<?xml version="1.0" encoding="UTF-8" standalone="no" ?>
<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">

  <anomaly type="notice" value="1.06102,1.68826,503,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="197.123.181.82" dst_port="80" proto="tcp" src_ip="154.101.16.10" src_port="1841"/>
      <filter dst_ip="197.123.181.82" dst_port="80" proto="udp" src_ip="154.101.16.10" src_port="1841"/>
      <filter dst_ip="197.123.181.82" dst_port="53" proto="tcp" src_ip="154.101.16.10" src_port="1841"/>
      <filter dst_ip="197.123.181.82" dst_port="53" proto="udp" src_ip="154.101.16.10" src_port="1841"/>
      <filter dst_ip="197.123.181.82" dst_port="80" proto="tcp" src_ip="154.101.16.10" src_port="1844"/>
      <filter dst_ip="197.123.181.82" dst_port="80" proto="udp" src_ip="154.101.16.10" src_port="1844"/>
      <filter dst_ip="197.123.181.82" dst_port="53" proto="tcp" src_ip="154.101.16.10" src_port="1844"/>
      <filter dst_ip="197.123.181.82" dst_port="53" proto="udp" src_ip="154.101.16.10" src_port="1844"/>
      <filter dst_ip="197.123.181.72" dst_port="80" proto="tcp" src_ip="154.101.16.10" src_port="1841"/>
      <filter dst_ip="197.123.181.72" dst_port="80" proto="udp" src_ip="154.101.16.10" src_port="1841"/>
      <filter dst_ip="197.123.181.72" dst_port="53" proto="tcp" src_ip="154.101.16.10" src_port="1841"/>
      <filter dst_ip="197.123.181.72" dst_port="53" proto="udp" src_ip="154.101.16.10" src_port="1841"/>
      <filter dst_ip="197.123.181.72" dst_port="80" proto="tcp" src_ip="154.101.16.10" src_port="1844"/>
      <filter dst_ip="197.123.181.72" dst_port="80" proto="udp" src_ip="154.101.16.10" src_port="1844"/>
      <filter dst_ip="197.123.181.72" dst_port="53" proto="tcp" src_ip="154.101.16.10" src_port="1844"/>
      <filter dst_ip="197.123.181.72" dst_port="53" proto="udp" src_ip="154.101.16.10" src_port="1844"/>
      <from sec="1230786752" usec="0"/>
      <to sec="1230786759" usec="0"/>
    </slice>
    <from sec="1230786752" usec="0"/>
    <to sec="1230786759" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.06102,1.68826,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="80.107.228.11" dst_port="53" proto="tcp" src_ip="160.48.181.76" src_port="1008"/>
      <filter dst_ip="80.107.228.11" dst_port="53" proto="udp" src_ip="160.48.181.76" src_port="1008"/>
      <filter dst_ip="202.37.219.22" dst_port="53" proto="tcp" src_ip="160.48.181.76" src_port="1008"/>
      <filter dst_ip="202.37.219.22" dst_port="53" proto="udp" src_ip="160.48.181.76" src_port="1008"/>
      <from sec="1230786150" usec="0"/>
      <to sec="1230786802" usec="0"/>
    </slice>
    <from sec="1230786150" usec="0"/>
    <to sec="1230786802" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.06102,1.68826,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="160.48.44.138" proto="tcp" src_ip="160.48.44.138" src_port="3941"/>
      <filter dst_ip="160.48.44.138" proto="tcp" src_ip="160.48.44.138" src_port="3941"/>
      <filter dst_ip="160.48.44.138" proto="tcp" src_ip="160.48.44.138" src_port="3941"/>
      <filter dst_ip="160.48.44.138" proto="tcp" src_ip="160.48.44.138" src_port="3941"/>
      <from sec="1230786409" usec="0"/>
      <to sec="1230786693" usec="0"/>
    </slice>
    <from sec="1230786409" usec="0"/>
    <to sec="1230786693" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.06102,1.68826,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="192.231.22.252" dst_port="80" proto="tcp" src_ip="192.231.22.252"/>
      <filter dst_ip="192.231.22.252" dst_port="80" proto="tcp" src_ip="192.231.22.252"/>
      <filter dst_ip="192.231.22.252" dst_port="80" proto="tcp" src_ip="192.231.22.252"/>
      <filter dst_ip="192.231.22.252" dst_port="80" proto="tcp" src_ip="192.231.22.252"/>
      <from sec="1230786335" usec="0"/>
      <to sec="1230786769" usec="0"/>
    </slice>
    <from sec="1230786335" usec="0"/>
    <to sec="1230786769" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.06102,1.68826,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="156.36.41.193" dst_port="21" proto="tcp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="21" proto="udp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="21" proto="tcp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="21" proto="udp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="21" proto="tcp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="21" proto="udp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="21" proto="tcp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="21" proto="udp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="25" proto="tcp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="25" proto="udp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="25" proto="tcp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="25" proto="udp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="25" proto="tcp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="25" proto="udp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="25" proto="tcp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="25" proto="udp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="22" proto="tcp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="22" proto="udp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="22" proto="tcp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="22" proto="udp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="22" proto="tcp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="22" proto="udp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="22" proto="tcp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="22" proto="udp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="53" proto="tcp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="53" proto="udp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="53" proto="tcp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="53" proto="udp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="53" proto="tcp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="53" proto="udp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="53" proto="tcp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="53" proto="udp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="80" proto="tcp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="80" proto="udp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="80" proto="tcp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="80" proto="udp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="80" proto="tcp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="80" proto="udp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="80" proto="tcp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="80" proto="udp" src_ip="13.233.218.35"/>
      <filter dst_ip="156.36.41.193" dst_port="21" proto="tcp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="21" proto="udp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="21" proto="tcp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="21" proto="udp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="21" proto="tcp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="21" proto="udp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="21" proto="tcp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="21" proto="udp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="25" proto="tcp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="25" proto="udp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="25" proto="tcp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="25" proto="udp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="25" proto="tcp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="25" proto="udp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="25" proto="tcp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="25" proto="udp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="22" proto="tcp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="22" proto="udp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="22" proto="tcp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="22" proto="udp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="22" proto="tcp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="22" proto="udp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="22" proto="tcp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="22" proto="udp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="53" proto="tcp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="53" proto="udp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="53" proto="tcp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="53" proto="udp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="53" proto="tcp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="53" proto="udp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="53" proto="tcp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="53" proto="udp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="80" proto="tcp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="80" proto="udp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="80" proto="tcp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="80" proto="udp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="80" proto="tcp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="80" proto="udp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="80" proto="tcp" src_ip="156.36.41.193"/>
      <filter dst_ip="156.36.41.193" dst_port="80" proto="udp" src_ip="156.36.41.193"/>
      <from sec="1230786205" usec="0"/>
      <to sec="1230786769" usec="0"/>
    </slice>
    <from sec="1230786205" usec="0"/>
    <to sec="1230786769" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.06102,1.68826,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="192.231.29.19" proto="icmp" src_ip="214.225.255.5"/>
      <from sec="1230786031" usec="0"/>
      <to sec="1230786282" usec="0"/>
    </slice>
    <from sec="1230786031" usec="0"/>
    <to sec="1230786283" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.06102,1.68826,999,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="52.0.72.24" dst_port="25" proto="tcp" src_ip="192.231.25.59" src_port="62371"/>
      <filter dst_ip="52.0.72.24" dst_port="25" proto="udp" src_ip="192.231.25.59" src_port="62371"/>
      <filter dst_ip="52.0.72.24" dst_port="53" proto="tcp" src_ip="192.231.25.59" src_port="62371"/>
      <filter dst_ip="52.0.72.24" dst_port="53" proto="udp" src_ip="192.231.25.59" src_port="62371"/>
      <filter dst_ip="52.0.72.24" dst_port="25" proto="tcp" src_ip="192.231.25.59" src_port="62373"/>
      <filter dst_ip="52.0.72.24" dst_port="25" proto="udp" src_ip="192.231.25.59" src_port="62373"/>
      <filter dst_ip="52.0.72.24" dst_port="53" proto="tcp" src_ip="192.231.25.59" src_port="62373"/>
      <filter dst_ip="52.0.72.24" dst_port="53" proto="udp" src_ip="192.231.25.59" src_port="62373"/>
      <filter dst_ip="52.0.72.24" dst_port="25" proto="tcp" src_ip="192.231.25.59" src_port="62372"/>
      <filter dst_ip="52.0.72.24" dst_port="25" proto="udp" src_ip="192.231.25.59" src_port="62372"/>
      <filter dst_ip="52.0.72.24" dst_port="53" proto="tcp" src_ip="192.231.25.59" src_port="62372"/>
      <filter dst_ip="52.0.72.24" dst_port="53" proto="udp" src_ip="192.231.25.59" src_port="62372"/>
      <filter dst_ip="52.0.72.24" dst_port="25" proto="tcp" src_ip="192.231.25.59" src_port="62363"/>
      <filter dst_ip="52.0.72.24" dst_port="25" proto="udp" src_ip="192.231.25.59" src_port="62363"/>
      <filter dst_ip="52.0.72.24" dst_port="53" proto="tcp" src_ip="192.231.25.59" src_port="62363"/>
      <filter dst_ip="52.0.72.24" dst_port="53" proto="udp" src_ip="192.231.25.59" src_port="62363"/>
      <filter dst_ip="49.85.44.30" dst_port="25" proto="tcp" src_ip="192.231.25.59" src_port="62371"/>
      <filter dst_ip="49.85.44.30" dst_port="25" proto="udp" src_ip="192.231.25.59" src_port="62371"/>
      <filter dst_ip="49.85.44.30" dst_port="53" proto="tcp" src_ip="192.231.25.59" src_port="62371"/>
      <filter dst_ip="49.85.44.30" dst_port="53" proto="udp" src_ip="192.231.25.59" src_port="62371"/>
      <filter dst_ip="49.85.44.30" dst_port="25" proto="tcp" src_ip="192.231.25.59" src_port="62373"/>
      <filter dst_ip="49.85.44.30" dst_port="25" proto="udp" src_ip="192.231.25.59" src_port="62373"/>
      <filter dst_ip="49.85.44.30" dst_port="53" proto="tcp" src_ip="192.231.25.59" src_port="62373"/>
      <filter dst_ip="49.85.44.30" dst_port="53" proto="udp" src_ip="192.231.25.59" src_port="62373"/>
      <filter dst_ip="49.85.44.30" dst_port="25" proto="tcp" src_ip="192.231.25.59" src_port="62372"/>
      <filter dst_ip="49.85.44.30" dst_port="25" proto="udp" src_ip="192.231.25.59" src_port="62372"/>
      <filter dst_ip="49.85.44.30" dst_port="53" proto="tcp" src_ip="192.231.25.59" src_port="62372"/>
      <filter dst_ip="49.85.44.30" dst_port="53" proto="udp" src_ip="192.231.25.59" src_port="62372"/>
      <filter dst_ip="49.85.44.30" dst_port="25" proto="tcp" src_ip="192.231.25.59" src_port="62363"/>
      <filter dst_ip="49.85.44.30" dst_port="25" proto="udp" src_ip="192.231.25.59" src_port="62363"/>
      <filter dst_ip="49.85.44.30" dst_port="53" proto="tcp" src_ip="192.231.25.59" src_port="62363"/>
      <filter dst_ip="49.85.44.30" dst_port="53" proto="udp" src_ip="192.231.25.59" src_port="62363"/>
      <filter dst_ip="215.181.208.26" dst_port="25" proto="tcp" src_ip="192.231.25.59" src_port="62371"/>
      <filter dst_ip="215.181.208.26" dst_port="25" proto="udp" src_ip="192.231.25.59" src_port="62371"/>
      <filter dst_ip="215.181.208.26" dst_port="53" proto="tcp" src_ip="192.231.25.59" src_port="62371"/>
      <filter dst_ip="215.181.208.26" dst_port="53" proto="udp" src_ip="192.231.25.59" src_port="62371"/>
      <filter dst_ip="215.181.208.26" dst_port="25" proto="tcp" src_ip="192.231.25.59" src_port="62373"/>
      <filter dst_ip="215.181.208.26" dst_port="25" proto="udp" src_ip="192.231.25.59" src_port="62373"/>
      <filter dst_ip="215.181.208.26" dst_port="53" proto="tcp" src_ip="192.231.25.59" src_port="62373"/>
      <filter dst_ip="215.181.208.26" dst_port="53" proto="udp" src_ip="192.231.25.59" src_port="62373"/>
      <filter dst_ip="215.181.208.26" dst_port="25" proto="tcp" src_ip="192.231.25.59" src_port="62372"/>
      <filter dst_ip="215.181.208.26" dst_port="25" proto="udp" src_ip="192.231.25.59" src_port="62372"/>
      <filter dst_ip="215.181.208.26" dst_port="53" proto="tcp" src_ip="192.231.25.59" src_port="62372"/>
      <filter dst_ip="215.181.208.26" dst_port="53" proto="udp" src_ip="192.231.25.59" src_port="62372"/>
      <filter dst_ip="215.181.208.26" dst_port="25" proto="tcp" src_ip="192.231.25.59" src_port="62363"/>
      <filter dst_ip="215.181.208.26" dst_port="25" proto="udp" src_ip="192.231.25.59" src_port="62363"/>
      <filter dst_ip="215.181.208.26" dst_port="53" proto="tcp" src_ip="192.231.25.59" src_port="62363"/>
      <filter dst_ip="215.181.208.26" dst_port="53" proto="udp" src_ip="192.231.25.59" src_port="62363"/>
      <filter dst_ip="215.181.208.27" dst_port="25" proto="tcp" src_ip="192.231.25.59" src_port="62371"/>
      <filter dst_ip="215.181.208.27" dst_port="25" proto="udp" src_ip="192.231.25.59" src_port="62371"/>
      <filter dst_ip="215.181.208.27" dst_port="53" proto="tcp" src_ip="192.231.25.59" src_port="62371"/>
      <filter dst_ip="215.181.208.27" dst_port="53" proto="udp" src_ip="192.231.25.59" src_port="62371"/>
      <filter dst_ip="215.181.208.27" dst_port="25" proto="tcp" src_ip="192.231.25.59" src_port="62373"/>
      <filter dst_ip="215.181.208.27" dst_port="25" proto="udp" src_ip="192.231.25.59" src_port="62373"/>
      <filter dst_ip="215.181.208.27" dst_port="53" proto="tcp" src_ip="192.231.25.59" src_port="62373"/>
      <filter dst_ip="215.181.208.27" dst_port="53" proto="udp" src_ip="192.231.25.59" src_port="62373"/>
      <filter dst_ip="215.181.208.27" dst_port="25" proto="tcp" src_ip="192.231.25.59" src_port="62372"/>
      <filter dst_ip="215.181.208.27" dst_port="25" proto="udp" src_ip="192.231.25.59" src_port="62372"/>
      <filter dst_ip="215.181.208.27" dst_port="53" proto="tcp" src_ip="192.231.25.59" src_port="62372"/>
      <filter dst_ip="215.181.208.27" dst_port="53" proto="udp" src_ip="192.231.25.59" src_port="62372"/>
      <filter dst_ip="215.181.208.27" dst_port="25" proto="tcp" src_ip="192.231.25.59" src_port="62363"/>
      <filter dst_ip="215.181.208.27" dst_port="25" proto="udp" src_ip="192.231.25.59" src_port="62363"/>
      <filter dst_ip="215.181.208.27" dst_port="53" proto="tcp" src_ip="192.231.25.59" src_port="62363"/>
      <filter dst_ip="215.181.208.27" dst_port="53" proto="udp" src_ip="192.231.25.59" src_port="62363"/>
      <from sec="1230786385" usec="0"/>
      <to sec="1230786389" usec="0"/>
    </slice>
    <from sec="1230786384" usec="0"/>
    <to sec="1230786390" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.06102,1.68826,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="216.196.235.61" dst_port="25" proto="tcp" src_ip="164.114.4.5" src_port="1030"/>
      <filter dst_ip="216.196.235.61" dst_port="25" proto="udp" src_ip="164.114.4.5" src_port="1030"/>
      <filter dst_ip="216.196.235.61" dst_port="80" proto="tcp" src_ip="164.114.4.5" src_port="1030"/>
      <filter dst_ip="216.196.235.61" dst_port="80" proto="udp" src_ip="164.114.4.5" src_port="1030"/>
      <filter dst_ip="216.196.235.61" dst_port="53" proto="tcp" src_ip="164.114.4.5" src_port="1030"/>
      <filter dst_ip="216.196.235.61" dst_port="53" proto="udp" src_ip="164.114.4.5" src_port="1030"/>
      <filter dst_ip="216.196.235.61" dst_port="137" proto="tcp" src_ip="164.114.4.5" src_port="1030"/>
      <filter dst_ip="216.196.235.61" dst_port="137" proto="udp" src_ip="164.114.4.5" src_port="1030"/>
      <from sec="1230786862" usec="0"/>
      <to sec="1230786866" usec="0"/>
    </slice>
    <slice>
      <filter dst_ip="216.196.235.61" dst_port="25" proto="tcp" src_ip="36.208.100.164" src_port="1030"/>
      <filter dst_ip="216.196.235.61" dst_port="25" proto="udp" src_ip="36.208.100.164" src_port="1030"/>
      <filter dst_ip="216.196.235.61" dst_port="80" proto="tcp" src_ip="36.208.100.164" src_port="1030"/>
      <filter dst_ip="216.196.235.61" dst_port="80" proto="udp" src_ip="36.208.100.164" src_port="1030"/>
      <filter dst_ip="216.196.235.61" dst_port="53" proto="tcp" src_ip="36.208.100.164" src_port="1030"/>
      <filter dst_ip="216.196.235.61" dst_port="53" proto="udp" src_ip="36.208.100.164" src_port="1030"/>
      <filter dst_ip="216.196.235.61" dst_port="137" proto="tcp" src_ip="36.208.100.164" src_port="1030"/>
      <filter dst_ip="216.196.235.61" dst_port="137" proto="udp" src_ip="36.208.100.164" src_port="1030"/>
      <from sec="1230786862" usec="0"/>
      <to sec="1230786867" usec="0"/>
    </slice>
    <from sec="1230786862" usec="0"/>
    <to sec="1230786867" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="1.06102,1.68826,901,1 0 0 0 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="156.36.32.12" dst_port="53" proto="tcp" src_ip="194.33.111.13"/>
      <filter dst_ip="156.36.32.12" dst_port="53" proto="udp" src_ip="194.33.111.13"/>
      <filter dst_ip="156.36.32.12" dst_port="53" proto="tcp" src_ip="194.33.111.13"/>
      <filter dst_ip="156.36.32.12" dst_port="53" proto="udp" src_ip="194.33.111.13"/>
      <filter dst_ip="156.36.32.12" dst_port="53" proto="tcp" src_ip="194.33.111.13"/>
      <filter dst_ip="156.36.32.12" dst_port="53" proto="udp" src_ip="194.33.111.13"/>
      <filter dst_ip="156.36.32.12" dst_port="53" proto="tcp" src_ip="194.33.111.13"/>
      <filter dst_ip="156.36.32.12" dst_port="53" proto="udp" src_ip="194.33.111.13"/>
      <filter dst_ip="156.36.32.12" dst_port="25" proto="tcp" src_ip="194.33.111.13"/>
      <filter dst_ip="156.36.32.12" dst_port="25" proto="udp" src_ip="194.33.111.13"/>
      <filter dst_ip="156.36.32.12" dst_port="25" proto="tcp" src_ip="194.33.111.13"/>
      <filter dst_ip="156.36.32.12" dst_port="25" proto="udp" src_ip="194.33.111.13"/>
      <filter dst_ip="156.36.32.12" dst_port="25" proto="tcp" src_ip="194.33.111.13"/>
      <filter dst_ip="156.36.32.12" dst_port="25" proto="udp" src_ip="194.33.111.13"/>
      <filter dst_ip="156.36.32.12" dst_port="25" proto="tcp" src_ip="194.33.111.13"/>
      <filter dst_ip="156.36.32.12" dst_port="25" proto="udp" src_ip="194.33.111.13"/>
      <filter dst_ip="156.36.32.12" dst_port="23" proto="tcp" src_ip="194.33.111.13"/>
      <filter dst_ip="156.36.32.12" dst_port="23" proto="udp" src_ip="194.33.111.13"/>
      <filter dst_ip="156.36.32.12" dst_port="23" proto="tcp" src_ip="194.33.111.13"/>
      <filter dst_ip="156.36.32.12" dst_port="23" proto="udp" src_ip="194.33.111.13"/>
      <filter dst_ip="156.36.32.12" dst_port="23" proto="tcp" src_ip="194.33.111.13"/>
      <filter dst_ip="156.36.32.12" dst_port="23" proto="udp" src_ip="194.33.111.13"/>
      <filter dst_ip="156.36.32.12" dst_port="23" proto="tcp" src_ip="194.33.111.13"/>
      <filter dst_ip="156.36.32.12" dst_port="23" proto="udp" src_ip="194.33.111.13"/>
      <from sec="1230786449" usec="0"/>
      <to sec="1230786453" usec="0"/>
    </slice>
    <from sec="1230786449" usec="0"/>
    <to sec="1230786454" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_15{
style=filled;
color=gray75;
3999[label="81.146.225.91;34pkt 34fpkt", shape=pentagon, color=darkviolet];
stat15[shape=component, label=&lt;Rules:&lt;BR/&gt;{81.146.225.91:*, 192.231.16.116:80}[91.1765%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4285: (1.47059%)&lt;BR/&gt; 4269: (1.47059%)&lt;BR/&gt; 4267: (1.47059%)&lt;BR/&gt; 4255: (1.47059%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="192.231.16.116" dst_port="80" src_ip="81.146.225.91"/>
    </slice>
    <from sec="1230786824" usec="0"/>
    <to sec="1230786900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,901,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="0.0.0.0"/>
      <from sec="1230786001" usec="0"/>
      <to sec="1230786829" usec="0"/>
    </slice>
    <from sec="256" usec="0"/>
    <to sec="0" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,901,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="0.0.0.0"/>
      <from sec="1230786001" usec="0"/>
      <to sec="1230786829" usec="0"/>
    </slice>
    <from sec="0" usec="0"/>
    <to sec="28894512" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.863625,1.45226,053,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_32{
style=filled;
color=gray75;
226[label="205.98.196.104;s;1pkt 1fpkt", shape=diamond, color=yellow];
227[label="164.114.31.43;d;9pkt 9fpkt", shape=diamond, color=yellow];
2452[label="205.98.196.104;s;1pkt 1fpkt", shape=hexagon, color=black];
4063[label="205.98.196.104;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5181[label="205.98.196.104;1pkt 1fpkt", shape=invtriangle, color=brown];
stat32[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.236.90.145:80, 164.114.31.43:*}[66.6667%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (26.9231%)&lt;BR/&gt; 7723: (19.2308%)&lt;BR/&gt; 1935: (19.2308%)&lt;BR/&gt; 7932: (3.84615%)&lt;BR/&gt; 7930: (3.84615%)&gt;];
}
226--227[label="1;1pkt 1fpkt"];
226--2452[label="1;1pkt 1fpkt"];
226--4063[label="1;1pkt 1fpkt"];
226--5181[label="1;1pkt 1fpkt"];
227--2452[label="1;1pkt 1fpkt"];
227--4063[label="1;1pkt 1fpkt"];
227--5181[label="1;1pkt 1fpkt"];
2452--4063[label="1;1pkt 1fpkt"];
2452--5181[label="1;1pkt 1fpkt"];
4063--5181[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="164.114.31.43" src_ip="192.236.90.145" src_port="80"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_33{
style=filled;
color=gray75;
320[label="152.74.61.83;s;1pkt 1fpkt", shape=diamond, color=yellow];
321[label="221.129.247.3;d;1pkt 1fpkt", shape=diamond, color=yellow];
2386[label="152.74.61.83;s;1pkt 1fpkt", shape=hexagon, color=black];
stat33[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.74.61.83:2049, 221.129.247.3:9015}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9015: (50%)&lt;BR/&gt; 2049: (50%)&gt;];
}
320--321[label="1;1pkt 1fpkt"];
320--2386[label="1;1pkt 1fpkt"];
321--2386[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="221.129.247.3" dst_port="9015" src_ip="152.74.61.83" src_port="2049"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786739" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_34{
style=filled;
color=gray75;
319[label="152.74.61.83;d;1pkt 1fpkt", shape=diamond, color=yellow];
322[label="221.129.247.3;s;1pkt 1fpkt", shape=diamond, color=yellow];
2971[label="221.129.247.3;s;1pkt 1fpkt", shape=hexagon, color=black];
stat34[shape=component, label=&lt;Rules:&lt;BR/&gt;{221.129.247.3:9015, 152.74.61.83:2049}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9015: (50%)&lt;BR/&gt; 2049: (50%)&gt;];
}
319--322[label="1;1pkt 1fpkt"];
319--2971[label="1;1pkt 1fpkt"];
322--2971[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="152.74.61.83" dst_port="2049" src_ip="221.129.247.3" src_port="9015"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,502,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_36{
style=filled;
color=gray75;
342[label="50.196.154.239;d;422pkt 422fpkt", shape=diamond, color=yellow];
343[label="202.171.144.156;s;475pkt 475fpkt", shape=diamond, color=yellow];
2712[label="202.171.144.156;s;374pkt 374fpkt", shape=hexagon, color=black];
stat36[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.171.144.156:22, 50.196.154.239:*}[99.7895%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 22: (49.9213%)&lt;BR/&gt; 60986: (0.118017%)&lt;BR/&gt; 60506: (0.118017%)&lt;BR/&gt; 60403: (0.118017%)&lt;BR/&gt; 60375: (0.118017%)&gt;];
}
342--343[label="1;422pkt 422fpkt"];
342--2712[label="0.997326;373pkt 373fpkt"];
343--2712[label="1;374pkt 374fpkt"];
</description>
    <slice>
      <filter dst_ip="50.196.154.239" src_ip="202.171.144.156" src_port="22"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,502,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_39{
style=filled;
color=gray75;
596[label="9.119.120.18;d;1pkt 1fpkt", shape=diamond, color=yellow];
597[label="164.114.158.244;s;1pkt 1fpkt", shape=diamond, color=yellow];
2539[label="9.119.120.18;d;1pkt 1fpkt", shape=hexagon, color=black];
stat39[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.114.158.244:22, 9.119.120.18:44103}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 44103: (50%)&lt;BR/&gt; 22: (50%)&gt;];
}
596--597[label="1;1pkt 1fpkt"];
596--2539[label="1;1pkt 1fpkt"];
597--2539[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="9.119.120.18" dst_port="44103" src_ip="164.114.158.244" src_port="22"/>
    </slice>
    <from sec="1230786065" usec="0"/>
    <to sec="1230786146" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_40{
style=filled;
color=gray75;
528[label="187.77.80.44;s;3pkt 3fpkt", shape=diamond, color=yellow];
606[label="50.200.12.19;d;1pkt 1fpkt", shape=diamond, color=yellow];
3078[label="187.77.80.44;s;3pkt 3fpkt", shape=hexagon, color=black];
stat40[shape=component, label=&lt;Rules:&lt;BR/&gt;{187.77.80.44:57142, 50.200.12.19:80}[33.3333%]&lt;BR/&gt;{187.77.80.44:57211, 210.199.181.148:80}[33.3333%]&lt;BR/&gt;{187.77.80.44:56825, 198.193.175.241:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 57142: (21.4286%)&lt;BR/&gt; 57211: (14.2857%)&lt;BR/&gt; 56825: (14.2857%)&gt;];
}
528--606[label="1;1pkt 1fpkt"];
528--3078[label="1;3pkt 3fpkt"];
606--3078[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="198.193.175.241" dst_port="80" src_ip="187.77.80.44" src_port="56825"/>
      <filter dst_ip="210.199.181.148" dst_port="80" src_ip="187.77.80.44" src_port="57211"/>
      <filter dst_ip="50.200.12.19" dst_port="80" src_ip="187.77.80.44" src_port="57142"/>
    </slice>
    <from sec="1230786698" usec="0"/>
    <to sec="1230786717" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="80.185.246.10"/>
      <from sec="1230786407" usec="0"/>
      <to sec="1230786829" usec="0"/>
    </slice>
    <from sec="1230786407" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_43{
style=filled;
color=gray75;
708[label="60.14.17.24;d;1pkt 1fpkt", shape=diamond, color=yellow];
709[label="160.48.99.16;s;85pkt 85fpkt", shape=diamond, color=yellow];
2635[label="160.48.99.16;s;79pkt 79fpkt", shape=hexagon, color=black];
stat43[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.48.99.16:12257, *:*}[98.8235%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 12257: (49.0909%)&lt;BR/&gt; 32459: (1.21212%)&lt;BR/&gt; 65349: (0.909091%)&lt;BR/&gt; 1264: (0.909091%)&lt;BR/&gt; 64689: (0.606061%)&gt;];
}
708--709[label="1;1pkt 1fpkt"];
708--2635[label="1;1pkt 1fpkt"];
709--2635[label="1;79pkt 79fpkt"];
</description>
    <slice>
      <filter src_ip="160.48.99.16" src_port="12257"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_44{
style=filled;
color=gray75;
249[label="193.17.100.196;s;213pkt 213fpkt", shape=diamond, color=yellow];
718[label="3.22.196.32;d;2pkt 2fpkt", shape=diamond, color=yellow];
769[label="81.237.218.66;d;1pkt 1fpkt", shape=diamond, color=yellow];
1268[label="4.192.212.40;d;7pkt 7fpkt", shape=diamond, color=yellow];
2376[label="193.17.100.196;s;212pkt 212fpkt", shape=hexagon, color=black];
3106[label="4.192.212.40;d;7pkt 7fpkt", shape=hexagon, color=black];
stat44[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.17.100.196:20265, *:*}[93.4272%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 20265: (44.9095%)&lt;BR/&gt; 23853: (3.16742%)&lt;BR/&gt; 6346: (1.69683%)&lt;BR/&gt; 24591: (0.678733%)&lt;BR/&gt; 14385: (0.452489%)&gt;];
}
249--718[label="1;2pkt 2fpkt"];
249--769[label="1;1pkt 1fpkt"];
249--1268[label="1;7pkt 7fpkt"];
249--2376[label="1;212pkt 212fpkt"];
249--3106[label="1;7pkt 7fpkt"];
718--2376[label="1;2pkt 2fpkt"];
769--2376[label="1;1pkt 1fpkt"];
1268--2376[label="1;7pkt 7fpkt"];
1268--3106[label="1;7pkt 7fpkt"];
2376--3106[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter src_ip="193.17.100.196" src_port="20265"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_46{
style=filled;
color=gray75;
785[label="154.101.132.176;s;133pkt 133fpkt", shape=diamond, color=yellow];
stat46[shape=component, label=&lt;Rules:&lt;BR/&gt;{154.101.132.176:25, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 4348: (0.75188%)&lt;BR/&gt; 2090: (0.75188%)&lt;BR/&gt; 1462: (0.75188%)&lt;BR/&gt; 65248: (0.37594%)&gt;];
}
785--1882[label="0.00884956;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="154.101.132.176" src_port="25"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786739" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,004,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_47{
style=filled;
color=gray75;
822[label="37.212.253.155;d;187pkt 187fpkt", shape=diamond, color=yellow];
stat47[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:445, 37.212.253.155:*}[86.631%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (43.3155%)&lt;BR/&gt; 7364: (5.34759%)&lt;BR/&gt; 0: (2.6738%)&lt;BR/&gt; 3747: (0.534759%)&lt;BR/&gt; 3247: (0.534759%)&gt;];
}
822--830[label="0.00534759;1pkt 1fpkt"];
822--1085[label="0.00534759;1pkt 1fpkt"];
822--2506[label="0.00561798;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="37.212.253.155" src_port="445"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786451" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_48{
style=filled;
color=gray75;
890[label="50.200.12.29;d;2pkt 2fpkt", shape=diamond, color=yellow];
902[label="187.77.80.33;s;4pkt 4fpkt", shape=diamond, color=yellow];
2527[label="187.77.80.33;s;4pkt 4fpkt", shape=hexagon, color=black];
stat48[shape=component, label=&lt;Rules:&lt;BR/&gt;{187.77.80.33:42800, 210.199.180.21:80}[25%]&lt;BR/&gt;{187.77.80.33:44659, 210.199.180.21:80}[25%]&lt;BR/&gt;{187.77.80.33:42503, 50.200.12.29:80}[25%]&lt;BR/&gt;{187.77.80.33:48694, 50.200.12.29:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 48694: (15%)&lt;BR/&gt; 42503: (15%)&lt;BR/&gt; 44659: (10%)&lt;BR/&gt; 42800: (10%)&gt;];
}
890--902[label="1;2pkt 2fpkt"];
890--2527[label="1;2pkt 2fpkt"];
902--2527[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="50.200.12.29" dst_port="80" src_ip="187.77.80.33" src_port="48694"/>
      <filter dst_ip="50.200.12.29" dst_port="80" src_ip="187.77.80.33" src_port="42503"/>
      <filter dst_ip="210.199.180.21" dst_port="80" src_ip="187.77.80.33" src_port="44659"/>
      <filter dst_ip="210.199.180.21" dst_port="80" src_ip="187.77.80.33" src_port="42800"/>
    </slice>
    <from sec="1230786388" usec="0"/>
    <to sec="1230786535" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="164.114.212.146"/>
      <from sec="1230786061" usec="0"/>
      <to sec="1230786466" usec="0"/>
    </slice>
    <from sec="1230786061" usec="0"/>
    <to sec="1230786466" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="84.8.43.34"/>
      <from sec="1230786685" usec="0"/>
      <to sec="1230786829" usec="0"/>
    </slice>
    <from sec="1230786685" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_52{
style=filled;
color=gray75;
931[label="164.114.210.156;s;2pkt 2fpkt", shape=diamond, color=yellow];
990[label="49.100.30.218;d;1pkt 1fpkt", shape=diamond, color=yellow];
2553[label="49.100.30.218;d;1pkt 1fpkt", shape=hexagon, color=black];
stat52[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.114.210.156:80, 48.187.170.50:43147}[50%]&lt;BR/&gt;{164.114.210.156:80, 49.100.30.218:41618}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 41618: (37.5%)&lt;BR/&gt; 43147: (12.5%)&gt;];
}
931--990[label="1;1pkt 1fpkt"];
931--2553[label="1;1pkt 1fpkt"];
990--2553[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="49.100.30.218" dst_port="41618" src_ip="164.114.210.156" src_port="80"/>
      <filter dst_ip="48.187.170.50" dst_port="43147" src_ip="164.114.210.156" src_port="80"/>
    </slice>
    <from sec="1230786057" usec="0"/>
    <to sec="1230786157" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="48.200.199.78"/>
      <from sec="1230786473" usec="0"/>
      <to sec="1230786524" usec="0"/>
    </slice>
    <from sec="1230786473" usec="0"/>
    <to sec="1230786524" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_54{
style=filled;
color=gray75;
776[label="6.236.105.47;d;1pkt 1fpkt", shape=diamond, color=yellow];
1059[label="164.114.197.163;s;57pkt 57fpkt", shape=diamond, color=yellow];
2648[label="6.236.105.47;d;1pkt 1fpkt", shape=hexagon, color=black];
2649[label="164.114.197.163;s;57pkt 57fpkt", shape=hexagon, color=black];
stat54[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.114.197.163:*, 202.150.104.133:53}[21.0526%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (41.3793%)&lt;BR/&gt; 25: (6.03448%)&lt;BR/&gt; 49927: (1.72414%)&lt;BR/&gt; 1194: (1.72414%)&lt;BR/&gt; 64704: (0.862069%)&gt;];
}
776--1059[label="1;1pkt 1fpkt"];
776--2648[label="1;1pkt 1fpkt"];
776--2649[label="1;1pkt 1fpkt"];
1059--2648[label="1;1pkt 1fpkt"];
1059--2649[label="1;57pkt 57fpkt"];
2648--2649[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="202.150.104.133" dst_port="53" src_ip="164.114.197.163"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_55{
style=filled;
color=gray75;
1074[label="164.114.190.48;s;457pkt 457fpkt", shape=diamond, color=yellow];
stat55[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.114.190.48:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1074--2362[label="0.00512821;1pkt 1fpkt"];
1074--3154[label="0.00512821;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="164.114.190.48"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_56{
style=filled;
color=gray75;
1077[label="152.74.34.0;s;499pkt 499fpkt", shape=diamond, color=yellow];
stat56[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.74.34.0:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1077--1438[label="0.00278552;1pkt 1fpkt"];
1077--1617[label="0.0026178;1pkt 1fpkt"];
1077--1621[label="0.00244499;1pkt 1fpkt"];
1077--1624[label="0.00246305;1pkt 1fpkt"];
1077--1625[label="0.0025;1pkt 1fpkt"];
1077--1632[label="0.0027027;1pkt 1fpkt"];
1077--1647[label="0.00250627;1pkt 1fpkt"];
1077--1815[label="0.00308642;1pkt 1fpkt"];
1077--1816[label="0.00344828;1pkt 1fpkt"];
1077--1823[label="0.0030303;1pkt 1fpkt"];
1077--1843[label="0.0030581;1pkt 1fpkt"];
1077--2212[label="0.00406504;1pkt 1fpkt"];
1077--2806[label="0.00340136;1pkt 1fpkt"];
1077--2972[label="0.00342466;1pkt 1fpkt"];
1077--2975[label="0.00271739;1pkt 1fpkt"];
1077--2981[label="0.00344828;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="152.74.34.0"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.787119,1.48264,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_58{
style=filled;
color=gray75;
817[label="160.131.245.179;d;2441pkt 2441fpkt", shape=diamond, color=yellow];
1091[label="210.66.169.184;s;1391pkt 1391fpkt", shape=diamond, color=yellow];
2736[label="160.131.245.179;d;1477pkt 1477fpkt", shape=hexagon, color=black];
2921[label="210.66.169.184;s;1241pkt 1241fpkt", shape=hexagon, color=black];
4021[label="213.93.47.96;392pkt 392fpkt", shape=pentagon, color=darkviolet];
