<admd:annotation xmlns:admd="http://www.nict.go.jp/admd" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://www.nict.go.jp/admd admd.xsd">
    <algorithm version="Graph-based combination of traffic classifier using SCANN" name="0.0.1">
        <description>Based on R.Fontugne et al. COST-TMA 2010</description>
        <url>http://www.fukuda-lab.org/~romain</url>
    </algorithm>
    <analysis>
        <description>MAWILab</description>
    </analysis>
    <dataset>
        <description>MAWI</description>
        <url>http://tracer.csl.sony.co.jp/mawi/</url>
    </dataset>
    <anomaly type="anomalous" value="1.408100,1.299400,503,1 1 1 0 0 0 0 0 0 1 1 0,salphfl">
        <slice>
            <filter src_ip="84.148.42.237" dst_ip="149.34.212.145" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.283680,1.742280,503,1 1 1 1 1 1 1 0 0 1 1 1,heavy_hitter">
        <slice>
            <filter src_ip="206.30.238.144" dst_ip="215.37.127.61" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.737330,1.528320,503,1 1 1 1 0 0 0 0 0 0 1 1,mptmp">
        <slice>
            <filter dst_ip="149.34.212.198" dst_port="80"/>
            <filter dst_ip="214.138.176.172" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.695920,1.349180,503,1 0 0 1 1 1 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="164.89.55.232" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.117970,1.072670,999,1 0 0 1 1 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="214.138.179.238" src_port="21896"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.283680,1.742280,503,1 1 1 1 1 1 1 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="215.37.127.61" dst_ip="206.30.238.144" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.504870,1.274220,999,1 0 0 1 1 1 0 0 0 1 0 0,ptmpla">
        <slice>
            <filter src_ip="133.208.154.172" src_port="19101"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.835050,1.471050,010,1 1 1 1 1 1 1 0 0 1 0 0,ntscSYNt">
        <slice>
            <filter src_ip="215.38.76.48" dst_port="135"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.227920,1.105040,999,1 0 0 1 1 0 1 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="149.173.188.128" dst_port="6881"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.008690,1.577300,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="133.208.25.108" dst_ip="60.16.8.21" src_port="80"/>
            <filter src_ip="133.208.25.108" dst_ip="205.159.250.172" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.394060,1.272220,999,0 0 0 1 1 1 0 0 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="193.156.126.7" dst_ip="164.89.165.44" src_port="5004" dst_port="4280"/>
            <filter src_ip="193.156.126.7" dst_ip="164.89.165.44" src_port="5004" dst_port="4278"/>
            <filter src_ip="193.156.126.7" dst_ip="164.89.165.44" src_port="554" dst_port="4272"/>
            <filter src_ip="93.40.236.84" dst_ip="164.89.165.44" src_port="30990" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1167627600"/>
        <to usec="0" sec="1167628158"/>
    </anomaly>
    <anomaly type="anomalous" value="2.008690,1.577300,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="81.46.148.180" src_port="80"/>
            <filter dst_ip="164.89.161.111" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.049490,1.600780,503,1 1 1 1 1 0 1 0 0 1 1 1,mptpHTTP">
        <slice>
            <filter dst_ip="164.89.55.232" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.428880,1.187610,999,0 0 0 1 1 0 1 0 0 1 1 0,mptp">
        <slice>
            <filter dst_ip="214.138.179.238" dst_port="21896"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.672890,1.346460,503,0 0 0 1 1 1 0 0 0 1 1 0,ptmpHTTP">
        <slice>
            <filter src_ip="149.34.212.145" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.394060,1.272220,503,0 0 0 1 1 1 0 0 0 0 0 0,ptmpHTTP">
        <slice>
            <filter src_ip="149.53.50.221" dst_port="80"/>
            <filter src_ip="149.53.50.221" dst_port="53"/>
        </slice>
        <from usec="0" sec="1167627614"/>
        <to usec="0" sec="1167628247"/>
    </anomaly>
