1fpkt"];
4395--6318[label="0.333333;1pkt 1fpkt"];
4395--6361[label="0.333333;1pkt 1fpkt"];
4395--6398[label="0.333333;1pkt 1fpkt"];
4395--8206[label="0.333333;1pkt 1fpkt"];
4401--6318[label="0.0294118;1pkt 1fpkt"];
4401--6361[label="0.0294118;1pkt 1fpkt"];
4401--6398[label="0.0294118;1pkt 1fpkt"];
4401--8206[label="1;34pkt 34fpkt"];
</description>
    <slice>
      <filter dst_ip="197.33.198.108" dst_port="53"/>
      <filter dst_ip="197.33.198.108" src_ip="148.208.183.197" src_port="80"/>
    </slice>
    <from sec="1204520474" usec="0"/>
    <to sec="1204521228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.937858,1.75689,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_725{
style=filled;
color=gray75;
7791[label="84.217.208.151;2pkt 2fpkt", shape=pentagon, color=darkviolet];
9093[label="84.217.208.151;2pkt 2fpkt", shape=invtriangle, color=brown];
9559[label="84.217.208.151;2pkt 2fpkt", shape=invhouse, color=bisque];
stat725[shape=component, label=&lt;Rules:&lt;BR/&gt;{84.217.208.151:80, 153.253.95.36:4955}[50%]&lt;BR/&gt;{84.217.208.151:80, 153.253.95.36:4956}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4956: (25%)&lt;BR/&gt; 4955: (25%)&gt;];
}
7791--9093[label="1;2pkt 2fpkt"];
7791--9559[label="1;2pkt 2fpkt"];
9093--9559[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="153.253.95.36" dst_port="4956" src_ip="84.217.208.151" src_port="80"/>
      <filter dst_ip="153.253.95.36" dst_port="4955" src_ip="84.217.208.151" src_port="80"/>
    </slice>
    <from sec="1204520978" usec="0"/>
    <to sec="1204521065" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="21.54.80.152"/>
    </slice>
    <from sec="1204520961" usec="0"/>
    <to sec="1204520974" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_727{
style=filled;
color=gray75;
7805[label="196.25.107.153;1pkt 1fpkt", shape=pentagon, color=darkviolet];
9098[label="196.25.107.153;1pkt 1fpkt", shape=invtriangle, color=brown];
stat727[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.25.107.153:20129, 59.204.14.158:20129}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 20129: (100%)&gt;];
}
7805--9098[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="59.204.14.158" dst_port="20129" src_ip="196.25.107.153" src_port="20129"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_728{
style=filled;
color=gray75;
7834[label="222.78.7.156;4pkt 4fpkt", shape=pentagon, color=darkviolet];
9105[label="222.78.7.156;4pkt 4fpkt", shape=invtriangle, color=brown];
stat728[shape=component, label=&lt;Rules:&lt;BR/&gt;{222.78.7.156:2660, 156.131.213.69:1004}[25%]&lt;BR/&gt;{222.78.7.156:17864, 156.131.213.69:1004}[25%]&lt;BR/&gt;{222.78.7.156:12792, 156.131.212.89:1004}[25%]&lt;BR/&gt;{222.78.7.156:19977, 156.131.212.89:1004}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1004: (50%)&lt;BR/&gt; 19977: (12.5%)&lt;BR/&gt; 17864: (12.5%)&lt;BR/&gt; 12792: (12.5%)&lt;BR/&gt; 2660: (12.5%)&gt;];
}
7834--9105[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="156.131.212.89" dst_port="1004" src_ip="222.78.7.156" src_port="19977"/>
      <filter dst_ip="156.131.212.89" dst_port="1004" src_ip="222.78.7.156" src_port="12792"/>
      <filter dst_ip="156.131.213.69" dst_port="1004" src_ip="222.78.7.156" src_port="17864"/>
      <filter dst_ip="156.131.213.69" dst_port="1004" src_ip="222.78.7.156" src_port="2660"/>
    </slice>
    <from sec="1204520408" usec="0"/>
    <to sec="1204521299" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="2.250.32.158"/>
    </slice>
    <from sec="1204520680" usec="0"/>
    <to sec="1204521245" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_731{
style=filled;
color=gray75;
7854[label="4.18.74.158;2pkt 2fpkt", shape=pentagon, color=darkviolet];
9114[label="4.18.74.158;2pkt 2fpkt", shape=invtriangle, color=brown];
stat731[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.18.74.158:80, 164.232.243.43:42611}[50%]&lt;BR/&gt;{4.18.74.158:80, 164.232.243.43:42612}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 42612: (25%)&lt;BR/&gt; 42611: (25%)&gt;];
}