stat58[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.66.169.184:*, 160.131.245.179:27191}[61.9086%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 27191: (49.9856%)&lt;BR/&gt; 3781: (0.0648228%)&lt;BR/&gt; 3617: (0.0648228%)&lt;BR/&gt; 2819: (0.0648228%)&lt;BR/&gt; 2120: (0.0648228%)&gt;];
}
817--1091[label="1;1391pkt 1391fpkt"];
817--2638[label="0.000409668;1pkt 1fpkt"];
817--2736[label="1;1477pkt 1477fpkt"];
817--2921[label="1;1241pkt 1241fpkt"];
817--4021[label="0.971939;381pkt 381fpkt"];
1091--2736[label="0.675773;940pkt 940fpkt"];
1091--2921[label="1;1241pkt 1241fpkt"];
2736--2921[label="0.757454;940pkt 940fpkt"];
2736--4021[label="0.581633;228pkt 228fpkt"];
</description>
    <slice>
      <filter dst_ip="160.131.245.179" dst_port="27191" src_ip="210.66.169.184"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786899" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,002,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="193.26.137.29"/>
      <from sec="1230786001" usec="0"/>
      <to sec="1230786738" usec="0"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786738" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="164.114.4.9"/>
      <from sec="1230786003" usec="0"/>
      <to sec="1230786737" usec="0"/>
    </slice>
    <from sec="1230786003" usec="0"/>
    <to sec="1230786737" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_66{
style=filled;
color=gray75;
1442[label="35.139.171.95;s;1pkt 1fpkt", shape=diamond, color=yellow];
1443[label="164.114.5.113;d;11pkt 11fpkt", shape=diamond, color=yellow];
2717[label="35.139.171.95;s;1pkt 1fpkt", shape=hexagon, color=black];
stat66[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 164.114.5.113:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 49538: (11.5385%)&lt;BR/&gt; 37344: (11.5385%)&lt;BR/&gt; 52932: (3.84615%)&lt;BR/&gt; 50155: (3.84615%)&lt;BR/&gt; 47828: (3.84615%)&gt;];
}
1442--1443[label="1;1pkt 1fpkt"];
1442--2717[label="1;1pkt 1fpkt"];
1443--2717[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="164.114.5.113"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.919689,1.51124,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_67{
style=filled;
color=gray75;
742[label="154.101.17.82;s;125pkt 125fpkt", shape=diamond, color=yellow];
1451[label="35.52.57.9;d;2pkt 2fpkt", shape=diamond, color=yellow];
1503[label="60.114.61.35;d;1pkt 1fpkt", shape=diamond, color=yellow];
3927[label="154.101.17.82;136pkt 136fpkt", shape=pentagon, color=darkviolet];
5134[label="154.101.17.82;136pkt 136fpkt", shape=invtriangle, color=brown];
5605[label="154.101.17.82;136pkt 136fpkt", shape=invhouse, color=bisque];
stat67[shape=component, label=&lt;Rules:&lt;BR/&gt;{154.101.17.82:31878, *:*}[91.9118%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 31878: (45.6157%)&lt;BR/&gt; 443: (1.1194%)&lt;BR/&gt; 9114: (0.932836%)&lt;BR/&gt; 50795: (0.466418%)&lt;BR/&gt; 4856: (0.466418%)&gt;];
}
742--1451[label="1;2pkt 2fpkt"];
742--1503[label="1;1pkt 1fpkt"];
742--3232[label="0.008;1pkt 1fpkt"];
742--3246[label="0.008;1pkt 1fpkt"];
742--3265[label="0.008;1pkt 1fpkt"];
742--3270[label="0.008;1pkt 1fpkt"];
742--3278[label="0.008;1pkt 1fpkt"];
742--3291[label="0.008;1pkt 1fpkt"];
742--3310[label="0.008;1pkt 1fpkt"];
742--3314[label="0.008;1pkt 1fpkt"];
742--3327[label="0.008;1pkt 1fpkt"];
742--3346[label="0.008;1pkt 1fpkt"];
742--3927[label="1;125pkt 125fpkt"];
742--5134[label="1;125pkt 125fpkt"];
742--5605[label="1;125pkt 125fpkt"];
1451--3927[label="1;2pkt 2fpkt"];
1451--5134[label="1;2pkt 2fpkt"];
1451--5605[label="1;2pkt 2fpkt"];
1503--3927[label="1;1pkt 1fpkt"];
1503--5134[label="1;1pkt 1fpkt"];
1503--5605[label="1;1pkt 1fpkt"];
3927--5134[label="1;136pkt 136fpkt"];
3927--5605[label="1;136pkt 136fpkt"];
5134--5605[label="1;136pkt 136fpkt"];
</description>
    <slice>
      <filter src_ip="154.101.17.82" src_port="31878"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786895" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,010,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_68{
style=filled;
color=gray75;
1458[label="160.48.135.5;s;382pkt 382fpkt", shape=diamond, color=yellow];
stat68[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.48.135.5:*, 81.88.164.141:28221}[29.8429%]&lt;BR/&gt;{160.48.135.5:65013, *:*}[27.7487%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 28221: (19.1099%)&lt;BR/&gt; 65013: (13.8743%)&lt;BR/&gt; 4661: (4.31937%)&lt;BR/&gt; 8911: (4.18848%)&lt;BR/&gt; 8899: (4.18848%)&gt;];
}
1458--3269[label="0.0026178;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="160.48.135.5" src_port="65013"/>
      <filter dst_ip="81.88.164.141" dst_port="28221" src_ip="160.48.135.5"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_69{
style=filled;
color=gray75;
1226[label="154.101.17.82;d;77pkt 77fpkt", shape=diamond, color=yellow];
1504[label="60.114.61.35;s;1pkt 1fpkt", shape=diamond, color=yellow];
3117[label="60.114.61.35;s;1pkt 1fpkt", shape=hexagon, color=black];
stat69[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 154.101.17.82:31878}[97.4026%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 31878: (47.4684%)&lt;BR/&gt; 50795: (1.89873%)&lt;BR/&gt; 3980: (1.89873%)&lt;BR/&gt; 0: (1.26582%)&lt;BR/&gt; 65207: (0.632911%)&gt;];
}
1226--1504[label="1;1pkt 1fpkt"];
1226--3117[label="1;1pkt 1fpkt"];
1504--3117[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="154.101.17.82" dst_port="31878"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786825" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="152.74.186.9"/>
      <from sec="1230786022" usec="0"/>
      <to sec="1230786822" usec="0"/>
    </slice>
    <from sec="1230786022" usec="0"/>
    <to sec="1230786822" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.919689,1.51124,010,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_71{
style=filled;
color=gray75;
1467[label="154.101.16.93;s;40pkt 40fpkt", shape=diamond, color=yellow];
1566[label="80.45.4.140;d;1pkt 1fpkt", shape=diamond, color=yellow];
4004[label="154.101.16.93;50pkt 50fpkt", shape=pentagon, color=darkviolet];
5163[label="154.101.16.93;50pkt 50fpkt", shape=invtriangle, color=brown];
5620[label="154.101.16.93;50pkt 50fpkt", shape=invhouse, color=bisque];
stat71[shape=component, label=&lt;Rules:&lt;BR/&gt;{154.101.16.93:*, 209.58.96.176:6112}[44%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6112: (40.5759%)&lt;BR/&gt; 80: (7.32984%)&lt;BR/&gt; 6194: (2.09424%)&lt;BR/&gt; 49680: (1.3089%)&lt;BR/&gt; 49735: (1.04712%)&gt;];
}
1467--1566[label="1;1pkt 1fpkt"];
1467--4004[label="1;40pkt 40fpkt"];
1467--5163[label="1;40pkt 40fpkt"];
1467--5620[label="1;40pkt 40fpkt"];
1566--4004[label="1;1pkt 1fpkt"];
1566--5163[label="1;1pkt 1fpkt"];
1566--5620[label="1;1pkt 1fpkt"];
4004--5163[label="1;50pkt 50fpkt"];
4004--5620[label="1;50pkt 50fpkt"];
5163--5620[label="1;50pkt 50fpkt"];
</description>
    <slice>
      <filter dst_ip="209.58.96.176" dst_port="6112" src_ip="154.101.16.93"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_72{
style=filled;
color=gray75;
1435[label="164.114.66.226;d;3pkt 3fpkt", shape=diamond, color=yellow];
1591[label="209.158.193.225;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat72[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.22.140.57:4311, 164.114.66.226:445}[33.3333%]&lt;BR/&gt;{129.166.186.92:1034, 164.114.66.226:445}[33.3333%]&lt;BR/&gt;{209.158.193.225:3572, 164.114.66.226:1039}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3572: (25%)&lt;BR/&gt; 1039: (25%)&lt;BR/&gt; 445: (25%)&lt;BR/&gt; 4311: (12.5%)&lt;BR/&gt; 1034: (12.5%)&gt;];
}
1435--1591[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="164.114.66.226" dst_port="1039" src_ip="209.158.193.225" src_port="3572"/>
      <filter dst_ip="164.114.66.226" dst_port="445" src_ip="129.166.186.92" src_port="1034"/>
      <filter dst_ip="164.114.66.226" dst_port="445" src_ip="217.22.140.57" src_port="4311"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_73{
style=filled;
color=gray75;
1633[label="154.101.18.146;d;812pkt 812fpkt", shape=diamond, color=yellow];
stat73[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:20129, 154.101.18.146:20129}[79.064%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 20129: (89.2857%)&lt;BR/&gt; 20128: (0.246305%)&lt;BR/&gt; 80: (0.184729%)&lt;BR/&gt; 60001: (0.123153%)&lt;BR/&gt; 2890: (0.123153%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="154.101.18.146" dst_port="20129" src_port="20129"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_74{
style=filled;
color=gray75;
1656[label="192.168.128.255;d;1pkt 1fpkt", shape=diamond, color=yellow];
1657[label="164.114.72.138;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat74[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.114.72.138:4445, 192.168.128.255:4445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4445: (100%)&gt;];
}
1656--1657[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="192.168.128.255" dst_port="4445" src_ip="164.114.72.138" src_port="4445"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_75{
style=filled;
color=gray75;
1696[label="192.231.28.66;s;179pkt 179fpkt", shape=diamond, color=yellow];
stat75[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.231.28.66:25, *:*}[54.1899%]&lt;BR/&gt;{192.231.28.66:*, *:113}[45.2514%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (27.095%)&lt;BR/&gt; 113: (22.6257%)&lt;BR/&gt; 64346: (0.27933%)&lt;BR/&gt; 64342: (0.27933%)&lt;BR/&gt; 64321: (0.27933%)&gt;];
}
</description>
    <slice>
      <filter src_ip="192.231.28.66" src_port="25"/>
      <filter dst_port="113" src_ip="192.231.28.66"/>
    </slice>
    <from sec="1230786003" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.787119,1.48264,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_76{
style=filled;
color=gray75;
1718[label="160.48.170.13;d;888pkt 888fpkt", shape=diamond, color=yellow];
1719[label="81.198.152.154;s;780pkt 780fpkt", shape=diamond, color=yellow];
2855[label="160.48.170.13;d;583pkt 583fpkt", shape=hexagon, color=black];
4349[label="81.198.152.154;941pkt 941fpkt", shape=pentagon, color=darkviolet];
stat76[shape=component, label=&lt;Rules:&lt;BR/&gt;{81.198.152.154:*, 160.48.170.13:41130}[99.8938%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 41130: (49.9843%)&lt;BR/&gt; 4937: (0.0626566%)&lt;BR/&gt; 4927: (0.0626566%)&lt;BR/&gt; 4924: (0.0626566%)&lt;BR/&gt; 4886: (0.0626566%)&gt;];
}
1718--1719[label="1;780pkt 780fpkt"];
1718--2855[label="1;583pkt 583fpkt"];
1718--4349[label="0.998874;887pkt 887fpkt"];
1719--2855[label="1;583pkt 583fpkt"];
1719--4349[label="1;780pkt 780fpkt"];
2855--4349[label="1;583pkt 583fpkt"];
</description>
    <slice>
      <filter dst_ip="160.48.170.13" dst_port="41130" src_ip="81.198.152.154"/>
    </slice>
    <from sec="1230786007" usec="0"/>
    <to sec="1230786893" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_77{
style=filled;
color=gray75;
1740[label="187.77.42.56;s;41pkt 41fpkt", shape=diamond, color=yellow];
1789[label="49.100.16.190;d;2pkt 2fpkt", shape=diamond, color=yellow];
2884[label="49.100.16.190;d;2pkt 2fpkt", shape=hexagon, color=black];
3130[label="187.77.42.56;s;41pkt 41fpkt", shape=hexagon, color=black];
stat77[shape=component, label=&lt;Rules:&lt;BR/&gt;{187.77.42.56:*, 201.69.110.17:53}[24.3902%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (36.0465%)&lt;BR/&gt; 113: (4.65116%)&lt;BR/&gt; 80: (4.65116%)&lt;BR/&gt; 25: (4.65116%)&lt;BR/&gt; 47877: (2.32558%)&gt;];
}
1740--1789[label="1;2pkt 2fpkt"];
1740--2884[label="1;2pkt 2fpkt"];
1740--3130[label="1;41pkt 41fpkt"];
1789--2884[label="1;2pkt 2fpkt"];
1789--3130[label="1;2pkt 2fpkt"];
2884--3130[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="201.69.110.17" dst_port="53" src_ip="187.77.42.56"/>
    </slice>
    <from sec="1230786029" usec="0"/>
    <to sec="1230786816" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.863625,1.45226,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_78{
style=filled;
color=gray75;
1798[label="49.100.31.102;d;1pkt 1fpkt", shape=diamond, color=yellow];
1799[label="192.231.24.44;s;1pkt 1fpkt", shape=diamond, color=yellow];
2887[label="192.231.24.44;s;1pkt 1fpkt", shape=hexagon, color=black];
3660[label="192.231.24.44;4pkt 4fpkt", shape=pentagon, color=darkviolet];
5027[label="192.231.24.44;4pkt 4fpkt", shape=invtriangle, color=brown];
stat78[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.231.24.44:80, 49.100.31.102:42649}[25%]&lt;BR/&gt;{192.231.24.44:80, 58.189.115.84:40426}[25%]&lt;BR/&gt;{192.231.24.44:80, 58.189.115.84:54240}[25%]&lt;BR/&gt;{192.231.24.44:80, 58.189.115.84:60216}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 42649: (22.7273%)&lt;BR/&gt; 60216: (9.09091%)&lt;BR/&gt; 54240: (9.09091%)&lt;BR/&gt; 40426: (9.09091%)&gt;];
}
1798--1799[label="1;1pkt 1fpkt"];
1798--2887[label="1;1pkt 1fpkt"];
1798--3660[label="1;1pkt 1fpkt"];
1798--5027[label="1;1pkt 1fpkt"];
1799--2887[label="1;1pkt 1fpkt"];
1799--3660[label="1;1pkt 1fpkt"];
1799--5027[label="1;1pkt 1fpkt"];
2887--3660[label="1;1pkt 1fpkt"];
2887--5027[label="1;1pkt 1fpkt"];
3660--5027[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="58.189.115.84" dst_port="60216" src_ip="192.231.24.44" src_port="80"/>
      <filter dst_ip="58.189.115.84" dst_port="54240" src_ip="192.231.24.44" src_port="80"/>
      <filter dst_ip="58.189.115.84" dst_port="40426" src_ip="192.231.24.44" src_port="80"/>
      <filter dst_ip="49.100.31.102" dst_port="42649" src_ip="192.231.24.44" src_port="80"/>
    </slice>
    <from sec="1230786528" usec="0"/>
    <to sec="1230786883" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.658853,1.50038,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_79{
style=filled;
color=gray75;
1806[label="164.114.137.142;s;1pkt 1fpkt", shape=diamond, color=yellow];
1807[label="2.39.97.158;d;6pkt 6fpkt", shape=diamond, color=yellow];
4270[label="164.114.137.142;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5257[label="164.114.137.142;1pkt 1fpkt", shape=invtriangle, color=brown];
stat79[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 2.39.97.158:0}[66.6667%]&lt;BR/&gt;{*:80, 2.39.97.158:40334}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (44.4444%)&lt;BR/&gt; 40334: (27.7778%)&lt;BR/&gt; 80: (27.7778%)&gt;];
}
1806--1807[label="1;1pkt 1fpkt"];
1806--4270[label="1;1pkt 1fpkt"];
1806--5257[label="1;1pkt 1fpkt"];
1807--4270[label="1;1pkt 1fpkt"];
1807--5257[label="1;1pkt 1fpkt"];
4270--5257[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="2.39.97.158"/>
      <filter dst_ip="2.39.97.158" dst_port="40334" src_port="80"/>
    </slice>
    <from sec="1230786550" usec="0"/>
    <to sec="1230786553" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="160.180.67.196"/>
      <from sec="1230786001" usec="0"/>
      <to sec="1230786829" usec="0"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="160.131.91.120"/>
      <from sec="1230786001" usec="0"/>
      <to sec="1230786829" usec="0"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="43.20.84.148"/>
      <from sec="1230786001" usec="0"/>
      <to sec="1230786829" usec="0"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="160.131.168.178"/>
      <from sec="1230786002" usec="0"/>
      <to sec="1230786733" usec="0"/>
    </slice>
    <from sec="1230786002" usec="0"/>
    <to sec="1230786733" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="160.38.145.136"/>
      <from sec="1230786037" usec="0"/>
      <to sec="1230786739" usec="0"/>
    </slice>
    <from sec="1230786037" usec="0"/>
    <to sec="1230786739" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="152.74.93.178"/>
      <from sec="1230786078" usec="0"/>
      <to sec="1230786829" usec="0"/>
    </slice>
    <from sec="1230786078" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.658853,1.50038,011,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_86{
style=filled;
color=gray75;
1968[label="160.48.115.76;d;1pkt 1fpkt", shape=diamond, color=yellow];
1969[label="4.183.68.204;s;1pkt 1fpkt", shape=diamond, color=yellow];
4643[label="4.183.68.204;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5406[label="4.183.68.204;1pkt 1fpkt", shape=invtriangle, color=brown];
stat86[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.183.68.204:6000, 160.48.115.76:440}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6000: (50%)&lt;BR/&gt; 440: (50%)&gt;];
}
1968--1969[label="1;1pkt 1fpkt"];
1968--4643[label="1;1pkt 1fpkt"];
1968--5406[label="1;1pkt 1fpkt"];
1969--4643[label="1;1pkt 1fpkt"];
1969--5406[label="1;1pkt 1fpkt"];
4643--5406[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="160.48.115.76" dst_port="440" src_ip="4.183.68.204" src_port="6000"/>
    </slice>
    <from sec="1230786592" usec="0"/>
    <to sec="1230786596" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.554793,1.5298,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_87{
style=filled;
color=gray75;
1854[label="164.114.76.172;d;126pkt 126fpkt", shape=diamond, color=yellow];
1983[label="199.29.130.64;s;2pkt 2fpkt", shape=diamond, color=yellow];
2171[label="73.144.235.223;s;8pkt 8fpkt", shape=diamond, color=yellow];
4411[label="197.120.210.164;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat87[shape=component, label=&lt;Rules:&lt;BR/&gt;{40.232.185.209:80, 164.114.76.172:*}[46.0317%]&lt;BR/&gt;{193.39.168.71:80, 164.114.76.172:*}[21.4286%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.9051%)&lt;BR/&gt; 8810: (0.729927%)&lt;BR/&gt; 8794: (0.729927%)&lt;BR/&gt; 8786: (0.729927%)&lt;BR/&gt; 8770: (0.729927%)&gt;];
}
1854--1983[label="1;2pkt 2fpkt"];
1854--2171[label="1;8pkt 8fpkt"];
1854--2446[label="0.00793651;1pkt 1fpkt"];
1854--4411[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="164.114.76.172" src_ip="40.232.185.209" src_port="80"/>
      <filter dst_ip="164.114.76.172" src_ip="193.39.168.71" src_port="80"/>
    </slice>
    <from sec="1230786002" usec="0"/>
    <to sec="1230786852" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_89{
style=filled;
color=gray75;
2002[label="154.101.17.163;s;446pkt 446fpkt", shape=diamond, color=yellow];
stat89[shape=component, label=&lt;Rules:&lt;BR/&gt;{154.101.17.163:47197, *:*}[95.9641%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 47197: (47.9821%)&lt;BR/&gt; 80: (1.4574%)&lt;BR/&gt; 6881: (0.672646%)&lt;BR/&gt; 59813: (0.224215%)&lt;BR/&gt; 21870: (0.224215%)&gt;];
}
2002--3232[label="0.0112108;5pkt 5fpkt"];
2002--3278[label="0.0112108;5pkt 5fpkt"];
2002--3314[label="0.0112108;5pkt 5fpkt"];
</description>
    <slice>
      <filter src_ip="154.101.17.163" src_port="47197"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="182.8.1.51"/>
      <from sec="1230786001" usec="0"/>
      <to sec="1230786739" usec="0"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786739" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,020,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="182.8.1.51"/>
      <from sec="1230786001" usec="0"/>
      <to sec="1230786739" usec="0"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786739" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.787119,1.48264,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_92{
style=filled;
color=gray75;
2027[label="152.74.106.172;d;1pkt 1fpkt", shape=diamond, color=yellow];
2028[label="212.93.138.134;s;1pkt 1fpkt", shape=diamond, color=yellow];
3101[label="152.74.106.172;d;1pkt 1fpkt", shape=hexagon, color=black];
4214[label="212.93.138.134;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat92[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.93.138.134:24032, 152.74.106.172:24196}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 24196: (50%)&lt;BR/&gt; 24032: (50%)&gt;];
}
2027--2028[label="1;1pkt 1fpkt"];
2027--3101[label="1;1pkt 1fpkt"];
2027--4214[label="1;1pkt 1fpkt"];
2028--3101[label="1;1pkt 1fpkt"];
2028--4214[label="1;1pkt 1fpkt"];
3101--4214[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="152.74.106.172" dst_port="24196" src_ip="212.93.138.134" src_port="24032"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,011,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_93{
style=filled;
color=gray75;
1283[label="2.240.92.43;s;390pkt 390fpkt", shape=diamond, color=yellow];
2050[label="156.36.3.179;d;175pkt 175fpkt", shape=diamond, color=yellow];
2053[label="156.36.49.31;d;197pkt 197fpkt", shape=diamond, color=yellow];
stat93[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.240.92.43:6667, 156.36.49.31:*}[50.1279%]&lt;BR/&gt;{2.240.92.43:6667, 156.36.3.179:*}[49.6164%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6667: (49.9344%)&lt;BR/&gt; 4877: (0.131234%)&lt;BR/&gt; 4876: (0.131234%)&lt;BR/&gt; 4875: (0.131234%)&lt;BR/&gt; 4874: (0.131234%)&gt;];
}
1283--2050[label="1;175pkt 175fpkt"];
1283--2053[label="0.994924;196pkt 196fpkt"];
2053--2180[label="0.00507614;1pkt 1fpkt"];
2053--3074[label="0.00507614;1pkt 1fpkt"];
2053--3222[label="0.00507614;1pkt 1fpkt"];
2053--3273[label="0.00507614;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="156.36.49.31" src_ip="2.240.92.43" src_port="6667"/>
      <filter dst_ip="156.36.3.179" src_ip="2.240.92.43" src_port="6667"/>
    </slice>
    <from sec="1230786002" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_94{
style=filled;
color=gray75;
2064[label="156.36.107.101;d;2pkt 2fpkt", shape=diamond, color=yellow];
2065[label="200.124.0.108;s;1pkt 1fpkt", shape=diamond, color=yellow];
stat94[shape=component, label=&lt;Rules:&lt;BR/&gt;{200.124.0.108:6662, 156.36.107.101:1626}[50%]&lt;BR/&gt;{49.4.136.240:5050, 156.36.107.101:1030}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6662: (33.3333%)&lt;BR/&gt; 1626: (33.3333%)&lt;BR/&gt; 5050: (16.6667%)&lt;BR/&gt; 1030: (16.6667%)&gt;];
}
2064--2065[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="156.36.107.101" dst_port="1030" src_ip="49.4.136.240" src_port="5050"/>
      <filter dst_ip="156.36.107.101" dst_port="1626" src_ip="200.124.0.108" src_port="6662"/>
    </slice>
    <from sec="1230786004" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_95{
style=filled;
color=gray75;
2083[label="193.26.136.104;s;545pkt 545fpkt", shape=diamond, color=yellow];
stat95[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.26.136.104:*, *:53}[95.2294%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (47.7982%)&lt;BR/&gt; 0: (4.22018%)&lt;BR/&gt; 64971: (0.183486%)&lt;BR/&gt; 64772: (0.183486%)&lt;BR/&gt; 63053: (0.183486%)&gt;];
}
2083--2197[label="0.00798403;4pkt 4fpkt"];
2083--2205[label="0.00392927;2pkt 2fpkt"];
2083--2261[label="0.0110092;6pkt 6fpkt"];
2083--2283[label="0.0110092;6pkt 6fpkt"];
2083--2500[label="0.00183486;1pkt 1fpkt"];
2083--3089[label="0.00392927;2pkt 2fpkt"];
2083--3132[label="0.0110092;6pkt 6fpkt"];
2083--3269[label="0.0110092;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_port="53" src_ip="193.26.136.104"/>
    </slice>
    <from sec="1230786013" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_96{
style=filled;
color=gray75;
2112[label="49.100.16.109;d;14pkt 14fpkt", shape=diamond, color=yellow];
2113[label="187.77.211.95;s;11pkt 11fpkt", shape=diamond, color=yellow];
stat96[shape=component, label=&lt;Rules:&lt;BR/&gt;{187.77.211.95:80, 49.100.16.109:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 65246: (4%)&lt;BR/&gt; 62842: (4%)&lt;BR/&gt; 61498: (4%)&lt;BR/&gt; 61091: (4%)&gt;];
}
2112--2113[label="1;11pkt 11fpkt"];
</description>
    <slice>
      <filter dst_ip="49.100.16.109" src_ip="187.77.211.95" src_port="80"/>
    </slice>
    <from sec="1230786327" usec="0"/>
    <to sec="1230786827" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.554793,1.5298,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_97{
style=filled;
color=gray75;
2178[label="49.100.16.110;d;1pkt 1fpkt", shape=diamond, color=yellow];
2179[label="160.38.217.186;s;1pkt 1fpkt", shape=diamond, color=yellow];
4541[label="160.38.217.186;2pkt 2fpkt", shape=pentagon, color=darkviolet];
stat97[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.38.217.186:80, 49.100.16.110:54147}[50%]&lt;BR/&gt;{160.38.217.186:80, 49.100.16.110:59352}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 54147: (37.5%)&lt;BR/&gt; 59352: (12.5%)&gt;];
}
2178--2179[label="1;1pkt 1fpkt"];
2178--4541[label="1;1pkt 1fpkt"];
2179--4541[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="49.100.16.110" dst_port="59352" src_ip="160.38.217.186" src_port="80"/>
      <filter dst_ip="49.100.16.110" dst_port="54147" src_ip="160.38.217.186" src_port="80"/>
    </slice>
    <from sec="1230786324" usec="0"/>
    <to sec="1230786693" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,504,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_98{
style=filled;
color=gray75;
1810[label="154.101.41.115;s;68pkt 68fpkt", shape=diamond, color=yellow];
2193[label="56.165.189.101;d;23pkt 23fpkt", shape=diamond, color=yellow];
2966[label="154.101.41.115;s;66pkt 66fpkt", shape=hexagon, color=black];
stat98[shape=component, label=&lt;Rules:&lt;BR/&gt;{154.101.41.115:11378, *:*}[55.8824%]&lt;BR/&gt;{154.101.41.115:*, 56.165.189.101:443}[33.8235%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 11378: (24.2038%)&lt;BR/&gt; 443: (21.3376%)&lt;BR/&gt; 80: (1.91083%)&lt;BR/&gt; 44522: (1.27389%)&lt;BR/&gt; 2446: (1.27389%)&gt;];
}
1810--2193[label="1;23pkt 23fpkt"];
1810--2966[label="1;66pkt 66fpkt"];
1810--3246[label="0.0147059;1pkt 1fpkt"];
1810--3265[label="0.0147059;1pkt 1fpkt"];
1810--3270[label="0.0147059;1pkt 1fpkt"];
1810--3291[label="0.0147059;1pkt 1fpkt"];
1810--3310[label="0.0147059;1pkt 1fpkt"];
1810--3327[label="0.0147059;1pkt 1fpkt"];
1810--3346[label="0.0147059;1pkt 1fpkt"];
2193--2966[label="0.913043;21pkt 21fpkt"];
2966--3246[label="0.0151515;1pkt 1fpkt"];
2966--3265[label="0.0151515;1pkt 1fpkt"];
2966--3270[label="0.0151515;1pkt 1fpkt"];
2966--3291[label="0.0151515;1pkt 1fpkt"];
2966--3310[label="0.0151515;1pkt 1fpkt"];
2966--3327[label="0.0151515;1pkt 1fpkt"];
2966--3346[label="0.0151515;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="154.101.41.115" src_port="11378"/>
      <filter dst_ip="56.165.189.101" dst_port="443" src_ip="154.101.41.115"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786826" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="152.74.176.34"/>
      <from sec="1230786001" usec="0"/>
      <to sec="1230786829" usec="0"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.658853,1.50038,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_100{
style=filled;
color=gray75;
1293[label="154.101.32.134;s;14pkt 14fpkt", shape=diamond, color=yellow];
2252[label="49.100.16.16;d;22pkt 22fpkt", shape=diamond, color=yellow];
4209[label="154.101.32.134;14pkt 14fpkt", shape=pentagon, color=darkviolet];
5235[label="154.101.32.134;14pkt 14fpkt", shape=invtriangle, color=brown];
stat100[shape=component, label=&lt;Rules:&lt;BR/&gt;{154.101.32.134:80, 49.100.16.16:*}[65.2174%]&lt;BR/&gt;{160.38.192.241:80, 49.100.16.16:*}[26.087%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 63580: (3.125%)&lt;BR/&gt; 61135: (3.125%)&lt;BR/&gt; 58605: (3.125%)&lt;BR/&gt; 55288: (3.125%)&gt;];
}
1293--2252[label="1;14pkt 14fpkt"];
1293--3230[label="0.0714286;1pkt 1fpkt"];
1293--3276[label="0.0714286;1pkt 1fpkt"];
1293--4209[label="0.928571;13pkt 13fpkt"];
1293--5235[label="0.928571;13pkt 13fpkt"];
2252--3230[label="0.0454545;1pkt 1fpkt"];
2252--3276[label="0.0454545;1pkt 1fpkt"];
2252--4209[label="0.928571;13pkt 13fpkt"];
2252--5235[label="0.928571;13pkt 13fpkt"];
4209--5235[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter dst_ip="49.100.16.16" src_ip="154.101.32.134" src_port="80"/>
      <filter dst_ip="49.100.16.16" src_ip="160.38.192.241" src_port="80"/>
    </slice>
    <from sec="1230786005" usec="0"/>
    <to sec="1230786855" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,503,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_101{
style=filled;
color=gray75;
2274[label="49.100.24.65;d;45pkt 45fpkt", shape=diamond, color=yellow];
2275[label="160.38.146.118;s;45pkt 45fpkt", shape=diamond, color=yellow];
stat101[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.38.146.118:80, 49.100.24.65:*}[95.6522%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.4444%)&lt;BR/&gt; 65404: (1.11111%)&lt;BR/&gt; 64228: (1.11111%)&lt;BR/&gt; 63955: (1.11111%)&lt;BR/&gt; 62884: (1.11111%)&gt;];
}
2274--2275[label="0.977778;44pkt 44fpkt"];
2274--3230[label="0.0222222;1pkt 1fpkt"];
2274--3276[label="0.0222222;1pkt 1fpkt"];
2275--3230[label="0.0222222;1pkt 1fpkt"];
2275--3276[label="0.0222222;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="49.100.24.65" src_ip="160.38.146.118" src_port="80"/>
    </slice>
    <from sec="1230786014" usec="0"/>
    <to sec="1230786793" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="84.96.69.254"/>
      <from sec="1230786312" usec="0"/>
      <to sec="1230786829" usec="0"/>
    </slice>
    <from sec="1230786312" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_108{
style=filled;
color=gray75;
3387[label="160.38.164.5;23pkt 23fpkt", shape=pentagon, color=darkviolet];
3873[label="165.66.36.74;52pkt 52fpkt", shape=pentagon, color=darkviolet];
4461[label="154.101.185.174;53pkt 53fpkt", shape=pentagon, color=darkviolet];
stat108[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.66.36.74:80, 49.100.30.123:*}[38.2812%]&lt;BR/&gt;{154.101.185.174:80, 49.100.16.98:*}[38.2812%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.2188%)&lt;BR/&gt; 123: (1.5625%)&lt;BR/&gt; 65518: (0.390625%)&lt;BR/&gt; 65313: (0.390625%)&lt;BR/&gt; 64713: (0.390625%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="49.100.16.98" src_ip="154.101.185.174" src_port="80"/>
      <filter dst_ip="49.100.30.123" src_ip="165.66.36.74" src_port="80"/>
    </slice>
    <from sec="1230786005" usec="0"/>
    <to sec="1230786898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.75455,1.61773,901,0 0 0 0 1 0 0 0 0 0 0 0 ">
    <slice>
      <filter dst_ip="0.0.0.0"/>
      <from sec="1230786001" usec="0"/>
      <to sec="1230786739" usec="0"/>
    </slice>
    <from sec="0" usec="0"/>
    <to sec="0" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.75455,1.61773,901,0 0 0 0 1 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="0.0.0.0"/>
      <from sec="1230786001" usec="0"/>
      <to sec="1230786649" usec="0"/>
    </slice>
    <from sec="32285112" usec="0"/>
    <to sec="32285112" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_113{
style=filled;
color=gray75;
644[label="164.114.79.210;s;240pkt 240fpkt", shape=diamond, color=yellow];
2453[label="164.114.79.210;s;61pkt 61fpkt", shape=hexagon, color=black];
stat113[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.114.79.210:25, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 62065: (0.332226%)&lt;BR/&gt; 54374: (0.332226%)&lt;BR/&gt; 50990: (0.332226%)&lt;BR/&gt; 50303: (0.332226%)&gt;];
}
644--2453[label="1;61pkt 61fpkt"];
</description>
    <slice>
      <filter src_ip="164.114.79.210" src_port="25"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786827" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.787119,1.48264,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_114{
style=filled;
color=gray75;
677[label="154.101.18.243;s;59pkt 59fpkt", shape=diamond, color=yellow];
1348[label="84.97.170.193;d;1pkt 1fpkt", shape=diamond, color=yellow];
1581[label="4.182.125.232;d;1pkt 1fpkt", shape=diamond, color=yellow];
2466[label="154.101.18.243;s;36pkt 36fpkt", shape=hexagon, color=black];
4846[label="154.101.18.243;63pkt 63fpkt", shape=pentagon, color=darkviolet];
stat114[shape=component, label=&lt;Rules:&lt;BR/&gt;{154.101.18.243:8889, *:8000}[39.6825%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8889: (44.6875%)&lt;BR/&gt; 8000: (21.25%)&lt;BR/&gt; 80: (4.0625%)&lt;BR/&gt; 9800: (1.25%)&lt;BR/&gt; 1968: (1.25%)&gt;];
}
677--1348[label="1;1pkt 1fpkt"];
677--1581[label="1;1pkt 1fpkt"];
677--2466[label="1;36pkt 36fpkt"];
677--4846[label="1;59pkt 59fpkt"];
1348--2466[label="1;1pkt 1fpkt"];
1348--4846[label="1;1pkt 1fpkt"];
1581--4846[label="1;1pkt 1fpkt"];
2466--4846[label="1;36pkt 36fpkt"];
</description>
    <slice>
      <filter dst_port="8000" src_ip="154.101.18.243" src_port="8889"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786805" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_116{
style=filled;
color=gray75;
378[label="192.231.8.111;d;4232pkt 4232fpkt", shape=diamond, color=yellow];
2482[label="192.231.8.111;d;1191pkt 1191fpkt", shape=hexagon, color=black];
stat116[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 192.231.8.111:6881}[99.5274%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6881: (50.0922%)&lt;BR/&gt; 16001: (1.04186%)&lt;BR/&gt; 0: (0.460999%)&lt;BR/&gt; 1501: (0.2766%)&lt;BR/&gt; 21588: (0.10142%)&gt;];
}
378--1163[label="0.000236295;1pkt 1fpkt"];
378--2482[label="1;1191pkt 1191fpkt"];
378--2616[label="0.000236295;1pkt 1fpkt"];
378--3187[label="0.000236295;1pkt 1fpkt"];
378--3263[label="0.000236295;1pkt 1fpkt"];
378--3308[label="0.000236295;1pkt 1fpkt"];
378--3344[label="0.000236295;1pkt 1fpkt"];
378--4610[label="0.000236295;1pkt 1fpkt"];
378--5391[label="0.000236295;1pkt 1fpkt"];
378--5707[label="0.000236295;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="192.231.8.111" dst_port="6881"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786739" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_117{
style=filled;
color=gray75;
830[label="192.231.24.22;s;626pkt 626fpkt", shape=diamond, color=yellow];
2506[label="192.231.24.22;s;178pkt 178fpkt", shape=hexagon, color=black];
stat117[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.231.24.22:0, *:0}[99.8403%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.8756%)&lt;BR/&gt; 6000: (0.0621891%)&lt;BR/&gt; 2967: (0.0621891%)&gt;];
}
830--1162[label="0.00159744;1pkt 1fpkt"];
830--2506[label="1;178pkt 178fpkt"];
</description>
    <slice>
      <filter src_ip="192.231.24.22"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_120{
style=filled;
color=gray75;
904[label="49.100.30.85;d;75pkt 75fpkt", shape=diamond, color=yellow];
905[label="160.38.216.75;s;43pkt 43fpkt", shape=diamond, color=yellow];
2530[label="160.38.216.75;s;35pkt 35fpkt", shape=hexagon, color=black];
stat120[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.38.216.75:80, 49.100.30.85:*}[53.2468%]&lt;BR/&gt;{160.38.236.39:80, 49.100.30.85:*}[36.3636%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.0392%)&lt;BR/&gt; 443: (1.96078%)&lt;BR/&gt; 65340: (0.980392%)&lt;BR/&gt; 62777: (0.980392%)&lt;BR/&gt; 59505: (0.980392%)&gt;];
}
904--905[label="0.953488;41pkt 41fpkt"];
904--2530[label="0.942857;33pkt 33fpkt"];
904--3230[label="0.04;3pkt 3fpkt"];
904--3276[label="0.04;3pkt 3fpkt"];
905--2530[label="1;35pkt 35fpkt"];
905--3230[label="0.0465116;2pkt 2fpkt"];
905--3276[label="0.0465116;2pkt 2fpkt"];
2530--3230[label="0.0571429;2pkt 2fpkt"];
2530--3276[label="0.0571429;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="49.100.30.85" src_ip="160.38.216.75" src_port="80"/>
      <filter dst_ip="49.100.30.85" src_ip="160.38.236.39" src_port="80"/>
    </slice>
    <from sec="1230786019" usec="0"/>
    <to sec="1230786824" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.787119,1.48264,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_121{
style=filled;
color=gray75;
498[label="154.101.18.244;d;26pkt 26fpkt", shape=diamond, color=yellow];
584[label="199.127.16.159;s;6pkt 6fpkt", shape=diamond, color=yellow];
594[label="58.152.136.196;s;1pkt 1fpkt", shape=diamond, color=yellow];
611[label="56.179.138.177;s;1pkt 1fpkt", shape=diamond, color=yellow];
977[label="48.179.185.81;s;1pkt 1fpkt", shape=diamond, color=yellow];
1137[label="56.179.168.31;s;1pkt 1fpkt", shape=diamond, color=yellow];
1352[label="56.179.160.111;s;1pkt 1fpkt", shape=diamond, color=yellow];
2538[label="58.152.136.196;s;1pkt 1fpkt", shape=hexagon, color=black];
2679[label="56.179.160.111;s;1pkt 1fpkt", shape=hexagon, color=black];
4597[label="58.152.136.196;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat121[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:1935, 154.101.18.244:*}[30.7692%]&lt;BR/&gt;{199.127.16.159:80, 154.101.18.244:*}[23.0769%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (25%)&lt;BR/&gt; 1935: (20%)&lt;BR/&gt; 2879: (5%)&lt;BR/&gt; 2914: (3.75%)&lt;BR/&gt; 2913: (2.5%)&gt;];
}
498--584[label="1;6pkt 6fpkt"];
498--594[label="1;1pkt 1fpkt"];
498--611[label="1;1pkt 1fpkt"];
498--977[label="1;1pkt 1fpkt"];
498--1137[label="1;1pkt 1fpkt"];
498--1352[label="1;1pkt 1fpkt"];
498--2538[label="1;1pkt 1fpkt"];
498--2679[label="1;1pkt 1fpkt"];
498--3230[label="0.0384615;1pkt 1fpkt"];
498--3276[label="0.0384615;1pkt 1fpkt"];
498--4597[label="1;1pkt 1fpkt"];
594--2538[label="1;1pkt 1fpkt"];
594--4597[label="1;1pkt 1fpkt"];
1352--2679[label="1;1pkt 1fpkt"];
2538--4597[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="154.101.18.244" src_port="1935"/>
      <filter dst_ip="154.101.18.244" src_ip="199.127.16.159" src_port="80"/>
    </slice>
    <from sec="1230786003" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_126{
style=filled;
color=gray75;
1114[label="160.33.121.43;d;64pkt 64fpkt", shape=diamond, color=yellow];
2604[label="160.33.121.43;d;38pkt 38fpkt", shape=hexagon, color=black];