    <anomaly type="anomalous" value="1.394060,1.272220,503,0 0 0 1 1 1 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="161.207.168.99" dst_ip="204.92.91.80" src_port="80" dst_port="26821"/>
        </slice>
        <from usec="0" sec="1167627601"/>
        <to usec="0" sec="1167628338"/>
    </anomaly>
    <anomaly type="anomalous" value="1.394060,1.272220,503,0 0 0 1 1 1 0 0 0 0 0 0,mptpHTTP">
        <slice>
            <filter dst_ip="195.170.238.6" dst_port="80"/>
        </slice>
        <from usec="0" sec="1167627610"/>
        <to usec="0" sec="1167628428"/>
    </anomaly>
    <anomaly type="anomalous" value="2.250220,2.100260,020,0 0 0 1 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="70.129.245.80"/>
        </slice>
        <from usec="0" sec="1167627600"/>
        <to usec="0" sec="1167627885"/>
    </anomaly>
    <anomaly type="anomalous" value="1.374920,1.323550,999,1 0 0 0 0 0 1 1 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="164.89.55.147" dst_port="3128"/>
            <filter dst_ip="164.89.55.147" dst_port="3124"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.578480,1.491260,010,1 1 1 0 0 0 1 1 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="64.210.184.222" dst_port="139"/>
        </slice>
        <from usec="0" sec="1167627690"/>
        <to usec="0" sec="1167627736"/>
    </anomaly>
    <anomaly type="anomalous" value="1.514140,1.369430,999,0 0 0 1 1 0 1 1 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="214.130.122.11" dst_port="23959"/>
        </slice>
        <from usec="0" sec="1167627600"/>
        <to usec="0" sec="1167628184"/>
    </anomaly>
    <anomaly type="anomalous" value="1.818630,1.532440,999,0 0 0 1 1 1 1 1 0 0 0 0,ptmp">
        <slice>
            <filter src_ip="214.130.122.11" src_port="23959"/>
        </slice>
        <from usec="0" sec="1167627600"/>
        <to usec="0" sec="1167628428"/>
    </anomaly>
    <anomaly type="anomalous" value="1.166690,1.118900,999,0 0 0 1 0 0 1 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="164.89.55.147" src_port="3128"/>
            <filter src_ip="164.89.55.147" src_port="3124"/>
            <filter src_ip="164.89.55.155" src_port="3128"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.254990,1.737800,999,1 1 1 1 1 1 1 1 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="214.2.100.162" dst_port="53"/>
            <filter dst_ip="214.2.100.173" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.240660,2.107350,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="194.71.186.28"/>
        </slice>
        <from usec="0" sec="1167627600"/>
        <to usec="0" sec="1167627646"/>
    </anomaly>
    <anomaly type="anomalous" value="2.240660,2.107350,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="60.98.21.167"/>
        </slice>
        <from usec="0" sec="1167627600"/>
        <to usec="0" sec="1167627646"/>
    </anomaly>
    <anomaly type="anomalous" value="2.240660,2.107350,020,0 0 0 0 0 0 1 1 1 0 0 0,ntscICec">
        <slice>
            <filter src_ip="61.79.148.18"/>
        </slice>
        <from usec="0" sec="1167627600"/>
        <to usec="0" sec="1167627646"/>
    </anomaly>
    <anomaly type="anomalous" value="1.760010,1.422030,999,1 0 0 1 1 0 0 0 0 1 1 1,mptp">
        <slice>
            <filter src_ip="194.6.221.95" dst_ip="215.37.121.18"/>
            <filter src_ip="194.6.221.95" dst_port="21"/>
            <filter dst_ip="215.37.121.18" dst_port="21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.446970,2.137140,999,0 0 0 1 1 0 1 1 1 1 0 0,mptp">
        <slice>
            <filter dst_ip="214.2.102.132" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.540840,1.376060,999,1 0 0 0 0 0 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="130.164.227.15" dst_port="1026"/>
            <filter dst_ip="164.89.165.14" src_port="80"/>
            <filter dst_ip="164.89.165.14" dst_port="27446"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.008690,1.577300,503,0 0 0 1 1 1 0 0 0 1 1 1,mptmp">
        <slice>
            <filter src_ip="149.34.212.199" src_port="80"/>