7854--9114[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="164.232.243.43" dst_port="42612" src_ip="4.18.74.158" src_port="80"/>
      <filter dst_ip="164.232.243.43" dst_port="42611" src_ip="4.18.74.158" src_port="80"/>
    </slice>
    <from sec="1204520981" usec="0"/>
    <to sec="1204521065" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="222.2.38.160"/>
    </slice>
    <from sec="1204521036" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_733{
style=filled;
color=gray75;
7877[label="36.56.2.161;7pkt 7fpkt", shape=pentagon, color=darkviolet];
9125[label="36.56.2.161;7pkt 7fpkt", shape=invtriangle, color=brown];
stat733[shape=component, label=&lt;Rules:&lt;BR/&gt;{36.56.2.161:*, 153.253.101.192:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 57027: (7.14286%)&lt;BR/&gt; 52868: (7.14286%)&lt;BR/&gt; 46092: (7.14286%)&lt;BR/&gt; 44280: (7.14286%)&gt;];
}
7877--9125[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter dst_ip="153.253.101.192" dst_port="80" src_ip="36.56.2.161"/>
    </slice>
    <from sec="1204520456" usec="0"/>
    <to sec="1204521195" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="4.181.66.166"/>
    </slice>
    <from sec="1204520712" usec="0"/>
    <to sec="1204520786" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_736{
style=filled;
color=gray75;
7957[label="84.99.177.168;41pkt 41fpkt", shape=pentagon, color=darkviolet];
9153[label="84.99.177.168;41pkt 41fpkt", shape=invtriangle, color=brown];
stat736[shape=component, label=&lt;Rules:&lt;BR/&gt;{84.99.177.168:80, 164.232.129.35:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2525: (1.21951%)&lt;BR/&gt; 2522: (1.21951%)&lt;BR/&gt; 2257: (1.21951%)&lt;BR/&gt; 2255: (1.21951%)&gt;];
}
7957--9153[label="1;41pkt 41fpkt"];
</description>
    <slice>
      <filter dst_ip="164.232.129.35" src_ip="84.99.177.168" src_port="80"/>
    </slice>
    <from sec="1204521243" usec="0"/>
    <to sec="1204521287" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_738{
style=filled;
color=gray75;
7986[label="196.145.32.171;2pkt 2fpkt", shape=pentagon, color=darkviolet];
9163[label="196.145.32.171;2pkt 2fpkt", shape=invtriangle, color=brown];
stat738[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.145.32.171:80, 153.253.99.234:1053}[50%]&lt;BR/&gt;{196.145.32.171:80, 153.253.99.234:1055}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1055: (25%)&lt;BR/&gt; 1053: (25%)&gt;];
}
7986--9163[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="153.253.99.234" dst_port="1055" src_ip="196.145.32.171" src_port="80"/>
      <filter dst_ip="153.253.99.234" dst_port="1053" src_ip="196.145.32.171" src_port="80"/>
    </slice>
    <from sec="1204520790" usec="0"/>
    <to sec="1204520810" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="218.181.131.172"/>
    </slice>
    <from sec="1204521046" usec="0"/>
    <to sec="1204521104" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="2.248.105.173"/>
    </slice>
    <from sec="1204521185" usec="0"/>
    <to sec="1204521199" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.937858,1.75689,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_741{
style=filled;
color=gray75;
8046[label="156.103.166.177;9pkt 9fpkt", shape=pentagon, color=darkviolet];
9185[label="156.103.166.177;9pkt 9fpkt", shape=invtriangle, color=brown];
9589[label="156.103.166.177;9pkt 9fpkt", shape=invhouse, color=bisque];
stat741[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.103.166.177:*, 221.76.66.72:80}[66.6667%]&lt;BR/&gt;{156.103.166.177:*, 221.76.66.105:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4766: (5.55556%)&lt;BR/&gt; 4764: (5.55556%)&lt;BR/&gt; 4755: (5.55556%)&lt;BR/&gt; 4563: (5.55556%)&gt;];
}
8046--9185[label="1;9pkt 9fpkt"];
8046--9589[label="1;9pkt 9fpkt"];
9185--9589[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="221.76.66.72" dst_port="80" src_ip="156.103.166.177"/>
      <filter dst_ip="221.76.66.105" dst_port="80" src_ip="156.103.166.177"/>
    </slice>
    <from sec="1204520625" usec="0"/>
    <to sec="1204521219" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="39.160.99.181"/>
    </slice>