stat126[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 160.33.121.43:25}[98.4375%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (49.0196%)&lt;BR/&gt; 0: (2.45098%)&lt;BR/&gt; 64883: (0.980392%)&lt;BR/&gt; 63246: (0.980392%)&lt;BR/&gt; 62261: (0.980392%)&gt;];
}
1114--2604[label="1;38pkt 38fpkt"];
</description>
    <slice>
      <filter dst_ip="160.33.121.43" dst_port="25"/>
    </slice>
    <from sec="1230786026" usec="0"/>
    <to sec="1230786712" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_131{
style=filled;
color=gray75;
1269[label="160.48.162.62;s;669pkt 669fpkt", shape=diamond, color=yellow];
2658[label="160.48.162.62;s;669pkt 669fpkt", shape=hexagon, color=black];
stat131[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.48.162.62:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1269--1438[label="0.00278552;1pkt 1fpkt"];
1269--1621[label="0.00244499;1pkt 1fpkt"];
1269--1625[label="0.0025;1pkt 1fpkt"];
1269--1632[label="0.0027027;1pkt 1fpkt"];
1269--1647[label="0.00250627;1pkt 1fpkt"];
1269--1815[label="0.00308642;1pkt 1fpkt"];
1269--1816[label="0.00344828;1pkt 1fpkt"];
1269--1823[label="0.0030303;1pkt 1fpkt"];
1269--1843[label="0.0030581;1pkt 1fpkt"];
1269--2212[label="0.00406504;1pkt 1fpkt"];
1269--2658[label="1;669pkt 669fpkt"];
1269--2806[label="0.00340136;1pkt 1fpkt"];
1269--2972[label="0.00342466;1pkt 1fpkt"];
1269--2975[label="0.00271739;1pkt 1fpkt"];
1269--2981[label="0.00344828;1pkt 1fpkt"];
2658--2806[label="0.00340136;1pkt 1fpkt"];
2658--2972[label="0.00342466;1pkt 1fpkt"];
2658--2975[label="0.00271739;1pkt 1fpkt"];
2658--2981[label="0.00344828;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="160.48.162.62"/>
    </slice>
    <from sec="1230786002" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.787119,1.48264,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_133{
style=filled;
color=gray75;
1086[label="160.48.167.82;d;27pkt 27fpkt", shape=diamond, color=yellow];
2660[label="160.48.167.82;d;25pkt 25fpkt", shape=hexagon, color=black];
3493[label="85.136.194.18;5pkt 5fpkt", shape=pentagon, color=darkviolet];
4553[label="218.168.230.188;4pkt 4fpkt", shape=pentagon, color=darkviolet];
stat133[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 160.48.167.82:993}[85.7143%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 993: (44.2623%)&lt;BR/&gt; 443: (4.91803%)&lt;BR/&gt; 50606: (2.45902%)&lt;BR/&gt; 50598: (2.45902%)&lt;BR/&gt; 50597: (2.45902%)&gt;];
}
1086--2660[label="1;25pkt 25fpkt"];
1086--3493[label="0.8;4pkt 4fpkt"];
1086--4553[label="1;4pkt 4fpkt"];
2660--3493[label="0.6;3pkt 3fpkt"];
2660--4553[label="0.75;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="160.48.167.82" dst_port="993"/>
    </slice>
    <from sec="1230786002" usec="0"/>
    <to sec="1230786883" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,504,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_134{
style=filled;
color=gray75;
485[label="160.48.167.82;s;224pkt 224fpkt", shape=diamond, color=yellow];
1748[label="11.160.41.49;d;13pkt 13fpkt", shape=diamond, color=yellow];
2295[label="2.111.17.94;d;46pkt 46fpkt", shape=diamond, color=yellow];
stat134[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.48.167.82:995, *:*}[29.9107%]&lt;BR/&gt;{160.48.167.82:443, 2.111.17.94:*}[20.0893%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (27.0318%)&lt;BR/&gt; 995: (14.1343%)&lt;BR/&gt; 993: (6.36042%)&lt;BR/&gt; 143: (1.94346%)&lt;BR/&gt; 80: (0.530035%)&gt;];
}
485--947[label="0.0196078;1pkt 1fpkt"];
485--1748[label="1;13pkt 13fpkt"];
485--2295[label="1;46pkt 46fpkt"];
485--2676[label="0.0196078;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="160.48.167.82" src_port="995"/>
      <filter dst_ip="2.111.17.94" src_ip="160.48.167.82" src_port="443"/>
    </slice>
    <from sec="1230786002" usec="0"/>
    <to sec="1230786825" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.787119,1.48264,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_135{
style=filled;
color=gray75;
220[label="192.231.29.222;s;814pkt 814fpkt", shape=diamond, color=yellow];
2698[label="192.231.29.222;s;591pkt 591fpkt", shape=hexagon, color=black];
4736[label="192.231.29.222;937pkt 937fpkt", shape=pentagon, color=darkviolet];
stat135[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.231.29.222:*, *:53}[81.3234%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (38.8557%)&lt;BR/&gt; 0: (22.1178%)&lt;BR/&gt; 62086: (0.170794%)&lt;BR/&gt; 64753: (0.128096%)&lt;BR/&gt; 64128: (0.128096%)&gt;];
}
220--2698[label="1;591pkt 591fpkt"];
220--3269[label="0.0614251;50pkt 50fpkt"];
220--4736[label="1;814pkt 814fpkt"];
2698--3269[label="0.00169205;1pkt 1fpkt"];
2698--4736[label="1;591pkt 591fpkt"];
</description>
    <slice>
      <filter dst_port="53" src_ip="192.231.29.222"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_139{
style=filled;
color=gray75;
1471[label="164.114.52.109;s;93pkt 93fpkt", shape=diamond, color=yellow];
2735[label="164.114.52.109;s;79pkt 79fpkt", shape=hexagon, color=black];
stat139[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.114.52.109:25, *:*}[95.6989%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (48.5465%)&lt;BR/&gt; 53: (1.45349%)&lt;BR/&gt; 1533: (0.872093%)&lt;BR/&gt; 63018: (0.581395%)&lt;BR/&gt; 62332: (0.581395%)&gt;];
}
1471--2735[label="1;79pkt 79fpkt"];
</description>
    <slice>
      <filter src_ip="164.114.52.109" src_port="25"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786825" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.863625,1.45226,999,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_140{
style=filled;
color=gray75;
1501[label="202.209.180.236;s;46pkt 46fpkt", shape=diamond, color=yellow];
2743[label="202.209.180.236;s;35pkt 35fpkt", shape=hexagon, color=black];
4821[label="202.209.180.236;50pkt 50fpkt", shape=pentagon, color=darkviolet];
5481[label="202.209.180.236;50pkt 50fpkt", shape=invtriangle, color=brown];
stat140[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.209.180.236:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1501--2743[label="1;35pkt 35fpkt"];
1501--4821[label="1;46pkt 46fpkt"];
1501--5481[label="1;46pkt 46fpkt"];
2743--4821[label="1;35pkt 35fpkt"];
2743--5481[label="1;35pkt 35fpkt"];
4821--5481[label="1;50pkt 50fpkt"];
</description>
    <slice>
      <filter src_ip="202.209.180.236"/>
    </slice>
    <from sec="1230786003" usec="0"/>
    <to sec="1230786900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,504,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_141{
style=filled;
color=gray75;
1115[label="160.33.127.102;d;212pkt 212fpkt", shape=diamond, color=yellow];
1116[label="212.36.38.47;s;100pkt 100fpkt", shape=diamond, color=yellow];
1126[label="80.27.173.126;s;114pkt 114fpkt", shape=diamond, color=yellow];
2762[label="80.27.173.126;s;114pkt 114fpkt", shape=hexagon, color=black];
stat141[shape=component, label=&lt;Rules:&lt;BR/&gt;{80.27.173.126:*, 160.33.127.102:443}[52.3364%]&lt;BR/&gt;{212.36.38.47:*, 160.33.127.102:443}[46.729%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (49.6296%)&lt;BR/&gt; 64023: (0.277778%)&lt;BR/&gt; 64022: (0.277778%)&lt;BR/&gt; 64021: (0.277778%)&lt;BR/&gt; 64020: (0.277778%)&gt;];
}
1115--1116[label="1;100pkt 100fpkt"];
1115--1126[label="0.982456;112pkt 112fpkt"];
1115--2762[label="0.982456;112pkt 112fpkt"];
1126--2762[label="1;114pkt 114fpkt"];
</description>
    <slice>
      <filter dst_ip="160.33.127.102" dst_port="443" src_ip="80.27.173.126"/>
      <filter dst_ip="160.33.127.102" dst_port="443" src_ip="212.36.38.47"/>
    </slice>
    <from sec="1230786029" usec="0"/>
    <to sec="1230786343" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.787119,1.48264,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_143{
style=filled;
color=gray75;
650[label="154.101.18.252;d;39pkt 39fpkt", shape=diamond, color=yellow];
651[label="193.196.1.169;s;2pkt 2fpkt", shape=diamond, color=yellow];
2776[label="193.196.1.169;s;2pkt 2fpkt", shape=hexagon, color=black];
4432[label="193.196.1.169;4pkt 4fpkt", shape=pentagon, color=darkviolet];
stat143[shape=component, label=&lt;Rules:&lt;BR/&gt;{52.33.155.17:80, 154.101.18.252:*}[56.4103%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (37.234%)&lt;BR/&gt; 6970: (6.38298%)&lt;BR/&gt; 554: (6.38298%)&lt;BR/&gt; 30598: (4.25532%)&lt;BR/&gt; 2570: (4.25532%)&gt;];
}
650--651[label="1;2pkt 2fpkt"];
650--2776[label="1;2pkt 2fpkt"];
650--3230[label="0.0512821;2pkt 2fpkt"];
650--3276[label="0.0512821;2pkt 2fpkt"];
650--4432[label="1;4pkt 4fpkt"];
651--2776[label="1;2pkt 2fpkt"];
651--4432[label="1;2pkt 2fpkt"];
2776--4432[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="154.101.18.252" src_ip="52.33.155.17" src_port="80"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786792" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.863625,1.45226,020,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_145{
style=filled;
color=gray75;
1020[label="192.231.28.56;s;510pkt 510fpkt", shape=diamond, color=yellow];
2793[label="192.231.28.56;s;498pkt 498fpkt", shape=hexagon, color=black];
3743[label="192.231.28.56;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5058[label="192.231.28.56;2pkt 2fpkt", shape=invtriangle, color=brown];
stat145[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.231.28.56:0, *:0}[99.8039%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.8024%)&lt;BR/&gt; 6000: (0.0988142%)&lt;BR/&gt; 2967: (0.0988142%)&gt;];
}
1020--1162[label="0.00392157;2pkt 2fpkt"];
1020--1438[label="0.00278552;1pkt 1fpkt"];
1020--1647[label="0.00250627;1pkt 1fpkt"];
1020--1816[label="0.00344828;1pkt 1fpkt"];
1020--2383[label="0.00775194;1pkt 1fpkt"];
1020--2793[label="1;498pkt 498fpkt"];
1020--2813[label="0.00925926;1pkt 1fpkt"];
1020--3743[label="1;2pkt 2fpkt"];
1020--5058[label="1;2pkt 2fpkt"];
2793--2813[label="0.00925926;1pkt 1fpkt"];
2793--3743[label="1;2pkt 2fpkt"];
2793--5058[label="1;2pkt 2fpkt"];
3743--5058[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_ip="192.231.28.56"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_147{
style=filled;
color=gray75;
1047[label="193.26.137.29;s;96pkt 96fpkt", shape=diamond, color=yellow];
2807[label="193.26.137.29;s;82pkt 82fpkt", shape=hexagon, color=black];
stat147[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.26.137.29:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1047--2807[label="1;82pkt 82fpkt"];
</description>
    <slice>
      <filter src_ip="193.26.137.29"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.787119,1.48264,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_149{
style=filled;
color=gray75;
1290[label="154.101.46.11;d;75pkt 75fpkt", shape=diamond, color=yellow];
1701[label="192.195.46.205;s;55pkt 55fpkt", shape=diamond, color=yellow];
2841[label="154.101.46.11;d;57pkt 57fpkt", shape=hexagon, color=black];
4650[label="192.195.46.205;60pkt 60fpkt", shape=pentagon, color=darkviolet];
stat149[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.195.46.205:*, 154.101.46.11:80}[69.7674%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 50036: (0.809717%)&lt;BR/&gt; 49923: (0.809717%)&lt;BR/&gt; 49820: (0.809717%)&lt;BR/&gt; 49732: (0.809717%)&gt;];
}
1290--1358[label="0.02;1pkt 1fpkt"];
1290--1701[label="0.890909;49pkt 49fpkt"];
1290--2683[label="0.02;1pkt 1fpkt"];
1290--2841[label="1;57pkt 57fpkt"];
1290--3200[label="0.02;1pkt 1fpkt"];
1290--3232[label="0.04;3pkt 3fpkt"];
1290--3246[label="0.0533333;4pkt 4fpkt"];
1290--3265[label="0.0666667;5pkt 5fpkt"];
1290--3270[label="0.0666667;5pkt 5fpkt"];
1290--3278[label="0.04;3pkt 3fpkt"];
1290--3291[label="0.0533333;4pkt 4fpkt"];
1290--3310[label="0.0666667;5pkt 5fpkt"];
1290--3314[label="0.04;3pkt 3fpkt"];
1290--3327[label="0.0533333;4pkt 4fpkt"];
1290--3346[label="0.0666667;5pkt 5fpkt"];
1290--4650[label="0.816667;49pkt 49fpkt"];
1701--2841[label="0.672727;37pkt 37fpkt"];
1701--3232[label="0.0545455;3pkt 3fpkt"];
1701--3246[label="0.0545455;3pkt 3fpkt"];
1701--3265[label="0.0545455;3pkt 3fpkt"];
1701--3270[label="0.0545455;3pkt 3fpkt"];
1701--3278[label="0.0545455;3pkt 3fpkt"];
1701--3291[label="0.0545455;3pkt 3fpkt"];
1701--3310[label="0.0545455;3pkt 3fpkt"];
1701--3314[label="0.0545455;3pkt 3fpkt"];
1701--3327[label="0.0545455;3pkt 3fpkt"];
1701--3346[label="0.0545455;3pkt 3fpkt"];
1701--4650[label="1;55pkt 55fpkt"];
2841--3200[label="0.02;1pkt 1fpkt"];
2841--3232[label="0.0526316;3pkt 3fpkt"];
2841--3246[label="0.0701754;4pkt 4fpkt"];
2841--3265[label="0.0877193;5pkt 5fpkt"];
2841--3270[label="0.0350877;2pkt 2fpkt"];
2841--3278[label="0.0526316;3pkt 3fpkt"];
2841--3291[label="0.0701754;4pkt 4fpkt"];
2841--3310[label="0.0877193;5pkt 5fpkt"];
2841--3314[label="0.0526316;3pkt 3fpkt"];
2841--3327[label="0.0701754;4pkt 4fpkt"];
2841--3346[label="0.0877193;5pkt 5fpkt"];
2841--4650[label="0.649123;37pkt 37fpkt"];
</description>
    <slice>
      <filter dst_ip="154.101.46.11" dst_port="80" src_ip="192.195.46.205"/>
    </slice>
    <from sec="1230786004" usec="0"/>
    <to sec="1230786892" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.787119,1.48264,503,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_150{
style=filled;
color=gray75;
862[label="164.114.145.107;s;156pkt 156fpkt", shape=diamond, color=yellow];
1430[label="201.139.202.167;d;70pkt 70fpkt", shape=diamond, color=yellow];
2843[label="164.114.145.107;s;129pkt 129fpkt", shape=hexagon, color=black];
4079[label="164.114.145.107;167pkt 167fpkt", shape=pentagon, color=darkviolet];
stat150[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.114.145.107:*, 201.139.202.167:80}[44.0476%]&lt;BR/&gt;{164.114.145.107:*, 199.127.31.232:80}[22.619%]&lt;BR/&gt;{164.114.145.107:*, 199.127.21.82:80}[21.4286%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (48.9464%)&lt;BR/&gt; 995: (0.766284%)&lt;BR/&gt; 3424: (0.383142%)&lt;BR/&gt; 3418: (0.383142%)&lt;BR/&gt; 3412: (0.383142%)&gt;];
}
862--1430[label="0.985714;69pkt 69fpkt"];
862--1468[label="0.0128205;2pkt 2fpkt"];
862--2843[label="1;129pkt 129fpkt"];
862--3002[label="0.0128205;2pkt 2fpkt"];
862--3230[label="0.00641026;1pkt 1fpkt"];
862--3232[label="0.0512821;8pkt 8fpkt"];
862--3246[label="0.0384615;6pkt 6fpkt"];
862--3265[label="0.0384615;6pkt 6fpkt"];
862--3270[label="0.0384615;6pkt 6fpkt"];
862--3276[label="0.00641026;1pkt 1fpkt"];
862--3278[label="0.0512821;8pkt 8fpkt"];
862--3291[label="0.0384615;6pkt 6fpkt"];
862--3310[label="0.0384615;6pkt 6fpkt"];
862--3314[label="0.0512821;8pkt 8fpkt"];
862--3327[label="0.0384615;6pkt 6fpkt"];
862--3346[label="0.0384615;6pkt 6fpkt"];
862--4079[label="1;156pkt 156fpkt"];
1430--2843[label="0.814286;57pkt 57fpkt"];
1430--3232[label="0.0714286;5pkt 5fpkt"];
1430--3246[label="0.0428571;3pkt 3fpkt"];
1430--3265[label="0.0428571;3pkt 3fpkt"];
1430--3270[label="0.0428571;3pkt 3fpkt"];
1430--3278[label="0.0714286;5pkt 5fpkt"];
1430--3291[label="0.0428571;3pkt 3fpkt"];
1430--3310[label="0.0428571;3pkt 3fpkt"];
1430--3314[label="0.0714286;5pkt 5fpkt"];
1430--3327[label="0.0428571;3pkt 3fpkt"];
1430--3346[label="0.0428571;3pkt 3fpkt"];
1430--4079[label="0.985714;69pkt 69fpkt"];
2843--3002[label="0.0155039;2pkt 2fpkt"];
2843--3230[label="0.00775194;1pkt 1fpkt"];
2843--3232[label="0.0620155;8pkt 8fpkt"];
2843--3246[label="0.0465116;6pkt 6fpkt"];
2843--3265[label="0.0465116;6pkt 6fpkt"];
2843--3270[label="0.0465116;6pkt 6fpkt"];
2843--3276[label="0.00775194;1pkt 1fpkt"];
2843--3278[label="0.0620155;8pkt 8fpkt"];
2843--3291[label="0.0465116;6pkt 6fpkt"];
2843--3310[label="0.0465116;6pkt 6fpkt"];
2843--3314[label="0.0620155;8pkt 8fpkt"];
2843--3327[label="0.0465116;6pkt 6fpkt"];
2843--3346[label="0.0465116;6pkt 6fpkt"];
2843--4079[label="1;129pkt 129fpkt"];
</description>
    <slice>
      <filter dst_ip="201.139.202.167" dst_port="80" src_ip="164.114.145.107"/>
      <filter dst_ip="199.127.31.232" dst_port="80" src_ip="164.114.145.107"/>
      <filter dst_ip="199.127.21.82" dst_port="80" src_ip="164.114.145.107"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786896" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_151{
style=filled;
color=gray75;
517[label="193.26.136.40;s;1264pkt 1264fpkt", shape=diamond, color=yellow];
2851[label="193.26.136.40;s;836pkt 836fpkt", shape=hexagon, color=black];
stat151[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.26.136.40:4672, *:*}[83.3861%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4672: (48.0238%)&lt;BR/&gt; 80: (2.11905%)&lt;BR/&gt; 4662: (1.52381%)&lt;BR/&gt; 2886: (1.38095%)&lt;BR/&gt; 4665: (0.833333%)&gt;];
}
517--1858[label="0.414286;29pkt 29fpkt"];
517--2851[label="1;836pkt 836fpkt"];
517--3232[label="0.00158228;2pkt 2fpkt"];
517--3246[label="0.00316456;4pkt 4fpkt"];
517--3265[label="0.00158228;2pkt 2fpkt"];
517--3270[label="0.00474684;6pkt 6fpkt"];
517--3278[label="0.00158228;2pkt 2fpkt"];
517--3291[label="0.0039557;5pkt 5fpkt"];
517--3310[label="0.00158228;2pkt 2fpkt"];
517--3314[label="0.00158228;2pkt 2fpkt"];
517--3327[label="0.00316456;4pkt 4fpkt"];
517--3346[label="0.00158228;2pkt 2fpkt"];
2851--3232[label="0.00239234;2pkt 2fpkt"];
2851--3246[label="0.00478469;4pkt 4fpkt"];
2851--3265[label="0.00239234;2pkt 2fpkt"];
2851--3270[label="0.00478469;4pkt 4fpkt"];
2851--3278[label="0.00239234;2pkt 2fpkt"];
2851--3291[label="0.00478469;4pkt 4fpkt"];
2851--3310[label="0.00239234;2pkt 2fpkt"];
2851--3314[label="0.00239234;2pkt 2fpkt"];
2851--3327[label="0.00478469;4pkt 4fpkt"];
2851--3346[label="0.00239234;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_ip="193.26.136.40" src_port="4672"/>
    </slice>
    <from sec="1230786005" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.863625,1.45226,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_153{
style=filled;
color=gray75;
500[label="192.231.22.200;d;643pkt 643fpkt", shape=diamond, color=yellow];
835[label="192.231.22.129;d;521pkt 521fpkt", shape=diamond, color=yellow];
836[label="219.168.246.37;s;642pkt 642fpkt", shape=diamond, color=yellow];
883[label="192.29.97.19;s;28pkt 28fpkt", shape=diamond, color=yellow];
1110[label="85.96.40.86;s;339pkt 339fpkt", shape=diamond, color=yellow];
1725[label="81.242.150.149;s;142pkt 142fpkt", shape=diamond, color=yellow];
2603[label="85.96.40.86;s;339pkt 339fpkt", shape=hexagon, color=black];
2662[label="219.168.246.37;s;642pkt 642fpkt", shape=hexagon, color=black];
2754[label="192.29.97.19;s;26pkt 26fpkt", shape=hexagon, color=black];
2859[label="81.242.150.149;s;93pkt 93fpkt", shape=hexagon, color=black];
3497[label="192.29.97.19;29pkt 29fpkt", shape=pentagon, color=darkviolet];
4960[label="192.29.97.19;30pkt 30fpkt", shape=invtriangle, color=brown];
stat153[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 192.231.22.129:80}[44.7684%]&lt;BR/&gt;{219.168.246.37:*, 192.231.22.200:80}[36.5352%]&lt;BR/&gt;{85.96.40.86:*, *:80}[29.0738%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.9712%)&lt;BR/&gt; 46851: (0.0719632%)&lt;BR/&gt; 46850: (0.0719632%)&lt;BR/&gt; 46848: (0.0719632%)&lt;BR/&gt; 46847: (0.0719632%)&gt;];
}
500--836[label="0.663551;426pkt 426fpkt"];
500--1110[label="0.637168;216pkt 216fpkt"];
500--1163[label="0.00155521;1pkt 1fpkt"];
500--2603[label="0.637168;216pkt 216fpkt"];
500--2616[label="0.00155521;1pkt 1fpkt"];
500--2662[label="0.663551;426pkt 426fpkt"];
500--3187[label="0.00155521;1pkt 1fpkt"];
500--3232[label="0.0575428;37pkt 37fpkt"];
500--3246[label="0.0653188;42pkt 42fpkt"];
500--3263[label="0.00155521;1pkt 1fpkt"];
500--3265[label="0.0684292;44pkt 44fpkt"];
500--3270[label="0.059098;38pkt 38fpkt"];
500--3278[label="0.0575428;37pkt 37fpkt"];
500--3291[label="0.0653188;42pkt 42fpkt"];
500--3308[label="0.00155521;1pkt 1fpkt"];
500--3310[label="0.0684292;44pkt 44fpkt"];
500--3314[label="0.0575428;37pkt 37fpkt"];
500--3327[label="0.0653188;42pkt 42fpkt"];
500--3344[label="0.00155521;1pkt 1fpkt"];
500--3346[label="0.0684292;44pkt 44fpkt"];
500--4610[label="0.00155521;1pkt 1fpkt"];
500--5391[label="0.00155521;1pkt 1fpkt"];
500--5707[label="0.00155521;1pkt 1fpkt"];
835--836[label="0.414587;216pkt 216fpkt"];
835--883[label="1;28pkt 28fpkt"];
835--1110[label="0.362832;123pkt 123fpkt"];
835--1163[label="0.00191939;1pkt 1fpkt"];
835--1725[label="1;142pkt 142fpkt"];
835--2603[label="0.362832;123pkt 123fpkt"];
835--2616[label="0.00191939;1pkt 1fpkt"];
835--2662[label="0.414587;216pkt 216fpkt"];
835--2754[label="1;26pkt 26fpkt"];
835--2859[label="1;93pkt 93fpkt"];
835--3187[label="0.00191939;1pkt 1fpkt"];
835--3232[label="0.0614203;32pkt 32fpkt"];
835--3246[label="0.059501;31pkt 31fpkt"];
835--3263[label="0.00191939;1pkt 1fpkt"];
835--3265[label="0.059501;31pkt 31fpkt"];
835--3270[label="0.0575816;30pkt 30fpkt"];
835--3278[label="0.0614203;32pkt 32fpkt"];
835--3291[label="0.059501;31pkt 31fpkt"];
835--3308[label="0.00191939;1pkt 1fpkt"];
835--3310[label="0.059501;31pkt 31fpkt"];
835--3314[label="0.0614203;32pkt 32fpkt"];
835--3327[label="0.059501;31pkt 31fpkt"];
835--3344[label="0.00191939;1pkt 1fpkt"];
835--3346[label="0.059501;31pkt 31fpkt"];
835--3497[label="0.931034;27pkt 27fpkt"];
835--4610[label="0.00191939;1pkt 1fpkt"];
835--4960[label="0.933333;28pkt 28fpkt"];
835--5391[label="0.00191939;1pkt 1fpkt"];
835--5707[label="0.00191939;1pkt 1fpkt"];
836--2662[label="1;642pkt 642fpkt"];
836--3232[label="0.0638629;41pkt 41fpkt"];
836--3246[label="0.0700935;45pkt 45fpkt"];
836--3265[label="0.076324;49pkt 49fpkt"];
836--3270[label="0.0654206;42pkt 42fpkt"];
836--3278[label="0.0638629;41pkt 41fpkt"];
836--3291[label="0.0700935;45pkt 45fpkt"];
836--3310[label="0.076324;49pkt 49fpkt"];
836--3314[label="0.0638629;41pkt 41fpkt"];
836--3327[label="0.0700935;45pkt 45fpkt"];
836--3346[label="0.076324;49pkt 49fpkt"];
883--2754[label="1;26pkt 26fpkt"];
883--3232[label="0.0714286;2pkt 2fpkt"];
883--3246[label="0.0714286;2pkt 2fpkt"];
883--3265[label="0.0714286;2pkt 2fpkt"];
883--3270[label="0.0714286;2pkt 2fpkt"];
883--3278[label="0.0714286;2pkt 2fpkt"];
883--3291[label="0.0714286;2pkt 2fpkt"];
883--3310[label="0.0714286;2pkt 2fpkt"];
883--3314[label="0.0714286;2pkt 2fpkt"];
883--3327[label="0.0714286;2pkt 2fpkt"];
883--3346[label="0.0714286;2pkt 2fpkt"];
883--3497[label="0.964286;27pkt 27fpkt"];
883--4960[label="1;28pkt 28fpkt"];
1110--2603[label="1;339pkt 339fpkt"];
1110--3232[label="0.0501475;17pkt 17fpkt"];
1110--3246[label="0.0530973;18pkt 18fpkt"];
1110--3265[label="0.0530973;18pkt 18fpkt"];
1110--3270[label="0.0501475;17pkt 17fpkt"];
1110--3278[label="0.0501475;17pkt 17fpkt"];
1110--3291[label="0.0530973;18pkt 18fpkt"];
1110--3310[label="0.0530973;18pkt 18fpkt"];
1110--3314[label="0.0501475;17pkt 17fpkt"];
1110--3327[label="0.0530973;18pkt 18fpkt"];
1110--3346[label="0.0530973;18pkt 18fpkt"];
1725--2859[label="1;93pkt 93fpkt"];
1725--3232[label="0.0492958;7pkt 7fpkt"];
1725--3246[label="0.056338;8pkt 8fpkt"];
1725--3265[label="0.0422535;6pkt 6fpkt"];
1725--3270[label="0.0492958;7pkt 7fpkt"];
1725--3278[label="0.0492958;7pkt 7fpkt"];
1725--3291[label="0.056338;8pkt 8fpkt"];
1725--3310[label="0.0422535;6pkt 6fpkt"];
1725--3314[label="0.0492958;7pkt 7fpkt"];
1725--3327[label="0.056338;8pkt 8fpkt"];
1725--3346[label="0.0422535;6pkt 6fpkt"];
2603--3232[label="0.0501475;17pkt 17fpkt"];
2603--3246[label="0.0530973;18pkt 18fpkt"];
2603--3265[label="0.0530973;18pkt 18fpkt"];
2603--3270[label="0.0501475;17pkt 17fpkt"];
2603--3278[label="0.0501475;17pkt 17fpkt"];
2603--3291[label="0.0530973;18pkt 18fpkt"];
2603--3310[label="0.0530973;18pkt 18fpkt"];
2603--3314[label="0.0501475;17pkt 17fpkt"];
2603--3327[label="0.0530973;18pkt 18fpkt"];
2603--3346[label="0.0530973;18pkt 18fpkt"];
2662--3232[label="0.0638629;41pkt 41fpkt"];
2662--3246[label="0.0700935;45pkt 45fpkt"];
2662--3265[label="0.076324;49pkt 49fpkt"];
2662--3270[label="0.0654206;42pkt 42fpkt"];
2662--3278[label="0.0638629;41pkt 41fpkt"];
2662--3291[label="0.0700935;45pkt 45fpkt"];
2662--3310[label="0.076324;49pkt 49fpkt"];
2662--3314[label="0.0638629;41pkt 41fpkt"];
2662--3327[label="0.0700935;45pkt 45fpkt"];
2662--3346[label="0.076324;49pkt 49fpkt"];
2754--3232[label="0.0769231;2pkt 2fpkt"];
2754--3246[label="0.0769231;2pkt 2fpkt"];
2754--3265[label="0.0769231;2pkt 2fpkt"];
2754--3270[label="0.0769231;2pkt 2fpkt"];
2754--3278[label="0.0769231;2pkt 2fpkt"];
2754--3291[label="0.0769231;2pkt 2fpkt"];
2754--3310[label="0.0769231;2pkt 2fpkt"];
2754--3314[label="0.0769231;2pkt 2fpkt"];
2754--3327[label="0.0769231;2pkt 2fpkt"];
2754--3346[label="0.0769231;2pkt 2fpkt"];
2754--3497[label="0.961538;25pkt 25fpkt"];
2754--4960[label="1;26pkt 26fpkt"];
2859--3232[label="0.0752688;7pkt 7fpkt"];
2859--3246[label="0.0860215;8pkt 8fpkt"];
2859--3265[label="0.0645161;6pkt 6fpkt"];
2859--3270[label="0.0322581;3pkt 3fpkt"];
2859--3278[label="0.0752688;7pkt 7fpkt"];
2859--3291[label="0.0860215;8pkt 8fpkt"];
2859--3310[label="0.0645161;6pkt 6fpkt"];
2859--3314[label="0.0752688;7pkt 7fpkt"];
2859--3327[label="0.0860215;8pkt 8fpkt"];
2859--3346[label="0.0645161;6pkt 6fpkt"];
3497--4960[label="1;29pkt 29fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="85.96.40.86"/>
      <filter dst_ip="192.231.22.129" dst_port="80"/>
      <filter dst_ip="192.231.22.200" dst_port="80" src_ip="219.168.246.37"/>
    </slice>
    <from sec="1230786002" usec="0"/>
    <to sec="1230786851" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.863625,1.45226,501,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_154{
style=filled;
color=gray75;
423[label="156.36.41.193;d;119pkt 119fpkt", shape=diamond, color=yellow];
1328[label="200.10.33.184;s;3pkt 3fpkt", shape=diamond, color=yellow];
1465[label="55.167.67.92;s;1pkt 1fpkt", shape=diamond, color=yellow];
1655[label="43.23.147.30;s;8pkt 8fpkt", shape=diamond, color=yellow];
2007[label="192.234.248.201;s;1pkt 1fpkt", shape=diamond, color=yellow];
2243[label="56.186.142.147;s;3pkt 3fpkt", shape=diamond, color=yellow];
2864[label="200.10.33.184;s;3pkt 3fpkt", shape=hexagon, color=black];
3001[label="55.167.67.92;s;1pkt 1fpkt", shape=hexagon, color=black];
3005[label="43.23.147.30;s;8pkt 8fpkt", shape=hexagon, color=black];
3119[label="56.186.142.147;s;3pkt 3fpkt", shape=hexagon, color=black];
3381[label="217.107.27.5;2pkt 2fpkt", shape=pentagon, color=darkviolet];
3909[label="214.1.106.79;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4122[label="41.181.163.117;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4285[label="194.185.195.144;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4372[label="22.84.113.158;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4412[label="54.244.210.164;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4665[label="54.242.4.209;3pkt 3fpkt", shape=pentagon, color=darkviolet];
4898[label="2.178.177.254;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5415[label="54.242.4.209;3pkt 3fpkt", shape=invtriangle, color=brown];
stat154[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 156.36.41.193:21}[78.9916%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (41.5152%)&lt;BR/&gt; 20: (6.9697%)&lt;BR/&gt; 41433: (1.81818%)&lt;BR/&gt; 61808: (0.909091%)&lt;BR/&gt; 61121: (0.909091%)&gt;];
}
423--1328[label="1;3pkt 3fpkt"];
423--1465[label="1;1pkt 1fpkt"];
423--1655[label="1;8pkt 8fpkt"];
423--2007[label="1;1pkt 1fpkt"];
423--2180[label="0.00840336;1pkt 1fpkt"];
423--2243[label="1;3pkt 3fpkt"];
423--2864[label="1;3pkt 3fpkt"];
423--3001[label="1;1pkt 1fpkt"];
423--3005[label="1;8pkt 8fpkt"];
423--3074[label="0.00840336;1pkt 1fpkt"];
423--3119[label="1;3pkt 3fpkt"];
423--3222[label="0.00840336;1pkt 1fpkt"];
423--3381[label="1;2pkt 2fpkt"];
423--3909[label="1;1pkt 1fpkt"];
423--4122[label="1;2pkt 2fpkt"];
423--4285[label="1;1pkt 1fpkt"];
423--4372[label="1;1pkt 1fpkt"];
423--4412[label="1;1pkt 1fpkt"];
423--4665[label="1;3pkt 3fpkt"];
423--4898[label="1;1pkt 1fpkt"];
423--5415[label="1;3pkt 3fpkt"];
1328--2864[label="1;3pkt 3fpkt"];
1465--3001[label="1;1pkt 1fpkt"];
1655--3005[label="1;8pkt 8fpkt"];
2243--3119[label="1;3pkt 3fpkt"];
4665--5415[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="156.36.41.193" dst_port="21"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.75455,1.61773,999,0 0 0 0 1 0 0 0 0 0 0 0 ">
    <slice>
      <filter src_ip="80.185.246.10"/>
      <from sec="1230786407" usec="0"/>
      <to sec="1230786558" usec="0"/>
    </slice>
    <from sec="1230786407" usec="0"/>
    <to sec="1230786558" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_158{
style=filled;
color=gray75;
612[label="57.235.181.66;d;192pkt 192fpkt", shape=diamond, color=yellow];
613[label="164.114.15.210;s;188pkt 188fpkt", shape=diamond, color=yellow];
2546[label="164.114.15.210;s;188pkt 188fpkt", shape=hexagon, color=black];
stat158[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.114.15.210:*, 57.235.181.66:80}[96.8912%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.3838%)&lt;BR/&gt; 53: (0.440141%)&lt;BR/&gt; 0: (0.352113%)&lt;BR/&gt; 51170: (0.264085%)&lt;BR/&gt; 51169: (0.264085%)&gt;];
}
612--613[label="0.994681;187pkt 187fpkt"];
612--2546[label="0.994681;187pkt 187fpkt"];
612--2901[label="0.0260417;5pkt 5fpkt"];
612--3265[label="0.0260417;5pkt 5fpkt"];
612--3310[label="0.0260417;5pkt 5fpkt"];
612--3346[label="0.0260417;5pkt 5fpkt"];
613--673[label="0.00531915;1pkt 1fpkt"];
613--2546[label="1;188pkt 188fpkt"];
613--3265[label="0.0265957;5pkt 5fpkt"];
613--3310[label="0.0265957;5pkt 5fpkt"];
613--3346[label="0.0265957;5pkt 5fpkt"];
2546--3265[label="0.0265957;5pkt 5fpkt"];
2546--3310[label="0.0265957;5pkt 5fpkt"];
2546--3346[label="0.0265957;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="57.235.181.66" dst_port="80" src_ip="164.114.15.210"/>
    </slice>
    <from sec="1230786098" usec="0"/>
    <to sec="1230786255" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_159{
style=filled;
color=gray75;
405[label="152.74.42.99;s;1176pkt 1176fpkt", shape=diamond, color=yellow];
471[label="152.74.42.106;s;1375pkt 1375fpkt", shape=diamond, color=yellow];
732[label="49.222.242.206;d;3035pkt 3035fpkt", shape=diamond, color=yellow];
2804[label="49.222.242.206;d;2129pkt 2129fpkt", shape=hexagon, color=black];
2912[label="152.74.42.106;s;1375pkt 1375fpkt", shape=hexagon, color=black];
stat159[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.74.42.99:1433, 49.222.242.206:*}[50.2142%]&lt;BR/&gt;{152.74.42.106:1433, 49.222.242.206:*}[49.7858%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1433: (50%)&lt;BR/&gt; 48293: (0.0385039%)&lt;BR/&gt; 47765: (0.0385039%)&lt;BR/&gt; 45074: (0.0385039%)&lt;BR/&gt; 43720: (0.0385039%)&gt;];
}
405--732[label="1;1176pkt 1176fpkt"];
405--2804[label="0.938776;1104pkt 1104fpkt"];
471--732[label="1;1375pkt 1375fpkt"];
471--2804[label="0.745455;1025pkt 1025fpkt"];
471--2912[label="1;1375pkt 1375fpkt"];
732--2804[label="1;2129pkt 2129fpkt"];
732--2912[label="1;1375pkt 1375fpkt"];
2804--2912[label="0.745455;1025pkt 1025fpkt"];
</description>
    <slice>
      <filter dst_ip="49.222.242.206" src_ip="152.74.42.99" src_port="1433"/>
      <filter dst_ip="49.222.242.206" src_ip="152.74.42.106" src_port="1433"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_160{
style=filled;
color=gray75;
1473[label="164.114.189.87;s;843pkt 843fpkt", shape=diamond, color=yellow];
2913[label="164.114.189.87;s;744pkt 744fpkt", shape=hexagon, color=black];
stat160[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.114.189.87:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1473--1617[label="0.0026178;1pkt 1fpkt"];
1473--1624[label="0.00246305;1pkt 1fpkt"];
1473--2383[label="0.00775194;1pkt 1fpkt"];
1473--2913[label="1;744pkt 744fpkt"];
</description>
    <slice>
      <filter src_ip="164.114.189.87"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.787119,1.48264,011,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_161{
style=filled;
color=gray75;
680[label="214.200.81.185;s;2362pkt 2362fpkt", shape=diamond, color=yellow];
1644[label="152.74.194.30;d;778pkt 778fpkt", shape=diamond, color=yellow];
1661[label="152.74.194.31;d;808pkt 808fpkt", shape=diamond, color=yellow];
1813[label="152.74.194.29;d;776pkt 776fpkt", shape=diamond, color=yellow];
2896[label="214.200.81.185;s;1859pkt 1859fpkt", shape=hexagon, color=black];
2914[label="152.74.194.31;d;635pkt 635fpkt", shape=hexagon, color=black];
2998[label="152.74.194.30;d;778pkt 778fpkt", shape=hexagon, color=black];
4533[label="214.200.81.185;2545pkt 2545fpkt", shape=pentagon, color=darkviolet];
stat161[shape=component, label=&lt;Rules:&lt;BR/&gt;{214.200.81.185:81, 152.74.194.31:*}[34.1425%]&lt;BR/&gt;{214.200.81.185:81, 152.74.194.29:*}[32.9287%]&lt;BR/&gt;{214.200.81.185:81, 152.74.194.30:*}[32.9287%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 81: (50%)&lt;BR/&gt; 56987: (0.0664074%)&lt;BR/&gt; 57319: (0.0521772%)&lt;BR/&gt; 62959: (0.0474338%)&lt;BR/&gt; 62013: (0.0474338%)&gt;];
}
680--1644[label="1;778pkt 778fpkt"];
680--1661[label="1;808pkt 808fpkt"];
680--1813[label="1;776pkt 776fpkt"];
680--2896[label="1;1859pkt 1859fpkt"];
680--2914[label="1;635pkt 635fpkt"];
680--2998[label="1;778pkt 778fpkt"];
680--4533[label="0.99619;2353pkt 2353fpkt"];
1644--2896[label="0.785347;611pkt 611fpkt"];
1644--2998[label="1;778pkt 778fpkt"];
1644--4533[label="0.996144;775pkt 775fpkt"];
1661--2896[label="0.785891;635pkt 635fpkt"];
1661--2914[label="1;635pkt 635fpkt"];
1661--4533[label="0.996287;805pkt 805fpkt"];
1813--2896[label="0.789948;613pkt 613fpkt"];
1813--4533[label="0.996134;773pkt 773fpkt"];
2896--2914[label="1;635pkt 635fpkt"];
2896--2998[label="0.785347;611pkt 611fpkt"];
2896--4533[label="0.995159;1850pkt 1850fpkt"];
2914--4533[label="0.995276;632pkt 632fpkt"];
2998--4533[label="0.996144;775pkt 775fpkt"];
</description>
    <slice>
      <filter dst_ip="152.74.194.31" src_ip="214.200.81.185" src_port="81"/>
      <filter dst_ip="152.74.194.30" src_ip="214.200.81.185" src_port="81"/>
      <filter dst_ip="152.74.194.29" src_ip="214.200.81.185" src_port="81"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_164{
style=filled;
color=gray75;
1726[label="164.114.39.244;s;49pkt 49fpkt", shape=diamond, color=yellow];
2932[label="164.114.39.244;s;42pkt 42fpkt", shape=hexagon, color=black];
stat164[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.114.39.244:995, 11.161.172.96:*}[24.4898%]&lt;BR/&gt;{164.114.39.244:995, 81.237.163.126:*}[24.4898%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 995: (50%)&lt;BR/&gt; 62774: (1.0989%)&lt;BR/&gt; 59020: (1.0989%)&lt;BR/&gt; 54740: (1.0989%)&lt;BR/&gt; 52238: (1.0989%)&gt;];
}
1726--2932[label="1;42pkt 42fpkt"];
</description>
    <slice>
      <filter dst_ip="81.237.163.126" src_ip="164.114.39.244" src_port="995"/>
      <filter dst_ip="11.161.172.96" src_ip="164.114.39.244" src_port="995"/>
    </slice>
    <from sec="1230786013" usec="0"/>
    <to sec="1230786727" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.787119,1.48264,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_165{
style=filled;
color=gray75;
1908[label="164.114.197.228;s;24pkt 24fpkt", shape=diamond, color=yellow];
2933[label="164.114.197.228;s;24pkt 24fpkt", shape=hexagon, color=black];
4779[label="164.114.197.228;25pkt 25fpkt", shape=pentagon, color=darkviolet];
stat165[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.114.197.228:110, 9.12.18.116:*}[44%]&lt;BR/&gt;{164.114.197.228:25, 9.12.18.116:*}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 110: (21.2329%)&lt;BR/&gt; 25: (16.4384%)&lt;BR/&gt; 3283: (8.21918%)&lt;BR/&gt; 57133: (2.05479%)&lt;BR/&gt; 56426: (2.05479%)&gt;];
}
1908--2933[label="1;24pkt 24fpkt"];
1908--3230[label="0.0416667;1pkt 1fpkt"];
1908--3276[label="0.0416667;1pkt 1fpkt"];
1908--4779[label="1;24pkt 24fpkt"];
2933--3230[label="0.0416667;1pkt 1fpkt"];
2933--3276[label="0.0416667;1pkt 1fpkt"];
2933--4779[label="1;24pkt 24fpkt"];
</description>
    <slice>
      <filter dst_ip="9.12.18.116" src_ip="164.114.197.228" src_port="110"/>
      <filter dst_ip="9.12.18.116" src_ip="164.114.197.228" src_port="25"/>
    </slice>
    <from sec="1230786019" usec="0"/>
    <to sec="1230786888" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_166{
style=filled;
color=gray75;
330[label="85.172.99.21;d;92pkt 92fpkt", shape=diamond, color=yellow];
331[label="182.71.111.78;s;129pkt 129fpkt", shape=diamond, color=yellow];
1956[label="12.160.13.167;d;1pkt 1fpkt", shape=diamond, color=yellow];
2469[label="85.172.99.21;d;26pkt 26fpkt", shape=hexagon, color=black];
2710[label="182.71.111.78;s;64pkt 64fpkt", shape=hexagon, color=black];
2947[label="12.160.13.167;d;1pkt 1fpkt", shape=hexagon, color=black];
stat166[shape=component, label=&lt;Rules:&lt;BR/&gt;{182.71.111.78:80, 85.172.99.21:*}[86.0465%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 50348: (0.638978%)&lt;BR/&gt; 50347: (0.638978%)&lt;BR/&gt; 50346: (0.638978%)&lt;BR/&gt; 50345: (0.638978%)&gt;];
}
330--331[label="1;92pkt 92fpkt"];
330--2469[label="1;26pkt 26fpkt"];
330--2710[label="0.984375;63pkt 63fpkt"];
330--3230[label="0.108696;10pkt 10fpkt"];
330--3276[label="0.108696;10pkt 10fpkt"];
331--1956[label="1;1pkt 1fpkt"];
331--2469[label="1;26pkt 26fpkt"];
331--2710[label="1;64pkt 64fpkt"];
331--2947[label="1;1pkt 1fpkt"];
331--3230[label="0.0775194;10pkt 10fpkt"];
331--3276[label="0.0775194;10pkt 10fpkt"];
1956--2947[label="1;1pkt 1fpkt"];
2469--2710[label="1;26pkt 26fpkt"];
2469--3230[label="0.384615;10pkt 10fpkt"];
2469--3276[label="0.384615;10pkt 10fpkt"];
2710--3230[label="0.15625;10pkt 10fpkt"];