            <filter src_ip="149.34.212.198" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.515450,1.373390,503,0 0 0 0 0 0 0 0 0 1 1 1,mptplaHTTP">
        <slice>
            <filter src_ip="208.46.46.174" dst_ip="214.138.16.203" src_port="80"/>
            <filter src_ip="39.231.17.174" dst_ip="214.138.16.203" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.027910,1.579620,501,1 0 0 1 1 1 0 0 0 1 1 1,ptmp">
        <slice>
            <filter src_ip="215.37.121.18" src_port="21"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.194960,1.172460,503,1 1 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter dst_ip="81.46.148.180" dst_port="80"/>
            <filter src_ip="164.89.161.111" dst_ip="86.239.164.38" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="2.008690,1.577300,503,0 0 0 1 1 1 0 0 0 1 1 1,ptmplaHTTP">
        <slice>
            <filter src_ip="164.89.144.143" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.515450,1.373390,503,0 0 0 0 0 0 0 0 0 1 1 1,alphflHTTP">
        <slice>
            <filter src_ip="215.37.124.41" dst_ip="84.148.42.103" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="anomalous" value="1.515450,1.373390,503,0 0 0 0 0 0 0 0 0 1 1 1,ptmpHTTP">
        <slice>
            <filter src_ip="164.89.2.135" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.701236,0.992376,503,0 0 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter dst_ip="149.34.212.198" dst_port="80"/>
            <filter dst_ip="214.138.176.172" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.903567,1.085360,002,1 1 0 0 0 0 0 0 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="65.226.36.248" src_port="1029" dst_port="137"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.061900,1.222300,503,1 1 1 0 0 0 0 0 0 0 0 0,alphflHTTP">
        <slice>
            <filter src_ip="84.148.33.196" dst_ip="145.65.211.132" src_port="38767" dst_port="80"/>
        </slice>
        <from usec="0" sec="1167628060"/>
        <to usec="0" sec="1167628083"/>
    </anomaly>
    <anomaly type="suspicious" value="1.138530,1.144060,999,1 1 0 1 1 0 0 0 0 0 0 0,ipv4gretun">
        <slice>
            <filter src_ip="83.177.203.238" dst_ip="214.130.120.245"/>
            <filter src_ip="83.177.203.238"/>
            <filter src_ip="83.177.203.238"/>
            <filter src_ip="83.177.203.238" dst_port="80"/>
            <filter dst_ip="214.130.120.245" dst_port="80"/>
            <filter dst_ip="214.130.120.245"/>
        </slice>
        <from usec="0" sec="1167627600"/>
        <to usec="0" sec="1167628375"/>
    </anomaly>
    <anomaly type="suspicious" value="1.061900,1.222300,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="85.136.2.99" dst_port="445"/>
            <filter src_ip="85.136.2.99" dst_port="139"/>
        </slice>
        <from usec="0" sec="1167628414"/>
        <to usec="0" sec="1167628460"/>
    </anomaly>
    <anomaly type="suspicious" value="0.756839,1.086390,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="213.217.119.137" src_port="1029" dst_port="137"/>
        </slice>
        <from usec="0" sec="1167627818"/>
        <to usec="0" sec="1167627834"/>
    </anomaly>
    <anomaly type="suspicious" value="1.061900,1.222300,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="194.83.72.168" dst_port="139"/>
        </slice>
        <from usec="0" sec="1167628061"/>
        <to usec="0" sec="1167628085"/>
    </anomaly>
    <anomaly type="suspicious" value="0.756839,1.086390,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="214.78.136.191" dst_port="135"/>
        </slice>
        <from usec="0" sec="1167627644"/>
        <to usec="0" sec="1167627770"/>
    </anomaly>
    <anomaly type="suspicious" value="0.756839,1.086390,002,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="59.104.211.27" dst_port="137"/>
        </slice>
        <from usec="0" sec="1167627856"/>
        <to usec="0" sec="1167627872"/>
    </anomaly>
    <anomaly type="suspicious" value="1.061900,1.222300,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="219.68.61.220" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1167627689"/>
        <to usec="0" sec="1167627691"/>