    <from sec="1204520747" usec="0"/>
    <to sec="1204520856" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,504,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="84.40.103.181"/>
    </slice>
    <from sec="1204520407" usec="0"/>
    <to sec="1204521298" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="5.202.81.182"/>
    </slice>
    <from sec="1204520974" usec="0"/>
    <to sec="1204520978" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="4.181.22.186"/>
    </slice>
    <from sec="1204521164" usec="0"/>
    <to sec="1204521188" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_747{
style=filled;
color=gray75;
8112[label="152.65.152.186;8pkt 8fpkt", shape=pentagon, color=darkviolet];
9201[label="152.65.152.186;8pkt 8fpkt", shape=invtriangle, color=brown];
stat747[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.65.152.186:22855, 4.217.4.40:*}[75%]&lt;BR/&gt;{152.65.152.186:22855, 4.217.50.31:*}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 22855: (50%)&lt;BR/&gt; 2472: (6.25%)&lt;BR/&gt; 2470: (6.25%)&lt;BR/&gt; 1815: (6.25%)&lt;BR/&gt; 1811: (6.25%)&gt;];
}
8112--9201[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="4.217.4.40" src_ip="152.65.152.186" src_port="22855"/>
      <filter dst_ip="4.217.50.31" src_ip="152.65.152.186" src_port="22855"/>
    </slice>
    <from sec="1204520890" usec="0"/>
    <to sec="1204521272" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,504,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="213.142.145.191"/>
    </slice>
    <from sec="1204520410" usec="0"/>
    <to sec="1204521262" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="13.105.204.191"/>
    </slice>
    <from sec="1204520688" usec="0"/>
    <to sec="1204520702" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="198.4.172.192"/>
    </slice>
    <from sec="1204520823" usec="0"/>
    <to sec="1204520849" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="153.253.117.197"/>
    </slice>
    <from sec="1204520474" usec="0"/>
    <to sec="1204520491" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="223.85.36.198"/>
    </slice>
    <from sec="1204520657" usec="0"/>
    <to sec="1204520696" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_754{
style=filled;
color=gray75;
8226[label="164.232.8.200;3pkt 3fpkt", shape=pentagon, color=darkviolet];
9249[label="164.232.8.200;3pkt 3fpkt", shape=invtriangle, color=brown];
stat754[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.232.8.200:25, 40.87.86.156:3291}[33.3333%]&lt;BR/&gt;{164.232.8.200:25, 220.142.66.246:2960}[33.3333%]&lt;BR/&gt;{164.232.8.200:25, 220.142.66.246:2967}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 3291: (16.6667%)&lt;BR/&gt; 2967: (16.6667%)&lt;BR/&gt; 2960: (16.6667%)&gt;];
}
8226--9249[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="220.142.66.246" dst_port="2967" src_ip="164.232.8.200" src_port="25"/>
      <filter dst_ip="220.142.66.246" dst_port="2960" src_ip="164.232.8.200" src_port="25"/>
      <filter dst_ip="40.87.86.156" dst_port="3291" src_ip="164.232.8.200" src_port="25"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.74811,1.71088,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_755{
style=filled;
color=gray75;
2446[label="196.25.150.144;d;385pkt 385fpkt", shape=diamond, color=yellow];
2527[label="84.99.179.82;s;357pkt 357fpkt", shape=diamond, color=yellow];
7200[label="84.99.179.82;357pkt 357fpkt", shape=pentagon, color=darkviolet];
8888[label="84.99.179.82;357pkt 357fpkt", shape=invtriangle, color=brown];
stat755[shape=component, label=&lt;Rules:&lt;BR/&gt;{84.99.179.82:80, 196.25.150.144:*}[92.7273%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.5192%)&lt;BR/&gt; 26552: (0.137363%)&lt;BR/&gt; 26551: (0.137363%)&lt;BR/&gt; 26550: (0.137363%)&lt;BR/&gt; 26549: (0.137363%)&gt;];
}
2446--2527[label="1;357pkt 357fpkt"];
2446--3486[label="0.00763359;1pkt 1fpkt"];
2446--3706[label="0.0227273;2pkt 2fpkt"];
2446--4499[label="0.0116279;1pkt 1fpkt"];
2446--5779[label="0.00519481;2pkt 2fpkt"];
2446--5812[label="0.00793651;1pkt 1fpkt"];
2446--5826[label="0.00763359;1pkt 1fpkt"];