2710--3276[label="0.15625;10pkt 10fpkt"];
</description>
    <slice>
      <filter dst_ip="85.172.99.21" src_ip="182.71.111.78" src_port="80"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.787119,1.48264,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_170{
style=filled;
color=gray75;
1057[label="160.48.171.141;d;44pkt 44fpkt", shape=diamond, color=yellow];
2992[label="160.48.171.141;d;43pkt 43fpkt", shape=hexagon, color=black];
4287[label="80.106.32.145;14pkt 14fpkt", shape=pentagon, color=darkviolet];
stat170[shape=component, label=&lt;Rules:&lt;BR/&gt;{220.182.61.252:*, 160.48.171.141:25}[43.1818%]&lt;BR/&gt;{80.106.32.145:*, 160.48.171.141:25}[31.8182%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (49.505%)&lt;BR/&gt; 25204: (1.48515%)&lt;BR/&gt; 25201: (1.48515%)&lt;BR/&gt; 25188: (1.48515%)&lt;BR/&gt; 25183: (1.48515%)&gt;];
}
1057--2992[label="1;43pkt 43fpkt"];
1057--4287[label="1;14pkt 14fpkt"];
2992--4287[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter dst_ip="160.48.171.141" dst_port="25" src_ip="220.182.61.252"/>
      <filter dst_ip="160.48.171.141" dst_port="25" src_ip="80.106.32.145"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786812" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.863625,1.45226,999,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_171{
style=filled;
color=gray75;
250[label="2.213.153.224;s;1pkt 1fpkt", shape=diamond, color=yellow];
635[label="193.17.100.196;d;90pkt 90fpkt", shape=diamond, color=yellow];
770[label="81.237.218.66;s;1pkt 1fpkt", shape=diamond, color=yellow];
1445[label="3.22.196.32;s;3pkt 3fpkt", shape=diamond, color=yellow];
2377[label="2.213.153.224;s;1pkt 1fpkt", shape=hexagon, color=black];
2993[label="81.237.218.66;s;1pkt 1fpkt", shape=hexagon, color=black];
4753[label="2.213.153.224;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5452[label="2.213.153.224;1pkt 1fpkt", shape=invtriangle, color=brown];
stat171[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 193.17.100.196:20265}[87.7778%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 20265: (42.4242%)&lt;BR/&gt; 0: (4.0404%)&lt;BR/&gt; 24591: (3.0303%)&lt;BR/&gt; 6346: (3.0303%)&lt;BR/&gt; 7615: (2.52525%)&gt;];
}
250--635[label="1;1pkt 1fpkt"];
250--2377[label="1;1pkt 1fpkt"];
250--4753[label="1;1pkt 1fpkt"];
250--5452[label="1;1pkt 1fpkt"];
635--770[label="1;1pkt 1fpkt"];
635--1078[label="0.0111111;1pkt 1fpkt"];
635--1445[label="1;3pkt 3fpkt"];
635--2377[label="1;1pkt 1fpkt"];
635--2993[label="1;1pkt 1fpkt"];
635--4753[label="1;1pkt 1fpkt"];
635--5452[label="1;1pkt 1fpkt"];
770--2993[label="1;1pkt 1fpkt"];
2377--4753[label="1;1pkt 1fpkt"];
2377--5452[label="1;1pkt 1fpkt"];
4753--5452[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="193.17.100.196" dst_port="20265"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,020,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_172{
style=filled;
color=gray75;
1237[label="154.7.185.179;s;201pkt 201fpkt", shape=diamond, color=yellow];
2996[label="154.7.185.179;s;183pkt 183fpkt", shape=hexagon, color=black];
stat172[shape=component, label=&lt;Rules:&lt;BR/&gt;{154.7.185.179:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1237--1438[label="0.00497512;1pkt 1fpkt"];
1237--1617[label="0.00497512;1pkt 1fpkt"];
1237--1621[label="0.00497512;1pkt 1fpkt"];
1237--1624[label="0.00497512;1pkt 1fpkt"];
1237--1625[label="0.00497512;1pkt 1fpkt"];
1237--1632[label="0.00497512;1pkt 1fpkt"];
1237--1647[label="0.00497512;1pkt 1fpkt"];
1237--1815[label="0.00497512;1pkt 1fpkt"];
1237--1816[label="0.00497512;1pkt 1fpkt"];
1237--1823[label="0.00497512;1pkt 1fpkt"];
1237--2212[label="0.00497512;1pkt 1fpkt"];
1237--2383[label="0.00775194;1pkt 1fpkt"];
1237--2806[label="0.00497512;1pkt 1fpkt"];
1237--2972[label="0.00497512;1pkt 1fpkt"];
1237--2975[label="0.00497512;1pkt 1fpkt"];
1237--2981[label="0.00497512;1pkt 1fpkt"];
1237--2996[label="1;183pkt 183fpkt"];
</description>
    <slice>
      <filter src_ip="154.7.185.179"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_174{
style=filled;
color=gray75;
1874[label="156.36.90.33;d;13pkt 13fpkt", shape=diamond, color=yellow];
3017[label="156.36.90.33;d;13pkt 13fpkt", shape=hexagon, color=black];
stat174[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:5050, 156.36.90.33:*}[61.5385%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5050: (30.7692%)&lt;BR/&gt; 2057: (7.69231%)&lt;BR/&gt; 123: (7.69231%)&lt;BR/&gt; 63283: (3.84615%)&lt;BR/&gt; 63282: (3.84615%)&gt;];
}
1874--3017[label="1;13pkt 13fpkt"];
</description>
    <slice>
      <filter dst_ip="156.36.90.33" src_port="5050"/>
    </slice>
    <from sec="1230786003" usec="0"/>
    <to sec="1230786828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_175{
style=filled;
color=gray75;
2157[label="178.202.46.106;d;2pkt 2fpkt", shape=diamond, color=yellow];
3071[label="178.202.46.106;d;1pkt 1fpkt", shape=hexagon, color=black];
stat175[shape=component, label=&lt;Rules:&lt;BR/&gt;{187.77.80.96:48993, 178.202.46.106:80}[50%]&lt;BR/&gt;{187.77.80.96:53391, 178.202.46.106:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 48993: (33.3333%)&lt;BR/&gt; 53391: (16.6667%)&gt;];
}
2157--3071[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="178.202.46.106" dst_port="80" src_ip="187.77.80.96" src_port="53391"/>
      <filter dst_ip="178.202.46.106" dst_port="80" src_ip="187.77.80.96" src_port="48993"/>
    </slice>
    <from sec="1230786647" usec="0"/>
    <to sec="1230786762" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.863625,1.45226,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_176{
style=filled;
color=gray75;
2158[label="154.101.16.42;d;7pkt 7fpkt", shape=diamond, color=yellow];
2183[label="217.61.172.185;s;1pkt 1fpkt", shape=diamond, color=yellow];
2354[label="50.35.47.24;s;1pkt 1fpkt", shape=diamond, color=yellow];
3076[label="217.61.172.185;s;1pkt 1fpkt", shape=hexagon, color=black];
4536[label="217.61.172.185;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5360[label="217.61.172.185;1pkt 1fpkt", shape=invtriangle, color=brown];
stat176[shape=component, label=&lt;Rules:&lt;BR/&gt;{217.61.170.104:80, 154.101.16.42:*}[42.8571%]&lt;BR/&gt;{217.18.16.92:80, 154.101.16.42:*}[28.5714%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3635: (20.8333%)&lt;BR/&gt; 3656: (8.33333%)&lt;BR/&gt; 3654: (4.16667%)&lt;BR/&gt; 3653: (4.16667%)&gt;];
}
2158--2183[label="1;1pkt 1fpkt"];
2158--2354[label="1;1pkt 1fpkt"];
2158--3076[label="1;1pkt 1fpkt"];
2158--4536[label="1;1pkt 1fpkt"];
2158--5360[label="1;1pkt 1fpkt"];
2183--3076[label="1;1pkt 1fpkt"];
2183--4536[label="1;1pkt 1fpkt"];
2183--5360[label="1;1pkt 1fpkt"];
3076--4536[label="1;1pkt 1fpkt"];
3076--5360[label="1;1pkt 1fpkt"];
4536--5360[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="154.101.16.42" src_ip="217.61.170.104" src_port="80"/>
      <filter dst_ip="154.101.16.42" src_ip="217.18.16.92" src_port="80"/>
    </slice>
    <from sec="1230786650" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,999,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_178{
style=filled;
color=gray75;
2017[label="192.231.25.53;s;104pkt 104fpkt", shape=diamond, color=yellow];
3097[label="192.231.25.53;s;104pkt 104fpkt", shape=hexagon, color=black];
stat178[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.231.25.53:25, *:*}[95.1923%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (48.5577%)&lt;BR/&gt; 443: (1.44231%)&lt;BR/&gt; 62643: (0.480769%)&lt;BR/&gt; 60880: (0.480769%)&lt;BR/&gt; 54130: (0.480769%)&gt;];
}
2017--3097[label="1;104pkt 104fpkt"];
</description>
    <slice>
      <filter src_ip="192.231.25.53" src_port="25"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.787119,1.48264,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_180{
style=filled;
color=gray75;
1895[label="160.48.92.119;d;1376pkt 1376fpkt", shape=diamond, color=yellow];
2288[label="8.86.65.14;s;557pkt 557fpkt", shape=diamond, color=yellow];
3123[label="160.48.92.119;d;1376pkt 1376fpkt", shape=hexagon, color=black];
3458[label="8.86.65.14;686pkt 686fpkt", shape=pentagon, color=darkviolet];
stat180[shape=component, label=&lt;Rules:&lt;BR/&gt;{8.86.65.14:*, 160.48.92.119:10406}[45.6175%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 10406: (29.4994%)&lt;BR/&gt; 37104: (6.05757%)&lt;BR/&gt; 14690: (5.40676%)&lt;BR/&gt; 12423: (3.95494%)&lt;BR/&gt; 37717: (1.77722%)&gt;];
}
1895--2288[label="1;557pkt 557fpkt"];
1895--3123[label="1;1376pkt 1376fpkt"];
1895--3458[label="0.810496;556pkt 556fpkt"];
2288--3123[label="1;557pkt 557fpkt"];
2288--3458[label="0.998205;556pkt 556fpkt"];
3123--3458[label="0.810496;556pkt 556fpkt"];
</description>
    <slice>
      <filter dst_ip="160.48.92.119" dst_port="10406" src_ip="8.86.65.14"/>
    </slice>
    <from sec="1230786008" usec="0"/>
    <to sec="1230786898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,501,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_181{
style=filled;
color=gray75;
256[label="154.101.230.154;s;407pkt 407fpkt", shape=diamond, color=yellow];
257[label="193.88.163.70;d;17pkt 17fpkt", shape=diamond, color=yellow];
760[label="46.214.201.104;d;346pkt 346fpkt", shape=diamond, color=yellow];
1307[label="49.100.30.235;d;87pkt 87fpkt", shape=diamond, color=yellow];
1775[label="52.100.114.183;d;2pkt 2fpkt", shape=diamond, color=yellow];
3127[label="49.100.30.235;d;87pkt 87fpkt", shape=hexagon, color=black];
stat181[shape=component, label=&lt;Rules:&lt;BR/&gt;{154.101.230.154:*, 46.214.201.104:*}[76.2115%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21: (7.66385%)&lt;BR/&gt; 20: (1.69133%)&lt;BR/&gt; 80: (0.317125%)&lt;BR/&gt; 43716: (0.264271%)&lt;BR/&gt; 2523: (0.264271%)&gt;];
}
256--257[label="1;17pkt 17fpkt"];
256--760[label="0.898844;311pkt 311fpkt"];
256--1307[label="0.862069;75pkt 75fpkt"];
256--1775[label="1;2pkt 2fpkt"];
256--3127[label="0.862069;75pkt 75fpkt"];
256--3230[label="0.004914;2pkt 2fpkt"];
256--3276[label="0.004914;2pkt 2fpkt"];
1307--3127[label="1;87pkt 87fpkt"];
</description>
    <slice>
      <filter dst_ip="46.214.201.104" src_ip="154.101.230.154"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="3.66.17.0"/>
    </slice>
    <from sec="1230786557" usec="0"/>
    <to sec="1230786677" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="40.181.98.0"/>
    </slice>
    <from sec="1230786290" usec="0"/>
    <to sec="1230786345" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="193.168.50.1"/>
    </slice>
    <from sec="1230786795" usec="0"/>
    <to sec="1230786857" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="8.66.114.1"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="66.181.73.2"/>
    </slice>
    <from sec="1230786201" usec="0"/>
    <to sec="1230786258" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="56.221.16.3"/>
    </slice>
    <from sec="1230786326" usec="0"/>
    <to sec="1230786355" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="129.178.51.4"/>
    </slice>
    <from sec="1230786846" usec="0"/>
    <to sec="1230786874" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.208.85.4"/>
    </slice>
    <from sec="1230786863" usec="0"/>
    <to sec="1230786872" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="41.75.83.6"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="37.168.198.7"/>
    </slice>
    <from sec="1230786614" usec="0"/>
    <to sec="1230786695" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="53.192.188.10"/>
    </slice>
    <from sec="1230786022" usec="0"/>
    <to sec="1230786026" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="80.185.246.10"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786842" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="47.44.76.11"/>
    </slice>
    <from sec="1230786505" usec="0"/>
    <to sec="1230786513" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="130.6.82.11"/>
    </slice>
    <from sec="1230786592" usec="0"/>
    <to sec="1230786620" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.71.132.11"/>
    </slice>
    <from sec="1230786276" usec="0"/>
    <to sec="1230786285" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="3.67.183.11"/>
    </slice>
    <from sec="1230786797" usec="0"/>
    <to sec="1230786862" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.787119,1.48264,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_214{
style=filled;
color=gray75;
209[label="209.17.106.156;d;3pkt 3fpkt", shape=diamond, color=yellow];
623[label="193.17.115.41;s;14pkt 14fpkt", shape=diamond, color=yellow];
631[label="193.17.114.12;s;46pkt 46fpkt", shape=diamond, color=yellow];
2955[label="193.17.115.41;s;14pkt 14fpkt", shape=hexagon, color=black];
3443[label="193.17.114.12;49pkt 49fpkt", shape=pentagon, color=darkviolet];
3640[label="193.17.115.41;14pkt 14fpkt", shape=pentagon, color=darkviolet];
stat214[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.17.114.12:*, 212.7.130.59:9990}[57.1429%]&lt;BR/&gt;{193.17.115.41:*, *:*}[22.2222%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9990: (24.6429%)&lt;BR/&gt; 8000: (8.92857%)&lt;BR/&gt; 9035: (7.14286%)&lt;BR/&gt; 17788: (5%)&lt;BR/&gt; 10086: (3.92857%)&gt;];
}
209--623[label="0.666667;2pkt 2fpkt"];
209--631[label="0.333333;1pkt 1fpkt"];
209--2955[label="0.666667;2pkt 2fpkt"];
209--3443[label="0.333333;1pkt 1fpkt"];
209--3640[label="0.666667;2pkt 2fpkt"];
623--2955[label="1;14pkt 14fpkt"];
623--3640[label="1;14pkt 14fpkt"];
631--3443[label="1;46pkt 46fpkt"];
2955--3640[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter src_ip="193.17.115.41"/>
      <filter dst_ip="212.7.130.59" dst_port="9990" src_ip="193.17.114.12"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="60.145.0.13"/>
    </slice>
    <from sec="1230786470" usec="0"/>
    <to sec="1230786502" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="129.154.40.13"/>
    </slice>
    <from sec="1230786030" usec="0"/>
    <to sec="1230786167" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="13.148.252.13"/>
    </slice>
    <from sec="1230786442" usec="0"/>
    <to sec="1230786549" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="9.1.46.14"/>
    </slice>
    <from sec="1230786519" usec="0"/>
    <to sec="1230786549" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="187.77.35.15"/>
    </slice>
    <from sec="1230786129" usec="0"/>
    <to sec="1230786811" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="78.34.6.16"/>
    </slice>
    <from sec="1230786489" usec="0"/>
    <to sec="1230786655" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="53.246.169.17"/>
    </slice>
    <from sec="1230786334" usec="0"/>
    <to sec="1230786366" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="57.242.222.17"/>
    </slice>
    <from sec="1230786146" usec="0"/>
    <to sec="1230786171" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="217.36.66.19"/>
    </slice>
    <from sec="1230786545" usec="0"/>
    <to sec="1230786549" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.554793,1.5298,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_224{
style=filled;
color=gray75;
1048[label="154.101.135.21;s;270pkt 270fpkt", shape=diamond, color=yellow];
3510[label="154.101.135.21;288pkt 288fpkt", shape=pentagon, color=darkviolet];
stat224[shape=component, label=&lt;Rules:&lt;BR/&gt;{154.101.135.21:25, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 4918: (0.358423%)&lt;BR/&gt; 4218: (0.358423%)&lt;BR/&gt; 4086: (0.358423%)&lt;BR/&gt; 3277: (0.358423%)&gt;];
}
1048--2016[label="0.0128205;1pkt 1fpkt"];
1048--3510[label="1;270pkt 270fpkt"];
</description>
    <slice>
      <filter src_ip="154.101.135.21" src_port="25"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786896" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="52.209.8.22"/>
    </slice>
    <from sec="1230786657" usec="0"/>
    <to sec="1230786681" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,011,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="209.12.90.22"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="6.192.17.24"/>
    </slice>
    <from sec="1230786422" usec="0"/>
    <to sec="1230786499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="164.114.27.24"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="50.35.47.24"/>
    </slice>
    <from sec="1230786812" usec="0"/>
    <to sec="1230786858" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="220.13.86.24"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.11.116.24"/>
    </slice>
    <from sec="1230786490" usec="0"/>
    <to sec="1230786515" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.134.129.24"/>
    </slice>
    <from sec="1230786831" usec="0"/>
    <to sec="1230786859" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="3.68.64.25"/>
    </slice>
    <from sec="1230786811" usec="0"/>
    <to sec="1230786895" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="7.37.152.26"/>
    </slice>
    <from sec="1230786091" usec="0"/>
    <to sec="1230786225" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="203.174.85.27"/>
    </slice>
    <from sec="1230786180" usec="0"/>
    <to sec="1230786225" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="9.104.219.27"/>
    </slice>
    <from sec="1230786419" usec="0"/>
    <to sec="1230786437" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="121.158.242.27"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,501,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="80.193.7.28"/>
    </slice>
    <from sec="1230786256" usec="0"/>
    <to sec="1230786900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="192.231.7.28"/>
    </slice>
    <from sec="1230786012" usec="0"/>
    <to sec="1230786844" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.229.33.28"/>
    </slice>
    <from sec="1230786650" usec="0"/>
    <to sec="1230786668" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="80.179.160.28"/>
    </slice>
    <from sec="1230786402" usec="0"/>
    <to sec="1230786411" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="42.161.174.28"/>
    </slice>
    <from sec="1230786181" usec="0"/>
    <to sec="1230786900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.88.128.29"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="34.177.33.30"/>
    </slice>
    <from sec="1230786398" usec="0"/>
    <to sec="1230786403" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="187.77.202.30"/>
    </slice>
    <from sec="1230786189" usec="0"/>
    <to sec="1230786200" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="192.158.50.32"/>
    </slice>
    <from sec="1230786643" usec="0"/>
    <to sec="1230786714" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="52.239.69.32"/>
    </slice>
    <from sec="1230786537" usec="0"/>
    <to sec="1230786542" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="212.88.169.33"/>
    </slice>
    <from sec="1230786836" usec="0"/>
    <to sec="1230786861" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="55.78.26.34"/>
    </slice>
    <from sec="1230786116" usec="0"/>
    <to sec="1230786124" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="198.194.144.34"/>
    </slice>
    <from sec="1230786756" usec="0"/>
    <to sec="1230786788" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="84.183.246.34"/>
    </slice>
    <from sec="1230786415" usec="0"/>
    <to sec="1230786543" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="11.68.134.36"/>
    </slice>
    <from sec="1230786607" usec="0"/>
    <to sec="1230786611" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="80.236.63.37"/>
    </slice>
    <from sec="1230786291" usec="0"/>
    <to sec="1230786519" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.554793,1.5298,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_254{
style=filled;
color=gray75;
587[label="154.101.126.37;s;86pkt 86fpkt", shape=diamond, color=yellow];
600[label="217.22.193.17;d;6pkt 6fpkt", shape=diamond, color=yellow];
3618[label="154.101.126.37;195pkt 195fpkt", shape=pentagon, color=darkviolet];
stat254[shape=component, label=&lt;Rules:&lt;BR/&gt;{154.101.126.37:*, *:80}[99.4872%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.6516%)&lt;BR/&gt; 8080: (0.348432%)&lt;BR/&gt; 2058: (0.348432%)&lt;BR/&gt; 2041: (0.348432%)&lt;BR/&gt; 2040: (0.348432%)&gt;];
}
587--1925[label="0.1;5pkt 5fpkt"];
587--3054[label="0.105263;4pkt 4fpkt"];
587--3270[label="0.104651;9pkt 9fpkt"];
587--3618[label="1;86pkt 86fpkt"];
600--3618[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_port="80" src_ip="154.101.126.37"/>
    </slice>
    <from sec="1230786056" usec="0"/>
    <to sec="1230786894" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="3.67.24.38"/>
    </slice>
    <from sec="1230786525" usec="0"/>
    <to sec="1230786538" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="3.67.81.38"/>
    </slice>
    <from sec="1230786036" usec="0"/>
    <to sec="1230786079" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="3.67.82.38"/>
    </slice>
    <from sec="1230786526" usec="0"/>
    <to sec="1230786688" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="84.195.150.39"/>
    </slice>
    <from sec="1230786497" usec="0"/>
    <to sec="1230786511" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.554793,1.5298,020,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_260{
style=filled;
color=gray75;
1067[label="182.8.171.40;s;138pkt 138fpkt", shape=diamond, color=yellow];
3637[label="182.8.171.40;138pkt 138fpkt", shape=pentagon, color=darkviolet];
stat260[shape=component, label=&lt;Rules:&lt;BR/&gt;{182.8.171.40:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
1067--3637[label="0.992754;137pkt 137fpkt"];
</description>
    <slice>
      <filter src_ip="182.8.171.40"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786841" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.68.64.42"/>
    </slice>
    <from sec="1230786168" usec="0"/>
    <to sec="1230786601" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.48.182.43"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786824" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="187.77.80.44"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="204.1.73.45"/>
    </slice>
    <from sec="1230786003" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="83.58.21.46"/>
    </slice>
    <from sec="1230786023" usec="0"/>
    <to sec="1230786894" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,501,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="46.91.31.46"/>
    </slice>
    <from sec="1230786012" usec="0"/>
    <to sec="1230786900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.554793,1.5298,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_267{
style=filled;
color=gray75;
408[label="160.48.137.147;d;1657pkt 1657fpkt", shape=diamond, color=yellow];
3679[label="210.157.40.47;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3688[label="209.52.132.48;1pkt 1fpkt", shape=pentagon, color=darkviolet];
stat267[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 160.48.137.147:49763}[97.6463%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 49763: (48.7945%)&lt;BR/&gt; 443: (0.632911%)&lt;BR/&gt; 0: (0.482218%)&lt;BR/&gt; 80: (0.361664%)&lt;BR/&gt; 26950: (0.241109%)&gt;];
}
408--3232[label="0.0006035;1pkt 1fpkt"];
408--3246[label="0.0030175;5pkt 5fpkt"];
408--3265[label="0.0030175;5pkt 5fpkt"];
408--3270[label="0.0030175;5pkt 5fpkt"];
408--3278[label="0.0006035;1pkt 1fpkt"];
408--3291[label="0.0030175;5pkt 5fpkt"];
408--3310[label="0.0030175;5pkt 5fpkt"];
408--3314[label="0.0006035;1pkt 1fpkt"];
408--3327[label="0.0030175;5pkt 5fpkt"];
408--3346[label="0.0030175;5pkt 5fpkt"];
408--3679[label="1;1pkt 1fpkt"];
408--3688[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="160.48.137.147" dst_port="49763"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786895" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.113.142.48"/>
    </slice>
    <from sec="1230786131" usec="0"/>
    <to sec="1230786477" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="201.117.27.50"/>
    </slice>
    <from sec="1230786005" usec="0"/>
    <to sec="1230786896" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.109.59.50"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.161.102.52"/>
    </slice>
    <from sec="1230786235" usec="0"/>
    <to sec="1230786395" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="85.166.199.52"/>
    </slice>
    <from sec="1230786071" usec="0"/>
    <to sec="1230786872" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="81.83.22.53"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="11.13.15.56"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="81.196.84.56"/>
    </slice>
    <from sec="1230786246" usec="0"/>
    <to sec="1230786461" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="48.27.168.56"/>
    </slice>
    <from sec="1230786527" usec="0"/>
    <to sec="1230786564" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="66.183.173.57"/>
    </slice>
    <from sec="1230786348" usec="0"/>
    <to sec="1230786376" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_279{
style=filled;
color=gray75;
3759[label="164.114.174.58;125pkt 125fpkt", shape=pentagon, color=darkviolet];
stat279[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.114.174.58:33476, *:53}[74.4%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (42.4%)&lt;BR/&gt; 33476: (37.2%)&lt;BR/&gt; 25: (4%)&lt;BR/&gt; 113: (3.6%)&lt;BR/&gt; 59682: (0.4%)&gt;];
}
</description>
    <slice>
      <filter dst_port="53" src_ip="164.114.174.58" src_port="33476"/>
    </slice>
    <from sec="1230786133" usec="0"/>
    <to sec="1230786898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="219.85.14.59"/>
    </slice>
    <from sec="1230786866" usec="0"/>
    <to sec="1230786886" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="23.61.121.60"/>
    </slice>
    <from sec="1230786773" usec="0"/>
    <to sec="1230786798" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.108.211.61"/>
    </slice>
    <from sec="1230786002" usec="0"/>
    <to sec="1230786605" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="54.3.55.62"/>
    </slice>
    <from sec="1230786579" usec="0"/>
    <to sec="1230786608" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="192.231.19.64"/>
    </slice>
    <from sec="1230786007" usec="0"/>
    <to sec="1230786898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="182.8.4.65"/>
    </slice>
    <from sec="1230786007" usec="0"/>
    <to sec="1230786895" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="130.110.22.67"/>
    </slice>
    <from sec="1230786266" usec="0"/>
    <to sec="1230786818" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.919689,1.51124,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_287{
style=filled;
color=gray75;
553[label="49.100.30.249;d;23pkt 23fpkt", shape=diamond, color=yellow];
554[label="160.38.0.71;s;26pkt 26fpkt", shape=diamond, color=yellow];
3846[label="160.38.0.71;28pkt 28fpkt", shape=pentagon, color=darkviolet];
5103[label="160.38.0.71;28pkt 28fpkt", shape=invtriangle, color=brown];
5590[label="160.38.0.71;28pkt 28fpkt", shape=invhouse, color=bisque];
stat287[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.38.0.71:80, 49.100.30.249:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 64899: (1.8797%)&lt;BR/&gt; 63134: (1.8797%)&lt;BR/&gt; 60118: (1.8797%)&lt;BR/&gt; 54145: (1.8797%)&gt;];
}
553--554[label="1;23pkt 23fpkt"];
553--3230[label="0.0434783;1pkt 1fpkt"];
553--3276[label="0.0434783;1pkt 1fpkt"];
553--3846[label="1;23pkt 23fpkt"];
553--5103[label="1;23pkt 23fpkt"];
553--5590[label="1;23pkt 23fpkt"];
554--3230[label="0.0384615;1pkt 1fpkt"];
554--3276[label="0.0384615;1pkt 1fpkt"];
554--3846[label="1;26pkt 26fpkt"];
554--5103[label="1;26pkt 26fpkt"];
554--5590[label="1;26pkt 26fpkt"];
3846--5103[label="1;28pkt 28fpkt"];
3846--5590[label="1;28pkt 28fpkt"];
5103--5590[label="1;28pkt 28fpkt"];
</description>
    <slice>
      <filter dst_ip="49.100.30.249" src_ip="160.38.0.71" src_port="80"/>
    </slice>
    <from sec="1230786021" usec="0"/>
    <to sec="1230786893" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="121.231.168.71"/>
    </slice>
    <from sec="1230786483" usec="0"/>
    <to sec="1230786490" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.554793,1.5298,020,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_289{
style=filled;
color=gray75;
1085[label="192.231.24.72;s;539pkt 539fpkt", shape=diamond, color=yellow];
3857[label="192.231.24.72;2pkt 2fpkt", shape=pentagon, color=darkviolet];
stat289[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.231.24.72:0, *:0}[99.8148%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.8152%)&lt;BR/&gt; 6000: (0.0924214%)&lt;BR/&gt; 2967: (0.0924214%)&gt;];
}
1085--1162[label="0.00185529;1pkt 1fpkt"];
1085--3857[label="0.5;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="192.231.24.72"/>
    </slice>
    <from sec="1230786002" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="22.84.116.72"/>
    </slice>
    <from sec="1230786135" usec="0"/>
    <to sec="1230786845" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="60.96.216.72"/>
    </slice>
    <from sec="1230786003" usec="0"/>
    <to sec="1230786194" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="217.29.179.73"/>
    </slice>
    <from sec="1230786222" usec="0"/>
    <to sec="1230786228" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.224.137.76"/>
    </slice>
    <from sec="1230786008" usec="0"/>
    <to sec="1230786900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="44.254.176.78"/>
    </slice>
    <from sec="1230786006" usec="0"/>
    <to sec="1230786899" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="195.196.220.78"/>
    </slice>
    <from sec="1230786004" usec="0"/>
    <to sec="1230786886" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,010,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="193.217.34.82"/>
    </slice>
    <from sec="1230786008" usec="0"/>
    <to sec="1230786900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.88.76.82"/>
    </slice>
    <from sec="1230786008" usec="0"/>
    <to sec="1230786198" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="197.123.181.82"/>
    </slice>
    <from sec="1230786752" usec="0"/>
    <to sec="1230786869" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="3.252.79.83"/>
    </slice>
    <from sec="1230786322" usec="0"/>
    <to sec="1230786328" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.164.47.84"/>
    </slice>
    <from sec="1230786606" usec="0"/>
    <to sec="1230786679" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="62.231.147.84"/>
    </slice>
    <from sec="1230786734" usec="0"/>
    <to sec="1230786766" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="62.74.232.84"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="9.137.249.84"/>
    </slice>
    <from sec="1230786195" usec="0"/>
    <to sec="1230786900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.554793,1.5298,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_307{
style=filled;
color=gray75;
775[label="156.36.32.40;d;2270pkt 2270fpkt", shape=diamond, color=yellow];
3957[label="63.143.83.85;11pkt 11fpkt", shape=pentagon, color=darkviolet];
stat307[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 156.36.32.40:6930}[96.1708%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6930: (47.8957%)&lt;BR/&gt; 2857: (1.05217%)&lt;BR/&gt; 25: (0.832968%)&lt;BR/&gt; 0: (0.131521%)&lt;BR/&gt; 4300: (0.109601%)&gt;];
}
775--2180[label="0.000440529;1pkt 1fpkt"];
775--3074[label="0.000440529;1pkt 1fpkt"];
775--3222[label="0.000440529;1pkt 1fpkt"];
775--3273[label="0.000440529;1pkt 1fpkt"];
775--3957[label="0.818182;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="156.36.32.40" dst_port="6930"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="61.213.173.85"/>
    </slice>
    <from sec="1230786391" usec="0"/>
    <to sec="1230786418" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="3.68.177.85"/>
    </slice>
    <from sec="1230786577" usec="0"/>
    <to sec="1230786693" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="3.67.82.87"/>
    </slice>
    <from sec="1230786198" usec="0"/>
    <to sec="1230786500" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="164.114.189.87"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="201.236.195.89"/>
    </slice>
    <from sec="1230786463" usec="0"/>
    <to sec="1230786485" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,501,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="35.218.217.89"/>
    </slice>
    <from sec="1230786037" usec="0"/>
    <to sec="1230786900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="3.65.165.93"/>
    </slice>
    <from sec="1230786746" usec="0"/>
    <to sec="1230786776" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="80.46.37.94"/>
    </slice>
    <from sec="1230786683" usec="0"/>
    <to sec="1230786695" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="3.164.249.95"/>
    </slice>
    <from sec="1230786004" usec="0"/>
    <to sec="1230786100" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="3.68.94.96"/>
    </slice>
    <from sec="1230786430" usec="0"/>
    <to sec="1230786472" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_318{
style=filled;
color=gray75;
4024[label="187.77.80.97;10pkt 10fpkt", shape=pentagon, color=darkviolet];
stat318[shape=component, label=&lt;Rules:&lt;BR/&gt;{187.77.80.97:*, 80.229.12.128:80}[60%]&lt;BR/&gt;{187.77.80.97:*, 22.213.78.42:80}[40%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 58152: (5%)&lt;BR/&gt; 52777: (5%)&lt;BR/&gt; 51456: (5%)&lt;BR/&gt; 48376: (5%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="80.229.12.128" dst_port="80" src_ip="187.77.80.97"/>
      <filter dst_ip="22.213.78.42" dst_port="80" src_ip="187.77.80.97"/>
    </slice>
    <from sec="1230786063" usec="0"/>
    <to sec="1230786845" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="84.97.141.97"/>
    </slice>
    <from sec="1230786019" usec="0"/>
    <to sec="1230786868" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.38.216.97"/>
    </slice>
    <from sec="1230786024" usec="0"/>
    <to sec="1230786879" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="66.170.89.100"/>
    </slice>
    <from sec="1230786372" usec="0"/>
    <to sec="1230786463" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="85.16.74.101"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="80.96.121.101"/>
    </slice>
    <from sec="1230786004" usec="0"/>
    <to sec="1230786207" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="154.101.7.102"/>
    </slice>
    <from sec="1230786133" usec="0"/>
    <to sec="1230786260" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="58.25.142.102"/>
    </slice>
    <from sec="1230786070" usec="0"/>
    <to sec="1230786084" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="54.64.61.103"/>
    </slice>
    <from sec="1230786871" usec="0"/>
    <to sec="1230786890" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="60.133.105.103"/>
    </slice>
    <from sec="1230786575" usec="0"/>
    <to sec="1230786688" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="164.114.99.105"/>
    </slice>
    <from sec="1230786037" usec="0"/>
    <to sec="1230786849" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="36.129.143.105"/>
    </slice>
    <from sec="1230786465" usec="0"/>
    <to sec="1230786471" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="99.194.165.105"/>
    </slice>
    <from sec="1230786078" usec="0"/>
    <to sec="1230786234" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="7.165.65.108"/>
    </slice>
    <from sec="1230786141" usec="0"/>
    <to sec="1230786281" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="8.51.75.111"/>
    </slice>
    <from sec="1230786234" usec="0"/>
    <to sec="1230786359" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="11.104.157.111"/>
    </slice>
    <from sec="1230786002" usec="0"/>
    <to sec="1230786208" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="56.179.160.111"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="165.66.40.118"/>
    </slice>
    <from sec="1230786028" usec="0"/>
    <to sec="1230786429" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.38.35.119"/>
    </slice>
    <from sec="1230786285" usec="0"/>
    <to sec="1230786732" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="83.217.123.119"/>
    </slice>
    <from sec="1230786483" usec="0"/>
    <to sec="1230786492" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="44.26.106.120"/>
    </slice>
    <from sec="1230786510" usec="0"/>
    <to sec="1230786560" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="41.58.156.123"/>
    </slice>
    <from sec="1230786191" usec="0"/>
    <to sec="1230786289" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,504,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="192.58.132.127"/>
    </slice>
    <from sec="1230786015" usec="0"/>
    <to sec="1230786854" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="83.113.184.128"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="56.15.83.130"/>
    </slice>
    <from sec="1230786661" usec="0"/>