    </anomaly>
    <anomaly type="suspicious" value="0.756839,1.086390,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="24.6.229.7" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1167628365"/>
        <to usec="0" sec="1167628369"/>
    </anomaly>
    <anomaly type="suspicious" value="0.756839,1.086390,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="211.225.35.52" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1167628167"/>
        <to usec="0" sec="1167628173"/>
    </anomaly>
    <anomaly type="suspicious" value="1.061900,1.222300,002,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="58.101.90.253" dst_port="137"/>
        </slice>
        <from usec="0" sec="1167627750"/>
        <to usec="0" sec="1167627763"/>
    </anomaly>
    <anomaly type="suspicious" value="1.061900,1.222300,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="215.148.115.212" dst_port="445"/>
        </slice>
        <from usec="0" sec="1167628146"/>
        <to usec="0" sec="1167628196"/>
    </anomaly>
    <anomaly type="suspicious" value="0.756839,1.086390,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="59.91.162.103" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1167627690"/>
        <to usec="0" sec="1167627694"/>
    </anomaly>
    <anomaly type="suspicious" value="0.756839,1.086390,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="213.81.161.59" dst_port="445"/>
        </slice>
        <from usec="0" sec="1167627754"/>
        <to usec="0" sec="1167627767"/>
    </anomaly>
    <anomaly type="suspicious" value="1.061900,1.222300,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="24.68.21.68" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1167627992"/>
        <to usec="0" sec="1167627997"/>
    </anomaly>
    <anomaly type="suspicious" value="0.756839,1.086390,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="223.158.204.221" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1167627897"/>
        <to usec="0" sec="1167627898"/>
    </anomaly>
    <anomaly type="suspicious" value="0.756839,1.086390,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="65.8.17.53" dst_port="135"/>
        </slice>
        <from usec="0" sec="1167628032"/>
        <to usec="0" sec="1167628130"/>
    </anomaly>
    <anomaly type="suspicious" value="0.756839,1.086390,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="156.104.146.39" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1167627690"/>
        <to usec="0" sec="1167627694"/>
    </anomaly>
    <anomaly type="suspicious" value="0.756839,1.086390,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="161.241.153.177" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1167627690"/>
        <to usec="0" sec="1167627691"/>
    </anomaly>
    <anomaly type="suspicious" value="0.756839,1.086390,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="8.71.128.35" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1167627992"/>
        <to usec="0" sec="1167627997"/>
    </anomaly>
    <anomaly type="suspicious" value="0.756839,1.086390,010,1 1 0 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="84.198.136.97" dst_port="445"/>
        </slice>
        <from usec="0" sec="1167627814"/>
        <to usec="0" sec="1167627883"/>
    </anomaly>
    <anomaly type="suspicious" value="0.756839,1.086390,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="144.133.34.120" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1167627790"/>
        <to usec="0" sec="1167627791"/>
    </anomaly>
    <anomaly type="suspicious" value="0.756839,1.086390,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="8.145.223.35" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1167627690"/>
        <to usec="0" sec="1167627691"/>
    </anomaly>
    <anomaly type="suspicious" value="0.756839,1.086390,999,1 1 0 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="21.154.35.237" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1167627609"/>
        <to usec="0" sec="1167627610"/>
    </anomaly>
    <anomaly type="suspicious" value="0.903567,1.085360,503,1 1 0 0 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="219.93.0.124" dst_port="1026"/>