2446--6318[label="0.0103896;4pkt 4fpkt"];
2446--6361[label="0.0103896;4pkt 4fpkt"];
2446--6398[label="0.0103896;4pkt 4fpkt"];
2446--7200[label="1;357pkt 357fpkt"];
2446--7287[label="0.0206186;2pkt 2fpkt"];
2446--7398[label="0.00704225;1pkt 1fpkt"];
2446--7988[label="0.00735294;1pkt 1fpkt"];
2446--8249[label="0.0357143;1pkt 1fpkt"];
2446--8467[label="0.238095;5pkt 5fpkt"];
2446--8888[label="1;357pkt 357fpkt"];
2446--8953[label="0.00704225;1pkt 1fpkt"];
2446--9257[label="0.0357143;1pkt 1fpkt"];
2446--9504[label="0.0070922;1pkt 1fpkt"];
2527--7200[label="1;357pkt 357fpkt"];
2527--8888[label="1;357pkt 357fpkt"];
7200--8888[label="1;357pkt 357fpkt"];
</description>
    <slice>
      <filter dst_ip="196.25.150.144" src_ip="84.99.179.82" src_port="80"/>
    </slice>
    <from sec="1204520667" usec="0"/>
    <to sec="1204521223" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="196.139.96.202"/>
    </slice>
    <from sec="1204520448" usec="0"/>
    <to sec="1204521272" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="83.176.1.204"/>
    </slice>
    <from sec="1204520825" usec="0"/>
    <to sec="1204520889" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,020,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_758{
style=filled;
color=gray75;
8284[label="153.253.220.206;10pkt 10fpkt", shape=pentagon, color=darkviolet];
9270[label="153.253.220.206;10pkt 10fpkt", shape=invtriangle, color=brown];
stat758[shape=component, label=&lt;Rules:&lt;BR/&gt;{153.253.220.206:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
8284--9270[label="1;10pkt 10fpkt"];
</description>
    <slice>
      <filter src_ip="153.253.220.206"/>
    </slice>
    <from sec="1204520580" usec="0"/>
    <to sec="1204521291" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="223.144.59.207"/>
    </slice>
    <from sec="1204521235" usec="0"/>
    <to sec="1204521239" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="199.99.1.210"/>
    </slice>
    <from sec="1204520528" usec="0"/>
    <to sec="1204520828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="5.41.165.211"/>
    </slice>
    <from sec="1204520403" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_762{
style=filled;
color=gray75;
8328[label="159.144.43.212;4pkt 4fpkt", shape=pentagon, color=darkviolet];
9287[label="159.144.43.212;4pkt 4fpkt", shape=invtriangle, color=brown];
stat762[shape=component, label=&lt;Rules:&lt;BR/&gt;{159.144.43.212:80, 164.232.211.27:52688}[25%]&lt;BR/&gt;{159.144.43.212:80, 164.232.211.76:62485}[25%]&lt;BR/&gt;{159.144.43.212:80, 164.232.56.26:51259}[25%]&lt;BR/&gt;{159.144.43.212:80, 164.232.56.26:51260}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 62485: (12.5%)&lt;BR/&gt; 52688: (12.5%)&lt;BR/&gt; 51260: (12.5%)&lt;BR/&gt; 51259: (12.5%)&gt;];
}
8328--9287[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="164.232.56.26" dst_port="51260" src_ip="159.144.43.212" src_port="80"/>
      <filter dst_ip="164.232.56.26" dst_port="51259" src_ip="159.144.43.212" src_port="80"/>
      <filter dst_ip="164.232.211.76" dst_port="62485" src_ip="159.144.43.212" src_port="80"/>
      <filter dst_ip="164.232.211.27" dst_port="52688" src_ip="159.144.43.212" src_port="80"/>
    </slice>
    <from sec="1204520733" usec="0"/>
    <to sec="1204521238" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="200.128.69.212"/>
    </slice>
    <from sec="1204521174" usec="0"/>
    <to sec="1204521179" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="21.55.111.212"/>
    </slice>
    <from sec="1204520430" usec="0"/>
    <to sec="1204520438" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="216.5.65.216"/>
    </slice>
    <from sec="1204520728" usec="0"/>
    <to sec="1204520752" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.937858,1.75689,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_766{
style=filled;
color=gray75;
8360[label="38.40.68.216;4pkt 4fpkt", shape=pentagon, color=darkviolet];
9300[label="38.40.68.216;4pkt 4fpkt", shape=invtriangle, color=brown];
9633[label="38.40.68.216;4pkt 4fpkt", shape=invhouse, color=bisque];