    <to sec="1230786743" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.554793,1.5298,011,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_343{
style=filled;
color=gray75;
1601[label="212.55.16.131;s;936pkt 936fpkt", shape=diamond, color=yellow];
4196[label="212.55.16.131;936pkt 936fpkt", shape=pentagon, color=darkviolet];
stat343[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.55.16.131:80, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 63287: (0.106838%)&lt;BR/&gt; 62070: (0.106838%)&lt;BR/&gt; 56678: (0.106838%)&lt;BR/&gt; 52260: (0.106838%)&gt;];
}
1601--4196[label="1;936pkt 936fpkt"];
</description>
    <slice>
      <filter src_ip="212.55.16.131" src_port="80"/>
    </slice>
    <from sec="1230786405" usec="0"/>
    <to sec="1230786593" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="3.67.93.132"/>
    </slice>
    <from sec="1230786733" usec="0"/>
    <to sec="1230786787" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="47.118.8.134"/>
    </slice>
    <from sec="1230786055" usec="0"/>
    <to sec="1230786086" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="3.66.103.134"/>
    </slice>
    <from sec="1230786387" usec="0"/>
    <to sec="1230786407" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="193.17.122.134"/>
    </slice>
    <from sec="1230786003" usec="0"/>
    <to sec="1230786900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.196.64.135"/>
    </slice>
    <from sec="1230786004" usec="0"/>
    <to sec="1230786898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="13.171.53.136"/>
    </slice>
    <from sec="1230786006" usec="0"/>
    <to sec="1230786900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.554793,1.5298,999,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_350{
style=filled;
color=gray75;
1424[label="160.38.161.53;s;82pkt 82fpkt", shape=diamond, color=yellow];
2104[label="85.79.186.148;d;46pkt 46fpkt", shape=diamond, color=yellow];
3726[label="160.38.161.53;85pkt 85fpkt", shape=pentagon, color=darkviolet];
4230[label="160.38.192.136;19pkt 19fpkt", shape=pentagon, color=darkviolet];
stat350[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.38.161.53:25, *:*}[72.973%]&lt;BR/&gt;{*:25, 85.79.186.148:*}[37.8378%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (46.9828%)&lt;BR/&gt; 53: (3.01724%)&lt;BR/&gt; 32907: (2.15517%)&lt;BR/&gt; 4611: (0.862069%)&lt;BR/&gt; 4956: (0.646552%)&gt;];
}
1424--2104[label="0.456522;21pkt 21fpkt"];
1424--3726[label="0.987805;81pkt 81fpkt"];
2104--2358[label="0.0217391;1pkt 1fpkt"];
2104--3272[label="0.0217391;1pkt 1fpkt"];
2104--3525[label="0.0869565;4pkt 4fpkt"];
2104--3726[label="0.456522;21pkt 21fpkt"];
2104--3872[label="0.0217391;1pkt 1fpkt"];
2104--4230[label="1;19pkt 19fpkt"];
2104--4972[label="0.0869565;4pkt 4fpkt"];
2104--5112[label="0.0217391;1pkt 1fpkt"];
2104--5536[label="0.0869565;4pkt 4fpkt"];
2104--5594[label="0.0217391;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="160.38.161.53" src_port="25"/>
      <filter dst_ip="85.79.186.148" src_port="25"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="164.114.72.138"/>
    </slice>
    <from sec="1230786002" usec="0"/>
    <to sec="1230786898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="3.66.96.139"/>
    </slice>
    <from sec="1230786445" usec="0"/>
    <to sec="1230786662" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="44.177.108.139"/>
    </slice>
    <from sec="1230786528" usec="0"/>
    <to sec="1230786536" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="193.26.137.139"/>
    </slice>
    <from sec="1230786004" usec="0"/>
    <to sec="1230786898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.6.62.141"/>
    </slice>
    <from sec="1230786371" usec="0"/>
    <to sec="1230786377" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_357{
style=filled;
color=gray75;
4258[label="212.2.140.141;61pkt 61fpkt", shape=pentagon, color=darkviolet];
stat357[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.2.140.141:*, 192.231.16.117:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 13943: (0.819672%)&lt;BR/&gt; 13938: (0.819672%)&lt;BR/&gt; 13911: (0.819672%)&lt;BR/&gt; 13910: (0.819672%)&gt;];
}
</description>
    <slice>
      <filter dst_ip="192.231.16.117" dst_port="80" src_ip="212.2.140.141"/>
    </slice>
    <from sec="1230786303" usec="0"/>
    <to sec="1230786900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,011,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="81.88.164.141"/>
    </slice>
    <from sec="1230786006" usec="0"/>
    <to sec="1230786895" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.38.145.142"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.88.118.144"/>
    </slice>
    <from sec="1230786848" usec="0"/>
    <to sec="1230786895" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="48.17.122.145"/>
    </slice>
    <from sec="1230786607" usec="0"/>
    <to sec="1230786613" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="84.70.194.147"/>
    </slice>
    <from sec="1230786069" usec="0"/>
    <to sec="1230786210" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="166.169.192.148"/>
    </slice>
    <from sec="1230786155" usec="0"/>
    <to sec="1230786175" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="61.198.181.149"/>
    </slice>
    <from sec="1230786343" usec="0"/>
    <to sec="1230786402" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="61.235.85.150"/>
    </slice>
    <from sec="1230786225" usec="0"/>
    <to sec="1230786403" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.787119,1.48264,020,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_366{
style=filled;
color=gray75;
1210[label="192.231.28.56;d;449pkt 449fpkt", shape=diamond, color=yellow];
1432[label="192.231.28.187;d;443pkt 443fpkt", shape=diamond, color=yellow];
1649[label="192.231.28.222;d;442pkt 442fpkt", shape=diamond, color=yellow];
1650[label="152.74.34.0;d;359pkt 359fpkt", shape=diamond, color=yellow];
2210[label="164.114.190.48;d;108pkt 108fpkt", shape=diamond, color=yellow];
3099[label="192.231.28.222;d;442pkt 442fpkt", shape=hexagon, color=black];
4014[label="81.88.245.94;6pkt 6fpkt", shape=pentagon, color=darkviolet];
4332[label="159.37.141.151;4pkt 4fpkt", shape=pentagon, color=darkviolet];
4448[label="192.34.163.172;7pkt 7fpkt", shape=pentagon, color=darkviolet];
stat366[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:0, 192.231.28.56:0}[24.8337%]&lt;BR/&gt;{*:0, 192.231.28.187:0}[24.5011%]&lt;BR/&gt;{*:0, 192.231.28.222:0}[24.4457%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.823%)&lt;BR/&gt; 6000: (0.0884956%)&lt;BR/&gt; 2967: (0.0884956%)&gt;];
}
1210--2616[label="0.00222717;1pkt 1fpkt"];
1210--3187[label="0.00222717;1pkt 1fpkt"];
1210--3263[label="0.00222717;1pkt 1fpkt"];
1210--3308[label="0.00222717;1pkt 1fpkt"];
1210--3344[label="0.00222717;1pkt 1fpkt"];
1210--4014[label="0.166667;1pkt 1fpkt"];
1210--4332[label="0.25;1pkt 1fpkt"];
1210--4448[label="0.142857;1pkt 1fpkt"];
1210--4610[label="0.00222717;1pkt 1fpkt"];
1210--5391[label="0.00222717;1pkt 1fpkt"];
1210--5707[label="0.00222717;1pkt 1fpkt"];
1432--2616[label="0.00225734;1pkt 1fpkt"];
1432--3187[label="0.00225734;1pkt 1fpkt"];
1432--3263[label="0.00225734;1pkt 1fpkt"];
1432--3308[label="0.00225734;1pkt 1fpkt"];
1432--3344[label="0.00225734;1pkt 1fpkt"];
1432--4014[label="0.166667;1pkt 1fpkt"];
1432--4332[label="0.25;1pkt 1fpkt"];
1432--4448[label="0.142857;1pkt 1fpkt"];
1432--4610[label="0.00225734;1pkt 1fpkt"];
1432--5391[label="0.00225734;1pkt 1fpkt"];
1432--5707[label="0.00225734;1pkt 1fpkt"];
1649--2616[label="0.00226244;1pkt 1fpkt"];
1649--3099[label="1;442pkt 442fpkt"];
1649--3187[label="0.00226244;1pkt 1fpkt"];
1649--3263[label="0.00226244;1pkt 1fpkt"];
1649--3308[label="0.00226244;1pkt 1fpkt"];
1649--3344[label="0.00226244;1pkt 1fpkt"];
1649--4014[label="0.166667;1pkt 1fpkt"];
1649--4332[label="0.25;1pkt 1fpkt"];
1649--4448[label="0.142857;1pkt 1fpkt"];
1649--4610[label="0.00226244;1pkt 1fpkt"];
1649--5391[label="0.00226244;1pkt 1fpkt"];
1649--5707[label="0.00226244;1pkt 1fpkt"];
1650--4014[label="0.166667;1pkt 1fpkt"];
1650--4332[label="0.25;1pkt 1fpkt"];
1650--4448[label="0.142857;1pkt 1fpkt"];
2210--4014[label="0.166667;1pkt 1fpkt"];
2210--4448[label="0.142857;1pkt 1fpkt"];
3099--3187[label="0.00226244;1pkt 1fpkt"];
3099--3263[label="0.00226244;1pkt 1fpkt"];
3099--3308[label="0.00226244;1pkt 1fpkt"];
3099--3344[label="0.00226244;1pkt 1fpkt"];
3099--4014[label="0.166667;1pkt 1fpkt"];
3099--4332[label="0.25;1pkt 1fpkt"];
3099--4448[label="0.142857;1pkt 1fpkt"];
3099--4610[label="0.00226244;1pkt 1fpkt"];
3099--5391[label="0.00226244;1pkt 1fpkt"];
3099--5707[label="0.00226244;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="192.231.28.56"/>
      <filter dst_ip="192.231.28.187"/>
      <filter dst_ip="192.231.28.222"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786899" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.863625,1.45226,999,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_367{
style=filled;
color=gray75;
1717[label="193.17.111.152;s;390pkt 390fpkt", shape=diamond, color=yellow];
2854[label="193.17.111.152;s;346pkt 346fpkt", shape=hexagon, color=black];
4334[label="193.17.111.152;457pkt 457fpkt", shape=pentagon, color=darkviolet];
5282[label="193.17.111.152;457pkt 457fpkt", shape=invtriangle, color=brown];
stat367[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.17.111.152:*, *:53}[73.7418%]&lt;BR/&gt;{193.17.111.152:25, *:*}[22.5383%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (36.7273%)&lt;BR/&gt; 25: (11.697%)&lt;BR/&gt; 123: (1.15152%)&lt;BR/&gt; 443: (0.30303%)&lt;BR/&gt; 1240: (0.242424%)&gt;];
}
1717--1842[label="0.00512821;2pkt 2fpkt"];
1717--2197[label="0.00769231;3pkt 3fpkt"];
1717--2205[label="0.00769231;3pkt 3fpkt"];
1717--2283[label="0.0025641;1pkt 1fpkt"];
1717--2854[label="1;346pkt 346fpkt"];
1717--3089[label="0.00769231;3pkt 3fpkt"];
1717--3132[label="0.0025641;1pkt 1fpkt"];
1717--3269[label="0.074359;29pkt 29fpkt"];
1717--4334[label="1;390pkt 390fpkt"];
1717--5282[label="1;390pkt 390fpkt"];
2854--3089[label="0.00867052;3pkt 3fpkt"];
2854--3132[label="0.00289017;1pkt 1fpkt"];
2854--3269[label="0.083815;29pkt 29fpkt"];
2854--4334[label="1;346pkt 346fpkt"];
2854--5282[label="1;346pkt 346fpkt"];
4334--5282[label="1;457pkt 457fpkt"];
</description>
    <slice>
      <filter src_ip="193.17.111.152" src_port="25"/>
      <filter dst_port="53" src_ip="193.17.111.152"/>
    </slice>
    <from sec="1230786007" usec="0"/>
    <to sec="1230786892" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="37.34.20.155"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.787119,1.48264,999,0 0 0 1 1 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_369{
style=filled;
color=gray75;
208[label="193.17.115.41;d;20pkt 20fpkt", shape=diamond, color=yellow];
210[label="209.17.106.156;s;3pkt 3fpkt", shape=diamond, color=yellow];
630[label="193.17.114.12;d;58pkt 58fpkt", shape=diamond, color=yellow];
1752[label="7.193.5.26;s;2pkt 2fpkt", shape=diamond, color=yellow];
2559[label="193.17.115.41;d;14pkt 14fpkt", shape=hexagon, color=black];
3049[label="7.193.5.26;s;2pkt 2fpkt", shape=hexagon, color=black];
3543[label="7.193.5.26;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4359[label="209.17.106.156;3pkt 3fpkt", shape=pentagon, color=darkviolet];
stat369[shape=component, label=&lt;Rules:&lt;BR/&gt;{212.7.130.59:9990, 193.17.114.12:*}[42.3077%]&lt;BR/&gt;{*:*, 193.17.115.41:*}[25.641%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9990: (15.8654%)&lt;BR/&gt; 443: (6.73077%)&lt;BR/&gt; 8000: (5.76923%)&lt;BR/&gt; 10086: (5.28846%)&lt;BR/&gt; 9035: (4.80769%)&gt;];
}
208--210[label="0.666667;2pkt 2fpkt"];
208--1752[label="1;2pkt 2fpkt"];
208--2559[label="1;14pkt 14fpkt"];
208--3049[label="1;2pkt 2fpkt"];
208--3543[label="1;2pkt 2fpkt"];
208--4359[label="0.666667;2pkt 2fpkt"];
210--630[label="0.333333;1pkt 1fpkt"];
210--2559[label="0.666667;2pkt 2fpkt"];
210--4359[label="1;3pkt 3fpkt"];
630--4359[label="0.333333;1pkt 1fpkt"];
1752--2559[label="0.5;1pkt 1fpkt"];
1752--3049[label="1;2pkt 2fpkt"];
1752--3543[label="1;2pkt 2fpkt"];
2559--3049[label="0.5;1pkt 1fpkt"];
2559--3543[label="0.5;1pkt 1fpkt"];
2559--4359[label="0.666667;2pkt 2fpkt"];
3049--3543[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="193.17.115.41"/>
      <filter dst_ip="193.17.114.12" src_ip="212.7.130.59" src_port="9990"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.863625,1.45226,502,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_370{
style=filled;
color=gray75;
192[label="160.180.189.81;s;656pkt 656fpkt", shape=diamond, color=yellow];
193[label="35.44.26.106;d;7484pkt 7484fpkt", shape=diamond, color=yellow];
241[label="160.180.189.82;s;545pkt 545fpkt", shape=diamond, color=yellow];
286[label="160.180.189.220;s;479pkt 479fpkt", shape=diamond, color=yellow];
292[label="160.180.176.155;s;523pkt 523fpkt", shape=diamond, color=yellow];
306[label="160.180.189.103;s;285pkt 285fpkt", shape=diamond, color=yellow];
325[label="160.180.145.92;s;593pkt 593fpkt", shape=diamond, color=yellow];
347[label="160.180.176.156;s;506pkt 506fpkt", shape=diamond, color=yellow];
387[label="160.180.189.19;s;699pkt 699fpkt", shape=diamond, color=yellow];
419[label="160.180.189.41;s;517pkt 517fpkt", shape=diamond, color=yellow];
435[label="160.180.189.3;s;516pkt 516fpkt", shape=diamond, color=yellow];
645[label="160.180.148.138;s;164pkt 164fpkt", shape=diamond, color=yellow];
658[label="160.180.177.6;s;281pkt 281fpkt", shape=diamond, color=yellow];
666[label="160.180.176.167;s;478pkt 478fpkt", shape=diamond, color=yellow];
741[label="160.180.189.234;s;593pkt 593fpkt", shape=diamond, color=yellow];
1031[label="160.180.176.152;s;271pkt 271fpkt", shape=diamond, color=yellow];
1203[label="160.180.189.181;s;343pkt 343fpkt", shape=diamond, color=yellow];
2360[label="35.44.26.106;d;2653pkt 2653fpkt", shape=hexagon, color=black];
2387[label="160.180.145.92;s;467pkt 467fpkt", shape=hexagon, color=black];
2389[label="160.180.176.156;s;286pkt 286fpkt", shape=hexagon, color=black];
2461[label="160.180.189.103;s;285pkt 285fpkt", shape=hexagon, color=black];
2490[label="160.180.189.234;s;131pkt 131fpkt", shape=hexagon, color=black];
2620[label="160.180.189.81;s;656pkt 656fpkt", shape=hexagon, color=black];
2627[label="160.180.177.6;s;281pkt 281fpkt", shape=hexagon, color=black];
2702[label="160.180.148.138;s;93pkt 93fpkt", shape=hexagon, color=black];
2723[label="160.180.189.41;s;517pkt 517fpkt", shape=hexagon, color=black];
2726[label="160.180.189.3;s;516pkt 516fpkt", shape=hexagon, color=black];
2796[label="160.180.176.167;s;320pkt 320fpkt", shape=hexagon, color=black];
2958[label="160.180.189.181;s;305pkt 305fpkt", shape=hexagon, color=black];
2968[label="160.180.176.155;s;466pkt 466fpkt", shape=hexagon, color=black];
3084[label="160.180.189.82;s;545pkt 545fpkt", shape=hexagon, color=black];
3399[label="160.180.177.6;304pkt 304fpkt", shape=pentagon, color=darkviolet];
3925[label="160.180.189.81;708pkt 708fpkt", shape=pentagon, color=darkviolet];
4339[label="160.180.176.152;294pkt 294fpkt", shape=pentagon, color=darkviolet];
4356[label="160.180.176.155;566pkt 566fpkt", shape=pentagon, color=darkviolet];
4363[label="160.180.176.156;547pkt 547fpkt", shape=pentagon, color=darkviolet];
4425[label="160.180.176.167;506pkt 506fpkt", shape=pentagon, color=darkviolet];
4507[label="160.180.189.181;373pkt 373fpkt", shape=pentagon, color=darkviolet];
5133[label="160.180.189.81;708pkt 708fpkt", shape=invtriangle, color=brown];
5285[label="160.180.176.152;294pkt 294fpkt", shape=invtriangle, color=brown];
5294[label="160.180.176.156;547pkt 547fpkt", shape=invtriangle, color=brown];
5344[label="160.180.189.181;373pkt 373fpkt", shape=invtriangle, color=brown];
stat370[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:22, 35.44.26.106:*}[96.0438%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 22: (48.5203%)&lt;BR/&gt; 53: (1.3388%)&lt;BR/&gt; 80: (0.0704633%)&lt;BR/&gt; 25: (0.0523958%)&lt;BR/&gt; 0: (0.036135%)&gt;];
}
192--193[label="0.914634;600pkt 600fpkt"];
192--1327[label="0.00199203;1pkt 1fpkt"];
192--1564[label="0.00729927;1pkt 1fpkt"];
192--1736[label="0.04;3pkt 3fpkt"];
192--2056[label="0.0015456;1pkt 1fpkt"];
192--2360[label="0.323171;212pkt 212fpkt"];
192--2620[label="1;656pkt 656fpkt"];
192--3037[label="0.046875;3pkt 3fpkt"];
192--3264[label="0.00152439;1pkt 1fpkt"];
192--3309[label="0.00152439;1pkt 1fpkt"];
192--3345[label="0.00152439;1pkt 1fpkt"];
192--3925[label="1;656pkt 656fpkt"];
192--5133[label="1;656pkt 656fpkt"];
193--241[label="1;545pkt 545fpkt"];
193--286[label="1;479pkt 479fpkt"];
193--292[label="1;523pkt 523fpkt"];
193--306[label="1;285pkt 285fpkt"];
193--325[label="1;593pkt 593fpkt"];
193--347[label="0.998024;505pkt 505fpkt"];
193--387[label="1;699pkt 699fpkt"];
193--419[label="1;517pkt 517fpkt"];
193--435[label="0.998062;515pkt 515fpkt"];
193--645[label="1;164pkt 164fpkt"];
193--658[label="1;281pkt 281fpkt"];
193--666[label="0.585774;280pkt 280fpkt"];
193--741[label="0.903879;536pkt 536fpkt"];
193--1031[label="1;271pkt 271fpkt"];
193--1203[label="1;343pkt 343fpkt"];
193--2360[label="1;2653pkt 2653fpkt"];
193--2387[label="1;467pkt 467fpkt"];
193--2389[label="1;286pkt 286fpkt"];
193--2461[label="1;285pkt 285fpkt"];
193--2490[label="1;131pkt 131fpkt"];
193--2620[label="0.914634;600pkt 600fpkt"];
193--2627[label="1;281pkt 281fpkt"];
193--2702[label="1;93pkt 93fpkt"];
193--2723[label="1;517pkt 517fpkt"];
193--2726[label="0.998062;515pkt 515fpkt"];
193--2796[label="0.590625;189pkt 189fpkt"];
193--2958[label="1;305pkt 305fpkt"];
193--2968[label="1;466pkt 466fpkt"];
193--3084[label="1;545pkt 545fpkt"];
193--3399[label="0.921053;280pkt 280fpkt"];
193--3925[label="0.847458;600pkt 600fpkt"];
193--4339[label="0.921769;271pkt 271fpkt"];
193--4356[label="0.924028;523pkt 523fpkt"];
193--4363[label="0.923218;505pkt 505fpkt"];
193--4425[label="0.55336;280pkt 280fpkt"];
193--4507[label="0.919571;343pkt 343fpkt"];
193--5133[label="0.847458;600pkt 600fpkt"];
193--5285[label="0.921769;271pkt 271fpkt"];
193--5294[label="0.923218;505pkt 505fpkt"];
193--5344[label="0.919571;343pkt 343fpkt"];
241--2360[label="0.355963;194pkt 194fpkt"];
241--3084[label="1;545pkt 545fpkt"];
286--2360[label="0.39666;190pkt 190fpkt"];
292--2360[label="0.357553;187pkt 187fpkt"];
292--2968[label="1;466pkt 466fpkt"];
292--4356[label="1;523pkt 523fpkt"];
306--2360[label="0.396491;113pkt 113fpkt"];
306--2461[label="1;285pkt 285fpkt"];
325--2360[label="0.354132;210pkt 210fpkt"];
325--2387[label="1;467pkt 467fpkt"];
347--2360[label="0.353755;179pkt 179fpkt"];
347--2389[label="1;286pkt 286fpkt"];
347--4363[label="1;506pkt 506fpkt"];
347--5294[label="1;506pkt 506fpkt"];
387--2360[label="0.450644;315pkt 315fpkt"];
419--2360[label="0.355899;184pkt 184fpkt"];
419--2723[label="1;517pkt 517fpkt"];
435--879[label="0.00595238;1pkt 1fpkt"];
435--2360[label="0.399225;206pkt 206fpkt"];
435--2598[label="0.00869565;1pkt 1fpkt"];
435--2726[label="1;516pkt 516fpkt"];
645--2360[label="0.353659;58pkt 58fpkt"];
645--2702[label="1;93pkt 93fpkt"];
658--2360[label="0.355872;100pkt 100fpkt"];
658--2627[label="1;281pkt 281fpkt"];
658--3399[label="0.996441;280pkt 280fpkt"];
666--2197[label="0.0125523;6pkt 6fpkt"];
666--2360[label="0.207113;99pkt 99fpkt"];
666--2796[label="1;320pkt 320fpkt"];
666--3264[label="0.0104603;5pkt 5fpkt"];
666--3309[label="0.0104603;5pkt 5fpkt"];
666--3345[label="0.0104603;5pkt 5fpkt"];
666--4425[label="1;478pkt 478fpkt"];
741--2205[label="0.0510806;26pkt 26fpkt"];
741--2360[label="0.320405;190pkt 190fpkt"];
741--2490[label="1;131pkt 131fpkt"];
741--3089[label="0.0510806;26pkt 26fpkt"];
1031--2360[label="0.354244;96pkt 96fpkt"];
1031--4339[label="1;271pkt 271fpkt"];
1031--5285[label="1;271pkt 271fpkt"];
1203--2360[label="0.349854;120pkt 120fpkt"];
1203--2958[label="1;305pkt 305fpkt"];
1203--4507[label="1;343pkt 343fpkt"];
1203--5344[label="1;343pkt 343fpkt"];
2360--2387[label="0.449679;210pkt 210fpkt"];
2360--2389[label="0.625874;179pkt 179fpkt"];
2360--2461[label="0.396491;113pkt 113fpkt"];
2360--2490[label="1;131pkt 131fpkt"];
2360--2620[label="0.323171;212pkt 212fpkt"];
2360--2627[label="0.355872;100pkt 100fpkt"];
2360--2702[label="0.623656;58pkt 58fpkt"];
2360--2723[label="0.355899;184pkt 184fpkt"];
2360--2726[label="0.399225;206pkt 206fpkt"];
2360--2796[label="0.309375;99pkt 99fpkt"];
2360--2958[label="0.393443;120pkt 120fpkt"];
2360--2968[label="0.401288;187pkt 187fpkt"];
2360--3084[label="0.355963;194pkt 194fpkt"];
2360--3399[label="0.325658;99pkt 99fpkt"];
2360--3925[label="0.299435;212pkt 212fpkt"];
2360--4339[label="0.326531;96pkt 96fpkt"];
2360--4356[label="0.330389;187pkt 187fpkt"];
2360--4363[label="0.327239;179pkt 179fpkt"];
2360--4425[label="0.195652;99pkt 99fpkt"];
2360--4507[label="0.321716;120pkt 120fpkt"];
2360--5133[label="0.299435;212pkt 212fpkt"];
2360--5285[label="0.326531;96pkt 96fpkt"];
2360--5294[label="0.327239;179pkt 179fpkt"];
2360--5344[label="0.321716;120pkt 120fpkt"];
2389--4363[label="1;286pkt 286fpkt"];
2389--5294[label="1;286pkt 286fpkt"];
2620--3037[label="0.046875;3pkt 3fpkt"];
2620--3264[label="0.00152439;1pkt 1fpkt"];
2620--3309[label="0.00152439;1pkt 1fpkt"];
2620--3345[label="0.00152439;1pkt 1fpkt"];
2620--3925[label="1;656pkt 656fpkt"];
2620--5133[label="1;656pkt 656fpkt"];
2627--3399[label="0.996441;280pkt 280fpkt"];
2796--3264[label="0.015625;5pkt 5fpkt"];
2796--3309[label="0.015625;5pkt 5fpkt"];
2796--3345[label="0.015625;5pkt 5fpkt"];
2796--4425[label="1;320pkt 320fpkt"];
2958--4507[label="1;305pkt 305fpkt"];
2958--5344[label="1;305pkt 305fpkt"];
2968--4356[label="1;466pkt 466fpkt"];
3925--5133[label="1;708pkt 708fpkt"];
4339--5285[label="1;294pkt 294fpkt"];
4363--5294[label="1;547pkt 547fpkt"];
4507--5344[label="1;373pkt 373fpkt"];
</description>
    <slice>
      <filter dst_ip="35.44.26.106" src_port="22"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="121.228.32.158"/>
    </slice>
    <from sec="1230786048" usec="0"/>
    <to sec="1230786896" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="192.231.22.160"/>
    </slice>
    <from sec="1230786115" usec="0"/>
    <to sec="1230786823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="80.122.35.160"/>
    </slice>
    <from sec="1230786473" usec="0"/>
    <to sec="1230786502" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="23.30.198.160"/>
    </slice>
    <from sec="1230786378" usec="0"/>
    <to sec="1230786429" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="154.101.171.161"/>
    </slice>
    <from sec="1230786060" usec="0"/>
    <to sec="1230786898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="214.210.83.162"/>
    </slice>
    <from sec="1230786883" usec="0"/>
    <to sec="1230786888" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="44.254.176.162"/>
    </slice>
    <from sec="1230786004" usec="0"/>
    <to sec="1230786891" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.658853,1.50038,020,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_379{
style=filled;
color=gray75;
1267[label="192.231.28.163;s;210pkt 210fpkt", shape=diamond, color=yellow];
4394[label="192.231.28.163;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5304[label="192.231.28.163;1pkt 1fpkt", shape=invtriangle, color=brown];
stat379[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.231.28.163:0, *:0}[99.5238%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.5283%)&lt;BR/&gt; 6000: (0.235849%)&lt;BR/&gt; 2967: (0.235849%)&gt;];
}
1267--1438[label="0.0047619;1pkt 1fpkt"];
1267--1617[label="0.0047619;1pkt 1fpkt"];
1267--1621[label="0.0047619;1pkt 1fpkt"];
1267--1624[label="0.0047619;1pkt 1fpkt"];
1267--1625[label="0.0047619;1pkt 1fpkt"];
1267--1632[label="0.0047619;1pkt 1fpkt"];
1267--1647[label="0.0047619;1pkt 1fpkt"];
1267--1815[label="0.0047619;1pkt 1fpkt"];
1267--1816[label="0.0047619;1pkt 1fpkt"];
1267--1823[label="0.0047619;1pkt 1fpkt"];
1267--1843[label="0.0047619;1pkt 1fpkt"];
1267--2212[label="0.0047619;1pkt 1fpkt"];
1267--2383[label="0.00775194;1pkt 1fpkt"];
1267--2806[label="0.0047619;1pkt 1fpkt"];
1267--2972[label="0.0047619;1pkt 1fpkt"];
1267--2975[label="0.0047619;1pkt 1fpkt"];
1267--2981[label="0.0047619;1pkt 1fpkt"];
1267--4394[label="1;1pkt 1fpkt"];
1267--5304[label="1;1pkt 1fpkt"];
4394--5304[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="192.231.28.163"/>
    </slice>
    <from sec="1230786002" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,002,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="44.189.209.164"/>
    </slice>
    <from sec="1230786634" usec="0"/>
    <to sec="1230786658" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="193.129.42.166"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="216.215.39.167"/>
    </slice>
    <from sec="1230786415" usec="0"/>
    <to sec="1230786461" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.38.145.172"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="206.140.155.172"/>
    </slice>
    <from sec="1230786380" usec="0"/>
    <to sec="1230786403" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="56.134.74.174"/>
    </slice>
    <from sec="1230786410" usec="0"/>
    <to sec="1230786463" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.38.140.174"/>
    </slice>
    <from sec="1230786097" usec="0"/>
    <to sec="1230786874" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="193.240.82.175"/>
    </slice>
    <from sec="1230786341" usec="0"/>
    <to sec="1230786411" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="49.165.152.175"/>
    </slice>
    <from sec="1230786404" usec="0"/>
    <to sec="1230786426" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.161.86.176"/>
    </slice>
    <from sec="1230786852" usec="0"/>
    <to sec="1230786898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="204.114.83.177"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="81.194.4.178"/>
    </slice>
    <from sec="1230786046" usec="0"/>
    <to sec="1230786295" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.208.125.178"/>
    </slice>
    <from sec="1230786121" usec="0"/>
    <to sec="1230786126" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="201.158.63.179"/>
    </slice>
    <from sec="1230786057" usec="0"/>
    <to sec="1230786800" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="63.141.58.180"/>
    </slice>
    <from sec="1230786098" usec="0"/>
    <to sec="1230786379" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="217.213.80.181"/>
    </slice>
    <from sec="1230786007" usec="0"/>
    <to sec="1230786889" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.219.243.181"/>
    </slice>
    <from sec="1230786007" usec="0"/>
    <to sec="1230786896" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="219.38.184.182"/>
    </slice>
    <from sec="1230786109" usec="0"/>
    <to sec="1230786202" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="9.104.99.184"/>
    </slice>
    <from sec="1230786572" usec="0"/>
    <to sec="1230786601" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="3.141.254.186"/>
    </slice>
    <from sec="1230786018" usec="0"/>
    <to sec="1230786576" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="200.250.152.187"/>
    </slice>
    <from sec="1230786599" usec="0"/>
    <to sec="1230786661" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="2.99.81.190"/>
    </slice>
    <from sec="1230786391" usec="0"/>
    <to sec="1230786408" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="193.196.18.192"/>
    </slice>
    <from sec="1230786464" usec="0"/>
    <to sec="1230786499" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="215.196.64.192"/>
    </slice>
    <from sec="1230786005" usec="0"/>
    <to sec="1230786900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="54.103.6.193"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="84.97.170.193"/>
    </slice>
    <from sec="1230786188" usec="0"/>
    <to sec="1230786458" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="80.164.0.195"/>
    </slice>
    <from sec="1230786601" usec="0"/>
    <to sec="1230786803" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="61.235.234.195"/>
    </slice>
    <from sec="1230786800" usec="0"/>
    <to sec="1230786830" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.171.133.197"/>
    </slice>
    <from sec="1230786020" usec="0"/>
    <to sec="1230786168" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="41.41.233.197"/>
    </slice>
    <from sec="1230786596" usec="0"/>
    <to sec="1230786897" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_412{
style=filled;
color=gray75;
4609[label="192.231.29.198;221pkt 221fpkt", shape=pentagon, color=darkviolet];
stat412[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.231.29.198:*, *:53}[99.5475%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (49.7738%)&lt;BR/&gt; 59389: (0.226244%)&lt;BR/&gt; 59381: (0.226244%)&lt;BR/&gt; 59378: (0.226244%)&lt;BR/&gt; 59373: (0.226244%)&gt;];
}
</description>
    <slice>
      <filter dst_port="53" src_ip="192.231.29.198"/>
    </slice>
    <from sec="1230786007" usec="0"/>
    <to sec="1230786899" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="35.180.39.199"/>
    </slice>
    <from sec="1230786658" usec="0"/>
    <to sec="1230786704" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="3.68.80.199"/>
    </slice>
    <from sec="1230786583" usec="0"/>
    <to sec="1230786637" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.863625,1.45226,503,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_415{
style=filled;
color=gray75;
896[label="85.96.40.86;d;339pkt 339fpkt", shape=diamond, color=yellow];
1092[label="192.231.22.200;s;217pkt 217fpkt", shape=diamond, color=yellow];
1486[label="192.231.22.129;s;276pkt 276fpkt", shape=diamond, color=yellow];
1903[label="81.242.150.149;d;142pkt 142fpkt", shape=diamond, color=yellow];
2593[label="192.231.22.200;s;133pkt 133fpkt", shape=hexagon, color=black];
2739[label="192.231.22.129;s;155pkt 155fpkt", shape=hexagon, color=black];
3033[label="81.242.150.149;d;126pkt 126fpkt", shape=hexagon, color=black];
4617[label="192.231.22.200;233pkt 233fpkt", shape=pentagon, color=darkviolet];
5395[label="192.231.22.200;233pkt 233fpkt", shape=invtriangle, color=brown];
stat415[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.231.22.200:80, 85.96.40.86:*}[45.5796%]&lt;BR/&gt;{192.231.22.129:80, 81.242.150.149:*}[27.8978%]&lt;BR/&gt;{192.231.22.129:80, 85.96.40.86:*}[24.165%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.8921%)&lt;BR/&gt; 4998: (0.134844%)&lt;BR/&gt; 4997: (0.134844%)&lt;BR/&gt; 4994: (0.134844%)&lt;BR/&gt; 4993: (0.134844%)&gt;];
}
896--1092[label="0.995392;216pkt 216fpkt"];
896--1486[label="0.445652;123pkt 123fpkt"];
896--2593[label="0.992481;132pkt 132fpkt"];
896--2739[label="0.445161;69pkt 69fpkt"];
896--3230[label="0.0501475;17pkt 17fpkt"];
896--3276[label="0.0501475;17pkt 17fpkt"];
896--4617[label="0.927039;216pkt 216fpkt"];
896--5395[label="0.927039;216pkt 216fpkt"];
1092--1162[label="0.00460829;1pkt 1fpkt"];
1092--2593[label="1;133pkt 133fpkt"];
1092--3230[label="0.0460829;10pkt 10fpkt"];
1092--3276[label="0.0460829;10pkt 10fpkt"];
1092--4617[label="1;217pkt 217fpkt"];
1092--5395[label="1;217pkt 217fpkt"];
1486--1903[label="1;142pkt 142fpkt"];
1486--2739[label="1;155pkt 155fpkt"];
1486--3033[label="1;126pkt 126fpkt"];
1486--3230[label="0.057971;16pkt 16fpkt"];
1486--3276[label="0.057971;16pkt 16fpkt"];
1903--2739[label="0.549296;78pkt 78fpkt"];
1903--3033[label="1;126pkt 126fpkt"];
1903--3230[label="0.0492958;7pkt 7fpkt"];
1903--3276[label="0.0492958;7pkt 7fpkt"];
2593--3230[label="0.075188;10pkt 10fpkt"];
2593--3276[label="0.075188;10pkt 10fpkt"];
2593--4617[label="1;133pkt 133fpkt"];
2593--5395[label="1;133pkt 133fpkt"];
2739--3033[label="0.619048;78pkt 78fpkt"];
2739--3230[label="0.103226;16pkt 16fpkt"];
2739--3276[label="0.103226;16pkt 16fpkt"];
3033--3230[label="0.0555556;7pkt 7fpkt"];
3033--3276[label="0.0555556;7pkt 7fpkt"];
4617--5395[label="1;233pkt 233fpkt"];
</description>
    <slice>
      <filter dst_ip="85.96.40.86" src_ip="192.231.22.129" src_port="80"/>
      <filter dst_ip="81.242.150.149" src_ip="192.231.22.129" src_port="80"/>
      <filter dst_ip="85.96.40.86" src_ip="192.231.22.200" src_port="80"/>
    </slice>
    <from sec="1230786002" usec="0"/>
    <to sec="1230786900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="7.251.203.201"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="84.106.235.201"/>
    </slice>
    <from sec="1230786002" usec="0"/>
    <to sec="1230786900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="192.234.248.201"/>
    </slice>
    <from sec="1230786002" usec="0"/>
    <to sec="1230786900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="58.98.93.203"/>
    </slice>
    <from sec="1230786844" usec="0"/>
    <to sec="1230786874" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="23.178.7.204"/>
    </slice>
    <from sec="1230786408" usec="0"/>
    <to sec="1230786454" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.554793,1.5298,503,0 0 0 1 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_422{
style=filled;
color=gray75;
2132[label="192.231.18.130;d;30pkt 30fpkt", shape=diamond, color=yellow];
4653[label="212.134.169.205;9pkt 9fpkt", shape=pentagon, color=darkviolet];
stat422[shape=component, label=&lt;Rules:&lt;BR/&gt;{50.43.37.154:80, 192.231.18.130:*}[33.3333%]&lt;BR/&gt;{212.134.169.205:80, 192.231.18.130:*}[30%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 51121: (2.5641%)&lt;BR/&gt; 51073: (2.5641%)&lt;BR/&gt; 51046: (2.5641%)&lt;BR/&gt; 51034: (2.5641%)&gt;];
}
2132--4378[label="0.0666667;1pkt 1fpkt"];
2132--4653[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="192.231.18.130" src_ip="50.43.37.154" src_port="80"/>
      <filter dst_ip="192.231.18.130" src_ip="212.134.169.205" src_port="80"/>
    </slice>
    <from sec="1230786591" usec="0"/>
    <to sec="1230786784" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="61.229.79.206"/>
    </slice>
    <from sec="1230786829" usec="0"/>
    <to sec="1230786875" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="62.219.108.206"/>
    </slice>
    <from sec="1230786483" usec="0"/>
    <to sec="1230786510" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="45.96.122.207"/>
    </slice>
    <from sec="1230786254" usec="0"/>
    <to sec="1230786315" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="47.222.37.209"/>
    </slice>
    <from sec="1230786182" usec="0"/>
    <to sec="1230786234" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.863625,1.45226,999,0 0 0 1 1 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_427{
style=filled;
color=gray75;
259[label="154.101.68.89;d;26pkt 26fpkt", shape=diamond, color=yellow];
442[label="23.3.27.37;s;1pkt 1fpkt", shape=diamond, color=yellow];
640[label="84.71.46.211;s;1pkt 1fpkt", shape=diamond, color=yellow];
851[label="210.105.195.31;s;1pkt 1fpkt", shape=diamond, color=yellow];
1479[label="3.172.123.205;s;1pkt 1fpkt", shape=diamond, color=yellow];
2102[label="9.137.249.84;s;1pkt 1fpkt", shape=diamond, color=yellow];
2738[label="3.172.123.205;s;1pkt 1fpkt", shape=hexagon, color=black];
4675[label="84.71.46.211;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5421[label="84.71.46.211;1pkt 1fpkt", shape=invtriangle, color=brown];
stat427[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:17788, 154.101.68.89:2332}[38.4615%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 2332: (42.6471%)&lt;BR/&gt; 17788: (14.7059%)&lt;BR/&gt; 7201: (7.35294%)&lt;BR/&gt; 1569: (7.35294%)&lt;BR/&gt; 33662: (5.88235%)&gt;];
}
259--442[label="1;1pkt 1fpkt"];
259--640[label="1;1pkt 1fpkt"];
259--851[label="1;1pkt 1fpkt"];
259--1479[label="1;1pkt 1fpkt"];
259--2102[label="1;1pkt 1fpkt"];
259--2738[label="1;1pkt 1fpkt"];
259--4675[label="1;1pkt 1fpkt"];
259--5421[label="1;1pkt 1fpkt"];
640--4675[label="1;1pkt 1fpkt"];
640--5421[label="1;1pkt 1fpkt"];
1479--2738[label="1;1pkt 1fpkt"];
4675--5421[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="154.101.68.89" dst_port="2332" src_port="17788"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786829" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="84.165.246.212"/>
    </slice>
    <from sec="1230786580" usec="0"/>
    <to sec="1230786605" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="154.101.44.216"/>
    </slice>
    <from sec="1230786255" usec="0"/>
    <to sec="1230786877" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <description>subgraph cluster_430{
style=filled;
color=gray75;
4708[label="193.26.167.216;304pkt 304fpkt", shape=pentagon, color=darkviolet];
stat430[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.26.167.216:*, *:53}[65.7895%]&lt;BR/&gt;{193.26.167.216:53, *:*}[34.2105%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (50%)&lt;BR/&gt; 65490: (0.164474%)&lt;BR/&gt; 65453: (0.164474%)&lt;BR/&gt; 65348: (0.164474%)&lt;BR/&gt; 65216: (0.164474%)&gt;];
}
</description>
    <slice>
      <filter src_ip="193.26.167.216" src_port="53"/>
      <filter dst_port="53" src_ip="193.26.167.216"/>
    </slice>
    <from sec="1230786008" usec="0"/>
    <to sec="1230786895" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="210.161.16.217"/>