            <filter dst_ip="164.89.165.151" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.061900,1.222300,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="68.204.25.24" dst_port="135"/>
        </slice>
        <from usec="0" sec="1167628068"/>
        <to usec="0" sec="1167628079"/>
    </anomaly>
    <anomaly type="suspicious" value="1.061900,1.222300,504,1 1 1 0 0 0 0 0 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="161.207.199.176" dst_ip="192.72.62.191" src_port="1606" dst_port="443"/>
        </slice>
        <from usec="0" sec="1167628165"/>
        <to usec="0" sec="1167628354"/>
    </anomaly>
    <anomaly type="suspicious" value="1.171000,1.221390,503,1 1 1 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="202.212.92.209" dst_ip="214.130.122.82" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.061900,1.222300,503,1 1 1 0 0 0 0 0 0 0 0 0,mptplaHTTP">
        <slice>
            <filter src_ip="90.16.10.38" dst_ip="164.89.144.143" src_port="59032" dst_port="80"/>
            <filter src_ip="84.148.33.87" dst_ip="164.89.144.143" src_port="50162" dst_port="80"/>
        </slice>
        <from usec="0" sec="1167628450"/>
        <to usec="0" sec="1167628463"/>
    </anomaly>
    <anomaly type="suspicious" value="0.871783,1.153540,901,0 0 1 0 0 0 0 0 0 0 0 0,empty">
        <slice>
            <filter src_ip="214.2.100.173" dst_ip="214.2.100.173" proto="udp"/>
        </slice>
        <from usec="0" sec="1167627646"/>
        <to usec="0" sec="1167628422"/>
    </anomaly>
    <anomaly type="suspicious" value="1.061900,1.222300,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="205.232.96.147" dst_port="22"/>
        </slice>
        <from usec="0" sec="1167628294"/>
        <to usec="0" sec="1167628370"/>
    </anomaly>
    <anomaly type="suspicious" value="1.061900,1.222300,002,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="75.148.184.119" src_port="1025" dst_port="137"/>
        </slice>
        <from usec="0" sec="1167627989"/>
        <to usec="0" sec="1167628001"/>
    </anomaly>
    <anomaly type="suspicious" value="1.061900,1.222300,010,1 1 1 0 0 0 0 0 0 0 0 0,ntscSYNt139445">
        <slice>
            <filter src_ip="201.5.36.240" dst_port="445"/>
            <filter src_ip="201.5.36.240" dst_port="139"/>
        </slice>
        <from usec="0" sec="1167628272"/>
        <to usec="0" sec="1167628317"/>
    </anomaly>
    <anomaly type="suspicious" value="1.061900,1.222300,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="21.24.110.169" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1167627687"/>
        <to usec="0" sec="1167627692"/>
    </anomaly>
    <anomaly type="suspicious" value="1.061900,1.222300,999,1 1 1 0 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="45.107.254.253" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1167628367"/>
        <to usec="0" sec="1167628369"/>
    </anomaly>
    <anomaly type="suspicious" value="1.081910,1.210040,999,1 1 1 1 0 0 0 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="93.40.236.84" dst_port="1026"/>
        </slice>
        <from usec="0" sec="1167627606"/>
        <to usec="0" sec="1167628428"/>
    </anomaly>
    <anomaly type="suspicious" value="0.909533,1.030840,999,1 0 0 1 0 0 1 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="215.37.113.209" src_port="3128"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711361,1.028360,999,0 0 0 1 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="145.65.246.131" src_port="53"/>
            <filter src_ip="145.65.246.131" src_port="54873" dst_port="53"/>
            <filter src_ip="149.34.212.150" src_port="32805" dst_port="53"/>
        </slice>
        <from usec="0" sec="1167627600"/>
        <to usec="0" sec="1167628276"/>
    </anomaly>
    <anomaly type="suspicious" value="1.081910,1.210040,503,1 1 1 1 0 0 0 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="214.130.122.83" dst_ip="202.212.92.209"/>
            <filter src_ip="214.130.122.83" dst_port="80"/>
            <filter src_ip="214.130.122.82" dst_port="80"/>