stat766[shape=component, label=&lt;Rules:&lt;BR/&gt;{38.40.68.216:2247, 197.33.211.34:3128}[25%]&lt;BR/&gt;{38.40.68.216:2238, 197.33.211.45:3128}[25%]&lt;BR/&gt;{38.40.68.216:2240, 197.33.211.35:3124}[25%]&lt;BR/&gt;{38.40.68.216:2246, 197.33.211.35:3128}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3128: (37.5%)&lt;BR/&gt; 3124: (12.5%)&lt;BR/&gt; 2247: (12.5%)&lt;BR/&gt; 2246: (12.5%)&lt;BR/&gt; 2240: (12.5%)&gt;];
}
8360--9300[label="1;4pkt 4fpkt"];
8360--9633[label="1;4pkt 4fpkt"];
9300--9633[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="197.33.211.35" dst_port="3128" src_ip="38.40.68.216" src_port="2246"/>
      <filter dst_ip="197.33.211.35" dst_port="3124" src_ip="38.40.68.216" src_port="2240"/>
      <filter dst_ip="197.33.211.45" dst_port="3128" src_ip="38.40.68.216" src_port="2238"/>
      <filter dst_ip="197.33.211.34" dst_port="3128" src_ip="38.40.68.216" src_port="2247"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.937858,1.75689,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_767{
style=filled;
color=gray75;
8420[label="197.33.196.225;4pkt 4fpkt", shape=pentagon, color=darkviolet];
9314[label="197.33.196.225;4pkt 4fpkt", shape=invtriangle, color=brown];
9640[label="197.33.196.225;4pkt 4fpkt", shape=invhouse, color=bisque];
stat767[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.33.196.225:52589, 209.24.133.14:80}[25%]&lt;BR/&gt;{197.33.196.225:59945, 47.40.84.137:80}[25%]&lt;BR/&gt;{197.33.196.225:43122, 209.24.133.181:80}[25%]&lt;BR/&gt;{197.33.196.225:47034, 209.24.133.181:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 59945: (12.5%)&lt;BR/&gt; 52589: (12.5%)&lt;BR/&gt; 47034: (12.5%)&lt;BR/&gt; 43122: (12.5%)&gt;];
}
8420--9314[label="1;4pkt 4fpkt"];
8420--9640[label="1;4pkt 4fpkt"];
9314--9640[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="209.24.133.181" dst_port="80" src_ip="197.33.196.225" src_port="47034"/>
      <filter dst_ip="209.24.133.181" dst_port="80" src_ip="197.33.196.225" src_port="43122"/>
      <filter dst_ip="47.40.84.137" dst_port="80" src_ip="197.33.196.225" src_port="59945"/>
      <filter dst_ip="209.24.133.14" dst_port="80" src_ip="197.33.196.225" src_port="52589"/>
    </slice>
    <from sec="1204520570" usec="0"/>
    <to sec="1204521196" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.937858,1.75689,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_768{
style=filled;
color=gray75;
8424[label="172.20.32.227;121pkt 121fpkt", shape=pentagon, color=darkviolet];
9316[label="172.20.32.227;121pkt 121fpkt", shape=invtriangle, color=brown];
9642[label="172.20.32.227;121pkt 121fpkt", shape=invhouse, color=bisque];
stat768[shape=component, label=&lt;Rules:&lt;BR/&gt;{172.20.32.227:*, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8888: (7.85124%)&lt;BR/&gt; 443: (6.61157%)&lt;BR/&gt; 80: (5.78512%)&lt;BR/&gt; 64543: (2.06612%)&lt;BR/&gt; 46237: (2.06612%)&gt;];
}
8424--9316[label="1;121pkt 121fpkt"];
8424--9642[label="1;121pkt 121fpkt"];
9316--9642[label="1;121pkt 121fpkt"];
</description>
    <slice>
      <filter src_ip="172.20.32.227"/>
    </slice>
    <from sec="1204520420" usec="0"/>
    <to sec="1204521190" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_770{
style=filled;
color=gray75;
8429[label="196.214.224.227;5pkt 5fpkt", shape=pentagon, color=darkviolet];
9320[label="196.214.224.227;5pkt 5fpkt", shape=invtriangle, color=brown];
stat770[shape=component, label=&lt;Rules:&lt;BR/&gt;{196.214.224.227:1058, 196.16.244.68:1434}[20%]&lt;BR/&gt;{196.214.224.227:1058, 156.161.82.90:1434}[20%]&lt;BR/&gt;{196.214.224.227:1058, 156.213.190.120:1434}[20%]&lt;BR/&gt;{196.214.224.227:1058, 153.253.5.237:1434}[20%]&lt;BR/&gt;{196.214.224.227:1058, 166.218.179.240:1434}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1434: (50%)&lt;BR/&gt; 1058: (50%)&gt;];
}
8429--9320[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="166.218.179.240" dst_port="1434" src_ip="196.214.224.227" src_port="1058"/>
      <filter dst_ip="153.253.5.237" dst_port="1434" src_ip="196.214.224.227" src_port="1058"/>