    </slice>
    <from sec="1230786800" usec="0"/>
    <to sec="1230786804" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="121.234.183.218"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="2.203.48.219"/>
    </slice>
    <from sec="1230786322" usec="0"/>
    <to sec="1230786337" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="37.180.86.219"/>
    </slice>
    <from sec="1230786851" usec="0"/>
    <to sec="1230786898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="164.114.88.220"/>
    </slice>
    <from sec="1230786602" usec="0"/>
    <to sec="1230786857" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.919689,1.51124,020,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_436{
style=filled;
color=gray75;
1076[label="192.231.28.222;s;469pkt 469fpkt", shape=diamond, color=yellow];
4735[label="192.231.28.222;470pkt 470fpkt", shape=pentagon, color=darkviolet];
5445[label="192.231.28.222;470pkt 470fpkt", shape=invtriangle, color=brown];
5724[label="192.231.28.222;470pkt 470fpkt", shape=invhouse, color=bisque];
stat436[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.231.28.222:0, *:0}[99.7872%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (99.7871%)&lt;BR/&gt; 6000: (0.10644%)&lt;BR/&gt; 2967: (0.10644%)&gt;];
}
1076--1162[label="0.0021322;1pkt 1fpkt"];
1076--2383[label="0.00775194;1pkt 1fpkt"];
1076--4735[label="1;469pkt 469fpkt"];
1076--5445[label="1;469pkt 469fpkt"];
1076--5724[label="1;469pkt 469fpkt"];
4735--5445[label="1;470pkt 470fpkt"];
4735--5724[label="1;470pkt 470fpkt"];
5445--5724[label="1;470pkt 470fpkt"];
</description>
    <slice>
      <filter src_ip="192.231.28.222"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="45.188.98.224"/>
    </slice>
    <from sec="1230786770" usec="0"/>
    <to sec="1230786815" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="129.83.136.224"/>
    </slice>
    <from sec="1230786377" usec="0"/>
    <to sec="1230786387" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="9.169.2.226"/>
    </slice>
    <from sec="1230786583" usec="0"/>
    <to sec="1230786637" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="36.160.221.227"/>
    </slice>
    <from sec="1230786576" usec="0"/>
    <to sec="1230786585" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="38.160.50.228"/>
    </slice>
    <from sec="1230786363" usec="0"/>
    <to sec="1230786376" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="53.95.140.228"/>
    </slice>
    <from sec="1230786842" usec="0"/>
    <to sec="1230786898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="81.84.15.229"/>
    </slice>
    <from sec="1230786264" usec="0"/>
    <to sec="1230786399" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="49.4.136.229"/>
    </slice>
    <from sec="1230786009" usec="0"/>
    <to sec="1230786882" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="49.4.136.230"/>
    </slice>
    <from sec="1230786002" usec="0"/>
    <to sec="1230786890" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="58.75.19.231"/>
    </slice>
    <from sec="1230786499" usec="0"/>
    <to sec="1230786503" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="160.48.87.232"/>
    </slice>
    <from sec="1230786090" usec="0"/>
    <to sec="1230786886" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,901,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.155.139.232"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="208.71.106.233"/>
    </slice>
    <from sec="1230786756" usec="0"/>
    <to sec="1230786895" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="194.22.135.236"/>
    </slice>
    <from sec="1230786346" usec="0"/>
    <to sec="1230786373" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="43.138.198.237"/>
    </slice>
    <from sec="1230786403" usec="0"/>
    <to sec="1230786435" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="84.106.237.237"/>
    </slice>
    <from sec="1230786039" usec="0"/>
    <to sec="1230786898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="49.65.86.246"/>
    </slice>
    <from sec="1230786198" usec="0"/>
    <to sec="1230786201" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="4.170.37.247"/>
    </slice>
    <from sec="1230786483" usec="0"/>
    <to sec="1230786578" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="192.231.22.248"/>
    </slice>
    <from sec="1230786004" usec="0"/>
    <to sec="1230786008" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,999,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="49.4.136.251"/>
    </slice>
    <from sec="1230786007" usec="0"/>
    <to sec="1230786900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,020,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="182.8.136.251"/>
    </slice>
    <from sec="1230786006" usec="0"/>
    <to sec="1230786897" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="47.186.180.251"/>
    </slice>
    <from sec="1230786114" usec="0"/>
    <to sec="1230786218" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.391687,1.59989,503,0 0 0 0 0 0 0 0 0 1 0 0 ">
    <slice>
      <filter src_ip="218.234.119.252"/>
    </slice>
    <from sec="1230786006" usec="0"/>
    <to sec="1230786900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="3.66.17.0"/>
    </slice>
    <from sec="1230786557" usec="0"/>
    <to sec="1230786677" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_466{
style=filled;
color=gray75;
3352[label="50.82.128.0;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4902[label="50.82.128.0;1pkt 1fpkt", shape=invtriangle, color=brown];
stat466[shape=component, label=&lt;Rules:&lt;BR/&gt;{50.82.128.0:50220, 192.231.22.252:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 50220: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
3352--4902[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="192.231.22.252" dst_port="80" src_ip="50.82.128.0" src_port="50220"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_467{
style=filled;
color=gray75;
3354[label="187.77.224.0;17pkt 17fpkt", shape=pentagon, color=darkviolet];
4903[label="187.77.224.0;17pkt 17fpkt", shape=invtriangle, color=brown];
stat467[shape=component, label=&lt;Rules:&lt;BR/&gt;{187.77.224.0:80, 49.100.17.138:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 61807: (2.94118%)&lt;BR/&gt; 59756: (2.94118%)&lt;BR/&gt; 57738: (2.94118%)&lt;BR/&gt; 56486: (2.94118%)&gt;];
}
3354--4903[label="1;17pkt 17fpkt"];
</description>
    <slice>
      <filter dst_ip="49.100.17.138" src_ip="187.77.224.0" src_port="80"/>
    </slice>
    <from sec="1230786031" usec="0"/>
    <to sec="1230786898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="54.149.66.3"/>
    </slice>
    <from sec="1230786525" usec="0"/>
    <to sec="1230786543" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_469{
style=filled;
color=gray75;
3401[label="2.213.233.6;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4917[label="2.213.233.6;2pkt 2fpkt", shape=invtriangle, color=brown];
5516[label="2.213.233.6;1pkt 1fpkt", shape=invhouse, color=bisque];
stat469[shape=component, label=&lt;Rules:&lt;BR/&gt;{2.213.233.6:55998, 164.114.4.16:80}[50%]&lt;BR/&gt;{2.213.233.6:55999, 164.114.4.16:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 55999: (30%)&lt;BR/&gt; 55998: (20%)&gt;];
}
3401--4917[label="1;2pkt 2fpkt"];
3401--5516[label="1;1pkt 1fpkt"];
4917--5516[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="164.114.4.16" dst_port="80" src_ip="2.213.233.6" src_port="55999"/>
      <filter dst_ip="164.114.4.16" dst_port="80" src_ip="2.213.233.6" src_port="55998"/>
    </slice>
    <from sec="1230786848" usec="0"/>
    <to sec="1230786858" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.919689,1.51124,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_470{
style=filled;
color=gray75;
863[label="193.17.156.102;d;150pkt 150fpkt", shape=diamond, color=yellow];
1098[label="49.100.24.230;s;108pkt 108fpkt", shape=diamond, color=yellow];
1314[label="156.36.61.1;d;110pkt 110fpkt", shape=diamond, color=yellow];
3403[label="58.184.62.7;5pkt 5fpkt", shape=pentagon, color=darkviolet];
3450[label="40.206.15.13;21pkt 21fpkt", shape=pentagon, color=darkviolet];
4530[label="49.86.136.184;5pkt 5fpkt", shape=pentagon, color=darkviolet];
4919[label="58.184.62.7;5pkt 5fpkt", shape=invtriangle, color=brown];
5518[label="58.184.62.7;4pkt 4fpkt", shape=invhouse, color=bisque];
stat470[shape=component, label=&lt;Rules:&lt;BR/&gt;{49.100.24.230:*, 193.17.156.102:80}[41.3793%]&lt;BR/&gt;{*:*, 156.36.61.1:80}[22.9885%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (43.3824%)&lt;BR/&gt; 25: (5.51471%)&lt;BR/&gt; 11967: (0.735294%)&lt;BR/&gt; 4592: (0.490196%)&lt;BR/&gt; 2915: (0.490196%)&gt;];
}
863--1098[label="1;108pkt 108fpkt"];
863--1565[label="0.00666667;1pkt 1fpkt"];
863--1758[label="0.00714286;1pkt 1fpkt"];
863--2770[label="0.010101;1pkt 1fpkt"];
863--3232[label="0.0666667;10pkt 10fpkt"];
863--3246[label="0.08;12pkt 12fpkt"];
863--3265[label="0.0466667;7pkt 7fpkt"];
863--3270[label="0.06;9pkt 9fpkt"];
863--3278[label="0.0666667;10pkt 10fpkt"];
863--3291[label="0.08;12pkt 12fpkt"];
863--3310[label="0.0466667;7pkt 7fpkt"];
863--3314[label="0.0666667;10pkt 10fpkt"];
863--3327[label="0.08;12pkt 12fpkt"];
863--3346[label="0.0466667;7pkt 7fpkt"];
863--3403[label="1;5pkt 5fpkt"];
863--3779[label="0.0909091;2pkt 2fpkt"];
863--4530[label="0.2;1pkt 1fpkt"];
863--4919[label="1;5pkt 5fpkt"];
863--5518[label="1;4pkt 4fpkt"];
1098--3232[label="0.0648148;7pkt 7fpkt"];
1098--3246[label="0.0740741;8pkt 8fpkt"];
1098--3265[label="0.0555556;6pkt 6fpkt"];
1098--3270[label="0.0648148;7pkt 7fpkt"];
1098--3278[label="0.0648148;7pkt 7fpkt"];
1098--3291[label="0.0740741;8pkt 8fpkt"];
1098--3310[label="0.0555556;6pkt 6fpkt"];
1098--3314[label="0.0648148;7pkt 7fpkt"];
1098--3327[label="0.0740741;8pkt 8fpkt"];
1098--3346[label="0.0555556;6pkt 6fpkt"];
1314--1565[label="0.00909091;1pkt 1fpkt"];
1314--2180[label="0.00909091;1pkt 1fpkt"];
1314--2770[label="0.010101;1pkt 1fpkt"];
1314--3074[label="0.00909091;1pkt 1fpkt"];
1314--3222[label="0.00909091;1pkt 1fpkt"];
1314--3232[label="0.0181818;2pkt 2fpkt"];
1314--3246[label="0.0818182;9pkt 9fpkt"];
1314--3265[label="0.0727273;8pkt 8fpkt"];
1314--3268[label="0.0363636;4pkt 4fpkt"];
1314--3270[label="0.0272727;3pkt 3fpkt"];
1314--3273[label="0.00909091;1pkt 1fpkt"];
1314--3278[label="0.0181818;2pkt 2fpkt"];
1314--3291[label="0.0818182;9pkt 9fpkt"];
1314--3310[label="0.0727273;8pkt 8fpkt"];
1314--3314[label="0.0181818;2pkt 2fpkt"];
1314--3327[label="0.0818182;9pkt 9fpkt"];
1314--3346[label="0.0727273;8pkt 8fpkt"];
1314--3450[label="0.952381;20pkt 20fpkt"];
1314--3780[label="0.133333;2pkt 2fpkt"];
1314--4530[label="0.8;4pkt 4fpkt"];
1314--4840[label="0.107143;3pkt 3fpkt"];
3403--4919[label="1;5pkt 5fpkt"];
3403--5518[label="1;4pkt 4fpkt"];
4919--5518[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="156.36.61.1" dst_port="80"/>
      <filter dst_ip="193.17.156.102" dst_port="80" src_ip="49.100.24.230"/>
    </slice>
    <from sec="1230786004" usec="0"/>
    <to sec="1230786886" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="129.56.136.8"/>
    </slice>
    <from sec="1230786637" usec="0"/>
    <to sec="1230786640" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="53.192.188.10"/>
    </slice>
    <from sec="1230786022" usec="0"/>
    <to sec="1230786026" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="80.185.246.10"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786842" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="47.44.76.11"/>
    </slice>
    <from sec="1230786505" usec="0"/>
    <to sec="1230786513" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_476{
style=filled;
color=gray75;
3451[label="210.139.34.13;447pkt 447fpkt", shape=pentagon, color=darkviolet];
4940[label="210.139.34.13;447pkt 447fpkt", shape=invtriangle, color=brown];
5524[label="210.139.34.13;441pkt 441fpkt", shape=invhouse, color=bisque];
stat476[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.139.34.13:*, 160.48.235.36:37954}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 37954: (50%)&lt;BR/&gt; 4983: (0.11236%)&lt;BR/&gt; 4974: (0.11236%)&lt;BR/&gt; 4966: (0.11236%)&lt;BR/&gt; 4948: (0.11236%)&gt;];
}
3451--4940[label="1;447pkt 447fpkt"];
3451--5524[label="1;441pkt 441fpkt"];
4940--5524[label="1;441pkt 441fpkt"];
</description>
    <slice>
      <filter dst_ip="160.48.235.36" dst_port="37954" src_ip="210.139.34.13"/>
    </slice>
    <from sec="1230786020" usec="0"/>
    <to sec="1230786895" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="13.148.252.13"/>
    </slice>
    <from sec="1230786442" usec="0"/>
    <to sec="1230786549" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="61.181.6.15"/>
    </slice>
    <from sec="1230786394" usec="0"/>
    <to sec="1230786423" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="208.203.20.15"/>
    </slice>
    <from sec="1230786412" usec="0"/>
    <to sec="1230786415" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_480{
style=filled;
color=gray75;
3464[label="61.13.57.15;3pkt 3fpkt", shape=pentagon, color=darkviolet];
4944[label="61.13.57.15;3pkt 3fpkt", shape=invtriangle, color=brown];
5526[label="61.13.57.15;3pkt 3fpkt", shape=invhouse, color=bisque];
stat480[shape=component, label=&lt;Rules:&lt;BR/&gt;{61.13.57.15:30943, 156.36.59.229:80}[33.3333%]&lt;BR/&gt;{61.13.57.15:47940, 156.36.59.229:80}[33.3333%]&lt;BR/&gt;{61.13.57.15:48083, 156.36.59.229:80}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 48083: (16.6667%)&lt;BR/&gt; 47940: (16.6667%)&lt;BR/&gt; 30943: (16.6667%)&gt;];
}
3464--4944[label="1;3pkt 3fpkt"];
3464--5526[label="1;3pkt 3fpkt"];
4944--5526[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="156.36.59.229" dst_port="80" src_ip="61.13.57.15" src_port="48083"/>
      <filter dst_ip="156.36.59.229" dst_port="80" src_ip="61.13.57.15" src_port="47940"/>
      <filter dst_ip="156.36.59.229" dst_port="80" src_ip="61.13.57.15" src_port="30943"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_481{
style=filled;
color=gray75;
3465[label="57.10.78.15;7pkt 7fpkt", shape=pentagon, color=darkviolet];
4945[label="57.10.78.15;7pkt 7fpkt", shape=invtriangle, color=brown];
stat481[shape=component, label=&lt;Rules:&lt;BR/&gt;{57.10.78.15:12975, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 12975: (50%)&lt;BR/&gt; 60841: (7.14286%)&lt;BR/&gt; 57986: (7.14286%)&lt;BR/&gt; 3320: (7.14286%)&lt;BR/&gt; 2962: (7.14286%)&gt;];
}
3465--4945[label="1;7pkt 7fpkt"];
</description>
    <slice>
      <filter src_ip="57.10.78.15" src_port="12975"/>
    </slice>
    <from sec="1230786031" usec="0"/>
    <to sec="1230786894" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="78.34.6.16"/>
    </slice>
    <from sec="1230786489" usec="0"/>
    <to sec="1230786655" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_483{
style=filled;
color=gray75;
3501[label="154.101.22.20;22pkt 22fpkt", shape=pentagon, color=darkviolet];
4963[label="154.101.22.20;22pkt 22fpkt", shape=invtriangle, color=brown];
stat483[shape=component, label=&lt;Rules:&lt;BR/&gt;{154.101.22.20:*, 196.41.167.81:110}[63.6364%]&lt;BR/&gt;{154.101.22.20:46092, *:*}[36.3636%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 110: (31.8182%)&lt;BR/&gt; 46092: (18.1818%)&lt;BR/&gt; 63944: (2.27273%)&lt;BR/&gt; 57248: (2.27273%)&lt;BR/&gt; 51229: (2.27273%)&gt;];
}
3501--4963[label="1;22pkt 22fpkt"];
</description>
    <slice>
      <filter src_ip="154.101.22.20" src_port="46092"/>
      <filter dst_ip="196.41.167.81" dst_port="110" src_ip="154.101.22.20"/>
    </slice>
    <from sec="1230786039" usec="0"/>
    <to sec="1230786845" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_484{
style=filled;
color=gray75;
3507[label="193.9.214.20;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4966[label="193.9.214.20;1pkt 1fpkt", shape=invtriangle, color=brown];
stat484[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.9.214.20:49788, 160.33.106.238:161}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 49788: (50%)&lt;BR/&gt; 161: (50%)&gt;];
}
3507--4966[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="160.33.106.238" dst_port="161" src_ip="193.9.214.20" src_port="49788"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="52.209.8.22"/>
    </slice>
    <from sec="1230786657" usec="0"/>
    <to sec="1230786681" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="220.13.86.24"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="7.37.152.26"/>
    </slice>
    <from sec="1230786091" usec="0"/>
    <to sec="1230786225" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="9.104.219.27"/>
    </slice>
    <from sec="1230786419" usec="0"/>
    <to sec="1230786437" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_489{
style=filled;
color=gray75;
3555[label="160.48.85.28;18pkt 18fpkt", shape=pentagon, color=darkviolet];
4984[label="160.48.85.28;17pkt 17fpkt", shape=invtriangle, color=brown];
stat489[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.48.85.28:25, *:*}[66.6667%]&lt;BR/&gt;{160.48.85.28:110, *:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (32.8571%)&lt;BR/&gt; 110: (17.1429%)&lt;BR/&gt; 63247: (2.85714%)&lt;BR/&gt; 62779: (2.85714%)&lt;BR/&gt; 62316: (2.85714%)&gt;];
}
3555--4984[label="1;17pkt 17fpkt"];
</description>
    <slice>
      <filter src_ip="160.48.85.28" src_port="25"/>
      <filter src_ip="160.48.85.28" src_port="110"/>
    </slice>
    <from sec="1230786014" usec="0"/>
    <to sec="1230786840" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_490{
style=filled;
color=gray75;
3560[label="213.75.72.29;2pkt 2fpkt", shape=pentagon, color=darkviolet];
4987[label="213.75.72.29;2pkt 2fpkt", shape=invtriangle, color=brown];
stat490[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.75.72.29:3208, 192.231.16.117:80}[50%]&lt;BR/&gt;{213.75.72.29:3211, 192.231.16.117:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3211: (25%)&lt;BR/&gt; 3208: (25%)&gt;];
}
3560--4987[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="192.231.16.117" dst_port="80" src_ip="213.75.72.29" src_port="3211"/>
      <filter dst_ip="192.231.16.117" dst_port="80" src_ip="213.75.72.29" src_port="3208"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_492{
style=filled;
color=gray75;
3582[label="154.101.171.32;21pkt 21fpkt", shape=pentagon, color=darkviolet];
4994[label="154.101.171.32;22pkt 22fpkt", shape=invtriangle, color=brown];
stat492[shape=component, label=&lt;Rules:&lt;BR/&gt;{154.101.171.32:*, 49.130.158.121:80}[59.0909%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 51758: (2.32558%)&lt;BR/&gt; 51757: (2.32558%)&lt;BR/&gt; 51754: (2.32558%)&lt;BR/&gt; 51118: (2.32558%)&gt;];
}
3582--4994[label="1;21pkt 21fpkt"];
</description>
    <slice>
      <filter dst_ip="49.130.158.121" dst_port="80" src_ip="154.101.171.32"/>
    </slice>
    <from sec="1230786673" usec="0"/>
    <to sec="1230786842" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="3.70.132.34"/>
    </slice>
    <from sec="1230786419" usec="0"/>
    <to sec="1230786435" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="84.183.246.34"/>
    </slice>
    <from sec="1230786415" usec="0"/>
    <to sec="1230786543" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="84.134.12.36"/>
    </slice>
    <from sec="1230786130" usec="0"/>
    <to sec="1230786137" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_496{
style=filled;
color=gray75;
3607[label="85.136.22.36;46pkt 46fpkt", shape=pentagon, color=darkviolet];
5004[label="85.136.22.36;46pkt 46fpkt", shape=invtriangle, color=brown];
stat496[shape=component, label=&lt;Rules:&lt;BR/&gt;{85.136.22.36:*, 164.114.226.201:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1157: (1.08696%)&lt;BR/&gt; 1156: (1.08696%)&lt;BR/&gt; 1155: (1.08696%)&lt;BR/&gt; 1154: (1.08696%)&gt;];
}
3607--5004[label="1;46pkt 46fpkt"];
</description>
    <slice>
      <filter dst_ip="164.114.226.201" dst_port="80" src_ip="85.136.22.36"/>
    </slice>
    <from sec="1230786786" usec="0"/>
    <to sec="1230786818" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="3.67.81.38"/>
    </slice>
    <from sec="1230786036" usec="0"/>
    <to sec="1230786079" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="3.67.82.38"/>
    </slice>
    <from sec="1230786526" usec="0"/>
    <to sec="1230786688" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.733657,1.56545,503,0 0 0 1 0 0 0 0 0 0 1 0 ">
    <description>subgraph cluster_500{
style=filled;
color=gray75;
1944[label="164.114.43.39;s;150pkt 150fpkt", shape=diamond, color=yellow];
5012[label="164.114.43.39;214pkt 214fpkt", shape=invtriangle, color=brown];
stat500[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.114.43.39:*, 208.34.110.175:80}[22.4299%]&lt;BR/&gt;{164.114.43.39:*, 42.94.109.81:80}[21.9626%]&lt;BR/&gt;{164.114.43.39:*, 42.94.109.31:80}[21.028%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.8626%)&lt;BR/&gt; 3346: (0.274725%)&lt;BR/&gt; 3344: (0.274725%)&lt;BR/&gt; 3343: (0.274725%)&lt;BR/&gt; 3340: (0.274725%)&gt;];
}
1944--3270[label="0.0666667;10pkt 10fpkt"];
1944--5012[label="1;150pkt 150fpkt"];
</description>
    <slice>
      <filter dst_ip="208.34.110.175" dst_port="80" src_ip="164.114.43.39"/>
      <filter dst_ip="42.94.109.81" dst_port="80" src_ip="164.114.43.39"/>
      <filter dst_ip="42.94.109.31" dst_port="80" src_ip="164.114.43.39"/>
    </slice>
    <from sec="1230786009" usec="0"/>
    <to sec="1230786895" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_501{
style=filled;
color=gray75;
3629[label="164.114.142.39;93pkt 93fpkt", shape=pentagon, color=darkviolet];
5013[label="164.114.142.39;93pkt 93fpkt", shape=invtriangle, color=brown];
5547[label="164.114.142.39;94pkt 94fpkt", shape=invhouse, color=bisque];
stat501[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.114.142.39:*, 215.179.86.162:53}[27.6596%]&lt;BR/&gt;{164.114.142.39:53, *:*}[27.6596%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (49.2857%)&lt;BR/&gt; 0: (1.42857%)&lt;BR/&gt; 65531: (0.535714%)&lt;BR/&gt; 64010: (0.535714%)&lt;BR/&gt; 63654: (0.535714%)&gt;];
}
3629--5013[label="1;93pkt 93fpkt"];
3629--5547[label="1;93pkt 93fpkt"];
5013--5547[label="1;93pkt 93fpkt"];
</description>
    <slice>
      <filter src_ip="164.114.142.39" src_port="53"/>
      <filter dst_ip="215.179.86.162" dst_port="53" src_ip="164.114.142.39"/>
    </slice>
    <from sec="1230786002" usec="0"/>
    <to sec="1230786785" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_502{
style=filled;
color=gray75;
3635[label="48.187.145.40;5pkt 5fpkt", shape=pentagon, color=darkviolet];
5015[label="48.187.145.40;5pkt 5fpkt", shape=invtriangle, color=brown];
stat502[shape=component, label=&lt;Rules:&lt;BR/&gt;{48.187.145.40:80, 154.101.18.213:2889}[20%]&lt;BR/&gt;{48.187.145.40:80, 154.101.18.213:2987}[20%]&lt;BR/&gt;{48.187.145.40:80, 154.101.18.213:2989}[20%]&lt;BR/&gt;{48.187.145.40:80, 154.101.18.213:2991}[20%]&lt;BR/&gt;{48.187.145.40:80, 154.101.18.213:2993}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2993: (10%)&lt;BR/&gt; 2991: (10%)&lt;BR/&gt; 2989: (10%)&lt;BR/&gt; 2987: (10%)&gt;];
}
3635--5015[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="154.101.18.213" dst_port="2993" src_ip="48.187.145.40" src_port="80"/>
      <filter dst_ip="154.101.18.213" dst_port="2991" src_ip="48.187.145.40" src_port="80"/>
      <filter dst_ip="154.101.18.213" dst_port="2989" src_ip="48.187.145.40" src_port="80"/>
      <filter dst_ip="154.101.18.213" dst_port="2987" src_ip="48.187.145.40" src_port="80"/>
      <filter dst_ip="154.101.18.213" dst_port="2889" src_ip="48.187.145.40" src_port="80"/>
    </slice>
    <from sec="1230786681" usec="0"/>
    <to sec="1230786740" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.974676,1.57586,999,0 0 0 1 0 0 0 0 0 0 1 1 ">
    <description>subgraph cluster_503{
style=filled;
color=gray75;
1477[label="193.17.156.89;d;171pkt 171fpkt", shape=diamond, color=yellow];
1593[label="215.57.166.40;s;2pkt 2fpkt", shape=diamond, color=yellow];
5016[label="215.57.166.40;1pkt 1fpkt", shape=invtriangle, color=brown];
5548[label="215.57.166.40;1pkt 1fpkt", shape=invhouse, color=bisque];
stat503[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:53, 193.17.156.89:*}[95.3216%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (46.5714%)&lt;BR/&gt; 80: (2.28571%)&lt;BR/&gt; 54122: (1.14286%)&lt;BR/&gt; 54121: (0.571429%)&lt;BR/&gt; 123: (0.571429%)&gt;];
}
1477--1593[label="1;2pkt 2fpkt"];
1477--2198[label="0.0116959;2pkt 2fpkt"];
1477--2636[label="0.00584795;1pkt 1fpkt"];
1477--3264[label="0.0935673;16pkt 16fpkt"];
1477--3309[label="0.0935673;16pkt 16fpkt"];
1477--3345[label="0.0935673;16pkt 16fpkt"];
1477--3484[label="0.00584795;1pkt 1fpkt"];
1477--4221[label="0.00584795;1pkt 1fpkt"];
1477--4749[label="0.00584795;1pkt 1fpkt"];
1477--5016[label="1;1pkt 1fpkt"];
1477--5548[label="1;1pkt 1fpkt"];
1593--5016[label="1;1pkt 1fpkt"];
1593--5548[label="1;1pkt 1fpkt"];
5016--5548[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="193.17.156.89" src_port="53"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786810" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="209.64.0.41"/>
    </slice>
    <from sec="1230786340" usec="0"/>
    <to sec="1230786357" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_505{
style=filled;
color=gray75;
3645[label="219.168.246.41;25pkt 25fpkt", shape=pentagon, color=darkviolet];
5019[label="219.168.246.41;25pkt 25fpkt", shape=invtriangle, color=brown];
stat505[shape=component, label=&lt;Rules:&lt;BR/&gt;{219.168.246.41:80, 192.231.22.189:*}[92%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 55406: (2%)&lt;BR/&gt; 51241: (2%)&lt;BR/&gt; 41906: (2%)&lt;BR/&gt; 41895: (2%)&gt;];
}
3645--5019[label="1;25pkt 25fpkt"];
</description>
    <slice>
      <filter dst_ip="192.231.22.189" src_ip="219.168.246.41" src_port="80"/>
    </slice>
    <from sec="1230786003" usec="0"/>
    <to sec="1230786898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_506{
style=filled;
color=gray75;
3646[label="34.145.60.42;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5020[label="34.145.60.42;1pkt 1fpkt", shape=invtriangle, color=brown];
stat506[shape=component, label=&lt;Rules:&lt;BR/&gt;{34.145.60.42:58171, 192.231.21.209:48698}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 58171: (50%)&lt;BR/&gt; 48698: (50%)&gt;];
}
3646--5020[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="192.231.21.209" dst_port="48698" src_ip="34.145.60.42" src_port="58171"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_507{
style=filled;
color=gray75;
3680[label="154.101.110.47;11pkt 11fpkt", shape=pentagon, color=darkviolet];
5033[label="154.101.110.47;11pkt 11fpkt", shape=invtriangle, color=brown];
stat507[shape=component, label=&lt;Rules:&lt;BR/&gt;{154.101.110.47:31863, *:*}[63.6364%]&lt;BR/&gt;{154.101.110.47:*, 35.180.39.199:80}[27.2727%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 31863: (31.8182%)&lt;BR/&gt; 80: (13.6364%)&lt;BR/&gt; 41231: (9.09091%)&lt;BR/&gt; 55347: (4.54545%)&lt;BR/&gt; 50237: (4.54545%)&gt;];
}
3680--5033[label="1;11pkt 11fpkt"];
</description>
    <slice>
      <filter src_ip="154.101.110.47" src_port="31863"/>
      <filter dst_ip="35.180.39.199" dst_port="80" src_ip="154.101.110.47"/>
    </slice>
    <from sec="1230786236" usec="0"/>
    <to sec="1230786780" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_508{
style=filled;
color=gray75;
3682[label="193.17.155.47;9pkt 9fpkt", shape=pentagon, color=darkviolet];
5034[label="193.17.155.47;9pkt 9fpkt", shape=invtriangle, color=brown];
5555[label="193.17.155.47;8pkt 8fpkt", shape=invhouse, color=bisque];
stat508[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.17.155.47:80, 210.115.43.11:*}[88.8889%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 50127: (5.76923%)&lt;BR/&gt; 50126: (5.76923%)&lt;BR/&gt; 50123: (5.76923%)&lt;BR/&gt; 50121: (5.76923%)&gt;];
}
3682--5034[label="1;9pkt 9fpkt"];
3682--5555[label="1;8pkt 8fpkt"];
5034--5555[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="210.115.43.11" src_ip="193.17.155.47" src_port="80"/>
    </slice>
    <from sec="1230786058" usec="0"/>
    <to sec="1230786529" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,504,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_509{
style=filled;
color=gray75;
3684[label="164.114.64.48;10pkt 10fpkt", shape=pentagon, color=darkviolet];
5035[label="164.114.64.48;10pkt 10fpkt", shape=invtriangle, color=brown];
5556[label="164.114.64.48;9pkt 9fpkt", shape=invhouse, color=bisque];
stat509[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.114.64.48:*, 193.27.128.95:443}[90%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (46.5517%)&lt;BR/&gt; 1662: (5.17241%)&lt;BR/&gt; 1661: (5.17241%)&lt;BR/&gt; 1660: (5.17241%)&lt;BR/&gt; 1659: (5.17241%)&gt;];
}
3684--5035[label="1;10pkt 10fpkt"];
3684--5556[label="1;9pkt 9fpkt"];
5035--5556[label="1;9pkt 9fpkt"];
</description>
    <slice>
      <filter dst_ip="193.27.128.95" dst_port="443" src_ip="164.114.64.48"/>
    </slice>
    <from sec="1230786511" usec="0"/>
    <to sec="1230786898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="216.113.142.48"/>
    </slice>
    <from sec="1230786131" usec="0"/>
    <to sec="1230786477" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_511{
style=filled;
color=gray75;
3696[label="160.48.84.49;25pkt 25fpkt", shape=pentagon, color=darkviolet];
5039[label="160.48.84.49;25pkt 25fpkt", shape=invtriangle, color=brown];
stat511[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.48.84.49:*, 48.187.145.40:80}[24%]&lt;BR/&gt;{160.48.84.49:*, 53.53.73.154:80}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 4709: (2%)&lt;BR/&gt; 4708: (2%)&lt;BR/&gt; 4707: (2%)&lt;BR/&gt; 4705: (2%)&gt;];
}
3696--5039[label="1;25pkt 25fpkt"];
</description>
    <slice>
      <filter dst_ip="48.187.145.40" dst_port="80" src_ip="160.48.84.49"/>
      <filter dst_ip="53.53.73.154" dst_port="80" src_ip="160.48.84.49"/>
    </slice>
    <from sec="1230786623" usec="0"/>
    <to sec="1230786898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_512{
style=filled;
color=gray75;
3700[label="192.231.5.50;20pkt 20fpkt", shape=pentagon, color=darkviolet];
5041[label="192.231.5.50;20pkt 20fpkt", shape=invtriangle, color=brown];
5558[label="192.231.5.50;19pkt 19fpkt", shape=invhouse, color=bisque];
stat512[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.231.5.50:*, *:53}[70%]&lt;BR/&gt;{192.231.5.50:*, *:80}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (35.5932%)&lt;BR/&gt; 80: (11.8644%)&lt;BR/&gt; 46940: (2.54237%)&lt;BR/&gt; 46936: (2.54237%)&lt;BR/&gt; 46934: (2.54237%)&gt;];
}
3700--5041[label="1;20pkt 20fpkt"];
3700--5558[label="1;19pkt 19fpkt"];
5041--5558[label="1;19pkt 19fpkt"];
</description>
    <slice>
      <filter dst_port="53" src_ip="192.231.5.50"/>
      <filter dst_port="80" src_ip="192.231.5.50"/>
    </slice>
    <from sec="1230786004" usec="0"/>
    <to sec="1230786878" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.658853,1.50038,999,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_513{
style=filled;
color=gray75;
1685[label="3.149.134.8;d;14pkt 14fpkt", shape=diamond, color=yellow];
1697[label="193.17.111.154;s;175pkt 175fpkt", shape=diamond, color=yellow];
3685[label="193.17.102.48;3pkt 3fpkt", shape=pentagon, color=darkviolet];
3705[label="193.17.102.50;3pkt 3fpkt", shape=pentagon, color=darkviolet];
4184[label="193.17.104.129;4pkt 4fpkt", shape=pentagon, color=darkviolet];
4395[label="193.17.104.163;4pkt 4fpkt", shape=pentagon, color=darkviolet];
5042[label="193.17.102.50;3pkt 3fpkt", shape=invtriangle, color=brown];
stat513[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.17.111.154:25, *:*}[46.5969%]&lt;BR/&gt;{193.17.111.154:*, *:113}[40.3141%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (21.6019%)&lt;BR/&gt; 113: (18.6893%)&lt;BR/&gt; 60468: (2.42718%)&lt;BR/&gt; 49249: (2.42718%)&lt;BR/&gt; 993: (1.94175%)&gt;];
}
1685--1697[label="0.285714;4pkt 4fpkt"];
1685--3685[label="0.666667;2pkt 2fpkt"];
1685--3705[label="0.666667;2pkt 2fpkt"];
1685--4184[label="0.5;2pkt 2fpkt"];
1685--4395[label="0.5;2pkt 2fpkt"];
1685--5042[label="0.666667;2pkt 2fpkt"];
3705--5042[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter src_ip="193.17.111.154" src_port="25"/>
      <filter dst_port="113" src_ip="193.17.111.154"/>
    </slice>
    <from sec="1230786002" usec="0"/>
    <to sec="1230786895" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_514{
style=filled;
color=gray75;
3709[label="209.165.17.51;30pkt 30fpkt", shape=pentagon, color=darkviolet];
5045[label="209.165.17.51;30pkt 30fpkt", shape=invtriangle, color=brown];
stat514[shape=component, label=&lt;Rules:&lt;BR/&gt;{209.165.17.51:*, 154.101.41.182:161}[93.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 161: (48.3333%)&lt;BR/&gt; 55559: (3.33333%)&lt;BR/&gt; 0: (3.33333%)&lt;BR/&gt; 65327: (1.66667%)&lt;BR/&gt; 65326: (1.66667%)&gt;];
}
3709--5045[label="1;30pkt 30fpkt"];
</description>
    <slice>
      <filter dst_ip="154.101.41.182" dst_port="161" src_ip="209.165.17.51"/>
    </slice>
    <from sec="1230786004" usec="0"/>
    <to sec="1230786881" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_515{
style=filled;
color=gray75;
3710[label="49.100.24.51;11pkt 11fpkt", shape=pentagon, color=darkviolet];
5046[label="49.100.24.51;11pkt 11fpkt", shape=invtriangle, color=brown];
stat515[shape=component, label=&lt;Rules:&lt;BR/&gt;{49.100.24.51:*, 152.74.142.73:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 60488: (4.54545%)&lt;BR/&gt; 57492: (4.54545%)&lt;BR/&gt; 55285: (4.54545%)&lt;BR/&gt; 52586: (4.54545%)&gt;];
}
3710--5046[label="1;11pkt 11fpkt"];
</description>
    <slice>
      <filter dst_ip="152.74.142.73" dst_port="80" src_ip="49.100.24.51"/>
    </slice>
    <from sec="1230786087" usec="0"/>
    <to sec="1230786858" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="3.65.201.53"/>
    </slice>
    <from sec="1230786298" usec="0"/>
    <to sec="1230786312" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_518{
style=filled;
color=gray75;
3739[label="48.187.170.55;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5056[label="48.187.170.55;1pkt 1fpkt", shape=invtriangle, color=brown];
5564[label="48.187.170.55;1pkt 1fpkt", shape=invhouse, color=bisque];
stat518[shape=component, label=&lt;Rules:&lt;BR/&gt;{48.187.170.55:54219, 192.231.31.65:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 54219: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
3739--5056[label="1;1pkt 1fpkt"];
3739--5564[label="1;1pkt 1fpkt"];
5056--5564[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="192.231.31.65" dst_port="80" src_ip="48.187.170.55" src_port="54219"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="81.196.84.56"/>
    </slice>
    <from sec="1230786246" usec="0"/>
    <to sec="1230786461" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="48.27.168.56"/>
    </slice>
    <from sec="1230786527" usec="0"/>
    <to sec="1230786564" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="66.183.173.57"/>
    </slice>
    <from sec="1230786348" usec="0"/>
    <to sec="1230786376" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_522{
style=filled;
color=gray75;
3755[label="11.84.32.58;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5066[label="11.84.32.58;1pkt 1fpkt", shape=invtriangle, color=brown];
5567[label="11.84.32.58;1pkt 1fpkt", shape=invhouse, color=bisque];
stat522[shape=component, label=&lt;Rules:&lt;BR/&gt;{11.84.32.58:4617, 192.231.16.117:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4617: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
3755--5066[label="1;1pkt 1fpkt"];
3755--5567[label="1;1pkt 1fpkt"];
5066--5567[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="192.231.16.117" dst_port="80" src_ip="11.84.32.58" src_port="4617"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_523{
style=filled;
color=gray75;
3761[label="23.87.70.59;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5069[label="23.87.70.59;1pkt 1fpkt", shape=invtriangle, color=brown];
stat523[shape=component, label=&lt;Rules:&lt;BR/&gt;{23.87.70.59:1527, 192.231.21.209:3127}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3127: (50%)&lt;BR/&gt; 1527: (50%)&gt;];
}
3761--5069[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="192.231.21.209" dst_port="3127" src_ip="23.87.70.59" src_port="1527"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="210.108.211.61"/>
    </slice>
    <from sec="1230786002" usec="0"/>
    <to sec="1230786605" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_525{
style=filled;
color=gray75;
3777[label="49.113.2.62;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5073[label="49.113.2.62;1pkt 1fpkt", shape=invtriangle, color=brown];
stat525[shape=component, label=&lt;Rules:&lt;BR/&gt;{49.113.2.62:1416, 192.231.16.116:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1416: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
3777--5073[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="192.231.16.116" dst_port="80" src_ip="49.113.2.62" src_port="1416"/>
    </slice>
    <from sec="1230786885" usec="0"/>