            <filter dst_ip="202.212.92.209" dst_port="80"/>
        </slice>
        <from usec="0" sec="1167627614"/>
        <to usec="0" sec="1167628391"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711361,1.028360,999,0 0 0 1 0 0 1 0 0 0 0 0,mptmp">
        <slice>
            <filter src_ip="194.4.197.103" dst_ip="164.89.55.155"/>
            <filter src_ip="194.4.197.103" dst_ip="215.37.113.209"/>
            <filter src_ip="194.4.197.103" dst_port="3127"/>
            <filter dst_ip="164.89.55.155" dst_port="3127"/>
            <filter dst_ip="215.37.113.209" dst_port="3127"/>
        </slice>
        <from usec="0" sec="1167627612"/>
        <to usec="0" sec="1167628409"/>
    </anomaly>
    <anomaly type="suspicious" value="1.046670,1.186790,002,1 0 1 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="212.216.45.107" src_port="1025" dst_port="137"/>
        </slice>
        <from usec="0" sec="1167627690"/>
        <to usec="0" sec="1167627736"/>
    </anomaly>
    <anomaly type="suspicious" value="0.735327,1.046270,010,1 0 0 0 0 0 1 0 0 0 0 0,ntscSYNt">
        <slice>
            <filter src_ip="215.38.109.50" dst_port="135"/>
        </slice>
        <from usec="0" sec="1167627870"/>
        <to usec="0" sec="1167627923"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711361,1.028360,999,0 0 0 1 0 0 1 0 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="149.34.212.150" dst_port="53"/>
            <filter dst_ip="145.65.246.131" dst_port="53"/>
            <filter dst_ip="149.34.212.150" src_port="53" dst_port="32805"/>
            <filter dst_ip="145.65.246.131" src_port="53" dst_port="54873"/>
        </slice>
        <from usec="0" sec="1167627608"/>
        <to usec="0" sec="1167628426"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840682,1.041700,999,0 0 0 0 0 0 1 0 0 1 0 0,mptp">
        <slice>
            <filter dst_ip="215.37.113.218" dst_port="3128"/>
            <filter dst_ip="215.37.113.218" dst_port="3124"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711361,1.028360,999,0 0 0 1 0 0 1 0 0 0 0 0,mptp">
        <slice>
            <filter dst_ip="215.37.113.219" dst_port="3128"/>
        </slice>
        <from usec="0" sec="1167627620"/>
        <to usec="0" sec="1167628158"/>
    </anomaly>
    <anomaly type="suspicious" value="0.711361,1.028360,999,0 0 0 1 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="216.115.42.12" src_port="53"/>
            <filter src_ip="149.34.93.44" src_port="53"/>
        </slice>
        <from usec="0" sec="1167627600"/>
        <to usec="0" sec="1167628276"/>
    </anomaly>
    <anomaly type="suspicious" value="0.735327,1.046270,999,1 0 0 0 0 0 1 0 0 0 0 0,ntscUDP">
        <slice>
            <filter src_ip="161.207.172.96" src_port="62538" dst_port="53"/>
        </slice>
        <from usec="0" sec="1167628230"/>
        <to usec="0" sec="1167628455"/>
    </anomaly>
    <anomaly type="suspicious" value="0.840682,1.041700,999,0 0 0 0 0 0 1 0 0 1 0 0,ntscUDP">
        <slice>
            <filter src_ip="149.34.93.14" dst_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.252670,1.321620,999,0 0 0 0 0 0 1 1 0 0 0 0,alphfl">
        <slice>
            <filter src_ip="161.207.176.53" dst_ip="82.203.199.131" dst_port="2703"/>
        </slice>
        <from usec="0" sec="1167627600"/>
        <to usec="0" sec="1167627646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.252670,1.321620,503,0 0 0 0 0 0 1 1 0 0 0 0,salphfl">
        <slice>
            <filter src_ip="201.31.210.231" dst_ip="145.65.117.64" dst_port="80"/>
        </slice>
        <from usec="0" sec="1167627600"/>
        <to usec="0" sec="1167627646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.252670,1.321620,999,0 0 0 0 0 0 1 1 0 0 0 0,mptpla">
        <slice>
            <filter src_ip="164.89.55.155" dst_ip="205.156.30.8" src_port="38203"/>
            <filter src_ip="164.89.55.147" dst_ip="205.156.30.8" src_port="55327"/>
        </slice>
        <from usec="0" sec="1167627600"/>
        <to usec="0" sec="1167627646"/>
    </anomaly>
    <anomaly type="suspicious" value="1.252670,1.321620,002,0 0 0 0 0 0 1 1 0 0 0 0,ntscICec">