      <filter dst_ip="156.213.190.120" dst_port="1434" src_ip="196.214.224.227" src_port="1058"/>
      <filter dst_ip="156.161.82.90" dst_port="1434" src_ip="196.214.224.227" src_port="1058"/>
      <filter dst_ip="196.16.244.68" dst_port="1434" src_ip="196.214.224.227" src_port="1058"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="197.140.16.230"/>
    </slice>
    <from sec="1204520404" usec="0"/>
    <to sec="1204520441" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_772{
style=filled;
color=gray75;
8454[label="156.103.45.231;22pkt 22fpkt", shape=pentagon, color=darkviolet];
9329[label="156.103.45.231;21pkt 21fpkt", shape=invtriangle, color=brown];
stat772[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.103.45.231:25, *:*}[77.2727%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (38.3721%)&lt;BR/&gt; 80: (9.30233%)&lt;BR/&gt; 123: (4.65116%)&lt;BR/&gt; 62496: (2.32558%)&lt;BR/&gt; 49785: (2.32558%)&gt;];
}
8454--9329[label="1;21pkt 21fpkt"];
</description>
    <slice>
      <filter src_ip="156.103.45.231" src_port="25"/>
    </slice>
    <from sec="1204520401" usec="0"/>
    <to sec="1204521187" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="153.253.145.231"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_774{
style=filled;
color=gray75;
8481[label="36.158.112.234;45pkt 45fpkt", shape=pentagon, color=darkviolet];
9337[label="36.158.112.234;45pkt 45fpkt", shape=invtriangle, color=brown];
stat774[shape=component, label=&lt;Rules:&lt;BR/&gt;{36.158.112.234:*, 197.33.215.17:33438}[33.3333%]&lt;BR/&gt;{36.158.112.234:*, 197.33.215.17:33435}[31.1111%]&lt;BR/&gt;{36.158.112.234:*, 196.25.117.73:*}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 33438: (25.5556%)&lt;BR/&gt; 33435: (24.4444%)&lt;BR/&gt; 12416: (2.22222%)&lt;BR/&gt; 12288: (2.22222%)&lt;BR/&gt; 12280: (2.22222%)&gt;];
}
8481--9337[label="1;45pkt 45fpkt"];
</description>
    <slice>
      <filter dst_ip="196.25.117.73" src_ip="36.158.112.234"/>
      <filter dst_ip="197.33.215.17" dst_port="33438" src_ip="36.158.112.234"/>
      <filter dst_ip="197.33.215.17" dst_port="33435" src_ip="36.158.112.234"/>
    </slice>
    <from sec="1204520443" usec="0"/>
    <to sec="1204521294" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.937858,1.75689,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_775{
style=filled;
color=gray75;
8514[label="156.120.84.239;13pkt 13fpkt", shape=pentagon, color=darkviolet];
9349[label="156.120.84.239;13pkt 13fpkt", shape=invtriangle, color=brown];
9656[label="156.120.84.239;13pkt 13fpkt", shape=invhouse, color=bisque];
stat775[shape=component, label=&lt;Rules:&lt;BR/&gt;{156.120.84.239:*, 222.238.113.228:80}[69.2308%]&lt;BR/&gt;{156.120.84.239:*, 222.238.113.225:80}[30.7692%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1595: (3.84615%)&lt;BR/&gt; 1594: (3.84615%)&lt;BR/&gt; 1593: (3.84615%)&lt;BR/&gt; 1592: (3.84615%)&gt;];
}
8514--9349[label="1;13pkt 13fpkt"];
8514--9656[label="1;13pkt 13fpkt"];
9349--9656[label="1;13pkt 13fpkt"];
</description>
    <slice>
      <filter dst_ip="222.238.113.228" dst_port="80" src_ip="156.120.84.239"/>
      <filter dst_ip="222.238.113.225" dst_port="80" src_ip="156.120.84.239"/>
    </slice>
    <from sec="1204520614" usec="0"/>
    <to sec="1204520728" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.601651,1.77132,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_776{
style=filled;
color=gray75;
8545[label="217.138.43.245;129pkt 129fpkt", shape=pentagon, color=darkviolet];
9364[label="217.138.43.245;129pkt 129fpkt", shape=invtriangle, color=brown];
stat776[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.138.43.245:58102, *:1026}[52.7132%]&lt;BR/&gt;{217.138.43.245:58102, *:1027}[47.2868%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 58102: (50%)&lt;BR/&gt; 1026: (26.3566%)&lt;BR/&gt; 1027: (23.6434%)&gt;];
}
8545--9364[label="1;129pkt 129fpkt"];
</description>
    <slice>
      <filter dst_port="1026" src_ip="217.138.43.245" src_port="58102"/>
      <filter dst_port="1027" src_ip="217.138.43.245" src_port="58102"/>
    </slice>
    <from sec="1204520725" usec="0"/>