    <to sec="1230786891" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="54.3.55.62"/>
    </slice>
    <from sec="1230786579" usec="0"/>
    <to sec="1230786608" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="192.231.19.64"/>
    </slice>
    <from sec="1230786007" usec="0"/>
    <to sec="1230786898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_528{
style=filled;
color=gray75;
3794[label="197.251.30.65;4pkt 4fpkt", shape=pentagon, color=darkviolet];
5080[label="197.251.30.65;4pkt 4fpkt", shape=invtriangle, color=brown];
stat528[shape=component, label=&lt;Rules:&lt;BR/&gt;{197.251.30.65:80, 154.101.99.82:34601}[25%]&lt;BR/&gt;{197.251.30.65:80, 154.101.99.82:39260}[25%]&lt;BR/&gt;{197.251.30.65:80, 154.101.99.82:45303}[25%]&lt;BR/&gt;{197.251.30.65:80, 154.101.99.82:48885}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 48885: (12.5%)&lt;BR/&gt; 45303: (12.5%)&lt;BR/&gt; 39260: (12.5%)&lt;BR/&gt; 34601: (12.5%)&gt;];
}
3794--5080[label="1;4pkt 4fpkt"];
</description>
    <slice>
      <filter dst_ip="154.101.99.82" dst_port="48885" src_ip="197.251.30.65" src_port="80"/>
      <filter dst_ip="154.101.99.82" dst_port="45303" src_ip="197.251.30.65" src_port="80"/>
      <filter dst_ip="154.101.99.82" dst_port="39260" src_ip="197.251.30.65" src_port="80"/>
      <filter dst_ip="154.101.99.82" dst_port="34601" src_ip="197.251.30.65" src_port="80"/>
    </slice>
    <from sec="1230786073" usec="0"/>
    <to sec="1230786169" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_529{
style=filled;
color=gray75;
3807[label="192.231.28.66;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5086[label="192.231.28.66;1pkt 1fpkt", shape=invtriangle, color=brown];
5581[label="192.231.28.66;1pkt 1fpkt", shape=invhouse, color=bisque];
stat529[shape=component, label=&lt;Rules:&lt;BR/&gt;{192.231.28.66:25, 85.114.4.215:3129}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3129: (50%)&lt;BR/&gt; 25: (50%)&gt;];
}
3807--5086[label="1;1pkt 1fpkt"];
3807--5581[label="1;1pkt 1fpkt"];
5086--5581[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="85.114.4.215" dst_port="3129" src_ip="192.231.28.66" src_port="25"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_530{
style=filled;
color=gray75;
3812[label="164.114.225.66;88pkt 88fpkt", shape=pentagon, color=darkviolet];
5089[label="164.114.225.66;88pkt 88fpkt", shape=invtriangle, color=brown];
stat530[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.114.225.66:*, *:53}[62.5%]&lt;BR/&gt;{164.114.225.66:53, *:*}[28.4091%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (45.4545%)&lt;BR/&gt; 0: (6.81818%)&lt;BR/&gt; 25: (1.13636%)&lt;BR/&gt; 64760: (0.568182%)&lt;BR/&gt; 64697: (0.568182%)&gt;];
}
3812--5089[label="1;88pkt 88fpkt"];
</description>
    <slice>
      <filter src_ip="164.114.225.66" src_port="53"/>
      <filter dst_port="53" src_ip="164.114.225.66"/>
    </slice>
    <from sec="1230786063" usec="0"/>
    <to sec="1230786900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,504,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_531{
style=filled;
color=gray75;
3818[label="154.101.7.68;8pkt 8fpkt", shape=pentagon, color=darkviolet];
5090[label="154.101.7.68;8pkt 8fpkt", shape=invtriangle, color=brown];
5583[label="154.101.7.68;8pkt 8fpkt", shape=invhouse, color=bisque];
stat531[shape=component, label=&lt;Rules:&lt;BR/&gt;{154.101.7.68:*, 48.40.153.53:443}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (50%)&lt;BR/&gt; 1917: (6.25%)&lt;BR/&gt; 1916: (6.25%)&lt;BR/&gt; 1908: (6.25%)&lt;BR/&gt; 1907: (6.25%)&gt;];
}
3818--5090[label="1;8pkt 8fpkt"];
3818--5583[label="1;8pkt 8fpkt"];
5090--5583[label="1;8pkt 8fpkt"];
</description>
    <slice>
      <filter dst_ip="48.40.153.53" dst_port="443" src_ip="154.101.7.68"/>
    </slice>
    <from sec="1230786080" usec="0"/>
    <to sec="1230786753" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_532{
style=filled;
color=gray75;
3823[label="160.48.73.68;160pkt 160fpkt", shape=pentagon, color=darkviolet];
5093[label="160.48.73.68;160pkt 160fpkt", shape=invtriangle, color=brown];
stat532[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.48.73.68:*, 198.65.28.52:53}[93.125%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (46.5625%)&lt;BR/&gt; 110: (3.125%)&lt;BR/&gt; 65522: (0.3125%)&lt;BR/&gt; 65466: (0.3125%)&lt;BR/&gt; 65323: (0.3125%)&gt;];
}
3823--5093[label="1;160pkt 160fpkt"];
</description>
    <slice>
      <filter dst_ip="198.65.28.52" dst_port="53" src_ip="160.48.73.68"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786885" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_533{
style=filled;
color=gray75;
3824[label="85.61.96.68;16pkt 16fpkt", shape=pentagon, color=darkviolet];
5094[label="85.61.96.68;16pkt 16fpkt", shape=invtriangle, color=brown];
5584[label="85.61.96.68;16pkt 16fpkt", shape=invhouse, color=bisque];
stat533[shape=component, label=&lt;Rules:&lt;BR/&gt;{85.61.96.68:*, 164.114.4.6:25}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 3937: (3.125%)&lt;BR/&gt; 3802: (3.125%)&lt;BR/&gt; 3716: (3.125%)&lt;BR/&gt; 2907: (3.125%)&gt;];
}
3824--5094[label="1;16pkt 16fpkt"];
3824--5584[label="1;16pkt 16fpkt"];
5094--5584[label="1;16pkt 16fpkt"];
</description>
    <slice>
      <filter dst_ip="164.114.4.6" dst_port="25" src_ip="85.61.96.68"/>
    </slice>
    <from sec="1230786271" usec="0"/>
    <to sec="1230786351" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_534{
style=filled;
color=gray75;
3825[label="216.224.142.68;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5095[label="216.224.142.68;2pkt 2fpkt", shape=invtriangle, color=brown];
5585[label="216.224.142.68;2pkt 2fpkt", shape=invhouse, color=bisque];
stat534[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.224.142.68:43128, 156.36.39.108:25}[50%]&lt;BR/&gt;{216.224.142.68:43166, 156.36.39.108:25}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 43166: (25%)&lt;BR/&gt; 43128: (25%)&gt;];
}
3825--5095[label="1;2pkt 2fpkt"];
3825--5585[label="1;2pkt 2fpkt"];
5095--5585[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="156.36.39.108" dst_port="25" src_ip="216.224.142.68" src_port="43166"/>
      <filter dst_ip="156.36.39.108" dst_port="25" src_ip="216.224.142.68" src_port="43128"/>
    </slice>
    <from sec="1230786839" usec="0"/>
    <to sec="1230786862" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_535{
style=filled;
color=gray75;
3841[label="216.224.142.70;3pkt 3fpkt", shape=pentagon, color=darkviolet];
5102[label="216.224.142.70;3pkt 3fpkt", shape=invtriangle, color=brown];
stat535[shape=component, label=&lt;Rules:&lt;BR/&gt;{216.224.142.70:27606, 156.36.4.42:25}[33.3333%]&lt;BR/&gt;{216.224.142.70:27459, 156.36.39.108:25}[33.3333%]&lt;BR/&gt;{216.224.142.70:27445, 156.36.84.189:25}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 27606: (16.6667%)&lt;BR/&gt; 27459: (16.6667%)&lt;BR/&gt; 27445: (16.6667%)&gt;];
}
3841--5102[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="156.36.84.189" dst_port="25" src_ip="216.224.142.70" src_port="27445"/>
      <filter dst_ip="156.36.39.108" dst_port="25" src_ip="216.224.142.70" src_port="27459"/>
      <filter dst_ip="156.36.4.42" dst_port="25" src_ip="216.224.142.70" src_port="27606"/>
    </slice>
    <from sec="1230786840" usec="0"/>
    <to sec="1230786855" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_536{
style=filled;
color=gray75;
3866[label="208.2.218.72;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5111[label="208.2.218.72;2pkt 2fpkt", shape=invtriangle, color=brown];
5593[label="208.2.218.72;2pkt 2fpkt", shape=invhouse, color=bisque];
stat536[shape=component, label=&lt;Rules:&lt;BR/&gt;{208.2.218.72:54610, 192.231.29.168:80}[50%]&lt;BR/&gt;{208.2.218.72:54611, 192.231.29.168:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 54611: (25%)&lt;BR/&gt; 54610: (25%)&gt;];
}
3866--5111[label="1;2pkt 2fpkt"];
3866--5593[label="1;2pkt 2fpkt"];
5111--5593[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="192.231.29.168" dst_port="80" src_ip="208.2.218.72" src_port="54611"/>
      <filter dst_ip="192.231.29.168" dst_port="80" src_ip="208.2.218.72" src_port="54610"/>
    </slice>
    <from sec="1230786847" usec="0"/>
    <to sec="1230786849" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_537{
style=filled;
color=gray75;
3899[label="4.144.107.78;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5121[label="4.144.107.78;1pkt 1fpkt", shape=invtriangle, color=brown];
stat537[shape=component, label=&lt;Rules:&lt;BR/&gt;{4.144.107.78:21250, 192.231.16.117:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 21250: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
3899--5121[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="192.231.16.117" dst_port="80" src_ip="4.144.107.78" src_port="21250"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_538{
style=filled;
color=gray75;
3905[label="130.36.0.79;18pkt 18fpkt", shape=pentagon, color=darkviolet];
5123[label="130.36.0.79;18pkt 18fpkt", shape=invtriangle, color=brown];
stat538[shape=component, label=&lt;Rules:&lt;BR/&gt;{130.36.0.79:*, 192.231.21.208:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 1458: (2.77778%)&lt;BR/&gt; 1456: (2.77778%)&lt;BR/&gt; 1455: (2.77778%)&lt;BR/&gt; 1454: (2.77778%)&gt;];
}
3905--5123[label="1;18pkt 18fpkt"];
</description>
    <slice>
      <filter dst_ip="192.231.21.208" dst_port="80" src_ip="130.36.0.79"/>
    </slice>
    <from sec="1230786874" usec="0"/>
    <to sec="1230786884" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_539{
style=filled;
color=gray75;
3915[label="33.76.15.80;3pkt 3fpkt", shape=pentagon, color=darkviolet];
5128[label="33.76.15.80;3pkt 3fpkt", shape=invtriangle, color=brown];
5602[label="33.76.15.80;3pkt 3fpkt", shape=invhouse, color=bisque];
stat539[shape=component, label=&lt;Rules:&lt;BR/&gt;{33.76.15.80:80, 154.101.57.76:2939}[33.3333%]&lt;BR/&gt;{33.76.15.80:80, 154.101.57.76:2940}[33.3333%]&lt;BR/&gt;{33.76.15.80:80, 154.101.57.76:2941}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2941: (16.6667%)&lt;BR/&gt; 2940: (16.6667%)&lt;BR/&gt; 2939: (16.6667%)&gt;];
}
3915--5128[label="1;3pkt 3fpkt"];
3915--5602[label="1;3pkt 3fpkt"];
5128--5602[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="154.101.57.76" dst_port="2941" src_ip="33.76.15.80" src_port="80"/>
      <filter dst_ip="154.101.57.76" dst_port="2940" src_ip="33.76.15.80" src_port="80"/>
      <filter dst_ip="154.101.57.76" dst_port="2939" src_ip="33.76.15.80" src_port="80"/>
    </slice>
    <from sec="1230786063" usec="0"/>
    <to sec="1230786751" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_540{
style=filled;
color=gray75;
3917[label="187.77.20.80;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5129[label="187.77.20.80;1pkt 1fpkt", shape=invtriangle, color=brown];
stat540[shape=component, label=&lt;Rules:&lt;BR/&gt;{187.77.20.80:80, 49.100.30.88:64833}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 64833: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
3917--5129[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="49.100.30.88" dst_port="64833" src_ip="187.77.20.80" src_port="80"/>
    </slice>
    <from sec="1230786214" usec="0"/>
    <to sec="1230786217" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_541{
style=filled;
color=gray75;
3919[label="182.8.116.80;31pkt 31fpkt", shape=pentagon, color=darkviolet];
5131[label="182.8.116.80;31pkt 31fpkt", shape=invtriangle, color=brown];
stat541[shape=component, label=&lt;Rules:&lt;BR/&gt;{182.8.116.80:80, 49.100.10.97:*}[61.2903%]&lt;BR/&gt;{182.8.116.80:80, 216.62.212.44:*}[25.8065%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 56195: (1.6129%)&lt;BR/&gt; 56194: (1.6129%)&lt;BR/&gt; 56193: (1.6129%)&lt;BR/&gt; 56191: (1.6129%)&gt;];
}
3919--5131[label="1;31pkt 31fpkt"];
</description>
    <slice>
      <filter dst_ip="49.100.10.97" src_ip="182.8.116.80" src_port="80"/>
      <filter dst_ip="216.62.212.44" src_ip="182.8.116.80" src_port="80"/>
    </slice>
    <from sec="1230786332" usec="0"/>
    <to sec="1230786865" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_542{
style=filled;
color=gray75;
3932[label="160.48.167.82;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5136[label="160.48.167.82;1pkt 1fpkt", shape=invtriangle, color=brown];
5607[label="160.48.167.82;1pkt 1fpkt", shape=invhouse, color=bisque];
stat542[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.48.167.82:993, 212.249.177.251:3075}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3075: (50%)&lt;BR/&gt; 993: (50%)&gt;];
}
3932--5136[label="1;1pkt 1fpkt"];
3932--5607[label="1;1pkt 1fpkt"];
5136--5607[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="212.249.177.251" dst_port="3075" src_ip="160.48.167.82" src_port="993"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="4.164.47.84"/>
    </slice>
    <from sec="1230786606" usec="0"/>
    <to sec="1230786679" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="62.231.147.84"/>
    </slice>
    <from sec="1230786734" usec="0"/>
    <to sec="1230786766" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_545{
style=filled;
color=gray75;
3955[label="194.194.30.85;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5144[label="194.194.30.85;1pkt 1fpkt", shape=invtriangle, color=brown];
5612[label="194.194.30.85;1pkt 1fpkt", shape=invhouse, color=bisque];
stat545[shape=component, label=&lt;Rules:&lt;BR/&gt;{194.194.30.85:1364, 192.231.21.208:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1364: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
3955--5144[label="1;1pkt 1fpkt"];
3955--5612[label="1;1pkt 1fpkt"];
5144--5612[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="192.231.21.208" dst_port="80" src_ip="194.194.30.85" src_port="1364"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,504,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_546{
style=filled;
color=gray75;
3965[label="165.66.39.87;40pkt 40fpkt", shape=pentagon, color=darkviolet];
5147[label="165.66.39.87;40pkt 40fpkt", shape=invtriangle, color=brown];
stat546[shape=component, label=&lt;Rules:&lt;BR/&gt;{165.66.39.87:443, 49.100.30.230:*}[67.5%]&lt;BR/&gt;{165.66.39.87:*, 218.235.105.62:53}[22.5%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 443: (38.75%)&lt;BR/&gt; 53: (11.25%)&lt;BR/&gt; 65452: (1.25%)&lt;BR/&gt; 63530: (1.25%)&lt;BR/&gt; 62901: (1.25%)&gt;];
}
3965--5147[label="1;40pkt 40fpkt"];
</description>
    <slice>
      <filter dst_ip="49.100.30.230" src_ip="165.66.39.87" src_port="443"/>
      <filter dst_ip="218.235.105.62" dst_port="53" src_ip="165.66.39.87"/>
    </slice>
    <from sec="1230786019" usec="0"/>
    <to sec="1230786885" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_547{
style=filled;
color=gray75;
3972[label="195.199.231.87;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5152[label="195.199.231.87;1pkt 1fpkt", shape=invtriangle, color=brown];
5614[label="195.199.231.87;1pkt 1fpkt", shape=invhouse, color=bisque];
stat547[shape=component, label=&lt;Rules:&lt;BR/&gt;{195.199.231.87:1176, 160.33.80.240:445}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1176: (50%)&lt;BR/&gt; 445: (50%)&gt;];
}
3972--5152[label="1;1pkt 1fpkt"];
3972--5614[label="1;1pkt 1fpkt"];
5152--5614[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="160.33.80.240" dst_port="445" src_ip="195.199.231.87" src_port="1176"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_548{
style=filled;
color=gray75;
3997[label="182.71.137.91;74pkt 74fpkt", shape=pentagon, color=darkviolet];
5160[label="182.71.137.91;74pkt 74fpkt", shape=invtriangle, color=brown];
stat548[shape=component, label=&lt;Rules:&lt;BR/&gt;{182.71.137.91:34962, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 34962: (50%)&lt;BR/&gt; 65218: (0.675676%)&lt;BR/&gt; 64949: (0.675676%)&lt;BR/&gt; 64055: (0.675676%)&lt;BR/&gt; 62857: (0.675676%)&gt;];
}
3997--5160[label="1;74pkt 74fpkt"];
</description>
    <slice>
      <filter src_ip="182.71.137.91" src_port="34962"/>
    </slice>
    <from sec="1230786009" usec="0"/>
    <to sec="1230786848" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="3.65.165.93"/>
    </slice>
    <from sec="1230786746" usec="0"/>
    <to sec="1230786776" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_550{
style=filled;
color=gray75;
4028[label="193.17.156.97;48pkt 48fpkt", shape=pentagon, color=darkviolet];
5171[label="193.17.156.97;48pkt 48fpkt", shape=invtriangle, color=brown];
stat550[shape=component, label=&lt;Rules:&lt;BR/&gt;{193.17.156.97:25, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 62208: (1.04167%)&lt;BR/&gt; 21277: (1.04167%)&lt;BR/&gt; 16096: (1.04167%)&lt;BR/&gt; 4902: (1.04167%)&gt;];
}
4028--5171[label="1;48pkt 48fpkt"];
</description>
    <slice>
      <filter src_ip="193.17.156.97" src_port="25"/>
    </slice>
    <from sec="1230786017" usec="0"/>
    <to sec="1230786891" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.658853,1.50038,503,0 0 0 1 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_551{
style=filled;
color=gray75;
832[label="164.114.18.105;s;330pkt 330fpkt", shape=diamond, color=yellow];
861[label="49.100.24.84;d;294pkt 294fpkt", shape=diamond, color=yellow];
4029[label="187.77.211.97;13pkt 13fpkt", shape=pentagon, color=darkviolet];
5172[label="187.77.211.97;13pkt 13fpkt", shape=invtriangle, color=brown];
stat551[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.114.18.105:80, 49.100.24.84:*}[92.4198%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.8462%)&lt;BR/&gt; 63461: (0.230769%)&lt;BR/&gt; 47634: (0.230769%)&lt;BR/&gt; 47476: (0.230769%)&lt;BR/&gt; 46786: (0.230769%)&gt;];
}
832--861[label="0.97619;287pkt 287fpkt"];
832--1564[label="0.00729927;1pkt 1fpkt"];
832--3230[label="0.0727273;24pkt 24fpkt"];
832--3276[label="0.0727273;24pkt 24fpkt"];
861--3230[label="0.0680272;20pkt 20fpkt"];
861--3276[label="0.0680272;20pkt 20fpkt"];
861--4029[label="0.538462;7pkt 7fpkt"];
861--5172[label="0.538462;7pkt 7fpkt"];
4029--5172[label="1;13pkt 13fpkt"];
</description>
    <slice>
      <filter dst_ip="49.100.24.84" src_ip="164.114.18.105" src_port="80"/>
    </slice>
    <from sec="1230786002" usec="0"/>
    <to sec="1230786880" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_552{
style=filled;
color=gray75;
4036[label="152.74.42.99;3pkt 3fpkt", shape=pentagon, color=darkviolet];
5174[label="152.74.42.99;3pkt 3fpkt", shape=invtriangle, color=brown];
stat552[shape=component, label=&lt;Rules:&lt;BR/&gt;{152.74.42.99:1433, 49.222.242.206:38303}[33.3333%]&lt;BR/&gt;{152.74.42.99:1433, 49.222.242.206:38544}[33.3333%]&lt;BR/&gt;{152.74.42.99:1433, 49.222.242.206:38774}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1433: (50%)&lt;BR/&gt; 38774: (16.6667%)&lt;BR/&gt; 38544: (16.6667%)&lt;BR/&gt; 38303: (16.6667%)&gt;];
}
4036--5174[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="49.222.242.206" dst_port="38774" src_ip="152.74.42.99" src_port="1433"/>
      <filter dst_ip="49.222.242.206" dst_port="38544" src_ip="152.74.42.99" src_port="1433"/>
      <filter dst_ip="49.222.242.206" dst_port="38303" src_ip="152.74.42.99" src_port="1433"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,999,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_553{
style=filled;
color=gray75;
4037[label="49.69.126.99;6pkt 6fpkt", shape=pentagon, color=darkviolet];
5175[label="49.69.126.99;6pkt 6fpkt", shape=invtriangle, color=brown];
5624[label="49.69.126.99;6pkt 6fpkt", shape=invhouse, color=bisque];
stat553[shape=component, label=&lt;Rules:&lt;BR/&gt;{49.69.126.99:*, 156.36.48.101:25}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 30099: (8.33333%)&lt;BR/&gt; 30040: (8.33333%)&lt;BR/&gt; 30022: (8.33333%)&lt;BR/&gt; 30019: (8.33333%)&gt;];
}
4037--5175[label="1;6pkt 6fpkt"];
4037--5624[label="1;6pkt 6fpkt"];
5175--5624[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="156.36.48.101" dst_port="25" src_ip="49.69.126.99"/>
    </slice>
    <from sec="1230786643" usec="0"/>
    <to sec="1230786649" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="58.25.142.102"/>
    </slice>
    <from sec="1230786070" usec="0"/>
    <to sec="1230786084" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="60.133.105.103"/>
    </slice>
    <from sec="1230786575" usec="0"/>
    <to sec="1230786688" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="36.129.143.105"/>
    </slice>
    <from sec="1230786465" usec="0"/>
    <to sec="1230786471" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="200.124.0.108"/>
    </slice>
    <from sec="1230786006" usec="0"/>
    <to sec="1230786889" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.850718,1.54845,503,0 0 0 1 1 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_558{
style=filled;
color=gray75;
1326[label="160.48.79.166;s;31pkt 31fpkt", shape=diamond, color=yellow];
1540[label="49.100.30.69;d;29pkt 29fpkt", shape=diamond, color=yellow];
2673[label="160.48.79.166;s;15pkt 15fpkt", shape=hexagon, color=black];
3038[label="49.100.30.69;d;26pkt 26fpkt", shape=hexagon, color=black];
stat558[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.48.79.166:80, 49.100.30.69:*}[93.5484%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 65285: (1.9802%)&lt;BR/&gt; 64935: (1.9802%)&lt;BR/&gt; 62006: (1.9802%)&lt;BR/&gt; 61801: (1.9802%)&gt;];
}
1326--1540[label="1;29pkt 29fpkt"];
1326--1564[label="0.0322581;1pkt 1fpkt"];
1326--2673[label="1;15pkt 15fpkt"];
1326--3038[label="1;26pkt 26fpkt"];
1326--3230[label="0.0645161;2pkt 2fpkt"];
1326--3276[label="0.0645161;2pkt 2fpkt"];
1540--2673[label="0.866667;13pkt 13fpkt"];
1540--3038[label="1;26pkt 26fpkt"];
1540--3230[label="0.0689655;2pkt 2fpkt"];
1540--3276[label="0.0689655;2pkt 2fpkt"];
2673--3038[label="0.866667;13pkt 13fpkt"];
2673--3230[label="0.133333;2pkt 2fpkt"];
2673--3276[label="0.133333;2pkt 2fpkt"];
3038--3230[label="0.0769231;2pkt 2fpkt"];
3038--3276[label="0.0769231;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="49.100.30.69" src_ip="160.48.79.166" src_port="80"/>
    </slice>
    <from sec="1230786035" usec="0"/>
    <to sec="1230786828" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="56.179.160.111"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_560{
style=filled;
color=gray75;
4101[label="167.164.97.112;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5194[label="167.164.97.112;1pkt 1fpkt", shape=invtriangle, color=brown];
5635[label="167.164.97.112;1pkt 1fpkt", shape=invhouse, color=bisque];
stat560[shape=component, label=&lt;Rules:&lt;BR/&gt;{167.164.97.112:80, 160.48.99.118:49731}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 49731: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
4101--5194[label="1;1pkt 1fpkt"];
4101--5635[label="1;1pkt 1fpkt"];
5194--5635[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="160.48.99.118" dst_port="49731" src_ip="167.164.97.112" src_port="80"/>
    </slice>
    <from sec="1230786417" usec="0"/>
    <to sec="1230786419" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_561{
style=filled;
color=gray75;
4103[label="210.148.202.112;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5196[label="210.148.202.112;1pkt 1fpkt", shape=invtriangle, color=brown];
stat561[shape=component, label=&lt;Rules:&lt;BR/&gt;{210.148.202.112:34861, 192.231.16.117:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 34861: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
4103--5196[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="192.231.16.117" dst_port="80" src_ip="210.148.202.112" src_port="34861"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_562{
style=filled;
color=gray75;
4113[label="154.101.41.115;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5202[label="154.101.41.115;1pkt 1fpkt", shape=invtriangle, color=brown];
5638[label="154.101.41.115;1pkt 1fpkt", shape=invhouse, color=bisque];
stat562[shape=component, label=&lt;Rules:&lt;BR/&gt;{154.101.41.115:4386, 56.165.189.101:443}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 4386: (50%)&lt;BR/&gt; 443: (50%)&gt;];
}
4113--5202[label="1;1pkt 1fpkt"];
4113--5638[label="1;1pkt 1fpkt"];
5202--5638[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="56.165.189.101" dst_port="443" src_ip="154.101.41.115" src_port="4386"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_564{
style=filled;
color=gray75;
4138[label="49.130.158.121;14pkt 14fpkt", shape=pentagon, color=darkviolet];
5210[label="49.130.158.121;14pkt 14fpkt", shape=invtriangle, color=brown];
stat564[shape=component, label=&lt;Rules:&lt;BR/&gt;{49.130.158.121:80, 154.101.171.32:*}[92.8571%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 45972: (3.57143%)&lt;BR/&gt; 45971: (3.57143%)&lt;BR/&gt; 45970: (3.57143%)&lt;BR/&gt; 45969: (3.57143%)&gt;];
}
4138--5210[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter dst_ip="154.101.171.32" src_ip="49.130.158.121" src_port="80"/>
    </slice>
    <from sec="1230786674" usec="0"/>
    <to sec="1230786861" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="41.58.156.123"/>
    </slice>
    <from sec="1230786191" usec="0"/>
    <to sec="1230786289" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_567{
style=filled;
color=gray75;
4178[label="81.75.128.128;144pkt 144fpkt", shape=pentagon, color=darkviolet];
5222[label="81.75.128.128;144pkt 144fpkt", shape=invtriangle, color=brown];
stat567[shape=component, label=&lt;Rules:&lt;BR/&gt;{81.75.128.128:47964, *:1026}[50.6944%]&lt;BR/&gt;{81.75.128.128:47964, *:1027}[49.3056%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 47964: (50%)&lt;BR/&gt; 1026: (25.3472%)&lt;BR/&gt; 1027: (24.6528%)&gt;];
}
4178--5222[label="1;144pkt 144fpkt"];
</description>
    <slice>
      <filter dst_port="1026" src_ip="81.75.128.128" src_port="47964"/>
      <filter dst_port="1027" src_ip="81.75.128.128" src_port="47964"/>
    </slice>
    <from sec="1230786665" usec="0"/>
    <to sec="1230786666" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="83.113.184.128"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="56.15.83.130"/>
    </slice>
    <from sec="1230786661" usec="0"/>
    <to sec="1230786743" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="3.67.93.132"/>
    </slice>
    <from sec="1230786733" usec="0"/>
    <to sec="1230786787" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_571{
style=filled;
color=gray75;
4215[label="52.33.152.134;3pkt 3fpkt", shape=pentagon, color=darkviolet];
5237[label="52.33.152.134;3pkt 3fpkt", shape=invtriangle, color=brown];
stat571[shape=component, label=&lt;Rules:&lt;BR/&gt;{52.33.152.134:5050, 156.36.14.27:1322}[33.3333%]&lt;BR/&gt;{52.33.152.134:5050, 156.36.37.72:1243}[33.3333%]&lt;BR/&gt;{52.33.152.134:5050, 156.36.48.132:4850}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5050: (50%)&lt;BR/&gt; 4850: (16.6667%)&lt;BR/&gt; 1322: (16.6667%)&lt;BR/&gt; 1243: (16.6667%)&gt;];
}
4215--5237[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="156.36.48.132" dst_port="4850" src_ip="52.33.152.134" src_port="5050"/>
      <filter dst_ip="156.36.37.72" dst_port="1243" src_ip="52.33.152.134" src_port="5050"/>
      <filter dst_ip="156.36.14.27" dst_port="1322" src_ip="52.33.152.134" src_port="5050"/>
    </slice>
    <from sec="1230786002" usec="0"/>
    <to sec="1230786897" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,020,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="215.196.64.135"/>
    </slice>
    <from sec="1230786004" usec="0"/>
    <to sec="1230786898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_573{
style=filled;
color=gray75;
4227[label="202.182.89.136;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5242[label="202.182.89.136;1pkt 1fpkt", shape=invtriangle, color=brown];
5649[label="202.182.89.136;1pkt 1fpkt", shape=invhouse, color=bisque];
stat573[shape=component, label=&lt;Rules:&lt;BR/&gt;{202.182.89.136:53, 154.101.193.109:3085}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 3085: (50%)&lt;BR/&gt; 53: (50%)&gt;];
}
4227--5242[label="1;1pkt 1fpkt"];
4227--5649[label="1;1pkt 1fpkt"];
5242--5649[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="154.101.193.109" dst_port="3085" src_ip="202.182.89.136" src_port="53"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_574{
style=filled;
color=gray75;
4238[label="160.180.148.138;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5245[label="160.180.148.138;1pkt 1fpkt", shape=invtriangle, color=brown];
5651[label="160.180.148.138;1pkt 1fpkt", shape=invhouse, color=bisque];
stat574[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.180.148.138:22, 35.44.26.106:34325}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 34325: (50%)&lt;BR/&gt; 22: (50%)&gt;];
}
4238--5245[label="1;1pkt 1fpkt"];
4238--5651[label="1;1pkt 1fpkt"];
5245--5651[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="35.44.26.106" dst_port="34325" src_ip="160.180.148.138" src_port="22"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="44.177.108.139"/>
    </slice>
    <from sec="1230786528" usec="0"/>
    <to sec="1230786536" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_576{
style=filled;
color=gray75;
4263[label="73.144.235.141;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5253[label="73.144.235.141;1pkt 1fpkt", shape=invtriangle, color=brown];
stat576[shape=component, label=&lt;Rules:&lt;BR/&gt;{73.144.235.141:1935, 164.114.76.172:1384}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1935: (50%)&lt;BR/&gt; 1384: (50%)&gt;];
}
4263--5253[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="164.114.76.172" dst_port="1384" src_ip="73.144.235.141" src_port="1935"/>
    </slice>
    <from sec="1230786852" usec="0"/>
    <to sec="1230786882" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_577{
style=filled;
color=gray75;
4274[label="6.234.49.143;6pkt 6fpkt", shape=pentagon, color=darkviolet];
5259[label="6.234.49.143;6pkt 6fpkt", shape=invtriangle, color=brown];
5655[label="6.234.49.143;6pkt 6fpkt", shape=invhouse, color=bisque];
stat577[shape=component, label=&lt;Rules:&lt;BR/&gt;{6.234.49.143:*, 154.101.230.157:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 49191: (8.33333%)&lt;BR/&gt; 49190: (8.33333%)&lt;BR/&gt; 49189: (8.33333%)&lt;BR/&gt; 49188: (8.33333%)&gt;];
}
4274--5259[label="1;6pkt 6fpkt"];
4274--5655[label="1;6pkt 6fpkt"];
5259--5655[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="154.101.230.157" dst_port="80" src_ip="6.234.49.143"/>
    </slice>
    <from sec="1230786852" usec="0"/>
    <to sec="1230786863" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_578{
style=filled;
color=gray75;
4283[label="52.33.152.144;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5263[label="52.33.152.144;2pkt 2fpkt", shape=invtriangle, color=brown];
stat578[shape=component, label=&lt;Rules:&lt;BR/&gt;{52.33.152.144:5050, 156.36.21.3:1739}[50%]&lt;BR/&gt;{52.33.152.144:5050, 156.36.14.136:1051}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5050: (50%)&lt;BR/&gt; 1739: (25%)&lt;BR/&gt; 1051: (25%)&gt;];
}
4283--5263[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="156.36.14.136" dst_port="1051" src_ip="52.33.152.144" src_port="5050"/>
      <filter dst_ip="156.36.21.3" dst_port="1739" src_ip="52.33.152.144" src_port="5050"/>
    </slice>
    <from sec="1230786033" usec="0"/>
    <to sec="1230786890" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_579{
style=filled;
color=gray75;
4297[label="43.85.40.146;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5268[label="43.85.40.146;1pkt 1fpkt", shape=invtriangle, color=brown];
stat579[shape=component, label=&lt;Rules:&lt;BR/&gt;{43.85.40.146:80, 192.231.21.209:38080}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 38080: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
4297--5268[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="192.231.21.209" dst_port="38080" src_ip="43.85.40.146" src_port="80"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="84.70.194.147"/>
    </slice>
    <from sec="1230786069" usec="0"/>
    <to sec="1230786210" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_581{
style=filled;
color=gray75;
4330[label="182.71.79.151;95pkt 95fpkt", shape=pentagon, color=darkviolet];
5281[label="182.71.79.151;95pkt 95fpkt", shape=invtriangle, color=brown];
stat581[shape=component, label=&lt;Rules:&lt;BR/&gt;{182.71.79.151:8112, *:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8112: (50%)&lt;BR/&gt; 55005: (1.05263%)&lt;BR/&gt; 55000: (1.05263%)&lt;BR/&gt; 64703: (0.526316%)&lt;BR/&gt; 64208: (0.526316%)&gt;];
}
4330--5281[label="1;95pkt 95fpkt"];
</description>
    <slice>
      <filter src_ip="182.71.79.151" src_port="8112"/>
    </slice>
    <from sec="1230786007" usec="0"/>
    <to sec="1230786898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_582{
style=filled;
color=gray75;
4336[label="204.112.159.152;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5283[label="204.112.159.152;1pkt 1fpkt", shape=invtriangle, color=brown];
5664[label="204.112.159.152;1pkt 1fpkt", shape=invhouse, color=bisque];
stat582[shape=component, label=&lt;Rules:&lt;BR/&gt;{204.112.159.152:80, 164.114.1.161:53519}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53519: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
4336--5283[label="1;1pkt 1fpkt"];
4336--5664[label="1;1pkt 1fpkt"];
5283--5664[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="164.114.1.161" dst_port="53519" src_ip="204.112.159.152" src_port="80"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,901,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="37.34.20.155"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_584{
style=filled;
color=gray75;
4352[label="164.114.46.155;14pkt 14fpkt", shape=pentagon, color=darkviolet];
5291[label="164.114.46.155;14pkt 14fpkt", shape=invtriangle, color=brown];
stat584[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.114.46.155:*, 215.176.44.5:80}[57.1429%]&lt;BR/&gt;{164.114.46.155:*, 215.176.44.102:80}[35.7143%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 63850: (3.57143%)&lt;BR/&gt; 61232: (3.57143%)&lt;BR/&gt; 61059: (3.57143%)&lt;BR/&gt; 60839: (3.57143%)&gt;];
}
4352--5291[label="1;14pkt 14fpkt"];
</description>
    <slice>
      <filter dst_ip="215.176.44.5" dst_port="80" src_ip="164.114.46.155"/>
      <filter dst_ip="215.176.44.102" dst_port="80" src_ip="164.114.46.155"/>
    </slice>
    <from sec="1230786510" usec="0"/>
    <to sec="1230786625" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_585{
style=filled;
color=gray75;
4354[label="160.38.116.155;21pkt 21fpkt", shape=pentagon, color=darkviolet];
5292[label="160.38.116.155;21pkt 21fpkt", shape=invtriangle, color=brown];
5669[label="160.38.116.155;21pkt 21fpkt", shape=invhouse, color=bisque];
stat585[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.38.116.155:80, 49.100.24.122:*}[90.4762%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (47.619%)&lt;BR/&gt; 62381: (2.38095%)&lt;BR/&gt; 61068: (2.38095%)&lt;BR/&gt; 58189: (2.38095%)&lt;BR/&gt; 56754: (2.38095%)&gt;];
}
4354--5292[label="1;21pkt 21fpkt"];
4354--5669[label="1;21pkt 21fpkt"];
5292--5669[label="1;21pkt 21fpkt"];
</description>
    <slice>
      <filter dst_ip="49.100.24.122" src_ip="160.38.116.155" src_port="80"/>
    </slice>
    <from sec="1230786015" usec="0"/>
    <to sec="1230786874" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_586{
style=filled;
color=gray75;
4364[label="164.114.210.156;12pkt 12fpkt", shape=pentagon, color=darkviolet];
5295[label="164.114.210.156;12pkt 12fpkt", shape=invtriangle, color=brown];
stat586[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.114.210.156:80, 13.185.49.156:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 52130: (4.16667%)&lt;BR/&gt; 52129: (4.16667%)&lt;BR/&gt; 52128: (4.16667%)&lt;BR/&gt; 52127: (4.16667%)&gt;];
}
4364--5295[label="1;12pkt 12fpkt"];
</description>
    <slice>
      <filter dst_ip="13.185.49.156" src_ip="164.114.210.156" src_port="80"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="23.30.198.160"/>
    </slice>
    <from sec="1230786378" usec="0"/>
    <to sec="1230786429" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_588{
style=filled;
color=gray75;
4393[label="154.101.17.163;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5303[label="154.101.17.163;1pkt 1fpkt", shape=invtriangle, color=brown];
5672[label="154.101.17.163;1pkt 1fpkt", shape=invhouse, color=bisque];
stat588[shape=component, label=&lt;Rules:&lt;BR/&gt;{154.101.17.163:47197, 41.125.41.169:38956}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 47197: (50%)&lt;BR/&gt; 38956: (50%)&gt;];
}
4393--5303[label="1;1pkt 1fpkt"];
4393--5672[label="1;1pkt 1fpkt"];
5303--5672[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="41.125.41.169" dst_port="38956" src_ip="154.101.17.163" src_port="47197"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_589{
style=filled;
color=gray75;
4398[label="164.114.18.164;3pkt 3fpkt", shape=pentagon, color=darkviolet];
5305[label="164.114.18.164;3pkt 3fpkt", shape=invtriangle, color=brown];
stat589[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.114.18.164:80, 58.162.147.83:41837}[33.3333%]&lt;BR/&gt;{164.114.18.164:80, 9.118.37.209:49947}[33.3333%]&lt;BR/&gt;{164.114.18.164:80, 9.118.37.209:49950}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 49950: (16.6667%)&lt;BR/&gt; 49947: (16.6667%)&lt;BR/&gt; 41837: (16.6667%)&gt;];