        <slice>
            <filter src_ip="60.98.21.167" dst_ip="215.37.119.100" dst_port="139"/>
            <filter src_ip="60.98.21.167"/>
        </slice>
        <from usec="0" sec="1167628095"/>
        <to usec="0" sec="1167628141"/>
    </anomaly>
    <anomaly type="suspicious" value="0.725537,1.010920,999,1 0 0 0 0 0 0 0 0 1 0 0,ptmp">
        <slice>
            <filter src_ip="149.173.188.128" src_port="6881"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.701236,0.992376,503,0 0 0 1 0 0 0 0 0 1 0 0,mptmp">
        <slice>
            <filter src_ip="149.34.212.198" src_port="80"/>
            <filter dst_ip="58.66.88.168" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.252670,1.321620,999,0 0 0 0 0 0 1 1 0 0 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="216.115.42.8" dst_port="53"/>
        </slice>
        <from usec="0" sec="1167627600"/>
        <to usec="0" sec="1167627961"/>
    </anomaly>
    <anomaly type="suspicious" value="1.171000,1.221390,503,1 1 1 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="84.148.42.82" dst_ip="149.131.223.201" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.029720,1.100580,503,0 0 0 0 0 0 0 0 0 1 1 0,mptmp">
        <slice>
            <filter src_ip="39.231.23.138" dst_ip="145.65.27.16" src_port="80"/>
            <filter src_ip="39.231.23.138" dst_ip="145.65.9.1" src_port="80"/>
            <filter src_ip="193.212.138.150" dst_ip="145.65.27.16" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.725537,1.010920,999,1 0 0 0 0 0 0 0 0 1 0 0,ntscUDPUDPrp">
        <slice>
            <filter dst_ip="149.34.93.14" src_port="53"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.865830,1.027280,999,0 0 0 1 0 0 1 0 0 1 0 0,heavy_hitter">
        <slice>
            <filter src_ip="194.4.197.103" dst_ip="164.89.55.155" dst_port="3127"/>
            <filter src_ip="194.4.197.103" dst_ip="164.89.55.155" dst_port="3124"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.725537,1.010920,503,1 0 0 0 0 0 0 0 0 1 0 0,point_to_point">
        <slice>
            <filter src_ip="194.179.155.52" dst_ip="164.89.185.154" src_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.066730,1.103900,503,1 0 0 0 0 0 0 0 0 1 1 0,ptmplaHTTP">
        <slice>
            <filter src_ip="133.208.46.15" dst_ip="214.50.21.209" dst_port="80"/>
            <filter src_ip="133.208.46.15" dst_ip="214.50.22.96" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="0.725537,1.010920,503,1 0 0 0 0 0 0 0 0 1 0 0,alphflHTTP">
        <slice>
            <filter src_ip="145.65.6.10" dst_ip="87.197.226.146" src_port="46283" dst_port="80"/>
            <filter src_ip="145.65.6.10" dst_ip="87.197.226.146" src_port="46238" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.050350,1.086940,503,0 0 0 1 0 0 0 0 0 1 1 0,mptpHTTP">
        <slice>
            <filter dst_ip="164.89.2.135" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.029720,1.100580,011,0 0 0 0 0 0 0 0 0 1 1 0,ntscTCPRSTACKrp">
        <slice>
            <filter dst_ip="215.38.76.48" src_port="135"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.029720,1.100580,503,0 0 0 0 0 0 0 0 0 1 1 0,mptplaHTTP">
        <slice>
            <filter src_ip="145.65.9.1" dst_ip="39.231.23.138" dst_port="80"/>
            <filter src_ip="145.65.27.16" dst_ip="39.231.23.138" dst_port="80"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
    <anomaly type="suspicious" value="1.029720,1.100580,999,0 0 0 0 0 0 0 0 0 1 1 0,alphfl">
        <slice>
            <filter src_ip="215.37.120.89" dst_ip="84.148.40.129" src_port="80" dst_port="59428"/>
            <filter src_ip="215.37.120.89" dst_ip="84.148.40.129" src_port="80" dst_port="58637"/>
            <filter src_ip="215.37.120.89" dst_ip="84.148.40.129" src_port="80" dst_port="58101"/>
            <filter src_ip="215.37.120.89" dst_ip="84.148.40.129" src_port="56697" dst_port="60164"/>
            <filter src_ip="215.37.120.89" dst_ip="84.148.40.129" src_port="21" dst_port="59940"/>
        </slice>
        <from usec="0" sec="0"/>
        <to usec="0" sec="2147483645"/>
    </anomaly>
</admd:annotation>