    <to sec="1204520726" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="217.101.13.250"/>
    </slice>
    <from sec="1204520403" usec="0"/>
    <to sec="1204521296" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="4.183.78.250"/>
    </slice>
    <from sec="1204520779" usec="0"/>
    <to sec="1204520835" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="1.233.14.251"/>
    </slice>
    <from sec="1204520807" usec="0"/>
    <to sec="1204520820" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.644648,1.81108,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="209.70.161.251"/>
    </slice>
    <from sec="1204520669" usec="0"/>
    <to sec="1204520853" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="38.231.112.0"/>
    </slice>
    <from sec="1204520431" usec="0"/>
    <to sec="1204520450" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="204.146.97.2"/>
    </slice>
    <from sec="1204520608" usec="0"/>
    <to sec="1204520622" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="38.231.112.2"/>
    </slice>
    <from sec="1204520400" usec="0"/>
    <to sec="1204520403" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="1.13.210.2"/>
    </slice>
    <from sec="1204520585" usec="0"/>
    <to sec="1204520635" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="40.143.16.5"/>
    </slice>
    <from sec="1204521277" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="215.1.32.6"/>
    </slice>
    <from sec="1204521269" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="215.1.32.9"/>
    </slice>
    <from sec="1204521022" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="42.158.216.12"/>
    </slice>
    <from sec="1204520841" usec="0"/>
    <to sec="1204520874" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="82.158.198.15"/>
    </slice>
    <from sec="1204520796" usec="0"/>
    <to sec="1204520801" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="50.69.80.24"/>
    </slice>
    <from sec="1204521169" usec="0"/>
    <to sec="1204521181" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="4.183.186.27"/>
    </slice>
    <from sec="1204520424" usec="0"/>
    <to sec="1204521019" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="216.90.220.27"/>
    </slice>
    <from sec="1204521186" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="132.112.136.30"/>
    </slice>
    <from sec="1204520421" usec="0"/>
    <to sec="1204520445" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="156.120.167.30"/>
    </slice>
    <from sec="1204520407" usec="0"/>
    <to sec="1204521273" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="58.224.39.33"/>
    </slice>
    <from sec="1204520826" usec="0"/>
    <to sec="1204520845" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="216.20.119.43"/>
    </slice>
    <from sec="1204520403" usec="0"/>
    <to sec="1204520414" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="218.39.77.44"/>
    </slice>
    <from sec="1204520731" usec="0"/>
    <to sec="1204520797" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="38.231.125.45"/>
    </slice>
    <from sec="1204520651" usec="0"/>
    <to sec="1204520661" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="38.231.126.71"/>
    </slice>
    <from sec="1204520782" usec="0"/>
    <to sec="1204520788" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="36.56.2.75"/>
    </slice>
    <from sec="1204520946" usec="0"/>
    <to sec="1204520957" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="215.1.32.77"/>
    </slice>
    <from sec="1204520635" usec="0"/>
    <to sec="1204520783" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="213.157.17.78"/>
    </slice>
    <from sec="1204521216" usec="0"/>
    <to sec="1204521218" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="13.107.98.97"/>
    </slice>
    <from sec="1204520681" usec="0"/>
    <to sec="1204520692" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="222.85.194.102"/>
    </slice>
    <from sec="1204520958" usec="0"/>
    <to sec="1204520959" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="42.10.92.137"/>