}
4398--5305[label="1;3pkt 3fpkt"];
</description>
    <slice>
      <filter dst_ip="9.118.37.209" dst_port="49950" src_ip="164.114.18.164" src_port="80"/>
      <filter dst_ip="9.118.37.209" dst_port="49947" src_ip="164.114.18.164" src_port="80"/>
      <filter dst_ip="58.162.147.83" dst_port="41837" src_ip="164.114.18.164" src_port="80"/>
    </slice>
    <from sec="1230786195" usec="0"/>
    <to sec="1230786815" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="216.215.39.167"/>
    </slice>
    <from sec="1230786415" usec="0"/>
    <to sec="1230786461" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_591{
style=filled;
color=gray75;
4429[label="55.7.102.168;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5314[label="55.7.102.168;1pkt 1fpkt", shape=invtriangle, color=brown];
5675[label="55.7.102.168;1pkt 1fpkt", shape=invhouse, color=bisque];
stat591[shape=component, label=&lt;Rules:&lt;BR/&gt;{55.7.102.168:29273, 192.231.21.209:3128}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 29273: (50%)&lt;BR/&gt; 3128: (50%)&gt;];
}
4429--5314[label="1;1pkt 1fpkt"];
4429--5675[label="1;1pkt 1fpkt"];
5314--5675[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="192.231.21.209" dst_port="3128" src_ip="55.7.102.168" src_port="29273"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_592{
style=filled;
color=gray75;
4447[label="164.114.157.172;16pkt 16fpkt", shape=pentagon, color=darkviolet];
5319[label="164.114.157.172;16pkt 16fpkt", shape=invtriangle, color=brown];
stat592[shape=component, label=&lt;Rules:&lt;BR/&gt;{164.114.157.172:25, *:*}[75%]&lt;BR/&gt;{164.114.157.172:*, *:25}[25%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 25: (50%)&lt;BR/&gt; 58299: (3.125%)&lt;BR/&gt; 50764: (3.125%)&lt;BR/&gt; 50382: (3.125%)&lt;BR/&gt; 48511: (3.125%)&gt;];
}
4447--5319[label="1;16pkt 16fpkt"];
</description>
    <slice>
      <filter src_ip="164.114.157.172" src_port="25"/>
      <filter dst_port="25" src_ip="164.114.157.172"/>
    </slice>
    <from sec="1230786180" usec="0"/>
    <to sec="1230786823" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_593{
style=filled;
color=gray75;
4451[label="6.238.91.173;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5320[label="6.238.91.173;1pkt 1fpkt", shape=invtriangle, color=brown];
stat593[shape=component, label=&lt;Rules:&lt;BR/&gt;{6.238.91.173:56617, 192.231.29.168:80}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 56617: (50%)&lt;BR/&gt; 80: (50%)&gt;];
}
4451--5320[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="192.231.29.168" dst_port="80" src_ip="6.238.91.173" src_port="56617"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_594{
style=filled;
color=gray75;
4456[label="187.77.56.174;32pkt 32fpkt", shape=pentagon, color=darkviolet];
5322[label="187.77.56.174;32pkt 32fpkt", shape=invtriangle, color=brown];
5679[label="187.77.56.174;32pkt 32fpkt", shape=invhouse, color=bisque];
stat594[shape=component, label=&lt;Rules:&lt;BR/&gt;{187.77.56.174:80, 49.100.25.95:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 65151: (1.5625%)&lt;BR/&gt; 64135: (1.5625%)&lt;BR/&gt; 61342: (1.5625%)&lt;BR/&gt; 60809: (1.5625%)&gt;];
}
4456--5322[label="1;32pkt 32fpkt"];
4456--5679[label="1;32pkt 32fpkt"];
5322--5679[label="1;32pkt 32fpkt"];
</description>
    <slice>
      <filter dst_ip="49.100.25.95" src_ip="187.77.56.174" src_port="80"/>
    </slice>
    <from sec="1230786002" usec="0"/>
    <to sec="1230786884" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="56.134.74.174"/>
    </slice>
    <from sec="1230786410" usec="0"/>
    <to sec="1230786440" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_596{
style=filled;
color=gray75;
4464[label="187.77.56.175;17pkt 17fpkt", shape=pentagon, color=darkviolet];
5326[label="187.77.56.175;17pkt 17fpkt", shape=invtriangle, color=brown];
stat596[shape=component, label=&lt;Rules:&lt;BR/&gt;{187.77.56.175:80, 49.100.31.115:*}[35.2941%]&lt;BR/&gt;{187.77.56.175:80, 49.100.31.112:*}[29.4118%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 65370: (2.94118%)&lt;BR/&gt; 64357: (2.94118%)&lt;BR/&gt; 62967: (2.94118%)&lt;BR/&gt; 61895: (2.94118%)&gt;];
}
4464--5326[label="1;17pkt 17fpkt"];
</description>
    <slice>
      <filter dst_ip="49.100.31.115" src_ip="187.77.56.175" src_port="80"/>
      <filter dst_ip="49.100.31.112" src_ip="187.77.56.175" src_port="80"/>
    </slice>
    <from sec="1230786047" usec="0"/>
    <to sec="1230786850" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.919689,1.51124,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_598{
style=filled;
color=gray75;
1349[label="154.101.17.144;d;11pkt 11fpkt", shape=diamond, color=yellow];
3436[label="215.180.152.11;1pkt 1fpkt", shape=pentagon, color=darkviolet];
3898[label="50.152.96.78;7pkt 7fpkt", shape=pentagon, color=darkviolet];
4473[label="215.57.177.176;33pkt 33fpkt", shape=pentagon, color=darkviolet];
4933[label="215.180.152.11;2pkt 2fpkt", shape=invtriangle, color=brown];
5328[label="215.57.177.176;33pkt 33fpkt", shape=invtriangle, color=brown];
5521[label="215.180.152.11;2pkt 2fpkt", shape=invhouse, color=bisque];
stat598[shape=component, label=&lt;Rules:&lt;BR/&gt;{215.57.177.176:80, *:*}[70.2128%]&lt;BR/&gt;{*:80, 154.101.17.144:*}[23.4043%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3064: (2.24719%)&lt;BR/&gt; 3061: (1.68539%)&lt;BR/&gt; 3048: (1.68539%)&lt;BR/&gt; 3047: (1.68539%)&gt;];
}
1349--3436[label="1;1pkt 1fpkt"];
1349--3898[label="0.285714;2pkt 2fpkt"];
1349--4473[label="0.181818;2pkt 2fpkt"];
1349--4933[label="1;2pkt 2fpkt"];
1349--5328[label="0.181818;2pkt 2fpkt"];
1349--5521[label="1;2pkt 2fpkt"];
3436--4933[label="1;1pkt 1fpkt"];
3436--5521[label="1;1pkt 1fpkt"];
4473--5328[label="1;33pkt 33fpkt"];
4933--5521[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter src_ip="215.57.177.176" src_port="80"/>
      <filter dst_ip="154.101.17.144" src_port="80"/>
    </slice>
    <from sec="1230786007" usec="0"/>
    <to sec="1230786894" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_599{
style=filled;
color=gray75;
4474[label="154.101.185.176;26pkt 26fpkt", shape=pentagon, color=darkviolet];
5329[label="154.101.185.176;26pkt 26fpkt", shape=invtriangle, color=brown];
5682[label="154.101.185.176;26pkt 26fpkt", shape=invhouse, color=bisque];
stat599[shape=component, label=&lt;Rules:&lt;BR/&gt;{154.101.185.176:80, 49.100.31.33:*}[34.6154%]&lt;BR/&gt;{154.101.185.176:80, 49.100.31.42:*}[30.7692%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 64788: (1.92308%)&lt;BR/&gt; 62764: (1.92308%)&lt;BR/&gt; 62317: (1.92308%)&lt;BR/&gt; 60892: (1.92308%)&gt;];
}
4474--5329[label="1;26pkt 26fpkt"];
4474--5682[label="1;26pkt 26fpkt"];
5329--5682[label="1;26pkt 26fpkt"];
</description>
    <slice>
      <filter dst_ip="49.100.31.33" src_ip="154.101.185.176" src_port="80"/>
      <filter dst_ip="49.100.31.42" src_ip="154.101.185.176" src_port="80"/>
    </slice>
    <from sec="1230786019" usec="0"/>
    <to sec="1230786843" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="81.194.4.178"/>
    </slice>
    <from sec="1230786046" usec="0"/>
    <to sec="1230786295" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="194.208.125.178"/>
    </slice>
    <from sec="1230786121" usec="0"/>
    <to sec="1230786126" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="63.141.58.180"/>
    </slice>
    <from sec="1230786098" usec="0"/>
    <to sec="1230786379" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.919689,1.51124,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_603{
style=filled;
color=gray75;
478[label="160.48.77.37;d;90pkt 90fpkt", shape=diamond, color=yellow];
1306[label="49.54.171.66;s;42pkt 42fpkt", shape=diamond, color=yellow];
1664[label="154.101.17.65;d;55pkt 55fpkt", shape=diamond, color=yellow];
1852[label="49.54.171.72;s;35pkt 35fpkt", shape=diamond, color=yellow];
3863[label="49.54.171.72;38pkt 38fpkt", shape=pentagon, color=darkviolet];
4510[label="58.50.16.182;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5110[label="49.54.171.72;38pkt 38fpkt", shape=invtriangle, color=brown];
5346[label="58.50.16.182;1pkt 1fpkt", shape=invtriangle, color=brown];
5690[label="58.50.16.182;1pkt 1fpkt", shape=invhouse, color=bisque];
stat603[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:80, 160.48.77.37:*}[54.1667%]&lt;BR/&gt;{*:80, 154.101.17.65:*}[32.7381%]&lt;BR/&gt;{49.54.171.66:80, *:*}[25.5952%]&lt;BR/&gt;{49.54.171.72:80, *:*}[22.619%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (49.8339%)&lt;BR/&gt; 63225: (0.664452%)&lt;BR/&gt; 63223: (0.664452%)&lt;BR/&gt; 63213: (0.664452%)&lt;BR/&gt; 57878: (0.664452%)&gt;];
}
478--1306[label="0.595238;25pkt 25fpkt"];
478--1852[label="0.771429;27pkt 27fpkt"];
478--3230[label="0.0777778;7pkt 7fpkt"];
478--3276[label="0.0777778;7pkt 7fpkt"];
478--3863[label="0.710526;27pkt 27fpkt"];
478--5110[label="0.710526;27pkt 27fpkt"];
1306--1664[label="0.119048;5pkt 5fpkt"];
1306--3086[label="0.047619;2pkt 2fpkt"];
1306--3230[label="0.047619;2pkt 2fpkt"];
1306--3276[label="0.047619;2pkt 2fpkt"];
1664--3230[label="0.0727273;4pkt 4fpkt"];
1664--3276[label="0.0727273;4pkt 4fpkt"];
1664--4510[label="1;1pkt 1fpkt"];
1664--5346[label="1;1pkt 1fpkt"];
1664--5690[label="1;1pkt 1fpkt"];
1852--3230[label="0.0857143;3pkt 3fpkt"];
1852--3276[label="0.0857143;3pkt 3fpkt"];
1852--3863[label="1;35pkt 35fpkt"];
1852--5110[label="1;35pkt 35fpkt"];
3863--5110[label="1;38pkt 38fpkt"];
4510--5346[label="1;1pkt 1fpkt"];
4510--5690[label="1;1pkt 1fpkt"];
5346--5690[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="49.54.171.66" src_port="80"/>
      <filter src_ip="49.54.171.72" src_port="80"/>
      <filter dst_ip="160.48.77.37" src_port="80"/>
      <filter dst_ip="154.101.17.65" src_port="80"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786897" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="219.38.184.182"/>
    </slice>
    <from sec="1230786109" usec="0"/>
    <to sec="1230786202" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="9.104.99.184"/>
    </slice>
    <from sec="1230786572" usec="0"/>
    <to sec="1230786601" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_607{
style=filled;
color=gray75;
4537[label="187.77.56.186;20pkt 20fpkt", shape=pentagon, color=darkviolet];
5361[label="187.77.56.186;20pkt 20fpkt", shape=invtriangle, color=brown];
stat607[shape=component, label=&lt;Rules:&lt;BR/&gt;{187.77.56.186:80, 49.100.31.224:*}[45%]&lt;BR/&gt;{187.77.56.186:80, 49.100.31.226:*}[35%]&lt;BR/&gt;{187.77.56.186:80, 49.100.31.225:*}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 64212: (2.5%)&lt;BR/&gt; 61894: (2.5%)&lt;BR/&gt; 61864: (2.5%)&lt;BR/&gt; 59114: (2.5%)&gt;];
}
4537--5361[label="1;20pkt 20fpkt"];
</description>
    <slice>
      <filter dst_ip="49.100.31.224" src_ip="187.77.56.186" src_port="80"/>
      <filter dst_ip="49.100.31.226" src_ip="187.77.56.186" src_port="80"/>
      <filter dst_ip="49.100.31.225" src_ip="187.77.56.186" src_port="80"/>
    </slice>
    <from sec="1230786019" usec="0"/>
    <to sec="1230786877" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,901,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_608{
style=filled;
color=gray75;
4546[label="80.90.149.187;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5365[label="80.90.149.187;1pkt 1fpkt", shape=invtriangle, color=brown];
5698[label="80.90.149.187;1pkt 1fpkt", shape=invhouse, color=bisque];
stat608[shape=component, label=&lt;Rules:&lt;BR/&gt;{80.90.149.187:1616, 160.180.56.112:1434}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 1616: (50%)&lt;BR/&gt; 1434: (50%)&gt;];
}
4546--5365[label="1;1pkt 1fpkt"];
4546--5698[label="1;1pkt 1fpkt"];
5365--5698[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="160.180.56.112" dst_port="1434" src_ip="80.90.149.187" src_port="1616"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="200.250.152.187"/>
    </slice>
    <from sec="1230786599" usec="0"/>
    <to sec="1230786661" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_611{
style=filled;
color=gray75;
4564[label="160.38.172.191;170pkt 170fpkt", shape=pentagon, color=darkviolet];
5372[label="160.38.172.191;170pkt 170fpkt", shape=invtriangle, color=brown];
stat611[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.38.172.191:*, *:53}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53: (50%)&lt;BR/&gt; 65278: (0.294118%)&lt;BR/&gt; 65003: (0.294118%)&lt;BR/&gt; 64721: (0.294118%)&lt;BR/&gt; 64241: (0.294118%)&gt;];
}
4564--5372[label="1;170pkt 170fpkt"];
</description>
    <slice>
      <filter dst_port="53" src_ip="160.38.172.191"/>
    </slice>
    <from sec="1230786022" usec="0"/>
    <to sec="1230786869" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.919689,1.51124,503,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_612{
style=filled;
color=gray75;
1299[label="156.36.32.10;d;66pkt 66fpkt", shape=diamond, color=yellow];
1562[label="57.235.195.238;s;11pkt 11fpkt", shape=diamond, color=yellow];
4118[label="83.129.95.116;21pkt 21fpkt", shape=pentagon, color=darkviolet];
4579[label="203.71.102.193;1pkt 1fpkt", shape=pentagon, color=darkviolet];
4833[label="57.235.195.238;12pkt 12fpkt", shape=pentagon, color=darkviolet];
5375[label="203.71.102.193;1pkt 1fpkt", shape=invtriangle, color=brown];
5486[label="57.235.195.238;12pkt 12fpkt", shape=invtriangle, color=brown];
5700[label="203.71.102.193;1pkt 1fpkt", shape=invhouse, color=bisque];
5739[label="57.235.195.238;12pkt 12fpkt", shape=invhouse, color=bisque];
stat612[shape=component, label=&lt;Rules:&lt;BR/&gt;{83.129.95.116:80, 156.36.32.10:*}[31.8182%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3400: (1.82482%)&lt;BR/&gt; 3399: (1.82482%)&lt;BR/&gt; 3396: (1.82482%)&lt;BR/&gt; 3389: (1.82482%)&gt;];
}
1299--1562[label="1;11pkt 11fpkt"];
1299--2180[label="0.0151515;1pkt 1fpkt"];
1299--3074[label="0.0151515;1pkt 1fpkt"];
1299--3222[label="0.0151515;1pkt 1fpkt"];
1299--3230[label="0.136364;9pkt 9fpkt"];
1299--3273[label="0.0151515;1pkt 1fpkt"];
1299--3276[label="0.136364;9pkt 9fpkt"];
1299--4118[label="1;21pkt 21fpkt"];
1299--4579[label="1;1pkt 1fpkt"];
1299--4833[label="1;12pkt 12fpkt"];
1299--5375[label="1;1pkt 1fpkt"];
1299--5486[label="1;12pkt 12fpkt"];
1299--5700[label="1;1pkt 1fpkt"];
1299--5739[label="1;12pkt 12fpkt"];
1562--4833[label="1;11pkt 11fpkt"];
1562--5486[label="1;11pkt 11fpkt"];
1562--5739[label="1;11pkt 11fpkt"];
4579--5375[label="1;1pkt 1fpkt"];
4579--5700[label="1;1pkt 1fpkt"];
4833--5486[label="1;12pkt 12fpkt"];
4833--5739[label="1;12pkt 12fpkt"];
5375--5700[label="1;1pkt 1fpkt"];
5486--5739[label="1;12pkt 12fpkt"];
</description>
    <slice>
      <filter dst_ip="156.36.32.10" src_ip="83.129.95.116" src_port="80"/>
    </slice>
    <from sec="1230786008" usec="0"/>
    <to sec="1230786724" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,010,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_613{
style=filled;
color=gray75;
4586[label="11.0.90.194;129pkt 129fpkt", shape=pentagon, color=darkviolet];
5379[label="11.0.90.194;129pkt 129fpkt", shape=invtriangle, color=brown];
stat613[shape=component, label=&lt;Rules:&lt;BR/&gt;{11.0.90.194:*, *:8080}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 8080: (50%)&lt;BR/&gt; 4993: (0.387597%)&lt;BR/&gt; 4985: (0.387597%)&lt;BR/&gt; 4970: (0.387597%)&lt;BR/&gt; 4966: (0.387597%)&gt;];
}
4586--5379[label="1;129pkt 129fpkt"];
</description>
    <slice>
      <filter dst_port="8080" src_ip="11.0.90.194"/>
    </slice>
    <from sec="1230786534" usec="0"/>
    <to sec="1230786552" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="80.164.0.195"/>
    </slice>
    <from sec="1230786601" usec="0"/>
    <to sec="1230786803" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="61.235.234.195"/>
    </slice>
    <from sec="1230786800" usec="0"/>
    <to sec="1230786830" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.919689,1.51124,901,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_617{
style=filled;
color=gray75;
942[label="160.33.123.31;d;450pkt 450fpkt", shape=diamond, color=yellow];
1337[label="160.131.84.155;d;432pkt 432fpkt", shape=diamond, color=yellow];
2282[label="50.241.99.233;s;297pkt 297fpkt", shape=diamond, color=yellow];
2310[label="182.8.195.209;d;423pkt 423fpkt", shape=diamond, color=yellow];
3599[label="57.93.105.35;161pkt 161fpkt", shape=pentagon, color=darkviolet];
3950[label="85.114.208.84;90pkt 90fpkt", shape=pentagon, color=darkviolet];
4018[label="21.73.58.95;117pkt 117fpkt", shape=pentagon, color=darkviolet];
4293[label="51.98.182.145;108pkt 108fpkt", shape=pentagon, color=darkviolet];
4379[label="194.141.39.159;126pkt 126fpkt", shape=pentagon, color=darkviolet];
4598[label="213.177.156.196;135pkt 135fpkt", shape=pentagon, color=darkviolet];
4680[label="121.118.18.212;153pkt 153fpkt", shape=pentagon, color=darkviolet];
4739[label="46.20.13.223;144pkt 144fpkt", shape=pentagon, color=darkviolet];
5100[label="54.245.81.70;135pkt 135fpkt", shape=invtriangle, color=brown];
5267[label="51.98.182.145;108pkt 108fpkt", shape=invtriangle, color=brown];
5386[label="213.177.156.196;135pkt 135fpkt", shape=invtriangle, color=brown];
5659[label="51.98.182.145;108pkt 108fpkt", shape=invhouse, color=bisque];
stat617[shape=component, label=&lt;Rules:&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 9768: (8.36003%)&lt;BR/&gt; 50729: (8.21589%)&lt;BR/&gt; 5218: (8.07175%)&lt;BR/&gt; 9345: (5.55734%)&lt;BR/&gt; 8345: (5.55734%)&gt;];
}
942--2282[label="0.030303;9pkt 9fpkt"];
942--3599[label="0.0559006;9pkt 9fpkt"];
942--4018[label="0.0769231;9pkt 9fpkt"];
942--4379[label="0.0714286;9pkt 9fpkt"];
942--4598[label="0.0666667;9pkt 9fpkt"];
942--4739[label="0.0625;9pkt 9fpkt"];
942--5386[label="0.0666667;9pkt 9fpkt"];
1337--2282[label="0.030303;9pkt 9fpkt"];
1337--4018[label="0.0769231;9pkt 9fpkt"];
1337--4293[label="0.0833333;9pkt 9fpkt"];
1337--4379[label="0.0714286;9pkt 9fpkt"];
1337--4739[label="0.0625;9pkt 9fpkt"];
1337--5100[label="0.0666667;9pkt 9fpkt"];
1337--5267[label="0.0833333;9pkt 9fpkt"];
1337--5659[label="0.0833333;9pkt 9fpkt"];
2282--2310[label="0.030303;9pkt 9fpkt"];
2310--3950[label="0.1;9pkt 9fpkt"];
2310--4293[label="0.0833333;9pkt 9fpkt"];
2310--4379[label="0.0714286;9pkt 9fpkt"];
2310--4598[label="0.0666667;9pkt 9fpkt"];
2310--4680[label="0.0588235;9pkt 9fpkt"];
2310--4739[label="0.0625;9pkt 9fpkt"];
2310--5100[label="0.0666667;9pkt 9fpkt"];
2310--5267[label="0.0833333;9pkt 9fpkt"];
2310--5386[label="0.0666667;9pkt 9fpkt"];
2310--5659[label="0.0833333;9pkt 9fpkt"];
4293--5267[label="1;108pkt 108fpkt"];
4293--5659[label="1;108pkt 108fpkt"];
4598--5386[label="1;135pkt 135fpkt"];
5267--5659[label="1;108pkt 108fpkt"];
</description>
    <slice/>
    <from sec="1230786018" usec="0"/>
    <to sec="1230786900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="4.171.133.197"/>
    </slice>
    <from sec="1230786020" usec="0"/>
    <to sec="1230786168" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,999,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="84.106.235.201"/>
    </slice>
    <from sec="1230786002" usec="0"/>
    <to sec="1230786900" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="58.98.93.203"/>
    </slice>
    <from sec="1230786844" usec="0"/>
    <to sec="1230786874" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_622{
style=filled;
color=gray75;
4632[label="213.80.128.203;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5400[label="213.80.128.203;2pkt 2fpkt", shape=invtriangle, color=brown];
stat622[shape=component, label=&lt;Rules:&lt;BR/&gt;{213.80.128.203:4406, 160.131.245.179:27191}[50%]&lt;BR/&gt;{213.80.128.203:4425, 160.131.245.179:27191}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 27191: (50%)&lt;BR/&gt; 4425: (25%)&lt;BR/&gt; 4406: (25%)&gt;];
}
4632--5400[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="160.131.245.179" dst_port="27191" src_ip="213.80.128.203" src_port="4425"/>
      <filter dst_ip="160.131.245.179" dst_port="27191" src_ip="213.80.128.203" src_port="4406"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="62.219.108.206"/>
    </slice>
    <from sec="1230786483" usec="0"/>
    <to sec="1230786510" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,020,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_624{
style=filled;
color=gray75;
4668[label="182.8.195.209;37pkt 37fpkt", shape=pentagon, color=darkviolet];
5416[label="182.8.195.209;37pkt 37fpkt", shape=invtriangle, color=brown];
stat624[shape=component, label=&lt;Rules:&lt;BR/&gt;{182.8.195.209:0, *:0}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 0: (100%)&gt;];
}
4668--5416[label="1;37pkt 37fpkt"];
</description>
    <slice>
      <filter src_ip="182.8.195.209"/>
    </slice>
    <from sec="1230786647" usec="0"/>
    <to sec="1230786781" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_626{
style=filled;
color=gray75;
4702[label="80.188.2.216;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5434[label="80.188.2.216;2pkt 2fpkt", shape=invtriangle, color=brown];
stat626[shape=component, label=&lt;Rules:&lt;BR/&gt;{80.188.2.216:3200, 164.114.4.16:80}[50%]&lt;BR/&gt;{80.188.2.216:3201, 164.114.4.16:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 3201: (25%)&lt;BR/&gt; 3200: (25%)&gt;];
}
4702--5434[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="164.114.4.16" dst_port="80" src_ip="80.188.2.216" src_port="3201"/>
      <filter dst_ip="164.114.4.16" dst_port="80" src_ip="80.188.2.216" src_port="3200"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.919689,1.51124,999,0 0 0 1 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_627{
style=filled;
color=gray75;
779[label="152.74.88.70;d;2433pkt 2433fpkt", shape=diamond, color=yellow];
3911[label="9.22.134.79;253pkt 253fpkt", shape=pentagon, color=darkviolet];
4535[label="209.26.171.185;171pkt 171fpkt", shape=pentagon, color=darkviolet];
4587[label="11.179.200.194;171pkt 171fpkt", shape=pentagon, color=darkviolet];
4707[label="210.20.131.216;212pkt 212fpkt", shape=pentagon, color=darkviolet];
5435[label="210.20.131.216;212pkt 212fpkt", shape=invtriangle, color=brown];
5721[label="210.20.131.216;212pkt 212fpkt", shape=invhouse, color=bisque];
stat627[shape=component, label=&lt;Rules:&lt;BR/&gt;{*:*, 152.74.88.70:53632}[99.96%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 53632: (49.9864%)&lt;BR/&gt; 4462: (0.10917%)&lt;BR/&gt; 2443: (0.10917%)&lt;BR/&gt; 1338: (0.10917%)&lt;BR/&gt; 3688: (0.095524%)&gt;];
}
779--807[label="0.000411015;1pkt 1fpkt"];
779--3911[label="0.920949;233pkt 233fpkt"];
779--4535[label="0.918129;157pkt 157fpkt"];
779--4587[label="0.900585;154pkt 154fpkt"];
779--4707[label="0.924528;196pkt 196fpkt"];
779--5435[label="0.924528;196pkt 196fpkt"];
779--5721[label="0.924528;196pkt 196fpkt"];
4707--5435[label="1;212pkt 212fpkt"];
4707--5721[label="1;212pkt 212fpkt"];
5435--5721[label="1;212pkt 212fpkt"];
</description>
    <slice>
      <filter dst_ip="152.74.88.70" dst_port="53632"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_628{
style=filled;
color=gray75;
4712[label="198.20.146.217;21pkt 21fpkt", shape=pentagon, color=darkviolet];
5438[label="198.20.146.217;21pkt 21fpkt", shape=invtriangle, color=brown];
stat628[shape=component, label=&lt;Rules:&lt;BR/&gt;{198.20.146.217:80, 154.101.44.216:*}[38.0952%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 60734: (2.38095%)&lt;BR/&gt; 57086: (2.38095%)&lt;BR/&gt; 53654: (2.38095%)&lt;BR/&gt; 53583: (2.38095%)&gt;];
}
4712--5438[label="1;21pkt 21fpkt"];
</description>
    <slice>
      <filter dst_ip="154.101.44.216" src_ip="198.20.146.217" src_port="80"/>
    </slice>
    <from sec="1230786174" usec="0"/>
    <to sec="1230786877" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="2.203.48.219"/>
    </slice>
    <from sec="1230786322" usec="0"/>
    <to sec="1230786337" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,901,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_630{
style=filled;
color=gray75;
4742[label="187.77.83.223;1pkt 1fpkt", shape=pentagon, color=darkviolet];
5447[label="187.77.83.223;1pkt 1fpkt", shape=invtriangle, color=brown];
stat630[shape=component, label=&lt;Rules:&lt;BR/&gt;{187.77.83.223:21795, 85.79.90.31:50319}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 50319: (50%)&lt;BR/&gt; 21795: (50%)&gt;];
}
4742--5447[label="1;1pkt 1fpkt"];
</description>
    <slice>
      <filter dst_ip="85.79.90.31" dst_port="50319" src_ip="187.77.83.223" src_port="21795"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,999,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_631{
style=filled;
color=gray75;
4750[label="49.4.136.224;5pkt 5fpkt", shape=pentagon, color=darkviolet];
5450[label="49.4.136.224;5pkt 5fpkt", shape=invtriangle, color=brown];
stat631[shape=component, label=&lt;Rules:&lt;BR/&gt;{49.4.136.224:5050, 156.36.104.14:3499}[20%]&lt;BR/&gt;{49.4.136.224:5050, 156.36.48.23:1159}[20%]&lt;BR/&gt;{49.4.136.224:5050, 154.101.16.37:53713}[20%]&lt;BR/&gt;{49.4.136.224:5050, 156.36.57.106:1126}[20%]&lt;BR/&gt;{49.4.136.224:5050, 156.36.90.196:1038}[20%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 5050: (50%)&lt;BR/&gt; 53713: (10%)&lt;BR/&gt; 3499: (10%)&lt;BR/&gt; 1159: (10%)&lt;BR/&gt; 1126: (10%)&gt;];
}
4750--5450[label="1;5pkt 5fpkt"];
</description>
    <slice>
      <filter dst_ip="156.36.90.196" dst_port="1038" src_ip="49.4.136.224" src_port="5050"/>
      <filter dst_ip="156.36.57.106" dst_port="1126" src_ip="49.4.136.224" src_port="5050"/>
      <filter dst_ip="154.101.16.37" dst_port="53713" src_ip="49.4.136.224" src_port="5050"/>
      <filter dst_ip="156.36.48.23" dst_port="1159" src_ip="49.4.136.224" src_port="5050"/>
      <filter dst_ip="156.36.104.14" dst_port="3499" src_ip="49.4.136.224" src_port="5050"/>
    </slice>
    <from sec="1230786008" usec="0"/>
    <to sec="1230786894" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="9.169.2.226"/>
    </slice>
    <from sec="1230786583" usec="0"/>
    <to sec="1230786637" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_633{
style=filled;
color=gray75;
4771[label="154.101.123.227;2pkt 2fpkt", shape=pentagon, color=darkviolet];
5462[label="154.101.123.227;2pkt 2fpkt", shape=invtriangle, color=brown];
stat633[shape=component, label=&lt;Rules:&lt;BR/&gt;{154.101.123.227:2136, 35.180.39.201:80}[50%]&lt;BR/&gt;{154.101.123.227:2137, 35.180.39.201:80}[50%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 2137: (25%)&lt;BR/&gt; 2136: (25%)&gt;];
}
4771--5462[label="1;2pkt 2fpkt"];
</description>
    <slice>
      <filter dst_ip="35.180.39.201" dst_port="80" src_ip="154.101.123.227" src_port="2137"/>
      <filter dst_ip="35.180.39.201" dst_port="80" src_ip="154.101.123.227" src_port="2136"/>
    </slice>
    <from sec="1230786455" usec="0"/>
    <to sec="1230786463" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="36.160.221.227"/>
    </slice>
    <from sec="1230786576" usec="0"/>
    <to sec="1230786585" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="38.160.50.228"/>
    </slice>
    <from sec="1230786363" usec="0"/>
    <to sec="1230786376" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.528877,1.57179,503,0 0 0 0 0 0 0 0 0 1 1 0 ">
    <description>subgraph cluster_636{
style=filled;
color=gray75;
4808[label="160.48.87.234;6pkt 6fpkt", shape=pentagon, color=darkviolet];
5474[label="160.48.87.234;6pkt 6fpkt", shape=invtriangle, color=brown];
stat636[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.48.87.234:80, 49.100.30.98:*}[33.3333%]&lt;BR/&gt;{160.48.87.234:80, 58.162.0.126:*}[33.3333%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 51872: (8.33333%)&lt;BR/&gt; 50443: (8.33333%)&lt;BR/&gt; 45339: (8.33333%)&lt;BR/&gt; 45276: (8.33333%)&gt;];
}
4808--5474[label="1;6pkt 6fpkt"];
</description>
    <slice>
      <filter dst_ip="58.162.0.126" src_ip="160.48.87.234" src_port="80"/>
      <filter dst_ip="49.100.30.98" src_ip="160.48.87.234" src_port="80"/>
    </slice>
    <from sec="1230786210" usec="0"/>
    <to sec="1230786872" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,503,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_637{
style=filled;
color=gray75;
4810[label="160.38.192.234;37pkt 37fpkt", shape=pentagon, color=darkviolet];
5475[label="160.38.192.234;37pkt 37fpkt", shape=invtriangle, color=brown];
5733[label="160.38.192.234;37pkt 37fpkt", shape=invhouse, color=bisque];
stat637[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.38.192.234:80, 49.100.24.201:*}[100%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 65137: (1.35135%)&lt;BR/&gt; 64800: (1.35135%)&lt;BR/&gt; 64181: (1.35135%)&lt;BR/&gt; 62616: (1.35135%)&gt;];
}
4810--5475[label="1;37pkt 37fpkt"];
4810--5733[label="1;37pkt 37fpkt"];
5475--5733[label="1;37pkt 37fpkt"];
</description>
    <slice>
      <filter dst_ip="49.100.24.201" src_ip="160.38.192.234" src_port="80"/>
    </slice>
    <from sec="1230786027" usec="0"/>
    <to sec="1230786893" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.641842,1.59367,999,0 0 0 1 0 0 0 0 0 0 0 0 ">
    <description>subgraph cluster_638{
style=filled;
color=gray75;
1922[label="160.38.111.72;s;42pkt 42fpkt", shape=diamond, color=yellow];
1923[label="84.8.34.233;d;1pkt 1fpkt", shape=diamond, color=yellow];
stat638[shape=component, label=&lt;Rules:&lt;BR/&gt;{160.38.111.72:6886, *:*}[85.7143%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 6886: (41.8605%)&lt;BR/&gt; 80: (4.65116%)&lt;BR/&gt; 63094: (2.32558%)&lt;BR/&gt; 36905: (2.32558%)&lt;BR/&gt; 65534: (1.16279%)&gt;];
}
1922--1923[label="1;1pkt 1fpkt"];
1922--3246[label="0.0714286;3pkt 3fpkt"];
1922--3265[label="0.0238095;1pkt 1fpkt"];
1922--3291[label="0.0714286;3pkt 3fpkt"];
1922--3310[label="0.0238095;1pkt 1fpkt"];
1922--3327[label="0.0714286;3pkt 3fpkt"];
1922--3346[label="0.0238095;1pkt 1fpkt"];
</description>
    <slice>
      <filter src_ip="160.38.111.72" src_port="6886"/>
    </slice>
    <from sec="1230786164" usec="0"/>
    <to sec="1230786826" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="194.22.135.236"/>
    </slice>
    <from sec="1230786346" usec="0"/>
    <to sec="1230786373" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.831535,1.58216,010,0 0 0 0 0 0 0 0 0 1 1 1 ">
    <description>subgraph cluster_640{
style=filled;
color=gray75;
4831[label="84.176.89.238;117pkt 117fpkt", shape=pentagon, color=darkviolet];
5485[label="84.176.89.238;117pkt 117fpkt", shape=invtriangle, color=brown];
5738[label="84.176.89.238;117pkt 117fpkt", shape=invhouse, color=bisque];
stat640[shape=component, label=&lt;Rules:&lt;BR/&gt;{84.176.89.238:*, *:445}[65.812%]&lt;BR/&gt;{84.176.89.238:*, *:139}[34.188%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 445: (32.906%)&lt;BR/&gt; 139: (17.094%)&lt;BR/&gt; 33001: (0.42735%)&lt;BR/&gt; 32988: (0.42735%)&lt;BR/&gt; 32825: (0.42735%)&gt;];
}
4831--5485[label="1;117pkt 117fpkt"];
4831--5738[label="1;117pkt 117fpkt"];
5485--5738[label="1;117pkt 117fpkt"];
</description>
    <slice>
      <filter dst_port="445" src_ip="84.176.89.238"/>
      <filter dst_port="139" src_ip="84.176.89.238"/>
    </slice>
    <from sec="1230786418" usec="0"/>
    <to sec="1230786459" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="49.65.86.246"/>
    </slice>
    <from sec="1230786198" usec="0"/>
    <to sec="1230786201" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.619578,1.63401,503,0 0 0 0 0 0 0 0 0 0 1 0 ">
    <slice>
      <filter src_ip="192.231.22.248"/>
    </slice>
    <from sec="1230786004" usec="0"/>
    <to sec="1230786008" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818123,1.67088,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="3.68.64.25"/>
    </slice>
    <from sec="1230786836" usec="0"/>
    <to sec="1230786895" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818123,1.67088,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="84.183.246.34"/>
    </slice>
    <from sec="1230786415" usec="0"/>
    <to sec="1230786543" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818123,1.67088,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="58.28.73.43"/>
    </slice>
    <from sec="1230786006" usec="0"/>
    <to sec="1230786023" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818123,1.67088,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="55.222.213.46"/>
    </slice>
    <from sec="1230786307" usec="0"/>
    <to sec="1230786327" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818123,1.67088,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="13.234.46.52"/>
    </slice>
    <from sec="1230786365" usec="0"/>
    <to sec="1230786375" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818123,1.67088,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="66.183.173.57"/>
    </slice>
    <from sec="1230786348" usec="0"/>
    <to sec="1230786376" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818123,1.67088,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="210.108.211.61"/>
    </slice>
    <from sec="1230786002" usec="0"/>
    <to sec="1230786605" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818123,1.67088,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="192.231.19.64"/>
    </slice>
    <from sec="1230786007" usec="0"/>
    <to sec="1230786898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818123,1.67088,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="198.21.5.65"/>
    </slice>
    <from sec="1230786775" usec="0"/>
    <to sec="1230786781" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818123,1.67088,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="56.249.213.80"/>
    </slice>
    <from sec="1230786720" usec="0"/>
    <to sec="1230786753" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818123,1.67088,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="62.231.147.84"/>
    </slice>
    <from sec="1230786734" usec="0"/>
    <to sec="1230786766" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818123,1.67088,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="129.165.155.103"/>
    </slice>
    <from sec="1230786379" usec="0"/>
    <to sec="1230786388" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818123,1.67088,999,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="205.98.196.104"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818123,1.67088,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="3.68.9.114"/>
    </slice>
    <from sec="1230786773" usec="0"/>
    <to sec="1230786819" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818123,1.67088,020,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="215.196.64.135"/>
    </slice>
    <from sec="1230786004" usec="0"/>
    <to sec="1230786898" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818123,1.67088,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="195.110.123.150"/>
    </slice>
    <from sec="1230786001" usec="0"/>
    <to sec="1230786148" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818123,1.67088,901,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="37.34.20.155"/>
    </slice>
    <from sec="1230786900" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818123,1.67088,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="216.215.39.167"/>
    </slice>
    <from sec="1230786415" usec="0"/>
    <to sec="1230786461" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818123,1.67088,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="80.164.0.195"/>
    </slice>
    <from sec="1230786604" usec="0"/>
    <to sec="1230786803" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818123,1.67088,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="61.235.234.195"/>
    </slice>
    <from sec="1230786800" usec="0"/>
    <to sec="1230786830" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818123,1.67088,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="4.171.133.197"/>
    </slice>
    <from sec="1230786020" usec="0"/>
    <to sec="1230786168" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818123,1.67088,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="58.98.93.203"/>
    </slice>
    <from sec="1230786844" usec="0"/>
    <to sec="1230786874" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.75177,1.61008,503,0 0 0 0 0 0 0 0 0 1 0 1 ">
    <description>subgraph cluster_668{
style=filled;
color=gray75;
4737[label="154.101.114.222;50pkt 50fpkt", shape=pentagon, color=darkviolet];
5725[label="154.101.114.222;49pkt 49fpkt", shape=invhouse, color=bisque];
stat668[shape=component, label=&lt;Rules:&lt;BR/&gt;{154.101.114.222:80, 49.100.30.229:*}[54%]&lt;BR/&gt;&lt;BR/&gt; Major Ports:&lt;BR/&gt; 80: (50%)&lt;BR/&gt; 63329: (1.0101%)&lt;BR/&gt; 62170: (1.0101%)&lt;BR/&gt; 61792: (1.0101%)&lt;BR/&gt; 61022: (1.0101%)&gt;];
}
4737--5725[label="1;49pkt 49fpkt"];
</description>
    <slice>
      <filter dst_ip="49.100.30.229" src_ip="154.101.114.222" src_port="80"/>
    </slice>
    <from sec="1230786002" usec="0"/>
    <to sec="1230786901" usec="0"/>
  </anomaly>

  <anomaly type="notice" value="0.818123,1.67088,503,0 0 0 0 0 0 0 0 0 0 0 1 ">
    <slice>
      <filter src_ip="194.22.135.236"/>
    </slice>
    <from sec="1230786346" usec="0"/>
    <to sec="1230786373" usec="0"/>
  </anomaly>

</admd:annotation>