    </slice>
    <from sec="1204520403" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="38.231.124.138"/>
    </slice>
    <from sec="1204521234" usec="0"/>
    <to sec="1204521251" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="21.54.80.152"/>
    </slice>
    <from sec="1204520961" usec="0"/>
    <to sec="1204520974" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="5.202.81.173"/>
    </slice>
    <from sec="1204520661" usec="0"/>
    <to sec="1204520663" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="39.160.99.181"/>
    </slice>
    <from sec="1204520747" usec="0"/>
    <to sec="1204520856" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="5.202.81.182"/>
    </slice>
    <from sec="1204520974" usec="0"/>
    <to sec="1204520978" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="13.105.204.191"/>
    </slice>
    <from sec="1204520688" usec="0"/>
    <to sec="1204520702" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="198.4.172.192"/>
    </slice>
    <from sec="1204520823" usec="0"/>
    <to sec="1204520849" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="46.89.122.193"/>
    </slice>
    <from sec="1204520940" usec="0"/>
    <to sec="1204520943" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="57.164.164.194"/>
    </slice>
    <from sec="1204520404" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.06493,1.65653,503,0 0 0 1 1 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_815{
style=filled;
color=gray75;
1751[label="156.124.113.125;d;94pkt 94fpkt", shape=diamond, color=yellow];
4642[label="156.124.113.125;d;94pkt 94fpkt", shape=hexagon, color=black];
8246[label="216.123.33.202;8pkt 8fpkt", shape=pentagon, color=darkviolet];
9617[label="216.123.33.202;3pkt 3fpkt", shape=invhouse, color=bisque];
stat815[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.84.6.163:*, 156.124.113.125:80}[41.8367%]&lt;BR/&gt;{213.84.6.160:*, 156.124.113.125:80}[30.6122%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.2412%)&lt;BR/&gt; 443: (1.75879%)&lt;BR/&gt; 1425: (0.753769%)&lt;BR/&gt; 1424: (0.753769%)&lt;BR/&gt; 1423: (0.753769%)&gt;];
}
1751--4642[label="1;94pkt 94fpkt"];
1751--8246[label="0.5;4pkt 4fpkt"];
4642--8246[label="0.5;4pkt 4fpkt"];
8246--9617[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="156.124.113.125" dst_port="80" src_ip="213.84.6.163"/>
      <filter dst_ip="156.124.113.125" dst_port="80" src_ip="213.84.6.160"/>
    </slice>
    <from sec="1204520522" usec="0"/>
    <to sec="1204520813" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="196.139.96.202"/>
    </slice>
    <from sec="1204520448" usec="0"/>
    <to sec="1204521272" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="5.41.165.211"/>
    </slice>
    <from sec="1204520403" usec="0"/>
    <to sec="1204521294" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="200.128.69.212"/>
    </slice>
    <from sec="1204521174" usec="0"/>
    <to sec="1204521179" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.966004,1.79698,999,0 0 0 0 0 0 0 0 0 0 1 1 ">
    <description>subgraph cluster_819{
style=filled;
color=gray75;
9322[label="56.234.30.228;1pkt 1fpkt", shape=invtriangle, color=brown];
9645[label="56.234.30.228;1pkt 1fpkt", shape=invhouse, color=bisque];
stat819[shape=component, label=&lt;Rules:&lt;BR/&gt;{56.234.30.228:41292, 164.232.169.23:14568}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 41292: (50%)&lt;BR/&gt; 14568: (50%)&gt;];
}
9322--9645[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="164.232.169.23" dst_port="14568" src_ip="56.234.30.228" src_port="41292"/>
    </slice>
    <from sec="1204521253" usec="0"/>
    <to sec="1204521300" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="197.140.16.230"/>
    </slice>
    <from sec="1204520404" usec="0"/>
    <to sec="1204520441" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.848599,1.81526,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="153.253.145.231"/>
    </slice>
    <from sec="1204521300" usec="0"/>
    <to sec="1204521301" usec="0"/>
  </anomaly>

</admd:annotation>
